14 ms·

It is now proven that copilot returns code from codebases with non-permissive licenses [1]. I'm curious - what are the legal implications of this going forward

It is now proven that copilot returns code from codebases with non-permissive licenses [1]. I'm curious - what are the legal implications of this going forward? I've so many questions. 1. Will Microsoft ever face lawsuits for these license violations? 2. If so, who/how? Class-action? 3. Will copilot be forced to open-source in the future? Under which license? Some open source licenses are incompatible with others, but copilot uses code from probably every OSS license conceived. 4. If Microsoft faces no justice, will we start seeing more OSS license violations? Will Google start using AGPL-licensed code? [1] https://news.ycombinator.com/item?id=27710287 https://news.ycombinator.com/item?id=27710287 | Copilot regurgitating Quake code

pwdisswordfish9 4y ago
Is there any leaked Microsoft code on GitHub? Someone should check if Copilot regurgitates that as well, then see how Microsoft reacts when someone slaps an AGPL license on that…
- q-big 4y ago
  > Is there any leaked Microsoft code on GitHub? There seems to be. Google 'windows nt source code leak github': https://www.google.com/search?q=windows+nt+source+code+leak+github https://www.google.com/search?q=windows+nt+source+code+leak+... First search results: Windows NT 4.0: > https://github.com/lianthony/NT4.0 https://github.com/lianthony/NT4.0 > https://github.com/ZoloZiak/WinNT4 https://github.com/ZoloZiak/WinNT4 Windows XP: > https://github.com/tongzx/nt5src https://github.com/tongzx/nt5src > https://github.com/onein528/NT5.1 https://github.com/onein528/NT5.1
542458 4y ago
IANAL. My understanding is that the general legal precedent in the US is that a) datamining text has no copyright implications (in the same way that reading a book has no copyright implications) and b) it is not a copyright violation to use a small amount of copyrighted material provided the context is sufficiently transformative. This might seem silly or unfair to you, but that is the current legal reality. But even ignoring that, everybody uploading code to GitHub has given GitHub the right to analyze that code as per the GitHub ToS. This is the same mechanism by which you can't upload code to GitHub with a license that says "nobody is allowed to display this code on the internet" and then sue GitHub.
- aposm 4y ago
  I can't imagine a scenario in which any lawyer would consider granting Github the right to "analyze" code anywhere close to granting Github the right to spit out that same code verbatim without your copyright notice (even if laundered by AI).
  - 542458 4y ago
    Here's Kate Downing, an IP lawyer specializing in software license: > According to Downing, the answer depends to a certain extent on where that code is hosted. If it’s on GitHub, there very clearly would not be copyright infringement. > “If you look at the GitHub Terms of Service, no matter what license you use, you give GitHub the right to host your code and to use your code to improve their products and features,” Downing says. “So with respect to code that’s already on GitHub, I think the answer to the question of copyright infringement is fairly straightforward.” Downing cautions that copilot output of large chunks of code complete with comments are more questionable to use, but that for the most part it looks above board. https://fossa.com/blog/analyzing-legal-implications-github-copilot/ https://fossa.com/blog/analyzing-legal-implications-github-c... Here's an English lawyer on the same topic... > The licence is broadly worded, and I'm confident that there is scope for argument, but if it turns out that Github does not require a licence for its activities then, in respect of the code hosted on Github, I suspect it could make a reasonable case that the mandatory licence grant in its terms covers this as against the uploader. https://decoded.legal/blog/2021/06/github-copilot-initial-thoughts-from-an-english-law-perspective https://decoded.legal/blog/2021/06/github-copilot-initial-th...
    - Engineering-MD 4y ago
      To me regardless if it is technically legal, it certainly doesn’t feel right. Furthermore, contracts rely on people understanding what they are agreeing to, and I don’t think many developers would agree to letting the code be used outside the terms of the license they uploaded it under. I am very surprised there hasn’t been a legal challenge to it.
      - 4y ago
mhaymo 4y ago
That regurgitated code exists on Github exists under an MIT license: https://github.com/jethrodaniel/fast_inv_sqrt https://github.com/jethrodaniel/fast_inv_sqrt "jethrodaniel" does not appear to have the copyright to offer that license, but it's hard for Github to determine that in general, so I doubt they would be liable for the error.
- jsiaajdsdaa 4y ago
  That doesn't stop youtube from blasting people away over copyright issues? On youtube, video uploads are a cost center, whereas on github, code is a profit center
- vorpalhex 4y ago
  > but it's hard for Github to determine that in general, so I doubt they would be liable for the error. Please insert that meme, "That's not how that works. That's not how any of this works!" The legal system is permission based, not forgiveness or "I didn't know" based.
  - concordDance 4y ago
    If they had a reasonable basis for believing they had a license they're in the clear. "I didn't know" might not be enough but "I had good reasons to think otherwise" is.
    - vorpalhex 4y ago
      > If they had a reasonable basis for believing they had a license they're in the clear. False. If they committed copyright infringement, even if they genuinely believed they weren't, they are not in the clear. They still owe damages.
