Oracle Corp. v. SAP AG

734 F.Supp.2d 956 (2010)

ORACLE CORPORATION, et al., Plaintiffs,
v.
SAP AG, et al., Defendants.

No. C 07-1658 PJH.

United States District Court, N.D. California.

August 17, 2010.

Donn P. Pickett, Bree Hann, Geoffrey M. Howard, Tanya King Dumas, Zachary J. Alinder, Bingham McCutchen LLP, Chad Lawrence Russell, Holly A. House, McCutchen Doyle Brown Enersen LLP, Christopher D. Jensen, Barg Coffin Lewis & Trapp LLP, San Francisco, CA, Jennifer Wysong Gloss, Oracle USA, Inc., Dorian Estelle Daley, Redwood City, CA, for Plaintiffs.

Jane Louise Froyd, Tharan Gregory Lanier, Jones Day, Palo Alto, CA, Robert Allan Mittelstaedt, Elaine Wallace, Jason S. McDonell, Jones Day, San Francisco, CA, Joshua Lee Fuchs, Jones Day, Scott Wagner Cowan, Houston, TX, for Defendants.

ORDER RE MOTIONS FOR PARTIAL SUMMARY JUDGMENT

PHYLLIS J. HAMILTON, District Judge.

The parties' motions for partial summary judgment came on for hearing before this court on May 5, 2010. Plaintiffs appeared by their counsel Geoffrey Howard, Donn Pickett, Chad Russell, Holly House, Amy Donnelly, Zachary Alinder, and John Polito. Defendants appeared by their counsel Tharan Gregory Lanier, Elaine Wallace, and Jane Froyd. Having read the parties' papers and carefully considered their arguments, and the relevant legal authority, the court hereby GRANTS the motions in part and DENIES them in part.

BACKGROUND

Plaintiffs in this action are Oracle USA, Inc. ("Oracle USA"^[1]); Oracle International Corporation ("OIC"); Oracle EMEA Ltd. ("OEMEA"); and Siebel Systems, Inc. ("Siebel") (collectively, "Oracle" or "plaintiffs"). Oracle USA is the successor to PeopleSoft USA, Inc. ("PeopleSoft") and the successor in interest to certain PeopleSoft, J.D. Edwards ("JDE"), and Siebel entities. Plaintiffs allege that intellectual property rights formerly held by PeopleSoft, JDE, and Siebel entitles were transferred to OIC as part of the acquisition of PeopleSoft and Siebel by Oracle; and that OEMEA is also the successor in interest to certain PeopleSoft and JDE entities.

Defendants are SAP AG ("SAP AG"); SAP America, Inc. ("SAP America"); and TomorrowNow, Inc. ("SAP TN") (collectively "SAP" or "defendants"). SAP America is a wholly-owned subsidiary of SAP AG, and SAP TN is a wholly-owned subsidiary of SAP America.

The fourth amended complaint assert ten causes of action against the three defendants: (1) copyright infringement, alleged by OIC; (2) violations of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. §§ 1030(a)(2)(C), 1030(a)(4), & 1030(a)(5)(A), alleged by Oracle USA and OIC; (3) violations of the California Data Access and Fraud Act ("CDAFA"), Cal. Penal Code § 502(c)(7), alleged by Oracle USA and OIC; (4) breach of contract, alleged by Oracle USA; (5) intentional interference with prospective economic advantage, alleged by Oracle USA, OIC, and OEMEA; (6) negligent interference with prospective economic advantage, alleged by Oracle USA, OIC, and OEMEA; (7) unfair competition, under Cal. Bus. & Prof. Code § 17200 ("UCL"), alleged by Oracle USA, OIC, OEMEA, and Siebel; (8) trespass to chattels, alleged by Oracle USA; (9) unjust enrichment and restitution, alleged by Oracle USA, OIC, OEMEA, and Siebel; and (10) entitlement to an accounting, alleged by Oracle USA, OIC, OEMEA, and Siebel.

On March 3, 2010, each side filed a motion for partial summary judgment. Plaintiffs sought a ruling that SAP TN directly infringed OIC's copyrights;^[2] that SAP AG and SAP America are liable for vicarious and contributory infringement; and that SAP TN violated the CFAA and the CDAFA. Defendants sought a ruling that OEMEA's California claims should be dismissed; that plaintiffs could not recover damages incurred by related non-parties; that "saved development costs" are an impermissible measure of damages; and that plaintiffs could not recover under claims for which they did not disclose damage calculations.

In their opposition to plaintiffs' motion, defendants conceded SAP TN's liability for direct infringement of the three PeopleSoft (HRMS) registrations for the period beginning March 1, 2005, and the three Oracle Database registrations with no time limitation; as well as SAP AG's and SAP America's vicarious liability for infringement of the six registrations over the same time period. Defendants also conceded SAP TN's liability for violations of CFAA § 1030(a)(2)(C) and CDAFA.

On August 5, 2010, the parties filed their trial briefs and the joint pretrial statement. Based on those filings, the court requested that the parties submit a joint statement clarifying which, if any, of the issues disputed in the motions for partial summary judgment had been resolved and need not be addressed by the court.

In response, the parties filed a statement indicating that they had met and conferred, and that they agreed that plaintiffs were entitled to summary judgment as to the issues of direct copyright infringement of the six registrations by SAP TN, as indicated above; vicarious copyright infringement of the six registrations by SAP AG and SAP America; direct liability of SAP TN for violations of CFAA § 1030(a)(2)(C); and direct liability of SAP TN for violations of CDAFA.

The parties agreed that certain other issues were ripe for decision—the contributory copyright infringement of the six registrations by SAP AG and SAP America; the indirect liability of SAP AG and SAP America for CFAA and CDAFA violations; the availability of "saved costs" as a measure of damages in this case; the availability of lost profits of related nonparty entities in this case; and the limitation of damages under CDAFA, if at all, to no more than plaintiffs' alleged "investigation costs."

