Opinion
Civil Action 3:21cv252
01-11-2022
SYOPSYS, INC., Plaintiff, v. RISK BASED SECURITY, INC., Defendant.
OPINION
John A. Gibney, Jr. Senior United States District Judge
The companies in this litigation-Synopsys, Inc. ("Synopsys") and Risk Based Security, Inc. ("RBS")-identify and share with their customers software security vulnerabilities. Earlier this year, after Synopsys announced additional work it planned to perform in this area, RBS sent Synopsys a cease and desist letter alleging that Synopsys's planned work would constitute copyright infringement of RBS's database, misappropriation of RBS's trade secrets, and tortious interference with RBS's current and prospective economic relationships. Synopsys then brought this action, seeking a declaratory judgment that Synopsys's conduct does not so infringe, misappropriate, or interfere. Synopsys also sues RBS fr copyright misuse.
In the months leading up to a November 18, 2021 hearing before this Court, RBS moved to dismiss Synopsys's claim fr copyright misuse and moved fr judgment on the pleadings as to Synopsys's other claims. At the hearing, the Court granted the motion to dismiss because copyright misuse constitutes an affirmative defense, but not an affirmative claim. And, because a justiciable controversy existed and RBS had waived its ability to enforce a forum-selection clause, the Court denied RBS's motion fr judgment on the pleadings. The Court further explains these holdings below.
Since the November 18 hearing, RBS has fled with the Court a covenant not to sue ("covenant") and a letter to Synopsys withdrawing its cease and desist letter ("withdrawal letter"). The parties dispute whether these documents render the case or controversy moot and, thus, require dismissal of Synopsys's remaining claims: RBS says they do; Synopsys says they do not. The Court held a hearing on the parties' arguments on January 6, 2022. Because RBS has not demonstrated that the covenant remedies or prevents the injuries Synopsys alleges, the Court will not dismiss the action as moot.
I. FACTS ALLEGED IN THE COMPLAINT
A. The Letter and the Lawsuit
On March 30, 2021, Synopsys issued a press release announcing its designation as a CNA. In the release, Synopsys also promised to "close a gap" between the vulnerabilities currently listed in the CVE database and a wider range of unidentified vulnerabilities. (ECF No. 49, at 2.) In response, on April 5, 2021, RBS sent Synopsys a cease and desist letter asserting that Synopsys could complete its new work as a CNA only if it acquired and disclosed trade secrets that Synopsys's subsidiary-Black Duck Software, Inc. ("Black Duck")-had allegedly misappropriated from RBS's private vulnerability database, VulnDB. (ECF No. 1-1.) In the letter, RBS stated that Synopsys's ''threatened release of VulnDB content and information would, if consummated, constitute ... a) copyright infringement of the VulnDB database; b) misappropriation of [trade secrets] under the Defend Trade Secrets Act... and state law under the Virginia Trade Secrets Act ...; and c) tortious interference with RBS's current and prospective economic relationships under Virginia common law." (Id. at 2.) RBS further demanded that Synopsys stop using, distributing, or modifying vulnerabilities identified in VulnDB ad all vulnerabilities Synopsys might discover via Black Duck's alleged misappropriation of VulnDB, and requested that Synopsys agree, in writing, to refrain from identifying vulnerabilities to CVE until completion of separate Massachusetts state court litigation between RS and Black Duck. (Id.) The letter concluded:
The Common Vulnerabilities and Exposure ("CVE") Program identifes, defines, and catalogs publicly disclosed cyber security vulnerabilities. A designated CVE Numbering Authority ("CNA'') may assign CVE identifcation numbers to newly discovered vulnerabilities "fr inclusion in first-time public announcements of new vulnerabilities." (ECF No. 1, at 9; ECF No. 142, at 4.)
No statement contained in this letter shall be construed as waiving or otherwise prejudicing RBS's right to seek an appropriate remedy in the event this matter is not expeditiously resolved.(Id.) Synopsys promptly fled this suit, seeking a declaratory judgment that Synopsys's conduct does not so infringe, misappropriate, or interfere, and alleging copyright misuse.
