Opinion
Civil Action No. 1:23-cv-478 (RDA/IDD)
2023-05-19
CACI, INC. - FEDERAL, Plaintiff, v. UNITED STATES NAVY, Defendant.
Courtney L. Batliner, Pro Hac Vice, Jacob W.S. Schneider, Pro Hac Vice, Joshua C. Krumholz, Pro Hac Vice, Holland & Knight, Boston, MA, Mark Hunter Churchill, Holland & Knight LLP, Tysons, VA, for Plaintiff. Matthew J. Mezger, United States Attorney's Office, Alexandria, VA, for Defendant.
Courtney L. Batliner, Pro Hac Vice, Jacob W.S. Schneider, Pro Hac Vice, Joshua C. Krumholz, Pro Hac Vice, Holland & Knight, Boston, MA, Mark Hunter Churchill, Holland & Knight LLP, Tysons, VA, for Plaintiff. Matthew J. Mezger, United States Attorney's Office, Alexandria, VA, for Defendant. MEMORANDUM OPINION AND ORDER Rossie D. Alston, Jr., United States District Judge
This matter comes before the Court on Plaintiff CACI's Motion for a Preliminary Injunction (Dkt. 4). This matter has been fully briefed and is now ripe for disposition. Having considered the Motion along with Plaintiff's Memorandum in Support (Dkt. 5) and its attached exhibits, the Defendant the United States Navy's Opposition (Dkt. 35) along with its attached exhibit, Plaintiff's Reply (Dkt. 41) along with its attached exhibits, the United States' Notice (Dkt. 54), the parties' arguments at the May 10, 2023 hearing (Dkt. 59), and the parties' supplemental briefs (Dkt. Nos 60; 61), it is hereby ORDERED that Plaintiff's Motion for a Preliminary Injunction is GRANTED-IN-PART.
I. STANDARD OF REVIEW
Federal Rule of Civil Procedure 65(a) authorizes federal courts to issue preliminary injunctions. Because a preliminary injunction is "an extraordinary remedy," it "may only be awarded upon a clear showing that the plaintiff is entitled to such relief." Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 22, 129 S.Ct. 365, 172 L.Ed.2d 249 (2008); Perry v. Judd, 471 F. App'x 219, 223 (4th Cir. 2012). A preliminary injunction is "never awarded as of right." Winter, 555 U.S. at 24, 129 S.Ct. 365. And "granting a preliminary injunction requires that a district court, acting on an incomplete record, order a party to act, or refrain from acting, in a certain way." Hughes Network Sys. v. InterDigital Commc'ns Corp., 17 F.3d 691, 693 (4th Cir. 1994). As a result, courts do not lightly award this extraordinary relief, and preliminary injunctions are therefore "to be granted only sparingly." Toolchex, Inc. v. Trainor, 634 F. Supp. 2d 586, 590-91 (E.D. Va. 2008) (quoting In re Microsoft Corp. Antitrust Litig., 333 F.3d 517, 524 (4th Cir. 2003)).
In this case, CACI seeks a "mandatory" preliminary injunction, which courts scrutinize with care. There are generally two types of preliminary injunctions: prohibitory and mandatory injunctions. Prohibitory preliminary injunctions maintain the "status quo." Pashby v. Delia, 709 F.3d 307, 319 (4th Cir. 2013). On the other hand, mandatory preliminary injunctions "alter the status quo" and instead require a party to take certain action. Judd, 471 F. App'x at 223. That is what CACI seeks here, as it asks this Court to enjoin the Navy from continuing certain actions and/or to require the Navy to take certain actions. Dkt. 4. Because such relief "in any circumstance is disfavored, and warranted only in the most extraordinary circumstances[,]" this Court's "application of the exacting standard of review . . . is even more searching" in this case. Judd, 471 F. App'x at 223-24.
II. FINDINGS OF FACT
These findings of fact are derived from Plaintiff's Complaint (Dkt. 1) and related Declarations as well as the exhibits related to the briefing for Plaintiff's Motion for a Preliminary Injunction (Dkt. Nos. 6-10; 13-18; 25; 39; 42-43; 46-52; 54-1; 55).
A. The ADCS Software
Plaintiff, CACI, is a "professional services and information technology company" that offers "solutions and services" to various private companies and federal agencies. Dkt. 7 (Declaration of Stephanie Giese, hereinafter "Giese Decl.") ¶ 2. It provides those services to various branches of the United States Armed Forces, including the Defendant, the United States Navy. Id.
One of CACI's products is a software application called Automated Data Capture System, or "ADCS." The software "guides personnel through the aircraft inspection and maintenance process . . . ." Dkt. 6 (Declaration of Frank J. Kalas, Jr., hereinafter "Kalas Decl.") ¶ 4. CACI personnel tout it as a "highly efficient, effective, safety-focused, and time-saving" software. Id. The Navy has used ADCS as its "sole-source software for inspecting and maintaining its aircraft for more than two decades." Id. ¶ 13.
It took a while for CACI to develop ADCS. American Management Systems ("AMS") (which CACI acquired in 2004) created a predecessor application that was "briefly commissioned by" the Navy around 1996. Id. ¶ 15. Then, around 2000, the government urged AMS to shift its project to a commercial software development model—meaning that the software would be developed using private funding, rather than pursuant to a government contract—and AMS complied. Id. ¶ 41. Eventually, AMS developed what came to be ADCS and released it in August of 2002. Id. ¶ 24. CACI has continued to improve ADCS since then, including by "rebuil[ding] ADCS from the ground up" between 2015 and 2017. Id. ¶ 25.
The predecessor application that was built by AMS around 1996 used a different methodology than what the current version of ADCS uses. That product used a "vertical methodology[,]" which is what "most software developers use on their projects." Id. ¶ 16. The vertical methodology is a "serial or systematic approach" that addresses problems in a "series of predefined steps." Id. That approach, however, "fell far short of the functionality and speed" that CACI developers wanted and the Navy needed, as it was unable to handle the "vast network of connections" that exist in aircraft. Id. ¶ 17. The 2000 redevelopment used that same "vertical methodology" and was similarly deficient, as it could not "accommodate the thousands of different variables that needed to be considered." Id. ¶ 18.
After the 2000 redevelopment, AMS took an entirely different approach. It switched to a "lateral" approach to designing the software. Id. ¶ 19. That method of design had been seldom, if ever, used in a software like ADCS. Id. Using a "lateral" methodology involves a "complex, interconnected, interdependent network of virtual elements to process information and efficiently arrive at the best solution." Id. ¶ 21. It is "highly complex[,]" but the ADCS developers believed it was suitable for ADCS because of the "complexities that aircraft present." Id. ¶¶ 21-22. Ultimately, it took two years for AMS to develop ADCS, which was provided to the Navy on a subscription basis starting in 2002. Id. ¶¶ 23-24, 43.
Pivoting from the vertical methodology approach it had originally tried, the product that ADCS provided to the Navy in 2002 relied on a type of database called a "relational database." Id. ¶ 28. Generally, a relational database "stores data in tables that are interrelated or contain interrelated data." Id. One of the most important pieces of knowledge in working with a relational database is the relational database "schema" (also known as a "data dictionary") which is the complete system of tables that "defines the types of data between the tables and . . . the relationships between the tables" and their data. Id. Essentially, the schema is a "blueprint" for both building the database and understanding how the software manages its data. Id.
Consequently, ADCS's database schema is one of its most important aspects. Because ADCS is designed to allow those who maintain aircrafts to "begin their work from any point" while still being assured that they can "address every need of the aircraft[,]" the schema "must be designed to account for every component in every one of the serviced aircraft[s]" as well as how those components affect one another. Id. ¶ 37. To that end, CACI's engineers had to both map out all of the various connections between components and make various choices about how to "define, organize[,] and prioritize all of the data within ADCS." Id. ¶ 38. And the schema that the engineers designed had to be flexible enough to allow changes on-the-fly without updates that interrupted the use of ADCS. Id.
To accomplish all that was required of the software it was developing, CACI expended numerous resources. CACI invested "millions of dollars[,]" and devoted the work and expertise of many engineers to develop the product, and more specifically, the database schema. Id. ¶ 39. CACI is not aware of any competitor being able to design a similar product, meaning that no one else has been able to "match what ADCS provides to the marketplace[,]" and consequently, what CACI has provided to the Navy. Id. ¶ 40. To this day, CACI continues to improve and enhance its lateral methodology. Id. ¶ 25.
