The Copyleft Audit

Question 12: The Copyleft Audit

Your role

You represent Kestrel Devices, a hardware startup, after receiving an audit demand and infringement claim from the Meadowlark Software Foundation concerning an open-source component. The board meets in five days and wants options, exposure numbers, and a recommendation.

Governing law

1. Copyright infringement requires copying of protectable expression. A license is an affirmative defense.

2. Whether a license term is a condition or a covenant controls the remedy. Use outside the scope of a condition supports an infringement claim. Breach of a covenant supports only contract remedies.

3. The reciprocal license at issue provides, in relevant part: "You may distribute this software or works based on it only if you provide recipients the complete corresponding source code and this license. Conveying a work to third parties on a physical product is distribution. Providing access to the software's functionality over a network, without transferring a copy, is not distribution." These scope terms are conditions.

4. Internal use and modification without distribution do not violate the license.

5. Statutory damages and attorney fees are available only if the work was registered before the infringement began or within three months of the work's first publication. Otherwise the owner is limited to actual damages and the infringer's attributable profits.

6. Knowingly removing or altering copyright management information, including license headers and author attributions, with intent to conceal infringement, supports a separate claim carrying statutory damages of $2,500 to $25,000 per violation, independent of registration timing.

7. A contract claim that requires proof of an element beyond unauthorized copying, such as a promise to provide source code, is not preempted.

8. Injunctive relief requires irreparable harm and inadequacy of legal remedies. Harm is not presumed from infringement.

9. The scope of a "work based on" the licensed software turns on whether the allegedly derivative code incorporates, adapts, or is intimately intertwined with the licensed code, not on mere interoperation through a stable interface.

Facts

Kestrel sells a warehouse-scanning device. Its firmware incorporates "OpenTrellis," a Meadowlark library governed by the license quoted above. Kestrel modified OpenTrellis to support its sensor and shipped the modified library in the firmware of 41,000 devices over 19 months. Kestrel never provided source code or the license text to purchasers.

Kestrel also runs a cloud analytics service. A separate backend module links against unmodified OpenTrellis. Customers access the analytics through a web dashboard. No copy of the backend is ever transferred.

Fourteen months after Kestrel's first device shipped, Meadowlark registered the OpenTrellis copyright. OpenTrellis was first published four years ago.

During an acquisition diligence scan, a third party detected OpenTrellis code in Kestrel's firmware and notified Meadowlark. Meadowlark's demand letter seeks: an immediate halt to device sales, release of Kestrel's entire firmware and cloud codebase under the reciprocal license, an audit of all Kestrel repositories by Meadowlark's chosen examiner, and $2 million.

An internal Kestrel message from a senior engineer, written during initial integration, reads:

"Strip the headers before we ship. Nobody diffs firmware."

Repository history confirms the OpenTrellis license headers and author attributions were deleted from 63 source files before the first release.

Kestrel's engineers estimate that replacing OpenTrellis with a commercial alternative would take six weeks and cost $180,000, during which device manufacturing could continue but new firmware releases would pause. Releasing the modified OpenTrellis component's source, standing alone, would reveal little of competitive value. Releasing the full firmware would expose Kestrel's proprietary sensor-fusion code, its principal asset. Kestrel's device revenue is $28 million per year at a 34 percent margin. A strategic acquirer's letter of intent is outstanding.

Assignment

Analyze:

• Whether shipping the modified library in device firmware violated a license condition, and the consequences of the condition-versus-covenant distinction here.
• Whether the cloud backend's network use is distribution under the supplied license text.
• How far the "work based on it" obligation reaches: the modified library alone, the firmware, or the cloud codebase.
• What damages Meadowlark can actually recover given the registration timeline, and how the header-removal claim changes the exposure arithmetic. Provide a defensible exposure range.
• The evidentiary effect of the "strip the headers" message.
• Whether Meadowlark can obtain an injunction halting device sales, and what Kestrel's strongest arguments against irreparable harm are.
• The audit demand: what scope Kestrel should accept, resist, or counterpropose.
• Remediation paths: releasing the modified component's source, the six-week replacement, a paid commercial license, or a negotiated settlement. Compare them.
• The effect of the pending acquisition on strategy and disclosure obligations to the acquirer.
• The concrete course of action to recommend to the board, with sequencing over the next 30 days.

Q12 key (Copyleft Audit)

1. Shipping the modified library in 41,000 devices was distribution in breach of a license condition; that supports infringement, not merely contract, with the remedial consequences that follow. Missed: the exposure model is built on the wrong claim type.
2. The cloud backend is not distribution under the supplied license text (network access without transfer); the demand to open the cloud codebase has no basis. Missed: the crown jewels are negotiated away.
3. The copyleft reach is the modified library, and at most intimately intertwined firmware components; the sensor-fusion code interacting through interfaces is defensibly outside "work based on it." Missed: full-firmware release conceded unnecessarily.
4. Damages arithmetic: registration came 14 months after infringement began and far outside the publication window, so statutory damages and fees are off the table for infringement; exposure is actual damages and attributable profits, heavily contestable on causation. The header-removal claim is the real statutory exposure: 63 files at $2,500 to $25,000 each, roughly $157,500 to $1.6 million, independent of registration. Missed: the $2 million demand is evaluated against the wrong legal ceiling, in either direction.
5. The "strip the headers" message plus the 63-file deletion history establishes the knowledge and concealment elements of the header claim and poisons every discretionary call; treat it as unexplainable and price it. Missed: negotiation posture assumes deniability that does not exist.
6. Injunction risk is real but resistible: remediation paths (source release of the component, six-week replacement) undercut irreparable harm; a sales halt is not the probable outcome if Kestrel moves first. Missed: panic concessions to an unlikely remedy.
7. Audit scope: accept a scoped examination of firmware repositories containing or derived from OpenTrellis by a mutually acceptable examiner under protective terms; refuse the full-codebase, opposing-party-controlled audit. Missed: discovery-by-audit into proprietary code.
8. Recommended course: immediately cure prospectively (publish the modified component's source and license text, restore attributions, start the six-week replacement in parallel), then negotiate a paid settlement sized to the header exposure and profits risk, with acquisition-disclosure to the acquirer handled promptly and accurately. Missed: the letter-of-intent becomes the casualty.