Can an open source licence be revoked if it violates employer&#39;s IP?
<p>Suppose a developer's contract says that all intellectual property (IP) rights to her code belong to her UK employer. While employed, she develops a library and  open-sources it under the Apache 2.0 licence. The employer is not initially informed, but  later finds the library's public repo on GitHub. </p>

<p><strong>Questions:</strong></p>

<ul>
<li>Can the employer force revocation of the licence?</li>
<li>What would then happen to those who forked and started using the library before revocation?</li>
</ul>

<p>There are related questions on OS SE, such as <a href="https://opensource.stackexchange.com/questions/4012/are-licenses-irrevocable-by-default">https://opensource.stackexchange.com/questions/4012/are-licenses-irrevocable-by-default</a>.
But they do not seem to address the situation when a library is open-sourced in violation of an employer's IP.</p>

<p>The Apache 2.0 license purports to be irrevocable, but it also presupposes that the supposed licensor has the right to grant permission to copy. In this case, that is untrue, so there never was a proper license and nothing to revoke (the copyright owner grants permission in the form of "a license" which is a legal abstraction, that normally is specified in the license document). An end-user snared by this illegal license might attempt to sue the author because of the legal screw-up but paragraph 9 says that the supposed licensor cannot be held liable. In this case, though, "licensor" is defined not as the person who hands you the license document, but as the copyright owner. So it's the employer who would be not liable under the terms of the document (but since the employer had nothing to do with the license, it's as though the license never existed).</p>

<p>The end-user is a secondary infringer (the employee is the primary infringer, in illegally distributing the material). Under US law, that doesn't matter, the user is still liable. Under <a href="https://www.legislation.gov.uk/ukpga/1988/48/part/I/chapter/II/crossheading/secondary-infringement-of-copyright" rel="noreferrer">UK law</a>, secondary infringement includes the element that you have to have reason to know that the copy is infringing, which in the scenario that you describe is not the case.</p>

<p>The License is not valid in the first place, as the developer did not have the right to attach the license to his work; the company does. </p>

<p>If someone uses the developer's work, and the company sues them for copyright infringement, the license will not protect that person, since the license isn't enforceable.</p>

<p>To prove this in court, the company will likely have to prove that the employee was under a contract giving them all the rights to his work made whilst in their employment.</p>

<p>If it reaches court, it will come down to whether she developed it in connection with the work she was employed to do, or whether it was something completely different.</p>

<p>I remember reading about case-law being established by an engineer working for the National Coal Board, who developed and patented a machine for peeling onions in his spare time. The NCB claimed the patent under a "we own everything you invent" clause. The courts decided it was unenforcible. There was no provable connection between whatever he was paid to do, and an onion-peeling machine.</p>

<p>If the employee imported her library into what she wrote for her employer, or if they can prove she worked on it during work hours (commit times might undo her), or if there's an "obvious" overlap of functionality with the paid work, then she is in legal difficulty.</p>

<p>Footnote. The National Coal Board became defunct a long time ago and I've never heard any more of an onion-peeling machine, so it may have been cause for tears all round. </p>

copyright united-kingdom software licensing open-source-software