Proofpoint, Inc. v. Vade Secure, Incorporated

Opinion

PROOFPOINT, INC., et al., Case No. 19-cv-04238-MMC

Plaintiffs, ORDER GRANTING IN PART AND DENYING IN PART PLAINTIFFS' v. MOTION FOR PERMANENT INJUNCTION AND FOR FINAL VADE SECURE, INCORPORATED, et DISPOSITION; DIRECTIONS TO al., PARTIES Defendants. Before the Court is the Motion for Permanent Injunction and Final Disposition, filed July 1, 2022, by plaintiffs Proofpoint, Inc. ("Proofpoint") and Cloudmark LLC ("Cloudmark"). Defendants Vade Secure, Inc., Vade Secure SASU (collectively, "Vade") and Olivier Lemarié ("Lemarié") have filed opposition, to which plaintiffs have replied. The matter came on regularly for hearing on August 12, 2022, at which time Sean Pak and Iman Lordgooei of Quinn Emanuel Urquhart & Sullivan, LLP appeared on behalf of plaintiffs, Douglas Lumish and Arman Zahoory of Latham & Watkins LLP appeared on behalf of Vade, and Adam Cashman of Singer Cashman LLP appeared on behalf of Lemarié. Thereafter, with leave of court, the parties lodged copies of trial exhibits on which they respectively have relied and, additionally, filed supplemental briefs. Having considered the parties' respective written submissions and the oral arguments of counsel, the Court rules as follows. In the above-titled action, plaintiffs assert that Vade and Lemarié, who Vade formerly employed as its Chief Technology Officer, misappropriated plaintiffs’ trade code in violation of the Copyright Act. In the operative complaint, the First Amended Complaint filed September 2, 2020, plaintiffs request compensatory damages, exemplary damages, injunctive relief, and an order providing for disposition of copies of plaintiffs' copyrighted works in defendants' possession or control. Beginning July 26, 2021, a jury trial was conducted on the claims triable to a jury. On August 20, 2021, the jury rendered its verdict as follows: (1) plaintiffs’ asserted Trade Secrets 1-7 and 9-20 qualified as trade secrets, but asserted Trade Secret 8 did not, (2) Vade misappropriated Trade Secrets 1-7 and 9-16, but not 17-20, (3) Lemarié misappropriated Trade Secrets 1-7 and 9-15, but not 16-20, (4) Vade willfully and maliciously misappropriated Trade Secrets 1-7 and 9-16, (5) Lemarié did not willfully and maliciously misappropriate Trade Secrets 1-7 and 9-15, (6) plaintiffs did not suffer an actual loss as a result of the misappropriation, and (7) Vade, by reason of its misappropriation, was unjustly enriched in the amount of $13,495,659. Additionally, the jury found Lemarié breached the terms of his employment contract with Cloudmark1 and that plaintiffs were entitled to compensatory damages in the amount of $480,000 as against Lemarié. Lastly, the jury found Vade and Lemarié infringed one or more of plaintiffs' copyrights. After the jury verdict was entered, plaintiffs filed a motion requesting the Court award plaintiffs exemplary damages, which motion the Court, by order filed November 18, 2021, denied. By the instant motion, plaintiffs seek the two remaining forms of relief, namely, a permanent injunction and an order of disposition. Plaintiffs seek a permanent injunction that would prohibit defendants from "using, developing, making, preparing, licensing, leasing, selling, offering to license, lease, or

1 Prior to his employment at Vade, Lemarié was employed by Cloudmark as its sell, or otherwise distributing" products that "incorporate or otherwise use the misappropriated trade secrets" and/or plaintiffs' "copyrighted materials" (see Pls.' Mot. at i:17-19, 21-24), and would prohibit defendants from "further misappropriation of [p]laintiffs' trade secrets" (see id. at i:15-17). Additionally, plaintiffs seek a "final disposition of [p]laintiffs' copyrighted works in [d]efendants' possession, custody, or control with confirmation of the same by [d]efendants." (See id. at i:24-26.) A. Permanent Injunction "[A] plaintiff seeking a permanent injunction must satisfy a four-factor test before a court may grant such relief." eBay Inc. v. MercExchange, LLC, 