B. The Massachusetts Action
Though this action stems from Synopsys's March 2021 designation as a CNA and RBS's subsequent cease and desist letter, RBS and Synopsys-through Synopsys's subsidiary, Black Duck-have a long history. In 2014, RBS and Black Duck entered into a licensing agreement ("the Agreement") to allow Black Duck to incorporate RBS's private vulnerability database, VulnDB, into its own product. Black Duck then sublicensed the product to its customers. (ECF No. 142, at 7 n.4.) In 2018, RBS sued Black Duck in Massachusetts state court fr several claims related to the Agreement, including misappropriation of trade secrets. (See ECF No. 143-8.) The Massachusetts litigation remains ongoing, and on December 14, 2021, RBS added Synopsys as a party to that action. (ECF No. 149-3.)
Synopsys acquired Black Duck in 2017. (ECF No. 89, at 8.)
C. The Covenant and the Withdrawal Letter
On November 29, 2021, RBS fled with the Court the covenant and withdrawal letter. (ECF Nos. 132, 132-1, 132-2.) The covenant provides, in part:
NOW, THEREFORE, in reliance on Synopsys' CNA Non-Use Representations, 3 RBS hereby covenants not to sue Synopsys fr any and all existing or future claims based on Synopsys's role as a CNA related to VulnDB.(ECF No. 132-1, at.) In the withdrawal letter to Synopsys, RBS "withdraws the April 5, 2021 cease-and-desist letter," subsequent correspondence, and "any subsequent assertion concerning Synopsys' use or potential use of VulnDB in its role as a CNA." (ECF No. 132-2, at 2.)
RBS defines Synopsys's "CNA Non-Use Representations" as "Synopsys's representations of non-use of VulnDB, BOSA, or any other vulnerability database in its role as a CNA, as set frth in its opposition to RBS's motion fr reconsideration of RBS's prior motion to stay ([ECF No.] 74) and its counsel's representations during the November 18, 2021 hearing." (ECF No. 132-1, at 3.)
II. DISCUSSION
At the time of the November 18 hearing, RBS had not yet issued the covenant and withdrawal letter. The Court first addresses the facts as they existed during the November 18 hearing, and then separately analyzes justifiability in light of the covenant and withdrawal letter.
A Rule 12(b)(6) motion gauges a complaint's sufciency without resolving any factual discrepancies or testing claims' merits. Republican Party of NC. v. Martin, 980 F.2d 943, 952 (4th Cir. 1992). In considering the motion, a court must accept all allegations in the complaint as true and draw all reasonable inferences in the plaintiffs favor. Nemet Chevrolet, Ltd v. Consumerajairs.com, Inc., 591 F.3d 250, 253 (4th Cir. 2009). The principle that a court must accept all allegations as true, however, does not apply to legal conclusions. Ashcroi v. Iqbal, 556 U.S. 662, 678 (2009). To survive a Rule 12(b)(6) motion to dismiss, a complaint must state facts that, when accepted as true, state a claim to relief that is plausible on its face. Id. "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable fr the misconduct alleged." Id. A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief." Fed.R.Civ.P. 8(a)(2). "The Court applies the same standard of review to a Rule 12(c) motion as it would to a Rule l 2(b) motion." Seneca Ins. Co. v. Shipping Boxes I, LLC, 30 F.Supp.3d 506, 510 (E.D. Va. 2014).
1. Case or Controversy
RBS argues that the Court should dismiss Synopsys's declaratory judgment claims because "Synopsys mooted any controversy by disclaiming reliance on VulnDB ... in its role as a CNA." (ECF No. 89, at 3.) RBS also raises several alternative arguments fr dismissing these claims fr lack of substantial controversy, including that Synopsys has not identified "the 'potential future' disclosures that it will make as a CNA'' and that RBS has not registered its asserted copyrights. (Id. at 4, 7; ECF No. 71, at 8, 11-13.) None of RBS's arguments warrant dismissal.
