Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 1 of 15 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF IDAHO BATTELLE ENERGY ALLIANCE, LLC, a Delaware limited liability company, Case No. 4:13-cv-00442-BLW MEMORANDUM DECISION & ORDER Plaintiff, vs. SOUTHFORK SECURITY, INC., an Idaho corporation, COREY THUEN, an individual, and DOES 1 through 10, inclusive, Defendants. INTRODUCTION Pending before the Court is plaintiff Battelle Energy Alliance, LLC's Ex Parte Application for a Temporary Restraining Order (Dkt. 2). Battelle asks for an order (1) requiring defendants to disable Southfork's website (http://www.southforksecurity.com) and take down all internet postings related to computer programs known as Visdom and Sophia (which are described further below), and (2) permitting Battelle and its computer MEMORANDUM DECISION & ORDER - 1 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 2 of 15 forensic expert to "image or copy" defendant Corey Thuen's "computer(s) hard drive(s) and the data thereon to hold in escrow for the purpose of preserving critical evidence." Ex Parte App., Dkt. 2, at 2. The Court will issue an order preventing defendants from releasing Sophia or Visdom as open-source products. The Court will also authorize Battelle's forensic expert to (1) make a single copy or image of defendant Thuen's computer hard drive, (2) without examining that copy or image in any manner, immediately deliver it to the Court where it will be held pending further litigation in this case; and (3) after the copy or image is made, return the computer to the defendant Thuen in the same condition it was in when received. Between the time this Order is issued and the time the copying takes place, the Court will order the defendant Thuen to preserve his hard drive by not deleting any material thereon. BACKGROUND The Idaho National Laboratory is a federal governmental facility owned by the United States Department of Energy. Plaintiff Battelle is the lab's management and operating contractor. Battelle's work at the lab includes performing federally funded research projects. In 2009, the Department of Energy commissioned Battelle to research and develop a computer program aimed at protecting the United States' critical energy infrastructure (oil, gas, chemical and electrical companies) from cyber attacks. Defendant Corey Thuen is a former Battelle employee who helped develop this computer program during his MEMORANDUM DECISION & ORDER - 2 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 3 of 15 tenure at Battelle. The program ultimately became known as Sophia. The name Sophia was chosen as a reference to the Greek goddess of wisdom. Battelle tested Sophia in 2012 and learned that electric utility companies were interested in a commercial version of the software program. These companies, however, said they did not want an "open source" version of the software, which means that the source code would be available to the public. Instead, they wanted a closed-loop proprietary version of the software. Battelle does not have the capability to commercialize its research products and inventions. Rather, the lab licenses its technologies to third parties who market and sell them. Thus, as Sophia neared completion, Battelle began a bidding process, which allowed commercial software and network security firms to compete for the right to exclusively license Sophia. Defendant Southfork Security, Inc. was one of eight companies who expressed an interest in competing for the exclusive license. Thuen created Southfork for the purpose of bidding on Sophia. Southfork submitted a licensing proposal for Sophia in February 2013, but in April 2013, abruptly withdrew from the competitive business process. Shortly afterward, in May 2013, another company, NexDefense, was awarded the right to negotiate an exclusive commercial license. See Stmt. of Facts, Dkt. 2-2, ? 22. Around that same time, on May 1, 2013, Southfork began marketing a software product called "Visdom" on its website. Id. ? 44. Battelle says Visdom is a copy of Sophia, and further says that defendants intend to offer Visdom as an open-source product. Battelle has submitted a screenshot of Southfork's website, as it existed on October 10, 2013. That screenshot MEMORANDUM DECISION & ORDER - 3 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 4 of 15 says, relative to Visdom, that "We'll have the source code and an issue/feature tracking system up shortly." See Randolph Dec., Dkt. 7, ? 