Source: s3://data.kl3m.ai/documents/govinfo/USCOURTS/USCOURTS-cand-3_09-cv-05892/USCOURTS-cand-3_09-cv-05892-2/pdf.json

Nature of Suit Code: 820
Nature of Suit: Copyright
Cause of Action: 17:101 Copyright Infringement

---

United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

ACTUATE CORP.,

Plaintiff,

v.

INTERNATIONAL BUSINESS MACHINES

CORP., ET AL.,

Defendants.

___________________________________/

No. C-09-05892 JCS

ORDER DENYING MOTION TO

DISMISS [Docket No. 15]

I. INTRODUCTION

This case arises out of a software licensing agreement between Plaintiff Actuate Corporation

(“Actuate”) and Defendant MRO Software, Inc. (“MRO”), which is a wholly-owned subsidiary of

Defendant International Business Machines, Inc. (“IBM”). Actuate asserts claims for: 1) breach of

contract; 2) copyright infringement in violation of 17 U.S.C. §§ 101 et seq. (the Copyright Act); 3)

circumvention of access controls and distribution of circumvention tools in violation of 17 U.S.C. §§

1201 et seq. (Digital Millennium Copyright Act (“DMCA”)); and 4) fraudulent concealment. 

Defendants filed a Motion to Dismiss Actuate’s Complaint (“the Motion”), seeking dismissal under

Rule 12(b)(6) of the Federal Rules of Civil Procedure of Actuate’s claims for breach of contract

(Claim One), violation of the DMCA (Claim Three) and fraudulent concealment (Claim Four). 

Defendants subsequently withdrew the Motion as to Claim Four. The parties have consented to the

jurisdiction of a United States magistrate judge pursuant to 28 U.S.C. § 636(c). A hearing on the

Motion was held on Friday, April 2, 2010. For the reasons stated below, the Motion is DENIED.

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 1 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1

The Court assumes the allegations in the complaint to be true for the purposes of this motion.

See Cahill v. Liberty Mutual Ins. Co., 80 F.3d 336, 338 (9th Cir. 1996)(on motion to dismiss under Rule

12(b)(6) of the Federal Rules of Civil Procedure, the court assumes the facts alleged in the complaint

are true).

2

II. BACKGROUND 

A. Factual Background1

Actuate is a corporation based in California and incorporated in Delaware that develops and

licenses computer software aimed at business needs. Complaint, ¶ 7. MRO is a Massachusetts

corporation and is a wholly-owned subsidiary of IBM. Id., ¶ 8. IBM is a Delaware Corporation

with its principal place of business in New York. Id., ¶ 9. IBM has represented itself to be MRO’s

successor-in-interest. Id. 

In December 2000, Actuate entered into a written agreement with MRO entitled “E.Business

Application Partner Software License Agreement” (“License Agreement”), extending rights to MRO

to use certain Actuate software and to sell licenses to MRO products incorporating that software in

exchange for license and maintenance fees. Id., ¶ 15. In particular, according to the Complaint,

“[t]he License Agreement provided that MRO had the limited right to market, distribute and sublicense Actuate software for use with Partner Products that it distributes to new and existing end

users during the term of the License Agreement.” Id., ¶ 16. The License Agreement defined

“Partner Products” as the software listed in Exhibit A of the License Agreement, which included

MRO’s Maximo line of products. Id. The License Agreement allowed MRO to distribute an

unlimited number of copies of the Actuate software covered by the agreement for a flat fee, so long

as the terms of the license were met. Id., ¶ 20. Under the License Agreement, in the event that

MRO was acquired by a third party during the term of the agreement, use of Actuate’s software

would continue to be limited to “Partner’s Products and their Natural Successors.” Id., ¶ 18. 

Alternatively, the License Agreement permitted MRO to extend its rights under the License

Agreement to permit use of Actuate software in connection with third-party products if it paid

additional license fees. Id. 

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 2 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

2

In the Motion, Defendants requested dismissal of Claim Four, for fraudulent concealment, under

the New York statute of limitations that they argued applied to that claim. Subsequently, however, they

conceded that their argument was based on a flawed reading of the statute and withdrew the motion as

to the fraudulent concealment claim. Accordingly, the Court addresses only the arguments raised by

Defendants with respect to Claim One (breach of contract) and Claim three (violation of the DMCA).

