Episode 190: Karen M. Sandler on Software Freedom Conservancy  ## Metadata - Author: [[Sustain]] - Full Title: Episode 190: Karen M. Sandler on Software Freedom Conservancy - Category: #podcasts - URL: https://share.snipd.com/episode/2ee02f70-cd1d-4e9b-af70-d5f87c34e1de ## Document Notes ## Highlights - **Heart Condition Sparks OSS Advocacy** - Karen Sandler's heart condition led her to deeply explore the need for software freedom in medical devices. - Her defibrillator's unexpected behavior highlighted critical gaps in control and auditability of such technology. Transcript: Speaker 2 Get involved in open source? Speaker 1 I'm an engineer turned lawyer who wound up falling into the open source world. I was someone who thought that open source was really cool. And then I wound up finding out that I have an inherited heart condition. I have a really big heart called hypertrophy cardiopathy. And I needed a defibrillator pacemaker implanted. And I got that. But in doing that, I started researching the safety and efficacy of this device, started looking into it. And what I found was just like. Pauling, shocking, as you might say, to make a terrible pun about the fact that my defibrillator has shocked me when I haven't needed it to because of its interesting algorithms. So doing that research made me think that when source was more than just this cool thing. And in fact, like we need it as a public and as individuals to have much more control over our technology and certainly more oversight than we do. And this caused me to embark on this journey of really loving a lot about software freedom and becoming activists for safer and better technology. So I'm at Software Freedom Conservancy as Executive Director. Previously, I was at the Gnome Foundation and before that Software Freedom Law Center. And so I'm in mostly a non-legal role now, although I do teach a class at Columbia Law School, it gets semi-bio too. So all that is to say, like the main things that I do are run SSC, which includes, as you said, like promoting copy left licenses and defending the GPL and helping alternatives to proprietary Software so that we actually have other technology that we can use. So you don't have to be the one saying, no, I don't want to use Zoom. I don't want to use Google Docs without being able to say, here's something else we could use. Like either pad is a Software Freedom Conservancy Member Project, for example. And then thirdly, we run Outreachy, which is a diversity initiative where we give remote paid internships to people who are subject to systemic bias and are impacted by discrimination. And it's all part of the same thing of like, our technology may not be made for us. And what are we going to do when it's not? And how could our technology ever be made by us if it's not made by a diverse set of people? If it's not made by people who are like us, then what are it's only by a small section of people, then how will that get us? So it's all kind of wrapped up in the same, like, what are the ethics of our software and how can we make it better? Speaker 2 Thank you so much. That is a lot of information. I'm really excited about getting into it. I'm going ([Time 0:01:45](https://share.snipd.com/snip/97f41de7-deaf-4153-9ea3-ad08fd56bd6a)) - **Fiscal Sponsorship's Unique Role** - Software Freedom Conservancy uses fiscal sponsorship to help open source projects legally and financially. - This comprehensive model supports projects needing strong legal and liability backing, not just grant funding. Transcript: Speaker 2 Do like lawsuits and stuff. So I'm just confused. What exactly is your mandate? Speaker 1 Oh, I would love to tell you. So yeah, I mean, so interesting. We were one of the first fiscal sponsorship organizations. We came in after Software in the Public Interest and they were a heavy inspiration for the way that Software Freedom Conservancy was set up. But they're more of a grant model than a comprehensive fiscal sponsorship model. This may be far too in the weeds. I love nonprofit law and nonprofit related stuff. And so I can like dive deep in the stuff, which I will not do because it is like a whole different topic for probably a different audience. But it's so fun. Anyway, so slightly different and that really was a need for a comprehensive fiscal sponsor, which means the member projects of Software Freedom Conservancy are a part of Software Freedom Conservancy. So they're like analogous to a division in a corporation. So we are the legal entity for them as opposed to just taking and money and doing a grant type of relationship. And that means that there are problems, there are problems and that really works well when you have projects that may have some complicated legal issues or other kinds of like liability Related issues. But also it works out really well when there needs to be a deep partnership between the member project and the Software Freedom Conservancy in order to like succeed for Software Freedom. And so when we started, we were initially just a plain old fiscal sponsor, like taking anything that was free and open source software or like anything with a free license. So like Dubfocus, we've been very excited when more fiscal sponsors come in and we've always shared all of our documents. We give them to Numb Focus, we've given them to other organizations because let a thousand roses bloom. It was never our purpose to just be a fiscal sponsor. It was our purpose to support Software Freedom. So here we are down the road. We don't need to take such an active role in fiscal sponsorship because there are so many different options, open collective, Numb Focus, tons of other organizations. And