Oracle and the Evil Alternative: Taking Java Private

In a recent episode of the Java Spotlight Podcast, Henrik Ståhl (Oracle's Senior Product Director of Java Platform Development) is interviewed about Oracle's strategy for Java past and present.

At 9 minutes 20 seconds he says "[Oracle] looked at the evil alternative, taking Java private". He then goes on to say "we determined it wasn't a good idea". But I was interested that Henrik didn't say "we determined it wasn't possible".

I contacted Henrik and asked for clarification: how would 'taking Java private' work?

Relax, This Isn't Going To Happen

First, let's be clear. Henrik has been explicit about Oracle's strategy for Java (here, here, here and here): they have considered this evil alternative and rejected it. That's not what this blog is about. Let's not start a FUD storm.

Rather I'm interested in how any company could, even hypothetically, take a GPL'd project private.

So, Hypothetically, How Would It Work?

Henrik explained the basic idea was that, given Oracle owns or co-owns all OpenJDK Intellectual Property (IP), they
have the right to release it under a non-GPL license. The owner of the IP can retroactively apply any license he/she wants, provided all prior modifications to the IP were made by that same owner. This appears to sidestep the GPL copyleft clause.

Of course you can't stop the community using the existing GPL'd version. Nor can you stop them forking it (though under a different name). But being able to un-GPL the code is a significant leg up from, say, having to build a clean room implementation before you can privatize it. It means you can have a 100% compatible, closed source product from day one, built using modified GPL'd code. And I assume if you rev the versions quick enough, most corporates will follow you rather than wait for the community version to catch up. Effectively you can close source a GPL project.

So my question is: is this legitimate? Can a corporation take a piece of Open Source software, acquire all IP rights to it, then close source its future versions? Is this a risk of relying on Open Source software? Should steps be taken to mitigate this risk? For example, should an Open Source project ensure its IP is distributed between multiple neutral entities (and avoid having Contributor Agreements that require handing over IP rights)?