Scott & Scott | Software Compliance Counsel
Scott & Scott Scott & Scott

May 14, 2008

Trademark Infringement Verdict – Over $300 Million in Damages

Companies concerned about trademark issues should take note of a recent federal court verdict in an infringement case. On May 7, 2008, a jury in Oregon awarded Adidas $305 million in damages for trademark infringement by Payless Shoes, which is owned by Kansas-based Collective Brands. The jury’s award is believed to be the largest trademark verdict ever.

Adidas alleged that Payless purchased multiple versions of Adidas’s three-stripe sneakers, sent them to China where copies were manufactured with either two or four stripes, then sold approximately 30 million pairs of the copies in its stores. Sales for the shoes totaled approximately $400 million. The verdict form in the case included pictures of more than 200 shoe styles that Adidas alleged infringed its trademarks. The jury awarded $30 million in actual damages for trademark and trade dress infringement, trademark and trade dress dilution, and unfair and deceptive trade practices. The jury also found that Payless acted willfully and ordered it to disgorge its profits from the infringing shoes, approximately $137 million. The jury also awarded approximately $137 million in punitive damages. Based on the willfulness finding, the court may also award attorney’s fees and has the option of trebling the actual damages award. Payless has indicated that it will ask the court to set the verdict aside and pursue an appeal if necessary.

The verdict form itself may be accessed here: http://s.wsj.net/public/resources/documents/WSJ_JuryVerdict_No861.pdf

Arbitrators Cannot be Disqualified Based on Voluntary Disclosures

In a case of first impression, the California Court of Appeal has rejected an attempt to disqualify an arbitrator after the arbitrator volunteered information that was not required to be disclosed under the rules and statutes governing arbitration. In Luce, Forward, Hamilton & Scripps, LLP v. Koch, 2008 WL 1886606 (Cal. App. 2008), the Court of Appeal, Fourth Appellate District, held that the arbitrator could not be disqualified based on information he voluntarily disclosed orally during the proceedings.

Luce Forward filed a breach of contract suit against four former clients who had retained the firm to represent them in a complex securities litigation. Other than their initial retainer, the former clients did not pay Luce Forward any fees, and after filing suit, Luce Forward successfully compelled arbitration under the fee agreements, which contained an arbitration clause. Judge J. Richard Haden, a retired Superior Court judge with the Judicial Arbitration and Medication Services (“JAMS”) was selected as the arbitrator. As required by the rules, the Judge Haden sent the parties a written disclosure indicating that he had served as mediator in three cases in which Luce Forward was a party and attorneys at the firm participated as counsel in those mediations. The judge indicated that the mediations did not concern issues arising in this case and stated that he did not believe that his prior work would impact his ability to be fair. None of the parties challenged the disclosure.

After the arbitration commenced, the judge stated that after reviewing the witness list and the pleadings the weekend before the arbitration, he discovered that he had served on the board of a local trial lawyers’ association with one of the witnesses and one of the firm’s lawyers. Koch then requested that the judge disqualify himself, but the judge denied that challenge. Ultimately, the judge issued an award in favor of the law firm, and the award was confirmed by the superior court.

The Court of Appeal rejected Koch’s contention that Judge Haden was required to disqualify himself based on the disclosures made during the arbitration. According to the court, “Judge Haden was not legally required to make any disclosures pertaining to” the witness of the attorney where “there was no indication Judge Haden had a personal relationship, or close friendship” with either of them. There was no evidence of a business relationship, and serving on a volunteer board or participating in the same professional organizations did not create one. Generally, no disclosure is required when there has been slight or attenuated contact because “arbitrators cannot sever all their ties with the business world” or the legal community. The court noted that “under the defendants’ theory, an arbitrator could be disqualified during arbitration for orally revealing even the most attenuated contact with a party’s counsel or witness, such as occasionally shopping at the same grocery store.”

Because Judge Haden was not required to make the disclosures, he also was not obligated to disqualify himself after voluntarily disclosing the relationships. The judge complied with the disclosure obligations under the statutes, and an arbitrator may only be disqualified “when the disclosure is legally required.”