      - concordDance 4y ago
        Can I have a citation?
rifty 4y ago
It seems like Microsoft could be in the clear on the basis of it being essentially "search". But it also seems like anyone who uses it could be risking to a high degree getting infected with copyright violating code. My question is, if it isn't a copyright infringement issue to use copilot in its current form right now, why not just claim copilot was used whenever accused of copyright infringement hence forth?
- TAForObvReasons 4y ago
  Microsoft is trying to legally position Copilot like StackOverflow. It is possible to post copyright-infringing code on SO even though their TOS requires a CC BY-SA 4.0 grant to the company and its users. https://stackoverflow.com/legal/terms-of-service#licensing https://stackoverflow.com/legal/terms-of-service#licensing
- solveit 4y ago
  > why not just claim copilot was used whenever accused of copyright infringement hence forth? Without speaking to the particulars of copilot, this situation where laws seem toothless because of the ease of plausible deniability is actually fairly common. And in many such cases, the law is not as toothless as it seems, because 1. Getting multiple people to stick to a script under oath is difficult and dangerous. 2. Criminals frequently send each other messages like A: "lol I just crimed, hope nobody figures it out." B: "lol just say you used copilot". A: "lolol yeah fuck the law" Obviously this only gets the worst criminals, but there seems to be lots and lots of them.
blihp 4y ago
1) Most likely 2) TBD 3) Not likely. Worst case a judgement will go against them, they'll effectively pay a fine and then they'll retrain it on a more restricted set of source code. 4) OSS has a pretty tragic history re: enforcement. It wins nearly every skirmish but has no interest in the war so from a big picture standpoint, it loses due to apathy.
concordDance 4y ago
There's also one more question: 5. Even if it is illegal, is it actually bad? No one can possibly sell code snippets, the transaction costs are many orders of magnitude greater than any reasonable price. In my opinion, at least in this case the benefits massively outweigh the costs and the law should not apply here.
- citizenkeen 4y ago
  Then the law should change. Saying "it's illegal but it's good/harmless" is a terrible stance.
  - anamexis 4y ago
    Seems like an eminently reasonable stance, and exactly the stance you would take to get the law changed.
    - citizenkeen 4y ago
      Fair. I had read "and the law should not apply" as "so we ignore it", not "so we change it".
- xtracto 4y ago
  I really, REALLY like the idea of Copilot. I think it is a glance at what the future of AI can bring to improve programming. I understand where all the litigation and "uneasiness" is coming from, both from commercial and open-source projects. I've not installed or used it for the same reason (don't want to use AGPL or GPLd code by accident, and don't want my closed source code to be used accidentally as well), but the thought of Copilot being "killed" due to litigation/copyright/licensing issues is sad. For me, It's kind of like when MP3 first appeared: Sharing music in Napster or downloading Mp3s from Geocities was just amazing. The idea of having such things at your fingertips. Even though I understood the issue the authors had with the unpaid distribution of their music... still, the idea of "what could be..." made it amazing. I guess Microsoft could be a bit forward thinking, and implement the "Spotify" model in code: Pay OpenSource developers (whoever owns the repo, or whoever made a commit?) a small amount whenever their code gets used through Copilot. I'm super excited by how "Copilot" related services will look like in 10 years. And I really really hope that the technology/idea doesn't get killed by litigation.
bastardoperator 4y ago
You don't think a mountain of MSFT lawyers in every state, including partner law firms around the world haven't thought about this? Do you practice law or are you speculating based on emotions?
- worker_person 4y ago
  MSFT tried very hard to sue Linux into oblivion. Buying SCO, then claiming they owned all of Linux. http://www.groklaw.net/ http://www.groklaw.net/ I trust MSFT to screw everyone over.
  - bastardoperator 4y ago
    You're making stuff up. MSFT never bought SCO. https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitions_by_Microsoft https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitio...
    - birdyrooster 4y ago
      Not sure where your confidence came from but a Google of “sco Microsoft” reveals: By the mid-1980s Microsoft had gotten out of the Unix business, except for its ownership stake in SCO.[20] https://en.m.wikipedia.org/wiki/History_of_Microsoft https://en.m.wikipedia.org/wiki/History_of_Microsoft
      - colejohnson66 4y ago
        Owning stock, on its own, is not the same as buying a company
        birdyrooster 4y ago
        lmao
        worker_person 4y ago
        If you own a controlling percentage. Then yes it is. That is how you buy/control a publicly traded company. You can buy 100% of shares and take it private, but that's overkill for what Microsoft wanted.
throwaway23234 4y ago
Big meh. That quake code was MIT.
- monocasa 4y ago
  A) Public Quake is GPL. Just because someone else dumped it in an MIT library doesn't change that. B) MIT still requires attribution to not infringe.
Beltalowda 4y ago
> It is now proven that copilot returns code from codebases with non-permissive licenses [1]. That same Quake example from last year is repeated every single time. Aside from the fact that GitHub has since added a protection for this, that this example gets repeated time and time again instead of a *list of examples leads me to believe this is (and was not) a common occurrence.

