Lynwood Investments CY Limited v. Maxim Konovalov, et al.

Opinion

LYNWOOD INVESTMENTS CY Case No. 20-cv-03778-MMC (KAW) LIMITED, Plaintiff, ORDER GRANTING IN PART AND DENYING IN PART MOTION TO v. COMPEL MAXIM KONOVALOV, et al., Re: Dkt. No. 228 Defendants. Pending before the Court is Plaintiff Lynwood Investments CY Ltd.’s motion to compel non-party Netflix, Inc.’s (“Netflix”) compliance with a subpoena. (Pl.’s Mot. to Compel, Dkt. No. 228.) Having considered the parties’ filings, the relevant legal authorities, and the arguments made at the October 16, 2025 hearing, the Court GRANTS IN PART and DENIES IN PART Plaintiff’s motion to compel. The sole claim in this case is Plaintiff’s copyright claim based upon the NGINX1 Plus software code, which was allegedly developed by Defendants Igor Sysoev, Maxim Konovalov, and Gleb Smirnoff while employed at Rambler Internet Holding LLC (“Rambler”) in Russia. (See Sec. Amend. Compl. (“SAC”) ¶ 1, Dkt. No. 217; 2/28/25 CMC St. at 2, Dkt. No. 209.) Plaintiff asserts that because NGINX Plus is a work for hire, it was exclusively owned by Rambler, who later assigned its interest to Plaintiff. (SAC ¶ 183.) Specifically, Defendant Sysoev was a software engineer at Rambler from November 14, 2000 through December 1, 2011. (SAC ¶¶ 51.) While employed at Rambler, Defendant Sysoev developed the NGINX software code as part of his official duties, using Rambler’s infrastructure and resources. (SAC ¶ 108.) In 2004, Defendant Sysoev released some of the NGINX code as open source software, but stockpiled other NGINX code between 2009 and his separation from Rambler in 2011. (SAC ¶¶ 126-27.) Plaintiff alleges that Defendants Sysoev, Smirnoff, and Konovalov intended to create an “open core” business model, using the Open Source NGINX to build name recognition and goodwill while using the stockpiled NGINX code to develop a proprietary NGINX Plus that could be commercially licensed on top of and in conjunction with the Open Source NGINX code. (SAC ¶¶ 6, 150.) Once Open Source NGINX was sufficiently popular and the stockpiled NGINX Plus code was sufficiently developed and tested, Defendants Sysoev, Smirnoff, and Konovalov created their own NGINX business while still employed at Rambler. (SAC ¶¶ 150, 169, 171.) In September 2011, the NGINX business brought on Netflix as its first customer, providing Netflix with content delivery network (“CDN”)-related “custom” add-ons to the Open Source NGINX. (SAC ¶¶ 212- 13, 217.) Plaintiff asserts that the NGINX CDN that was provided to Netflix in 2011 and 2012 was developed in 2010 and 2011, and was one of the first products formally released under the name NGINX Plus in 2013. (Pl.’s Mot. to Compel at 6.) In October 2011, the NGINX business obtained their first venture capital seed investment. (SAC ¶ 213.) During that time, Defendants Sysoev, Smirnoff, and Konovalov began staggering their resignations from Rambler, with Defendant Konovalov leaving in April 2011, Defendant Sysoev leaving in December 2011, and Defendant Smirnoff leaving in November 2012. (SAC ¶¶ 37, 93, 152.) When Defendant Smirnoff left, he allegedly acted as the “cleanup man,” removing the stockpiled NGINX Plus code from the Rambler servers and deleting communications regarding the misappropriation of the NGINX business and NGINX Plus code. (SAC ¶ 10.) In March 2019, the NGINX business was acquired for $670 million. (SAC ¶ 8.) On June 8, 2020, the instant case was filed. (Dkt. No. 1.) Following several motions to dismiss, the case was appealed to the Ninth Circuit. (See Ninth Cir. Slip Op., Dkt. No. 205.) The Ninth Circuit reversed the dismissal of the copyright claim only, based on Plaintiff’s allegation and Open Source NGINX, in both source code and executable form, conceived and/or developed before the end of 2011, when Sysoev left the employ of Rambler.” (Id. at 13.) The Ninth Circuit found that while Plaintiff could not plausibly assert a copyright infringement claim in Open Source NGINX, Plaintiff could bring a claim based on NGINX Plus developed at Rambler. (Id. at 13-14.) On March 7, 2025, the presiding judge held a case management conference (“CMC”), setting a deadline for Initial Phase Fact Discovery. (CMC Minutes at 1, Dkt. No. 210.) Initial Phase Fact Discovery was to be “[l]imited