[Update] Kogan and the GPL

One of the best things about Android is its open source nature. While it is not entirely open source (many apps are not), there is the Android Open Source Project, or AOSP, which refers to “the people, the processes, and the source code that make up Android.” The AOSP allows anyone with the knowledge and a 64bit operating system to build a version of Android. So what makes Android run? The kernel. The kernel tells the operating system what to do and when to do it. It is, in simple terms, the link between the OS to the hardware. In Android the kernel is based on the Linux kernel. It is not exactly the same though, as it contains a lot of specific Android code.

The Android kernel is specific for each device due to each device having different hardware. The kernel is also open source due to it being a modification of the Linux kernel. The Linux kernel is licenced through GPLv2 and as such the source for any and all modifications to it must be provided whether requested or not. This means that every single OEM that releases an Android device must then provide the source code for the kernel specific for that device. There are no guidelines nor a timeline for when this source must be provided. A couple of years ago HTC asserted it was 90-120 days although after much uproar the source code was released pronto to some fanfare although the Linux developer community does have long memories (and fast wit it seems). The source code must be complete so that it allows the user to build the kernel to run the device in the exact same state with all the same functions working as that released by the OEM.

GPLv2

For those who are lawyers and want to look over the GPLv2 in there spare time they can find it here. For those of us who aren’t lawyers and often get lost in the terms and conditions of the KitKat Android competition let alone the points of a software licensing agreement I’ll try to simplify it. If a piece of software is GPLv2 licensed it means that the software can be modified and it can be distributed. If distributed the distributor must include the original software with the distributed software and must disclose the source code when the software is distributed. The GPL ensures that any and all modified versions of the code it covers remain free and open source.

So what happens if someone doesn’t follow the GPLv2? Normally nothing because most companies eventually come to the party. On the occasion that they don’t then they are breaching copyright. Whose copyright I hear you ask? Every single person who has contributed to that software in the past to make it what it has become today. So for the Android kernel, because it is a modified Linux kernel, it is every single person who has contributed lines of code to the Linux kernel. That would be thousands of people. All it takes is for one person to push for copyright infringement. What then? According to the GPLv2, taking it at its literal meaning, a violation of it “leads to an automatic termination of all rights to the software“. Historically copyright holders of GPL licences do not want this nor do they push for this, they just want the offenders to come back into compliance. Technically though if a company were to violate the Android kernel GPL by not releasing the source they could be prevented from ever distributing this software ever again, ie. never able to sell another Android device they have manufactured.

It is through slow release or even non-release of the source code that many OEMs have drawn the ire of the developer community. Now it seems here in Australia we have a kernel GPL violation situation developing on our own doorstep. Local developer Benjamin Dobell has brought to our attention what he sees is a GPL violation by Kogan in not releasing source code for any of their products. Ben is a software developer by day developing mobile apps for both Android and iOS and by night is the Co-Founder and a Director of Glass Echidna Pty Ltd. He is the developer of Heimdall, the MIT licensed cross-platform open-source firmware flashing suite for Samsung Galaxy S (and related) series devices. Heimdall is extremely popular and over the last few years has had over a million downloads directly from Ben’s site alone. Many of us will have used Heimdall instead of Odin for flashing roms onto Samsung and other devices.

Ben contacted Kogan regarding the kernel source code for a Kogan Agora Smartphone and a 42″ Agora Smart 3D LED TV he purchased from them. You can read the details of his saga with Kogan on his post over at XDA-Developers. The brief version is that he and a friend (who bought a different TV again) separately asked Kogan to provide the source for their devices. Ben has told me that he bought the TV to tinker around with the Android firmware as most good Android hackers and developers do. He thought the software shipped on the TV was “incredibly buggy” and that his goal was to build better, more reliable software for the devices. You would think that Kogan would welcome this with open arms as they would be able to incorporate these stability changes and enhancements into their shipped devices. Not so. After a long email exchange with them over two months and this excerpt from one of the emails sums it up well:

“What you’ve linked to is the source-code for the Android Open Source Project (AOSP) which is used as a basis for Android manufacturers. On it’s own AOSP will not run on third-party devices. Every device is unique and has its own modifications to Android.”

