Licensing Working Group/Minutes/2023-09-11

OpenStreetMap Foundation, Licensing Working Group (LWG) - Agenda & Minutes
11 September 2023, 17:00 UTC

Participants

Kathleen Lu (Chairing)
Dermot McNally
Simon Hughes
Tom Lee
Tom Hummel
Guillaume Rischard (OSMF board)

Absent

Jim Vidano

Adoption of Minutes of previous meetings

2023-08-14 Approved
2023-07-10 Approved

Previous action items

Reportage and action item updates

Any updates on reported attribution cases?

Reports in OTRS:

Ticket#2021081210000057 printed maps with false copyright
Ticket#2022011910000082 interparcel.com: Dermot Emailed them on 10th Nov, no reply
Ticket#2022012610000149 https://poster.printmijnstad.nl/editor/city
Ticket#2022033010000217
- complaint that Aberdeen city council may not be attributing correctly – https://www.aberdeencity.gov.uk/news/consultation-starts-street-improvements-ashgrove-road
- Note that Aberdeen credits Ordnance Survey, so possible OS is using OSM as one of many sources and the full attribution is not getting carried through
Ticket#2022032710000125 - https://www.evri.com/find-a-parcelshop
- Hermes UK changed name to evri. So this is an old issue.
Ticket#2022062610000078 -
- Härryda, Sweden, uses Open Street Map for an app they developed. Inside the app there are no license references to OSM.
- You can see the app on the Google Apps store here: https://play.google.com/store/apps/details?id=se.harryda.medborgar.app&gl=US
Ticket#2021120810000146 mondialrelay.fr not attributing correctly
Ticket#2022120510000177 — Club Vosgien complaint – any reply?

Trademarks – any updates?

Trademark renewal

Invoice has been paid and Lawdit is working on this.

Guillaume - HOT trademark agreement update

Simon - Any new notices

Holdover items

Where to forward user deletion requests?

Kathleen has created text for a template: `LWG - User deletion requests` – need one of the admins to add this to the queues

Template response to missing attribution reports

Background

Draft. For review and agreement:

Hi <name>,

Thanks for getting in touch regarding a failure to correctly attribute OpenStreetMap. Attribution is part of OpenStreetMap’s covenant with its contributors and an important tool tool for growing the project’s adoption and success.

As you can imagine, with LWG being an all-volunteer group, we lack the capacity to deal with all cases. In most instances, the users have made an honest mistake, and we think that it's easiest for mappers themselves to make the first contact and provide helpful information, especially as mappers have more local knowledge of the use. Many do this very successfully. As a mapper and contributor to OSMF, you can help educate users of OpenStreetMap data on our license and attribution obligations.

In order to make it easier for you to deal with such cases, we have prepared template content for emails to those who may be neglecting their obligations. These are designed to allow you to pick and choose considered blocks of text that respectfully and accurately express what needs to be improved. You can find this content at: https://wiki.osmfoundation.org/wiki/Licence/Attribution_Reminder_Templates

In limited high-stake cases, LWG can become more directly involved. Please let us know if there are special circumstances.

Thanks!
LWG

Dermot to update:
Add love letter to https://wiki.osmfoundation.org/wiki/Licence/Waiver_and_Permission_Templates or other page on OSMF wiki
https://wiki.openstreetmap.org/wiki/Lacking_proper_attribution
And replace https://wiki.openstreetmap.org/wiki/Lacking_proper_attribution/Example_email

Dermot went through the text of the template on the July agenda, accepted changes to the template, and then the text was copied over to the September agenda.

Action items:

Kathleen to add the "template response to missing attribution reports" to the OTRS queue.
Kathleen to email OWG and ask them to add the following two templates to the OTRS group queues (LWG, DWG, MWG, etc): 1) template response to missing attribution reports 2) user deletion request template.

On use of OSMF tiles, which are intended to be used by the community ("community tiles") There is an operations policy about use of OSMF tiles.

Suggestion: The LWG could provide to the community a version of a text that cautions people to be aware of the OSMF tile usage policy and that tiles are for community use, not for commercial use. If their use exceeds the policy, they can use a commercial provider.

Community members may not be able to determine if a website/app has been using the OSMF tiles, especially whether the use is heavy or not.
If the community sends emails regarding the tile usage policy to people using OSMF tiles, it will dilute our message.
It may lead to people using OSM tiles getting multiple emails by community members regarding the OSMF tile usage policy.
OPS know when the tile servers are heavily used.
We should focus on attribution.

On the initial proposed process for cases of missing attribution

The LWG would confirm that the attribution was missing and give directions to the OWG.
Process is cumbersome, requiring much communications.
Clear only when attribution is completely missing.

On who would define whether attribution is adequate

If the OWG don't want to pronounce adequate attribution, they can pass it to LWG.
Probably not all LWG members are needed to make a decision.

