Opinion
Case No. 19-81160-CIV-SMITH
2020-12-29
APPLE INC., Plaintiff, v. CORELLIUM, LLC, Defendant.
Emily Louise Pincow, Martin B. Goldberg, Lash & Goldberg LLP, Miami, FL, Andrew M. Gass, Pro Hac Vice, Latham & Watkins LLP, Marc R. Lewis, Pro Hac Vice, Lewis and Llewellyn LLP, San Francisco, CA, Elana Nightingale Dawson, Pro Hac Vice, Kathryn H. Ruemmler, Pro Hac Vice, Sarang Vijay Damle, Pro Hac Vice, Latham & Watkins LLP, Washington, DC, Gabriel S. Gross, Pro Hac Vice, Latham & Watkins LLP, Menlo Park, CA, Jessica Stebbins Bina, Pro Hac Vice, Latham & Watkins LLP, Los Angeles, CA, Joseph R. Wetzel, Jr., Pro Hac Vice, Latham & Watkins LLP, San Francisco, FL, Michele D. Johnson, Pro Hac Vice, Latham & Watkins LLP, Costa Mesa, CA, for Plaintiff. Gavin Cunningham Gaukroger, Berger Singerman LLP, Fort Lauderdale, FL, Thomas Lee Hunker, Cole, Scott & Kissane, P.A., Plantation, FL, Barry Adam Postman, Justin B. Levine, Lizza Carola Constantine, S. Jonathan Vine, Cole Scott & Kissane, Michael Alexander Boehringer, Cole, Scott, Kissane, West Palm Beach, FL, Conor B. McDonough, Pro Hac Vice, David L. Hecht, Maxim Price, Minyao Wang, Melody L. McGowin, Pro Hac Vice, Yi Wen Wu, Pro Hac Vice, Pierce Bainbridge Beck Price & Hecht LLP, New York, NY, for Defendant.
Emily Louise Pincow, Martin B. Goldberg, Lash & Goldberg LLP, Miami, FL, Andrew M. Gass, Pro Hac Vice, Latham & Watkins LLP, Marc R. Lewis, Pro Hac Vice, Lewis and Llewellyn LLP, San Francisco, CA, Elana Nightingale Dawson, Pro Hac Vice, Kathryn H. Ruemmler, Pro Hac Vice, Sarang Vijay Damle, Pro Hac Vice, Latham & Watkins LLP, Washington, DC, Gabriel S. Gross, Pro Hac Vice, Latham & Watkins LLP, Menlo Park, CA, Jessica Stebbins Bina, Pro Hac Vice, Latham & Watkins LLP, Los Angeles, CA, Joseph R. Wetzel, Jr., Pro Hac Vice, Latham & Watkins LLP, San Francisco, FL, Michele D. Johnson, Pro Hac Vice, Latham & Watkins LLP, Costa Mesa, CA, for Plaintiff.
Gavin Cunningham Gaukroger, Berger Singerman LLP, Fort Lauderdale, FL, Thomas Lee Hunker, Cole, Scott & Kissane, P.A., Plantation, FL, Barry Adam Postman, Justin B. Levine, Lizza Carola Constantine, S. Jonathan Vine, Cole Scott & Kissane, Michael Alexander Boehringer, Cole, Scott, Kissane, West Palm Beach, FL, Conor B. McDonough, Pro Hac Vice, David L. Hecht, Maxim Price, Minyao Wang, Melody L. McGowin, Pro Hac Vice, Yi Wen Wu, Pro Hac Vice, Pierce Bainbridge Beck Price & Hecht LLP, New York, NY, for Defendant.
ORDER ON THE PARTIES’ MOTIONS FOR SUMMARY JUDGMENT
RODNEY SMITH, UNITED STATES DISTRICT JUDGE Plaintiff, Apple Inc. ("Apple") designs and manufactures mobile communication devices, personal computers, and media devices, and sells a variety of related software, services, accessories, and third-party digital content and applications. iOS is Apple's mobile operating system (or "OS") for certain devices like the iPhone. iOS is publicly available online for free download from Apple's servers as part of a packaged file. Around 2016 or 2017, Apple removed encryption from the kernel, which is the core of the operating system that has complete control over all system resources.
In 2017, Defendant, Corellium, LLC ("Corellium") began developing a commercial product ("the Corellium Product") that permits users to create tailored, virtual models of iPhones, using iOS files loaded by the user. (The Corellium Product also virtualizes Android, the mobile operating system used by Google, but the Android aspects of the Corellium Product are not issue in this case.) With its relatively limited functionality, among other things, the Corellium Product does not virtualize the Apple App Store, and users cannot make phone calls or use camera—features of interest to the average customer buying an iPhone off the shelf. According to testimony of developers of the Corellium Product, the product is intended to provide an environment in which technology security researchers can conduct research with features of interest to those researchers. Still, there is no evidence that the Corellium Product, like other technology, cannot be used for unintended purposes, or that Corellium can control how users utilize any Corellium Product installed on their premises.
Starting in January 2018, Apple and Corellium began engaging in acquisition talks which, if successful, would have allowed Apple to acquire Corellium (including its people and the Corellium Product). During the acquisition process, there were several in-person meetings and calls between the companies. The Corellium Product was demonstrated ("demo'ed") to Apple and there was technical due diligence. In the summer of 2018, the potential deal fell apart and Apple did not acquire Corellium.
On August 15, 2019, Apple filed this lawsuit alleging that Corellium infringed Apple's copyrights in iOS and circumvented its security measures in violation of the federal Digital Millennium Copyright Act ("DMCA"). Corellium denies that it has violated the DMCA or Apple's copyrights. Corellium further argues that even if it used Apple's copyrighted work, such use constitutes "fair use" and, therefore, is legally permissible. Apple filed a Motion for Partial Summary Judgment [DE 470] and Corellium filed a Motion for Summary Judgment [DE 464]. For the reasons explained below, on the copyright claim, the Court finds that Corellium's use of iOS constitutes fair use, and a genuine dispute of material facts precludes summary judgment on the DMCA claim. Thus, Corellium's motion is granted in part and denied in part, and Apple's motion is denied.
To the extent the parties agree on the facts and the facts as stated are supported by the evidence, the Court may cite to the parties’ Statements of Material Facts ("SOF"). Regarding declarations, under the law of this Circuit, "[w]hen a party has given clear answers to unambiguous questions which negate the existence of any genuine issue of material fact [for summary judgment], that party cannot thereafter create such an issue with an affidavit that merely contradicts, without explanation, previously given clear testimony. Such an affidavit would be a sham." McCormick v. City of Fort Lauderdale , 333 F.3d 1234, 1240 (11th Cir. 2003) (internal citation omitted). Additionally, the Court does not consider evidence that has been stricken pursuant to the Court's August 24, 2020 Order [DE 658] and the parties’ related Joint Stipulation [DE 722]. Lastly, citations to the record primarily reflect sealed versions of the document, not the publicly available copies.
BACKGROUND
A. iOS: APPLE'S OPERATING SYSTEM
An operating system is a program that manages the resources of the computer, allocating those resources to other programs as needed. It manages the computer's most basic functions, including the user's interaction with the device. iOS is Apple's operating system for its iPhone, iPod Touch, and until September 25, 2019, iPad. (Andrews Decl. [DE 470-4] ¶ 4.) The iPhone was introduced in 2007. It is one of the world's first "smartphones" and remains one of the most popular consumer electronic devices in the world. (Andrews Decl. ¶ 3.) For the iPhone, among other things, the ability to make phone calls, send text messages, take photos, and download apps from Apple's App Store are important features of iOS. (Def.’s SOF [DE 472] ¶ 3.)
iOS does not include hardware or some components of the secure boot chain (discussed below), like Boot ROM, which are built directly into the physical device. (Def.’s SOF ¶ 4.) However, iOS encompasses default software applications, underlying graphics, images, and files that help create the iOS displays, and graphical user interface ("GUI") elements installed on Apple's mobile devices. (Andrews Decl. ¶ 6.) Generally, GUI is a visual way of interacting with a computer using items such as icons and menus. iOS also encompasses the source code and object code representing the processes managing the execution of applications and utilization of device resources. (Andrews Decl. ¶ 6.)
https://www.merriam-webster.com/dictionary/graphical% 20user% 20interface.
Regarding source code and object code:
Computers come down to one basic premise: They operate with a series of on and off switches, using two digits in the binary (base 2) number system—0 (for off) and 1 (for on). All data and instructions input to or contained in computers therefore must be reduced to ... 1 and 0 .... Some highly skilled human beings can reduce data and instructions to strings of 1's and 0's and thus program computers to perform complex tasks by inputting commands and data in that form. But it would be inconvenient, inefficient and, for most people, probably impossible to do so. In consequence, computer science has developed programming languages. These languages, like other written languages, employ symbols and syntax to convey meaning. The text of programs written in these languages is referred to as source code. And whether directly or through the medium of another program, the sets of instructions written in programming languages—the source code—ultimately are translated into machine "readable" strings of 1's and 0's, known in the computer world as object code, which typically are executable by the computer .... All code is human readable. As source code is closer to human language than is object code, it tends to be comprehended more easily by humans than object code.
