Case 3:22-cv-07611-WHA Document 373 Filed 05/24/24 Page 1 of 9
`
`
`
`
`
`
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`SPLUNK INC.,
`
`
`
`v.
`
`CRIBL, INC.,
`
`Plaintiff,
`
`Defendant.
`
`
`
`
`No. C 22-07611 WHA
`
`
`
`ORDER RE REMAINING
`CLAIMS AND DEFENSES,
`AND INJUNCTIVE RELIEF
`
`
`
`This order addresses the claims and affirmative defenses preserved by the parties and
`
`tried to the bench, as well as plaintiff Splunk Inc.’s motion for a permanent injunction (Dkt.
`
`Nos. 346–48).
`
`1.
`
`AFFIRMATIVE DEFENSES.
`
`Starting with the affirmative defenses, defendant Cribl, Inc. seeks judgment in its favor
`
`on account of equitable estoppel, unclean hands, and copyright misuse.
`
`First, the elements of equitable estoppel are (1) the party to be estopped must know the
`
`facts; (2) the party to be estopped must intend that its conduct shall be acted on or must so act
`
`that the party asserting estoppel has a right to believe the conduct is so intended; (3) the party
`
`asserting estoppel must be ignorant of the true facts; and (4) the party asserting estoppel must
`
`rely on the conduct to its injury. Baccei v. United States, 632 F.3d 1140, 1147 (9th Cir. 2011)
`
`(citation omitted). At a minimum, Cribl has not met its burden of proving, by clear and
`
`
`
`
`
`
`
`
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:22-cv-07611-WHA Document 373 Filed 05/24/24 Page 2 of 9
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`convincing evidence, that it was ignorant of the true facts. For example, Cribl has not met its
`
`burden of proving, by clear and convincing evidence, that it believed Splunk approved of uses
`
`of Splunk Enterprise that were permitted under the TAP contract but not under the SGT
`
`contract, which governed once the TAP contract was terminated for cause in November 2021.
`
`Cribl made no meaningful attempt to justify the argument it understood Splunk’s position to be
`
`that Cribl would retain all rights it merely licensed under the TAP contract once the TAP
`
`contract was terminated. If that had been the case, why would Splunk have terminated the
`
`TAP contract to begin with? Meanwhile, Cribl has not met its burden of proving, by clear and
`
`convincing evidence, that it ever believed Splunk approved of its reverse engineering. Indeed,
`
`there is ample evidence in the trial record to support the proposition that Cribl understood
`
`Splunk did not (or would not) approve, so Cribl did not seek to “rock the boat.”
`
`Second, unclean hands “closes the doors of a court of equity to one tainted with
`
`inequitableness or bad faith relative to the matter in which he seeks relief, however improper
`
`may have been the behavior of the defendant.” Adler v. Fed. Republic of Nigeria, 219 F.3d
`
`869, 876–77 (9th Cir. 2000). “Bad intent is the essence of the defense of unclean hands.”
`
`Dollar Sys., Inc. v. Avcar Leasing Sys., Inc., 890 F.2d 165, 173 (9th Cir. 1989). Cribl’s
`
`argument that it was terminated from the TAP program in bad faith was submitted to and
`
`rejected by the jury. Although the judge found Cribl’s argument that the TAP contract was
`
`improperly terminated because Cribl did not “become” a competitor colorable, the jury did not
`
`agree based on its response to Special Interrogatory A (Dkt. No. 327 at 3). In light of that, this
`
`order cannot reasonably find that Cribl has proven, by clear and convincing evidence, that it
`
`was terminated from the TAP program in bad faith. Nor can this order reasonably find that
`
`Cribl has proven, by clear and convincing evidence, that Splunk induced infringement and
`
`breach on account of improper termination, as Cribl now argues, seeing that the jury rejected
`
`Cribl’s argument that the termination was improper to begin with.
`
`Third, as for copyright misuse, our court of appeals has recognized that it “forbids a
`
`copyright holder from ‘secur[ing] an exclusive right or limited monopoly not granted by the
`
`Copyright Office.’” A & M Records, Inc. v. Napster, Inc., 239 F.3d 1004, 1026 (9th Cir. 2001)
`
`2
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:22-cv-07611-WHA Document 373 Filed 05/24/24 Page 3 of 9
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`(quoting Lasercomb Am., Inc. v. Reynolds, 911 F.2d 970, 977–79 (4th Cir. 1990)). It thereby
`
`“prevents copyright holders from leveraging their limited monopoly to allow them control of
`
`areas outside the monopoly.” Ibid. True, our court of appeals has held that copyright misuse is
`
`a “defense to copyright infringement” and “not a defense to [] state law claims.” Altera Corp.
