Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 1 of 38

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF FLORIDACASE NO. 19-81160-CIV-SMITH
APPLE INC.,
Plaintiff,v.
CORELLIUM, LLC,
Defendant.
_______________________/ORDER ON THE PARTIES’ MOTIONS FOR SUMMARY JUDGMENT
Plaintiff, Apple Inc. (“Apple”) designs and manufactures mobile communication devices,personal computers, and media devices, and sells a variety of related software, services,
accessories, and third-party digital content and applications. iOS is Apple’s mobile operating
system (or “OS”) for certain devices like the iPhone. iOS is publicly available online for freedownload from Apple’s servers as part of a packaged file. Around 2016 or 2017, Apple removed
encryption from the kernel, which is the core of the operating system that has complete control
over all system resources.
In 2017, Defendant, Corellium, LLC (“Corellium”) began developing a commercial
product (“the Corellium Product”) that permits users to create tailored, virtual models of iPhones,
using iOS files loaded by the user. (The Corellium Product also virtualizes Android, the mobile
operating system used by Google, but the Android aspects of the Corellium Product are not issue
in this case.) With its relatively limited functionality, among other things, the Corellium Productdoes not virtualize the Apple App Store, and users cannot make phone calls or use camera––features of interest to the average customer buying an iPhone off the shelf. According to testimony
of developers of the Corellium Product, the product is intended to provide an environment in which
technology security researchers can conduct research with features of interest to those researchers.

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 2 of 38

Still, there is no evidence that the Corellium Product, like other technology, cannot be used forunintended purposes, or that Corellium can control how users utilize any Corellium Productinstalled on their premises.
Starting in January 2018, Apple and Corellium began engaging in acquisition talks which,if successful, would have allowed Apple to acquire Corellium (including its people and theCorellium Product). During the acquisition process, there were several in-person meetings andcalls between the companies. The Corellium Product was demonstrated (“demo’ed”) to Apple andthere was technical due diligence. In the summer of 2018, the potential deal fell apart and Apple
did not acquire Corellium.
On August 15, 2019, Apple filed this lawsuit alleging that Corellium infringed Apple’s
copyrights in iOS and circumvented its security measures in violation of the federal Digital
Millennium Copyright Act (“DMCA”). Corellium denies that it has violated the DMCA orApple’s copyrights. Corellium further argues that even if it used Apple’s copyrighted work, suchuse constitutes “fair use” and, therefore, is legally permissible. Apple filed a Motion for Partial
Summary Judgment [DE 470] and Corellium filed a Motion for Summary Judgment [DE 464].
For the reasons explained below, on the copyright claim, the Court finds that Corellium’s use of
iOS constitutes fair use, and a genuine dispute of material facts precludes summary judgment on
the DMCA claim. Thus, Corellium’s motion is granted in part and denied in part, and Apple’s
motion is denied. 1

1

To the extent the parties agree on the facts and the facts as stated are supported by the evidence,
the Court may cite to the parties’ Statements of Material Facts (“SOF”). Regarding declarations,
under the law of this Circuit, “[w]hen a party has given clear answers to unambiguous questions
which negate the existence of any genuine issue of material fact [for summary judgment], thatparty cannot thereafter create such an issue with an affidavit that merely contradicts, without
explanation, previously given clear testimony. Such an affidavit would be a sham.” McCormick v.
City of Fort Lauderdale, 333 F.3d 1234, 1240 (11th Cir. 2003) (internal citation omitted).
2

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 3 of 38

BACKGROUND
A. iOS: APPLE’S OPERATING SYSTEM
An operating system is a program that manages the resources of the computer, allocating
those resources to other programs as needed. It manages the computer’s most basic functions,
including the user’s interaction with the device. iOS is Apple’s operating system for its iPhone,
iPod Touch, and until September 25, 2019, iPad. (Andrews Decl. [DE 470-4] ¶ 4.) The iPhone
was introduced in 2007. It is one of the world’s first “smartphones” and remains one of the mostpopular consumer electronic devices in the world. (Andrews Decl. ¶ 3.) For the iPhone, among
other things, the ability to make phone calls, send text messages, take photos, and download apps
from Apple’s App Store are important features of iOS. (Def.’s SOF [DE 472] ¶ 3.)
iOS does not include hardware or some components of the secure boot chain (discussed
below), like Boot ROM, which are built directly into the physical device. (Def.’s SOF ¶ 4.)
However, iOS encompasses default software applications, underlying graphics, images, and files
that help create the iOS displays, and graphical user interface (“GUI”) elements installed on
Apple’s mobile devices. (Andrews Decl. ¶ 6.) Generally, GUI is a visual way of interacting witha computer using items such as icons and menus. 2 iOS also encompasses the source code andobject code representing the processes managing the execution of applications and utilization ofdevice resources. 3 (Andrews Decl. ¶ 6.)

Additionally, the Court does not consider evidence that has been stricken pursuant to the Court’sAugust 24, 2020 Order [DE 658] and the parties’ related Joint Stipulation [DE 722]. Lastly,
citations to the record primarily reflect sealed versions of the document, not the publicly available
copies.
2

https://www.merriam-webster.com/dictionary/graphical%20user%20interface.

3

Regarding source code and object code:3Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 4 of 38

iOS includes open and partially open source code; it includes code that was not written byApple. (Marineau-Mes Dep. [DE 472-4] 37:6-14.) This includes: (1) open source code that Apple
uses under license (e.g., Secure Socket Layer); (2) components for which Apple is the primaryowner (e.g., WebKit); and (3) aspects where Apple contributes some of the code (e.g., the kernel).
(Andrews Dep. [DE 472-3] 91:22-93:13, 100:20-23; Marineau-Mes Dep. 37:6- 40:11 (other open
source components of iOS are the compiler and Swift).) Likewise, iOS’ Darwin, which is part of
the kernel, stems from research dating back thirty to forty years––long before Apple developed theiPhone. (Marineau-Mes Dep. 37:6-40:6.) For these open source components, Apple is key
contributor to the code bases and, in many cases, invented the code and chose to make it available
in open source. (Marineau-Mes Dep. 39:23-40:7.)

Computers come down to one basic premise: They operate with a series of on andoff switches, using two digits in the binary (base 2) number system—0 (for off) and
1 (for on). All data and instructions input to or contained in computers therefore
must be reduced to . . . 1 and 0 . . . . Some highly skilled human beings can reduce
data and instructions to strings of 1’s and 0’s and thus program computers to
perform complex tasks by inputting commands and data in that form. But it would
be inconvenient, inefficient and, for most people, probably impossible to do so. In
consequence, computer science has developed programming languages. These
languages, like other written languages, employ symbols and syntax to convey
meaning. The text of programs written in these languages is referred to as sourcecode. And whether directly or through the medium of another program, the sets of
instructions written in programming languages—the source code—ultimately aretranslated into machine “readable” strings of 1’s and 0’s, known in the computerworld as object code, which typically are executable by the computer . . . . All codeis human readable. As source code is closer to human language than is object code,
it tends to be comprehended more easily by humans than object code.
Universal City Studios, Inc. v. Reimerdes, 111 F. Supp. 2d 294, 306 (S.D.N.Y.), aff’d sub nom.
Universal City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001) (internal citation omitted).
4

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 5 of 38

B. IPSW FILESApple continuously releases new versions of iOS. It also releases at least some componentsof iOS in software files known as “IPSW” files. (Andrews Dep. 94:13-25; Krstic Dep. [DE 4721] 126:13-127:21; Wang Dep. [DE 472-6] 59:24-61:10.) IPSW files are available online for freedownload from Apple’s servers, including via links provided on third-party sites like ipsw.me.
(Def.’s SOF ¶ 6.) A user is not presented with or required to agree to the iOS Software License
Agreement or End User License Agreement (“EULA”) before downloading an IPSW file. (Def.’s
SOF ¶ 12; Andrews Dep. 95:13-15, 98:14-20.)
IPSW files have iOS without some of the runtime elements such as the cryptographic
authorization ticket, which authorizes a given version of iOS to run in a given piece of hardware.
(Krstic Dep. 126:13-127:21.) Further, many parts of the IPSW files are unencrypted, including
the kernel, which is the core of the operating system that has complete control over all system
resources. (Def.’s SOF ¶ 8.) Thus, once downloaded, a person can read some of the file contents,
and it is possible to access contents of the kernel, as well as extract other parts of the file. (Krstic
Dep. 67:12-21, 129:21-130:4; Marineau-Mes Dep. 57:2-10.) The kernel can run on non-Appledevices, but protections put in place by Apple––which intends for the kernel to run on Appledevices––makes it difficult to do so. (Krstic Dep. 130:23-132:13, 141-143:3.) The IPSW files
also contain image files such as wallpaper. (Def.’s SOF ¶ 7.)
C. APPLE’S TECHNICAL CONTROL MEASURESApple designs iOS and devices running iOS as an integrated hardware/software system.
(Pl.’s SOF [DE 470-2] ¶ 10.) Apple does not provide the functionality to “clone” or copy thecomplete contents of an iPhone. (Id. ¶ 11.) Combining hardware, software, and service features,Apple has put security measures in place to protect its devices and customers’ experience. (Pl.’s

