Defend and Indemnify

The CPL is the first major open source license to announce certain special responsibilities of licensees who are commercial distributors . It is the only place where the CPL uses the word should , implying that it has a philosophical or practical business objective in mind:

Commercial distributors of software may accept certain responsibilities with respect to end users, business partners and the like. While this license is intended to facilitate the commercial use of the Program, the Contributor who includes the Program in a commercial product offering should do so in a manner which does not create potential liability for other Contributors. ( CPL section 4.)

What, by the way, is a "commercial product offering"? Almost certainly it is a product that one can obtain at a store or online. Does the term apply to software distributed alone, or to software that is a part of some physical commercial product? Does it require that an offer for the product be made to the public as a whole, or merely to other Contributors in the context of an open source development project? Does the term apply where a distributor offers software to the public at zero price ? Does it apply when the price merely covers the costs of distribution? The CPL is silent on those questions. This is an important undefined term in the CPL. I assume this ambiguity was intentional.

The CPL seeks to protect other Contributors from the acts of a Commercial Contributor. It does this through an agreement to defend and indemnify:

If a Contributor includes the Program in a commercial product offering, such Contributor ("Commercial Contributor") hereby agrees to defend and indemnify every other Contributor ("Indemnified Contributor") against any losses, damages and costs (collectively "Losses") arising from claims, lawsuits and other legal actions brought by a third party against the Indemnified Contributor to the extent caused by the acts or omissions of such Commercial Contributor in connection with its distribution of the Program in a commercial product offering. ( CPL section 4.)

This provision is important in the context of consumer protection, which is mandated in various ways by all civilized countries . The laws acknowledge that products introduced into the stream of commerce sometimes harm people, their property or their businesses. In many jurisdictions, any company responsible for introducing a product into the stream of commerce is potentially liable to pay for Losses caused to consumers by that product.

Under the laws of some countries, this potential liability often cannot be disclaimed regardless of what a license says. Disclaimers of liability such as the one in the CPL and other licenses simply don't apply in a commercial “consumer situation in many countries. (See CPL section 5; MPL section 9; GPL section 12; OSL/AFL section 8.) Liability disclaimers are contrary to law and voidable in some situations by injured consumers.

So who then potentially pays when consumers sue? First, an individual plaintiff may sue a company for actual Losses incurred. More seriously perhaps, class action lawsuits may also be filed for individually small Losses to large numbers of similarly placed consumers; a defendant may pay the combined Losses of all members of the class. Defendant companies with deep pockets are particularly vulnerable to consumer lawsuits and to large jury verdicts for injured consumers.

Second, in the United States and in some other countries, each party in a lawsuit is generally responsible to pay its own attorneys ' fees and litigation costs. This is not cheap. Merely defending such lawsuits occasionally bankrupts defendants, leaving little or no money to pay for Losses . Consider, for example, the cost of litigation relating to asbestos and silicone breast implants.

Also consider this example outside of the software field. When Firestone tires began to fail on Ford automobiles, injured plaintiffs sued both companies. It became the court 's problem to determine degree of liability, if any, of each of the defendants, and then perhaps to allocate the damages accordingly . Legal procedures for analyzing degree of liability and for allocating damages vary widely around the world. Potentially, both Ford and Firestone would pay the judgments assessed against them individually, and each would pay its own attorneys' fees and costs.

But if Firestone had an obligation to defend and indemnify Ford, then it would be entirely Firestone's money on the line. Firestone would pay all judgments, and Firestone would pay all attorneys' fees and costs.

Broadly speaking, under the CPL, a Commercial Contributor must defend and indemnify every other Contributor . To the extent that IBM (and any other initial Contributor ) allows others to be its Commercial Contributors , it is those other companies that will bear the burden to defend and indemnify .

This, of course, states the CPL's rule incompletely. The obligation to defend and indemnify applies only to the extent the Losses were caused b y "the acts or omissions of such Commercial Contributor." This means that a Commercial Contributor may still prove it is not directly at fault. But because of its acceptance of an obligation to defend and indemnify, it cannot rely on the other companies to step in to protect it.

The CPL obligation to defend and indemnify does not apply to "Losses relating to any actual or alleged intellectual property infringement." (CPL section 4.) This is consistent with the CPL's warranty disclaimer, which disclaims the warranty of noninfringement. (CPL section 5.)

The obligation to defend can be very costly for a company that is a Commercial Contributor to open source software. Paying damages for an injured consumer can require a deep reach into the bank account. An obligation to defend and indemnify every other Contributor can be particularly painful where a Commercial Contributor must pay for particularly complicated or expensive consumer injuries. Commercial Contributors need to assess their exposure carefully under the CPL before distributing software under that license.

As for individual Contributors who are not directly distributing a "commercial product offering" (whatever that term really means), the defend and indemnify provision doesn't apply to them.