Argthtjtr

I have a question regarding code which was originally under GPL. The code was used and was built upon and used as a service. The code was kept private, which seems okay under GPL.

However, if one of the developers was to steal the code or it was leaked. How does this work? I can't really find any information regarding this situation online.

The code of the service has multiple copyright holders. Some published code under the GPL, others didn't publish the code at all. If the service code were to be published, it could only be published under the terms of the GPL license.

However, it is the right of each copyright holder to decide whether their code shall be published. If the code were to become public against their will, that would be copyright infringement. The right to control whether a creative work is published is more fundamental than the GPL. Therefore, the illegally published code would not have a valid GPL license attached to it.

The GPL FAQ has a related entry:

If someone steals a CD containing a version of a GPL-covered program, does the GPL give the thief the right to redistribute that version?

[…] If the version in question is unpublished and considered by a company to be its trade secret, then publishing it may be a violation of trade secret law, depending on other circumstances.

I think that the FSF's reference to trade secrets is correct but not necessary, and that the illegal publication is already prevented by copyright law. So what the thief is doing is illegal whether or not they are stealing from a company that has trade secrets.

Jurisdiction-specific arguments for the US (but this is going to be similar anywhere):

Distributing copies of a copyrighted work is the exclusive right of the copyright holder(s) under 17 USC 106. A thief has not received permission from the copyright holders of the service, therefore the thief is performing copyright infringement (17 USC 501(a)). The GPL restricts the service's copyright holders that they must license the code under the GPL if they distribute it, but does not compel them to distribute it in the first place.

Possible counterargument: if the service is a joint work then all joint authors might have full rights to the work. A joint author cannot “steal” their own work by publishing it. However, a lot here would depend on the specifics.

If the service was created as a work for hire, the developers are not copyright holders and have no rights in the software. Joint authorship cannot apply in that case, and this would be plain copyright infringement.

Based on my understanding of copyright licenses (local to the U.S.), it seems to me that if Alice modified some GPL-licensed program Foobar, and Bob stole and distributed her unpublished modified version, then

• Alice never issued a license for anyone to distribute her modified version of Foobar


• The modified version is not licensed under the GPL, since it is not licensed to anyone under any terms whatsoever

Consider a different case where Alice violates the GPL herself by distributing a modified version of Foobar but clearly licenses her parts of the work under a GPL-incompatible license. In that case, her parts don't become GPL licensed without her say-so by some legal magic. Instead, she's simply committed copyright infringement by distributing a derivative of Foobar in a way that Foobar's author did not allow. The author of Foobar could sue her for damages, seek an injunction against her to stop distribution of her modified version, etc. but cannot decide that Alice has licensed her work differently from how she actually licensed it. Alice holds the exclusive right to distribute her own copyrighted work (and therefore holds exclusive ability to license that right to others), and her having run afoul of someone else's copyright rights does not change that fact for her own work.

To return to the case where Bob steals and redistributes Alice's modifications, there once again seems to be no reason that Alice's work would be licensed under the GPL. Thus, no one may make use of Alice's work under the terms of the GPL, and neither is Alice liable for the distribution of her work in a GPL-incompatible way, since she never authorized such redistribution.

The above is my own layman legal understanding, and may be wrong and/or vary by jurisdiction.

GPL FAQ does not comment about the copyright situation of an unpublished derivative, but it does note an additional issue in Alice's favor about trade secrets

If someone steals a CD containing a version of a GPL-covered program, does the GPL give the thief the right to redistribute that version?

[...] If the version in question is unpublished and considered by a company to be its trade secret, then publishing it may be a violation of trade secret law, depending on other circumstances. The GPL does not change that. If the company tried to release its version and still treat it as a trade secret, that would violate the GPL, but if the company hasn't released this version, no such violation has occurred.