Opensc: Polish e-Dowód management tool violates OpenSC LGPL license

[majkrzak]

I finally delivered, as I promised. Now it is your turn, @mtrojnar :blush:
https://github.com/OpenSC/OpenSC/issues/1831#issuecomment-569445040

Context

In March 2019 Polish governments introduced the new identity card. First Polish identity card with the electronic layer. Also, management application was released, which is the main reason of this issue. (ref)

Copyright infringement

At lest one component of the eDo (e-dowod-pkcs11-64.so) looks, smells and acts like derived from OpenSC pkcs11 lib. It can be easily noticed by investigating content of the file, or even by looking into the logs emitted by e-dowod_can(ref). According to those traces, at least following files were affected:

• https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/ctx.c
• https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/reader-pcsc.c
• https://github.com/OpenSC/OpenSC/blob/master/src/libopensc/cache-client.c

There is no information about OpenSC or any other LGPL content used by the application. Eula(ref) states that PWPW (Polish Security Printing Works)(ref) is the copyright holder of everything.

My actions

I have opened the issue on the official support channel, but I got informed that the source code is the "company secret and can not be revealed"(ref). As I'm not holding any copyrights of OpenSC I'm not legit of taking any further actions according to that.

Appendixes

e-Dowód URL-s

• https://www.gov.pl/web/e-dowod
• https://www.gov.pl/pliki/edowod/e-dowod-3.0.27.171.run

Vendor response

Szanowny Użytkowniku,z przyczyn bezpieczeństwa, kody źródłowe aplikacji objęte są tajemnicą przedsiębiorstwa i nie mogą być udostępniane. Zespół eDO

Witam

Proszę o udostępnienie kodu źródłowego aplikacji e-dowód Menedżer a w szczególności komponentów opartych na otwartych licencjiach., jak np.: e-dowod-pkcs11-64.so na LGPL

Z poważaniem
Piotr Majkrzak

Fragment of ~./edowod/can.log

2020-03-25T22:37:06.158 common         CAN => Monitor <can>private<can><cmd>checkCAN<cmd><rid>Identiv Identiv uTrust 4701 F Dual Interface Reader [uTrust 4701 F CL Reader] (55041747202849) 01 00<rid>
2020-03-25T22:37:06.260 common         CAN <= Monitor <cmd>canResult<cmd><res>10<res>
2020-03-25T22:37:06.260 driver_pkcs11  checkCan()
2020-03-25T22:37:06.260 driver_pkcs11  driver:init()
2020-03-25T22:37:06.261 common         find "e-dowod-pkcs11-64.so" in prod ("/opt/e-dowod")
2020-03-25T22:37:06.261 driver_pkcs11  Loading library:  "/opt/e-dowod/e-dowod-pkcs11-64.so"
2020-03-25T22:37:06.264 driver_pkcs11  C_initialize()
0x7f7e62999700 22:37:06.264 [opensc-pkcs11] ctx.c:305:sc_context_create: ===================================
0x7f7e62999700 22:37:06.264 [opensc-pkcs11] ctx.c:306:sc_context_create: opensc version: 3.0.27.171, logLevel=20675
0x7f7e62999700 22:37:06.264 [opensc-pkcs11] reader-pcsc.c:778:pcsc_init: PC/SC options: connect_exclusive=0 disconnect_action=0 transaction_end_action=0 reconnect_action=0 enable_pinpad=1 enable_pace=1
0x7f7e62999700 22:37:06.265 [opensc-pkcs11] reader-pcsc.c:1108:pcsc_detect_readers: called
0x7f7e62999700 22:37:06.266 [opensc-pkcs11] reader-pcsc.c:1175:pcsc_detect_readers: pcsc_detect_readers called for reader name: Identiv Identiv uTrust 4701 F Dual Interface Reader [uTrust 4701 F Contact Reader] (55041747202849) 00 00
0x7f7e62999700 22:37:06.266 [opensc-pkcs11] reader-pcsc.c:1198:pcsc_detect_readers: pcsc_detect_readers found
0x7f7e62999700 22:37:06.266 [opensc-pkcs11] reader-pcsc.c:1199:pcsc_detect_readers: Found new pcsc reader 'Identiv Identiv uTrust 4701 F Dual Interface Reader [uTrust 4701 F Contact Reader] (55041747202849) 00 00'
0x7f7e62999700 22:37:06.267 [opensc-pkcs11] reader-pcsc.c:438:refresh_attributes: current  state: 0x00000012
0x7f7e62999700 22:37:06.267 [opensc-pkcs11] reader-pcsc.c:439:refresh_attributes: previous state: 0x00000000
0x7f7e62999700 22:37:06.267 [opensc-pkcs11] reader-pcsc.c:442:refresh_attributes: CardChange=TRUE
0x7f7e62999700 22:37:06.267 [opensc-pkcs11] reader-pcsc.c:337:clear_reader_data_and_flags: clear reader can and flags
0x7f7e62999700 22:37:06.267 [opensc-pkcs11] reader-pcsc.c:512:refresh_attributes: card absent
0x7f7e62999700 22:37:06.267 [opensc-pkcs11] reader-pcsc.c:514:refresh_attributes: Refresh atribiutes 0
0x7f7e62999700 22:37:06.267 [opensc-pkcs11] reader-pcsc.c:1233:pcsc_detect_readers: pcsc_detect_readers reaeder already detected not skipping but goto hide in if
0x7f7e62999700 22:37:06.267 [opensc-pkcs11] reader-pcsc.c:1241:pcsc_detect_readers: Requesting reader features.....................
0x7f7e62999700 22:37:06.268 [opensc-pkcs11] reader-pcsc.c:1242:pcsc_detect_readers: Requesting reader features ... 
0x7f7e62999700 22:37:06.268 [opensc-pkcs11] reader-pcsc.c:1260:pcsc_detect_readers: Identiv Identiv uTrust 4701 F Dual Interface Reader [uTrust 4701 F Contact Reader] (55041747202849) 00 00:SCardConnect(SHARED): 0x8010000c
0x7f7e62999700 22:37:06.268 [opensc-pkcs11] reader-pcsc.c:1198:pcsc_detect_readers: pcsc_detect_readers found
0x7f7e62999700 22:37:06.268 [opensc-pkcs11] reader-pcsc.c:1199:pcsc_detect_readers: Found new pcsc reader 'Identiv Identiv uTrust 4701 F Dual Interface Reader [uTrust 4701 F CL Reader] (55041747202849) 01 00'
0x7f7e62999700 22:37:06.269 [opensc-pkcs11] reader-pcsc.c:438:refresh_attributes: current  state: 0x00150022
0x7f7e62999700 22:37:06.269 [opensc-pkcs11] reader-pcsc.c:439:refresh_attributes: previous state: 0x00000000
0x7f7e62999700 22:37:06.269 [opensc-pkcs11] reader-pcsc.c:442:refresh_attributes: CardChange=TRUE
0x7f7e62999700 22:37:06.269 [opensc-pkcs11] cache-client.c:583:cache_get_can: CAN read from cache
0x7f7e62999700 22:37:06.269 [opensc-pkcs11] cache-client.c:392:cache_get: cache_get:  Identiv Identiv uTrust 4701 F Dual Interface Reader [uTrust 4701 F CL Reader] (55041747202849) 01 00:CAN

EULA head

<p align="justify" ><a name="_Hlk1906251"></a>
Majątkowe
prawa autorskie do aplikacji „e-dowód”,
w skład którego wchodzą „e-dowód Menedżer”, „e-dowód
Monitor”, „e-dowód Podaj CAN”, oraz „e-dowód Pomoc”
oraz do dokumentu „Dokumentacja Użytkownika aplikacji MdO”
przysługują Polskiej Wytwórni Papierów Wartościowych S.A.
(zwanej zamiennie PWPW S.A.) z siedzibą w Warszawie, przy ulicy
Sanguszki 1. Powyższe prawa są chronione ustawą z dnia 4 lutego
1994 r. o prawie autorskim i prawach pokrewnych (tj. Dz. U. z 2018 r.
poz. 1191 z późn. zm.). 
</p>

PWPW (Polish Security Printing Works) contact

Polska Wytwórnia Papierów Wartościowych S.A.

ul. Sanguszki 1
00-222 Warszawa

tel. [phone]
fax [phone]

[email protected]

[hillar]

ref to https://www.pwpw.pl/en/Aboutpwpw/Governing_bodies.html

Zbigniew Bogucki | Chairman of the Supervisory Board

so @majkrzak ask https://twitter.com/boguckizbigniew about it ..