Because of the proprietary nature of ADCS, CACI has taken various steps to protect it. First, it has various "technical" security measures in place—which include limiting the personnel who have access, password protection to the source code and other sensitive material, and encryption. See id. ¶¶ 48-51 (describing technical security measures). Second, it places confidentiality markings on anything associated with ADCS. Id. ¶¶ 52-53. Third, it takes specific actions to inform third parties of the confidential nature of ADCS. For example, it limits who at the third parties can access ADCS, informs third parties about the sensitive nature of ADCS, and uses secure methods to transfer files related to ADCS. See id. ¶¶ 54-55 (describing Defendant's access to ADCS and the secure methods of transferring ADCS material). Finally, CACI considers ADCS so proprietary that it has turned away customers who would like to make their use of ADCS contingent on CACI divulging confidential information. See, e.g., id. ¶¶ 56-57 (describing examples of CACI turning down commercial opportunities that would have allowed others to access ADCS).
B. Navy's Use of ADCS and Efforts to Replace It
The Navy has contracted with CACI to use ADCS for a while. The current contract was awarded on November 25, 2019. Dkt. 35-1 (Declaration of Andrew P. Zager, hereinafter "Zager Decl.") ¶ 11; Dkt. 39-1 (under seal Zager Declaration Attachment A) (contract). Among various other provisions, the contract explicitly incorporates various Defense Federal Acquisition Regulation Supplement ("DFARS") clauses. E.g., Dkt 39-1 at 141 (page 122 of contract) (incorporating various DFARS clauses by reference). The contract also provides that ADCS is to be implemented with Navy's MRO 8.3 program. E.g., id. at 104 (page 85 of contract).
The Navy uses ADCS to help maintain its aircraft. Aircraft maintenance is extremely complex, partly because there are individual manuals for each of the tens of thousands of components in a single aircraft. Zager Decl. ¶ 4. ADCS assists with that maintenance by allowing aircraft inspectors to identifying all of the potentially relevant information when they are maintaining aircraft. Id. ¶ 5. The inspectors input what failures need repair into ADCS, and ADCS identifies the information "necessary to begin repairs." Id. Critically, all of the data within ADCS is created by the Navy and then loaded into ADCS; ADCS is a tool that assists inspectors and technicians by allowing them to "submit a query identifying what aircraft [they are] working on and what the deficiency is[,]" and figure out what procedures are necessary without having to sift through each specific manual. Id. ¶ 6.
But ADCS is not the only tool that is used in this process. The ADCS outputs are put into a set of "larger Navy software systems" which help maintenance workers complete the required tasks, such as ordering parts, creating work orders, and transmitting records. Id. ¶ 7. One of those programs is called "MRO 8.3" which helps assist the Navy maintenance personnel with taking action to execute repairs. See id. ¶¶ 7-9 (describing the process of maintaining the aircraft after ADCS gives an output).
Over time, the Navy has become somewhat dissatisfied with ADCS. Among other things, the Navy has found that (1) ADCS has contributed to production delays; (2) ADCS is not compatible with all Navy applications; and (3) ADCS is not workable with Navy's "changing shop floor business processes[.]" Id. ¶ 21. As a result, the Navy has begun the process of replacing ADCS with its own system, called the Aircraft Emergent Workflow Process ("AEW"). Id.
C. CACI's Issues with the Navy's Access to ADCS
CACI started becoming concerned with how the Navy was ensuring the protection of ADCS in late 2022. On November 16, 2022, Matthew Sines—who was one of two Navy employees granted access to ADCS's database—pasted a "small portion" of the ADCS schema in an email to a CACI employee. Kalas Decl. ¶ 55; see Dkt. 14 (Kalas Exhibit K-1, filed under seal) (email chain between Sines and CACI). Immediately, the CACI employee reminded Sines that he should not send such information via email, but should instead use a secure method to exchange the material. Kalas Decl. ¶ 55; Dkt. 14. Because it appeared to be an innocent mistake, CACI considered that email an "isolated" incident that was the "result of inadvertence by [the Navy]." Kalas Decl. ¶ 55. Nevertheless, CACI took an additional step to ensure the confidentiality of ADCS: it provided the Navy with a "script file" that applied "confidentiality markings" to ADCS metadata to "protect against any further missteps." Id. ¶ 62. But the Navy declined to use that script. Id. ¶ 63; Dkt. 7-2 (Kalas Exhibit K-2) (December 14, 2022 Navy email to CACI, informing CACI that they would not use the script).
The Navy's refusal to use the script led to correspondence between the parties. CACI was unhappy with the Navy's decision not to use the script, and sent a "Letter of Concern" to Navy's contracting officer, Ms. Lydia Munley, on December 16, 2022. Dkt. 8 (Declaration of Eliza Jo Smarr, hereinafter "Smarr Decl.") ¶ 10; Dkt. 8-1 (Smarr Exhibit SM-1) (letter from CACI to Munley). That letter laid out CACI's concerns with the Navy's decision not to use the script and emphasized the confidential nature of ADCS. Dkt. 8-1. The Navy did not respond until over a month later, January 19, 2023, raising various questions for CACI. Smarr Decl. ¶ 11; Dkt. 8-2 (Smarr Exhibit SM-2) (letter responding to CACI's December 16 letter). CACI first responded four days later to that letter asking the Navy to ensure they were protecting the database schema, Smarr Decl. ¶ 12; Dkt. 8-3 (Smarr Exhibit SM-3), and then eventually answered the questions the Navy had posed on February 16, 2023, Smarr Decl. ¶ 13; Dkt. 8-4 (Smarr Exhibit SM-4).
Things had started deteriorating between the parties in February of 2023. On February 13, Mr. Sines emailed a CACI employee, Mr. Matthew Strand, asking him what kinds of information he could share about ADCS because Mr. Sines had received requests for ADCS information that he thought were improper. Dkt. 10 (Declaration of Matthew Strand, hereinafter "Strand Decl.") ¶¶ 7-9; Dkt. 6-3 (Kalas Exhibit K-3) (Strand email exchange with Sines). Mr. Sines explained that he had received requests from a Navy employee, Mr. Jon Gabiou, as well as a contractor, Mr. George Rice, who worked for Deloitte. Strand Decl. ¶¶ 9-10; Dkt. 6-3. Sines was concerned because Mr. Gabiou sought "the tool with which [ ] Sines administers the ADCS database, as well as ADCS's 'full dictionary of all tables[,]' " which he thought would disclose the schema. Strand Decl. ¶ 12; Dkt. 6-5 (Kalas Ex. K-5) (Sines email to Strand, containing screenshot of requests). Separately, on February 16, 2023, CACI learned that Mr. Gabiou had asked Mr. Sines to run a query that, if granted, "would have exported the ADCS database schema[,]" and thus enabled the Navy to reverse-engineer ADCS. Kalas Decl. ¶¶ 69, 71; Dkt. 6-5 (Kalas Ex. K-4) (Sines relaying Gabiou request to CACI).
CACI became concerned and started investigating. It eventually learned that Mr. Rice had both (1) been given access to the ADCS "test" environment and (2) been given "aircraft administrator privileges" to ADCS. Dkt. 9 (Declaration of Dexter Francis, hereinafter "Francis Decl.") ¶ 8. That sort of access gave Mr. Rice "insight into how ADCS functioned and was structured." Id. Additionally, as to Mr. Gabiou's February 16 request to Mr. Sines, CACI told Mr. Sines to "not comply with [the] request" as it was "not a simple data request" and would "expose CACI's intellectual property." Kalas Decl. ¶ 71; Dkt. 6-4 (Kalas Ex. K-4) (CACI response to Sines). CACI also emailed Ms. Munley, notifying her of Mr. Gabiou's requests and CACI's concerns—specifically, that such a request would expose CACI's intellectual property and allow Mr. Gabiou to reverse-engineer ADCS. Smarr Decl. ¶ 15a; Dkt. 8-6 (Smarr Ex. SM-6) (email from Smarr to Munley).
CACI also sent formal correspondence to the Navy. This formal correspondence included a cease-and-desist-letter on February 16, 2023. Smarr Decl. ¶ 13; Dkt. 8-4 (Smarr Ex. SM-4, filed under seal at Dkt. 16). In that letter, CACI (1) responded to the questions that the Navy had asked on January 19; (2) set out what it had learned in the preceding days about the Navy's purportedly inappropriate access to ADCS; and (3) asked the Navy to stop accessing ADCS beyond the authorized scope. Dkt. 8-4. That led to further correspondence between the parties and, eventually, on February 22, 2023, Ms. Munley confirmed that Mr. Rice could no longer access the ADCS test environment. Smarr Decl. ¶ 14; Dkt. 8-5 (Smarr Ex. SM-5) (correspondence between Smarr and Munley).