3

Actuate and MRO amended the License Agreement five times after its initial execution. Id.,

¶ 19. Amendment 4, which was effective June 30, 2006, gave MRO the unilateral option to extend

the terms of the License Agreement until December 31, 2011. Id. Amendment 4 was negotiated in a

series of telephone conversations and in-person meetings between May 13 and June 30, 2006. Id., ¶

21. During those negotiations, MRO representatives told individuals negotiating on behalf of

Actuate that its sales of Actuate’s software were declining and likely would continue to decline. Id. 

Actuate representatives were not informed of a potential acquisition of MRO by IBM. Id., ¶ 24. On

August 2, 2006, however, IBM announced that it was acquiring MRO. Id., ¶ 23. Proxy statements

filed on August 28, 2006 with the Securities and Exchange Commission indicate that IBM and MRO

were engaged in active discussions about the acquisition while Amendment 4 was being negotiated. 

Id. 

After IBM acquired MRO, it incorporated MRO’s Maximo software into its own Tivoli line

of products. Id., ¶ 31. IBM did not, however, pay Actuate any additional license fees. Id. In

addition, Actuate alleges that sometime after IBM acquired MRO, it posted on the internet Actuate

software and related materials, including development tools, documentation and license keys,

without Actuate’s authorization. Id., ¶ 32. Actuate further alleges that the license keys posted by

IBM “enable Actuate’s software to be installed on an unlimited basis.” Id. 

B. The Motion to Dismiss2

1. Breach of Contract Claim (Claim One) 

Actuate asserts that Defendants have breached the License Agreement because IBM has

failed to pay additional licensing fees for its use of Actuate’s software in connection with its Tivoli

products. Defendants argue, however, that under the plain language of the License Agreement,

IBM’s use of Actuate’s software in its Tivoli products is within the scope of the License Agreement

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 3 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

3

Defendants assert that the Court is not limited to the allegations in the Complaint regarding the

License Agreement but rather, may look to the agreement itself, even though it was not attached to the

Complaint, because Plaintiff cited to the License Agreement in support of its claims. Actuate does not

dispute that the Court may consider the License Agreement in resolving Defendants’ motion.

4

The remainder of Paragraph 9 sets forth a formula for determining the amount of the

Incremental License Fees.

4

because it is incorporated into those products as part of the Maximo software, which is a Partner

Product under the agreement. Therefore, Defendants assert, IBM is not required to pay additional

license fees under the License Agreement. 

In support of their position, Defendants cite to Paragraph 1.8 of the License Agreement,

which provides as follows:

Limited Use. “Limited Use” means that the Software can be used by an End User or in a

hosted Services environment solely in conjunction with the contemporaneous use of Partner

Products. Limited Use does not include use of the Software in a standalone fashion or with

software or data not incorporated into or integrated with Partner products.

Declaration of James D. Wade in Support of Defendants’ Motion to Dismiss Actuate’s Complaint

(“Wade Decl.”), Ex. A (License Agreement).3

 According to Defendants, this definition applies to

the provision of the License Agreement addressing licensing fees in the case of a third-party

acquisition of MRO. That provision provides, in part, as follows:

Acquisition or Merger

Should Partner acquire, merge with or be acquired by a third party during the Term, this

Agreement shall remain in full force and effect in accordance with its terms. However,

Partner’s use of the Software shall continue to be Limited to Partner’s Products and their

Natural Successors as stated in this Exhibit A. Partner may elect to extend its rights under

this Agreement to use the Actuate Software in connection with the products of such third

party by agreeing to pay the incremental License Fees as defined below.

Wade Decl., Ex. A (License Agreement), Ex. A, Paragraph 9.4 Because IBM continues to use

Actuate’s software as part of the Maximo line of products (which are, in turn, used in IBM’s Tivoli

products), Defendants assert that Paragraph 9 permits this use without the payment of additional

license fees.

