Actuate Corporation v. International Business Machines Corporation et al

Filing 32

ORDER by Judge Joseph C. Spero denying 15 Motion to Dismiss (jcslc1, COURT STAFF) (Filed on 4/5/2010)

1 2 3 4 5 6 7 8 9 10 v. INTERNATIONAL BUSINESS MACHINES CORP., ET AL., Defendants. ___________________________________/ ACTUATE CORP., Plaintiff, No. C-09-05892 JCS ORDER DENYING MOTION TO DISMISS [Docket No. 15] UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

I.

INTRODUCTION This case arises out of a software licensing agreement between Plaintiff Actuate Corporation

("Actuate") and Defendant MRO Software, Inc. ("MRO"), which is a wholly-owned subsidiary of Defendant International Business Machines, Inc. ("IBM"). Actuate asserts claims for: 1) breach of contract; 2) copyright infringement in violation of 17 U.S.C. §§ 101 et seq. (the Copyright Act); 3) circumvention of access controls and distribution of circumvention tools in violation of 17 U.S.C. §§ 1201 et seq. (Digital Millennium Copyright Act ("DMCA")); and 4) fraudulent concealment. Defendants filed a Motion to Dismiss Actuate's Complaint ("the Motion"), seeking dismissal under Rule 12(b)(6) of the Federal Rules of Civil Procedure of Actuate's claims for breach of contract (Claim One), violation of the DMCA (Claim Three) and fraudulent concealment (Claim Four). Defendants subsequently withdrew the Motion as to Claim Four. The parties have consented to the jurisdiction of a United States magistrate judge pursuant to 28 U.S.C. § 636(c). A hearing on the Motion was held on Friday, April 2, 2010. For the reasons stated below, the Motion is DENIED.

1 2 3 4 5 6 7 8 9 10

II.

BACKGROUND A. Factual Background1

Actuate is a corporation based in California and incorporated in Delaware that develops and licenses computer software aimed at business needs. Complaint, ¶ 7. MRO is a Massachusetts corporation and is a wholly-owned subsidiary of IBM. Id., ¶ 8. IBM is a Delaware Corporation with its principal place of business in New York. Id., ¶ 9. IBM has represented itself to be MRO's successor-in-interest. Id. In December 2000, Actuate entered into a written agreement with MRO entitled "E.Business Application Partner Software License Agreement" ("License Agreement"), extending rights to MRO to use certain Actuate software and to sell licenses to MRO products incorporating that software in exchange for license and maintenance fees. Id., ¶ 15. In particular, according to the Complaint, "[t]he License Agreement provided that MRO had the limited right to market, distribute and sublicense Actuate software for use with Partner Products that it distributes to new and existing end users during the term of the License Agreement." Id., ¶ 16. The License Agreement defined "Partner Products" as the software listed in Exhibit A of the License Agreement, which included MRO's Maximo line of products. Id. The License Agreement allowed MRO to distribute an unlimited number of copies of the Actuate software covered by the agreement for a flat fee, so long as the terms of the license were met. Id., ¶ 20. Under the License Agreement, in the event that MRO was acquired by a third party during the term of the agreement, use of Actuate's software would continue to be limited to "Partner's Products and their Natural Successors." Id., ¶ 18. Alternatively, the License Agreement permitted MRO to extend its rights under the License Agreement to permit use of Actuate software in connection with third-party products if it paid additional license fees. Id.