On February 22, 2023, another event raised alarm bells for CACI. On that day, CACI learned that individuals associated with the Navy had uploaded portions of the database schema to a shared website that the Navy's "Transition Group" used. Kalas Decl. ¶¶ 72, 74; Smarr Decl. ¶ 15b; Dkt. 8-7 (Smarr Ex. SM-7, filed under seal at Dkt. 17) (email from Smarr to Munley). The "Transition Group"—which included over 60 people, Dkt. 10-2 (Strand Ex. ST-2) (email from Sines to Strand)—was responsible for transitioning the Navy from ADCS to a new software. CACI believed that the portion that was uploaded "show[ed] a plan to convert one of the central ADCS database tables into a competitor's format[,]" which meant that the Navy was trying to migrate part of what ADCS did to a different software. Kalas Decl. ¶ 77. As a result, CACI immediately emailed the Navy, asking it to tell its employees to stop "using or accessing ADCS proprietary information" that was placed on the shared website. Smarr Decl. ¶ 15b; Dkt. 8-7 (Smarr Ex. SM-7) (email from Smarr to Munley) at 2. The next day, CACI discovered that Mr. Gabiou had obtained the information and uploaded it to the shared site by asking Ms. Lesa Michell (the only individual other than Mr. Sines with full access to ADCS) to grant him access and run his query. Strand Decl. ¶¶ 13, 15. As a result, CACI again reached out to Ms. Munley and asked her to revoke Mr. Gabiou's access and take various actions to ensure the confidentiality of the trade secrets. Smarr Decl. ¶ 15c; Dkt. 8-8 (Smarr Ex. SM-8) (email from Smarr to Munley). CACI next went over Ms. Munley's head and reiterated its requests to her supervisor, Ms. Meghan Huett, who told CACI that Mr. Gabiou's access would be revoked. Smarr Decl. ¶ 16; Dkt. 8-9 (Smarr Ex. SM-9) (email exchange between Smarr and Huett). However, the Navy was silent as to whether they took any other actions to remove ADCS proprietary information from the shared site.
The Navy claims that Mr. Gabiou was simply trying to move data. According to the Navy, he accessed data dictionaries related to a single aircraft to "create a data migration plan" to export Navy-owned data to Navy systems, specifically AEW. Zager Decl. ¶¶ 20-21. The Navy claims he sought to "learn how the Navy's data could be exported from ADCS" to understand how ADCS "interface[s] (or 'fit[s]')" into the Navy's other systems. Id. ¶ 25. CACI claims that the Navy already had that information. Dkt. 42 (Kalas Supplemental Declaration, hereinafter "Kalas Supp. Decl.") ¶¶ 5-23.
Notably, Mr. Gabiou did not provide a declaration in support of the Navy's opposition to CACI's Motion for a Preliminary Injunction; in fact, he did not provide a declaration until two days before the preliminary injunction hearing. Dkt. 54-1. All of the facts about what Mr. Gabiou did (and why) were initially relayed through Mr. Zager's Declaration.
Eventually, CACI (and its counsel) started communicating with the Navy's counsel, William Mohn. In the days and weeks following February 23, CACI exchanged communications with Mr. Mohn about the actions it believed needed to be taken and what the Navy was doing in response to those requests. See Giese Decl. ¶¶ 7-22 (describing the interactions between CACI and Mohn); Dkt. Nos. 7-1 (Giese Ex. G-1) (letter from Holland and Knight, CACI's outside counsel to Mohn); 7-2 (Giese Ex. G-2) (email chain between Ms. Giese, CACI in-house counsel, and Mohn, spanning from February 28 to March 27). The Navy took some action in response; for example, after CACI requested that the Navy take down any ADCS material from the shared website, it confirmed it had done so. Dkt. 7-2 (Giese Ex. G-2) at 8 (confirmation from Mohn that the information had been removed). It also removed all contractor access from ADCS. Zager Decl. ¶ 36. Moreover, Mr. Gabiou stopped accessing the ADCS database after being instructed to, and the Navy took efforts to remove all ADCS information from his computer. Zager Decl. ¶¶ 28-36.
While the Navy thought it had removed all information related to ADCS from Mr. Gabiou's computer, it in fact had not done so. He discovered additional ADCS information on his computer while briefing related to this motion was ongoing. Dkt. 54-1 ¶ 20.
Over time, however, Mr. Mohn became less cooperative. On a March 9 call between Mr. Mohn, Ms. Giese, and David Black (outside counsel for CACI), Mr. Mohn evidently told CACI that (1) he had not sent written communication to the third-party contractors about the ADCS access; (2) he had not made any progress towards searching the Navy's systems for copies of proprietary ADCS material; and (3) he had not taken various steps with regard to the Transition Group that CACI had asked the Navy to take. Dkt. 7-3 (Giese Ex. G-3) (March 13 letter from CACI to Mohn summarizing March 9 call). Eventually, on a March 22 call, Mr. Mohn informed CACI that any future communications had to be in writing. Giese Decl. ¶ 18. CACI followed up by email on March 23, 2023, and Mr. Mohn responded four days later that the Navy would "respond when appropriate" Dkt. 7-2 (Giese Ex. G-2) at 3. After more emails throughout late March and early April, Mr. Mohn eventually told CACI that it intended to resume its "transition to a new [g]overnment system to replace ADCS" (i.e., AEW) later on in April, despite CACI's concerns. Dkt. 7-4 (Giese Ex. G-4).
Mr. Mohn had, however, met with representatives of Deloitte and Blue Yonder, two of the at-issue third parties. Zager Decl. ¶¶ 39, 42. Those contractors indicated that their employees did not have access to CACI proprietary information and that the Deloitte employees who had access to the shared website when ADCS was available had that access revoked.
III. LEGAL ANALYSIS
A. Subject Matter Jurisdiction
The Court must first address the issue of subject matter jurisdiction. CACI has asserted that this Court has jurisdiction via the Administrative Procedure Act, claiming that the Navy's decisions vis-à-vis ADCS—and the resulting Trade Secret Act violations—were a final agency action not in accordance with the law, and thus challengeable under the APA. Dkt. 5 at 19-20. The Navy did not provide a full-throated jurisdictional argument in its opposition, relegating a single footnote to the issue of subject matter jurisdiction by claiming that this Court's jurisdiction was "not quite clear." Dkt. 39 at 8 n.1. However, at oral argument and in the supplemental brief that the Court invited from each party, the Navy expounded on its argument that the Court does not have jurisdiction here. See Dkt. 59 (Transcript of May 10, 2023 Oral Argument, hereinafter "Tr."); Dkt. 60 (Navy's Supplemental Brief). Because subject matter jurisdiction concerns this Court's "very power to hear a case," it has an "independent obligation to assess . . . subject matter jurisdiction" regardless of when, where, how, or if a party raises that as an issue. Gaines Motor Lines, Inc. v. Klaussner Furniture Indus., Inc., 734 F.3d 296, 302 (4th Cir. 2013) (cleaned up).
1. The Contract Disputes Act
The Navy's first argument is that proper jurisdiction lies exclusively in the Court of Federal Claims, as this is a contract dispute "controlled by the Contract Disputes Act." Dkt. 39 at 8-9, n.1; Dkt. 60 at 2-3. It claims that controlling law mandates that when the CDA applies, it provides the exclusive route to a remedy, and that remedy can only be pursued in the Court of Federal Claims. According to the Navy, "this is a contract dispute dressed up as an APA action[;]" they point to the fact that the Navy took their initial concerns "to the Navy's Contracting Officer[,]" that the central dispute is over the applicability of terms in the contract, and that analogous disputes cited by CACI are contract disputes. Dkt. 60 at 2-3.
