There was a recent discussion on debian-project about lawsuits involving Debian. Pierre-Elliott Bécue has written:
But Debian having no legal existence, it can't file
Personally, we don't want to encourage anybody to make an un-necessary lawsuit but it also concerns us that false information has been presented about this issue. The false information is problematic because claimants may be deterred from pursuing legitimate claims but more importantly, because volunteers may not realize they are at risk of being sued.
If a non-profit organization is incorporated, most lawsuits have to be sent to the office of the organization. The managers and employees can't be named in most lawsuits. The person making a claim is claiming against the assets of the organization but they probably can't claim against the homes and other private assets of managers and employees.
As people noted in the discussion on debian-project, Debian is not incorporated. This means that none of the volunteers have the protection described above.
Some people may feel they are participating in Debian for their job and they are protected by their employer. This is not always true. Many people use their private email addresses in Debian, even when making contributions for their employer. This, in itself, may make them targets for personal lawsuits. Some large companies may choose to indemnify their employees, in other words, even if a claimant finds a way to make a personal lawsuit against a volunteer, the employer could voluntarily pay the legal defence fees. What about contributors who work for small companies? What if a person decides to change jobs during a long-running lawsuit, will the old employer continue to pay their legal bills? What if the volunteer changes jobs and then a few months later, somebody else starts a lawsuit about something the volunteer did during their last job? Will either the past or present employer want to pay the employee's defence costs? It just sounds messy.
These are very important questions both for volunteers and also for all employers who choose to have staff contributing to free software projects like Debian.
It may be far easier to incorporate the Debian organization. Incorporation would give volunteers more certainty about their protections, it would give employers more certainty that their employees won't get sucked into a legal nightmare and it would also give all members more protection and rights. When managers of an organization want to benefit from the buffer against personal liability, they also have to ensure the organization is accountable to the members and they can no longer indulge in abusive expulsions and shamings. Oddly enough, that is one of the reasons cabal members often resist the idea of incorporating.
The project currently hosts a lot of information about shamings and character assassination. Who is legally liable for that? Is it only the person who wrote each email, or can the DPL and volunteers who run the mail servers, BTS and other facilities be sued too? People who use the good name of Debian to shame volunteers should have nowhere to hide.
Anybody choosing to nominate in the upcoming Debian Project Leader elections may want to think carefully about whether their personal assets will be at risk. If the organization doesn't want some candidates to be deterred from nominating, it might be a good idea to prioritize the issue. ⬆