`
`v. Clear Logic, Inc., 424 F.3d 1079, 1090 (9th Cir. 2005). But Splunk is incorrect when it
`
`suggests this means copyright misuse cannot be used to bar enforcement of language in a
`
`licensing agreement that facilitates the misuse at issue. Indeed, “most of the cases that
`
`recognize the affirmative defense of copyright misuse involve unduly restrictive licensing
`
`schemes.” A & M Records, 239 F.3d at 1027 n.8. Incorporating unduly restrictive language
`
`into a licensing agreement is how copyright holders generally secure an exclusive right or
`
`limited monopoly not granted by the Copyright Office. Altera stands for the straightforward
`
`proposition that “it makes little sense to allow [a party] to proceed on an independent claim for
`
`copyright misuse when there has been no allegation of copyright infringement.” 424 F.3d
`
`at 1090.
`
`Cribl appears to invite this district court to broadly enter judgment in its favor under the
`
`doctrine of copyright misuse. That cannot be right. Note the verdict is ambiguous concerning
`
`the extent to which the jury found Cribl liable for breaching the SGT contract. On the one
`
`hand, it might have found that several uses of the Splunk Enterprise copyrighted software by
`
`Cribl violated the “internal business purposes” use restriction in Section 9(c) and monitoring
`
`for competitive purposes use restriction in Section 9(e). On the other hand, it might have
`
`found that only the marketing uses did so. In any event, it cannot be said that Cribl has
`
`established that it should get off scot-free because some (but not all) of its uses of Splunk
`
`Enterprise were fair uses, notwithstanding all language in the SGT contract.
`
`A narrower case could have been made that copyright misuse bars enforcement of
`
`language in that licensing agreement to the extent it would prohibit fair use. No court of
`
`appeals has yet to extend copyright misuse to language that prohibits fair use specifically,
`
`though some have come close. See, e.g., Assessment Techs. of WI, LLC v. WIREdata, Inc.,
`
`350 F.3d 640, 646 (7th Cir. 2003) (Judge Richard Allan Posner) (observing that restricting
`
`3
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:22-cv-07611-WHA Document 373 Filed 05/24/24 Page 4 of 9
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`access to one’s uncopyrighted data within a copyrighted computer program by contract might
`
`constitute copyright misuse). Recognizing that Cribl did not advance the argument, however,
`
`and that any appeal will be to the Federal Circuit tasked with applying Ninth Circuit law on the
`
`issue, this would be an inappropriate vehicle to seek the Ninth Circuit’s opinion on it. What’s
`
`more, seeing that the injunction granted herein, as tailored, will afford Cribl the relief it could
`
`have attained by way of copyright misuse, it is also immaterial.
`
`2.
`
`SECTION 17200 CLAIM AND COUNTERCLAIM.
`
`Next, we turn to Splunk’s claim and Cribl’s counterclaim under Section 17200 of the
`
`California Business and Professions Code.
`
`Starting with Splunk’s Section 17200 claim, at this late stage in the litigation, Splunk
`
`sought to premise a violation only on Cribl’s breach of the SGT contract. Specifically, Splunk
`
`argued that Cribl violated the unlawful and unfair prongs of Section 17200. With respect to
`
`the unlawful prong, our court of appeals has held that breaches of contract alone are
`
`insufficient to state a claim for unlawful violation of Section 17200. See, e.g., Shroyer v. New
`
`Cingular Wireless Servs., 622 F.3d 1035, 1043–44 (9th Cir. 2010). Splunk averred that
`
`systematic breaches of contract are sufficient, but the decisions it cited are distinguishable. As
`
`a concession to the shortness of life, this order directs the reader to the reasons provided in
`
`Cribl’s brief (Cribl Section 17200 Opp. 2–7).
