Vir2us, Inc. v. Sophos Inc.

• Court: Court of Appeals for the Fourth Circuit
• Decided: February 21, 2023
• Docket: 21-1402
• Status: Unpublished

Opinion

USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 1 of 11

UNPUBLISHED

UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT

No. 21-1402

VIR2US, INC.,

Plaintiff – Appellee,

v.

SOPHOS INC.; INVINCEA, INC.,

Defendants – Appellants.

Appeal from the United States District Court for the Eastern District of Virginia, at Norfolk. Henry Coke Morgan, Jr., Senior District Judge. (2:19-cv-00018-HCM-RJK)

Argued: January 24, 2023 Decided: February 21, 2023

Before KING, AGEE, and HEYTENS, Circuit Judges.

Vacated and remanded by unpublished per curiam opinion.

ARGUED: Kevin Paul Martin, GOODWIN PROCTER LLP, Boston, Massachusetts, for Appellants. Adam Howard Charnes, KILPATRICK TOWNSEND & STOCKTON LLP, Winston-Salem, North Carolina, for Appellee. ON BRIEF: Benjamin Hayes, GOODWIN PROCTER LLP, Washington, D.C.; Robert M. Tata, Norfolk, Virginia, Elbert Lin, HUNTON ANDREWS KURTH LLP, Richmond, Virginia, for Appellants. Brian A.E. Smith, BARTKO, ZANKEL, BUNZEL & MILLER APC, San Francisco, California; Stephen E. Noona, KAUFMAN & CANOLES, P.C., Norfolk, Virginia, for Appellee.

Unpublished opinions are not binding precedent in this circuit. USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 2 of 11

PER CURIAM:

Vir2us, Inc., and Invincea, Inc., entered into a patent license agreement (the

“Agreement”) that granted Invincea a license to sell Vir2us’ patented computer-security

software in exchange for royalty payments. Invincea was later acquired by Sophos Inc.,

which began performing Invincea’s obligations under the Agreement. Believing that

Sophos and Invincea (collectively, “Sophos”) were skirting their royalty obligations,

Vir2us sued for breach of contract. The district court awarded summary judgment to

Vir2us, agreeing that Sophos breached the Agreement. But in doing so, the district court

adopted a reading of the Agreement that cannot be squared with its plain text. We therefore

vacate the judgment below and remand for further proceedings.

I.

A.

Vir2us—a California corporation that designs and sells computer-security

software—developed and patented antivirus software that uses a process called

“containerization.” This software enables a computer to “contain” a potentially malicious

file by testing it in a virtual safe room—that is, in isolation—so as to prevent that file from

infecting the rest of the computer.

In 2015, Vir2us sued Invincea—a Delaware corporation that also sells antivirus

software—in federal district court, alleging that several of Invincea’s antivirus-software

products infringed Vir2us’ patented container technology. The parties ultimately settled

the case and, as part of the settlement, entered into the Agreement.

2 USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 3 of 11

Under the Agreement, Vir2us granted Invincea a license to use “all patents and

patent applications owned by Vir2us.” J.A. 243. In exchange, Invincea agreed to (1) deliver

quarterly reports to Vir2us detailing the quantity and description of “Licensed Products

and Services Sold by Invincea and/or its Affiliates during the calendar quarter,” J.A. 246,

and (2) pay “Vir2us a royalty . . . for each Container Products and Services Sold,” J.A. 245.

The term “Container Products and Services” (which we will refer to simply as “Container

Products”) is defined in the Agreement as “the accused container products currently called

Invincea X Endpoint – Spearphish Protection and formerly known as Invincea FreeSpace,

Invincea Enterprise, and Invincea Advanced Endpoint Protection, as well as natural

evolutions and derivations of these products.” J.A. 243.

B.

The parties’ dispute in this case turns on what the term “Container Products” means

and whether certain antivirus-software products that Sophos sold fall within that meaning

such that Sophos is required to pay royalties on the sale of those products. To better

understand this dispute, as well as the district court’s resolution of it, additional context is

required.

About two months before Vir2us and Invincea executed the Agreement, Invincea

launched a line of antivirus-software products called “X by Invincea.” Some of those

products employed containerization, like Invincea X Endpoint – Spearphish Protection

(“Spearphish”), which the Agreement explicitly identifies as an “accused container

product” in the Container Product definition. J.A. 243. Other X by Invincea products, like

“Detect” and “Prevent,” employed a different kind of antivirus technology called “machine

3 USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 4 of 11

learning,” which analyzes files without “containing” them. Although the Detect and

Prevent products existed at the time of the Agreement, neither product was expressly

included within the definition of Container Products.

Critically, all X by Invincea products used the same underlying “source code,” a

collection of thousands of different data files that enable various functionalities. According

to Sophos, by using “license files,” 1 Invincea could activate or deactivate certain portions

of the source code (i.e., activate or deactivate certain files) to create different configurations

of the software. Each such unique configuration constituted a separate X by Invincea

product. To illustrate the point, Sophos contends that the Spearphish product is a software

configuration with the containerization-enabling files activated and the machine-learning-

enabling files deactivated. Likewise, it maintains that the Detect and Prevent products are

software configurations with the machine-learning-enabling files activated and the

containerization-enabling files deactivated.