5

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 6 of 38

Resp. to Second Interr. No. 16 [DE 553-9]. 4) In its motion, Apple focuses on the following
measures:
Authorization Server: According to Apple, upon installing iOS on an Apple device (e.g.,
iPhone), the device must first communicate with Apple’s “authorization server” for approval. The
device sends information to Apple about the physical iPhone and the version of iOS the user seeks
to install. The authorization server checks this information, and if the information presented
checks out, returns a cryptographic signature (known as an “AP Ticket”) authorizing installationon the device. The signed AP Ticket is saved to the device and is required to be checked every
time the device tries to run iOS. (Pl.’s SOF ¶¶ 14-15.) Corellium disagrees with this statement,
asserting instead that “iOS in the public IPSW distribution . . . has no such requirements––thissecurity function is hard-coded into physical iOS devices.” (Def.’s Resp. SOF [DE 513] ¶¶ 1415.)
Secure boot chain: Secure boot chain is a way Apple prevents unauthorized code fromrunning on its systems. The process involves an interaction between iOS and software embeddedin the physical device. (Wang Dep. 62:8-18, 212:4-22; Marineau-Mes Dep. 36:6-23.) It is “anextremely well-meaning and well-designed feature that is intended to safeguard the privacy andsecurity of Apple iPhone users[.]” (Pl.’s SOF ¶ 18.) The boot chain is “secure” because each step
must be verified before the next step can proceed. (Wang Dep. 212:4-22; Pl.’s SOF ¶ 17.)
Buddy program: When iOS is freshly installed on an Apple device, a program called“Buddy” runs. The “Buddy” program helps the user set up iOS on the device. One portion of the“Buddy” program presents the EULA governing that version of iOS to the user on the iOS device.
A user must accept the EULA before the user can continue to interact with any other part of iOS.

4

The parties disagree on the nature, operation, and purpose of some of these measures.
6

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 7 of 38

If the user does not accept the EULA, the Buddy program prevents the user from further accessing
iOS. (Andrews Decl. ¶ 17.)
Trust Cache: The trust cache is a list of trusted applications that Apple has approved forexecution on iOS. The trust cache prevents users from installing and operating unapproved
applications on iOS. The trust cache prevents the installation of rogue software and ensures that
only-Apple-verified applications can be run on iOS. (Pl.’s SOF ¶ 21.)
Pointer Authentication Codes (or PAC): This hardware feature works with Apple software
to protect iOS and makes it “difficult or impossible” for the kernel to run on non-Apple platform.
(Krstic Dep. 132:25-133:17, 140:23-141:18, 142:19-143:3.) Apple began implementing custom
PAC with the release of iOS 12.0 for the iPhone XR, XS, and XS Max in September 2018. (Pl.’s
SOF ¶ 22.) PAC is a cryptographic signature Apple inserts and stores in various places in iOS
code to ensure that the code is executed as intended, without modification or distortion. When thedevice processor receives certain instructions, it generates the cryptographic measurement for the
next instruction it has been asked to execute. If the measurement does not match the stored PAC,
the processor will halt execution. (Id.)
D. THE CORELLIUM PRODUCTCorellium was founded in August 2017. (Gorton Dep. [DE 472-25] 20:8; Skowronek Dep.
[DE 472-20] 46:21–47:2.) Development of a prototype of the Corellium Product began aroundsummer 2017. (Gorton Dep. 33:5-21.) By January 2018, Corellium was able to demo the creationof a virtual device and was able to use the virtual device in basic ways. (Gorton Dep. 33:22-34:20).
Corellium developed both a cloud (or online) version and an on-premises version (i.e., where thecustomer purchases and installs a server on their premises) of the Corellium Product. By the endof January 2018, a trial version (Version 1.1) of the cloud-based product was offered to a limited

7

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 8 of 38

number of users for beta testing (to detect bugs and any usability issues) and business development.
(Gorton Dep. 52:23-53:9; Def.’s Fourth Am. Ans. to First Interr. No. 1 [DE 470-9].)
The Corellium Product enables users to create and interact with virtual devices by loading
firmware (that is, files for operating systems like iOS, Android, and Linux). (Def.’s SOF ¶ 30.)
Virtualization is the ability to run software on hardware it is not ordinarily meant to run on. (Wang
Dep. 55:10-21.) Among other reasons, virtualization is beneficial because it permits the user torun software on faster hardware and permits examination and debugging of the software to get abetter understanding of how it works. (Wang Dep. 55:10-21.) According to Corellium’s founders,the Corellium Product was developed with the primary intent of facilitating security testing,research, and development by, inter alia, allowing researchers to examine aspects of iOS code.
(Wade Dep. 179:17-20, 180:12-13; Wang Dep. 210:9-212:3; Gorton Dep. 50:20-51:5; Skowronek
Dep. 71:18-23, 96:21-97:2.) Security research is an activity designed to find unintended andunknown weaknesses in a system, including through source code inspection and certain runtime
debugging. (Krstic Dep. 123:12-124:3.) Among other things, security researchers are interested
in whether software has vulnerabilities and how and if those vulnerabilities can be exploited anddefended against. (Wang Dep. 249:17-22.) Security researchers include, for example, membersof Apple’s Security Bug Bounty Program, a program that rewards researchers who help findvulnerabilities in Apple’s products. (Krstic Dep. 181:5-9.) Vulnerability is a technical term for a
bug that has security impact; that is, if exploited, it can undermine the security of the user’s system.
(Krstic Dep. 102:4-6. 5) Security researchers can use their talent for good or for nefarious purposes.
(Pl.’s SOF ¶ 61.)

5

“In some context a bug could be different from a vulnerability . . . . An exploit uses a vulnerability
to achieve a purpose,” such as a jailbreak. (Wang Dep. 51:9-14, 52:15-53:10.) Jailbreaking is a8Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 9 of 38

Turning back to the Corellium Product, Corellium directly sells to customers and has, until
recently, used a reseller for the on-premises version of the product. 6 (Gorton Dep. 15:1-16:2,
53:15-54:14, 125:17-19, 127:1-11.) For its direct sales, Corellium has a vetting process. (Gorton
Dep. 52:14-18, 116:7-126:6; Dyer Dep. [DE 472-32] 32:2-36:15, 39:13-40:14, 46:14-57:13.)
Generally, upon receiving an inquiry, the process begins with an initial evaluation. This initial
analysis takes several factors into consideration, including whether the inquiry came from anenterprise account or from an individual account (e.g., a Gmail account). Corellium also considers
the nature of the content of the inquiry and whether it comports with Corellium’s intended use forits product. For example, if the inquiry requests the ability to run iOS on an Android mobile
device, Corellium discards it. Similarly, if there are red flags based on the identity of a putative
customer (e.g., someone involved with unlawful activity) or based on the geographic origins of
the request, Corellium does not engage.
If Corellium finds, after the initial evaluation, that the request might be a qualified lead, it
responds and starts a line of communication with the putative customer. Discussions at this stage
may entail a telephone conversation, demo of the Corellium Product, providing a data sheet of
product features and pricing or an order form with license terms, or an offer of a trial period in thecloud. In some cases, Corellium also continues to investigate the potential customer to determine,for instance, the nature of their business and their affiliations. Red flags during this investigation
may result in a decision by Corellium not to continue to engage with the company.

