Synopsys, Inc. v. Risk Based Security, Inc.

70 F.4th 759

• Court: Court of Appeals for the Fourth Circuit
• Decided: June 15, 2023
• Docket: 22-1812
• Status: Published

Opinion

USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 1 of 31

PUBLISHED

UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT

No. 22-1812

SYNOPSYS, INC.,

Plaintiff – Appellee,

v.

RISK BASED SECURITY, INC.,

Defendant – Appellant.

Appeal from the United States District Court for the Eastern District of Virginia, at Richmond. John A. Gibney, Jr., Senior District Judge. (3:21-cv-00252-JAG)

Argued: March 8, 2023 Decided: June 15, 2023

Before AGEE and RUSHING, Circuit Judges, and Joseph DAWSON III, United States District Judge for the District of South Carolina, sitting by designation.

Affirmed by published opinion. Judge Agee wrote the opinion, in which Judge Rushing and Judge Dawson joined.

ARGUED: Andrew Evan Samuels, BAKER & HOSTETLER LLP, Columbus, Ohio, for Appellant. Catherine Emily Stetson, HOGAN LOVELLS US LLP, Washington, D.C., for Appellee. ON BRIEF: Kevin W. Kirsch, Columbus, Ohio, Michael S. Gordon, New York, New York, Christopher A. Wiech, BAKER & HOSTETLER LLP, Atlanta, Georgia; C. Dewayne Lonas, Stewart R. Pollock, MORAN REEVES CONN PC, Richmond, Virginia, for Appellant. N. Thomas Connally, Christopher T. Pickens, Tysons, Virginia, USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 2 of 31

Patrick T. Michael, San Francisco, California, Sean Marotta, Johannah Walker, HOGAN LOVELLS US LLP, Washington, D.C., for Appellee.

2 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 3 of 31

AGEE, Circuit Judge:

Both Risk Based Security, Inc. (“RBS”) and Synopsys, Inc., identify vulnerabilities

in the source code of software and share information about those vulnerabilities so they

can be corrected before nefarious individuals exploit them. After RBS accused Synopsys

of engaging in unlawful conduct related to the content of RBS’ vulnerability database,

Synopsys filed this declaratory judgment action. In relevant part, Synopsys sought a

judicial declaration that it had not misappropriated RBS’ trade secrets. On the merits, the

district court granted Synopsys’ motion for summary judgment on that claim after

concluding that RBS had not come forward with evidence showing that any of its alleged

trade secrets satisfied the statutory definition of that term. RBS appeals by challenging the

district court’s merits determination of trade secrets as well as its decisions denying RBS’

motion to dismiss the case as moot, excluding testimony from two of RBS’ expert

witnesses, and denying its motion for partial summary judgment as to some of its trade

secret claims. For the reasons set out below, we affirm the district court’s judgment in favor

of Synopsys.

I.

Software programs run according to their list of instructions, and those instructions

are found in the programs’ code. See Decision Insights, Inc. v. Sentia Grp., Inc., 416 F.

App’x 324, 325 n.2 (4th Cir. 2011) (per curiam)) (describing “source code” as “a document

written in computer language, which contains a set of instructions designed to be used in a

computer to bring about a certain result” (citing Trandes Corp. v. Guy F. Atkinson Co., 996

3 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 4 of 31

F.2d 655, 662–63 (4th Cir. 1993))). Many software programs use open source code,

meaning that the code is publicly accessible. Open source code allows for a greater

exchange of information between all users, including the subset of users who want to

identify and exploit vulnerabilities in the code for malevolent purposes. To counter the

risks posed by these cyberattacks, entities like the federal government as well as private

companies such as RBS and Synopsys work to identify vulnerabilities in open source code.

Once identified, these vulnerabilities can be shared with the public or paying customers for

their use.

RBS has been in the business of identifying and disclosing open source code

vulnerabilities for over a decade. In 2011, it acquired a publicly available vulnerability

database and used the data it contained to create a private database known as “VulnDB.”

It then invested years of research and development into expanding VulnDB’s content far

beyond the originally acquired public database. RBS then commercially licensed VulnDB

to companies including some of its competitors.

One such licensed competitor was Black Duck Software, Inc., which is now a

wholly owned subsidiary of Synopsys. RBS and Black Duck entered into a license

agreement permitting Black Duck certain uses of VulnDB beginning in 2014. During the

time this agreement was in force, Black Duck developed its own databases to manage and

store information about open source code vulnerabilities. Believing that Black Duck

violated the license agreement and misappropriated VulnDB content to undertake that

initiative, RBS revoked Black Duck’s license in 2018 and also filed a complaint against it

in Massachusetts state court. That complaint has since languished in the Massachusetts

4 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 5 of 31

courts, but in late 2021, RBS filed a second amended complaint naming Synopsys—which

acquired Black Duck in 2017—as a new defendant in the case. To date, the Massachusetts

litigation has not been resolved.

As noted earlier, the parties here are not the only entities interested in identifying

vulnerabilities in open source code. The U.S. Department of Homeland Security and the

Cybersecurity and Infrastructure Security Agency sponsor programs for this purpose as

well, one of which is the Common Vulnerabilities and Exposures (“CVE”) Program. As

part of this program, certain entities—CVE Numbering Authorities (“CNA”)—are

authorized to “assign unique identifier numbers [(“CVE Identifiers”)] to vulnerabilities in

open source security software and publish information about the vulnerabilities in the CVE

Program’s public catalogs.” Synposys, Inc. v. Risk Based Sec., Inc., No. 3:21cv252, 2022

WL 3005990, at *2 (E.D. Va. July 28, 2022). Only CNAs can assign CVE Identifiers,

which are unique, alphanumeric identifiers referring to a specific vulnerability that are then

made available to the public for use in cataloging information about and evaluating that

specific vulnerability.

