Free-software warriors celebrate landmark case that enforced GNU LGPL

Sebastian Steck, a software developer based in Germany, has obtained the source code and library installation scripts for his AVM FRITZ!Box 4020 router, thanks to a lawsuit funded by the Software Freedom Conservancy (SFC).

According to an English translation [PDF] of the July 2023 German complaint [PDF] filed in a Berlin court, Steck purchased the router in 2021, and requested the relevant source code used to generate firmware versions 6.83 and 7.02 of the FRITZ!OS operating system kernel.

FRITZ!OS is simply a modified version of Linux, licensed under the GNU General Public License, Version 2, (GPL 2.0), but several of its libraries - uClibc, libblkid, libexif, and libosip2 - are licensed under the Lesser General Public License, version 2.1 (LGPL 2.1).

Using the supplied code, Steck had added an additional function to the uClibc networking library that logs which Fritz!Box applications connect to servers on the internet and the data those applications send. He did so out of a desire to understand what his router was doing.

But the source code AVM provided in response to his request was incomplete - it lacked the scripts necessary to compile and install modified libraries on the router. And that capability is necessary, the complaint argues, in order to give users the ability to change how their devices function.

So Steck took the matter to court to enforce his rights under the LGPL. And several months after the lawsuit was filed, AVM fully provided the requested source code. Meanwhile, the litigation continued. On June 24, 2024, the court in Berlin found in Steck's favor, awarding €7,500 (~$7,725) in legal expenses. No order to provide the installation scripts was necessary as AVM has already done so.

AVM was given six months to appeal and that period has now elapsed. The Berlin-based biz did not immediately respond to a request for comment.

The SFC expressed frustration that companies like AVM ignore user requests under copyleft until litigation commences. And as the group's long-running case against TV maker Vizio demonstrates, not every company concedes as AVM did.

Despite a preference for resolving disputes without lawyers, the SFC applauded the court's affirmation of Steck's rights as a win for the GPL/LGPL and for the Right to Repair.

"I am pleased that this litigation compelled AVM to provide the compilation and reinstallation information in the filings," Steck said in a statement Thursday.

"I look forward to them amending their publicly available source code archives with the complete scripts used to control compilation and installation soon."

According to the SFC, GPL/LGPL lawsuits have tended to focus on copyright enforcement, but Steck's claim was about user rights. "There is now no doubt that both GPL and LGPL mandate the device owner's ability to make changes to the software in the flash memory so those changes persist across reboots," the SFC said.

Denver Gingerich, director of compliance for the SFC, told The Register that this is the first time to his knowledge that the LGPL has been successfully litigated.

"The AVM lawsuit is an excellent example of how users can make practical use of the courts to receive the freedoms owed to them by the companies that sell devices to them," he said.

"SFC's ongoing lawsuit against Vizio is exactly an example of a device purchaser suing a device manufacturer who failed to provide the software right to repair and modify that was given to them when they made the device, and is owed to the purchasers of their devices just as it was owed to them when they received the software to integrate into their devices."

Gingerich said that if the SFC prevails in the Vizio case, scheduled for trial in September, 2025, that will demonstrate the viability of consumer actions under the GPL and perhaps encourage companies to comply with licensing obligations voluntarily.

"SFC is part of multiple right to repair working groups that affect legislation and policy around the world," he said. "They are not exclusively but primarily focused in the US, where substantial recent legislation has been passed to promote the right to repair hardware that people purchase.

"We continue to work collaboratively with these groups to promote the importance of software as part of Right to Repair, so that our devices remain secure and functional beyond any end-of-life that a manufacturer may wish to apply to them," he added. "By ensuring both the hardware and software last as long as the device owners want, including adding features and security updates as needed, we reduce e-waste and promote resilience for both our devices and communities."

Asked to assess the present need to enforce the GPL, Gingerich said: "As companies exert more and more control over the devices they sell, it becomes more and more important that we enforce copyleft licenses such as the GPL and LGPL in the courts.

"While we always use lawsuits as a last resort, it is a sad fact that companies increasingly give us no other option. Whether it is to promote some DRM scheme, or reduce your ability to be tracked and targeted, the forces that seek to control the devices you use are increasing, and so must our efforts to combat them."

"There is an increasing awareness that companies are controlling people's devices in these new ways that are adverse to the public interest," he continued, "and so the desire for software using copyleft agreements is also increasing. With examples of copyleft compliance like the OpenWrt One and ThinkPenguin routers, companies know what they need to do to comply.

"In that sense, the GPL is accepted and understood. However, companies still often refuse to comply with the license, despite these examples, until they are sued, so lawsuits remain an important tool in the software right to repair toolbox. We work to be as impactful as possible with the resources that we have and to consider how to do this work in new ways." ®