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

The Court assumes the allegations in the complaint to be true for the purposes of this motion. See Cahill v. Liberty Mutual Ins. Co., 80 F.3d 336, 338 (9th Cir. 1996)(on motion to dismiss under Rule 12(b)(6) of the Federal Rules of Civil Procedure, the court assumes the facts alleged in the complaint are true). 2

1

1 2 3 4 5 6 7 8 9 10

Actuate and MRO amended the License Agreement five times after its initial execution. Id., ¶ 19. Amendment 4, which was effective June 30, 2006, gave MRO the unilateral option to extend the terms of the License Agreement until December 31, 2011. Id. Amendment 4 was negotiated in a series of telephone conversations and in-person meetings between May 13 and June 30, 2006. Id., ¶ 21. During those negotiations, MRO representatives told individuals negotiating on behalf of Actuate that its sales of Actuate's software were declining and likely would continue to decline. Id. Actuate representatives were not informed of a potential acquisition of MRO by IBM. Id., ¶ 24. On August 2, 2006, however, IBM announced that it was acquiring MRO. Id., ¶ 23. Proxy statements filed on August 28, 2006 with the Securities and Exchange Commission indicate that IBM and MRO were engaged in active discussions about the acquisition while Amendment 4 was being negotiated. Id. After IBM acquired MRO, it incorporated MRO's Maximo software into its own Tivoli line of products. Id., ¶ 31. IBM did not, however, pay Actuate any additional license fees. Id. In addition, Actuate alleges that sometime after IBM acquired MRO, it posted on the internet Actuate software and related materials, including development tools, documentation and license keys, without Actuate's authorization. Id., ¶ 32. Actuate further alleges that the license keys posted by IBM "enable Actuate's software to be installed on an unlimited basis." Id. B. The Motion to Dismiss2 1. Breach of Contract Claim (Claim One)

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Actuate asserts that Defendants have breached the License Agreement because IBM has failed to pay additional licensing fees for its use of Actuate's software in connection with its Tivoli products. Defendants argue, however, that under the plain language of the License Agreement, IBM's use of Actuate's software in its Tivoli products is within the scope of the License Agreement

In the Motion, Defendants requested dismissal of Claim Four, for fraudulent concealment, under the New York statute of limitations that they argued applied to that claim. Subsequently, however, they conceded that their argument was based on a flawed reading of the statute and withdrew the motion as to the fraudulent concealment claim. Accordingly, the Court addresses only the arguments raised by Defendants with respect to Claim One (breach of contract) and Claim three (violation of the DMCA). 3

2

1 2 3 4 5 6 7 8 9 10

because it is incorporated into those products as part of the Maximo software, which is a Partner Product under the agreement. Therefore, Defendants assert, IBM is not required to pay additional

license fees under the License Agreement. In support of their position, Defendants cite to Paragraph 1.8 of the License Agreement, which provides as follows: Limited Use. "Limited Use" means that the Software can be used by an End User or in a hosted Services environment solely in conjunction with the contemporaneous use of Partner Products. Limited Use does not include use of the Software in a standalone fashion or with software or data not incorporated into or integrated with Partner products. Declaration of James D. Wade in Support of Defendants' Motion to Dismiss Actuate's Complaint ("Wade Decl."), Ex. A (License Agreement).3 According to Defendants, this definition applies to the provision of the License Agreement addressing licensing fees in the case of a third-party acquisition of MRO. That provision provides, in part, as follows: Acquisition or Merger Should Partner acquire, merge with or be acquired by a third party during the Term, this Agreement shall remain in full force and effect in accordance with its terms. However, Partner's use of the Software shall continue to be Limited to Partner's Products and their Natural Successors as stated in this Exhibit A. Partner may elect to extend its rights under this Agreement to use the Actuate Software in connection with the products of such third party by agreeing to pay the incremental License Fees as defined below. Wade Decl., Ex. A (License Agreement), Ex. A, Paragraph 9.4 Because IBM continues to use Actuate's software as part of the Maximo line of products (which are, in turn, used in IBM's Tivoli products), Defendants assert that Paragraph 9 permits this use without the payment of additional license fees. Actuate responds that Defendants improperly equate the definition for the defined term "Limited Use" with the undefined term "Limited" that is used in Paragraph 9. In doing so, Actuate