Universal City Studios, Inc. v. Reimerdes , 111 F. Supp. 2d 294, 306 (S.D.N.Y. 2000), aff'd sub nom. Universal City Studios, Inc. v. Corley , 273 F.3d 429 (2d Cir. 2001) (internal citation omitted).
iOS includes open and partially open source code; it includes code that was not written by Apple. (Marineau-Mes Dep. [DE 472-4] 37:6-14.) This includes: (1) open source code that Apple uses under license (e.g., Secure Socket Layer); (2) components for which Apple is the primary owner (e.g., WebKit); and (3) aspects where Apple contributes some of the code (e.g., the kernel). (Andrews Dep. [DE 472-3] 91:22-93:13, 100:20-23; Marineau-Mes Dep. 37:6-40:11 (other open source components of iOS are the compiler and Swift).) Likewise, iOS’ Darwin, which is part of the kernel, stems from research dating back thirty to forty years—long before Apple developed the iPhone. (Marineau-Mes Dep. 37:6-40:6.) For these open source components, Apple is key contributor to the code bases and, in many cases, invented the code and chose to make it available in open source. (Marineau-Mes Dep. 39:23-40:7.)
B. IPSW FILES
Apple continuously releases new versions of iOS. It also releases at least some components of iOS in software files known as "IPSW" files. (Andrews Dep. 94:13-25; Krstic Dep. [DE 472-1] 126:13-127:21; Wang Dep. [DE 472-6] 59:24-61:10.) IPSW files are available online for free download from Apple's servers, including via links provided on third-party sites like ipsw.me. (Def.’s SOF ¶ 6.) A user is not presented with or required to agree to the iOS Software License Agreement or End User License Agreement ("EULA") before downloading an IPSW file. (Def.’s SOF ¶ 12; Andrews Dep. 95:13-15, 98:14-20.)
IPSW files have iOS without some of the runtime elements such as the cryptographic authorization ticket, which authorizes a given version of iOS to run in a given piece of hardware. (Krstic Dep. 126:13-127:21.) Further, many parts of the IPSW files are unencrypted, including the kernel, which is the core of the operating system that has complete control over all system resources. (Def.’s SOF ¶ 8.) Thus, once downloaded, a person can read some of the file contents, and it is possible to access contents of the kernel, as well as extract other parts of the file. (Krstic Dep. 67:12-21, 129:21-130:4; Marineau-Mes Dep. 57:2-10.) The kernel can run on non-Apple devices, but protections put in place by Apple—which intends for the kernel to run on Apple devices—makes it difficult to do so. (Krstic Dep. 130:23-132:13, 141-143:3.) The IPSW files also contain image files such as wallpaper. (Def.’s SOF ¶ 7.)
C. APPLE'S TECHNICAL CONTROL MEASURES
Apple designs iOS and devices running iOS as an integrated hardware/software system. (Pl.’s SOF [DE 470-2] ¶ 10.) Apple does not provide the functionality to "clone" or copy the complete contents of an iPhone. (Id. ¶ 11.) Combining hardware, software, and service features, Apple has put security measures in place to protect its devices and customers’ experience. (Pl.’s Resp. to Second Interr. No. 16 [DE 553-9]. ) In its motion, Apple focuses on the following measures: Authorization Server : According to Apple, upon installing iOS on an Apple device (e.g., iPhone), the device must first communicate with Apple's "authorization server" for approval. The device sends information to Apple about the physical iPhone and the version of iOS the user seeks to install. The authorization server checks this information, and if the information presented checks out, returns a cryptographic signature (known as an "AP Ticket") authorizing installation on the device. The signed AP Ticket is saved to the device and is required to be checked every time the device tries to run iOS. (Pl.’s SOF ¶¶ 14-15.) Corellium disagrees with this statement, asserting instead that "iOS in the public IPSW distribution ... has no such requirements—this security function is hard-coded into physical iOS devices." (Def.’s Resp. SOF [DE 513] ¶¶ 14-15.)
The parties disagree on the nature, operation, and purpose of some of these measures.
Secure boot chain : Secure boot chain is a way Apple prevents unauthorized code from running on its systems. The process involves an interaction between iOS and software embedded in the physical device. (Wang Dep. 62:8-18, 212:4-22; Marineau-Mes Dep. 36:6-23.) It is "an extremely well-meaning and well-designed feature that is intended to safeguard the privacy and security of Apple iPhone users[.]" (Pl.’s SOF ¶ 18.) The boot chain is "secure" because each step must be verified before the next step can proceed. (Wang Dep. 212:4-22; Pl.’s SOF ¶ 17.)
Buddy program : When iOS is freshly installed on an Apple device, a program called "Buddy" runs. The "Buddy" program helps the user set up iOS on the device. One portion of the "Buddy" program presents the EULA governing that version of iOS to the user on the iOS device. A user must accept the EULA before the user can continue to interact with any other part of iOS. If the user does not accept the EULA, the Buddy program prevents the user from further accessing iOS. (Andrews Decl. ¶ 17.)
Trust Cache : The trust cache is a list of trusted applications that Apple has approved for execution on iOS. The trust cache prevents users from installing and operating unapproved applications on iOS. The trust cache prevents the installation of rogue software and ensures that only-Apple-verified applications can be run on iOS. (Pl.’s SOF ¶ 21.)
Pointer Authentication Codes (or PAC) : This hardware feature works with Apple software to protect iOS and makes it "difficult or impossible" for the kernel to run on non-Apple platform. (Krstic Dep. 132:25-133:17, 140:23-141:18, 142:19-143:3.) Apple began implementing custom PAC with the release of iOS 12.0 for the iPhone XR, XS, and XS Max in September 2018. (Pl.’s SOF ¶ 22.) PAC is a cryptographic signature Apple inserts and stores in various places in iOS code to ensure that the code is executed as intended, without modification or distortion. When the device processor receives certain instructions, it generates the cryptographic measurement for the next instruction it has been asked to execute. If the measurement does not match the stored PAC, the processor will halt execution. (Id. )
D. THE CORELLIUM PRODUCT
Corellium was founded in August 2017. (Gorton Dep. [DE 472-25] 20:8; Skowronek Dep. [DE 472-20] 46:21–47:2.) Development of a prototype of the Corellium Product began around summer 2017. (Gorton Dep. 33:5-21.) By January 2018, Corellium was able to demo the creation of a virtual device and was able to use the virtual device in basic ways. (Gorton Dep. 33:22-34:20). Corellium developed both a cloud (or online) version and an on-premises version (i.e., where the customer purchases and installs a server on their premises) of the Corellium Product. By the end of January 2018, a trial version (Version 1.1) of the cloud-based product was offered to a limited number of users for beta testing (to detect bugs and any usability issues) and business development. (Gorton Dep. 52:23-53:9; Def.’s Fourth Am. Ans. to First Interr. No. 1 [DE 470-9].)
The Corellium Product enables users to create and interact with virtual devices by loading firmware (that is, files for operating systems like iOS, Android, and Linux). (Def.’s SOF ¶ 30.) Virtualization is the ability to run software on hardware it is not ordinarily meant to run on. (Wang Dep. 55:10-21.) Among other reasons, virtualization is beneficial because it permits the user to run software on faster hardware and permits examination and debugging of the software to get a better understanding of how it works. (Wang Dep. 55:10-21.) According to Corellium's founders, the Corellium Product was developed with the primary intent of facilitating security testing, research, and development by, inter alia , allowing researchers to examine aspects of iOS code. (Wade Dep. 179:17-20, 180:12-13; Wang Dep. 210:9-212:3; Gorton Dep. 50:20-51:5; Skowronek Dep. 71:18-23, 96:21-97:2.) Security research is an activity designed to find unintended and unknown weaknesses in a system, including through source code inspection and certain runtime debugging. (Krstic Dep. 123:12-124:3.) Among other things, security researchers are interested in whether software has vulnerabilities and how and if those vulnerabilities can be exploited and defended against. (Wang Dep. 249:17-22.) Security researchers include, for example, members of Apple's Security Bug Bounty Program, a program that rewards researchers who help find vulnerabilities in Apple's products. (Krstic Dep. 181:5-9.) Vulnerability is a technical term for a bug that has security impact; that is, if exploited, it can undermine the security of the user's system. (Krstic Dep. 102:4-6. ) Security researchers can use their talent for good or for nefarious purposes. (Pl.’s SOF ¶ 61.)