The CDA addresses very specific claims. The CDA "applies to any express or implied contract . . . made by an executive agency for . . . the procurement of services." Sys. App. & Techs., Inc. v. United States, 26 F.4th 163, 170 (4th Cir. 2022) (quoting 41 U.S.C. § 7102(a)). Essentially, that means the CDA provides the mechanism for the resolution of any claims arising out of a contract dispute between a contractor and the government. See Lockheed Martin Corp. v. Def. Cont. Audit Agency, 397 F. Supp. 2d 659, 664 (D. Md. 2005) (stating that the CDA is a "comprehensive scheme for the resolution of all claims by a contractor against the government relating to a contract." (cleaned up)). If a contractor has a CDA claim, it must first present a written claim to its contracting officer. 41 U.S.C. § 7103(a)(1)-(3); see also Sys. App. & Techs., Inc., 26 F.4th at 170 (describing the first step of this process). Then, if the contractor has an issue with the contracting officer's decision, it may either (1) appeal the decision to an agency board, 41 U.S.C. § 7104(a); or (2) bring a de novo action in the Court of Federal Claims, 41 U.S.C. § 7104(b).
The government argues that the Fourth Circuit has "held that the ambit of 'claims' that can fall under the CDA is to be 'broadly' construed." Dkt. 60 at 2 (quoting Sys. App. & Techs. Inc., 26 F.4th at 171). But the passage that the government cites does not stand for that proposition: there, the Fourth Circuit indicated that courts should broadly read the definition of "claim" as it pertains to the exhaustion of administrative remedies that are a prerequisite for bringing a CDA claim—the Fourth Circuit did not hold that the scope of the CDA itself should be broadly construed. Sys. App. & Techs. Inc., 26 F.4th at 171-72.
The question at hand, then, is whether this claim arises out of a contract dispute between CACI and the Navy. It decidedly does not. Consider the nature of CACI's claims, and Navy's defense: CACI claims that the Navy has improperly utilized its trade secrets, in violation of the Trade Secrets Act, while the Navy points to the contract and argues that it was allowed to access the material it did under the contract, i.e., it points to the contract as a defense. This means that there are two options for the Court given the claims before it: (1) the Navy has improperly utilized CACI's trade secrets, in violation of the TSA (but with no alleged or apparent breach of contract) or (2) the Navy has properly accessed ADCS, and has not violated the TSA because of its compliance with the contract. In neither scenario is a breach-of-contract inquiry material, meaning that the merits question is not "one of contract interpretation." See United States v. J & E Salvage Co., 55 F.3d 985, 988 (4th Cir. 1995) (CDA covers a dispute if the "crux of the case" rests on a specific contract provision and the relevant merits question is "one of contract interpretation").
Case law confirms that this action is not covered by the CDA. Whether an action is "at its essence a contract action depends both on the source of the rights upon which the plaintiff bases its claims, and upon the type of relief sought (or appropriate)." Megapulse, Inc. v. Lewis, 672 F.2d 959, 968 (D.C. Cir. 1982) (cleaned up). Here, the "source of [CACI's] rights" is not the contract—it is the Trade Secrets Act. That source of rights has consistently been classified as outside of the scope of the CDA. See, e.g., Megapulse, 672 F.2d at 969 (the CDA did not preclude claim based on "alleged governmental infringement of property rights and violation of the Trade Secrets Act"); Westech Gear Corp. v. Dep't of Navy, 733 F. Supp. 390, 391 (D.D.C. 1989) (holding that the CDA did not deprive court of jurisdiction over TSA claim because plaintiff's position was based "on an alleged governmental infringement of property rights"); cf. Ananiades v. Kendall, No. CV 21-1645 MCS, 2022 WL 1446817, at *10 (C.D. Cal. April 14, 2022) (holding that the CDA did not cover suit where plaintiff "alleg[ed] an infringement of property rights, not a breach of contract"); Arch Ins. Co. v. United States, No. 3:9-cv-395, 2010 WL 11640030, at *3 (N.D. Fla. Aug. 9, 2010) (the CDA did not preclude claim when the crucial question involved "traditional tort principles" relating to negligence). And the type of relief sought here—an injunction, not specific performance or monetary damages flowing from a contract breach—further indicates that this claim is not contractual. See Blackhawk Indus. Prods. Grp. Unlimited, LLC v. United States Gen. Servs. Admin., 348 F. Supp. 2d 662, 669 (E.D. Va. 2004) (APA claim that was not "claiming contract remedies" was not covered by the CDA); Megapulse, 672 F.2d at 969 (CDA did not cover claim that sought "no monetary damages against the United States" and the claim "was not properly characterized as one for specific performance").
2. Sovereign Immunity Under the APA
The Navy next claims that CACI cannot overcome the Navy's sovereign immunity protection under the APA. First, it argues that CACI is not seeking review of a "final agency action," meaning that the APA does not apply here. Dkt. 60 at 4-5. Second, it avers that CACI has not "demonstrated that it has no adequate remedy in another court" because it has an adequate contractual remedy under the CDA; according to the Navy, with that alternative remedy available, CACI cannot seek relief under the APA.
The APA is a waiver of sovereign immunity, and thus CACI must meet the strictures of the APA to overcome the Navy's sovereign immunity. Under the APA, "[a] person suffering legal wrong because of agency action, or adversely affected or aggrieved by agency action within the meaning of a relevant statute, is entitled to judicial review thereof." 5 U.S.C. § 702. But that judicial review is circumscribed: it is only afforded to a plaintiff contesting (1) final agency action; (2) for which there is no adequate remedy in a court. 5 U.S.C. § 704.
An agency action is only "final" under certain circumstances. "First, the action must mark the consummation of the agency's decision[-]making process—it must not be of a merely tentative or interlocutory nature. And second, the action must be one by which rights or obligations have been determined, or from which legal consequences will flow." Bennett v. Spear, 520 U.S. 154, 177-78, 117 S.Ct. 1154, 137 L.Ed.2d 281 (1997) (cleaned up).
The Navy suggests that this Court graft an additional requirement: that the agency action be a product of a formal agency decision-making process. It claims that the actions taken here are "nowhere close to the type of acts contemplated in the APA's definition of agency action, which include 'rule, order, lien sanction, [or] relief.' " Dkt. 60 at 4 (quoting 5 U.S.C. § 551(13)). And it attempts to distinguish the cases that CACI relies on as involving "formal decision-making processes and a final decision by an agency" that are not present in this case. Id. at 5.
There is no basis for the additional requirement that the Navy asks this Court to impose. First, the Navy omits a critical part of the statutory definition for agency action, which encompasses an agency's failure to act. 5 U.S.C. § 551(13) (providing that " 'agency action' includes the whole or a part of an agency rule, order, license, sanction, relief, or the equivalent or denial thereof, or failure to act"). And nowhere is there a requirement that "agency action" culminate from some formal decision-making process on the agency's part—and the Navy cannot point to any statute or case law indicating otherwise. This stands to reason, since the statutory definition of agency action "is meant to cover comprehensively every manner in which an agency may exercise its power." Whitman v. American Trucking Ass'ns, 531 U.S. 457, 478, 121 S.Ct. 903, 149 L.Ed.2d 1 (2001). That is why courts have reviewed various actions pursuant to the APA that are not the product of a formal decision-making process, such as the decision to enforce an already-in-place fishing prohibition, San Francisco Herring Ass'n v. Dep't of the Interior, 946 F.3d 564, 575-76 (9th Cir. 2019), the decision not to allow a cruise line to employ persons with a certain visa status, Bimini Superfast Operations LLC v. Winkowski, 994 F. Supp. 2d 106, 117 (D.D.C. 2014), and, similar to the facts at hand, the Navy's decision to release purported trade secrets to competitors, Conax Florida Corp. v. United States, 824 F.2d 1124, 1128-29 (D.C. Cir. 1987). And so the Court declines to impose a de facto formality requirement for the decision-making process, as suggested by the Navy.
Returning to the Spear test, this Court is satisfied that the challenged action is the "consummation of the agency's decision-making process." 531 U.S. at 478, 121 S.Ct. 903. It is quite simple what this inquiry asks: whether the agency action is preliminary (i.e. subject to further review and potential reversal) or final. See Sackett v. E.P.A., 566 U.S. 120, 127, 132 S.Ct. 1367, 182 L.Ed.2d 367 (2012) (decision-making consummated when order at issue was "not subject to further Agency review"); Jake's Fireworks Inc. v. United States Consumer Prod. Safety Comm'n, 498 F. Supp. 3d 792, 803 (D. Md. 2020) (holding that this requirement asks whether the decision "represents the culmination of the [agency's] decision-making process rather than a tentative or intermediate step" (cleaned up)). What the Navy did here was final; that is confirmed by the last communication from the Navy to CACI, where the Navy indicated that it had reviewed CACI's concerns and decided to move forward with the AEW project. Dkt. 7-4 at 2-3. Because the facts show that the Navy's failure to act—despite CACI's urgings otherwise—was not subject to further review and potential change, the first part of the Spear test is satisfied.
