Arvest Bank v. RSA Securities Inc. et al

Filing 121

Judge Indira Talwani: ORDER entered. MEMORANDUM AND ORDER. The 73 MOTION for Summary Judgment, that Plaintiff's Claims are Precluded or Time-Barred by the Two Year Bar in the Arvest-RSA License Agreement is ALLOWED IN PART as to C ount I (Breach of the Duty to Defend) and Count IV (Unjust Enrichment). The motion is otherwise DENIED.The 89 MOTION for Partial Summary Judgment is ALLOWED as to the timeliness of the indemnity claim, and will be further addressed by the court separately. (DaSilva, Carolina)

UNITED STATES DISTRICT COURT
DISTRICT OF MASSACHUSETTS

ARVEST BANK,
Plaintiff,
v.
RSA SECURITY INC.,
RSA SECURITY LLC, and
EMC CORPORATION,
Defendants.

*
*
*
*
*
*
*
*
*
*
*

Civil Action No. 1:15-cv-11798-IT

MEMORANDUM AND ORDER
September 27, 2017
TALWANI, D.J.
I.

Introduction
Plaintiff Arvest Bank (“Arvest”) entered into a software license agreement1 with

Defendants RSA Security, Inc., RSA Security LLC, and EMC Corporation’s (collectively,
“RSA”) granting Arvest a license to use RSA’s software as part of Arvest’s online banking
business. This action was commenced after Arvest settled a patent infringement lawsuit brought
against Arvest by non-party Secure Axcess, LLC (the “Secure Axcess litigation”). In the first
three claims for relief, Arvest contends that RSA breached its contractual duties to defend and to
indemnify Arvest, as well as the implied covenant of good faith and fair dealing. Compl. [#1].
Arvest also claims unjust enrichment. Id. Now before the court is RSA’s Motion for Summary

The full text of the operative contract—captioned “Software License and Support Service
Agreement”— is appended as Exhibit 1 to the Declaration of Samuel Brenner [#77], and will
hereinafter be referred to as the “Agreement.”
1

Judgment [#73], which argues that Arvest’s three contract-based claims are time-barred by the
Agreement’s two-year limitation of actions, and that Arvest’s unjust enrichment claim is barred
under Massachusetts law because the Agreement governs the relationship between the parties.
Arvest cross-moved for partial summary judgment as to RSA’s affirmative limitations
defense to Arvest’s indemnification claim. Mot. Partial Summ. J. [#89].2
For the following reasons, RSA’s Motion [#73] is ALLOWED IN PART as to the
contractual duty to defend and unjust enrichment, and DENIED as to the contractual duty to
indemnify. Arvest’s Motion [#89] is ALLOWED IN PART as to the duty to indemnify.
II.

Facts
In December 2006, the parties executed the Agreement, by which RSA granted Arvest a

license to run and use “Licensed Software,” described at Exhibit A to the Agreement. Agreement
¶ 3(a). The Agreement includes an “Intellectual Property Indemnity” provision (“Indemnity
Provision”), which provides in relevant part that:
RSA shall defend, indemnify and hold Licensee . . . harmless from and against all
claims, actions, judgments, awards, expenses (including reasonable attorneys’
fees) and awarded damages assessed against Licensee or agreed to be paid by
RSA in settlement that arise from a claim that the current, unaltered release of the
Licensed Software used in accordance with the terms of this Agreement infringes
a third party copyright, trademark or U.S. patent, as long as Licensee gives RSA
(1) prompt written notice of such claim or action; (2) the right to control and
direct the investigation, preparation, defense, and settlement of the action; and (3)
reasonable assistance and information with respect to the claim or action.
Id. ¶ 11(d)(1). The Agreement contains the following limitation of liability:
Neither party shall bring any action, whether in contract or tort, including
negligence, arising out of or in connection with this Agreement, more than two
years after the cause of action has accrued.
Id. ¶ 13(d).

