 Turn off your mobile phones if you have them on. It gives me great pleasure to introduce our next speaker. I know of this person through his work with our XML standards and various things over the last few years. Today he's going to be talking to us about trade practices, issues of infringing open source software. May introduce Brendan Scott. Thank you for having me here today everybody and it's nice to see you all turning up to a talk which is about the law rather than about video standards or whatever it is that you've been listening to so far. My name is Brendan and that's me, up on the screen. I'm a lawyer, I'm based in Sydney and I do technology law so that's stuff like software licensing, development contracts, those sorts of things. Today I'm talking about consumer law issues which you might be running into if you're selling an embedded device or any other device or any other thing actually which has open source software on it if that open source software is infringing or improperly licensed. So, too long didn't listen. The summary of the talk is you'll be in trouble, don't do it. And the essence of the talk is not so much that you'll be in trouble, don't do it, but rather that you'll be in trouble with people other than the copyright holder because traditionally the way people have thought about this is if you're the copyright holder then you'll go and sue somebody and that's what you've got to look out for. So this presentation is actually talking to a piece of research that I did for Linux Australia halfway through last year it was released and it was looking at whether or not consumer law could be used to enforce compliance of open source software licenses and the output of that work was a research note and that research note I mean I'm sure you've already got a copy but if you don't have a copy with you at the moment and you want one you can get it from that URL and it's openly licensed so feel free to share it if you like. And this talk is basically talking to that note. So if you happen to fall asleep halfway through the talk and you miss what I've said and you can't find the video you can still look at the note and in fact the note has more details than what I'm going to talk about today. I'm just going to be talking about some, well actually just two of the big guns in the note that are in there. And before I go on I should make a bit of a comment here that on the first slide you see I've put trade practices in square brackets. That's because when I did the note it was the Trade Practices Act and it had been the Trade Practices Act for like 36 years before that but as at 1 January this year they changed the name of the Act. So it's not the Trade Practices Act anymore. It's the Competition and Consumer Act and not only did they change the Act they actually moved bits around and put this over here and changed some of the wording. So I was faced with this issue of well what do I do I change it all and then I'm out of sync with the research note or do I stick to the research note and then I'm sort of out of sync with reality. And I've chosen the latter rather than the former but what I have done is if you are really interested in knowing what the actual sections are these days there's a slide at the end of this talk which does the mapping from what I'm talking about to from the words that I'm using which is like section 52 and section 53 to what those sections are these days. And the good news is that the bad news is that some of the wording has changed so the key sections that I'm looking at some of the wording is not exactly the same when they moved it from where it was to where it is within the Act but the good news is that the changes aren't that great so I don't think the change that they've made to the Act makes any difference to the analysis that I've put forward in the research note. And as something to focus your minds in this talk I'm putting forward a sample scenario or a hypothetical scenario which involves you going out and buying an embedded device from some fictional vendor of embedded devices somewhere out there in the world and you take this embedded device home and you just happen to stick it plug it into your serial port and have a look at what sort of prompt it's providing and you recognise instantly that it's actually got this fictional set of Unix tools for embedded devices which I will call busyfoss and which is licensed under the GPL so the GPL is just to give you a requirement to provide the source code and you go oh great well it's GPL it must have the source code somewhere so you flip through the box and you look in the manual and you get the CD out and you can see every but there's no source code and so you go well where's my source code? This is an infringing copy on this device so you go back to the store and you say where's the source code? Where is it? And the owner says well I'm not giving you the source code because I don't have it and then you say well you've got to give it to me because this is infringing if you don't give it to me and then the vendor of the store says well are you actually a copyright holder of this busyfoss software? And you say no and then they say well then you can't sue me for infringement so what's the issue? The issue that I've, if you've been listening closely what I've been talking about is an infringing copy of some open source software infringing by definition means that it's in breach of copyright right? Someone can sue you because you're in breach of copyright that's sort of, it's not in contention and so isn't it just game over? I mean isn't it just game over? It's infringing copies so let's hit them with a suit for breach of copyright and the answer is well yes it is game over you can sue these people for a breach of copyright if you happen to be the holder of copyright and if you're not the holder of the copyright you can't because you're what's called, what the law calls an intermeddler you don't have standing before the court there's this concept that the court has of standing and what standing