Compulife Software Inc. v. Moses Newman

959 F.3d 1288

Opinion

[PUBLISH]

IN THE UNITED STATES COURT OF APPEALS

FOR THE ELEVENTH CIRCUIT

_________________________

No. 18-12004

________________________

D.C. Docket No. 9:16-cv-81942-RLR

COMPULIFE SOFTWARE INC., Plaintiff - Appellant,

versus

MOSES NEWMAN, AARON LEVY, DAVID RUTSTEIN, a.k.a. David Anthony Gordon, a.k.a. Bob Gordon, a.k.a. Nate Golden, BINYOMIN RUTSTEIN, a.k.a. Ben Rutstein,

Defendants - Appellees.

_________________________

No. 18-12007

________________________

D.C. Docket No. 9:16-cv-80808-RLR

COMPULIFE SOFTWARE INC., Plaintiff - Appellant,

versus

BINYOMIN RUTSTEIN, a.k.a. Ben Rutstein, JOHN DOES 1 - 10, DAVID RUTSTEIN,

Defendants - Appellees.

________________________

Appeals from the United States District Court for the Southern District of Florida

________________________

(May 20, 2020)

Before JORDAN and NEWSOM, Circuit Judges, and HALL, * District Judge. NEWSOM, Circuit Judge:

There’s nothing easy about this case. The facts are complicated, and the governing law is tangled. At its essence, it’s a case about high-tech corporate espionage. The very short story: Compulife Software, Inc., which has developed and markets a computerized mechanism for calculating, organizing, and comparing life-insurance quotes, alleges that one of its competitors lied and hacked its way

*

Honorable James Randal Hall, United States District Chief Judge for the Southern District of Georgia, sitting by designation.

3

into Compulife’s system and stole its proprietary data. The question for us is whether the defendants crossed any legal lines—and, in particular, whether they infringed Compulife’s copyright or misappropriated its trade secrets, engaged in false advertising, or violated an anti-hacking statute.

With the parties’ consent, a magistrate judge was tasked with tackling these thorny issues in a bench trial. He determined that Compulife had failed to prove any legal violation. We conclude, however, that in finding that Compulife hadn’t demonstrated either copyright infringement or trade-secret misappropriation, the magistrate judge made several discrete legal errors and, more generally, failed to adequately explain his conclusions. Accordingly, we vacate the judgment in part and remand with instructions to make new findings of fact and conclusions of law.

I

A

Warning: This gets pretty dense (and difficult) pretty quickly.

Compulife and the defendants are direct competitors in a niche industry:

generating life-insurance quotes. Compulife maintains a database of insurance- premium information—called the “Transformative Database”—to which it sells access. The Transformative Database is valuable because it contains up-to-date information on many life insurers’ premium-rate tables and thus allows for simultaneous comparison of rates from dozens of providers. Most of Compulife’s

4

customers are insurance agents who buy access to the database so that they can more easily provide reliable cost estimates to prospective policy purchasers. Although the Transformative Database is based on publicly available information—namely, individual insurers’ rate tables—it can’t be replicated without a specialized method and formula known only within Compulife.

Compulife sells two different kinds of access to the Transformative Database—a “PC version” and an “internet-engine version”—each run by its own piece of software and each accompanied by its own type of license. Both pieces of software contain an encrypted copy of the database. The PC-version software— called the “PC quoter”—is sold along with a PC license that allows licensees to install copies of the quoter on their personal computers and other devices for (depending on the number of devices) a cost of either $180 or $300 per year. The PC quoter uses its local copy of the Transformative Database to generate insurance-rate estimates corresponding to demographic information entered by the end user.

A PC licensee can purchase an add-on called the “web quoter” for an extra $96 per year. The web-quoter feature allows the PC licensee to put a quoter on its own website, which it can then use as a marketing tool to attract customers. Once a licensee’s website is equipped with the web quoter, prospective life-insurance purchasers can enter demographic information into fields on the licensee’s site and

5

receive quotes directly from the licensee. Unlike the PC quoter—which contains its own local copy of the Transformative Database—the web quoter generates quotes by communicating with an internet-quote engine hosted on Compulife’s server. The HTML source code of the web quoter is protected by a registered copyright.

A second kind of license—the “internet-engine” license—permits a licensee to host Compulife’s internet-quote engine, which includes the Transformative Database, on its own server and to integrate it with additional features of its own creation. (Naturally, it’s more expensive—it costs $1200 per year.) An internet- engine licensee can then sell access to “its” product—which is an amalgamation of Compulife’s internet-quote engine with any accoutrements that the licensee has seen fit to add. Importantly, though, internet-engine licensees can sell access only to Compulife’s PC licensees. This arrangement allows an internet-engine licensee to include Compulife’s internet-quote engine—again, with the Transformative Database—as a part of its own product, while simultaneously ensuring that it doesn’t compete with Compulife for potential insurance-agent customers. Compulife also permits an internet-engine licensee to provide its web-quoter HTML code to the licensee’s customers so that the customers’ websites can retrieve quotes from the licensee’s server. This is the same copyrighted HTML code that Compulife provides to PC licensees with the web quoter add-on.

6

In addition to the PC-version and internet-engine products that it licenses to agents and that contain the Transformative Database, Compulife also provides consumers with direct access to life-insurance quotes through its Term4Sale internet site, www.term4sale.com. Term4Sale communicates with essentially the same internet-quote engine that PC licensees’ web quoters access and that internet- engine licensees are permitted to maintain on their own servers. Anyone can use the Terms4Sale site to receive free life-insurance quotes directly from a copy of the Transformative Database that Compulife hosts on its own server. The Term4Sale site refers prospective life-insurance purchasers to insurance agents with whom Compulife partners, who in turn pay Compulife for the referrals.

Now, to the defendants, who are also in the business of generating life-

insurance quotes—primarily through a website, www.naaip.org. “NAAIP” stands for National Association of Accredited Insurance Professionals, but as the court below found, “NAAIP is not a real entity, charity, not-for-profit, or trade association, and is not incorporated anywhere.” Compulife Software, Inc. v. Rutstein, No. 9:16-cv-80808, 2018 U.S. Dist. LEXIS 41111, at *15 (Mar. 12, 2018). Through naaip.org, the defendants offer a service similar to—and, the evidence shows, at least partially copied from—Compulife’s web quoter, which they call a “Life Insurance Quote Engine.” Any insurance agent can sign up for a free website located on the domain naaip.org—for example,

7

“http://naaip.org/tmatteson77.” The defendants host thousands of these sites on a server in Israel and equip each one with the Life Insurance Quote Engine. Prospective life-insurance purchasers can then obtain quotes on any of these NAAIP-hosted websites by entering demographic information, just as they could on the website of any Compulife PC licensee with a web quoter add-on. Each NAAIP site includes a link that allows consumers to purchase insurance through One Resource Group, Inc., a brokerage firm with which the defendants have partnered. If a visitor to an NAAIP site uses the link to buy insurance, the defendants receive a part of One Resource’s brokerage fees in exchange for the referral.

The defendants also operate the BeyondQuotes website, www.beyondquotes.com, which includes a Life Insurance Quote Engine like the ones on participating NAAIP websites. BeyondQuotes operates similarly to Compulife’s Term4Sale site, generating revenue by selling referrals to affiliated insurance agents.

B

Having canvassed Compulife’s and the defendants’ respective businesses, we should introduce the (complex) cast of individual characters that populate this case. The first is Robert Barney, the founder and CEO of Compulife. Barney personally updates Compulife’s Transformative Database. To do so, he draws on

8

insurers’ publicly available rate information, but he also employs a proprietary calculation technique—in particular, a secure program to which only he has access and that only he knows how to use. Other relevant players at Compulife include Jeremiah Kuhn, its CFO/COO, and Chris Bruner, the programmer who created the Transformative Database.

Most significant among the defendants is David Rutstein, the founder of NAAIP and the owner of BeyondQuotes. He operates naaip.org and beyondquotes.com with help from his son, defendant Binyomin Rutstein, and their co-defendants Aaron Levy and Moses Newman. At one point—more on this to come—the defendants also employed a hacker named Natal, who, it is undisputed, took Compulife’s data for use in the defendants’ software.1 There are also several key characters who aren’t directly affiliated with any of the parties. MSCC is a software company and a Compulife customer with an internet-engine license. It sells access to a proprietary program for life-insurance agents called “Vam DB,” which (as is permissible for internet-engine licensees) includes Compulife’s internet engine. And because MSCC hosts Compulife’s

1 There is some confusion about the hacker’s name in the record. We don’t know her first name. As for her last, sometimes it’s rendered Natal, sometimes Matal. For simplicity’s sake, we will use Natal.

9

internet engine on its Vam DB server, it also hosts (again, as is permissible) a copy of Compulife’s Transformative Database.