In late March 2021, Synopsys became a CNA and announced its designation in a

press release. Shortly after that announcement, RBS sent Synopsys a cease and desist letter

stating that Synopsys’ work as a CNA would constitute a “severe escalation of the wrongful

conduct engaged in by Black Duck, and now Synopsys” because, in RBS’ view, it

necessarily involved VulnDB data that Black Duck had unlawfully obtained. J.A. 58. RBS

asserted that Synopsys’ work as a CNA would “at a minimum” constitute several violations

5 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 6 of 31

of state and federal law, including misappropriation of trade secrets. 1 J.A. 58. It thus

demanded in the cease and desist letter that Synopsys and its affiliates:

1. Immediately cease the unauthorized use, distribution, and modification of RBS’s intellectual property, including but not limited to the VulnDB database, all vulnerabilities identified therein, and all vulnerabilities discovered by Black Duck or Synopsys by copying or misappropriating information in the VulnDB database.

2. Immediately commit, in writing, to refrain from identifying vulnerabilities to CVE until the full resolution of the Massachusetts litigation against Black Duck.

J.A. 58 (emphases added). The letter expressly reserved RBS’ “right to seek an appropriate

remedy in the event this matter is not expeditiously resolved.” J.A. 59.

In April 2021, Synopsys filed this declaratory judgment action in the U.S. District

Court for the Eastern District of Virginia. Against the backdrop of the cease and desist

letter’s accusations and demands, the complaint sought a declaration that Synopsys had not

misappropriated RBS’ trade secrets. 2

During discovery, however, RBS sent Synopsys a covenant not to sue and a

withdrawal letter, which it also filed in the district court. Based on those documents, RBS

1 Both the cease and desist letter and the complaint identified multiple alleged violations of state and federal law, all of which have been resolved before this appeal and none of which are contested in this appeal. Accordingly, we do not address them and focus instead on the allegation of misappropriated trade secrets under Virginia and federal law. 2 Although Synopsys filed the declaratory judgment complaint, the district court identified the parties based on their relative positions in a misappropriation-of-trade-secrets claim, with RBS as the “plaintiff” alleging that “defendant” Synopsys had violated the pertinent statutes. This opinion adopts the same approach, discussing the misappropriation claims as if RBS were the “plaintiff” and Synopsys were the “defendant.”

6 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 7 of 31

moved to dismiss the complaint as moot. 3 As expounded on below, the district court held

that the declaratory judgment action was not moot because “RBS has not demonstrated that

the covenant remedies or prevents the injuries Synopsys alleges.” Synopsys, Inc. v. Risk

Based Sec., Inc., No. 3:21cv252, 2022 WL 107184, *1 (E.D. Va. Jan. 11, 2022). 4

Upon the close of discovery, each party moved to exclude certain testimony from

the other’s experts and for summary judgment (Synopsys in full and RBS partially). The

district court addressed the motions in a single order. Relevant to this appeal, the district

court granted Synopsys’ motion to exclude one of RBS’ expert witnesses in toto and one

in part, concluding that “each conveys improper legal conclusions, speculation, or factual

narrative.” Synposys, Inc., 2022 WL 3005990, at *5 (footnotes omitted). In addition, the

district court granted Synopsys’ motion for summary judgment after determining that RBS

had failed to come forward with proof sufficient to show that the alleged “trade secrets” it

accused Synopsys of misappropriating met the legal definition of that term. As relevant to

the court’s determination, the definition of “trade secret” common to Virginia and federal

law requires proof of something (here, data or information) that “[d]erives independent

economic value” from its secrecy, id. at *15 (alteration in original) (quoting Va. Code

§ 59.1-336 and citing 18 U.S.C. § 1839(3)), and that its owner had undertaken “reasonable

efforts to maintain the secrecy of its asserted trade secrets,” id. at *16; Va. Code § 59.1-

336; 18 U.S.C. § 1839(3)(A). The district court concluded RBS’ evidence was deficient as

Around the same time, RBS added Synopsys as a defendant in the pending 3

Massachusetts litigation. 4 In January 2022, RBS was acquired by Flashpoint for . 7 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 8 of 31

to both aspects of a trade secret. Accordingly, it granted Synopsys summary judgment for

a declaration that the company had not misappropriated RBS’ trade secrets. Lastly, the

district court held that regardless of its ruling on Synopsys’ motion for summary judgment,

it would have separately denied RBS’ motion for partial summary judgment.

After the parties resolved the remaining claims and procured the district court’s

entry of final judgment, RBS noted a timely appeal. The Court has jurisdiction under 28

U.S.C. § 1291.

II.

Before proceeding to the merits, we must assure ourselves that the district court

correctly determined that the parties’ dispute was not moot.

A.

Article III limits a federal court’s jurisdiction to actual “cases” and “controversies,”

and the parties’ dispute must “be extant at all stages of review, not merely at the time the

complaint is filed.” Campbell-Ewald Co. v. Gomez, 577 U.S. 153, 160 (2016) (citations

omitted). To account for this requirement, the mootness doctrine recognizes that some

“intervening circumstance[s] deprive[] the plaintiff of a personal stake in the outcome of

the lawsuit, [such that] the action can no longer proceed.” Id. at 160–61 (cleaned up). “A

case becomes moot, however, only when it is impossible for a court to grant any effectual

relief whatever to the prevailing party.” Id. at 161 (cleaned up). “As long as the parties

have a concrete interest, however small, in the outcome of the litigation, the case is not

moot.” Id. (citation omitted).

8 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 9 of 31

Article III’s case and controversy requirement—and the attendant doctrine of

mootness—is “no less strict under the Declaratory Judgment Act than in case of other

suits.” Altvater v. Freeman, 319 U.S. 359, 363 (1943) (internal citation omitted). In

MedImmune, Inc. v. Genentech, Inc., 549 U.S. 118 (2007), the Supreme Court held that a

declaratory action is available when the totality of the circumstances “show[s] that there is

a substantial controversy, between parties having adverse legal interests, of sufficient

immediacy and reality to warrant the issuance of a declaratory judgment.” Id. at 127

(citation omitted). This means that the parties’ dispute must be “definite and concrete,

touching the legal relations of parties having adverse legal interests,” it must be “real and

substantial,” and it must be amenable to “specific relief through a decree of a conclusive

character, as distinguished from an opinion advising what the law would be upon a

hypothetical state of facts.” Id. (citation omitted).

