Splunk Inc. v. Cribl, Inc.

Opinion

1 2 3 4 5 6 UNITED STATES DISTRICT COURT 7 NORTHERN DISTRICT OF CALIFORNIA 8

10 SPLUNK INC., 11 Plaintiff, No. C 22-07611 WHA

12 v.

13 CRIBL, INC., MEMORANDUM OPINION ON FAIR USE 14 Defendant.

15 16 INTRODUCTION 17 This memorandum opinion explains the judge’s instruction and ruling on “fair use” under 18 Section 107 of the Copyright Act, namely:

19 I instruct you that Cribl’s copying and uses of the Splunk Enterprise copyrighted software for the purpose of reverse engineering the 20 uncopyrighted S2S protocol was fair use. I further instruct you that Cribl’s copying and uses of the Splunk Enterprise copyrighted software 21 for the purpose of testing and troubleshooting Cribl software for interoperating with Splunk Enterprise was fair use. 22 23 (Dkt. No. 317 at 1). 24 STATEMENT 25 By way of background, the copyrighted work in this action was Splunk Enterprise, 26 plaintiff Splunk Inc.’s flagship software product. Splunk Enterprise enables Splunk customers 27 to collect data from different sources and put it into a dashboard so those customers can search 1 Defendant Cribl, Inc. developed its own flagship software product, Cribl Stream, that sits 2 between data sources and destinations, allowing Cribl customers to flexibly route data between 3 them. Cribl Stream is a complementary product to Splunk Enterprise in that it can sit between 4 data sources and Splunk Enterprise. It thereby enables Splunk customers to route data from 5 data sources to destinations other than Splunk Enterprise, reducing the licensing fees paid to 6 Splunk (by reducing the amount of junk data received in Splunk Enterprise) and/or increasing 7 the licensing fees paid to Splunk (by increasing the amount of useful data received in Splunk 8 Enterprise). 9 To get data into Splunk Enterprise, Splunk customers can use software called a 10 “forwarder” to collect and forward data along to a Splunk “indexer,” the Splunk Enterprise 11 software component that receives the data on a server on premises (“on prem”) or in the cloud. 12 Although Cribl and other companies offer forwarders that can collect and forward data along to 13 Splunk indexers, many Splunk customers have installed Splunk forwarders to do so. And, 14 although forwarders can send data to Splunk indexers using a variety of protocols, Splunk 15 forwarders send data to Splunk indexers using the S2S (“Splunk-to-Splunk”) protocol. A 16 protocol is not itself code but rather a set of rules for formatting and processing data that can be 17 embodied in code. At trial, Splunk emphasized that the S2S protocol was developed by Splunk 18 and “proprietary,” but all agreed that the S2S protocol was not itself protected by copyright or, 19 for that matter, copyrightable. 20 It bears emphasis that Splunk did not allege or in any way suggest that Cribl Stream code 21 contained Splunk Enterprise code. There was no claim that Cribl or its customers infringed 22 Splunk’s copyright by copying and using Cribl Stream. According to Splunk, however, Cribl 23 infringed Splunk’s copyright by copying and using the Splunk Enterprise copyrighted software 24 to reverse engineer the S2S protocol and to test, troubleshoot, and market Cribl Stream. 25 Cribl’s downloads and runs of Splunk Enterprise for these purposes were challenged herein, 26 which put in issue the extent to which they were protected under the fair use doctrine. 27 In the first phase of argument and deliberations, to resolve underlying factual disputes 1 those suggested by the parties. The jury’s answers were then considered by the judge in 2 making a ruling on the ultimate question of law as to whether the facts at hand showed fair use, 3 a procedure called for by the Supreme Court’s decision in Google LLC v. Oracle America, 4 Inc., 593 U.S. 1, 23–25 (2021). This series of questions, along with the jury’s unanimous 5 answers, are reproduced below: 6 (1) Could Cribl viably interoperate with Splunk forwarders and indexers without reverse engineering the S2S protocol? 7 Answer: No. 8

9 (2) Was reverse engineering the only means for Cribl to determine the S2S protocol? 10 Answer: Yes. 11 (3) Was Cribl receiving data from a Splunk forwarder with “raw” 12 or “syslog” a viable alternative to Cribl using the S2S protocol? 13 Answer: No.