to whether any NGINX Plus code was written by defendant Sysoev or other former Rambler employees during their employment by Rambler before the end of 2011.” (Id.) On March 10, 2025, the presiding judge issued a Pretrial Preparation Order, which again reiterated that the Initial Phase Fact Discovery was limited to whether the NGINX Plus code was written by Defendant Sysoev or other former Rambler employees “before the end of 2011.” (Pretrial Prep. Order at 2, Dkt. No. 211.) On June 10, 2025, Plaintiff served a subpoena on Netflix, with 31 requests for production. (Major Decl. ¶ 3, Dkt. No. 230.) Netflix objected on the grounds that the subpoena was unduly burdensome and premature, and that portions of the discovery sought fell outside the scope of the Initial Phase Fact Discovery. (Major Decl., Exh. 2 at 3.) On August 29, 2025, Plaintiff filed the instant motion to compel discovery from Netflix. That same day, the motion was referred to this Court. (Dkt. No. 231.) On September 19, 2025, Netflix filed its opposition. (Netflix Opp’n, Dkt. No. 243.) On October 2, 2025, Plaintiff filed its reply.2 (Pl.’s Reply, Dkt. No. 245.) Federal Rule of Civil Procedure 45 governs discovery of nonparties by subpoena. “The scope of discovery under Rule 45 is the same as under Rule 26(b).” Waymo LLC v. Uber Techs., Inc., No. 17-cv-939-WHA (JSC), 2017 U.S. Dist. LEXIS 105394, at *8 (N.D. Cal. July 7, 2017).

2 Plaintiff’s reply fails to comply with Civil Local Rule 3-4(c)(2)(B), which requires that all text, Rule 26(b), in turn, allows a party to “obtain discovery regarding any nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case[.]” “Underlying the protections of Rule 45,” however, “is the recognition that ‘the word non-party serves as a constant reminder of the reasons for the limitations that characterize third-party discovery. Thus, a court determining the propriety of a subpoena balances the relevance of the discovery sought, the requesting party’s need, and the potential hardship to the party subject to the subpoena.” Gonzales v. Google, Inc., 234 F.R.D. 674, 680 (N.D. Cal. 2006). As an initial matter, the parties acknowledged at the hearing that Plaintiff and Netflix have not fully met and conferred as to each individual request due to Netflix’s threshold objections that: (1) Plaintiff is improperly seeking discovery from Netflix without identifying the “gaps” in party discovery that non-party discovery is expected to fill, and (2) Plaintiff’s subpoena exceeds the scope of Initial Phase Fact Discovery because it seeks documents through December 31, 2012. (See Pl.’s Mot. to Compel at 12; Major Decl. ¶ 9; Netflix Opp’n at 6-12.) Thus, the Court is not in a position to consider whether each of Plaintiff’s discovery requests are appropriate. The Court will resolve these threshold issues, determine whether NGINX Plus-related code should be produced, and provide guidance to assist with any future meet and confers. A. Initial Phase Fact Discovery Timeframe Plaintiff and Netflix dispute whether Initial Phase Fact Discovery extends through the end of 2011 or 2012. (Pl.’s Mot. to Compel at 14; Netflix Opp’n at 11.) Although the CMC minutes and Pretrial Preparation Order both state that Initial Phase Fact Discovery is “[l]imited to whether any NGINX Plus code was written by defendant Sysoev or other former Rambler employees during their employment by Rambler before the end of 2011,” Plaintiff asserts that this is a typo and that the presiding judge actually meant 2012, i.e., when Defendant Smirnoff left Rambler. (Pl.’s Mot. to Compel at 14; Pl.’s Reply at 4-5.) The Court confirmed with the presiding judge that this is not a typo. The CMC minutes and Pretrial Preparation Order are consistent with the Ninth Circuit’s ruling, which found Plaintiff of 2011, when Sysoev left the employ of Rambler.” (Ninth Cir. Slip Op. at 13.) Based on its own terms, the Initial Phase Fact Discovery is not tied to the dates of employment, but to the development of NGINX Plus before the end of 2011 -- the same date identified by Plaintiff to the Ninth Circuit. Plaintiff, however, is correct that the Initial Phase Fact Discovery is not limited to documents created by the end of 2011; documents made after 2011 can still go to whether the NGINX Plus