The stranger who read a router's fine print, without owning the router

In June 2003 a Linux developer named Andrew Miklas posted a long message to the Linux kernel mailing list, the public email list where the people who build Linux talk to each other. Its subject was "Linksys WRT54G and the GPL". The WRT54G was a Linksys wireless router, the kind of box that sits on an office desk and hands out Wi-Fi.

Miklas had not taken one apart. In his own words: "I should note that I don't own this product, so I can't determine if the source is shipped with it." He had downloaded the router's software file, which Linksys offered free on its website, and looked at what was inside. He found Linux and several other free programs.

Why that mattered

Those programs are published under the GPL, a licence that lets any company use them free of charge, with conditions. One condition is that if you ship them inside a product, you must also make the code available to the people who get the product. The code is the written instructions a program is built from, the part a programmer can read and change. Miklas wrote that the router's software did "not seem to have any of the source available, or acknowledge the use of the GPLed software."

His post was not the first time he had raised it. It opens with "Awhile ago, I mentioned", so the June post is the detailed one that set things moving. He had also spoken to someone at Linksys about four weeks earlier. That person, he wrote, "was initially unaware Linux was used in this product," and promised to work with his managers to get the code released. Then, Miklas wrote, three weeks of emails went unanswered.

Miklas had his own reason to care. Linux could not yet work with many newer wireless chips. Yet, he wrote, it worked very well with one maker's chips if you were running it inside a Linksys router.

Linksys was also changing owners. In March 2003 Cisco had announced it would buy the company, for shares worth about US$500 million.

What Linksys did, and what it left out

By 8 July 2003, another developer told the list: "Linksys have opened up and released their code." A page offering the code was up on the Linksys website. The exact day it went up is not on record, and no public statement from Linksys or Cisco about it has been found.

The release was incomplete. Developers said the published code for the core of the system left out the code that runs the wireless chips, and other pieces needed to rebuild what Linksys shipped. In September 2003, after three versions of the router's software had come out, a group of developers including Jeremy Allison and Erik Andersen wrote that the published code could not be used to rebuild the core of the software Linksys was shipping. In their view, Linksys remained "in violation of the GPL."

What grew from it

Incomplete or not, the code was enough to start from. OpenWrt says it "started in January 2004", and that its first versions "were based on Linksys GPL sources for WRT54G". Its own pages list Mike Baker and Gerry Rozema as co-founders. Some retellings say Linksys released the code in 2004. The mailing list shows it was 2003; 2004 is when OpenWrt began.

OpenWrt is now a version of Linux for routers and similar devices, with more than 3,000 add-ons you can install. Since September 2020 it has been a member project of the Software Freedom Conservancy. In November 2024 it released the OpenWrt One, a router of its own, priced at US$89. The prpl Foundation describes its prplOS, aimed at internet providers, as "based on OpenWRT". We have found no source saying any Malaysian internet provider's router runs OpenWrt or prplOS, so we do not claim it.

Other router software traces back to the same box. Secondary sources say DD-WRT, first released in 2005, descends from the WRT54G's software, and name Tomato as another. We have not checked these against the projects' own records.

Five years later, a court

On 11 December 2008, the Free Software Foundation sued Cisco in a New York federal court. This was not the 2003 complaint. The case was about "various products under the Linksys brand", and about free programs the FSF owns the copyright to, such as GCC and the GNU C Library. It was not about Linux. The FSF said it had been working with Cisco on the problem since 2003 and "never gone to court before."

The case settled in May 2009. Cisco agreed to appoint a Free Software Director for Linksys, tell past buyers about their rights, keep the code available, and make a contribution to the FSF of an undisclosed amount.

What it means for your business

The FBI warned in May 2025 that criminals are exploiting old routers that no longer get updates, and that "Routers dated 2010 or earlier likely no longer receive software updates". The FBI calls a router "end of life" once its maker stops supporting it and stops releasing security fixes. Its advice: "If the router is at end of life, replace the device with an updated model if possible."

In the UK, makers of connected consumer products must now publish how long they will provide security updates. That rule is UK only. The question is still a good one to ask here. Ask your internet provider or router supplier until what date your router gets security updates. If the answer is "none" or a date that has passed, the FBI's advice applies.