Splunk Inc. v. Cribl, Inc. ( 2024 )

1 2 3 4 5 6 UNITED STATES DISTRICT COURT 7 NORTHERN DISTRICT OF CALIFORNIA 8 9 10 SPLUNK INC., 11 Plaintiff, No. C 22-07611 WHA 12 v. 13 CRIBL, INC., ORDER RE REMAINING CLAIMS AND DEFENSES, 14 Defendant. AND INJUNCTIVE RELIEF 15 16 17 This order addresses the claims and affirmative defenses preserved by the parties and 18 tried to the bench, as well as plaintiff Splunk Inc.’s motion for a permanent injunction (Dkt. 19 Nos. 346–48). 20 1. AFFIRMATIVE DEFENSES. 21 Starting with the affirmative defenses, defendant Cribl, Inc. seeks judgment in its favor 22 on account of equitable estoppel, unclean hands, and copyright misuse. 23 First, the elements of equitable estoppel are (1) the party to be estopped must know the 24 facts; (2) the party to be estopped must intend that its conduct shall be acted on or must so act 25 that the party asserting estoppel has a right to believe the conduct is so intended; (3) the party 26 asserting estoppel must be ignorant of the true facts; and (4) the party asserting estoppel must 27 rely on the conduct to its injury. Baccei v. United States, 632 F.3d 1140, 1147 (9th Cir. 2011) 1 convincing evidence, that it was ignorant of the true facts. For example, Cribl has not met its 2 burden of proving, by clear and convincing evidence, that it believed Splunk approved of uses 3 of Splunk Enterprise that were permitted under the TAP contract but not under the SGT 4 contract, which governed once the TAP contract was terminated for cause in November 2021. 5 Cribl made no meaningful attempt to justify the argument it understood Splunk’s position to be 6 that Cribl would retain all rights it merely licensed under the TAP contract once the TAP 7 contract was terminated. If that had been the case, why would Splunk have terminated the 8 TAP contract to begin with? Meanwhile, Cribl has not met its burden of proving, by clear and 9 convincing evidence, that it ever believed Splunk approved of its reverse engineering. Indeed, 10 there is ample evidence in the trial record to support the proposition that Cribl understood 11 Splunk did not (or would not) approve, so Cribl did not seek to “rock the boat.” 12 Second, unclean hands “closes the doors of a court of equity to one tainted with 13 inequitableness or bad faith relative to the matter in which he seeks relief, however improper 14 may have been the behavior of the defendant.” Adler v. Fed. Republic of Nigeria, 219 F.3d 15 869, 876–77 (9th Cir. 2000). “Bad intent is the essence of the defense of unclean hands.” 16 Dollar Sys., Inc. v. Avcar Leasing Sys., Inc., 890 F.2d 165, 173 (9th Cir. 1989). Cribl’s 17 argument that it was terminated from the TAP program in bad faith was submitted to and 18 rejected by the jury. Although the judge found Cribl’s argument that the TAP contract was 19 improperly terminated because Cribl did not “become” a competitor colorable, the jury did not 20 agree based on its response to Special Interrogatory A (Dkt. No. 327 at 3). In light of that, this 21 order cannot reasonably find that Cribl has proven, by clear and convincing evidence, that it 22 was terminated from the TAP program in bad faith. Nor can this order reasonably find that 23 Cribl has proven, by clear and convincing evidence, that Splunk induced infringement and 24 breach on account of improper termination, as Cribl now argues, seeing that the jury rejected 25 Cribl’s argument that the termination was improper to begin with. 26 Third, as for copyright misuse, our court of appeals has recognized that it “forbids a 27 copyright holder from ‘secur[ing] an exclusive right or limited monopoly not granted by the 1 (quoting Lasercomb Am., Inc. v. Reynolds, 911 F.2d 970, 977–79 (4th Cir. 1990)). It thereby 2 “prevents copyright holders from leveraging their limited monopoly to allow them control of 3 areas outside the monopoly.” Ibid. True, our court of appeals has held that copyright misuse is 4 a “defense to copyright infringement” and “not a defense to [] state law claims.” Altera Corp. 5 v. Clear Logic, Inc., 424 F.3d 1079, 1090 (9th Cir. 2005). But Splunk is incorrect when it 6 suggests this means copyright misuse cannot be used to bar enforcement of language in a 7 licensing agreement that facilitates the misuse at issue. Indeed, “most of the cases that 8 recognize the affirmative defense of copyright misuse involve unduly restrictive licensing 9 schemes.” A & M Records, 239 F.3d at 1027 n.8. Incorporating unduly restrictive language 10 into a licensing agreement is how copyright holders generally secure an exclusive right or 11 limited monopoly not granted by the Copyright Office. Altera stands for the straightforward 12 proposition that “it makes little sense to allow [a party] to proceed on an independent claim for 13 copyright misuse when there has been no allegation of copyright infringement.” 424 F.3d 14 at 1090. 