Wasabi Systems Says GPL Violations Can Turn Into SOX Violations

Published: January 24, 2006

by Timothy Prickett Morgan

Here's an odd one. Last week, embedded systems provider Wasabi Systems put out a white paper and launched a special Web site dealing with the issues of Unix and Linux software licensing and how this might affect compliance regulations such as the Sarbanes-Oxley law. Because it is a Unix and Linux supplier and it sells embedded systems--which often end up in manufacturing and government installations--the legal team at Wasabi Systems often has to field a lot of questions about how the use of these open source technologies can affect compliance reporting and visa versa.

To that end, Wasabi Systems has launched a special Web site dedicated to the interface between open source licensing and compliance regulations like SOX. According to Jay Michaelson, general counsel at Wasabi Systems and the author of the white paper and the associated Web site, SOX requires companies to disclose their ownership of intellectual property. The problem is, if you are using software distributed under the GNU General Public License (GPL) and you either purposefully or inadvertently violate any of the provisions of the GPL, you then no longer have the right to use that software until you get compliant with the GPL. And, this triggers a SOX reporting event.

Michaelson says that the Free Software Foundation has several dozen public companies that it pursues for violating the GPL, and they are violating the federal SOX law if they do not report this action. Moreover, Michaelson brings up the point that the risk assessment related to open source programs commonly done by software engineering teams is breaking SOX law, according to an interpretation of SOX law by Michaelson. "If engineering teams are in charge of compliance and risk assessment, executives are trusting non-lawyers to make legal decisions," he explains. "Even if those decisions are right, the process is wrong--and that means it's a Sarbanes-Oxley violation if the company is public."

Exactly what Wasabi Systems, which distributes software under the open source GPL and BSD licenses, gets from bringing all of this up is unclear. The company is clearly trying to make a little noise and show off Michaelson's analysis of this issue. I think the larger lesson to learn from this issue is this: Never take your company public. It just isn't worth it. If you never go public, you still have to honor the GPL, of course, but you don't have to worry about regulations like SOX or appeasing Wall Street.