Splunk Inc. v. Cribl, Inc.

Background

Splunk alleged that Cribl and its chief executive officer, Clint Sharp, infringed Splunk’s patents and copyrights and engaged in other unfair business practices. Splunk operates Splunk Enterprise, a platform that processes and indexes large amounts of machine data. Cribl’s products interoperate with Splunk Enterprise. Cribl had participated in Splunk’s Technology Alliance Partner program under an agreement that gave Cribl a limited license to use Splunk software, but Splunk terminated Cribl’s participation in November 2021.

Splunk alleged that Cribl infringed five patents and that Sharp copied Splunk’s copyrighted source code, created derivative code called go-S2S, posted it on GitHub, replaced Splunk’s copyright headers with a purported open-source license, and later took the code offline. These allegations were treated as allegations for purposes of the motion to dismiss, not as established facts.

Standards and issues

The defendants moved under Rule 12(b)(6), which tests whether a complaint alleges enough facts to state a legally plausible claim. The motion addressed four groups of claims: (1) Cribl’s willful and indirect patent-infringement claims; (2) all patent-infringement claims against Cribl based on patent-ineligibility under Section 101 of the Patent Act; (3) indirect copyright-infringement claims against Cribl and Sharp; and (4) Sharp’s alleged violation of Section 1202 of the Digital Millennium Copyright Act.

Willful and indirect patent infringement

The court granted the motion as to Cribl’s willful and indirect patent-infringement claims. Willful infringement requires knowledge of the asserted patents and knowledge that the defendant’s conduct infringed them. Indirect infringement also requires the relevant knowledge. The court held that Splunk had not plausibly alleged that Cribl knew of the five specific patents, or knew that it was infringing them, before the lawsuit.

The court found insufficient Splunk’s allegations that Cribl was founded by former Splunk employees, that Cribl had used Splunk software marked with patent information, that Cribl had copied Splunk software, and that Cribl employees could have viewed Splunk’s patent-marking webpage. The court also rejected the argument that termination of the Technology Alliance Partner agreement established the required knowledge. The agreement licensed use of Splunk software but did not identify the five patents at issue. The court did not reach the defendants’ alternative arguments concerning specific intent or substantial non-infringing uses.

Patent eligibility

The court also granted the motion as to all of Splunk’s patent-infringement claims against Cribl based on the ineligibility of the five asserted patents. Applying the two-step test from Alice Corp. v. CLS Bank, the court examined claim 1 of each patent as a representative claim. At the first step, the court asks whether the claims are directed to an abstract idea. At the second step, it asks whether the claims contain an inventive concept that adds something beyond the abstract idea and ordinary computer functions.

For the ’206 patent, the court characterized the representative claim as previewing data-analysis rules and applying a selected rule to a larger set of data. The court found that the claim did not describe a specific technological improvement and instead used generic computing devices to carry out an abstract data-manipulation process. It also found no inventive concept at the second step.

For the ’438 and ’443 patents, the court characterized the representative claims as using configuration data and network data to generate or transform event data. The court found that the claims described results without explaining a specific non-abstract way to achieve them. The claims therefore used generic processes and equipment and lacked an inventive concept.

For the ’312 patent, the court characterized the representative claim as creating time-searchable output by determining whether input data contains time information and using earlier time information when it does not. The court found that the claim did not explain how the claimed timestamp calculation improved computer technology and amounted to a generic computer implementation of an abstract idea.

For the ’467 patent, the court characterized the representative claim as handling overflow data on demand through a dynamically created dual-queue system. The court found that the claim did not disclose a particular technique for dynamically creating the queues or operating them, and that it recited generic computer processes and storage rather than an inventive solution.

The court concluded that all representative claims were directed to abstract ideas and lacked inventive concepts. It therefore granted the motion as to all patent-infringement claims against Cribl based on the five patents’ ineligibility.

Indirect copyright infringement

The court denied the motion as to Splunk’s indirect copyright-infringement claims against Cribl and Sharp. Under the court’s explanation, contributory copyright infringement requires knowledge of another person’s infringement plus material contribution to or inducement of that infringement.

The court held that Splunk plausibly alleged Sharp’s knowledge and involvement by alleging that he derived go-S2S from Splunk’s copyrighted source code, provided it to Cribl while knowing it was an unlicensed derivative, and encouraged Cribl’s continued use of it in Stream. The court also found that the complaint plausibly alleged Cribl’s knowledge and contribution, including allegations that Sharp’s knowledge could be attributed to Cribl and that Cribl used the code to promote its products and services. The court emphasized that the allegations were sufficient at the pleading stage, while noting that the allegations might ultimately prove false.

Digital Millennium Copyright Act Section 1202

The court denied the motion as to Sharp’s claim-related violation of Section 1202 of the Digital Millennium Copyright Act. Section 1202 addresses copyright-management information, such as information identifying a work’s author or copyright owner, and prohibits certain knowing conduct involving false, removed, or altered information.

The court held that Splunk adequately identified the allegedly removed or altered copyright information: copyright headers in Splunk’s source code that indicated authorship and ownership. Splunk also plausibly alleged the required knowledge and intent by alleging that Sharp copied Splunk’s code, removed the copyright information, posted the code on a publicly accessible webpage, and added a license falsely identifying himself as the author or owner. The court noted that later proceedings could determine that the information was not legally protected copyright-management information, that the headers did not identify Splunk, that they were not removed, or that go-S2S was not derived from Splunk’s code. Those factual questions did not defeat the claim at the motion-to-dismiss stage.

Disposition

Judge William Alsup granted the motion to dismiss in part and denied it in part. The motion was granted as to all claims for willful and indirect patent infringement against Cribl and all claims for infringement of the five asserted patents against Cribl based on patent ineligibility. The motion was denied as to all indirect copyright-infringement claims against Cribl and Sharp and the Digital Millennium Copyright Act Section 1202 claim against Sharp.

The defendants’ answer was due within fourteen days. Splunk was permitted to move for leave to amend its complaint within fourteen days, but the order did not itself grant leave to amend.