pwdisswordfish9 4y ago

Is there any leaked Microsoft code on GitHub? Someone should check if Copilot regurgitates that as well, then see how Microsoft reacts when someone slaps an AGPL license on that…

q-big 4y ago
> Is there any leaked Microsoft code on GitHub? There seems to be. Google 'windows nt source code leak github': https://www.google.com/search?q=windows+nt+source+code+leak+github https://www.google.com/search?q=windows+nt+source+code+leak+... First search results: Windows NT 4.0: > https://github.com/lianthony/NT4.0 https://github.com/lianthony/NT4.0 > https://github.com/ZoloZiak/WinNT4 https://github.com/ZoloZiak/WinNT4 Windows XP: > https://github.com/tongzx/nt5src https://github.com/tongzx/nt5src > https://github.com/onein528/NT5.1 https://github.com/onein528/NT5.1

542458 4y ago

IANAL. My understanding is that the general legal precedent in the US is that a) datamining text has no copyright implications (in the same way that reading a book has no copyright implications) and b) it is not a copyright violation to use a small amount of copyrighted material provided the context is sufficiently transformative. This might seem silly or unfair to you, but that is the current legal reality. But even ignoring that, everybody uploading code to GitHub has given GitHub the right to analyze that code as per the GitHub ToS. This is the same mechanism by which you can't upload code to GitHub with a license that says "nobody is allowed to display this code on the internet" and then sue GitHub.