Full Opinion Text: http://www.courtinfo.ca.gov/opinions/documents/D049788.PDF

New Potential Liability for Internet Service Providers

The U.S. District Court in New Hampshire recently issued a written opinion that undoubtedly will give some Internet service providers reason to re-think their policies with regard to some anonymous user accounts. In Doe v. Friendfinder Network, Inc., the plaintiff discovered prior to filing suit that an unnamed individual had created a number of profiles using information about the plaintiff’s identity on various social networking websites operated by the defendants and oriented toward people seeking sexual relationships with others. The plaintiff sued defendants on various state-law claims arising out of the allegedly false and unauthorized personal advertisements. In its opinion, the court addressed the defendants’ motion to dismiss, which asserted that the plaintiffs’ claims were barred by the Communications Decency Act of 1996. That Act provides, in part, that “[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider,” which the Act further defines as “any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service.”

The court held that the Act did work to bar all of the plaintiff’s state-law claims, except for one: invasion of privacy, to the extent that the plaintiff’s claim was based on the right of publicity. The court specifically looked to an exception in the Act, which provides: “[n]othing in this section shall be construed to limit or expand any law pertaining to intellectual property.” The court stated that a state-law right of publicity claim arises from a “law pertaining to intellectual property,” and it further held that state-law intellectual property claims are within the scope of the Act’s exception. In so holding, the court expressly disapproved the 9th Circuit’s opinion in Perfect 10, Inc. v. CCBill, LLC, where it held last year that the exception only extended to claims based on violations of federal laws pertaining to intellectual property.

The Friendfinder case may be one to watch for at least two reasons. First, it has the potential to set up a conflict between two federal circuits, which may help lead to or hasten review by the Supreme Court. (A petition for certiorari was denied following the 9th Circuit’s ruling in the CCBill case.) Second, if the trial court’s opinion in Friendfinder prevails, then Internet service providers – especially those operating social networking sites (which now include heavy-hitters such as Facebook and Second Life) – may face the daunting prospect of having to verify the validity of information entered in users’ personal profiles in order to avoid exposure from state-law claims based on violation of a third party’s right of publicity. Such a precedent could mean significant changes to the way such sites operate today.

District Court Clarifies Exclusive Right to Distribution

An Arizona district judge recently reconsidered its decision to grant summary judgment in favor of a group of recording companies in Atlantic Recording Corporation et al. v. Howell. The record companies accused Mr. and Mrs. Howell of using music-sharing software KaZaA to share music files in violation of the Copyright Act. The Howells, proceeding pro se, argued that KaZaA shared Mr. Howell’s private music folder without his authorization or knowledge. Mr. Howell denied placing music files in KaZaA’s shared folder, which allows public access to computer files. The district court originally granted summary judgment based on the record companies’ evidence that Mr. Howell admitted he shared copyrighted materials through KaZaA. However, upon reconsideration, the court determined that Mr. Howell never admitted he disseminated the materials.

The Copyright Act provides in section 106(3) that the owner of a copyright possesses, among other rights, the exclusive right to distribute copies of the copyrighted work. Although the Copyright Act does not define “distribute,” the court followed precedent from other jurisdictions and determined that actual dissemination of either copies or phonorecords is required to demonstrate a violation of Section 106.

The court concluded that unless a copy of the work is transferred “by sale or other transfer of ownership, or by rental, lease, or lending,” there is no distribution. Judge Wake added that merely making available an unauthorized copy for public access is does not violate the copyright owner's exclusive right to distribution. Combined with other circumstantial evidence, such conduct may create liability, but it is insufficient on its own to result in a copyright violation.

Although the record companies may ultimately prevail on their copyright claims, the court’s ruling makes it difficult for plaintiffs in Arizona to prevail merely by showing that copyrighted material was available on a file-sharing network without an additional showing that the defendant affirmatively disseminated the material.

To view the court’s opinion, click here.

The Use of Pricing Schedules in Managed Service Provider Agreements

Many managed service providers incorporate their pricing and payment terms into their Master Services Agreements or their Service Level Agreements. While it is important to ensure that the financial arrangements are clearly delineated in writing to ensure that everyone’s expectations are clear, it is equally important to allow Managed Service Providers (“MSPs”) to adjust their prices when circumstances justify an increase.