[majkrzak]

@hillar Will be the best if one of copyright holders will do it.

[martinpaljak]

@majkrzak I can give you my "blessing" to pursue this on my behalf, for example if you want to communicate in Polish. FYI, there's a proven record of me not liking these kinds of things in the past when a few other countries/vendors doing things like this. But "don't attribute malice to that which could be explained by incompetence or ignorance" so if you get past ignorant first reply to somebody who actually understands things, it might be easy. For example, in the case of Spain, it was the police who was responsible for the messup, and they rightfully understood what license violation means, even if the "fix" takes appropriate bureaucratic time to be implemented. Hopefully pwpw.pl folks also understand it without further actions.

Could you please provide binaries that would clearly show linking of OpenSC code with code that is not published under LGPL-compatible license?

[martinpaljak]

Got notified that Lithuania also distributes the "pwpw software" https://www.nsc.vrm.lt/downloads.htm so the problem is shared, but possibly more avenues to reach competent and decision-authorized people.

[martinpaljak]

@majkrzak https://twitter.com/martinpaljak/status/1245616094775140354 <- might help you get started.

[martinpaljak]

Looking at the only-in-polish EULA during install and what gets installed later to opt/e-dowod/Licenses/license-e-dowod.html they also forget to mention the bundled OpenSSL. I can only assume/hope they are using a paid license of Qt instead of the opensource one.

[majkrzak]

I've just poked PWPW via the official channel ([email protected]) not via the app support like previously. Let's see what they will respond.

[Avamander]

@martinpaljak

I can only assume/hope they are using a paid license of Qt instead of the opensource one.

Judging by the strings in the project, I think they're using the LGPL version.

[zyga]

If you are serious about it open a case in court.

[Avamander]

@zyga

If you are serious about it open a case in court.

It shouldn't require court to comply with open-source licenses.

[Jadeszek]

@majkrzak Maybe try to ask referring to _Law on access to public information_?

[ad-m]

@Jadeszek , Unfortunately, several court cases show that the courts do not recognize the source code as content by the procedure written in natural language and do not consider it subject to the provisions on access to information (FOI law). Due to the specific legal structure of company and reference to business secrets, this can be additionally difficult and generate a long-term court dispute. Citizens Network Watchdog Poland may provide legal expert in this area.

In addition, administrative courts in Poland do not have the right to appoint an expert, so judges must assess documents and assess them on their simple (in terms of technical knowledge) mind. Lack of technical knowledge among judges is conducive to building secrets so as not to order too much to be revealed due to lack of own knowledge.

I think that it is worth considering - due to the less popular - use the provisions on the re-use of information from the public sector. ePaństwo Foundation ( http://epf.org.pl/ ) may have experience in this area.

[ad-m]

We can ask for invoice and contract for paid license of Qt. The reply of such a request should not cause problems, and will eventually allow us to get the support of another injured copyright owner.

[Avamander]

@ad-m @majkrzak

If FOI or similar laws do not apply in this case, could they be or have they been informed (in Polish) that they're violating the licenses of multiple projects and mustn't distribute those binaries?

[ad-m]

could they

Who?

[Avamander]

@ad-m

Who?

The ministry/institution that runs the gov.pl website that currently distributes the e-dowód software.

[Keij0]

Responses translated to english

Vendor response

Dear user, due to security concerns, the source code of the application is a secret of the company and can't be publicly shared. Team eDO

Hello,

Please share the source code of the e-dowód Menedżer application, especially of its open source components like e-dowod-pkcs11-64 licensed under LGPL

Best regards,
Piotr Majkrzak

EULA head

Commercial copyrights of "e-dowód" application, which includes "e-dowód Menedżer", "e-dowód Podaj CAN", and "e-dowód Pomoc" and "Dokumentacja użytkownika MdO" document belong to Polska Wytwórnia Papierow Wartościowych (also called PWPW S.A.), located on Sanguszki 1 Street, Warsaw are protected by <Polish copyright law identificator in polish law system, you can see the document on the internet, but I guess it's only available in polish>

[ad-m]

In general, FOI law is about getting information (this corresponds to a GET request in HTTP, for ease of explain) and is guaranteed by art. 61 of the Polish Constitution. In order to influence the operation of an institution (POST, PUT, PATCH in HTTP):

• everyone has the right to submit petitions, applications and complaints in the public, own or other person's interest with their consent to public authorities (Article 63 of the Polish Constitution),
• the copyright owner can take legal and judicial actions.

At the weekend I will try to find a moment to neatly formulate a petition to the Ministry
of Digital Affairs to verify the license status of the project and consider - at least temporarily - to suspend publication of the application binary until the legal doubts are removed. If anyone would like to co-sign the petition (this is not required) - please contact me.

[Keij0]

@ad-m Is there any valid way to sign the petition online?

[majkrzak]

<joke>
@Keij0 You can make qualified signature with your ID
</joke>

[martinpaljak]

@ad-m the case here should be to get them to comply with licenses, that is: publish source code and give credit. Not to pursue "cease and desist".

Open source wants to spread (suspending publication does not allow it) and it wants "freedoms" to be granted to users, in the form of source code. As a copyright holder I'd prefer a big red sign on the downloads page "this software include OpenSC, OpenSSL and Qt" until the source code issue is fixed, rather than that download page to disappear from the internet. And ASAP a "here is the source code for the download" link to appear next to download links, that would direct to github, if possible. The appearance of the latter is what this issue should be tracking.

[Devligue]

Isn't this a case for http://gpl-violations.org/?

To provide some background about Open Source license infringement in Poland I think the first loud case was the one from 2010 when eClicto was released. You can read more about it here on page 5. Unfortunately there is no information about how it ended.

[martinpaljak]

@Devligue OpenSC is LGPL, not GPL and I don't see any immediate value gpl-violations could provide.

During a previous case I got assistance from FSFE, in the form of a lawyer who understood the topic of IP as well as spoke the local language, and that helped a lot.

I'd first try to reach some decorated person from pwpw.pl (supervisory board member referred by @hillar is a good target) and if there is no reply or the reply is not sufficient, I'd pursue official government channels with gov.pl and also vrm.lt who distribute that software. Unless there is no reply or the reply is not satisfactory ("we will fix things next fiscal period, maybe" or similar BS) I'd pursue other avenues. From personal experience, I can say that even with best intentions bureaucratic processes can take anything from 6 to 12 months, especially currently (covid19 and summer coming).

[adibo]

Whatever the outcome of FOI approach would be (and Polish government has some history of neglecting the FOI requests), if this is really the case (as it reasonably seems to be), perhaps the first (and wise) thing to do - and in parallel - would be to issue a formal "call to stop copyright infringement" (in Polish: "wezwanie do zaprzestania naruszania praw autorskich") by the copyright owner (!!) towards the violating party. This step does not require any court interaction neither it does require collecting responses from the party.

[xfix]

Send a request for list of licenses of e-Dowód to Ministry of Digital Affairs (I believe this is more likely to succeed, as they distribute the software, PWPW merely developed it), will provide their response when they respond. Of course, additional requests are welcome.

[quetzalcoatl]

@adibo small correction: it should be "zaprzestania naruszania" instead of "zaprzestania naruszenia". It's a subtle difference, something close to "had been infringing" versus "is infringing now". "Naruszenia" goes with "wezwanie do usunięcia naruszenia praw autorskich" (="call to remove copyright infringement"), which is also quite useful phrase -- it's used when you want to call someone for example to remove infringing materials, or to fix/patch something that currently goes against license (i.e. formally correct the copyrights wording, publish affected code, acknowledge authors, etc).

[adibo]

@quetzalcoatl corrected!

[ad-m]

I suggest you stay calm. There is no reason to accept bad intentions for actions that can be explained by ignorance.

The energy obtained through emotional agitation can be used for constructive actions so that the government's project activities in this area are corrected.

If you expect the attention of the press - you can legibly present the topic (nowadays specialist knowledge of the LGPL license and expectations of the FOSS community to understand the problem are required) and provide information to the press. Press inquiries to the spokesperson can provide us with valuable information about a government project.