“mechanism to exploit security vulnerability or allow execution of code that didn’t come from [thedeveloper].” Jailbreaking can be used for good. (Andrews Dep. 97:6-98:13.)
6Corellium contracted with two resellers but only one has engaged in any sales. (Gorton Dep.
15:25-16:16.)9Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 10 of 38. (Gorton Dep.
123:3-124:25, 163:8-164:7; Dyer Dep. 143:9-144:5, 150:15-153:11.) The vetting process issimilar for the on-premises and cloud versions of the Corellium Product, except that for the cloud
product, Corellium may sell to locations they are not otherwise comfortable shipping servers to.
(Gorton Dep. 125:21-126:6.)
In terms of Corellium’s control of the use of its product, customers are not required toreport bugs or vulnerabilities in iOS to Apple or Corellium. (Gorton Dep. 128:7-130:16.)
However, for the cloud product, if there are concerns regarding malicious activity, Corellium canlog into an account, investigate, and terminate the account, if necessary. (Gorton Dep. 98:1-6,
99:13-17, 107:10-20; Wade Dep. 204:4-15, 205:14-207:16, 208:24-15.) Corellium does not havethe same control over the on-premises version of the Corellium Product; there is no way to evenknow where the product is after it has been shipped from Corellium, and customers are not required
to keep the product in a particular location upon sale. Instead, Corellium asserts that it relies on
the legal enforcement of licensing or end user agreements to ensure that its customers comply withany legal requirements.
Corellium’s CEO and its Vice President of Sales and Business Development testified thatthe typical inquiry received pertains to application security testing, operating system security
testing, training, and “miscellaneous.” “Miscellaneous” requests are not received often but might
include things like continuous integration or the development of tools, such as forensics tools.
(Gorton Dep. 118:4-24; see also Dyer Dep. 48:5-17, 83:9-105:15.) While Corellium may engage
with iOS app developers, these developers are not target customers, and Corellium generally does

10

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 11 of 38

not advertise for application development, because the Corellium Product “is designed for security
testing and research particularly,” and “[t]he price point makes it unattractive to app developers .
. . .” (Gorton Dep. 118:14-24.)
Once Corellium decides to sell the product, for either version of the Corellium Product,
customers must pay an annual licensing fee and must purchase a server. Additionally, if the user
chooses the Enterprise or Premium edition of the Corellium Product they must pay an upgrade fee.
(Gorton Dep. 92:13-95:21; Dyer Dep. 66:1-24.) On-premises customers perform their own installand upgrades and manage their network. (Gorton Dep. 98:23-99:2; Wang Dep. 99:23-103:7,
106:4-7.) Prior to April 2018, upon setting up the hardware and IP settings, an on-premisescustomer would not need to take additional steps to setup, as firmware (e.g., IPSW file) links were
provided by ipsw.me. (Def.’s Fourth Am. Ans. to First Interr. No. 2.) However, for versions of
the Corellium Product released between April 2018 and March 2019, an additional step ofobtaining IPSW files must be performed and the files must be placed in. (Def.’s Fourth Am. Ans. to First Interr. No. 2.) Then, for versions of theCorellium Product released during or after March 2019, there are additional steps to get to thedirectory permitting download of the IPSW files required to set up iOS devices. (Def.’s Fourth
Am. Ans. to First Interr. No. 2.) The setup for cloud-based customers is more straightforward;
users log into their online account to get started.
At the point users are ready to create a virtual iOS device, Corellium maintains an IPSW
database which matches physical devices with available versions of iOS and the associated internet
download addresses (URLs) for each IPSW file. (Pl.’s SOF ¶ 51.) From early 2019 until February
2020, Corellium’s cloud interface included a “dropdown” menu that enabled its customers to selectfrom a prepopulated list of iOS versions and iOS Devices. The customer would pick a version of11

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 12 of 38

iOS and device from that menu (e.g., iPhone 11 Max running iOS 13), and the Corellium Productwould automatically download the associated IPSW file from Apple’s servers. (Pl.’s SOF ¶ 52.)
Corellium also instructs its customers on how to manually download IPSW files from Apple’s
servers and then load or import those files into the Corellium Product to create iOS virtual devices.
(Pl.’s SOF ¶ 53.) Thus, customers obtain IPSW files by manual download or by a Corellium
program that automates downloading the IPSW files from Apple servers. On-premises customers
have the option of saving IPSW files manually. (Def.’s SOF ¶ 55.) Each time a Cloud user wants
an IPSW file, the user must download it from Apple’s servers; Corellium does not save the IPSW
file on its system. (Wang Dep. 152:18-153:1. 7)
The Corellium Product dynamically unpacks IPSW files as they are downloading. (Def.’s
SOF ¶ 53.) The files are “transiently stored” until they can be transferred to the right computenode and translated, and are there for a “very short amount of time.” (Wang Dep. 173:8-17;
Skowronek Dep. 116:2-117:1, 119:13-120:22, 166:8-19.) Additionally, in creating virtual devices,
the Corellium Product does not use iOS in the form in which it exists within the downloaded IPSW
files. Rather, once a user loads the firmware, the Corellium Product “transforms” iOS by. (Def.’s SOF ¶ 66. 9) Thus, following the transformation process, the software

7

There is evidence that, at least once, Corellium provided IPSW files to its reseller for a demo
unit. (Azimuth Security, LLC Dep. [DE 557-13] 175:176:4.)
8.
9Corellium uses the term “transform” to describe this process, while Apple appears to prefer theword “modify.” Regardless if it is a “transformation” or “modification,” there are some changes
12Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 13 of 38

involved in creating the virtual device derives from a combination of Corellium’s code and Apple’s
iOS code. (Wang Dep. 158:13-159:16, 161:15-162:5, 195:17-23; Andrews Dep. 102:23-103:16.)
Additionally, Corellium ordinarily avoids using encrypted parts of the IPSW files because it cannot
decrypt them. (Wang Dep. 64:2-15, 65:4-12, 259:19-24.) However, if a user has an unencryptedversion of otherwise encrypted portions of the firmware, the Corellium Product allows the user toload it and see those portions displayed in the Corellium Product. (Gorton Dep. 96:9-19.)
E. ACQUISITION EFFORTS
Between January 2018 and the summer of 2018, the parties engaged in discussions
regarding Apple’s potential acquisition of Corellium. During this time, the parties met in-person
and telephonically. Corellium explained to Apple the technology behind the Corellium Productand how it works, and discussed Corellium’s business and intention to commercialize theCorellium Product. 10 In addition to several engineers, discussions involved Apple’s Senior Vice
President of Software Engineering, the Vice President of OS Software Engineering, and the Headof Apple’s Security Engineering and Architecture. (See Federighi, Andrews, & Krstic Dep., supra
n.10.) Corellium also provided Apple with a temporary account or administrative access to theCorellium Product. (Andrews Dep. 50:15-54:9, 60:15-20, 168:17-25.) While Apple’s legal
department did not formally discuss copyright violations with Corellium, there is a dispute as towhether, and to what extent, Corellium was told by Apple employees that Corellium needed amade once the user loads the IPSW files. Hence, the Court uses the words “change,’ “modify,”
and “transform” interchangeably.
10

See, e.g., Gorton Dep. 177:22-178:8, 180:18-181:17; Andrews Dep. 48:23-49:25, 50:15-54:9,
60:15-20, 102:13-22, 112:23-113:13, 133:2-134:4, 162:14-163:12, 168:17-25, 188:17-24; Krstic
Dep. 72:12-23, 74:18-75:3, 143:20-144:6, 149:6-15; Wade Dep. 274:4-276:15; Smith Dep. [DE472-28] 64:13-65:25, 83:18-84:10, 134:4-135:3; Federighi Dep. [DE 472-10] 31:8-23, 73:5-13,
142:8-23.
13

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 14 of 38

license to utilize iOS in connection with the Corellium Product. (Wade Dep. 276:4-15, 278:1-5;
Federighi Dep. 42:9-44:8, 115:12-14, 128:2-9, 132:8-133:4.)
If Apple had acquired the Corellium Product, the product would have been used internallyfor testing and validation (that is, for verifying any system weaknesses and functioning of devices).
(Marineau-Mes Dep. 27:3-22, 121:17-19; Krstic Dep. 171:22-25; Smith Dep. 61:16-19.) Even
with the Corellium Product, Apple would still need physical iPhones to conduct its testing. (Wade
Dep. 210:20-21; Marineau-Mes Dep. 200:10-202:18.) Generally, the Corellium Product received
positive feedback from Apple employees. (Andrews Dep. 159:13-16, 192:23-193:15; Krstic Dep.
106:5-10.) But there were also concerns, including regarding its utility and long-term value toApple. (Krstic Dep. 106:5-107:12, 110:9-22.)
The parties ultimately could not agree on a price and, as a result, acquisition efforts were
unfruitful. Roughly a year after talks fell apart, Apple filed this suit. (See Compl. [DE 1].)
F. SECOND AMENDED COMPLAINT
In the Second Amended Complaint [DE 589], Apple asserts claims against Corellium for
Direct Federal Copyright Infringement (Computer Programs), 17 U.S.C. § 501, Direct Federal
Copyright Infringement (Graphical User Interface Elements), 17 U.S.C. § 501, Contributory
Federal Copyright Infringement, 17 U.S.C. § 501, and Unlawful Trafficking, 17 U.S.C. §§1201(a)(2), (b), 1203. Apple contends that Corellium infringed on the following products:

