Hello all,
The Mobile Verification Toolkit[1] project (developed by the Amnesty International Security Lab in light of the recent news about the Pegasus[2] spyware) is using an adapted MPL 2.0 license, the MVT License.
I'd like for this license to be vetted by the legal team, and added to the list of allowed licenses in Fedora so the software can be distributed through Fedora channels.
From https://github.com/mvt-project/mvt#license:
The purpose of MVT is to facilitate the consensual forensic analysis of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want MVT to enable privacy violations of non-consenting individuals. Therefore, the goal of this license is to prohibit the use of MVT (and any other software licensed the same) for the purpose of adversarial forensics.
In order to achieve this, MVT is released under an adaptation of Mozilla Public License v2.0. This modified license includes a new clause 3.0, "Consensual Use Restriction" which permits the use of the licensed software (and any "Larger Work" derived from it) exclusively with the explicit consent of the person/s whose data is being extracted and/or analysed ("Data Owner").
Full License text at https://github.com/mvt-project/mvt/blob/main/LICENSE
Thank you,
Christian
[1] https://github.com/mvt-project/mvt [2] https://forbiddenstories.org/about-the-pegasus-project/
Therefore, the goal of this license is to prohibit the use of MVT (and any other software licensed the same) for the purpose of adversarial forensics.
That sounds like a field-of-use restriction. I can't imagine how such a license can be free under the usual definitions.
For the misspellings of the word "individual", I filed https://github.com/mvt-project/mvt/issues/70
" 3.0. Consensual Use Restriction
Use of Covered Software or of a Larger Work is permitted provided that the Data Owner must explicitly consent to the procedure, free from any form of coercion, and must be fully informed about the nature of the procedure, its privacy implications, and any data retention and disposal policy. "
For context: " 1.16. "Device Owner" (or "Device Owners") means an individal or a legal entity with legal ownership of an electronic device which is being analysed through the use of Covered Software or a Larger Work, or from which Data was extracted for subsequent analysis.
1.17. "Data Owner" (or "Data Owners") means an individial or group of individuals who made use of the electronic device from which Data that is extracted and/or analyzed originated. "Data Owner" might or might not differ from "Device Owner". "
-
Christian Glombek -
Jason L Tibbitts III