One aspect of mootness associated with declaratory judgment actions arises when a

party unilaterally covenants not to sue the other party, thus raising the question of whether

that covenant sufficiently alters the circumstances so as to render the case moot. These

actions fall within the doctrine’s broader recognition that a party “cannot automatically

moot a case simply by ending its unlawful conduct once sued.” Already, LLC v. Nike, Inc.,

568 U.S. 85, 91 (2013). And a party “claiming that its voluntary compliance moots a case

bears the formidable burden of showing that it is absolutely clear the allegedly wrongful

behavior could not reasonably be expected to recur.” Id. (emphases added) (citation

omitted). In assessing whether a particular covenant not to sue renders the declaratory

judgment action moot, the Court looks to the claims and relief sought in the complaint as

9 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 10 of 31

compared to the scope of the covenant not to sue. E.g., Revolution Eyewear, Inc. v. Aspex

Eyewear, Inc., 556 F.3d 1294, 1297 (Fed Cir. 2009) (“Whether a covenant not to sue will

divest the trial court of jurisdiction depends on what is covered by the covenant.”); Caraco

Pharm. Lab’ys, Ltd. v. Forest Lab’ys, Inc., 527 F.3d 1278, 1297 (Fed. Cir. 2008) (observing

that if, after the covenant has been issued, “a substantial controversy . . . of sufficient

immediacy and reality to warrant the issuance of a declaratory judgment” still exists, then

the case is not moot (quoting MedImmune, 549 U.S. at 127)).

B.

RBS asserts that “in reliance on” certain representations made during the pretrial

proceedings, it covenanted not to sue Synopsys and withdrew its cease and desist letter.

J.A. 581, 583. In particular, both the covenant and the withdrawal letter hinged on certain

representations Synopsys allegedly made in the pending litigation, such as that its

continuing work as a CNA would be “the product of its independent research and not based

on any vulnerability database at all, let alone VulnDB.” J.A. 580–81. In express “good faith

reliance” on those representations, J.A. 581, RBS asserted that it withdrew the cease and

desist letter “and any subsequent assertion concerning Synopsys’ use or potential use of

VulnDB in its role as a CNA,” J.A. 583. RBS viewed the covenant not to sue and the

withdrawal letter as “finally resolv[ing] any dispute over Synopsys’s conduct as a CNA

related to VulnDB®” and urged that the case be dismissed as moot because these

documents “conclusively end[ed] this litigation.” J.A. 581.

The district court disagreed and declined to dismiss the declaratory judgment action.

Relying on the Supreme Court’s seminal decision in Already, LLC v. Nike, Inc., the court

10 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 11 of 31

determined that RBS’ unilateral covenant not to sue did not satisfy its “‘formidable’ burden

of showing that the injury Synopsys seeks to remedy and prevent ‘could not reasonably be

expected’ to recur.” Synopsys, Inc., 2022 WL 107184, at *7 (quoting Already, 568 U.S. at

91). In particular it observed that the covenant was limited to Synopsys’ “role as a CNA

related to VulnDB,” and thus “does not sufficiently protect Synopsys’s other commercial

conduct,” which it had sought to protect “in its complaint [through] repeated[] refer[ences]

to its business relationships.” Id. Acknowledging that Synopsys’ CNA activities formed

the backdrop for the litigation, the district court observed that this ultimately was one

“example of the conduct [Synopsys] s[ought] to protect in its remaining claims, [and] the

relief it s[ought] for each claim demonstrate[d] that it did not refer to this conduct in a

vacuum” given the “financial and reputational harm that” it desired to avoid by seeking a

declaratory judgment. Id. at *8. “[G]iven the narrowly-tailored protection the covenant

provide[d],” and the broader scope of the complaint’s alleged harms and claim for relief,

the district court concluded the case had not been rendered moot under Already’s standards.

Id.

C.

On appeal, RBS renews its argument that the case is moot, urging the Court to vacate

the district court’s judgment on the merits and dismiss the case for want of jurisdiction. It

contends that the complaint’s factual allegations pertained solely to Synopsys’ role as a

CNA and that the relief sought here similarly relates solely to that role. RBS maintains that

its covenant not to sue and withdrawal of the cease and desist letter resolved the entirety of

the parties’ dispute because in them RBS agreed not to sue Synopsys based on its

11 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 12 of 31

performance of that role. And it asserts the district court improperly looked outside

Synopsys’ actions as a CNA to determine the case was not moot because that conduct falls

outside the scope of the parties’ dispute.

We review de novo this issue of the federal courts’ jurisdiction. Porter v. Clarke,

852 F.3d 358, 363 (4th Cir. 2017).

D.

Under the governing legal principles outlined above, our review centers on the scope

of the covenant not to sue and the withdrawal of the cease and desist letter when read in

tandem with the complaint. That review leads us to conclude that RBS did not meet its

“formidable burden” by unilaterally withdrawing the cease and desist letter and

covenanting not to sue. Already, 568 U.S. at 91 (citation omitted). This is so for at least

three reasons. First, the complaint’s broader background and prayer for relief addressed a

dispute larger than Synopsys’ specific role as a CNA, and the covenant not to sue and

withdrawal letter only partially addressed the entire dispute. Second, the language of the

covenant not to sue and the withdrawal letter were vaguely conditioned on Synopsys’ future

performance and thus did not make it “absolutely clear” that RBS’ “allegedly wrongful

behavior could not reasonably be expected to recur.” Id. (citation omitted). Third, and

relatedly, because RBS’ unilateral change relied on certain conditions about how Synopsys

12 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 13 of 31

undertook its role as a CNA, the withdrawal letter and covenant not to sue were revocable

at its discretion and thus fell further short of the high benchmark established in Already. 5

