Yes. Mostly.
If you distribute GPLed code to a contractor, the contractor can do with it as they like.
Where I quibble is that there are things that look a lot like distribution but aren't. For instance if auditors came in to audit your code on site, then I don't think that that would count as distribution. The GPL FAQ agrees on that. So there is a form of due diligence that does not trigger the GPL.
I further suspect that if a court of law required you to hand over code as evidence in a court case, that would also not count as distribution. I don't know the rationale that a lawyer would use to not count it as distribution, but I would be shocked if there isn't one.
Without knowing that rationale, I can't say what its boundaries are and what kinds of pseudo-distribution you can get away with.
But if you distribute, then the GPL is very clear about what happens next.
Furthermore, as a practical matter, if nobody knows about the copyright violation, it may not be a big deal. You would be amazed at the kinds of copyright violations that are ignored in practice. If you're trying to keep your nose clean, you don't want to go there. But unless a copyright holder gets upset enough to go after you (and GPL copyright holders have not demonstrated themselves to be so aggressive), it doesn't in some sense matter that you're technically in violation.
Cheers,
Ben
I have come to believe that idealism without discipline is a quick road to disaster, while discipline without idealism is pointless. -- Aaron Ward (my brother)