"In some context a bug could be different from a vulnerability .... An exploit uses a vulnerability to achieve a purpose," such as a jailbreak. (Wang Dep. 51:9-14, 52:15-53:10.) Jailbreaking is a "mechanism to exploit security vulnerability or allow execution of code that didn't come from [the developer]." Jailbreaking can be used for good. (Andrews Dep. 97:6-98:13.)
Turning back to the Corellium Product, Corellium directly sells to customers and has, until recently, used a reseller for the on-premises version of the product. (Gorton Dep. 15:1-16:2, 53:15-54:14, 125:17-19, 127:1-11.) For its direct sales, Corellium has a vetting process. (Gorton Dep. 52:14-18, 116:7-126:6; Dyer Dep. [DE 472-32] 32:2-36:15, 39:13-40:14, 46:14-57:13.) Generally, upon receiving an inquiry, the process begins with an initial evaluation. This initial analysis takes several factors into consideration, including whether the inquiry came from an enterprise account or from an individual account (e.g., a Gmail account). Corellium also considers the nature of the content of the inquiry and whether it comports with Corellium's intended use for its product. For example, if the inquiry requests the ability to run iOS on an Android mobile device, Corellium discards it. Similarly, if there are red flags based on the identity of a putative customer (e.g., someone involved with unlawful activity) or based on the geographic origins of the request, Corellium does not engage.
Corellium contracted with two resellers but only one has engaged in any sales. (Gorton Dep. 15:25-16:16.)
If Corellium finds, after the initial evaluation, that the request might be a qualified lead, it responds and starts a line of communication with the putative customer. Discussions at this stage may entail a telephone conversation, demo of the Corellium Product, providing a data sheet of product features and pricing or an order form with license terms, or an offer of a trial period in the cloud. In some cases, Corellium also continues to investigate the potential customer to determine, for instance, the nature of their business and their affiliations. Red flags during this investigation may result in a decision by Corellium not to continue to engage with the company. [Redacted]. (Gorton Dep. 123:3-124:25, 163:8-164:7; Dyer Dep. 143:9-144:5, 150:15-153:11.) The vetting process is similar for the on-premises and cloud versions of the Corellium Product, except that for the cloud product, Corellium may sell to locations they are not otherwise comfortable shipping servers to. (Gorton Dep. 125:21-126:6.)
In terms of Corellium's control of the use of its product, customers are not required to report bugs or vulnerabilities in iOS to Apple or Corellium. (Gorton Dep. 128:7-130:16.) However, for the cloud product, if there are concerns regarding malicious activity, Corellium can log into an account, investigate, and terminate the account, if necessary. (Gorton Dep. 98:1-6, 99:13-17, 107:10-20; Wade Dep. 204:4-15, 205:14-207:16, 208:24-15.) Corellium does not have the same control over the on-premises version of the Corellium Product; there is no way to even know where the product is after it has been shipped from Corellium, and customers are not required to keep the product in a particular location upon sale. Instead, Corellium asserts that it relies on the legal enforcement of licensing or end user agreements to ensure that its customers comply with any legal requirements.
Corellium's CEO and its Vice President of Sales and Business Development testified that the typical inquiry received pertains to application security testing, operating system security testing, training, and "miscellaneous." "Miscellaneous" requests are not received often but might include things like continuous integration or the development of tools, such as forensics tools. (Gorton Dep. 118:4-24; see also Dyer Dep. 48:5-17, 83:9-105:15.) While Corellium may engage with iOS app developers, these developers are not target customers, and Corellium generally does not advertise for application development, because the Corellium Product "is designed for security testing and research particularly," and "[t]he price point makes it unattractive to app developers ...." (Gorton Dep. 118:14-24.)
Once Corellium decides to sell the product, for either version of the Corellium Product, customers must pay an annual licensing fee and must purchase a server. Additionally, if the user chooses the Enterprise or Premium edition of the Corellium Product they must pay an upgrade fee. (Gorton Dep. 92:13-95:21; Dyer Dep. 66:1-24.) On-premises customers perform their own install and upgrades and manage their network. (Gorton Dep. 98:23-99:2; Wang Dep. 99:23-103:7, 106:4-7.) Prior to April 2018, upon setting up the hardware and IP settings, an on-premises customer would not need to take additional steps to setup, as firmware (e.g., IPSW file) links were provided by ipsw.me. (Def.’s Fourth Am. Ans. to First Interr. No. 2.) However, for versions of the Corellium Product released between April 2018 and March 2019, an additional step of obtaining IPSW files must be performed and the files must be placed in [Redacted]. (Def.’s Fourth Am. Ans. to First Interr. No. 2.) Then, for versions of the Corellium Product released during or after March 2019, there are additional steps to get to the directory permitting download of the IPSW files required to set up iOS devices. (Def.’s Fourth Am. Ans. to First Interr. No. 2.) The setup for cloud-based customers is more straightforward; users log into their online account to get started. At the point users are ready to create a virtual iOS device, Corellium maintains an IPSW database which matches physical devices with available versions of iOS and the associated internet download addresses (URLs) for each IPSW file. (Pl.’s SOF ¶ 51.) From early 2019 until February 2020, Corellium's cloud interface included a "dropdown" menu that enabled its customers to select from a prepopulated list of iOS versions and iOS Devices. The customer would pick a version of iOS and device from that menu (e.g., iPhone 11 Max running iOS 13), and the Corellium Product would automatically download the associated IPSW file from Apple's servers. (Pl.’s SOF ¶ 52.) Corellium also instructs its customers on how to manually download IPSW files from Apple's servers and then load or import those files into the Corellium Product to create iOS virtual devices. (Pl.’s SOF ¶ 53.) Thus, customers obtain IPSW files by manual download or by a Corellium program that automates downloading the IPSW files from Apple servers. On-premises customers have the option of saving IPSW files manually. (Def.’s SOF ¶ 55.) Each time a Cloud user wants an IPSW file, the user must download it from Apple's servers; Corellium does not save the IPSW file on its system. (Wang Dep. 152:18-153:1. )
There is evidence that, at least once, Corellium provided IPSW files to its reseller for a demo unit. (Azimuth Security, LLC Dep. [DE 557-13] 175:176:4.)
The Corellium Product dynamically unpacks IPSW files as they are downloading. (Def.’s SOF ¶ 53.) The files are "transiently stored" until they can be transferred to the right compute node and translated, and are there for a "very short amount of time." (Wang Dep. 173:8-17; Skowronek Dep. 116:2-117:1, 119:13-120:22, 166:8-19.) Additionally, in creating virtual devices, the Corellium Product does not use iOS in the form in which it exists within the downloaded IPSW files. Rather, once a user loads the firmware, the Corellium Product "transforms" iOS by [Redacted] . (Def.’s SOF ¶ 66. ) Thus, following the transformation process, the software involved in creating the virtual device derives from a combination of Corellium's code and Apple's iOS code. (Wang Dep. 158:13-159:16, 161:15-162:5, 195:17-23; Andrews Dep. 102:23-103:16.) Additionally, Corellium ordinarily avoids using encrypted parts of the IPSW files because it cannot decrypt them. (Wang Dep. 64:2-15, 65:4-12, 259:19-24.) However, if a user has an unencrypted version of otherwise encrypted portions of the firmware, the Corellium Product allows the user to load it and see those portions displayed in the Corellium Product. (Gorton Dep. 96:9-19.)
[Redacted].
Corellium uses the term "transform" to describe this process, while Apple appears to prefer the word "modify." Regardless if it is a "transformation" or "modification," there are some changes made once the user loads the IPSW files. Hence, the Court uses the words "change," "modify," and "transform" interchangeably.
E. ACQUISITION EFFORTS
Between January 2018 and the summer of 2018, the parties engaged in discussions regarding Apple's potential acquisition of Corellium. During this time, the parties met in-person and telephonically. Corellium explained to Apple the technology behind the Corellium Product and how it works, and discussed Corellium's business and intention to commercialize the Corellium Product. In addition to several engineers, discussions involved Apple's Senior Vice President of Software Engineering, the Vice President of OS Software Engineering, and the Head of Apple's Security Engineering and Architecture. (See Federighi, Andrews, & Krstic Dep., supra n.10.) Corellium also provided Apple with a temporary account or administrative access to the Corellium Product. (Andrews Dep. 50:15-54:9, 60:15-20, 168:17-25.) While Apple's legal department did not formally discuss copyright violations with Corellium, there is a dispute as to whether, and to what extent, Corellium was told by Apple employees that Corellium needed a license to utilize iOS in connection with the Corellium Product. (Wade Dep. 276:4-15, 278:1-5; Federighi Dep. 42:9-44:8, 115:12-14, 128:2-9, 132:8-133:4.)