[majkrzak]

@martinpaljak Looks like it is time to start moderating this issue :sweat_smile:

[ad-m]

I sent to the Minister of Digital Affairs (Ministerstwo Cyfryzacji), the Minister of the Interior and Administration (Ministerstwo Spraw Wewnętrznych i Administracji) and PWPW S.A. official FOI requests as party involved in government project of ID card:

Szanowni Państwo,

Uwzględniając Państwa rolę w projekcie e-dowód, uprzejmie wnoszę o przesłanie [email protected] danych dotyczących aplikacji „e-dowód”, w tym aplikacji „e-dowód Menedżer”, „e-dowód Monitor”, „e-dowód Podaj CAN”, oraz „e-dowód Pomoc” w zakresie:

1. pełną kopie treści wszystkich umów licencyjnych (dalej: licencji) ww. aplikacji, która obowiązują użytkownika końcowego,
2. pełną kopie treści wszystkich licencji wszystkich modułów (bibliotek) wykorzystanych do stworzenia aplikacji,
3. informacji czy zamierzają lub dokonali Państwo weryfikacji postanowień licencji wykorzystanych modułów (bibliotek) w zakresie zgodności ze sposobem dystrybucji i wykorzystania aplikacji w projekcie "e-dowód",
4. kopii treści kodu źródłowego ww. aplikacji, wraz z wszystkimi modułami (bibliotekami).

Pragnę wskazać, że niniejszy wniosek jest konieczny i uzasadniony, gdyż – jak wskazują niezależne ogólnodostępne analizy tego oprogramowania opublikowane na https://github.com/OpenSC/OpenSC/issues/1992 – oprogramowanie to nie jest w pełni autorskim rozwiązaniem PWPW S.A., wbrew miejscami mylącym oznaczeniom, a opiera się na wykorzystaniu otwartych bibliotek, które mają swoje właściwe warunki licencyjne, które wymagają przestrzegania przez autorów oprogramowania, a także użytkowników końcowych.

Oprogramowanie "e-dowód" – w postaci opublikowane na gov.pl – wykorzystuje statycznie skompilowany kod biblioteki OpenSC. Biblioteka ta jest dystrybuowana na warunkach licencji LGPL ( https://github.com/OpenSC/OpenSC/blob/master/COPYING ), która wymaga w takim przypadku dystrybucji treści licencji LGPL i kodu źródłowego.

Z poważaniem,
Adam Dobrawy

I notice that I wrote about the petition before, but I like the idea of getting the content of license agreements first. Obtaining agreements from the government should not be difficult and should not cause legal doubts (in my year of experience with FOI requests). Since I sent a FOI request, I also asked about the source code, as it may turn out that they decide to make the source code available, and then we can - if I'm not mistaken - contribute their changes upstream.

In the message I also signaled the problem of licenses to read our comments, but this does not create a direct obligation to improve the operation. However, it can provide an impulse for auto-correction if it is forwarded internally accordingly.

Due to the suspension in Poland of protection of human rights and freedoms (in my opinion), for complex political and epidemic reasons, we can expect a long response time, if any.

@FineTechPL, the fact that the problem is clear for you is great. So you can work constructively to correct the government's activity in this area. From the emotional repetition of information on this issue, nothing valuable will happen. Shouting in your room "Thief!" you probably won't stop any thief.

Can you write to SpiderWeb, DI24, Niebezpiecznik.pl etc. (Marcin Maj, who works there, is sensitive about copyright law) and other national media asking you to highlight the problem and ask to inquire to spokesperson?

[majkrzak]

@mszarak package provided by the gov.pl contains PKCS#11 library which is derived from OpenSC and implements support for Polish e-dowód.

[martinpaljak]

This is not a critical matter of hours. Do wait for a reply from relevant official channels "within reasonable timeframe" like 3..4 working days or so. And do give indication of "unless no reply within reasonable timeframe, will turn to media". Politically involved folks are often pretty sensitive when it comes to bad PR and it might be a good motivator.

[michael-o]

This is another security-by-obscurity approach..pretty miserable for PL.

[ad-m]

Can we gather experience in opening the source code of similar software from other countries? Polish government will have to decide how to solve the problem and I think it can be helpful to show good examples from other countries.

[michael-o]

Here is the one from here, Germany: https://github.com/Governikus/AusweisApp2, and the information for: https://www.personalausweisportal.de/DE/Buergerinnen-und-Buerger/Online-Ausweisen/das-brauchen-Sie/Software/software-node.html

[Avamander]

Can we gather experience in opening the source code of similar software from other countries?

Estonia has published the source code for all its electronic identity software, including custom opensc, for at least five years now. https://github.com/open-eid

I'm really surprised that pretty much each and every country has decided to reinvent the wheel using the same tech instead of forking LGPL DigiDoc.

[michael-o]

I'm really surprised that pretty much each and every country has decided to reinvent the wheel using the same tech instead of forking LGPL DigiDoc.

Because you don't make money as a contractor when you reuse other people's stuff. I have seen so many reinvent-the-wheel from contractors.

[mik-laj]

According to Polish law, officials have up to 14 days to respond to a request for public information.

If the public information cannot be made available within this period, the entity obliged to make it available shall notify (up to 14 days) of the reasons for the delay and the date by which it will make the information available, not longer than 2 months from the date of submission of the application.

Please, don't assume a bad will. We only have one answer from technical support. It is possible that there is no agreement and a mistake. We are people and everyone makes mistakes. This should not have happened, but it has already happened and we must solve the problem. Nervousness at officials won't solve this problem.

We have to wait until we get the answer to @ad-m's request.

More information about FOI: https://informacjapubliczna.org/poradnik/najczesciej-zadawane-pytania/

[emilkarolak]

Mistake or not - best approach to get them to correct theire "mistakes" would be to inform Google Play Store and Apple Store about copyright infringement - they will be forced to remove it and contact with owner. And then PWPW will have to act quick to restore the app. And the fastest way is to add copyright info and publish source code instead of remaking whole app. With Polish government you have to force them to act. They do not do anything that don't gives them power or money.

[xfix]

Mistake or not - best approach to get them to correct theire "mistakes" would be to inform Google Play Store and Apple Store about copyright infringement - they will be forced to remove it and contact with owner. And then PWPW will have to act quick to restore the app. And the fastest way is to add copyright info and publish source code instead of remaking whole app. With Polish government you have to force them to act. They do not do anything that don't gives them power or money.

e-Dowód is not a mobile application. It shouldn't be confused with mObywatel.

That being said, I would appreciate if somebody did analyze mObywatel for possible copyright violations, the application says nothing about free software being used in it (for instance, from quick analysis I can find okhttp's code which is licensed under Apache 2 license).

[hiciu]

would be to inform Google Play Store and Apple Store about copyright infringement

Please be patient and avoid doing things that could harm end users. This won't help anyone and probably would not be in the best interest of the project.

There will be many options to bring public's attention to the issue in unlikely case that diplomacy fails. But right now you have to be patient, you know that things like that take time in government.

I find it hard to believe that Polish government would ignore such obvious case of piracy (can you imagine the PR fallout? With the elections coming?); ball is in their court, just sit tight and do nothing.

[quetzalcoatl]

@hiciu Actually, I think they could. IIRC, few years ago there was going to be a new law established, saying that the government can take over (or ignore) certain rights/copyrights/products/technologies/etc if the matter was essential for national security.. I remember that there was some short (few months?) outrage and discussion in the media, and then it ceased and nobody talked about it anymore. I'm not 100% sure if politicians succeeded in establishing it, but I'd be surprised if they didn't. But we'll see. If it has been established, this is an almost perfect case for using such law as a shield against any such claims.

[Rev-gh]

My friend send a request to the Ministry of Internal Affairs and the PWPW for the source code for modified parts of OpenSC in March 2019. There was no reply.