547 U.S. 388, 391 (2006). Specifically, the plaintiff must demonstrate "(1) that it has suffered an irreparable injury; (2) that remedies available at law, such as monetary damages, are inadequate to compensate for that injury; (3) that, considering the balance of hardships between the plaintiff and defendant, a remedy in equity is warranted; and (4) that the public interest would not be disserved by a permanent injunction." See id. The Court next addresses these factors as to each defendant, in turn. 1. Vade With respect to Vade, plaintiffs argue they face a threat of irreparable injury, in that, according to plaintiffs, Vade is continuing to use plaintiffs' trade secrets, causing plaintiffs, in turn, to suffer a "loss of market position, sales, and customer opportunities" (see Pls.' Mot. at 11:25-27), as well as "price erosion and reputational harm" (see id. at 14:9-10). The threshold issue thus presented is whether plaintiffs have established, by evidence offered at trial and/or evidence submitted in support of the instant motion, that Vade is continuing to use plaintiffs' trade secrets. As set forth below, the Court finds plaintiffs have failed to demonstrate continuing use and, consequently, fail to make the requisite showing as to the first of the above factors.2 2 In light thereof, the Court does not address herein the remaining three. See Midwest Growers Cooperative Corp. v. Kirkemo, 533 F.2d 455, 465-66 (9th Cir. 1976) As relevant to the issue of continuing use, plaintiffs' theory of liability at trial was as follows. First, plaintiffs argued that Lemarié used knowledge he obtained from plaintiffs' trade secrets and source code to develop for Vade a module to detect spear phishing, which module Vade used in two products Vade began selling in 2018, namely, Vade for O365 ("O365") and Content Filter. (See Transcript of Trial Proceedings ("Trial Tr.") at 2730:5-23, 2731:21-2732:24, 2746:18-23, 2747:2-3, 2754:19-21, 2762:23-2763:3, 2769.) Second, plaintiffs argued that, after the instant action was filed, Vade contracted with a company called Zenika to develop "technology that can detect email spoofing and spear phishing attacks" (see PX2273 at 4),3 that Vade's Chief Science Officer Sebastian Goutal ("Goutal") used plaintiffs' trade secrets when he participated in writing the specifications Vade provided to Zenika, and that, beginning in 2020, Vade replaced the module Lemarié had developed with the module Zenika developed. (See Trial Tr. at 2779:22-25, 2781:10-2782:22, 2784:1-4, 2790:6-20.) Third, plaintiffs argued that, in addition to revenue Vade realized from product sales, Vade has been unjustly enriched by reason of its use of a database, known as VRGNI, that analyzes Vade customers' emails, which analysis Vade uses to improve product performance. (See Trial Tr. at 2751:15-2752:3.) At the outset, the Court considers whether the jury, in rendering its verdict, gave any indication of a finding that Vade is continuing to use plaintiffs' trade secrets. In that regard, plaintiffs argued to the jury that, if the jury found the spear-phishing modules developed respectively by Lemarié and by Zenika were the result of Vade's use of plaintiffs' trade secrets, the jury should award them the sum of $46,579,641, a figure comprising revenue obtained from sales of assertedly infringing products up to the time of trial (see Trial Tr. at 2754:19-21; see also Trial Tr. at 2970:20-22), whereas Vade argued