Brian McSweeney is a life-insurance agent who, during the time of the defendants’ alleged misconduct, was a Compulife PC licensee who used MSCC’s Vam DB server. At the same time, McSweeney also had a working relationship with the defendants—in particular, he was one of the agents who (as already described) paid the defendants for leads generated from the BeyondQuotes site. Eric Savage—another Compulife licensee—also had a working relationship with defendant David Rutstein. McSweeney and Savage are important here because the defendants used their relationships with them to gain access to Vam DB, and thus to Compulife’s Transformative Database.

C

With that background, we turn (at last) to the alleged espionage. Compulife claims that the defendants’ websites don’t report their own quotes but merely reproduce Compulife’s own proprietary data. According to Compulife, the defendants stole its data in two different ways, which form the basis of two separate lawsuits. These suits—which have been called the “08 case” and the “42 case” throughout these proceedings, to denote their original docket numbers—were consolidated for trial and remain consolidated on appeal.

10

In the 08 case, Compulife contends that the defendants gained access to the Transformative Database under false pretenses by purporting to work for licensed Compulife customers. In particular, David Rutstein, using the email address bob@naaip.org, represented that he was working with Compulife PC licensees McSweeney and Savage and requested the HTML code for Compulife’s web quoter, which he said would allow his websites to communicate with the copy of the Transformative Database hosted on MSCC’s Vam DB server. Compulife CFO/COO Kuhn responded by sending Rutstein the HTML code, believing that he was a web designer employed by McSweeney, a licensed customer. 2 A comparison of the HTML used by the defendants with Compulife’s HTML source code shows without a doubt that the defendants copied some of it, although (as we’ll discuss) the legal significance of that copying is disputed.

2 As already noted, the defendants really did have a professional relationship with McSweeney and Savage, but Kuhn provided the HTML code only because he misunderstood the nature of that relationship. Rutstein had partnered with McSweeney and Savage and forwarded them customer leads from Beyond Quotes, but Beyond Quotes was not owned by McSweeney or Savage. Nevertheless, when Rutstein requested HTML code for www.beyondquotes.com by email he claimed to have an “account . . . thru Eric Savage.” He also explained that he intended to set up a web quoter to forward “leads” to McSweeney, although he planned to set it up on a website that “would be separate from” McSweeney’s. In context, Kuhn took this to mean that Rutstein was a web designer helping McSweeney to set up a second website of his own. As Kuhn had explained to Savage in an email exchange a few months earlier, each customer was permitted to put the quoter on any website that he owned without an additional license, but an additional license was required before the quoter could be implemented on a website owned by someone else. Kuhn testified that he wouldn’t have emailed the HTML code if he had known that “Beyond Quotes did not belong to Eric Savage or Brian McSweeney or any other authorized user.”

11

For several years, the defendants’ websites enjoyed access to Compulife’s internet engine—and thus to the Transformative Database—on MSCC’s Vam DB server. They used this access to generate quotes for all NAAIP websites and for their own BeyondQuotes site. Compulife eventually discovered the ruse and cut off the defendants’ unauthorized access, at which point their sites temporarily (and conspicuously) stopped producing quotes. The defendants don’t deny that they connected their NAAIP websites and BeyondQuotes to Compulife’s database on the Vam DB server—they simply claim that their access was innocent.

In the 42 case, Compulife alleges that the defendants hired a hacker, Natal, to “scrape” data from its server. Scraping is a technique for extracting large amounts of data from a website. The concept is simple; a hacker requests information from a server using ordinary HTTP commands similar to those that a legitimate client program of the server might employ in the ordinary course. Although a hacker could obtain the data manually by entering each command as a line of code and then recording the results, the true power of a scraping attack is realized by creating a robot—or “bot,” for short—that can make many requests automatically and much more rapidly than any human could. A bot can request a huge amount of data from the target’s server—technically one query at a time, but several queries per second—and then instantaneously record the returned information in an electronic database. By formulating queries in an orderly fashion

12

and recording the resulting information, the bot can create a copy—or at least a partial copy—of a database underlying a website.

Natal used this scraping technique to create a partial copy of Compulife’s Transformative Database, extracting all the insurance-quote data pertaining to two zip codes—one in New York and another in Florida.3 That means the bot requested and saved all premium estimates for every possible combination of demographic data within those two zip codes, totaling more than 43 million quotes. Doing so naturally required hundreds of thousands of queries and would have required thousands of man-hours if performed by humans—but it took the bot only four days. The HTML commands used in the scraping attack included variables and parameters—essentially words (or for that matter any string of characters) used to designate and store values—from Compulife’s copyrighted HTML code. For example, the parameter “BirthMonth” in Compulife’s code stores a number between one and twelve, corresponding to a prospective purchaser’s birth month.)

Compulife alleges that the defendants then used the scraped data as the basis for generating quotes on their own websites. The defendants don’t disagree,

3 David Rutstein testified that he asked Natal to obtain data on New York and California. Whether he misspoke or Natal simply scraped the wrong data is unclear, but unrebutted testimony establishes that the defendants set up their quote engines to provide only New York and Florida quotes—specifically, quotes corresponding to two zip codes: 10458 and 33433. Moreover, it is undisputed that the defendants received data files from Natal with data for just those zip codes.

13

except to claim that they didn’t know the source of the scraped data but, rather, innocently purchased the data from a third party. Moses Newman testified, however, that he watched Natal collect the requested data in a manner consistent with a scraping attack. David Rutstein also testified that when the defendants instructed Natal to obtain insurance-quote information, they fully intended for her to “extract[] data” from an existing website.

D

Compulife filed suit in the United States District Court for the Southern District of Florida. In both the 08 case and the 42 case, it asserted counts of copyright infringement and trade-secret misappropriation. In the 08 case, Compulife alleged that the defendants (1) infringed its copyright in the HTML source code of its web quoter when they implemented similar quoters on their own websites and (2) misappropriated its trade secret by accessing the Transformative Database on MSCC’s Vam DB server to generate quotes without permission. In the 42 case, Compulife alleged that the defendants (1) infringed its copyright by copying parameters and variables from the HTML source code in order to carry out a scraping attack and (2) misappropriated a trade secret by scraping data from its Term4Sale site. Compulife also asserted false-advertising claims under the Lanham Act, Florida Deceptive and Unfair Trade Practices Act, and Florida

14

common law in both cases, as well as a violation of the Florida Computer Abuse and Data Recovery Act in the 42 case.

The parties consented to a bench trial before a federal magistrate judge.

Although the judge found, as an initial matter, that Compulife had a valid copyright in the text of its HTML source code and that its Transformative Database was a protectable trade secret, he ruled in favor of the defendants. In doing so, he held that Compulife hadn’t met its burden to prove—as it had to in order to make out a copyright-infringement claim—that the defendants’ copied code was “substantially similar” to its own and, further, that the defendants hadn’t misappropriated any trade secrets. The judge separately rejected Compulife’s false-advertising claims on the ground that Compulife had failed to identify any false or misleading advertisement. Finally, he ruled that the defendants hadn’t violated the Florida Computer Abuse and Data Recovery Act, because Compulife failed to show that the data that the defendants took was protected by any “technological access barrier” within the meaning of that statute.

Compulife contends that all of these determinations were in error, identifying what it contends are mistakes of both law and fact in the magistrate judge’s decision. Regarding copyright infringement and trade-secret misappropriation, we agree with Compulife. As to the false-advertising and Florida statutory claims, we agree with the magistrate judge’s conclusions.

15

Accordingly, we will vacate the judgment in part and remand for new findings and conclusions limited to the issues of copyright infringement and trade-secret misappropriation.

II

On appeal from a bench trial, “the district court’s conclusions of law are reviewed de novo,” but its “findings of fact . . . ‘shall not be set aside unless clearly erroneous.’” MiTek Holdings, Inc. v. Arce Eng’g Co., 89 F.3d 1548, 1554 (11th Cir. 1996) (citation omitted) (quoting Fed. R. Civ. P. 52(a)(6)). “[T]he standard of review for a mixed question [of law and fact] all depends—on whether answering it entails primarily legal or factual work.” U.S. Bank Nat. Ass’n ex rel. CWCapital Asset Mgmt. LLC v. Vill. at Lakeridge, LLC, 138 S. Ct. 960, 967 (2018). Separately, “[w]hen an appellate court discerns that a district court has failed to make a finding because of an erroneous view of the law, the usual rule is that there should be a remand for further proceedings to permit the trial court to make the missing findings.” Pullman-Standard v. Swint, 456 U.S. 273, 291 (1982).

We must also review findings of fact and conclusions of law to ensure that they satisfy Federal Rule of Civil Procedure 52(a)(1). That rule requires that a district court “find the facts specially and state its conclusions of law separately.” Fed. R. Civ. P. 52(a)(1). We will vacate and remand a judgment resulting from a bench trial where “the findings of the district court do not provide a sufficiently

16

definite predicate for proper appellate review.” Hydrospace-Challenger, Inc. v. Tracor/MAS, Inc., 520 F.2d 1030, 1034 (5th Cir. 1975).