One way to allow for flexibility is to extract the pricing information from the Master Services Agreement or Service Level Agreement and include a pricing addendum to the agreements. With a separate pricing document, an MSP can adjust the price without revising an entire MSA or SLA. Because many agreements span several years, MSPs should protect themselves by reducing the possibility that a price increase will result in a renegotiation of all the MSP agreements. For example, a managed services client who is presented with a revised agreement containing new pricing and a description of services identical to the original agreement may insist on renegotiating the scope of services provided. However, if the original agreement contains a provision allowing for periodic increases in pricing, and if the pricing document is separate from the core agreements, the MSP may be able to increase its prices, send an updated pricing addendum, and avoid renegotiating the terms of the rest of the agreement.

It is important to consider whether to allow your clients to terminate the agreement in the event of a price increase. Many MSPs want to use price increases as a way to jettison underperforming clients. To achieve that objective, these MSPs allow their customers to terminate the agreement if the MSP increases the price. Others want to have the right to increase the price by a certain percentage without the possibility of cancellation. Like other components of an agreement, the pricing provisions should be specifically tailored to meet the business objectives of each MSP. Experienced counsel can assist MSPs with using documents to reduce risks and increase client satisfaction.

Master Service Agreements

The master service agreement for MSP's defines the terms and conditions of the relationship between the MSP and its client related to all managed services and project based work. There are several critical provisions that are necessary to protect the MSP's legal rights in a master service agreement. The indemnification provision of the master service agreement is one of the most frequenty negotiated by MSP's and their clients.

The indemnification provision of a master service agreement sets forth the risks that each party will be undertaking in the event of a claim or loss arising out of or relating to the services being provided. The indeminication section of a master service agreement frequently will say "MSP agrees to defend, indemnify, and hold customer harmless for any and all claims . . . ." End-users frequenly seek broad indemnification language from the MSP defining the scope of claims covered as broadly as possible. The MSP should be careful not to assume legal risks that can be adverse to its business in the event of a claim by it customer or a third-party. We recommend that all MSP's carry professional liability insurance and that the indemnity provisions in the master service agreement are carefully tailored to the coverages provided under the insurance contract.

For example, if the MSP has Managed Service Professional Liability insurance, the indemnity provision in the MSP Master Service Agreement should be drafted so the MSP agrees to contractually provide the same indemnities that the insurance company covers. By tailoring the indemnification to the language in the professional liability insurance, the MSP is able to offer broad indemnification to its clients without undertaking risks for which insurance has not been obtained.

April 30, 2008

Record Companies Ordered to Pay Attorney's Fees

The District Court of Oregon recently ordered a group of record companies to pay an accused file-sharer's attorneys’ fees in the amount of $300,000 for defending her suit over a two-year period. Plaintiffs Atlantic Recording Corp., Priority Records LLC, Capitol Records Inc., UMG Recordings Inc., and BMG Music accused Tanya Andersen of sharing more than 1,000 music files from her computer via the peer-to-per file sharing network Kazaa in 2005.

The plaintiffs were unable to locate sufficient evidence to convince the court that the Defendant infringed any copyrights and attempted to depose Andersen's 10-year-old daughter. Eventually, the record companies stipulated to a dismissal of the case with prejudice. Andersen thereafter moved to recover attorney's fees.

The record companies disputed Andersen's status as “prevailing party.” The Copyright Act allows the court to award reasonable attorney's fees to the prevailing party in a copyright action. The court stated that awarding fees under this provision is a matter of the court's discretion, but that it is to be applied in an evenhanded manner. In other words, prevailing plaintiffs and prevailing defendants are to be treated alike.

Although Plaintiff record companies argued that fees may not be awarded to a prevailing party unless there is a material alteration of the legal relationship of the parties as demonstrated by an enforceable judgment on the merits or a court-ordered consent decree, the court refused to apply such a strict analysis. Instead, the court reviewed the underlying social policy of the Copyright Act to determine how the purposes of the Act would best be served given the specific facts and relevant considerations.

