GitHub & other LLM-gen-AI Companies Urge You to Misdirect California Legislature on FOSS Licensing!

GitHub, Mozilla, Hugging Face, and other LLM-gen-AI companies oppose updates to the California Artificial Intelligence Transparency Act (SB 1000), arguing that provisions requiring revocation of licenses for modified systems conflict with FOSS licensing. The Software Freedom Conservancy refutes these claims, stating the law is good for software right to repair and that the companies' arguments are disingenuous.

A blog post from Software Freedom Conservancy. Blog post by Bradley M. Kühn. Please email any comments on this entry to <bkuhn@sfconservancy.org . Last week, Microsoft's GitHub 1 https://sfconservancy.org/feeds/omnibus/ return-microsoft-wholly-owns-github-anti-copyleft announced they'd joined a coalition of other LLM-gen-AI for-profit entities who oppose updates to the California Artificial Intelligence Transparency Act “Cal. Bus. & Prof. Code § 22757” . In Cal. Bus. & Prof. Code §22757 and its updates currently under debate in the current session's SB 1000 https://leginfo.legislature.ca.gov/faces/billCompareClient.xhtml?bill id=202520260SB1000&showamends=false are — like most legislation we see around new technologies in USA State and Commonwealth legislatures — well meaning and seeks reasonable goals, but remains confused about some details that are obvious to those who deeply understand the technology. Regardless, the law's aim is good policy. Definitely read through its interesting terms https://leginfo.legislature.ca.gov/faces/billCompareClient.xhtml?bill id=202520260SB1000&showamends=false found in the amended §§22757.{1,2,3 a } proposed in SB 1000. I suspect anyone who uses a for-profit, proprietary LLM-gen-AIs perhaps by choice, or perhaps under mandate from their employer would strongly prefer LLM-gen-AI vendors to provide the tools and information that §22757 mandates. These policy goals — mandating transparency and allowing users to “trust but verify” these systems — are precisely the requirements that we want deployed widely for any LLM-gen-AI. SFC's own recommendations on LLM-gen-AI https://sfconservancy.org/llm-gen-ai/llm-backed-generative-ai-recommendations.html , in fact, correlate with and encourage “after market” implementation of some of §22757's requirements. While this law is of course not written the way technology policy wonks would likely write it, on balance, the law is a good one. Of course, GitHub, Mozilla, Hugging Face, Black Forest Labs, and likely other companies hate this law. It requires them to do work to treat their users better. No one in the business of proprietary technology wants to do any more of that than is absolutely necessary to keep the customer. After all, it cuts into profits if companies do anything nice for their users that the customers have not directly demanded through a contractual requirement. These for-profit corporations use misdirection and disinformation to convince the public that this law is bad for FOSS. Cal. Bus. & Prof. Code §22757 both as on-the-books now, and as proposed for amendment is not bad for FOSS , and, is generally good for the software right to repair. Complaints regarding SB 1000 from Big Tech and their cronies focus on a narrow point in the amendments found in §22757.3 b 1-3 . Herein, I analyze this clause, and refute these companies' falsehoods about how it impacts FOSS. The key portion found in the proposed-amended §22757.3 b 1-3 reads: 22757.3 b On the surface, their argument that claims that text contradicts the irrevocability of FOSS licenses has truthiness. Nevertheless, their argument is sophistry. Here's why: - If a covered provider licenses its GenAI system to a third party, the covered provider shall require both of the following as terms of the license: - That the system remains in compliance with this chapter, to the extent it is technically feasible. - That the covered provider may revoke, suspend, or terminate the licensee’s authorization to use the GenAI system if the licensee modifies the GenAI system such that it no longer complies with this chapter. - If a covered provider knows that an identifiable third-party licensee modified a licensed GenAI system such that it no longer complies with this chapter, the covered provider shall terminate the licensee’s authorization to use the GenAI system within 72 hours of discovering the licensee’s action. - A third-party licensee shall cease using or making available a licensed GenAI system, including a copy or modified version of the GenAI system, after the licensee’s authorization to use the GenAI system has been terminated by the covered provider pursuant to paragraph 2 . - This subdivision does not require a covered provider to monitor, investigate, or otherwise inquire into a third-party licensee’s use or modification of a licensed GenAI system. SFC called our statement seeking a FOSS-friendly LLM-gen-AI system https://sfconservancy.org/news/2024/oct/25/aspirational-on-llm-generative-ai-programming/ aspirational precisely because none of the currently