At the outset, RBS’ mid-litigation course reversal only partially addressed the

parties’ underlying dispute, as evidenced by the language of both the cease and desist letter

and—more importantly—the complaint. Although the cease and desist letter’s immediate

factual foundation was RBS’ belief that Synopsys would misuse VulnDB content in its role

as a CNA, the letter articulates the dispute more broadly. RBS demanded that Synopsys

“[i]mmediately cease the unauthorized use, distribution, and modification of RBS’s

intellectual property, including but not limited to the VulnDB database, all vulnerabilities

identified therein, and all vulnerabilities discovered by Black Duck or Synopsys by

copying or misappropriating information in the VulnDB database.” J.A. 58 (emphases

added). Given that the cease and desist letter spurred Synopsys to file the complaint, this

broader demand supports the district court’s conclusion that what Synopsys sought to

protect in the complaint, including its specific prayer for relief, went beyond clarifying the

parties’ rights solely as to Synopsys’ CNA activities. As recounted throughout the

complaint, Synopsys sought—in relevant part—declarations that it “has not copied or

misappropriated any of RBS’ purported” trade secrets, and thus has not violated federal or

Virginia law in any capacity; not just as a CNA. J.A. 37 (emphasis added); see also J.A.

5 Synopsys contends that RBS’ characterizations of certain statements made during the litigation—which form part of the recitals giving rise to the covenant and withdrawal letter—misrepresent its position in this case. If true, this too would be problematic, though we have ample basis for rejecting RBS’ mootness arguments without needing to delve into the record to resolve that aspect of the parties’ arguments on appeal. 13 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 14 of 31

54 (prayer for relief). These requests are untethered to Synopsys’ specific role as a CNA

or its use of VulnDB in that role, and thus support the district court’s conclusion that RBS’

covenant not to sue Synopsys “for any and all existing or future claims based on Synopsys’s

role as a CNA related to VulnDB®” did not conclusively show the parties’ dispute had

been resolved. J.A. 581. 6 As we have previously recognized, “the bar for maintaining a

legally cognizable claim is not high: ‘As long as the parties have a concrete interest,

however small, in the outcome of the litigation, the case is not moot.’” Grimm v. Gloucester

Cnty. Sch. Bd., 972 F.3d 586, 604 (4th Cir. 2020) (quoting Chafin v. Chafin, 568 U.S. 165,

172 (2013)).

Two more reasons apparent on the face of the covenant and withdrawal letter make

clear that their issuance did not affect the justiciability of Synopsys’ action: conditionality

and revocability. Each document is conditioned on lengthy fact-specific recitals purporting

to serve as the basis for RBS’ willingness to issue them. For example, they cite Synopsys’

counsel “unequivocal[ly] represent[ing] that its conduct as a CNA is not and will not be

6 The broader context in which the covenant was issued bolsters our conclusion, though it’s unnecessary to reach it. Shortly after issuing the covenant and withdrawal letter, RBS added Synopsys as a party defendant to the pending Massachusetts litigation also involving alleged misappropriation of VulnDB and its data. While the state case involves different claims against Black Duck and Synopsys, it still demonstrates RBS’ ongoing belief that Synopsys is liable to it for conduct relating to VulnDB. To the extent that Synopsys sought a determination in this case that particular allegations and claims of misconduct relating to VulnDB were untrue apart from the limited context of its role as a CNA, those remained a live controversy as RBS intends to continue pursuing its core theory that some portion of Black Duck and Synopsys’ ongoing work improperly originates from VulnDB. Thus, there’s a “live” controversy and Synopsys continues to have a “legally cognizable interest in the outcome” of this action. See Already, 568 U.S. at 91 (citation omitted).

14 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 15 of 31

based on VulnDB” “or any other vulnerability database” and they note RBS’ “good faith

reliance” on these statements as the basis for RBS’ willingness to covenant not to sue and

withdraw the cease and desist letter. J.A. 580–81. These reservations expressly condition

RBS’ issuance of both documents on Synopsys’ alleged representations, and thus implicitly

condition RBS’ future obligation to adhere to them as well. Nothing in either document

would prevent RBS from unilaterally determining at some future date that Synopsys had

violated the basis for its own obligations and thus arguing that it was not bound by the

covenant not to sue.

The absence of language unequivocally disavowing future litigation or other action

against Synopsys makes the covenant not to sue here a far cry from the one at issue in

Already. In that case, Nike “unconditionally and irrevocably covenant[ed] to refrain from

making any claim(s) or demand(s) . . . against Already or any of its . . . related business

entities . . . on account of any possible cause of action based on or involving” any of the

claims or any of the current or previous products at issue, including colorable imitations of

them. 568 U.S. at 93 (second and third alterations in original). In discussing why Nike’s

covenant satisfied the burden of showing that its unilateral issuance made it “absolutely

clear [Nike’s] allegedly wrongful behavior could not reasonably be expected to recur,” id.

at 91 (citation omitted), the Court pointed to it being “unconditional and irrevocable”; it

prohibited not just “filing suit,” but also “making any claim or any demand”; it extended

beyond Already itself to include affiliates; and “it covers not just current or previous

designs, but any colorable imitations.” Id. at 93. In short, the covenant “encompass[ed] all

of [Nike’s] allegedly unlawful conduct,” id. at 94, meaning that “Already [was] free to sell

15 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 16 of 31

its shoes without any fear of” Nike acting against it, id. at 96, and Already had not come

forward with any argument to the contrary, id. at 95.

Even accepting that a covenant not to sue may not need to contain such extensive

language as used in Already, it’s readily evident here that RBS’ covenant falls well short

of meeting its initial burden under the Supreme Court’s high standard. 7 Its conditioned

terms and revocability are both fatal to satisfying the requirements set forth in Already. See

Porter, 852 F.3d at 364 (“The Supreme Court has held that a defendant satisfies [its] heavy

burden when, for example, it enters into an ‘unconditional and irrevocable’ agreement that

prohibits it from returning to the challenged conduct.” (citation omitted)); ArcelorMittal v.