The court ultimately concluded that the policy underlying the Copyright Act was best served by awarding Anderson the $300,000 she incurred in defending the copyright infringement suit.

Perfect 10 Gets Help from Industry Groups in Fight Against Visa

Perfect 10 – the publisher of adult photographs that lost its appeal to hold Google liable for copyright infringement by linking to and displaying thumbnails of unauthorized copies of its copyrighted images – has won the support of the MPAA, the RIAA, and several other industry groups in a separate effort to hold Visa and other financial services businesses liable for enabling copyright infringement.

The various industry groups recently filed an amicus curiae brief with the U.S. Supreme Court in support of Perfect 10’s petition for review of the 9th Circuit’s refusal to reverse the trial court’s dismissal of its claims against the defendant businesses. In this litigation, Perfect 10 has argued that the credit card companies facilitated infringement of its copyrighted content by providing payment processing services to various businesses that copy and distribute that content for profit. However, the 9th Circuit dismissed all of Perfect 10’s claims in July 2007, characterizing those claims as “radical new theories of liability.” In its opinion, the Court held that the fact “that Defendants have the power to undermine the commercial viability of infringement does not demonstrate that the Defendants materially contribute to that infringement.” In their brief, the amici counter that it is the 9th Circuit’s opinion that “dramatically changes the secondary liability standards that courts have applied for decades, and it does so in ways that threaten the effectiveness of secondary liability as a means to combat Internet piracy.”

Though it seems an unlikely result, if the Supreme Court does grant Perfect 10’s petition for review, the effects of its opinion on the matter could be very far-reaching and could further inform interpretation of the 9th Circuit’s earlier ruling on Perfect 10’s claims against Google.

No Fiduciary Relationship Between Inventor and Party That Agrees to Develop and Patent the Invention

Inventors and researchers often enter into agreements with other parties to develop, patent, and commercially exploit their inventions. But does such an agreement create a fiduciary relationship or is it nothing more than a simple contractual relationship? The answer to this question is critical – if there is a fiduciary relationship, a breach of that relationship gives rise to a tort claim and a potential recovery of punitive damages. But if the relationship is merely contractual, punitive damages would not be available. In City of Hope National Medical Center v. Genentech, Inc., 2008 WL 1820916 (Cal. 2008), the California Supreme Court held that such an arrangement should be “treated like an ordinary contractual agreement, a breach of which supports only contract and not punitive damages.” In so holding, the Court invalidated a $200 million punitive damages award that City of Hope had won at trial.

The case arose from a scientific discovery by two scientists employed by City of Hope. The scientists developed a groundbreaking process of genetically engineering human proteins that enabled the production of large quantities of various medicines. Genentech sent a proposal to City of Hope to provide funding for further development, and the parties entered into an agreement under which Genentech would provide funding, use the results in the manufacture of medicines, and secure and hold patents as they emerged. In 1999, City of Hope sued Genentech for breach of fiduciary duty and breach of contract. The jury found that Genentech had breached its fiduciary duty to City of Hope, acted with fraud and malice, and also breached the contract. The judgment awarded City of Hope $300,164,030 in compensatory damages and $200 million in punitive damages. The Court of Appeals affirmed.

The Supreme Court noted that the case was very complex, with “25,567 pages of reporter’s transcript plus 12,267 pages of clerk’s transcript and . . . 18 friend-of-the-court briefs.” The court affirmed the part of the judgment awarding City of Hope $300,164,030 in damages for Genentech’s breach of contract. But because the relationship did not give rise to a breach of fiduciary duty claim, the court set aside the punitive damages award. Generally, a contract between two parties, without more, does not create a fiduciary relationship. In this case, the contract between Genentech and City of Hope was between two sophisticated parties advised by counsel.

