On 16 September 2026, the United States Court of Appeals for the Ninth Circuit upheld the dismissal of a claim under the Digital Millennium Copyright Act in Doe v. GitHub, Inc. The plaintiffs are programmers who published copyrighted code under open-source licences on GitHub. They alleged that GitHub Copilot sometimes generated identical, near-identical or modified versions of training material without the attribution, copyright notices or licence terms that accompanied the original code, thereby removing or altering copyright management information.
The ruling is much narrower than a finding that AI may use code without attribution. The court separated the dispute into an input theory about training and an output theory about generation. It did not decide the merits of the input theory because the plaintiffs had not preserved it in the lower court. On the output theory, it held that the complaint described Copilot as generating new works from statistical patterns, rather than taking information already attached to an existing copy and removing it. Failing to add information to a new output was not, on that account, the same act as removing or altering information on an existing work. The court expressly declined to decide whether an output might infringe copyright under traditional doctrine, and the open-source licensing contract claims remain pending below.
The philosophical question raised by the decision is not simply who should win this lawsuit. It is whether an AI output that does not display an author, source work or production history presents erased provenance or provenance that has not been expressed. The formulations sound similar, but they describe different structures of fact and different conditions of responsibility.
Removal is an action directed at an existing object and its identifying information. An author’s name is printed in a book and cut away during copying; a photographer’s credit appears on an image and is cropped out before publication. To describe removal, we must be able to identify the pre-existing work, the information attached to it and an operation through which that information disappeared. Absence is a weaker condition. A new object may contain no provenance information at all, but that alone does not prove that it once contained such information or that an actor performed an act of removal. The Ninth Circuit’s reading of the DMCA preserves this operational distinction.
Legal removal, however, does not exhaust the philosophical idea of provenance. The World Wide Web Consortium’s PROV framework defines provenance as information about the entities, activities and people involved in producing data or a thing, information that can support judgements about quality, reliability and trustworthiness. On this broader account, provenance is not merely an attribution string attached to a finished product. It is a relational record of how the product came to be. Even where an AI output has not had a credit removed from it, it may still stand in traceable relations to training materials, retrieved results, prompt inputs, matched code, a model version and a user’s choices.
Attribution must therefore be distinguished from provenance. Attribution asks to whom a work or contribution should be credited. Provenance asks through which materials, activities and transformations a result was formed. They often overlap, but neither can replace the other. A model may produce a new combination with no single human author while the assessment of its quality or licensing still depends on identifiable material relations. Conversely, adding a person’s name to an output does not establish how the output was produced, whether it copied a licence-governed passage or whether the credit is accurate.
GitHub’s current code-referencing mechanism illustrates the distinction. Its documentation says Copilot compares a possible suggestion and about 150 characters of surrounding code against an index of public repositories. When a match is found, it can provide file URLs and licence information so that the user can decide whether and how to attribute the code or remove it. GitHub also states that the index is refreshed only every few months, excludes private repositories and code outside GitHub, and does not check altered suggestions in the same way. This is not a complete proof of the provenance of every output. It is a matching mechanism bounded by thresholds, an index and product scope.
My judgement is that missing provenance and erased provenance should not be conceptually merged. The first describes the state of visible information; the second additionally alleges an action directed at information that already existed. Merging them would interpret every unattributed AI output in advance as an act of deletion. Separating them completely, however, would invite the opposite error: treating “not removal” as “no provenance obligation”. The Ninth Circuit resolved the latter claim under a particular statute. It did not settle how much provenance an AI system should preserve for purposes of knowledge, licensing or trust.
Sustenesis Theory helps state the distinction more precisely. Difference is not merely ordinary dissimilarity but the distinguishability from which relations can form. Original code, training inputs, model parameters, generated passages, copyright management information and code authors must remain distinguishable before provenance can have an object. Constraint refers to the conditions that make relationships discoverable or verifiable, including matching thresholds, index coverage, licence text, retained logs, model access and rules of evidence. Sustained Coherence requires the provenance relation to maintain structural consistency across generation, use, review and correction, rather than appearing only as an occasional name beside an output.
This also gives responsibility a more accurate boundary. A platform cannot reasonably turn every abstract influence into an author list; doing so would be unworkable and could create false certainty. Yet when an output has a sufficiently specific match to existing material, when licence conditions may continue to apply, or when a user needs the relationship to decide whether the output can be used, there is a reason to preserve and present that relationship. The basis of responsibility is not that every influence counts as copying, but that a distinguishable and verifiable provenance relation relevant to an actual decision has formed.
The evidence has clear limits. The decision rests on Copilot as described in the complaint and addresses one statutory output-stage claim. It is not a factual determination about every generative system’s internal process, nor a final conclusion about copyright infringement, open-source licensing or moral attribution. If a system directly retrieves and emits existing files, or evidence shows that copyright management information was actively stripped during training or distribution, both the legal and philosophical analysis may change. What can be maintained now is that failing to display provenance, removing provenance and having no provenance are three different propositions. A reliable AI provenance regime must establish them separately.
References
Click to access doe-vs-github-ninth-circuit.pdf
https://docs.github.com/en/copilot/concepts/completions/code-referencing
https://www.w3.org/TR/prov-overview/
https://plato.stanford.edu/entries/intellectual-property/
Discover more from Geoffrey Chen
Subscribe to get the latest posts sent to your email.