14 (4) Was Cribl using the HEC protocol, with or without a third- 15 party forwarder, a viable alternative to Cribl using the S2S protocol? 16 Answer: No. 17 (5) Would Splunk have earned more money had Cribl not copied 18 and used Splunk Enterprise? 19 Answer: Unknown.

20 (6) Did the public benefit from Cribl’s copying and use of Splunk 21 Enterprise? 22 Answer: Yes.

23 (7) Was Cribl’s S2S capability in its software a transformative use resulting from its copying and use of Splunk Enterprise? 24 Answer: Yes. 25 26 (Dkt. No. 321 at 1–2). 27 As stated, the judge considered these answers in ruling on fair use as a matter of law and 1 memorandum opinion. In the second phase of argument and deliberations, counsel and the 2 jury had the benefit of the judge’s ruling on fair use. Now, to explain the fair use instruction 3 and ruling, this memorandum opinion takes up the statutory factors. 4 ANALYSIS 5 Section 107 of the Copyright Act provides, in pertinent part:

6 [T]he fair use of a copyrighted work, including . . . for purposes such as criticism, comment, news reporting, teaching (including 7 multiple copies for classroom use), scholarship, or research, is not 8 an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be 9 considered shall include ––

10 (1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational 11 purposes; 12 (2) the nature of the copyrighted work; 13 (3) the amount and substantiality of the portion used in relation 14 to the copyrighted work as a whole; and

