[latchkey]

Simpler than what, MIT?

[jph]

Yes simpler than MIT.

The Fortune 50's compliance team carefully evaluated many open source licenses, including MIT, BSD, GPL, Apache, etc. and determined that GPL is the best for their company for internal tools such as these, that must be wholly separate from any product offerings.

And when I say carefully, I mean multiple lawyers, for multiple years, considering many worldwide regulatory compliance laws. GPL won over all the other options.

[nequo]

Do you know what makes MIT and BSD more complicated for internal tools for these companies?

What about MIT or (two-clause) BSD makes it harder to comply with? Would attribution be an excessive burden for them in case such code ended up in their own products?

My understanding is that BSD and Apache were historically favorable licenses for code that was intended to promote a protocol and make it an industry standard. Easy reuse helped achieving this goal. For example, IIRC FreeBSD's TCP/IP code was repurposed for Windows and MacOS X, and the Apache HTTP server also went a long way toward establishing HTTP as a standard.

Edit: Paragraph on standards.

[jph]

MIT and BSD et al. required the compliance team to track code, attribute it, audit it, and ensure that if the code ended up in the company's external products, then the company could prove the code was always correctly handled

This necessarily included all updates to the code, subsequent patches by external contributors that come downstream, subsequent patches by internal contributors that go upstream, eventual sunset of the code, etc.

GPL was akin to a bright highlighter stating "internal use only".

[latchkey]

Creating a dependency on a 3rd party piece of software or releasing an internal tool as open source?

[jph]

Dependency tracking was the primary issue because the company was in a regulated industry. Releasing patches for upstream existing open source was a secondary issue; GPL made this especially easy.