MICHAEL: Our keynote speaker today is Karen Sandler
She'll be talking about Companies, Free Software and You.
Karen is the Executive Director of the Software Freedom Conservancy and she used
to be the Executive Director of the GNOME Foundation
and she's also working a lot on the Outreach programme for Women
and several other programmes, so everyone please welcome Karen.
(APPLAUSE)
KAREN: Thanks so much. I can't even tell you how beyond excited I am to be at DebConf
I was briefly at the New York DebConf
and I was so impressed and enthralled by Debian that I kind of ran away, (LAUGHTER)
So all these years later it's so exciting to be here and to be a speaker.
I'm Executive Director of Conservancy.
Raise your hand if you've heard of Conservancy.
So that's almost everyone, hooray!
We're a non-profit charitable fiscal sponsorship organisation
These are all of our member projects.
If you're here, you're surely using a few of them.
Two of the member projects that are not listed here include the
GPL compliance project for Linux kernel developers
and also the Debian Copyright Aggregation project
and I'll talk a little bit about those in a bit.
I'm also a lawyer, which when I admit I often have to hide behind the podum
lest people throw rotten fruit at me, but I only do pro-bono legal work.
I do that as a volunteer for the Free Software Foundation and GNOME
and a few other free software organisations.
I'm really, really in to free software, and the reason why, for many reasons,
but largely I'm actually a cyborg.
I actually, literally have a big heart.
My heart is three times the size of a normal person's heart
and it's fine. I'm mostly asymptomatic, it's not a big deal,
but I’m at a very high risk of suddenly dying.
The medical term is actually ‘sudden death’.
It’s 2—3% per year, compounding my risk of suddenly dying,
and I was diagnosed at age 3.
And so it's a very high risk of suddenly dying, but it’s all fine, because
my doctors prescribed a pacemaker defibrillator.
When you go to the doctor’s office, and they tell you that you need one of these
things, the electro-physiologists have
these devices in their desk drawers.
The medical device companies give them a stack of them.
They're extremely expensive — I got the bill for mine, I think it was something
like $75,000 US
They have them in their drawer, they slide them over to you, because they want you to
hold them and to know that theyzre so small, and so light and theyzre not scary.
They say ‘hold this’, so I take it, and I hold it, and I’m looking at it,
and the doctor’s looking at me like ‘Right? This is OK, right?’
And I say ‘OK, so what does it run?’
(LAUGHTER)
And the guy looked at me and said ‘Run?’
And so I said ‘Oh, yeah’, so then I explained there’s software in this device.
We had a little back and forth, and he said ‘Well, don't worry about it because
I'm going to get the representative from Medtronic, who you’re so lucky is in
the office today!’ and that guy said ‘Software? Run?’
This sent me down a path where I started researching the safety of software
in these devices and I was luckily able to make it a part of my job, and do a bunch
of research, and ultimately, I decided I had to get this defibrillator and get
proprietary software literally implanted into my body and screwed into my heart.
And that I would advocate for software safety.
When you start looking at your own mortality
and your own life, and you realise that you rely on software that you can’t see,
that you can’t review, you can’t get anyone else to review it,
if there’s a problem you can’t patch it.
And worse still, locked in to single vendors
if there’s a catastrophic failure at one of these medical device companies,
then we’re out of luck.
I can't update my defibrillator, and it is a problem.
I have to wait until Metronic —
Well, I'm picking on Metronic, but I chose them because I thought they were the
best of the bunch —
but I have to wait for Metronic to admit that there’s a problem,
for them to make a fix, to deploy that fix
I’m completely powerless
Once you start thinking about your medical devices and your heart
It’s not a long walk to get to cars.
A luxury car is 100 million lines of code
and the Software Engineering Institute
estimates that there’s 1 bug introduced for every 100 lines of code
So even if we’re catching the vast majority, medical device recalls have
demonstrated that simple things like all-pairs testing would have avoided
98% of the software recalls in medical devices, it’s all really fascinating.
It’s a whole talk in itself.
For me, this got me extremely passionate about software freedom,
where I previously thought that open source was cool.
I have now come along to the view that software freedom is absolutely essential
to our lives, to our society, and to our overall framework.
That has put me solidly in the free software space and
I am lucky that I get to work on the charity side.
