It is a conundrum. If I were to hack into Microsoft and obtain the source to Windows 8, release it on github under the GPL - it seems highly unlikely that would be honored. Although if even one single person downloaded it under GPL then technically they should be able to distribute their own version under GPL.

It seems like if the code is considered "stolen" there must be some legal common sense. I would also imagine the longer the code stays as open source, the less likely you'd be able to claim theft. If you immediately took it down claiming copyright that would be one thing. If you knowingly left it up for a year, though, that would certainly be a different situation.

"It is a conundrum. If I were to hack into Microsoft and obtain the source to Windows 8, release it on github under the GPL - it seems highly unlikely that would be honored. Although if even one single person downloaded it under GPL then technically they should be able to distribute their own version under GPL."

While I think there is a lot of legal subtlety at play in the nv3d case, I think your case is a lot more clear cut. You never had the legal authority to make the Windows 8 source code GPL in the first place, so the code isn't GPL, no matter what the README you attached to it says and people continuing to distribute it would be in clear violation of copyright.

Your Windows 8 example is pretty clear cut, sort of like if I steal your car and resell it to someone else. Just because they bought the car doesn't mean they own it, it still belongs to the original owner though the person who bought it clearly has a legal case for restitution against the person who sold it to them without owning it.

Yeah, it probably wouldn't be honored unless the company did something to indicate they sanctioned your actions. Your second scenario, in which the company leaves it up for a year, may go a little ways towards creating apparent authority. However, if you had no prior connection to Microsoft, the court would probably say a reasonable person would not believe you had the authority. Even if you were a Microsoft employee, because it's Windows 8 in particular, the bar would be pretty high for showing that a reasonable person would actually trust the authenticity of this open source license.

"... If you knowingly left it up for a year, though, that would certainly be a different situation."

It would be different but it would still be utterly unlike what jarrett describes.

I'm not sure what your legal background is, but

1. Estoppel is only going to get you a very limited set of rights. It's highly unlikely a judge is going to find you have the same rights as the open source license, unless you were actually relying on all of those rights. You certainly would not be able to sublicense those rights further, except to those you had already. This is not the same as Novus's ability to "stop licensing the software to new parties", it means you would not be able to give others the rights you had gotten through estoppel.

In effect, estoppel mainly going to protect you from damages, not give you the right to use it as open source.

2. It certainly depends, but the apparent authority question is a lot closer than you make it out to be. There are plenty of cases in the US where "the nature of the transaction" should have caused one to question whether the employee had authority, etc. Not just that, but in New York state, where Novus Partners is, the law is nowhere near like you make it out to be. AFAIK, under New York State law, the apparent authority doctrine will hold a principal responsible for its agent’s actions as long as the principal clothed the agent with apparent authority. Novus Partners would have had to have done something explicit to make you believe this person had authority to open source.

See Hallock v. State, 64 N.Y.2d 224, 231 (1984).

  “Essential to the creation of apparent authority are words
  or conduct of the principal, communicated to a third party,   
  that give rise to the appearance and belief 
  that the agent possesses authority to enter into a  
  transaction,”

  An agent can never “by his own acts imbue himself with
  apparent authority,” Id.

  “[T]he existence of ‘apparent authority’ depends upon a   
  factual showing that the third party relied upon the
  misrepresentation of the agent because of
  some misleading conduct on the part of the principal — not 
  the agent,” Id.

  “Moreover, a third party with whom the agent deals may rely 
  on an appearance of authority only to the extent that such   
  reliance is reasonable,” Id.

The only communication I see from Novus Partners here is something saying "sorry, he had no authority". If there is something else, great, you may be right. If there isn't, i wouldn't say it's "highly questionable" whether they could do what they did.

Source: I'm a registered patent attorney and corporate IP lawyer who has been doing open source lawyering for many many years now.

Very good points, and well researched.

"It's highly unlikely a judge is going to find you have the same rights as the open source license, unless you were actually relying on all of those rights. You certainly would not be able to sublicense those rights further, except to those you had already. This is not the same as Novus's ability to "stop licensing the software to new parties", it means you would not be able to give others the rights you had gotten through estoppel."--I agree 100%. My apologies to other readers if I implied the opposite. I do still think that estoppel would protect licensees themselves insofar as they had relied on the software in, e.g., the development of their businesses.

Your point about sub licensing is well taken and deserves further exploration. It would appear that, estoppel or not, those who are now rereleasing the software may be on shaky legal ground. As you said, estoppel would probably not give you the right to sublicense, which is effectively what these folks are doing.

"Essential to the creation of apparent authority are words or conduct of the principal, communicated to a third party, that give rise to the appearance and belief that the agent possesses authority to enter into a transaction"--Agreed. I was under the impression this had transpired in the present case. I'm not sure about New York, but in many jurisdictions a principal's failure to act (given some other criteria) can be enough. I was thinking that would come into play here. Naturally it would depend on the exact facts, of which I am uncertain.

I would also raise the question of jurisdiction. Novus may be in New York, but what of licensees in other states? They could potentially make the argument that their states' laws apply, because part of the "transaction," i.e. the downloading and licensing of the software, occurred there. Would this argument succeed? I dunno.

  and people come to rely on that free licensing

  there was no reason to believe that the open source
  licensing was anything but company-sanctioned

What both these things seem to rely on, is the amount of time that has passed since the original open sourcing. It seems highly unlikely that they only discovered the open sourcing just now. If they had undertaken this action immediately after discovering the open sourcing, there would be no doubt that it wasn't company sanctioned and no-one would have come to rely on it.

I wouldn't find it terribly unlikely that non-technical managerial-level people within the company were unaware that certain code had been open sourced. I know that unless I make an effort to let other departments know about it, that no one at my company would have any idea we created, or even used, open-source code.

That's a very difficult question of fact, and one which I think could easily be a central if this went to trial.