[martinpaljak]

For the record:

$ wget https://www.gov.pl/pliki/edowod/e-dowod-3.0.27.171.run
$ sha256sum e-dowod-3.0.27.171.run
c1430fdbd2d90c4dbd49457c7dffeb45481ae5aa26163155227a233bdd571e29  e-dowod-3.0.27.171.run
$ ./e-dowod-3.0.27.171.run
...
$ sha256sum /opt/e-dowod/e-dowod-pkcs11-64.so
e29255af47ece58a89bf41c61b6bcf183e1ce9f478be8df910e39e9bc27ff360  /opt/e-dowod/e-dowod-pkcs11-64.so
$ ldd /opt/e-dowod/e-dowod-pkcs11-64.so 
    linux-vdso.so.1 (0x00007ffea33e4000)
    libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007fcff3933000)
    libedowod.so => /opt/e-dowod/libedowod.so (0x00007fcff34c6000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fcff3303000)
    /lib64/ld-linux-x86-64.so.2 (0x00007fcff3b95000)
    librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007fcff32f8000)
    libuuid.so.1 => /lib/x86_64-linux-gnu/libuuid.so.1 (0x00007fcff32ef000)
    libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fcff32ce000)
    libstdc++.so.6 => /lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007fcff30ff000)
    libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fcff2fba000)
    libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007fcff2fa0000)

$ nm /opt/e-dowod/e-dowod-pkcs11-64.so | grep __pkcs15_create_data_object
000000000002ac40 t __pkcs15_create_data_object
$ strings /opt/e-dowod/e-dowod-pkcs11-64.so | grep -C 2 PWPW
C_SetCAN() get slot rv %i
C_GetInfo()
PWPW S.A.
PL-ID PKCS#11 API v.
3.0.27.171

Few things to pay attention to:

1. https://github.com/OpenSC/OpenSC/blob/master/src/pkcs11/framework-pkcs15.c#L477 is so-very-obviously linked into the binary
2. There is no "C_SetCAN" in PKCS#11, as was already nicely reported earlier: https://stackoverflow.com/questions/58412609/what-is-can-and-how-to-provide-it/59555954#59555954
3. This thread should be put on hold until Monday-Tuesday (assuming there would be some reply by then)

[martinpaljak]

Folks, don't be trigger-happy. OpenSC is not FSF code, thus the action @nkod-pl did is useless

"The Free Software Foundation acts on GPL violations reported on FSF-copyrighted code. Thus, if the program includes code that is copyright Free Software Foundation, please send your report to [e-mail]."

At the same time, as an actual copyright holder with the mentioned OpenSC code I'm happy with what folks have done this far (that is, contacting the software distributor + slight escalation via public channels).

The thing to do right now is to wait for follow-up by PWPW.

[bderleta]

Apparently they used there a lot more of opensource software. One of the programmers working for PWPW admitted they're using OpenSC explicitely.

https://www.linkedin.com/in/krzysztof-guć-9105bb76/

"
Programista C++

Nazwa firmy

PWPW S.A.
Okres zatrudnienia maj 2015 – obecnie
Czas zatrudnienia 5 lat

• Rozwój oprogramowania do obsługi kart mikroprocesorowych.
• Używane biblioteki: Qt5, Gtk3, openssl, opensc, boost, objective_c, multi-thread, cryptography.
• Docelowe systemy Windows/Linux/MacOSX "

[quetzalcoatl]

@bderleta nice find. Please cache it / screenshot / etc, this could be useful in future.

[Kern3l]

Hello,
Please share the source code of the e-dowód Menedżer application, especially of its open source components like e-dowod-pkcs11-64 licensed under LGPL
Best regards

Please explain your reasons more clearly next time to get better results. If a random person sees such message and they don't know what "open source" means, then they will most likely just ask devs if they can share the code (if ask at all). The answer will be a "no". The correct way is in the later comment: https://github.com/OpenSC/OpenSC/issues/1992#issuecomment-609421306 - the first paragraph. Just indicate in a clear way that a law violation may be present there. That should get their more serious attention ;)

[maciejsszmigiero]

As the #9 top contributor to this project (by lines added) I certainly did not consent for PWPW (or anyone else, for that matter) to use or distribute my contributions in a way that violates the OpenSC license.

[Czaki]

@CodeLesser From polish law "Ustawa o prawie autorskim i prawach pokrewnych" (Act on copyright and related rights)

Art. 16 Autorskie prawa osobiste
Jeżeli ustawa nie stanowi inaczej, autorskie prawa osobiste chronią nieograniczoną w czasie i niepodlegającą zrzeczeniu się lub zbyciu więź twórcy z utworem, a w szczególności prawo do:
1) autorstwa utworu;
2) oznaczenia utworu swoim nazwiskiem lub pseudonimem albo do udostępniania go anonimowo;

Which means

Art. 16 Copyright personal rights
Unless the Act provides otherwise, personal copyrights protect the author unrestricted and non-surrender or sale bond with the work, and in particular the right to:
1) authorship of the work;
2) mark the work with your name or nickname or to make it available anonymously;

So it is break of law in Poland.

Other points of Art 16 are not related to computer program.

[grzebo]

Besides civil proceedings you can initiate a criminal case, because Polish law penalizes following crimes:

• falsely pretending to be an author of a work,
• publishing someone's work without discloing author's name or chosen pseudonym,
• publishing someone's work against the terms of a licence,
• illegaly acquiring someone's computer program for material gain.

The relevant law is:

From Ustawa o prawie autorskim i prawach pokrewnych (Act on copyright and related rights):
Art. 115.

1. Kto przywłaszcza sobie autorstwo albo wprowadza w błąd co do autorstwa całości lub części cudzego utworu albo artystycznego wykonania,
   podlega grzywnie, karze ograniczenia wolności albo pozbawienia wolności do lat 3.
2. Tej samej karze podlega, kto rozpowszechnia bez podania nazwiska lub pseudonimu twórcy cudzy utwór w wersji oryginalnej albo w postaci opracowania, artystyczne wykonanie albo publicznie zniekształca taki utwór, artystyczne wykonanie, fonogram, wideogram lub nadanie.
3. Kto w celu osiągnięcia korzyści majątkowej w inny sposób niż określony w ust. 1 lub 2 narusza cudze prawa autorskie lub prawa pokrewne określone w art. 16, art. 17, art. 18, art. 19 ust. 1, art. 191, art. 86, art. 94 ust. 4 lub art. 97, albo nie wykonuje obowiązków określonych w art. 193 ust. 2 lub art. 20 ust. 1-4,
   podlega grzywnie, karze ograniczenia wolności albo pozbawienia wolności do roku.

Art. 116.

1. Kto bez uprawnienia albo wbrew jego warunkom rozpowszechnia cudzy utwór w wersji oryginalnej albo w postaci opracowania, artystyczne wykonanie, fonogram, wideogram lub nadanie,
   podlega grzywnie, karze ograniczenia wolności albo pozbawienia wolności do lat 2.
2. Jeżeli sprawca dopuszcza się czynu określonego w ust. 1 w celu osiągnięcia korzyści majątkowej,
   podlega karze pozbawienia wolności do lat 3.
3. Jeżeli sprawca uczynił sobie z popełniania przestępstwa określonego w ust. 1 stałe źródło dochodu albo działalność przestępną, określoną w ust. 1, organizuje lub nią kieruje,
   podlega karze pozbawienia wolności od 6 miesięcy do lat 5.
4. Jeżeli sprawca czynu określonego w ust. 1 działa nieumyślnie,
   podlega grzywnie, karze ograniczenia wolności albo pozbawienia wolności do roku.

Art. 117.

1. Kto bez uprawnienia albo wbrew jego warunkom w celu rozpowszechnienia utrwala lub zwielokrotnia cudzy utwór w wersji oryginalnej lub w postaci opracowania, artystyczne wykonanie, fonogram, wideogram lub nadanie,
   podlega grzywnie, karze ograniczenia wolności albo pozbawienia wolności do lat 2.
2. Jeżeli sprawca uczynił sobie z popełniania przestępstwa określonego w ust. 1 stałe źródło dochodu albo działalność przestępną, określoną w ust. 1, organizuje lub nią kieruje,
   podlega karze pozbawienia wolności do lat 3.

Art. 122.
Ściganie przestępstw określonych w art. 116 ust. 1, 2 i 4, art. 117 ust. 1, art. 118 ust. 1, art. 1181 oraz art. 119 następuje na wniosek pokrzywdzonego.

Translation:
Art. 115.

1. Whoever appropriates authorship or misleads as to the authorship of all or part of someone else's work or artistic performance,
   is subject to a fine, the penalty of restriction of liberty or the deprivation of liberty for up to 3 years.
2. The same punishment shall be imposed on anyone who distributes, without providing the name or nickname of the creator, someone else's work in the original version or in the form of an elaboration, artistic performance or publicly distorting such work, artistic performance, phonogram, videogram or broadcast.
3. Who, in order to achieve financial gain in a different way than specified in para. 1 or 2 infringes other people's copyright or related rights specified in art. 16, art. 17, art. 18, art. 19 paragraph 1, art. 191, art. 86, art. 94 section 4 or art. 97, or does not perform the obligations specified in art. 193 paragraph 2 or art. 20 clause 1-4
   subject to a fine, restriction of liberty or imprisonment for a year.