14

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 15 of 38(Sec. Am. Compl., Ex. A.) Each of Apple’s copyright registrations “[e]xclude . . . [p]reviously
published Apple material,” including prior versions of iOS. (Def.’s SOF ¶ 21.)
SUMMARY JUDGMENT STANDARD
Under Federal Rule of Civil Procedure 56, “summary judgment is proper if the pleadings,
depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any,
show that there is no genuine issue as to any material fact and that the moving party is entitled toa judgment as a matter of law.” Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986). “[G]enuine
disputes of facts are those in which the evidence is such that a reasonable jury could return a verdict
for the non-movant.” Mann v. Taser Int’l, Inc., 588 F.3d 1291, 1303 (11th Cir. 2009) (internalmarks and citation omitted). A fact is material if, under the applicable substantive law, it might
affect the outcome of the case. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986).
A party seeking summary judgment bears the initial responsibility of supporting its motion
and identifying those portions of the record which it believes demonstrate the absence of a genuine
issue of material fact. Celotex, 477 U.S. at 323. “[A]t the summary judgment stage the judge’s
15

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 16 of 38

function is not himself to weigh the evidence and determine the truth of the matter but to determine
whether there is a genuine issue for trial.” Anderson, 477 U.S. at 249. The Court “must view all
the evidence and all factual inferences reasonably drawn from the evidence in the light mostfavorable to the nonmoving party and must resolve all reasonable doubts about the facts in favorof the non-movant.” Rioux v. City of Atlanta, Ga., 520 F.3d 1269, 1274 (11th Cir. 2008) (internalmarks and citation omitted).
DISCUSSION
Apple’s claims fall in two buckets: copyright infringement and violation of section 1201
of the DMCA. In its motion, Corellium argues it is entitled to summary judgment in its favorbecause (1) the Corellium Product contains no copyrighted Apple code, (2) the fair use doctrine
makes any use of protectable elements of Apple’s work permissible, (3) Apple misused its
copyright, (4) Apple should be estopped from asserting a copyright claim against Corellium, (5)Apple cannot show that Corellium infringed any of the 17 copyrights at issue in the Second
Amended Complaint, 11 and (6) the Corellium Product does not violate the DMCA. Apple also
moves for partial summary judgment on the DMCA issue, arguing it is entitled to summary
judgment in its favor because Corellium violated the antitrafficking provisions of the statute.
Before turning to the DMCA, the Court will analyze the copyright claim. If the Court
agrees that the fair use doctrine applies, Corellium’s other arguments are rendered moot. Thus,
the Court will address that argument first.

11

Apple initially identified 22 copyright registrations at issue but has since removed 5 of them.
Compare Compl., with Sec. Am. Compl.
16

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 17 of 38

I.
A.

COPYRIGHT CLAIM

The Copyright Clause

The Copyright Clause of the United States Constitution provides:
The Congress shall have Power . . . To promote the Progress of Science and usefulArts, by securing for limited Times to Authors and Inventors the exclusive Right totheir respective Writings and Discoveries . . . .
U.S. CONST. art. I, § 8, cl. 8. The Copyright Clause is “both a grant of power and a limitation,”and “to the extent [Congress] enacts copyright laws at all,” such laws must “promote the Progressof Science.” Eldred v. Ashcroft, 537 U.S. 186, 212 (2003). Indeed, “[t]he primary objective of
copyright is not to reward the labor of authors, but ‘[t]o promote the Progress of Science and usefulArts.’” Feist Publ’ns, Inc. v. Rural Tel. Serv. Co., 499 U.S. 340, 349 (1991) (citing the Copyright
Clause). Even in the technological era, “the Copyright Act must be construed in light of this basic
purpose.” Twentieth Century Music Corp. v. Aiken, 422 U.S. 151, 156 (1975).
B.

Fair Use

From the infancy of copyright protection, courts have recognized that some opportunity
for fair use of copyrighted materials is necessary to fulfill copyright’s purpose of promoting “theProgress of Science and useful Arts.” Campbell v. Acuff-Rose Music, Inc., 510 U.S. 569, 575(1994) (citing the Copyright Clause). “If copyright’s utilitarian goal is to be met, we must be
careful not to place overbroad restrictions on the use of copyrighted works, because to do so would
prevent would-be authors from effectively building on the ideas of others.” Cambridge Univ.
Press v. Patton, 769 F.3d 1232, 1238 (11th Cir. 2014) (citation omitted). “In a sense, the grant toan author of copyright in a work is predicated upon a reciprocal grant to the public by the work’s
author of an implied license for fair use of the work.” Id. at 1257 (citation omitted). “[C]opyrightis not an inevitable, divine, or natural right that confers on authors the absolute ownership of their

17

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 18 of 38

creations. It is designed rather to stimulate activity and progress in the arts for the intellectualenrichment of the public.” Id. at 1256.
“Some unpaid use of copyrighted materials must be allowed in order to prevent copyrightfrom functioning as a straightjacket that stifles the very creative activity it seeks to foster.” Id. at1238. “If we allow too much unpaid copying, however, we risk extinguishing the economic
incentive to create that copyright is intended to provide.” Id. Therefore, “a secondary user who
takes overmuch in the name of fair use operates outside the bounds of his or her implied-by-law
license.” Id. at 1257.
Pursuant to its authority under the Copyright Clause, Congress codified the judiciallycreated fair use defense, “to ensure that copyright protection advances rather than thwarts theessential purpose of copyright . . . .” Lexmark Int’l, Inc. v. Static Control Components, Inc., 387
F.3d 522, 537 (6th Cir. 2004). Section 107 of the Copyright Act provides:[T]he fair use of a copyrighted work, including such use by reproduction in copies. . . for purposes such as criticism, comment, news reporting, teaching (including
multiple copies for classroom use), scholarship, or research, is not an infringementof copyright. In determining whether the use made of a work in any particular caseis a fair use the factors to be considered shall include(1) the purpose and character of the use, including whether such use is of acommercial nature or is for nonprofit educational purposes;(2) the nature of the copyrighted work;(3) the amount and substantiality of the portion used in relation to the copyrighted
work as a whole; and(4) the effect of the use upon the potential market for or value of the copyrighted
work.
17 U.S.C. § 107.
The enumerated examples (e.g., criticism, comment, and research) are meant to give someidea of the sort of activities courts might regard as fair use under the circumstances. Patton, 769
F.3d at 1259. “This listing was not intended to be exhaustive, or to single out any particular use
as presumptively a ‘fair’ use.” Id. (citation omitted). Likewise, the four statutory factors are not18Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 19 of 38

exclusive. Harper & Row Publishers, Inc. v. Nation Enters., 471 U.S. 539, 560 (1985). However,they “establish the contours within which a court may investigate whether, in a given case, afinding of fair use would serve the objectives of copyright.” Id. These factors are not to be treatedin isolation one from another. Campbell, 510 U.S. at 578. Rather, “[a]ll are to be explored, andthe results weighed together, in light of the purposes of copyright.” Id. Still, some factors may
weigh more heavily on the fair use determination than others. Patton, 769 F.3d at 1260; see, e.g.,
Campbell, 510 U.S. at 586 (noting that the second factor––nature of the work––is generally notimportant in determining whether a finding of fair use is justified in the case of a parody); Harper& Row Publishers, 471 U.S. at 566 (noting that the fourth factor––effect on market value––“isundoubtedly the single most important element of fair use.”).
“The affirmative defense of fair use is a mixed question of law and fact as to which theproponent carries the burden of proof.” Peter Letterese & Assocs., Inc. v. World Inst. Of
Scientology Enters., 533 F.3d 1287, 1307 n.21 (11th Cir. 2008). Thus, the burden is on Corellium
to “convince the court that allowing [its] unpaid use of copyrighted material would be equitable
and consonant with the purposes of copyright.” Patton, 769 F.3d at 1238. Where material facts
are not in dispute, fair use is appropriately decided on summary judgment. See, e.g., Stewart v.
Abend, 495 U.S. 207, 214, 236-38 (1990).
With these principles in mind, the Court now analyzes each of the relevant factors.
1. Purpose and character of the allegedly infringing use
Under this first factor, courts consider “(1) the extent to which the use is a ‘transformative’
rather than merely superseding use of the original work and (2) whether the use is for a nonprofit
educational purpose, as opposed to a commercial purpose.” Patton, 769 F.3d at 1261. These
facets do not create “hard evidentiary presumption[s]” or “categories of presumptively fair use.”