15 Cribl appears to invite this district court to broadly enter judgment in its favor under the 16 doctrine of copyright misuse. That cannot be right. Note the verdict is ambiguous concerning 17 the extent to which the jury found Cribl liable for breaching the SGT contract. On the one 18 hand, it might have found that several uses of the Splunk Enterprise copyrighted software by 19 Cribl violated the “internal business purposes” use restriction in Section 9(c) and monitoring 20 for competitive purposes use restriction in Section 9(e). On the other hand, it might have 21 found that only the marketing uses did so. In any event, it cannot be said that Cribl has 22 established that it should get off scot-free because some (but not all) of its uses of Splunk 23 Enterprise were fair uses, notwithstanding all language in the SGT contract. 24 A narrower case could have been made that copyright misuse bars enforcement of 25 language in that licensing agreement to the extent it would prohibit fair use. No court of 26 appeals has yet to extend copyright misuse to language that prohibits fair use specifically, 27 though some have come close. See, e.g., Assessment Techs. of WI, LLC v. WIREdata, Inc., 1 access to one’s uncopyrighted data within a copyrighted computer program by contract might 2 constitute copyright misuse). Recognizing that Cribl did not advance the argument, however, 3 and that any appeal will be to the Federal Circuit tasked with applying Ninth Circuit law on the 4 issue, this would be an inappropriate vehicle to seek the Ninth Circuit’s opinion on it. What’s 5 more, seeing that the injunction granted herein, as tailored, will afford Cribl the relief it could 6 have attained by way of copyright misuse, it is also immaterial. 7 2. SECTION 17200 CLAIM AND COUNTERCLAIM. 8 Next, we turn to Splunk’s claim and Cribl’s counterclaim under Section 17200 of the 9 California Business and Professions Code. 10 Starting with Splunk’s Section 17200 claim, at this late stage in the litigation, Splunk 11 sought to premise a violation only on Cribl’s breach of the SGT contract. Specifically, Splunk 12 argued that Cribl violated the unlawful and unfair prongs of Section 17200. With respect to 13 the unlawful prong, our court of appeals has held that breaches of contract alone are 14 insufficient to state a claim for unlawful violation of Section 17200. See, e.g., Shroyer v. New 15 Cingular Wireless Servs., 622 F.3d 1035, 1043–44 (9th Cir. 2010). Splunk averred that 16 systematic breaches of contract are sufficient, but the decisions it cited are distinguishable. As 17 a concession to the shortness of life, this order directs the reader to the reasons provided in 18 Cribl’s brief (Cribl Section 17200 Opp. 2–7). 19 Turning to the unfair prong, as Cribl recognizes, Splunk’s motion is replete with 20 decisions applying the traditional balancing test for claims brought by consumers. But “[t]he 21 California Supreme Court has rejected the traditional balancing test for [Section 17200] claims 22 between business competitors and instead requires that claims under the unfair prong be 23 ‘tethered to some legislatively declared policy.’” Hadley v. Kellogg Sales Co., 243 F. Supp. 3d 24 1074, 1104 (N.D. Cal. 2017) (Judge Lucy H. Koh) (quoting Cel-Tech Commc’ns, Inc. v. L.A. 25 Cellular Tel. Co., 973 P.2d 527, 544 (Cal. 1999)). “In competitor cases, a business practice is 26 ‘unfair’ only if it ‘threatens an incipient violation of an antitrust law, or violates the policy or 27 spirit of one of those laws because its effects are comparable to or the same as a violation of 1 Valley Bar Assn., 182 Cal. App. 4th 247, 254 (Cal. Ct. App. 2010) (quoting Cel-Tech, 973 P.2d 2 at 544). Here, however, Splunk has not sufficiently pleaded any incipient violation of antitrust 3 law, or violation of the policy or spirit of antitrust law, let alone any threat or harm to 4 competition, beyond mere generalizations. See Levitt v. Yelp! Inc., 765 F.3d 1123, 1136–37 5 (9th Cir. 2014). Rather, it has focused on harm to itself, a competitor (and an incumbent). 6 This is inadequate to state a claim for unfair violation of Section 17200. 7 As for Cribl’s Section 17200 counterclaim, Cribl seeks to premise an unfair violation on 8 copyright misuse. This order finds a Section 17200 claim can be premised on copyright 9 misuse where that copyright misuse violates the policy or spirit of antitrust law. See Apple Inc. 10 v. Psystar Corp., No. C 08-03251 WHA, 2009 WL 303046, at *5 (N.D. Cal. Feb. 6, 2009). In 11 light of the issues raised above, however, and seeing that the tailored injunction granted herein 12 has the effect of affording Cribl the relief that Cribl could have attained under the 13 counterclaim, this order does not address it further. 