Following its acquisition of Invincea, Sophos continued to sell X by Invincea

products, including Spearphish, Detect, and Prevent, but it also incorporated some of

Invincea’s source-code files into its own products. Specifically, Sophos integrated the

Invincea source-code files that enable machine-learning functionality into Sophos products

“Sandstorm” and “Intercept X.”

1 The parties dispute whether the record contains sufficient evidence on the existence of these license files. We need not resolve that dispute here, however, as it is irrelevant to our analysis.

4 USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 5 of 11

Although Sophos paid royalties on sales of the Invincea Spearphish product, which

is expressly identified as a royalty bearing Container Product in the Agreement, Sophos

did not pay royalties on sales of Invincea products Detect and Prevent or Sophos products

Sandstorm and Intercept X. Vir2us then sued Sophos for breach of contract, contending

that those four products also constituted royalty bearing Container Products under the

Agreement.

C.

In the district court, Vir2us advanced two arguments as to why the disputed Invincea

and Sophos products fell within the definition of Container Products. Beginning with the

disputed Sophos products Sandstorm and Intercept X, Vir2us argued that those products

were royalty bearing “derivations” of Spearphish, one of the expressly named “accused

container products” in the Container Products definition. Specifically, Vir2us asserted that

because the disputed Sophos products incorporated Invincea’s machine-learning files,

which are also embedded in Spearphish’s source code, the disputed products “derived”

from Spearphish. As to the disputed Invincea products Detect and Prevent, Vir2us argued

that those products, which contained source code identical to that of Spearphish, were not

just derivations of Spearphish but were each the same product as Spearphish.

Sophos countered that what made a particular product a Container Product was not

whether the product shared the same source code as one of the identified accused container

products, but whether the product employed containerization. And because the disputed

Invincea and Sophos products purportedly employed machine learning only, Sophos

argued that those products did not constitute royalty bearing Container Products under the

5 USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 6 of 11

Agreement. To support its position, Sophos noted that even though all X by Invincea

products had identical source code, only Spearphish and its prior versions—the products

with the containerization files activated—were explicitly identified by name in the

Container Products definition as the “accused container products.” Invincea’s machine-

learning products Detect and Prevent, which existed at the time the parties signed the

Agreement and thus could have been identified by name, were not included in the

definition.

On the parties’ cross-motions for summary judgment, the district court found that

the Agreement’s definition of Container Products was not functionality-based, as Sophos

proposed, but was unambiguously “product-based.” J.A. 126–27. According to the court,

the definition made no “differentiation” between products “based on [the] type of

technology or enablement of that technology.” J.A. 127. Thus, the court held that the

functionality of a particular product was irrelevant to the question whether that product was

appropriately characterized as a Container Product.

The district court then concluded that Sophos breached the Agreement by failing to

report sales and pay royalties on the disputed Invincea and Sophos products. In the court’s

view, because those products contained some or all of the source code found in

Spearphish—one of the named “accused container products”—each of the disputed

products was itself “classified as one of the named Container Products.” J.A. 124 n.10. 2

2 In light of its holding that the disputed products fell within the class of identified accused container products in the Container Products definition, the district court expressly declined to address Vir2us’ claim as presented, which was that the disputed products—the (Continued) 6 USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 7 of 11

The district court therefore ordered Sophos to file corrected quarterly reports and to pay

Vir2us $24.6 million in damages for unpaid royalties.

On appeal, Sophos argues, among other things, that the district court erred in its

interpretation of the Agreement. As discussed below, we agree with Sophos.

II.

This Court reviews summary judgments de novo, applying the same legal standards

as the district court and viewing all facts in the light most favorable to the nonmoving party.

W.C. Eng., Inc. v. Rummel, Klepper & Kahl, LLP, 934 F.3d 398, 402–03 (4th Cir. 2019).

Summary judgment is proper “if the movant shows that there is no genuine dispute as to

any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ.

P. 56(a). In breach-of-contract cases, summary judgment is appropriate if the contract is

unambiguous or if extrinsic evidence “definitively resolve[s]” any ambiguity. Wash.

Metro. Area Transit Auth. v. Potomac Inv. Props., Inc., 476 F.3d 231, 235 (4th Cir. 2007).

Sophos products in particular—fell within the definition’s “natural evolutions and derivations” clause. J.A. 124 n.10 (“Since the Court has determined that the Defendants’ products are classified as one of the named ‘Container Products’, the Court need not interpret the definition of [‘natural evolutions and derivations’] in the Agreement.”).

7 USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 8 of 11

III.

