NORTHERN DISTRICT OF CALIFORNIA
Plaintiff, No. C 22-07611 WHA
v.
ON FAIR USE Defendant.
This memorandum opinion explains the judge’s instruction and ruling on “fair use” under Section 107 of the Copyright Act, namely:
I instruct you that Cribl’s copying and uses of the Splunk Enterprise copyrighted software for the purpose of reverse engineering the uncopyrighted S2S protocol was fair use. I further instruct you that Cribl’s copying and uses of the Splunk Enterprise copyrighted software for the purpose of testing and troubleshooting Cribl software for interoperating with Splunk Enterprise was fair use. (Dkt. No. 317 at 1). By way of background, the copyrighted work in this action was Splunk Enterprise, plaintiff Splunk Inc.’s flagship software product. Splunk Enterprise enables Splunk customers to collect data from different sources and put it into a dashboard so those customers can search Defendant Cribl, Inc. developed its own flagship software product, Cribl Stream, that sits between data sources and destinations, allowing Cribl customers to flexibly route data between them. Cribl Stream is a complementary product to Splunk Enterprise in that it can sit between data sources and Splunk Enterprise. It thereby enables Splunk customers to route data from data sources to destinations other than Splunk Enterprise, reducing the licensing fees paid to Splunk (by reducing the amount of junk data received in Splunk Enterprise) and/or increasing the licensing fees paid to Splunk (by increasing the amount of useful data received in Splunk Enterprise). To get data into Splunk Enterprise, Splunk customers can use software called a “forwarder” to collect and forward data along to a Splunk “indexer,” the Splunk Enterprise software component that receives the data on a server on premises (“on prem”) or in the cloud. Although Cribl and other companies offer forwarders that can collect and forward data along to Splunk indexers, many Splunk customers have installed Splunk forwarders to do so. And, although forwarders can send data to Splunk indexers using a variety of protocols, Splunk forwarders send data to Splunk indexers using the S2S (“Splunk-to-Splunk”) protocol. A protocol is not itself code but rather a set of rules for formatting and processing data that can be embodied in code. At trial, Splunk emphasized that the S2S protocol was developed by Splunk and “proprietary,” but all agreed that the S2S protocol was not itself protected by copyright or, for that matter, copyrightable. It bears emphasis that Splunk did not allege or in any way suggest that Cribl Stream code contained Splunk Enterprise code. There was no claim that Cribl or its customers infringed Splunk’s copyright by copying and using Cribl Stream. According to Splunk, however, Cribl infringed Splunk’s copyright by copying and using the Splunk Enterprise copyrighted software to reverse engineer the S2S protocol and to test, troubleshoot, and market Cribl Stream. Cribl’s downloads and runs of Splunk Enterprise for these purposes were challenged herein, which put in issue the extent to which they were protected under the fair use doctrine. In the first phase of argument and deliberations, to resolve underlying factual disputes those suggested by the parties. The jury’s answers were then considered by the judge in making a ruling on the ultimate question of law as to whether the facts at hand showed fair use, a procedure called for by the Supreme Court’s decision in Google LLC v. Oracle America, Inc., 593 U.S. 1, 23–25 (2021). This series of questions, along with the jury’s unanimous answers, are reproduced below: (1) Could Cribl viably interoperate with Splunk forwarders and indexers without reverse engineering the S2S protocol? Answer: No.
(2) Was reverse engineering the only means for Cribl to determine the S2S protocol? Answer: Yes. (3) Was Cribl receiving data from a Splunk forwarder with “raw” or “syslog” a viable alternative to Cribl using the S2S protocol? Answer: No.
(4) Was Cribl using the HEC protocol, with or without a third- party forwarder, a viable alternative to Cribl using the S2S protocol? Answer: No. (5) Would Splunk have earned more money had Cribl not copied and used Splunk Enterprise? Answer: Unknown.
(6) Did the public benefit from Cribl’s copying and use of Splunk Enterprise? Answer: Yes.