* * *

With that précis, we will consider Compulife’s claims in turn: (1) copyright infringement; (2) trade-secret misappropriation; (3) false advertising; and (4) violation of Florida’s Computer Abuse and Data Recovery Act.

III

A

To succeed on its claim of copyright infringement, Compulife “must prove ‘(1) ownership of a valid copyright, and (2) copying of constituent elements of the work that are original.’” Bateman v. Mnemonics, Inc., 79 F.3d 1532, 1541 (11th Cir. 1996) (quoting Feist Publications, Inc. v. Rural Tel. Serv. Co., 499 U.S. 340, 361 (1991)). The existence and validity of Compulife’s copyright are undisputed, so we can proceed directly to the second prong—copying. Copying comprises two subparts, “factual and legal copying,” both of which Compulife, as the plaintiff, has the burden to prove. See BUC Int’l Corp. v. Int’l Yacht Council Ltd., 489 F.3d 1129, 1148 n.40 (11th Cir. 2007).

Factual copying—the question “whether the defendant actually used the plaintiff's material,” id.—may be shown “either by direct evidence, or, in the absence of direct evidence, it may be inferred from indirect evidence

17

demonstrating that the defendant had access to the copyrighted work and that there are probative similarities between the allegedly infringing work and the copyrighted work.” MiTek, 89 F.3d at 1554.4 Factual copying isn’t really disputed here, and we think it has been established, in any event, 5 so we focus here on legal copying.

“Legal”—or “actionable”—copying occurs when “those elements of the [copyrighted work] that have been copied are protected expression and of such importance to the copied work that the appropriation is actionable.” Peter Letterese & Assocs. v. World Inst. of Scientology Enters., 533 F.3d 1287, 1300 (11th Cir. 2008) (alteration in original) (quoting MiTek, 89 F.3d at 1554). In most cases, a “‘substantial similarity’ between the allegedly offending program and the protectable, original elements of the copyrighted works” establishes actionable copying. Bateman, 79 F.3d at 1542; see also BUC, 489 F.3d at 1149 n.42

4 A warning here: Although “probative similarity” may sound just like “substantial similarity”— which we’ll encounter momentarily—“[t]here is a vital distinction here between” them. 4 Nimmer on Copyright § 13.02[B] n.70.4 (2019). “[P]robative similarity is but one of several vehicles to prove copying as a factual matter,” whereas “substantial similarity” is part of the test for legal copying and “remains an indispensable element of plaintiff’s proof, even in cases . . . in which defendant does not contest factual copying.” Id. § 13.01[B]. 5 David Rutstein frankly admits that the defendants had access to Compulife’s copyrighted HTML. Further, his testimony strongly suggests copying in fact, because he admits that “a life insurance quote engine [was] put on to Beyond Quote” after “[c]ommunications between myself and Compulife Software.” The defendants make similar admissions in their brief to us. Finally, defendant Moses Newman agreed that he modified the HTML on naaip.org “so that it would no longer be the same” as Compulife’s copyright-protected HTML. All of which is to say that the defendants have conceded access, at the very least, and they don’t meaningfully dispute factual copying.

18

(“BellSouth established the ‘substantial similarity’ standard as the default mode of analysis for compilation copyright claims.”). 6 Substantial similarity “must be assessed with respect to both the quantitative and the qualitative significance of the amount copied to the copyrighted work as a whole.” Peter Letterese, 533 F.3d at 1307. Quantitively insubstantial copying may still be actionable if it is qualitatively substantial. See Harper & Row Publishers, Inc. v. Nation Enterprises, 471 U.S. 539, 565 (1985). For instance, because “a small portion of the structure or code of a [computer] program may nonetheless give it distinctive features or may make the program especially creative or desirable,” copying of that portion is actionable. 4 Nimmer on Copyright § 13.03[F][5] (2019).

Before comparing two works to determine if they display the required substantial similarity, a court must “eliminate from comparison the unprotectable

6 In special circumstances, we have required that two works be more than substantially similar before infringement can be found, but this is not such a case. In MiTek, we adopted a “virtual identicality” standard for “analyzing claims of compilation copyright infringement of nonliteral elements of a computer program.” 89 F.3d at 1558. The virtual-identicality standard originated in the Ninth Circuit. See Apple Computer, Inc. v. Microsoft Corp., 35 F.3d 1435, 1446 (9th Cir. 1994). Nonliteral elements of a computer program “are the products that are generated by the code’s interaction with the computer hardware and operating program(s),” of which “screen displays and the main menu” are illustrative examples. MiTek, 89 F.3d at 1555 n.15. “Source and object code,” on the other hand, are “literal elements.” Id. Copying of these elements, even nonliterally—i.e., without verbatim copying—therefore does not fall into the category analyzed for “virtual identicality” as identified in MiTek. “[A]pplication of ‘virtual identicality’ [is] limited to a specific factual context” that we have described as “narrow.” BUC, 489 F.3d at 1149 n.42. Because the copying alleged here concerns source code, the substantial-similarity standard, rather than the heightened virtual-identicality standard, applies.

19

elements of” the copyrighted work. Bateman, 79 F.3d at 1545. This process— known as “filtration”—is necessary because even substantial similarity between a copyrighted work’s unprotectable elements and a purportedly infringing work isn’t actionable, regardless of how many unprotectable elements are copied or how important they may be. Id. at 1544.

B

We conclude that the magistrate judge (sitting as the district court) made several errors in the course of concluding that Compulife had failed to prove actionable—or legal—copying. Unpacking those errors will take some doing, but in short they are as follows. First, the magistrate judge improperly placed the burden on Compulife to prove, as part of the filtration analysis, that the elements the defendants copied were protectable; we hold that he should have required the defendants to prove that those elements were not protectable. Second, the judge seems to have evaluated the substantiality of the defendants’ copying vis-à-vis their allegedly infringing work; we hold that he should have judged the substantiality of the copied material vis-à-vis Compulife’s copyrighted work. Finally, even if the magistrate judge hadn’t based his decision on these legal errors, he failed to state on the record sufficient findings of fact and conclusions of law to

20

permit meaningful appellate review. All of these missteps call for the same corrective: vacatur of the judgment with respect to copyright infringement.

1

First, the misplaced burden. To properly frame this error, a little background is in order. The magistrate judge misallocated the burden of proof applicable to the filtration step of the substantial-similarity analysis. Filtration, again, refers to the process of separating the protectable elements of a copyrighted work from elements that, for one reason or another, aren’t protected.7 The notion that unprotected material should be disregarded when comparing two works is at least a century old. See Int’l News Serv. v. Associated Press, 248 U.S. 215, 234 (1918). Conceiving of filtration as a distinct step in the infringement analysis, however, came into the law relatively recently, in the Second Circuit’s seminal decision in Computer Assocs. Int’l, Inc. v. Altai, Inc., 982 F.2d 693 (2d Cir. 1992). We have adopted a version of Altai’s test, see Bateman, 79 F.3d at 1543–46, which has three steps: (1) abstraction, (2) filtration, and (3) comparison. Altai, 982 F.2d at 706. In order to “ascertain[] substantial similarity under this approach, a court . . . first break[s] down the allegedly infringed program into its

7 Filtering “protectable expression from non-protectable expression is . . . a question of law or, at the very least, a mixed question of law and fact.” Home Design Servs., Inc. v. Turner Heritage Homes Inc., 825 F.3d 1314, 1325 (11th Cir. 2016) (alteration in original) (quoting Intervest Constr., Inc. v. Canterbury Estate Homes, Inc., 554 F.3d 914, 920 (11th Cir. 2008)).

21

constituent structural parts”—that’s abstraction. Bateman, 79 F.3d at 1544 (quoting Altai, 982 F.2d at 706). Next, the court “sift[s] out all non-protectable material”—filtration. Id. The “last step [is] to compare” any remaining “kernels[] of creative expression” with the “allegedly infringing program” to determine if there is in fact a substantial similarity—comparison. Id. Although we have observed that Altai, by its terms, dealt only with a narrow category of copying, see MiTek, 89 F.3d at 1555 n.16, “a parallel type of analysis”—including filtration, or its equivalent—applies more generally, see Bateman, 79 F.3d at 1545. Here, we focus on the filtration step because that’s where we conclude the magistrate judge went astray.