code was created before the end of 2011. See Lang Van, Inc. v. VNG Corp., No. 814CV00100AG-JDEX, 2019 WL 8107874, at *6 (C.D. Cal. May 28, 2019) (“[T]he fact that a document bears a date outside of the timeframe set herein does not excuse production if information contained or referenced in the document bears upon the relevant timeframe.”); Hatamian v. Advanced Micro Devices, Inc., Case No. 14-cv-226-YGR (JSC), 2015 WL 7180662, at *2 (“In general, courts allow discovery to extend to events before and after the period of actual liability so as to provide context.”). For example, Netflix complains that Plaintiff has propounded a discovery request seeking documents about custom modules, source code, and NGINX web servers that were referenced in the “Smirnoff Presentation,” which was given in 2014. (Netflix Opp’n at 11.) Plaintiff, however, responds that in the Smirnoff Presentation, Defendant Smirnoff confirmed that the commercial CDN and media streaming NGINX modules that were deployed to Netflix in 2011 included core NGINX Plus features. (Pl.’s Mot. to Compel at 7.) Thus, to the extent the discovery requests are focused on the code that is ultimately part of the NGINX Plus code developed before the end of 2011, such discovery would appear to be within the scope of the Initial Phase Fact Discovery even if they are based on statements made in 2014. B. Party Discovery Plaintiff and Netflix dispute whether Plaintiff is required to identify “gaps” in party discovery before seeking discovery from Netflix. (Pl.’s Mot. to Compel at 21; Netflix Opp’n at 6.) Plaintiff points out that “Rule 45 does not require that a requesting party exhaust party discovery before seeking discovery from a nonparty.” In re Uber Techs., Inc., Case No. 23-md- 3084-CRB (LJC), 2024 U.S. Dist. LEXIS 123530, at *20 (N.D. Cal. July 14, 2024). Likewise, defendants’ possession.” Viacom Int’l, Inc. v. YouTube, Inc., No. C 08-80129 SI, 2008 U.S. Dist. LEXIS 79777, at *10 (N.D. Cal. Aug. 18, 2008). Thus, Plaintiff argues that “[t]he proper inquiry is not the purported ‘delta’ between the discovery in Defendants’ and Netflix’s possession, custody, or control, but is whether the scope of discovery [Plaintiff] seeks is proportional to the needs of the action.” (Pl.’s Mot. to Compel at 21; see also Pl.’s Reply at 7.) Important to this proportionality determination, however, is whether a gap exists in the first place, as “[c]ourts have long taken care to protect non-parties from bearing the burden of discovery properly borne by parties to a litigation.” Patel Eng’g Ltd. v. Patel, No. 25-mc-80118- VKD, 2025 WL 1745724, at *5 (N.D. Cal. June 23, 2025); see also In re Uber Techs., Inc., 2024 U.S. Dist. LEXIS 123530, at *21 (“nonparties subject to discovery requests deserve extra protections from the courts.”). Thus, contrary to Plaintiff’s assertion that the Court need not consider whether there is a gap between the documents in Netflix’s and Defendants’ possession, courts have generally only compelled production from a nonparty in “appropriate circumstances,” e.g., “because there is a reason to believe that the files of the third party may contain different versions of documents, additional material, or perhaps significant omissions.” Viacom Int’l, Inc., 2008 U.S. Dist. LEXIS 79777, at *10 (permitting discovery from nonparty where the plaintiff established that the defendant had poor recordkeeping, including identifying documents produced by another nonparty that had not been produced by the defendant). Otherwise, “[t]here is simply no reason to burden nonparties when the documents sought are in possession of the party defendant.” Nidec Corp. v. Victor Co., 249 F.R.D. 575, 577 (N.D. Cal. 2007); see LegalZoom.com v. Rocket Lawyer Inc., Case No. 15-mc-80003 NC, 2015 WL 12832823, at *2 (N.D. Cal. Mar. 23, 2015) (denying motion to compel compliance with a subpoena where the plaintiff “has not specified the parameters of the ‘gaps’ that [the nonparty] needs to fill”). In re Uber Technologies, Inc. is a useful illustration of these principles. There, the plaintiffs sought discovery from several nonparties, including Lyft (one of Uber’s primary competitors) and Checkr (a vendor who provided Uber with background checks and other screening services). 