15 (4) the effect of the use upon the potential market for or value of 16 the copyrighted work. 17 17 U.S.C. § 107. 18 The first statutory factor “considers the reasons for, and nature of, the copier’s use of an 19 original work.” Andy Warhol Found. for the Visual Arts, Inc. v. Goldsmith, 598 U.S. 508, 509 20 (2023). As the Supreme Court recently observed, this factor asks the central question of 21 “whether the use ‘merely supersedes the objects of the original creation . . . (supplanting the 22 original), or instead adds something new, with a further purpose or different character.’” Ibid. 23 (quoting Campbell v. Acuff-Rose Music, Inc., 510 U.S. 569, 579 (1994)). The commercial 24 nature of a use is not dispositive, but it is relevant. Id. at 510. Specifically, “[i]t is to be 25 weighed against the degree to which the use has a further purpose or different character,” 26 recognizing this “furthers the goal of copyright, namely, to promote the progress of science 27 and the arts, without diminishing the incentive to create.” Id. at 510–11. 1 What this means is that “the presumption of unfairness that arises in such cases can be 2 rebutted by the characteristics of a particular commercial use.” Sega Enters. Ltd. v. Accolade, 3 Inc., 977 F.2d 1510, 1522 (9th Cir. 1992) (citation omitted). So too here. Our analysis of the 4 first statutory factor closely tracks our court of appeals’ analysis of the first statutory factor in 5 Sega, where the use of copyrighted software was “an intermediate one only and thus any 6 commercial ‘exploitation’ was indirect or derivative.” Ibid. 7 Recall, there were no allegations that Cribl Stream code contained Splunk Enterprise 8 code, or that downloading and running Cribl Stream itself infringed Splunk’s copyright. Cribl 9 wrote its own code and created its own software that had its own distinct purpose. Its copies 10 and uses of Splunk Enterprise were not made to duplicate and supplant the copyrighted 11 software. For the most part, they were made to reverse engineer the S2S protocol used by the 12 copyrighted software — which was itself unprotected and uncopyrightable — and to 13 interoperate with the copyrighted software. This was not a commercial case where one party 14 sold counterfeit copies of the other party’s copyrighted work. Nor was this a commercial case 15 where one party made copies “to be used for purposes that [were] substantially the same as 16 those of the originals.” Warhol, 598 U.S. at 512. Rather, this was a commercial case where 17 one party used the other party’s copyrighted work to build out its own interoperable, 18 compatible software that could make the copyrighted work even more attractive to the other 19 party’s own customers, extending the copyrighted work’s benefit, capability, and value. 20 In Sega, our court of appeals determined that the first statutory factor weighed in favor of 21 an alleged infringer when the alleged infringer copied and used copyrighted software to gain 22 access to the functional elements of that software and to discover the functional requirements 23 for compatibility. 977 F.2d at 1522–23. Here too, Cribl copied and used copyrighted software 24 to gain access to the functional elements of that software and to discover the functional 25 requirements for compatibility. More precisely, Cribl copied and used the Splunk Enterprise 26 copyrighted software to reverse engineer the S2S protocol and viably interoperate Cribl Stream 27 with the Splunk Enterprise copyrighted software. As the jury recognized in its answer to 1 Enterprise resulting from Cribl’s copying and uses of Splunk Enterprise. Cribl’s copying and 2 uses of Splunk Enterprise to reverse engineer the S2S protocol and viably interoperate Cribl 3 Stream with Splunk Enterprise were “reasonably necessary to achieve [its] new purpose.” 4 Warhol, 598 U.S. at 511. 5 During trial, Splunk repeatedly suggested that Cribl could have used other means to 6 viably interoperate Cribl Stream with Splunk Enterprise without reverse engineering and using 7 the S2S protocol, i.e., receiving data from a Splunk forwarder using “raw” or “syslog,” and 8 sending data to a Splunk indexer with or without a forwarder using the HEC protocol. 9 Therefore, Splunk argued, there was no need to copy and use the Splunk Enterprise 10 copyrighted software for this purpose, so these downloads and runs of the Splunk Enterprise 11 copyrighted software could not have been fair use. The jury rejected this argument in its 12 answers to Questions 1, 3, and 4. It found that, even if the use of other means was available to 13 serve a substantial customer base, Cribl needed to reverse engineer and use the S2S protocol to 14 viably interoperate Cribl Stream with Splunk Enterprise. 15 Meanwhile, in evaluating the first statutory factor, “we are free to consider the public 16 benefit resulting from a particular use notwithstanding the fact that the alleged infringer may 17 gain commercially.” Sega, 977 F.2d at 1523. In its answer to Question 6, the jury found that 18 the public benefitted from Cribl’s copying and uses of Splunk Enterprise. The evidence 19 showed interoperability between Cribl Stream and Splunk Enterprise has facilitated synergy 20 between the two products that has encouraged innovation and creativity — exactly what the 21 Copyright Act was intended to encourage. Moreover, the Supreme Court has cautioned that 22 the “primary objective of copyright is not to reward the labor of authors, but ‘[t]o promote the 23 Progress of Science and useful Arts.’” Feist Publ’ns, Inc. v. Rural Tel. Serv. Co., 499 U.S. 24 340, 349 (1991) (quoting U.S. Const., art. I, § 8, cl. 8). In sum, the first statutory factor favors 25 Cribl. 26 With respect to the second statutory factor, the nature of the copyrighted work, the 27 Supreme Court has recognized that “where copyrightable material is bound up with 1 Feist, 499 U.S. at 349). Such is the case with respect to one’s copyright interest in software. 2 Computer programs are functional in nature, and functional aspects are not copyrightable. 