The Software Freedom Conservancy is a 501(c)3
That’s a reference to the US tax code
Extremely geeky and you get a lot of people in our space who know all about
the different tax codes and will rattle off different numbers to you.
It’s like the same people who rattle off sections of the GPL to you.
(c)3 refers to the US tax code
It’s a charity and there are analogues
in every country — most of them have —
different types of charitable organisations, vs
a trade association which in the US is a (c)6 — you’ll hear people say
‘It’s a (c)3, it’s a (c)6’
(c)3 — charity, (c)6 — trade association
We’ve got companies, free software is developed in a wide variety of ways,
in a wide variety of organisations
and all these organisations are working together
on a lot of the same goals
but with extremely different motivations.
If you look at all these different areas,
you can start to contemplate how that might start to play out.
In this talk, I’m focusing on the company element because I think that
we’re sort of at point of a tree in free and open source software where we're able
to see what’s happened over a longer period of time
and start to look forward in how that impacts us.
I think it’s so awesome that companies have an interest in free software.
Raise your hand if you’re making money by working in free and open source software.
It’s like, ¾ of the room!
I did notice that John Sullivan of the FSF was raising his hand too. (LAUGHTER)
And I should raise my hand too, because I do take a salary from Conservancy.
The Company interest in free and open source software is fantastic because it
means we all get to work on making sure there’s great free and open source
software that companies use in their products.
It works out well for a lot of reasons
I think that, in fact, it’s essential that companies be interested in free and open
source software because it takes free and open source software to another level.
It means that free software is doing something right
if the software is so good that companies are deploying it in their products
and it’s now an essential part of the software that companies need to be
relevant and to bring their products to market.
It’s great that there’s money in free and open source software because
everyone needs to eat.
On top of that, we can do a lot more when there are people working full time
on these issues.
When companies are employing those people to work in free software
there are interesting things that happen.
This works out some of the time.
It works out where companies employ people to work in free software,
and great work is done, and everyone benefits from it.
Companies have increased software to draw from.
Companies work together where they're allies in some ways, and
competitors in others
It's very interesting.
This is a slide from the Linux Foundation brochure.
They may have updated it since then, but it sort of says all the places
where Linux is and you can appreciate how much money there is in free software
and how relevant Linux is generally — the Linux kernel.
Or GNU/Linux.
When you start to evaluate the presence of companies in free software you start to
feel the boundaries of where lawyers say our interests are aligned.
When we're talking about people who have different motivations
or are interested in different things, but are working together.
So their interests are aligned.
You can see how the free software community and society's interests
are often aligned with companies.
But when you start to think about it closely, you start to get
to the borders and boundaries of where those interests are, in fact, aligned.
During that introductory panel yesterday about open hardware we started
to touch on it.
Andy was talking about a particular product,
where the product was effectively bricked because the company who had sold it
had turned off the services to it.
Bdale was talking about how in an Internet of Things, we really need open standards
and we need to make choices where we can work together so that the efforts we make
individually extend to everyone.
I think that starts to hit it on the head.
I think that where we start to think critically on the role of free software
in society, or the role of free software at companies,
we hit against this idea very, very quickly.
Edward Snowden gave a really amazing keynote Q&A at LibrePlanet.
There he said "while sometimes corporations are on our side,
and sometimes stand up for the public interest,
we should not have to rely on them."
That's the thing - companies can do the right thing.
They can have societal interests at heart
but it's not their goal, it's not their job, it's not what they're set up for.
They're set up to maximise profit.
And there are ethical rules, and different countries have different rules about
things that companies can do.
I don't want to overly dramatise it.
I don't think that anyone can say that companies are evil.
There could in extreme cases be evil people that are working at
a particular company.
These things are much more complex.
It's just that companies have the goal of making profit.
They're not necessarily looking out for the public interest.
In fact they often have incentives such that
they're not focused on the public interest at all.
Raise your hand if you've heard of Volkswagen and the scandal that happened
recently - I think that's probably everybody.
Raise your hand if you've heard about VMware and the lawsuit against them.
So that, like three quarters.