Finally, the parties were unable to reach agreement as to whether defendants' concessions had mooted the following issues: the direct liability of SAP TN for violations of CFAA § 1030(a)(5)(A)(i)-(iii); the availability of damages for trespass to chattels and CDAFA claims; the dismissal of OEMEA's claims; and the dismissal of the pre-March 1, 2005 copyright infringement claims for the PeopleSoft/JDE registrations based on lack of standing.

DISCUSSION

A. Legal Standard

Summary judgment is appropriate when there is no genuine issue as to material facts and the moving party is entitled to judgment as a matter of law. Fed. R.Civ.P. 56. Material facts are those that might affect the outcome of the case. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). A dispute as to a material fact is "genuine" if there is sufficient evidence for a reasonable jury to return a verdict for the nonmoving party. Id.

A party seeking summary judgment bears the initial burden of informing the court of the basis for its motion, and of identifying those portions of the pleadings and discovery responses that demonstrate the absence of a genuine issue of material fact. Celotex Corp. v. Catrett, 477 U.S. 317, 323, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). Where the moving party will have the burden of proof at trial, it must affirmatively demonstrate that no reasonable trier of fact could find other than for the moving party. Southern Calif. Gas. Co. v. City of Santa Ana, 336 F.3d 885, 888 (9th Cir.2003). The court must not weigh the evidence or determine the truth of the matter but only determine whether there is a genuine issue for trial. See Balint v. Carson City, 180 F.3d 1047, 1054 (9th Cir. 1999).

On an issue where the nonmoving party will bear the burden of proof at trial, the moving party can prevail merely by pointing out to the district court that there is an absence of evidence to support the nonmoving party's case. Celotex, 477 U.S. at 324-25, 106 S.Ct. 2548. If the moving party meets its initial burden, the opposing party must then set forth specific facts showing that there is some genuine issue for trial in order to defeat the motion. See Fed. R.Civ.P. 56(e); Anderson, 477 U.S. at 250, 106 S.Ct. 2505.

B. Plaintiffs' Motion

1. SAP TN's Liability for Direct Infringement

To prove a claim of direct copyright infringement, a plaintiff must show that he owns the copyright and that the defendant himself violated one or more of the plaintiff's exclusive rights under the Copyright Act. See 17 U.S.C. § 501(a); Ellison v. Robertson, 357 F.3d 1072, 1076 (9th Cir. 2004). Only a "legal or beneficial owner of an exclusive right under a copyright is entitled ... to institute an action for any infringement of that right while he or she is the owner of it." 17 U.S.C. § 501(b); see also Sybersound Records, Inc. v. UAV Corp., 517 F.3d 1137, 1144 (9th Cir.2008); Silvers v. Sony Pictures Entm't, Inc., 402 F.3d 881, 884-85 (9th Cir.2005).

The parties dispute whether OIC qualifies as the owner of the three HRMS copyrights at issue during the pre-March 1, 2005 period. The evidence provided by plaintiffs shows that PeopleSoft obtained valid registrations for the three copyrights within five years of publication. On March 1, 2005, PeopleSoft and the various JDE entities merged into Oracle Systems Corporation ("OSC"), with OSC surviving the merger. The merger agreements were recorded with the Delaware Secretary of State as of that same date. The evidence shows further that on March 1, 2005, the PeopleSoft registrations were transferred to OIC. The PeopleSoft/JDE/OIC asset transfer agreement was recorded in the Copyright Office on August 12, 2008.

On July 10, 2009, pursuant to an "IP Rights Transfer Clarification Agreement," OSC transferred to OIC all of its rights to sue for past infringement of the transferred copyrights. This agreement states that "at the time of the transfer of the PeopleSoft/JDE Assets and the JDE IP Assets to OIC [March 1, 2005], the parties intended that all of the IP Rights (as defined herein) be transferred to OIC, effective as of the Effective Date[.]" The "IP Rights" include "all rights to sue for or otherwise enforce past, present, and future infringement claims with respect to the IP Assets ..."

In their opposition and "cross-motion," defendants argue that OIC does not have standing to sue for pre-March 1, 2005 infringement of any PeopleSoft/JDE copyrights, because prior to that date, OIC did not own the registrations. Thus, defendants assert, OIC may sue for pre-March 1, 2005 infringement only if it received a valid transfer of the right to pursue those claims at the time of the mergers.

The general rule is that a general transfer or assignment of "exclusive rights" does not convey accrued causes of action, because the right to sue for an accrued claim is not an exclusive right under § 106 of the Copyright Act. Silvers, 402 F.3d at 884. Such preexisting causes of action must be expressly included in the assignment or transfer. ABKCO Music, Inc. v. Harrisongs Music, Ltd., 944 F.2d 971, 980 (2nd Cir.1991); Co-opportunities, Inc. v. National Broadcasting Co., Inc., 510 F.Supp. 43, 46-47 (N.D.Cal.1981).

However, accrued claims may also be transferred, either in the assignment/transfer agreement itself, or in a separate agreement, Co-opportunities, 510 F.Supp. at 46-48, and the weight of authority holds that a document executed subsequent to the transfer may effectively convey to the transferee the right to sue for infringements occurring prior to the transfer, even where the subsequent assignment of the right to sue was executed after the commencement of litigation by the transferee. See, e.g., Wade Williams Distribution, Inc. v. American Broadcasting Co., Inc., 2005 WL 774275 at *3-4 (S.D.N.Y., Apr. 5, 2005); Intimo, Inc. v. Briefly Stated, Inc., 948 F.Supp. 315, 317-19 (S.D.N.Y.1996); Infodek, Inc. v. Meredith-Webb Printing Co., Inc., 830 F.Supp. 614, 620 (N.D.Ga.1993); Co-opportunities, 510 F.Supp. at 46-47; see also 2 Patry on Copyright (2010) § 5:113 (and cases cited therein).