(7) Was Cribl’s S2S capability in its software a transformative use resulting from its copying and use of Splunk Enterprise? Answer: Yes. (Dkt. No. 321 at 1–2). As stated, the judge considered these answers in ruling on fair use as a matter of law and memorandum opinion. In the second phase of argument and deliberations, counsel and the jury had the benefit of the judge’s ruling on fair use. Now, to explain the fair use instruction and ruling, this memorandum opinion takes up the statutory factors. Section 107 of the Copyright Act provides, in pertinent part:
[T]he fair use of a copyrighted work, including . . . for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include ––
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes; (2) the nature of the copyrighted work; (3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
Free access — add to your briefcase to read the full text and ask questions with AI
NORTHERN DISTRICT OF CALIFORNIA
Plaintiff, No. C 22-07611 WHA
v.
ON FAIR USE Defendant.
This memorandum opinion explains the judge’s instruction and ruling on “fair use” under Section 107 of the Copyright Act, namely:
I instruct you that Cribl’s copying and uses of the Splunk Enterprise copyrighted software for the purpose of reverse engineering the uncopyrighted S2S protocol was fair use. I further instruct you that Cribl’s copying and uses of the Splunk Enterprise copyrighted software for the purpose of testing and troubleshooting Cribl software for interoperating with Splunk Enterprise was fair use. (Dkt. No. 317 at 1). By way of background, the copyrighted work in this action was Splunk Enterprise, plaintiff Splunk Inc.’s flagship software product. Splunk Enterprise enables Splunk customers to collect data from different sources and put it into a dashboard so those customers can search Defendant Cribl, Inc. developed its own flagship software product, Cribl Stream, that sits between data sources and destinations, allowing Cribl customers to flexibly route data between them. Cribl Stream is a complementary product to Splunk Enterprise in that it can sit between data sources and Splunk Enterprise. It thereby enables Splunk customers to route data from data sources to destinations other than Splunk Enterprise, reducing the licensing fees paid to Splunk (by reducing the amount of junk data received in Splunk Enterprise) and/or increasing the licensing fees paid to Splunk (by increasing the amount of useful data received in Splunk Enterprise). To get data into Splunk Enterprise, Splunk customers can use software called a “forwarder” to collect and forward data along to a Splunk “indexer,” the Splunk Enterprise software component that receives the data on a server on premises (“on prem”) or in the cloud. Although Cribl and other companies offer forwarders that can collect and forward data along to Splunk indexers, many Splunk customers have installed Splunk forwarders to do so. And, although forwarders can send data to Splunk indexers using a variety of protocols, Splunk forwarders send data to Splunk indexers using the S2S (“Splunk-to-Splunk”) protocol. A protocol is not itself code but rather a set of rules for formatting and processing data that can be embodied in code. At trial, Splunk emphasized that the S2S protocol was developed by Splunk and “proprietary,” but all agreed that the S2S protocol was not itself protected by copyright or, for that matter, copyrightable. It bears emphasis that Splunk did not allege or in any way suggest that Cribl Stream code contained Splunk Enterprise code. There was no claim that Cribl or its customers infringed Splunk’s copyright by copying and using Cribl Stream. According to Splunk, however, Cribl infringed Splunk’s copyright by copying and using the Splunk Enterprise copyrighted software to reverse engineer the S2S protocol and to test, troubleshoot, and market Cribl Stream. Cribl’s downloads and runs of Splunk Enterprise for these purposes were challenged herein, which put in issue the extent to which they were protected under the fair use doctrine. In the first phase of argument and deliberations, to resolve underlying factual disputes those suggested by the parties. The jury’s answers were then considered by the judge in making a ruling on the ultimate question of law as to whether the facts at hand showed fair use, a procedure called for by the Supreme Court’s decision in Google LLC v. Oracle America, Inc., 593 U.S. 1, 23–25 (2021). This series of questions, along with the jury’s unanimous answers, are reproduced below: (1) Could Cribl viably interoperate with Splunk forwarders and indexers without reverse engineering the S2S protocol? Answer: No.