Art. 116.

1. Whoever, without permission or contrary to its conditions, distributes someone else's work in the original version or in the form of an elaboration, artistic performance, phonogram, videogram or broadcast,
   is subject to a fine, the penalty of restriction of liberty or the penalty of imprisonment for up to 2 years.
2. If the perpetrator commits the act specified in para. 1 in order to achieve financial benefits,
   is subject to the penalty of imprisonment for up to 3 years.
3. If the perpetrator has made himself committing the offense specified in para. 1 permanent source of income or criminal activity referred to in para. 1, organizes or manages it,
   is punishable by imprisonment from 6 months to 5 years.
4. If the perpetrator of the act specified in para. 1 acts unintentionally,
   subject to a fine, restriction of liberty or imprisonment for a year.

Art. 117.

1. Whoever, without permission or contrary to its terms and conditions for dissemination, perpetuates or reproduces someone else's work in the original version or in the form of an elaboration, artistic performance, phonogram, videogram or broadcast,
   is subject to a fine, the penalty of restriction of liberty or the penalty of imprisonment for up to 2 years.
2. If the perpetrator has committed himself to committing the offense specified in para. 1 permanent source of income or criminal activity referred to in para. 1, organizes or manages it,
   is subject to the penalty of imprisonment for up to 3 years.

Art. 122.
Prosecution of offenses specified in art. 116 section 1, 2 and 4, art. 117 section 1, art. 118 paragraph 1, art. 1181 and art. 119 is at the request of the injured party.

From Kodeks karny (Penal code):
Art. 278.
§ 1. Kto zabiera w celu przywłaszczenia cudzą rzecz ruchomą,
podlega karze pozbawienia wolności od 3 miesięcy do lat 5.
§ 2. Tej samej karze podlega, kto bez zgody osoby uprawnionej uzyskuje cudzy program komputerowy w celu osiągnięcia korzyści majątkowej.

translation:
Art. 278.
§ 1. Who takes for the appropriation of someone else's movable property,
is punishable by imprisonment from 3 months to 5 years.
§ 2. The same punishment shall be imposed on anyone who, without the consent of the authorized person, obtains someone else's computer program in order to achieve financial gain.

[quetzalcoatl]

Please note that what CodeLesser wrote is very important. It should be investigated a bit more.

If the binaries were 100% unmodified except for the filename and copyrights, the case would be clear: they wanted to hide the origin of the code and make it look as it was their work. There would hardly be any doubt about that. It would be 100% theft, because they took one thing and relabelled it and republished as theirs. It's hard to disregard the feeling of malicious action, because someone wouldn't have to make any effort to make opensc-pkcs11.dll work in their project as it is, out of the box, and nobody would think about spending a single second on altering it in any way.. thus the action of renaming it to e-dowod-pkcs11-64.dll must have been dictated by the urge to conceal something. But what? OpenSC is not on any Software Blacklists of Poland (at least none I know to exist haha), hence the person doing that must have wanted to conceal dependencies or third party components.

However, if some parts of the code were really noticeably modified (i.e. new features, optimizations, bugfixes, etc -- so not only cosmetic changes to make file hashes differ), then it's also a case of a derived work (even if its 1% changed plus 99% original), which they may rightfully consider theirs (even if its 1% changed, it's their change). In this case, person who wrote/adapted/build/etc the code:

• might have been ignorant of copyright issues (not that's any excuse, but still)
• might have wanted to protect their ideas ("I changed it a lot, it's mine now!")
• might have wanted to protect OpenSC ("I changed it, so it's not original, so I should rename it")
• might be untrained in copyrights and tried to be smart and keep out of legal issues by intentionally not using OpenSC name ("I can't use OpenSC name, library is free but the world is crazy about trademarks, we can't be paying for using the OpenSC logo/trademark/etc")
• and so on.

Over the years, I've met a huge number of people who had some better or worse idea about copyrights, but everyone had some specific bits just wrong. Not that I'm an expert myself. But at least I know that I'm not sure, and that I should seek legal advice when in doubt - but for example, almost every junior programmer I met so far lacked that knowledge. Most of them simply thought that copy&adapt = new work, their work, no strings attached. Especially with free software and free content.. Like ancient greek texts in public domain. It's free, right? If you take it and adapt it as space opera, you don't need to write everywhere it was Homer's Odyssey, right? If this was what happened, then it's not an explicit malice, but rather a negligence of the project's management staff that didn't train the juniors in copyrights or didn't take care about reviewing whever/what components were being used in the projects.. I've seen that already :|

...and since polish law system is weird (really), I'd advise you against taking any legal steps unless you are already experienced in doing this in Poland. Yes, I know we're in EU, but Poland law was strange, and the current main political party is HYPER WEIRD and highly anti-EU and in many cases doesn't feel like abiding EU rules, and problems within this e-Dowod project will be seen by those politicians who actually can influence the law system.

Once you want to escalate the case further than just polite inquiries,do contact some polish FOSS organization. They will be able to either judge the situation and advise what legal steps should be taken, or at least will know some lawyer experienced in copyrights.. I mean, if you start it off wrong way, you can easily have your case stuck in the court for a decade.. Also, keep in mind that if too much bad PR arises, if the case starts smelling bad country-wide/etc, you may have it abruptly "solved" by politicians.. one will say the project is "national security", other will say "EU won't tell us how to handle internal affairs", escalated to "we're an independent country", "we must defend ourselves on our own!" and main political party makes a blitz-overnight-parliament-proceedings to fix the law so you can't touch this.. Seriously. Happens a lot lately, maybe not in the area of copyrights (yet?), but it's cRaZy here. Tread lightly when walking near the government affairs.

[krzys-h]

I noticed that everybody keeps mentioning e-dowod-pkcs11-64.so, so I would just like to take a moment to pay your attention to libedowod.so...

I wonder, what could it possibly be? :wink: Yeah, it seems to be just libopensc (with OpenSSL linked in statically for some reason)

This also suggests there were indeed some customizations made. I can't find a reference to sc_activate_security_env anywhere on the internet, and certainly not in OpenSC repo.

Oh, and by the way, they forgot to strip e-dowod-pkcs11-64.so from debug symbols, in case that's useful. libedowod.so and all other binaries are stripped though.

e-dowod_can:            ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=c9d5b150ced3c2ac692b8faba9ae650ccc492470, stripped
e-dowod_manager:        ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=13d0bfc22df7e4eea17eba3fb97647f48aedb30c, stripped
e-dowod_monitor:        ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=7723d421f24f363f01da8dd999ebbb7437b6591e, stripped
e-dowod-pkcs11-64.so:   ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=eecddc9bf1a964b58d578675b77cb389fffd13d3, not stripped
libedowod.so:           ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=f2db16c862c8df3cb658490747e5bc7e1b5dc08d, stripped

[grepwood]

Why not just sue them without warning? All they do is make more taxes and welfare which we have to foot for.

[quetzalcoatl]

@grepwood because if you sue them the wrong way, the case may get stuck FOR YEARS, and while it's "open", you cannot sue them the second time for the same thing, even if you now are now more skilled in the legalese.

[grepwood]

Oh hecc, good point @quetzalcoatl

[wvffle]

Why not just sue them without warning? All they do is make more taxes and welfare which we have to foot for.

Second thing is that even if we win, the ones who will pay for the whole thing is us. In the taxes.

[Ickerday]

I'm gonna be blunt, but I can't stand the shit that's happening in this country anymore.
Worst case, someone will moderate my post, welp.

I find it hard to believe that Polish government would ignore such obvious case of piracy (can you imagine the PR fallout? With the elections coming?); ball is in their court, just sit tight and do nothing.

@hiciu ...are you serious?

No. They don't care. There will be no PR fallout. No mainstream media will cover this. Nobody cares about these things in Poland. Current government's electorate can barely understand what apps are, let alone who makes them. Don't expect to understand what "open source licenses" are.

Nowadays Poland is pretty reminiscent of a USSR-like state. My advice - treat it as such.
If you can't somehow make them fix their mistakes - they won't fix them.
If you suspect their apps are breaching FOSS licenses - report them.