Arvest’s Motion [#89] also seeks partial summary judgment as to the scope and application of
the Agreement’s indemnity provision, which this court will address in a separate order.
2

2

On March 3, 2011, Arvest’s counsel notified RSA that Arvest had been sued by Secure
Axcess, stating that:
[RSA] has an obligation to defend, indemnify and hold Arvest harmless against
any and all claims that arise from a claim that the licensed software infringes a
U.S. patent. This letter constitutes written notice of the claims against Arvest.
Please confirm that you received this letter and that RSA will comply . . . .
[#77-12].
The next day, March 4, 2011, RSA’s counsel responded, stating:
We have studied the patent-in-suit, and have concluded that RSA’s “site-to-user”
authentication feature clearly does not infringe, nor does any system that utilizes
it in its intended manner. . . . [F]urther, our product is only one piece of the
system implementation, so it’s not clear that the claim is against RSA’s product.
However, we do confirm that if it becomes clear that the claim is against RSA’s
product, RSA will live up to and fulfill its indemnity obligations under applicable
agreements. Further, we will not just stand by, but will actively try to determine
what is be accused.
[#77-13].
On April 21, 2011, RSA’s counsel wrote again to Arvest (after discussing Secure Axcess’
suit with Secure Axcess), stating:
For the reasons discussed below, we are not convinced there is a claim against an
RSA product (e.g. the Passmark product, or any other product). Thus, we believe
it is premature to confirm indemnity and assume defense of this case. . . . [I]f it
becomes clear in the future that there is a claim against an RSA product, and the
other indemnification conditions are met, we will fulfill our indemnity
obligations.
[#77-16].
Just shy of two years later, on April 17, 2013, Arvest’s counsel notified RSA that Arvest
intended to settle the Secure Axcess ligation, stating:
Arvest Bank previously provided notice to [RSA] that Arvest believe that the
claim made by Secure Axcess is within the scope of the indemnity obligations set
forth in the [Agreement]. Arvest also required that [RSA] fulfill its obligation and
defend and indemnify Arvest Bank. [RSA] declined to do so. . . .

3

[I] provided you this information [about Arvest’s intention to settle with Secure
Axcess] and the opportunity to object. You indicated that the position of [RSA]
has not changed and that because you believe no indemnification obligation exists
[RSA] does not object to Arvest’s settlement of this case on terms as outlined or
similar thereto. Arvest intends to move forward with this settlement effort and if a
settlement is reached will be seeking recovery of the settlement amount along
with all of its attorneys’ fees and costs incurred in the lawsuit.
[#77-21].
On May 10, 2013, Arvest and Secure Axcess formally executed their settlement, and on
May 15, 2013, Secure Axcess dismissed its claims against Arvest. Pl.’s Statement of Fact [#91]
¶¶ 80, 81. On August 19, 2013, Arvest’s counsel again wrote to RSA, stating:
The case filed by Secure Axcess, L.L.C. against Arvest Bank has now been
settled and dismissed with prejudice as evidenced by the attached notice. Arvest
spent significant sums of money in defense and settlement of the lawsuit. Because
the case has now been resolved, Arvest asked me to reach out again on its behalf
to request that RSA fulfill its indemnity obligations. RSA was placed on notice of
its obligations by a letter dated March 3, 2011, and again in correspondence dated
April 17, 2013.
[#77-22].
On September 12, 2013, RSA’s counsel responded, stating:
As we explained in my letter of April 21, 2011, the only function of the Passmark
software (i.e. Licensed Software) is to look up the user’s preselected
image/caption in a look-up table and provide it to the bank’s site server when so
requested. As confirmed by Secure Axcess, this functionality is not alleged to
infringe the patent-in-suit. Rather, Secure Axcess alleges infringement by the
overall system that includes software in the bank’s site server and located on the
customer’s computer. Thus, there was no claim that the Licensed Software
infringes a third-party claim. . . .
[F]or the reasons discussed above, we do not believe that RSA has an obligation
to indemnify RSA bank.
[#77-23].
The present action commenced on May 7, 2015.

4

III.

Discussion
a. Limitation of Liability
A Massachusetts cause of action for breach of contract accrues at the breach. Int’l

Mobiles Corp. v. Corroon & Black/Fairfield & Ellis, Inc., 560 N.E.2d 122, 126 (Mass. App. Ct.
1990). The parties’ motions require this court to determine when the alleged breaches of contract
occurred.
Contractual duties to defend and to indemnify are, as their names suggest, distinct, and
are subject to distinct analyses, including distinct accrual dates. Cf. John Beaudette, Inc. v.
Sentry Ins. A. Mut. Co., 94 F. Supp. 2d 77, 100 (D. Mass. 1999) (“The contractual duty to
defend is dependent upon commencement of a lawsuit, and is measured by the allegations of the
underlying complaint. In contrast, the duty to indemnify is dependent upon the entry of a final
judgment, settlement or final resolution by other means. In short, whereas the duty to defend is
measured by the allegations of the underlying complaint, the duty to indemnify is measured by
the facts as they unfold at trial or are inherent in the settlement agreement.”) (internal quotations
and citations omitted) (citing Travelers Ins. Co. v. Waltham Industrial Labs. Corp., 883 F.2d
1092, 1100 (1st Cir. 1989); Boston Symphony Orchestra, Inc. v. Commercial Union Ins. Co.,
545 N.E.2d 1156, 1158 (Mass. 1989) (“It is axiomatic that an insurance company's duty to
defend is broader than its duty to indemnify. An insurer must indemnify its insured when a
judgment within the policy coverage is rendered against that insured. The duty to defend,
however, is antecedent to, and independent of, the duty to indemnify.”)3; see also Sheehan v.

