open source and classified software

[Kevin Buettner]

On Nov 13, 12:23pm, Michael Sheldon wrote:

> >>The GPL requires that
> you make the source code available to those to whom you distribute
> this analysis software.  That may or may not be acceptable depending
> upon the security clearances of those ultimately using the software. <<
> 
> This may not actually be an issue. As far as the govt. is concerned,
> individual users are not "distributed to", the agency is the one to whom the
> app is distributed. (It's not the end-user's computer, it's the agency's.)
> Therefore, the agency would have to have access to the code. But then, since
> they're the ones who modded it, that's not really a problem, is it? :)

As I said in my original message, it is probably best to get a legal
opinion on this.  What you say does make a certain amount of sense,
but I think there are gray areas.  E.g, suppose media containing
binaries of the software in question is provided to the agency's
employees to install on their workstations.  Is this not a form of
distribution?  Alternately, suppose the agency which developed the
software "distributed" it to another agency.  Could not this second
agency then request the source code to the software under the terms of
the GPL?

> To put it in context, I can modify Apache all I want, and not re-distribute
> the changes, even though all of my web-visitors are "using" it. It's on my
> systems, I did not distribute it.

I don't think this is a good example for two reasons:

 1) Apache is distributed under a BSD-style license.  (As I mentioned,
    in my earlier message, you'll probably have fewer of these sorts
    of questions if you start off with software made available through
    a BSD style license.)

 2) You haven't actually distributed the software in question to
    visitors to your web site.

However, your point regarding "use" vs. "distribution" is well taken.
Only when binaries to GPL'd software are "distributed" in some sense
do the questions regarding source code distribution become pertinent.

Consider a supermarket kiosk based at least in part on GPL'd software. 
User's (i.e, the store's customers) of the kiosk are not entitiled to
request source code to the kiosk software.  OTOH, the supermarket is
entitled to request copies of the GPL'd sources in the kiosk from the
kiosk providers.

Kevin