Under the Declaratory Judgment Act, a federal court "may declare the rights and other legal relations of any interested party seeking such declaration, whether or not further relief is or could be sought" where "a case of actual controversy within its jurisdiction" exists. 28 U.S.C. § 2201(a). "[T]he phrase 'case of actual controversy' ... refers to the type of 'Cases' and 'Controversies' that are justiciable under Article III." Medlmmune Inc., v. Genentech, Inc., 549 U.S. 118, 127 (2007) (citing Aetna Life Ins. Co. v. Haworth, 300 U.S. 227, 240 (1937)). "The declaratory judgment procedure ... may not be made the medium fr securing an advisory opinion in a controversy which has not arisen." Coffman v. Breeze Corps., 323 U.S. 316, 324 (1945).
The difference between an abstract question and a "controversy" contemplated by the Declaratory Judgment Act is necessarily one of degree, and it would be difficult, if it would be possible, to fashion a precise test fr determining in every case whether there is such a controversy. Basically, the question in each case is whether the facts alleged, under all the circumstances, show that there is a substantial controversy, between parties having adverse legal interests, of sufficient immediacy and reality to warrant the issuance of a declaratory judgment.Md. Cas. Co. v. Pac. Coal & Oil Co., 312 U.S. 270, 273 (1941).
The parties here share a history of conflicts: Synopsys acquired RBS's former licensee in 2017, RBS fled suit against that licensee in 2018 (fr claims that overlap, in part, with the underlying issues in this action), and, in recent years, RBS and Synopsys became direct competitors in the vulnerability market. In the 2021 cease and desist letter, RBS demanded immediate action from Synopsys to avoid "costly and time-consuming litigation." (ECF No. 1-1, at 3.) The letter then stated that, absent resolution, "RBS [would] seek all available remedies under the law, including injunctive relief and recovery of its attorneys' fees." (Id.) Synopsys, well aware that its subsidiary was already defending a lawsuit against RBS, took RBS's threat seriously and fled this declaratory judgment action. Given the parties' history, RBS's explicit threat to sue in the cease and desist letter generated "an objectively ·real and reasonable apprehension of litigation. " Dunn, 133 F.Supp.2d at 827.
See Surefoot LC v. Sure Foot C01p., 531 F.3d 1236, 1247 (10th Cir. 2008) ('·[I]n assessing whether a live controversy exists between the parties, we must both take into account ·all the circumstances' before us, and be sensitive to the fact that whether jurisdiction exists is often a question of "degree."' (internal citations omitted) (cleaned up)); Dunn Computer Corp. v. Loudcloud, Inc., 133 F.Supp.2d 823, 827 (E.D. Va. 2001) ("More is required" fr a case or controversy than a cease and desist letter that "does not explicitly threaten litigation.").
The fact that Synopsys had not yet identified the specific disclosures it intended to make did not strip the Court of subject-matter jurisdiction. The Declaratory Judgment Act provides plaintiffs "an alternative to pursuit of the arguably illegal activity." Medimmune, 549 U.S. at 772 (quoting Steffel v. Thompson, 415 U.S. 452, 480 (1974) (Rehnquist, J., concurring)). Requiring a plaintiff to choose ''between abandoning [its] rights or risking prosecution" would defeat the very purpose of the Declaratory Judgment Act. Id. at 773 (quoting Abbott Lab'ys. v. Gardner, 387 U.S. 136, 152 (1967), abrogated on other grounds by Califano v. Sanders, 430 U.S. 99 (1977)).
Nor does RBS's argument that it has not registered any copyrights in the subject intellectual property require dismissal of this case fr lack of subject-matter jurisdiction. Though a plaintiff must "apply for [ copyright] registration and receive the Copyright Office's decision on [its] application before instituting suit," this does not constitute a jurisdictional requirement. Fourth Est. Pub. Beneft Corp. v. Wall-Street.com, LLC, 139 S.Ct. 881, 891 (2019); Reed Elsevier, Inc. v. Muchnick, 559 U.S. 154, 166 (2010). Dismissing this action fr lack of a copyright would "improperly conflate[] the threshold standing question with the merits of [Synopsys's] claims." DiCocco v. Garland, 18 F.4th 406, 412 (4th Cir. 2021) (citing Pitt County v. Hotels.com, L.P., 553 F.3d 308, 312 (4th Cir. 2009)).
RBS admits that it currently holds no copyright in VulnDB and that "the chance of [RBS] registering VulnDB fr copyright protection are minimal." (ECF No. 130, at 44:7-9, 44:22-23.)