Actuate responds that Defendants improperly equate the definition for the defined term

“Limited Use” with the undefined term “Limited” that is used in Paragraph 9. In doing so, Actuate

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 4 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28 5

asserts, Defendants fail to read the language of the relevant provision in context such that its

construction is consistent with the agreement as a whole and “eviscerate[] numerous other

provisions of the License Agreement that set limits on an acquiror’s distribution right[s] and

establish post-acquisition payment obligations.” Opposition at 18. In particular, Actuate argues that 

Defendants’ construction ignores the limitation relating to “Natural Successors” contained in

Paragraph 9 – a term that is defined in the License Agreement as follows:

“Natural Successor” shall mean any replacement or substitute software for any of the

Actuate Software products or Partner Products (“Products”) listed in Exhibit A. Natural

Successors shall include without limitation any software that: (i) includes substantially

similar functionality to a Product; (ii) presents a performance or other enhancement to

similar functionality offered in a Product; or (iii) offers similar functionality to a Product but

that is translated into or supports additional natural languages and platforms.

Wade Decl., Ex. A (License Agreement), Paragraph 1.11. Given the detailed definition of “Natural

Successor” negotiated by the parties, as well as the elaborate formula for determining additional

licensing fees, Defendants’ construction of the language in Paragraph 9 must be incorrect, Actuate

asserts. Finally, Actuate concedes that in Paragraph 9, the word “Limited” is capitalized, as is the

convention for terms that are defined within a contract, but argues that this is most likely a

typographical error. 

2. DMCA Claim

Actuate alleges that in posting its license keys/files on the internet without authorization,

IBM “circumvented a technological measure and/or trafficked in a circumvention technology and

device within the meaning of” the DMCA. Defendants assert, however, that every case to address

the question has held that improper use of a password issued by the copyright holder does not

amount to “circumvention” of a technological control under the DMCA. Motion at 5 (citing I.M.S.

Inquiry Management Systems, Ltd. v. Berkshire Information Systems, Inc., 307 F. Supp. 2d 521, 532-

33 (S.D.N.Y. 2004); R.C. Olmstead, Inc. v. CU Interface LLC, 2009 WL 3049867 (N.D. Ohio 2009); 

Egilman v. Keller & Heckman, LLP, 401 F. Supp. 2d 105, 113-114 (D.D.C. 2005)). 

Actuate responds that Defendants’ argument is incorrect because they rely on authority

addressing a provision of the DMCA that prohibits direct circumvention of access controls whereas

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 5 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28 6

Actuate’s claims are based on provisions that prohibit trafficking in technology designed to

circumvent access or copy controls. Specifically, section 1201 contains three relevant provisions. 

First, section 1201(a)(1) prohibits circumvention of access controls:

No person shall circumvent a technological measure that effectively controls access to a

work protected under this title.

17 U.S.C. § 1201(a)(1). Second, section 1201(a)(2) prohibits trafficking in technology designed to

circumvent access controls:

No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any

technology, product, service, device, component, or part thereof, that—

(A) is primarily designed or produced for the purpose of circumventing a technological

measure that effectively controls access to a work protected under this title;

(B) has only limited commercially significant purpose or use other than to circumvent a

technological measure that effectively protects a right of a copyright owner under this title;

or

(C) is marketed by that person or another acting in concert with that person with that person's

knowledge for use in circumventing a technological measure that effectively controls access

to a work protected under this title.

17 U.S.C. § 1201(a)(2). Third, section 1201(b)(1) prohibits trafficking in technology designed to

circumvent copy controls:

No person shall manufacture, import, offer to the public, provide, or otherwise traffic in any

technology, product, service, device, component, or part thereof, that—

(A) is primarily designed or produced for the purpose of circumventing protection

afforded by a technological measure that effectively protects a right of a copyright

owner under this title in a work or a portion thereof;

(B) has only limited commercially significant purpose or use other than to circumvent

protection afforded by a technological measure that effectively protects a right of a

copyright owner under this title in a work or a portion thereof; or

(C) is marketed by that person or another acting in concert with that person with that

person's knowledge for use in circumventing protection afforded by a technological

measure that effectively protects a right of a copyright owner under this title in a

work or a portion thereof.