Don't fool yourselves, "pretty please" won't cut it here.

[emilkarolak]

My thoughts exactly. Our (Polish) government is criminal. They are currently in the process of faking president election during Covid-19 outbreak. We have soldiers on streets and assembly ban. We can not protest.
And you think they will care about copyrights? No. Only way is to block this "app" by 3-rd parties and prosecuted by EU courts.

I'm gonna be blunt, but I can't stand the shit that's happening in this country anymore.
Worst case, someone will moderate my post, welp.

I find it hard to believe that Polish government would ignore such obvious case of piracy (can you imagine the PR fallout? With the elections coming?); ball is in their court, just sit tight and do nothing.

@hiciu ...are you serious?

No. They don't care. There will be no PR fallout. No mainstream media will cover this. Nobody cares about these things in Poland. Current government's electorate can barely understand what apps are, let alone who makes them. Don't expect to understand what "open source licenses" are.

Nowadays Poland is pretty reminiscent of a USSR-like state. My advice - treat it as such.
If you can't somehow make them fix their mistakes - they won't fix them.
If you suspect their apps are breaching FOSS licenses - report them.

Don't fool yourselves, "pretty please" won't cut it here.

[ad-m]

I think that this is not the place for political discussions on whether Poland is a democratic country or not anymore. I am asking you to keep the thread clean so that we can focus on the issue.

I received a response from the Ministry of Digital Affairs:

Translation:

I would like to kindly inform you that the Ministry of Digital Afairs is not competent to answer in
the issues raised by you. Applications and components indicated in the question
related items were created based on the order awarded to PWPW by the Ministry of Interior and Administration.
In connection with the above, I suggest referring to the above letter, as appropriate, to PWPW
or the Ministry of the Interior and Administration. Please provide contact details below.

It is worth noting that the answer indicates that in the opinion of the Ministry it is not appropriate to answer the questions. However, the law indicates that the entity that holds (stores, does not have to be the addressee or author) information is appropriate to respond to FOI requests. The Ministry has not indicated in any way that it does not store such information in any way.

However, I accept this answer as solve issue with this Ministry of Digital Affairs at this stage, because we expect other entities to respond.

[hiciu]

My thoughts exactly. Our (Polish) government is criminal.

Nowadays Poland is pretty reminiscent of a USSR-like state. My advice - treat it as such.
If you can't somehow make them fix their mistakes - they won't fix them.
If you suspect their apps are breaching FOSS licenses - report them.

Don't fool yourselves, "pretty please" won't cut it here.

I am pretty sure that github comments are not a place for political content and that is why I have tried to keep my previous comment neutral. But since I've been called out I feel like my previous comment needs a clarification: I am not a fan of current political regime, far from that. There is a great French invention from 17th century and I'll be there building one with you when the time comes.

That said, the main point of my previous comment was to stop any hot heads from flooding Google Play Store and Apple Store with reports, because:

1. removal of such application, without warning, could have negative impact on innocent end users,
2. the way I understand it only the copyright owner / owners have legitimate power to make such claims / reports,
3. additional low quality reports will only clog the system.

But that part is no longer a concern here because, as someone previously noted, there was a confusion about e-Dowód / mObywatel applications[1].

Whatever Polish government can just burry this issue or not, and whatever people will actually care - that is beyond our control, but keep in mind that e-Dowód development was financed from European Union funds[2], there is no doubt about whatever there actually was a copyright infringement. So while they could ignore us, hopefully they can't ignore EU.

I don't think we should derail this issue with Polish politics more than necessary. Keep yourselves safe, practice opsec and keep that stuff separate from your RL identity; you never know how this will unfold.

[hiciu]

I wanted to include just some more evidence.

1. I can download, from https://www.gov.pl/web/e-dowod, file described as "E-dowód menadżer, v.3.0.27.171 wersja dla systemu Windows" ("e-Dowód manager, v.3.0.27.171, version for Windows system"). It leads to https://www.gov.pl/pliki/edowod/e-dowod-3.0.27.171.exe and downloading that file leaves me with:

   $ env TZ=UTC date
   Fri Apr 10 17:03:32 UTC 2020
   $ sha256sum e-dowod-3.0.27.171.exe 
   5c09a4990fda4d48c9b692d44c25ed3788509b11bd9058098379c661b5fef53f  e-dowod-3.0.27.171.exe
   $ du -hs e-dowod-3.0.27.171.exe 
   35M     e-dowod-3.0.27.171.exe
   

2. Since I choose to download windows .exe, I am executing it with wine. During installation, in second step, I am presented with License Agreement text (in polish; sorry, I'm not sure if there is an English translation somewhere) that I have copied and included in an attachment:

   e-dowod-polish-license-text.txt

   

   That visible first paragraph of the license has already been included in https://github.com/OpenSC/OpenSC/issues/1992#issue-588551737. It basically says:

   Copyrights to the e-Dowód application, which includes e-Dowód manager, e-Dowód (...) and to the document "User Documentation of MdO application" belong to Polska Wytwórnia Papierów Wartościowych S.A (interchangeably referred to as PWPW S.A.) with its registered office in Warsaw, at Sanguszki 1 Street. The above rights are protected by the Act of 4 February 1994 on Copyright and Related Rights (tj. Dz. U. z 2018 r. poz. 1191 z późn. zm.)

   (that "Dz. U. ..." part is just a reference to the act)

3. I am confirming that extracted files have opensc-related strings inside:

   $ sha256sum wine/e-dowod/drive_c/PWPW/e-dowod/*/e-dowod-*.dll
   807436a8ea28261f32a9fca1f8db5a95be7ef5a80d351800eb9b00ba5a5bf7d0  wine/e-dowod/drive_c/PWPW/e-dowod/32/e-dowod-minidriver-32.dll
   f391e4950fade532c0c53a11a93baeec0a6abd7aa8d1576acd85e266b5966b46  wine/e-dowod/drive_c/PWPW/e-dowod/32/e-dowod-pkcs11-32.dll
   0451d8c62ab1420c727aad1d25b6d69ece73945accfb7193ed3bab3f15ac2092  wine/e-dowod/drive_c/PWPW/e-dowod/64/e-dowod-minidriver-64.dll
   e664772756bb9d9da02e869a5de616ad64a274412d4d31a2451cf53737b13303  wine/e-dowod/drive_c/PWPW/e-dowod/64/e-dowod-pkcs11-64.dll
   $ strings wine/e-dowod/drive_c/PWPW/e-dowod/*/e-dowod-*.dll | grep opensc -i
   OPENSC_MD_LOG
   OPENSC_LEAK_LOG_DIR
   OPENSC_LOG
   opensc version: %s, logLevel=%i
   OpenSC Card
   OpenSC Project
   opensc-pkcs11
   OPENSC_LEAK_LOG_DIR
   libopensc return value: %d (%s)
   OpenSC (www.opensc-project.org)
   OPENSC_LOG
   opensc version: %s, logLevel=%i
   OpenSC Card
   OpenSC Project
   OPENSC_MD_LOG
   OPENSC_LEAK_LOG_DIR
   OPENSC_LOG
   opensc version: %s, logLevel=%i
   OpenSC Card
   OpenSC Project
   opensc-pkcs11
   OPENSC_LEAK_LOG_DIR
   libopensc return value: %d (%s)
   OpenSC (www.opensc-project.org)
   OPENSC_LOG
   opensc version: %s, logLevel=%i
   OpenSC Card
   OpenSC Project
   

[xfix]

Got a response, not too surprising, pretty much the same thing as @ad-m has received.

[Ickerday]

Yeah, they're just ceding the responsibility. Don't expect any resolution from "pretty please" emails, this is how the whole country operates.

[adibo]

Clearly (and not surprisingly) they are not eager to take the ownership. As of 2019-12-06 the supervision of PWPW S.A. is in the hands of The Ministry of Internal Affairs and Administration (pl: MSWiA).
See here: https://www.pwpw.pl/O_pwpw/Organy_spolki.html

[martinpaljak]

FYI: sent an e-mail to [email protected] and m.[email protected] (based on https://www.pwpw.pl/en/Contact.html and https://www.pwpw.pl/en/Aboutpwpw/Management_board.html)

Subject: Action required: license violation in PWPW-branded software.

