Matthew Butterick, a developer and lawyer, has filed lawsuits against Microsoft, GitHub , and OpenAI. He claims that GitHub Copilotviolates the terms of open source licenses and infringes on the rights of developers.
See also: Dropbox announces security breach – Hacker stole GitHub repositories
GitHub Copilot, available in June 2022, is an AI- powered by OpenAI Codex. It provides real-time suggestions for source code and features in Visual Studio.
The tool was built using machine learning by studying billions of lines of code from public repositories. It can take natural language and turn it into code snippets for dozens of programming languages.
Copilot has the potential to speed up code writing and make software development easier overall, but because it uses public open source, there are some concerns about performance and licensing.
Open source licenses, such as GPL, Apache, and MIT licenses, require users to cite the author's name and provide information about copyright.
However, Copilot removes this attribution element for snippets, so even when the snippets are longer than 150 characters and come directly from the training set, no attribution will be given.
See also: Cryptomining campaign abused free GitHub account trials
Some developers have gone so far as to call it open source laundering, and the legal implications of this approach became clear after the release of the AI tool.
“Microsoft is clearly making money off the hard work of others by failing to follow the terms of open source licenses and other legal agreements,” said Joseph Saveri, the attorney representing Butterick in the lawsuit.
Unfortunately, there have been cases where Copilot has accidentally leaked secrets that were published in public repositories and were therefore included in the training set. For example, API keys have been reported to be among these secrets.
According to Butterick, in addition to the license violations , the development feature also violates:
- The terms of use and the privacy policies of GitHub,
- DMCA 1202 prevents people from removing information that indicates something is protected by copyright.
- The California Consumer Privacy Act (CCPA)
- The legal claims arising from these laws.
See also: GitHub: Repositories with fake PoC exploits distribute malware
The lawsuit was filed in the U.S. District Court for the Northern District of California, seeking $9,000,000,000 in statutory damages.