The court rejected the notion that an agreement to develop, patent, and market an invention automatically gave rise to a fiduciary relationship, stating that “a fiduciary relationship is not necessarily created simply when one party, in exchange for royalty payments, entrusts a secret invention to another party to develop, patent, and market the eventual product.” In addition, while the secrecy of the information entrusted by one party to another may be a factor, “it does not compel the imposition of fiduciary duties by operation of law.” Accordingly, the trial court erred by instructing the jury that a fiduciary relationship necessarily arises “when a party, in return for royalties, entrusts a secret idea to another to develop, patent, and commercially develop.” Because City of Hope’s legal theory for the creation of a fiduciary relationship was invalid, the court reversed the award of tort damages against Genentech. Businesses should study this decision before deciding to entrust a new invention to another party for development.

Full Opinion Text: http://www.courtinfo.ca.gov/opinions/documents/S129463.PDF

Court Expands Owner’s Liability Under New York Labor Law 240

New York businesses should review a recent decision by the Court of Appeals expanding the scope of liability under New York Labor Law section 240(1). In Sanatass v. Consolidated Investing Company, Inc., 2008 WL 1817261 (N.Y. 2008), a divided court held that a property owner is liable for a Labor Law section 240(1) violation even when a tenant of the building contracted for the work without the owner’s knowledge.

Consolidated owned a commercial building in Manhattan, and C2 Media subleased the 11th floor of the building. Under the lease, C2 Media was required to get the landlord’s written consent for any repairs and renovations. In January of 2000, C2 Media hired Sanatass to install a commercial air conditioning unit on their floor. C2 Media did not notify Consolidated about the work. While he was installing the air conditioning unit, one of the manual lifts fails causing the unit to drop, nearly crushing Sanatass.

Sanatass then sued Consolidated alleging violations of Labor Law 240(1) and 241(6). Consolidated successfully moved for summary judgment, and the Appellate Division affirmed, holding that Consolidated could not be held liable because the installation was performed without its consent and in violation of the lease.

The Court of Appeals disagreed. The court first determined that the installation of an air conditioner constituted an “alteration” within the scope of section 240(1), and that Sanatass sustained injuries “as a result of an elevation-related hazard – a falling object.” The Court then rejected Consolidated’s contention that it could not be held liable given that C2 Media breached the lease by not obtaining Consolidated’s permission before hiring a contractor to perform the alterations. Recognizing that the purpose of section 240(1) was to protect workers, the Court noted that section 240(1) imposes strict liability that “is nondelegable and that an owner is liable for a violation of the section even though the job was performed by an independent contractor over which it exercised no supervision or control.” For instance, out-of-possession owners have been held liable under section 240(1).

The Court concluded that Consolidated similarly could not avoid liability by contending that it was not an “owner” for purposes of the statute by relying on its lack of knowledge of Sanatass’ work. In sum, the Court refused to create “a lack-of-notice exception to owner liability.” Instead, the court held that “the owner’s lack of notice or control over the work is not conclusive – this is precisely what is meant by absolute or strict liability in this context.” In reaching this conclusion, the Court distinguished its decision in Abbatiello v. Lancaster Studio Assoc., 3 N.Y.3d 46 (2004). In Abbatiello, a cable repair technician was injured while accessing a junction box on the exterior of a building. The court in Abbatiello refused hold the owner liable because the plaintiff was only on the property by virtue of the Public Service Law to repair the cable system, meaning there was no nexus between the owner and the plaintiff. In contrast, Sanatass was employed by C2 Media to perform work in Consolidated’s building, and “as between the owner and the worker, section 240(1) clearly places the burden on the owner should a violation of the statute proximately cause injury.” In the wake of Sanatass, an owner cannot insulate itself from liability under Labor Law 240(1) by requiring its tenants to give notice of any repairs or alterations.

Full Opinion Text: http://www.nycourts.gov/ctapps/decisions/apr08/60opn08.pdf

April 23, 2008

California adopts “Sophisticated User” Doctrine for Products Liability

The California Supreme Court has given additional protections to manufacturers faced with products liability suits. Following the lead of other state and federal courts, California courts will now apply the “sophisticated user” doctrine. Under this doctrine, a manufacturer cannot be held liable when it fails to warn specialists about a product’s dangers when those dangers should be well known to such sophisticated users.

