Ikarus Security Software violating LGPL (Bochs, WINE and ReactOS)

Wonderful good day,

Ikarus Security Software (www.ikarus.at) is using open source in their
anti-virus scanning engine, without publishing the modified source. I
already informed the developers of bochs, WINE and ReactOS about the
violation.

Can you give me some tips what to do next? There is a trial Ikarus against
me on January 25 2010, because they accuse me of selling their source.

When I came to Ikarus, there was already the simulator, part of the scanning
engine, that simulates viruses until they are unpacked. My work at Ikarus
was to improve that simulator, making it faster and better. I am now aware
that the existing simulator was based on bochs, and 80% of the code there is
now stolen open source.

Can someone ask Ikarus for the modified source code? If, then please put me
in CC, then I can also show the court that they do not publish their
modified open source upon request (if they don't give you the source).

Any tips etc. would be helpful.

Kind regards,

Peter Kleissner

=?iso-8859-15?Q?Re:_Ikarus_Security_Software_violating_LGPL_(Bochs, _WI?= NE and ReactOS)

Hi,

i used several friends and relatives, with a different last name in other cities:
I wrote different letters, with different fonts etc. and they sent them
with their signature from their city, for different date stamps.
For a receipt and a faster reply fax is an alternative.

Best regards,

Rolf

> -----Ursprüngliche Nachricht-----
> Von: "Peter Kleissner" <Peter <at> Kleissner.at>
> Gesendet: 01.01.10 13:45:58
> An: <legal <at> lists.gpl-violations.org>
> CC: christianembacher <at> gmx.at
> Betreff: Ikarus Security Software violating LGPL (Bochs, WINE and ReactOS)

> Wonderful good day,
> 
> Ikarus Security Software (www.ikarus.at) is using open source in their
> anti-virus scanning engine, without publishing the modified source. I
> already informed the developers of bochs, WINE and ReactOS about the
> violation.
> 
> Can you give me some tips what to do next? There is a trial Ikarus against
> me on January 25 2010, because they accuse me of selling their source.
> 
> When I came to Ikarus, there was already the simulator, part of the scanning
> engine, that simulates viruses until they are unpacked. My work at Ikarus

Re: Ikarus Security Software violating LGPL (Bochs, WINE and ReactOS)

Peter

**This is not legal advice**

This looks to be an even more complex situation than usual, to my mind-

a.) You appear to have had a past (employment/contracting) relationship
with Ikarus;
b.) You are engaged in litigation with Ikarus; and
c.) There is an alleged infringement of open source licences.

However, each of these could impact the situation differently, and, for
this reason, I would strongly advise that you seek independent legal
advice in advance of your court appearance.

It is rather unclear to me quite what you are looking to achieve here,
too - are you looking to report, and have rectified, a GPL violation, or
are you looking for support in defence of Ikarus' claim against you, and
looking to use evidence of a GPL violation as part of your defence?

Some further thoughts inline below.

----

Peter Kleissner wrote:

>  There is a trial Ikarus against
> me on January 25 2010, because they accuse me of selling their source.

AW: Ikarus Security Software violating LGPL (Bochs, WINE and ReactOS)

Hi,

To explain the story: No I have not sold any line of their code, they just accuse me because of a joke (an easter
egg) I've made. I want report here the LGPL violation, and look for support. The fact that the Ikarus
scanner is mostly open source will be part of my defense (why would I sell open source), but at the same time I
want to force Ikarus to publish their modified stolen open source, committing back the changes and fixes
to Bochs x86 PC emulator etc.
	
Ikarus steals open source (bochs), makes money out of the work of others and licensing their engine to other
companies, thus taking advantage of open source software developers. My own software is published under
the EUPL, I think that "Human knowledge belongs to the world".

> There is no claim of "selling their source" as such - is the claim one
> of copyright infringement? Or is it some form of contractual dispute? To

They say "giving further business secrets to the advantage of foreign countries", and say because of a
program I have published (also as open source) they had to develop a new anti-virus scanner version (they
are loco) and want "at least" (their words) 23.000 € - and that is going to be discussed on January 25 in
front of court.

> unfortunately - demonstrating that Ikarus is infringing copyright, if
> indeed it is, is unlikely to be a defence to a claim of copyright
> infringement against you.

Depends. If you steal open source and accuse then an ex-employee to sell the source then you should be aware
that those claims do not fall back on you. I will surely not go to jail because someone accuses me of selling
open source.

