Where is the copyright notice and license for Debian GNU/Linux itself?


In recent times, over $120,000 has been spent on disputes trying to denounce a Debian Developer who was elected as a representative in the FSFE.

Legal panels looking at the disputes have so far refused to make any finding about who owns a copyright interest in Debian.

Precedents in the UDRP have determined that any joint author has a legitimate interest in using the Debian name as part of a domain name. The example that people have been discussing is the Scientologie.org dispute ( WIPO UDRP case D2000-0410).

Copyright is important because it gives rise to legitimate interests of the co-authors who want to register their own Debian domain names.

Co-authors of a work are equal. Notions of exclusive memberships, expulsions and demotions violate the principle of being equal.

University of California: Each joint author has the right to exercise any or all of the exclusive rights inherent in the joint work

The implication of this statement is clear: the Scientologie.org precedent for a single entity having a copyright interest can be relied upon by any equal co-author of a work. The precedent is not only applicable to cases with a single author and doesn't require all authors to be in agreement (or Debian groupthink) with each other.

In the most recent Debian UDRP vendetta, the legal panel wrote:

The Panel confirms that this finding does not imply that it has taken any view of the ownership of copyright in DEBIAN software. Indeed, it is unable to do so on the evidence before it.

Here I try to fill that gap and provide evidence about Debian GNU/Linux copyright, including my own copyright interest.

Debian Developers are asserting that:

  1. Debian GNU/Linux is a Collective Work, which has a special meaning in copyright law
  2. The aforementioned Collective Work is created not by a single author but by Joint Authors
  3. Debian GNU/Linux copyright is based on the US law and may be influenced by the laws of other countries where various Debian Developers and Debian Project Leaders have resided over the years

What a WIPO legal panel told us about Debian GNU/Linux copyright

This analysis has been conducted by long time Debian Developer Daniel Pocock.

Various people have been holding up copies of one of the UDRP vendetta verdicts. Therefore, they are clearly aware of the references to the original Scientologie.org verdict and the logic in that verdict ( WIPO UDRP case D2000-0410).

The two lines quoted above from the 2022 panel are significant and as the misfits have submitted this document in support of their demands again in 2024, with the help of legal counsel, we are surprised they have not tried to answer that question proactively. It appears that they don't care too much about documenting and protecting the exclusive economic rights of a copyright owner or the moral rights of an author.

On the distinction between the exclusive economic rights of a copyright owner, I note that none of us Debian Developers, being the co-authors of Debian, have ever been asked to assign our rights to any third-party copyright owner. The misfits have not submitted any evidence purporting to prove that such an assignment did take place. Therefore, there is no copyright owner having exclusive economic rights over the Debian software. By default, the rights rest with the authors who did the work. Despite having clearly read the panel's comments, the misfits have not submitted any evidence claiming that any such party exists with exclusive economic rights as a copyright owner of the Debian software.

Where is the real Debian license statement?

Oddly enough, Debian documents and files in a Debian system refer to the licenses of the individual packages being distributed. It was hard to find an actual example of a copyright statement or license for Debian itself as a collective work.

The Debian Project constitution of 1998, referred to above, encourages Software in the Public Interest, Inc to register a trademark. It says nothing about copyright in the existing body of work.

Here are the words from the original constitution:

Since Debian has no authority to hold money or property, any donations for the Debian Project must be made to SPI, which manages such affairs.

SPI have made the following undertakings:

1. SPI will hold money, trademarks and other tangible and intangible property and manage other affairs for purposes related to Debian.

So people can donate intangible property like copyright to SPI if they make a personal decision to do so. The constitution did not oblige us to make such donations/assignments.

This situation is well known in open source software development. Some companies ask their contributors to sign a Contributor License Agreement or an assignment granting all their rights to a central entity with exclusive copyright.

