Hacker News Reader

Comment by bunderbunder | Hacker News Reader

I'd want to get an international law expert's take on this before getting too worried.

Based on skimming the preamble, it looks to me like "Party" is capitalized to indicate that, within the context of this document, Party has a very specific meaning: One of the nation-states that has entered into this trade agreement.

If that's a correct reading, then this might have some unintended consequences around government open source projects, but, since it isn't trying to place any restrictions on anyone who isn't a nation-state, it wouldn't be that much of a threat to copyleft in general.

I think what it's really trying to say is, "You can't pass laws saying overseas companies have to share their source code if they want to sell software or SaaS in your country."

View on HN

>I think what it's really trying to say is, "You can't pass laws saying overseas companies have to share their source code if they want to sell software or SaaS in your country."

Your interpretation seems reasonable. I'm guessing OSIA and the Linux Journal are interpreting it like this:

>No Party (e.g. GNU GCC) shall require the transfer of, or access to, source code of software owned by a person of another Party (e.g. Australia Atlassian), as a condition for the import, distribution, sale or use of such software (e.g. GCC), or of products containing such software (e.g. GCC), in its territory.

The "such software" is misinterpreted as referring back to a hypothetical "GCC" instead of "Atlassian".

Your interpretation would be more like:

>No Party (e.g. USA) shall require the transfer of, or access to, source code of software owned by a person of another Party (e.g. Australia Atlassian), as a condition for the import, distribution, sale or use of such software (e.g. Atlassian), or of products containing such software (e.g. Atlassian), in its territory.

With that interpretation, the text is a response against China and Russia demanding source code from USA and European tech companies. E.g. https://www.google.com/search?q=china+russia+import+share+so...

If so, the worry would be whether countries would use the ambiguous wording of CPTPP as a way to ignore copyleft. Ignoring GCC's license wasn't the intention but it becomes the side effect. Organizations like GNU don't have an army of expensive lawyers to fight companies in Australia, etc. I have no idea if this "abuse" of CPTPP is a realistic concern.

My understanding (granted, second-hand from international copyright law experts) is that this is the correct interpretation: Microsoft does not want Chinese or Russian governments demanding the source code of Windows. I'm extremely skeptical of the Linux Journal's claims here.

As per usual in international trade agreements, this provision merely codifies the present status quo. There's no reason to expect that it will affect the GPL.

> If so, the worry would be whether countries would use the ambiguous wording of CPTPP as a way to ignore copyleft. Ignoring GCC's license wasn't the intention but it becomes the side effect. Organizations like GNU don't have an army of expensive lawyers to fight companies in Australia, etc. I have no idea if this "abuse" of CPTPP is a realistic concern.

How is it ambiguous? The treaty contains a definition of "Party":

> Party means any State or separate customs territory for which this Agreement is in force;

To argue that this means that GNU cannot enforce the GPL would be to argue that GNU is a state or a customs territory that signed the treaty.

>How is it ambiguous? The treaty contains a definition of "Party"

I'm guessing it's because "commercially negotiated contract" in subsection 3a seems to use another (inferred) meaning of "party" such as a commercial business and not a country. (Text is "a person of another Party".) So one side of that "contract" is not a country. (E.g. Microsoft Windows is not the USA.)

>To argue that this means that GNU cannot enforce the GPL would be to argue that GNU is a state

Since CPTPP is a trade agreement, maybe an analogy is the NAFTA trade agreement[1]. Even though Boeing is not a signatory on the treaty, the USA signed it so Boeing is prohibited from certain practices with Canada and Mexico. Although "party" is literally defined as "country", it applies to the businesses in within a country.

[1] https://www.italaw.com/sites/default/files/laws/italaw6187%2...

> "commercially negotiated contract" in subsection 3a seems to use another (inferred) meaning of "party" such as a commercial business and not a country. (Text is "a person of another Party".)

It's the same definition. "A person of another Party" is "a person from another country."

And note that because it says 'person' and not 'natural person', it includes corporations.

ie. "Boeing" is the person and "USA" is the Party.

The text forbids parties (i.e., countries) from requiring source code disclosure as a condition of sale. It does not forbid persons (e.g., GNU) from requiring source code disclosure as a condition of sale. (It should be noted that it also doesn't forbid countries from tendering a contract proposal that requires source code disclosure in the contract).

I'm going a bit of a limb here in applying SCOTUS principles to how to read law, as we're not talking about US jurisdiction, but since Australia is also a common law country, I'd assume that the principles are basically the same. One basic principle of determining different interpretations is that you have to ask "is there a clearer way to write this interpretation?" If the intent of the treaty were to make copyleft unenforceable, the text included would be along the lines of "No party shall permit a person to require the disclosure of source code." Indeed, if you read some of the other articles in that chapter, there is actually text that says "No party shall require a covered person..." This does signal that there is intent that the text of Article 14.17 apply onto the government and not to the general public within a country.

> If the intent of the treaty were to make copyleft unenforceable,

I think the consensus is that is not the intent. The OSIA and Linux Journal concern is the unintended alternative interpretation of the text.

I explained how SCOTUS would explain what the text means under the guideline of legislative intent (you'd probably arrive at the same conclusion under the principle of plain meaning). Legislative intent is explicitly trying to understand what a law means by understanding what the legislature intended it to mean, so whatever funky definition the OSIA and Linux Journal comes up is completely and totally irrelevant under that standard.

I don't know the jurisprudence of Australian law to understand how Australian courts would interpret the text, but I would honestly be surprised if OSIA's purported interpretation were accepted.