On way forward

Guillaume has asked OWG to create a new public GitHub tracker for reporting obvious cases of missing attribution, where people are using OSMF tiles.
Guillaume to create a form with a checklist that community members can use, before reporting a case on the new tracker.
Form could include fields for the community member confirming: 1) that there's no attribution 2) that they contacted the other party 3) providing the email they sent to the other party 4) adequate time for a response (e.g. 1 week) has passed 5) ask for the email address of the party that uses OSMF tiles (if one was found).
The two websites that have been recently forwarded to the LWG (https://www.oelschneider.de/saarbruecken-rodenhof.html and https://radar-opadow.pl/) are candidates for using the new process.

Other points mentioned

Lack of attribution to OSM is a valid reason to shut off access to OSMF tiles.
OTRS: Templates have to be individually added to each team's OTRS queue, to be available for selection.

Suggestions

add the template to the board's queue
- Guillaume to point the template to Mateusz Konieczny.
remove the section about the OSMF tile usage policy from the template letter regarding attribution, but keep it for cases when we decide to notify someone about blocking use of OSMF tiles.
- we might not need to notify offenders of missing attribution after blocking tile usage.

From Microsoft re Mapbuilder (see email below)

Background

I would like to discuss a legal topic related to the Single Sign-On project being driven by the Microsoft Map Builder team. This project aims to improve the user experience during the OSM signup process. You can find the specification and all details about the Single Sign-On project here: https://github.com/openstreetmap/openstreetmap-website/issues/4128.

During our discussion, Tom Hughes raised the question of obtaining approval from LWG to move the contributor terms to a link. I have attached a mock-up of how this might look. The Contributor Terms link would lead to wiki.osmfoundation.org/wiki/Licence/Contributor_Terms, where the terms are available in different translations and variants.

Microsoft wrote back and sent a screenshot of the mock-up for the new page.

Normal sign-up for an OSM account on www.osm.org

You get sent to https://www.openstreetmap.org/welcom which mentions to not copy from other maps.
Suggestion to change "our terms" to "OSM terms" (Guillaume can open a pull-request).

Brief discussion about which OSM/F page is best to link to, during the creation of the OSM accounts by MapBuilder users.

Suggestions

Add that "By signing up, you agree to our terms of use and the OpenStreetMap (https://www.openstreetmap.org/about) Foundation’s Contributor Terms (https://wiki.osmfoundation.org/wiki/Licence/Contributor_Terms)."
Add: "OpenStreetMap is a place for mapping things that are both real and current - it includes millions of buildings, roads, and other details about places. You can map whatever real-world features are interesting to you. What it doesn't include is opinionated data like ratings, historical or hypothetical features, and data from copyrighted sources. Unless you have special permission, don't copy from online or paper maps." (DWG issue - Guillaume to raise).

On "don't copy from other maps"

It's not legally necessary to tell people not copy from other maps.
Currently, MapBuilder users copy from satellite imagery, not from maps.
- They might get access to a full editor.

On theming the login window (putting a brand specific theme from the third party SSO onto the login page)

There was a suggestion to theme the login to OSM, according to who you choose to be your single sign on provider.
They are going to get an icon, instead of a full width button, as was proposed on the screenshot of the mock-up which they sent.
How they start their login screen is up to them.
Probably not an LWG issue.

Action item: Kathleen to request tweak: By signing up, you agree to our terms of use and the OpenStreetMap Foundation’s Contributor Terms.

From OWG - allegedly Russian email

Background

Email from OWG to LWG: Some part of the Russian government got complaints about the vandalism appearing on a bus tracking website, and their investigations lead them to us because the site was using OSM maps. They want the information on the users behind the vandalism that we have.

For this specific request, I have no problems telling them we don't have information on the users since the changes were made with throw-away email accounts and edits were from proxies. We've disclosed that publicly before. I also have no problem giving them our name and registered address, on the page https://blog.openstreetmap.org/about/, and the legal@osmfoundation.org contact address.

If they ask for what details we do have or insist on following up even though we don't have useful information, my understanding is they would need a court order domesticated to the UK to require us to provide that information. I am not certain what circumstances we could voluntarily disclose user information under our terms and privacy policy, and would leave that to a lawyer.

Some further details are that the site sometimes uses Standard Tile Layer tiles such as on https://ru.busti.me/ekaterinburg/jam/, some pages like that one have no attribution, and we have no presence in Russia.

Tom: Recommendation: tacitly discard. Likely a scam to gather internal OSMF information. There are no insignia whatsoever. The sender is a commercial mail service, free to use for anybody. No Russian gov’t agency is known to handles its communication through this service. Presumably Sachalinskaja does not have a ministry of the interior of its own by that designation. The MWD is a centralized entity. It’s quite unlikely, anybody from a lower law enforcement is allowed to contact entities abroad on his own. Russia is not a federal state in the sense the EU or USA is.