17 U.S.C. § 1201(b)(1). Actuate states that its claims are based on the anti-trafficking provisions of

the DMCA, sections 1201(a)(2) and (b), and not on the direct circumvention provision, section

1201(a)(1). Actuate points to two decisions within this district in which courts have held under

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 6 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28 7

similar circumstances that defendants were liable under the anti-trafficking provisions of the

DMCA, 321 Studios v. MGM Studios, Inc., 307 F. Supp. 2d 1085 (N.D. Cal. 2004) and Microsoft

Corp. v. EEE Business Inc., 555 F. Supp. 2d 1051 (N.D. Cal. 2008).

III. ANALYSIS

A. Legal Standard

A complaint may be dismissed for failure to state a claim for which relief can be granted

under Federal Rule of Civil Procedure 12(b)(6). Fed. R. Civ. P 12(b)(6). In order to survive a

motion to dismiss under Rule 12(b)(6), a complaint must “contain either direct or inferential

allegations respecting all the material elements necessary to sustain recovery under some viable legal

theory.” Bell Atl. Corp. v. Twombley, 550 U.S. 544, 127 S. Ct. 1955, 1969 (2007) (quoting Car

Carriers, Incl v. Ford Motor Co., 745 F.2d 1101, 1106 (7th Cir. 1984) (internal quotations omitted;

emphasis in original). For purposes of resolving a Rule 12(b)(6) motion, courts accept all

allegations of material fact as true and construe the complaint in the light most favorable to the

nonmoving party. Nat’l Wildlife Fed’n v. Espy, 4 F.3d 1337, 1380 (9th Cir. 1995).

B. The Breach of Contract Claim

Defendants argue that Actuate’s breach of contract claim should be dismissed with prejudice

because the clear and unambiguous language of the License Agreement allows IBM to distribute 

Actuate’s software in connection with its Tivoli line of products without paying additional licensing

fees so long as the Actuate software is sold in conjunction with MRO’s Maximo products. This

issue cannot be resolved on a Rule 12 motion.

Whether New York or California law applies, the terms of a contract must be construed in a

manner that takes into account the context of the language and is consistent with the contract as a

whole. See Dupree v. Holman Professional Counseling Centers, 572 F.3d 1094 (9th Cir. 2009)

(citing Cal. Civ. Code § 1641); Westmoreland Coal Co. v. Entech, Inc., 794 N.E.2d 667, 670 (N.Y.

2003). Here, Defendants assert that they have complied with Paragraph 9 of the License Agreement,

as a matter of law, because IBM continued to use Actuate’s software in connection with Maximo,

which is a Partner Product under the License Agreement, thus satisfying the definition of “Limited

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 7 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

5

Plaintiff also asserts that the License Agreement is ambiguous as to whether it permits a third

party to use Actuate’s software, in the event of an acquisition or merger, without paying additional

licensing fees so long as it is used in a Partner Product. The Court need not decide at this time

whether the contract is ambiguous because it finds that even under Defendants’ interpretation of the

contract, the requirements for dismissal of the breach of contract claim under Rule 12(b)(6) have not

been satisfied.

6

Hereinafter, the Court refers to this line of cases as “the I.M.S. line of cases.”

8

Use.” Even assuming that Defendants are correct that the definition of “Limited Use” should be

read into Paragraph 9 in interpreting that provision, the Court finds that factual questions relating to

how Actuate’s software is incorporated into IBM’s Tivoli line preclude dismissal on this basis under

Rule 12(b)(6). In particular, the definition of Limited Use excludes “use of the Software in a

standalone fashion or with software or data not incorporated into or integrated with Partner

products.” Because it is not apparent from the allegations in the complaint that Defendants’ use of

Actuate’s software was a Limited Use, as defined under the contract, dismissal of the breach of

contract claim under Rule 12(b)(6) is not appropriate .5

C. The DMCA Claim

Defendants assert that Actuate’s DMCA claim must be dismissed with prejudice because

improper use of a password issued by the copyright holder does not amount to “circumvention”

under the DMCA, citing I.M.S. Inquiry Management Systems, Ltd. v. Berkshire Information Systems,