The Ninth Circuit provides no clear guidance on this issue. In Intimo, a case that has been cited for this point by a number of courts, the original owner of the copyrights assigned them to the plaintiff six months before the plaintiff filed suit for copyright infringement that was alleged to have occurred both before and after the assignment. A year after the complaint was filed, the plaintiff submitted an amended assignment, which stated that the intent of the original owner when it assigned its copyright was also to assign its cause of action to the plaintiff. The court found that the amended assignment was effective and that the plaintiff had standing to sue for infringement that allegedly occurred before the first assignment. Intimo, 948 F.Supp. at 318-19. The court concluded that "an assignment of interest should be recognized provided the assignment occurs before trial, the plaintiff is the real party in interest in at least one other claim, and the defendant suffers no prejudiced from its recognition." Id. at 318.

Here, in line with the above-described analysis, the court notes that the assignment of the right to sue for past infringement was executed on July 10, 2009, more than a year before the scheduled trial date. In addition, there appears to be no dispute that OIC is the real party in interest with regard to the infringements that occurred after the March 1, 2005 merger and transfer of copyrights. Finally, although defendants have not addressed this particular issue from this perspective, the court sees no prejudice to defendants, in view of the facts that the parties have conducted discovery on the substantive issues in this case, discovery has closed, and the assignment will not change the issues to be litigated at trial.

Accordingly, defendants' cross-motion for summary judgment of non-infringement based on pre-March 1, 2005 conduct with regard to the PeopleSoft/JDE registrations at issue is DENIED. In addition, however, because it is not clear to the court that OIC has established infringement during the pre-March 1, 2005 period, and because defendants' concession with regard to the claim of direct infringement by SAP TN appears to have been limited to the post-March 1, 2005 period, plaintiffs' motion for summary judgment as to any such pre-March 1, 2005 infringement claims is DENIED. Based on defendants' concessions, the motion is GRANTED as to plaintiffs' claim of direct infringement of the three HRMS registrations by SAP TN post-March 1, 2005, and as to the three Database registrations by SAP TN without time limitation.

2. SAP AG's and SAP America's Liability for Contributory Infringement

Plaintiffs argue that SAP AG and SAP America are liable for vicarious and contributory infringement of OIC's copyrights. A defendant may be liable as a contributory copyright infringer if he "with knowledge of the infringing activity, induces, causes or materially contributes to the infringing conduct of another." Ellison, 357 F.3d at 1076 (citation and quotation omitted). The Ninth Circuit interprets the knowledge requirement for contributory copyright infringement to include both those with actual knowledge and those who have reason to know of direct infringement. Id.; see also Fonovisa, Inc. v. Cherry Auction, Inc., 76 F.3d 259, 264 (9th Cir.1996) (contributory infringement "imposes liability where one person knowingly contributes to the infringing conduct of another").

Plaintiffs contend that SAP AG and SAP America knew about SAP TN's copying of Oracle's software, even before SAP acquired TomorrowNow, and that SAP AG and SAP America also knew about SAP TN's use of the database software. Plaintiffs assert that SAP AG and SAP America exercised control over SAP TN following SAP's acquisition of Tomorrow Now, which SAP announced on January 19, 2005. Finally, plaintiffs claim that SAP AG admitted it enjoyed significant financial and strategic benefits from SAP TN's allegedly illegal business model.

In response, defendants argue that plaintiffs' motion should be denied because they have no evidence that SAP AG or SAP America took any specific, affirmative steps that actively contributed to infringement. Defendants assert that one cannot induce, cause, or materially contribute to infringement through mere inaction. It is this, according to defendants, that distinguishes "contributory" liability from "vicarious" liability.

The court finds that the motion must be DENIED. While mere knowledge of infringing conduct is insufficient to show contributory infringement, inaction can in some cases constitute material contribution. See, e.g., Ellison, 357 F.3d at 1076-78. Here, the court finds that triable issues exist with regard to the extent of SAP AG's and SAP America's knowledge of the alleged infringement; with regard to whether SAP AG or SAP America induced, caused, or materially contributed to the alleged infringement; and also with regard to the extent of any actual involvement by SAP AG or SAP America in any copying that was performed by SAP TN.

3. SAP TN's Liability for Violation of the CFAA

Plaintiffs argue that SAP TN violated the CFAA, 18 U.S.C. §§ 1030(a)(2)(C) and 1030(a)(5)(A)(i)-(iii).

Subsection (a)(2) of CFAA § 1030 provides that whoever

(a)(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—

(A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.);

(B) information from any department or agency of the United States; or

(C) information from any protected computer if the conduct involved an interstate or foreign communication ... shall be punished as provided in subsection (c) of this section.

18 U.S.C. § 1030(a)(2)(2007) (emphasis added).

Subsection (a)(5)(A) of CFAA § 1030 provides that whoever

(a)(5)(A)(i) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

(ii) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or

(iii) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage;...

shall be punished as provided in subsection (c) of this section.

18 U.S.C. § 1030(a)(5)(A)(2007) (emphasis added).^[3]

As indicated above, defendants have conceded that SAP TN violated CFAA § 1030(a)(2)(C). Thus, the only issue for decision as to SAP TN's liability under CFAA is with regard to § 1030(a)(5)(A)(i)(iii).

In order to establish a violation of subsection (i), plaintiffs must show that SAP TN "knowingly cause[d] the transmission of a program, information, code, or command." Plaintiffs argue that SAP TN was fully aware of its illegal Titan and post-MED downloading and the resulting harm to Oracle. Similarly, with regard to all three subsections, plaintiffs must show that SAP TN caused "damage" to Oracle, and for subsection (ii), acted "recklessly."