> Text is "a person of another Party"

That just means "foreigner".

> Although "party" is literally defined as "country", it applies to the businesses in within a country.

What "it"? The NAFTA could certainly have requirements from signatory states to implement certain laws, and when such laws are implemented, of course they would apply to Boeing or any other US company. But I don't think NAFTA itself would apply directly.

Let's be honest, China a Russia simply steal the code anyways.

Here's how it will go down: China will steal GCC from GNU. Turns out the GNU people are really bad at guarding their Property. Then Russia steals GCC from China to demand ransom. Redhat will pay, it's their business after all. Bad times ahead I tell you...

I wonder why LJ would consider GNU a party to the CPTPP? They certainly didn't sign it.

> If that's a correct reading, then this might have some unintended consequences around government open source projects

Restrictions on states in treaties also restrict their judiciary and their executive in enforcing judicial acts, not just acts taken in running the government administration. So, if the terms conflicted with what the state must do to give effect to enforcemrnt of open source licenses, it would make them unenforceable even if it doesn't prohibit private parties from offering and accepting them.

The third clause explicitly states "Nothing in this Article shall preclude: (a) the inclusion or implementation of terms and conditions related to the provision of source code in commercially negotiated contracts;"

That is to say, the article is explicitly not prohibiting countries from enforcing copyleft licenses.

Most copyleft licenses are not, in the manner normally entered into, “commercially negotiated contracts”, and many are gratuitous licenses, not contracts at all.

Licenses are contracts, legally speaking.

No, they aren't. Licenses are legal permission, which may either be unilateral and gratuitous with no exchange, or mutual as a (part of a) contract.

Does anyone have a link to a chapter where they define that term?

>Party means any State or separate customs territory for which this Agreement is in force;

https://www.mfat.govt.nz/assets/Trans-Pacific-Partnership/Te...

> I think what it's really trying to say is, "You can't pass laws saying overseas companies have to share their source code if they want to sell software or SaaS in your country."

This is terrifying. Foreign-made self-driving cars can deliberately kill people via software algorithms, and even the government can't insist on seeing the source code to find out whether the car maker is incompetent or malicious.

I see nothing to suggest that this provision would prohibit a subpoena.

There’s a difference between requiring source code as a precondition for selling and stopping sales of a product on documented safety concerns and requiring participation in an investigation to resume sales. It’s down to whether the law is correctly written to distinguish the two.

Personally, I'd much prefer proactive auditing (i.e. requiring source code) over waiting until someone is injured and possibly killed to launch an investigation.

Transparency is a dependency of trust. There's no going around that. If a product is not transparent, then it is not trustworthy, period. I'm not at all inclined to wait for something to violate my trust further before demanding a prerequisite for that trust. Governments shouldn't be so inclined, either, especially when it comes to human safety.

I'd also like that, but even today there is lots of software that can kill people if it contains bugs. It is usually enough that the makers can prove that they followed some process like EN50128. Source code is not required. I don't think there are competent people available for auditing source code.

I agree. I just don't think we should collectively allow companies to hide their source code and still be considered trustworthy.

— especially for innovative safety algorithms that could save the lives of their competitors' customers, if only the code was reusable.

Competent auditors will emerge if there's demand. There were once no competent astronauts!

"I don't think there are competent people available for auditing source code."

Probably not, but by requiring companies to disclose source code on request, effective independent audit of that code is merely improbable versus effectively impossible.

I'd rather have an algorithm deliberately kill someone 1 in 1,000 cases than have distraction, negligence, and poor reaction times of a human driver accidentally kill someone 1 in 100.

Hypothetical example:

Entities in Country A provide entities in Country B with software for, say, self-driving cars. Such cars become sufficently popular in Country B. ("Sufficiently" being read as numerous enough for the next step to become important.)

Country A and Country B come into conflict. Potential causes: resources (oil, fresh water, rare earths, whatever), ideology, etc.

Country A uses its legal (and extra-legal) powers to force the entities providing said software to push out an over-the-air update of the software. When Country A flips a switch, the self-driving cars begin moving offensively, attempting to kill passengers and pedestrians and jam the road infrastructure, doing as much economic and political damage as possible. (Whoo; suppose they target specific people and infrastructure.)

It's an entertaining scenario for your favorite TV series or something, but possibly more troubling for software controlling information networks or the power grid. And the proof-of-concept of such an attack has already been shown to be successful.

P.S. We are both assuming that self-driving cars are better than human-driven cars, which fact is not currently in evidence.

Possible issues with your ideas:

- false numbers, similar with Tesla PR where they use bad statistics to prove their system is safer

- too general statistics for your situation, say car X is safer then human globally but locally in your region humans are much safer, will you send your children with car X where is probably not safer then average human(including drunks, teens and tired people)

- say car X is super safe, so you allow them to kill some people deliberately because they saved lives, so CEO of X hates people from a specific group(say gun owners, or teachers, or developers) so he decides that on 13 every month 666 people will be sacrificed

The first and third examples are fraud. These have nothing to do with the proposed issue anymore than someone falsifying that a plane can fly (for whatever guidelines a jurisdiction uses to govern that). The third is subtle because it's not 1 in 1000 (randomly) but 1 in N-members of 1000, making it not in 1/1000.

How can you discover this fraud? If the proprietor says these are horrible unrelated accidents and they promise they're working hard to fix the problem, how can you find out the truth if you can't audit the code?

Reply on news.ycombinator.com