3 Shortly after the instant action was filed, Lemarié told Vade's Chief Executive Officer, that, in developing the initial spear-phishing module for Vade, he had used "some code . . . that contained information from Cloudmark" (see Trial Tr. 653:7-19) and, in response thereto, Vade "immediately decided to . . . remake from zero in a clean room the spear-phishing module with a third-party company," specifically, "Zenika" (see Trial the proper sum based on any such sales was $4,600,000 (see Trial Tr. at 2898:6-13). As noted, however, the jury's award for unjust enrichment was in the amount of $13,495,659, a sum not sought by any party and one the Court is unable to attribute to a finding that Vade was or was not unjustly enriched as a result of its having used plaintiffs' trade secrets in the development of the Zenika module, particularly given that Vade's pre- Zenika sales were large enough to account for the amount awarded. (See Trial Tr. at 1646:5-16, 2611:1-14, 2615:19-2616:10; see also Doc. No. 476-24 at 47.) Accordingly, the Court, as the "trier of the equitable claims," see GTE Sylvania Inc. v. Continental T.V., Inc., 537 F.2d 980, 986 n.7 (9th Cir. 1976) (holding, where "issues common to both legal and equitable claims are to be tried together, the legal issues are to be tried first, and the findings of the jury are binding on the trier of the equitable claims"), next considers whether plaintiffs have otherwise established that Vade is continuing to use plaintiffs' trade secrets, i.e., that the Zenika module uses plaintiffs' trade secrets. In support of a finding of continuing use, plaintiffs first argue that Vade, acting through Goutal, used plaintiffs' trade secrets in connection with the specifications provided to Zenika, which trade secrets, according to plaintiffs, he obtained from Lemarié. Plaintiffs, however, cite no evidence in the trial record demonstrating Lemarié provided any trade secrets to Goutal.4 Moreover, even assuming, arguendo, plaintiffs have shown Goutal was made aware of plaintiffs' spear-phishing trade secrets, plaintiffs have failed to show Goutal used those secrets in providing Vade's specifications to Zenika. Indeed, plaintiffs' liability expert acknowledged the specifications made no use of plaintiffs' trade 4 Although plaintiffs note their liability expert testified "[his] understanding from what [he'd] been able to review is that Mr. Lemarié showed [Goutal] code, and that [Goutal] had an understanding of its workings" (see Trial Tr. at 1353:13-18), an apparent reference to a deposition said expert had reviewed, no such testimony was offered at trial or in connection with the instant motion, and plaintiffs' citation to an email Lemarié sent in September 2017 to Goutal and others (see PX2146), is unavailing, in that said correspondence, as the Court noted at the hearing, refers to no more than the general subject of spear phishing (see Transcript of Proceedings, conducted August 12, 2022, at secrets. (See Trial Tr. 1399:22-1400:18 (agreeing there is not "a single place in th[e] specification that . . . reveals a Cloudmark or Proofpoint trade secret").) Plaintiffs nonetheless argue Goutal's omission of "domain spoofing" from those specifications was based on his knowledge of the results of Vade's pre-Zenika improper use of that step and his assessment of its performance. (See Trial Tr. 1356:16-22; see also PX2276.) The authority on which plaintiffs rely for such proposition, however, is distinguishable, in that the misappropriated trade secrets in those cases were themselves in the form of "negative know-how," see Genentech, Inc. v. JHL Biotech, Inc., 2019 WL 1045911, at *11 (N.D. Cal. March 5, 2019) (finding plaintiff's trade secrets constituted "undisclosed proprietary information regarding . . . the relative strengths and weaknesses of various formulations") or were used to develop products "closely resembling [the plaintiff's] technology," see BladeRoom Group Ltd. v. Facebook, Inc., 2018 WL 514923, at *9-10; (N.D. Cal. 2018); Picon Imaging, Inc. v. Empower Technology Corp., 2011 WL 3739529, at *4 (S.D. Cal. August 24, 2011) (granting temporary restraining order "given the degree of similarity between [plaintiff's] technology and [defendant's] products"). In sum, the Court finds plaintiffs have not established Vade's existing products use plaintiffs' trade secrets. Lastly, the Court finds unpersuasive plaintiffs' argument that Vade continues to use plaintiffs' trade secrets by use of Vade's VRGNI database. In particular, plaintiffs, noting "[t]he more sales Vade received through