William Johnson is a certified HVAC technician who had received extensive training in the field of air conditioning repair. In particular, he had been certified by the EPA to work on large commercial air conditioning systems. Johnson filed suit against American Standard, air conditioner manufacturers, and various chemical manufacturers and suppliers after he developed pulmonary fibrosis. Johnson contended that the disease resulted from his exposure to phosgene gas. Large air conditioning systems commonly use R-22, a hydrochlorofluorocarbon refrigerant that, when exposed to light or flame, can decompose into phosgene gas. Johnson claimed that while maintaining and repairing air conditioning systems, he brazed refrigerant lines and was thereby exposed to phosgene gas. The trial court granted summary judgment in favor of the manufacturer, and the court of appeal affirmed, holding that the manufacturer did not have a duty to warn a sophisticated user like Johnson of such dangers which were well known in the industry.

In Johnson v. American Standard, Inc., 179 P.3d 905 (Cal. 2008), the California Supreme Court agreed. The court adopted the sophisticated user doctrine, concluding that normally, there is no duty to warn professionals about commonly known hazards. This doctrine is an exception to the general duty a manufacturer has to warn consumers about potential risks and dangers. According to the court, “just as a manufacturer need not warn ordinary consumers about generally known dangers, a manufacturer need not warn members of a trade or profession (sophisticated users) about dangers generally known to that trade or profession.” In reaching this determination, the court cited decisions by other state courts, as well as federal cases, adopting the doctrine. The court also mad eit plain that the sophisticated user doctrine applies equally in strict liability and negligent failure to warn cases.

The court also rejected Johnson’s contention that even though he received training and held certifications, he did not remember hearing or reading about the dangers of phosgene. According to the court, “even if a user was truly unaware of a product’s hazards, that fact is irrelevant if the danger was objectively obvious.” The decision in American Standard will certainly make it more difficult for sophisticated consumers to hold manufacturers liable under a failure to warn theory.

Full opinion text: http://www.courtinfo.ca.gov/opinions/documents/S139184.PDF

Summary Judgment Difficult to Obtain for Claims of Trademark Design Infringement

A recent opinion from the Southern District of California highlights the difficulties that a trademark owner can face when seeking summary judgment on a claim that a defendant infringed its design trademarks. HIT Entertainment, Inc., et al., v. National Discount Costume Co., Inc., et al., (“NDC”) stems from a case filed in the mid-1990s against NDC, a manufacturer and distributor of costumes. The plaintiffs then and in the current litigation alleged, in part, that NDC had engaged in the creation and sale of costumes based on their trademarked designs in certain children’s characters, such as Barney the Dinosaur. (In the current litigation, additional plaintiffs allege that NDC more recently infringed trademarked designs in Bob the Builder and Thomas the Tank Engine.) Though the parties to the older case settled out of court and stipulated to a permanent injunction, the current plaintiffs’ investigation revealed that NDC continued to make and distribute costumes based on Barney and the other characters. The plaintiffs sought and obtained a preliminary injunction and contempt sanctions against the defendants in the amount of $29,689.75, and they then moved for summary judgment on their claims of trademark and copyright infringement.

In its opinion, the court granted that part of the plaintiffs’ motion regarding claims that the defendants were liable for infringing the plaintiffs’ word trademarks in the names of the characters at issue. However, the fact-intensive nature of the infringement inquiry with regard to trademarked designs led the court to deny that part of the plaintiffs’ motion. While the plaintiffs attached evidence regarding the strength of the marks at issue; the similarity between the allegedly infringing costumes and the marks; and the defendants’ intent to allege the marks, the court noted that no compelling evidence was presented regarding the proximity of the costumes to the products and services sold under the marks; the presence of any actual confusion in the marketplace; any similarity in the marketing channels used for the allegedly competing products; the degree of care likely to be exercised by potential purchasers; or the likelihood of expansion of the relevant product lines. Courts typically look to all of the above factors in determining whether there is a likelihood of confusion sufficient to support a claim of infringement. In the absence of compelling evidence regarding so many of the factors, the court deferred to the Ninth Circuit’s admonishment that “district courts should grant summary judgment motions regarding the likelihood of confusion sparingly, as careful assessment of the pertinent factors that go into determining likelihood of confusion usually requires a full record.”