Filtration can be tricky because copied material may be unprotectable for a wide variety of reasons. First, for instance, copyright protection extends only to a work’s expressive elements, not to any underlying “idea, procedure, process, system, method of operation, concept, principle, or discovery” expressed therein. 17 U.S.C. § 102; see also Baker v. Selden, 101 U.S. 99, 102 (1879) (“[T]here is a clear distinction between the book, as such, and the art which it is intended to illustrate.”). Courts call this the “idea-expression” dichotomy, with the term “idea” standing in “as a metonym for all eight categories” of unprotectable material. 1 Nimmer on Copyright § 2A.06; see, e.g., Oravec v. Sunny Isles Luxury Ventures, L.C., 527 F.3d 1218, 1224 (11th Cir. 2008). Second, and separately, some

22

expression may be so intrinsic to the communication of an idea—or procedure, process, etc.—that it is considered to have “merged” into the idea. According to the merger doctrine, where there are sufficiently “few ways of expressing an idea, not even the expression is protected by copyright.” BUC, 489 F.3d at 1143. In one seminal example, the First Circuit determined that a written rule governing a sweepstakes—requiring, for instance, that “[e]ntrants should print name, address and social security number on a boxtop, or a plain paper”—wasn’t protectable because the ideas it expressed were “so straightforward and simple” that “at best only a limited number” of possible modes of expression could exist to convey them. Morrissey v. Procter & Gamble Co., 379 F.2d 675, 678–79 (1st Cir. 1967).

Third—and this is easier to understand—material taken from the public domain is unprotected, even if incorporated into a copyrighted work. See Stewart v. Abend, 495 U.S. 207, 234 (1990) (holding that an author “may receive protection only for his original additions,” not “elements . . . already in the public domain”). Fourth, material may be unprotected if it constitutes scènes à faire— that is “[i]ncidents, characters, or settings that are indispensable or standard in the treatment of a given topic.” Corwin v. Walt Disney Co., 475 F.3d 1239, 1251 (11th Cir. 2007) (alteration in original) (quoting Herzog v. Castle Rock Entm't, 193 F.3d 1241, 1248 (11th Cir. 1999)); see also Beal v. Paramount Pictures Corp., 20 F.3d 454, 459 (11th Cir. 1994) (describing scènes à faire as “stock scenes that naturally

23

flow from a common theme”). For example, we have noted that there is “no protection for common elements in police fiction, such as ‘drunks, prostitutes, vermin and derelict cars’ and ‘foot chases and the morale problems of policemen, not to mention the familiar figure of the Irish cop.’” Corwin, 475 F.3d at 1251 (quoting Walker v. Time Life Films, Inc., 784 F.2d 44, 50 (2d Cir. 1986)). Finally, certain ways of arranging information—say, alphabetically—are entirely unoriginal, and therefore unprotectable. See Feist, 499 U.S. at 363 (explaining that presenting data in alphabetical order is “so commonplace that it has come to be expected as a matter of course”).

How might these categories of unprotectability apply in a case like this one?

Well, for one, by analogy to merger and scènes à faire, elements of computer source-code expression “dictated by external factors” aren’t entitled to copyright protection. Bateman, 79 F.3d at 1547. Frequently, “compatibility requirements and industry demands . . . [can make it] ‘virtually impossible to write a program to perform particular functions in a specific computing environment without employing standard techniques.’” Id. at 1546–47 (quoting Altai, 982 F.2d at 709). The author of a copyrighted code can’t obtain protection for such standard modes of expression, lest he effectively monopolize an underlying “idea.”

In any event, many species of unprotectability may be at issue in a single case, and the filtration process must eliminate all of them so that only protectable

24

material is considered when deciding—at the comparison step—whether two works are substantially similar. Bateman, 79 F.3d at 1545 (“[F]iltration should eliminate from comparison the unprotectable elements of ideas, processes, facts, public domain information, merger material, scènes à faire material, and other unprotectable elements.” (alteration in original)).

With that background, we come to the magistrate judge’s first error. In his opinion, the magistrate judge implicitly placed on Compulife the burden of proving that the elements of its HTML code that the defendants copied were protectable. In particular, he faulted Compulife for having “made no attempt to identify the protectable elements of the 2010 HTML Source Code.” Compulife Software, 2018 U.S. Dist. LEXIS 41111, at *38. Although we haven’t previously done so, we now clarify that after an infringement plaintiff has demonstrated that he holds a valid copyright and that the defendant engaged in factual copying, the defendant bears the burden of proving—as part of the filtration analysis—that the elements he copied from a copyrighted work are unprotectable. That is so for two main reasons. First, assigning this burden to the defendant is consonant with our existing precedent, and it enjoys the support of the foremost copyright treatise. See Bateman, 79 F.3d at 1542 (“[T]he plaintiff must also respond to any proof advanced by the defendant that the portion of the copyrighted work actually taken does not satisfy the constitutional requirement of originality as set forth in Article

25

I, § 8, cl. 8.” (emphasis added)); 4 Nimmer on Copyright § 13.03[F][3] (“Although [a] plaintiff’s failure to present proof about [merger and scènes à faire] could defeat a plaintiff’s application for a preliminary injunction, it would seem that defendant must go forward at trial with appropriate evidence as to those doctrines.”).

Second, placing the burden to prove protectability on the infringement plaintiff would unfairly require him to prove a negative. Protectability can’t practicably be demonstrated affirmatively but, rather, consists of the absence of the various species of unprotectability. If the plaintiff had the burden of proving protectability, he would have to preemptively present evidence negating all possible theories of unprotectability just to survive a motion for summary judgment. Cf. Fitzpatrick v. City of Atlanta, 2 F.3d 1112, 1116 (11th Cir. 1993) (noting that a summary-judgment movant “simply may . . . point[ ] out . . . that there is an absence of evidence to support the non-moving party’s case” where the non-moving party bears the burden of proof). And, of course, some types of unprotectability can be negated only by presenting practically infinite evidence. A plaintiff, for instance, can’t be expected to present the entirety of the public domain as it existed when he authored his copyrighted material in order to show that no elements of his work were taken from it. Nor could a plaintiff reasonably introduce the entire corpus of relevant, industry-standard techniques just to prove

26

that none of the material copied from his work constituted scènes à faire. Placing the burden of proving protectability on the plaintiff would seemingly require just these kinds of impossibilities.

Placing the burden on the defendant, by contrast, merely requires him to identify the species of unprotectability that he is alleging and to present supporting evidence where appropriate. If, for instance, the defendant believes that some part of the copyrighted work is in the public domain, he must narrow the inquiry by indicating where in the public domain that portion of the work can be found. Similarly, if he thinks that what he copied amounts to usual industry practice, he must indicate the standards that dictate that technique. The plaintiff then faces the manageable task of “respond[ing],” Bateman, 79 F.3d at 1542, to the appropriately narrowed issue. Placing the burden on the defendant, therefore, isn’t just consistent with our own precedent and leading scholarly commentary, but also fairer and more efficient.

In light of these considerations, copyright-infringement analysis should proceed as follows: Once the plaintiff has proven that he has a valid copyright and that the defendant engaged in factual copying, the defendant may seek to prove that some or all of the copied material is unprotectable. If the defendant carries this burden as to any portion of the copied material, that material should be filtered out of the analysis before comparing the two works. After filtration is complete,

27

the burden shifts back to the plaintiff to prove substantial similarity between any remaining (i.e., unfiltered) protectable material and the allegedly infringing work. If the defendant demonstrates—at the filtration stage—that it copied only unprotectable material, such that no substantial similarities remain after filtration, the defendant is entitled to summary judgment. See Home Design Servs., Inc. v. Turner Heritage Homes Inc., 825 F.3d 1314, 1322 (11th Cir. 2016). But because the defendant bears the burden to demonstrate unprotectability, the mere failure of the plaintiff to present evidence of protectability—assuming that a valid copyright and factual copying have already been established—isn’t a sufficient reason to give judgment to the defendant. Rather, where the defendant’s evidence is insufficient to prove that a particular element is unprotectable, the court should simply assume that the element is protectable and include that element in the final substantial- similarity comparison between the works.8

8 That is not to say that the defendant must always introduce evidence in order to enable the district court to filter. The defendant may sometimes be able to demonstrate by argument alone that an element of a copyrighted work is unprotected. For example, no evidence would be necessary to convince a court that alphabetization is an entirely unoriginal method of arranging data and thus unprotectable as a structural element of a work. See Feist, 499 U.S. at 363. But where evidence is required to determine whether some element is protectable, it is the defendant who must advance it or risk abandoning the issue.

One other thing: A plaintiff may concede that some element of code is unprotectable, in which case a district court will not err in filtering that element. When, for instance, the plaintiff provides a list of features it believes to be protectable, he implicitly concedes that elements not included on the list are unprotectable. See MiTek, 89 F.3d at 1555 (“After submitting a specification of the elements that it deemed to be protectable, [a plaintiff] cannot now argue that the district court failed to abstract further the elements of its own designation of protectable features.”).

28

Accordingly, the magistrate judge here erred by placing on Compulife the burden of proving protectability. For the reasons we have explained, Compulife didn’t have to affirmatively prove that the copied portions of its code were protectable. Rather, the defendants had the burden to demonstrate that the copied elements were unprotectable. If the magistrate judge believed that the record contained insufficient evidence to make a conclusive finding about the protectability of any element, he should have proceeded to the comparison step— i.e., proceeded to determine substantial similarity—without filtering anything out. Instead, the judge found for the defendants—seemingly without undertaking any comparison of the parties’ codes—in effect treating the entirety of Compulife’s code as unprotectable. That was an error.

