Oct 4, 2019 8:00 AM

An Open Source License That Requires Users to Do No Harm

Open source software can generally be freely copied and reused. One developer wants to impose ethical constraints on the practice.

Illustration: Casey Chin

China uses facial recognition technology to track Uyghur Muslims. The US military uses drones to kill suspected terrorists—any nearby civilians. US Immigration and Customs Enforcement—which has locked children in cages near the Mexican border—relies on software for communications and coordination, like all modern organizations.

Someone had to write the code that makes all of that possible. Increasingly, some developers are calling on their employers and the government to stop using their work in ways they believe are unethical. Google employees convinced the company to stop its drone footage analysis work and cancel plans to bid on a cloud computing contract with the Pentagon. Microsoft employees have protested the company's work for ICE and the military, though with little success thus far.

But it's hard to stop a company or government from using software that it already has, especially if that software is open source. Last month, for example, programmer Seth Vargo deleted some of his open source code from online repositories to protest its potential use by ICE. But because open source code can be freely copied and distributed, his code was soon back online elsewhere.

Coraline Ada Ehmke wants to give her fellow developers more control over how their software is used. Software released under her new "Hippocratic License" can be shared and modified for almost any purpose, with one big exception: "Individuals, corporations, governments, or other groups for systems or activities that actively and knowingly endanger, harm, or otherwise threaten the physical, mental, economic, or general well-being of individuals or groups in violation of the United Nations Universal Declaration of Human Rights.”

Coraline Ada Ehmke

Photograph: Courtesy of Coraline Ada Ehmke

Defining what it means to do harm is inherently contentious, but Ehmke hopes that tying the license to existing international standards will reduce the uncertainty. The declaration of human rights "is a document that's 70 years old and is pretty well established and accepted for its definition of harm and what violating human rights really means," she says.

It's a bold proposal, but it's exactly the sort of thing Ehmke is known for. In 2014 she wrote the first draft of a code of conduct for open source projects called the "Contributor Covenant." She was met with skepticism at first, but more than 40,000 open source projects have adopted it, ranging from Google's artificial intelligence platform TensorFlow to the Linux kernel.

For now, few are using the Hippocratic License. Ehmke herself isn't even using it yet. It still needs to pass a legal review, for which she's hired a lawyer, and there are plenty of potential pitfalls, such as compatibility with other licenses, to be addressed. But Ehmke says the license is less about getting people to use it, and more to start a conversation about ethics in open source and programmers’ control over their work.

Ehmke acknowledges that changing the way technologists license their work won't in and of itself stop human rights abuses. But she wants to give technologists a tool to inhibit companies, governments, or other bad actors from using their code while committing those abuses.

The nonprofit Open Source Initiative says open source software "must not discriminate against any person or group of persons" and "must not restrict anyone from making use of the program in a specific field of endeavor."

Whether human rights violations qualify as a "specific field of endeavor" under that definition is something of an open question, because Ehmke hasn't formally submitted the Hippocratic License to the OSI for review. But in a tweet last month, the organization suggested that the license doesn't fit its definition of open source. OSI cofounder Bruce Perens also wrote on his blog that the license conflicts with the organization's definition.

Ehmke hopes to rally the open source community to either pressure the OSI to change its definition or to devise a new one. "I think the Open Source Initiative definition is horribly dated," Ehmke says. "Right now as an open source community we don't have the tools to make sure our technology isn't used by fascists."

Ehmke's concerns are resonating with other technologists. Michael Cafarella, the cocreator of the popular open source data crunching platform Hadoop, has seen his work used in ways he didn't expect, including by the National Security Agency.

"It’s a good idea for people to be very concerned about abuse of their software," he says. "I’m personally most concerned by abuse by non-democratic governments, who have substantial engineering resources they can use to modify and deploy these projects. I don’t have enough background to know if [the Hippocratic License] will be effective with that kind of abuse."

Trying to change the definition of open source to accommodate ethical concerns has a long and controversial history. Ehmke is far from the first to write a license aimed at stopping harmful uses of freely available code. Peer-to-peer computing application GPU was released in 2006 under a license forbidding its use by the military. That’s had little effect thus far, but that could be changing. Earlier this year dozens of software projects adopted the "Anti-996 License," which requires users to comply with both local and international labor standards, in response to reports of grueling working conditions at Chinese technology companies. Ehmke believes that the backlash against ICE, which extends beyond the technology community, might be a tipping point.

Others point to the possibility of establishing a new term for code that is open for most uses but restricted for others. "Maybe we stop calling it 'open source' and start calling it 'open for good source,'" tweeted Vargo, the programmer who deleted code to protest ICE, last month.
The term "open source" was adopted in the late 1990s as an alternative to "free software," which was tied to more ideological aims. As developers become more ideological, it would be only fitting for yet another term to emerge.