3

RSA contends that these cases are inapplicable because they construe defense and indemnity in
the insurance context, rather than the general commercial context, and because courts routinely
decline to apply law across this divide. But it is more accurate to say courts caution against
exportation of specific aspects of insurance law that are in fact unique to the insurance law
context. For example, in Johnson v. Modern Continental Const. Co., Inc., 731 N.E.2d 96, 99
5

Modern Continental/Healy, 822 N.E.2d 305, 306-07 (Mass. App. Ct. 2005) (noting that even
where a subcontractor’s duty to indemnify may be void by statute, its duty to defend may still
exist—a proposition that would be meaningless unless the duties were distinct).
RSA argues that the claim for both the breach of the duty to defend and the breach of the
duty to indemnify accrued with RSA’s April 21, 2011, letter. RSA is correct as to the duty to
defend, for that duty was (i) allegedly triggered by Arvest’s notifying RSA of the lawsuit, and
(ii) allegedly breached by RSA’s refusal to defend (regardless of the suit’s merits), which left
Arvest to defend itself (at least until RSA changed positions, which it never did). Further,
“accrual of an action for defense costs is not postponed until their full extent can be determined.”
See OneBeacon Am. Ins. Co. v. Narragansett Elec. Co., 31 N.E.3d 1143, 1154 (Mass. App. Ct.
2015) (“Accordingly, we decline to follow those jurisdictions that require resolution of the

(Mass. App. Ct. 2000), on which RSA relies for this argument, the Massachusetts Appeals Court
declined to import into the construction law context a First Circuit case construing law in the
insurance context, because that First Circuit decision was construing a unique iteration of
insurance law regarding a general favoring of the insured in policy interpretation, whereas in
Massachusetts indemnity provisions in contracts are afforded no special treatment. See Caldwell
Tanks, Inc. v. Haley & Ward, Inc., 471 F.3d 210, 215 (1st Cir. 2006). In Great Northern Ins. Co.
v. Paino Associates, 457 F. Supp. 2d 104, 106-07 (D. Mass. 2006), also cited by RSA, the court
analyzed whether a unique insured-insurer exception to the “America Rule” on fees should
extend to contractual indemnitors. And Fidelity Nat. Title Ins. Co. of New York v. Crowley,
2015 WL 4887598, *2 n.4 (Mass. App. Ct. Aug. 18, 2018), on which RSA also relies, the
Massachusetts Appeals Court simply noted that (as here) a breach of a contractual duty accrues
at the breach, and that one must first suffer indemnifiable damages before bringing an action for
indemnity. None of these cases cautions against application of the principle articulated in John
Beaudette into the instant case, and RSA does not otherwise demonstrate why the distinguishing
of defense and indemnity in the insurance context is unique to that context and should be
inapplicable generally. See Air Brake Systems, Inc. v. TUV Rheinland of North America, Inc.,
699 F. Supp. 2d 462, 472 (D. Conn. 2010) (“[Plaintiff] first attempts to distinguish most of the
cases cited by [defendant] by emphasizing that such cases arose in the context of a suit to enforce
coverage under an insurance policy. That is an accurate characterization, so far as it goes, but it
does not diminish the breadth of the general contract-law proposition that those cases endorse.”)
(citation omitted).
6

underlying litigation before the insured's claim for breach of the duty to defend accrues.”)
Arvest’s breach of contract claim as to the duty to defend is therefore time-barred.4
In contrast, a duty to indemnify contemplates reimbursement of loss suffered. See
Indemnify, Black’s Law Dictionary (10th ed. 2014) (“To reimburse (another) for a loss suffered
because of a third party’s or one’s own act or default . . . to promise to reimburse (another) for
such a loss.”) (emphasis added); cf. 275 Washington Street Corp. v. Hudson River Inter., LLC,
987 N.E.2d 194, 199 (Mass. 2013) (“Because an indemnification clause reimburses a landlord
for actual losses arising from termination of the lease after the tenant's default, and because the
precise amount of those losses cannot be ascertained until the end of the period specified in the
lease, a landlord cannot recover losses under an indemnification clause until the end of the period