is is that the court will only listen to will only listen to people who have some sort of connection with the rights which are in dispute, the manner which is in dispute and the reason the courts do this is because they don't want the whole world coming in and just litigating things if there's no reason to litigate them and so for many many many many years, decades, in fact centuries courts have been excluding people who want to bring a court action on the basis that that person doesn't have a close enough connection with what's going on, with the matter that's in dispute and so some examples here are if you've got a contract between two people if I've got a contract with you you know I'm supposed to bring you a cup of coffee or something and I don't do it or it's too hot or something and I'm in breach of contract the person, if you don't care you don't care that I'm in flagrant breach by bringing you a latte rather than a cappuccino the fellow next to you or the person next to you can't do anything they can't take me to court for breach of contract because my contract is not with that person my contract is with you and the same and that's even true if if I'm providing you a cup of coffee for you to provide to them because the connection is between me and you or the relationship there is between me and you and it's similar for tort although tort is a little bit more complex because the relationship in a tort where someone hits somebody or does a wrong to somebody is what tort means the relationship is defined by the damage and so it's a little bit broader but basically the court says well is this any of your business to the person who is bringing the action and if they can't show that they have some interest in the right which is being sued over then the court just says well thank you very much but out you go and this is where you get this concept of amicus curia where you might have seen it from time to time it's a Latin for friend of the court and that's just someone who actually doesn't have an interest in the case but the court says that they have the court thinks that they have something interesting to say so they let them in on a limited basis to say to make some comment on what's going on and so the short the summary of it is if the people who are concerned don't have an issue then the court's not going to listen to you not going to listen to third parties and in the case of you and your vendor the distributor is or the vendor is A and the copyright holder is B but you are this C person you're outside the circle you don't have any interest in that copyright in the busy-foss software and that means that you cannot enforce compliance because you have no standing oops and like I said if you were the copyright holder you could bring an action in copyright but there's often lots of reasons why the copyright holder won't want to bring an action in copyright in particular they might not be in Australia they might be somewhere on the other side of the world they might be too busy they might have a long list of other non-compliant device manufacturers that they're going through and your guys just down the bottom of the list and they don't want to do anything about it so if you're just a consumer buying a device the copyright act is probably not going to help you very much so flashback to our scenario and we just pick up again where the vendor says well you're not the copyright holder and you go oh my god you're right, I'm not and all of the people who are copyright holders are miles and miles and miles away and I'll never convince them to come over here to sue you just because I've got an infringing router for 50 bucks or whatever it happens to be but what you do say is nevertheless I think you're in breach of the Australian Consumer Law which you all know is Schedule 2 of the Competition and Consumer Act 2010 formally known as the Trade Brexit Act 1974 so I will have standing to bring an action under that legislation myself and the reason that you have standing under the Consumer Law to bring an action is that the Consumer Law is designed specifically to prevent harm to consumers and you can imagine if you're a consumer and you've been ripped off by five dollars or ten dollars because of some something that a seller of devices is doing you're probably just going to chalk it up to experience and not do anything about it but if everyone in the city or the country chalks it up to experience there's actually quite a lot of damage to the economy which is not being addressed and so the legislature tries to be proactive and tries to prevent this harm from happening and in order to do that it needs to focus on actions of the vendors rather than on harm and on rights and that means if it's going to be proactive it can't wait until after someone's been hurt it has to stop the hurt from happening and if it has to and if it can't wait until someone is hurt then you're going to have a hard time defining who is that person who has a relationship with the right to take action so if I hit you it's quite clear that you've been hurt by me that gives you standing to sue me but if I'm going to give a right to consumers to take action even before harm happens then I have to have a very broad concept of standing so that's what the consumer law does it allows pretty much anybody to bring an action where there's a breach of the consumer law so flashback to our scenario and so you've just said well I'm going to get you under the consumer law but the vendor then says to you well there haven't been any consumer law cases dealing with free and open source software and you're totally out of left field how are you ever going to sue me you're going to be breaking new ground and your response is well you're right there haven't been any cases specifically on free and open source software or at least none that I could find but there are plenty of cases and the principles those cases establish principles and they establish them pretty well so all my job is is to take those principles and apply them to the facts