`
`Turning to the unfair prong, as Cribl recognizes, Splunk’s motion is replete with
`
`decisions applying the traditional balancing test for claims brought by consumers. But “[t]he
`
`California Supreme Court has rejected the traditional balancing test for [Section 17200] claims
`
`between business competitors and instead requires that claims under the unfair prong be
`
`‘tethered to some legislatively declared policy.’” Hadley v. Kellogg Sales Co., 243 F. Supp. 3d
`
`1074, 1104 (N.D. Cal. 2017) (Judge Lucy H. Koh) (quoting Cel-Tech Commc’ns, Inc. v. L.A.
`
`Cellular Tel. Co., 973 P.2d 527, 544 (Cal. 1999)). “In competitor cases, a business practice is
`
`‘unfair’ only if it ‘threatens an incipient violation of an antitrust law, or violates the policy or
`
`spirit of one of those laws because its effects are comparable to or the same as a violation of
`
`the law, or otherwise significantly threatens or harms competition.’” Drum v. San Fernando
`
`4
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:22-cv-07611-WHA Document 373 Filed 05/24/24 Page 5 of 9
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Valley Bar Assn., 182 Cal. App. 4th 247, 254 (Cal. Ct. App. 2010) (quoting Cel-Tech, 973 P.2d
`
`at 544). Here, however, Splunk has not sufficiently pleaded any incipient violation of antitrust
`
`law, or violation of the policy or spirit of antitrust law, let alone any threat or harm to
`
`competition, beyond mere generalizations. See Levitt v. Yelp! Inc., 765 F.3d 1123, 1136–37
`
`(9th Cir. 2014). Rather, it has focused on harm to itself, a competitor (and an incumbent).
`
`This is inadequate to state a claim for unfair violation of Section 17200.
`
`As for Cribl’s Section 17200 counterclaim, Cribl seeks to premise an unfair violation on
`
`copyright misuse. This order finds a Section 17200 claim can be premised on copyright
`
`misuse where that copyright misuse violates the policy or spirit of antitrust law. See Apple Inc.
`
`v. Psystar Corp., No. C 08-03251 WHA, 2009 WL 303046, at *5 (N.D. Cal. Feb. 6, 2009). In
`
`light of the issues raised above, however, and seeing that the tailored injunction granted herein
`
`has the effect of affording Cribl the relief that Cribl could have attained under the
`
`counterclaim, this order does not address it further.
`
`Before turning to injunctive relief, this order observes that Cribl has recently sought to
`
`broadly recast its affirmative defenses and counterclaim based on the judge’s recent decision in
`
`another matter in which a party asserted a copyright preemption defense (see, e.g., Cribl Supp.
`
`Br. 1 (quoting X Corp. v. Bright Data Ltd., No. C 23-03698 WHA, 2024 WL 2113859, at *13
`
`(N.D. Cal. May 9, 2024)). This is too little too late. “Cribl, mindful of the Court’s request that
`
`[it] be selective in choosing which of its equitable defenses and counterclaims to pursue with
`
`the Court, [] narrowed its requests for determination” (Cribl Br. 1). In doing so, it deliberately
`
`“preserve[d] and assert[ed] its copyright preemption defense . . . to the extent it applie[d] to
`
`Splunk’s pending claim of violation of California’s [Section 17200]” (Cribl Br. 21). This order
`
`declines to allow Cribl to strategically pivot and try again after the fact. That said, it observes
`
`that Cribl’s general concerns will be addressed in the injunctive relief analysis below.
`
`3.
`
`INJUNCTIVE RELIEF.
`
`Finally, this order takes up Splunk’s motion for a permanent injunction, premised on the
`
`jury’s findings of copyright infringement and breach of the SGT contract (not Splunk’s failed
`
`5
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:22-cv-07611-WHA Document 373 Filed 05/24/24 Page 6 of 9
`
`
`
`Section 17200 claim). The question that remains to be decided is whether injunctive relief is
`
`appropriate and, if so, the scope of that injunctive relief.
`
`As for the standard,
`
`Under the Copyright Act . . . a court is authorized to grant a
`permanent injunction “on such terms as it may deem reasonable to
`prevent or restrain” further infringement of a copyright . . . . Such
`relief, however, does not automatically issue upon a finding of
`liability. Rather, a plaintiff must show entitlement to a permanent
`injunction by demonstrating: (1) that it has suffered an irreparable
`injury; (2) that remedies available at law, such as monetary
`damages, are inadequate to compensate for that injury; (3) that,
`considering the balance of hardships between the plaintiff and
`defendant, a remedy in equity is warranted; and (4) that the public
`interest would not be disserved by a permanent injunction.