(2) Was reverse engineering the only means for Cribl to determine the S2S protocol? Answer: Yes. (3) Was Cribl receiving data from a Splunk forwarder with “raw” or “syslog” a viable alternative to Cribl using the S2S protocol? Answer: No.
(4) Was Cribl using the HEC protocol, with or without a third- party forwarder, a viable alternative to Cribl using the S2S protocol? Answer: No. (5) Would Splunk have earned more money had Cribl not copied and used Splunk Enterprise? Answer: Unknown.
(6) Did the public benefit from Cribl’s copying and use of Splunk Enterprise? Answer: Yes.
(7) Was Cribl’s S2S capability in its software a transformative use resulting from its copying and use of Splunk Enterprise? Answer: Yes. (Dkt. No. 321 at 1–2). As stated, the judge considered these answers in ruling on fair use as a matter of law and memorandum opinion. In the second phase of argument and deliberations, counsel and the jury had the benefit of the judge’s ruling on fair use. Now, to explain the fair use instruction and ruling, this memorandum opinion takes up the statutory factors. Section 107 of the Copyright Act provides, in pertinent part:
[T]he fair use of a copyrighted work, including . . . for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include ––
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes; (2) the nature of the copyrighted work; (3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the copyrighted work. 17 U.S.C. § 107. The first statutory factor “considers the reasons for, and nature of, the copier’s use of an original work.” Andy Warhol Found. for the Visual Arts, Inc. v. Goldsmith, 598 U.S. 508, 509 (2023). As the Supreme Court recently observed, this factor asks the central question of “whether the use ‘merely supersedes the objects of the original creation . . . (supplanting the original), or instead adds something new, with a further purpose or different character.’” Ibid. (quoting Campbell v. Acuff-Rose Music, Inc., 510 U.S. 569, 579 (1994)). The commercial nature of a use is not dispositive, but it is relevant. Id. at 510. Specifically, “[i]t is to be weighed against the degree to which the use has a further purpose or different character,” recognizing this “furthers the goal of copyright, namely, to promote the progress of science and the arts, without diminishing the incentive to create.” Id. at 510–11. What this means is that “the presumption of unfairness that arises in such cases can be rebutted by the characteristics of a particular commercial use.” Sega Enters. Ltd. v. Accolade, Inc., 977 F.2d 1510, 1522 (9th Cir. 1992) (citation omitted). So too here. Our analysis of the first statutory factor closely tracks our court of appeals’ analysis of the first statutory factor in Sega, where the use of copyrighted software was “an intermediate one only and thus any commercial ‘exploitation’ was indirect or derivative.” Ibid. Recall, there were no allegations that Cribl Stream code contained Splunk Enterprise code, or that downloading and running Cribl Stream itself infringed Splunk’s copyright. Cribl wrote its own code and created its own software that had its own distinct purpose. Its copies and uses of Splunk Enterprise were not made to duplicate and supplant the copyrighted software. For the most part, they were made to reverse engineer the S2S protocol used by the copyrighted software — which was itself unprotected and uncopyrightable — and to interoperate with the copyrighted software. This was not a commercial case where one party sold counterfeit copies of the other party’s copyrighted work. Nor was this a commercial case where one party made copies “to be used for purposes that [were] substantially the same as those of the originals.” Warhol, 598 U.S. at 512. Rather, this was a commercial case where one party used the other party’s copyrighted work to build out its own interoperable, compatible software that could make the copyrighted work even more attractive to the other party’s own customers, extending the copyrighted work’s benefit, capability, and value. In Sega, our court of appeals determined that the first statutory factor weighed in favor of an alleged infringer when the alleged infringer copied and used copyrighted software to gain access to the functional elements of that software and to discover the functional requirements for compatibility. 