and one of the early criticisms of the project of the research that I was doing was that there weren't any cases on free and open source software so what the research note that I was doing was going through and seeing what sort of cases have come up in other areas and to what extent can those cases be applied to this scenario where someone's buying a device with a infringing copy of something on it so what are the sort of things that the cases talk about and the two main consumer law sections in the legislation you might have already heard of them section 52 which is misleading or deceptive conduct and section 53 which is also misleading or deceptive conduct but it's sort of like a subset of 52 these are the two things in the research note that I'm focusing on and there are a couple of other things and points and in order to that's the wording of section 52 that's the old wording as of 31 December last year the new wording of section 52 says it's a person but I think it's otherwise unchanged and section 53 some of the wording they've sort of changed the phraseology but it's pretty much still the same and basically what you have to do is you have to engage in conduct which is misleading or deceptive and do it do it in trade or commerce and if you do those things then you're in trouble and in fact you don't even have to be misleading or deceptive you can do something which is likely to mislead or deceive even though it's not in fact misleading section 53 is sort of like a subset of section 52 and it prevents and it applies so 52 was sort of in trade or commerce and 53 is in trade or commerce in connection with the supply of goods or services so it's sort of like a zeroing in on a specific category of conduct which is a supply of things and the reason section 53 is is separated out is that it has high penalties or it has pecuniary penalties which are attached to it whereas section 52 is really just damages which you'd be exposed to and what section 53 does there's sort of like it's like a dozen subsections where it says no false or misleading representations in relation to this or this or this is just a couple which I'm pulling out and so you're not supposed to make false representations about sponsorship or approval of a device or that it has performance characteristics or benefits blah blah blah the sponsorship or approval of a person or the existence or exclusion of any condition warranty, guarantee, write or remedy so flashback again I'm sorry to be making you a little bit dizzy flashing backwards and forwards between this scenario and what I'm talking about but the owner, you've just established to the owner that you've got a case or you've got a potential case under the Trade Presses Act and then the owner says to you well, what's your loss? You haven't suffered any loss and in fact I haven't even misled you because you knew when you bought that that this was going to be a dodgy product and so when you bought it you did it knowing that you weren't going to get the source code in a sense you probably just bought it so you could have a go at me because you thought it might be a little bit funny and the court's response to that is that it doesn't matter I don't need to prove that I've lost that I've suffered any damage to bring an action and that's you can see that because you probably can't remember the wording was that you must not engage in conduct which is likely to mislead or deceive and so if just being likely to mislead or deceive isn't mislead or deceive is enough then you don't need to have actually misled somebody and equally if you don't need to actually have misled somebody then you also don't need to show that there's damage because it might be the case you haven't misled somebody and if you haven't misled somebody then there's not going to be any damage and so what's happening here is that the courts are just saying the courts just look at the set of circumstances they just look to see whether the conduct has occurred and if the conduct has occurred then they say well bad luck you're in breach of the consumer law and furthermore something can be technically true and yet it can still be misleading and so the example in the cases given is that there's this famous opera singer that everybody knows about and the local theatre is putting on a performance by a person of the same name advertising that person's name may well be misleading or deceptive even though it's quite true that this person is going to be singing because the average person who sees the aversements would think it's a different person depending on how it's advertised so you go back to this fellow and say well whether or not I was misled is actually not relevant it's just whether or not your conduct is misleading and they said but I didn't mean to do it I didn't even know that there was software on it I just get this stuff from an old lady in Taiwan who makes them in her garage and she assured me that it was all legitimate and you say well let me tell you about this case called embo holdings so embo holdings is a case about an airplane and in this case well there's there's three protagonists the seller S the sales agent for the airplane A and the buyer B the seller tells the agent that the seller owns the plane the buyer says to the agent I own this plane and I want to sell it the buyer says to the agent I'd like to buy a plane and the agent says to the buyer well seller S owns this plane you could buy it off him or I think it was a hint but the fact is the seller didn't own the plane but the seller took the buyer's money and and the buyer didn't get the plane I think what happened was there's some registration process where ownership gets transferred by some register and the maintainer of the register of the plane said well S isn't the seller sorry S isn't the owner of the plane at that point the buyer could sue the seller to get the money back except that the seller had already taken that money and spent it so there was no money to get out of the seller you couldn't actually recover the money the