To be sure, some filtration is warranted here. Some elements of Compulife’s code are unprotectable—and indeed, are so obviously so that no proof is necessary. For example, in order to calculate insurance quotes, Compulife’s code has to collect each consumer’s state of residence, and in organizing that information Compulife has chosen to alphabetize the 50 states and assign each state a number. Although the decision to order the states in this way may have originated with Compulife, mere alphabetization is unoriginal and unprotectable. See Feist, 499 U.S. at 363. As a result, although the defendants copied the

29

alphabetization, that particular structural element should be filtered out and excluded when analyzing the similarities between the works. 9 But the magistrate judge never even reached the filtration issue. Instead, having placed the burden on Compulife to prove that the copied elements of its code were protectable—and found its evidence lacking—he gave judgment for the defendants without ever undertaking a filtration analysis. In so doing, he failed to make required factual findings and legal conclusions “because of an erroneous view of the law.” Swint, 456 U.S. at 291. Accordingly, we must vacate and “remand for further proceedings” to give the district court a chance to make the missing findings. Id. We won’t attempt a comprehensive filtration analysis from scratch—“[w]e are, after all, a court of review, not a court of first view.” Callahan v. United States Dep't of Health & Human Servs. through Alex Azar II, 939 F.3d 1251, 1266 (11th Cir. 2019). 10

9 A closer question, however, is whether Compulife’s inclusion of the District of Columbia in the list of states and the bifurcation of New York into business and non-business categories are protectable elements of structure. We don’t reach the question, but rather leave all specific filtering questions for the district court to consider in the first instance on remand. 10 It is enough to remand for new findings and conclusions rather than an entirely new trial. See, e.g., Ionmar Compania Naviera, S. A. v. Olin Corp., 666 F.2d 897, 905 (Former 5th Cir. 1982) (Tjoflat, J.); Golf City, Inc. v. Wilson Sporting Goods, Co., 555 F.2d 426, 438 & n.20 (5th Cir. 1977). Like the rest of this case, though, the procedural history here is complicated. The magistrate judge retired just days after issuing his decision and wasn’t available even to consider Compulife’s motion for a new trial. In his absence, the district court encouraged Compulife to withdraw the motion and file this appeal, noting that it would take considerable time for a new magistrate to get sufficiently up to speed on the technical facts of this case to rule on its motion for a new trial, a suggestion that Compulife seems to have followed. Federal Rule of Civil Procedure 63 allows one judge to substitute for another in conducting a hearing or trial “upon

Explaining the magistrate judge’s second legal error is more straightforward.

(A low bar.) As we will explain, he implicitly evaluated the significance of the defendants’ copying vis-à-vis their offending work, rather than Compulife’s copyrighted work. In so doing, the magistrate judge called his ultimate conclusion into doubt. The law is clear that both the quantity of the appropriation and the qualitative importance of the appropriated portion are properly judged by their significance to the copyrighted work, not their significance to the allegedly infringing work. As the Supreme Court has said—and as we have reaffirmed—“a taking may not be excused merely because it is insubstantial with respect to the infringing work.” Harper & Row, 471 U.S. at 565 (emphasis in original); see also Peter Letterese, 533 F.3d at 1307 (explaining that “it is the relative portion of the copyrighted work—not the relative portion of the infringing work—that is the relevant comparison”).

The magistrate judge evinced this error in stating that Compulife “provided no basis on which to evaluate what quantity of the HTML code from the

certifying familiarity with the record and determining that the case may be completed without prejudice to the parties,” but “[i]n a hearing or a nonjury trial, the successor judge must, at a party’s request, recall any witness whose testimony is material and disputed and who is available to testify again without undue burden.” Because the issues are technical and complicated, new findings will be necessary here, and the parties will likely be entitled to recall many witnesses should they wish, the substitute judge may be “satisfied that he cannot perform the duties we have given him.” Golf City, 555 F.2d at 438 n.20 (5th Cir. 1977). If so, the judge “may in his discretion grant a new trial.” Id.

31

www.naaip.org agent’s website, which spans twenty-five pages, is copied from [Compulife’s] 2010 HTML code, which spans just over nine pages.” Compulife Software, 2018 U.S. Dist. LEXIS 41111, at *39–40. In addition to being wrong as a matter of fact—the full texts of both codes are in the record, and a side-by-side comparison reveals the extent of the defendants’ copying—this statement implies a mistaken view of law. A 25-page work could, of course, reproduce the entirety of a 9-page work verbatim, even though it also necessarily includes some material not taken from the shorter work. Seemingly, then, by pointing to the disparity in lengths here, the magistrate judge meant to suggest that the defendants’ inclusion of additional material could undercut or even preclude a finding of infringement. But, under controlling law, adding new material to copied material doesn’t negate (or even ameliorate) the copying. See Harper & Row, 471 U.S. at 565. That the accused work is significantly longer than the copyrighted work is irrelevant because the substantiality of copying is evaluated only with respect to the copyrighted work. See Peter Letterese, 533 F.3d at 1307. The magistrate judge’s ultimate determination that the works are not substantially similar therefore implicitly rests on another misunderstanding of law. Remand is necessary to allow fresh findings, untainted by this error.

Finally—with respect to copyright infringement, anyway—even if the magistrate judge hadn’t based his determination on the foregoing legal errors, his analysis was insufficient to permit meaningful appellate review. Rule 52 requires a district court conducting a bench trial to “find the facts specially and state its conclusions of law separately” and to include these findings and conclusions on the record. Fed. R. Civ. P. 52(a)(1). A court’s failure to “to state [findings of fact] with sufficient detail to indicate the factual basis for [the] ultimate conclusions of law” requires us to vacate the judgment and remand for a new bench trial because it renders appellate review “practically impossible.” Ionmar Compania Naviera, S. A. v. Olin Corp., 666 F.2d 897, 903 (Former 5th Cir. 1982) (Tjoflat, J.). 11 Vacatur and remand are also warranted where the district court fails to reach a sufficiently important conclusion of law necessary to support its judgment. Gechter v. Davidson, 116 F.3d 1454, 1458 (Fed. Cir. 1997) (“The same rule governs when a conclusion on a crucial issue of law is omitted.”). Rule 52 violations require us to vacate and remand for new findings and conclusions because “[w]e are . . . a court of review, not a court of first view.” Callahan, 939 F.3d at 1266.

11 Ionmar was decided by a non-unit panel of the Former Fifth Circuit and is therefore binding on us. See Ionmar, 666 F.2d at 897 n.*; Stein v. Reynolds Sec., Inc., 667 F.2d 33, 34 (11th Cir. 1982) (explaining that a decision “made by a non-unit panel of the Former Fifth, the full en banc court of the Former Fifth, or Unit B panel of the Former Fifth Circuit” is “binding precedent which we would have to follow absent Eleventh Circuit en banc consideration”).

33

To allow meaningful appellate review, a district court must indicate which elements of the copyrighted work it considers to be unprotectable in more detail than was given here. The magistrate judge didn’t filter—or even specifically identify—any protectable or unprotectable elements of Compulife’s copyrighted code. 12 Nor did he evaluate the importance of any copied elements of that code as part of a substantial-similarity analysis. Nor, finally, did he even identify, at the threshold, which elements of Compulife’s code the defendants had copied as a factual matter. Instead of making these necessary determinations, the magistrate judge merely stated that Compulife “failed to prove that ‘th[e] elements of the program that have been copied are protected expression,’” Compulife Software, 2018 U.S. Dist. LEXIS 41111, at *38 (quoting MiTek, 89 F.3d at 1554), that Compulife had “failed to provide any basis on which to conclude that the copied portions of the 2010 HTML Source Code . . . are important,” id. (quotation and quotation marks omitted), and that Compulife “provided no basis on which to evaluate what quantity of the HTML code from the www.naaip.org agent’s website . . . is copied from [its] 2010 HTML code,” id. at *39–40. We can’t

12 As already noted, which elements should be filtered is a question of law, or at least a mixed question of law and fact, to be determined by a judge before a factfinder decides whether copying was substantial. See supra note 7. We would likely review the filtration determination de novo—based on our case law and because it requires primarily legal work—but we needn’t definitively settle on a standard of review here. Even if this determination is reviewed for clear error, the magistrate judge’s failure to make a specific determination frustrates our ability to meaningfully review the ultimate determination of actionable copying.

34

effectively review the magistrate judge’s ultimate conclusion—that Compulife failed to prove its case—without answers to the important prerequisite questions that he left unaddressed. And we decline to answer such questions as a matter of “first view.” Callahan, 939 F.3d at 1266. Accordingly, vacatur and remand are appropriate.

