Many common open source licenses were drafted as far back as the 1990’s. The network infrastructure at that time was not yet strong enough for business models such as “software as a service” (SaaS). As a result, most open source licenses do not contain express provisions relating to use in the Cloud, so that use of open source software (OSS) in Cloud services may involve license risks for both providers and for users.
Legal risks for providers of Cloud services
There is a wide range of OSS for Cloud services. As a result, depending on the type of service, service providers may have to consider many different licenses and comply with their terms. SaaS providers require licenses in order to provide services to customers for use. Whether a reproduction license is required is disputed. According to the prevailing view, such a license is not required because customers do not receive a copy of the software. But the modification of OSS, e.g. by embedding OSS components into independently developed Cloud services, involves additional obligations. Even more recent licenses, such as AfferoGPLv3 , require providers to disclose the source code and include a copyleft clause. In the worst case, violating the terms of a license may force a provider to discontinue Cloud operation because no licenses exist. It is therefore indispensable for providers of Cloud services to know and comply with the licenses of the OSS they use in order to avoid legal risks. Technical aids such as Black Duck and other software composition analysis (SCA) tools may also be used for this purpose.
Legal risks for users of Cloud services
Merely using a work is not typically subject to specific licensing requirements, even for OSS. But the question as to whether use of OSS in the Cloud qualifies as “distribution” in terms of the OSS license is of great importance for users. This is typically not the case if the software is being used internally, since the use or conveyance is taking place within the same legal entity. However, dissemination of the software between different affiliates of the same corporate group, or dissemination to a third party, may qualify as distribution and could therefore involve license obligations. As a result, even users of Cloud services should take measures to ensure compliance with OSS licenses.
Conclusion
The use of OSS in the Cloud may involve license risks for both providers and users. In order to minimize these risks, it is important to precisely understand the license terms of the OSS in use. Aside from a detailed legal assessment, the use of technical aids may be necessary in order to minimize the risk of violations. More information can be found in our one-pager on open source software: how companies can avoid license risks.
back