we only take member projects now that really want to advance software freedom and will benefit from our help. Speaker 3 Big game of lawsuits. What's going on with the Visio? I've been doing things since 2022. Speaker 1 Yeah, so lawsuits take a really long time. And so Software Freedom Conservancy has three major branches. And because our logo is a tree and we do the Nature Conservancy logo, we have that cute little, these are our three branches. Our three branches are the fiscal sponsorship where we support alternatives to proprietary software, our diversity and inclusion initiative, and then our copy left work. And so the lawsuit comes into our copy left work because what we found and one of the threads I wish would get picked up in the sustained conversation, which I haven't seen so much in the Sustain, like in the sort of like, how do we sustain open source, is that a really deep thinking about licensing and whether or not how it works out to have non-copy left licensing and Copy left licensing, how that impacts the longevity of a community and the ability to maintain the software as open source. So if software is licensed under copy left licensing, detractors used to call it viral before viral was a good thing. The idea is that it's forever free. So if something is licensed under a copy left license and it has distributed copyright holding, meaning you don't have one company who's acquiring assignments so that they could do You license it any way they want, if you have those two things, then that means you always have a level playing field. It means that you never lose track of the code base ability to fragment it is much more limited. You know that people are going to be able to play on the same field. And so there's something very special about copy left. And there's something ideological about copy left that is very motivating. And so when you can combine this inspired ideological contributions along with the keeping business in check through copy left, I don't know that the full experiment of copy left has Ever really been tried. We've seen wild success with the Linux kernel and a few other important projects, but because of corporate interest in open source and the emphasis on non-copy left, so many projects Went non-copy left that I think we haven't really tried that. So it's really quick. Speaker 2 Not all of our listeners are going to be as familiar as we are with copy left first copy right. And I've always mixed my left some rights up. Can you describe again what those are? Speaker 1 So there are major ways that we can license under a free and open source software license. A non-copy left license or some people call it permissive or detractors will say lax permissive. Lax permissive license is one where you just the license says you could do whatever you want. You can copy it, you can modify it, you can do whatever you want. You can even put it into a proprietary product. And most of the open source software out there is licensed under a non-copy left license. A copy left license says you can do whatever you want with this also. You can distribute it, you can modify it, you can share your changes. But if you distribute it, you have to do so under the same terms of this license. So if you make changes and you distribute those changes, you have to also keep those changes under the same license. So you can use this ever increasing body of software that's available for use. And that's the piece that's different. And there are other licenses in the middle. It gets a little bit more complicated, some are pens, some don't, blah, blah, that could be another topic for another day. But the main difference is that copy left has, they call them reciprocal obligations. So if you are using a copy left license of company has copy left its software and its products, it has to make the source code available for the public so that if somebody wants to change That software, they can do that. And so getting back to the video suit, Visio is one of those companies who have copy lefted software in their products, multiple different kinds, but aren't fulfilling their obligations Under the license. And so we have enforced in a number of different ways. We have a coalition of Linux kernel developers that have asked us to enforce their license for us. We have member projects that are copy left that care about their licenses. But the Visio case was actually different because in the Visio case, we filed as ([Time 0:10:55](https://share.snipd.com/snip/cbb71dde-8b85-4714-a731-70fc8289f011)) - **Power of Copyleft Licensing** - Copyleft licenses require that modified distributed software remains under the same license. - This maintains software freedom and limits codebase fragmentation much more than permissive licenses. Transcript: Speaker 1 Know that people are going to be able to play on the same field. And so there's something very special about copy left. And there's something ideological about copy left that is very motivating. And so when you can combine this inspired ideological contributions along with the keeping business in check through copy left, I don't know that the full experiment of copy left has Ever really been tried. We've seen wild success with the Linux kernel and a few other important projects, but because of corporate interest in open source and the emphasis on non-copy left, so many projects Went non-copy left that I think we haven't really tried that. So it's really quick. Speaker 2 Not all of our listeners are going to be as familiar as we are with copy left first copy right. And I've always mixed my left some rights up. Can you describe again what those are? Speaker 1 So there are