An interesting point came up on another thread about alleged misappropriation of a GPL project. In this case the enterprise software was used by some large companies who essentially took the code, changed the name, removed the GPL notices and used the result.
The point was – if the company did this and only used the software internally then there isn’t any distribution and that’s perfectly legal under GPL. Modifications by their own employees for internal use would also be allowed.
So At what point does it become a distribution?
Presumably if they brought in outside contractors under ‘work for hire’ their modifications would also be internal and so not a distribution.
If they hired an external software outfit to do modifications and those changes were only used internally by the company – would those changes be distributed? Does the GPL apply to the client or to the external developers?
If the company then give the result to another department, another business unit, another company? What if the other company is a wholly owned subsidiary?
ps. yes I know the answer is ask a lawyer. But all the discussion I have seen over GPL2/GPL3 distribution has been about webservices – not about internal use.
3
The essence of the GPL is that it does not limit what you can do with the software — it imposes requirements on you when you Convey or Propagate the covered work. To quote the GPLv3:
To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. [emphasis added]
So if the only use is with a private copy you are not Propagating or Conveying the work so the conditions that allow you to Convey the work are not relevant.
See this FAQ:
Does the GPL require that source code of modified versions be posted to the public?
The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.
5
Look at it this way. It won’t really matter if there are different departments, or subsidiaries. It only matters if you are going to distribute the binaries to another party and not give them the source.
If there is another department that will use the modifications, they will get the source to work on it. No big deal. You are complying with everything in the license. Anyone who can get a distribution needs the source.
Services over the network is not considered distribution.
Here is an attempt at a simple explanation of GPL:
If a GPL project produces awesomeProduct.jar, any place that awesomeProduct.jar exists, awesomeProduct_src.jar also needs to exist. If someone doesn’t have awesomeProduct.jar they don’t get awesemeProduct_src.jar
7
If that is what the company wants to do, then there is a very simple method to avoid all obligations and all legal problems: Whenever you give a copy of the software to an employee, give them the complete source code at the same time. That is one of the three ways to fulfil your obligations under the GPL.
Tell the employees that they are not allowed to hand the software to anyone else, and that they are definitely not allowed to hand the source code to anyone. If they do, then they are in trouble with their employer. If they do without handing over the source code they are in legal trouble (and not the employer, because the employer didn’t distribute the software).
5
I would look at this quote from their website
If you commercially distribute binaries not accompanied with source code, the GPL says you must provide a written offer to distribute the source code later. When users non-commercially redistribute the binaries they received from you, they must pass along a copy of this written offer. This means that people who did not get the binaries directly from you can still receive copies of the source code, along with the written offer.
You have to pass the source all the way down the chain, just look at it as your external api is the customer of the internal api. The requirement to provide source is inherited by the external api’s use of the internal api.