On February 24 2024, the Paris Court of Appeal rendered its (final?) decision in a dispute which since 2011 pitted the small open source company Entre’Ouvert (hereafter EO) against the giant Orange telecom company. This is the conclusion of a 13-year-old dispute, which duration can be explained by an attempt at mediation followed by multiple appeals (first instance, appeal, cassation, new ruling of the court of appeal).

Orange had integrated the LASSO tool (software library distributed by EO under GPL-2.0) into its Identity Management Platform (“IDMP”) and had sold the solution to the French State under its own terms.

It is fortunate that courts are ruling on the validity and binding nature of Open Source licenses and in particular on applying Directive 2009/24 on the legal protection of computer programs, because it is too rare. The court rightly ruled that the GPL-2.0 license is a contract entered into within the framework of copyright law. Unfortunately, the court's ruling is also an opportunity to note that certain aspects of free/open source licenses are still not understood.

Here, this is mainly the case of free access: Orange is criticized for having sold the State a solution of which more than half (around 57% of the code) had been obtained free of charge. However, nothing in a free/open source license prevents this, especially if Orange were to provide a service (installation, warranty, maintenance, etc.). The GPL-2.0 license is wrongly presented as a "gratis license" and the court is wrong ruling that the entire derived solution should have been given for free.

However, the main criticism addressed to Orange, which was better founded, is to have used its own terms and violated the GPL-2.0. On this point, everything is depending on the degree of integration of LASSO into IDMP. Based on expert advices, the court declares that a great quality of LASSO is to be easily integrated into an application or solution thanks to its various interfaces (API): “The characteristic of LASSO is to be software which is easily implemented”. But if there was only linking, in order to make the LASSO programs interoperable with the IDMP solution, Orange's lawyers could have argued that for interoperability purposes, the APIs escape copyright (an exception arising from Directive 2009/24 recitals 10 and 15). It would then have been necessary for, with the exception of common APIs, the 2 source codes to be clearly distributed separately (i.e. LASSO under GPL-2.0 and IDMP under ORANGE terms) and only communicating via interoperable APIs. It does not appear that this point was made. The defendants preferred to challenge the originality of LASSO or the validity of GPL-2.0, which was a false path.

The fact remains that according to the expert opinions in the court's possession, there were much more than simple links: the two programs seem to have really been "merged". According to experts, LASSO has been profoundly modified by Orange. The modified source code was not communicated to the client. LASSO and IDMP do not exist side by side separately and independently. LASSO is encapsulated in at least one of the components of IDMP and other components have, from the source code, extremely strong dependencies. IDMP relies entirely on LASSO. The interaction is total and permanent. Finally, the software integrated into IDMP was not distributed as a “separate work”. The solution was distributed under a single license, without mentioning EO's rights. 

In this case, a linking exception is difficult to invoke. There is copyright infringement.

In the appendix, you will find (in French) the full text of the decision of the Court of Appeal.