I chose these two companies not because they begin with the letter 'V' [laughter]
The Volkswagen scandal, which I don't think I need to go in to,
I think everybody raised their hand,
was very interesting because
it was a part of technology where
if the engineers in house, like those working in VMware, had felt empowered
to raise the issue much, much earlier
you would see that actually, Volkswagen would have done better profit wise, too.
It's a really interesting situation, because
having the scandal, and some of the people knew that this was happening
and the corporate culture was such that they determined it was more
in Volkswagen's interest to keep this quiet, hoping they wouldn't be caught.
Corporate interests sometimes point in that direction, whereas if -
well, I'll get to that at some point.
But VMware is very interesting because,
for people who didn't know, and there's about a quarter of you who didn't.
One of the things we do at the Software Freedom Conservancy is that we have
a group of kernel developers who hold copyrights in their portions of the Linux
Kernel and they come together as a group within Conservancy to have us
enforce their copyrights.
So we go knocking on companies doors and we say:
"Hey, you've got no source with your product, and no offer for source.
Can you do something about it" and we have a lot of back and forth about that.
We also now have the Debian Copyright Aggregation project
which does a similar thing for Debian.
VMware was a company that we had tried to get into compliance for four years.
While they had made significant progress towards doing the right thing and having
compliance, at the end of the day they put their foot down and said that they
basically didn't agree with the derivative works provisions of the GPL,
as how it related to VMware, and they refused to comply.
And so Christoph Hellwig filed a lawsuit that Conservancy funded in Germany and
that's starting to unfold and it'll be interesting to see
where that case lies.
All of these things point towards motivations of companies
with their use of software and how that might be different from
what the community might want.
One of those ways that plays out in a very fundamental way is the timescale at which
companies are acting are often more concerned with their quarterly results
than they are with their long term results.
And so they're going to be highly motivated to look a little bit more
short term, as opposed to —
There are some companies that think very strategically about the long term -
but overall global corporate culture has become one,
such that companies are really trying to maximise their quarterly results.
What makes a good short to medium-term decision for a company is often not at all
what is good for society, or even in the long-term interests of customers,
because companies don't necessarily care if you'll be a customer of their's
in 10 years, they care more that you continue tomorrow, and next week,
and next month.
Especially in technology where it's very hard to predict where technology might go
within the next year or two.
There are a lot of ways in which companies
don't necessarily have your interests at heart that are not necessarily nefarious.
For example, I have this pacemaker defibrillator.
I am not in the standard set of people who get pacemaker defibrillators.
Still, I'm young enough that that's still true.
I was recently pregnant, and when I've been pregnant, I've been shocked twice
inappropriately by my defibrillator.
Because my heart was doing something that a normal pregnant woman's heart does.
Pregnant women often have their hearts race and my pulse shot up and
I got shocked twice even though I was not in need of a shock.
Simply put - I couldn't expect Medtronic to be focused on my use case,
because for example when I went to my obstetrician in New York city,
at a major hospital, where the high risk doctor surely saw thousands of -
I mean, she's a senior in her career, she's a great doctor -
and there were a couple of things I said to her like, you know:
"If you have patients with defibrillators you should know that if they get an
epidural, it reminds you of getting shocked."
You should know this for your future defibrillator patients.
And she looked at me and she said: "Karen, I don't have defibrillator patients that
have babies! I've had one other patient in all of my years, like 5 years ago who had
a defibrillator, who had a baby in my hospital"
It's simply the class of people who have defibrillators and the class of people who
have babies overlap very little.
So Metronic as a company doesn't have a strong sample set to work with.
They're not focused on the use case.
I promise you that Metronic does not want their pregnant patients being shocked.
(LAUGHTER)
They have a strong interest in making sure that pregnant women with heart
conditions are not inappropriately shocked.
But nonetheless, I was shocked because the
company simply wasn't focused on my use case.
And this can happen in many ways, and it's hard to predict the ways in which you're
using software that was written for one purpose,
how you might be using it for a use case that wasn't anticipated.
This is true across the board.
My health condition is just a metaphor for all the ways we use software.
When you move from one geographic region into another,
communities have different needs, and they different cultures, and they use
software very differently.
We could talk a lot - and I hope that we do informally - about how improving
diversity in our communities helps us deal with that a little bit more by
anticipating use cases across cultures and across expectations.
That's sort of one way that there's sort of a mismatch.
