Hacker News Reader

Comment by jasode | Hacker News Reader

The relevant text from the linked pdf[1]:

>Article 14.17: Source Code

>1. No Party shall require the transfer of, or access to, source code of software owned by a person of another Party, as a condition for the import, distribution, sale or use of such software, or of products containing such software, in its territory.

>2. For the purposes of this Article, software subject to paragraph 1 is limited to mass-market software or products containing such software and does not include software used for critical infrastructure.

>3. Nothing in this Article shall preclude: (a) the inclusion or implementation of terms and conditions related to the provision of source code in commercially negotiated contracts;

To point (1), the text seems like something Steve Ballmer would write to because "GPL is a cancer".

To point (2), I wonder if "GNU gcc" is considered "mass-market" or "infrastructure".

To point (3), I assume that proprietary software users will want the most narrow definition of "commercially negotiated contracts". This means reading the LICENSE.TXT that states "copyleft" and downloading from github is definitely not a "contract". Therefore, copyleft would be null & void.

[1] http://dfat.gov.au/trade/agreements/not-yet-in-force/tpp-11/...

View on HN

I'd want to get an international law expert's take on this before getting too worried.

Based on skimming the preamble, it looks to me like "Party" is capitalized to indicate that, within the context of this document, Party has a very specific meaning: One of the nation-states that has entered into this trade agreement.

If that's a correct reading, then this might have some unintended consequences around government open source projects, but, since it isn't trying to place any restrictions on anyone who isn't a nation-state, it wouldn't be that much of a threat to copyleft in general.

I think what it's really trying to say is, "You can't pass laws saying overseas companies have to share their source code if they want to sell software or SaaS in your country."

>I think what it's really trying to say is, "You can't pass laws saying overseas companies have to share their source code if they want to sell software or SaaS in your country."

Your interpretation seems reasonable. I'm guessing OSIA and the Linux Journal are interpreting it like this:

>No Party (e.g. GNU GCC) shall require the transfer of, or access to, source code of software owned by a person of another Party (e.g. Australia Atlassian), as a condition for the import, distribution, sale or use of such software (e.g. GCC), or of products containing such software (e.g. GCC), in its territory.

The "such software" is misinterpreted as referring back to a hypothetical "GCC" instead of "Atlassian".

Your interpretation would be more like:

>No Party (e.g. USA) shall require the transfer of, or access to, source code of software owned by a person of another Party (e.g. Australia Atlassian), as a condition for the import, distribution, sale or use of such software (e.g. Atlassian), or of products containing such software (e.g. Atlassian), in its territory.

With that interpretation, the text is a response against China and Russia demanding source code from USA and European tech companies. E.g. https://www.google.com/search?q=china+russia+import+share+so...

If so, the worry would be whether countries would use the ambiguous wording of CPTPP as a way to ignore copyleft. Ignoring GCC's license wasn't the intention but it becomes the side effect. Organizations like GNU don't have an army of expensive lawyers to fight companies in Australia, etc. I have no idea if this "abuse" of CPTPP is a realistic concern.

My understanding (granted, second-hand from international copyright law experts) is that this is the correct interpretation: Microsoft does not want Chinese or Russian governments demanding the source code of Windows. I'm extremely skeptical of the Linux Journal's claims here.

As per usual in international trade agreements, this provision merely codifies the present status quo. There's no reason to expect that it will affect the GPL.

> If so, the worry would be whether countries would use the ambiguous wording of CPTPP as a way to ignore copyleft. Ignoring GCC's license wasn't the intention but it becomes the side effect. Organizations like GNU don't have an army of expensive lawyers to fight companies in Australia, etc. I have no idea if this "abuse" of CPTPP is a realistic concern.

How is it ambiguous? The treaty contains a definition of "Party":

> Party means any State or separate customs territory for which this Agreement is in force;

To argue that this means that GNU cannot enforce the GPL would be to argue that GNU is a state or a customs territory that signed the treaty.

