The Open Invention Network (OIN): Oracle vs. Google is its biggest debacle so far

Right after I learned about Oracle's patent infringement suit against Google, I pointed out that this was "another big failure for the so-called Open Invention Network" (OIN), an organization that claims (without any credible evidence) to protect the Linux ecosystem against patent threats.

The OIN has three stated goals, and a few commentators failed to look at all of them:

1. The OIN buys up patents at auctions and licenses them for free to companies who accept its license agreement. This part isn't relevant to Oracle vs. Google. Oracle asserts seven patents that previously belonged to Sun but never belonged to the OIN.


2. The OIN wants to serve as a deterrent because it might enforce those patents against other companies. Mutually assured damage. This isn't stated explicitly on its website but it's made pretty clear by some of its press releases, such as this one ("'We view an OIN license as one of the key methods through which open source leaders and innovators can deter software patent aggression,' said Lasse Andresen, CEO of ForgeRock.").
   
   Oracle sued Google without any fear of the OIN possibly enforcing against Oracle, as an act of retaliation, some of the patents it acquired. So the OIN has certainly failed on this count (until it proves the opposite, but I'm sure we won't see it happen).


3. In the Oracle vs. Google context the most important fact is that the OIN, in addition to the two previous items which relate to patents the OIN itself owns (as a company), also tries to establish a plurilateral (multi-company) cross-license agreement with respect to those companies' patents. The OIN recently announced that by the end of last quarter 140 companies had acceded to its license agreement.
   
   What has failed here is primarily this multi-company cross-license agreement. If it worked, it would serve as a Linux-related cross license deal -- a patent peace treaty -- between (among others) Oracle and Google. But everyone can see now that it doesn't.

TheRegister quoted me on Oracle vs. Google, and I highlighted the OIN's failure.

Well-known FOSS advocates share the concern

I was the only vocal critic of the OIN's shortcomings for some time, but the fact that Oracle (one OIN licensee) decided to sue Google (another OIN licensee) over an essential component of Android has led others to also express doubts concerning the OIN's suitability-to-task.

Simon Phipps was formerly Sun's chief open source liaison and is now a ForgeRock executive. ForgeRock is one of OIN's 140 licensees. Simon is also a board member of the Open Source Initiative. On Twitter he wrote:

"Oracle's move is a huge test for OIN. They need a coherent response when one licensee attacks another over a Linux distro."

Bradley Kuhn, a former FSF executive and now the Technical Director of the Software Freedom Law Center (SFLC), pointed out on identi.ca:

"OIN claims to be defenders against patent trolls that hurt [FOSS]. What'll it do when its members are the trolls?"

While Brad is right to call the OIN into question, his organization's silence about the Oracle/Google situation is conspicuous. They've now had more than a week to take a position. On the SFLC blog, something related to BlackBerry (!) was discussed a week ago. But not a word on Oracle vs. Google. I explained the primary reason here.

There's also a conflict of interests. Last year Eben Moglen, the SFLC's leader, declared in a submission to the European Commission that "the funding from Oracle [...] has [not] exceeded 5% of our total funding since SFLC's inception." Then you might add funding from Sun (now owned by Oracle) on top. Presumably it was a lot. Sun was known to be very generous vis-à-vis such entities...

Questions concerning the OIN's true agenda

The OIN is funded by IBM, Philips, Sony, NEC, Red Hat and Novell, and to a lesser degree, Canonical.

When a "cartel" like that suffers a failure of enormous proportions, you can be sure that there will be apologists trying to spin-doctor the event. It's critical for the OIN and its allies to do so. After all, the OIN's inability to do what it claims to be able to do raises questions as to whether there's a hidden agenda concerning those patents.

I feel strongly that there is an ulterior motive: the OIN's owners want to disadvantage non-member FOSS companies. They want to equip those whose FOSS programs are covered with a "protected by OIN" selling point, although the Oracle vs. Google situation makes that selling point pretty weak from today's perspective. By not protecting the FOSS projects that are relevant to their competitors, they can try to distort competition. In a worst-case scenario, the six owners could even decide to use the OIN as a patent troll that enforces its patents against the competitors of its owners, especially against FOSS-related ones.

Look at the current situation: if Oracle is right, then the seven patents it asserts will read on Dalvik, Google's virtual machine for Android. Dalvik is an important component: Android applications run on it. You can be sure that if Dalvik were a similarly essential part of Red Hat's or Novell's Linux distributions, or if it played an Apache-like strategic role to IBM, it would definitely fall within the OIN's scope of protection.

My suggestions would solve the problem for Dalvik

The OIN has a completely arbitrary definition of "the Linux System", which is a list of programs to which its whole patent license agreement relates. Apache is on that list, although it's not needed to run Linux (well, it's simply key to IBM). But Dalvik isn't.

If Dalvik were on the list, Oracle couldn't sue Google now. But Google is only a licensee, not an OIN member, and therefore has no control over the OIN's definition of "the Linux System".

Back in June I made four alternative suggestions for how the OIN could address the problem of the arbitrarily defined "Linux System" and provide a reliable definition or at least a proper process. If you look at those suggestions, you can see that any one of the four could solve the problem for Dalvik.