The second part of the Spear test is also satisfied because the Navy's actions clearly "determined rights or obligations." Sackett v. E.P.A., 566 U.S. 120, 126, 132 S.Ct. 1367, 182 L.Ed.2d 367 (2012) (cleaned up). The back-and-forth between CACI and the Navy ended when the Navy determined that it had the legal right to the database schema under the relevant DFARS regulations. Logically, that determination also meant that the agency decided that CACI did not have the right to protect that database schema pursuant to the TSA. Those effects, which resulted from the Navy's actions, had a concrete impact on CACI's rights and obligations. See City of New York v. United States Dep't of Def., 913 F.3d 423, 432 (4th Cir. 2019) (explaining that the requirement that agency action determine rights and obligations is "directed at the effect that agency conduct has on private parties").
Independently, the "pragmatic" inquiry as to whether "legal consequences [flowed]" from the Navy's action also indicates that the second Spear factor is satisfied. United States Army Corps of Eng'rs v. Hawkes Co., 578 U.S. 590, 598-99, 136 S.Ct. 1807, 195 L.Ed.2d 77 (2016). "[A]gency actions that expose an individual to criminal or civil liability cause legal consequences." Parsons v. United States Dep't of Justice, 878 F.3d 162, 167 (6th Cir. 2017); see also Louisiana v. United States Army Corps of Eng'rs, 834 F.3d 574, 583 (5th Cir. 2016) ("Judicially reviewable agency actions normally affect a regulated party's possible legal liability . . . ."). Similarly, legal consequences flow from agency action when that action binds the government in a way that exposes it to liability or constricts the legal actions it may take. See QinetiQ US Holdings, Inc. & Subsidiaries v. Comm'r of the Internal Revenue Serv., 845 F.3d 555, 560 (4th Cir. 2017) ("Legal consequences include agency determinations that restrict the government's power to take contrary litigation positions in subsequent proceedings." (cleaned up)); Nat. Res. Def. Council v. E.P.A., 643 F.3d 311, 319 (D.C. Cir. 2011) (EPA action was final agency action when it bound "EPA regional directors"); Harkness v. Sec'y of Navy, 174 F. Supp. 3d 990, 1009-14 (W.D. Tenn. 2016) (reviewing, pursuant to the APA, Establishment Clause claim against the Navy). Here, the agency's actions exposed the government to liability under the Trade Secrets Act, meaning that legal consequences for both sides flowed from the Navy's decision not to comply with CACI's requests.
CACI must meet one more requirement, as it has to show that it has no other adequate remedy. Of particular note here is CACI's potential claim under the Tucker Act: as binding Fourth Circuit precedent directs this Court: "to determine whether [a] [p]laintiff's suit is cognizable under the APA, the court must first examine whether [it] has an available remedy under the Tucker Act." Randall v. United States, 95 F.3d 339, 346 (4th Cir. 1996). The government claims that because CACI could have instead brought a claim for breach of contract seeking money damages pursuant to the Tucker Act, review pursuant to the APA in this Court is inappropriate. Dkt. 60 at 5-6.
The Court has no problem rejecting the government's argument in this regard. The Supreme Court's opinion in Bowen v. Massachusetts, 487 U.S. 879, 108 S.Ct. 2722, 101 L.Ed.2d 749 (1988), is instructive. There, faced with a challenge to agency action that requested injunctive relief, the government argued that the claim was not reviewable under the APA because the plaintiff (Massachusetts) had an adequate remedy in the Claims Court. 487 U.S. at 901-02, 108 S.Ct. 2722. The Supreme Court rejected that argument: "We are not willing to assume, categorically, that a naked money judgment against the United States will always be an adequate substitute for prospective relief fashioned in the light of the rather complex ongoing relationship between the parties." Id. at 905, 108 S.Ct. 2722. Following that principle, when parties seek a remedy that the Claims Court cannot provide, courts consistently hold that federal district courts have jurisdiction. See, e.g., Fort Bend Cnty. v. United States Army Corps of Eng'rs, 59 F.4th 180, 192-93 (5th Cir. 2023) (holding that Tucker Act claim for Takings Clause damages would not provide adequate remedy to county that sought order requiring government to comply with regulatory obligations); Taylor Energy Co. v. Dep't of the Interior, 990 F.3d 1303, 1310-11 (Fed. Cir. 2021) (jurisdiction lied in federal district court because a Tucker Act suit would not provide an adequate remedy to party that asked court to set aside administrative decision). In those cases, any such remedy for money damages would not have been adequate given the nature of the claims. This case is the same—CACI has already expended millions of dollars and countless resources over decades to develop a product that is "highly successful and profitable" and unmatched on the market. Kalas Decl. ¶¶ 4, 40. That value cannot be adequately compensated by a hypothetical claim in the Court of Claims. See Randall, 95 F.3d at 347 (allowing APA action to proceed in federal district court, as opposed to Claims Court, when the "claim for injunctive relief [was] the essence of [the] complaint"); Megapulse, Inc., 672 F.2d at 970 (rejecting government argument that plaintiff had adequate remedy in Court of Claims when plaintiff alleged that the trade secrets it sought to protect were "the very economic life blood" of the company). Accordingly, CACI has demonstrated that it has no adequate remedy in another court.
The Navy seems to argue that Randall commands a different result. Dkt. 60 at 5. However, in Randall, the Fourth Circuit analyzed the claims there and held that "the injunctive relief requested by Plaintiff would not be available under the Tucker Act because it would not be an incident of, or collateral to, a monetary award." 95 F.3d at 347. The same is true here—the sought-after injunction is not available under the Tucker Act in the Court of Federal Claims. Megapulse, Inc., 672 F.2d at 963. As a result, Randall does not support the government's position.
* * * *
Because this claim is not properly classified as a contract claim covered by the CDA, and because CACI has established that its claim is within the scope of the APA, this Court has subject matter jurisdiction.
B. The Preliminary Injunction Factors
Having established jurisdiction, CACI must now show that it is entitled to an injunction. To do so, CACI must establish that each of four preliminary injunction factors weighs in its favor: (1) the likelihood that it will succeed on the merits; (2) the likelihood of irreparable harm to it if the preliminary injunction is denied; (3) the balance of the equities; and (4) the public interest. Winter, 555 U.S. at 20, 129 S.Ct. 365.
1. Likelihood of Success on the Merits
To show that it is likely to succeed on the merits of its case, Plaintiff must make a "clear showing that it will likely succeed on the merits at trial." Real Truth About Obama, Inc. v. F.E.C., 575 F.3d 342, 346 (4th Cir. 2009). However, Plaintiff need not show a "certainty of success" for a preliminary injunction to properly issue. Pashby v. Delia, 709 F.3d 307, 321 (4th Cir. 2013).
CACI contends that it is likely to succeed on its APA claim. It seeks relief pursuant to 5 U.S.C. § 706(2)(A), which provides that a court can "hold unlawful and set aside agency action, findings, and conclusions" that are "arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law." The basis of CACI's suit is that the Navy has not acted "in accordance with law" by violating the Trade Secrets Act (18 U.S.C. § 1905). Dkt. 5 at 20.
A violation of the Trade Secrets Act can be the basis for an APA claim. While 18 U.S.C. § 1905 is actually a criminal statute, an agency's violation of that statute can be the foundation for an APA violation. See Chrysler Corp. v. Brown, 441 U.S. 281, 317-19, 99 S.Ct. 1705, 60 L.Ed.2d 208 (1979) (holding that while 18 U.S.C. § 1905 does not provide a private right of action, a violation of that statute is reviewable under the APA). Specifically, if an agency violates that statute, the action is not "in accordance with the law" and thus is an APA violation. See Blackhawk Indus. Prods. Grp., 348 F. Supp. 2d at 672 (reviewing purported Trade Secrets Act violation under APA); Megapulse, Inc., 672 F.2d at 963 (same). Accordingly, the analysis here is really whether the Navy violated the Trade Secrets Act: the APA claim rises and falls with that determination.