977 F.2d at 1522–23. Here too, Cribl copied and used copyrighted software to gain access to the functional elements of that software and to discover the functional requirements for compatibility. More precisely, Cribl copied and used the Splunk Enterprise copyrighted software to reverse engineer the S2S protocol and viably interoperate Cribl Stream with the Splunk Enterprise copyrighted software. As the jury recognized in its answer to Enterprise resulting from Cribl’s copying and uses of Splunk Enterprise. Cribl’s copying and uses of Splunk Enterprise to reverse engineer the S2S protocol and viably interoperate Cribl Stream with Splunk Enterprise were “reasonably necessary to achieve [its] new purpose.” Warhol, 598 U.S. at 511. During trial, Splunk repeatedly suggested that Cribl could have used other means to viably interoperate Cribl Stream with Splunk Enterprise without reverse engineering and using the S2S protocol, i.e., receiving data from a Splunk forwarder using “raw” or “syslog,” and sending data to a Splunk indexer with or without a forwarder using the HEC protocol. Therefore, Splunk argued, there was no need to copy and use the Splunk Enterprise copyrighted software for this purpose, so these downloads and runs of the Splunk Enterprise copyrighted software could not have been fair use. The jury rejected this argument in its answers to Questions 1, 3, and 4. It found that, even if the use of other means was available to serve a substantial customer base, Cribl needed to reverse engineer and use the S2S protocol to viably interoperate Cribl Stream with Splunk Enterprise. Meanwhile, in evaluating the first statutory factor, “we are free to consider the public benefit resulting from a particular use notwithstanding the fact that the alleged infringer may gain commercially.” Sega, 977 F.2d at 1523. In its answer to Question 6, the jury found that the public benefitted from Cribl’s copying and uses of Splunk Enterprise. The evidence showed interoperability between Cribl Stream and Splunk Enterprise has facilitated synergy between the two products that has encouraged innovation and creativity — exactly what the Copyright Act was intended to encourage. Moreover, the Supreme Court has cautioned that the “primary objective of copyright is not to reward the labor of authors, but ‘[t]o promote the Progress of Science and useful Arts.’” Feist Publ’ns, Inc. v. Rural Tel. Serv. Co., 499 U.S. 340, 349 (1991) (quoting U.S. Const., art. I, § 8, cl. 8). In sum, the first statutory factor favors Cribl. With respect to the second statutory factor, the nature of the copyrighted work, the Supreme Court has recognized that “where copyrightable material is bound up with Feist, 499 U.S. at 349). Such is the case with respect to one’s copyright interest in software. Computer programs are functional in nature, and functional aspects are not copyrightable. While software can certainly be creative, it is different from Moby Dick (and works of nonfiction). Often humans cannot gain access to the unprotected aspects of a program without obtaining a copy of that program. See Sega, 977 F.2d at 1525. “[B]ecause [the Splunk Enterprise copyrighted software] contain[s] unprotected aspects that cannot be examined without copying, we afford [it] a lower degree of protection than more traditional literary works” and ultimately “conclude that the second statutory factor also weighs in favor of [Cribl].” Id. at 1526. Keep in mind that copying in this context is different from copying in commercial cases involving literature where it refers to reprinting exact passages, usually for direct profit. The analog would be copying part or all of Splunk’s source code into an accused software product. But the copying at issue was simply Cribl copying Splunk’s object code into memory and running the Splunk Enterprise copyrighted software, which allowed it to reverse engineer the uncopyrighted S2S protocol used by that software through “packet sniffing” (analyzing data packets flowing across a network when transferring data between Splunk forwarders and Splunk indexers) and decompiling JAR files. Across the full spectrum of copying, this falls on the least suspect side. With respect to the third statutory factor, the amount and substantiality of the portion used in relation to the copyrighted work as a whole, the entire Splunk Enterprise software program was by necessity downloaded and run for reverse engineering the uncopyrighted S2S protocol