AK Steel Corp., 856 F.3d 1365, 1370 (Fed. Cir. 2017) (concluding that a covenant not to

sue had not rendered the case moot because it had not “unconditionally assure[d]

Defendants and their customers that it would never assert [the challenged] claims . . .

against them”); Lewis Bros. Bakeries Inc. v. Interstate Brands Corp. (In re Interstate

Bakeries Corp.), 751 F.3d 955, 960–61 (8th Cir. 2014) (declining to dismiss the action as

moot where the defendant—unlike Nike in Already—“ha[d] not given ironclad assurances

7 This case does not require us to determine what distance exists between the particular covenant not to sue at issue in Already and a less comprehensive covenant not to sue that nonetheless meets the Already standard. But we note that other courts have recognized at least some distance is permissible. See, e.g., ABS Glob., Inc. v. Cytonome/ST, LLC, 984 F.3d 1017, 1021–22 (Fed. Cir. 2021) (concluding that a covenant that was “unquestionably narrower than the covenant not to sue in Already” still satisfied Already’s standard because the disavowal was “coextensive with the asserted injury,” allowing the plaintiff to continue operating, and prohibiting the defendant from asserting liability against it for doing so not just for the products at issue but also for those that were “essentially the same” as the ones at issue (citation omitted)).

16 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 17 of 31

about the License Agreement” and, “[e]specially in light of the lengthy and ongoing dispute

between the parties over [that agreement], the record d[id] not foreclose a reasonable

possibility that [the owner of the disputed mark would] maintain that the agreement is

executory,” which was the “precise dispute in th[e] case”). We have previously recognized

that “[w]henever ‘a defendant retains the authority and capacity to repeat an alleged harm,

a plaintiff’s claims should not be dismissed as moot.’” Courthouse News Serv. v. Schaefer,

2 F.4th 318, 323 (4th Cir. 2021) (quoting Wall v. Wade, 741 F.3d 492, 497 (4th Cir. 2014)).

RBS retained such authority and capacity by issuing a covenant premised on its

interpretation of Synopsys’ representations and future conduct in accordance with those

understandings.

In sum, the documents RBS issued mid-litigation do not meet Already’s standards

because they are partial, conditional, and revocable. Accordingly, we reject RBS’

contention that the case should have been dismissed as moot following RBS’ issuance of

the covenant not to sue and its withdrawal of the cease and desist letter. The district court

appropriately concluded that it retained jurisdiction to consider the merits.

III.

We next turn to whether the district court erred in granting Synopsys’ motion for

summary judgment on whether it had misappropriated RBS’ trade secrets and the related

question of whether the court abused its discretion in excluding testimony from RBS’

expert witnesses.

17 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 18 of 31

Failing to prove the existence of a “trade secret” dooms a misappropriation claim.

Trandes Corp., 996 F.2d at 661 (observing that a plaintiff does not satisfy his burden by

identifying something that “could qualify as trade secrets,” but also must come forward

with “evidence that these items met the definition of a trade secret” (emphasis added)); see

also MicroStrategy Inc. v. Li, 601 S.E.2d 580, 588 (Va. 2004) (stating that the relevant

Virginia statute has two elements—“the existence of a ‘trade secret’ and its

‘misappropriation’ by the defendant” —and that “if a plaintiff fails to prove either required

element, the plaintiff is not entitled to relief” (citation omitted)). The Virginia and federal

definitions of “trade secret” are of a piece, applying to all sorts of things—including

information and compilations of information—bearing two characteristics. First, a trade

secret must “[d]erive[] independent economic value, actual or potential, from not being

generally known to, and not being readily ascertainable by proper means by, other persons

who can obtain economic value from its disclosure or use.” Va. Code § 59.1-336; accord

18 U.S.C. § 1839(3)(B) (containing materially identical language). Second, a trade secret

must be “the subject of efforts that are reasonable under the circumstances to maintain its

secrecy.” Va. Code § 59.1-336; accord 18 U.S.C. § 1839(3)(A) (requiring that “the owner

thereof has taken reasonable measures to keep such information secret”). For ease of

reference, we refer to the two elements of the trade secret definition by the shorthand

requirements of “independent economic value” and “reasonable secrecy.”

Although the existence of a trade secret “ordinarily presents a question of fact to be

determined by the fact finder from the greater weight of the evidence,” MicroStrategy Inc.,

18 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 19 of 31

601 S.E.2d at 589, summary judgment can still be appropriate when the record does not

create a genuine issue of material fact as to the necessary elements.

In the district court, RBS repeatedly altered the number of trade secrets that it

alleged Synopsys purportedly misappropriated. For most of the case, it asserted 150 and as

many as 160 trade secrets were at issue. By the summary-judgment stage, however, RBS

had cut the number to seventy-five. Broadly speaking, its alleged trade secrets consisted of

vulnerability data collected over certain periods of time or in certain file locations,

including structures, mapping, and relationships contained in VulnDB as well as

compilations and methods of analyzing and documenting identified vulnerabilities. E.g.,

J.A. 4682 (Trade Secret 1: “RBS’s vulnerability references from January through May of

2016 contained in ossAvailability2016.csv (cited in BD-RBS-000006741).”); J.A. 4692

(Trade Secret 26: “The compilation of software vulnerability data contained in

base_credits.csv (RBS-00003368).”); J.A. 4699 (Trade Secret 68: “VulnDB software

vulnerability data structure contained in BD-RBS-181790-91.”).

The district court concluded RBS failed to come forward with proof that could show

that the seventy-five alleged trade secrets satisfied both statutory requirements—

independent economic value and reasonable secrecy. Synopsys, Inc., 2022 WL 3005990,

at *15–17. In short, the court held that RBS failed to establish that its trade secrets had

independent economic value because it had not “established a connection between” RBS’

mid-litigation acquisition price, its “revenues, VulnDB, and any particular trade secret.”

Id. at *15. It observed the acquisition price did not provide a relevant marker of any asserted

19 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 20 of 31

trade secret’s value because RBS had not shown how a value for the entire company on the

date of its recent sale reflected the value of any of the trade secrets. In particular, it observed

that since that date, RBS had cut the number of alleged trade secrets by almost half, yet it

had not adjusted its asserted value for the remaining trade secrets. As for reasonable

secrecy, the district court concluded that although RBS had required nondisclosure

agreements from some of its customers, it had not done so consistently or comprehensively,

including pertinent gaps in agreements with major customers.