`
`Apple Inc. v. Psystar Corp., 673 F. Supp. 2d 943, 948 (N.D. Cal. 2009), aff’d, 658 F.3d 1150
`
`(9th Cir. 2011) (citing eBay Inc. v. MercExchange, L.L.C., 547 U.S. 388, 391 (2006)). Under
`
`California law, the same four-factor analysis has been used to enjoin breaches of contract
`
`where remedies at law were inadequate. See, e.g., Nat’l Abortion Fed’n v. Ctr. for Med.
`
`Progress, 533 F. Supp. 3d 802, 811 (N.D. Cal. 2021) (Judge William H. Orrick), aff’d, No. 21-
`
`15953, 2022 WL 3572943 (9th Cir. Aug. 19, 2022). This order evaluates injunctive relief for
`
`both copyright infringement and breach of the SGT contract using the eBay factors.
`
`At the outset, it bears emphasis that Section 9(a) of the SGT contract prohibited “reverse
`
`engineering (except to the extent specifically permitted by statutory law),” as explained in the
`
`final charge for the second phase of argument and deliberations (Dkt. No. 317 at 6–7). And, as
`
`explained in the companion memorandum opinion on fair use, Section 107 of the Copyright
`
`Act allowed copying and uses of the Splunk Enterprise copyrighted software for the purpose of
`
`reverse engineering the S2S protocol. It also allowed copying and uses of the Splunk
`
`Enterprise copyrighted software for the purposes of testing and troubleshooting Cribl Stream
`
`for interoperating with the Splunk Enterprise copyrighted software.
`
`One question teed up by the briefing of the motion for a permanent injunction is whether
`
`the SGT contract’s use restrictions governing “internal business purposes” (in Section 9(c))
`
`and monitoring for competitive purposes (in Section 9(e)) could override and disallow those
`
`statutory fair uses, as Splunk argued in its motion and at the hearing. As a matter of contract
`
`6
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:22-cv-07611-WHA Document 373 Filed 05/24/24 Page 7 of 9
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`interpretation, this order finds they cannot. Why go through the trouble of spelling out how the
`
`SGT contract preserved the extent to which statutory law protects reverse engineering if such
`
`restrictions could override and disallow this anyways? Meanwhile, copying and using Splunk
`
`Enterprise to reverse engineer the S2S protocol, as required to viably interoperate Cribl Stream
`
`with Splunk Enterprise, accomplishes nothing if Cribl cannot copy and use Splunk Enterprise
`
`to test and troubleshoot Cribl Stream for maintaining the interoperability. Such ambiguity in
`
`the SGT contract will be resolved against the drafter, Splunk, so as to ultimately allow all
`
`statutory fair uses of Splunk Enterprise. Keep in mind, however, that copying and using
`
`Splunk Enterprise to market Cribl Stream was not and is not a statutory fair use.
`
`The verdict is ambiguous concerning the extent to which the jury found Cribl liable for
`
`infringing Splunk’s copyright. And, as already mentioned, it is all the more ambiguous
`
`concerning the extent to which the jury found Cribl liable for breaching the SGT contract. On
`
`the one hand, it might have found that several uses of Splunk Enterprise by Cribl violated the
`
`“internal business purposes” and monitoring for competitive purposes use restrictions. On the
`
`other hand, it might have found that only the marketing uses did so. Assuming, arguendo, the
`
`broadest possible finding of liability (contrary to the interpretation above), this order holds that
`
`an injunction is warranted but the balance of the hardships as well as the public interest militate
`
`against the broadest possible injunction.