5; Ex. A at 4. Southfork's website also contains the following statement: "We like hacking things and we don't want to stop." Id., Ex. A, at 8. Battelle terminated Thuen in June 2013. In this action, Battelle alleges eight claims against Thuen and Southfork: (1) copyright infringement; (2) trade secret misappropriation; (3) breach of contract; (4) tortious interference with prospective economic advantage; (5) unfair competition; (6) conversion; (7) breach of the implied covenant of good faith and fair dealing; and (8) unjust enrichment. ANALYSIS 1. The Legal Standard The standard for a temporary restraining order is the same as for a preliminary injunction. See Stuhlbarg Int'l Sales Co., Inc. v. John D. Brush & Co., 240 F.3d 832, 839 n. 7 (9th Cir. 2001). To obtain preliminary injunctive relief, the moving party must show: (1) a likelihood of success on the merits; (2) a likelihood of irreparable harm to the moving party in the absence of preliminary relief; (3) that the balance of equities tips in favor of the moving party; and (4) that an injunction is in the public interest. Winter v. Natural Res. Def. Council Inc., 555 U.S. 7, 20 (2008). The court may apply a sliding scale test, under which "the elements of the preliminary injunction test are balanced, so that a stronger showing of one element may offset a weaker showing of another." Alliance for the Wild Rockies v. Cottrell, 632 F.3d 1127, 1131 (9th Cir. 2011). A MEMORANDUM DECISION & ORDER - 4 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 5 of 15 restraining order is an "extraordinary remedy that may only be awarded upon a clear showing that the plaintiff is entitled to such relief." Winter, 555 U.S. at 22. Plaintiffs in this case ask the Court issue a temporary restraining order without first notifying defendants. Under Rule 65(b), a district court may issue a temporary restraining order without notice only if: (A) specific facts in an affidavit or a verified complaint clearly show that immediate and irreparable injury, loss, or damage will result to the movant before the adverse party can be heard in opposition; and (B) the movant's attorney certifies in writing any efforts made to give notice and the reasons why it should not be required. Fed. R. Civ. P. 65(b)(1) (emphasis added). The Court will address each of these required showings in turn. 2. Likelihood of Success on the Merits - Copyright Infringement Regarding the likelihood of success on the merits - "the main bearing wall of the four-factor framework," Ross-Simons of Warwick, Inc. v. Baccarat, Inc., 102 F.3d 12, 16 (1st Cir. 1996) - Battelle has established it will likely succeed on the merits of its copyright infringement claim. 1 To establish copyright infringement, Battelle must show (1) ownership of a valid copyright and (2) the unauthorized copying of constituent elements of the copyrighted work that are original. Feist Pub'ns, Inc. v. Rural Tel. Serv. Co., 499 U.S. 340, 361 (1991). 1 Battelle also alleges six other claims. The Court will not address these claims at this point, given its conclusion that Battelle will likely succeed on the merits of its copyright claim. MEMORANDUM DECISION & ORDER - 5 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 6 of 15 A. Ownership Battelle relies on the fact that in September 2013, it applied for copyright registration to establish a presumption of copyright ownership. See App. Mem., Dkt. 2-1, at 4. Applying for registration, however, does not entitle Battelle to this presumption. Battelle needs the registration certificate. See 17 U.S.C. ? 410(c); 2 Cosmetic Ideas, Inc. v. IAC/Interactivecorp., 606 F.3d 612, 621, n.14 (9th Cir. 2010) ("a defendant is in some ways aided by a plaintiff's lack of a certificate, because if a party proceeds to litigation without a registration certificate, it bears a greater evidentiary burden of proving the validity of its copyright") Regardless, Battelle has adequately demonstrated that it authored Sophia and that Sophia is copyrightable subject matter. See 17 U.S.C. ? 102(a)(1) (copyright production subsists in original works of authorship in various categories, including literary works). Battelle has submitted evidence establishing that Sophia was created by a Battelle project team during the years 2010 to 2012. See SOF, Dkt. 2-2, ? 4-6. And there is no doubt that that computer programs are eligible for copyright protection. See Johnson Controls, Inc. v. Phoenix Control Sys., 886 F.2d 1173, 1175 (9th Cir.1989) ("Computer software is subject to copyright protection."), abrogated on other grounds by eBay Inc. v. MercExchange, L.L.C, 547 U.S. 388 (2006). Protection under the Copyright Act extends to both "literal" and "non-literal" components of computer software. Id. Literal 2 This section provides: "In any judicial proceedings the certificate of a registration made before or within five years after first publication of the work shall constitute prima facie evidence of the validity of the copyright and of the facts stated in the certificate. The evidentiary weight to be accorded the certificate of a registration made thereafter shall be within the discretion of the court." MEMORANDUM DECISION & ORDER - 6 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 