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Defendants assert that the Court is not limited to the allegations in the Complaint regarding the License Agreement but rather, may look to the agreement itself, even though it was not attached to the Complaint, because Plaintiff cited to the License Agreement in support of its claims. Actuate does not dispute that the Court may consider the License Agreement in resolving Defendants' motion. The remainder of Paragraph 9 sets forth a formula for determining the amount of the Incremental License Fees. 4
4

3

1 2 3 4 5 6 7 8 9 10

asserts, Defendants fail to read the language of the relevant provision in context such that its construction is consistent with the agreement as a whole and "eviscerate[] numerous other provisions of the License Agreement that set limits on an acquiror's distribution right[s] and establish post-acquisition payment obligations." Opposition at 18. In particular, Actuate argues that Defendants' construction ignores the limitation relating to "Natural Successors" contained in Paragraph 9 ­ a term that is defined in the License Agreement as follows: "Natural Successor" shall mean any replacement or substitute software for any of the Actuate Software products or Partner Products ("Products") listed in Exhibit A. Natural Successors shall include without limitation any software that: (i) includes substantially similar functionality to a Product; (ii) presents a performance or other enhancement to similar functionality offered in a Product; or (iii) offers similar functionality to a Product but that is translated into or supports additional natural languages and platforms. Wade Decl., Ex. A (License Agreement), Paragraph 1.11. Given the detailed definition of "Natural Successor" negotiated by the parties, as well as the elaborate formula for determining additional licensing fees, Defendants' construction of the language in Paragraph 9 must be incorrect, Actuate asserts. Finally, Actuate concedes that in Paragraph 9, the word "Limited" is capitalized, as is the convention for terms that are defined within a contract, but argues that this is most likely a typographical error. 2. DMCA Claim

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Actuate alleges that in posting its license keys/files on the internet without authorization, IBM "circumvented a technological measure and/or trafficked in a circumvention technology and device within the meaning of" the DMCA. Defendants assert, however, that every case to address the question has held that improper use of a password issued by the copyright holder does not amount to "circumvention" of a technological control under the DMCA. Motion at 5 (citing I.M.S. Inquiry Management Systems, Ltd. v. Berkshire Information Systems, Inc., 307 F. Supp. 2d 521, 53233 (S.D.N.Y. 2004); R.C. Olmstead, Inc. v. CU Interface LLC, 2009 WL 3049867 (N.D. Ohio 2009); Egilman v. Keller & Heckman, LLP, 401 F. Supp. 2d 105, 113-114 (D.D.C. 2005)). Actuate responds that Defendants' argument is incorrect because they rely on authority addressing a provision of the DMCA that prohibits direct circumvention of access controls whereas 5

1 2 3 4 5 6 7 8 9 10

Actuate's claims are based on provisions that prohibit trafficking in technology designed to circumvent access or copy controls. Specifically, section 1201 contains three relevant provisions. First, section 1201(a)(1) prohibits circumvention of access controls: No person shall circumvent a technological measure that effectively controls access to a work protected under this title. 17 U.S.C. § 1201(a)(1). Second, section 1201(a)(2) prohibits trafficking in technology designed to circumvent access controls: No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that-- (A) is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a work protected under this title; (B) has only limited commercially significant purpose or use other than to circumvent a technological measure that effectively protects a right of a copyright owner under this title; or (C) is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing a technological measure that effectively controls access to a work protected under this title. 17 U.S.C. § 1201(a)(2). Third, section 1201(b)(1) prohibits trafficking in technology designed to circumvent copy controls: No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any technology, product, service, device, component, or part thereof, that-- (A) is primarily designed or produced for the purpose of circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof; (B) has only limited commercially significant purpose or use other than to circumvent protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof; or (C) is marketed by that person or another acting in concert with that person with that person's knowledge for use in circumventing protection afforded by a technological measure that effectively protects a right of a copyright owner under this title in a work or a portion thereof. 17 U.S.C. § 1201(b)(1). Actuate states that its claims are based on the anti-trafficking provisions of the DMCA, sections 1201(a)(2) and (b), and not on the direct circumvention provision, section 1201(a)(1). Actuate points to two decisions within this district in which courts have held under 6