19

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 20 of 38

Campbell, 510 U.S. at 584. In other words, “the mere fact that a use is educational and not for
profit does not insulate it from a finding of infringement, any more than the commercial characterof a use bars a finding of fairness.” Id. Rather, the commercial or non-transformative uses of awork are to be regarded as “separate factor[s] that tend[ ] to weigh against a finding of fair use,”and “the force of that tendency will vary with the context.” Id. at 585 (citation omitted).
a. Transformative
In deciding if the alleged infringing use of the copyrighted work is transformative, courts
consider “‘whether the new work merely supersede[s] the objects of the original creation, orinstead adds something new, with a further purpose or different character, altering the first withnew expression, meaning, or message.’” Patton, 769 F.3d at 1262 (citing Campbell, 510 U.S. at
579). “Even verbatim copying ‘may be transformative so long as the copy serves a different
function than the original work.’” Id. (citation omitted). While a transformative use is “‘notabsolutely necessary for a finding of fair use,’ . . . transformative uses tend to favor a fair use
finding because a transformative use is one that communicates something new and different fromthe original or expands its utility, thus serving copyright’s overall objective of contributing to
public knowledge.” Authors Guild v. Google, Inc., 804 F.3d 202, 214 (2d Cir. 2015) (citing
Campbell, 510 U.S. at 579). Thus, copying from an original for the purpose of criticism orcommentary on the original or to provide information about it, tends most clearly to satisfy thenotion of the ‘transformative’ purpose involved in the analysis of factor one. Id. at 215–16. “The
more the appropriator is using the copied material for new, transformative purposes, the more it
serves copyright’s goal of enriching public knowledge and the less likely it is that the appropriation
will serve as a substitute for the original or its plausible derivatives, shrinking the protected market
opportunities of the copyrighted work.” Id. at 214 (citing Campbell, 510 U.S. at 591).

20

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 21 of 38

Apple disagrees with Corellium that the Corellium Product is transformative. According
to Apple, the Corellium Product is not transformative because Corellium merely modifies iOS and“offers the software in a different medium––virtually, rather than on a physical device.” (Pl.’s
Resp. [DE 557-1] at 13.) For support, Apple cites cases like Oracle America, Inc. v. Google LLC,
886 F.3d 1179, 1187 (Fed. Cir. 2018), where courts found the mere repackaging of copyrighted
material from one medium to the next, without new content or meaning, to be non-transformative.
Here, the evidence establishes that the Corellium Product is not merely a repackaged
version of iOS––this time in a virtual environment as opposed to an iPhone. Rather, Corellium
makes several changes to iOS and incorporates its own code to create a product that serves atransformative purpose. The Corellium Product makes available significant information about
iOS, permitting users to, inter alia: (1) see and halt running processes; (2) modify the kernel; (3)use CoreTrace, a tool to view system calls; (4) use an app browser and a file browser; and (5) takelive snapshots. These features are beneficial to security research. And, as Apple concedes, theCorellium Product adds significant features that are not available on Apple’s devices running iOS.
Unequivocally, this case is not like Oracle. In Oracle, the defendant, Google, copiedverbatim the declaring code of a number of the plaintiff’s copyrighted and patented application
programming interface (“API”) packages; made no alteration to the expressive content or message;
and used the API packages in Google’s competing Android operating system for the same purpose
as plaintiff’s use of API packages in its own platform. 886 F.3d at 1185-1211. Oracle isdistinguishable from this case, where Corellium transforms iOS and adds new content, Corellium
is not a direct competitor with Apple in the iOS device market, and the Corellium Product has
functionalities not available on Apple’s iOS devices.

21

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 22 of 38

The Court finds that the purpose of the Corellium Product in this case is more akin to
Google’s transformative search and snippet function in Author’s Guild. In that case, the plaintiffs––authors of published books under copyright––sued Google for copyright infringement. 804 F.3d
at 206-11. Acting without the authors’ permission, Google made digital copies of tens of millions
of books that were submitted to it in connection with its Library Project and its Google Books
project. Id. Google scanned the digital copies and established a publicly available search function,
which allowed internet users to search without charge to determine whether the book contains a
specified word or term and see “snippets” of text containing the searched-for terms. Id. Google
also allowed the participating libraries to download and retain digital copies of books, and Google
retained the original scanned image of each book and all the digital information created in theprocess on its servers. Id.
Google argued that its actions constituted fair use. Id. at 211, 214-19. The plaintiffs
disagreed. On the issue of transformativeness, plaintiffs argued that Google’s digital copying of
entire books, the snippet feature (which allowed users to read portions of the book), and Google’s
distribution of digital copies to the libraries did not constitute transformative use but, rather,
provided a substitute for plaintiffs’ works and subjected plaintiffs to the risk of loss of copyrightrevenues through access allowed by libraries.

Id.

The Second Circuit rejected plaintiffs’

arguments and sustained the district court’s finding of fair use.
Finding Google’s search function and snippet view to be transformative, the Second Circuit
explained that “the purpose of Google’s copying of the original copyrighted books is to makeavailable significant information about those books, permitting a searcher to identify those that
contain a word or term of interest” and “to learn the frequency of usage of selected words in theaggregate corpus of published books in different historical periods.” Id. Snippet view, which was22

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 23 of 38“designed to show the searcher just enough context surrounding the searched term to help her
evaluate whether the book falls within the scope of her interest,” added “to the highly
transformative purpose of identifying books of interest to the searcher.” Id.
Here, like Google’s search and snippet functions, the Corellium Product makes available
significant information about iOS. A user can see running processes, halt execution of the virtual
device, amend the kernel, look at lists of files, clone snapshots, among other things––giving great
introspection into aspects of iOS and its operation on iOS devices. These tools are useful tosecurity research and testing. The product creates a new, virtual platform for iOS and adds
capabilities not available on Apple’s iOS devices. See Sony Comput. Entm’t, Inc. v. Connectix
Corp., 203 F.3d 596, 599, 606 (9th Cir. 2000) (finding fair use where defendant made intermediate
copies of defendant’s copyrighted software program and, by reverse engineering, createddefendant’s own software program which emulated the functioning of plaintiff’s game console sousers could play plaintiff’s games on their computer as opposed to on the console; the court foundthat the alleged infringing work was “modestly transformative” because it (1) created a newplatform or environment in which consumers could play games designed for plaintiff’s product,and (2) notwithstanding the similarity of uses and functions between the copyrighted andsecondary work, defendant’s program was “a wholly new product”).
Finally, Apple argues that the Corellium Product does not serve a transformative purpose
because it can be used for other purposes other than security research and Corellium has been
willing to sell to anyone (presumably, meaning not just to security researchers). This argument is
not persuasive. To start, it is settled that an alleged infringing work does not need to fall within
the enumerated examples of section 107 (e.g., research) to constitute fair use. Further, Apple
provides no authority to support its position that potential unintended use or a secondary use for23

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 24 of 38

an alleged infringing product precludes a finding of fair use, where otherwise there is evidence
that the product serves some transformative purpose. In fact, caselaw seems to indicate otherwise.
For example, in A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630, 634 (4th Cir. 2009), thedefendant owned and operated an online technology system used by schools to evaluate originalityof written works to prevent plagiarism. The technology gave schools the option of “archiving” orstoring students’ written assignment, which then became a part of the defendant’s database toevaluate the originality of other students’ works in the future. Id.
The plaintiffs––the students––argued that the defendant’s use of their works could not betransformative because the archiving process added nothing but, rather, merely stored the work
unaltered and in its entirety. Id. at 639. The appellate court was not persuaded. It held that “theuse of a copyrighted work need not alter or augment the work to be transformative in nature.” Id.
And, defendant’s use of plaintiffs’ works was transformative because it had an entirely different
function and purpose than the original works. Id. The students then argued that defendant’s work
failed to “effect” its purported transformative purpose. Id. at 639-40. Rejecting this argument, theappellate court explained that the “question of whether a use is transformative does not rise or fallon whether the use perfectly achieves its intended purpose.” Id. The fact that the defendant’ssystem did detect some level of plagiarism was sufficient, even if it was an imperfect system. Id.
(citing Campbell, 510 U.S. at 582).
Here, there is evidence in the record to support Corellium’s position that its product is
intended for security research and, as Apple concedes, can be used for security research. Further,
Apple itself would have used the product for internal testing had it successfully acquired thecompany. Both Corellium’s CEO and its VP of Sales have testified to the use cases for theCorellium Product for which they fielded inquiries. These inquiries pertain to, for example,