To whom it may concern,

I believe you have heard about a license violation of software distributed in (at least) Poland and Lithuania which claims exclusive PWPW copyright, but is in fact blunt re-packaging of open source software (OpenSC) without following the legal requirements to attribute authors, include license information and to make the source code available together with the binaries.

The details of the issue can be found here: https://github.com/OpenSC/OpenSC/issues/1992

Here is a link to the license text in question: https://github.com/OpenSC/OpenSC/blob/master/COPYING

Such license violation is more commonly called “stealing”.

To my knowledge PWPW has this far not responded with adequate replies about the situation, nor how it plans to remediate the license violation.

As a legal copyright holder (read: a person PWPW steals from) with the software in question (OpenSC) I’d like to hear from a human being at PWPW that the information about the license violation has been received and understood, before pursuing further actions on my behalf. Please reply with an acknowledging confirmation via e-mail to [email protected] or by phone +372 XXX XXXX ASAP, but no later than Tuesday, 21 April 2020 12:00 GMT (14:00 in Warsaw).

If you have any questions, please don’t hesitate to call me on the mentioned number.

Best Regards,

Martin Paljak
Estonia

https://twitter.com/martinpaljak/status/1251048503129841664

[martinpaljak]

There is contact with a person with a name at PWPW.

Thank you for your inquiry. The technical teams in PWPW S.A. have already started internal verification process to check the possible violation of software licence. Due to the field we operate in, we are dedicated to response the issue as soon as possible. However, the epidemic in Poland makes this more difficult. The analytical process should be completed by the end of April 2020 and we undertake to send an official reply in that regard by that time.

Will keep you posted how it goes, this far better than nothing.

I also notified Lithuanian Ministry of the Interior regarding the software made available for download by them (but implemented by PWPW) that also includes OpenSC, but not in a license-compatible way. As they distribute it (via https://www.nsc.vrm.lt/downloads.htm) they must also make available the source code (they do attribute, but the distributed work is not LGPL-compliant linking, thus the distributed work is derivative work where combined source code must be made available).

[ad-m]

PWPW has stated that it is not possible to answer my questions, and the deadline - due to recent changes in law - has been suspended indefinitely.

This type of reply cannot be appealed to court, because in Poland the human right to court has also been suspended. I can only hope that someday eventually I will receive an answer.

BTW. As you can see, the electronic signature in PWPW has not been adopted well. We have the first stamps in the case! :smile_cat:

[quetzalcoatl]

While I won't attempt to translate it whole to english, due to the legalese (IANAL), the reply basically boils down to two things:

(..covid blah blah covid..) nie rozpoczyna się, a rozpoczęty ulega zawieszeniu na ten okres
(..) Z uwagi na (..) nie rozpoczął się bieg terminu

which means that "due to the recent COVID regulations, the deadline countdown for getting access to public information could either be extended (if the time was already ticking), or could be not even started (if the case is new and wasn't recognized yet)" and later next sentence claims the latter: since this case is new, the deadline countdown was not even started in this case. This means, it's not delayed, it's not "open". Once COVID regulations are cancelled, nothing will happen automatically. You'll have to resend the query.

and then:

Obecnie nie jest możliwe podjęcie czynności zmierzających do rozpoznaniu przedmiotowego wniosku.

which means something close to "Currently it is not possible to undertake any actions dedicated to assess your query" - that is, formally, they didn't even read it, nor considered validity, nor considered replying to you, since they are unable to do so (~covid blah blah deadline invalid blah).

So. No cigar so far. However, that is a nice thing to have. Once COVID "shield" wears off, you've got a direct contact to their representative, and a one that has the power to respond to queries regarding access-to-public-information. Considering she apparently has "pełnomocnictwo" (sorry, I forgot how that's in english) since 2018, she'll probably stay on that position for some time.

[tomato42]

Considering she apparently has "pełnomocnictwo" (sorry, I forgot how that's in english) since 2018, she'll probably stay on that position for some time.

the English legal term for that is "power of attorney"

[majkrzak]

I have a good news for you. I've managed to make a valid signature using my implementation. By the end of the week, I will deliver initial PR. :muscle:

[ad-m]

@majkrzak , proszę trzymać się pierwotnego tematu zagadnienia i nie utrudniać rozwoju projektu OpenSC :wink: Zapewne chciałeś skomentować w #1831 .

[wiedzmin26]

@majkrzak e-dowód menadżer has new 4.0.0 version.
https://www.gov.pl/web/e-dowod/#Pliki-do-pobrania
Did you check this version? This version also has legal problems?

[majkrzak]

In EULA there is now section about licenses of:

• Qt Installer Framework v. 3.2.0
• Network Security Services v. 3.39
• Qt v. 5.x
• Spdlog
• OpenSSL v. 1.0.2p oraz OpenSSL v. 1.1.1c

Issue with fonts is now resolved.

It is possible to configure Firefox by the app.

Logs are still landing in the middle of home directory, but they don't contain OpenSC like messages.

Also binaries are now stripped, but they are still quite sure OpenSC based:
strings libedowod.so | grep sc_

P. S.
libedowod.so was garbage from previous installation. It might be different implementation, because pkcs15 emulation layer is slightly different.

[mtrojnar]

Attempts to hide evidence prove premeditation, don't they?

[quetzalcoatl]

In EULA there is now section about licenses of:

• Qt Installer Framework v. 3.2.0
• Network Security Services v. 3.39
• Qt v. 5.x
• Spdlog
• OpenSSL v. 1.0.2p oraz OpenSSL v. 1.1.1c

(...)
Also binaries are now stripped, but they are still quite sure OpenSC based:
strings libedowod.so | grep sc_

I must admit, I did not expect that they will add ANY licensing information so fast, but going further from this, I'm pretty shocked that they have omitted OpenSC. What's the point of it? If they admit to be using QT and OpenSSL and others, then why not admit using OpenSC? The only thing that I can think of is that they: modified OpenSC and that they added some critical changes that cannot be published and they are now cornered. I wonder, what was that. I feel an itch to fireoff a disassembler. I probably won't have the time to do this, but by any chance, do we have any best guesses about what was the base code revision they forked from?

[Avamander]

@quetzalcoatl
Your hypothesis sounds likely. However there's one other possibility that OpenSSL and Qt devs are a bit scarier for them, the @qt company has resources to take this further. I am not certain they still comply though, have they paid for Qt?

It is very low of pwpw just to strip binaries to hide their blatant copyright violation, shame on them.

[mtrojnar]

I'm pretty shocked that they have omitted OpenSC. What's the point of it?

I guess this is because both:

1. OpenSC requires distributing sources of any derivative works along with those works (LGPL is a copyleft license).
2. They consider their derived library as their trade secret.

[ad-m]

In Poland, the suspension of law was withdrawn. Now PWPW postpones the consideration of information request to next 2 month. In my opinion, it violates law (see the judgment of the Provincial Administrative Court in Łódź of 28 April 2020, II SAB/Łd 12/20), but the courts will not be able to consider this before the new date - 24 July. I'll wait.

Justification of postponse:

The need to extend the deadline for providing the requested information results from the need to thoroughly verify the application, collect and analyze the necessary data, and evaluate the principles and procedure for examining the request.

It is worth noting that the procedure in Poland provides for such a long extension only for the purpose of providing information, not for the purposes of refusal:

Article 13. 1. Public information shall be made available on request without undue delay, but no later than within 14 days from the date of submission of the request, subject to paragraph 2 and Article 15 paragraph 2.

1. If public information cannot be made available within the deadline specified in paragraph 1, the entity obliged to make it available shall notify the delay delay and due date within that period, with what information it will make available, however, not longer than 2 months from the date of submitting the application.

I am afraid, however, that "evaluate the principles and procedure for examining the request" will lead to a refusal within a deadline that is against the law. The extension of the deadline is not authorized for the purposes of performing these activities.

Classically, more stamps, because the electronic signature was not accepted even by the producer of the electronic signature. :smile_cat:

[martinpaljak]

Can anyone with access to the card verify the stuff that has been published recently on the gov.pl site?

Especially the PKCS#11 module, which seems a bit ... aggressively stripped.

