Who is responsible for the proper license handling in a software project?

Question

I recently participated in a discussion where we wanted to find out what kinds of open-source software we can use in our production system. The corporate guidance is not clear, and the project members had a very different understanding on the topic. For example, the mentioned guidance stated that in most cases the license applies when one downloads an open-source project. Which is non-sense.

For me, the situation is similar to the risk management, although a risk usually harms only the project, but a law suite harms the whole company. So it is a bigger deal. This suggests that the license handling is a project manager task, however no-one can expect a project manager to know every single third party library along with their licenses, which are used the project.

I have two examples. First, a developer downloads a third party library, adds it to the build system and to the product. Second, a developer finds a great algorithm with google and adds it to the production code. In both cases the company can face serious law suites if the license agreements are not met, which must be prevented. Of course, the developer can be accounted for this action, and serious new regulations can be introduced in the process, but whose responsibility is to prevent this from happening? And, how to do it?

Answer 1

This is a very interesting issue, but in many companies often underestimated.

From my experience, developers often do not realize that usage of a library or third-party code without checking a license can bring very serious legal consequences.

An additional issue, besides usage of a particular piece of code, are patent-protected solutions. Often a person is unaware that a solution from the internet can be protected and other company may demand payment for its use.

I am not able to identify one person who could watch over the use of such components, but it seems to me that during the entire project life cycle such issues should be reviewed by different people:

• Developer - who should be aware of these issues (defined by some internal procedures), and every idea of using the library / code / solution should involve at least the notification of such fact to the person who can verify the legal status, or if he can - do it by himself,

• Internal Auditor - if such person exists, should check if any protected by license / copyright elements were used,

• Lawyer - should provide support for all the people in deciding whether a license / patent agreement does not jeopardize the interests of the company,

Project Manager certainly should not be the person responsible for this type of work. Of course, he should be aware of these issues, but at the management level and arrange inspections.

On the other hand he is an excellent person to raise awareness of these issues among people producing software.

Answer 2

This is thicket and as the PM you have the responsibility to shepherd your project through the maze. Some firms establish "clean rooms" to insulate their developers from the team that reverse engineers the specifications from the binaries (or even source) being reverse engineered.

The community supporting open source software your team "borrows" may get frosted if they find out; many OS licenses (e.g. GPL and LGPL) will "contaminate" the intellectual property rights of your software should you copy that code. So the corporate guidance of applying the license terms upon download is prudent - and definitely not nonsense.

StackExchange founder Jeff Atwood has a great article on the subject entitled Pick a License, Any License. The bottom line from Jeff is pick a license at the start of your project. Your developers may be operating on the WTFPL which is likely not what corporate wants.

See the Stack OverFlow article Is there an Open Source license matrix?