24

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 25 of 38

application security testing and operating system security testing. Apple has presented no evidence
to raise a genuine issue of material fact on this point. Apple points to the testimony of Corellium’s
reseller. In the quoted portion of the transcript, the deponent merely speculates––stating he“believe[s]” (not “knows”)––that Corellium wanted to “sell their product to whoever wasinterested in acquiring it.” (Azimuth Dep. 102:25-103:3.) The deponent offers no facts that
contradict evidence presented by Corellium regarding the use of the Corellium Product for security
research.
Therefore, the Court finds that the Corellium Product serves a transformative purpose.
b. Nonprofit educational versus commercial purpose
Concerning this aspect of the first factor of the fair use analysis, Apple argues that because
the Corellium Product is sold commercially, and for significant amounts, those facts compel afinding in Apple’s favor. (Pl.’s Resp. at 13.) Not so. To the contrary, the Supreme Court hascautioned against drawing presumptions against commercial fair uses. See Campbell, 510 U.S. at
583-85 (reversing appellate court finding that alleged infringing work done for profit could not be
fair use and reiterating that the commercial or nonprofit character of a work is not conclusive but
merely factors to be weighed under the fair use analysis). Furthermore, “the more transformative
the new work, the less will be the significance of other factors, like commercialism, that may weighagainst a finding of fair use.” Id. at 579. “Many of the most universally accepted forms of fairuse . . . are all normally done commercially for profit.” Authors Guild, 804 F.3d at 219.
The Court has found that the Corellium Product is transformative; it adds something new
to iOS, with a further purpose or different character than Apple’s iOS devices. Hence, Corellium’s
profit motivation does not undermine its fair use defense, particularly considering the publicbenefit of the product.

25

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 26 of 38

Therefore, both facets of the first factor favor a finding of fair use.
2. Nature of the copyrighted work
This second factor recognizes that there is a hierarchy of copyright protection depending
upon the nature of the copyrighted work. Peter Letterese & Assocs., 533 F.3d at 1312 (citation
omitted). “Works that are ‘closer to the core of intended copyright protection,’ and thus merit
greater protection, include original as opposed to derivative works; creative as opposed to factual
works; and unpublished as opposed to published works.” Id. (citation omitted). “Although‘software products are not purely creative works,’ it is well established that copyright law protects
computer software.” Oracle Am., 886 F.3d at 1204 (citation omitted).
That said, there are significant limitations on copyright protection for software. See, e.g.,Sony Comput. Entm’t, 203 F.3d at 602 (concluding that defendant’s intermediate copying and useof plaintiff’s software program was a fair use for the purpose of gaining access to the unprotected
elements of plaintiff’s software, and explaining that while the “object code of a program may be
copyrighted as expression . . . it also contains ideas and performs functions that are not entitled tocopyright protection.”); Oracle Am., Inc. v. Google Inc., 750 F.3d 1339, 1360 (Fed. Cir. 2014)(“Under the merger doctrine, a court will not protect a copyrighted work from infringement if theidea contained therein can be expressed in only one way. For computer programs, ‘this means thatwhen specific [parts of the code], even though previously copyrighted, are the only and essential
means of accomplishing a given task, their later use by another will not amount to infringement.’”)(internal citation omitted). These limitations on copyright protection for software are important;they ensure that the primary objective of copyright––the progress of science and art––continues tobe served. See Feist Publ’ns, Inc, 499 U.S. at 349 (citing the Copyright Clause); Sega Enters. Ltd.
v. Accolade, Inc., 977 F.2d 1510, 1527 (9th Cir. 1992), as amended (Jan. 6, 1993).

26

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 27 of 38

Corellium argues that, based on the interest of security researchers, the Corellium Productmakes use of the functional aspects of iOS, as opposed to Apple’s creativity, and those functional
aspects are not protectable. In response, Apple briefly states that iOS is “sophisticated,” “popular,”and its “development necessarily involved significant creativity,” but does not otherwise mount anadequate challenge to Corellium’s position.
While the Court notes the limitations on copyright protection for software, in the end, this“factor has rarely played a significant role in the determination of a fair use dispute.” Authors
Guild, 804 F.3d at 220. Thus, the Court moves to the next factor.
3. Size and significance of portion of the copyrighted work that was copied“This third factor examines whether defendants have helped themselves overmuch of the
copyrighted work in light of the purpose and character of the use.” Patton, 769 F.3d at 1271
(citation and internal marks omitted). Apple contends that Corellium has done so, by extracting,copying, publicly displaying, and modifying iOS.
The quantity of the copyrighted work copied does not give rise to any presumption. To thecontrary, “courts have rejected any categorical rule that a copying of the entirety [of the
copyrighted work] cannot be a fair use.” Authors Guild, 804 F.3d at 221. “Even verbatim copying
may be transformative so long as the copy serves a different function than the original work.”
Patton, 769 F.3d at 1262 (internal marks and citation omitted). “Complete unchanged copying
has repeatedly been found justified as fair use when the copying was reasonably appropriate toachieve the copier’s transformative purpose and was done in such a manner that it did not offer acompeting substitute for the original.” Authors Guild, 804 F.3d at 221. So, the appropriate inquiry
under this factor is whether “‘the quantity and value of the materials used . . . are reasonable inrelation to the purpose of the copying.’” Patton, 769 F.3d at 1272 (quoting Campbell, 510 U.S. at

27

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 28 of 38586). In making this determination, courts consider not only the quantity of the materials used,
but their quality and importance, too. Id. at 1271. “‘[T]he amount and substantiality of the portion
used’ is measured with respect to the ‘copyrighted work as a whole,’ not to the putatively
infringing work.” Peter Letterese & Assocs., 533 F.3d at 1314–15 (citation omitted)
Apple argues that, to the extent Corellium users are only interested in a subset of iOS,
Corellium’s use of iOS is not proportional as “the entire IPSW” is copied. This argument has no
merit. iOS is contained in the IPSW files and, therefore, it is necessary to download and explore
the IPSW files to access iOS. Once imported from Apple’s servers, to create a virtual device on
the Corellium Product, the files are transiently stored and then modified by altering aspects of iOS
and adding Corellium’s own code. This use of the IPSW files is permissible and proportional,
particularly considering the transformative finished product. See, e.g., Sony Comput. Entm’t, 203
F.3d at 602-10 (concluding that defendant’s intermediate copying and use of plaintiff’s software
program was a fair use); Sega Enters., 977 F.2d at 1527-28 (“[W]here disassembly is the only way
to gain access to the ideas and functional elements embodied in a copyrighted computer program
and where there is a legitimate reason for seeking such access, disassembly is a fair use of the
copyrighted work, as a matter of law.”); Authors Guild, 804 F.3d at 221 (finding defendant’s
copying of entire original copyrighted books permissible because it was necessary to serve thepurpose of the alleged infringing work of making significant information about those books
available, permitting a searcher to identify a word or term of interest and to learn the frequency ofusage, and to show the searcher just enough context surrounding the searched term to help her
evaluate whether the book falls within the scope of her interest). 12

12

In this vein, the Court also finds Corellium’s download and use of the publicly available IPSW
files solely for its own internal testing is permissible.
28

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 29 of 38

Corellium’s copying, modifying, and using of iOS is reasonable in relation to the purposeof the copying. The testimony is that the Corellium Product is intended to create a virtualenvironment in which users can, for instance, examine, test, and research iOS or portions of iOS
code. 13 To be an efficient and effective research environment that accurately reflects the operationof iOS on Apple’s devices, the Corellium Product necessarily utilizes iOS. In line with thispurpose, the Corellium Product excludes or does not virtualize the full functionality of features
available on iOS devices, like Face ID, Touch ID, baseband, camera, the App Store, and so on.
Users of the Corellium Product cannot make calls or send text messages, which can be done on an
iPhone.
In permitting users to interact with the virtual device, the Corellium Product allows users
to view certain graphical user elements (like the iPhone home screen or wallpaper). The evidence
does not reflect that these images serve a central purpose or are of principal importance to theoverall functionality of the Corellium Product, or are a major part of Apple’s complex copyrighted
work as a whole. 14 Thus, Corellium’s use of these graphical elements does not undermine a findingof fair use. See, e.g., Solid Oak Sketches, LLC v. 2K Games, Inc., 449 F. Supp. 3d 333, 349(S.D.N.Y. 2020) (finding in case against an interactive entertainment and video game company
brought by licensee of copyrighted tattoos used by professional basketball players that, while thetattoos were copied in their entirety, defendants did so in order to effectuate the transformative
purpose of creating a realistic game experience); Sony Comput. Entm’t Am., Inc. v. Bleem, LLC,