14 Before turning to injunctive relief, this order observes that Cribl has recently sought to 15 broadly recast its affirmative defenses and counterclaim based on the judge’s recent decision in 16 another matter in which a party asserted a copyright preemption defense (see, e.g., Cribl Supp. 17 Br. 1 (quoting X Corp. v. Bright Data Ltd., No. C 23-03698 WHA, 2024 WL 2113859, at *13 18 (N.D. Cal. May 9, 2024)). This is too little too late. “Cribl, mindful of the Court’s request that 19 [it] be selective in choosing which of its equitable defenses and counterclaims to pursue with 20 the Court, [] narrowed its requests for determination” (Cribl Br. 1). In doing so, it deliberately 21 “preserve[d] and assert[ed] its copyright preemption defense . . . to the extent it applie[d] to 22 Splunk’s pending claim of violation of California’s [Section 17200]” (Cribl Br. 21). This order 23 declines to allow Cribl to strategically pivot and try again after the fact. That said, it observes 24 that Cribl’s general concerns will be addressed in the injunctive relief analysis below. 25 3. INJUNCTIVE RELIEF. 26 Finally, this order takes up Splunk’s motion for a permanent injunction, premised on the 27 jury’s findings of copyright infringement and breach of the SGT contract (not Splunk’s failed 1 Section 17200 claim). The question that remains to be decided is whether injunctive relief is 2 appropriate and, if so, the scope of that injunctive relief. 3 As for the standard, 4 Under the Copyright Act . . . a court is authorized to grant a permanent injunction “on such terms as it may deem reasonable to 5 prevent or restrain” further infringement of a copyright . . . . Such relief, however, does not automatically issue upon a finding of 6 liability. Rather, a plaintiff must show entitlement to a permanent injunction by demonstrating: (1) that it has suffered an irreparable 7 injury; (2) that remedies available at law, such as monetary damages, are inadequate to compensate for that injury; (3) that, 8 considering the balance of hardships between the plaintiff and defendant, a remedy in equity is warranted; and (4) that the public 9 interest would not be disserved by a permanent injunction. 10 Apple Inc. v. Psystar Corp., 673 F. Supp. 2d 943, 948 (N.D. Cal. 2009), aff’d, 658 F.3d 1150 11 (9th Cir. 2011) (citing eBay Inc. v. MercExchange, L.L.C., 547 U.S. 388, 391 (2006)). Under 12 California law, the same four-factor analysis has been used to enjoin breaches of contract 13 where remedies at law were inadequate. See, e.g., Nat’l Abortion Fed’n v. Ctr. for Med. 14 Progress, 533 F. Supp. 3d 802, 811 (N.D. Cal. 2021) (Judge William H. Orrick), aff’d, No. 21- 15 15953, 2022 WL 3572943 (9th Cir. Aug. 19, 2022). This order evaluates injunctive relief for 16 both copyright infringement and breach of the SGT contract using the eBay factors. 17 At the outset, it bears emphasis that Section 9(a) of the SGT contract prohibited “reverse 18 engineering (except to the extent specifically permitted by statutory law),” as explained in the 19 final charge for the second phase of argument and deliberations (Dkt. No. 317 at 6–7). And, as 20 explained in the companion memorandum opinion on fair use, Section 107 of the Copyright 21 Act allowed copying and uses of the Splunk Enterprise copyrighted software for the purpose of 22 reverse engineering the S2S protocol. It also allowed copying and uses of the Splunk 23 Enterprise copyrighted software for the purposes of testing and troubleshooting Cribl Stream 24 for interoperating with the Splunk Enterprise copyrighted software. 25 One question teed up by the briefing of the motion for a permanent injunction is whether 26 the SGT contract’s use restrictions governing “internal business purposes” (in Section 9(c)) 27 and monitoring for competitive purposes (in Section 9(e)) could override and disallow those 1 interpretation, this order finds they cannot. Why go through the trouble of spelling out how the 2 SGT contract preserved the extent to which statutory law protects reverse engineering if such 3 restrictions could override and disallow this anyways? Meanwhile, copying and using Splunk 4 Enterprise to reverse engineer the S2S protocol, as required to viably interoperate Cribl Stream 5 with Splunk Enterprise, accomplishes nothing if Cribl cannot copy and use Splunk Enterprise 6 to test and troubleshoot Cribl Stream for maintaining the interoperability. Such ambiguity in 7 the SGT contract will be resolved against the drafter, Splunk, so as to ultimately allow all 8 statutory fair uses of Splunk Enterprise. Keep in mind, however, that copying and using 9 Splunk Enterprise to market Cribl Stream was not and is not a statutory fair use. 10 The verdict is ambiguous concerning the extent to which the jury found Cribl liable for 11 infringing Splunk’s copyright. And, as already mentioned, it is all the more ambiguous 12 concerning the extent to which the jury found Cribl liable for breaching the SGT contract. On 13 the one hand, it might have found that several uses of Splunk Enterprise by Cribl violated the 14 “internal business purposes” and monitoring for competitive purposes use restrictions. On the 15 other hand, it might have found that only the marketing uses did so. Assuming, arguendo, the 16 broadest possible finding of liability (contrary to the interpretation above), this order holds that 17 an injunction is warranted but the balance of the hardships as well as the public interest militate 18 against the broadest possible injunction. 