Trademark litigation can be littered with potential pitfalls for parties on wither side of the aisle. It is important to consider all of the factors relevant to an infringement inquiry, both when making the decision to file a claim and when making strategic decision during the course of the lawsuit.

Data Brokers Settle with FTC

Data brokers Reed Elsevier and Seisint have agreed to conduct biennial audits of its data protection procedures for 20 years as part of a settlement with the FTC. Businesses that find themselves under the FTC's scrutiny and choose to settle data privacy allegations may have to eventually assume the expense of conducting costly audits for as long as 20 years.

Reed Elsevier, via its LexisNexis data broker business, and Seisint gather information about millions of consumers, including names, current and prior addresses, dates of birth, drivers’ license numbers and Social Security Numbers. The companies relied on user IDs and passwords to control customer access to consumer information in their databases.

The FTC alleged that Reed Elsevier and Seisint failed, among other things, to:
• Make Seisint user credentials hard to guess;
• Suspend credentials after a certain number unsuccessful log-in attempts;
• Require Seisint customers to encrypt or protect credentials, search queries or search results in transit between customer computers and Seisint Web sites;
• Verify that new user credentials were created by customers rather than identity thieves;
• Prevent users from sharing credentials;
• Adequately assess the vulnerability of Seisint’s Web applications and computer network to commonly known attacks; and
• Implement simple, low-cost, and readily available defenses to such attacks.

Identity thieves allegedly exploited these security failures and obtained access to the sensitive information of at least 316,000 consumers from Accurint databases. The identity thieves used the information to create and activate new credit cards with which they made fraudulent purchases. Reed Elsevier acquired Seisint in late 2004, and the breaches continued for at least nine months afterward, during which time Reed Elsevier controlled Seisint’s practices.

For the next 20 years, auditors will be required to certify that the companies’ security programs meet or exceed the requirements of the FTC’s orders and are operating with sufficient effectiveness to provide reasonable assurance that the security of consumers’ personal information is being protected. The Reed Elsevier and Seisint settlements also contain bookkeeping and record keeping provisions to allow the FTC to monitor compliance with its orders.
View the compliant here.
View the settlement agreement here.

Copyright Owners May Lose Standing to Sue for Infringement as a Result of Agreements with Industry Groups

A Western District of New York Magistrate Judge recently recommended that claims filed by the owners of several copyrighted songs (allegedly performed without their permission) should be dismissed as a result of the plaintiffs’ membership in the American Society of Composers, Authors and Publishers (“ASCAP”). In ruling on a number of pre-trial matters, the Judge independently raised the issue of the plaintiffs’ standing to sue based on ASCAP membership agreements they had attached to a motion for summary judgment. Those agreements included the following provisions:

1. "[Plaintiff] grants to [ASCAP] for the term hereof, the right to license non-dramatic public performances ... of each musical work .... The rights hereby granted shall include:
(a) All the rights and remedies for enforcing the copyrights or copyrights of such musical works ... as well as the right to sue under such copyrights in the name of [ASCAP] and/or in the name of [plaintiff] and/or others, to the end that [ASCAP] may effectively protect and be assured of all the rights hereby granted.
* * *
3. [ASCAP] agrees, during the term hereof ... to hold and apply all royalties, profits, benefits and advantages arising from the exploitation of the rights assigned to it by its several members, including [plaintiff], to the uses and purposes as provided in its Articles of Association.
4. [Plaintiff] hereby irrevocably, during the term hereof, authorize, empowers and vests in [ASCAP] the right ... to prevent the infringement thereof, to litigate, collect and receipt for damages arising from infringement ... and to release, compromise, or refer to arbitration any actions, in the same manner and to the same extent ... as [plaintiff] might or could do, had this instrument not been made.
5. [Plaintiff] hereby makes, constitutes and appoints [ASCAP] or its successor [plaintiff's] true and lawful attorney ... to do all acts, take all proceedings ... proper or expedient to restrain infringements and recover damages".
6. [Plaintiff] agrees from time to time, to execute, acknowledge and deliver to [ASCAP], such assurances ... as [ASCAP] may deem necessary or expedient to enable it to ... enjoy ..., in its own name or otherwise, all rights and remedies aforesaid."

