The Commission unconditionally clears the acquisition of GitHub by Microsoft

January 2019

CPI EU News Column edited by Thibault Schrepel, Sam Sadden & Jan Roth (CPI) presents:

The Commission unconditionally clears the acquisition of GitHub by Microsoft By Anna Renata Pisarkiewicz (European University Institute)1

The Facts of the Microsoft/GitHub Acquisition

On September 14, 2018, Microsoft and GitHub notified the European Commission about their intention to merge. Both parties to the transaction supply various software development and operations (“DevOps”) tools that individuals and organizations use when developing and releasing software. GitHub, in particular, supplies the popular code hosting platform for version control and collaboration on software development, which can be used online (GitHub.com), and on-premises (GitHub Enterprise). At the time of the notification, with more than 28 million developers in its community, and 85 million code repositories, GitHub was the largest host of source code globally.²

Given that the EU turnover of GitHub was less than EUR 250 million in the last financial year for which data was available at the time of the notification, the transaction did not have a Union dimension under Article 1(2) or Article 1(3) of the Merger Regulation. However, it did have such a dimension pursuant to Article 4(5), as it was capable of being reviewed under the national competition laws of four Member States, namely Austria, Cyprus, Germany, and the United Kingdom. Having reviewed the transaction, the Commission approved it unconditionally on October 19, 2018 (Case M.8994 – Microsoft/GitHub).³

Potentially Affected Markets and Competition Assessment

To assess the impact of the transaction on the internal market, the Commission identified four relevant product markets: (1) DevOps tools; (2) source code hosting services for version control and collaboration; (3) code editors (computer programs designed for editing source code) and integrated development environments (IDEs, applications consisting of a code editor and additional features, such as intelligent code completion); and (4) IaaS and PaaS, which are two different forms of cloud computing services.

With respect to all these four markets, the Commission decided that for the purpose of the decision, it could leave the product market definitions open as regardless of how markets would be defined, the transaction did not raise serious doubts as to its compatibility with the internal market. Also, for the geographic scope of all four relevant markets, the Commission again decided that it was possible to leave them open as the transaction did not raise any serious concerns regardless of whether any potential market would be EEA- or world-wide.⁴

The analysis of the potential impact of the transaction focused on horizontal (non-coordinated) effects in the markets for DevOps tools, for source code hosting services for version control and collaboration, and for code editors and IDEs. Moreover, given that various DevOps tools are often used together with source code hosting platforms for version control and collaboration as well as with cloud services (IaaS and Paas), and that GitHub had more than 30 percent market share of the potential market for source code hosting services, the Commission also analyzed conglomerate effects in the market for DevOps tools and for Iaas and Paas. Last but not least, the Commission examined whether the transaction could produce vertical effects regarding access to data.

With respect to horizontal effects, the Commission found that the overlap between the merging parties in the market for DevOps tools was minimal. Moreover, the market is fragmented and the parties have low market shares worldwide: Microsoft [5-10 percent], and GitHub [0-5 percent]. Therefore, after the transaction the merged entity would continue to face significant competition from many other players, which include – to name just a few – IBM, Google, Amazon, and GitLab. In contrast, in the market for source code hosting services for version control and collaboration, the combined market share of the parties is high. On a worldwide scale, GitHub’s market share could be as high as [50-60 percent], while Microsoft’s [0-5 percent].⁵ However, there were a number of factors that led the Commission to conclude that the transaction would nonetheless raise no competition concerns. First, Microsoft and GitHub not only are not close competitors, but as the Commission noted, “they actually address different categories of customers.”⁶ Second, should GitHub become unavailable, customers would switch to GitLab and Bitbucket rather than Microsoft’s online hosting platform VSTS or its on premises solution. Third, switching hosting platform is easy for developers. This is because the entire history of the changes made to the code can be stored on developers’ personal computer, and can be moved to another hosting service without undue hurdles. Switching is furthermore facilitated by multi-homing, while learning costs arising from switching seemed to be reduced, given that according to data submitted by the parties “most users of GitHub are familiar with the user interface and other features of competing service providers.”⁷ Furthermore, the ease and propensity of users to switch⁸ are important as they are likely to weaken any potential network effects from which GitHub could benefit with respect to public repositories where “the value of a hosting service like GitHub […] may increase [for its users] as its total number of developers (and hosted projects) grows.”⁹ Last but not least, while Microsoft would have the technical capacity to block the portability of certain data, doing so “would be ineffective at preventing developers from switching” to a competing service as the data in question is used by a small fraction of developers.¹⁰