`
`With respect to irreparable injury, this order credits Splunk’s observation that
`
`“[p]ermitting Cribl to continue operating as if it possessed a TAP license, and to indefinitely
`
`flout the scope of the SGT and Sections 9(c) and 9(e) in particular, would render both Splunk’s
`
`TAP program and the SGT pointless” (Splunk Injunction Br. 13–14). Just because certain uses
`
`of the Splunk Enterprise copyrighted software are fair uses under the Copyright Act does not
`
`mean that Splunk must relinquish all control of its copyrighted software, as Cribl appears to
`
`suggest. Likewise, with respect to inadequate remedies at law, this order credits Splunk’s
`
`observation that no monetary remedy can restore Splunk’s ability to administer its own
`
`licensing program, which is basically essential to being a contemporary software company
`
`7
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:22-cv-07611-WHA Document 373 Filed 05/24/24 Page 8 of 9
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`(Splunk Injunction Br. 16). As such, the first two eBay factors strongly favor an injunction.
`
`But the remaining two eBay factors strongly favor a narrower one.
`
`With respect to the balance of the hardships, a consideration that weighs heavily against
`
`Splunk is the whole history of its TAP “partnership” program and how that program led Cribl,
`
`as a “partner,” to invest many millions in developing its product that extended the features and
`
`functionality of Splunk Enterprise only for Splunk to then pull the rug out from under it. After
`
`all, the jury found that Splunk terminated Cribl’s TAP membership not on account of breaches
`
`of confidentiality obligations and misappropriation, as Splunk had argued, but rather on
`
`account of competition, according to Special Interrogatories A and B (Dkt. No. 327 at 3).
`
`Originally, Splunk welcomed Cribl as a TAP partner specifically to develop a complementary
`
`product like Cribl Stream, and the TAP contract expressly acknowledged that the parties could
`
`cooperate to develop complementary products that were “competitive,” i.e., to engage in
`
`“coopetition.” So, Cribl built its product and operated as a TAP partner from October 2018 to
`
`November 2021.
`
`During the last fifteen months of that partnership period, however, Splunk’s internal
`
`documents showed that Splunk was planning to terminate Cribl as a partner as soon as Splunk
`
`could improve its own inferior product (DSP) that it was developing to compete with Cribl
`
`Stream, which it finally did (after releasing Ingest Actions) in November 2021. Throughout
`
`that time, Cribl continued to invest in Cribl Stream, unaware of Splunk’s termination plan. In
`
`other words, this was not a case of a copyright pirate selling knockoffs. This was a case of a
`
`“partner” being invited in by a copyright owner to use the copyrighted work, and to invest
`
`millions in designing and developing a complementary product, only to be terminated after all
`
`that effort was made. There is a large equity point on the scale favoring the terminated partner,
`
`Cribl. The sweeping injunction sought by Splunk could easily put Cribl out of business.
`
`With respect to the public interest, Cribl Stream has been favorably received by
`
`customers. Dr. Chris Mattman, a witness who worked at the NASA Jet Propulsion Laboratory,
`
`which is a customer of both Splunk and Cribl, praised its performance on the stand. The trial
`
`record demonstrated that Cribl Stream could save Splunk customers money by redirecting junk
`
`8
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:22-cv-07611-WHA Document 373 Filed 05/24/24 Page 9 of 9
`
`
`
`data to make room in Splunk Enterprise for useful data, a win for customers (and often Splunk
`
`too). In addition, the jury found Cribl Stream’s S2S capability reflected a “transformative use”
`
`of Splunk Enterprise that benefited the public. A sweeping injunction would disserve the
`
`public by preventing Cribl from continuing to viably interoperate with Splunk Enterprise
`
`moving forward. Customers will need updates to account for changes made to Splunk
`
`Enterprise and the S2S protocol. This, too, weighs against a sweeping injunction.
`
`In evaluation of the eBay factors and, in particular, the balance of the hardships and the
`
`public interest — all arising out of the course of dealing and history of Splunk and Cribl, the
`
`“partnership” program, and this court case — this order finds that the appropriate course is to
`
`allow Cribl to continue using the Splunk Enterprise copyrighted software for all fair uses under
`
`the Copyright Act but to enjoin Cribl from other uses, including uses for marketing purposes.
`
`The parties shall meet and confer to provide terms outlining a mechanism for enforcement of
`
`this injunction, which may include depositions and site visits, by JUNE 4, 2024, AT NOON. The
`
`parties shall also jointly file a proposed judgment that covers all issues addressed in this action
`
`at that time.
`
`IT IS SO ORDERED.
`
`
`
`Dated: May 24, 2024.
`
`
`
`
`
`
`
`WILLIAM ALSUP
`UNITED STATES DISTRICT JUDGE
`
`9
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`