>How is it ambiguous? The treaty contains a definition of "Party"

I'm guessing it's because "commercially negotiated contract" in subsection 3a seems to use another (inferred) meaning of "party" such as a commercial business and not a country. (Text is "a person of another Party".) So one side of that "contract" is not a country. (E.g. Microsoft Windows is not the USA.)

>To argue that this means that GNU cannot enforce the GPL would be to argue that GNU is a state

Since CPTPP is a trade agreement, maybe an analogy is the NAFTA trade agreement[1]. Even though Boeing is not a signatory on the treaty, the USA signed it so Boeing is prohibited from certain practices with Canada and Mexico. Although "party" is literally defined as "country", it applies to the businesses in within a country.

[1] https://www.italaw.com/sites/default/files/laws/italaw6187%2...

> "commercially negotiated contract" in subsection 3a seems to use another (inferred) meaning of "party" such as a commercial business and not a country. (Text is "a person of another Party".)

It's the same definition. "A person of another Party" is "a person from another country."

And note that because it says 'person' and not 'natural person', it includes corporations.

ie. "Boeing" is the person and "USA" is the Party.

The text forbids parties (i.e., countries) from requiring source code disclosure as a condition of sale. It does not forbid persons (e.g., GNU) from requiring source code disclosure as a condition of sale. (It should be noted that it also doesn't forbid countries from tendering a contract proposal that requires source code disclosure in the contract).

I'm going a bit of a limb here in applying SCOTUS principles to how to read law, as we're not talking about US jurisdiction, but since Australia is also a common law country, I'd assume that the principles are basically the same. One basic principle of determining different interpretations is that you have to ask "is there a clearer way to write this interpretation?" If the intent of the treaty were to make copyleft unenforceable, the text included would be along the lines of "No party shall permit a person to require the disclosure of source code." Indeed, if you read some of the other articles in that chapter, there is actually text that says "No party shall require a covered person..." This does signal that there is intent that the text of Article 14.17 apply onto the government and not to the general public within a country.

> If the intent of the treaty were to make copyleft unenforceable,

I think the consensus is that is not the intent. The OSIA and Linux Journal concern is the unintended alternative interpretation of the text.

I explained how SCOTUS would explain what the text means under the guideline of legislative intent (you'd probably arrive at the same conclusion under the principle of plain meaning). Legislative intent is explicitly trying to understand what a law means by understanding what the legislature intended it to mean, so whatever funky definition the OSIA and Linux Journal comes up is completely and totally irrelevant under that standard.

I don't know the jurisprudence of Australian law to understand how Australian courts would interpret the text, but I would honestly be surprised if OSIA's purported interpretation were accepted.

> Text is "a person of another Party"

That just means "foreigner".

> Although "party" is literally defined as "country", it applies to the businesses in within a country.

What "it"? The NAFTA could certainly have requirements from signatory states to implement certain laws, and when such laws are implemented, of course they would apply to Boeing or any other US company. But I don't think NAFTA itself would apply directly.

Let's be honest, China a Russia simply steal the code anyways.

Here's how it will go down: China will steal GCC from GNU. Turns out the GNU people are really bad at guarding their Property. Then Russia steals GCC from China to demand ransom. Redhat will pay, it's their business after all. Bad times ahead I tell you...

I wonder why LJ would consider GNU a party to the CPTPP? They certainly didn't sign it.

> I think what it's really trying to say is, "You can't pass laws saying overseas companies have to share their source code if they want to sell software or SaaS in your country."

This is terrifying. Foreign-made self-driving cars can deliberately kill people via software algorithms, and even the government can't insist on seeing the source code to find out whether the car maker is incompetent or malicious.

I see nothing to suggest that this provision would prohibit a subpoena.

There’s a difference between requiring source code as a precondition for selling and stopping sales of a product on documented safety concerns and requiring participation in an investigation to resume sales. It’s down to whether the law is correctly written to distinguish the two.

Personally, I'd much prefer proactive auditing (i.e. requiring source code) over waiting until someone is injured and possibly killed to launch an investigation.