Inc., 307 F. Supp. 2d 521, 532-33 (S.D.N.Y. 2004) and two cases in which other district courts

followed that decision, R.C. Olmstead, Inc. v. CU Interface LLC, 2009 WL 3049867 (N.D. Ohio

2009) and Egilman v. Keller & Heckman, LLP, 401 F. Supp. 2d 105, 113-114 (D.D.C. 2005).6

 

Plaintiff counters that these cases are distinguishable because they address claims under section

1201(a)(1) whereas Actuate’s claim is asserted under sections 1201(a)(2) and (b)(1). Rather,

Actuate asserts, the Court should look to two decisions that were decided in this district that hold

that unauthorized use of passwords is “circumvention” under sections 1201(a)(2) and (b)(1), 321

Studios v. MGM Studios, Inc., 307 F. Supp. 2d 1085 (N.D. Cal. 2004) and Microsoft Corp. v. EEE

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 8 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

7

Hereinafter, the Court refers to this line of cases as “the 321 Studios line of cases.”

9

Business Inc., 555 F. Supp. 2d 1051 (N.D. Cal. 2008).7

 The Court concludes that the reasoning in

the two lines of cases, when applied to the facts here, points to different results. Though there is

scant case law to guide the Court’s decision, the Court declines to follow the reasoning of the I.M.S.

line of cases and therefore denies Defendants’ motion.

As noted above, section 1201(a)(1) prohibits circumvention of access controls, while

sections 1201(a)(2) and (b)(1) prohibit trafficking in technology designed to circumvent access or

copy controls. Section 1201(a)(3) provides the following definitions, applicable to all of subsection

(a):

(3) As used in this subsection--

(A) to “circumvent a technological measure” means to descramble a scrambled work, to

decrypt an encrypted work, or otherwise to avoid, bypass, remove, deactivate, or impair a

technological measure, without the authority of the copyright owner; and 

(B) a technological measure “effectively controls access to a work” if the measure, in the

ordinary course of its operation, requires the application of information, or a process or a

treatment, with the authority of the copyright owner, to gain access to the work. 

17 U.S.C. § 1201(a)(3). Section 1201(b) provides the following definitions:

(A) to “circumvent protection afforded by a technological measure” means avoiding,

bypassing, removing, deactivating, or otherwise impairing a technological measure; and 

(B) a technological measure “effectively protects a right of a copyright owner under this

title” if the measure, in the ordinary course of its operation, prevents, restricts, or otherwise

limits the exercise of a right of a copyright owner under this title. 

17 U.S.C. § 1201(b)(2). The parties cite to two lines of cases on the question of what constitutes

“circumvention” under these provisions, the I.M.S. line of cases and the 321 Studios line of case.

1. The I.M.S. Line of Cases

In I.M.S. Inquiry Management Systems, the court addressed whether the unauthorized use by

the defendant of passwords that had been issued by the plaintiff to a third party constituted a

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 9 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28 10

violation of section 1201(a)(1) of the DMCA. The court concluded that they did not, reasoning as

follows:

Circumvention requires either descrambling, decrypting, avoiding, bypassing, removing,

deactivating or impairing a technological measure qua technological measure. In the instant

matter, defendant is not said to have avoided or bypassed the deployed technological

measure in the measure's gatekeeping capacity. The Amended Complaint never accuses

defendant of accessing the e-Basket system without first entering a plaintiff-generated

password.

307 F. Supp. 2d at 1531. Because the defendant “did not surmount or puncture or evade any

technological measure” but instead “used a password intentionally issued by plaintiff to another

entity,” the court found that there was no “circumvention” under section 1201(a)(1). Id. at 1532.

In reaching this conclusion, the I.M.S. court relied on a Second Circuit decision, Universal

City Studios, Inc. v. Corley, 273 F.3d 429 (2d Cir. 2001). Although that case did not address the

meaning of “circumvent” under the DMCA (as the I.M.S. court acknowledged), it addressed a

technology that the I.M.S. court viewed as materially different from the use of passwords, a DVD

decryption program called DeCSS, which enabled the viewing of movies without a DVD player. Id.