7 of 15 components include source codes and object codes and non-literal components include the software's structure, organization, and user interface. Id. However, elements of computer programs which constitute ideas, processes, or methods of operation are not protected by copyright law. Apple Computer, Inc. v. Microsoft Corp., 35 F.3d 1435, 1444 (9th Cir. 1994). Whether a particular component of a computer program is protected by a copyright depends on whether it qualifies as an "expression" of an idea rather than the idea itself. Harper & Row Publishers, Inc. v. Nation Enters., 471 U.S. 539, 547 (1985); see Johnson, 886 F.2d at 1175. Here, based on the evidence before it, the Court concludes that Sophia's source code is a literal component of the computer program, and thus protectable. B. Infringement As for infringement, if there is no evidence of direct copying, "proof of infringement involves fact-based showings that the defendant had 'access' to the plaintiff's work and that the two works are 'substantially similar.'" Funky Films, Inc. v. Time Warner Entm't Co., 462 F.3d 1072, 1076 (9th Cir. 2006) (citation omitted). Here, Battelle has put forward adequate circumstantial evidence to permit an inference that defendants copied Sophia. Battelle says Thuen created Visdom in a time period that is impossible without copying; he described Visdom in nearly identical language as was used to describe Sophia; he used the same demonstration videos to showscase Visdom's functionality as he did to showcase Sophia; he has admitted to copying parts of Sophia; and he has adopted a nearly identical name. Based on this MEMORANDUM DECISION & ORDER - 7 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 8 of 15 record, the Court concludes that Battelle is likely to prevail on its copyright infringement claim. 3. Likelihood of Irreparable Harm There is no presumption of irreparable harm based upon a finding of likely success on the merits of a copyright infringement claim. See Flexible Lifeline Sys., Inc. v. Precision Lift, Inc., 654 F.3d 989 (9th Cir. 2011). Many courts have observed, however, that proof of irreparable harm should not be difficult to establish in a run-of-the-mill copyright infringement case. E.g., Apple Inc. v. Pystar Corp., 673 F. Supp. 3d 943, 948 (N.D. Cal. 2009). Here, Battelle has shown that the harm from infringement will be immediate and irreparable. Most broadly, releasing Sophia open-source has national security implications. As Battelle puts it, "Defendants plan to give away the keys to Sophia . . . to the very attackers Sophia is meant to thwart." App. at 2-1 (citing SOF ? 51). Additionally, Battelle has demonstrated that it faces intangible losses such as loss of (1) goodwill with third parties and commercial partners; (2) the ability to attract and retain talent; and (3) the ability to pursue R&D projects in "sensitive government areas." Thus, the Court finds a likelihood of irreparable harm. 4. Balance of Hardships An injunction may not issue unless the balance of hardships tips sharply in favor of the moving party. Int'l Jensen, Inc. v. Metrosound U.S.A., Inc., 4 F.3d 819, 822 (9th Cir.1993). Battette has demonstrated that the balance of hardships tips sharply in its favor. At most, defendants could claim that an injunction might harm their business. But MEMORANDUM DECISION & ORDER - 8 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 9 of 15 the hardship suffered by Battelle will be greater if defendants are not enjoined from infringing or misappropriating Battelle's copyrighted work. Indeed,dDefendants "cannot complain of the harm that will befall [them] when properly forced to desist from [their infringing activities." Triad Systems Corp. v. Southeastern Exp. Co., 64 F.3d 1330, 1338 (9th Cir.1995). Accordingly, the Court concludes that the balance of hardships tips sharply in favor of Plaintiffs. 5. Public Interest In each case, a court must balance the competing claims of injury and must consider the effect on each party of the granting or withholding of the requested relief." Amoco Production Co., 480 U.S. at 542. Here, there are national security implications associated with an open-source release of Sophia or Visdom. Further, "it is virtually axiomatic that the public interest can only be served by upholding copyright protections and correspondingly, preventing the misappropriation of skills, creative energies, and resources which are invested in the protected work." Apple Computer, Inc. v. Franklin Computer Corp., 714 F.2d 1240, 1255 (3d Cir. 1983). 