GitHub, Microsoft, OpenAI fail to wriggle out of Copilot copyright lawsuit

Judge won't toss out two key charges, software source slurping case still on

The judge overseeing the lawsuit challenging the legality of GitHub Copilot, and its underlying OpenAI Codex model, "borrowing" people's code samples has refused to dismiss two claims in the case and sent most of the other allegations back for revision.

The order [PDF] issued by US District Judge Jon Tigar in Northern California on Thursday can be read as a brief respite for GitHub, parent Microsoft, and its multibillion-dollar partner OpenAI. But it leaves the most significant aspects of the case intact while allowing other claims to be better supported in a revised complaint.

Filed in November, the initial complaint [PDF] alleged GitHub, Microsoft, and OpenAI violated copyright, contract, privacy, and business laws, among others, by using public source code culled from GitHub to create the OpenAI's Codex machine learning model and GitHub's Copilot programming assistant.

Software developers have bristled that Codex and Copilot were created from their code, and sometimes reproduce it, without explicit permission or concern for the terms under which they licensed their work. And some of them have sued over it.

The judge rejected the defense motion to dismiss the plaintiffs' claim that Codex's capacity to reproduce code represents a breach of software licensing terms. He also rejected the defense effort to toss a claim under Section 1202(b) of the Digital Millennium Copyright Act that Copilot and Codex reproduce copyrighted code without the required copyright management information – author, title, owner, terms and conditions, and so on.

So litigation, at the very least, can be expected to continue based on those allegations.

The ruling found other aspects of the complaint less compelling. Tigar dismissed the civil conspiracy allegations against the companies, as well as the unidentified plaintiffs' demand for declaratory relief – essentially a judicial declaration of the plaintiffs' rights.

He did so with prejudice, meaning those charges cannot be amended and refiled.

It's not over

Tigar also dismissed – though with leave to amend – the plaintiffs' claims for violating Section 1202(a) of Digital Millennium Copyright Act (false copyright information), contract interference, fraud, false designation of origin, unjust enrichment, unfair competition, breach of the GitHub Privacy Policy and Terms of Service, violation of the California Consumer Privacy Act, and negligence.

Should plaintiffs’ code be reproduced as output, it will be reproduced in a manner that violates the open-source licenses

Essentially, the related claims made by the defendants lack the detail required by law to proceed. But he found them plausible enough to consider an amended complaint that provides more clarity about the supposed injury arising from Copilot and Codex.

With regard to the plaintiffs' assertion that Codex and Copilot violate their property rights, the defendant companies argued that the claim should be dismissed because the plaintiffs didn't identify specific code of theirs that had been reproduced.

The judge however said that assuming the facts of the complaint are true, it's reasonable to "infer that, should plaintiffs’ code be reproduced as output, it will be reproduced in a manner that violates the open-source licenses under which plaintiffs published their code."

So if Copilot or Codex can be coaxed to generate code specifically attributable to one of the plaintiffs, and that reproduction can be included in a more thoroughly documented complaint, GitHub, Microsoft, and OpenAI will find that difficult to reconcile with the law.

The judge meanwhile rejected the defense argument that the plaintiffs should not be allowed to continue their claim pseudonymously based on death threats sent to the plaintiffs' counsel.

"GitHub and Microsoft suggest that plaintiffs' fear is unreasonable because 'the types of nasty messages at issue here are a fact of modern life in the era of internet 'trolls,'" the judge wrote in his order. "GitHub and Microsoft do not explain why the rise of internet trolls renders Plaintiffs’ fears of harm unreasonable."

Matthew Butterick, a lawyer and developer involved in the case, told The Register the tech giants' efforts to remove two of the case's primary allegations – breach of license and the removal of copyright management information – were denied. He declined to get into what will be included in the amended complaint but expressed optimism about the case's prospects.

OpenAI also did not immediately respond to a request for comment.

"We firmly believe AI will transform the way the world builds software, leading to increased productivity and most importantly, happier developers," a GitHub spokesperson told The Register.

"We’ve been committed to innovating responsibly with Copilot from the start and will continue to invest in and advocate for the AI-powered developer experience of the future." ®