(citing Universal Studios, 273 F.3d at 453). The I.M.S. court explained:

Universal Studios is instructive as a matter of reference. There, the offending circumvention

was a DVD decryption program, DeCSS, which enabled the viewing of movies without using

a DVD player. See Universal Studios, 273 F.3d at 452. The security device that prevented

access to DVD movies without a DVD player, CSS, was described “[i]n its basic function ...

[as] a lock on a homeowner's door, a combination of a safe, or a security device attached to a

store's products.” Id., at 452-53. Likewise, “[i]n its basic function, [DeCSS, the decryption

program] is like a skeleton key that can open a locked door, a combination that can open a

safe, or a device that can neutralize the security device attached to a store's products. DeCSS

enables anyone to gain access to a DVD movie without using a DVD player.” Universal

Studios, 273 F.3d at 453.

Id. The I.M.S. court concluded that use of passwords issued by the plaintiff (even if not to the

defendant) was not like the DeCSS decryption program in Universal Studios and therefore did not

“circumvent” a technological measure. Id.

In Egilman, the court addressed whether a plaintiff could bring a DMCA claim under section

1201(a)(1) based on the allegation that the defendant had used unauthorized but valid passwords and

user names to access the plaintiff’s website. 401 F. Supp. 2d at 112. The court concluded he could

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 10 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28 11

not, citing to I.M.S. Id at 113-114. The court found that I.M.S. was correctly decided and reiterated

the reasoning of that case. In particular, the court stated: 

Circumvention, as defined in the DMCA, is limited to actions that “descramble,” “decrypt,”

“avoid, bypass, remove, deactivate or impair a technological measure.” 17 U.S.C. §

1201(a)(3). What is missing from this statutory definition is any reference to “use” of a

technological measure without the authority of the copyright owner, and the court declines to

manufacture such language now. As such, the court concludes that using a

username/password combination as intended-by entering a valid username and password,

albeit without authorization-does not constitute circumvention under the DMCA.

Id. at 113. The court in Egilman rejected the plaintiff’s attempt to distinguish I.M.S. on the grounds

that in that case, the passwords and usernames had been legitimately issued to a third party, whereas

there was no such allegation in Egilman. The court stated:

Simply put, this is a distinction without a difference. The important aspect of the holding in

I.M.S. was that the authorized use of a technological measure does not constitute

circumvention for purposes of the DMCA. It was irrelevant who provided the

username/password combination to the defendant, or, given that the combination itself was

legitimate, how it was obtained.

Id. 

In R.C. Olmsted, another district court followed I.M.S. 657 F. Supp. 2d 878 (N.D.

Oh.2009). In that case, a software developer brought a claim against another developer under

section 1201(a)(1) based on the defendant’s use of passwords and user names legitimately obtained

from plaintiff by a third party to access the plaintiff’s software application. Id. at 888. The court

found the facts to be indistinguishable from those of I.M.S. and on the basis of the reasoning in that

case concluded that the plaintiff’s DMCA claim failed. Id. at 889.

2. The 321 Studios Line of Cases

In 321 Studios, the court addressed DMCA claims asserted under sections 1201(a)(2) and

(b)(1). As in Universal Studios (which the court found to be “instructive and persuasive”), the

technology at issue was the DeCSS technology used to decrypt DVDs. 307 F. Supp. 2d at 1089,

1092. The plaintiff was a company that marketed and sold software and instructions for copying

DVDs and was seeking a declaratory judgment that its actions did not violate the DMCA. Id. at

1089. The court held that the plaintiff’s product “circumvented” the defendant’s encryption even

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 11 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28 12

though it used an authorized key to access the DVDs and such keys are licensed for use in DVD

players to allow DVDs to be read. Id. at 1098. The court reasoned as follows:

321 also asserts that its software does not violate § 1201(b)(2) because the software does not

“circumvent” encryption. Section 1201(b)(1) defines such circumvention, as “avoiding,

bypassing, removing, deactivating, or otherwise impairing a technological measure,” and 321

states that its software does not avoid, bypass, remove, deactivate, or otherwise impair a

technological measure, but that it simply uses the authorized key to unlock the encryption.