Plaintiffs claim that the evidence shows at least three different types of damage from SAP TN's illegal downloading—the downloading took so much bandwidth that it impaired the ability of customers to separately log in to Oracle's system; the same downloading also skewed customer support data that Oracle uses to improve its customer support experience, making that data useless for its intended purpose; and the access and use of Oracle's confidential support materials, including the use of scrapers to access internal Oracle files, for use in competition with Oracle and in violation of the Terms of Use, also impaired the integrity and confidentiality of that data.

In opposition, defendants contend that plaintiffs are not entitled to summary judgment on these claims because there is no evidence that their computers suffered "damage," and there is no evidence of any "intent to damage."

First, defendants assert that a showing of "damage" requires more than a showing that a defendant copied data from a plaintiff's website—rather, a plaintiff must establish that the defendant's activities impaired the "integrity" or the "availability" of the defendant's data or systems, such that existing data was corrupted or delayed, or the servers crashed.

Here, defendants contend, there is no evidence that SAP TN's downloading caused "damage" to plaintiffs' servers. They argue that plaintiffs' claim that SAP TN's use of Titan impaired Oracle's customers' ability to log onto Oracle's customer support websites relies entirely on speculation about what might have happened. They also contend that "skewed customer feedback" is not cognizable "damage."

Defendants argue further that "impairment" to the confidentiality of plaintiffs' materials is not cognizable "damage." They note that "accessing" and "using" confidential information on plaintiffs' support websites does not result in "damage" under the CFAA, because it does not result in the corruption or deletion of existing data—which is what defendants assert is typically required to show "damage" under the CFAA. They argue that mere copying does not constitute "damage" because it does not "impair" data.

Similarly, defendants argue, plaintiffs have failed to demonstrate that defendants acted with an "intent to damage" Oracle's computers. They argue that simply asserting that the downloading or access was intentional is not sufficient—plaintiffs must allege and prove that SAP TN specifically "intended" to "cause damage." In the absence of this proof, defendants argue, plaintiffs' motion as to the (a)(5)(A)(i) claim should be denied.

The court finds that the existence of triable issues precludes summary judgment, and that the motion must therefore be DENIED. For example, the evidence is inconclusive as to whether the alleged copying constitutes "impairment to the integrity or availability of data, a program, a system, or information" that caused a loss aggregating at least $5000 in value during a one-year period. 18 U.S.C. § 1030(e)(8).

The evidence presented does not clearly establish that SAP TN's copying of plaintiffs' files caused any slowdowns, disruptions in service, crashes, or other impairments to the availability or accessibility of the systems or data; that SAP TN's access or downloading activities ever changed, altered, deleted, or destroyed any data, programs, systems, or other information on Oracle's customer support websites, or resulted in any other type of damage to the computer system or data; or that Oracle's systems were compromised as a result of SAP TN's activities.

Similarly, the evidence is inconclusive as to whether any "damage" was "intentional." Undoubtedly any copying of plaintiffs' files was deliberate; it is not clear, however, whether in copying the files, SAP TN intended to cause "damage."

a. Indirect Liability of SAP AG and SAP America for CFAA/CDAFA violations

Plaintiffs argue that under the law of agency, SAP AG and SAP America are just as liable for the CFAA violations as SAP TN, because of the nature and extent of the control exercised over SAP TN by SAP AG and SAP America.

Plaintiffs contend that SAP AG and SAP America admit that they had control of SAP TN's management, and that through SAP TN, they assumed complete responsibility for maintenance, service, and support of Oracle's applications, which included the downloading referenced above. Plaintiffs assert that SAP TN admits that its downloading from Oracle's website was an "urgent step" in providing its service offering—according to plaintiffs, the very offering for which SAP AG and SAP America marketed SAP TN in an effort to win Oracle's customers.

To prove a violation of § 1030(a)(2)(C), plaintiffs must show that SAP AG and/or SAP America accessed a "protected computer," that the access was done "intentionally," that the access was "without authorization" or "exceeded authorized access," that SAP TN thereby obtained information, and that there was resulting damage to plaintiffs aggregating at least $5000 in a one-year period. See 18 U.S.C. §§ 1030(a)(2)(C), 1030(a)(5)(b)(1), 1030(g).^[4]

Under CFAA § 1030(e) (definitions), the term "computer" means

an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device;

and the term "protected computer" means

a computer—

(A) exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government and the conduct constituting the offense affects that use by or for the financial institution or the Government; or

(B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States;

18 U.S.C. § 1030(e)(1), (e)(2)(2007).

Defendants argue that SAP AG and SAP America are not indirectly liable under the CFAA or CDAFA for SAP TN's allegedly wrongful conduct. First, with regard to CFAA, defendants contend that contrary to plaintiffs' position, broad agency principles do not trigger liability under CFAA's civil remedy provision. They argue that CFAA imposes liability only where a defendant has actually directed the wrongful acts.

The CFAA was enacted as a criminal statute in 1984 to "enhance the government's ability to prosecute computer crimes." LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1130 (9th Cir.2009). In 1994, a provision was added allowing the filing of a civil action:

Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B)....

18 U.S.C. § 1030(g)(2007). The factors set forth in § 1030(a)(5)(B)(i)-(v) are

(i) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value;

(ii) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals;

(iii) physical injury to any person;

(iv) a threat to public health or safety; or

(v) damage affecting a computer system used by or for a government entity in furtherance of the administration of justice, national defense, or national security....

18 U.S.C. § 1030(a)(5)(B).

By its terms, therefore, subsection (g) provides a civil remedy "against the violator." Defendants assert that "the violator" is the person who violated the statute with the requisite criminal intent, and that the CFAA does not provide a cause of action against individuals who fail to supervise violators, fail to train them properly, or conspire to cover up their conduct.

