Legal entities for Debian (was: Re: General resolution: Condemn Russian invasion of the Ukraine)

[Russ Allbery]

Holger Levsen  writes:

> the CCC e.V. association OTOH was formed as a legal entity to protect
> individuals. 

To be clear, this sort of outcome may well be the correct outcome of "give
Debian legal existence."  In other words, the goal doesn't need to be to
form a non-profit with the name "Debian," and it may well be wiser to have
multiple organizations for different legal domains.

The desired outcome from my perspective is just that if one is doing work
on Debian in a country where legal liability is a concern, that work is
being done under the auspices of some sort of organization that provides a
liability shield so that Debian Developers aren't individually liable for
everything Debian does, including things they had nothing to do with.

Obviously if the law doesn't work that way in your jurisdiction, your
jurisdiction may not require any such organization.  But my understanding
is that the law *does* work that way in the US, and possibly some other
countries.  And I do not believe (although I would be delighted to be
corrected if I'm wrong) that Software in the Public Interest currently
provides that sort of liability shield for Debian in the US.

-- 
Russ Allbery (r...@debian.org)  

Re: General resolution: Condemn Russian invasion of the Ukraine

[Ross Vandegrift]

On Fri, Apr 08, 2022 at 10:19:27PM +, Holger Levsen wrote:
> On Fri, Apr 08, 2022 at 01:35:14PM -0500, Gunnar Wolf wrote:
> > Debian does not exist, legally :-)

I'm repeating others, but I think it's important to repeat:

This may not be true.  At least in the US, existence is a matter of
fact.  Debian has members, bylaws, elections, common traditions, and
we're recognized by the free software and broader tech communities.  All
of this would be brought as evidence that Debian exists.

Debian isn't *incorporated* - but that's not the only way to exist.

> and that's a feature, not a bug.

I don't think so.  At least in the US, it probably leaves all members
wholly and severally liable for Debian.  So if there's a mixup and
someone doesn't pay a US-based company, they could attempt to recover
from any US-based member personally.

Unlikely - but I don't understand how that's a feature.

> the CCC e.V. association OTOH was formed as a legal entity to protect
> individuals. 

This seems prudent.

It'd also provide some options for settling agreements with service
providers for e.g. cloud accounts.  We get along managing it via TOs,
but it's a perpetual source of confusion and delay.

Ross


signature.asc
Description: PGP signature

Re: General resolution: Condemn Russian invasion of the Ukraine

[Holger Levsen]

On Fri, Apr 08, 2022 at 01:35:14PM -0500, Gunnar Wolf wrote:
> Debian does not exist, legally :-)

and that's a feature, not a bug.

the CCC e.V. association OTOH was formed as a legal entity to protect
individuals. 

it's possible to go both ways to achieve some of the same goals, but the
current structures have worked for Debian for almost three decades.


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

Imagine god created trillions of galaxies but freaks out because some dude
kisses another.


signature.asc
Description: PGP signature

Re: DebConf and legal structure for the project

[Russ Allbery]

martin f krafft  writes:

> … I recommend you don't even start trying. Not only is it going to be a
> massive bikeshed, DebConf also basically requires a legal entity in
> whatever country we choose for our next holiday camp. And so yeah,
> DebConf is never going to be formally a part of Debian.

That's... what I said?

> Are we really still talking about Russia?

No, which is why I changed the subject header.

-- 
Russ Allbery (r...@debian.org)  

Re: DebConf and legal structure for the project (was: General resolution: Condemn Russian invasion of the Ukraine)

[martin f krafft]

Regarding the following, written by "Russ Allbery" on 2022-04-08 at 10:17 Uhr 
-0700:
Correct me if I'm wrong, but Debconf is not formally a part of 
Debian, and so cannot be bound by the outcome of a GR anyway.


This is the sort of thing that would be good to clear up as part of 
the process of making Debian a more formal organization.


… I recommend you don't even start trying. Not only is it going to 
be a massive bikeshed, DebConf also basically requires a legal 
entity in whatever country we choose for our next holiday camp. And 
so yeah, DebConf is never going to be formally a part of Debian.


