Using open source software to deliver online services?

As a Gartner report published earlier this year suggests, the uptake of Software as a Service (SaaS), also known as Application Service Provision (ASP), will experience substantial growth over the next few years. Some analysts suggest that open-source software will be used to underpin and deliver 98% to 99% of SaaS and will dominate the software infrastructure for cloud-based computing.

Open source software is computer software which is made available in adherence to a number of principles. These principles include that it can be freely given away; that the source code will be made available or will be readily available; that it may be distributed with modifications, and that the rights attached to the programme must apply to all those to whom the software is redistributed, without the need for additional licences. There are a number of forms of open source licence which prescribe the particular rights and obligations attached to any particular item or module of open source software.

In March 2008, the Open Source Initiative (OSI) approved the Affero General Public Licence (AGPL). The AGPL is a modified version of the well-known General Public Licence (GPL) open-source licence; the AGPL is designed specifically to cover the use of open source software to provide a service. In short, if AGPL-licensed software is used to provide an online service, e.g. online banking, web search, e-commerce, etc, the provider of the service is required to make the source code of the software available to users of the service.

This is not the case under the GPL, which only imposes this obligation when the software is distributed. Arguably for SaaS services, the software is not distributed and therefore there is no need under the traditional form of GPL to provide the source code to users. The AGPL addresses this issue and is intended to ensure retention of the open source principles in a SaaS context. In so doing, it might catch service providers out.

How does this impact you? If you are an organisation looking to provide online services using open-source software you need to look out for software that is licensed under AGPL. OSI approval of the AGPL means that we are likely to see an increase in open-source software being made available on AGPL terms and an increase in organisations using such software. One commentator suggests that AGPL may replace GPL as the dominant open-source software licence within the next five years.

If you inadvertently use or integrate AGPL-licensed software to deliver your online service, you may be required to make the source code that underpins your online service available to users of that service. Is this something that you would be comfortable doing? If not you need to put in place proper controls to ensure you know what code is being used by your organisation, what terms it is licensed on and what this means for you.