deployed LLM-gen-AIs in wide use are anywhere near FOSS . The portions installed on the users' computers are of course, proprietary. Those on-system UIs are thin layers that access a service via an API — which lives on some server running trade-secret software. Unsurprisingly, GitHub's statement gives not a single example of a specific LLM-gen-AI whose distribution is already thwarted by the existing Cal. Bus. & Prof. Code §22757, nor one that was not thwarted by the existing law but would be thwarted if the amendments in SB 1000 are adopted. They didn't name one because there isn't one . While non-copyleft licenses such as the MIT and 3-Clause-BSD licenses are indeed irrevocable, they also permit redistributors of the software to impose additional terms that are not accounted for in the upstream license text. Therefore, even if Microsoft's GitHub were to release all of Copilot model, server-side code, on-system UI under the MIT license, they could do so with an additional term that complied with either formulation of Cal. Bus. & Prof. Code § 22757. I highly doubt that Microsoft, GitHub or the other entities who deploy these systems in California would ever willingly release one of their LLM-gen-AIs under a copyleft license. However, even if they did, the GPL Agreements already account for such situations. First, nothing in SB 1000's amended § 2757.{1,2,3 a } conflicts or contradicts anything in any version of the GPL Agreements. Any entity that might someday release a GPL'd LLM-gen-AI can both simultaneously comply with GPL's requirements and meet all the requirements in §2757.{1,2,3 a } . Nothing in GPL prohibits a redistributor from doing extra nice things for their customers and users beyond copyleft — as long as they don't directly contradict a requirement already in the GPL. SB 1000 2757.3 b requires some complex analysis, but causes no problem. All versions of the GPL Agreements had to consider that software patent licensing might impose additional restrictions outside of the GPL. Specifically, the GPL has no real mechanism to force a third party 2 https://sfconservancy.org/feeds/omnibus/ return-patent-license-gpl who has never copied, modified, distributed, installed, and/or deployed the GPL'd software to issue a GPL-compatible patent license. All versions of the GPL Agreements therefore have a catch-all clause to deal with situations where external conditions make it impossible to comply with the license. Here's that clause from GPLv3: 12. … If conditions are imposed on you whether by court order, agreement or otherwise that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program. This clause was specifically designed to catch situations like we have with Cal. Bus. & Prof. Code § 2757.3 c and SB 1000 §2757.3 b 's amendments . Imagine that this series of exceedingly unlikely events come to pass. Some Big Tech company: condition imposed onthis company that contradict s the conditions of the GPLv3 . This company now cannot convey the covered work so as to satisfy simultaneously their objections under GPLv3 and … other pertinent obligationsimposed by §2757.3. The GPL Agreements planned for this possibility: in the end, GPLv3 requires everyone in the distribution chain from the original company down to all its licensees to stop conveying the work. NB: GPLv2§7 is nearly identical to GPLv3§12. Furthermore, note that the GPL Agreements terminate on their own when any entity in the distribution chain violates any term — including GPLv3§12 / GPLv2§7. So, yes, GPL Agreements are irrevocable, but only as long as everyone remains in compliance with the license . Termination for reasons of non-compliance is fully accounted for, and thus the SB 1000 changes to Cal Bus. & Prof. Code § 22757.3, despite GitHub's misdirection, actually make the law more copyleft-compatible by changing the term ”revoke” to ”terminate“ — which tracks GPL's language exactly Even if the analysis above fails, and a Court rules that there is an irreconcilable incompatibility in California between the GPL Agreements and Cal. Bus. & Prof. Code § 22757 as it currently stands, or as amended by SB 1000 , a simple addition to GPLv3§7 can account for this. That section, entitled Additional Terms is designed to explicitly incorporate pro-user policy terms that might not be explicitly available in GPL Agreements. Regardless, there is no need to rush to update the GPL Agreements on this front, as the above analysis likely holds. Below we include our own template letter that we urge you to download, modify into your own words, and send it to Senator FIXME. It's particularly important to do this if you live or work in California, and be sure to Cc your own senator as well. Letter coming in about 30 minutes, check back soon. 1 https://sfconservancy.org/feeds/omnibus/ return-microsoft-wholly-owns-github In June 2018, 2 https://sfconservancy.org/feeds/omnibus/ footnote-patent-license-gpl Various terms of the GPL Agreements can bind patent holders in various ways to keep the code safe from patent infringement claims for downstream users