2024 U.S. Dist. LEXIS 123530, at *19, 26. With respect to Lyft, the sexual assault, and the Industry Sharing Safety Program (“ISSP”). Id. at *20-21. The district court required compliance with these requests, noting that the plaintiffs had spent months trying to collect discovery from Uber, but that Uber had not begun producing responsive documents despite the substantial completion deadline being less than two months away. Id. at *22. The district court, however, found that other requests for all documents and communications between Lyft and Uber on other collaborations, all contracts and agreements, and all payments were “broadly worded, catch-all requests . . . designed to gather information related to many different types of collaborations that may exist between Uber and Lyft.” Id. at *23-24. Absent an explanation for “why this broad, open-ended range of materials would be relevant to their claims,” the district court declined to enforce those requests except to the extent they were related to the ISSP. As to Checkr, the district court acknowledged that the plaintiffs had raised concerns about Uber’s document retention policies, but noted that they had not identified gaps in Uber’s productions. 2024 U.S. Dist. LEXIS 1235350, at *27. With that in mind, the district court found that requests for “all communications with Uber” and “all documents exchanged with Uber” were “so broad that, on their face, [the p]laintiffs failed to demonstrate the relevancy of such a broad range of documents, and the requests unduly burden Checkr with far reaching ESI collection, processing, and production.” Id. at *29. Similarly, a request asking for all payments or contributions was “disproportionate to the needs of the case because it is not clear how the information is important to advancing [the p]laintiffs’ claims or why [the p]laintiffs need this broad range of payment information.” Id. at *30. The district court also found that requests that sought “‘all documents’ ‘relating to’ or ‘related to’ or ‘reflecting’ a general topic create a significant risk of undue burden on a nonparty.” Id. at *30. Rather, the district court found that requests had to be “narrowly tailor[ed] to a more limited set of records.” Id. at *31. The district court did, however, permit document requests that sought more specific records (e.g., Checkr’s policies and procedures regarding its handling, monitoring, and auditing of background checks, recommendations made by Checkr to Uber regarding improving passenger safety with respect to sexual misconduct, and statements of work describing Checkr’s role in carrying out or facilitating documents would be in Uber’s possession. Id. at *32-34. Taken together, there appears to be a clear requirement that nonparty discovery be targeted towards documents that a party may not possess. This inquiry is also informed by the breadth and scope of the document requests; broad, general document requests are more likely to be scrutinized for seeking information that is not relevant to a case, making such requests disproportionate to the needs of the case. With these principles in mind, the Court considers the discovery requests at issue. i. Netflix Source Code The primary request at issue in this motion appears to be any NGINX Plus source code provided by Defendants to Netflix. (See Pl.’s Mot. to Compel at 15-18; Netflix Opp’n at 7-9.) Again, Netflix was the first customer of the NGINX business, with individual Defendants providing to Netflix NGINX CDN-related custom add-ons that ultimately became one of the first products formally released under the name NGINX Plus. (Pl.’s Mot. to Compel at 6.) Plaintiff seeks to determine what code was developed by individual Defendants for Netflix, as Plaintiff has alleged that code comprises of the NGINX Plus code at issue in this case. (Id. at 15.) The Court first determines the relevance of the discovery sought. Gonzales, 234 F.R.D. at 680. There can be no real dispute that any NGINX Plus code developed by individual Defendants for Netflix in 2010 and 2011 are directly relevant to the copyright infringement case. Instead, Netflix argues that Plaintiff’s requests are overbroad to the extent they seek information on Netflix’s Open Connect system because Open Connect is not NGINX Plus. (Netflix Opp’n at 