Failure to Comply with GNU GPL V2 License: Key Takeaways from Orange's Conviction

Understanding the Allegations Against Orange

Orange faced severe condemnation for violating the terms of use of the Lasso software. Entr’ouvert, the developer of Lasso, offers it under a dual licensing model, allowing users to choose between the GNU GPL V2 open-source license (considered a strong copyleft license) or a commercial license, which involves paying a usage fee. 

In 2005, Orange integrated the Lasso software into its Identity Management Platform (IDMP) as part of a public contract initiated by ADAE aimed at simplifying access to online public services in France. 

Entr’ouvert, as the owner of Lasso, alleged that Orange's integration of Lasso into the IDMP platform and its usage violated the conditions of the GNU GPL V2 license, particularly the obligations of sharing and transparency inherent in this license. The central argument was that the IDMP software was not independent of Lasso and was indeed distributed by Orange to ADAE.

Ten Years of Legal Proceedings Against Orange for GPL License Violations

In 2011, Entr’ouvert filed lawsuits against Orange, accusing it of infringement and unfair competition.

On 21st June 2019, the Paris Tribunal de Grande Instance deemed Entr’ouvert's accusation of infringement inadmissible, arguing that the dispute solely pertained to contractual responsibility.

On 19th March 2021, the Court of Appeal confirmed the infringement claim and upheld Entr’ouvert's claim of unfair competition, fining Orange 150,000 euros.

In October 2022, the Court of Cassation overturned the Court of Appeal's decision, deeming the infringement claim admissible and referring the parties back to the Court of Appeal. 

On 14th February 2024, after 12 long years of legal proceedings, the Paris Court of Appeal finally ruled in favor of Entr’ouvert, recognising Orange's actions as a violation of Entr’ouvert's intellectual property rights and the open-source license under which the Lasso software was distributed.

Entr’ouvert sought 4 million euros in damages for lost revenue. However, following the Paris Court of Appeal's decision, Orange is required to pay Entr’ouvert a total of 800,000 euros in damages. This amount is divided into three parts: 500,000 euros for damages resulting from the violation of intellectual property rights, 150,000 euros representing the savings Orange made on R&D due to unauthorised software usage, and 150,000 euros to compensate for the moral prejudice suffered by Entr’ouvert.

Deciphering the Breached Terms of the GNU GPL V2 License

Orange has been convicted for violating multiple terms of the GNU GPL V2 license. 

Failure to Comply with The Terms of Use: Modification of Open-Source Software

According to Article 2 of the GNU GPL V2 license, if a user modifies or creates a derivative work of open-source software, they must adhere to three conditions:

• Firstly, they must indicate in the source code what has been modified and when.
• Secondly, they must make the modified software available under the same conditions as the original license.
• Thirdly, they must clearly display copyright notices and warranty disclaimers during program execution.

Entr’ouvert argued that Orange failed to comply with these criteria since it integrated Lasso into its IDMP platform without the required notifications and without freely distributing the modified software. 

The Court Establishes a Dependency Relationship Between Lasso and the IDMP Platform

Facing Entr’ouvert's accusation, Orange defended itself by emphasising the independence between the Lasso software and its IDMP Platform, a provision that allows for bypassing the obligations of the GNU GPL V2 license.

However, the Court of Appeal found that the experts demonstrated a strong dependency between Lasso and IDMP, as Lasso constituted 57% of the IDMP software's source code and was essential for the platform's operation.

Failure to Comply with Usage Conditions: Providing Free Access to the Source Code

The Court of Appeal determined that Orange also breached the terms of the GNU GPL V2 license by not sharing the entire source code of its IDMP platform. The GNU GPL, a strong copyleft license, stipulates that in cases of integration, modification, or derivation of open-source software components, the entire source code developed around those components must adhere to the license terms, which, in this case, must be provided to third parties. Orange argued that it was not subject to this requirement, claiming it had not "distributed" Lasso in the strict sense of the license.

The Court Demonstrates That Orange Did Indeed Distribute the IDMP Software in the Strict Sense of the GNU GPL V2 License

The Paris Court of Appeal dismissed Orange's argument, demonstrating that the IDMP platform, which integrated modified Lasso software, was sold and delivered to ADAE, constituting distribution. Therefore, Orange was obligated to comply with the terms of the GNU GPL V2 license and make the entire platform code available to users.

To distribute the IDMP software under different conditions than those of the GNU GPL V2 license, Orange should have approached Entr’ouvert, the author of the Lasso software, to negotiate different terms of use, such as paying a fee.

How to Manage Risks Associated with Strong Copyleft Licenses Like GNU GPL V2?

The ruling against Orange highlights the dangers of integrating open-source components, such as GNU GPL V2, into software programs without strictly adhering to the usage conditions set by the license owners. The offending company risks being sued for infringement and may also face prohibitions on the exploitation or distribution of its software.

While open-source software offers significant productivity gains, it's essential to remain vigilant because "free" does not equate to "without restrictions." It's crucial for the company using the software to understand the potential restrictions that a license may impose on the software's subsequent use and distribution.

Intellectual Property Audit: A Major Asset in Open Source Risk Management

Effective internal governance of open-source licenses entails adopting a rigorous process for assessing compliance with open-source software used from the outset of software development and throughout its lifecycle. It's highly recommended to conduct a comprehensive code audit using a scanner to identify all open-source elements used, assess their potential risks, and develop a corrective action plan.

This plan may involve modifying high-risk components or negotiating a fee to distribute the developed software. Caution, training, and verification will be allies in the optimal use of open-source software.

References:

1. https://numeum.fr/actu-informatique/etude-lusage-de-lopen-source-en-france-open-source-monitor-2023