Consider that you can post somebody else's code to GitHub, and that may be licensed AGPL (or anything else). In that case, somebody else is the copyright holder so clearly the ToS doesn't magically give GitHub any additional rights and the licence applies.

The most they could do is transfer any liability back to you for posting it in breach of some term in their ToS. But that would be absurd since posting someone else's code, licensed under a common (eg. OSI-approved) license, is an established and normal use case for GitHub. If their ToS really did ban the posting of some AGPL code, they really ought to have pointed it out, and of course it'd render GitHub useless for hosting AGPL code.

This would only apply when posting someone else's code. But of course you could always arrange that.

The ToS do give GitHub an indemnity against the consequences of that scenario - so if the actual copyright holder complains about copilot spitting out their code without proper attribution and license, they could indeed transfer to the liability to the uploader. (That scenario could apply to GPL and MIT code, too, not just AGPL.)

FWIW I find it highly unlikely that (at least in my country, Germany) a court would agree that Microsoft/GitHub could hold you liable for uploading a vendored AGPL dependency in your public GitHub repository because Copilot used your repository as part of its training corpus and someone won a lawsuit against Copilot for reproducing the AGPL code without a license.

Just because it's in the Terms of Use doesn't mean it can be upheld in court (or more specifically: in every court). If you uploaded your repository to a service advertising itself as a version control service, the service using your uploaded code to feed a commercial code generation product would likely be ruled as "surprising", which at least in Germany has been used by courts to dismiss claims of Terms of Use violations (e.g. when WhatsApp banned users for using third party apps).

Replace "AGPL" with Old Microsoft's "public source" (i.e. proprietary code published without an open source license) for a more likely scenario.

Personally, I believe it may actually hold up in court.

That's why for my own projects, I actually made sure to get approval from all contributors when vendoring a dependency just after the ToS change: https://github.com/justjanne/QuasselDroid-ng/issues/5

> ...so if the actual copyright holder complains about copilot spitting out their code without proper attribution and license, they could indeed transfer to the liability to the uploader.

The defence would probably claim that GitHub effectively invite users to post AGPL code (this being a pretty fundamental part of their business model), including when they don't hold the copyright, so it is implied that the ToS indemnity cannot be interpreted to include this situation. If GitHub tried to claim otherwise, they'd have to contradict themselves and courts usually find that kind of thing unacceptable.

The indemnity would stand for other cases of course, such as users posting code without permission of a license.

As a follow-on, what if you're mirroring code which is under an AGPL license? Are you allowed to post it on GitHub if you can't grant those rights under the ToS due to the license of the code?

Probably the ToS. You've granted GitHub specifically license to use your code under the terms of the ToS, they effectively have 2 licenses. They can therefore choose under which licence they want to use your code, and will choose the most permissive one, or the one they have the best understanding of: in this case the ToS.

Other parties are not granted license under the ToS, and so will have to abide by the AGPL.

License takes precedence when you don’t own the copyright. ToS takes precedence when legally allowed and you do own the copyright.

ToS regularly gets thrown out in Europe if considered unfair. Much of OSS is written in the rest of the world.

(Of course the GitHub ToS do not allow any CoPilot activities in the first place.)

That statement is dangerous. ToS often gets thrown out in business to consumer transactions where the business has a significantly better negotiation position (legal counsel,…) It’s a consumer protection mechanism. In business to business interactions, the chance of getting a ToS thrown out is much lower since it’s assumed that the playing field is much more level.

The blog post articulates how GitHub TOS does allow CoPilot.

Their service is hosting code, not writing code.

That's why it's GitHub, not CodeScribe ( or something)

It’s definitely more than just hosting code - GitHub offers issue/PR management, light weight project management, an online IDE for collaborative editing and CI services at least. Arguing that GitHub provides services that aim to improve developer/development team productivity is not a stretch. And arguing that ML-assisted development support is part of that definition isn’t particularly far out either.

They're also allowed to add new services anytime they'd like.

An interesting though experiment is how keen Microsoft would be to allow Copilot to be trained on the Office or Windows source code. If the output is truly free of copyright from its training materials then if not, why not?

It's likely already trained on Windows source code unless they have specifically excluded the repositories of the leaked Win 2000 code. Perhaps someone who's never going to contribute to ReactOS and Wine can verify?

Why would they do that, regardless of whether the output could be restricted via Copyright or not? Also, this case isn't about copyright, as the lawyer clearly explains.

I was more talking about the general morality issue than the specifics of the case.

Why wouldn't they? They are both large important codebases which they can do whatever they like with. If they are confident that Copilot does is akin to learning or at least something transformative then it makes perfect sense.

The output isn't guaranteed to be free of copyright from its training materials. It just usually is. There have been clear demonstrations of it regurgitating code from the training set verbatim, which would of course still be covered by the original license.

Microsoft isn't going to train Copilot on Windows code for the same reason it didn't train it on private repos: the code is private and they don't want to risk leaking private code.

I imagine there would be no problem training it on e.g. the Unreal Engine code which is not open source but is available to read.

The big practical issue is that there's no warning when Copilot produces code that might violate copyright, so you're taking a bit of a risk if you use it to generate huge chunks of code as-is. I imagine they are working on a solution to that though. It's not difficult conceptually.

Private isn't a useful distinction though right? Even open source code often has a licence and conditions on how you can reuse or integrate it into your own code. Someone owns it.

If you sell a product which can regurgitate large parts of code who's licence doesn't allow it to be completely freely used and modified then this kind of outcome seems a foregone conclusion.

> Private isn't a useful distinction though right?

Yes it is. If code is public you can't necessarily use or copy the code (depending on the license) but there's nothing stopping you reading it and learning how it works and any secrets contained in it (e.g. information about future products).

There's a reason most proprietary software isn't "source available".

> If you sell a product which can regurgitate large parts of code who's licence doesn't allow it to be completely freely used and modified

Yes but they don't do that. I'm not sure why people are finding this so hard to understand.

OP here. If you own the copyright to a work, you can license it in any way you like. You can offer it to some people under a commercial license and to other people under an open source license. Many entities practices dual (or tri or whatever) licensing. When you post things on GitHub, you are essentially dual licensing your work. You're providing it under a very broad license to GitHub and you are providing it under an OSS license (or whatever you like) to other GitHub users. Neither license takes precedence. One license applies to one group of people and the other license applies to the other group of people.

This is very similar to what happens when you sign a contributor agreement before contributing code to an open source project. When you sign the contributor agreement, you're granting a very broad license to your work to the project maintainers. They can then license your work out under any license they want. But likewise, because you are not granting them an exclusive license, you're free to put your contribution license out into the world under any license of your choosing separate and apart from the project that you contributed it to.

Technically, I think the scenario you're describing with AGPL code may well be possible and legal. But practically, I think people would stop using GitHub if they felt that doing so would lead to GitHub/Microsoft undercutting their projects, stealing their customers, or essentially stripping the project of any AGPL obligations. I think that from a business perspective, they're really gambling on the idea that developers will see Copilot as a big boon rather than a value suck. Time will tell whether their gamble has paid off.