software licensing signature
Why do Contributor License Agreements need to be signed explicitly?
<p>It seems like most Customer License Agreements need to be explicitly signed by the contributor. This is a bit of an inconvenience, as contributors need to retrieve the CLA document, have access to some digital signing service or even print it out, and then attach it to their contribution.</p>
<p>I read that signing a contract is often <a href="https://law.stackexchange.com/a/18818">necessary to enforce it against the signing party</a>. Isn't a CLA generally only granting rights to the maintainer? What would the maintainer need to enforce against the contributor?</p>
<p>Would it be sufficient for the maintainer to simply write &quot;By submitting your patches to us in such and such a way, you are releasing them to us under the terms of our CLA&quot;? How would e.g. the <a href="http://www.harmonyagreements.org/docs/ha-combined-v1.html" rel="nofollow noreferrer">Harmony</a> CLA need to be modified to allow for that?</p>

<h2>The signature requirement is reasonable and need not be onerous</h2>
<h3>Signature requirement</h3>
<p>Various licenses, including copyright transfers and assignments, are required by the local version of the Statute of Frauds in most jurisdictions to be in writing.</p>
<p>Under 17 USC 204(a)](<a href="https://www.copyright.gov/title17/92chap2.html#204" rel="nofollow noreferrer">https://www.copyright.gov/title17/92chap2.html#204</a>)</p>
<blockquote>
<p>(a) A transfer of copyright ownership, other than by operation of law, is not valid unless an instrument of conveyance, or a note or memorandum of the transfer, is in writing and signed by the owner of the rights conveyed or such owner’s duly authorized agent.</p>
</blockquote>
<p>I believe there are similar requirements for patent rights.</p>
<p>Thus the maintainers reasonably require a signature.</p>
<p>A maintainer might need to establish the validity of the rights and licenses transferred from the contributor, whether against a claim of infringement by the contributor or another, or against a claim that the maintainer is not authorized to b ring a copyright suit for infringement of its rights from some third party. A signed transfer would substantially assist a maintainer in any such legal situation.</p>
<h3>No &quot;Signature Service&quot; is needed</h3>
<h4>US Federal Esign Act</h4>
<p>According to the US Federal Esign Act (found in 15 USC Chapter 96](<a href="https://www.law.cornell.edu/uscode/text/15/chapter-96" rel="nofollow noreferrer">https://www.law.cornell.edu/uscode/text/15/chapter-96</a>)) no &quot;digital signing service&quot; is required for a fully valid electronic signature.</p>
<p><a href="https://www.law.cornell.edu/uscode/text/15/7001" rel="nofollow noreferrer">15 USC 7001 (a)</a> provides that:</p>
<blockquote>
<p>(1) a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form; and<br />
(2) a contract relating to such transaction may not be denied legal effect, validity, or enforceability solely because an electronic signature or electronic record was used in its formation.</p>
</blockquote>
<p>and <a href="https://www.law.cornell.edu/uscode/text/15/7006" rel="nofollow noreferrer">15 USC 7006 (5)</a> provides:</p>
<blockquote>
<p>(5) <strong>Electronic signature</strong></p>
</blockquote>
<blockquote>
<p>The term “electronic signature” means an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.</p>
</blockquote>
<p>Under section <a href="https://www.law.cornell.edu/uscode/text/15/7002" rel="nofollow noreferrer">15 USC 7002</a> (subsection (a)(2)(A)(ii)) alternative procedures for electronic signatures are valid <strong>only</strong> if:</p>
<blockquote>
<p>such alternative procedures or requirements do not require, or accord greater legal status or effect to, the implementation or application of a specific technology or technical specification for performing the functions of creating, storing, generating, receiving, communicating, or authenticating electronic records or electronic signatures;</p>
</blockquote>
<p>In short an &quot;electronic signature&quot; may consist of nothing more than a text version of the signer's name, with no special cryptographic or other technical measures applied, provided that the signed included the name with intent to indicate the signer's acceptance of the document.</p>
<h4>US Uniform Electronic Transactions Act</h4>
<p>The <a href="https://en.wikipedia.org/wiki/Uniform_Electronic_Transactions_Act" rel="nofollow noreferrer">Uniform Electronic Transactions Act</a> adopted by almost all US states, has simialr provisions. In the <a href="https://www.uniformlaws.org/HigherLogic/System/DownloadDocumentFile.ashx?DocumentFileKey=21c366b3-b11c-d774-f34d-7901ab76e9a5&amp;forceDialog=0" rel="nofollow noreferrer">text of the act</a></p>
<p>section 2 paragraph (8) reads:</p>
<blockquote>
<p>“Electronic signature” means an electronic sound, symbol, or process attached
to or logically associated with a record and executed or adopted by a person with the intent to sign the record</p>
</blockquote>
<p>The official comment on theis part of section 2 reads:</p>
<blockquote>
<p>“<strong>Electronic signature</strong>.” The idea of a signature is broad and not specifically defined. Whether any particular record is “signed” is a question of fact. Proof of that fact must be made under other applicable law. This Act simply assures that the signature may be accomplished through electronic means. <strong>No specific technology need be used in order to create a valid signature.</strong> One’s voice on an answering machine may suffice if the requisite intention is present.