6. Issuing the Order Without Notice Having determined that Battelle is entitled to a temporary restraining order, the Court now turns to the question of whether that order can be entered without notice to defendants. The Supreme Court has explained that the circumstances justifying the issuance of an ex parte temporary restraining order are extremely limited. "The stringent restrictions imposed . . . by Rule 65 on the availability of ex parte temporary restraining orders reflect MEMORANDUM DECISION & ORDER - 9 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 10 of 15 the fact that our entire jurisprudence runs counter to the notion of court action taken before reasonable notice and an opportunity to be heard has been granted both sides of a dispute." Granny Goose Foods, Inc. v. Teamsters, 415 U.S. 423, 438-439 (1974) (internal citation omitted). In keeping with these concerns, the Ninth Circuit has stated that there are "very few circumstances justifying the issuance of an ex parte TRO." Reno Air Racing Ass'n, Inc. v. McCord, 452 F.3d 1126, 1131 (9th Cir. 2006). When notice could have been given to an adverse party, the moving party must establish that "'notice to the defendant would render fruitless the further prosecution of the action.'" Id. (citing Am. Can Co., 742 F.2d at 322). Here, there are two potential actions defendants might take if they get notice of this lawsuit and of Battelle's request for a restraining order. First, defendants say they intend to release Visdom as an "open-source" product "shortly." Second, Battelle asserts that defendants are likely to wipe the hard drives on Thuen's computer, thus destroying direct evidence of wrongdoing. Battelle suggests that either of these actions would render further prosecution of the lawsuit fruitless. The Court is persuaded to issue a restraining order without notice based on defendants' statements that they will release Visdom "shortly" as an open-source product. Battelle has put forth facts showing that such an action would destroy their business and substantial development of Sophia, because Battelle would not be able to sell a product if defendants give it away. See SOF ? 52; Kaczor Dec. ?? 30-31. The Court finds it significant that defendants are self-described hackers, who say, "We like hacking things and we don't want to stop." Id., Ex. A, at 8. Additionally, the facts show that Thuen MEMORANDUM DECISION & ORDER - 10 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 11 of 15 previously defied Battelle's instructions to refrain from widely releasing video demonstrations of Sophia on the internet. See Colson Dec. ?? 18-20 (Thuen released a video demonstration of Sophia widely, rather than in accordance with the limitations Battelle imposed). Additionally, the Court is also convinced that defendants would destroy evidence (i.e., that they would wipe their hard drives) if they were given notice of this lawsuit. To demonstrate that the defendants would destroy evidence, Battelle "must do more than assert that the adverse party would dispose of evidence if given notice.'" Reno Air, 452 F.3d at 1131 (citing First Tech. Safety Sys., Inc. v. Depinet, 11 F.3d 641, 650 (6th Cir. 1993)). Rather, Battelle must show that the defendants have "a history of disposing of evidence or violating court orders or that persons similar to the adverse party have such a history." Id. (citing In the Matter of Vuitton et Fils S.A., 606 F.2d 1, 5 (2d Cir. 1979)). Battelle asserts generally that defendants who have the technical ability to wipe out a hard drive will do precisely that when faced with allegations of wrongdoing. See App. Mem., Dkt. 2-1, at 17. To support this assertion, defendants cite to Battelle employee Michael Colson, who testifies as follows: I have 23 years of experience as an investigator for government and private entities and have worked many times on matters where employees have - without authorization - taken data from employers for their own purposes. In my experience it is very common for such individuals to simply delete the data when they are confronted with an investigation, rather than admit wrongdoing. This is particularly so in regards to those with technical skills to wipe the data in a way which does [not 3] leave digital footprints. My investigation has revealed that Thuen has (or had) an unauthorized copy of executable Sophia code on 3 Based on the context, it is obvious that the word "not" should be inserted here. MEMORANDUM DECISION & ORDER - 11 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 12 of 15 his home computer and, from my experience, there is a high risk that he might wipe his computers destroying evidence if he had advance warning. Colson Aff., Dkt. 2-3 ? 