In-Depth

SCO Fine Tunes Its Claims; Court Deadline Looms

A preliminary ruling in December sets this week as the deadline for providing specific Linux code misappropriation examples to IBM. "Derivative works" is the focus of SCO's argument.

• By Stephen Swoyer
• 01/06/2004

Although the ruling by U.S. Magistrate Brooke C. Wells undoubtedly cheered the hearts of open source advocates—Wells took the not unreasonable position that IBM is entitled to see more specific evidence of the code misappropriations that SCO has charged it with—analysts cautions that because of its broad plan of attack, SCO is by no means down and out.

The decision capped a year of quasi-obscurantist posturing by SCO, which, after going on the warpath against Linux last March, declined to provide major Linux vendors with evidence of the misappropriation and line-by-line copying of code that it alleged, both in its lawsuit with Big Blue and elsewhere.

Even more telling was SCO’s demand that IBM comply with the terms of its Unix System V license or risk having that license revoked: SCO didn’t provide any prescriptive guidance as to what IBM could do to get compliant, and its deadline came and went with nary a response from Big Blue. Thereafter, SCO trebled the amount in damages it was seeking, from $1 billion to $3 billion.

To date, SCO has provided IBM with its complete Unix System V source code—in motions filed with the court, Big Blue’s lawyers reported receiving 46 CDs totaling more than 900,000 pages of code—but still hasn’t provided IBM with specific examples of proprietary Unix code that has been available as open source by IBM. IBM filed a pair of motions to compel a proper response from SCO to Interrogatories Nos. 12 and 13. Last month’s ruling means that SCO has until this week to provide IBM with more specific information about its claims.

In the first motion, Interrogatory No. 12, Big Blue requested that SCO disclose precisely which code in Linux it has rights to, presumably as a result of its ownership of the Unix System V source code, as well as describe what it believes those rights to be. In its second motion, Interrogatory No. 13, IBM requested information about instances in which SCO may have made its proprietary Unix code available to the open source community, which would have occurred in violation of the intellectual property rights that it now seeks to assert.

While SCO has declined to share snippets of misappropriated code with Big Blue and major Linux vendors, the embattled company has been more forthcoming with industry analysts, enterprise users of Linux, and its own user base. During a keynote address at SCO Forum 2003 last summer in Las Vegas, Chris Sontag, senior vice president and general manager of SCO’s SCOsource IP licensing initiative, showed attendees several snippets of code that SCO claims have been illegally copied into Linux. SCO has also expressed a willingness to show enterprise users of Linux snippets of suspect code, provided they sign an NDA, of course.

One problem is that SCO’s examples have been less than convincing. For example, the kernel memory allocation routine that Sontag revealed at SCO Forum may have been legitimately transferred to Linux—not under the GNU General Public License (GPL), but instead under a BSD license. “The same code is available under the BSD license … in code copyrighted by the University [of California],” wrote Open Source advocate Bruce Perens in an online discussion thread (see http://lwn.net/Articles/44981/). Because of this, many open source advocates and Linux enterprise users have thus far been underwhelmed by the evidence SCO has put forward in support of its charges. When SCO made noises about expanding its fight to include enterprise users of Linux—and then introduced a special license, dubbed the “SCO Intellectual Property License for Linux”, that would let allow them to “get clean”—some users began to smell a rat. “They can sue companies until the cows come home. Unless and until it is proven in a court of law that Linux infringes on SCO-held code, and that the GPL is invalid, and that IBM was responsible for putting that code in, they are not licensing, they are racketeering. They are more or less doing a shakedown of companies for 'protection,’” argued James Melin, a systems programmer with a county government that uses Big Iron Linux in a limited fashion, last year.

Fine Tuning Its Claims

Since then, SCO has fine-tuned its claims of misappropriation and infringement, focusing on so-called “derivative works”—Unix routines or technologies that weren’t developed by SCO, such as read-copy update (RCU), symmetrical multiprocessing (SMP), non-uniform memory access (NUMA) and IBM's Journaled File System (JFS), but which have been incorporated into Linux.

“SCO’s claim is that much of the add-on Unix development done by IBM and others, things that were added to the basic Unix System V [code], as they evolved their own versions of Unix—even the add-on parts taken by themselves—are derivative works of Unix, and therefore a violation of copyright, if they’re made available as open source,” explains Gordon Haff, a senior analyst with consultancy Illuminata.

According to Haff, the point of contention has shifted away from questions of straightforward copyright infringement and issues of line-by-line copying of source code to a notion of derivative works copyright infringement, in which SCO is applying “an extremely broad reading of a derivative works copyright law” to argue that literally anything built on top of, or as a result of exposure to, Unix System V source code and libraries and which is subsequently made available as open source constitutes copyright infringement.

SCO spokesperson Blake Stowell claims his company’s effort to assert copyright privileges over derivative works has been a primary thrust of its case from the beginning. “That’s been our claim all along. Our case has been a contracts-based case and not a copyrights case to this point,” he maintains. “Certainly, it was well within IBM’s right to develop AIX based on the Unix System V source code that we provided them with as part of their license of Unix. They were well within their right to develop that and sell that. Where we claim that IBM went outside the bounds of that license and that contract is where they took AIX code and contributed it to Linux, which they have no right to do.”

Viewed in this light, Haff says, it’s much too early to write SCO off—even if the embattled vendor turns over little new or otherwise substantive in support of its claims of line-by-line copying of code. “Certainly, SCO’s derivative works claim is extremely broad, and I don’t mean to suggest that it’s any more legitimate than the line-for-line copying charge, but whether there’s a valid claim there or not, the argument around that [derivative works] claim comes down to a more abstract, legal theory, legal case law precedent, et cetera type of argument, as opposed to this intuitive thing [line-by-line copying],” he notes.

A vendor’s ability to assert its copyright over derivative works has been tested in the past, Haff notes, notably by Nintendo, which asserted that a device called the Game Genie, designed to be inserted between a game ROM cartridge and the Nintendo console system, violated its copyrights. At the time, the court conceded that the Game Genie interacted with Nintendo’s proprietary components at a low level, but noted that “the examples of derivative works provided by the [Copyright] Act all physically incorporate the underlying work or works. The act's legislative history similarly indicates that ‘the infringing work must incorporate a portion of the copyrighted work in some form.’”

In the coming weeks, SCO will also press IBM for additional information, such as source code for all versions of AIX, along with source code for all versions of the Dynix operating environment—originally developed by NUMA specialist Sequent—which IBM acquired in 1999, The Deseret News reported last month. “We want to know what part is trade secrets, what part is contract, what part is copyright, until we've seen all of IBM's contributions," SCO CEO Darl McBride told the publication. "We can't point out what we don't know. … It's important we get a scalpel here and see exactly what we're looking at."

Stowell says his company will comply with Wells’ ruling, but notes that SCO has motions pending for disclosure of the AIX and Dynix source code later this month, which Wells could rule on by January 23.

“We felt like we had provided IBM all of the evidence that they had asked for. They wanted us to be more specific about the code we had given to them as part of this case, and so we will do that within the next thirty days,” he said in early December. “But on January 23rd, there will be another Motion to Compel hearing, where we will have the opportunity to ask the judge to compel IBM to provide certain evidence that we feel they haven’t provided.”

SCO also plans to append a new charge to the existing charges in the case: That of copyright infringement.

“I’ve not yet seen even a draft yet of that filing, so I really can’t speak to what the lawyers will present,” he concludes.