aposm 4y ago
I can't imagine a scenario in which any lawyer would consider granting Github the right to "analyze" code anywhere close to granting Github the right to spit out that same code verbatim without your copyright notice (even if laundered by AI).
- 542458 4y ago
  Here's Kate Downing, an IP lawyer specializing in software license: > According to Downing, the answer depends to a certain extent on where that code is hosted. If it’s on GitHub, there very clearly would not be copyright infringement. > “If you look at the GitHub Terms of Service, no matter what license you use, you give GitHub the right to host your code and to use your code to improve their products and features,” Downing says. “So with respect to code that’s already on GitHub, I think the answer to the question of copyright infringement is fairly straightforward.” Downing cautions that copilot output of large chunks of code complete with comments are more questionable to use, but that for the most part it looks above board. https://fossa.com/blog/analyzing-legal-implications-github-copilot/ https://fossa.com/blog/analyzing-legal-implications-github-c... Here's an English lawyer on the same topic... > The licence is broadly worded, and I'm confident that there is scope for argument, but if it turns out that Github does not require a licence for its activities then, in respect of the code hosted on Github, I suspect it could make a reasonable case that the mandatory licence grant in its terms covers this as against the uploader. https://decoded.legal/blog/2021/06/github-copilot-initial-thoughts-from-an-english-law-perspective https://decoded.legal/blog/2021/06/github-copilot-initial-th...
  - Engineering-MD 4y ago
    To me regardless if it is technically legal, it certainly doesn’t feel right. Furthermore, contracts rely on people understanding what they are agreeing to, and I don’t think many developers would agree to letting the code be used outside the terms of the license they uploaded it under. I am very surprised there hasn’t been a legal challenge to it.
    - 4y ago

mhaymo 4y ago

That regurgitated code exists on Github exists under an MIT license: https://github.com/jethrodaniel/fast_inv_sqrt https://github.com/jethrodaniel/fast_inv_sqrt "jethrodaniel" does not appear to have the copyright to offer that license, but it's hard for Github to determine that in general, so I doubt they would be liable for the error.

jsiaajdsdaa 4y ago
That doesn't stop youtube from blasting people away over copyright issues? On youtube, video uploads are a cost center, whereas on github, code is a profit center
vorpalhex 4y ago
> but it's hard for Github to determine that in general, so I doubt they would be liable for the error. Please insert that meme, "That's not how that works. That's not how any of this works!" The legal system is permission based, not forgiveness or "I didn't know" based.
- concordDance 4y ago
  If they had a reasonable basis for believing they had a license they're in the clear. "I didn't know" might not be enough but "I had good reasons to think otherwise" is.
  - vorpalhex 4y ago
    > If they had a reasonable basis for believing they had a license they're in the clear. False. If they committed copyright infringement, even if they genuinely believed they weren't, they are not in the clear. They still owe damages.
    - concordDance 4y ago
      Can I have a citation?

rifty 4y ago

It seems like Microsoft could be in the clear on the basis of it being essentially "search". But it also seems like anyone who uses it could be risking to a high degree getting infected with copyright violating code. My question is, if it isn't a copyright infringement issue to use copilot in its current form right now, why not just claim copilot was used whenever accused of copyright infringement hence forth?

TAForObvReasons 4y ago
Microsoft is trying to legally position Copilot like StackOverflow. It is possible to post copyright-infringing code on SO even though their TOS requires a CC BY-SA 4.0 grant to the company and its users. https://stackoverflow.com/legal/terms-of-service#licensing https://stackoverflow.com/legal/terms-of-service#licensing
solveit 4y ago
> why not just claim copilot was used whenever accused of copyright infringement hence forth? Without speaking to the particulars of copilot, this situation where laws seem toothless because of the ease of plausible deniability is actually fairly common. And in many such cases, the law is not as toothless as it seems, because 1. Getting multiple people to stick to a script under oath is difficult and dangerous. 2. Criminals frequently send each other messages like A: "lol I just crimed, hope nobody figures it out." B: "lol just say you used copilot". A: "lolol yeah fuck the law" Obviously this only gets the worst criminals, but there seems to be lots and lots of them.