Transparency is a dependency of trust. There's no going around that. If a product is not transparent, then it is not trustworthy, period. I'm not at all inclined to wait for something to violate my trust further before demanding a prerequisite for that trust. Governments shouldn't be so inclined, either, especially when it comes to human safety.

I'd also like that, but even today there is lots of software that can kill people if it contains bugs. It is usually enough that the makers can prove that they followed some process like EN50128. Source code is not required. I don't think there are competent people available for auditing source code.

I agree. I just don't think we should collectively allow companies to hide their source code and still be considered trustworthy.

— especially for innovative safety algorithms that could save the lives of their competitors' customers, if only the code was reusable.

Competent auditors will emerge if there's demand. There were once no competent astronauts!

"I don't think there are competent people available for auditing source code."

Probably not, but by requiring companies to disclose source code on request, effective independent audit of that code is merely improbable versus effectively impossible.

I'd rather have an algorithm deliberately kill someone 1 in 1,000 cases than have distraction, negligence, and poor reaction times of a human driver accidentally kill someone 1 in 100.

Hypothetical example:

Entities in Country A provide entities in Country B with software for, say, self-driving cars. Such cars become sufficently popular in Country B. ("Sufficiently" being read as numerous enough for the next step to become important.)

Country A and Country B come into conflict. Potential causes: resources (oil, fresh water, rare earths, whatever), ideology, etc.

Country A uses its legal (and extra-legal) powers to force the entities providing said software to push out an over-the-air update of the software. When Country A flips a switch, the self-driving cars begin moving offensively, attempting to kill passengers and pedestrians and jam the road infrastructure, doing as much economic and political damage as possible. (Whoo; suppose they target specific people and infrastructure.)

It's an entertaining scenario for your favorite TV series or something, but possibly more troubling for software controlling information networks or the power grid. And the proof-of-concept of such an attack has already been shown to be successful.

P.S. We are both assuming that self-driving cars are better than human-driven cars, which fact is not currently in evidence.

Possible issues with your ideas:

- false numbers, similar with Tesla PR where they use bad statistics to prove their system is safer

- too general statistics for your situation, say car X is safer then human globally but locally in your region humans are much safer, will you send your children with car X where is probably not safer then average human(including drunks, teens and tired people)

- say car X is super safe, so you allow them to kill some people deliberately because they saved lives, so CEO of X hates people from a specific group(say gun owners, or teachers, or developers) so he decides that on 13 every month 666 people will be sacrificed

The first and third examples are fraud. These have nothing to do with the proposed issue anymore than someone falsifying that a plane can fly (for whatever guidelines a jurisdiction uses to govern that). The third is subtle because it's not 1 in 1000 (randomly) but 1 in N-members of 1000, making it not in 1/1000.

How can you discover this fraud? If the proprietor says these are horrible unrelated accidents and they promise they're working hard to fix the problem, how can you find out the truth if you can't audit the code?

> If that's a correct reading, then this might have some unintended consequences around government open source projects

Restrictions on states in treaties also restrict their judiciary and their executive in enforcing judicial acts, not just acts taken in running the government administration. So, if the terms conflicted with what the state must do to give effect to enforcemrnt of open source licenses, it would make them unenforceable even if it doesn't prohibit private parties from offering and accepting them.

The third clause explicitly states "Nothing in this Article shall preclude: (a) the inclusion or implementation of terms and conditions related to the provision of source code in commercially negotiated contracts;"

That is to say, the article is explicitly not prohibiting countries from enforcing copyleft licenses.

Most copyleft licenses are not, in the manner normally entered into, “commercially negotiated contracts”, and many are gratuitous licenses, not contracts at all.

Licenses are contracts, legally speaking.

No, they aren't. Licenses are legal permission, which may either be unilateral and gratuitous with no exchange, or mutual as a (part of a) contract.

Does anyone have a link to a chapter where they define that term?

>Party means any State or separate customs territory for which this Agreement is in force;

https://www.mfat.govt.nz/assets/Trans-Pacific-Partnership/Te...