Concerning the conglomerate and vertical effects, the Commission assessed both the ability and the incentive of the merged entity to weaken competition by foreclosing its rivals. With respect to conglomerate effects, the concern was that these could harm competing DevOps tools as well as competing Iaas/Paas. Competing DevOps tools could be negatively affected if Microsoft could leverage the popularity of GitHub’s source code hosting services for version control and collaboration to increase sales of its own DevOps tools.11 Competing Iaas/Paas, on the other hand, could suffer if Microsoft could further integrate its cloud platform Azure with GitHub and degrade or limit interoperability of competing Iaas/Paas with GitHub to prevent GitHub users from deploying their application to their preferred Iaas/Paas. However, Microsoft’s internal documents as well as views expressed by competing providers of Iaas/PaaS confirmed that such behavior was unlikely as it would undermine the rationale of the transaction, which was mainly to cater for the needs of developers in order to improve their perception of Microsoft’s products.¹²

Some respondents to the market investigation were also concerned about vertical effects that could arise if Microsoft could refuse or degrade access to GitHub’s data, thereby impairing competitors from offering products matching those of Microsoft. Such concern would be valid should the data in question be an important input for competitors’ ability to develop improved products. GitHub collects three types of data: user-generated content, users’ personal information, and metadata. User-generated content, which can be stored in private and public repositories, includes – among others – source code, revision history, and author’s identity. The users’ personal information comprises data that users provide to GitHub to create accounts, such as user name, password, and email address. Metadata refers to data obtained from the normal commercial operations of GitHub.com, for example billing information or information about the types of devices/browsers used to access GitHub.com.

The Commission assessed these categories of data focusing on whether a given type of data was already accessible to third parties or not. With respect to data already accessible to third parties – namely source code, revision history, author’s identity, and commit messages,¹³ – the Commission concluded that Microsoft would have neither the ability nor the incentive to restrict access to such data. First, this type of data can be accessed through other sources, which are beyond GitHub’s control. Second, blocking access to such data or degrading the interoperability of all third-party tools, would “have to break existing project workflows and degrade the overall user experience on GitHub, with the risk of losing many customers to competition version control systems.”¹⁴ Even if access to this type of data were blocked, anticompetitive effects would be unlikely given that “these categories of user-generated data do not seem to be competitively important inputs that Microsoft could reserve for itself.”¹⁵ Last but not least, alternative data sources exist and post-transaction there will remain enough alternative providers of data equivalent to that which is available in GitHub.¹⁶ As for the data that is not accessible to third parties, such as user-generated data in private repositories, the Commission concluded that since it does not constitute a “competitively unique and critical input,” it is unlikely to be competitively significant.¹⁷ Moreover, since data deposited in private repositories is subject to significant contractual constraints, Microsoft could not deny access to such data to its competitors, while accessing it itself, without breaching GitHub’s Terms of Service.

Having found no horizontal, conglomerate or vertical effects that could have negative impact on competition, the Commission declared the transaction to be compatible with the internal market.

Opinion

This decision raises a number of important questions relevant for the ongoing discussion about the role and evaluation of innovation, intellectual property rights, and open source software (“OSS”) in mergers in digital markets. Traditionally, the intellectual property regime, favored by tech companies as a foundation of their business strategy, has been seen as completely opposite to open source. However, the acquisition of GitHub by Microsoft, which is just one in a series of similar transactions, testifies to an important change in the tech industry concerning the way tech giants and other important companies, that have been typically associated with strong protection of their intellectual property, view open source.¹⁸

Microsoft, for example, which back in 2001 considered Linux as “a cancer that attaches itself in an intellectual property sense to everything it touches,”¹⁹ in October 2018 joined the Open Invention Network, “a defensive patent pool and community of patent non-aggression,” established to protect Linux and other open sources software programs from patent risk.²⁰ This clearly shows the shift in Microsoft’s attitude towards open source community. In fact, one of the main rationales behind the acquisition of GitHub, the one to which both the Commission and the merging parties referred repeatedly, was to “[demonstrate Microsoft’s] very strong commitment towards the open source community.”²¹ This commitment is naturally driven by a plethora of business considerations.

