How a Dying Company's $5B Linux Lawsuit Collapsed — and Gave Us 'Signed-off-by'

I. 1991, University of Helsinki

In autumn 1991, 21-year-old Helsinki University student Linus Torvalds grew dissatisfied with the operating systems available to him. On August 25, 1991, he posted to the MINIX Usenet newsgroup: "I'm doing a (free) operating system (just a hobby, won't be big and professional like GNU) for 386(486) AT clones." Version 0.01 followed in September. Torvalds originally wanted to name it Freax, but the server administrator Ari Lemmke named the upload directory "linux," and the name stuck.

In January 1992, MINIX creator Professor Andrew Tanenbaum posted "Linux is Obsolete," arguing microkernels were the future and that using a monolithic kernel in 1991 was "a giant step back into the 1970s" [1]. Despite Tanenbaum's academic authority — his textbook "Operating Systems: Design and Implementation" (1987) included the full 12,000-line MINIX source — Torvalds defended his design choices in the same thread and continued releasing new versions.

II. One of the Wisest Decisions

Linux 0.01 carried a homemade license: free use but no commercial profit. In early 1992, with version 0.1, Torvalds replaced it with the GNU General Public License version 2 (GPLv2). He later called this "one of the wisest decisions I've ever made." GPLv2 grants anyone the right to obtain, modify, and distribute the code, provided they pass the same freedoms to all recipients and supply the source code. This rule makes it impossible for any single party to seize exclusive control of the code.

A concrete illustration: Oracle recompiles Red Hat's Linux packages, modifies them, and sells the result as Oracle Linux; Red Hat cannot stop this because the GPLv2 automatically grants identical redistribution rights to anyone who distributes Linux. Any company wishing to monopolize Linux would first have to revoke the GPL's legal force on every copy already distributed — a practical impossibility.

III. $5 Billion and 1,500 Cease-and-Desist Letters

On March 6, 2003, the SCO Group sued IBM. SCO alleged that IBM had obtained confidential Unix source code and secretly inserted it into Linux, meaning parts of Linux belonged to SCO. In May 2003, SCO CEO Darl McBride publicly claimed Linux contained millions of lines of stolen Unix code and warned every enterprise running Linux of legal risk. SCO sent roughly 1,500 warning letters to companies. The damages demand against IBM rose from $1 billion to $3 billion, then to $5 billion.

SCO's Unix business was shrinking each quarter; the litigation became its de facto revenue stream. Major enterprises, fearing the $5 billion threat, stayed silent. But one person stepped forward: the system's original author.

IV. "They've Completely Lost Their Minds"

Torvalds responded without PR consultants, using his own blunt words. Facing personal lawsuit threats, he remarked: "I don't see what SCO would gain by suing me; they're not making any sense." In a June 23, 2003 eWeek interview he called SCO's claims "a bunch of crap." Two months later: "They've completely lost their minds." In a February 2004 BusinessWeek interview: "SCO is wrong on multiple levels. Even in a parallel universe where SCO's story held up, they'd still be wrong." While corporations felt a $5 billion legal threat, Torvalds felt offense more than fear.

When SCO's list of allegedly stolen confidential files leaked, Torvalds did something few defendants can: he published the files himself.

V. 65 Files, Line-by-Line Examination

The leaked list contained about 65 files SCO claimed were copied from Unix. Torvalds reviewed each and posted a public rebuttal vowing to "thoroughly debunk" the allegations.

ctype.c and ctype.h — the simplest files, implementing basic character classification (isalpha, isdigit, isspace) and case conversion (toupper, tolower). Torvalds wrote them in September 1991 for Linux 0.01, taking under five minutes. Evidence lies inside the code: the earliest ctype.c uses an internal variable named _ctmp. No released Unix system ever used that variable name. If the code were copied from a mature codebase, a programmer would not invent a private variable absent from all existing systems.

These files bear novice fingerprints. Torvalds' toupper/tolower are not thread-safe: simultaneous calls overwrite each other because they reuse the same temporary variable ( _ctmp) instead of allocating independent storage. A mature commercial library would specifically avoid such hazards. Even the brace style looks inexperienced. These details prove the code was written from scratch, not lifted.

