Analyzing the legal implications of GitHub Copilot

I contribute my code to X project outside of github (say on a mailing list) under the explicit understand that my code is under GPL (say GPLv3 to be specific). If someone later uploads my code to github and github uses my code to train their ML model in violation of GPLv3 isn't the point that the person who uploaded my code to github is in violation of GPL by giving it to someone else under less restrictive terms?

Does this mean that the github terms of service are perhaps fundamentally incompatible with uploading copyleft-style (or perhaps specifically only GPLv3 level) restrictive licenses?

And, if so, probably they always were but nobody cared until now.

Is it that widely scoped? Can't we narrow it to "A third party who finds their GPL code on Github but has not uploaded that specific code to Github themselves has a right of action limited to that specific code."

Just because I created a github account once and agreed to the TOS doesn't mean that I agree to let others upload my code to github, where would that scope end. Could someone steal code off my computer which i've never published and put it on Github and that was OK because I once signed up for a github account, clearly a contrived example but.

As the article notes, longer and more complex blocks of code are most likely copyrightable.

> GitHub reports that Copilot is mostly producing brand-new material, only regurgitating copies of learned code 0.1% of the time.

For me, the issue is one of risk. Let's say that you have 100 developers at your company making software for you and they decide that Copilot is great. 1 in 1,000 suggestions is regurgitated code verbatim. Let's say that only 1 in 10 of those suggestions is sufficiently long and complex enough that it warrants copyright protection. Within a week, you'd have to assume that you have dozens of copyrighted pieces of code in your codebase. The big issue is that you now don't know where the code came from and which pieces might be direct copies. It opens up a bit of a can of worms for a company looking to avoid risk.

I think one of the pieces that might get overlooked is someone trying to weaponize Copilot. For example, Wikipedia has seen people upload creative-commons licensed media to Wikipedia and then become very litigious against people who might be slightly off in the attribution requirements. Attribution requirements are often more complicated than just "provide whatever attribution you think makes sense." The images are legitimately creative-commons licensed, but if someone doesn't provide the correct attribution, they sue them. This attribution can include the documentation of the modifications made, author, link, link to the license (which I think a lot of people forget), copyright notice, etc.

https://news.ycombinator.com/item?id=27606035

I don't think most people are looking to be copyright trolls. However, Copilot offers a neat little way to potentially inject your code into other people's programs. Will people start searching for uses of their code and use it as a form of copyright trolling? I don't think most people will, but we've seen it happen with patents and images.

If you have a hundred engineers creating dozens of co-pilot suggested blocks per day, we're talking around a million blocks in a year. I don't think the odds of any individual suggested block being a problem are high. The issue is when you start scaling that up. If we're talking about a large company, the risk can start getting large. You don't know where the code came from and it starts getting likely that verbatim pieces of someone else's code are finding their way into your codebase.

Does Copilot offer enough value to offset this risk? Will future versions of Copilot make sure that the suggestions are sufficiently different from the training source? Heck, there can even be chicken-and-egg problems where someone claims copyright on a block of code that was generated by Copilot and you then have to prove that your identical code generated by Copilot isn't an infringement. Can you prove "yes, Copilot would have generated that code block before you pushed your code into Github" when they claim "Copilot only generated that code block for you because of our code on Github"? It might not even be a company that's evil doing this. Large companies often have no idea what different parts of the company are doing - especially several years later.

One thing I want to make clear is that this isn't just about cases that would win on their merits. One of the big parts of the Wikipedia discussion on overly-litigious uploaders is that it can cost a lot more to fight infringement claims than they're asking. If someone slaps your startup with a $250 "you stole my copyrighted code" claim, do you hire a lawyer at an hourly rate that might cost more, risk a trial costing tens of thousands, and risk a judgement against you? Or do you pay them off with a small amount of money to make it go away? I'm not saying this is a good situation. I'm just noting that it definitely exists and trolls can try and come after you at the worst times like when you're trying to raise funding. Do you decide to fight it when you're trying to IPO? Do you let the IPO price sink by a few percent and lose you lots of money when they're just looking for $5,000 to go away?

It just seems like adding a lot of risk.