3 While software can certainly be creative, it is different from Moby Dick (and works of 4 nonfiction). Often humans cannot gain access to the unprotected aspects of a program without 5 obtaining a copy of that program. See Sega, 977 F.2d at 1525. “[B]ecause [the Splunk 6 Enterprise copyrighted software] contain[s] unprotected aspects that cannot be examined 7 without copying, we afford [it] a lower degree of protection than more traditional literary 8 works” and ultimately “conclude that the second statutory factor also weighs in favor of 9 [Cribl].” Id. at 1526. 10 Keep in mind that copying in this context is different from copying in commercial cases 11 involving literature where it refers to reprinting exact passages, usually for direct profit. The 12 analog would be copying part or all of Splunk’s source code into an accused software product. 13 But the copying at issue was simply Cribl copying Splunk’s object code into memory and 14 running the Splunk Enterprise copyrighted software, which allowed it to reverse engineer the 15 uncopyrighted S2S protocol used by that software through “packet sniffing” (analyzing data 16 packets flowing across a network when transferring data between Splunk forwarders and 17 Splunk indexers) and decompiling JAR files. Across the full spectrum of copying, this falls on 18 the least suspect side. 19 With respect to the third statutory factor, the amount and substantiality of the portion 20 used in relation to the copyrighted work as a whole, the entire Splunk Enterprise software 21 program was by necessity downloaded and run for reverse engineering the uncopyrighted S2S 22 protocol and viably interoperating Cribl Stream with Splunk Enterprise. And, the simple fact 23 is that one had to reverse engineer the uncopyrighted S2S protocol in order to support the S2S 24 protocol, as the jury recognized in its answer to Question 2. Again, there were no allegations 25 that Cribl Stream code contained Splunk Enterprise code, or that downloading and running 26 Cribl Stream itself infringed Splunk’s copyright. The use of Splunk Enterprise was an 27 intermediate one. Although the third statutory factor weighs against Cribl, “where the ultimate 1 (as opposed to direct) use is as limited as it was here, the factor is of very little weight.” Id. 2 at 1526–27. 3 With respect to the fourth statutory factor, the effect on the potential market for the 4 copyrighted work, the jury was unanimous that it was “unknown” whether Splunk would have 5 earned more money had Cribl not copied and used Splunk Enterprise in its answer to 6 Question 5. True, Cribl marketed Cribl Stream on the premise that it would weed out junk data 7 from Splunk Enterprise and reduce Splunk customers’ licensing fees paid to Splunk. Yet there 8 was ample evidence in the trial record that Splunk customers responded to this savings by 9 routing more (useful) data into Splunk Enterprise, which could increase their licensing fees 10 paid to Splunk. The fourth statutory factor thus does not tip in favor of either party. All told, 11 however, the four statutory factors clearly favor Cribl. 12 In Sega, our court of appeals evaluated the four statutory factors and concluded that 13 “where disassembly is the only way to gain access to unprotected elements embedded in a 14 program and where there is a legitimate reason for seeking such access, disassembly is a fair 15 use of the copyrighted work, as a matter of law.” Id. at 1527–28. In doing so, it recognized 16 that intermediate copying can be protected as fair use if it is necessary to gain access to 17 functional elements of copyrighted software. This “preserves public access to the ideas and 18 functional elements embedded in copyrighted computer software programs . . . consistent with 19 the ‘ultimate aim [of the Copyright Act], to stimulate artistic creativity for the general public 20 good.’” Sony Comput. Ent., Inc. v. Connectix Corp., 203 F.3d 596, 603 (9th Cir. 2000) 21 (quoting Sony Corp. of Am. v. Universal City Studios, Inc., 464 U.S. 417, 432 (1984)). This 22 also allows fair use to “carry out its basic purpose of providing a context-based check that can 23 help to keep a copyright monopoly within its lawful bounds.” Google, 593 U.S. at 22 (citing, 24 inter alia, Sony Comput., 203 F.3d at 603–08, and Sega, 977 F.2d at 1521–27). 25 Sega looms large here, where reverse engineering was the only way for Cribl to gain 26 access to the unprotected S2S protocol embedded in the Splunk Enterprise copyrighted 27 software and viably interoperate with Splunk Enterprise, and where Cribl sought to build out 1 Splunk Enterprise copyrighted software for the purpose of reverse engineering the 2 uncopyrighted S2S protocol was fair use. So was Cribl’s copying and uses of the Splunk 3 Enterprise copyrighted software for the purpose of testing and troubleshooting Cribl Stream for 4 interoperating with Splunk Enterprise. 5 To the contrary, however, Cribl’s copying and uses of the Splunk Enterprise copyrighted 6 software for the purpose of marketing Cribl Stream was not fair use. In brief, downloading and 7 running Splunk Enterprise to market Cribl Stream was not necessary for Cribl to access Splunk 8 Enterprise’s functional elements and to develop its own interoperable, compatible software 9 with its own distinct purpose. So, by way of example, fair use did not allow Cribl to run 10 Splunk Enterprise in its “sandbox” to show a potential customer how Cribl Stream worked 11 with Splunk Enterprise. 12 CONCLUSION 5 13 For the foregoing reasons, Cribl’s copying and uses of the Splunk Enterprise copyrighted 14 software for the purpose of reverse engineering the uncopyrighted S2S protocol was fair use. 15 In addition, Cribl’s copying and uses of the Splunk Enterprise copyrighted software for the 16 purposes of testing and troubleshooting Cribl software for interoperating with Splunk 3 17 Enterprise was fair use. Cribl’s copying and uses of the Splunk Enterprise copyrighted 18 software for the purpose of marketing Cribl software, however, was not. 19 IT IS SO ORDERED. 20 21 Dated: May 24, 2024. Pee 22 Al ~ A ILLIAM ALSUP 23 UNITED STATES DISTRICT JUDGE 24 25 26 27 28