There's nothing to see here. "Party" (capitalized) and "person of a Party" have specific meanings in this document, as defined in the definitions section:

"Party means any State or separate customs territory for which this Agreement is in force;"

"person of a Party means a national or an enterprise of a Party;"

(Chapter 1, Section A, Article 1.3, [0])

So the statement "No Party shall require the transfer of..." restricts what a State that signed the treaty may do to the persons and enterprises of another State. For example, China can't require Microsoft to disclose its source code as a condition to selling Windows in China.

Regarding the other quote about contracts, the operative part is "Nothing in this Article shall preclude". So this treaty has no effect on terms regarding source code in commercially negotiated contracts. Even if you are of the misguided belief that FOSS licenses are contracts, this provision does not affect them.

Finally, FOSS licenses are not contracts because they do not contain bargained-for reciprocal promises. They are grants of rights, subject to terms and conditions. A FOSS license operates as a defense against copyright infringement. If the terms and conditions are not met, then the license is void. The infringer can then be sued for copyright infringement, not breach of contract. This has two important implications: (1) a court won't order specific performance (a contract remedy) in a case of copyright infringement, and (2) a third party has no standing to sue, because where there is no contract there can't be a third-party beneficiary (only the rights-holder may sue).

[0] http://dfat.gov.au/trade/agreements/not-yet-in-force/tpp-11/...

(Edit: Clarified lack of breach of contract claim.)

I don't think it really changes anything, but there have been cases where the GPL has been considered a contract. https://perens.com/2017/05/28/understanding-the-gpl-is-a-con...

No. Even in that case, the GPL wasn’t considered a contract. There was an open offer to anyone, essentially, “If you’d like to use this software, either buy a commercial license or abide by the terms of the GPL.” The defendant accepted the offer by using the software and proclaiming that it would meet the terms of the GPL. That offer and acceptance created a contract. So, the GPL wasn’t the contract itself, but provided the terms for the offeree’s performance.

To be a bit more accurate, the judge’s decision was only on a motion to dismiss. So, he didn’t actually decide that there was a contract, he decided that if you assume that plaintiff’s assertions are true, then there could have been a contract. That allows the case to continue.

The other linked case, MedioStream v. Microsoft, doesn't seem to be based on any other offer. It's also a denial of a motion to dismiss, though.

This phrasing may be slightly deceptive, but in this instance the word "Party" specifically refers to the countries (and/or their respective government) signing this agreement.

All in all, it only says that a government cannot demand the source code to a piece of software that is being exported from another country. Although, they can still force a software developer in their own country to give up the source code to a piece of software. It goes on to add some exceptions but is otherwise very inconsequential.

I am not a lawyer, but this a paraphrasing of an explanation given to me by someone who is a copyright/securities lawyer in one of the member countries (Canada).

How does one specialize in both copyright _and_ securities law? I could understand copyright and real estate or securities and corporate law, but that seems to be a novel pairing.

The 11 countries who signed (many still need to ratify the treaty). Alphabetical order:

1. Australia

2. Brunei

3. Canada

4. Chile

5. Japan (already ratified)

6. Malaysia

7. Mexico (already ratified)

8. New Zealand

9. Peru

10. Singapore

11. Vietnam

Much of the terms of this treaty were negotiated behind closed doors with "industry leaders" (large corporate interests) invited to attend.

> Much of the terms of this treaty were negotiated behind closed doors with "industry leaders" (large corporate interests) invited to attend.

In other words: Business as usual.

I wish people would stop wanting to micromanage their governments. Some things, like negotiation, military planning, or crime investigation don't work when all their details are made public as they happen. Trade deals are never secret once they're completed so it's not a cover-up. You elect leaders who you believe will work in your interests and leave them to get the job done. If they do it wrong, you can unelect them or their whole party next time. This actually happened in America when people didn't like the TPP that Obama agreed to behind closed doors and they elected Trump who withdrew from it.