How many people here think that free software and open source software
are the same thing? Raise your hand.
It's not a trick question, whatever you think - if you think it's the same thing,
raise your hand.
How may people think they're radically different things, or different things?
Ok, so it's interesting.
More people thought they were different things than thought they were the same,
but there were a lot of people who were undecided.
I can tell you that maybe five years ago, maybe more,
I was on a real advocating bent to convince people that it really didn't
matter what we called free software and open source software,
it didn't matter what we called it as long as we were talking about freedom.
And if you look, the definition - the four freedoms, and the open source definition
line up pretty well.
There are a few, very historic, situations where there are licenses that are
approved by OSI but not on the Free Software Foundation's list,
but generally, what they're talking about in principle are the same thing.
So I think from a legal perspective we can use the terms interchangeably,
but with the perspective now that I've had of watching companies in our space
a little bit more, I actually feel a little bad about the glossing over that
I had done, because the motivations that are represented by the terms,
even if it's not a legal description of licenses,
the motivations that people assign when they talk about free software
versus when they talk about open source software are very interesting,
and very different.
Has anybody here seen the Silicon Valley, (LAUGHTER)
Everyone who has seen the TV show Silicon Valley was laughing very loudly.
So not very many people in here.
There's this TV show in the United States called Silicon Valley.
It's hilarious, it's about the startup culture in Silicon Valley, in California.
There's this company called Hooli, which is like an analogue to Google, but it's
an amalgamation of different companies.
And in the first season of this show, everywhere they go in Silicon Valley
people are talking about "Making the world better" through whatever
start up idea they had.
And there were posters everywhere: "Making the world better through
blah-di-blah-di-blah-di-blah-di-blah."
When actually, they weren't trying to make the world better, they were just using
that language, and when I first saw that on TV, my jaw dropped!
I was like "Wait! That is our rhetoric!"
And we've been using that in software freedom to talk about making
the world better and it's been completely co-opted by companies who are also active
in our space, who may also be, to some extent, making the world better,
but co-opting that message so strongly that it's now a joke.
It's such a joke that everywhere in this show, for the entire season,
it was somebody, you know: "We are raising our series A, but the important thing
is we're making the world better".
It's interesting to take a hard look, and it actually threw me through a loop
because I thought: Wait, am I trying to make the world better through software
freedom really, or have I completely lost the plot?
Because this is what I've been saying and is that true?
I think I've sort of come out the other end of saying actually, this is residual
from a very good job that the free software community has been doing of
making companies feel welcome, and making them feel empowered and good about the
choices they make by investing in free software
and there are a lot of good things that are related to this that we can continue
to increase, but we have to be very wary of what our motivations are and who's
selling us what, so that we know how we can interact with them and what we should
do if there's partnerships. And I can tell you that undertaking GPL enforcement:
Completely eye-opening to see what companies do
and how they really think about free software.
Because when you ask them to comply and they're out of compliance,
when you ask them to release their proprietary kernel modules,
the answers you get are not about making the world better, I promise you [laughter]
We need companies. We need to work with them.
Free software won't be relevant, we won't win - I mean, win, whatever that means -
we won't be relevant, we won't really make the world better if we don't also have
companies participating and contributing
and companies have a lot to add, with their own perspective.
But we need to do it on our own terms.
And we need to, as a community, take more ownership of that
and be more of a participant in that culture.
I'm naturally an optimist. By nature I really think the best of people and
I think the best of companies, I think the best of the world.
I've been accused of being a bit of a Pollyanna at times
however, as a lawyer, there's nothing about being trained to be a lawyer except
being trained to be a pessimist.
And expect absolutely the worst of everyone.
And you have to expect that situations will go bad.
And you have to expect, that even though you're working positively with a company
today, that tomorrow that relationship might go south.
It might be because the people who are in ownership or running the company have
had incentives to change their goals,
but it could also simply be that the company has been acquired.
Or that leadership has changed completely. You can't expect that a company that is a
good actor today will be a good actor tomorrow.
Again, that's not to say you should be unreasonably suspicious but
you need to plan for the worst case scenarios no matter what
and this is why we have lawyers, and this is why we have legal regimes.
What it's really about is power, and it's about a power balance.
One of the things that's really cool about free and open source software is that we
have some legal regimes that are sometimes in place
to help keep that balance of power.