It bears noting that the magistrate judge’s reasoning would have been sufficient if it really were true that, in seeking to demonstrate substantial similarity, Compulife had provided “no basis” to evaluate either the quantity or the quality of the defendants’ copying. Although “[t]he burden is on the copyright owner to demonstrate the significance of the copied features,” MiTek, 89 F.3d at 1560, and “both the quantitative and the qualitative significance of the amount copied” must be assessed, Peter Letterese, 533 F.3d at 1307, the plaintiff needn’t prove both the quantitative and qualitative substantiality of copying—it’s enough to prove one or the other. See id. (noting that qualitatively important copying may be actionable even where “the amount of expression copied [is] quantitatively small with respect to the length” of the copyrighted work). If Compulife had failed in both respects, that failure would have been fatal. In fact, though, Compulife provided at least some evidence of both quantitative and qualitative significance.

To start, Compulife provided the texts of both works, and the court could easily have analyzed the similarities between them to ascertain the quantitative

35

extent of copying. So too, the qualitative significance could have been evaluated solely on the basis of the two texts. Although the copyright owner has the burden to prove qualitative significance, MiTek, 89 F.3d at 1560, nothing requires him to introduce extrinsic evidence of that significance. Qualitative significance is often apparent on the face of the copied portion of a copyrighted work. See Peter Letterese, 533 F.3d at 1315 (inferring the qualitative significance of “the way [concepts] were ‘selected, coordinated, or arranged’” from statements within the work itself). Moreover, and in any event, Compulife actually did provide extrinsic evidence of the qualitative significance of some copied elements. Chris Bruner testified that part of the code copied by the defendants includes variable names and parameters that must be formatted exactly for the web quoter to communicate with the Transformative Database at all. At a minimum, this testimony is some evidence of the qualitative significance of the copied portion of Compulife’s work. A district court is free not to credit such testimony, but it can’t ignore it.

The magistrate judge’s failure to look more closely at the texts of the two codes is particularly concerning given the similarities apparent on their faces. Even a cursory comparison of the two segments suggests that the defendants’ work copied material from nearly every page of the copyrighted work. The defendants’ code includes nine of the eleven basic sections of Compulife’s code, arranged in almost exactly the same order. The defendants’ code even reproduces

36

idiosyncratic elements of Compulife’s work, like treating New York as two separate jurisdictions—one for business and another for non-business—an element of the code that was obsolete by the time the defendants copied it. Perhaps the magistrate judge had good reasons to discount these and other similarities, but his failure to explain himself prevents any meaningful review.

Accordingly, the magistrate judge’s conclusions that Compulife failed to present necessary evidence were unwarranted. At the least, the judge should have engaged with the evidence presented by Compulife and explained why he found it unconvincing. He then should have explained what elements of Compulife’s work he had filtered out and why the defendants’ code was not substantially similar to whatever material survived filtration. The omission of these details from the magistrate judge’s findings of fact and conclusions of law precludes meaningful review and requires vacatur and remand.

IV

And now for something completely different—trade-secret law. To prove a claim under the Florida Uniform Trade Secrets Act (FUTSA), Compulife “must demonstrate that (1) it possessed a trade secret and (2) the secret was misappropriated.” Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d

37

1279, 1297 (11th Cir. 2018) (quotation and quotation marks omitted).13 Florida law defines a trade secret as

information . . . that: (a) [d]erives independent economic value . . .

from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use; and (b) [i]s the subject of efforts that are reasonable under the circumstances to maintain its secrecy.

Fla. Stat. § 688.002(4). “[W]hether something is a trade secret is a question typically ‘resolved by a fact finder after full presentation of evidence from each side.’” Yellowfin Yachts, 898 F.3d at 1298–99 (quoting Lear Siegler, Inc. v. Ark- Ell Springs, Inc., 569 F.2d 286, 288–89 (5th Cir. 1978)). The magistrate judge found that Compulife’s Transformative Database was a trade secret, a finding that is not clearly erroneous and that, in any event, doesn’t seem to be contested on appeal. We can therefore move straight to the question of misappropriation.

13 Compulife also alleges a violation of the Defend Trade Secrets Act (DTSA). DTSA creates a federal cause of action that largely mirrors FUTSA. See 18 U.S.C. § 1836(b)(1) (“An owner of a trade secret that is misappropriated may bring a civil action.”). Indeed, DTSA’s definitions of “misappropriation” and “improper means” are largely identical to those discussed in text, with one important difference. See 18 U.S.C. § 1839(5), (6). In DTSA, “reverse engineering, independent derivation, or any other lawful means of acquisition” are expressly exempted from the definition of “improper means.” 18 U.S.C. § 1839(6)(b). The definition of “trade secret,” while not identical to FUTSA’s definition, is substantially equivalent. 18 U.S.C. § 1839(3). We assume, as the parties seem to, that the substantive standard for misappropriation is identical under FUTSA and DTSA, at least as they apply here. Accordingly, we won’t undertake a separate analysis of Compulife’s DTSA claim.

38

One party can misappropriate another’s trade secret by either acquisition, disclosure, or use. See Fla. Stat. § 688.002(2). Compulife alleges misappropriation both by acquisition and by use—but not by improper disclosure. A person misappropriates a trade secret by acquisition when he acquires it and “knows or has reason to know that the trade secret was acquired by improper means.” Id.§ 688.002(2)(a). A person misappropriates a secret by use if he uses it “without express or implied consent” and either:

1. Used improper means to acquire knowledge of the trade secret; or

2. At the time of disclosure or use, knew or had reason to know that her or his knowledge of the trade secret was:

a. Derived from or through a person who had utilized improper means to acquire it;

b. Acquired under circumstances giving rise to a duty to maintain its secrecy or limit its use; or

c. Derived from or through a person who owed a duty to the person seeking relief to maintain its secrecy or limit its use; or

3. Before a material change of her or his position, knew or had reason to know that it was a trade secret and that knowledge of it had been acquired by accident or mistake.

Id. § 688.002(2)(b).

The concept of “improper means”—which under FUTSA may apply in both the acquisition and use contexts—is significant here, so we should pause to unpack it. As used in FUTSA, “[i]mproper means” is defined to include “theft, bribery,

39

misrepresentation, breach or inducement of a breach of a duty to maintain secrecy, or espionage through electronic or other means.” Id. § 688.002(1). In the law of trade secrets more generally, “theft, wiretapping, or even aerial reconnaissance” can constitute improper means, but “independent invention, accidental disclosure, or . . . reverse engineering” cannot. Kewanee Oil Co. v. Bicron Corp., 416 U.S. 470, 476 (1974).14 Actions may be “improper” for trade-secret purposes even if not independently unlawful. See E. I. duPont deNemours & Co. v. Christopher, 431 F.2d 1012, 1014 (5th Cir. 1970) (rejecting the argument “that for an appropriation of trade secrets to be wrongful there must be a trespass, other illegal conduct, or breach of a confidential relationship”). Moreover, the inadequacy of measures taken by the trade-secret owner to protect the secret cannot alone render a means of acquisition proper. So long as the precautions taken were reasonable, it doesn’t matter that the defendant found a way to circumvent them. Indeed, even if the trade-secret owner took no measures to protect its secret from a certain type of reconnaissance, that method may still constitute improper means.

In one case from the former Fifth Circuit, for example, DuPont claimed that trade secrets had been misappropriated by photographers who took pictures of its methanol plant from a plane. See Christopher, 431 F.2d at 1013. These aerial

14 The defendants here don’t argue that they reverse-engineered any trade secret, so we needn’t address the reverse-engineering question.

40

photographs, DuPont contended, threatened to reveal its secret method of manufacturing methanol. See id. at 1013–14. The photographers sought summary judgment, emphasizing that “they conducted all of their activities in public airspace, violated no government aviation standard, did not breach any confidential relation, and did not engage in any fraudulent or illegal conduct.” Id. at 1014. The Fifth Circuit rejected their contention and held that the aerial photography constituted improper means even though DuPont had left the its facility open to inspection from the air. See id. at 1015. Under the broad definition adopted in Christopher, misappropriation occurs whenever a defendant acquires the secret from its owner “without his permission at a time when he is taking reasonable precautions to maintain its secrecy.” Id.

* * *

Although the magistrate judge found Compulife’s Transformative Database to be a trade secret, he determined that the defendants hadn’t misappropriated it. The magistrate judge’s analysis, however, contains two flaws. First, in both in the 08 case and in the 42 case, he failed to consider the several alternative varieties of misappropriation contemplated by FUTSA. Second, in the 42 case, he erred in reasoning that the public availability of quotes on Compulife’s Term4Sale site automatically precluded a finding that scraping those quotes constituted misappropriation.