major ways that we can license under a free and open source software license. A non-copy left license or some people call it permissive or detractors will say lax permissive. Lax permissive license is one where you just the license says you could do whatever you want. You can copy it, you can modify it, you can do whatever you want. You can even put it into a proprietary product. And most of the open source software out there is licensed under a non-copy left license. A copy left license says you can do whatever you want with this also. You can distribute it, you can modify it, you can share your changes. But if you distribute it, you have to do so under the same terms of this license. So if you make changes and you distribute those changes, you have to also keep those changes under the same license. So you can use this ever increasing body of software that's available for use. And that's the piece that's different. And there are other licenses in the middle. It gets a little bit more complicated, some are pens, some don't, blah, blah, that could be another topic for another day. But the main difference is that copy left has, they call them reciprocal obligations. So if you are using a copy left license of company has copy left its software and its products, it has to make the source code available for the public so that if somebody wants to change That software, they can do that. And so getting back to the video suit, Visio is one of those companies who have copy lefted software in their products, multiple different kinds, but aren't fulfilling their obligations Under the license. And so we have enforced in a number of different ways. We have a coalition of Linux kernel developers that have asked us to enforce their license for us. We have member projects that are copy left that care about their licenses. But the Visio case was actually different because in the Visio case, we filed as a customer. So we purchased TVs and we found that the TVs were out of compliance. We had previously had an enforcement action with Visio and they had not given us complete and corresponding source code. And then later we got new TVs because we've been getting complaints and also because we want to do alternative firmware projects to use these. There's so much promise in devices where you can get access to the software because you can create alternative builds. You can do really cool stuff with them. Speaker 2 Wait, so were you sitting in a garage somewhere with a screwdriver trying to find the code in a Visio TV? Like how did this even come up? And why Visio? Why not every other IoT device in the world? Speaker 1 We get lots of reports from people who are frustrated because they get these products and they look and they either see no offer for source code or there's an offer. But when they ask the company for the software for the source code, they don't get an answer or they get something that doesn't build or doesn't install or something which are requirements Of GPLB2, which is one of the most popular licenses that are of the copyleth licenses. And so what we do at SFC is we investigate as many of these complaints as we can, but we always prioritize people who are really trying to do something with the devices that they purchased. So that is our priority. If somebody wants their source code because they're going to replace the software to do something like prevent a company from spying on them, because a lot of these devices are sending Reports back from people. Or if they want to be able to add accessibility, we've had people complain because they couldn't add captioning. So we try to prioritize the really good use cases. And so from there, then we kind of narrow it down and we're a small organization. So we do the best that we can. And the Visio case really made a lot of sense because it was a company that had ignored our advice and requests in order to comply and their newer devices were out of compliance in a very Dramatic way. And so that's why we filed this lawsuit and it's different because in the past, most of these suits have all been filed on behalf of copyright holders, but we instead filed as a consumer. And we said that the copyleft licenses, they say that there are rights given to third parties. So the licenses say, if you use this code, if you use this software, you agree that you're going to give third parties this right. And under the law, there is a whole cause of action that is raised by being a third party beneficiary to a license. So it's basically saying if two people enter an agreement and they promise a third person that they're going to do something, that third person can actually bring a lawsuit because They were specifically named in that agreement. And this is a well-tried legal theory. And so because the parties were agreeing that the public and third parties and people, purchasers are the ones who have this right, we filed in that way. And it's really important that we did that because it's really the downstream recipients who are the ones who are hurt by the lack of compliance. If you buy a TV and you can't get access to the source code, well, then that frustrates the entire purpose of copylefted software. It's the whole point. And also, it's the downstream users who are the ones who are even aware that there is no compliance. So that's why we filed it this way. And the other thing is that companies tend to not take requests for source code seriously because they think there will be no consequences if they don't. But this lawsuit demonstrates that you have to really take it seriously when people are asking for source code because, ultimately, there's a third party beneficiary