Action item: Kathleen Lu to reply "Feel free to disregard."

Post-meeting note: the email that OWG received was a scam email.

From OWG - email related to sunnypilot and dragonpilot

Background

on a recent ops call we discussed sunnypilot and dragonpilot, two forks of openpilot, software for driver assist on several vehicles.

Both forks will, by default, record GPS traces and upload them to OpenStreetMap. These traces are high resolution, in some cases having 10 samples/second, and contain the vehicle make, model, and year. An example is https://www.openstreetmap.org/user/sunnypilot/traces/9852183. The position and time information should generally be very accurate, as they are coming from specialized hardware designed for controlling cars. These are automatically recorded every time the car is turned on, so many traces are very short and involve no movement.

The OWG has concerns about the data volume which we are discussing, but there is a potential privacy issue. It is our understanding that both pieces of software have a setting for if they upload traces to OpenStreetMap, and the default setting is on. The traces are uploaded to an account that the user does not own, and there is no signing of the contributor terms. There is no way for the user to delete a GPS trace or their account.

sunnypilot's user data section is https://github.com/sunnyhaibin/sunnypilot#-user-data and dragonpilot's is https://github.com/dragonpilot-community/dragonpilot#user-data-and-comma-account. Both are focused on the comma.ai data collection, but make no mention of use by OpenStreetMap.

I am concerned that users of this software are automatically opted in to supplying us with data without meaningful consent, or the ability to exercise their rights to delete data.

If the LWG has concerns with these uploads, we should coordinate our communications. The sysadmins have the technical ability to stop the uploads if necessary.

There seem to be experimental open source software that one can install on their vehicle to gather information for purposes of training self driving vehicles.
The providers of the software have decided to give a copy of all of the gathered GPS traces to OSM.

Entities

Each entity uses a single account to upload all the traces of all of their users.
They use comma.ai

Concerns by OWG

Privacy issues, which would might result to deletion requests.
Data volume (OPS issue).

Private information provided with the traces

The car model, which is useless information to us.
Where people have driven to (considered private data in the US)
Timestamps.

Suggestions to ask the two entities

Data anonymisation: remove all information from the GPS traces, except the trace.
Data modification: 1) change lines of GPS traces into points and 2) each user should be associated with an identifier for their account, for deletion requests.
- The identifier would make their data less private, but they will have consented to sharing the data.
Data hosting: host the anonymised data and make it available to the OSM community.
- They probably won't host it.
- Mappers probably won't know about the data hosted by the two companies.
- Ideal place would be in our own GPX dataset.
Opt-in mechanism: Require their users to opt-in to the OSM terms when they select to upload traces, so that they consent and are aware.
Require their users to use individual OSM accounts.

On the data provided

Their data is useful.
If we consider the data not useful, the OWG could block them.
This type of data is used by companies, but with additional privacy processing and with tight custody.
- The compliance environment is hostile.
We are quite far away from being in a safe place for OSM to gather this data.

Suggestion

Ask OWG about the issue of data volume and if asking the entities to host the data instead would be a solution.
- OWG can deal with the issue.

Other point mentioned

Commodot AI - setting up a self driving car that was hacked together and taking a reporter for a live drive in traffic within two weeks of beginning development.

Decision: Ask OWG about the volume issue and whether the company hosting the data would help that issue.

Any Other Business

Any update by Tom Hummel on moving OSMF to EU country (Belgium?)

Tom had one meeting with lawyers (2 British lawyers, 1 from Belgium) and Sarah Hoffmann (board) last week.

They haven't looked through the document that Sarah provided.
Tom tried to direct them towards the contributor terms and they said they would look into it.
The lawyer from the Belgian firm might not have gotten the focus on the project until now.

Points mentioned during discussion

OSM is not the usual thing they deal with and it takes time.
No need to change lawyers at the moment.
Optimistic towards the British lawyers, once they read through our documents.

Queries to legal-questions

Ticket#2023032410000272 – Asesoría

Background by LWG

Buenas tardes. Solicito su apoyo amablemente para asesoría en contribución de información a la plataforma de OSM. La cual contempla información de tipo vectorial: líneas (nomenclatura de calles oficiales del municipio de Temoaya, Estado de México, México) y polígonos (límite de localidades oficiales del municipio de Temoaya, Estado de México, México, así como el límite oficial del municipio de Temoaya, Estado de México, México). Lo anterior conservando las etiquetas correspondientes a: - nombre de calle (línea), - nombre de localidad (polígono) - superficie (polígono) y, - notas adicionales (en polígonos). Gracias. agradecería bastante su apoyo.