its misappropriation, the more mailbox data it acquired" (see Pls.' Mot. at 8:27-28), argue such "feedback" was used by Vade "to improve . . . VRGNI" and thereby the performance of its spear-phishing products (see id. at 8:19-20; see also Trial Tr. 1660:13-22). As discussed above, however, Vade, in 2020, stopped incorporating into its products the module developed by Lemarié, and plaintiffs have not shown the products sold thereafter incorporate plaintiffs' trade secrets. Under such circumstances, plaintiffs are, in essence, seeking to hold Vade liable in perpetuity for a misappropriation it has ceased to commit, a fact distinguishing the authority on 2013 WL 890126, at *3, *12 (N.D. Cal. January 23, 2013) (granting injunctive relief where plaintiff demonstrated defendant's "continued access to and use of [plaintiff's] trade secrets"). Accordingly, as to Vade, to the extent plaintiffs seek a permanent injunction, the motion will be denied. 2. Lemarié Plaintiffs seek entry of a permanent injunction against Lemarié, arguing that Lemarié, who plaintiffs acknowledge "is no longer affiliated with Vade," presents an "even greater risk of irreparably harming [p]laintiffs were he to use or disclose the misappropriated trade secrets" in future employment. (See Pls.' Mot. at 2:1-3.) Plaintiffs, however, have offered no evidence showing Lemarié currently possesses any of plaintiffs' trade secrets or source code, and, indeed, elicited testimony at trial from Lemarié that he "deleted all of [the] Cloudmark information . . . in [his] possession" (see Trial Tr. 649:13-650:8), testimony plaintiffs did not counter at trial and have not attempted to counter in connection with the instant motion. Under such circumstances, plaintiffs have not shown they face a threat that, in the future, Lemarié will use plaintiffs' trade secrets and/or copyrighted material himself or that he will disclose those secrets and materials to another. See 18 U.S.C. § 1836(b)(3)(A)(i) (providing plaintiff may seek injunction under DTSA "to prevent any actual or threatened misappropriation"); 17 U.S.C. § 502(a) (providing plaintiff may seek injunction under Copyright Act "to prevent or restrain infringement"). Accordingly, as to Lemarié, to the extent plaintiffs seek a permanent injunction, the motion will be denied. B. Disposition Order Under the Copyright Act, "the court may order the destruction or other reasonable disposition of all copies . . . found to have been made or used in violation of the copyright owner's exclusive rights." See 17 U.S.C. § 503(b). 1 defendant has retained any copies of plaintiffs’ copyrighted material, and, accordingly, 2 have not shown a disposition order as to Lemarié is warranted. 3 By contrast, Vade, at the hearing conducted on the instant motion, acknowledged 4 it had retained plaintiffs' source code and that Vade's counsel was in possession of such 5 material. The Court having received no further information on that point, and there being 6 no reason for Vade or its counsel to continue to retain such code upon the conclusion of 7 the instant case, the Court, as to Vade, will grant plaintiffs' request for an order of final 8 disposition. Accordingly, the Court will direct plaintiffs and Vade to meet and confer as to 9 the language of a final disposition order, and to submit a joint proposal for approval. 11 For the reasons stated above, plaintiffs' motion is hereby GRANTED in part and g 12 DENIED in part, as follows: s 13 1. To the extent plaintiffs seek a permanent injunction, the motion is hereby S 14 || DENIED. Oo 15 2. To the extent plaintiffs seek a final disposition order, the motion is hereby 16 DENIED as to Lemarié and GRANTED as to Vade. In light thereof, plaintiffs and Vade g 17 || are hereby DIRECTED to meet and confer and to thereafter submit, no later than 30 days 18 from the date of this Order, a joint proposal for disposition of the copyrighted material. 20 21 Dated: December 22, 2022 tare late INE M. CHESNEY 22 United States District Judge 23 24 25 26 27 28