Revokable BSD - What are the implications?

Question

While examining alternatives to Exim/Dovecot for a dedicated mail server, I came across the lamson project, a python-based MTA. I also found the following fork of the project:

https://github.com/moggers87/salmon

Quoting from the docs at the fork:

Salmon is a fork of Lamson. In the summer of 2012 (2012-07-13 to be exact), Lamson was relicenced under a BSD variant that was revokable. The two clauses that were of most concern:

1. Contributors agree that any contributions are owned by the copyright holder and that contributors have absolutely no rights to their contributions.

2. The copyright holder reserves the right to revoke this license on anyone who uses this copyrighted work at any time for any reason.

I read that to mean that I could make a contribution but then have said work denied to me because Mr. Shaw didn't like the colour of my socks. So I went and found the latest version that was available under the GNU GPL version 3.

Salmon is an anagram of Lamson, if you hadn't worked it out already.

I am familiar with the BSD license but have never seen it modified in this way. I am curious what the implications of this kind of license would be for other developers using the code, especially in paid commercial projects (thinking something like subscription-based webapps here).

Assuming the license were revoked, could the user be liable for monetary damages, or would a scenario like this be equivalent to a cease-and-desist, in which case whatever functionality the library was providing would have to be reimplemented?

To Clarify:

Usual caveats with regard to answers are assumed. I ask out of curiosity only and have no intentions on acting or assuming legal risk via the advice posted.

Answer 1

I'm not a lawyer; this answer comes out of my (US-centric) understanding of basic licensing and copyright fundamentals. I'll address some basic US copyright law and case law in an attempt to shed some light on the topic, but don't take anything below as definitive (except the last two sentences -- if you want a tl;dr, read those).

Lamson's license is very bad, for a large number of reasons, and the author of Salmon was wise to move as far away from it as possible.

Some US-centric copyright and licensing review:

In the US, copyright offers monopoly rights over six particular actions:

(1) to reproduce the copyrighted work in copies or phonorecords;

(2) to prepare derivative works based upon the copyrighted work;

(5) in the case of literary, musical, dramatic, and choreographic works, pantomimes, and pictorial, graphic, or sculptural works, including the individual images of a motion picture or other audiovisual work, to display the copyrighted work publicly; and

[(3), (4), and (6) omitted, as they relate only to audio and/or performance works]

As you can see, "in the case of software, run the program code" is not included. This suggests that if you have received a copy of the software already, you can do whatever you like with it. Imagine an analogous case with a book: when you receive a book in a sale, copyright disallows you from copying it, but it has no say in how often you can open it and read it.

This point is heavily muddied, however, by software licensing. If you only use software under a license (i.e., it is "licensed, not sold"), you have not actually participated in a bona fide sale-transfer of a copy of copyrighted material -- you have been granted some limited, license-dependent rights over that copyrighted material. The ruling in Vernor v. Autodesk devises a test to determine if a particular transfer is a sale or a license:

First, we consider whether the copyright owner specifies that a user is granted a license. Second, we consider whether the copyright owner significantly restricts the user’s ability to transfer the software. Finally, we consider whether the copyright owner imposes notable use restrictions.

In the narrow case of Lamson's BSD-like license, it certainly passes the first test, but probably fails the other two tests. However, it's difficult to guess exactly how a court might rule here, as it is painfully obvious that the license was not composed with the intent of being legally rigorous. Let's assume (rightly or wrongly) that this BSD-like license is actually a "sale with restrictions" rather than an actual license. From there, we'll infer from that fact that right-to-use is granted naturally, unfettered. (This means that for other licenses with more rules, like copyleft or proprietary licenses, this may be a significantly less safe assumption.)

To review our assumptions thus far:

• Lamson's license is actually a sale with restrictions
• The sale with restrictions implies an unfettered right to use the software (this is perhaps a more dubious assumption, and I consider it first as true and then again as false, below)

Actual answer:

Thus, if we assume that the preceding analysis is true: if you have a copy of the software, and your license is revoked, your only obvious responsibility is to immediately stop distributing the code. If you aren't distributing the code in the first place (e.g., you use it as part of a network service), you can continue using the software, as is your natural right as the recipient of a sale-transfer.

If we assume that the Lamson's license does impose enforceable restrictions on use (either because it passes the Vernor license test after all, or the sale-transfer does come with enforceable use restrictions), then a user would indeed need to stop using the software as well, or else be legally liable for violating the sale restrictions.

The user would need to comply immediately, but it seems extremely unlikely that the copyright holder could impose a retroactive revocation of the license. If the copyright holder informs a user that his license is revoked, the user might be held accountable for violations from that point onward. (To what degree a user might be held accountable for automated violations -- e.g., the license was revoked on Sunday, but the file server kept serving files to downloaders until it was shut down on Tuesday -- is left as an exercise for the courts.)

This license is also quite troubling because it requires private modifications to have their copyright assigned to the original Lamson copyright holder. It is totally unclear if those private modifications must be sent to the author, however. Again, this license was obviously not written by someone who gave (or was trained to give) significant legal consideration to the license.

The moral:

Please don't write your own license.

If you must, consult a lawyer.

Answer 2

Once forked from Lamson, Salmon became it's own codebase and all other bets are off.

The terms of BSD remain with Salmon since that's how that code was licenced at the point of forking. Changes to Lamson's licencing or codebase are irrelevant and cannot be applied retroactively (although changes/diffs from the Lamson codebase would be under the terms of the new licence.)

That licencing protection works both ways and Salmon cannot legally move to GPL v3 without violating the BSD licence. So if someone has attempted to re-licence Salmon as GPL v3 without permission from the Lamson authors (who presumably wrote most of the codebase) then that will be a big problem and I'd walk away at that point.

The terms which have been added to Lamson are probably not enforceable since there are no details on what constitutes a revocation even if the authors were to attempt one.

Usual caveats apply - I am not a lawyer so you should neither act (nor refrain from acting) based on anything I say. If you're in doubt, speak to a real lawyer.