Since the beginning of June, Oracle has been conducting a campaign around VirtualBox Extension Pack in Hungary. Companies are contacted by Oracle India and are being pushed to purchase licenses immediately due to a large number of downloads.
The inquiry is not a proper, written audit approach, nor is it routed through the companies’ key account manager: Oracle India is sending their template mail to anyone whose email address they have stored in Oracle’s systems.
Based on the examples seen so far, the information provided by Oracle seems to be exaggerated for effect, including, in a number of cases, downloads older than 5 years, to give the impression of a large volume of unlicensed commercial use. They even approach companies who have perpetural licences in the same way, without any differentiation.
Let us take a moment to analyze Oracle’s modus operandi. Companies are contacted by previously unknown Oracle employees. The approach sort of looks like a compliance inquiry but meets none of the conditions and requirements that govern such an audit. Downloads and They create an impression of a large volume of licensable usage by a very loosely related piece of information. They jump to an assumption that each download is equivalent of not just installation but commercial use. Using these logical jumps it is, then, possible to jump to an assumption of long-term unlicensed past usage, hence the urgency to purchase licences.
We need to realize all of this is done to direct attention away from the fact that this is not a proper approach of customers, side-stepping the contractual safeguard of the 45-day (or longer) notification period set out in Oracle’s license agreements and get customers to divulge information which can then be used against them. Apart from the hammering of the urgency to close the transaction, another significant tell is that Oracle would, reportedly, not agree to a recorded call on the matter.
Regarding the product in question, here are the basics: Oracle VirtualBox is a desktop hypervisor that is free software licensed under GNU GPL v2. It has two add-on packages:
- Guest additions, a free additional package to be installed in running virtual machines;
- VirtualBox Extension Pack, a dual-licensed pack, which is exclusively available under a commercial licence for enterprise use, listed as Oracle VM VirtualBox Enterprise Edition in the Oracle Linux price list.
Oracle’s communication assumes licensable commercial use based on nothing but downloads with a minimum cost of $5,000 plus support.
All in all, we see no need to follow Oracle’s lead, especially not in its timing. Downloads do not equate installation or commercial use. Organizations using the product for business purposes do, of course, need to buy the necessary licences but handing over sensitive information to Oracle is not part of meeting that requirement. The applicable licensing rules are quite simple and the number of required licences can easily be established without Oracle’s “help”.
That it is worthwhile to prepare the request with an internal survey and to discover whether there is any installation of the licensed component at all, or whether the product is being used for corporate purposes.
If you need help supporting the internal assessment, or if you have any questions on the topic, feel free to reach out to us.