In Virginia, 3 the interpretation of a contract is a question of law. PMA Cap. Ins. Co.

v. US Airways, Inc., 626 S.E.2d 369, 372 (Va. 2006). If the contract terms are “clear and

unambiguous,” a court will construe the contract “according to its plain meaning.” Id. If,

however, the terms are ambiguous, meaning that they are reasonably susceptible to more

than one interpretation, then the proper construction of the contract is generally a question

for the factfinder, who may consider extrinsic evidence to ascertain the parties’ intent.

Video Zone, Inc. v. KF & F Props., L.C., 594 S.E.2d 921, 923–24 (Va. 2004). It is for the

court to decide whether any ambiguity exists. Id. at 923.

The district court considered the term Container Products unambiguous. Purporting

to apply the Agreement’s “plain meaning,” J.A. 124, the court reasoned that the disputed

Invincea and Sophos products “are properly classified as [accused container products]

because they utilize source code from one of the listed products, particularly, Invincea X

Endpoint – Spearphish Protection,” J.A. 127.

The district court misinterpreted the plain language of the Agreement. The

Container Products definition unambiguously identifies only four “accused container

products”—“the products currently called Invincea X Endpoint – Spearphish Protection

and formerly known as Invincea FreeSpace, Invincea Enterprise, and Invincea Advanced

Endpoint Protection.” J.A. 243. The Agreement therefore provides an exhaustive list of the

“accused container products.” See Bentley Funding Grp., L.L.C. v. SK & R Grp., L.L.C.,

3 Under the Agreement’s choice-of-law provision, Virginia law governs.

8 USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 9 of 11

609 S.E.2d 49, 56 (Va. 2005) (“[U]nder the principle of expressio unius est exclusio

alterius, the omission of a particular covenant or term from a contract reduced to writing

shows an intent to exclude it.”). 4 The disputed Invincea and Sophos products are not

included in that list and thus cannot be classified as such. See PMA Cap. Ins. Co., 626

S.E.2d at 372 (“The contract is construed as written, without adding terms that were not

included by the parties.”). In fact, the disputed Invincea products Detect and Prevent

already existed when the Agreement was signed, so the parties could have included those

products in the defined list of accused container products. But they didn’t, and that

omission carries force. See Bentley Funding Grp., 609 S.E.2d at 56.

In concluding otherwise, the district court redefined the term “accused container

products,” hinging it on a delineated product’s source code. But the Agreement makes no

mention of a product’s source code. And it certainly doesn’t indicate that an unlisted

product amounts to an accused container product if it shares any source code with the

4 The Agreement does not explicitly define the modifier “accused,” a term that appears only in the Container Products definition. We note, however, that “accused” is a term of art commonly used in patent-infringement litigation (e.g., the “accused product”). We further note that the Agreement contains at least two, albeit obscure, references to the earlier underlying patent-infringement litigation between Vir2us and Invincea. See J.A. 243 (defining the term “Legal Proceedings” in reference to the underlying patent- infringement litigation but never employing that term in the Agreement), 251 (stating that the Agreement “and the Settlement Agreement together contain the entire agreement between the Parties” but providing no details about the Settlement Agreement). But any ambiguity about the modifier “accused” as used in the Agreement is irrelevant for purposes of our narrow ruling. As illustrated above, the phrase “accused container products” in the Container Products definition is self-defining: the Container Products definition expressly states which products are the accused container products—and (by omission) which are not.

9 USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 10 of 11

named accused container products. Thus, by stating that the determinative question is

whether the disputed Invincea and Sophos products incorporate source code taken from the

listed accused container products, the court inserted a term into the Container Products

definition that the parties didn’t include. Doing so ignored the plain language and

effectively rewrote the Agreement. That was error. See id. (“The trial court ignored the

plain language of the [c]ontract by adding provisions not included by the parties. This it

cannot do.”); see also Berry v. Klinger, 300 S.E.2d 792, 796 (Va. 1983) (“[T]he court

cannot make a new contract for the parties, but must construe its language as written.”). As

a result, we must vacate the district court’s judgment.

We note that the definition of Container Products contains two separate

components, and the district court’s reasoning was confined to the first—the enumerated

accused container products. It did not reach the second component—“natural evolutions

and derivations” of the delineated products. It may well be that the disputed Invincea and

Sophos products constitute royalty bearing Container Products under this second

component. Indeed, the parties argue as much on appeal, urging us to resolve this question

too. But that is not for us to decide today. Rather, that issue is best left to the district court

for resolution in the first instance.

10 USCA4 Appeal: 21-1402 Doc: 61 Filed: 02/21/2023 Pg: 11 of 11

IV.

Accordingly, we vacate the judgment below and remand for further proceedings. 5

VACATED AND REMANDED

5 Sophos also argues that the district court miscalculated the royalty damages and erroneously granted summary judgment to Vir2us on its breach-of-contract counterclaim. Because those rulings were predicated on the district court’s erroneous interpretation of the Agreement, however, they no longer stand, and we need not address them here. The parties, of course, may raise these arguments again, if relevant, after the district court decides the threshold issue of whether Sophos breached the Agreement by selling Container Products and failing to pay royalties on those sales.