Are we really still talking about Russia? What about all the other 
atrocities in the world, first and foremost those being done by the 
Western nations, where most of Debian's assets are being held in 
custody of some form or another?


--
 .''`.   martin f. krafft  @martinkrafft
: :'  :  proud Debian developer
`. `'`   http://people.debian.org/~madduck
  `-  Debian - when you have better things to do than fixing systems
 
"...the prevailing catholic odor - incense, wax, centuries of mild

 bleating from the lips of the flock."
-- thomas pynchon, gravity's rainbow

Re: General resolution: Condemn Russian invasion of the Ukraine

[Gunnar Wolf]

Jonas Smedegaard dijo [Fri, Apr 08, 2022 at 12:52:31PM +0200]:
> > Hmm, debconf.org says "Copyright Software in the Public Interest, 
> > Inc", but there is no imprint or anything. DebConf as such is not 
> > listed as a separate project on https://www.spi-inc.org/projects/; of 
> > course it could still be part of systemd or another project.
> > 
> > DebConf is also not listed on 
> > https://www.debian.org/trademark#licenses, but uses Debian trademarks.
> > 
> > So it pretty much looks like DebConf is part of Debian.
> 
> Sorry, I don't follow.  What you quoted above seems to indicate to me 
> that Debconf _uses_ Debian, not that it is legally a part of Debian.

Debian does not exist, legally :-)

DebConf is a project done largely by people in Debian, for Debian.


signature.asc
Description: PGP signature

DebConf and legal structure for the project (was: General resolution: Condemn Russian invasion of the Ukraine)

[Russ Allbery]

Jonathan Dowland  writes:

> Correct me if I'm wrong, but Debconf is not formally a part of Debian,
> and so cannot be bound by the outcome of a GR anyway.

This is the sort of thing that would be good to clear up as part of the
process of making Debian a more formal organization.  I don't want to harp
on this too much, but this sort of informality can be rather dangerous
under US law because there are all sorts of unwanted liability
implications to not having anything formally in writing that creates
limited liability and shields people from personal liability.  I suspect
the same or similar problems may exist in other countries as well.

There are a bunch of different ways we could structure this that don't
necessarily have to involve putting DebConf in the same organization as
Debian, but we really should have some formal and legal setup and
agreement.  For example, some conventions that move all over the world
form a local legal organization each year that has an agreement with some
permanent standing organization so that the convention liability can be
isolated from the parent organization (which given all the things that can
go wrong with a large physical gathering may be a good idea).

Anyway, a lawyer familiar with non-profit law and with conventions (which
are fairly common for non-profit organizations) will probably have helpful
opinions about all of this and likely would be able to advise us how to
make everything more robust.  I'm sure they see similar problems
regularly; a non-profit dedicated to a particular purpose that holds
associated conventions in various countries each year is a fairly common
setup (I can think of two or three others just off the top of my head).
Maybe Software in the Public Interest is sufficient and they could tell us
that (although I'm dubious).

It's hard to shake the feeling that we've just gotten quite lucky over the
lifetime of the project (which is not very surprising; liability problems
are one of those "low likelihood, high impact" kinds of issues), and
shouldn't rely on that luck continuing.

-- 
Russ Allbery (r...@debian.org)  

Re: General resolution: Condemn Russian invasion of the Ukraine

[Jonathan Carter]

Hi Jonathan

On 2022/04/08 11:44, Jonathan Dowland wrote:

Correct me if I'm wrong, but Debconf is not formally a part of Debian,
and so cannot be bound by the outcome of a GR anyway.


Due to how DebConf started and how it evolved, and the pace that they 
had to move on to get things done, they were initially a somewhat 
separate (but close) organization to Debian.


Over the last decade that has changed a lot, and DebConf is now as much 
part of the Debian project as any other Debian sub-project. We now 
mostly use the same Debian TOs (unless there's a good reason to add a 
temporary one for a conf), the DebConf committee is delegated within the 
project and there's no external setup of DebConf that exists anymore 
whatsoever.


I guess you could nitpick on what "formally a part of Debian" means, I 
mean, we don't have formal agreements with most teams within Debian, but 
as far as DebConf is concerned, I wouldn't say it's any more or less a 
part of Debian than any other Debian sub-project.


