Question on OSD #5

[Chris Travers]

On Nov 24, 2007 1:09 AM, Arnoud Engelfriet <arnoud at engelfriet.net> wrote:

> That would apply only if you made the FOUO restriction part of
> the software license. If you give me BSD software and additionally
> make me sign an NDA that says I won't redistribute it, the software
> still is BSD. I just can't distribute it.
>
> The same goes for GPL software, although there the NDA also triggers
> the "no additional restrictions" clause.

FOUO and NDA's may or may not run amok with the GPL (any versions), but IANAL.

But in a case like FOUO, if the restriction was "you may only use this
as part of official business by the legal entity which created the
modifications" I don;t think you would run into problems.  At very
least one could argue that this was mere internal distribution and not
distribution to end users.  Same with trade or state secret
protections.

Similarly, if I hand you a modified version of GPL v2 software with an
appropriately scoped NDA designed to prevent you from distributing the
software with my name attached (for example, designed to protect my
company from competitors knowing what I was up to), I would think that
would be no different than trademark questions and the GPL.  Similarly
under the GPL v3, if I release early pre-beta software under an NDA
which aslo states that this is distributed solely for partners to
contribute back bugfixes which are hampering integration with their
products, that would seem to be allowed under the GPL v3.

David Dillard Wrote:
> Transfers to the embargoed countries are forbidden (last time I looked
> they were Cuba, Iran, Libya, North Korea, Sudan and Syria).

Yes and no.  Under EAR (again IANAL), one is not allowed to knowingly
transfer technologies to embargoed countries, and there are various
(complicated) restrictions on transfers of humanitarian aid and
transfers of technologies to nationals of those countries.  However,
at the same time, publication on a web site of software available to
anyone free of charge is specifically stated as not implying knowing
transfer.

One thing I am *not* sure about is whether an open source project can
receive/accept contributions from a source in an embargoed country or
whether accepting such contributions implies a knowing transfer of
technologies to embargoed countries.  There may be other issues in
this area to which suggests that legal assistance might be helpful for
a lot of open source projects in this specific area (especially
relevant to but not limited to cryptography).

Best Wishes,
Chris Travers