Sunday, January 27, 2019

Google v Oracle: APIs as Intellectual Property

I see that Google is going to battle again with Oracle over its use of Java in Android. This is mired in complicated legal issues, and both Google and Oracle seem to use some very detailed technical arguments to make their case.  The legal arguments are probably too nuanced for lay-people to really understand. However, ultimately, it seems to boil down to an important question:

Should APIs (Application Programming Interfaces) be protectable intellectual property?

In this specific case, should APIs be copyrightable?

There are perhaps other mechanisms for protecting intellectual property rights for APIs (such as patents) as well -- but I think the fundamental question is whether a company can "protect" and monetize their APIs. Protection includes who can use a API, who can implement it, who can modify it, and who can define the semantics of it.

In deciding the complex legal questions, it would seem a basic understanding of APIs would be valuable. In reality, maybe legal minutiae will settle this dispute, devoid of any technical understanding. Nonetheless, here's my basic take on APIs. For programmers, this should be obvious. For those that are not, it should be informative. For all, it provides a framework for how one might think about the intellectual property protection for APIs.

APIs are fundamental for building complex software systems. APIs allow programmers to breakdown large, complex problems into smaller simpler ones. They are allow for a "divide and conquer" strategy to allow multiple people to work on a large problem. A programmer can, in theory, only concern themselves with the details of their subsystem and how it interacts with other subsystems. The API defines a contract between one subsystem and another.

Specifying good APIs is hard. An API should be easy to understand and use, implementable (in variety of ways), useable by a variety of applications, and scalable (within some specified boundaries) or possibly scale-free. Careful thought to extensibility, compatibility, and versioning are needed. Specifying good APIs is the job of a season programmer.

APIs are code. While APIs are different from implementations, APIs are code just like implementations. A header file or class definition is code.

APIs are valuable. An implementor of an API provides value to users of the API. The API is the access point to some service. Without the API, understanding how to access the value provided by the service is not clear. Conversely, the API is valuable to the client -- it provides access to services that the client would have to implement itself if it were not available.

Who Is Getting Paid?


Implementors of an API dictate how and how much they will charge for the services they provide and how they can be used (ignoring the issue of GNU General Public License (GPL) for now). Clients are contractually obligated to abide by the terms specified by the implementor.

So, the question remains -- who owns, controls, and monetizes the API -- the contract between the client and the implementor? And, maybe in this case and others, when the definer of the API is the same as the (first) implementor of it, the situation is even more murky.  How is the implementor of an API restricted by the "owner" of the API? This seems to be the crux of the dispute between Google and Oracle.

We've been here in the past.

Namely, follow on implementors of APIs avoided legal troubles by various (legal) mechanisms. Amdahl built computers that were compatible with IBM mainframes, IBM allowed for clones of the IBM PC, PC DOS implemented much of the CP/M interface, and AMD implemented the Intel x86 instruction set and built compatible x86 chips. These are all examples of implementations of  an interface that have been specified by other parties. Rights to implementing an interface were gained through payments, anti-trust rulings, and licensing agreements. Sometimes, the second party's implementation was just ignored. Finally, "clean room" implementations allowed some to sidestep the API IP issue.

SUN Microsystems (ironically the company bought by Oracle who inherited the Java Intellectual Property), created one of the first "Open API" models. SUN explicitly made many of their APIs freely available for anyone to implement. NFS, the Network File System interface, is the prototypical example. Anyone can implement the NFS protocol free of charge and distribute implementations without licensing fees. (SUN also sold implementations.) Note that while SUN explicitly made some APIs freely available, others had restrictions.

Programming languages seem to be an interesting exception. Other than the language at hand, Java, most programming languages are not copyrighted (or protected intellectual property in general). It's not hard to argue that a programming language is an API. Why haven't they been protected in the past? In the EU, its been ruled that programming languages can't be copyrighted. However, this doesn't seem to be the fundamental driver for them not to be protected. Perhaps leaving them "unprotected" allowed for greater adoption or there was just a lack of desire to secure IP rights. In a more innocent time, perhaps programmers were more likely to be altruistic idealists with less desire or awareness for commercialization and control.

My Take


APIs are necessary and valuable. They are difficult to get right, and they require talented people to do so. Ultimately, APIs are code. Given these attributes, APIs are Intellectual Property. As such, creators of APIs should be able to protect, control, and monetize them as allowed by the existing mechanisms such as copyright, patents or trademarks.

Finally, it seems the detailed technical arguments over things like "classpath exception," "rangeCheck function," and even "Structure, Sequence, and Organization" only obfuscate the fundamental issue:

Are APIs copyrightable? 

Because APIs are intellectual property of the written form, I think it is.

It is up to the owner to decide what legal mechanisms it wants to use to protect it (copyright or otherwise). Further, within these mechanisms, the owner chooses the terms for the use of the API.

In the specific case at hand, if this is all about whether or not APIs are protectable intellectual property, I side with Oracle. They have the right to determine how the the JAVA APIs can be used and at what cost. But it would be shame if  they didn't put the appropriate intellectual property protection and Terms of Service in place.