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

1 2 3 4 5 6 7 8 9 10

similar circumstances that defendants were liable under the anti-trafficking provisions of the DMCA, 321 Studios v. MGM Studios, Inc., 307 F. Supp. 2d 1085 (N.D. Cal. 2004) and Microsoft Corp. v. EEE Business Inc., 555 F. Supp. 2d 1051 (N.D. Cal. 2008). III. ANALYSIS A. Legal Standard

A complaint may be dismissed for failure to state a claim for which relief can be granted under Federal Rule of Civil Procedure 12(b)(6). Fed. R. Civ. P 12(b)(6). In order to survive a motion to dismiss under Rule 12(b)(6), a complaint must "contain either direct or inferential allegations respecting all the material elements necessary to sustain recovery under some viable legal theory." Bell Atl. Corp. v. Twombley, 550 U.S. 544, 127 S. Ct. 1955, 1969 (2007) (quoting Car Carriers, Incl v. Ford Motor Co., 745 F.2d 1101, 1106 (7th Cir. 1984) (internal quotations omitted; emphasis in original). For purposes of resolving a Rule 12(b)(6) motion, courts accept all allegations of material fact as true and construe the complaint in the light most favorable to the nonmoving party. Nat'l Wildlife Fed'n v. Espy, 4 F.3d 1337, 1380 (9th Cir. 1995). B. The Breach of Contract Claim

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Defendants argue that Actuate's breach of contract claim should be dismissed with prejudice because the clear and unambiguous language of the License Agreement allows IBM to distribute Actuate's software in connection with its Tivoli line of products without paying additional licensing fees so long as the Actuate software is sold in conjunction with MRO's Maximo products. This issue cannot be resolved on a Rule 12 motion. Whether New York or California law applies, the terms of a contract must be construed in a manner that takes into account the context of the language and is consistent with the contract as a whole. See Dupree v. Holman Professional Counseling Centers, 572 F.3d 1094 (9th Cir. 2009) (citing Cal. Civ. Code § 1641); Westmoreland Coal Co. v. Entech, Inc., 794 N.E.2d 667, 670 (N.Y. 2003). Here, Defendants assert that they have complied with Paragraph 9 of the License Agreement, as a matter of law, because IBM continued to use Actuate's software in connection with Maximo, which is a Partner Product under the License Agreement, thus satisfying the definition of "Limited 7

1 2 3 4 5 6 7 8 9 10

Use." Even assuming that Defendants are correct that the definition of "Limited Use" should be read into Paragraph 9 in interpreting that provision, the Court finds that factual questions relating to how Actuate's software is incorporated into IBM's Tivoli line preclude dismissal on this basis under Rule 12(b)(6). In particular, the definition of Limited Use excludes "use of the Software in a standalone fashion or with software or data not incorporated into or integrated with Partner products." Because it is not apparent from the allegations in the complaint that Defendants' use of Actuate's software was a Limited Use, as defined under the contract, dismissal of the breach of contract claim under Rule 12(b)(6) is not appropriate .5 C. The DMCA Claim

Defendants assert that Actuate's DMCA claim must be dismissed with prejudice because improper use of a password issued by the copyright holder does not amount to "circumvention" under the DMCA, citing I.M.S. Inquiry Management Systems, Ltd. v. Berkshire Information Systems, Inc., 307 F. Supp. 2d 521, 532-33 (S.D.N.Y. 2004) and two cases in which other district courts followed that decision, R.C. Olmstead, Inc. v. CU Interface LLC, 2009 WL 3049867 (N.D. Ohio 2009) and Egilman v. Keller & Heckman, LLP, 401 F. Supp. 2d 105, 113-114 (D.D.C. 2005).6 Plaintiff counters that these cases are distinguishable because they address claims under section 1201(a)(1) whereas Actuate's claim is asserted under sections 1201(a)(2) and (b)(1). Rather, Actuate asserts, the Court should look to two decisions that were decided in this district that hold that unauthorized use of passwords is "circumvention" under sections 1201(a)(2) and (b)(1), 321 Studios v. MGM Studios, Inc., 307 F. Supp. 2d 1085 (N.D. Cal. 2004) and Microsoft Corp. v. EEE