41

A

The magistrate judge rejected the misappropriation-by-use claims in the 08 case because he found that Compulife had “failed to prove the existence of the duty critical to its claims of trade secret misappropriation through use.” Compulife Software, 2018 U.S. Dist. LEXIS 41111, at *50. The judge erred in considering only varieties of misappropriation by use that require a violation of some legal “duty” external to the statute.15 To be sure, some types of use-misappropriation do require proof of an external duty under the Florida statute, see Fla. Stat. § 688.002(2)(b)2.b., c. Just as surely, though, the same statute describes other kinds of use-misappropriation that do not depend on the existence of an external duty. When, for instance, a defendant knows that his knowledge of a trade secret was acquired using “improper means,” or that he has acquired knowledge of a trade secret “by accident or mistake” and still uses it, such use is actionable misappropriation. Fla. Stat. § 688.002(2)(b)1., 2.a., 3. Moreover, while not defined in the statute, the bar for what counts as “use” of a trade secret is generally low. See Penalty Kick Mgmt. v. Coca Cola Co., 318 F.3d 1284, 1292 (11th Cir. 2003) (“[A]ny exploitation of the trade secret that is likely to result in injury to the

15 Compulife doesn’t concede that it failed to prove a preexisting duty, which it locates in its licensing agreements. We needn’t address the contractual-duty issue because we vacate the judgment on other grounds.

42

trade secret owner or enrichment to the defendant is a ‘use.’” (quoting Restatement (Third) of Unfair Competition § 40 cmt. c (1995))). Even assuming that the defendants had no external “duty” not to use Compulife’s trade secret, they nonetheless may have used the secret in violation of the statute.

The magistrate judge never considered these possibilities, although they are plainly contemplated in the Florida statute. And there was clearly enough evidence of these other, non-duty-based varieties of use-misappropriation that the magistrate judge should have discussed them before dismissing them. In the 08 case, the defendants plausibly engaged in “misrepresentation”—and thus “improper means” within meaning of the statute—given the way that David Rutstein explained the defendants’ affiliation with McSweeney and Savage to Compulife’s Jeremiah Kuhn when Rutstein initially sought access to the Transformative Database. Fla. Stat. § 688.002(1), (2)(b)1. Alternatively, even if the email exchange between Rutstein and Kuhn didn’t amount to “improper means,” it could have been understood as an “accident or mistake” of which the defendants knew or had reason to know and by which they gained knowledge of the Transformative Database. Id. § (2)(b)3. In either case, the defendants’ use would amount to misappropriation—without respect to the presence (or absence) of any external duty. The magistrate judge’s failure to consider either possibility requires vacatur and remand. See Swint, 456 U.S. at 291 (explaining that failure “to make a finding

43

because of an erroneous view of the law” generally requires remand “to permit the trial court to make the missing findings”).

The magistrate judge should also have considered misappropriation by use in the 42 case. The judge seems to have considered only misappropriation by acquisition as to that case—more on that momentarily—but there was no justification for truncating the analysis in this way. If the scraping attack constituted “improper means”—a question that the magistrate judge also failed to address—it would be difficult to escape the conclusion that the defendants either (1) used a trade secret of which they had improperly acquired knowledge or (2) used a trade secret of which they had acquired knowledge from a person whom they knew or had reason to know had improperly acquired the knowledge. See Fla. Stat. § 688.002(2)(b)1., 2.a. The defendants admitted both to hiring the hacker and to observing her take actions consistent with a scraping attack. It’s hard to see how the defendants didn’t at least “have reason to know” that Natal had acquired knowledge of a trade secret for them by improper means—if, indeed, the scraping attack amounted to improper means. The magistrate judge’s failure to consider this possibility must also be rectified on remand.

B

In addition to improperly ignoring the possibility of misappropriation by use in the 42 case, the magistrate judge erred in his treatment of misappropriation by

44

acquisition. He reasoned—improperly, we conclude—that the Transformative Database couldn’t have been misappropriated by acquisition in the 42 case because the individual quotes that Natal scraped were freely available to the public. True, the quotes’ public availability is important to the first prong of trade-secret misappropriation—the initial determination whether a protectable secret exists. Public availability creates a vulnerability, which—if unreasonable—could be inconsistent with the reasonable precautions requisite to trade-secret protection. See Fla. Stat.§ 688.002(4)(b). But here the magistrate judge found that the Transformative Database was a trade secret; he gave judgment for the defendants because he believed that the public availability of the quotes precluded a finding of misappropriation. The magistrate judge reasoned that all “claims in the 42 case, alleging misappropriation of these quotes, necessarily fail” simply because the individual quotes were available to the public and thus did “not constitute trade secrets.” Compulife Software, 2018 U.S. Dist. LEXIS 41111, at *45.

That is incorrect. Even granting that individual quotes themselves are not entitled to protection as trade secrets, the magistrate judge failed to consider the important possibility that so much of the Transformative Database was taken—in a bit-by-bit fashion—that a protected portion of the trade secret was acquired. The magistrate judge was correct to conclude that the scraped quotes were not individually protectable trade secrets because each is readily available to the

45

public—but that doesn’t in and of itself resolve the question whether, in effect, the database as a whole was misappropriated. Even if quotes aren’t trade secrets, taking enough of them must amount to misappropriation of the underlying secret at some point. Otherwise, there would be no substance to trade-secret protections for “compilations,” which the law clearly provides. See Fla. Stat. § 688.002(4) (“‘Trade secret’ means information, including a . . . compilation.”); Unistar Corp. v. Child, 415 So. 2d 733, 734 (Fla. Dist. Ct. App. 1982) (holding that a “distillation of” publicly available information was a protectable trade secret). And total, stem- to-stern appropriation is unnecessary to establish liability; appropriation of a “substantial portion” is sufficient. Cf. Penalty Kick Mgmt., 318 F.3d at 1292–1293 (“The unauthorized use need not extend to every aspect or feature of the trade secret; use of any substantial portion of the secret is sufficient to subject the actor to liability.” (quoting Restatement (Third) of Unfair Competition § 40 cmt. c (1995))).

Nor does the fact that the defendants took the quotes from a publicly accessible site automatically mean that the taking was authorized or otherwise proper. Although Compulife has plainly given the world implicit permission to access as many quotes as is humanly possible, a robot can collect more quotes than any human practicably could. So, while manually accessing quotes from Compulife’s database is unlikely ever to constitute improper means, using a bot to

46

collect an otherwise infeasible amount of data may well be—in the same way that using aerial photography may be improper when a secret is exposed to view from above. See Christopher, 431 F.2d at 1013. In the most closely analogous case of which we are aware, a district court held that hacking a public-facing website with a bot amounted “improper means.” Physicians Interactive v. Lathian Sys., Inc., No. CA 03-1193-A, 2003 WL 23018270, at *8 (E.D. Va. Dec. 5, 2003) (“There can be no doubt that the use of a computer software robot to hack into a computer system and to take or copy proprietary information is an improper means to obtain a trade secret, and thus is misappropriation under the VUTSA.”). 16 In that case, the trade-secret owner’s “failure to place a usage restriction on its website” did not automatically render the hacking proper. Id. at *7. So too, here.

Consider how broadly the magistrate judge’s reasoning would sweep. Even if Compulife had implemented a technological limit on how many quotes one person could obtain, and even if the defendants had taken all the data, rather than a subset of it, each quote would still be available to the public and therefore not entitled to protection individually. On the magistrate judge’s logic, Compulife

16 VUTSA—the Virginia Uniform Trade Secrets Act—is sufficiently similar to FUTSA that Physicians Interactive provides a persuasive indication that similar hacking would constitute improper means under FUTSA, as well. Compare Va. Code § 59.1-336 (“‘Improper means’ includes theft, bribery, misrepresentation, use of a computer or computer network without authority, breach of a duty or inducement of a breach of a duty to maintain secrecy, or espionage through electronic or other means.”) with Fla. Stat. § 688.002(1) (“‘Improper means’ includes theft, bribery, misrepresentation, breach or inducement of a breach of a duty to maintain secrecy, or espionage through electronic or other means.”).

47

couldn’t recover even in that circumstance, because even there—in the magistrate judge’s words—“any member of the public [could] visit the website of a Compulife customer to obtain a quote” with “no restriction” on the subsequent use of the quote. Compulife Software, 2018 U.S. Dist. LEXIS 41111, at *45. But under the plain terms of the governing statute, the defendants would be liable in this scenario; they would have acquired a compilation of information that “[d]erives independent economic value . . . from . . . not being readily ascertainable” and “[i]s the subject of efforts that are reasonable under the circumstances to maintain its secrecy” by means which plainly amount to “espionage through electronic . . . means.” Fla. Stat.§ 688.002(1), (4).

The magistrate judge treated the wrong question as decisive—namely, whether the quotes taken were individually protectable. He left undecided the truly determinative questions: (1) whether the block of data that the defendants took was large enough to constitute appropriation of the Transformative Database itself, and (2) whether the means they employed were improper. Having found that the Transformative Database was protectable generally, the magistrate judge was not free simply to observe that the portions taken were not individually protectable trade secrets.