4

Arvest contends that even were the limitation applicable to the duty to defend, RSA should be
equitably estopped from asserting it, and that in any event, the limitation period should be
deemed non-enforceable as unreasonable.
As to equitable estoppel: it is true, as Arvest notes, that “[t]he doctrine of equitable estoppel . . .
is available when a defendant lulls a plaintiff into a false belief that it is not necessary to
commence suit within the statutory period,” and works to prevent such a defendant from
“benefiting from its own wrongdoing.” Springfield Library and Museum Ass’n, Inc. v. Knoedler
Archivum, Inc., 341 F. Supp. 2d 32, 41 (D. Mass. 2004). But putting aside whether this doctrine
applies to bargained-for limitations periods in contracts—see Air Brake Systems, Inc., 699 F.
Supp. 2d at 474 (“As previously noted, periods of limitation that the parties create by contract
are not susceptible to statutes and doctrines that toll the relevant period of limitation that arises
by statute.”) (emphasis original)—the more essential point is that the record does not allow for
summary judgment that RSA wrongfully lulled Arvest, via relied-upon representations or
promises, into a false sense of security as to RSA’s defense obligations such that equitable
estoppel would be appropriate. As stated, Massachusetts law states that a breach of the duty to
defend accrues when defense is refused, and it appears RSA put Arvest on transparent notice of
its refusal to defend by in fact not assuming defense of the Secure Axcess litigation.
As to unreasonableness: the court does not find the two-year limitations period, bargained-for by
sophisticated parties, to be sufficiently contrary to public policy as to justify its being nonenforceable: there is nothing to indicate an unconscionably short limitations period, a particular
type of underlying agreement that would caution against enforcement, or unequal bargaining
power between the parties. See Creative Playthings Franchising, Corp. v. Reiser, 978 N.E.2d
765, 763-64 (Mass. 2012).
7

specified in the lease.”); Narragansett Bay Ins. Co. v. Kaplan, 146 F. Supp. 3d 364, 372 (D.
Mass. 2015) (“Accordingly, a declaratory judgment is not yet ripe for consideration regarding
the duty to indemnify where, as here, the underlying action has not determined liability or
adjudicated factual disputes.”). Thus, although a refusal of one’s duty to defend accrues when
one so refuses (even if the full extent of damages is not yet determinable, as articulated in
OneBeacon Am. Ins. Co., 31 N.E.3d at 1154), a categorical distinction attends an obligation to
reimburse a party—an obligation tied to resolution of the underlying dispute. The contours of
this point are implicit in OneBeacon Am. Ins. Co., 31 N.E.3d at 1154. There, the Massachusetts
Appeals Court stated that an action for breach of a duty to defend accrues with the insurer’s
failure to defend. But the court employed a different analysis as to indemnity, acknowledging the
principle in Jean Beaudette that indemnification requires that damages be “established.”
Although the court’s analysis centered on whether administrative action by the EPA (untested by
litigation and not yet formally adjudicated) was sufficiently final to trigger an indemnification
obligation by the insurer, such actually reaffirms that finality is a component of an
indemnification action.5
Stated differently, it appears Arvest made a timely demand to RSA to defend the Secure
Axcess suit with its March 3, 2011, letter notifying RSA of the action; but its demand for RSA’s
indemnification was premature until the August 19, 2013, letter, where Arvest stated it “spent

5

Arvest argues that, as to both claims, the April 21, 2011, letter, was equivocal, and thus did not
trigger the limitations date. RSA asserted in that letter that it was not convinced that Secure
Axcess’ claim was against an RSA product, that it was thus “premature to confirm indemnity and
assume defense,” but that RSA would fulfill its “indemnity obligations” if future circumstances
so demand. As noted above, as to the duty to defend, this letter leaves no question that Arvest
needed to undertake its own defense. But as to the duty to indemnify, this letter left RSA’s
obligations open—consistent with the distinction between the two claims recognized by courts
that a final determination of a claim for indemnification should wait “for the facts as they unfold
. . . .” See John Beaudette, Inc., 94 F. Supp. 2d at 100.
8