[majkrzak]

@martinpaljak If it is what you are asking version 4.0.0.100 works for me. Here is brief content analysis: https://github.com/OpenSC/OpenSC/issues/1992#issuecomment-630856601

[ad-m]

Full content: https://files.jawne.info.pl/private_html/2020_07_oj1ba8zai5As2louwiqu8weu7uebaequiemei1eeNahhaiYei0

In free translation PWPW states that:

1. the content of all end-user license agreements, the content of all licenses of all modules (libraries) used to create the application are distributed as part of the application available at: https://www.gov.gl/web/e-dowod#PIiki-do-pobrania. At the same time, they enclosed a copy of the license conditions to which mine applies proposal.

2. PWPW has verified the license provisions of the modules (libraries) used in the scope
   compliance with the way the application is distributed and used in the "e-dowod" project.

3. In response to mine request for the source code of the application, PWPW informs that the requested information does not constitute public information.

For people unfamiliar with the Polish specificity of the right to information, in Poland the basic element of the dispute over the right to information is usually whether the information is "public information" (whether it relates to "public matters", i.e. government action), not whether the disclosure of information violates the secrets or rights of other people. In Poland, statutory provisions provide for the disclosure of information that is "public information". Disputes about whether something is a "public matter" are arbitrary, because it is a broad term, but courts often try to understand it extremely narrowly. On several occasions, the courts excluded the source codes of government systems from the term "public information".

The stamps are still with us:

[Devligue]

So basically they skipped through the part of your request in which you said that they violate the license and therefore should make the source code public. Instead, they focused on what a public information is and why source code by itself is not a public information, even when used by public institutions.

In conclusion, what they wrote is completely unrelated and they are just trying to blow you off with some meaningless lawyer-talk waterfall.

[ernestask]

I also notified Lithuanian Ministry of the Interior regarding the software made available for download by them (but implemented by PWPW) that also includes OpenSC, but not in a license-compatible way. As they distribute it (via https://www.nsc.vrm.lt/downloads.htm) they must also make available the source code (they do attribute, but the distributed work is not LGPL-compliant linking, thus the distributed work is derivative work where combined source code must be made available).

Has there been any response from them? Do you need help in applying pressure from multiple ends?

[quetzalcoatl]

FYI: regarding general-purpose defense-line that "source code of a government utility system is not a public information", there's some interesting movement in a totally different place - https://www.hfhr.pl/helsinska-fundacja-praw-czlowieka-przystapila-do-postepowania-w-sprawie-dostepu-do-kodu-zrodlowego-system-losowego-przydzialu-spraw/

Unfortunatelly, text is in PL-only, I've not found an EN version. In short:

• Stowarzyszenie Sieć Obywatelska Watchdog Polska requested the gov to reveal the source code for a utility system that randomizes assignments of judges to lawsuits ("Systemu Losowego Przydziału Spraw" ~= Case Randomized Assignment System)
• the ministry responded that "the source code does not constitute a public information, so the request cannot be fulfilled" (you've seen that one, right?)
• first lawsuits and later appeals have supported that statement, code was not revealed
• Helsinki Foundation for Human Rights analyzed the case and supported the point of view that this is an important system having an impact on human life, and such code and algorithms should be a public information that can be freely reviewed

Interesting piece from that article:

Zdaniem Fundacji przedstawiona przez Wojewódzki Sąd Administracyjny teza, jakoby informacje na temat kodu źródłowego programów wykorzystywanych przez administrację stanowiły jedynie „narzędzia techniczne” jest błędna, gdyż pomija realny wpływ tego rodzaju oprogramowania na sprawowanie władzy publicznej. Ponadto ugruntowanie się takiej wykładni jest też niebezpieczne, bo pozbawiłoby obywateli dostępu do informacji na temat konstrukcji innych programów wykorzystywanych przez organy władzy, w tym sądy. Niewykluczone, że w przyszłości narzędzia komputerowe będą jeszcze szerzej wykorzystywane bezpośrednio przy podejmowaniu decyzji o wolnościach i prawach jednostki.

in loose translation:

The Foundation considers the statement of the Provincial Administrative Court, that, supposedly, the information regarding the source code of software used by the administration consitutes only a „technical means”, to be false, because it ignores the real influence of this such software on the exercise of public authority. Furthermore, establishing such an interpretation of the law is dangerous, because it deprives the citizens of their right to access information regarding the structure of software used by other authorities, also the courts. It is possible that in the future, software tools will be more widely directly used in deciding on the freedoms and rights of the individual.

[ad-m]

As I worte at 4 April 2020 I send to the Minister of Digital Affairs (Ministerstwo Cyfryzacji), the Minister of the Interior and Administration (Ministerstwo Spraw Wewnętrznych i Administracji) and PWPW S.A. official FOI requests as party involved in government project of ID card. See details in following comment: https://github.com/OpenSC/OpenSC/issues/1992#issuecomment-609030367

On August 24, 2020, I received a letter from the Ministry of the Interior and Administration, which forward my request to a separate legal entity - the Document Personalization Center of the Ministry of Interior and Administration. It is not an internal organizational unit, but a separate legal entity supervised by the minister.

It should be mentioned that forwarding FOI request is not permitted by law in Poland, as each legal entity is responsible on its own with regard to the information it has on its own. If I would like to check what information Document Personalization Center of the Ministry of Interior and Administration has, I can apply to this entity in a separate request. Each office that holds a document is competent to make it available upon request. Obviously, the response time is also far too long and against the law.

After the additional 12 days, I did not receive any additional documents. So I decided to sue them in order to obtain the requested information, it mean data related to the "e-dowod" application, including the "e-dowod Menedżer", "e-dowod Monitor", "Podaj CAN" and "e-dowod Pomoc" applications in the scope of:

• full copies of the content of all license agreements (hereinafter: licenses) of the above-mentioned applications that apply to the end user
• full copies of the content of all licenses of all modules (libraries) used to create the application,
• information whether Ministry intend or Ministry have verified the license provisions of the modules (libraries) used in terms of compliance with the distribution and use of the application in the "e-proof" project,
• a copy of the source code content application, along with all modules (libraries).

Content of the court complaint:

Loose translation:

On my own behalf, I am bringing a complaint against the inaction of the Minister of the Interior and Administration in the matter of failure to provide information on time, through violation of Art. 61 sec. 1 and 2 of the Constitution of the Republic of Poland by failure to provide information in accordance with the request within the specified time limit.
At the same time, I am requesting:

1. obligation of the other party to take steps to provide information in accordance with my request of April 4, 2020,
2. awarding the costs of proceedings in accordance with prescribed standards.

[mgorny]

While I wholly support the idea of releasing e-Dowod source code, I would like to point out that LGPL does not require releasing source code. It only requires that they release it in a form allowing users to easily split proprietary code from OpenSC, and replace OpenSC with another version.

If you statically link against an LGPLed library, you must also provide your application in an object (not necessarily source) format, so that a user has the opportunity to modify the library and relink the application.
https://www.gnu.org/licenses/gpl-faq.en.html#LGPLStaticVsDynamic

[quetzalcoatl]

FYI: earlier article about watchdog-polska and randomizing system: https://siecobywatelska.pl/tajemniczy-algorytm-losowania-sedziow/

[quetzalcoatl]

@ad-m I didn't notice earlier that you're affiliated with Citizens Network Watchdog Poland. I only noticed it through code commits on GitHub repository of https://porady.siecobywatelska.pl/ . Excuse me the noise generated, I was not aware that the Watchdog is already involved.

[ad-m]

Yes, I am a member of Citizens Network Watchdog Poland (SOWP). It's always nice to hear someone noticing our work and informing others about it. :smile_cat:

I am acting privately in this issue so far, but using the knowledge gained through working with SOWP. If I need help - I know that I can count on the support of SOWP.

Additionally, I notice that at the beginning of the thread I wrote:

@Jadeszek , Unfortunately, several court cases show that the courts do not recognize the source code as content by the procedure written in natural language and do not consider it subject to the provisions on access to information (FOI law). Due to the specific legal structure of company and reference to business secrets, this can be additionally difficult and generate a long-term court dispute. Citizens Network Watchdog Poland may provide legal expert in this area.

In addition, administrative courts in Poland do not have the right to appoint an expert, so judges must assess documents and assess them on their simple (in terms of technical knowledge) mind. Lack of technical knowledge among judges is conducive to building secrets so as not to order too much to be revealed due to lack of own knowledge.

I think that it is worth considering - due to the less popular - use the provisions on the re-use of information from the public sector. ePaństwo Foundation ( http://epf.org.pl/ ) may have experience in this area.