French bill could chill open source

On May 4, the French Senate will debate a copyright bill that is widely expected to have a chilling effect on the development and distribution of open-source software for digital rights management (DRM) or peer-to-peer file sharing. That’s because the bill’s provisions include a penalty of up to three years in prison and a fine of ?300,000 (US$363,171) for publishing, distributing or promoting software in France that is “manifestly intended” for the unauthorized distribution of copyright works.

On May 4, the French Senate will debate a copyright bill that is widely expected to have a chilling effect on the development and distribution of open-source software for digital rights management (DRM) or peer-to-peer file sharing. That’s because the bill’s provisions include a penalty of up to three years in prison and a fine of 300,000 euros ($363,171) for publishing, distributing or promoting software in France that is “manifestly intended” for the unauthorized distribution of copyright works.

The developers of the open-source multimedia player VLC, which can read DRM-protected DVDs, consider themselves targeted. But the legal uncertainty over the term “manifestly intended” makes the bill’s coverage so broad that it could even cover the open-source Web server Apache, which hosts over 60% of Web sites, opponents of the bill say. Open-source projects are thought to be more vulnerable than commercial operations because they typically have few resources at their disposal to defend legal actions.

France has been a strong supporter of open-source software, with many publicly funded bodies either using it or developing it. Legislation that punishes development and distribution of open-source applications could weaken projects based there, and tarnish the image of the open-source movement with users.

The text of the bill, entitled “Authors’ rights and related rights in an information society,” aims to transpose the requirements of the European Copyright Directive into French law. France is one of the last countries to transpose this European directive into national law, a situation that prompted the French government to rush the bill through its first reading in the National Assembly using emergency procedures. The bill will have its second and final reading in the Senate beginning May 4, and then must be approved by the president and finally published in the government’s Official Journal before it can become law.

Deputies gave their assent to the bill on the afternoon of March 21, and within hours it had claimed its first victim: the French “mirror” of the development site for the open-source file-sharing application Emule.

The Emule project is hosted by Sourceforge.net, a collaborative workspace for open-source developers run by OSTG Inc. Sourceforge provides discussion boards, tracks source code changes and hosts downloads for around 100,000 open-source projects.

A number of Web hosting companies around the world, among them OVH SAS of Roubaix, France, offer local copies, or mirrors, of the complete Sourceforge site to spread the load. But soon after deputies voted, OVH Chief Executive Officer Octave Klaba wrote to his customers to tell them: “We are going to remove Emule from our mirror of Sourceforge.”

As well as announcing Emule’s impending removal from the OVH mirror of Sourceforge, Klaba warned customers that they too face a fine or prison for distributing P-to-P software, and said the company will close down any of its servers found running or hosting such software.

OVH’s move has prompted French supporters of open-source software to open a “reserve” for endangered applications.

The legal threat posed by the bill is still imaginary until it becomes law, but the fear it is creating is just as damaging, according to Loic Dachary, a spokesman for the Free Software Foundation France (FSF France).

“People are going to say that, to avoid risking prison, they’re going to banish open-source software [from their servers],” Dachary said.

The prospect that no one will want to host open-source software in France if the bill becomes law has prompted FSF France to step in as host of last resort with a reserve for open-source software.

“Anyone who is afraid [of the bill] can announce that they want to host the software in the reserve,” Dachary said.

The reserve is operated by another campaign group, EUCD.info, hosted on servers in France, but FSF France is taking the legal responsibility, promising to defend the right to host open-source projects in the courts if necessary.

The reserve is already home to a handful of applications. For instance, there’s Azureus, a P-to-P client for the BitTorrent file-sharing system written in Java, and a number of other P-to-P applications including Emule, Solipsis, Maay and TinyP2P.

But the campaigners have also placed the Linux kernel and the Web server Apache in the reserve, a move which they hope demonstrates how ridiculous the bill’s provisions could be.

“The Linux kernel contains a component necessary for any exchange over the Internet: the TCP/IP stack. All the pirates utilize TCP/IP, and can’t commit their illegal acts without this component. Are French publishers distributing the Linux kernel targeted by Article 12bis of the bill? Maybe, maybe not. We just don’t know,” the reserve’s creators write, explaining its inclusion.

Putting a piece of software in the reserve is “a symbolic gesture” that challenges senators examining the bill to ask themselves whether they should really be driving development of open-source software out of the country, Dachary said.

“The law obliges us to flee French territory,” he said.

Olivier Chalouhi, founder of the project developing the Azureus client for the BitTorrent file-sharing protocol, believes the law will harm France more than it will hurt open-source projects like his.

“The law won’t change anything for P-to-P software, as it is developed at an international level. The only thing is that really smart people working in France may go abroad, and that’s not in the French interest,” he said.

Other European countries are re-examining their implementation of the European Copyright Directive, with varying consequences for open-source projects. Denmark may require DRM vendors to provide the information necessary to make interoperable systems — a plus for the open-source movement as it would allow, for example, the creation of media players that can play protected copyright works on the Linux OS. Meanwhile, Germany may toughen the sanctions for individuals caught sharing copyright works without authorization, increasing the risks for operators and users of P-to-P applications, whether open source or proprietary.

If these measures are being re-examined, could open-source software face the same threat elsewhere as in France?

“Today, that’s not a worry for us,” said Dachary. “The idea that other countries might change their law to introduce restrictions [on open-source software] seems unlikely.”