See, e.g. , Gorton Dep. 177:22-178:8, 180:18-181:17; Andrews Dep. 48:23-49:25, 50:15-54:9, 60:15-20, 102:13-22, 112:23-113:13, 133:2-134:4, 162:14-163:12, 168:17-25, 188:17-24; Krstic Dep. 72:12-23, 74:18-75:3, 143:20-144:6, 149:6-15; Wade Dep. 274:4-276:15; Smith Dep. [DE 472-28] 64:13-65:25, 83:18-84:10, 134:4-135:3; Federighi Dep. [DE 472-10] 31:8-23, 73:5-13, 142:8-23.
If Apple had acquired the Corellium Product, the product would have been used internally for testing and validation (that is, for verifying any system weaknesses and functioning of devices). (Marineau-Mes Dep. 27:3-22, 121:17-19; Krstic Dep. 171:22-25; Smith Dep. 61:16-19.) Even with the Corellium Product, Apple would still need physical iPhones to conduct its testing. (Wade Dep. 210:20-21; Marineau-Mes Dep. 200:10-202:18.) Generally, the Corellium Product received positive feedback from Apple employees. (Andrews Dep. 159:13-16, 192:23-193:15; Krstic Dep. 106:5-10.) But there were also concerns, including regarding its utility and long-term value to Apple. (Krstic Dep. 106:5-107:12, 110:9-22.)
The parties ultimately could not agree on a price and, as a result, acquisition efforts were unfruitful. Roughly a year after talks fell apart, Apple filed this suit. (See Compl. [DE 1].)
F. SECOND AMENDED COMPLAINT
In the Second Amended Complaint [DE 589], Apple asserts claims against Corellium for Direct Federal Copyright Infringement (Computer Programs), 17 U.S.C. § 501, Direct Federal Copyright Infringement (Graphical User Interface Elements), 17 U.S.C. § 501, Contributory Federal Copyright Infringement, 17 U.S.C. § 501, and Unlawful Trafficking, 17 U.S.C. §§ 1201(a)(2), (b), 1203. Apple contends that Corellium infringed on the following products:
| Title of Work | Registration Date | Registration No. |
|---|---|---|
| iOS 9.0 | June 20, 2016 | TX 8-205-229 |
| iOS 9.1 | June 21, 2016 | TX 8-205-204 |
| iOS 10.0 | November 10, 2016 | TX 8-344-158 |
| iOS 11.0 | December 22, 2017 | TX 8-609-048 |
| iOS 11.0.1 | August 8, 2018 | TX 8-584-724 |
| iOS 11.2 | November 9, 2018 | TX 8-634-702 |
| iOS 11.2.5 | November 9, 2018 | TX 8-647-053 |
| iOS 11.3 | August 8, 2018 | TX 8-584-722 |
| iOS 11.4 | July 23, 2018 | TX 8-611-420 |
| iOS 12.0 | December 4, 2018 | TC 8-651-122 |
| iOS 12.1.1 | January 25, 2019 | TX 8-668-993 |
| iOS 12.2 | June 25, 2019 | TX 8-759-263 |
| Apple icons - iOS 9 compilation - iPhone 6s Built-in Apps | October 19, 2016 | VA 2-061-057 |
| Apple icons - iOS 11 compilation - iPhone 8 Built-in Apps | December 8, 2017 | VA 2-100-045 |
| Apple Bokeh (bubble) Wallpaper iOS 7 | March 27, 2014 | VA 1-922-660 |
| Apple Wallpaper - Flower Magenta (iOS 8) | August 19, 2015 | VA 1-967-209 |
| Apple Wallpaper - Flower Chrysanthemum purple (iOS 8) | August 19, 2015 | VA 1-967-206 |
(Sec. Am. Compl., Ex. A.) Each of Apple's copyright registrations "[e]xclude ... [p]reviously published Apple material," including prior versions of iOS. (Def.’s SOF ¶ 21.)
SUMMARY JUDGMENT STANDARD
Under Federal Rule of Civil Procedure 56, "summary judgment is proper if the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law." Celotex Corp. v. Catrett, 477 U.S. 317, 322, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). "[G]enuine disputes of facts are those in which the evidence is such that a reasonable jury could return a verdict for the non-movant." Mann v. Taser Int'l, Inc., 588 F.3d 1291, 1303 (11th Cir. 2009) (internal marks and citation omitted). A fact is material if, under the applicable substantive law, it might affect the outcome of the case. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986).
A party seeking summary judgment bears the initial responsibility of supporting its motion and identifying those portions of the record which it believes demonstrate the absence of a genuine issue of material fact. Celotex , 477 U.S. at 323, 106 S.Ct. 2548. "[A]t the summary judgment stage the judge's function is not himself to weigh the evidence and determine the truth of the matter but to determine whether there is a genuine issue for trial." Anderson , 477 U.S. at 249, 106 S.Ct. 2505. The Court "must view all the evidence and all factual inferences reasonably drawn from the evidence in the light most favorable to the nonmoving party and must resolve all reasonable doubts about the facts in favor of the non-movant." Rioux v. City of Atlanta, Ga. , 520 F.3d 1269, 1274 (11th Cir. 2008) (internal marks and citation omitted).
DISCUSSION
Apple's claims fall in two buckets: copyright infringement and violation of section 1201 of the DMCA. In its motion, Corellium argues it is entitled to summary judgment in its favor because (1) the Corellium Product contains no copyrighted Apple code, (2) the fair use doctrine makes any use of protectable elements of Apple's work permissible, (3) Apple misused its copyright, (4) Apple should be estopped from asserting a copyright claim against Corellium, (5) Apple cannot show that Corellium infringed any of the 17 copyrights at issue in the Second Amended Complaint, and (6) the Corellium Product does not violate the DMCA. Apple also moves for partial summary judgment on the DMCA issue, arguing it is entitled to summary judgment in its favor because Corellium violated the antitrafficking provisions of the statute.
Apple initially identified 22 copyright registrations at issue but has since removed 5 of them. Compare Compl., with Sec. Am. Compl.
Before turning to the DMCA, the Court will analyze the copyright claim. If the Court agrees that the fair use doctrine applies, Corellium's other arguments are rendered moot. Thus, the Court will address that argument first.
I. COPYRIGHT CLAIM
A. The Copyright Clause
The Copyright Clause of the United States Constitution provides:
The Congress shall have Power ... To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries ....
U.S. CONST. art. I, § 8, cl. 8. The Copyright Clause is "both a grant of power and a limitation," and "to the extent [Congress] enacts copyright laws at all," such laws must "promote the Progress of Science." Eldred v. Ashcroft , 537 U.S. 186, 212, 123 S.Ct. 769, 154 L.Ed.2d 683 (2003). Indeed, "[t]he primary objective of copyright is not to reward the labor of authors, but ‘[t]o promote the Progress of Science and useful Arts.’ " Feist Publ'ns, Inc. v. Rural Tel. Serv. Co. , 499 U.S. 340, 349, 111 S.Ct. 1282, 113 L.Ed.2d 358 (1991) (citing the Copyright Clause). Even in the technological era, "the Copyright Act must be construed in light of this basic purpose." Twentieth Century Music Corp. v. Aiken , 422 U.S. 151, 156, 95 S.Ct. 2040, 45 L.Ed.2d 84 (1975).
B. Fair Use
From the infancy of copyright protection, courts have recognized that some opportunity for fair use of copyrighted materials is necessary to fulfill copyright's purpose of promoting "the Progress of Science and useful Arts." Campbell v. Acuff-Rose Music, Inc. , 510 U.S. 569, 575, 114 S.Ct. 1164, 127 L.Ed.2d 500 (1994) (citing the Copyright Clause). "If copyright's utilitarian goal is to be met, we must be careful not to place overbroad restrictions on the use of copyrighted works, because to do so would prevent would-be authors from effectively building on the ideas of others." Cambridge Univ. Press v. Patton , 769 F.3d 1232, 1238 (11th Cir. 2014) (citation omitted). "In a sense, the grant to an author of copyright in a work is predicated upon a reciprocal grant to the public by the work's author of an implied license for fair use of the work." Id. at 1257 (citation omitted). "[C]opyright is not an inevitable, divine, or natural right that confers on authors the absolute ownership of their creations. It is designed rather to stimulate activity and progress in the arts for the intellectual enrichment of the public." Id. at 1256.
"Some unpaid use of copyrighted materials must be allowed in order to prevent copyright from functioning as a straightjacket that stifles the very creative activity it seeks to foster." Id. at 1238. "If we allow too much unpaid copying, however, we risk extinguishing the economic incentive to create that copyright is intended to provide." Id. Therefore, "a secondary user who takes overmuch in the name of fair use operates outside the bounds of his or her implied-by-law license." Id. at 1257.