2. Forum-Selection Clause
RBS also says that a forum-selection clause in the Agreement requires dismissal of this case. (ECF No. 89, at 4, 7; ECF No. 71, at 8, 11-13.) The clause provides, in part:
The exclusive jurisdiction and venue of any action with respect to the subject matter of this Agreement shall be the state courts of the County of Middlesex, Commonwealth of Massachusetts and each of the parties hereto submits itself to
the exclusive jurisdiction and venue of such courts fr the purpose of any such action.(ECF No. I 0-11 13.11.) RBS says that because Synopsys constitutes an "Affiliate" of Back Duck and its claims fill within the "subject matter" of the Agreement, the Agreement-and, consequently, the forum-selection clause-apply to Synopsys's declaratory judgment claims. Synopsys argues that the forum-selection clause does not apply in this case because RBS waived its ability to enfrce it.
(See id at 1 (defining an "Affiliate" as "any corporation .. that directly or indirectly owns ... Reseller to the extent of at least ffy (50%) percent of the equity having the power to vote on or direct the affairs of the entity").)
"[A] valid forum-selection clause [should be] given controlling weight in all but the most exceptional cases." At. Marine Constr. Co. v. US. Dist. Ct. for W Dist. of Tex., 571 U.S. 49, 63 (2013) (quoting Stewart Org., Inc. v. Ricoh Corp., 487 U.S. 22, 33 (1988)) (Kennedy and O'Connor, J., concurring) (second alteration in original). "[T]he appropriate way to enforce a forum-selection clause pointing to a state or foreign frum is through the doctrine of forum non conveniens." Id. at 60. This common-law doctrine "allows a court to dismiss a case when the original venue is highly inconvenient, and an adequate alternative venue exists." BAE Sys. Tech. Sol. & Servs. v. Republic of Korea's Def Acquisition Program Admin., 884 F.3d 463, 470-71 (4th Cir. 2018). A party "must assert a motion to dismiss fr forum non conveniens within a reasonable time afer the fcts or circumstances which serve as the basis fr the motion have developed and become known or reasonably knowable to the [party]." Cable News Network L.P., LL.LP. v. CNNews.com, 177 F.Supp.2d 506, 528 (E.D. Va. 2001), afd in part. vacated in part on other grounds, 56 Fed.Appx. 599 (4th Cir. 2003).
Though "strong federal policy ... favors enforcement of forum-selection provisions," a party may waive its right to enforce a forum-selection clause if it "clear[ly] indicates], through its actions, ... its intent to do so." Whiting-Turner Contracting Co. v. Westchester Fire Ins. Co., No. JFM- 13-348, 2013 WL 3177881, at *4 (D. Md. June 20, 2013). A Court should not find that a party has waived its right to enforce a forum-selection clause 'unless (1) the party invoking the clause has taken actions inconsistent with it or has delayed its enforcement, and (2) the other party would be prejudiced by its enforcement." Kell/er Int' Inc. v. Starbuck Corp., 55 F.Supp.3d 839, 850 (E.D. Va. 2014) (quoting Whiting-Turner, 2013 WL 3177881, at *4).
The Fourth Circuit has applied these same factors in the context of an arbitration clause. See, e.g., MicroStrateg, Inc. v. Lauricia, 268 F.3d 244, 249 (4th Cir. 2001). But, "(a]s other jurisdictions have noted, there is little difference between arbitration, forum-selection, and choice-of-law clauses fr enforceability purposes." Zak/it v. Glob. Linguist Sols., LLC, 53 F.Supp.3d 835, 845 n.4 (E.D. Va. 2014); see also Aggarao v. MOL Ship Mgmt. Co., 675 F.3d 355, 365 n.9 (4th Cir. 2012) (noting that the Supreme Court has characterized an arbitration clause as 'a specialized kind of forum-selection clause" (quoting Scherk v. Alberto-Culver Co., 417 U.S. 506, 519 (1974))).