Another way to look at those suggestions is to read them one by one and ask oneself: why doesn't the OIN do any of that if it's sincere? If it really wants to protect the Linux ecosystem, why wouldn't it either use a reliable definition of its scope or otherwise at least put a process in place that it could be proud of?

The only plausible answer I can come up with: they aren't sincere. But I'd be happy to see real improvement. I just doubt it. The OIN prides itself on being one of the biggest buyers of patents. It's spent many hundreds of millions of dollars already. The companies funding that operation certainly want to gain a strategic advantage. An unfair one in my opinion because they capitalize on the lack of patent-related expertise on the part of most of those licensee companies.

Those licensees are largely companies who don't even have a patent department, nor know much about IP strategies, and they fall for the OIN's line. They are misguided by false hopes. Through their support they make the OIN bigger and more dangerous, not better and trustworthier.

The smokescreen they're preparing: Sun wasn't an OIN licensee

In a discussion on ZDNet, Ed Burnette said he talked to "sources close to the organizations [one of which is the OIN]" and that "there's a debate about whether the OIN patent license grants apply to Android or not, given that both Oracle and Google are licensees of OIN (but Sun wasn't)."

Ed is right from a journalistic point of view to look into all of the possible aspects and ramifications of this matter, but the fact that Sun wasn't an OIN licensee is irrelevant and just a smokescreen that the OIN and its apologists are trying to create. I will pre-empt them and explain this right here and now.

I have analyzed the OIN License Agreement:

1. With only one minor exception, all provisions of the OIN License Agreement are limited to the "Linux System" as defined by the OIN (in the form of a list of program files). Dalvik never was on that list. So all those clauses of the agreement give Oracle total freedom to sue Google over (alleged) patent infringement by Dalvik's code.
   
   Note that the term "Linux System" is capitalized throughout the agreement. That means it can be understood only as defined by the agreement, not by common sense.


2. The one minor exception is Section 3.3. It refers to "products that perform substantially the same function as the Linux System". I can't see how this would help Google in any way. The term "substantially" is a fairly high hurdle. There's nothing like Dalvik on the OIN's list, so I can't see how this would apply.
   
   Even if (contrary to my belief) the clause did apply, it wouldn't stop Oracle from suing. That clause would only make it easier for Google to countersue Oracle if Google had patents that read on "the Linux System" and hurt Oracle. I doubt strongly that they have any patents that meet those criteria. (Also, Oracle presumably checked on the risk of retaliation before going to court.)


3. In the combination of the two previous items, you can see that even if Sun's patents fell under the OIN agreement, Oracle could still sue its fellow OIN licensee Google because Dalvik isn't part of the OIN's Linux System definition.


4. Therefore, any talk about the fact that Sun (unlike Oracle, and unlike Google) never signed the OIN license agreement is irrelevant. Should the OIN and its allies tell this to journalists and to community leaders, then it's just a diversion from the real problem: the OIN's arbitrary scope.
   
   The more they try to divert away from it, the clearer it is that the arbitrary scope is a cornerstone of a scheme that can hurt FOSS companies and FOSS projects in the future.

OIN agreement is poorly crafted with respect to acquisitions of companies

Even though -- as I just noted -- the question of Sun's status is irrelevant due to the OIN's fundamentally flawed scope, I nevertheless did look into the hypothetical question of how this relates to Sun's patents (considering that Sun, unlike Oracle, never signed the agreement) out of curiosity and discovered that the OIN license agreement is poorly crafted with respect to acquisitions of companies by licensees.

This is now just about the cross-license aspect of the OIN agreement. For the sake of simplicity, let's forget for now about the patents the OIN acquires because those aren't relevant to the question at hand.

The cross-license between all OIN licensees is established by Sections 1.2 and 1.4.

In 1.2, a newly-joining licensee grants a patent license (limited to the OIN's scope) from there on out to all fellow licensees, certifies that it isn't legally restricted from doing so and declares that there aren't any pending legal claims in the relevant context ("Linux System", as always).

In 1.4, the newly-joining licensee then basically has to grant a retroactive license with respect to the past and always in connection with "the Linux System". It's called a release, not a license, but that's just a matter of terminology.

Let's focus on Oracle vs. Google. Oracle did what Sections 1.2 and 1.4 require. Sun never did. Let's forget for the sake of the argument that the OIN's scope doesn't cover Dalvik anyway. So what would Google do if the OIN covered Dalvik?

Google would firstly have to invoke Section 5.5 of the OIN agreement. Under that clause, Google is a "third party beneficiary" with respect to the agreement between Oracle and the OIN, and has "the right to enforce [the OIN agreement] against [Oracle] and [Oracle's] Affiliates."

The term "Affiliates" (capitalized because defined by the agreement) is key. It's not Oracle Corporation suing Google. It's "Oracle America", which is a wholly owned subsidiary of Oracle and which used to be Sun. But as you can see, Section 5.5 would give Google the right to enforce the agreement also against "Oracle America".

But to enforce the agreement against "Oracle America" is only of use if Google finds something in the agreement that it can benefit from. I repeat myself, but since the OIN's scope doesn't include Dalvik, this here is hypothetical and not a real option anyway.