Pursuant to its authority under the Copyright Clause, Congress codified the judicially-created fair use defense, "to ensure that copyright protection advances rather than thwarts the essential purpose of copyright ...." Lexmark Int'l, Inc. v. Static Control Components, Inc. , 387 F.3d 522, 537 (6th Cir. 2004). Section 107 of the Copyright Act provides:
[T]he fair use of a copyrighted work, including such use by reproduction in copies ... for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
(2) the nature of the copyrighted work;
(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the copyrighted work.
The enumerated examples (e.g., criticism, comment, and research) are meant to give some idea of the sort of activities courts might regard as fair use under the circumstances. Patton , 769 F.3d at 1259. "This listing was not intended to be exhaustive, or to single out any particular use as presumptively a ‘fair’ use." Id. (citation omitted). Likewise, the four statutory factors are not exclusive. Harper & Row Publishers, Inc. v. Nation Enters. , 471 U.S. 539, 560, 105 S.Ct. 2218, 85 L.Ed.2d 588 (1985). However, they "establish the contours within which a court may investigate whether, in a given case, a finding of fair use would serve the objectives of copyright." Id. These factors are not to be treated in isolation one from another. Campbell , 510 U.S. at 578, 114 S.Ct. 1164. Rather, "[a]ll are to be explored, and the results weighed together, in light of the purposes of copyright." Id. Still, some factors may weigh more heavily on the fair use determination than others. Patton , 769 F.3d at 1260 ; see, e.g. , Campbell , 510 U.S. at 586, 114 S.Ct. 1164 (noting that the second factor—nature of the work—is generally not important in determining whether a finding of fair use is justified in the case of a parody); Harper & Row Publishers , 471 U.S. at 566, 105 S.Ct. 2218 (noting that the fourth factor—effect on market value—"is undoubtedly the single most important element of fair use.").
"The affirmative defense of fair use is a mixed question of law and fact as to which the proponent carries the burden of proof." Peter Letterese & Assocs., Inc. v. World Inst. Of Scientology Enters. , 533 F.3d 1287, 1307 n.21 (11th Cir. 2008). Thus, the burden is on Corellium to "convince the court that allowing [its] unpaid use of copyrighted material would be equitable and consonant with the purposes of copyright." Patton , 769 F.3d at 1238. Where material facts are not in dispute, fair use is appropriately decided on summary judgment. See, e.g. , Stewart v. Abend , 495 U.S. 207, 214, 236-38, 110 S.Ct. 1750, 109 L.Ed.2d 184 (1990).
With these principles in mind, the Court now analyzes each of the relevant factors. 1. Purpose and character of the allegedly infringing use
Under this first factor, courts consider "(1) the extent to which the use is a ‘transformative’ rather than merely superseding use of the original work and (2) whether the use is for a nonprofit educational purpose, as opposed to a commercial purpose." Patton , 769 F.3d at 1261. These facets do not create "hard evidentiary presumption[s]" or "categories of presumptively fair use." Campbell , 510 U.S. at 584, 114 S.Ct. 1164. In other words, "the mere fact that a use is educational and not for profit does not insulate it from a finding of infringement, any more than the commercial character of a use bars a finding of fairness." Id. Rather, the commercial or non-transformative uses of a work are to be regarded as "separate factor[s] that tend[ ] to weigh against a finding of fair use," and "the force of that tendency will vary with the context." Id. at 585, 114 S.Ct. 1164 (citation omitted).
a. Transformative
In deciding if the alleged infringing use of the copyrighted work is transformative, courts consider " ‘whether the new work merely supersede[s] the objects of the original creation, or instead adds something new, with a further purpose or different character, altering the first with new expression, meaning, or message.’ " Patton , 769 F.3d at 1262 (citing Campbell , 510 U.S. at 579, 114 S.Ct. 1164 ). "Even verbatim copying ‘may be transformative so long as the copy serves a different function than the original work.’ " Id. (citation omitted). While a transformative use is " ‘not absolutely necessary for a finding of fair use,’ ... transformative uses tend to favor a fair use finding because a transformative use is one that communicates something new and different from the original or expands its utility, thus serving copyright's overall objective of contributing to public knowledge." Authors Guild v. Google, Inc. , 804 F.3d 202, 214 (2d Cir. 2015) (citing Campbell , 510 U.S. at 579, 114 S.Ct. 1164 ). Thus, copying from an original for the purpose of criticism or commentary on the original or to provide information about it, tends most clearly to satisfy the notion of the ‘transformative’ purpose involved in the analysis of factor one. Id. at 215–16. "The more the appropriator is using the copied material for new, transformative purposes, the more it serves copyright's goal of enriching public knowledge and the less likely it is that the appropriation will serve as a substitute for the original or its plausible derivatives, shrinking the protected market opportunities of the copyrighted work." Id. at 214 (citing Campbell , 510 U.S. at 591, 114 S.Ct. 1164 ).
Apple disagrees with Corellium that the Corellium Product is transformative. According to Apple, the Corellium Product is not transformative because Corellium merely modifies iOS and "offers the software in a different medium—virtually, rather than on a physical device." (Pl.’s Resp. [DE 557-1] at 13.) For support, Apple cites cases like Oracle America, Inc. v. Google LLC , 886 F.3d 1179, 1187 (Fed. Cir. 2018), where courts found the mere repackaging of copyrighted material from one medium to the next, without new content or meaning, to be non-transformative.
Here, the evidence establishes that the Corellium Product is not merely a repackaged version of iOS—this time in a virtual environment as opposed to an iPhone. Rather, Corellium makes several changes to iOS and incorporates its own code to create a product that serves a transformative purpose. The Corellium Product makes available significant information about iOS, permitting users to, inter alia : (1) see and halt running processes; (2) modify the kernel; (3) use CoreTrace, a tool to view system calls; (4) use an app browser and a file browser; and (5) take live snapshots. These features are beneficial to security research. And, as Apple concedes, the Corellium Product adds significant features that are not available on Apple's devices running iOS.
Unequivocally, this case is not like Oracle . In Oracle , the defendant, Google, copied verbatim the declaring code of a number of the plaintiff's copyrighted and patented application programming interface ("API") packages; made no alteration to the expressive content or message; and used the API packages in Google's competing Android operating system for the same purpose as plaintiff's use of API packages in its own platform. 886 F.3d at 1185-1211. Oracle is distinguishable from this case, where Corellium transforms iOS and adds new content, Corellium is not a direct competitor with Apple in the iOS device market, and the Corellium Product has functionalities not available on Apple's iOS devices.
The Court finds that the purpose of the Corellium Product in this case is more akin to Google's transformative search and snippet function in Authors Guild . In that case, the plaintiffs—authors of published books under copyright—sued Google for copyright infringement. 804 F.3d at 206-11. Acting without the authors’ permission, Google made digital copies of tens of millions of books that were submitted to it in connection with its Library Project and its Google Books project. Id. Google scanned the digital copies and established a publicly available search function, which allowed internet users to search without charge to determine whether the book contains a specified word or term and see "snippets" of text containing the searched-for terms. Id. Google also allowed the participating libraries to download and retain digital copies of books, and Google retained the original scanned image of each book and all the digital information created in the process on its servers. Id.
Google argued that its actions constituted fair use. Id. at 211, 214-19. The plaintiffs disagreed. On the issue of transformativeness, plaintiffs argued that Google's digital copying of entire books, the snippet feature (which allowed users to read portions of the book), and Google's distribution of digital copies to the libraries did not constitute transformative use but, rather, provided a substitute for plaintiffs’ works and subjected plaintiffs to the risk of loss of copyright revenues through access allowed by libraries. Id. The Second Circuit rejected plaintiffs’ arguments and sustained the district court's finding of fair use.
Finding Google's search function and snippet view to be transformative, the Second Circuit explained that "the purpose of Google's copying of the original copyrighted books is to make available significant information about those books, permitting a searcher to identify those that contain a word or term of interest" and "to learn the frequency of usage of selected words in the aggregate corpus of published books in different historical periods." Id. Snippet view, which was "designed to show the searcher just enough context surrounding the searched term to help her evaluate whether the book falls within the scope of her interest," added "to the highly transformative purpose of identifying books of interest to the searcher." Id.
Here, like Google's search and snippet functions, the Corellium Product makes available significant information about iOS. A user can see running processes, halt execution of the virtual device, amend the kernel, look at lists of files, clone snapshots, among other things—giving great introspection into aspects of iOS and its operation on iOS devices. These tools are useful to security research and testing. The product creates a new, virtual platform for iOS and adds capabilities not available on Apple's iOS devices. See Sony Comput. Entm't, Inc. v. Connectix Corp. , 203 F.3d 596, 599, 606 (9th Cir. 2000) (finding fair use where defendant made intermediate copies of defendant's copyrighted software program and, by reverse engineering, created defendant's own software program which emulated the functioning of plaintiff's game console so users could play plaintiff's games on their computer as opposed to on the console; the court found that the alleged infringing work was "modestly transformative" because it (1) created a new platform or environment in which consumers could play games designed for plaintiff's product, and (2) notwithstanding the similarity of uses and functions between the copyrighted and secondary work, defendant's program was "a wholly new product").