The GPL is a fundamental mechanism for keeping that balance of power
with companies, keeping that balance of power with each other,
and also keeping that balance of power in check with developers and
with society in general.
This is a copyheart logo with the GPL.
As you may have noticed, some people in the last 5-10 years,
lax permissive licensing has really taken hold.
I see some real vigorous nodding in the audience.
I think that a lot of that has to do with not the original emphasis on
lax permissive licensing.
Not the original freedom emphasis from the BSD communities -
that cultural insistence on a pure kind of freedom,
where folks thought that the GPL was too restrictive,
and that the only way of having true freedom was to have the ability
to proprietarize it.
As a concept of freedom, I think that has actually shifted and it's not the reason
why in the last 10 years lax permissive licensing has become so popular.
It's become so popular because companies have been messaging so strongly that
the only way you can get your software adopted is by using a lax permissive
license.
And people have thought this so wholeheartedly.
It's so fascinating to me because we had so much success with Linux
under the GPL and the technology gets to a place with the GPL that you wouldn't
necessarily be able to get to otherwise.
Linus Torvalds, for example has publicly said the biggest contribution he made
was not any technological contribution, but instead the license choice
behind the Linux kernel.
We're really out of balance on this because we've gone really strongly as a
society towards non-copylefted software.
This has upset the balance we can expect from companies and I thought it was very
interesting - this is Martin Fink of Hewlett Packard Enterprises
at the last LinuxCon Europe - he gave a talk and he said we need to
"change the default" back to copyleft, from permissive licensing.
He gave a lot of really interesting business minded reasons why
it's good for business that this is the case.
He said that what happens if you choose a non-copyleft license you have to
introduce all of this governance and infrastructure to make sure that companies
play fairly with one another, and it's expensive and it's artificial and
it sometimes breaks down.
From our perspective I think that from a community project,
from a community perspective, I think his message of change the default has a whole
additional power to it.
And I thought that hearing somebody who's coming from such a corporate perspective
echo within a corporate construct what I think we need to do more as a society
and community was I think extremely powerful.
So if somebody tries to tell you that if you're starting a new project
that you will only find success and popularity by using a permissive license
it's simply not true.
It's again, trading those long term versus short term goals.
Maybe you'll get some companies to adopt it a little bit sooner, but down the road
your project is potentially going to be forked by another company and you won't
be able to see any of those changes, and you'll be completely locked out of the
relevant part of software.
Just something to think about.
Without enforcement there is no copyleft, effectively.
You could choose a license until you're blue in the face,
but if there's not anyone who's going to enforce it at the end of the day,
you may as well have never made that choice to begin with.
Nobody is going to take you seriously if there are no consequences to
not following the rules.
But having centralised power can really, really frustrate that balance.
So if it's, for example, a strong copyleft license, if it's an AGPL or GPL program,
but all the copyrights are owned by a single company,
then you have a power balance.
The fact that the software is under a copyleft license helps, but it doesn't get
you all the way to that great balance.
In many ways Debian really has the best of both worlds,
because with Debian, it's such a big project, and there's copyrights that're so
diversely held, no one could aggregate those copyrights even if they tried.
But we don't necessarily want to because having a project that's held diversely
is extremely powerful and helpful.
It keeps these power balances much more in check.
At the same time, Debian has set up the Copyright Aggregation Programme with
Conservancy, so we will aggregate copyrights with people who are interested
in doing so, and that way we can help if there is a violation, it's easier to
pursue it because if you have a diversely held project, and there's a violation,
who's going to be the one to knock on the companies door?
They're not going to take any one developer seriously enough,
because it's such a small amount of code.
So if we aggregate it together it means that not only do we empower
a single steward that's going to be helpful,
but it also enables someone with a single voice to be able to be able to speak for
enforcement, to make sure the right thing is done for the project.
To respect the diversely held copyrights we now also take enforcement agreements
so that people want to have their copyrights enforced, we can do
enforcement agreements in addition to plain old copyright stewardship.
In many ways, it's the best of both worlds.
I think that a lot of the things that Debian has done has made it such a unique
community.
