Hacker News Reader

> To me this doesn't really look like a clear cut case. Does he own one of these cars? If not, then I think it is very dubious whether he has any standing to request the source code.

(All section references below are to GPLv2, since that is what the Linux kernel uses)

Section 3 governs distribution of object or executable code. Section 3 gives these requirements:

a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)

BMW is distributing commercially and they did not receive the program in object or executable form, so option "c" is out.

They are not distributing the source code with their cars, so option "a" is out.

That leaves option "b", which requires them to give the code to any third party that requests it, at no more than their cost of performing a source distribution.

> That leaves option "b", which requires them to give the code to any third party that requests it,

That's very interesting wording that I wasn't aware of. It still seems to me like it is a reasonable interpretation that only the customer could request it (the "offer" is to the customer, the distribution is to the third party). So, having bought the car, I could say "Please send the source code to my friend Fred". However my understanding is that the long held general interpretation of the GPL has always been that you only get standing to request the source code if you actually received the GPL code yourself.

"They are not distributing the source code with their cars, so option "a" is out"

I disagree. BMW currently offers the source code as a download on their website if a customer provides his 7-digit VIN, so this is them fulfilling the requirement that they must "accompany [the car] with the complete corresponding machine-readable source code". It is all in the meaning of "accompany it": giving the source code physically along with the keys when you purchase the car, or offering a source code download link. I would argue that either option is compliant with the GPL, so to me it seems BMW is in the right.

Edit: s/IBM/BMW/

(I think you meant BMW, not IBM...)

BMW VIN must be longer than 7 digits.... IBM product license serial numbers at 7 digits would make more sense.

Yes, VIN numbers are 17-characters long, but only the last 7 characters are unique, called "sequential number".[1] The first 10 characters are composed of make, model, year etc.

[1] https://en.wikipedia.org/wiki/Vehicle_identification_number

BMW only ever cares about the last 7 digits of your VIN, as demonstrated on their iDrive software update page:

http://www.bmw.com/update

(an example code would be "J123456")

Did you see any source code in that firmware download? I'm not an expert, but it looked to me like a lot of compiled binaries.

Read option B more carefully.

The requirement is NOT that you have to give out source code to anyone who asks. It is that the written offer you give out can be used by anyone. Did BMW hand out a written offer with the car that says how to get source code? If so, then it is fine if that offer requires you to enter a piece of information like a VIN.

BMW is under no obligation to hand out written offers to random strangers. You'll have to find someone who bought a car to get an offer.

Now why would BMW set things up this way? Well it is unlikely that all cars have the same exact source code. So without the VIN, BMW doesn't even know which copy to give you! So what are they going to do when someone shows up, is rude, clearly doesn't have the offer in hand, and then demands source code? Apparently they are going to tell him that he needs a VIN.

Let D be the distributor, C be their customer, and T be a third party. The language of 3(b) says that D must give C a written offer to distribute the source to any T. I don't see anything in it that says T has to have a copy of the offer.

It says "any third party", and unless there is something in the license that restricts this I'd expect a court to go with the normal meanings of "any" any "third party".

The GPL FAQ agrees with my reading, saying that "If you choose to provide source through a written offer, then anybody who requests the source from you is entitled to receive it" [1].

I'd say that requiring the VIN number in order to identify which software to provide source for is reasonable and would be allowed by the license.

[1] http://www.gnu.org/licenses/gpl-faq.en.html#WhatDoesWrittenO...

I think we are in agreement, but let me verify.

The scenario I outlined does not require possession of the written offer to get source code. Possession of the knowledge in it, yes. But not possession of the offer. In particular it is reasonable to require you to know that you have to provide a VIN number to get the software. It is also reasonable for you to know what number to call, or address to send, or fee to pay, or even what to say to get to someone knowledgeable enough to have a chance of answering your questions.

In fact this email thread said that there is a website where you can enter the VIN and get the source code. I doubt it validates that you are who you say you are. If that website is world readable, I'd say that the GPL is satisfied.

(The email thread also made it clear that the people who responded from BMW Australia didn't themselves understand the license. But that is no surprise for an odd request of random people in a big company.)

I agree the VIN thing is a red herring. Seems to me the bigger problem is this (emphasis mine):

"I have confirmed with our technical department who advised that to access the software download site the BMW Customer must provide the 7 digit VIN and accept the usage rights agreement. Part of the usage rights agreement states that the software is protected by copyright and BMW is the sole owner. So in this case it is not subject to the requirements of a "Public" licence."

They're denying that their software is even GPL and imposing extra restrictions on use. That's a problem, if it does indeed include GPL code.

No, the offer for source must be to anyone -- the supply of a binary may be limited. BMW cannot be the "sole owner" of the copyright -- even if they own the part they wrote, they must still supply source for the GPL parts.

"the GPL requires you to make the modified source code available to the program's users"

Source: https://www.gnu.org/licenses/gpl-faq.en.html#GPLRequireSourc...

BMW does not have to provide the sources to everybody. Only to its users.

edit: tzs also has a point. Hm?

I was also under that impression as well, but from that same page you posted:

https://www.gnu.org/licenses/gpl-faq.en.html#WhatDoesWritten...

Which sounds like if you didn't provide the source with the program up front then you're required to give it to anyone that asks since they may have received the program indirectly.

> since they may have received the program indirectly.

Which is rarely possible for a car OS, honestly.

Really? I would consider it to be quite common, given the prevalence of used cars.

Which would be direct, not indirect. You are in possession of the vehicle, with the legal standing of an owner.

People buying used cars is pretty common...

And also direct.

In that case you have the car, and the VIN – and received the software directly.

Please specify a use case where you received the software without the VIN, thanks.

Does the intention behind some GPL clause matter or how some court would interpret the text?

For a court the intention very much matters – in case of doubt, the court will always resort to interpreting the intention.

At least in Germany – and BMW is German.

I only tweeted the refusal after several verbal attempts to speak to someone in legal. My preferred approach - as it was when I dealt with Telstra over a similar issues - is to find the right person and sort things out with them.

BMW Australia, however, were quite hostile, refused to let me speak to anyone in legal, and told me verbally that I'd have to sue them in order for them to release the code to their customers.

I'm much less inclined to spend time resolving things smoothly and quietly at that point.

it is very dubious whether he has any standing to request the source code

That may be, but this tidbit is somewhat alarming to me:

[the user must] accept the usage rights agreement. Part of the usage rights agreement states that the software is protected by copyright and BMW is the sole owner

There's two red flags here for me:

- asserting copyright through an EULA

- additional "licensing" requirements for obtaining the source code