Such an assignment can't take place through a majority vote, such an assignment or transfer of rights to a single entity would require the unanimous consent of every single author who ever contributed to Debian. In the case of those authors who are deceased, we would need to obtain consent from their estates.

Continuing the search for a Debian license, on the ISO installation media, I found the file isolinux/f10.txt which contains the very brief text:

COPYRIGHTS AND WARRANTIES

Debian GNU/Linux is Copyright (C) 1993-2016 Software in the Public Interest,
and others.

The Debian GNU/Linux system is freely redistributable. After installation,
the exact distribution terms for each package are described in the
corresponding file /usr/share/doc/<packagename>/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.

It asserts that copyright is owned by Software in the Public Interest, and others. Most of us are individual private volunteers and we have never personally chosen to grant or assign our copyright interest to Software in the Public Interest. I became curious about who put this statement into the ISO image.

The history of the file is available in the source code repository. The text has been there for more than 20 years without any scrutiny.

It remains odd that there is no similar statement in the release notes or the installation guide.

The key things being asserted in that very brief license statement:

Debian originated in the United States under the leadership of a US citizen, Ian Murdock, in 1993. Therefore, the US Copyright law is relevant.

The moral rights of authors ("and others") exist in the context of both a Collective work and a work of Joint authorship.

Wikipedia has an article on this particular type of copyrighted work, Collective Works (US law).

Debian is a collective work under the above US copyright law. The work was initiated in 1993 by Ian Murdock in the United States.

In a Collective work (US), the authors (or co-authors) are selecting works from third parties and arranging them into the final product, Debian, a collective work. The decision making process that involves selecting third party works and the decision making process that involves arranging the third party works gives rise to the moral rights of authorship in the Debian collective work.

The US law on collective works states:

The “authorship” in a collective work comes from the original selection, coordination, and arrangement of the independent works included in the collective work.

In the Debian world, the independent works are referred to as "upstream" source code. The authors of independent works are referred to as "upstream authors" or just "upstream".

The Debian maintainer guide describes the process of jointly selecting the independent works for inclusion in Debian. In particular, co-authors are required to create a public "Intent To Package" (ITP) report in the bug tracking system (BTS) so that other co-authors can discuss the merits of the selection decision. The requirement to engage in a shared discussion for every selection decision gives rise to joint authorship rights.

Moreover, the person who creates the package importing the independent work into Debian is required to create a manifest describing the inclusion of the independent upstream work. This manifest is the debian/control file. The Debian Policy Manual provides a list of fields in the debian/control files.

Some of these fields are dedicated to the coordination and the arrangement of the independent works within a Debian system.

Coordination of the independent contributions: the package dependency fields describe the relationships between packages that have to be installed together or which conflict with each other. In many cases, when a library package is a dependency for other packages, we have to ensure that the version of the library package in Debian is compatible with the dependent packages. We have a formal process of coordination in this case, the Transition process. Populating the dependency fields in the debian/control file and participating in a Transition process, either as the producer or the consumer of a dependency, are examples of coordination of the independent works from upstream authors.

Here are some examples where I personally engaged in these actions:

Created an ITP bug report and discussed the inclusion/selection of a package, also discussed the selection of the source through the mailing list

created a control file for the SimpleID package

SimpleID transition

The fields Section and Priority impact the arrangement of the contributions from the perspective of the user. The person completing the values in these fields is engaged in the process of arrangement of the contributions in a collective work.

Creating a Collective Work is a process of decision making. In the Debian world, we have a joint process of decision making. In particular, every author can make individual decisions over any package in the collection at any time. From the Developers Reference, a package can be signed by any key in the Debian Developers keyring. The documentation about the NMU process explicitly describes the process by which any Debian Developer is authorized to modify the package contributed by any other Debian Developer.

