Opinion ID: 4557271
Heading Depth: 3
Heading Rank: 2

Heading: The Direct Infringement Claims

Text: As is relevant here, direct infringement requires copying of a protected work by the defendant. Seven Arts, 733 F.3d at 1254. It is undisputed that HPE’s installation of patches on unsupported servers would constitute infringement. But the parties dispute whether Oracle’s evidence showed that HPE performed such installations for its direct customers. We address separately the non-Symantec customers and Symantec and conclude that triable issues remain.
The district court reasoned that, to survive summary judgment on the direct infringement claims for nonSymantec customers, Oracle had to provide: “(1) evidence that HPE installed a patch on a server that was not supported by an Oracle support contract, and (2) evidence that the 9 We decline to resolve in the first instance whether Oracle produced sufficient evidence on the additional elements of secondary liability because the district court never considered those issues. Shirk v. U.S. ex rel. Dep’t of Interior, 773 F.3d 999, 1007 (9th Cir. 2014). 18 ORACLE AMERICA V. HEWLETT PACKARD ENTER. patch was released and downloaded while that server was not on contract.” Oracle does not challenge this application of the copying element, and thus, it guides us here. Oracle relied on an analysis by its expert, Christian Hicks, of HPE-produced spreadsheet data for 35 HPE direct customers to show that HPE performed unauthorized patch installations. The spreadsheets had an “Installed on Date” column and a column identifying the hardware serial number. Hicks treated the “Installed on Date” column as showing actual installation dates. He found 210 instances of patching where “the ‘Installed on Date’ in HPE’s data occurred after Oracle support for that server had ended.” He found that for 188 of those instances, Oracle had not released the patches until after Oracle support for the server expired. Crediting HPE’s arguments, the district court concluded that Oracle could not prove with this data (a) unauthorized installations (b) by HPE. We disagree.
The district court found an insurmountable “ambiguity” about whether the “Installed on Date” column reflected actual patch installations. The “ambiguity” stemmed from testimony by David Jensen, HPE’s Rule 30(b)(6) witness and a former HPE employee. In considering this testimony, the court failed to draw all reasonable inferences in Oracle’s favor. Jensen testified that the “Installed on Date” column had three possible meanings. It could mean the date that: (1) a kernel patch was installed, (2) a patch was released from the vendor, or (3) a file was updated on the system, such as a deletion, modification, or change to the file. Although Jensen testified that one could not know which meaning applied, he explained that the field prioritized the first ORACLE AMERICA V. HEWLETT PACKARD ENTER. 19 meaning. Only if actual installation data was unavailable would the entry reflect another meaning. This testimony supported the actual installation date meaning that Hicks attributed to “Installed on Date,” and it showed that that meaning was prioritized. 10 In light of this evidence, the district court could not properly assume in HPE’s favor that no entries reflected an actual installation. The court also reasoned that even if all entries reflected installations, “Oracle could not identify any particular nonsupported server on which a protected patch was improperly installed.” That conclusion stemmed from what the court viewed as a concession by Oracle during the summary judgment hearing. Oracle, however, effectively explained that it would prove unauthorized installations circumstantially. “Proof of copyright infringement is often highly circumstantial,” Loomis v. Cornish, 836 F.3d 991, 994 (9th Cir. 2016) (citation omitted), “[b]ecause direct evidence of copying is rarely available,” Baxter v. MCA, Inc., 812 F.2d 421, 423 (9th Cir. 1987). Here, Oracle could identify protected patches and the spreadsheets showed installations that post-dated the release of a given patch. Drawing all reasonable inferences in Oracle’s favor, a jury could find that at least one entry reflected an actual patch installation. 10 The district court also stated that the data had a “false positive” because Oracle identified a patch installation on an off-contract server before Oracle had released that patch. Such an entry can be explained as the date of a file update, consistent with Jensen’s third meaning of “Installed on Date.” That “false positive” would not preclude that other entries reflect actual installations. 20 ORACLE AMERICA V. HEWLETT PACKARD ENTER.