RBS is no stranger to the Agreement's frum-selection clause. Not only did RBS and Black Duck include it in the Agreement in 2014, but in 2018 RS fled suit against Black Duck in Middlesex County state court pursuant to the clause. RBS says it raises the frum-selection clause with regard to Synopsys now, though, because Synopsys only recently cited-"fr the frst time"-to the Agreement in an interrogatory response. (ECF No. 72, at 5.)
The parties have since jointly moved to refer the case to the Business Litigation Section of the Massachusetts Court system, which serves Middlesex County (among others), but RBS nevertheless initially fled the suit in accordance with the clause. (ECF No. 89, at 11.)
But even before Synopsys referred to the Agreement, RBS consistently tied together Black Duck and Synopsys's alleged misdeeds. In the cease and desist letter preceding this action, RS alleged that Synopsys's March 30, 2021 press release "demonstrate(d] the nexus between Black Duck's theft of RBS's intellectual property and Synopsys's promise to address the gap in CVE." (ECF No. 1-1, at I.) RBS further stated that the release "clear[ly] reference[d] ... the VulnDB data misappropriated by Black Duck." (Id. at 2) And in support of its first motion to stay, RBS argued that the Massachusetts action and the instant action paralleled one another in part because "through [Synopsys's] ownership of Black Duck, Synopsys has access to, and is seeking to misuse, the same trade secrets." (ECF No. 35, at 12.) The circumstances that, in RBS's view, warrant application of the forum-selection clause existed many months before RBS fled this motion.
Despite its own arguments linking Synopsys's actions to Black Duck's, RBS ardently litigated this action fr many months before attempting to enforce the forum-selection clause. During the approximately six-month period between when Synopsys fled this action and the date RBS moved fr judgment on the pleadings on these grounds, RBS moved to dismiss the complaint, fled an answer, moved to stay the action, appeared at a hearing, participated in a settlement conference, and engaged in discovery. (ECF Nos. 8, 46, 48, 50, 68, 73; see also ECF No. 75, at 10.) RBS's zealous defense in this action weighs against the application of the frum-selection clause.
Under these same facts, the Court finds that enforcement of the clause would prejudice Synopsys. Before RBS raised the forum-selection clause, Synopsys diligently responded to RBS's motions and prosecuted this action. Both parties participated in the hearing and settlement conference; fully briefed each motion; and engaged in discovery. Though the parties have agreed to share discovery between this and the Massachusetts action, not all the issues in each case overlap. And, perhaps most importantly, enforcement of the forum-selection clause here would prejudice Synopsys because the state court cannot remedy Synopsys's declaratory judgment claim fr no copyright infingement. (Id.); see 28 U.S.C. § 1338; see Liza/de v. Advanced Planning Servs., 875 F.Supp.2d 1150, 1158 (S.D. Ca. 2012). Having considered the elements, the Court finds that RBS waived its right to enforce the forum-selection clause.
Synopsys also argues that it is not a party to, and did not acquire Black Duck until after RBS and Black Duck had executed, the Agreement and that its future actions as a CNA "do[] not fill within or even relate to the subject matter of the Reseller Agreement." (ECF No. 75, at 11, 12.) Because the Court finds that RBS waived its ability to enforce the forum selection clause, it need not address these alternative arguments.
3. Copyright Misuse
RBS moves to dismiss Synopsys's copyright misuse claim because copyright misuse exists "only [as] an affirmative defense and not an affirmative claim fr relief." (ECF No. 49, at 7.) In first holding that copyright misuse exists as an affirmative defense to copyright infringement, the Fourth Circuit analogized copyright law to patent law: "[w]e are of the view, however, that since copyright and patent law serve parallel public interests, a 'misuse' defense should apply to infringement actions brought to vindicate either right." Lasercomb Am., Inc. v. Reynolds, 911 F.2d 970, 976 (4th Cir. 1990). When a party successfully alleges misuse under either doctrine, the defense "results in rendering the patent [or copyright] unenforceable until the misuse is purged." B. Braun Med., Inc. v. Abboll Lab ys., 124 F.3d 1419, 1427 (Fed. Cir. 1997).