The Trade Secrets Act prohibits disclosure of trade secrets by the government. In relevant part, it reads:
Whoever, being an officer or employee of the United States or of any department or agency thereof . . . publishes, divulges, discloses, or makes known in any manner or to any extent not authorized by law any information coming to him in the course of his employment or official duties or by reason of any examination or investigation made by, or return, report or record made to or filed with, such department or agency or officer or employee thereof, which information concerns or relates to the trade secrets . . . of any person, firm, partnership, corporation, or association . . . [shall be punished under the statute].18 U.S.C. § 1905. Taken down to its core, the statute prohibits (1) government disclosure; (2) of a trade secret (or other confidential information); (3) that is not authorized by law. Acumenics Res. & Tech. v. United States Dep't of Justice, 843 F.2d 800, 806 (4th Cir. 1988); Tao of Sys. Integration, Inc. v. Analytical Servs. & Materials, Inc., 299 F. Supp. 2d 565, 577 (E.D. Va. 2004); Walsh v. Alight Sol's LLC, 44 F.4th 716, 727 (7th Cir. 2022).
The first element—that the Navy disclosed the information that is allegedly a trade secret—is not contested. The government does not quibble with CACI's assertion that the Navy disclosed ADCS, nor could it. Only two individuals had complete access to ADCS: Mr. Sines and Ms. Mitchell. Kalas Decl. ¶ 54. As soon as Ms. Mitchell granted Mr. Gabiou access to ADCS, she disclosed the trade secrets. Strand Decl. ¶¶ 13, 15. Those trade secrets were subsequently further disclosed to government and non-government employees via the shared site. Kalas Decl. ¶¶ 72, 74; Dkt. 8-7.
At oral argument, there was some confusion over the word "access" in this context. For clarity's sake, when discussing who was able to utilize ADCS (aside from Ms. Mitchell and Mr. Sines), the Court refers to that as "disclosure" of ADCS by the government. That is consistent with the statute's language—since only Mr. Sines and Ms. Mitchell were granted full privileges to ADCS, when any individual had similar use of ADCS as them, the government "disclosed" ADCS. Later on, when discussing the actual use of ADCS, the Court refers to it as "access."
It is similarly easy to determine that the information that was disclosed is a trade secret. In its opposition, the government briefly attempts to argue that CACI has not adequately defined the "trade secret." Dkt. 39 at 10. That argument is unavailing. CACI thoroughly defined the work that went into developing ADCS: the use of "lateral methodology[,]" Kalas Decl. ¶¶ 19-24, the "relational database" that guides the software, id. ¶¶ 27-28, and the importance of the database schema to ADCS, id. ¶¶ 37-40. All of that is enough for CACI to meet its burden of establishing that it possesses a trade secret. See Trandes Corp. v. Guy F. Atkinson Co., 996 F.2d 655, 661 (4th Cir. 1993) (interpreting Maryland trade secret law and holding that plaintiff carried its burden of "producing some evidence that [its products] met the definition of a trade secret"). When combined with the various facts about the efforts CACI has taken to protect the proprietary nature of its trade secrets, e.g. Kalas Decl. ¶¶ 48-55, CACI has established that the Navy disclosed trade secrets.
The parties' disagreement is rooted in whether the Navy's disclosure of ADCS was "authorized by law." The Navy claims that it was allowed to access ADCS, as the contract that it has with CACI incorporates various regulations set forth in the Defense Federal Acquisition Regulations Supplement ("DFARS"). Dkt. 39 at 10. Those regulations, in turn, permit the Navy the "unrestricted right" to access "form, fit, and function data[,]" which the Navy claims is all it accessed. Id. at 13-16. As a result, the Navy argues, it was only disclosing data that the contract (via the regulation) gave it an "unrestricted right" to, meaning that such disclosure was "authorized by law" and not a violation of the Trade Secrets Act. Id.
Fundamentally, CACI disagrees. It first argues that the Navy's claims are not "credible" because there are no innocent explanations of why the Navy did what it did. Dkt. 41 at 8-10. Next, it asserts that the database scheme is "computer software" that is explicitly not "form, fit, and function" data covered by the applicable DFARS regulation. Id. at 10-14. Alternatively, it claims that even if the ADCS schema is not "computer software," it nevertheless does not fall under the definition of "form, fit, and function data." Id. at 14-16.
To begin, there is no dispute that the DFARS regulation the Navy cites could make its disclosure of the database schema proper under the Trade Secrets Act. The Navy argues, and CACI does not appear to contest, that an agency regulation can give the "authorization by law" that would render the Navy's actions outside of the scope of the Trade Secrets Act. So long as the regulation is (1) a properly promulgated, substantive regulation; that (2) affects individual rights and obligations; and (3) conforms with the APA's procedural prerequisites, it provides the "authorization by law" that the Navy needs. Chrysler Corp., 441 U.S. at 296, 302-03, 99 S.Ct. 1705. The Navy argues that all of those prerequisites are met by the DFARS provisions cited here, and CACI does not appear to contest that contention. There is also no dispute that those provisions were incorporated into the parties' contract. See Dkt. 39-1 (contract). Accordingly, the Court assumes that the relevant DFARS provisions constitute "authorization by law" under the Trade Secrets Act.
The question, then, is whether the database schema is covered by the DFARS provisions that the Navy cites. In relevant part, 48 C.F.R. § 252.227-7015(b)(1)(iv) (hereinafter "DFARS-7015") provides that the United States "shall have unlimited rights in technical data that are . . . form, fit, and function data[.]" And DFARS defines "form, fit, and function data" as "technical data that describes the required overall physical, functional, and performance characteristics (along with the qualification requirements, if applicable) of an item, component, or process to the extent necessary to permit identification of physically and functionally interchangeable items." 48 C.F.R. § 252.227-7013(a)(11) (hereinafter "DFARS-7013"). In reality, these regulations require the Navy to thread quite a thin needle: its only argument is that the disclosure of trade secrets was authorized by law because what it disclosed is "form, fit, and function data" under the regulations, and those definitions are fairly narrow.
So, the Court must determine whether the database schema is covered by the two DFARS regulations. Both DFARS-7015 and DFARS-7013 explicitly apply to "technical data." And, as both parties acknowledge, under the regulations, "computer software" is not "technical data." 48 C.F.R. § 252.227-7015(a)(4) (definition of "technical data" under the regulation, stating that "[t]he term does not include computer software"). Moreover, for DFARS to be an adequate shield for the Navy in this situation, the database schema must fall under the definition of "form, fit, and function data" as set forth in DFARS-7013. As a result, if the database schema is, pursuant to DFARS, either (1) "computer software" or (2) not "form, fit, and function" data, DFARS does not give the Navy the "authorization by law" that it needs.
The Court agrees with CACI that the database schema is properly classified as "computer software" under the regulations. As the Navy acknowledges, the applicable DFARS definition of "computer software" is fairly broad, as it includes "material that would enable the software to be reproduced, recreated, or recompiled." 48 C.F.R. § 252.227-7013(a)(3). The Navy has never disputed CACI's assertion that the database schema provides vital information into how CACI's "software development team organized and built the source code." Kalas Decl. ¶ 70. Nor has it contested that a software engineer could "build an alternative to ADCS" with access to the database schema "by examining the relationships between database elements." Id. See Digital Drilling Data Sys. LLC v. Petrolink Servs., Inc., No. 4:15-cv-2172, 2018 WL 2267139, at *6-*7 (S.D. Tex. May 16, 2018) (recognizing that database schema links together data in a "creative and discretionary" way). Because those facts are uncontested at this stage, under the relevant DFARS definitions, the database schema is plainly "computer software" not covered by the "form, fit, and function" provision, as ADCS can be reconstructed with mere access to the schema.
The Navy's response that the database schema is not "computer software" because it is a "computer data base" is not persuasive. Under DFARS, a "computer data base means a collection of data recorded in a form capable of being processed by a computer." 48 C.F.R. § 252.227-7013(a)(1). But the Navy provides little to support its assertion that the database schema meets this definition, and CACI's proffered facts indicate that the definition does not apply. The very term—database schema—indicates that what the Navy disclosed is not merely a "collection of data." See Kalas Decl. ¶ 28 (explaining that a database schema "defines the types of data within the tables and also the relationships between the tables and the data therein" (emphasis added)). As CACI has set forth, the database schema is the "blueprint" for the database, i.e. it enables one to understand "how [the database] effectively manages its data[,]" not what the data is. Id.; see also id. ¶¶ 29-40 (explaining how database schema relates to the underlying data). And in this context, that makes sense: the "data base" would be the underlying maintenance information (that is owned by the Navy), while the database schema organizes and sorts that information in a specific way.