Similarly, including one’s name as part of an electronic mail communication also may suffice, as may the firm name on a facsimile. It also may be shown that the requisite intent was not present and accordingly the symbol, sound or process did not amount to a signature. One may use a digital signature with the requisite intention, or one may use the private key solely as an accessdevice with no intention to sign, or otherwise accomplish a legally binding act. In any case the critical element is the intention to execute or adopt the sound or symbol or process for the purpose of signing the related record.</p>
<p>The definition requires that the signer execute or adopt the sound, symbol, or process with the intent to sign the record.</p>
</blockquote>
<p>Section 7(a) of the UETA provides:</p>
<blockquote>
<p>A record or signature may not be denied legal effect or enforceability solely
because it is in electronic form</p>
</blockquote>
<p>The official comment on section 7 reads, in pertinent part:</p>
<blockquote>
<ol>
<li>This section sets forth the fundamental premise of this Act: namely, that the medium
in which a record, signature, or contract is created, presented or retained does not affect it’s legal significance. Subsections (a) and (b) are designed to eliminate the single element of medium as a reason to deny effect or enforceability to a record, signature, or contract. The fact that the
information is set forth in an electronic, as opposed to paper, record is irrelevant</li>
</ol>
</blockquote>
<p>Section 9 of the UTEA reads:</p>
<blockquote>
<p>(a) An electronic record or electronic signature is attributable to a person if it was the act of the person. The act of the person may be shown in any manner, including a showing of the efficacy of any security procedure applied to determine the person to which the electronic record or electronic signature was attributable.<br />
(b) The effect of an electronic record or electronic signature attributed to a person
under subsection (a) is determined from the context and surrounding circumstances at the time of its creation, execution, or adoption, including the parties’ agreement, if any, and otherwise as provided by law</p>
</blockquote>
<p>The official comment on section 9 reads, in pertinent part:</p>
<blockquote>
<ol>
<li>Under subsection (a), so long as the electronic record or electronic signature resulted from a person’s action it will be attributed to that person – the legal effect of that attribution is addressed in subsection (b). This section does not alter existing rules of law regarding
attribution. The section assures that such rules will be applied in the electronic environment. A person’s actions include actions taken by human agents of the person, as well as actions taken by an electronic agent, i.e., the tool, of the person. Although the rule may appear to state the
obvious, it assures that the record or signature is not ascribed to a machine, as opposed to the person operating or programming the machine.</li>
</ol>
<p>In each of the following cases, both the electronic record and electronic signature would be attributable to a person under subsection (a):</p>
<ul>
<li>A. The person types his/her name as part of an e-mail purchase order;</li>
<li>B. The person’s employee, pursuant to authority, types the person’s name as part of an email purchase order;</li>
<li>C. The person’s computer, programmed to order goods upon receipt of inventory
information within particular parameters, issues a purchase order which includes the person’s name, or other identifying information, as part of the order.</li>
</ul>
<p>In each of the above cases, law other than this Act would ascribe both the signature and the action to the person if done in a paper medium. Subsection (a) expressly provides that the same result will occur when an electronic medium is used.</p>
</blockquote>
<h4>Effect of US Laws on E-signatures</h4>
<p>Thus under both US Federal and State law, an electronic signature need not use any particular technology, and may be simply a text name or symbol. Or a person could print out an agreement, sign it by pen, stamp, or pencil, and scan the signed document to produce an electronically signed document. A person could also generate a PGP signature of the licensee, using a previously (or subsequently) published key pair, and include the PGP signature with the electronic copy of he license.   Or there are other freely available cryptographic signature protocols available. B ut use of such a cryptographic solution is not required, a simple typed name will do.</p>
<p>Indeed merely having the contributor type his or her name into a web form would be sufficient in most jurisdictions.</p>
<p>I believe that the law of electronic signatures is similar in many other countries.</p>
<h3>Alterations to the harmony Agreement</h3>
<blockquote>
<p>Would it be sufficient for the maintainer to simply write &quot;By submitting your patches to us in such and such a way, you are releasing them to us under the terms of our CLA&quot;?</p>
</blockquote>
<p>Such &quot;click-through&quot; agreements are often held not binding, unless the other party has been clearly informed of the details, and has then engaged in an affirmative act of acceptance. Any such altered agreement would need to include some such affirmative act of accepting the agreement, different from merely submitting the contribution. What might be required could be different in different jurisdictions. Such a change might actually make the ways in which a contributor could submit a valid contribution more limited.</p>