Despite the prevalence of copyright misuse as an affirmative defense and counterclaim, the Fourth Circuit has yet not recognized copyright misuse as an affirmative claim. The Court may permit a novel claim to move forward even if it does "not fill within the fur comers of our prior case law," but it sees no reason to do so here where RBS denies having a copyright. Wright v. North Carolina, 787 F.3d 256, 263 (4th Cir. 2015) (quoting McGary v. City of Portland, 386 F.3d 1259, 1270 (9th Cir. 2004)). C/ Altera Corp. v. Clear Logic, Inc., 424 F.3d 1079 (9th Cir. 2005) ("Because the remedy fr copyright misuse is equitable, it makes little sense to allow [a party] to proceed on an independent claim fr copyright misuse when there has been no allegation of copyright infringement."). The Court thus dismisses Count III of the complaint.
B. Covenant and Withdrawal Letter
"In general a case becomes moot when the issues presented are no longer 'live' or the parties lack a legally cognizable interest in the outcome." Murphy v. Hunt, 455 U.S. 478, 481 (1982) (quoting US. Parole Comm 'n v. Geraghty, 445 U.S. 388, 396 (1980)) (cleaned up); see Arizonans for Of Eng. v. Arizona, 520 U.S. 43, 67 (1997) ("To qualify as a case federal-court adjudication, 'an actual controversy must be extant at all stages of review, not merely at the time the complaint is fled."' (quoting Preiser v. Newkirk, 422 U.S. 395, 401 (1975))). The Court is "obliged to inquire sua sponte whenever a doubt arises as to the existence of federal jurisdiction." Mt. Healthy City Sch. Dist. Bd of Educ. v. Doyle, 429 U.S. 274, 278 (1977); see Fed.R.Civ.P. l 2(h)(3) ("If the court determines at any time that it lacks subject-matter jurisdiction, the court must dismiss the action.").
Here, RBS created a question as to the continued justiciability of this action when it issued the covenant and the withdrawal letter. The Supreme Court has outlined a stringent burden-shifting famework that applies when a party issues a covenant not to sue in the midst of the litigation:
We have recognized ... that a defendant cannot automatically moot a case simply by ending its unlawfl conduct once sued. Cit of Mesquite v. Aladdin's Castle, Inc., 455 U.S. 283, 289 (1982). Otherwise, a defendant could engage in unlawful conduct, stop when sued to have the case declared moot, then pick up where he lef of, repeating this cycle until he achieves all his unlawful ends. Given this concern, our cases have explained that "a defendant claiming that its voluntary compliance moots a case bears the formidable burden of showing that it is absolutely clear the allegedly wrongful behavior could not reasonably be expected to recur." Friends of the Earth, Inc. v. Laidlaw Env't Servs. (OC), Inc., 528 U.S. 167, 190 (2000).
Already, LLC v. Nike, Inc., 568 U.S. 85, 91 (2013). Once the covenant-issuing party meets its burden, "it [becomes] incumbent on [the opposing party] to indicate that [the opposing party] engages in or has sufciently concrete plans to engage in activities not covered by the covenant." ABS Glob., Inc. v. Cytonome/ST LLC, 984 F.3d IO 17, 1020 (Fed. Cir. 2021) (quoting Already, 568 U.S. at 94).
In Already, the plaintiff Nike unilaterally issued a covenant not to sue afer the defendant Already, LLC ("Already"), another fotwear manufcturer, fled a declaratory judgment counterclaim. 568 U.S. at 88-89. The covenant explicitly stated that it was (I) unconditional; (2) irrevocable; (3) applicable to any claim or demand; and (4) applicable to Already's distributors and customers:
Nike also moved to dismiss its claims with prejudice. Id. at 89.
[Nike] unconditionally and irrevocably covenants to refrain from making any claim(s) or demand(s) ... against Already or any of its ... related business entities ... [including] distributors ... and employees of such entities and all customers ... on account of any possible cause of action based on or involving trademark infringement, unfair competition, or dilution, under state or federal law ... relating to the NIKE Mark based on the appearance of any of Already's current and/or previous footwear product designs, and any colorable imitations thereof, regardless of whether that footwear is produced ... or otherwise used in commerce before or after the Effective Date of this Covenant.Id. at 93 (emphases and alterations in original). Considering the breadth of these terms, the Supreme Court fund the language "sufcient] to meet the burden imposed by the voluntary cessation test." Id. at 93. The Court further stated:
Already's only legally cognizable injury-the fct that Nike took steps to enforce its trademark-is now gone and, given the breadth of the covenant, cannot reasonably be expected to recur. There being no other basis on which to find a live controversy, the case is clearly moot.Id. at 100.