Early Linux used different signal numbers than traditional Unix. For example, SIGBUS (memory access error) is 7 in Linux but 10 in Unix. Later ports adopted Unix signal numbers solely for binary compatibility — itself evidence against covert copying.

Remaining similarities stem from shared specifications: the C standard library and POSIX precisely define the required behavior of functions like ctype. When the required behavior is rigidly fixed, viable implementations are few; independent programmers can produce highly similar code without copying.

SCO publicly displayed two code excerpts. One was the Berkeley Packet Filter, a well-known UC Berkeley tool under the BSD license — "clearly BSD-licensed," Torvalds noted, legally usable by anyone, not secret Unix property. The other was old code Linux developers had already removed before SCO's accusations.

Verifying these facts required combing the kernel mailing list archives from 1992 onward. Torvalds called the exercise "no fun at all," but it was possible because the complete development history is public; every change is traceable to a date and author.

VI. Where the Lawsuit Money Came From

SCO was nearly bankrupt, yet the suit cost millions. Microsoft's stance on Linux was no secret: in June 2001, CEO Steve Ballmer called Linux "a cancer that attaches itself in an intellectual property sense to everything it touches" — exactly SCO's chosen battlefield. In May 2003 (the same month McBride issued his warnings), Microsoft paid SCO $6 million for a Unix license. In October 2003, BayStar Capital led a $50 million investment in SCO [2]. BayStar later stated they were pushed toward the deal after talks with Microsoft executives [3]. Microsoft confirmed the $6 million payment but denied guaranteeing BayStar's investment.

Funding sustained the litigation but could not fix the fatal flaw at the case's core.

VII. One Sentence in a 1995 Contract

The entire legal standing rested on one premise: to sue for copyright infringement, you must own the copyright. In 1995, SCO acquired Unix assets from Novell via an Asset Purchase Agreement [4]. Everyone, including SCO, assumed the copyright transferred too. But when lawyers and Groklaw readers scrutinized the agreement, they found it did not transfer the Unix copyrights; copyrights remained with Novell .

The company demanding $5 billion for copyright infringement did not own the copyrights in question .

On August 10, 2007, Judge Dale Kimball issued a 102-page summary judgment confirming Novell owned the Unix and UnixWare copyrights, not SCO, and that SCO owed Novell millions in collected licensing fees [5]. Within weeks, SCO filed for Chapter 11 bankruptcy protection. The ruling was not final; in August 2009 the Federal Circuit remanded the copyright ownership issue for a full trial. In March 2010 a jury reached the same conclusion as Judge Kimball: Unix copyrights belong to Novell; SCO has none . The 2007 judgment was upheld, ending the matter.

McBride was ousted as CEO in October 2009, filed personal bankruptcy in December 2020, and died on September 16, 2024, aged 64. The dispute lasted 18 years, finally closing in 2021 when IBM paid $14.25 million to the SCO bankruptcy trustee — not for the failed Linux infringement claims, but to settle a separate, much smaller contract dispute from an earlier IBM-SCO collaboration. SCO's multi-billion-dollar demand ended in bankruptcy.

VIII. Every Patch Must Carry a Signed-off-by

The panic spread because someone might have submitted code they didn't own, and the kernel project had no systematic way to verify every line's provenance. Today's concerns about AI-generated code are essentially the same problem.

At the time, all Linux kernel development history lived in the BitKeeper version-control system. History existed, but contributors made no formal declaration that their submissions were legally clean. In May 2004, Torvalds introduced the Developer's Certificate of Origin — the now-ubiquitous Signed-off-by line.

Pick any recent mainline kernel patch; near the end you'll see: Signed-off-by: Real Name <[email protected]> Writing that line creates a written record: either the code is the author's own work, or the submitter has legal authority to contribute it. If a company later claims ownership of kernel code, the responsible person is explicitly named.

Supplement: The Story Isn't Quite Over

In 2021, as the case neared final resolution, SCO sold its software business to Xinuos, which chose to continue the litigation. Since then, Xinuos's suits have dragged on inconclusively. Xinuos argues IBM never obtained a valid license from SCO; IBM maintains it did nothing wrong. The core questions: does Xinuos have standing to sue, and have the tangled contractual clauses expired? As of the article's writing, the dispute remains unresolved [6].