Open source: legal aspects and compliance requirements

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Open source: no payment, but not without obligations

A familiar scenario: a startup builds an open source library under a GPL license into its product. Two years later, in due diligence before an acquisition, the buyer discovers the breach. The deal is delayed, and the problem has to be solved with weeks of legal and programming work. This is not an imaginary scenario; this is how it happens in practice.

The common myth: “open source = free to use”. This is partly true. The code costs nothing, but it does not come without obligations. Every open source license is a legal contract in every sense, and failing to meet its terms can end in a copyright infringement claim, delayed deals and damage to your image.

The main licenses and what they require

MIT and Apache 2.0: the most permissive licenses. They allow commercial use, changes, and combining with proprietary code. The main requirement: keeping the original attribution. Companies such as Google and Microsoft like these licenses.

GPL (GNU General Public License): a “viral license”. If you built GPL code into a product that you distribute, you will have to license the entire combined work under the GPL and hand its source code over to the recipients (sections 5(c) and 6 of the GPLv3 license). Internal use without distribution does not trigger the obligation (section 2). For companies that sell proprietary software, this can be devastating.

LGPL: a lighter version of the GPL that allows using the library without “infecting” the whole project. In other words, you can call an LGPL library from proprietary code.

AGPL: a stricter version of the GPL. If you changed the software and let users interact with it remotely over a network, you must offer them the source code of your version (section 13 of the license), even without distributing a copy. This is the license that scares Israeli SaaS companies the most.

Rule of thumb: MIT and Apache are fine for commercial use. Any version of the GPL needs legal advice before you combine it with proprietary code.

What happens when an open source license is breached?

Use beyond the terms of an open source license could be copyright infringement (section 47), not just a breach of contract. In Israel, the Copyright Act, 5768-2007 protects a computer program as a literary work (section 1). A computer program has no moral right (section 45(a)), so the duty of attribution in open source comes from the terms of the license itself. The remedies include injunctions (section 53) and compensation without proof of damage of up to NIS 100,000 for each infringement, where infringements in a single course of conduct count as one infringement (section 56).

Organizations such as the Software Freedom Conservancy track GPL breaches and take legal action, also outside the US.

Checking license compliance

Every company that uses open source should run an “audit” of the licenses in use. Tools such as FOSSA, Black Duck and Snyk do this automatically. In an M&A process, checking open source licenses is a standard part of due diligence.

The AGPL license: the special trap for SaaS companies

The AGPL license (GNU Affero General Public License) extends the duty to hand over source code even to a case where the software is not distributed at all. If you changed the software and let users interact with it remotely over a network, you must offer them the source code of your version (section 13 of the license). A SaaS company that builds a library under an AGPL license into its service, without distributing a single copy of the software to the user, could have to offer users the source code of the version it changed. Sometimes this also covers proprietary code written in the company, if it is part of the same work. This is a common surprise for developers who only know permissive licenses such as MIT or Apache, and do not check whether someone in the hidden stack of dependencies included the AGPL.

Using open source in an Israeli company: a checklist

Before you add an open source library to a product, answer these questions:

1. Which license? MIT/Apache: green. GPL: a red flag. AGPL: a double red flag for cloud services
2. Do you distribute the code? If so, the GPL requires you to hand over the source code of the combined work to the recipients (sections 5(c) and 6 of the license)
3. Did you include attribution? Missing attribution (the author’s name, a link to the license) is a common breach, also under MIT
4. Did you check the dependencies? Not only the library itself, but also what it brings with it. GPL can “spread” through a chain
5. Do you have an internal policy? Mature companies require approval from a responsible officer before adding any open component with a strict license

What do you do if you discovered a breach?

The right step:

• Do not keep exposing the code until you understand the scope.
• Full mapping: FOSSA, Black Duck or Snyk will identify all the problematic components.
• Ways to fix it: replace the library with an alternative under a suitable license, buy a commercial license from the author (some GPL libraries are also offered under a commercial license: dual licensing), or publish the code.
• Document the fix: keep a record of what was fixed and when. It matters for future due diligence.

Frequently asked questions

We built a GPL library into our product. Do we have to hand over all the code?

Only if you distribute the product. If you built GPL code into a product that you distribute, you will have to license the entire combined work under the GPL and hand its source code over to the recipients (sections 5(c) and 6 of the GPLv3 license). Internal use without distribution does not trigger the obligation (section 2).

Can you use an LGPL library in proprietary code?

Yes. LGPL is a lighter version of the GPL that allows using the library without “infecting” the whole project, so you can call an LGPL library from proprietary code.

Is leaving out the attribution under the MIT license a breach?

Yes. Missing attribution (the author’s name, a link to the license) is a common breach, also under MIT. A computer program has no moral right (section 45(a) of the Copyright Act), so the duty of attribution in open source comes from the terms of the license itself.