Why is it so important to have business input into treaties but not important to have consumer input?

What if we want to hold government accountable?

With all due respect to the average consumer (including myself), I don't think their input is particularly valuable. They want lower prices for goods and for people not to be laid off. I don't think the average consumer has much to offer on Vietnamese shrimp subsidies and their effect on the global supply chain. Getting input from businesses doesn't mean blindly following them, but they do have a lot of information to offer.

It will be ratified in Canada without a doubt. The negotiations spanned both Liberal and Conservative governments, and the public wants contingency plans for US trade disruptions. Trump has made very clear that he does not value free trade with Canada, and his threat to dissolve NAFTA is a serious one. Expanded trade with Europe (CETA) and the Pacific Rim (CPTPP) would strengthen Canada's negotiating position by reducing our dependency on the United States.

It's fortunate that the United States left the TPP. They were the ones demanding draconian intellectual property laws. With the US gone, the worst clauses could be removed and the agreement was greatly improved.

The full text has been public for a while now. I'm not a fan of everything in there, but the good outweighs the bad. Linux Journal's concerns are based on a misunderstanding.

I don't see how this has anything to do with license enforcement at all. It only means participating countries can't block the import of closed-source software.

At first glance, text like this may have been included to prevent countries from attempting to claw source code from closed-source software and cloud vendors.

It would appear to be troublesome, at a minimum, for copyleft projects, too.

How would a country claw source code from a vendor in another nation, if they did not sign this agreement? File a lawsuit?

I suppose the most common method is to seize assets or personnel that are located in-country.

As the provision above states: "as a condition for the import, distribution, sale or use of such software, or of products containing such software, in its territory."

A country could state simply: If we can't audit your code, you can't import, distribute, sell, or use it in our country. See: United States vs. ZTE for a hardware example.

> How would a country claw source code from a vendor in another nation, if they did not sign this agreement?

By making it a condition of allowing imports of the product, which is why that's exactly what the provision prohibits.

And why is that so bad? A nation should be allowed to enforce laws to know the source code of its software because otherwise backdoors could kick in at some point, and other nasty stuff.

Such a requirement has positives and negatives, which are dependent upon point of view.

From the position of a free-trade agreement, it would be a statement of trust. We trust you enough to be our partner that we won't attempt to claw open your citizens' code if, in return, you don't do so to our citizens' code.

Entering such an agreement might be unwise, should a counterparty turn out to be disreputable or irresponsible.

Just like private citizens, a nation should also be allowed to enter into contracts where all the parties agree not to do things to each other that none of them want to have done to themselves.

You are simply describing the concept of a mutually symmetric contract. I think everybody here understands that concept.

Nations should also decide in a way that is representative of the desire of the population.

Perhaps the population thinks the following:

"Just like private citizens, a nation should also be allowed to enter into contracts where all the parties agree not to do things [commit cyber crime/negligence hidden behind the veil of closed source software] to each other that none of them want to have done to themselves."

Certain countries (China) have used this as a way to gain access to technologically advanced source code. They then turn around and share that code to domestic industry so that they can develop competing products that blatantly rip off the foreign companies.

I like that improvements in code are available to everyone.

Why not? Collaboration is far superior to competition as you can see Wikipedia beating Britannica and so on.

We just criticize it using our current capitalistic paradigm.

You are confusing open source with theft. I never said that China was open-sourcing the code, I said they are misappropriating it and giving it to specific Chinese companies. And, they certainly aren’t mandating that the Chinese companies return their improvements to the commons, or even to the company they stole from.

It says "no Party" - does it mean this only binds the signatories of the treaty - which probably are countries and not individual developers? And if so, I would read it as "we promise there will be no state law to mandate all software in the country be open-source" which seems to be reasonable (even though I never heard about any country trying to pass such a law anyway) not "open source licenses are un-enforceable". Also, it says "owned by person of another Party", so it's mostly even "we promise no import/export bans on non-open-source software", and the intra-governmental actions are not even discussed, only cross-governmental ones. Also (3) says if the government negotiates contracts, it still can require the software to be open-source, it just can't have blanket ban on non-open-source software imports altogether.