significant sums of money in defense and settlement of the lawsuit” and demanded that “RSA
fulfill its indemnity obligations.” (emphasis added). Indeed, to conclude that RSA breached its
indemnity obligation upon refusing indemnity at the underlying litigation’s outset would appear
to say that RSA is liable for anticipatory breach, which is a doctrine Massachusetts rejects. See
23 Williston on Contracts § 63:30 (4th ed.) (“[M]assachusetts simply does not accept the
doctrine of anticipatory repudiation as giving rise to an immediate cause of action for
damages.”).
The court does not find the above distinction contradicted by Fall River Housing
Authority v. H.V. Collins Co., 604 N.E.2d 1310, 1312-13 (Mass. 1992). There, in what appears
principally dicta, the Supreme Judicial Court recites the general proposition that “[w]hen there is
an express agreement of indemnity in a contract, a claim for indemnity accrues when there is a
breach of that provision.” Id. at 1312. (emphasis omitted). The Court then provides a general
example that “if a person were injured due to Cape Cod's negligence, then a breach of contract
would occur when Collins pays damages to the injured person because Cape Cod expressly
agreed to pay such damages.” Id. at 1313. But there is no reason not to think the Court there
articulated this hypothetical within the context of Collins paying out a total amount that Cape
Cod was then obligated to pay, and there is nothing dissonant between this proposition and the
one articulated in Jean Beaudette, which stands for the separate point that one’s agreement to
indemnify is not identical to one’s agreement to defend, and that breaches may therefore occur
non-conterminously.
The uncontroverted record demonstrates that Arvest executed its settlement with Secure
Axcess on May 10, 2013. It was upon RSA’s refusal to indemnify Arvest’s losses in the context
of the resolution of the Secure Axcess litigation that Arvest obtained a ripe cause of action for

9

indemnity; consequently, Arvest’s claim for breach of the duty to indemnify is timely.
In sum, RSA’s Motion [#73] is ALLOWED as to the duty to defend claim (Count I) and
DENIED as to the duty to indemnify claim (Count II).6 Arvest’s Motion [#89] is ALLOWED as
to the timeliness of its claim under the duty to indemnify.
b. Unjust Enrichment
“Ordinarily, a claim of unjust enrichment will not lie where there is a valid contract that
defines the obligations of the parties.” Metropolitan Life Ins. Co. v. Cotter, 984 N.E.2d 835, 849
(Mass. 2013). This is because an aspect of unjust enrichment, as a claim in equity, is a lack of
remedy at law—and a breach of contract claim is such a remedy. See Infinity Fluids Corp. v.
Gen. Dynamic Land Sys., Inc., 210 F. Supp. 3d 294, 309 (D. Mass. 2016). As a result, damages
between the two theories are mutually exclusive, despite the fact that courts will often allow a
party to proceed in the alternative as a case develops. See Lass v. Bank of America, N.A., 695
F.3d 129, 140 (1st Cir. 2012); Whitman & Co., Inc. v. Longview Partners (Guernsey) Ltd., 140
F. Supp. 3d 138, 140-41 (D. Mass. 2015).
Here, Arvest’s claim for unjust enrichment is premised on its having paid RSA the
licensing fee contemplated by the Agreement, but having not received the benefit of RSA’s duty
to indemnify or defend. Compl. [#1] 11. Arvest claims such is distinct from its claims in
contract. But Arvest has not demonstrated how such a claim that RSA failed to perform its duty
under a contract, and that Arvest is entitled to fees it paid pursuant to that contract, is not simply
a claim for breach with a demand for restitution damages. In other words, RSA’s duties to Arvest
with regard to RSA’s indemnification/defense and Arvest’s obligations with regard to licensing

Because the claim for breach of the duty to indemnify is not barred, RSA’s Motion [#73] as to
Arvest’s claim for beach of the implied covenant of good faith and fair dealing is also DENIED.
6

10

payments are all governed by the Agreement and, as such, are remediable at law to the exclusion
of unjust enrichment’s remedy in equity. There is no indication that further evidence would
sustain an unjust enrichment theory so as to prefer allowing Arvest to proceed in the alternative,
and thus RSA’s Motion [#73] as to unjust enrichment (Count IV) is ALLOWED.
IV.

Conclusion
For the foregoing reasons, RSA’s Motion [#73] is ALLOWED IN PART as to Count I

(Breach of the Duty to Defend) and Count IV (Unjust Enrichment). The motion is otherwise
DENIED.
Arvest’s Motion [#89] is ALLOWED as to the timeliness of the indemnity claim, and
will be further addressed by the court separately.
IT IS SO ORDERED.
September 27, 2017

/s/ Indira Talwani
United States District Judge

11