19 With respect to irreparable injury, this order credits Splunk’s observation that 20 “[p]ermitting Cribl to continue operating as if it possessed a TAP license, and to indefinitely 21 flout the scope of the SGT and Sections 9(c) and 9(e) in particular, would render both Splunk’s 22 TAP program and the SGT pointless” (Splunk Injunction Br. 13–14). Just because certain uses 23 of the Splunk Enterprise copyrighted software are fair uses under the Copyright Act does not 24 mean that Splunk must relinquish all control of its copyrighted software, as Cribl appears to 25 suggest. Likewise, with respect to inadequate remedies at law, this order credits Splunk’s 26 observation that no monetary remedy can restore Splunk’s ability to administer its own 27 licensing program, which is basically essential to being a contemporary software company 1 (Splunk Injunction Br. 16). As such, the first two eBay factors strongly favor an injunction. 2 But the remaining two eBay factors strongly favor a narrower one. 3 With respect to the balance of the hardships, a consideration that weighs heavily against 4 Splunk is the whole history of its TAP “partnership” program and how that program led Cribl, 5 as a “partner,” to invest many millions in developing its product that extended the features and 6 functionality of Splunk Enterprise only for Splunk to then pull the rug out from under it. After 7 all, the jury found that Splunk terminated Cribl’s TAP membership not on account of breaches 8 of confidentiality obligations and misappropriation, as Splunk had argued, but rather on 9 account of competition, according to Special Interrogatories A and B (Dkt. No. 327 at 3). 10 Originally, Splunk welcomed Cribl as a TAP partner specifically to develop a complementary 11 product like Cribl Stream, and the TAP contract expressly acknowledged that the parties could 12 cooperate to develop complementary products that were “competitive,” i.e., to engage in 13 “coopetition.” So, Cribl built its product and operated as a TAP partner from October 2018 to 14 November 2021. 15 During the last fifteen months of that partnership period, however, Splunk’s internal 16 documents showed that Splunk was planning to terminate Cribl as a partner as soon as Splunk 17 could improve its own inferior product (DSP) that it was developing to compete with Cribl 18 Stream, which it finally did (after releasing Ingest Actions) in November 2021. Throughout 19 that time, Cribl continued to invest in Cribl Stream, unaware of Splunk’s termination plan. In 20 other words, this was not a case of a copyright pirate selling knockoffs. This was a case of a 21 “partner” being invited in by a copyright owner to use the copyrighted work, and to invest 22 millions in designing and developing a complementary product, only to be terminated after all 23 that effort was made. There is a large equity point on the scale favoring the terminated partner, 24 Cribl. The sweeping injunction sought by Splunk could easily put Cribl out of business. 25 With respect to the public interest, Cribl Stream has been favorably received by 26 customers. Dr. Chris Mattman, a witness who worked at the NASA Jet Propulsion Laboratory, 27 which is a customer of both Splunk and Cribl, praised its performance on the stand. The trial 1 data to make room in Splunk Enterprise for useful data, a win for customers (and often Splunk 2 too). In addition, the jury found Cribl Stream’s S2S capability reflected a “transformative use” 3 of Splunk Enterprise that benefited the public. A sweeping injunction would disserve the 4 public by preventing Cribl from continuing to viably interoperate with Splunk Enterprise 5 moving forward. Customers will need updates to account for changes made to Splunk 6 Enterprise and the S2S protocol. This, too, weighs against a sweeping injunction. 7 In evaluation of the eBay factors and, in particular, the balance of the hardships and the 8 public interest — all arising out of the course of dealing and history of Splunk and Cribl, the 9 “partnership” program, and this court case — this order finds that the appropriate course is to 10 allow Cribl to continue using the Splunk Enterprise copyrighted software for all fair uses under 11 the Copyright Act but to enjoin Cribl from other uses, including uses for marketing purposes. 12 The parties shall meet and confer to provide terms outlining a mechanism for enforcement of 5 13 this injunction, which may include depositions and site visits, by JUNE 4, 2024, AT NOON. The 14 parties shall also jointly file a proposed judgment that covers all issues addressed in this action 3 15 at that time. a 16 IT IS SO ORDERED. ll Datea: May 24, 2024. 19 ILLIAM ALSUP 21 UNITED STATES DISTRICT JUDGE 22 23 24 25 26 27 28