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Plaintiff also asserts that the License Agreement is ambiguous as to whether it permits a third party to use Actuate's software, in the event of an acquisition or merger, without paying additional licensing fees so long as it is used in a Partner Product. The Court need not decide at this time whether the contract is ambiguous because it finds that even under Defendants' interpretation of the contract, the requirements for dismissal of the breach of contract claim under Rule 12(b)(6) have not been satisfied.
6

5

Hereinafter, the Court refers to this line of cases as "the I.M.S. line of cases." 8

1 2 3 4 5 6 7 8 9 10

Business Inc., 555 F. Supp. 2d 1051 (N.D. Cal. 2008).7 The Court concludes that the reasoning in the two lines of cases, when applied to the facts here, points to different results. Though there is scant case law to guide the Court's decision, the Court declines to follow the reasoning of the I.M.S. line of cases and therefore denies Defendants' motion. As noted above, section 1201(a)(1) prohibits circumvention of access controls, while sections 1201(a)(2) and (b)(1) prohibit trafficking in technology designed to circumvent access or copy controls. Section 1201(a)(3) provides the following definitions, applicable to all of subsection (a): (3) As used in this subsection-(A) to "circumvent a technological measure" means to descramble a scrambled work, to decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner; and (B) a technological measure "effectively controls access to a work" if the measure, in the ordinary course of its operation, requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work. 17 U.S.C. § 1201(a)(3). Section 1201(b) provides the following definitions: (A) to "circumvent protection afforded by a technological measure" means avoiding, bypassing, removing, deactivating, or otherwise impairing a technological measure; and (B) a technological measure "effectively protects a right of a copyright owner under this title" if the measure, in the ordinary course of its operation, prevents, restricts, or otherwise limits the exercise of a right of a copyright owner under this title. 17 U.S.C. § 1201(b)(2). The parties cite to two lines of cases on the question of what constitutes "circumvention" under these provisions, the I.M.S. line of cases and the 321 Studios line of case. 1. The I.M.S. Line of Cases

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

In I.M.S. Inquiry Management Systems, the court addressed whether the unauthorized use by the defendant of passwords that had been issued by the plaintiff to a third party constituted a

7

Hereinafter, the Court refers to this line of cases as "the 321 Studios line of cases." 9

1 2 3 4 5 6 7 8 9 10

violation of section 1201(a)(1) of the DMCA. The court concluded that they did not, reasoning as follows: Circumvention requires either descrambling, decrypting, avoiding, bypassing, removing, deactivating or impairing a technological measure qua technological measure. In the instant matter, defendant is not said to have avoided or bypassed the deployed technological measure in the measure's gatekeeping capacity. The Amended Complaint never accuses defendant of accessing the e-Basket system without first entering a plaintiff-generated password. 307 F. Supp. 2d at 1531. Because the defendant "did not surmount or puncture or evade any technological measure" but instead "used a password intentionally issued by plaintiff to another entity," the court found that there was no "circumvention" under section 1201(a)(1). Id. at 1532. In reaching this conclusion, the I.M.S. court relied on a Second Circuit decision, Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001). Although that case did not address the meaning of "circumvent" under the DMCA (as the I.M.S. court acknowledged), it addressed a technology that the I.M.S. court viewed as materially different from the use of passwords, a DVD decryption program called DeCSS, which enabled the viewing of movies without a DVD player. Id. (citing Universal Studios, 273 F.3d at 453). The I.M.S. court explained: Universal Studios is instructive as a matter of reference. There, the offending circumvention was a DVD decryption program, DeCSS, which enabled the viewing of movies without using a DVD player. See Universal Studios, 273 F.3d at 452. The security device that prevented access to DVD movies without a DVD player, CSS, was described "[i]n its basic function ... [as] a lock on a homeowner's door, a combination of a safe, or a security device attached to a store's products." Id., at 452-53. Likewise, "[i]n its basic function, [DeCSS, the decryption program] is like a skeleton key that can open a locked door, a combination that can open a safe, or a device that can neutralize the security device attached to a store's products. DeCSS enables anyone to gain access to a DVD movie without using a DVD player." Universal Studios, 273 F.3d at 453. Id. The I.M.S. court concluded that use of passwords issued by the plaintiff (even if not to the defendant) was not like the DeCSS decryption program in Universal Studios and therefore did not "circumvent" a technological measure. Id. In Egilman, the court addressed whether a plaintiff could bring a DMCA claim under section 1201(a)(1) based on the allegation that the defendant had used unauthorized but valid passwords and user names to access the plaintiff's website. 401 F. Supp. 2d at 112. The court concluded he could 10