As Microsoft itself admits, it hopes that its commitment will improve its reputation among developers, many of whom play an important part in the procurement of DevOps tools and cloud services for companies. This in turn could help Microsoft to compete more effectively with its Azure cloud against Amazon Web Services (“AWS”), Alphabet’s Google Cloud Platform (“GCP”), and others. Now, if one were to evaluate this acquisition considering the acquisition of LinkedIn, another important motivation could be revealed. By acquiring both LinkedIn and GitHub, Microsoft gained access to probably the most vital source of information on what top contributing developers are working on.²² This in turn could help Microsoft pre-empt market trends and acquire potential disruptors and/or the most promising innovators, thereby gaining an important competitive advantage in the market.

As far competition analysis is concerned, the Microsoft/GitHub decision does not offer any meaningful revelations concerning the definition of the relevant market involving OSS. As in a number of previous transactions involving such products, the Commission concluded that it was possible to leave the product market definitions open since, regardless of how markets would be defined, the transaction did not raise serious doubts as to its compatibility with the internal market. However, this may not always be the case. Certainly, competition analysis in mergers involving OSS is trickier than in mergers involving proprietary systems: the identification of all the providers of the product is more challenging as is the determination of whether entry will occur in a timely manner. Given that in the foreseeable future we are likely to see more mergers involving OSS and dominant tech players, it is important that competition authorities develop an in-depth understanding of intricate and complex competition-relevant issues that open-source software raises.

Click here for a PDF version of the article

1 Research Associate, Florence School of Regulation, European University Institute.

2 Yet, despite its popularity, GitHub was making significant losses and according to the business press it may have preferred an acquisition over trying to launch initial public offering (IPO).

3 Commission Decision (2018), Case M.8994 – Microsoft/GitHub.

4 Commission Decision, paras. 30, 47, 55 and 64.

5 Please note that Microsoft’s and GitHub’s markets shares vary depending on the segment (online or on premises) and whether it would include all types of services (decentralized version control systems and centralized control systems or just decentralized). See Commission Decision, paras. 85-86.

6 Commission Decision, para. 97.

7 Ibid, para. 100.

8 Ibid, para. 102. As the Commission indicated, mass switching of users was one of the risks associated with the acquisition of GitHub that Microsoft had identified.

9 Ibid, para. 102.

10 Data in question are bug trackers (issues) and pull requests. Ibid, para. 104.

11 As explained in the decision, such leveraging could be implemented by: (1) further integrating Microsoft’s DevOops tools with GitHub; (2) limiting GitHub’s interoperability with competing DevOps tools; or (3) limiting the integration of competing DevOps tools with GitHub.

12 Commission Decision, paras. 126-127.

13 Commit messages, known as “comits,” are the changes or edits to the code. See Commission Decision, footnote 53.

14 Commission Decision, para. 143.

15 Commission Decision, para. 146.

16 Commission Decision, paras. 149-150.

17 Commission Decision, para. 152.

18 For example, back in 2010, Oracle acquired Sun Microsystem. More recently, IBM announced in October 2018 that it would acquire RedHat for USD 34 billion.

19 The Register (2001), Balmer: ‘Linux is a cancer,’ available at https://www.theregister.co.uk/2001/06/02/ballmer_linux_is_a_cancer/.

20 See Open Invention Network at https://www.openinventionnetwork.com> The OIN Initiative is also supported by Google and IBM, and various other firms from a variety of sectors.

21 Commission Decision, para. 89.

22 Tech Republic (2018), “Why LinkedIn + GitHub profiles could be the hidden gem in $7.5 B Microsoft acquisition’, available at https://www.techrepublic.com/article/why-linkedin-github-profiles-could-be-the-hidden-gem-in-7-5b-microsoft-acquisition/.