Defendants argue that given the plain language of § 1030(g) and the predominately criminal nature of the statute, courts have expressly limited the scope of civil liability, and have imposed indirect liability on defendants only where it was clear that they directed the allegedly wrongful acts. Defendants argue in addition that even if agency-liability principles were applicable, the appropriate standard would be based on federal common law agency rules, not on the state law agency rules cited by plaintiffs. Under federal common law agency rules, a plaintiff seeking to demonstrate parent-subsidiary agency liability must show a manifestation by the principal that the agent shall act for him; that the agent has accepted the undertaking; and that there is an understanding between the parties that the principal is to be in charge of the undertaking. See Restatement (Third) of Agency, § 2.03 (2006); see also Bowoto v. Chevron Texaco Corp., 312 F.Supp.2d 1229, 1239-40 (N.D.Cal.2004) (plaintiff "must" establish these elements).

Here, defendants argue, plaintiffs have pointed to no evidence in the record showing that SAP AG and SAP America directed SAP TN to take any of the improper actions. They note that plaintiffs claim that SAP TN violated the CFAA by accessing Oracle customer support websites to develop and test Titan, after a customer's maintenance end date. To hold SAP AG and SAP America liable, defendants argue, plaintiffs must show that they "directed" SAP TN to access Oracle's support system.

Defendants contend that plaintiffs have pointed to SAP AG's and SAP America's control over SAP TN's support activities— but have not shown that SAP AG or SAP America "directed" any particular wrongful action, must less the particular alleged acts. In addition, they assert, it is irrelevant that access-related issues were "discussed" with SAP AG or SAP America, or that they "continued to allow" this access, as plaintiffs argue. Defendants assert that the CFAA imposes liability only for committing CFAA violations, or for directing such violations—it does not create a duty to prevent CFAA violations.

Moreover, defendants contend, SAP AG's and SAP America's ability to issue directives—as evidenced by the directive that SAP TN remove software copies from its computers—does not establish that SAP AG or SAP America actually directed SAP TN's alleged improper access in the first place. Finally, they assert that it makes no difference that SAP TN's downloading activities may have been an "urgent step" in its service offering, because plaintiffs cite no evidence showing that SAP AG or SAP America directed SAP TN to take that "step."

With regard to the CDAFA claim, defendants argue that plaintiffs' motion cannot reasonably be considered a motion for summary judgment under the CDAFA. They note that plaintiffs' motion exclusively addresses SAP TN's alleged liability under the CFAA, referencing direct liability under the CDAFA only in a footnote; and that with regard to the claim of indirect liability as to SAP AG and SAP America, plaintiffs do not even go so far as to include it in the footnote.

Moreover, defendants argue, as with the CFAA, the criminal nature of the CDAFA statute and the text of its civil remedy provision indicate that indirect liability should apply only where there is evidence that the defendant "directed" the alleged unlawful action (comparing Cal.Penal Code § 502(e)(1) with 18 U.S.C. § 1030(g)). They assert that even if state law agency principles applied in the context of the state-law CDAFA claim, summary judgment would still be inappropriate because California law considers agency to be a question of fact that should not typically be decided on summary judgment.

The court finds that the existence of triable issues precludes summary judgment, and that the motion for summary judgment as to SAP AG's and SAP America's indirect liability under CFAA (or, to the extent that plaintiffs also seek summary judgment as to the CDAFA claim) must therefore be DENIED. Because the CFAA has both criminal and noncriminal applications, the court finds that the statute should be construed narrowly, as opposed to broadly. See, e.g., LVRC Holdings, 581 F.3d at 1134-35 (where a statute has both criminal and noncriminal applications, courts should interpret the statute consistently in both contexts; ambiguity concerning ambit of criminal statutes should be resolved in favor of lenity) (quotations and citations omitted); see also Shamrock Foods Co. v. Gast, 535 F.Supp.2d 962, 966-67 (D.Ariz. 2008).

As an initial matter, plaintiffs have not established that either SAP AG or SAP America is a "violator" under the CFAA. In addition, plaintiffs have not established liability under agency principles. Federal common law controls with regard to federal claims such as the CFAA. See, e.g., Sun Microsystems, Inc. v. Hynix Semiconductor, Inc., 622 F.Supp.2d 890-99 (N.D.Cal. 2009). Here, plaintiffs have not shown any manifestation by SAP AG or SAP America that SAP TN act on their behalf; have not established that SAP TN accepted this undertaking; and have not established that there was an understanding among the defendants that SAP AG or SAP America was to be in charge of the undertaking. Plaintiffs simply assert that SAP TN's downloading was within the scope of SAP TN's authority as agent for SAP AG and SAP America, but this is not sufficient to establish liability under the federal common law of agency.

C. Defendants' Motion

Defendants seek a ruling that OEMEA's California claims should be dismissed; that plaintiffs may not recover damages incurred by related non-parties; that "saved development costs" are an impermissible measure of damages, for both the non-copyright claims and the copyright claims; and that plaintiffs may not recover under claims for which they did not disclose damage calculations.

1. OEMEA's California claims

OEMEA is an Irish private limited company with its principal place of business in Ireland, and which has software distribution rights in Europe, the Middle East, and Africa. OEMEA asserts state law claims of intentional and negligent interference with prospective economic advantage, unfair competition, unjust enrichment/restitution, and entitlement to an accounting, against all defendants.

Defendants argue that OEMEA's claims fail as a matter of law because California does not provide a remedy for non-residents alleging injuries caused by out-of-state conduct, and because applying California law to extraterritorial claims runs afoul of the due process clause of the U.S. Constitution.

The court finds that the motion must be GRANTED, as plaintiffs have failed to show the required California nexus. In general, "a court should not ordinarily construe a statute as regulating occurrences outside the state unless a contrary intention is clearly expressed or reasonably can be inferred from the language or purpose of the statute." J.P. Morgan & Co., Inc. v. Superior Court, 113 Cal.App.4th 195, 221, 6 Cal.Rptr.3d 214 (2003) (citing Norwest Mortgage, Inc. v. Superior Court, 72 Cal.App.4th 214, 222, 85 Cal.Rptr.2d 18 (1999)).