35. In addition, the defendants have identified themselves as hackers, as discussed above. A well-known characteristic of hackers is that they cover their tracks. Padmanabhan, Hacking for Lulz, 15 Vand. J. Ent. & Tech. L. 191, 197-98 (Fall 2012) (discussing how "hackers (1) log in to computers remotely, and (2) use fictitious Internet protocol (IP) addresses to conceal their identities"); Martin, Vicarious and Contributory Liability for Internet Host Providers, 27 Wis. Int'l L.J. 363, 408 (Summer 2009) (discussing how "hackers will likely become wiser and learn new and more effective ways to conceal their activities.") This makes it likely that defendant Thuen will delete material on the hard drive of his computer that could be relevant to this case. Battelle has therefore shown under Reno Air that "persons similar to" the defendant - a former employee who allegedly stole data and is a self-described computer hacker - have a history of disposing of evidence. The Court has struggled over the issue of allowing the copying of the hard drive. This is a serious invasion of privacy and is certainly not a standard remedy, as the discussion of the case law above demonstrates. The tipping point for the Court comes from evidence that the defendants - in their own words - are hackers. By labeling themselves this way, they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act. And concealment likely involves the destruction of evidence on the hard MEMORANDUM DECISION & ORDER - 12 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 13 of 15 drive of Thuen's computer. For these reasons, the Court finds this is one of the very rare cases that justifies seizure and copying of the hard drive. Finally, given these rulings, the Court can find no reason to shut down the website, which appears to serve other purposes than the dissemination of the litigated matters. 7. Security Federal Rule of Civil Procedure 65(c) provides that "The court may issue a preliminary injunction or a temporary restraining order only if the movant gives security in an amount that the court considers proper to pay the costs and damages sustained by any party found to have been wrongfully enjoined or restrained." The Court finds that security in the amount of $25,000 is sufficient under the circumstances of this case. This amount may be increased, if necessary, based upon an appropriately filed motion by defendants supporting such an increase. ORDER & TERMS OF THE TRO IT IS HEREBY ORDERED that: (1) Battelle's ex parte application for a temporary restraining order (Dkt. 2) is GRANTED in part and DENIED in part, for the reasons stated above. . (2) At 4:45 p.m. on this 15th day of October, 2013, the Court issues this Temporary Restraining Order enjoining defendants, and their agents, employees, attorneys or all persons acting in concert and participation with either of them as follows: a. Defendants are ordered to refrain from releasing Visdom or Sophia as an open-source product. MEMORANDUM DECISION & ORDER - 13 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 14 of 15 b. Defendants are ordered to refrain from destroying or altering any information on their computers (including on the hard drives) related in any way to Sophia or Visdom. c. Defendants shall immediately turn over defendant Thuen's computer hard drive to a forensic expert retained by Plaintiffs. d. Plaintiffs shall, without examining that copy or image, immediately deliver it to the Court where it will be held pending further litigation in this case e. Plaintiffs shall thereafter immediately return the hard driver to Thuen in the same condition it was in when obtained. f. Defendants shall take reasonable steps to preserve any and all records or documents, as defined in Federal Rule of Civil Procedure 34(a)(1)(A), including information contained on their computer hard drives. (3) Battelle shall hand-serve defendants with copies of (1) the complaint, (2) the ex parte application for a temporary restraining order, including all supporting documents and declarations; and (3) a copy of order, within 24 hours of the issuance of this order. (4) Battelle shall post security in the amount of $25,000 no later than 48 hours after this order issues. (5) This Temporary Restraining Order will EXPIRE at 4:45p.m. on October 29, 2013. MEMORANDUM DECISION & ORDER - 14 Case 4:13-cv-00442-BLW Document 8 Filed 10/15/13 Page 15 of 15 (6) The Court will expedite the hearing on Battelle's request for a preliminary injunction. The Court will refer this request to Honorable Robert J. Bryan, Senior United States District Judge for the Western District of Washington, sitting by special designation. The parties are ordered to appear for the preliminary-injunction hearing before Judge Bryan on Thursday, October 17, 2013 at 9:30 a.m., in Courtroom 1 of the Federal Courthouse in Boise, Idaho, which located at 550 West Fort Street. The Court is scheduling this hearing on an expedited basis because of the extraordinary relief requested and granted. At the defendant's request, the matter will be delayed to provide the defendant with an opportunity to obtain counsel and prepare for the hearing. DATED: October 15, 2013 _________________________ B. Lynn Winmill Chief Judge United States District Court MEMORANDUM DECISION & ORDER - 15