In this hypothetical scenario, we have to look separately at the commitments Oracle made under Section 1.2 and under Section 1.4.

License grant from a given date into the future (Section 1.2)

Section 1.2 (the grant of a license from there on out) relates to "Your [Oracle's] Patents". The OIN agreement defines "Your Patents" pretty broadly, and states specifically that those are patents belonging to "You or any of Your Affiliates" at any time during the relevant period (which started for Oracle in March 2007 and there's no reason to assume it has ended). The term "Affiliate" is defined in a forward-looking way ("now or in the future").

So even though Oracle signed in March 2007, its acquisition of Sun (concluded in January 2010) would be included. It's not stated explicitly as of when it would be.

One could argue that a company signing the OIN license agreement makes a commitment with respect to future acquisitions (I explained how "Affiliate" is defined in a forward-looking way and Section 1.2 is a commitment "on behalf of yourself and your Affiliates"), but it makes the commitment per se on the day it signs. In that case, Oracle made the commitment as of March 2007 and acquiring Sun in January 2010 -- virtually speaking -- automatically and retroactively extended the license (in Google's favor) back to Oracle's signing date. However, there's no such word there as "retroactive", and a license is typically granted on a given day and then extends into the future. So an alternative and more convincing interpretation would be that Sun's patents fall under Oracle's promise as of January 2010 (because Oracle wasn't able to make a commitment on Sun's behalf before consummating the acquisition).

Android was unveiled in November 2007. So the difference between a license in Google's favor starting in August 2007 (when Google joined) versus one starting in January 2010 is relevant in terms of indemnification that Oracle can demand.

If (hypothetically) Google received a license in January 2010, it would also be relevant. In that scenario, Oracle couldn't now ask for an injunction (meaning a court order to prohibit Google from further distributing Android). In that case, Oracle could -- if this Section 1.2 were the only relevant clause -- only ask for indemnification related to the period from November 2007 (initial Android release) until January 2010 (when the license grant occurred). But Oracle did ask for an injunction, just to remind you.

Still, Section 1.2 is only one of two clauses Google could try to use. There's also 1.4.

Release (retroactive license) for the past

Section 1.4 relates to a release (simply put, a retroactive license) related to the time before a license grant occurs under the OIN agreement. In Android's case, if one assumed (hypothetically) a license grant as of January 2010, the key period would then start in November 2007 (Android's first release, which was after the dates on which Google and Oracle, respectively, became OIN licensees) and end in January 2010.

By committing to Section 1.4 in March 2007, Oracle granted that retroactive license to "each Licensee on the Eligibility Date". One may wonder whether this means that the grant occurs on the Eligibility Date or whether it means that the licensee already has to be a licensee on that date (or else will never benefit). I analyzed the definitions in the OIN agreement. The term "Licensee" has a definition that contains "at any time, now or in the future". That's (hypothetically) good for Google, which joined after Oracle. Also, the OIN agreement talks about "Agreement Date" when it means what in our example is Oracle and "Eligibility Date" would in our example be when Google joined. Otherwise the distinction between "Agreement Date" and "Eligibility Date" wouldn't make much sense, nor would I be able to make sense of the definition of "Eligibility Date" as "the later of the [Oracle] Agreement Date and the date such Licensee [Google] becomes a Licensee."

What I consider a shortcoming of the OIN agreement is that it doesn't clearly state in the definition of "Eligibility Date" (and/or the definition of "Licensee") that this relates to OIN licensees other than the party signing the agreement at the relevant time (which also makes it a licensee, immediately). That clarification would eliminate the need to argue that it's the only way to explain the distinction between "Agreement Date" and "Eligibility Date".

But for the reasons I just explained, my interpretation is that Oracle did grant to Google a license to Sun's patents -- and even a release (retroactive license) for the past -- within the OIN's scope. And that scope is, as I explained on multiple occasions, the biggest OIN-related problem.

Since I concluded that Oracle did grant that retroactive license, the end result is the same whether one says it did so with respect to Sun's patents only when it acquired Sun in January 2010 or whether the grant has to be construed to have been made virtually back in August 2007 (when Google joined OIN, after Oracle).

If it was August 2007, it's easy because Android was unveiled only three months later.

If it was January 2010, which is the way I would interpret the agreement, then Google also benefits from it with a view to all of the time before.

So the problem is not that Sun itself never joined the OIN. Oracle acquired it; Oracle became an OIN licensee long before; and one way or the other, the only reasonable interpretation of the OIN agreement is that this way Google got (under Section 1.2) a license to whichever Sun patents read on "the Linux System" and (under Section 1.4) a release (like a retroactive license) for all of the time before, which goes beyond the time since Android's first release.

Again, and now for one last time at the end of such a long posting: the definition of "the Linux System" is the real problem. Concerning the OIN as a whole, it's not the only problem, but it's key and the Oracle-Google case shows it.

If you'd like to be updated on patent issues affecting free software and open source, please subscribe to my RSS feed (in the right-hand column) and/or follow me on Twitter @FOSSpatents.