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

1 2 3 4 5 6 7 8 9 10

not, citing to I.M.S. Id at 113-114. The court found that I.M.S. was correctly decided and reiterated the reasoning of that case. In particular, the court stated: Circumvention, as defined in the DMCA, is limited to actions that "descramble," "decrypt," "avoid, bypass, remove, deactivate or impair a technological measure." 17 U.S.C. § 1201(a)(3). What is missing from this statutory definition is any reference to "use" of a technological measure without the authority of the copyright owner, and the court declines to manufacture such language now. As such, the court concludes that using a username/password combination as intended-by entering a valid username and password, albeit without authorization-does not constitute circumvention under the DMCA. Id. at 113. The court in Egilman rejected the plaintiff's attempt to distinguish I.M.S. on the grounds that in that case, the passwords and usernames had been legitimately issued to a third party, whereas there was no such allegation in Egilman. The court stated: Simply put, this is a distinction without a difference. The important aspect of the holding in I.M.S. was that the authorized use of a technological measure does not constitute circumvention for purposes of the DMCA. It was irrelevant who provided the username/password combination to the defendant, or, given that the combination itself was legitimate, how it was obtained. Id. In R.C. Olmsted, another district court followed I.M.S. 657 F. Supp. 2d 878 (N.D.

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Oh.2009). In that case, a software developer brought a claim against another developer under section 1201(a)(1) based on the defendant's use of passwords and user names legitimately obtained from plaintiff by a third party to access the plaintiff's software application. Id. at 888. The court found the facts to be indistinguishable from those of I.M.S. and on the basis of the reasoning in that case concluded that the plaintiff's DMCA claim failed. Id. at 889. 2. The 321 Studios Line of Cases

In 321 Studios, the court addressed DMCA claims asserted under sections 1201(a)(2) and (b)(1). As in Universal Studios (which the court found to be "instructive and persuasive"), the technology at issue was the DeCSS technology used to decrypt DVDs. 307 F. Supp. 2d at 1089, 1092. The plaintiff was a company that marketed and sold software and instructions for copying DVDs and was seeking a declaratory judgment that its actions did not violate the DMCA. Id. at 1089. The court held that the plaintiff's product "circumvented" the defendant's encryption even