blihp 4y ago

1) Most likely 2) TBD 3) Not likely. Worst case a judgement will go against them, they'll effectively pay a fine and then they'll retrain it on a more restricted set of source code. 4) OSS has a pretty tragic history re: enforcement. It wins nearly every skirmish but has no interest in the war so from a big picture standpoint, it loses due to apathy.

concordDance 4y ago

There's also one more question: 5. Even if it is illegal, is it actually bad? No one can possibly sell code snippets, the transaction costs are many orders of magnitude greater than any reasonable price. In my opinion, at least in this case the benefits massively outweigh the costs and the law should not apply here.

citizenkeen 4y ago
Then the law should change. Saying "it's illegal but it's good/harmless" is a terrible stance.
- anamexis 4y ago
  Seems like an eminently reasonable stance, and exactly the stance you would take to get the law changed.
  - citizenkeen 4y ago
    Fair. I had read "and the law should not apply" as "so we ignore it", not "so we change it".
xtracto 4y ago
I really, REALLY like the idea of Copilot. I think it is a glance at what the future of AI can bring to improve programming. I understand where all the litigation and "uneasiness" is coming from, both from commercial and open-source projects. I've not installed or used it for the same reason (don't want to use AGPL or GPLd code by accident, and don't want my closed source code to be used accidentally as well), but the thought of Copilot being "killed" due to litigation/copyright/licensing issues is sad. For me, It's kind of like when MP3 first appeared: Sharing music in Napster or downloading Mp3s from Geocities was just amazing. The idea of having such things at your fingertips. Even though I understood the issue the authors had with the unpaid distribution of their music... still, the idea of "what could be..." made it amazing. I guess Microsoft could be a bit forward thinking, and implement the "Spotify" model in code: Pay OpenSource developers (whoever owns the repo, or whoever made a commit?) a small amount whenever their code gets used through Copilot. I'm super excited by how "Copilot" related services will look like in 10 years. And I really really hope that the technology/idea doesn't get killed by litigation.

bastardoperator 4y ago

You don't think a mountain of MSFT lawyers in every state, including partner law firms around the world haven't thought about this? Do you practice law or are you speculating based on emotions?

worker_person 4y ago
MSFT tried very hard to sue Linux into oblivion. Buying SCO, then claiming they owned all of Linux. http://www.groklaw.net/ http://www.groklaw.net/ I trust MSFT to screw everyone over.
- bastardoperator 4y ago
  You're making stuff up. MSFT never bought SCO. https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitions_by_Microsoft https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitio...
  - birdyrooster 4y ago
    Not sure where your confidence came from but a Google of “sco Microsoft” reveals: By the mid-1980s Microsoft had gotten out of the Unix business, except for its ownership stake in SCO.[20] https://en.m.wikipedia.org/wiki/History_of_Microsoft https://en.m.wikipedia.org/wiki/History_of_Microsoft
    - colejohnson66 4y ago
      Owning stock, on its own, is not the same as buying a company
      - birdyrooster 4y ago
        lmao
      - worker_person 4y ago
        If you own a controlling percentage. Then yes it is. That is how you buy/control a publicly traded company. You can buy 100% of shares and take it private, but that's overkill for what Microsoft wanted.

throwaway23234 4y ago

Big meh. That quake code was MIT.

monocasa 4y ago
A) Public Quake is GPL. Just because someone else dumped it in an MIT library doesn't change that. B) MIT still requires attribution to not infringe.

Beltalowda 4y ago

> It is now proven that copilot returns code from codebases with non-permissive licenses [1]. That same Quake example from last year is repeated every single time. Aside from the fact that GitHub has since added a protection for this, that this example gets repeated time and time again instead of a *list of examples leads me to believe this is (and was not) a common occurrence.