Finally, Apple argues that the Corellium Product does not serve a transformative purpose because it can be used for other purposes other than security research and Corellium has been willing to sell to anyone (presumably, meaning not just to security researchers). This argument is not persuasive. To start, it is settled that an alleged infringing work does not need to fall within the enumerated examples of section 107 (e.g., research) to constitute fair use. Further, Apple provides no authority to support its position that potential unintended use or a secondary use for an alleged infringing product precludes a finding of fair use, where otherwise there is evidence that the product serves some transformative purpose. In fact, caselaw seems to indicate otherwise. For example, in A.V. ex rel. Vanderhye v. iParadigms, LLC , 562 F.3d 630, 634 (4th Cir. 2009), the defendant owned and operated an online technology system used by schools to evaluate originality of written works to prevent plagiarism. The technology gave schools the option of "archiving" or storing students’ written assignment, which then became a part of the defendant's database to evaluate the originality of other students’ works in the future. Id.
The plaintiffs—the students—argued that the defendant's use of their works could not be transformative because the archiving process added nothing but, rather, merely stored the work unaltered and in its entirety. Id. at 639. The appellate court was not persuaded. It held that "the use of a copyrighted work need not alter or augment the work to be transformative in nature." Id. And, defendant's use of plaintiffs’ works was transformative because it had an entirely different function and purpose than the original works. Id. The students then argued that defendant's work failed to "effect" its purported transformative purpose. Id. at 639-40. Rejecting this argument, the appellate court explained that the "question of whether a use is transformative does not rise or fall on whether the use perfectly achieves its intended purpose." Id. The fact that the defendant's system did detect some level of plagiarism was sufficient, even if it was an imperfect system. Id. (citing Campbell , 510 U.S. at 582, 114 S.Ct. 1164 ).
Here, there is evidence in the record to support Corellium's position that its product is intended for security research and, as Apple concedes, can be used for security research. Further, Apple itself would have used the product for internal testing had it successfully acquired the company. Both Corellium's CEO and its VP of Sales have testified to the use cases for the Corellium Product for which they fielded inquiries. These inquiries pertain to, for example, application security testing and operating system security testing. Apple has presented no evidence to raise a genuine issue of material fact on this point. Apple points to the testimony of Corellium's reseller. In the quoted portion of the transcript, the deponent merely speculates—stating he "believe[s] " (not "knows")—that Corellium wanted to "sell their product to whoever was interested in acquiring it." (Azimuth Dep. 102:25-103:3.) The deponent offers no facts that contradict evidence presented by Corellium regarding the use of the Corellium Product for security research.
Therefore, the Court finds that the Corellium Product serves a transformative purpose.
b. Nonprofit educational versus commercial purpose
Concerning this aspect of the first factor of the fair use analysis, Apple argues that because the Corellium Product is sold commercially, and for significant amounts, those facts compel a finding in Apple's favor. (Pl.’s Resp. at 13.) Not so. To the contrary, the Supreme Court has cautioned against drawing presumptions against commercial fair uses. See Campbell , 510 U.S. at 583-85, 114 S.Ct. 1164 (reversing appellate court finding that alleged infringing work done for profit could not be fair use and reiterating that the commercial or nonprofit character of a work is not conclusive but merely factors to be weighed under the fair use analysis). Furthermore, "the more transformative the new work, the less will be the significance of other factors, like commercialism, that may weigh against a finding of fair use." Id. at 579, 114 S.Ct. 1164. "Many of the most universally accepted forms of fair use ... are all normally done commercially for profit." Authors Guild , 804 F.3d at 219.
The Court has found that the Corellium Product is transformative; it adds something new to iOS, with a further purpose or different character than Apple's iOS devices. Hence, Corellium's profit motivation does not undermine its fair use defense, particularly considering the public benefit of the product.
Therefore, both facets of the first factor favor a finding of fair use.
2. Nature of the copyrighted work
This second factor recognizes that there is a hierarchy of copyright protection depending upon the nature of the copyrighted work. Peter Letterese & Assocs. , 533 F.3d at 1312 (citation omitted). "Works that are ‘closer to the core of intended copyright protection,’ and thus merit greater protection, include original as opposed to derivative works; creative as opposed to factual works; and unpublished as opposed to published works." Id. (citation omitted). "Although ‘software products are not purely creative works,’ it is well established that copyright law protects computer software." Oracle Am. , 886 F.3d at 1204 (citation omitted).
That said, there are significant limitations on copyright protection for software. See, e.g., Sony Comput. Entm't , 203 F.3d at 602 (concluding that defendant's intermediate copying and use of plaintiff's software program was a fair use for the purpose of gaining access to the unprotected elements of plaintiff's software, and explaining that while the "object code of a program may be copyrighted as expression ... it also contains ideas and performs functions that are not entitled to copyright protection."); Oracle Am., Inc. v. Google Inc. , 750 F.3d 1339, 1360 (Fed. Cir. 2014) ("Under the merger doctrine, a court will not protect a copyrighted work from infringement if the idea contained therein can be expressed in only one way. For computer programs, ‘this means that when specific [parts of the code], even though previously copyrighted, are the only and essential means of accomplishing a given task, their later use by another will not amount to infringement.’ ") (internal citation omitted). These limitations on copyright protection for software are important; they ensure that the primary objective of copyright—the progress of science and art—continues to be served. See Feist Publ'ns, Inc. , 499 U.S. at 349, 111 S.Ct. 1282 (citing the Copyright Clause) ; Sega Enters. Ltd. v. Accolade, Inc. , 977 F.2d 1510, 1527 (9th Cir. 1992), as amended (Jan. 6, 1993).
Corellium argues that, based on the interest of security researchers, the Corellium Product makes use of the functional aspects of iOS, as opposed to Apple's creativity, and those functional aspects are not protectable. In response, Apple briefly states that iOS is "sophisticated," "popular," and its "development necessarily involved significant creativity," but does not otherwise mount an adequate challenge to Corellium's position.
While the Court notes the limitations on copyright protection for software, in the end, this "factor has rarely played a significant role in the determination of a fair use dispute." Authors Guild , 804 F.3d at 220. Thus, the Court moves to the next factor.
3. Size and significance of portion of the copyrighted work that was copied
"This third factor examines whether defendants have helped themselves overmuch of the copyrighted work in light of the purpose and character of the use." Patton , 769 F.3d at 1271 (citation and internal marks omitted). Apple contends that Corellium has done so, by extracting, copying, publicly displaying, and modifying iOS.
The quantity of the copyrighted work copied does not give rise to any presumption. To the contrary, "courts have rejected any categorical rule that a copying of the entirety [of the copyrighted work] cannot be a fair use." Authors Guild , 804 F.3d at 221. "Even verbatim copying may be transformative so long as the copy serves a different function than the original work." Patton , 769 F.3d at 1262 (internal marks and citation omitted). "Complete unchanged copying has repeatedly been found justified as fair use when the copying was reasonably appropriate to achieve the copier's transformative purpose and was done in such a manner that it did not offer a competing substitute for the original." Authors Guild , 804 F.3d at 221. So, the appropriate inquiry under this factor is whether " ‘the quantity and value of the materials used ... are reasonable in relation to the purpose of the copying.’ " Patton , 769 F.3d at 1272 (quoting Campbell , 510 U.S. at 586, 114 S.Ct. 1164 ). In making this determination, courts consider not only the quantity of the materials used, but their quality and importance, too. Id. at 1271. " ‘[T]he amount and substantiality of the portion used’ is measured with respect to the ‘copyrighted work as a whole,’ not to the putatively infringing work." Peter Letterese & Assocs. , 533 F.3d at 1314–15 (citation omitted)
Apple argues that, to the extent Corellium users are only interested in a subset of iOS, Corellium's use of iOS is not proportional as "the entire IPSW" is copied. This argument has no merit. iOS is contained in the IPSW files and, therefore, it is necessary to download and explore the IPSW files to access iOS. Once imported from Apple's servers, to create a virtual device on the Corellium Product, the files are transiently stored and then modified by altering aspects of iOS and adding Corellium's own code. This use of the IPSW files is permissible and proportional, particularly considering the transformative finished product. See, e.g. , Sony Comput. Entm't , 203 F.3d at 602-10 (concluding that defendant's intermediate copying and use of plaintiff's software program was a fair use); Sega Enters. , 977 F.2d at 1527-28 ("[W]here disassembly is the only way to gain access to the ideas and functional elements embodied in a copyrighted computer program and where there is a legitimate reason for seeking such access, disassembly is a fair use of the copyrighted work, as a matter of law."); Authors Guild , 804 F.3d at 221 (finding defendant's copying of entire original copyrighted books permissible because it was necessary to serve the purpose of the alleged infringing work of making significant information about those books available, permitting a searcher to identify a word or term of interest and to learn the frequency of usage, and to show the searcher just enough context surrounding the searched term to help her evaluate whether the book falls within the scope of her interest).