buyer couldn't recover the money that they had paid so what the buyer did was they sued the agent and they sued the agent because the agent told them that the seller owned the plane and that was false it wasn't true and the buyer successfully sued the agent because of that false representation and the court simply was in the analysis the court simply said the agent has had some conduct which is making the statement that the seller owned the plane and it was false or misleading and that's all it matters and when you look at the case it's quite clear that that there was no suggestion in any way the court just said well, that's the conduct you've met the criteria for the conduct you're in trouble so the owner says okay, alright, fair enough you've sort of convinced me that I don't need to know what's going on it just has to be false or misleading but the thing is, I haven't said anything what representation have I made to you which is false or misleading okay, you just bought this box there's nothing on the box when you came to buy it from me I didn't say oh, by the way, it's got a legitimate copy of busyfoss on it I just took your money and that was it so where's the representation well, we can have a look for where that representation might be to a string of cases by a company against people selling PCs of their software on it and in fact, and what's happened in these cases is that some person has been selling white box PCs and loaded on those white box PCs there's been an infringing copy of this software and the courts have consistently said that the sale of those PCs with the infringing copies on is a representation that the PCs were made with the permission of Microsoft in this case however so what the court said was there's a representation that the software on there has been legitimately loaded up it's been made with permission but the issue I guess with a lot of these cases is that Microsoft trademarks plastered all over the advertisements or over the packaging which came with the white box or on the thing itself and so you say to the vendor what about these piracy cases and the vendor says to you you can't rely on those cases they're all about trademarks trademarks are indicia of origin and they were making representations because they had Microsoft trademarks all over the thing whereas that thing you bought didn't mention busyfoss at all and in fact if you look at the code someone's been trying to go in there taking out everything which indicates that it is busyfoss there's a question oh I don't know that's not good but I guess I'll get back to that case before where the courts are culpable as hell and I'll just take you back to the case before where blameworthy conduct the court sort of not interested it's just the conduct that they're trying to establish but it certainly doesn't look good worse in a sense and so the question that you're faced with is you sort of have to prove that this is a false or misleading misrepresentation if you just have a white CD with the words backup CD written on it and that's all that happens on the shelf you white backup CD you take it to the desk you pay for it you walk out where's the representation if you were to just buy a backup CD like that and you say well let me tell you about the TYN case and the owner's getting a bit upset now because he says I'm not really sure about this so the TYN case the vendor was selling CDs white CDs with the words backup CD written on them and these CDs had infringing copies of software on them and the court hit these people under section 52, 53 and a number of the subsections of section 53 and moreover the court said that the conduct of the vendor in that case in selling or offering to sell the CDs was an express or implied representation that the items which is the CDs were made with the license of the copyright holder or that the vendor was lawfully entitled to sell them so the act of the sale by the vendor in that case and the court I mean this is actually what the court said you've made an express or implied representation it's like well was it an express or was it implied sort of covered its bases they didn't make it entirely clear but what the court did say was they're in trouble and so and they didn't have to show that there were trademarks on it and you didn't have to identify the software on it so what about our vendor of the embedded device with the infringing software on it from the TYN case that person is making a representation at the very least that they're entitled to sell it but also that if there's any software on that thing then it's properly licensed and from the embo holdings case we also know that whether or not they're aware that the software on it is beside the point they don't have to know and they don't have to be intending to mislead you they can be entirely ignorant and they still have a problem under the embo holdings case so so the owner says to you you're saying I'm liable even if I say nothing about busyfoss when I sell it to you and when the packaging on it is also silent tells you about the wonderful features of busyfoss and they say even if I didn't mean to mislead you even if I didn't know that there was a software on it and even if what I'm doing is not morally blameworthy anyway and the answer to those questions are yep that's right you might also be exposed to damages you say so what can happen if someone's in breach if you've actually suffered a loss as a result of their their conduct in misleading or deceptive conduct you can get damages an award of damages and that compensates you for whatever loss you've suffered if you're buying an embedded device you probably haven't suffered too much loss but who knows what the circumstances are there's scope for mandatory injunctions and an injunction means you stop someone from doing something but a mandatory injunction means you require them to do something and typically what happens is that you might have corrective advertising put in a newspaper or something and finally if they're in breach of that subset of section 52 