In his post on XDA Ben named 8 other devices that he believes Kogan are infringing upon the GPL aside from the 3 him and his friend own. If your maths are as rusty as mine, before you reach for the calculator, that’s 11 devices that Kogan has not provided the source code for their respective kernels, which they must do in following the GPLv2 licence. Whether deliberate or not Kogan have not provided the source for these devices. It doesn’t matter if deliberate or not. One of the responses from the support stated that after “thoroughly” investigating the matter Kogan believed that they had not made any changes to the kernel and as such are not required to publish or share anything and are fully compliant with GPL. In a followup email they stated again that they have not changed the kernel and that it was available online, linking to the AOSP. Surely someone at Kogan must have an idea what a kernel is, how it works and how it differs from one device to another? You cannot build a fully functional kernel for a third party device from the AOSP and nor can you build a fully functional kernel for a Kogan TV from the Linux kernel Git repository. For that matter GPLv2 requires that the source code be made available for all relevant devices whether or not the code has been modified. So even if Kogan did not modify the kernel they still have to provide the source for it so someone can build it and install it on their TV/phone/tablet/device.

It is also worth noting that Ben has found that the Android kernel is not the only piece of GPLv2-covered software running on the TV. U-Boot, which he found to be vital to the running of the TV (which of course it is as it’s the bootloader- those of us who have bricked phones while flashing a bootloader know exactly how vital this piece of software is to running an Android device), is also included and is also covered by GPLv2. No source has been released for this either.

After 2 months of getting nowhere with his emails he gave them a final ultimatum that if they didn’t release their source within 24 hours he would make their violation public. He waited 48 hours before posting his story on XDA-Developers and contacting us. With Kogan seemingly unable (or possibly unwilling) to publish the source to their products they are in violation of GPL. While Ben has not been contacted by Kogan since his last communique he has been contacted by a Linux kernel contributor and because they are a contributor it is their work that Kogan are illegally copying and distributing. At this stage it seems that Kogan are in violation of GPLv2 and as such committing copyright infringement. Ben is in the process of contacting a lawyer to get an official warning of infringement letter drafted on behalf of the Linux kernel contributor and having it served on Kogan. What happens from there we are unsure but there is a history of companies being taken to court and having to publish the source as well as pay damages. Interesting the case in Germany linked previously is similar to this where the court ruled that the company “can not use the defence that their Chinese supplier had developed the firmware and had assured them of the completeness of the source code. According to the court, the company should have checked the completeness of the sources themselves or with the help of experts, even if that would have incurred additional costs.”

I think this is Kogan’s issue. Having the devices made in China where it is the wild west when it comes to software laws and copyright infringement means that they are footloose and fancy-free with their source and don’t bother providing it for anyone. I doubt they would deliberately flout GPLv2 as their software modifications are hardly groundbreaking and not worth the risk. I think that they just do not have the source and are unable to obtain it from their supplier. The founder and owner of Kogan, Ruslan Kogan purports himself to be a supporter of open source software so I doubt he realises that his company are actively violating the GPL but surely someone at Kogan knows this and is either ignoring it hoping it will go away or is scrambling trying to get the source. Let’s hope for the second of those two options.

Kogan were contacted for comment but no reply was received.

While we wait with bated breath what happens from here it seems that Kogan need to do something to appease the developers and set everything right with respect to the GPL. We will keep you posted with any updates that may occur.

Updates to this story

November 8: Kogan provided comment to ZDNet on this issue on November 5, stating that it would release “all source code that has been requested by customers”.

We asked Ben to comment on the new developments, and he pointed out that Kogan incorrectly identified the item in question to ZDNet as one of their brand new phones, and that they also incorrectly stated that they had only received one request for source code. Ben in fact asked for the source code for a phone that is now 12 months old and a TV that had been available for 3-4 months, and claims he knows of at least 2 others who’ve made similar requests for varying products.

Ben also said that he had not heard from Kogan directly about the issue, until last night when he finally received the following response:

Hi Aidan,
We are working with our suppliers and building the code.
We don’t have any exact timeline on this however we have not intention to hold it back and release it as soon as possible.
You are among the first to request it so please bear with us and as soon as the code is available we will notify you.
Thank you for your patience in this matter.

This seems to be a step in the right direction for Kogan. We commend them for it, and hope that they continue to adhere to the open source guidelines embraced by the Android community.

At this stage, Ben seems happy with Kogan’s response but should they fail to provide the source, he does have the option of consulting a lawyer specialising in copyright infringement. There are also other avenues open to him, including the GPL Violations website.

Sound off in the comments if you have an opinion on this? Would this make you reconsider buying a Kogan branded product? Does this change your perception of them as a company?