Am I misreading it or misunderstanding what "Party" means?

Point (3a) seems to be explicitly protecting copyleft. A copyleft license is basically (IANAL) a commercially negotiated contract. It just happens that the negotiations are trivial: the licensor will accept one set of conditions or no deal.

More generally, it would seem very out of form for a free-trade deal to include provisions that undermine the freedom of contracts. Contracts are an important part of capitalism, after all.

> Point (3a) seems to be explicitly protecting copyleft. A copyleft license is basically (IANAL) a commercially negotiated contract. It just happens that the negotiations are trivial: the licensor will accept one set of conditions or no deal

You could just as validly say the same thing about pretty much all mass-market software. Replace "copyleft license" with "terms of service" or "end user license agreement".

It's hard to think of any mass-market software that would not be covered under that interpretation, which is a strong hint that the interpretation cannot be right.

What I believe (3a) is trying to cover cases where a Party (e.g., Australia) is acquiring software for its own use. For instance, suppose Australia wanted to use AgileBits' 1Password [1] on all the government's desktop computers.

1Password is mass-market software, and this treaty would prohibit Australia from requiring that AgileBits make the source available as a condition of selling to consumers in Australia.

But if Australia negotiates a deal with AgileBits to supply Australia's government istself with 1Password, rather than the government simply buying it the same way consumers would, (3a) applies and the treaty does not apply.

[1] Picked for this example because it is the only well-known mass market software that I could think of offhand that (1) a government might reasonably want to mass deploy internally, and (2) is owned by a company that is in a country (Canada) that will be a Party to this treaty.

> This means reading the LICENSE.TXT that states "copyleft" and downloading from github is definitely not a "contract".

It's possibly a contract, but it is clearly not “commercially negotiated”, it's a contract (if at all) of adhesion.

My understanding is that a license is not a contract, but simply permission from one party to do something. A license can be part of a contract e.g., when a license is provided in exchange for money. However, if I just plonk an open source license on a bit of software I wrote, there's no contract with anybody.

It's unlikely that invalidating an open source license would be of benefit to a user, since they then have no legal right to make copies of the software.

I believe the FSF has argued that the GPL is not a contract in order to defend against specifically this problem. Without the GPL, the recipient has no license to redistribute the software. Presumably, that couldn't be enforced in the countries under the treaty, but they would have problems distributing things outside those countries.

I don't think you need to take "the most narrow definition" of a contract to think that LICENSE.TXT doesn't qualify. Especially when you add the modifier "commercially negotiated" to it. I played no role in negotiating GPL.

Who the hell has ever been in a position to demand the source code to mass-market software as a condition of its use?

"I demand the full, buildable source to MS Outlook before accepting this meeting request!"

Still, does making this type of demand have to be made against the law?

Countries with highly regulated economies dominated by state-run businesses will often make this a condition of winning a government contract. In the sense of, if you want to provide the OS and productivity suite to all of our government offices, you must hand over the source code for “inspection”. When the contract is re-bid in 10 years, you lose out to the new government-owned software company,

For what purpose were these items added? It looks like a direct attack on open source otherwise.

it's to stop countries requiring companies from releasing their source code as a condition of use in their countries

So these aren't accidental consequences of provisions meant to address some other issue. These are specifically designed to attack GPL and other copy-left licenses.

Who is behind this antipathy to copyleft? I wasn’t aware it was on the radar of the sorts of entities involved in writing international trade agreements.

They seem on the surface to be designed to attack “source code as a condition of import license” laws,

The original intent was inspired (I think) by countries like China demanding the source code to Windows as a condition of it use in their country. GPL is just collateral damage due to (a) politicians being almost completely ignorant about everything technological, and (b) the whole thing being negotiated in secret with no input.

When you put (a) and (b) together, it seems like a miracle if the whole thing is not a disaster.

Reply on news.ycombinator.com