Thus, for example, courts have held with regard to UCL claims that while the UCL applies to wrongful conduct that occurs out-of-state but results in injury in California, regardless of the injured party's citizenship, the UCL does not apply to out-of-state conduct that does not cause injury in California. See Speyer v. Avis Rent a Car Sys., Inc., 415 F.Supp.2d 1090, 1098-99 (S.D.Cal.2005) (citing Norwest Mortgage, 72 Cal.App.4th at 222-25, 85 Cal.Rptr.2d 18; Yu v. Signet Bank, 69 Cal.App.4th 1377, 82 Cal.Rptr.2d 304 (1999)).

Here, the relevant question is not whether defendants have operations in California, but whether a sufficient connection exists between those operations and OEMEA's claims. Plaintiffs do not provide evidence sufficient to refute defendants' claims that OEMEA is a non-resident Irish corporation, that it is not registered to do business in California, that it has no customers in California, that its sales territory is limited to Europe and the Middle East, that it suffered no injury in California, and that SAP TN's support and marketing activities for OEMEA customers occurred in Texas and Europe, not in California.

While plaintiffs assert that SAP TN's contacts with California were widespread enough to provide a basis for OEMEA's claims in this action, the court notes that plaintiffs' own damages expert Paul Meyer confirmed that OEMEA's alleged damages are based on harm that occurred outside of California. The court finds that plaintiffs have failed to provide evidence sufficient to create a triable issue as to the required California nexus between OEMEA's claims and defendants' operations.

2. Damages incurred by related non-parties

Defendants contend that plaintiffs may recover only their own lost profits, and that they cannot assert the rights of third parties—even affiliated entities. Defendants assert that because corporations are considered separate legal entities, a plaintiff may seek damages only on its own behalf, and not on behalf of a subsidiary corporation.

The Oracle organization consists of a parent corporation (Oracle Corporation) plus hundreds of subsidiary corporations— only four of which (Oracle USA, OIC, OEMEA, and Siebel) are plaintiffs in this action. The court has previously dismissed two other plaintiffs for lack of standing, and defendants contend that plaintiffs cannot circumvent the court's dismissal by seeking to recover damages on behalf of dismissed parties, and also may not recover on behalf of entities they chose not to join as plaintiffs.

In opposition, plaintiffs argue that they do not seek to recover the lost profits that defendants are asking the court to bar— that is, they seek only lost support profits to which each plaintiff is legally entitled. Plaintiffs assert that Oracle is not seeking, as defendants argue, to avoid its corporate structure, and reiterate that they are seeking only those lost profits that should have flowed to the individual named plaintiffs.

The court finds that the motion must be GRANTED, as plaintiffs have effectively conceded that they do not seek lost profits from non-parties.

3. "Saved development costs" as measure of damages

Defendants assert that plaintiffs are not entitled to recover damages based on "saved development costs" for any of their claims.

a. Non-copyright claims

Defendants contend that unjust enrichment damages based on "saved development costs" are not available under claims permitting only the recovery of compensatory damages (the CFAA/CDAFA claims, the breach of contract claim, the trespass to chattels and tortious interference claims); and are also not available under claims permitting only recovery of restitutionary damages (the UCL and unjust enrichment/restitution claims). In opposition, plaintiffs contend that they may pursue "saved development costs" under their unjust enrichment claim, and assert that they do not seek them under any of the other non-copyright claims.

With regard to the unjust enrichment/restitution claim, defendants argue that under California law, a plaintiff asserting unjust enrichment may seek only restitution of benefits the plaintiff conferred on the defendant, which the defendant wrongfully retained. Thus, they contend, since Oracle did not literally confer "saved development costs" on defendants in this case, whatever benefit defendants may have incurred as represented by those saved costs is not an appropriate subject of restitution, and plaintiffs cannot recover those costs under the unjust enrichment claim.

Plaintiffs submit, however, that the "benefit conferred" need not be money or property directly conferred on the defendant, but can also be something that saves the defendant from expense or loss. In support, plaintiffs cite Ghirardo v. Antonioli, 14 Cal.4th 39, 57 Cal.Rptr.2d 687, 924 P.2d 996 (1996). In that case, the court noted that "[u]nder the law of restitution, an individual may be required to make restitution if he is unjustly enriched at the expense of another," and that "[a] person is enriched if he receives a benefit at another's expense." The court added that "[t]he term `benefit' denotes any form of advantage," and that a benefit is conferred "not only when one adds to the property of another, but also when one saves the other from expense or loss." However, "[e]ven when a person has received a benefit from another, he is required to make restitution only if the circumstances of its receipt or retention are such that, as between the two persons, it is unjust for him to retain it." Id. at 51, 57 Cal.Rptr.2d 687, 924 P.2d 996 (citing Restatement, Restitution § 1, com. (a), (c)).

Here, plaintiffs assert, the fact that Oracle did not directly confer the "saved development costs" on defendants does not mean that plaintiffs may not recover those "saved development costs" as damages.

Plaintiffs also cite Ajaxo, Inc. v. E*Trade Group, Inc., 135 Cal.App.4th 21, 37 Cal.Rptr.3d 221 (2005). In that case, the defendant (E*Trade) gave the plaintiff's trade secrets to one of the plaintiff's competitors, which used the trade secrets and saved some development costs for E*Trade. The court upheld an award of damages that included the saved development costs based on a theory of unjust enrichment/restitution. Id. at 55-57, 37 Cal.Rptr.3d 221. The court held that the purpose of unjust enrichment/restitution is to require the wrongdoer to restore what he has received, and thus restitution required E*Trade to return to the plaintiff the value or benefit that it received from the plaintiff's competitor. Id. at 56, 37 Cal.Rptr.3d 221. The court also held that the saved development costs provided evidence of unjust enrichment on the plaintiff's claim for misappropriation of trade secrets—a claim that plaintiffs argue is analogous to defendants' conduct here.