In this vein, the Court also finds Corellium's download and use of the publicly available IPSW files solely for its own internal testing is permissible.
Corellium's copying, modifying, and using of iOS is reasonable in relation to the purpose of the copying. The testimony is that the Corellium Product is intended to create a virtual environment in which users can, for instance, examine, test, and research iOS or portions of iOS code. To be an efficient and effective research environment that accurately reflects the operation of iOS on Apple's devices, the Corellium Product necessarily utilizes iOS. In line with this purpose, the Corellium Product excludes or does not virtualize the full functionality of features available on iOS devices, like Face ID, Touch ID, baseband, camera, the App Store, and so on. Users of the Corellium Product cannot make calls or send text messages, which can be done on an iPhone.
As stated earlier, the Corellium Product is also capable of virtualizing Android and Linux, and it can run any operating system on the virtual Apple product once it has restore ramdisk. (Wang Dep. 177:10-178:25.) The Corellium Product does not need a particular operating system. Id. Because only iOS is at issue in this case, the Court focuses on users interacting with iOS.
In permitting users to interact with the virtual device, the Corellium Product allows users to view certain graphical user elements (like the iPhone home screen or wallpaper). The evidence does not reflect that these images serve a central purpose or are of principal importance to the overall functionality of the Corellium Product, or are a major part of Apple's complex copyrighted work as a whole. Thus, Corellium's use of these graphical elements does not undermine a finding of fair use. See, e.g. , Solid Oak Sketches, LLC v. 2K Games, Inc. , 449 F. Supp. 3d 333, 349 (S.D.N.Y. 2020) (finding in case against an interactive entertainment and video game company brought by licensee of copyrighted tattoos used by professional basketball players that, while the tattoos were copied in their entirety, defendants did so in order to effectuate the transformative purpose of creating a realistic game experience); Sony Comput. Entm't Am., Inc. v. Bleem, LLC , 214 F.3d 1022, 1028-29 (9th Cir. 2000), amended on denial of reh'g (July 10, 2000) (finding in case brought by a manufacturer of console video games against a developer of a software emulator, alleging that developer's use of "screen shots" from manufacturer's games in developer's advertising violated manufacturer's copyright, that developer's degree of copying was reasonable where the "screen shots" at issue were a small portion of the complex copyrighted work as a whole).
See Wang Dep. 215:4-217:16.
Upon reviewing the evidence, the Court finds that Corellium's use of iOS (in terms of quantity, quality, and importance) is proportional and necessary to achieve Corellium's transformative purpose. Therefore, this third factor weighs in favor of finding fair use.
4. Effect of allegedly infringing use on potential market for or value of the original
"With respect to the fourth factor—the effect of the use on the value of the copyrighted material—the relevant question ... is whether the infringement impacted the market for the copyrighted work itself." Lexmark Int'l , 387 F.3d at 544 (citation omitted). This factor "focuses on whether the copy brings to the marketplace a competing substitute for the original, or its derivative, so as to deprive the rights holder of significant revenues because of the likelihood that potential purchasers may opt to acquire the copy in preference to the original." Authors Guild , 804 F.3d at 223. The adverse impact courts are primarily concerned with is that of market substitution. Patton , 769 F.3d at 1275 (citation omitted).
In this lawsuit, Apple asserts 17 copyrights pertaining to iOS; alleged copyrights in 12 versions of iOS released since 2015 and 5 copyrights in visual works of arts contained in iOS (i.e., icons of Apple's built-in applications and wallpaper). Concerning this fourth factor, there is no evidence that the Corellium Product has affected, let alone materially affected, Apple's market or the market value for iOS. Instead, Apple argues that Corellium markets its product as an alternative to an iPhone and lists Apple's "iOS Simulator" as a direct competitor. This marketing—whether puffery or factually accurate—is not evidence that the Corellium Product supplants Apple's market for iOS devices or that it has deprived, or will deprive, Apple of (significant) revenue made from iOS.
Next, Apple argues that the Corellium Product will compete with its upcoming Security Research Device Program, under which Apple will be licensing devices running iOS to security researchers in return for the disclosure of security vulnerabilities and related discoveries to Apple. This argument misses the mark. The relevant question under this fourth factor is whether the Corellium Product has impacted the market for the copyrighted work itself—that is, for iOS. See, e.g. , Lexmark Int'l , 387 F.3d at 545 (noting that the "the district court focused on the wrong market: it focused not on the value or marketability of the Toner Loading Program, but on Lexmark's market for its toner cartridges. Lexmark's market for its toner cartridges and the profitability of its Prebate program may well be diminished by the [defendant's] SMARTEK chip, but that is not the sort of market or value that copyright law protects."). Here, while Apple may very well expand into the security research or virtualization market, copyright law does not confer a monopoly. Sony Comput. Entm't , 203 F.3d at 607.
This principle equally applies to Apple's final argument, that it previously rejected the option of "licensing exactly this kind of software" (that is, a product like the Corellium Product). (Pl.’s Resp. at 17.) "[A] copyright holder can always assert some degree of adverse [effect] on its potential licensing revenues as a consequence of the secondary use at issue simply because the copyright holder has not been paid a fee to permit that particular use." Patton , 769 F.3d at 1276 (citation omitted, italics in original). "The goal of copyright is to stimulate the creation of new works, not to furnish copyright holders with control over all markets. Accordingly, the ability to license does not demand a finding against fair use." Id.
The Court does not find any significant market impact on iOS. Thus, this fourth factor also favors a finding of fair use.
5. Good faith and fair dealing
In addition to, or as a part of, the four statutory factors, Apple asks the Court to consider Corellium's lack of good faith and fair dealing. According to Apple, "Corellium's conduct has been entirely improper" because it deals with bad actors and does not require users to report bugs to Apple. Apple's position is puzzling, if not disingenuous. [Redacted]. (Krstic Dep. 184:22-185-10.) Likewise, while Apple spends significant time in its papers faulting Corellium for not requiring users of the Corellium Product to report bugs found in iOS to Apple, Apple does not impose that requirement under its own Bug Bounty Program. As for Apple's contention that Corellium sells its product indiscriminately, that statement is belied by the evidence in the record that the company has a vetting process in place (even if not perfect) and, in the past, has exercised its discretion to withhold the Corellium Product from those it suspects may use the product for nefarious purposes.
The Court does realize that with or without controls in place, the Corellium Product could be used maliciously in the wrong hands. As Apple's Jason Shirk aptly states: "Tools are agnostic; It's all the user." (Shirk Dep. [DE 472-31] 118:24.) The Corellium Product can be used for "good faith" security research and it also very likely can be exploited for nefarious reasons. No technology is infallible. For instance, notwithstanding strong protections put in place by Apple such as the secure boot chain, just recently the checkm8 exploit was released by security researchers, which enables certain iOS commercial devices to be jailbroken. (Shirk Dep. 94:11-20.)
Having reviewed the evidence, the Court does not find a lack of good faith and fair dealing. Further, weighing all the necessary factors, the Court finds that Corellium has met its burden of establishing fair use. Thus, its use of iOS in connection with the Corellium Product is permissible. On these grounds, Corellium's Motion for Summary Judgment is granted on Apple's copyright claim.
II. DMCA CLAIM
Both Corellium and Apple seek summary judgment on Apple's DMCA claim. The claim is brought under sections 1201(a)(2) and (b)(1) of the statute, which together prohibit selling tools to circumvent measures that protect access to, or rights in, copyrighted material, if the tools: (a) are "primarily designed or produced for the purpose of circumventing a technological measure that effectively" controls access to or protects rights in a copyrighted work; (b) have "only limited commercially significant purpose or use other than to circumvent a technological measure that effectively" controls access to or protects rights in a copyrighted work; or (c) are "marketed ... for use in circumventing a technological measure that effectively" controls access to or protects rights in a copyrighted work. 17 U.S.C. § 1201(a)(2), (b)(1). Under the DMCA, to "circumvent a technological measure" means to "to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner," and a technological measure " ‘effectively controls access to a work’ if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work." 17 U.S.C. § 1201(a)(3).