The parties' contract further confirms that the database schema is computer software. The contract incorporates a policy memorandum from Ms. Delores Etter, an Assistant Secretary of the Navy. Dkt. 39-1, Att. A (Contract) at 77, § 3.2.7.7. That policy memorandum includes "building database[ ] schema" within its definition of "computer software development." United States Navy, Software Process Improvement Initiative (SPII) Guidance for Software Process Improvement Contract Language at 3 (July 13, 2007). So in the Navy's own words, when a company builds "database schema" it is developing "computer software." Id.
Case law also buttresses the conclusion that database schema can be properly classified as "computer software" under DFARS. In the copyright context, courts consistently recognize the protectability of database schema under copyright law. See, e.g., DSMC, Inc. v. Convera Corp., 479 F. Supp. 2d 68, 80-83 (D.D.C. 2007) (holding that database schema are protected under copyright law); Merch. Transaction Sys., Inc. v. Nelcela, Inc., No. CV 2-1954, 2009 WL 723001, at *16 (D. Ariz. Mar. 18, 2009) (same). That further underscores the unique, proprietary nature of the database schema and the potentiality that access to the schema would enable reproduction of ADCS, especially since the "purpose of [ ] copyright laws is to protect original designs from copying[.]" Durham Indus., Inc. v. Tomy Corp., 630 F.2d 905, 912 (2d Cir. 1980) (cleaned up).
Independently, even if the database schema was not "computer software," it nevertheless does not qualify as "form, fit, and function" data. Recall the definition of "form, fit, and function" data: "technical data that describes the required overall physical, functional, and performance characteristics (along with the qualification requirements, if applicable) of an item, component, or process to the extent necessary to permit identification of physically and functionally interchangeable items." 48 C.F.R. § 252.227-7013(a)(11). The Navy explains that it needs the database schema to know "how the ADCS software is actually interacting with the Navy data." Opp. at 39; Zager Decl. ¶ 9. While the Navy might actually need information about some aspects of the database schema (and be entitled to it under the regulation, as incorporated by the contract), that is only true to a certain point: it has a right (under the DFARS definition of "form, fit, and function data") to the technical data that "describes the required overall physical, functional, and performance characteristics (along with the qualification requirements, if applicable) of" ADCS. 48 C.F.R. § 252.227-7013(a)(11). Undeniably, more than just technical data about the "physical, functional, and performance characteristics of ADCS" was involved when the Navy disclosed the database schema: it also accessed CACI's proprietary work on its relational database, which explained how the database schema "map[ped] out a complex network of connections [and made] numerous . . . choices about how to define, organize, and prioritize all of the data stored within ADCS." Kalas Decl. ¶ 38. So while some portion, information about, or description of the database schema could qualify as "form, fit, and function data[,]" what the Navy is entitled to under the regulation is quite limited. And the Navy has not offered any argument (or facts) concerning what information it specifically needs from CACI to identify "physically and functionally interchangeable items." It has only pointed to the database schema as a whole.
* * * *
CACI has shown that it is likely to succeed on the merits of its APA claim. The facts show that the database scheme is a "computer software" that the Navy has no right to and is also not "form, fit, and function data." As a result, the Navy's disclosure of the database schema to non-approved parties was not "authorized by law" under the Trade Secrets Act. Consequently, the Navy's actions were not "in accordance with the law" and CACI is likely to succeed on its APA claim.
C. Irreparable Harm
Plaintiff's must next show that it will suffer irreparable harm absent a preliminary injunction. To do so, CACI must make a "strong showing that it will suffer irreparable harm if the injunction is denied[,]" and that the irreparable harm it will suffer is "actual and imminent." Scotts Co. v. United Indus. Corp., 315 F.3d 264, 283 (4th Cir. 2002) (cleaned up). It must also be "likely" that the asserted harm will occur if no injunction is issued. Aslanturk v. Hott, 459 F. Supp. 3d 681, 700 (E.D. Va. 2020).
On its own, the disclosure of a trade secret "establishes immediate irreparable harm." Home Funding Grp., LLC v. Myers, No. 1:6-cv-1400, 2006 WL 6847953, at *2 (E.D. Va. Dec. 14, 2006). However, it is true in this case that the disclosure has already occurred, and, that as a result, the Navy has taken certain steps to ensure that there is no further disclosure of CACI's proprietary data and to identify those individuals who could have accessed the database schema. See, e.g., Zager Decl. ¶¶ 28-47 (describing efforts that the Navy has taken to mitigate effects of disclosure).
But it would make no sense to conclude that because the violation of the Trade Secrets Act has already occurred, Plaintiff cannot show "irreparable harm." Indeed, the disclosure of trade secrets establishes immediate irreparable harm "because a trade secret, once lost, is of course, lost forever." Myers, 2006 WL 6847953, at *2. CACI's point is that while the trade secret has been disclosed, it has not yet been lost. According to CACI, the trade secret will be "lost" when either the Navy (or some competitor) use the database schema to "reverse engineer ADCS." Dkt. 61 at 7. That makes sense: CACI would be irreparably harmed if its trade secrets are utilized in a way that compromises its ability to provide a unique—indeed, a one-of-a-kind—product to the Navy. See Conax Florida Corp. v. United States, 625 F. Supp. 1324, 1326-27 (D.D.C. 1985) (finding that plaintiff showed it would "suffer irreparable harm" by losing its "sole source position").
Accordingly, CACI has made the "strong showing" of irreparable harm. The harm is actual and imminent, as the Navy acknowledges that it is developing a replacement for ADCS which, to this point, has evidently been irreplaceable. And CACI has presented unrebutted facts that ADCS is irreplaceable because of the database schema. Kalas Decl. ¶¶ 38-40. The information about the database schema (i.e. the trade secret) has not yet been "lost[,]" but needs to be corralled, and the scope of its diffusion among the Navy and third-party contractors needs to be understood. Absent that corralling and understanding, CACI asserts, the trade secrets will be lost because the proprietary information that CACI has developed will be readily replicable. That is sufficient for CACI to meet its burden of establishing irreparable harm.
Curiously, the government argues that CACI has not established irreparable harm because it has not "submitted any evidence that Navy is freely sharing the information that the Navy has obtained." Dkt. 39 at 17. But that does not matter—even if no one outside of the Navy had access to the information, CACI would be subject to irreparable harm: the Navy cannot use CACI's proprietary information to develop its own replacement to ADCS, as the Trade Secrets Act and the APA would forbid the Navy from doing so. The Navy has not pointed to anything indicating otherwise.
D. The Equities and the Public Interest
Finally, CACI must show that the balance of equities and public interest tip in its favor, which, in this case (which is against the government) merge into a single inquiry. Nken v. Holder, 556 U.S. 418, 435, 129 S.Ct. 1749, 173 L.Ed.2d 550 (2009).
The issue of what relief CACI seeks is relevant to this determination. The parties disagree as to what CACI really seeks here: CACI claims it "simply seeks to restore the status quo ante[,]" Dkt. 5 at 29, while the government contends that CACI seeks active action on the Navy's part and does not want a return to the status quo, Dkt. 39 at 19. In a sense, it is impossible to return to the actual status quo ante: in such a world, only CACI and two individuals at the Navy had seen the inner workings of the database schema. But there is no way to un-ring the bell that the Navy has rung, as it is impossible to return to that status quo. What is critical to CACI, though, is that its "blueprint" does not inform competing products, whether developed by the Navy or a commercial competitor.
With that in mind, the Court is persuaded that the equities and public interest are heavily in CACI's favor. There is a strong public interest in curing the effects of the government's unlawful acts here, as the "public interest is, of course, best served when government agencies act lawfully." Minney v. United States Office of Personnel Mgmt., 130 F. Supp. 3d 225, 236 (D.D.C. 2015); see Planned Parenthood of N.Y.C., Inc. v. United States Dep't of Health and Human Servs., 337 F. Supp. 3d 308, 343 (S.D.N.Y. 2018) ("It is evident that there is generally no public interest in the perpetuation of unlawful agency action." (cleaned up)). And "[t]o the contrary, there is a substantial public interest in having governmental agencies abide by the federal laws that govern their existence and operations." League of Women Voters of the United States v. Newby, 838 F.3d 1, 12 (D.C. Cir. 2016) (cleaned up).