See also ABS Glob., 984 F.3d at 1022 (dismissing appeal as moot where the plaintiffs "affidavit disavowing its appeal [was] unquestionably narrower than the covenant not to sue in Already," but was "'coextensive with the asserted injury' in fact"); Nursery Decals & More, Inc. v. Neat Print, Inc., No. 3: 19cv2606, 2021 WL 4942192, at *7 (N.D. Tex. Oct. 22, 2021) (denying motion to dismiss after finding that the covenant not to sue did not eliminate the plaintiffs injuries).
Here, RBS has filed to meet its "frmidable" burden of showing that the injury Synopsys seeks to remedy and prevent "could not reasonably be expected" to recur. Already, 568 U.S. at 92. Because the covenant covers conduct "based on Synopsys's role as a CNA related to VulnDB," it does not sufciently protect Synopsys's other commercial conduct. (ECF No. 132-1, at 3.) Synopsys has stated that, afer it "discovers a publicly unknown vulnerability as a CNA, [it] will create associated [records in its product, Black Duck Security Advisories ("BOSA"), ] ... detailing the identified vulnerability and those BOSA records are made available to Synopsys' customers." (ECF No. 143, at 10 n.3.) Synopsys sought to protect this type of commercial activity in its complaint when it repeatedly referred to its business relationships and asked fr declaratory relief "to preserve its rights, defined its good name and protect i[t]s business" and those relationships. (ECF No. 111 51, 61, 74.) RBS does not dispute that Synopsys's post-CNA commercial conduct fills "outside the scope of the covenant, but finds this immaterial; according to RBS, "the instant action fcuse[s] on Synopsys's future conduct as a CNA." (ECF No. 142, at 2-3, 15.)
Though Synopsys relies on its CNA conduct as an example of the conduct it seeks to protect in its remaining claims, the relief it seeks fr each claim demonstrates that it did not refer to this conduct in a vacuum. By fling this suit, Synopsys intended to include other future business actions it may take with regard to BDSA and, accordingly, any financial and reputational harm that may result from efforts to impede such actions. (C. ECF No. 1-1, at 3 (demanding, without an explicit reference to Synopsys's CNA duties, that Synopsys "[immediately cease the unauthorized use, distribution, and modification of RBS's intellectual property").) The covenant, which covers only Synopsys's CNA conduct, provides a convenient loophole fr RBS to sue Synopsys fr its future alleged use of VulnDB in Synopsys's private customer-fcing products. (See ECF No. 169, at 21:23-22:2.)
The Court's Order denying RBS's first motion to stay recognized that, despite some overlap between the Massachusetts action and this action, the ''the threat of fture litigation over actions to occur in the future defines the scope of this action." (ECF No. 47, at 7.) Though Synopsys's CNA conduct certainly constitutes an important component of this suit, the Court's statement, and the Court's overall finding in that Order, does not limit the scope of this action to Synopsys's future conduct as a CNA.
Synopsys's many citations to its business relationships reveal another shortcoming of the covenant: unlike the covenant in Already, which protected Already's distributors and customers, RBS's covenant applies only to Synopsys. The Court does not opine today on whether Synopsys could bring a declaratory judgment claim based on potential action against one of its retailers, but finds that, given the narrowly-tailored protection the covenant provides, it does not remedy or adequately protect Synopsys's business or its business relationships.
Because the relief Synopsys seeks in this suit includes fture business activities in addition to its CNA conduct, and the covenant does not protect Synopsys in perfrming those activities, RBS has not met its burden. The Court will not dismiss the case as moot.
III. CONCLUSION
For the reasons explained above. the Court granted RBS"s motion to dismiss. (ECF No. 128), denied RBS· s motion for judgment on the pleadings. (id.). and will not dismiss the action as moot.
The Court will issue an appropriate Order.
Let the Clerk send a copy of this Opinion to all counsel of record and to the Special Master.