right. And they should be doing the right thing anyway. You use this software. You agree to this contract. The software is so amazing, right? There's so many benefits that are all connected to this copyleft licensing and you can't just get all the benefits without also, you know, handling the possibilities. And so this basically holds those companies accountable. And so that's why we brought this lawsuit in this way, which is very particular, but lawsuits take a really long time. So I'm pleased to say that in May of last year, we were able to get a really positive ruling from the federal court. So we brought it in state court. So basically, Busy O said, you brought this contract case, but really in the United States, you didn't really mean it was a contract case. What you meant was that it was really about copyright. And you may say it's about contract, but really it's about copyright. And if it's about copyright, it ([Time 0:14:17](https://share.snipd.com/snip/61aa4da2-4def-493f-9c69-506a1e0efeb3)) - **Vizio Lawsuit Defends User Rights** - SFC's lawsuit against Vizio arose because the company failed to meet copyleft license obligations on TVs. - They filed as a consumer, asserting third-party rights to access source code where compliance was lacking. Transcript: Speaker 1 To use these. There's so much promise in devices where you can get access to the software because you can create alternative builds. You can do really cool stuff with them. Speaker 2 Wait, so were you sitting in a garage somewhere with a screwdriver trying to find the code in a Visio TV? Like how did this even come up? And why Visio? Why not every other IoT device in the world? Speaker 1 We get lots of reports from people who are frustrated because they get these products and they look and they either see no offer for source code or there's an offer. But when they ask the company for the software for the source code, they don't get an answer or they get something that doesn't build or doesn't install or something which are requirements Of GPLB2, which is one of the most popular licenses that are of the copyleth licenses. And so what we do at SFC is we investigate as many of these complaints as we can, but we always prioritize people who are really trying to do something with the devices that they purchased. So that is our priority. If somebody wants their source code because they're going to replace the software to do something like prevent a company from spying on them, because a lot of these devices are sending Reports back from people. Or if they want to be able to add accessibility, we've had people complain because they couldn't add captioning. So we try to prioritize the really good use cases. And so from there, then we kind of narrow it down and we're a small organization. So we do the best that we can. And the Visio case really made a lot of sense because it was a company that had ignored our advice and requests in order to comply and their newer devices were out of compliance in a very Dramatic way. And so that's why we filed this lawsuit and it's different because in the past, most of these suits have all been filed on behalf of copyright holders, but we instead filed as a consumer. And we said that the copyleft licenses, they say that there are rights given to third parties. So the licenses say, if you use this code, if you use this software, you agree that you're going to give third parties this right. And under the law, there is a whole cause of action that is raised by being a third party beneficiary to a license. So it's basically saying if two people enter an agreement and they promise a third person that they're going to do something, that third person can actually bring a lawsuit because They were specifically named in that agreement. And this is a well-tried legal theory. And so because the parties were agreeing that the public and third parties and people, purchasers are the ones who have this right, we filed in that way. And it's really important that we did that because it's really the downstream recipients who are the ones who are hurt by the lack of compliance. If you buy a TV and you can't get access to the source code, well, then that frustrates the entire purpose of copylefted software. It's the whole point. And also, it's the downstream users who are the ones who are even aware that there is no compliance. So that's why we filed it this way. And the other thing is that companies tend to not take requests for source code seriously because they think there will be no consequences if they don't. But this lawsuit demonstrates that you have to really take it seriously when people are asking for source code because, ultimately, there's a third party beneficiary right. And they should be doing the right thing anyway. You use this software. You agree to this contract. The software is so amazing, right? There's so many benefits that are all connected to this copyleft licensing and you can't just get all the benefits without also, you know, handling the possibilities. And so this basically holds those companies accountable. And so that's why we brought this lawsuit in this way, which is very particular, but lawsuits take a really long time. So I'm pleased to say that in May of last year, we were able to get a really positive ruling from the federal court. So we brought it in state court. So basically, Busy O said, you brought this contract case, but really in the United States, you didn't really mean it was a contract case. What you meant was that it was really about copyright. And you may say it's about contract, but really it's about copyright. And if it's about copyright, it should be in federal court, which