However, while 321's software does use the authorized key to access the DVD, it does not

have authority to use this key, as licensed DVD players do, and it therefore avoids and

bypasses CSS.

Id.

Recently, Judge White followed 321 Studios in another case involving trafficking claims

under the DMCA, Microsoft Corp. v. EEE Business Inc., 555 F. Supp. 2d 1051 (N.D. Cal. 2008). In

that case, plaintiff Microsoft Corporation sued an individual who sold, without authorization, a 25-

character alphanumeric code, the “Volume License Key,” “which is unique to the licensee and

required to be kept confidential under the terms of the Volume License Agreement.” Id. at 1059. 

The court held that “[b]y distributing a VLK without authorization, [the defendant] effectively

circumvented Microsoft’s technological measure to control access to a copyrighted work in violation

of [section 1201(a)(2)] of the DCMA.” Id.

3. Analysis

Both sides attempt to reconcile these two lines of cases. Defendants assert that the I.M.S.

line of cases stands for the proposition that use of passwords and usernames that were issued by the

plaintiff (albeit to a third party) does not constitute circumvention under any of the three provisions

at issue, that is sections 1201(a)(1), (a)(2) and (b)(1). The 321 Studios line of cases is consistent

with this proposition, Defendants assert, because in both 321 Studios and EEE Business Inc., there

was no allegation that the parties whose passwords were being used had issued those passwords to a

third party. On the other hand, Plaintiff asserts that the I.M.S. line of cases applies only to claims

brought under Section 1201(a)(1) and therefore, the 321 Sudios line of cases does not contradict the

I.M.S. line of cases.

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 12 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28 13

The Court is not persuaded that these two lines of cases can be reconciled. Although

Defendants attempt to draw a distinction based on whether the passwords were legitimately issued

by the plaintiff to some third party or rather, whether they were obtained in some other manner,

there is no basis in the reasoning of I.M.S. or in the statute for such a distinction. In fact, the court

in Egilman expressly rejected such a distinction, as noted above, stating that “[i]It was irrelevant

who provided the username/password combination to the defendant, or, given that the combination

itself was legitimate, how it was obtained.” 401 F. Supp. 2d at 113. Conversely, the Court finds no

suggestion in the case law that the meaning of circumvention is different for claims asserted under

section 1201(a)(1) than it is for claims under sections 1201(a)(2) and (b)(1), as Plaintiff suggests. 

Indeed, as Defendants point out, the same definition applies to sections (a)(1) and (a)(2).

Rather, the Court concludes that the two lines of cases reach contradictory results. In both

321 Studios and EEE Business Inc., the courts concluded that access keys that are used without

authorization fall within the definition of circumvention because they avoid and bypass a

technological measure. This Court follows the approach taken in 321 Studios and EEE Business,

Inc. and holds that unauthorized distribution of passwords and usernames avoids and bypasses a

technological measure in violation of sections 1201(a)(2) and (b)(1). The Court does not find

persuasive the reliance of the I.M.S. court on Universal Studios to justify the distinction it draws

between passwords that are issued by a plaintiff and other types of technologies. The Court notes, in

particular, that in Universal Studios, the Second Circuit analogized the DeCSS technology at issue in

that case with a “skeleton key” or a “combination that can open a locked door.” 273 F.3d at 453. 

The reasoning of the I.M.S. court – that a password somehow does not fall within this description, is

not well-founded. Rather, a combination to a lock appears to be essentially the same as a password. 

Nor does the Court find support in the statute itself for drawing a distinction between passwords and

other types of code that might be used for decryption. Therefore, the Court rejects Defendants’

position. Unauthorized use of a password may constitute circumvention under the DMCA.

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 13 of 14
United States District Court

For the Northern District of California

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28 14

IV. CONCLUSION

For the reasons stated above, the Motion is DENIED.

IT IS SO ORDERED.

Dated: April 5, 2010

 

JOSEPH C. SPERO

United States Magistrate Judge

Case 3:09-cv-05892-JCS Document 32 Filed 04/05/10 Page 14 of 14