Here is an example where I used the NMU process to update the nfs-utils package

From time to time, the Debian co-authors undertake a vote to make a decision. Some of these votes concern social phenomena, such as the vote to accept the Diversity Statement, which says everybody is welcome in Debian. Some of the votes directly determine the arrangement of independent works in Debian. One of the most notable examples was the General Resolution on Init system coupling. Another example was the General Resolution on Handling source-less firmware in the Linux kernel. By participating in these votes, all co-authors exert some influence over which independent works are included in Debian and how those independent works are arranged.

Therefore, the development of Debian includes features of both a collective work and a work of joint authorship at the same time. Moreover, due to processes such as library transitions, NMU and our system of voting on certain decisions, any co-author may influence the way that other co-authors are integrating the independent upstream works into Debian. This cross-pollination of ideas and effort is a well known feature of Debian. In other Linux distributions, the developers are a little bit more siloed from each other.

Every two years, an official stable release of the Debian software is released to the public. This process of releasing involves declaring a version number that corresponds to a particular subset of the contributions that are in a working state at the time of the release. Even if a Debian Developer's contributions are obstructed from inclusion in future releases, or if a Debian Developer commits suicide, their work is still present in all the past releases that have been published.

My own contributions are included in a number of these Debian releases over the years.

This report finds my name in changelogs and copyright files. There are 21 pages of results.

Shooting themselves in the foot

To declare that the Debian Developers do not have authorship rights at all would be incredibly de-motivating.

Future volunteers may be deterred from contributing their intellectual property and their time.

Bad faith: the complainant is gaslighting about authorship and membership

The complainant appears to pivot back and forth between concepts from copyright law and from the law of associations.

Consider the case when somebody begins contributing to Debian. There is no such thing as a "New member" process. Rather, it has historically been called the "New maintainer" process. We can see that clearly in the name of the debian-newmaint mailing list.

The word "maintainer" primarily implies somebody is doing creative work to select, coordinate and arrange more independent works into Debian.

Then we have the guide for the New Member process, which was previously known as the New Maintainer process. In step 3, explained in that page, the new contributors are asked to agree to the Debian Social Contract, the Debian Free Software Guidelines and the Debian Machine Usage Policy. The former is ultimately about our relation as authors, not as members and the terms under which we license our work to the rest of the world.

The new maintainer/member guide doesn't ask people to ratify their adherence to the constitution. The notion of joining an association, whether it is incorporated or not, is inseparable from consenting to be governed by and uphold the association's constitution. The only people who ever ratified the constitution were 86 co-authors in 1998 (23% of the developers at that time) who wanted to have a constitution.

Somebody who did not ask to be a member can't be expelled.

Somebody who is not an employee can't be demoted or sacked.

Yet we have seen some of the leadership figures insist on having these powers over a series of victims. The title Debian Project Leader implies just that: to lead, not to give orders.

The insinuation that concepts of expulsions and demotions can be applied to co-authors is an example of gaslighting.

Copyright law is very clear: co-authors of a work are equal. Notions of expulsions and demotions violate the principle of being equal.

University of California: Each joint author has the right to exercise any or all of the exclusive rights inherent in the joint work

The fact that they are knowingly and deliberately trying to obfuscate our moral rights as co-authors, giving us nothing in exchange for the status they are taking away, is an aggravating factor that justifies the finding of harassment and bad faith against the complainant.

Bad faith: use of an administrative process to extinguish the moral rights and recognition of co authors

A recent paper in the University of Western Australia law journal examines the subject of Copyright Nazi Plunder: How the Nazis Aryanized Jewish Works.

The paper notes that the Nazis used administrative law to frustrate the rights of authors, just as misfits are using a WIPO administrative process to harass and intimidate a Debian co-author. Quoting the journal article:

Despite the fact that written IP legislation in Nazi Germany did not include specific exclusions for Jewish applicants and authors, in practice, they were excluded by administrative measures alone rather than legal ordinances.

The misfits frequently use the same language, the word "exclude" comes up again and again. Harassment, UDRP rule 15(e)

Debian, code search, Daniel Pocock, Debian Developer