Saludos.
Benito Romualdo Palma Temoaya, Temoaya, C.P. 50850, Estado de México, México.

Google translation by LWG:
Good afternoon. I kindly request your support for contribution advice of information to the OSM platform. which includes information on vector type: lines (nomenclature of official streets of the municipality of Temoaya, State of Mexico, Mexico) and polygons (limit of localities officials of the municipality of Temoaya, State of Mexico, Mexico, as well as the official limit of the municipality of Temoaya, State of Mexico, Mexico).
The above keeping the labels corresponding to: - street name (line),
- locality name (polygon)
- surface (polygon) and,
- additional notes (in polygons).

Thank you. I would greatly appreciate your support. Greetings.

Previous LWG discussions: 2023-08-14, 2023-07-10, 2023-06-12, 2023-05-15, 2023-04-03

Dermot to make connection.

Geolytica / PoiData.xyz - Email to legal@

Background by LWG

Sorry if this ruins anyones Sunday.

My employer buys POI data from Geolytica. I took a look at it yesterday. It's full of OSM data, I've attached a small sample, grepped for "local knowledge". I noticed because "Source_URL" is basically a one to one copy of OSM. I can provide the full dataset if required, but this is probably the biggest ODBL violation ever. I have no idea how many Geolytica customers there are.

https://poidata.xyz/

Someone is claiming that Geolytica is selling a POI database that they think is partly copied from OSM, without attributing.

Potential issues

Mixing with OSM data
Not attributing

Geolytica

Is a web-scraping company.
Is used as a source by TomTom.

TomTom

Identified some OSM POIs in the data Geolytica provided to them and asked Geolytica to provide an OSM-free dataset.
Geolytica is fixing this.

Action item: Simon Hughes to ask Geolytica whether they have removed all the OSM data, and not just for TomTom.

Two cases of missing attribution by websites using OSMF tile servers - Email to @legal

Background by LWG

I am writing due to two cases of missing attribution by websites using OSMF tile servers:

https://www.oelschneider.de/saarbruecken-rodenhof.html and
https://radar-opadow.pl/ - missing attribution, OSMF server use

(1)
https://www.oelschneider.de/saarbruecken-rodenhof.html

Contacted on 2020-11-15 ( according tohttps://wiki.openstreetmap.org/wiki/Lacking_proper_attribution )
Contacted on 2023-07-19 ( did it personally)

Proper attribution (or any attribution at all) remains missing as of 2023-07-28

They use OSMF tile servers, are missing attribution and break https://operations.osmfoundation.org/policies/tiles/

(2)
https://radar-opadow.pl/

2023-07-14 - provided contact email bounced, tried to contact via their crowdsourcing site but only donors can comment)
2023-07-21 - tried via https://zrzutka.pl/profile/kamil-bednarz - also bounced (send first message about technical issue - frontend tries to parse .geojson withXML, next message failed due to sending too many messages....)
2023-07-21 - managed to contact via https://zrzutka.pl/rm7fub about broken mail 2023-07-21 - tried also https://www.facebook.com/radaropadow/ - responded, promised fix

Proper attribution remains missing as of 2023-07-28, though hidden one- not fullfilling ODBL requirements and Tile Usage Policy - is present in one of menus. Operations mentioned that standard procedure in such case is to write to LWG so contact is attempted again, and if that fails LWG instructs

Operations to terminate access to OSMF tile servers. So I am doing it right now. Is it a recommended way to do this things?

Note: email back in July, got lost in the shuffle.

Not discussed.

Next Meetings

2023 LWG meeting dates:
Monday Oct 16, 1700 UTC
Monday Nov 13 – back to 1800 UTC
Monday Dec 11, 1800 UTC
Monday Jan 08 2024, 1800 UTC

US daylight savings start - Mar 12 2023
EU daylight savings start - Mar 26 2023
EU daylight savings end - Oct 29 2023
US daylight savings end - Nov 5 2023

Navigation menu

Licensing Working Group/Minutes/2023-09-11

Contents

Participants

Absent

Adoption of Minutes of previous meetings

Previous action items

Reportage and action item updates

Any updates on reported attribution cases?

Trademarks – any updates?

Trademark renewal

Guillaume - HOT trademark agreement update

Simon - Any new notices

Holdover items

Where to forward user deletion requests?

Template response to missing attribution reports

From Microsoft re Mapbuilder (see email below)

From OWG - allegedly Russian email

From OWG - email related to sunnypilot and dragonpilot

Any Other Business

Any update by Tom Hummel on moving OSMF to EU country (Belgium?)

Queries to legal-questions

Ticket#2023032410000272 – Asesoría

Geolytica / PoiData.xyz - Email to legal@

Two cases of missing attribution by websites using OSMF tile servers - Email to @legal

Next Meetings