is maybe also very in the weeds for your audience. But it automatically goes to federal court. And then we had to fight in front of a federal judge to say, actually, there is a cause of action here. It's contract and state court. So the right place to do it. And Vizio argue, no, it belongs in federal court because it's only copyright. And by the way, we also wanted to dismiss it because if it's copyright, then these people filed only as a third party beneficiary. So it should be turned out. And the federal judge said, Oh, actually, it does seem like there could be a cause of action here and remanded it back to the state. So that was actually a huge victory for us in May. But now we've been going through discovery and depositions and it'll take a while. There's a trial date at the end of the year, but whether that will stay is tough to know. We were the judge ([Time 0:17:09](https://share.snipd.com/snip/0150ff49-899e-4bdc-a1e9-91dd49bd5563)) - **Respect Copyleft or Face Lawsuits** - Companies should not ignore copyleft license obligations due to risk of enforcement actions. - Releasing source code is not a business threat but enables responsive service and platform growth. Transcript: Speaker 1 Gotten really complacent. Because if nobody's worried about a lawsuit, then why should companies invest in making sure they do the right thing they just want. Speaker 3 Yeah, and we're starting to see this a lot with AI. I see a lot of companies putting in, including my own is we're putting in gargrails to keep GPL code out because it's such a liability. Have you been already getting complaints from copy left authors to be like, Hey, I think this LMI is using my code. Speaker 1 I mean, we get complaints about every product you possibly imagine we get complaints all the time. It's amazing. And then, of course, with the assisted programming models. Of course, we get the like there were all of the very high profile related examples of these models taking copy left code and including it in programming suggestions without attribution Or acknowledgement. So this is a huge problem. I mean, I think that it's so sad. The idea that companies try to exclude copy left code in order to stay safe from liability or stay safe. I find that companies will find a way to use copy left code when it's really valuable to them. And the truth is that all you have to do is release source code. Almost no business models rely on proprietary source code anymore. Very few are like royalty based. If you're trying to make your revenue by locking in your customer set on a copyrighted proprietary code base, then you've already lost. You're going to make money because you're responsive to your clients needs because you've provided a platform because there's some kind of service that you're providing not because You've locked your customer base into an old code that they're stuck with because they can't transition out of it. So, I think it's very short sighted to do that. And I think that if we as an industry experimented a little bit more with copy left if we brought it in more than I think we would have more experience with showing how publishing this first Code is not this huge disaster that people think that it is so important ([Time 0:24:35](https://share.snipd.com/snip/c7be71aa-30a8-433c-bfc5-8af2cc65f70a)) - **AI Training Risks Software Freedom** - Using open source code to train AI without attribution undermines software freedom principles. - Lack of auditability in AI training and output risks reducing accessible sharable code for public benefit. Transcript: Speaker 2 And that's really interesting to me because it feels like they're going all in. Whereas everyone else is like, I don't know if that's the thing. I would just curious what you thought about that as an idea. Speaker 1 Yeah, I mean, I think it's so tricky, right? And one of the things that software freedom conservatives has spoken out about a lot is co pilot and we have a whole give up GitHub campaign. I know that GitHub has been present a lot in the conversations around sustainability and open source, but there are a number of ways in which GitHub's participation and open source Has been quite the opposite of sustainability and community. Aside from the fact that it's proprietary code hosting site, like all of the historical problems with GitHub. But one of the things that we were able to talk about with co pilot is this problem that I mentioned before about copy lefted code being part of the training set right like GitHub didn't Use all the software they had access to right. They only use what was available that was freely licensed or published on GitHub. They didn't train it on Microsoft Word or Windows, even though they had that ability. Why didn't they do that? Why do you think they wouldn't have trained it if there's no way that the output of co pilot would produce any of that source code. I don't know. And we did find that people were able to determine over time that the co pilot was including cognitive and its output. Yeah, and so effectively, this then becomes run around of copy left. It's like people created this code in the public good. They wanted it to be freely shared. They wanted to stay free. And by putting it through these models as part of the training set is not a problem at all. It's just that if you're not having any attribution and the output can be proprietorized, then you've got a problem. Speaker 2 I'm not incredibly intelligent about the law. I don't understand it. I don't understand morals either. I know there are things I ought to feel because I've been raised in a certain society, but I'm never sure where they match up with the law, which is