I think you guys here have a good experience in gpl violations, this is why I turned here. Looking at other GPL
violations (especially ones in Germany) helps, but I agree that I need a lawyer (for my court trial I'll get

Re: AW: Ikarus Security Software violating LGPL (Bochs, WINE and ReactOS)

Peter Kleissner wrote:

> To explain the story: No I have not sold any line of their code, they just accuse me because of a joke (an
easter egg) I've made. 

It sounds as if this part of the business is entirely without the scope
this list- but, if you have no sold any of its code, then, joke or no
joke, would Ikarus not have a difficult time proving copyright
infringement, if they cannot actually point to any of their code in your
product?

> I want report here the LGPL violation, and look for support.

Great.

> They say "giving further business secrets to the advantage of foreign countries", and say because of a
program I have published (also as open source) they had to develop a new anti-virus scanner version (they
are loco) and want "at least" (their words) 23.000 € - and that is going to be discussed on January 25 in
front of court.

Obviously something to discuss with your lawyer, but, proving a claim
such as this, irrespective of proving the quantum of damage, could be
difficult if, as you say, it has not actually occurred.

> Depends. If you steal open source and accuse then an ex-employee to sell the source then you should be aware
that those claims do not fall back on you.

Following up on a violation report is one thing - but using a claimant's
infringement as a defence to a claim against you is not always possible

Re: Ikarus Security Software violating LGPL (Bochs, WINE and ReactOS)

Neil Brown wrote:
> license..." and "You must license..." - clause 2, LGPL 2.1, for example,
> requires that a distributor of a modified work "must cause ... the
> work... to be licensed" - it's not clear to me that there is an inherent
> licence grant if the distributor decides to breach the licence terms.
> 
> This really is something which you should discuss, in respect of your
> particular situation, with a lawyer qualified in your jurisdiction, to
> find out if your defence, if my (many) assumptions above are correct, is
> one based on you having a valid licence, or else )

Agree completely. Without all the facts it is very hard to make any
kind of legal argument.

As to your last argument, GPLv2 and LGPLv2.1 both have statements to the
effect that "Each time you redistribute the Library (or any work based on
the Library), the recipient automatically receives a license from the
original licensor". Arguably this applies even when a redistribution is
unauthorized, so that the OP could invoke the LGPL's rights granted to
him in a defence against the company's accusations.

However, I am not sure copyright is at all an issue. I saw a reference to
Easter Eggs, which sounds more like a bad workmanship/defamation kind
of claim. Some companies consider Easter Eggs to be unprofessional.
Or perhaps there was exposure of proprietary data (even if the software
is open source, input data sets could be confidential or proprietary).

Arnoud

--

-- 

Re: Ikarus Security Software violating LGPL (Bochs, WINE and ReactOS)

Happy new year, Arnoud!

Arnoud Engelfriet wrote:

> As to your last argument, GPLv2 and LGPLv2.1 both have statements to the
> effect that "Each time you redistribute the Library (or any work based on
> the Library), the recipient automatically receives a license from the
> original licensor". Arguably this applies even when a redistribution is
> unauthorized, so that the OP could invoke the LGPL's rights granted to
> him in a defence against the company's accusations.

An excellent point.

> However, I am not sure copyright is at all an issue. 

On the basis of the information which Peter circulated after my
response, I agree that there is more to it than "just" a claim of
copyright infringement.

--

Neil

Linux kernel on HTC Hero Android phone (CDMA/US-Spec)

Re: Linux kernel on HTC Hero Android phone (CDMA/US-Spec)

(Originally replied just to Chris, by accident, so copied back onto list)

Quoting Chris McCracken <chrismc <at> ozarkmountain.net>:

> HTC is required by US and International copyright law to do so.

This is, perhaps, a little misleading, at least to my understanding-  
HTC is required by the terms of GNU GPL to do so (as you point out  
above), not by any copyright law. If HTC does not comply with the  
terms of the licence, then, HTC may infringe copyright, but there is  
no requirement of copyright law as such to make the source code  
available.

> If this request is not
> met, then HTC is required by law to cease and desist distribution of said
> software (Linux kernel), which would require ceasing distribution of the
> US-spec CDMA Hero phone as currently configured.

Similar to the above - this may be an aspect of US law with which I am  
not familiar, but, in the UK, there is no legal requirement to cease  
distributing something, even if it is infringing copyright, without a  
court order requiring this - it's just that the distribution would  
amount to an infringement of copyright.

In any case, were the request not met, cessation of distribution would  
be insufficient, to my mind, since this only prevents future  
infringement - it does nothing to remedy past infringement.

Just my thoughts, as always!

--

-- 

Neil

neil <at> neilzone.co.uk | http://neilzone.co.uk

Re: Linux kernel on HTC Hero Android phone (CDMA/US-Spec)