12.) Plaintiff, however, has explained that in the 2014 Smirnoff Presentation, Defendant Smirnoff explained that he and other individual Defendants designed Open Connect as a “specialized CDN” to serve video, and that the Open Connect appliance included “additional modules for NGINX” such as custom modules “specific to video streaming.” (Major Decl., Exh. 6 (“2014 Smirnoff Presentation Tr.”) at 6:24-7:3, 8:23-9:3, 10:12-19.) Thus, it appears that the Open Connect system used NGINX Plus code that was developed prior to the end of 2011, such that discovery on those systems is relevant. requested discovery can be produced by Defendants. See Gonzales, 234 F.R.D. at 674. At the hearing, Plaintiff stated that they would want to compare the Netflix code with any code provided by Defendants to determine if there were differences. Plaintiff also explains that prior to leaving Rambler, the individual Defendants destroyed and removed information -- including development history information -- from the Rambler equipment that they used to develop NGINX Plus. (Pl.’s Mot. to Compel at 7.) Further, Plaintiff explains that while Defendants have the NGINX Plus code in a code repository, access to the code repository (which appears to be a subject of contention between Plaintiff and Defendants) is still insufficient to identify when code was written. (Id. at 15.) Specifically, Plaintiff provides a declaration by Nicholas Ellison, who explains that a repository is a centralized database which includes “version control” systems that record snapshots of a project at different times. (Ellison Decl. ¶ 8, Dkt. No. 229.) This permits developers to track changes to files over time, including identifying when changes were made. (Ellison Decl. ¶ 9.) Changes made through a version control system are typically managed using the repository and “commits,” or snapshots of a software development project at a specific point in time. (Ellison Decl. ¶ 10.) Ellison, however, not only explains how commits can be manipulated to change the commit date and author information, but explains how such manipulation could have occurred in this case. (Ellison Decl. ¶ 10(b).) For example, code can be written on a local device and then committed to the repository (which can be months or years after the code was written), such that the commit date does not reflect when the code was actually written. (Ellison Decl. ¶ 14(a).) Here, Plaintiff has alleged that Defendants stored their NGINX Plus code on personal servers that were then removed from Rambler, which means the NGINX Plus code developed at Rambler could have remained on their local devices for an extended period of time before being committed to a repository. (Ellison Decl. ¶ 14(a).) Further, code can be moved between repositories without preserving the history. (Ellison Decl. ¶¶ 10(b), 14(b).) As Plaintiff alleges that Defendants used Rambler’s infrastructure to develop, test, and store the NGINX Plus code, it is possible that the repository of NGINX Plus code was copied to a local machine before the Rambler servers were (Ellison Decl. ¶¶ 10(b), (c).) Netflix does not dispute Ellison’s declaration, instead arguing that Ellison did not review Defendants’ source code or opine on what is actually in the source code. (Netflix Opp’n at 9.) The point of Ellison’s declaration, however, is not to explain what is in the source code, but to explain why Plaintiff should not be required to rely solely on Defendants’ source code, such that production of source code from Netflix is warranted. Having reviewed Ellison’s declarations, combined with Plaintiff’s allegations that individual Defendants went to great lengths to hide and destroy evidence on the Rambler servers, there appears to be a legitimate reason to believe that Netflix’s source code would be different from or reflect omissions in the source code stored in Defendants’ repository. Thus, Plaintiff has identified the “gap” in Defendants’ documents that would be filled by discovery of Netflix’s source code. In the alternative, Netflix argues that in its appellate brief, Plaintiff had argued that the commit dates could be used to determine which portions of the NGINX Plus code were finalized before Defendant Sysoev left Rambler. (Netflix Opp’n at 9.) Plaintiff responds