
Dear Dr Vousden,

Thanks for sending through the details of the policy consultation. As I
mentioned in my previous email, we didn't get much notice of this, so
these comments are somewhat rushed. If anyone needs more detail of any
of these, please do not hesitate to ask.

To begin with, we must commend the Government for beginning this
process. It has long puzzled us as technologists that it is possible for
public money to be used by researchers at public institutions to develop
private software in this way; it is particularly puzzling when this
money is spent on infrastructure projects. Having ourselves spent some
time persuading NESTA to accept the GPL for software produced with one
of their grants, we can only hope you are successful in this process.

To the licenses.

Firstly, a generic comment on license choices. In any area where a
reference implementation of a system is being produced, the use of a GPL
rather than a BSD license should be preferred. The reasoning for this
derives from the history of the BSD networking stack. Here, each
manufacturer making use of the stack has, over time, arrived at a
divergent implementation with bugs (security and protocol) existing in
some stack variants that have been discussed and fixed in others. Use of
a GPL license for reference implementations of infrastructure - with a
well-defined interface to protect proprietary systems from the so-called
"viral" GPL nature - is probably the best choice to produce improved
inter-operability, safety and security.

Reading Policy 2, it should be indicated that a variant license
developed for the UK will actually hinder uptake. Proliferation of
licenses (the OSI model) means that organisations need to spend
expensive legal time analysing these licenses. If possible, the use of
one of the well-tested licenses (GPL, BSD without Advertising, Artistic)
would be a better bet.

Also, it should be pointed out that the OSI is a vocal body with
commercial funding to produce and approve a set of licenses that are
acceptable to those commercial bodies. The analyses of the requirements
for Free and Open licenses that are performed by the Free Software
Foundation and the Debian Project suggest that some of the OSI-approved
licenses serve to restrict certain important freedoms that the 

The comment from one respondent that mechanisms must remain in place for
Universities to license technology opens up a dangerous hole. In the US
at present, a successful prosecution has been launched against a
University for patent violation. The University defense was that the
patent was being used for research and that was acceptable. The
prosecution case was that the business of the University is
grant-getting, teaching and research, and so their use of a patent for
research was commercial use, and they must license it. The judge ruled
against the University. If similar prosecutions occur with British
universities, then a license which insists on royalties for commercial
use will back-fire against the university.

The respondent who suggests that Universities would not be in a position
to exploit software through the support model, but companies would, must
I guess have forgotten that the main work done by Universities is
teaching. As a small business, if we want staff trained in something, we
would *far* prefer to have this happen at a University than at one of
the commercial training organisations attached to a company with
commercial interests - if only for reasons of trust!

The respondent who refers to the "reach-through" effects of the GPL has
mis-represented the effect of the GPL. If you use a GPL tool to develop
a product, the GPL does not alter the license of the product. Otherwise,
the Gnu Compiler Collection (GCC) could not be used for compiling
commercial programs. The FSF web-site has a chunk of material about
this. The EU robotics network CLAWAR has built a model for avoiding
these problems, and it is one of encapsulation around open standard
interfaces: if a Free or non-Free tool or component is to be used in a
system where there is a license issue, and it is encapsulated with an
open standard interface, then as far as we can tell there can be no
issue of cross-interface license propagation.


Policy 4 is a vital one - and normally it should form part of the
dissemination phase of a project. There is, of course, the need to
provide hosting for web-sites and mailing-lists for such projects, which
is especially important when the project team disbands quickly after the
end of the project. Whilst hosting sites like SourceForge and the FSF's
Savannah offer this kind of support, there is no particular UK variant
at present. It might be useful to talk to the administration behind the
UK Mirror Sites and the HENSA archive to see if they can provide a
UK-specific repository.


The idea of a specific rights-holding body is a tricky one, because of
the trust that must be vested in that body. Developers will often assign
rights to the FSF, because that body is seen to take a strong position
in this matter. A body with direct government ties, no matter how clear
its present intent, can always be re-directed by later Act of
Government. 

It might be simpler and more effective to provide a national register of
software-producing projects, and allow the projects to select their own
rights-holding body. Most Free projects have historically managed to
find a hosting location, and when a University sources state funding for
work, it would be expected to build into that funding a component for
long-term hosting and dissemination.

The issue of Liability is very important. At present, most commercial
software licenses disclaim all responsibility for the actions of the
software; the situation with Free software is that the same disclaimer
is made, but the author has no legal team to back it up. However,
historical testing and analysis shows that Free software is usually of a
higher standard of quality and safety, and can be tested by
inspection. Therefore, a method of enshrining the "No Warranty" clause
of the GPL in law would be useful to developers; and the provision of a
National test body, who could be used to test and certify Free software
in the cases where such certification is required, would be an
interesting development. (This body could be contracted to maintain an
active developer on any project whose safety and reliability was
regarded as critical - the role of this developer would be to address
test and security issues. Over time, the presence of such a developer in
a project would be seen as a key indicator of quality; the fact that
they were usually from a certain UK body would be a great source of
national prestige).


Thanks for considering this input. As mentioned above, if anything is
unclear, or you need references, please ask. Also, if another round of
comment occurs (or similar documents require comment), please inform me
- part of my job these days is exactly this process!

Rich Walker
