2023-08-18
Contributor License Agreements (CLAs) impede modest contributions
Over on the Fediverse, I said something:
As a university employee, can I sign an individual CLA to contribute a bugfix I made while at work, for something we use at work? I don't know, but I'm also pretty certain that I can't get the university's lawyers and senior management to come near your organizational CLA, and neither my management nor the university's lawyers probably want to even look into the individual CLA issue.
So basically a CLA means I'm not sending in our bug fixes. Not because I'm nasty, but because I can't.
I have some views on CLAs in general, but those only really apply to work I might do on my own. If I'm doing things as part of work, the university can decide whether or not to keep it private or send it upstream and by default not carrying private changes is easier and better (even if this feeds someone's monetization in the end).
However, as far as I know (and I did look), my university has no blanket policy on employees signing individual CLAs to contribute work they did on university time. Obtaining permission from the university would likely take multiple people each spending some time on this. Many of them are busy people, and beyond that you might as well think of this as a meeting where all of us are sitting around a table for perhaps half an hour, and we all know how much meetings cost once you multiply the cost of each person's time out. Universities may feel that staff time is often almost free, but that isn't universal and there are limits.
Things get much worse if the university would have to sign some sort of group or institutional CLA. Officially signing agreements on the behalf of (parts of) the university is a serious matter, as it should be. There is no such thing as a trivial legal agreement for an institution, especially an institution that's engaged in intellectual property licensing (possibly with one of the very companies that it previously executed an institutional CLA with).
The university and its sub-parts could probably overcome all of this if we were doing something large and significant; if someone's research group was collaborating, or a PhD student was doing a major chunk of work, or the like (and research work is somewhat different than work done by staff). But for a modest or trivial change? Forget it.
This doesn't make me happy. If I have a simple bugfix and I can make a trivial change and contribute it as a pull request, that's a win over filing a bug report and forcing other people to duplicate work I may already have done privately. But that's life in the land of CLAs. When you require CLAs, you're creating barriers to contributions.
(The same is true of a requirement for copyright assignment, although probably less obviously.)