Moreover, there is a strong public interest in ensuring the protection of trade secrets. As evidenced by CACI's efforts to develop ADCS, and the resulting ability for CACI to be the sole-source supplier to the Navy for its aircraft maintenance software, trade secrets have immense economic value to companies. See generally Michael Risch, Why Do We Have Trade Secrets?, 11 MARQ. INTELL. PROP. L. REV. 1, 26-28 (2007) (describing the economic reasons undergirding trade secret protection). That is why "[c]ourts within the Fourth Circuit recognize that the public interest favors the protection of confidential business information." Variable Annuity Life Ins. Co. v. Coreth, 535 F. Supp. 3d 488, 519 (E.D. Va. 2021) (cleaned up). Accordingly, "[t]here is no doubt that it is in the public interest to protect trade secrets . . . ." API Tech. Servs., LLC v. Francis, No. 4:13-cv-142, 2013 WL 12131381, at *3 (E.D. Va. Dec. 4, 2013) (cleaned up).
The government cannot demonstrate the public interest and equities tilt in its favor. It asserts that this Court should defer to the Navy's weighing of the relative interests, given the military implications and the Navy's expertise. Dkt. 39 at 19 (quoting Winter, 555 U.S. at 24, 129 S.Ct. 365 and In re Navy Chaplaincy, 697 F.3d 1171, 1179 (D.C. Cir. 2012)). There are two issues with that perspective. First, this case does not involve "complex, subtle, and professional decisions as to the composition, training, equipping, and control of a military force, which are essentially professional military judgments." Winter, 555 U.S. at 24, 129 S.Ct. 365 (quoting Gilligan v. Morgan, 413 U.S. 1, 10, 93 S.Ct. 2440, 37 L.Ed.2d 407 (1973)) (cleaned up). And so the "great deference" that Winter speaks to is not necessary here. See, e.g., 555 U.S. at 24-25, 129 S.Ct. 365 (deferring to military judgment when plaintiff sought an injunction against the Navy using sonar in its training exercises, which a Navy Captain described as "mission-critical"). Second, and even more fundamentally, the Navy has not pointed to any specific issues with a tailored injunction (described infra). It merely claims that the lawsuit "may . . . be an effort to get Navy not to develop its replacement to CACI's ADCS." Dkt. 39. That is far different from the military judgments that courts must defer to; in fact, the Navy has offered no "professional judgment of military authorities regarding the harm that would result to military interests if an injunction were granted." Navy Chaplaincy, 697 F.3d at 1179. Without such information, this Court need not defer to rank speculation about what possibly could occur if a hypothetically broad injunction were to issue.
E. The Scope of the Injunction
While the Court has "wide discretion to fashion injunctive relief in a particular case," it must "mold its decree to meet the exigencies of th[is] particular case." Cap. One Fin. Corp. v. Sykes, No. 3:20-cv-767, 2021 WL 2903241, at *15 (E.D. Va. July 9, 2021) (quoting Roe v. Dep't of Def., 947 F.3d 207, 231 (4th Cir. 2020)). As such, the Court "must consider the proper scope" of the preliminary injunction that Plaintiff seeks here. Id.
The scope of the injunction is especially important here for a few reasons. First, the Court recognizes that the Navy (and some third parties known and unknown) have taken some action to alleviate some of the harms that have resulted from the unauthorized disclosure of and access to CACI's proprietary information. Second, the Court recognizes that the Navy is free to replace ADCS, whether by developing its own products or seeking a replacement product from another company so long as the Navy does not use CACI's trade secrets—a proposition that CACI does not contest. Third, and relatedly, the Court recognizes that the status quo ante cannot be restored, and thus certain remedial measures must be taken to ensure that further harm is not done to CACI.
With that in mind, and having carefully considered the relevant interests, the Court finds that there are four objectives that should be served by an injunction. First, access to ADCS outside of the normal use of CACI's software should be prohibited. Second, the identities of each individual outside of CACI (aside from Ms. Mitchell and Mr. Sines) who had access to the database schema must be determined, and they should be precluded from working on the Navy's efforts to replace ADCS, whether AEW or otherwise. Third, any vestiges of the database schema that are on the Navy's systems outside of the normal use of ADCS should be deleted. And fourth, there should be an independent determination of whether (and if so, to what extent) the Navy's AEW project utilized CACI's trade secrets. The Court fashions an injunction to serve such purposes below.
F. The Bond Requirement
The Court must also address the Rule 65(c) security requirement. The purpose of the bond requirement is to "provide a mechanism for reimbursing an enjoined party from harm it suffers as a result of an improvidently issued injunction . . . ." Hoechst Diafoil Co. v. Nan Ya Plastics Corp., 174 F.3d 411, 421 n.3 (4th Cir. 1999). The Court "retains the discretion to set the [Rule 65(c)] bond amount as it sees fit or waive the security requirement." Pashby v. Delia, 709 F.3d 307, 332 (4th Cir. 2013). The Navy asks for a $215,000 bond, as an estimate of the money it has already spent on its efforts to replace ADCS.
The Court does not find that bond is appropriate here. As set forth below, the injunction does not require the Navy to cease its work on its efforts to replace ADCS. It only requires the Navy to identify and seal off any individuals who had access to CACI's proprietary information and investigate and remove the use of ADCS that is not in accordance with its normal use. That undertaking is not costly, and allows the Navy to continue its AEW project. That, combined with the public interest weighing heavily in CACI's favor and CACI's strong likelihood of success on the merits, renders bond inappropriate. The Court waives such a requirement.
If, after further investigation, it is revealed that the AEW project (or some other project) utilized the trade secrets in developing a replacement product, further relief may be necessary for CACI. But that issue is not yet ripe, and may never come to fruition, so the Court declines to address such hypotheticals at this stage.
IV. CONCLUSION
For the foregoing reasons, it is hereby ORDERED that Plaintiff's Motion for a Preliminary Injunction (Dkt. 4) is GRANTED-IN-PART; and it is
FURTHER ORDERED that the United States Navy, along with its officers, agents, servants, employees, franchisees, and all persons in active concert or participation with the United States Navy, are preliminarily enjoined from accessing, disclosing, or otherwise using the ADCS database schema for any purpose other than the normal use of CACI's software; specifically, how the Navy used the ADCS database schema for aircraft maintenance prior to February of 2023; and it is
FURTHER ORDERED that any individual who has or has had access to the ADCS database schema is preliminarily enjoined from being involved in any way in any portion of the AEW project that involves a relational database; and it is
FURTHER ORDERED that within ten (10) days of this Order, the United States Navy shall:
(1) Provide CACI with all logs from the Confluence site to which the ADCS database schema was posted during the time that the ADCS database schema was published;
(2) Undertake a thorough investigation to determine the identity of all individuals (whether associated with the Navy or third parties) that have or have had access in any way to the ADCS database schema, or have been exposed to any portion thereof in any manner;
(3) Conduct and provide to CACI a forensic examination of its computer systems, including its IT system, servers and resources, as well as the local drives of any Navy personnel who have been or are involved with the Transition Group, to determine whether and where portions of the ADCS database may still reside on the United States Navy's computers and computer systems. The Navy shall also provide CACI with a description of the methodology and searches employed, the locations searched, and the results of such searches;
(4) Provide CACI with all SQL Server logs showing all information relating to access to the ADCS databases (production and test environments), including all SQL commands executed by any user, from January 1, 2023 to the present;
(5) If the United States Navy finds the ADCS database schema, or any portions thereof, on any of its computers or computer systems, it shall first preserve all evidence, including metadata, regarding the ADCS database schema found on Navy's computers or computer network, and then remove the database schema from individuals' computers and Navy's computer network and quarantine the database schema in a safe, non-networked location; and it is
FURTHER ORDERED that within twenty-one (21) days of this Order the parties shall agree upon an independent expert to analyze the source code repository for AEW to determine whether the United States Navy utilized the proprietary ADCS database schema in developing AEW, whose costs are to be equally borne by the parties; if the parties cannot agree on an expert, they shall each submit two experts, for a total of four, of which the Court will choose one; and it is
FURTHER ORDERED that within fourteen (14) days of the selection of the expert, the parties shall agree upon a timeline and process for the expert to independently analyze the source code; if the parties cannot agree upon a timeline and process, they must each provide their proposals to the Court; and it is
FURTHER ORDERED that the parties shall provide a joint status report to the Court every fourteen (14) days.
IT IS SO ORDERED.