The court’s conclusions on the merits of RBS’ trade secrets claims rested in part on

its exclusion of testimony from RBS’ expert witnesses, observing that they had improperly

incorporated “legal conclusions, speculation, or factual narrative” into their written reports.

Id. at *5 (footnotes omitted). Only one of the witnesses—Adam Shostack—opined on

independent economic value and the court excluded that and other portions of his proposed

testimony. In explaining that decision, the court observed that Shostack’s testimony did

not “demonstrate that he individually evaluated RBS’s claimed trade secrets” in reaching

his opinion that the seventy-five alleged trade secrets collectively had independent

economic value. Id. at *7. The court then observed that it didn’t need to decide whether

grouping of trade secrets was permissible in an expert-opinion report because before

reaching such an opinion the expert would still be required to individually evaluate each

trade secret to know how to group them and determine that they indeed had independent

economic value. In excluding the other challenged witness’s testimony (Steven Kursh), the

court pointed to many instances where he described incomplete or missing data from

Synopsys files, and yet usurped the court’s function by making adverse credibility

20 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 21 of 31

assessments from those gaps and drawing conclusions against Synopsys without adequate

comparison of the underlying data.

On appeal, RBS challenges all four determinations, that is, both substantive

conclusions supporting summary judgment and the attendant exclusion of its two expert

witnesses’ testimony. We review the grant of summary judgment de novo, undertaking the

same review as the district court. Goodman v. Diggs, 986 F.3d 493, 497 (4th Cir. 2021).

Summary judgment should be granted “only if, taking the facts in the best light for the

nonmoving party, no material facts are disputed and the moving party is entitled to

judgment as a matter of law.” Id. at 497–98 (citation omitted); see Fed. R. Civ. P. 56(a).

When there’s a “failure of proof concerning an essential element of a plaintiff’s case,”

summary judgment is appropriate. Haulbrook v. Michelin N. Am., Inc., 252 F.3d 696, 702

(4th Cir. 2001) (cleaned up). As for the district court’s evidentiary determination, we

review the decision to exclude expert testimony for abuse of discretion. Sardis v. Overhead

Door Corp., 10 F.4th 268, 280 (4th Cir. 2021).

Having reviewed the record evidence and the parties’ arguments on appeal, we agree

with the district court that RBS failed to come forward with evidence showing its seventy-

five alleged trade secrets met the independent economic value requirement. Relatedly, we

conclude that the district court did not abuse its discretion in excluding Shostack’s

testimony on the matter of independent economic value because it would not have aided

21 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 22 of 31

RBS in satisfying its burden of proof. 8 For these reasons, we agree that Synopsys was

entitled to summary judgment on the Virginia and federal misappropriation-of-trade-

secrets claims.

As has been established, for information to constitute a “trade secret” under Virginia

and federal law, it must “[d]erive[] independent economic value” from its secrecy. Va.

Code § 59.1-336; 18 U.S.C. § 1839(3)(B). This element requires proof not just of value,

but of value specifically tied to secrecy. See Ruckelshaus v. Monsanto Co., 467 U.S. 986,

1012 (1984) (“The economic value of that property right lies in the competitive advantage

over others that [the plaintiff] enjoys by virtue of its exclusive access to the data, and

disclosure or use by others of the data would destroy that competitive edge.”). In the district

court, RBS sought to prove that all seventy-five of its alleged trade secrets satisfied this

requirement by pointing to its January 2022 acquisition price of and evidence

that at least 90 percent of its revenue comes from licensing VulnDB. But as the district

court correctly recognized, a fatal disconnect exists between the evidence RBS relied on

8 Because a “trade secret” comprises both independent economic value and reasonable secrecy, Va. Code § 59.1-336; 18 U.S.C. § 1839(3), RBS’ failure to prove independent economic value is fatal to its Virginia and federal claims that Synopsys misappropriated trade secrets. See Haulbrook, 252 F.3d at 702; accord Trandes Corp., 996 F.2d at 661 (“Trandes had to describe the subject matter of its alleged trade secrets in sufficient detail to establish each element of a trade secret.”). We therefore need not consider the other ground on which the district court relied to reach its conclusion, namely, whether RBS’ evidence was insufficient to prove its reasonable efforts to maintain the secrecy of the alleged trade secrets. Nor do we need to consider whether the court abused its discretion in excluding the entirety of Kursh’s testimony, which did not touch on independent economic value and thus would not have enabled RBS to satisfy its burden on that element.

22 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 23 of 31

and its burden of proof because that evidence does not reflect that the alleged trade secrets

had value nor prove that any such value derived from their secrecy.

RBS failed to come forward with evidence establishing the trade secrets had

“value.” Neither RBS itself nor its private database VulnDB is one of the alleged seventy-

five trade secrets, so evidence about RBS’ or VulnDB’s value cannot substitute for

evidence about the seventy-five alleged trade secrets’ value. 9 Permitting evidence of the

value of the whole entity to substitute as value of a particular component part (the trade

secrets) would defeat the obligation of proving that the alleged trade secrets themselves

have independent economic value. To hold otherwise would allow RBS to circumvent its

burden of proof and redefine “trade secret.”

But the problem with RBS’ evidence runs deeper still because it also failed to show

that any asserted value derives from the seventy-five alleged trade secrets’ secrecy. Not

everything with commercial value constitutes a trade secret. Both Virginia and federal law

require a specific connection between value and secrecy. Va. Code § 59.1-336 (defining

“trade secret” as “[d]eriv[ing] independent economic value . . . from not being generally

known . . . and not being readily ascertainable” (emphasis added)); 18 U.S.C. § 1839(3)(B)

9 By its own representation, RBS does many things, only one of which (though an important one) is maintaining VulnDB, and VulnDB comprises information far beyond the seventy-five alleged trade secrets. See, e.g., Opening Br. 6–7. Indeed, at the time of RBS’ sale, the company was asserting the existence of some 150 trade secrets, which it later recalibrated to 160 trade secrets before eventually slashing that number by over half. These representations show that both the company itself and its proprietary database consist of more than just the alleged seventy-five trade secrets. Far from being co-extensive and thus interchangeable for purposes of establishing value, they are nested, but distinct subparts.