that it never suggested that this was the only method of proving the time and author of code, or that it was conclusive. (Pl.’s Reply at 8.) Again, given Ellison’s explanation for how commit dates could be manipulated and the allegations in this case, there is a serious possibility that the commits in Defendants’ code repository are not accurate. Thus, Plaintiff has a substantial need for Netflix’s code to determine what NGINX Plus code was developed for Netflix by individual Defendants prior to the end of 2011. Balanced against this is the potential hardship to Netflix. See Gonzales, 234 F.R.D. at 680. Netflix has provided a declaration explaining the practical difficulties of accessing the source code at issue. While the Court appreciates the difficulties articulated by Netflix, Netflix notably does not suggest that searching for the responsive code is not feasible, nor does it identify the time and cost of collecting and producing the responsive code. Thus, balancing the burden on Netflix with Plaintiff’s need for discovery, the Court will allow discovery of NGINX Plus source code provided by Defendants to Netflix, to the extent that it reflects NGINX Plus code developed by the parties should discuss whether cost-sharing is appropriate. ii. Remaining Discovery Requests While the Court finds that Plaintiff has explained why it needs Netflix’s code, the Court finds that Plaintiff has failed to establish the relevance and need for discovery as to the remaining discovery requests. Rather, almost all of Plaintiff’s discovery requests are the type of overbroad requests rejected by In re Uber Technologies, Inc. as disproportionate to the needs of the case. For example, Plaintiff’s first discovery request seeks “All Documents and Communications concerning agreements, contracts and/or statements of work between Netflix and any of the Defendants.” (Major Decl., Exh. 1 (“Subpoena”) at 8.) While the subpoena includes a limitation to the period between January 1, 2008 and December 31, 2012, the subject matter scope of this request is still so broad that it could easily encompass agreements that are not related to the code that ultimately makes up NGINX Plus. (See Subpoena at 6.) The same applies to many of Plaintiff’s other document requests, which seek “All Documents and Communications concerning” broad topics such as work product provided to Netflix by any Defendant, any services provided by Defendants, the design and development of software for Netflix, and any consulting or development services provided by Defendants. (See Subpoena at 8.) In short, the overbreadth of these requests makes it unclear whether all responsive documents will be relevant, creating a significant likelihood that the requests are not proportionate to the needs of the case. This likelihood is only heightened by the fact that Plaintiff does not identify any “gaps” that Netflix’s discovery needs to fill. Plaintiff fails to explain, for example, why Defendants are unlikely to have communications between themselves and Netflix, such that discovery from Netflix is required. In so finding, the Court does not suggest Plaintiff must exhaust discovery before seeking discovery from Netflix. At the same time, Plaintiff cannot simply attempt to seek all documents from Netflix if those documents are also available from Defendants. Instead, Plaintiff needs to provide narrowed discovery requests that focus on documents that Defendants may not possess, and provide a basis for its belief that Defendants may not possess or produce those documents. Thus, the Court ORDERS the parties to meet and confer as to any requests outside of the source 2 For the reasons stated above, the Court GRANTS IN PART and DENIES IN PART 3 Plaintiff's motion to compel. Netflix is ordered to produce the requested NGINX Plus-related 4 source code by no later than 45 days from the date of this order, pursuant to a protective order, if 5 needed. If more time is needed, and extension may be requested. The Court denies Plaintiff's 6 motion to compel as to all other document requests, and orders the parties meet and confer to 7 narrow these requests. 9 Dated: October 21, 2025 ' 10 hue A. WESTMORE United States Magistrate Judge 12

© 15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28