and viably interoperating Cribl Stream with Splunk Enterprise. And, the simple fact is that one had to reverse engineer the uncopyrighted S2S protocol in order to support the S2S protocol, as the jury recognized in its answer to Question 2. Again, there were no allegations that Cribl Stream code contained Splunk Enterprise code, or that downloading and running Cribl Stream itself infringed Splunk’s copyright. The use of Splunk Enterprise was an intermediate one. Although the third statutory factor weighs against Cribl, “where the ultimate (as opposed to direct) use is as limited as it was here, the factor is of very little weight.” Id. at 1526–27. With respect to the fourth statutory factor, the effect on the potential market for the copyrighted work, the jury was unanimous that it was “unknown” whether Splunk would have earned more money had Cribl not copied and used Splunk Enterprise in its answer to Question 5. True, Cribl marketed Cribl Stream on the premise that it would weed out junk data from Splunk Enterprise and reduce Splunk customers’ licensing fees paid to Splunk. Yet there was ample evidence in the trial record that Splunk customers responded to this savings by routing more (useful) data into Splunk Enterprise, which could increase their licensing fees paid to Splunk. The fourth statutory factor thus does not tip in favor of either party. All told, however, the four statutory factors clearly favor Cribl. In Sega, our court of appeals evaluated the four statutory factors and concluded that “where disassembly is the only way to gain access to unprotected elements embedded in a program and where there is a legitimate reason for seeking such access, disassembly is a fair use of the copyrighted work, as a matter of law.” Id. at 1527–28. In doing so, it recognized that intermediate copying can be protected as fair use if it is necessary to gain access to functional elements of copyrighted software. This “preserves public access to the ideas and functional elements embedded in copyrighted computer software programs . . . consistent with the ‘ultimate aim [of the Copyright Act], to stimulate artistic creativity for the general public good.’” Sony Comput. Ent., Inc. v. Connectix Corp., 203 F.3d 596, 603 (9th Cir. 2000) (quoting Sony Corp. of Am. v. Universal City Studios, Inc., 464 U.S. 417, 432 (1984)). This also allows fair use to “carry out its basic purpose of providing a context-based check that can help to keep a copyright monopoly within its lawful bounds.” Google, 593 U.S. at 22 (citing, inter alia, Sony Comput., 203 F.3d at 603–08, and Sega, 977 F.2d at 1521–27). Sega looms large here, where reverse engineering was the only way for Cribl to gain access to the unprotected S2S protocol embedded in the Splunk Enterprise copyrighted software and viably interoperate with Splunk Enterprise, and where Cribl sought to build out 1 Splunk Enterprise copyrighted software for the purpose of reverse engineering the 2 uncopyrighted S2S protocol was fair use. So was Cribl’s copying and uses of the Splunk 3 Enterprise copyrighted software for the purpose of testing and troubleshooting Cribl Stream for 4 interoperating with Splunk Enterprise. 5 To the contrary, however, Cribl’s copying and uses of the Splunk Enterprise copyrighted 6 software for the purpose of marketing Cribl Stream was not fair use. In brief, downloading and 7 running Splunk Enterprise to market Cribl Stream was not necessary for Cribl to access Splunk 8 Enterprise’s functional elements and to develop its own interoperable, compatible software 9 with its own distinct purpose. So, by way of example, fair use did not allow Cribl to run 10 Splunk Enterprise in its “sandbox” to show a potential customer how Cribl Stream worked 11 with Splunk Enterprise. 13 For the foregoing reasons, Cribl’s copying and uses of the Splunk Enterprise copyrighted 14 software for the purpose of reverse engineering the uncopyrighted S2S protocol was fair use. 15 In addition, Cribl’s copying and uses of the Splunk Enterprise copyrighted software for the 16 purposes of testing and troubleshooting Cribl software for interoperating with Splunk 3 17 Enterprise was fair use. Cribl’s copying and uses of the Splunk Enterprise copyrighted 18 software for the purpose of marketing Cribl software, however, was not. 20 21 Dated: May 24, 2024. Pee 22 Al ~ A ILLIAM ALSUP 23 UNITED STATES DISTRICT JUDGE 24 25 26 27 28