13

As stated earlier, the Corellium Product is also capable of virtualizing Android and Linux, andit can run any operating system on the virtual Apple product once it has restore ramdisk. (Wang
Dep. 177:10-178:25.) The Corellium Product does not need a particular operating system. Id.
Because only iOS is at issue in this case, the Court focuses on users interacting with iOS.
14

See Wang Dep. 215:4-217:16.
29

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 30 of 38

214 F.3d 1022, 1028-29 (9th Cir. 2000), amended on denial of reh’g (July 10, 2000) (finding incase brought by a manufacturer of console video games against a developer of a software emulator,
alleging that developer’s use of “screen shots” from manufacturer’s games in developer’s
advertising violated manufacturer’s copyright, that developer’s degree of copying was reasonable
where the “screen shots” at issue were a small portion of the complex copyrighted work as awhole).
Upon reviewing the evidence, the Court finds that Corellium’s use of iOS (in terms ofquantity, quality, and importance) is proportional and necessary to achieve Corellium’s
transformative purpose. Therefore, this third factor weighs in favor of finding fair use.
4. Effect of allegedly infringing use on potential market for or value of theoriginal“With respect to the fourth factor—the effect of the use on the value of the copyrighted
material—the relevant question . . . is whether the infringement impacted the market for the
copyrighted work itself.” Lexmark Int’l, 387 F.3d at 544 (citation omitted). This factor “focuseson whether the copy brings to the marketplace a competing substitute for the original, or its
derivative, so as to deprive the rights holder of significant revenues because of the likelihood that
potential purchasers may opt to acquire the copy in preference to the original.” Authors Guild,
804 F.3d at 223. The adverse impact courts are primarily concerned with is that of market
substitution. Patton, 769 F.3d at 1275 (citation omitted).
In this lawsuit, Apple asserts 17 copyrights pertaining to iOS; alleged copyrights in 12
versions of iOS released since 2015 and 5 copyrights in visual works of arts contained in iOS (i.e.,
icons of Apple’s built-in applications and wallpaper). Concerning this fourth factor, there is noevidence that the Corellium Product has affected, let alone materially affected, Apple’s market or
the market value for iOS. Instead, Apple argues that Corellium markets its product as an
30

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 31 of 38

alternative to an iPhone and lists Apple’s “iOS Simulator” as a direct competitor. This marketing––whether puffery or factually accurate––is not evidence that the Corellium Product supplants
Apple’s market for iOS devices or that it has deprived, or will deprive, Apple of (significant)revenue made from iOS.
Next, Apple argues that the Corellium Product will compete with its upcoming Security
Research Device Program, under which Apple will be licensing devices running iOS to security
researchers in return for the disclosure of security vulnerabilities and related discoveries to Apple.
This argument misses the mark. The relevant question under this fourth factor is whether theCorellium Product has impacted the market for the copyrighted work itself––that is, for iOS. See,e.g., Lexmark Int’l, 387 F.3d at 545 (noting that the “the district court focused on the wrong market:
it focused not on the value or marketability of the Toner Loading Program, but on Lexmark’s
market for its toner cartridges. Lexmark’s market for its toner cartridges and the profitability of
its Prebate program may well be diminished by the [defendant’s] SMARTEK chip, but that is not
the sort of market or value that copyright law protects.”). Here, while Apple may very well expand
into the security research or virtualization market, copyright law does not confer a monopoly. Sony
Comput. Entm't, 203 F.3d at 607.
This principle equally applies to Apple’s final argument, that it previously rejected theoption of “licensing exactly this kind of software” (that is, a product like the Corellium Product).
(Pl.’s Resp. at 17.) “[A] copyright holder can always assert some degree of adverse [effect] on its
potential licensing revenues as a consequence of the secondary use at issue simply because thecopyright holder has not been paid a fee to permit that particular use.” Patton, 769 F.3d at 1276
(citation omitted, italics in original). “The goal of copyright is to stimulate the creation of new31

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 32 of 38

works, not to furnish copyright holders with control over all markets. Accordingly, the ability tolicense does not demand a finding against fair use.” Id.
The Court does not find any significant market impact on iOS. Thus, this fourth factor alsofavors a finding of fair use.
5. Good faith and fair dealing
In addition to, or as a part of, the four statutory factors, Apple asks the Court to consider
Corellium’s lack of good faith and fair dealing. According to Apple, “Corellium’s conduct has
been entirely improper” because it deals with bad actors and does not require users to report bugs
to Apple.
Apple’s position is puzzling, if not disingenuous.

. (Krstic Dep. 184:22-185-10.) Likewise,
while Apple spends significant time in its papers faulting Corellium for not requiring users of theCorellium Product to report bugs found in iOS to Apple, Apple does not impose that requirement
under its own Bug Bounty Program. As for Apple’s contention that Corellium sells its productindiscriminately, that statement is belied by the evidence in the record that the company has avetting process in place (even if not perfect) and, in the past, has exercised its discretion to withhold
the Corellium Product from those it suspects may use the product for nefarious purposes. 15

15

The Court does realize that with or without controls in place, the Corellium Product could be
used maliciously in the wrong hands. As Apple’s Jason Shirk aptly states: “Tools are agnostic;It’s all the user.” (Shirk Dep. [DE 472-31] 118:24.) The Corellium Product can be used for “good32Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 33 of 38

Having reviewed the evidence, the Court does not find a lack of good faith and fair dealing.
Further, weighing all the necessary factors, the Court finds that Corellium has met its burden of
establishing fair use. Thus, its use of iOS in connection with the Corellium Product is permissible.
On these grounds, Corellium’s Motion for Summary Judgment is granted on Apple’s copyrightclaim.
II.

DMCA CLAIM

Both Corellium and Apple seek summary judgment on Apple’s DMCA claim. The claim
is brought under sections 1201(a)(2) and (b)(1) of the statute, which together prohibit selling tools
to circumvent measures that protect access to, or rights in, copyrighted material, if the tools: (a)are “primarily designed or produced for the purpose of circumventing a technological measure that
effectively” controls access to or protects rights in a copyrighted work; (b) have “only limited
commercially significant purpose or use other than to circumvent a technological measure that
effectively” controls access to or protects rights in a copyrighted work; or (c) are “marketed . . .
for use in circumventing a technological measure that effectively” controls access to or protectsrights in a copyrighted work. 17 U.S.C. § 1201(a)(2), (b)(1). Under the DMCA, to “circumvent
a technological measure” means to “to avoid, bypass, remove, deactivate, or impair a technologicalmeasure, without the authority of the copyright owner,” and a technological measure “‘effectively
controls access to a work’ if the measure, in the ordinary course of its operation, requires theapplication of information, or a process or a treatment, with the authority of the copyright owner,
to gain access to the work.” 17 U.S.C. § 1201(a)(3).

faith” security research and it also very likely can be exploited for nefarious reasons. No
technology is infallible. For instance, notwithstanding strong protections put in place by Applesuch as the secure boot chain, just recently the checkm8 exploit was released by security
researchers, which enables certain iOS commercial devices to be jailbroken. (Shirk Dep. 94:1120.)
33

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 34 of 38

Apple argues that, at a minimum, Corellium circumvents its authentication server
validation check, secure boot chain, Buddy program, and trust cache. According to Apple, only
after circumventing these measures can the Corellium Product run iOS––which was not designed
to run on non-Apple hardware. Corellium disagrees that it circumvents Apple’s technologicalmeasures. Corellium argues instead that the IPSW files are “left unencrypted, unprotected,
unlocked, and out in the open for the public to access, copy, edit, distribute, perform, and display.”(Def.’s Resp. [DE 512] at 1.) Corellium further argues that it is entitled to a fair use defense, as
well as defenses under sections 1201(f), (g), and (j) of the DMCA, which provide exemptions forreverse engineering and security testing and encryption research. The Court begins by examining
whether fair use is a defense to a prima facie section 1201 violation.
A. “Fair use” and the DMCA
The DMCA provides:(c) Other rights, etc., not affected.--(1) Nothing in this section shall affect rights,
remedies, limitations, or defenses to copyright infringement, including fair use,
under this title.
17 U.S.C. § 1201(c) (italics added). At first glance, this subsection appears to resolve the issue ofa fair use defense. But, as applied, there may be tension between section 107’s fair use and the
DMCA’s antitrafficking provisions. One court captured the issue well:
Technological access control measures have the capacity to prevent fair uses of
copyrighted works as well as foul. Hence, there is a potential tension between theuse of such access control measures and fair use, [as well as the much broader rangeof explicitly noninfringing use]. As the DMCA made its way through the legislative
process, Congress was preoccupied with precisely this issue. Proponents of strong
restrictions on circumvention of access control measures argued that they were
essential if copyright holders were to make their works available in digital form
because digital works otherwise could be pirated too easily. Opponents contended
that strong anticircumvention measures would extend the copyright monopoly
inappropriately and prevent many fair uses of copyrighted material. Congressstruck a balance . . . .