Apple argues that, at a minimum, Corellium circumvents its authentication server validation check, secure boot chain, Buddy program, and trust cache. According to Apple, only after circumventing these measures can the Corellium Product run iOS—which was not designed to run on non-Apple hardware. Corellium disagrees that it circumvents Apple's technological measures. Corellium argues instead that the IPSW files are "left unencrypted, unprotected, unlocked, and out in the open for the public to access, copy, edit, distribute, perform, and display." (Def.’s Resp. [DE 512] at 1.) Corellium further argues that it is entitled to a fair use defense, as well as defenses under sections 1201(f), (g), and (j) of the DMCA, which provide exemptions for reverse engineering and security testing and encryption research. The Court begins by examining whether fair use is a defense to a prima facie section 1201 violation.
A. "Fair use" and the DMCA
The DMCA provides:
(c) Other rights, etc., not affected.--(1) Nothing in this section shall affect rights, remedies, limitations, or defenses to copyright infringement, including fair use , under this title.
17 U.S.C. § 1201(c) (italics added). At first glance, this subsection appears to resolve the issue of a fair use defense. But, as applied, there may be tension between section 107 ’s fair use and the DMCA's antitrafficking provisions. One court captured the issue well:
Technological access control measures have the capacity to prevent fair uses of copyrighted works as well as foul. Hence, there is a potential tension between the use of such access control measures and fair use, [as well as the much broader range of explicitly noninfringing use]. As the DMCA made its way through the legislative process, Congress was preoccupied with precisely this issue. Proponents of strong restrictions on circumvention of access control measures argued that they were essential if copyright holders were to make their works available in digital form because digital works otherwise could be pirated too easily. Opponents contended that strong anticircumvention measures would extend the copyright monopoly inappropriately and prevent many fair uses of copyrighted material. Congress struck a balance ....
Chamberlain Grp., Inc. v. Skylink Techs., Inc. , 381 F.3d 1178, 1196-97 (Fed. Cir. 2004) (citing Reimerdes , 111 F. Supp. 2d at 304 ).
This year—more than twenty years after the DMCA was enacted—with a series of hearings, Congress has begun to review the DMCA, including a review of how the DMCA has accounted for fair use, how fair use has been applied in practice, and how a reform bill should think about fair use. See, e.g. , How Does the DMCA Contemplate Limitations and Exceptions Like Fair Use? , Subcommittee Hearing, Senate Judiciary Subcommittee on Intellectual Property, available at https://www.judiciary.senate.gov/meetings/how-does-the-dmca-contemplate-limitations-and-exceptions-like-fair-use (last accessed December 10, 2020); see also The Digital Millennium Copyright Act at 22: What is it, why was it enacted, and where are we now, available at https://www.judiciary.senate.gov/meetings/the-digital-millennium-copyright-act-at-22-what-is-it-why-it-was-enacted-and-where-are-we-now (last accessed December 10, 2020).
In Chamberlain , the Federal Circuit suggested, in dicta, that fair use could be a defense to a section 1201 violation. The court noted that the DMCA does not "rescind[ ] the basic bargain granting the public noninfringing and fair uses of copyrighted materials ...." 381 F.3d at 1202 (citing § 1201(c) ). In reaching that conclusion, the court was wary of allowing "copyright owner[s], through a combination of contractual terms and technological measures, to repeal the fair use doctrine ...." Id. Notwithstanding this discussion, the Federal Circuit ultimately stated that it did "not reach the relationship between § 107 fair use and violations of § 1201." Id. at 1199 n.14. Neither the Supreme Court nor the Eleventh Circuit has squarely addressed the issue. And, like the Federal Circuit, the Ninth Circuit has put that decision off for another day. See MDY Indus., LLC v. Blizzard Entm't, Inc. , 629 F.3d 928, 950 n.12 (9th Cir. 2010), opinion amended and superseded on denial of reh'g , No. 09-15932, 2011 WL 538748 (9th Cir. Feb. 17, 2011) ("Like the [court in] Chamberlain ..., we need not and do not reach the relationship between fair use under § 107 of the Copyright Act and violations of § 1201 .... Accordingly, we too leave open the question whether fair use might serve as an affirmative defense to a prima facie violation of § 1201.").
The Second Circuit, however, has ruled on the issue, and has found that fair use is not a blanket defense to the circumvention provisions of section 1201 :
[Appellants] contend that subsection 1201(c)(1) ... can be read to allow the circumvention of encryption technology protecting copyrighted material when the material will be put to "fair uses" exempt from copyright liability. We disagree that subsection 1201(c)(1) permits such a reading. Instead, it simply clarifies that the DMCA targets the circumvention of digital walls guarding copyrighted material (and trafficking in circumvention tools), but does not concern itself with the use of those materials after circumvention has occurred. Subsection 1201(c)(1) ensures that the DMCA is not read to prohibit the "fair use" of information just because that information was obtained in a manner made illegal by the DMCA. The Appellants’ much more expansive interpretation of subsection 1201(c)(1) is not only outside the range of plausible readings of the provision, but is also clearly refuted by the statute's legislative history.
Corley , 273 F.3d at 443–44 ; see also United States v. Reichert , 747 F.3d 445, 448 (6th Cir. 2014) ("[T]he DMCA ‘targets the circumvention of digital walls guarding copyrighted material (and trafficking in circumvention tools),’ even though it ‘does not concern itself with the use of those materials after circumvention has occurred.’ ") (citing Corley , 273 F.3d at 443 ) (italics in original); Realnetworks, Inc. v. DVD Copy Control Ass'n , 641 F. Supp. 2d 913, 941-42 (N.D. Cal. 2009) ("The DMCA itself is, of course, rooted in the Copyright Act. The DMCA's section 1201(c) merely preserves the general fair use defense to copyright infringement. It does not create new exemptions, nor does it exempt from liability circumvention tools otherwise deemed unlawful under sections 1201(a)(2) or (b)(1) .... Fair use is not a defense to trafficking in products used to circumvent effective technological measures that prevent unauthorized access to, or unauthorized copying of, a copyrighted work under sections 1201(a) or (b), respectively .... [However] fair use applies to section 1201(b) under the DMCA because it does not speak to, and thus does not prohibit, appropriate individual uses of circumvention devices.").
Here, if the Court were to adopt Corellium's position that fair use is a defense to Apple's DMCA claim, that would effectively render section 1201 meaningless. "A venerable canon makes clear that an interpreter must, if possible, give effect to every word and phrase in a statute." Darrisaw v. Pennsylvania Higher Educ. Assistance Agency , 949 F.3d 1302, 1306 (11th Cir. 2020) (citation). "[Courts] cannot adopt an interpretation that would render a term meaningless ...." Id. (citation omitted, italics in original). Thus, the Court finds that the better reading is that adopted by the Corley court. Therefore, Corellium may make fair use of iOS, but it is not absolved of potential liability for allegedly employing circumvention tools to unlawfully access iOS or elements of iOS. As noted earlier, this result may seem to undercut section 107 ’s fair use. However, in passing the DMCA, Congress adopted a "balanced" approach to accommodate both piracy and fair use concerns. Corley , 273 F.3d at 444 n.13. "The balance embodied in a federal law is not something this court can disturb, absent a Constitutional violation not at issue here." Realnetworks, Inc. , 641 F. Supp. 2d at 943. The Court, therefore, rejects Corellium's fair use defense in the context of the DMCA.
B. Genuine issues of material facts exist
Issues of material facts preclude entry of summary judgment on this claim. For example, there is the fundamental question of, and dispute as to, whether Apple has copyrights in all of iOS or only portions of iOS. While Corellium maintains that iOS is open for public access to support its position that iOS or components of iOS in the IPSW files are not protectable, even open source material is protectable. Jacobsen v. Katzer , 535 F.3d 1373, 1381 (Fed. Cir. 2008) ("Copyright holders who engage in open source licensing have the right to control the modification and distribution of copyrighted material."). The parties also dispute the nature of Apple's technological measures and the applicability of those measures to the IPSW files and, by extension, elements of iOS in those files. Likewise, Corellium alleged statutory defenses raise factual questions that preclude entry of summary judgment on this claim. Therefore, the parties’ motions are denied as they relate to the DMCA claim. Accordingly, it is
ORDERED that:
1. Apple's Motion for Partial Summary Judgment [DE 470] is DENIED ;
2. Corellium's Motion for Summary Judgment [DE 464] is GRANTED IN PART AND DENIED :
a. The Motion is granted on the copyright claims, to the extent the Court finds that Corellium's use of iOS constitutes fair use;
b. The Motion is denied regarding the DMCA claim.
3. No later than January 11, 2021 , the parties shall each file a status report notifying the Court of any portions of pending motions rendered moot by this Order.
DONE AND ORDERED in Fort Lauderdale, Florida, this 29th day of December 2020.