which I called section 53 but it's actually section 29 of the Australian Consumer Law you can also get penalties and they're quite substantial up to a million dollars if you're a corporation and not so much if you're an individual but it's still pretty serious so back to the sample scenario and you say yeah you're likely to be in breach of the Australian Consumer Law and they say well fair cop so fair cop here's the source code including the build scripts and the config files and I make sure that when I'm distributing the devices in the future that I'll put them in and I'll put an ad in a newspaper of cash in the way of the busy foster developers and you say I knew you'd be reasonable and that's sort of the that's the talk there's a stage 2 to the research which hasn't been done yet and the stage 2 is to try and do some education of the the Fair Trading Departments around the country to alert them to the fact that there is an issue here that consumers are exposed to and also to put together some documentation for people who if they have a an issue with an embedded device it can at least get them started to send something off to a vendor saying well I'm not happy I want the source code bloody bloody bloody but that second part has not been approved so the project stage 2 of the project isn't going ahead as of as yet there's the mapping and I will I guess end there any questions how do you Brandon I did make it to your talk yes finally first of all could you go back to one slide or maybe two yeah that one from the whole conversation with that owner I was going to gamble that the owner does not actually have the source code to build script sort of config files which puts them in a bit of a jam because they are legally kind of obliged to give it otherwise they can still be sued but they don't have it they might not be able to get it from the little lady in Taiwan who might have disappeared by now I mean it's like one of big production they sell it cheaply and it's gone they'll stop selling it I mean for future things they'll stop selling it that's the easy but for the stuff they've already sold what are they going to do to remedy this well I mean if they can't actually remedy it they can't actually do it then they're probably not going to do it they're a bit stuck yeah I mean if they can't they won't but the issue here is to establish a principle so that if someone is able in a capacity they're in a position to be able to comply you've given them a reason to comply if they're not in a position to comply then they're obviously not going to just as a matter of fact yes so some theoretical cases that I would be looking at would be quite interesting in this but I think it's going to end just about there because the story is going to end there is my point we're creating an environment for these vendors so they're feeling uncomfortable and so they start thinking maybe I'd better do something about it so the follow up question on that is if a couple of these cases were pushed to maybe get a little bit of publicity or maybe even a case goes to goes to court over this isn't the usual stupid business logic then oh we won't we just won't make sure that there's no false stuff in there so we don't have to fuss about it isn't it going to hurt the usual false look I would need to I would need to see how because what typically happens is it all comes out of somewhere like China or Taiwan and so if everybody is asking these people in China and Taiwan to provide the source code I don't think it's going to be it might be a big issue for them but when your buyers have a requirement you start changing your processes to meet those requirements and I guess that's where I would see it would be going does the owner here get away if it was a white box with only one sticker and no source code included the box contains only one thing on the outside, no software included no source code if it had no software included that would be a misrepresentation well if it says no source code provided that doesn't get over the representation which is being made which is it's properly licensed so the court said when you sell something you're making a representation that you are able to sell it and in addition that it's properly licensed and if they're saying that it is properly licensed that's a misrepresentation if the words if they put something on the box which says this is well but then they're not allowed to sell it they have no right to sell it but I don't think you can get around it so was there other it was sort of related if they had a big sign up in the store saying we make no representations about availability if you can whether this is like properly licensed or whatever so they don't have a right to sell it I sort of see where everyone's going but the court I mean basically you gotta step back a bit and say well how's the court going to look at a vendor who's basically saying the Trade Practices Act doesn't apply to me right simply by putting a sign up and we'll the court say well okay you don't have to play by you don't have to play by the rules that everybody else does or we'll the court say well no get sensible you're going to still be in trouble well the no refund is let me take you back a bit so the no refund comes from section 53 existence, exclusion condition, warranty, guarantee, right or remedy and there's another section in the Trade Practices Act which says these rights are implied into all consumer transactions so if they're implied by law into a consumer transaction and you say you don't have that right that's a false representation about a right that's where the refund comes from but basically you know if the question is well can't they put up something in their store so that it's they're getting around the act and the answer is well I'm you know maybe but I think probably not and if they put something up a court's going to be not very happy with them because you can't if basically the question is can I opt out of being bound by the legislation and the court's going to say well no I'm not going to