In my 2019 open source licenses year in review, I suggested that 2020 would see more adoption of licenses with a strong ethical focus. Just on schedule, last week the authors of the Hippocratic License (a license that prohibits usage in situations that violate human rights) released version 2.0, and the vcr project adopted it. Kurtis Rainbolt-Greene, the lead author of vcr, gave the following straightforward explanation for the change: before the license change “anyone ... could start using our collected works for things that should be opposed on an ethical level.”
Since vcr has over 15,000 dependent repositories, and is in our dependency stack at Tidelift, I thought it would be timely to share how an attorney (like myself) might assess this license change and advise clients.
The most common way in which the license will get evaluated is “not at all.” The vast majority of users won’t notice this library’s new license, and will continue using it just as they have in the past. This is probably not ideal for anyone. For the authors of vcr, of course, it means their ethical goals likely are not going to be met. For the corporations using vcr and unaware of the license change, it’ll mean an ongoing potential copyright license violation.
The next most common evaluation will be a simple check against a list of accepted licenses, usually the list from the Open Source Initiative, a license-scanner vendor, or from counsel. Organizations using this approach are sophisticated enough to know what code they’re using, but prefer to take a risk-averse approach to what they accept.
In this case, the license will be rejected immediately, because the license isn’t on any of these lists yet (and may never be). These organizations will likely stick with vcr 5.0.0 (the last version under the old license) as long as they can, in the hopes either that newer versions will switch back to the old license, or that someone else will write a viable replacement, under a more permissive license, that they can use instead.
A very small number of organizations will go to the trouble of reading the license and figuring out if they can comply with its terms. This will be rare, because few organizations have the right kind of legal skills (or the time!) to analyze this. But for those that do analyze it, the first pass will be a simple search for any egregious flaw that would cause the document to be rejected immediately; only if there is a really compelling business reason to use the software will the lawyer dig further (say, by doing more research or looking for ways to work around problems).
Version 1.3 of the license, used (as of this writing) by vcr, has a number of these showstoppers; perhaps most importantly for most businesses, it prohibited harm to the “economic well-being” of others—which is a tough ask for businesses who see themselves as being in economic competition! So license compliance would have been very difficult for many businesses, unless they wanted to use loopholes to avoid the plain language of the license.
The new version 2.0 of the license removes some of the most obvious flaws of this sort, probably in part because it was the first version drafted with help from attorneys. These changes will force any counsel grappling with vcr and the Hippocratic License more generally to answer some fundamental questions about their business and their tolerance for risk—never fun or easy exercises!
In particular, four of the tough questions forced by the license include:
For example, if the Linux kernel adopted this, then for SaaS companies even the smallest, most inadvertent violations of labor law could turn from something resolvable with payment of a governmentally determined reasonable fine into a huge, potentially extinction-level problem.
Alternatively, consider the case of an upstanding nonprofit, whose own motives (and legal team) are unimpeachable.
For such an organization, some of the same concerns about the license will still apply. For example, most practicing nonprofit lawyers will still not be familiar with the UN UDHR. (They’re also, sadly, even more likely to be crunched for time.) So the license is still likely to face legal hurdles to adoption because they won’t have time to do that sort of research.
In fact, in some ways the license may be more difficult for a nonprofit to use. Where a hostile or risk tolerant for-profit will feel comfortable taking advantage of any ambiguity, and ignore the spirit of the license, a nonprofit will likely respect the spirit and reject attempts to use loopholes or ambiguity. They may also still have obligations (to funders or existing communities) that prevent them from following every detail of the license, just like for-profits do.
Despite my personal sympathy towards the goals of the license, I’ve asked the Tidelift team to keep us on the MIT-licensed version of vcr—for now.
To Coraline’s credit, the Hippocratic License is adopting a very open-source-y release-early, release-often model. This leads to some uncertainty (never ideal in a license) but also seems likely to help the license iterate more quickly. She has also engaged pro bono legal help, which is a great sign. So even though they aren’t there yet, that combination makes me optimistic that the project can move towards a license that can meet the moral goals of projects like vcr and pragmatic needs of the many businesses (like ours) that rely on them.