11

1 2 3 4 5 6 7 8 9 10

though it used an authorized key to access the DVDs and such keys are licensed for use in DVD players to allow DVDs to be read. Id. at 1098. The court reasoned as follows: 321 also asserts that its software does not violate § 1201(b)(2) because the software does not "circumvent" encryption. Section 1201(b)(1) defines such circumvention, as "avoiding, bypassing, removing, deactivating, or otherwise impairing a technological measure," and 321 states that its software does not avoid, bypass, remove, deactivate, or otherwise impair a technological measure, but that it simply uses the authorized key to unlock the encryption. However, while 321's software does use the authorized key to access the DVD, it does not have authority to use this key, as licensed DVD players do, and it therefore avoids and bypasses CSS. Id. Recently, Judge White followed 321 Studios in another case involving trafficking claims under the DMCA, Microsoft Corp. v. EEE Business Inc., 555 F. Supp. 2d 1051 (N.D. Cal. 2008). In that case, plaintiff Microsoft Corporation sued an individual who sold, without authorization, a 25character alphanumeric code, the "Volume License Key," "which is unique to the licensee and required to be kept confidential under the terms of the Volume License Agreement." Id. at 1059. The court held that "[b]y distributing a VLK without authorization, [the defendant] effectively circumvented Microsoft's technological measure to control access to a copyrighted work in violation of [section 1201(a)(2)] of the DCMA." Id. 3. Analysis

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

Both sides attempt to reconcile these two lines of cases. Defendants assert that the I.M.S. line of cases stands for the proposition that use of passwords and usernames that were issued by the plaintiff (albeit to a third party) does not constitute circumvention under any of the three provisions at issue, that is sections 1201(a)(1), (a)(2) and (b)(1). The 321 Studios line of cases is consistent with this proposition, Defendants assert, because in both 321 Studios and EEE Business Inc., there was no allegation that the parties whose passwords were being used had issued those passwords to a third party. On the other hand, Plaintiff asserts that the I.M.S. line of cases applies only to claims brought under Section 1201(a)(1) and therefore, the 321 Sudios line of cases does not contradict the I.M.S. line of cases.

12

1 2 3 4 5 6 7 8 9 10

The Court is not persuaded that these two lines of cases can be reconciled. Although Defendants attempt to draw a distinction based on whether the passwords were legitimately issued by the plaintiff to some third party or rather, whether they were obtained in some other manner, there is no basis in the reasoning of I.M.S. or in the statute for such a distinction. In fact, the court in Egilman expressly rejected such a distinction, as noted above, stating that "[i]It was irrelevant who provided the username/password combination to the defendant, or, given that the combination itself was legitimate, how it was obtained." 401 F. Supp. 2d at 113. Conversely, the Court finds no suggestion in the case law that the meaning of circumvention is different for claims asserted under section 1201(a)(1) than it is for claims under sections 1201(a)(2) and (b)(1), as Plaintiff suggests. Indeed, as Defendants point out, the same definition applies to sections (a)(1) and (a)(2). Rather, the Court concludes that the two lines of cases reach contradictory results. In both 321 Studios and EEE Business Inc., the courts concluded that access keys that are used without authorization fall within the definition of circumvention because they avoid and bypass a technological measure. This Court follows the approach taken in 321 Studios and EEE Business, Inc. and holds that unauthorized distribution of passwords and usernames avoids and bypasses a technological measure in violation of sections 1201(a)(2) and (b)(1). The Court does not find persuasive the reliance of the I.M.S. court on Universal Studios to justify the distinction it draws between passwords that are issued by a plaintiff and other types of technologies. The Court notes, in particular, that in Universal Studios, the Second Circuit analogized the DeCSS technology at issue in that case with a "skeleton key" or a "combination that can open a locked door." 273 F.3d at 453. The reasoning of the I.M.S. court ­ that a password somehow does not fall within this description, is not well-founded. Rather, a combination to a lock appears to be essentially the same as a password. Nor does the Court find support in the statute itself for drawing a distinction between passwords and other types of code that might be used for decryption. Therefore, the Court rejects Defendants' position. Unauthorized use of a password may constitute circumvention under the DMCA.

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

13

1 2 3 4 5 6 7 8 9 10

IV.

CONCLUSION For the reasons stated above, the Motion is DENIED. IT IS SO ORDERED.

Dated: April 5, 2010

JOSEPH C. SPERO United States Magistrate Judge

United States District Court

11
For the Northern District of California

12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 14