I think that the way that are so many developers that are so independent
and the way you come together and elect a single DPL is an
amazing and unusual thing and I think is the reason why the Debian community has
weathered the time so well,
even though many companies are building on Debian for their products,
the Debian community stays so strong, it's so independent, and it's so interesting
and it's so unique.
Another thing that I think we all need to pay attention to that can help tip that
balance is with our employment agreements.
How many people here have an employment agreement in place for what they're
working on now?
Wow, that's so low, it's only like a quarter of the people in here.
I bet many of you actually have employment agreements that you don't realise
that you have.
So, I'll be a little bit faster on this to say that when you take a new job at a
company you will generally asked to sign an employment agreement, and those
employment agreements have been getting stronger and stronger and stronger
over time.
And they often ask for the world.
They basically tell you to agree that everything that you do, not just within
the context of your job, but at all during the time you're employed is owned by your
company.
AUDIENCE: It's actually illegal in Germany.
KAREN: Yeah, so the different jurisdictions, some have some checks and
balances but the lines on that aren't necessarily as clear as you think that
they are, so it's all very, very fascinating stuff, but in any case,
making sure that you have an agreement with your employer about working on free
software is important.
And making sure that you negotiate that and ask for more is essential.
We at Conservancy are working on a project where we're publishing standard contract
language so you can say "I would like provisions 1, 3 and 5" when you negotiate
with an employer, and they can say "oh, we'd never take 5, but maybe we take
1 and 3" — occasionally.
And we're working with some companies so that they'll review it and they all say
"We may never take these provisions, we may never let individuals hold their
copyrights, but if we do the language looks like this"
Asking companies if you can hold your own copyrights - some people do negotiate it.
Some of those, I admit, are rock star developers, but some are not.
If we all ask for it, if a lot of the talented developers that a company seeks
to hire ask to keep their copyrights,
or asks for the freedom to work on free and open source software, that's outside
of their job, if we all ask for it, then some companies will start to bend,
because they'll see it as a feature for recruiting talent.
And together we can make a huge difference in the culture of this space and the
bargaining power.
Some people are advocating for unionised free software development,
which is a very interesting notion,
but I think that from a plain old normal way, It think it would be very interesting
if we all started to ask about keeping our own copyrights and other provisions.
So we're working to enable people to do that.
Support the charitable non-profits.
Think about — that’s very self serving, I know people are laughing.
Or Keith is laughing…
It's not just the Conservancys, it's the SPIs, right?
It's all — now Bdale is nodding. (LAUGHTER)
It's supporting the charitable structures around free and open source software
because they are what are going to enable us to keep the interests of the community
and the interest of society at heart.
The Free Software Foundation, SPI, Conservancy, we're organisations that have
a mission to support free and open source software, for freedom.
And so keeping the charitable organisations strong
is really essential and Conservancy in the last year shifted it's business
model so we're now individually funded primarily rather than company funded
and we've found that it's enabled us to be focused more on programmes that are
important to community and important to society.
If we were funded by companies, if we were a trade association, we could never do
that in the same way.
It's not that trade associations don't do good work, and it's not that they
can't also be doing things in the public good,
it's just it's not their focus.
So I would say, really, you're all so awesome for being at DebConf and for being
involved in the Debian community.
Debian is so unique and so focused on freedoms, so stay focused on freedom.
It's the most amazing thing and together, we can make the world better
and not in an ironic, hilarious way.
I'm happy to announce that due to a generous donation by an anonymous
donor, anyone at DebConf who signs up as a Conservancy supporter will be matched.
So it's a really good time if you're — I don't want to give a sales pitch but —
(LAUGHTER) but it's a good time, because someone who's here, who cares passionately
about software freedom is going to match that donation.
Anyway, so does anyone have any questions? Do we have time for questions?
MICHAEL: Thanks Karen for that talk. KAREN: Thank you very much.
(APPLAUSE)
MICHAEL: We started a bit late so we have time for a few questions.
GUNNAR: My question is more pulled by what Aba said. You mentioned a lot of work
from the Software Freedom Conservancy and benefits regarding the work you are doing
in a community such as ours but do you work with similar groups, not focused
in the US? Because I mean the rules are different everywhere, and I'm sure it will
be very hard for you personally to litigate here, or whatever.
KAREN: Yes, I'm a US lawyer admitted to practice in the state of New York, not
anywhere else.
