list for collecting reports of GPL violations.  On the basis of these

reports, Welte successfully pursued many enforcements in Europe, including

formal legal action.  Harald earns the permanent fame as the first copyright

In 2007, two copyright holders in BusyBox, in conjunction with the

Software Freedom Conservancy (``Conservancy''), filed the first copyright infringement lawsuit

based on a violation of the GPL\@ in the USA. While  lawsuits are of course

quite public, the vast majority of Conservancy's enforcement actions 

are resolved privately via

individual companies into compliance, both organizations have encountered numerous

violations resulting from preventable problems such as inadequate

attention to licensing of upstream software, misconceptions about the

typically only require preservation of copyright notices, licensees face many

important requirements from the GPL.  These requirements are

carefully designed to uphold certain values and standards of the software

counter-intuitive to those more familiar with proprietary software

licenses, by comparison, its terms are in fact clear and quite favorable to

licensees.  Indeed, the GPL's terms actually simplify compliance when

creative expression, no copyleft provisions are invoked.

Admittedly, a tiny

do involve close questions about derivative and combined works.  Those

situations admittedly do require a highly

fact-dependent analysis and cannot be addressed in a general-purpose

standard place describing each new Free Software component they add to the system,

and have them include a brief description of how they will incorporate it

into the product.  Further, make sure developers use a revision control

store the upstream versions of all software in a ``vendor branch'' or

similar mechanism, whereby they can easily track and find the main version

of the software and, separately, any local changes.

some software licensing scanning tool to inspect the codebase.  However,

there are few tools that are themselves Free Software.  Thus, GPL enforcers

usually recommend the GPL'd

source code base and produces a list of Free Software licenses that may apply to

already used to build your product.  You can then expand that into a more

structured inventory and process.

developers are using revision control systems properly.

\item Have developers mark or ``tag'' the full source tree corresponding to

\item Check that your developers store all parts of the software

development in the revision control system, including {\sc readme}s, build

distribution.

Finally, it is unacceptable to use option (b) merely because you do not have

because writing an offer is easy, but producing a source distribution as

an afterthought to a hasty development process is difficult.  The offer

for source does not exist as a stop-gap solution for companies rushing to

market with an out-of-compliance product.  If you ship an offer for source

with your product but cannot actually deliver \emph{immediately} on that

action.

\subsection{Option (c): Noncommercial Offers}

As discussed in the last section, GPLv2~\S~3(c) and GPLv3~\S~6(c) apply

only to noncommercial use.  These options are not available to businesses

software packaged for them by an upstream vendor cannot merely pass along

the offer they received from the vendor; they must provide their own offer

or corresponding source to their distributees.  We talk in detail about

with the license and respect freedom.

However, other entities who do not share the full ethos of software freedom

company that produces the GPL'd MySQL database, upon discovering GPL

violations typically negotiates a proprietary software license separately for

a fee.  While this practice is not one that FSF nor Conservancy would ever

holders to proceed.

Generally, GPL enforcers come in two varieties.  First, there are

policy goals of GPL (software freedom), and see financial compensation as

ultimately secondary to those goals.  Second, there are ``for-profit

induce infringement merely to gain proprietary licensing revenue.

the copyrights in the infringed work.  As such, multi-copyright-held works

are fully insulated from these tactics.

\item What are all the licenses that cover the software in this device?

\item From which upstream vendors, be they companies or individuals, did

\item What are your GPL compliance procedures?

% LocalWords:  redistributors NeXT's Slashdot Welte gpl ISC embedders BusyBox

% LocalWords:  someone's downloadable subdirectory subdirectories filesystem

% LocalWords:  makefiles violator's

\section{Ongoing Violations}

In conjunction with \S 4's termination of violators' rights, there is

single, solitary act of copying, distributing or modifying software.

Almost always, a violator will have legitimately acquired a copy of a

GPL'd program, either making modifications or not, and then begun

\begin{enumerate}

\item {\bf Enforcement should not begin until the evidence is confirmed.}

  times, violation reports are mistaken. Even with extensive efforts in

  GPL education, many users do not fully understand their rights and the

  obligations that companies have. By working through the investigation

  the GPL are ignored. If companies do not want to release source code

  for some reason, then they should not base the work on GPL'd software.

  No external argument for noncompliance can hold weight if the work as

  The ``security concerns'' argument is often floated as a reason to keep

  software proprietary, but the computer security community has on