-Jonathan

Re: General resolution: Condemn Russian invasion of the Ukraine

[Jonas Smedegaard]

Quoting Ansgar (2022-04-08 12:46:59)
> On Fri, 2022-04-08 at 10:44 +0100, Jonathan Dowland wrote:
> > On Thu, Mar 31, 2022 at 08:21:39PM +0300, Adrian Bunk wrote:
> > > If a Debconf location is also considered a political statement as 
> > > you imply then we have to choose Debconf locations by means of GR, 
> > > starting with a GR right now whether Debian wants to consider 
> > > Kosovo a self-determined sovereign nation by holding Debconf 2022 
> > > there.
> > 
> > Correct me if I'm wrong, but Debconf is not formally a part of 
> > Debian, and so cannot be bound by the outcome of a GR anyway.
> 
> Hmm, debconf.org says "Copyright Software in the Public Interest, 
> Inc", but there is no imprint or anything. DebConf as such is not 
> listed as a separate project on https://www.spi-inc.org/projects/; of 
> course it could still be part of systemd or another project.
> 
> DebConf is also not listed on 
> https://www.debian.org/trademark#licenses, but uses Debian trademarks.
> 
> So it pretty much looks like DebConf is part of Debian.

Sorry, I don't follow.  What you quoted above seems to indicate to me 
that Debconf _uses_ Debian, not that it is legally a part of Debian.


 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private

signature.asc
Description: signature

Re: General resolution: Condemn Russian invasion of the Ukraine

[Ansgar]

On Fri, 2022-04-08 at 10:44 +0100, Jonathan Dowland wrote:
> On Thu, Mar 31, 2022 at 08:21:39PM +0300, Adrian Bunk wrote:
> > If a Debconf location is also considered a political statement as
> > you
> > imply then we have to choose Debconf locations by means of GR,
> > starting
> > with a GR right now whether Debian wants to consider Kosovo a
> > self-determined sovereign nation by holding Debconf 2022 there.
> 
> Correct me if I'm wrong, but Debconf is not formally a part of
> Debian, and so cannot be bound by the outcome of a GR anyway.

Hmm, debconf.org says "Copyright Software in the Public Interest, Inc",
but there is no imprint or anything. DebConf as such is not listed as a
separate project on https://www.spi-inc.org/projects/; of course it
could still be part of systemd or another project.

DebConf is also not listed on
https://www.debian.org/trademark#licenses, but uses Debian trademarks.

So it pretty much looks like DebConf is part of Debian.

Ansgar

Re: General resolution: Condemn Russian invasion of the Ukraine

[Jonathan Dowland]

On Thu, Mar 31, 2022 at 04:17:42PM +0300, Adrian Bunk wrote:

Half the people on this planet are living in countries that did not
approve the "Aggression against Ukraine" UN resolution, including
many Debian contributors.


The proposed GR text makes no reference to that UN resolution, so I
don't know why you bring it up.


Does the Debian project consider the territorial integrity of a country
more important than the opinion of the majority of the people living in
a part of the country?
If the Debian project declares it considers Donbas and Crimea to be
part of Ukraine


You have stopped short of saying "the majority of the people in Donbas
and Crimea do not consider themselves to be part of Ukraine" but if
that's what you are intending to assert then you're going to have to
show some hard evidence.

--
Please do not CC me for listmail.

  Jonathan Dowland
✎j...@debian.org
   https://jmtd.net

Re: General resolution: Condemn Russian invasion of the Ukraine

[Jonathan Dowland]

On Thu, Mar 31, 2022 at 08:21:39PM +0300, Adrian Bunk wrote:

If a Debconf location is also considered a political statement as you
imply then we have to choose Debconf locations by means of GR, starting
with a GR right now whether Debian wants to consider Kosovo a
self-determined sovereign nation by holding Debconf 2022 there.


Correct me if I'm wrong, but Debconf is not formally a part of Debian,
and so cannot be bound by the outcome of a GR anyway.


--
Please do not CC me for listmail.

  Jonathan Dowland
✎j...@debian.org
   https://jmtd.net