The Judge stated that the effect of the above provisions was to strip the plaintiffs of their standing to sue under Article III of the U.S. Constitution. Under the Judge’s interpretation of the agreements, the plaintiffs assigned exclusively to ASCAP all rights to seek remedies for infringement of the covered works. Therefore, according to the Judge’s recommendation, none of the plaintiffs was unable to show that his “individual need requires the remedy for which he asks…that he stands to profit in some personal interest…and that he personally would benefit in a tangible way from the court's intervention." (internal quotes and citations omitted)

Many software publishers, including Microsoft, Adobe and Autodesk, are members in industry trade groups such as the Business Software Alliance (“BSA”) and the Software & Information Industry Association (“SIIA”), which typically operate under powers of attorney from the publishers to target small-to-medium-sized businesses with allegations of software copyright infringement. In the event of litigation arising from such allegations, filed either directly by the publishers or by the BSA or SIIA, it would be a good idea to carefully review all relevant membership documents to determine the scope of authority under which the named plaintiff has filed the action. It will also be interesting to watch the New York litigation to see if the Magistrate Judge’s recommendation is adopted by the District Court and upheld on appeal, if any.

April 3, 2008

What Constitutes a “Copy” of Software Under Copyright Law?

Software auditors almost always try to find ways to maximize the number of allegedly infringing software “copies” at issue in an audit engagement. It is typical for the Business Software Alliance (BSA), the Software & Information Industry Association (SIIA), and other software publishers to demand that their small-to-medium-sized business targets disclose all installations of relevant software products on all of the computers owned by the target, which number the auditors then use in determining how much money they are going to demand in settlement to keep the matter from going to court. This is perhaps unsurprising behavior by the auditors, because it clearly gives them more leverage during settlement negotiations. However, according to more than one federal court, it may not be a correct interpretation of federal law.

In FM Industries, Inc. v. Citicorp Credit Services, Inc., the United States District Court for the Northern District of Illinois determined the existence and extent of infringement of a software program by a business whose license to use the program had expired. In the case, the business at issue claimed that it its use was non-infringing because it initially installed the software with the consent of the publisher. The court rejected this argument, holding that “a user reproduces a program stored in his computer's hard drive merely by launching that program, thereby causing the computer to copy it to Random Access Memory.” The court also cited to a Ninth Circuit opinion in the case of MAI Systems Corp. v. Peak Computer, Inc., where the court there stated:

The district court's grant of summary judgment on MAI's claims of copyright infringement reflects its conclusion that a “copying” for purposes of copyright law occurs when a computer program is transferred from a permanent storage device to a computer's RAM. This conclusion is consistent with its finding, in granting the preliminary injunction, that: “the loading of copyrighted computer software from a storage medium (hard disk, floppy disk, or read only memory) into the memory of a central processing unit (“CPU”) causes a copy to be made. In the absence of ownership of the copyright or express permission by license, such acts constitute copyright infringement.” We find that this conclusion is supported by the record and by the law.

These opinions are at odds with the standard tactics employed by the BSA, the SIIA, Autodesk, and other software auditors. For example, when presented with information that a design firm has repurposed a CAD workstation to a reception desk or, in a perhaps more stark example, decommissioned the machine to a storage closet, the BSA would argue that any design or CAD software remaining on the machine’s hard drive remains relevant for audit purposes, and they would use any such installations as factors in calculating a settlement demand. However, according to the FM Industries and MAI Systems opinions, this methodology is flawed. A correct damages model would not count as “copying” the mere presence of copyrighted software on a hard drive. The relevant inquiry is whether that software is being used by loading it into a computer’s RAM.

When faced with a software audit demand from the BSA, the SIIA, or any other software publisher or industry representative, before disclosing any information regarding the software in use in your business’ computer network, it is important to consult with counsel to determine what is and what may not be within the scope of the audit.