The court find that the motion must be GRANTED. Plaintiffs cannot recover "saved development costs" for alleged unjust enrichment, where plaintiffs retained their right to use, distribute, license, and profit from the software and support materials at issue. It would not be equitable, logical, or legally permissible to award plaintiffs the full replacement value of property that they never lost or gave away.

The cases on which plaintiffs rely do not support their argument as applied to the facts of the present case. Ghirardo does not support a ruling that plaintiffs can recover the full replacement value of their intellectual property absent loss or conveyance of that property, as the court there simply permitted a plaintiff who had conveyed real property to the defendant to recover the unpaid balance of the purchase price. The remaining cases (Ajaxo and cases cited for the same point as Ajaxo) concern trade secret claims in which the court permitted recovery of "development costs" saved by misappropriating, rather than developing, the trade secrets at issue. Moreover, these cases are inapposite because, unlike the contract or tort claims for which plaintiffs' unjust enrichment claim serves as an alternative here, trade secret law allows recovery of saved development costs.

b. Copyright claims

Defendants also assert that "saved development costs" are not a permissible measure of recovery for the copyright claims. Apart from statutory damages, the Copyright Act provides for two types of monetary recovery—actual damages, and recovery of wrongful profits. "These remedies are two sides of the damages coin—the copyright holder's losses and the infringer's gains." Polar Bear Prods., Inc. v. Timex Corp., 384 F.3d 700, 708 (9th Cir.2004). Actual damages are awarded to compensate for demonstrable harm caused by the infringement. 17 U.S.C. § 504(b); Polar Bear, 384 F.3d at 708. Infringer's profits are analyzed from the infringer's point of view—if the infringer has earned a profit, it must disgorge that profit so that it does not benefit from wrongdoing. Id.

Courts have applied different calculations to determine the amount of actual damages that a copyright owner is entitled to recover as a result of infringement. One method assesses the damage to the "fair market value" of the plaintiff's work caused by the defendant's infringement. See, e.g., Abend v. MCA, Inc., 863 F.2d 1465, 1479-80 (9th Cir.1988). Another method attempts to prove actual damages by indirectly proving the plaintiff's lost profits. This method is often impractical because of the difficulty of proving such lost profits with specificity. See, e.g., Polar Bear, 384 F.3d at 709-10.

In Sid & Marty Krofft Television Prods, Inc. v. McDonald's Corp., 562 F.2d 1157 (9th Cir.1977), the Ninth Circuit held that "[t]he value of an infringer's use is a permissible basis for estimating actual damages." Id. at 1174. The test of market value is "what a willing buyer would have been reasonably required to pay to a willing seller for plaintiffs' work." Frank Music Corp. v. Metro-Goldwyn-Mayer, Inc., 772 F.2d 505, 512 (9th Cir.1985) (quoting id.).

In Deltak, Inc. v. Advanced Sys., Inc., 767 F.2d 357 (7th Cir.1985), the defendant copied the plaintiff's written materials, and distributed the copies without charge to its customers. Because the materials were not registered, and no sales resulted, the court attempted to resolve the question of how to determine damages when there had been no profit to the infringer and no lost sales to the copyright holder. The Seventh Circuit cited Krofft, but equated "value of use" with the fair market value of the infringed materials, as it found that there were damages in the value of the use of the infringing materials to the infringer. Id. at 360-63. The court concluded that "[e]ach of the copies [defendant] distributed had a value of use to it equal to the acquisition cost saved by infringement instead of purchase, which [defendant] was then free to put to other uses." Id. at 361.

In the present case, plaintiffs' expert Mr. Meyer measured actual damages for copyright infringement using both a traditional lost profits analysis, and a "fair market value" license analysis. For the latter, he calculated "hypothetical licenses" using three different approaches—a "market approach," an "income approach," and a "cost approach." According to Mr. Meyer, "[t]he cost approach attempts to measure the future benefit of the intellectual property by quantifying the cost to develop alternative technology or replace the technology being valued."

The underlying assumption, according to Mr. Meyer, "is that the cost to buy or develop alternative intellectual property is commensurate with the economic benefit, or value, of the intellectual property." Thus, under this "cost approach," Mr. Meyer considered the acquisition cost to Oracle of purchasing the intellectual property from PeopleSoft and J.D. Edwards, plus the amounts that PeopleSoft and J.D. Edwards spent on research and development, plus the amounts Oracle has subsequently spent in research and development in connection with the copyrighted materials. Thus, plaintiffs are seeking to recover damages based on the purported amount that defendants would have spent to acquire the relevant technology through their own development efforts—that is, the amount that defendants saved by infringing, rather than developing or directly purchasing, the technology.

Defendants contend that there is no authority to support Mr. Meyer's reliance on a "cost approach" to calculate the value of a fair-market value license. In their prior motion for partial summary judgment, on the question of the availability of "hypothetical license" damages, defendants argued that plaintiffs were not entitled to such damages if they were based on "saved acquisition costs." In the January 28, 2010 order denying defendants' motion, the court held that plaintiffs were not precluded from seeking actual damages for copyright infringement in the form of a "fair market value" or "hypothetical" license.

The court found it unnecessary to reach the specific question whether "saved acquisition costs" are a permissible component of such a license, as it assumed, based on the particular facts of this case, and also based on the relevant case law, that any damages in the form of a "hypothetical license" would more or less replicate the costs to defendants of acquiring a license permitting the use of the allegedly infringed copyrights (though not the costs of acquiring ownership of the copyrights). The court notes, in addition, however, that no court in this Circuit has considered "saved costs" when calculating a fair market value license, and the Ninth Circuit's "value of use" analysis says nothing about "saved costs."