We express no opinion as to whether enough of the Transformative Database was taken to amount to an acquisition of the trade secret, nor do we opine as to

48

whether the means were improper such that the acquisition or use of the quotes could amount to misappropriation. We merely clarify that the simple fact that the quotes taken were publicly available does not automatically resolve the question in the defendants’ favor. These issues must be addressed on remand. 17

V

That concludes the hard part. We turn now to the more straightforward issues, both of which the magistrate judge got exactly right: false advertising and Florida’s anti-hacking statute.

A

To recover for false advertising under the federal Lanham Act, 15 U.S.C.

§ 1051 et seq., Compulife had the burden to prove five elements:

(1) the ads of the opposing party were false or misleading, (2) the ads deceived, or had the capacity to deceive, consumers, (3) the deception had a material effect on purchasing decisions, (4) the misrepresented

17 The magistrate judge rejected the acquisition-based claims in the 08 case because it found that the nature of the defendants’ access to the Transformative Database couldn’t amount to acquisition. This question should also be reconsidered on remand, however, because the magistrate judge’s misunderstanding of the location of the Transformative Database was clear error and may have played a dispositive role in that determination. The magistrate judge found that “[e]nd users can access the Transformative Database only through . . . www.term4sale.com.” Compulife Software, 2018 U.S. Dist. LEXIS 41111, at *6–7. But in so doing, the judge cited to trial testimony in which Chris Bruner said the opposite. Bruner explained that the internet “engine is set up to use data files locally to itself” and users therefore can’t normally access “files on Compulife’s server.” The “internet engine software” accesses “data” put into Compulife’s “database” when it uses “data files locally to itself.” This indicates the basic fact that the magistrate judge misunderstood: Compulife provides an encrypted copy of its Transformative Database to each licensed user as part of its software. Robert Barney even testified squarely that “[t]he PC version delivers the database.” Indeed, the defendants don’t appear to contest that point; they acknowledge in their brief that MSCC’s Vam DB sever contained the Transformative Database.

49

product or service affects interstate commerce, and (5) the movant has been—or is likely to be—injured as a result of the false advertising.

Johnson & Johnson Vision Care, Inc. v. 1-800 Contacts, Inc., 299 F.3d 1242, 1247 (11th Cir. 2002). 18 Compulife bore the burden of proving that the defendants had actually advertised falsely or misleadingly, and the magistrate judge did not clearly err in determining that Compulife failed to prove the existence of any false or misleading advertisement. See Osmose, Inc. v. Viance, LLC, 612 F.3d 1298, 1309 (11th Cir. 2010) (“Literal falsity is a finding of fact reviewed for clear error.”). As the magistrate judge observed, Compulife didn’t clearly identify at trial any particular statement alleged to constitute false advertising. In its proposed findings of fact and conclusions of law, Compulife asserted that “[e]nticing . . . users” with “quotes for term life insurance where the source of those quotes is infringing software and

18 Compulife also asserts false advertising in violation of the Florida Deceptive and Unfair Trade Practices Act (FDUTPA) and Florida common law, but these aren’t truly distinct allegations. Compulife admits that “[t]he legal standards for Florida statutory and common law claims of trademark infringement and unfair competition under . . . [FDUTPA] are the same as those for federal claims of trademark infringement and unfair competition.” Br. of Appellant at 69 (quoting Rain Bird Corp. v. Taylor, 665 F. Supp. 2d 1258, 1267 (N.D. Fla. 2009)). Accordingly, Compulife has waived any claim under FDUTPA or Florida common law that doesn’t rise or fall with its Lanham Act claims, and we won’t analyze either separately. See also Crystal Entm’t & Filmworks, Inc. v. Jurado, 643 F.3d 1313, 1323 (11th Cir. 2011) (“[T]he legal standards we apply to [the FDUPTA] claim are the same as those we have applied under section 43(a) of the Lanham Act.”); Sovereign Military Hospitaller Order of Saint John of Jerusalem of Rhodes & of Malta v. Fla. Priory of Knights Hospitallers of Sovereign Order of Saint John of Jerusalem, Knights of Malta, Ecumenical Order, 702 F.3d 1279, 1296 (11th Cir. 2012) (“The success of . . . state unfair competition and FDUTPA claims is tied to the federal Lanham Act claims for infringement and false advertising.”).

50

stolen trade secrets is . . . unquestionably unfair competition and false advertising.” The bare fact that the defendants hosted a quote engine on their website without providing notification that Compulife was the ultimate source of the quotes, though, doesn’t imply the existence of any advertisement, let alone a false one. And just because the defendants stipulated that the quote engine was a “key benefit” doesn’t mean, as Compulife seems to imply, that the defendants made any particular advertisement regarding that engine, and, again, it certainly doesn’t imply any misleading advertisement. Although before us Compulife singles out an advertisement on NAAIP’s website, it didn’t present that ad to the magistrate judge. Accordingly, it has waived any argument predicated on that ad. See CSX Transportation, Inc. v. Gen. Mills, Inc., 846 F.3d 1333, 1336–37 (11th Cir. 2017) (“[I]f a party hopes to preserve a[n] . . . argument, . . . [it] must first clearly present it to the district court . . . in such a way as to afford the district court an opportunity to recognize and rule on it.” (alterations in original)).

Even if the issue had been properly preserved, we wouldn’t find clear error here. The language from NAAIP’s website on which Compulife now focuses likely doesn’t qualify as false advertising under the statute because it has no capacity to deceive and wasn’t material to any purchasing decision. See 1-800 Contacts, Inc., 299 F.3d at 1247. Compulife claims that the defendants advertised their quote engine as a “key benefit” on their website, but the contents of this

51

advertisement aren’t so clear in the record. The defendants stipulated before the magistrate judge that the quote engine was a key benefit of their site, not that they had advertised it as such. And while David Rutstein testified that NAAIP “advertises that it has a quote engine” on its home page, he refused to say that it was advertised as “a great quote engine” or that it was “an important selling point.” If credited, Rutstein’s testimony would indicate that the web advertisement lacked materiality and the “capacity to deceive” consumers. 1-800 Contacts, Inc., 299 F.3d at 1247 Compulife insists that the ad was deceiving because it held out Compulife’s technology as NAAIP’s, but merely claiming to have a quote engine is unlikely to mislead anyone into assuming anything about the ultimate source of the software or the quotes that it generates. Moreover, even if consumers were misled, it is still difficult to see why that deception would have “had a material effect on purchasing decisions.” Id. Consumers have good reason to care about the quality of the quote engine, but not the identity of its author or the host of the server with which it communicates.

We find no error—much less clear error—in the magistrate judge’s determination that Compulife failed to prove false advertising. To make its case, Compulife needed to identify a particular statement or set of statements that amount to a false advertisement, which it failed to do. And Compulife’s belated

52

argument before this Court is both unpreserved and unconvincing. We affirm as to this issue.

B

At long last, we reach the final issue in this appeal—the Florida Computer Abuse and Data Recovery Act, which provides a cause of action for certain kinds of hacking. As relevant here, it states: “A person who knowingly and with intent to cause harm or loss . . . [o]btains information from a protected computer without authorization . . . [or] [c]auses the transmission of a program, code, or command to a protected computer without authorization . . . caus[ing] harm or loss . . . is liable to. . . the owner of information stored in the protected computer.” Fla. Stat. § 668.803(1) & (2) (emphasis added). A “protected computer” is one that “can be accessed only by employing a technological access barrier.” Fla. Stat. § 668.802(6).

Compulife doesn’t attempt to argue that the defendants penetrated a “technological access barrier.” Instead, Compulife maintains that this showing was unnecessary because it did not allege a violation of Fla. Stat. § 668.803(3)— which imposes liability for “[t]raffic[king] in any technological access barrier through which access to a protected computer may be obtained without authorization”—but only of § 668.803(1) & (2). On this point, Compulife simply misreads the law, overlooking the fact that a “protected computer”—as used in

53

subsections (1) & (2)—is statutorily defined as one that can be accessed only “by employing a technological access barrier.” Fla. Stat. § 668.802(6). All CADRA violations—not just those arising under § 668.803(3)—therefore require proof of access through a “technological access barrier.” Compulife’s undisputed failure to prove the presence of a “technological access barrier” is fatal to its claim. We affirm as to CADRA.

VI

The magistrate judge committed errors of law and made insufficient findings, which tainted his conclusion that Compulife’s copyright was not infringed. He also erred in his analysis of trade-secret misappropriation, both by failing to consider the application of several species of misappropriation and by committing legal error. Accordingly, we vacate the judgment as to copyright infringement and trade-secret misappropriation and remand for new findings of fact and conclusions of law. We find no reversible error in the magistrate judge’s rejection of Compulife’s other claims and affirm the remainder of the judgment.

AFFIRMED in part, VACATED in part, and REMANDED for new findings of fact and conclusions of law on the claims of copyright infringement and trade-secret misappropriation.