23 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 24 of 31

(same); see Trandes Corp., 996 F.2d at 663 (discussing independent economic value as the

value competitors could obtain by possessing the information that had previously been kept

from them). Thus, part of RBS’ obligation was to come forward with evidence that its

seventy-five alleged trade secrets had value because they remain secret. See DTM

Research, L.L.C. v. AT&T Corp., 245 F.3d 327, 332 (4th Cir. 2001) (“[A trade secret’s]

continuing secrecy provides the value, and any general disclosure destroys the value.”);

see also Oakwood Laby’s LLC v. Thanoo, 999 F.3d 892, 913 (3d Cir. 2021) (“The trade

secret’s economic value depreciates or is eliminated altogether upon its loss of secrecy[.]”);

Stromback v. New Line Cinema, 384 F.3d 283, 305 (6th Cir. 2004) (“Thus, the essence of

a trade secret is that it derives its value from secrecy.”). Proof of value untethered to value

derived from secrecy does not show an alleged trade secret’s independent economic value.

E.g., Buffets, Inc. v. Klinke, 73 F.3d 965, 969 (9th Cir. 1996) (affirming the district court’s

conclusion that the evidence did not establish independent economic value of the plaintiff’s

recipes because, under Washington law, which uses a materially identical definition of a

trade secret, the plaintiff had not established a connection between the asserted value of the

recipes and those recipes “being kept secret”).

Here, even if we were to assume that RBS’ purchase price and the percentage of

revenue stemming from VulnDB could prove in the abstract that the trade secrets had some

commercial value, neither one satisfies the requirement of showing value arising from their

remaining secret. Put another way, the marker of value on which RBS relies does nothing

to establish that the asserted value associated with the seventy-five alleged trade secrets

derives from their “not being generally known” or “readily ascertainable” to others through

24 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 25 of 31

lawful means. At bottom, the company’s purchase price cannot—as a matter of law—serve

as the basis for satisfying this element of the definition of a trade secret.

RBS’ arguments in favor of a contrary holding on the requirement of independent

economic value do not hold force. For example, it criticizes the district court for requiring

it to prove independent economic value “per trade secret.” Opening Br. 60 (emphasis

omitted). To begin with, because independent economic value is one part of the definition

of a “trade secret,” Va. Code § 59.1-336; 18 U.S.C. § 1839(3)(B), a basis exists in the

statutory language for concluding that evidence of independent economic value must be

proven as to each item that a plaintiff seeks to have identified as a distinct “trade secret.”

Under this reading of the statutory language, value may need to be established “per trade

secret.” Opening Br. 60 (emphasis omitted). Recognizing as much would not necessarily

prohibit a court, the parties, or an expert witness from discussing the independent economic

value of individual trade secrets by groups so long as the same evidence related to more

than one of the alleged trade secrets and permitted a conclusion to be drawn with respect

to each individual trade secret’s value.

For purposes of this case, however, we need not definitively decide whether or when

“grouping” of evidence to establish a trade secret’s independent economic value is ever

permitted. Even accepting that RBS could satisfy its burden with proof of valuation based

on evidence about groups of its alleged trade secrets rather than individual assessments,

that is not what it tried to do here. Instead, RBS relied on evidence of valuation that was

not particularized to its seventy-five alleged trade secrets whether they are viewed

individually, in smaller groupings, or as a whole. That’s the fundamental disconnect

25 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 26 of 31

identified by the district court, and that’s a basis for our affirmance on appeal. E.g.,

Synopsys, 2022 WL 3005990, at *15 (observing that it “has no method—and RBS has

likewise suggested none—of determining which of the now-asserted trade secrets, if any,

contributed to RBS’s valuation on January 6, 2022”).

RBS’ reliance on the concept that “value” encompasses more than “a numerical

amount” also misses the mark. Opening Br. 60 (emphasis omitted). Once again, a concept

true in the abstract fails to grapple with the fundamental lack of evidence of the value of

the seventy-five alleged trade secrets based on how RBS decided to prove its case. In the

district court, RBS bore the burden of coming forward with evidence of value, and it relied

on the company’s acquisition price and the share of the company’s revenues derived from

VulnDB to do so. Thus, RBS—not the district court—introduced a numeric amount into

the analysis by relying on the collective corporate value as the sole basis for meeting its

burden. It’s the misdirection to unrelated measures of value that was the problem, not just

a lack of a specific numeric amount tied to each of the alleged trade secrets.

Lastly, in its opening brief, RBS points to evidence in the record that it did not rely

on in the district court as proof of the seventy-five alleged trade secrets’ independent

economic value. It says independent economic value exists based on (1) Synopsys’ expert

witness Dr. Eric Cole’s testimony that he “spent ‘a few hours’ searching 18 websites to

find only 21 of the 300,000+ vulnerabilities reported in VulnDB,” thus creating a genuine

dispute about the value of VulnDB’s “unique data compilations” based on what it would

cost an outsider to locate “every source, reference, and vulnerability in VulnDB,” Opening

Br. 58; (2) Black Duck’s repeated efforts to buy RBS and VulnDB and its (alleged)

26 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 27 of 31

unlawful extraction of VulnDB data, which demonstrate the value of the seventy-five

alleged trade secrets; and (3) Shostack’s testimony about independent economic value,

which the district court (purportedly) improperly excluded. 10

None of this evidence satisfied RBS’ burden for the same fundamental reason

already discussed. It too attempts to show the independent economic value of the seventy-

five alleged trade secrets through proof that RBS and VulnDB have value. Such sleight-of-

hand is no more availing as to this evidence than it is to the rest.

Only the exclusion of Shostack’s testimony warrants a brief additional discussion.