In any event, the concept of "saved development costs" raises an entirely different issue—whether plaintiffs are entitled to recoup all their research and development costs as actual damages for defendants' infringement. The court has located no case law supporting a theory of copyright damages based on "saved development costs," and plaintiffs have proffered none. Thus, the court is not persuaded by plaintiffs' argument that authority exists for such a proposition. Even the Seventh Circuit—which in Deltak introduced the concept of "saved acquisition costs" as a measure of actual damages (and for which it has been criticized by commentators and other courts)—did not go so far as plaintiffs would have this court go.

Accordingly, in the absence of Ninth Circuit authority for awarding research and development costs to plaintiffs as actual damages for infringement, this court declines to permit plaintiffs to seek such damages.^[5] Defendants' motion is GRANTED.

4. Claims for which plaintiffs did not disclose damage calculations

Defendants argue that plaintiffs may not recover damages for any claims for which they did not disclose damages calculations—specifically, the trespass to chattels claim, and the CDAFA claim. They argue that under Rule 26(a)(1), a plaintiff is required to provide in its initial disclosures a computation of each category of damages claimed, and that failure to do so results in exclusion of evidence.

Defendants assert that it is undisputed that plaintiffs did not disclose in their initial disclosures any damages calculations for their trespass to chattels claim, as they made only general allegations of damage to Oracle's "computers, data, and systems" caused by SAP TN's alleged trespass on plaintiffs' computer systems. Defendants contend that even in their supplemental and amended disclosures, plaintiffs provide no calculations or amounts to establish any actual damages, stating only that such amounts will be provided "in connection with Oracle's expert report or before"—and that no such calculations have been forthcoming.

In opposition, plaintiffs argue that they have disclosed all the damages they intend to seek for their trespass to chattels and CDAFA claims. Those damages, according to plaintiffs, include lost profits, harm and impairment to Oracle's computer systems, investigation costs, attorney's fees, and punitive damages. They contend that the cited investigation and lost profits damages evidence is what their damages expert relied on and quantified in his expert report.

The court finds that the motion must be DENIED, as inappropriate for resolution on a summary judgment motion. Defendants are, of course, free to move for preclusion of evidence of damages as to which plaintiffs may have failed to comply with the disclosure requirements.^[6]

CONCLUSION

In accordance with the foregoing, the court rules as follows:

1. Plaintiffs' motion for summary judgment as to SAP TN's liability for direct infringement of the three HRMS registrations at issue is GRANTED as to the post-March 1, 2005 period, based on defendants' concessions, and DENIED as to the pre-March 1, 2005 period.

2. Defendants' cross-motion for summary judgment of non-infringement based on pre-March 1, 2005 conduct with regard to the three HRMS registrations at issue is DENIED.

3. Plaintiffs' motion for summary judgment as to the SAP TN's liability for direct infringement of the three Database registrations at issue is GRANTED without time limitation, based on defendants' concessions.

4. Plaintiffs' motion for summary judgment as to SAP AG's and SAP America's liability for vicarious infringement of the six registrations at issue is GRANTED, based on defendants' concessions.

5. Plaintiffs' motion for summary judgment as to SAP AG's and SAP America's liability for contributory infringement of the six registrations at issue is DENIED.

6. Plaintiffs' motion for summary judgment as to SAP TN's liability for violation of CFAA § (a)(2)(C) is GRANTED, based on defendants' concessions; and is DENIED as to SAP TN's liability for violation of CFAA § (a)(5)(A)(i)-(iii).

7. Plaintiffs' motion for summary judgment as to SAP TN's liability for violation of the CDAFA is GRANTED, based on defendants' concessions.

8. Plaintiffs' motion for summary judgment as to SAP AG's and SAP America's indirect liability for violation of the CFAA is DENIED.

9. Plaintiffs' motion for summary judgment as to SAP AG's and SAP America's indirect liability for violation of the CDAFA is DENIED.

10. Defendants' motion for summary judgment as to OEMEA's California claims is GRANTED.

11. Defendants' motion for summary judgment as to damages incurred by non-parties is GRANTED.

12. Defendants' motion for summary judgment as to "saved development costs" as a measure of damages is GRANTED, as to both non-copyright claims and copyright claims.

13. Defendants' motion for summary judgment as to claims for which plaintiffs did not disclose damage calculations is DENIED.

14. The parties' objections to evidence are OVERRULED.

IT IS SO ORDERED.

NOTES

[1] Oracle USA is now known as Oracle America, Inc.

[2] Plaintiffs seek summary judgment as to infringement of six of the approximately 120 copyright registrations at issue. The six registrations are HRMS 7.0 (TX 4-792-577), HRMS 7.5 (TX 4-792-575), HRMS 8, Service Pack 1 ("HRMS 8 SP1") (TX 5-501-312), Database 8.1.6 (TX 5-222-106), Database 9i, Release.2 ("9.2") (TX 5-673-282), and Database 10g, Release.2 ("10.2") (TX 6-942-003). The HRMS software is used to run business payrolls and to automate various complex processes, and the Database software stores and organizes business data used by HRMS and other business application software.

[3] CFAA § 1030 was amended in 2008, and it is the former version (in effect from 2001 until the 2008 amendments) that is referenced here. The 2008 version eliminated subsections (i), (ii), and (iii) as part of (a)(5).

[4] In a footnote, plaintiffs assert that the evidence of CFAA violations presented in their motion also meets the elements of CDAFA, and that summary judgment is therefore appropriate on that claim as well.

[5] Even were there some authority for calculating actual damages under the Copyright Act using a "saved development costs" calculation, the court finds plaintiffs' calculations to be highly speculative, as they are based on the amounts that Oracle allegedly spent to develop and/or acquire the intellectual property at issue, not on what it would have cost SAP for research and development. As noted above, actual damages based on "value of use" are derived from "the value of an infringer's use," and plaintiffs have provided no evidence of what SAP would have spent.

[6] In light of this ruling, the court also does not decide whether plaintiffs' damages under the CDAFA should be limited to no more than alleged "investigation costs."