reach that sort of a conclusion my other question is like about the remedy if they can't actually remedy the thing do you think it's like the court would say well this white box thing can't do it you could supply the netgear one whatever that does come with everything and you'll have to pay for it ultimately in all of the infringement cases it comes down to what's going to happen in the future I mean if you have a look at the remedies that have come out of the other cases it's always well in the future I will make sure I put the source code up and I will do something like put the pass source code up on a site somewhere so the question was effectively can you substitute something but I I think they would just depend on the circumstances but I don't think just substituting something it's probably not going to get you there what about the case they're going to give you the bare minimum to be in compliance with the license so they give you the source code but not all the build tools or the tools to reflash the realms the issue is is an infringing copy and if it's an infringing copy then they've got a problem and if you look at the GPL the GPL has that wording that covers that but the other licenses don't go into the detail and so you might have to argue the toss and if you have to argue the toss it's really just a question of is it worth the effort to argue the toss with them and probably not Steve there's a couple of people down here too Steve I wonder if the more worrying problem for most of the people in this room is that they are actually more likely to be in the position of the little lady in Taiwan that we're actually manufacturing stuff which we then sell and we are likely to be caught on the other side of the fence and to me that's an interesting example but the lesson that I take away from that is that there's an awful lot of care that we need to take in using open source stuff either in embedded devices or in even websites the answer is yes but there's nothing in a sense the ground was broken by Microsoft with closed source software this is sort of taking it seeing whether the existing stuff these court cases are about Microsoft office and Microsoft windows so I don't see there's anything I don't see that you have to take extra care in relation to open source I guess is the comment I'm saying what I see it is you've got to take care and you might have to do different things but it's sort of the same sort of idea you have to take sir your example was really as the agent of the middleman to represent the seller but in many other forms of law there's kind of the representation of first sale from manufacturer which is somewhat more ignorant of a reseller model so books and media and tangible goods and so on isn't there some kind of in this particular example to actually just go at the manufacturer and not really focus on the agent and whether he represented it accurately or not this is this doesn't get the manufacturer off the hook it's just saying effectively what it's saying is middle middle people cannot simply say well I didn't know and therefore bat off any issues that might come up if it's a consumer transaction and what I didn't say is that that means it's for less than $40,000 so if it's over $40,000 it doesn't count but if it's a consumer transaction then what the law what the legislature has done in doing the consumer law is saying well if you're a consumer you don't have to fix up the chain to find somebody we will let you just go after whoever you can find and effectively that's why you don't have that first sale sort of well that's sort of true because it's in so far as manufacturers have to sell to somebody and if it's a reseller if all of the resellers are worried that this fridge for example doesn't get as cold as it's supposed to do and they're going to get sued if they sell this fridge that goes back up the chain to the manufacturer so it's not like having pressure on the resellers he's not pressure on the manufacturer he does put pressure on the manufacturer in terms of being the agent what sort of things do we have to look out for when we're delivering the products and software I've got a website contract I've bought a system I've driven by a community project I've delivered it to the client what sort of things do I need to look out for am I exposed to bugs that somebody else introduced if their site doesn't work because if somebody else can he gum me for I think it doesn't matter I think that's a question that can't be sort of answered right here and now what are the things that we need to be worried about then well just as a general statement about contracting you just have to be clear about what it is you're providing and what it is you're not providing so for example often in a contract component and I'm drafting it I'll just say we're not providing you the software we're not giving you a license to the software which is true open source software is typically licensed from a third party being the copyright holder if you if you and then it'll come down to a decision you're making about whether or not you want to take some responsibility if there's anything wrong with the software for which you would probably charge a premium to respond to and you might have a tiered structure for responding to it if it's like this then we'll do this and we'll do this this and this or you might say well if there's anything wrong with it well it's just not our problem and the reason it's not our problem is we're not charging it for it and you've got to understand that and if you're not happy with it then don't buy it from us yeah it's just the answer would be the same nice to know you're all listening say I buy this busyfoss device as a consumer and then a couple of months later I sell it on eBay am I then liable? technically probably then the question is you know who's going to go with you that's all we have time for thanks guys I'm sure Brendan will be able to I'd just like to thank Brendan for talking to us today on behalf of Linux Australia as a small gift thank you