As noted, the district court excluded relevant parts of Shostack’s testimony as a result of

his legal conclusions and speculative foundation, in addition to the court’s concern that

Shostack had not demonstrated that he’d reviewed the alleged trade secrets individually.

We agree that these problems plagued his assessment of independent economic value. Most

problematically, Shostack’s report repeatedly refers to the value of RBS and VulnDB while

making conclusory assertions about the trade secrets contained in the database. Further,

Shostack failed to connect the dots between the collective corporate value and the seventy-

10 Synopsys argues RBS’ failure to make these arguments in district court results in their forfeiture on appeal. See United States v. Lavabit, LLC (In re Under Seal), 749 F.3d 276, 285 (4th Cir. 2014) (reiterating our “settled rule [that] absent exceptional circumstances, we do not consider issues raised for the first time on appeal” (cleaned up)). RBS responds that these arguments can be considered in the first instance, citing language from our cases stating that when claims are “plainly encompassed by” and a “[v]ariation[] on arguments made” in district court. De Simone v. VSL Pharms., Inc., 36 F.4th 518, 528 (4th Cir. 2022) (citations omitted). We are inclined to agree that RBS has forfeited these arguments by failing to direct the district court’s attention to this evidence as part of its proof of independent economic value. But we ultimately do not determine the side of the line on which these arguments fall because they readily fail on their merits.

27 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 28 of 31

five alleged trade secrets. For example, Shostack’s written report included the opinion that

“[v]ulnerability databases such as VulnDB, and the trade secrets contained within VulnDB,

have independent economic value as a result of the skilled work which goes into creating,

organizing, compiling, and maintaining them (i.e., as a result of not being generally known

or readily ascertainable).” J.A. 5868–69. But his entire analysis explaining this viewpoint

focuses on the market for vulnerability databases as a whole without any discussion of why

the seventy-five alleged trade secrets have particular value. E.g., J.A. 5888 (“VulnDB’s

trade secret features, designs, methods, techniques, processes, procedures, programs, and

codes have independent value. This is demonstrated by RBS’s success in selling the

product both in the general market and to Black Duck in particular. Based on my

experience, if these secrets had no independent value, then [Black Duck] would not have

licensed them or would have cancelled their re-seller agreement without creating their own

database.”); J.A. 5890 (listing four additional “expression[s] of the value of RBS’s

database” as (1) royalty payments, (2) “valuation of a company like Black Duck,” (3)

“either increased number or value of sales,” and (4) “market perception by either customers

or influencers”).

Nor does Shostack represent that his conclusions were based on an individual

review of the seventy-five alleged trade secrets. 11 To the contrary, he suggests otherwise

11 Nor could he. At the time of his report, dated January 12, 2022, RBS was still propounding over 150 alleged trade secrets. The settled-upon seventy-five were not newly alleged items but were taken from the list of the earlier identified items. Even so, Shostack’s failure to identify with precision which alleged trade secrets he reviewed or based his opinions on presents problems when assessing his expert opinion because—given (Continued) 28 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 29 of 31

by observing that the “trade secrets in this case are numerous,” representing his

understanding “that another expert is examining the trade secrets individually,” and stating

that his analysis of Synopsys’ “[d]irect [u]se of [t]rade [s]ecrets” “focused on the trade

secrets pertaining to sources of vulnerability information to be evaluated and checked

regularly,” and then cautioning that his report was “intended to supplement, but not replace,

any other RBS expert opinion.” J.A. 5903. 12

RBS again contends that the district court abused its discretion in excluding

Shostack’s testimony on this ground because Shostack was not required to opine on the

trade secrets individually. 13 And as discussed earlier, RBS’ argument is problematic given

that the definition of a “trade secret” requires an individualized assessment even if that

assessment could be discussed in groups rather than per trade secret. Even if grouping is

appropriate in some cases, it must be done in a way that permits the trier of fact to undertake

this review. Sweeping conclusions untethered to specific shared characteristics of a group

of trade secrets that show that each has independent economic value would not aid the trier

of fact in undertaking that task. What’s more, the district court did not exclude Shostack’s

testimony on independent economic value only because he considered the trade secrets in

that there’s no indication he reviewed all of them—it increases the likelihood that his views were based on consideration of earlier-alleged trade secrets that were not part of the seventy-five. 12 RBS does not point to any of its other expert witness’s testimony as opining on the matter of independent economic value. 13 RBS’ only authority for that proposition consists of two district court decisions, both of which are narrower than how RBS uses them and involve scenarios different from what the district court concluded here.

29 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 30 of 31

his expert report as an undivided whole to streamline the analysis for a trier of fact. To the

contrary, the court specifically stated it “need not determine whether to permit this type of

grouping.” Synopsys, Inc., 2022 WL 3005990, at *7. Instead, the district court pointed out,

and the record confirms, that Shostack never indicates that, in formulating his opinion, he

ever assessed the trade secrets individually before determining their collective value simply

from being part of VulnDB. See id. (excluding Shostack’s conclusions because the report

“admits that he did not individually evaluate each trade secret and RBS has not identified

any evidence that shows otherwise”). Without undertaking that task, Shostack’s method

for formulating his opinions was on shaky ground, and the district court did not abuse its

discretion in excluding it.

****

In sum, the district court properly concluded that RBS failed to put forward

admissible evidence showing that the seventy-five alleged trade secrets had independent

economic value. Absent proof sufficient to satisfy that part of the statutory definition of a

“trade secret,” RBS could not prevail in a misappropriation-of-trade-secrets claim, and the

district court properly granted summary judgment to Synopsys. Given this holding, we

need not consider RBS’ additional argument that the district court erred in denying its

motion for partial summary judgment.

IV.

For the reasons stated, we hold that the district court properly exercised jurisdiction

because the case did not become moot during its pendency. In addition, we affirm the

30 USCA4 Appeal: 22-1812 Doc: 65 Filed: 06/15/2023 Pg: 31 of 31

district court’s grant of summary judgment to Synopsys on the claim that it had

misappropriated RBS’ trade secrets.

AFFIRMED