what gets me really tough. So Japan deciding that anyone can use anything for any LLM is really interesting because to me, that seems to be an amoral decision because it seems to be screwing basically the people Who made the code in the first place by allowing anyone to drag in the first particular use when the license said what you can't use that. But if Japan decides that if I'm in the jurisdiction of which Japan applies, which is an entire country with millions of people, hundreds of people, then that's fine. So I'm just kind of curious how you feel about that. And also what you think about that as someone who says SFC because the same thing could happen here in the US. In that case, like, is that a problem? Do you see what I'm trying to get at? Again, I'm not smart at raising this question because I don't understand the concept story. Speaker 1 Yes, my answer was sort of like a roundabout way of saying, how does that make me feel? It makes me feel like mad and a little helpless, like, totally honest, because as someone who wants more access to the source code of the technology we rely on, what I want is that. I don't care about copy left necessarily. It's a strategy to get us to that goal of software freedom. But it's so interesting because when copyright maximalism winds up sometimes hurting the goals of software freedom, but it also strengthens copy left or copyright is strong that If you use copy left is a way to keep sharing, but suddenly that copy left is very strengthened. So I'm happy when copyright laws are reduced if it increases sharing. But what happens is the output of these models is licensed under non sharing licenses. The extent that they can be licensed and that is different in different places around the world. Regardless of whether they can have copyright ability or not, generally the output is not being shared. And we're still the training set is not being shared. So that means that we don't have the audit ability. We don't have the checks and balances. And ultimately, it means that we are going to have even less code that we can test modify, make sure that it serves our interests instead of the companies that are ([Time 0:27:10](https://share.snipd.com/snip/45a879e1-4f3e-4f97-ae34-e3ed405ebe62)) - **Software Freedom Means User Control** - Software freedom means users have control over their technology and can collectively act to modify it. - Practical freedom is more important than philosophical debates about software licensing. Transcript: Speaker 2 When you say software freedom. Do you mean that the software itself is going to be free or do you mean that the users using the software are free? I know this has been debated, added to need them in like the SFS type world, but I'm curious what SFC thinks about it and in particular your opinion. Speaker 1 Yeah, I mean, from my perspective, I've always shied away from some of the slightly more philosophical arguments. I'm very pragmatic. From my perspective, stuff or freedom. I mean, I'm happy to engage in philosophical arguments about it. It's just that at the end of the day, what matters is where we as a public are left with the technology or land, right? Like my heart device is a metaphor for the software we rely on. What happens when you're getting unnecessarily shocked? And there's no way that it's like the technology, right? What happens when a whole community has deployed software that you're relying on and there's an exploit or there's a bug and you can't fix it. Issues around our technology are real and we are creating these centralized structures where we're building surveillance technology into everything we do. We are seeing a tremendous amount of control to corporations and one of the best ways of accountability that we already have is that which copy left gives us. So, software freedom for me is about having something we can actually do with our technology. Software freedom is I bought this phone. I replaced my software on the phone. I was able to strip out the goal related services and I still have a great functioning phone with a lively ecosystem of apps that I can put on that do what I needed to do. For me, software freedom is about that control that we as a public have and whether we can take collective action together in order to do something. ([Time 0:31:40](https://share.snipd.com/snip/498848b4-5542-4e5b-888f-4a9d2c588249)) - **Join FOSSi Open Source Conference** - Attend FOSSi, a community-led open source conference in Portland for learning and networking. - It offers affordable access and volunteer-organized tracks to deepen understanding. Transcript: Speaker 2 This sort of topic, are there any conferences coming up that you might plug that were we could go to learn more about free and open source software? Speaker 1 I'm so glad you asked. There's conference called FOSI free and open source software yearly, which was perhaps optimistically named but I do expect it to be at a new old conference. We'll see how it goes. It's kind of an experiment for the first year. It's sort of like, Fosdam like, meaning that we have tracks that are organized by volunteers and we're going to have a lot of really cool, interesting talks and we're going to be in Portland, Oregon, which is where the old Azkhan used to be. So, it'll be kind of a fun mashup of conferences but it's very community focused and community led. I think it's going to be a lot of fun. We'll see how it is for the first year. Like the kind of the expectation is to build it up over time. So, get your ticket now and be there for the very first one. There's a sliding scale ([Time 0:33:35](https://share.snipd.com/snip/2f083f6d-8229-48e3-8315-064329028868))