This is not legal advice and I am not your lawyer. (LAUGHTER)
However, free software is global.
You can't simply have a US focus and work in free software, so we're focused on a
lot of different jurisdictions. Obviously, we're focused in places that a lot of us
are, so our programmes where we have enforcement agreements and assignment
agreements like for the Linux kernel or Debian, we obviously work with lawyers
in those places too, so we have a European agreement for assignment now.
We're a US entity, so that it means that to the extent that we're taking copyright
from developers, we're going to hold them in the US because we are in the US.
But we have function abroad, we function everywhere and we, for example, don't have
any South African lawyers we've been working with, but whenever there's a place
for someone who's very interested in, and there's enough of an interest that it
would be worth the expenditure, we look to experts from those places.
I think that you simply can't just think about the US.
However, it's interesting that for better or for worse, a lot of the countries have
followed the US in a lot of policy and often that's for worse.
In many places the patent regimes have followed the US.
I think that a lot of the charitable structures as well.
So for example the Food and Drug Administration's review in the US over my
medical device - I used to when I gave a talk about medical devices, I would do a
lot of research into the local place's Food and Drug Administration and review
processes, but every place I went to it was the same.
They didn't review the software. So most of the big ideological issues are the same
from place to place, and for details we work with partners.
PHIL: When you were talking about retaining copyright, a company I was
working for was doing some work for a phone manufacturer in in 2000, and the
idea of retaining copyright really wasn't happening. So, as a fallback position we
suggested to them that if we were modifying existing projects that were
under copyleft licences, obviously we would have to comply with those licences
and that we'd like to retain the copyright in that instance, and they went for that
and then once you've got an agreement like that, it's not so difficult to persuade
someone to upload a project that hasn't got very much in it, under a license,
and then fork it immediately. (LAUGHTER)
KAREN: Early is really important. Making these decisions early is so essential.
You can never turn back the clock.
You'll ever have as much power as the day a company is trying to recruit you.
Once they have decided to hire you, before they have actually entered into an
agreement with you, before you've come on staff, they never want to hire you as much
as in that moment, because they've gone through the whole search,
they've decided you're the one for them, the process is over,
they just want to get the paper work done. And that's the time.
And even though you may think that it'll blow up the deal, it won't.
You can always blame me. You can say:
"A lawyer told me I need to do these things", and then they'll say:
"Well, we never do that", and you can gauge the interest.
If you're nice about it and not adversarial about it, then it's fine.
[Question via IRC from Mexico]: Karen, what do you think about the latest Oracle
and Google law fight about Java and the GPL? (LAUGHTER)
KAREN: I'm recording an oggcast Free as in Freedom about the whole issue, it would
take a long time to discuss it, so more to come on that.
MICHAEL: Any more questions?
STEVE: Echoing the thing about employment agreements, my experience in the UK,
I'm sure it's similar elsewhere is companies will just try things on.
There'll be a whole load of things in most employment agreements that are strictly
not enforceable and probably illegal in many jurisdictions, but they'll put them
in anyway. It's just a case of talking through it — they're negotiations, they're
not fixed terms, every employment contract is different, it's entirely up to you to
talk about it. I work for a company that self identifies as an IP company, so I
just scribbled out the thing that says they own everything I do, and it caused
no hassle. It's no problem.
KAREN: Yeah, people think that because they're given a contract and it looks very
official that it's fixed and there's no chance to edit it, but it's almost never
true. There are some companies who would rather walk away from employing you than
editing their employment agreement, but they're the exception rather than the rule.
Because a lot of companies will negotiate it, there's a lot of room there and if it
becomes more standard, if more developers ask, more employees ask for edits to the
employment contract, and especially if they all ask for it in the same way,
then it's generally true in contract negotiations that when you negotiate with
someone you ask for way more than you want because you want to be able to come down.
So often it's built in to these contracts provisions that companies know they're
willing to move from, and if you ask them to move on something else they'll say:
"Well, we can't move on that, but we have this other provision we could give you"
And so, the chances are you're not getting the best deal that's already available
to you if you haven't asked.
MICHAEL: I think we should move on now as we're running out of time.
Karen will be around at DebConf until Thursday I think, so talk to her if you
have any more questions or comments.
(APPLAUSE)