34

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 35 of 38

Chamberlain Grp., Inc. v. Skylink Techs., Inc., 381 F.3d 1178, 1196-97 (Fed. Cir. 2004) (citing
Reimerdes, 111 F. Supp. 2d at 304). 16
In Chamberlain, the Federal Circuit suggested, in dicta, that fair use could be a defense toa section 1201 violation. The court noted that the DMCA does not “rescind[] the basic bargain
granting the public noninfringing and fair uses of copyrighted materials . . . .” 381 F.3d at 1202
(citing § 1201(c)). In reaching that conclusion, the court was wary of allowing “copyrightowner[s], through a combination of contractual terms and technological measures, to repeal thefair use doctrine . . . .” Id. Notwithstanding this discussion, the Federal Circuit ultimately statedthat it did “not reach the relationship between § 107 fair use and violations of § 1201.” Id. at 1199
n.14. Neither the Supreme Court nor the Eleventh Circuit has squarely addressed the issue. And,
like the Federal Circuit, the Ninth Circuit has put that decision off for another day. See MDY
Indus., LLC v. Blizzard Entm’t, Inc., 629 F.3d 928, 950 n.12 (9th Cir. 2010), opinion amended andsuperseded on denial of reh'g, No. 09-15932, 2011 WL 538748 (9th Cir. Feb. 17, 2011) (“Like the[court in] Chamberlain . . ., we need not and do not reach the relationship between fair use under§ 107 of the Copyright Act and violations of § 1201 . . . . Accordingly, we too leave open thequestion whether fair use might serve as an affirmative defense to a prima facie violation of §1201.”).

16

This year––more than twenty years after the DMCA was enacted––with a series of hearings,
Congress has begun to review the DMCA, including a review of how the DMCA has accounted
for fair use, how fair use has been applied in practice, and how a reform bill should think about
fair use. See, e.g., How Does the DMCA Contemplate Limitations and Exceptions Like Fair Use?,
Subcommittee Hearing, Senate Judiciary Subcommittee on Intellectual Property, available athttps://www.judiciary.senate.gov/meetings/how-does-the-dmca-contemplate-limitations-andexceptions-like-fair-use (last accessed December 10, 2020); see also The Digital Millennium
Copyright Act at 22: What is it, why was it enacted, and where are we now, available athttps://www.judiciary.senate.gov/meetings/the-digital-millennium-copyright-act-at-22-what-isit-why-it-was-enacted-and-where-are-we-now (last accessed December 10, 2020).
35

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 36 of 38

The Second Circuit, however, has ruled on the issue, and has found that fair use is not a
blanket defense to the circumvention provisions of section 1201:[Appellants] contend that subsection 1201(c)(1) . . . can be read to allow thecircumvention of encryption technology protecting copyrighted material when thematerial will be put to “fair uses” exempt from copyright liability. We disagree that
subsection 1201(c)(1) permits such a reading. Instead, it simply clarifies that the
DMCA targets the circumvention of digital walls guarding copyrighted material(and trafficking in circumvention tools), but does not concern itself with the use of
those materials after circumvention has occurred. Subsection 1201(c)(1) ensuresthat the DMCA is not read to prohibit the “fair use” of information just because that
information was obtained in a manner made illegal by the DMCA. The Appellants’much more expansive interpretation of subsection 1201(c)(1) is not only outside
the range of plausible readings of the provision, but is also clearly refuted by thestatute’s legislative history.
Corley, 273 F.3d at 443–44; see also United States v. Reichert, 747 F.3d 445, 448 (6th Cir. 2014)(“[T]he DMCA ‘targets the circumvention of digital walls guarding copyrighted material (andtrafficking in circumvention tools),’ even though it ‘does not concern itself with the use of thosematerials after circumvention has occurred.’”) (citing Corley, 273 F.3d at 443) (italics in original);
Realnetworks, Inc. v. DVD Copy Control Ass’n, 641 F. Supp. 2d 913, 941-42 (N.D. Cal. 2009)(“The DMCA itself is, of course, rooted in the Copyright Act. The DMCA’s section 1201(c)merely preserves the general fair use defense to copyright infringement. It does not create new
exemptions, nor does it exempt from liability circumvention tools otherwise deemed unlawful
under sections 1201(a)(2) or (b)(1) . . . . Fair use is not a defense to trafficking in products used
to circumvent effective technological measures that prevent unauthorized access to, or
unauthorized copying of, a copyrighted work under sections 1201(a) or (b), respectively . . . .
[However] fair use applies to section 1201(b) under the DMCA because it does not speak to, andthus does not prohibit, appropriate individual uses of circumvention devices.”).
Here, if the Court were to adopt Corellium’s position that fair use is a defense to Apple’s
DMCA claim, that would effectively render section 1201 meaningless. “A venerable canon makes
36

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 37 of 38

clear that an interpreter must, if possible, give effect to every word and phrase in a statute.”
Darrisaw v. Pennsylvania Higher Educ. Assistance Agency, 949 F.3d 1302, 1306 (11th Cir. 2020)(citation). “[Courts] cannot adopt an interpretation that would render a term meaningless . . . .”Id. (citation omitted, italics in original). Thus, the Court finds that the better reading is that adopted
by the Corley court. Therefore, Corellium may make fair use of iOS, but it is not absolved ofpotential liability for allegedly employing circumvention tools to unlawfully access iOS orelements of iOS. As noted earlier, this result may seem to undercut section 107’s fair use.
However, in passing the DMCA, Congress adopted a “balanced” approach to accommodate bothpiracy and fair use concerns. Corley, 273 F.3d at 444 n.13. “The balance embodied in a federal
law is not something this court can disturb, absent a Constitutional violation not at issue here.”
Realnetworks, Inc., 641 F. Supp. 2d at 943. The Court, therefore, rejects Corellium’s fair use
defense in the context of the DMCA.
B. Genuine issues of material facts exist
Issues of material facts preclude entry of summary judgment on this claim. For example,
there is the fundamental question of, and dispute as to, whether Apple has copyrights in all of iOS
or only portions of iOS. While Corellium maintains that iOS is open for public access to support
its position that iOS or components of iOS in the IPSW files are not protectable, even open source
material is protectable. Jacobsen v. Katzer, 535 F.3d 1373, 1381 (Fed. Cir. 2008) (“Copyrightholders who engage in open source licensing have the right to control the modification anddistribution of copyrighted material.”).

The parties also dispute the nature of Apple’s

technological measures and the applicability of those measures to the IPSW files and, by extension,
elements of iOS in those files. Likewise, Corellium alleged statutory defenses raise factual37

Case 9:19-cv-81160-RS Document 784 Entered on FLSD Docket 12/29/2020 Page 38 of 38

questions that preclude entry of summary judgment on this claim. Therefore, the parties’ motions
are denied as they relate to the DMCA claim. Accordingly, it is
ORDERED that:1.

Apple’s Motion for Partial Summary Judgment [DE 470] is DENIED;

2.

Corellium’s Motion for Summary Judgment [DE 464] is GRANTED IN PARTAND DENIED:
a. The Motion is granted on the copyright claims, to the extent the Court finds that
Corellium’s use of iOS constitutes fair use;b. The Motion is denied regarding the DMCA claim.
3.

No later than January 11, 2021, the parties shall each file a status report notifying

the Court of any portions of pending motions rendered moot by this Order.
DONE AND ORDERED in Fort Lauderdale, Florida, this 29th day of December 2020.

Copies to:Counsel of record

38