A “direct infringement claim turn[s] on ‘who made’ the copies[.]” Fox Broad. Co. v. Dish Network L.L.C., 747 F.3d 1060, 1067 (9th Cir. 2014) (quoting Cartoon Network LP, LLLP v. CSC Holdings, Inc., 536 F.3d 121, 130 (2d Cir. 2008)) (emphasis in original). Oracle must “show causation (also referred to as ‘volitional conduct’) by the defendant.” Perfect 10, Inc. v. Giganews, Inc., 847 F.3d 657, 666 (9th Cir. 2017), cert denied, 138 S. Ct. 504 (2017). This requires conduct by the defendant “that can reasonably be described as the direct cause of the infringement.” Id. (citation omitted) (emphasis in original). Relying on Jensen’s testimony, HPE avers that some entity other than it—Oracle, the customer, or some unknown third party—could have installed patches for its direct support customers. Jensen’s testimony, however, could not foreclose that HPE installed patches. Indeed, he testified that when the data indicated that a patch was applied to a server, it “could mean” that a customer updated the patch, a customer-hired third party did it, or—critically—that HPE applied the patch if HPE had the responsibility to do so. HPE evades and the district court failed to acknowledge this third scenario, which plainly goes to causation by HPE. 11 HPE further contends that Oracle cannot prove causation because Hicks did not know who performed any patch installations. Hicks, however, relied on the fact that HPE supported the servers identified in HPE’s data and that 11 We reject Oracle’s assertion that Jensen’s testimony suffices to award summary judgment for it. Although Oracle cross moved for summary judgment on its infringement claims, we must view the evidence in the light most favorable to HPE. At the very least, the testimony creates a dispute of material fact. ORACLE AMERICA V. HEWLETT PACKARD ENTER. 21 customers specifically paid HPE to support their Solaris software to conclude that HPE made installations. We see no reason why a reasonable jury could not rely on these same circumstances. Viewing the evidence in the light most favorable to Oracle, a reasonable jury could find that HPE performed patch installations for direct customers. Thus, summary judgment was improper on the direct infringement claims concerning non-Symantec customers.
Summary judgment for HPE on the direct infringement claims concerning Symantec was also improper. The testimony from HPE’s employees permitted the reasonable inference that HPE installed a patch on an unsupported Symantec server. Indeed, the court acknowledged that testimony from HPE employees showed that HPE “had a practice of . . . installing patches downloaded from and delivered through Terix for Symantec’s off-contract servers.” Because Oracle may prove infringement circumstantially, Loomis, 836 F.3d at 994, Oracle did not need to further show that a particular patch was installed on a particular off-contract server to survive summary judgment. 12 HPE also argues that the district court held that Oracle did not show that any patch delivered to Symantec was protectable. If true, Oracle could not press infringement claims for such patches. Seven Arts, 733 F.3d at 1254 (observing that “ownership of a valid copyright” is a “basic 12 HPE argues that “many” Symantec servers ran older versions of Solaris that are not at issue and that Symantec also asked HPE to install patches received from Terix onto servers covered by Oracle support contracts. This would not preclude the reasonable inference that HPE performed an unauthorized patch installation. 22 ORACLE AMERICA V. HEWLETT PACKARD ENTER. element” of infringement) (citation omitted). The district court, however, does not appear to have granted summary judgment for HPE on this basis, but instead to have merely acknowledged HPE’s argument. Although we may affirm on any ground supported by the record, Johnson v. Riverside Healthcare Sys., LP, 534 F.3d 1116, 1121 (9th Cir. 2008), the record supplied by the parties is insufficient for us do so. We have no obligation to mine the extensive district court record, and we decline to do so here. See In re Oracle Corp. Sec. Litig., 627 F.3d 376, 386 (9th Cir. 2010) (“It behooves litigants, particularly in a case with a record of this magnitude, to resist the temptation to treat judges as if they were pigs sniffing for truffles.”). The district court may revisit and clarify this issue on remand.