Splunk Inc. v. Cribl, Inc.

Background

Splunk Enterprise is Splunk Inc.’s software for collecting data from different sources and displaying it in a searchable dashboard. Cribl, Inc. developed Cribl Stream, software that can sit between data sources and Splunk Enterprise and route data between them.

Splunk forwarders send data to Splunk indexers using the Splunk-to-Splunk, or S2S, protocol. The opinion states that a protocol is a set of rules for formatting and processing data, not code itself. Although Splunk described the S2S protocol as proprietary, the parties agreed that the protocol was not protected by copyright or copyrightable.

Splunk did not claim that Cribl Stream contained Splunk Enterprise code or that Cribl Stream itself infringed Splunk’s copyright. Instead, Splunk challenged Cribl’s downloading and running of Splunk Enterprise to reverse engineer the S2S protocol, test and troubleshoot Cribl Stream’s interoperability with Splunk Enterprise, and market Cribl Stream.

A jury answered factual questions submitted for the fair-use analysis. It found that Cribl could not viably interoperate with Splunk forwarders and indexers without reverse engineering the S2S protocol; that reverse engineering was the only way to determine the protocol; that other proposed methods were not viable alternatives; that the public benefited from Cribl’s copying and use; and that Cribl’s S2S capability was a transformative use. The jury answered “unknown” when asked whether Splunk would have earned more money if Cribl had not copied and used Splunk Enterprise. Judge Alsup then decided the ultimate fair-use legal question.

Analysis

Section 107 of the Copyright Act lists four fair-use factors: the purpose and character of the use, the nature of the copyrighted work, the amount used, and the effect on the potential market.

For the first factor, the court found that Cribl used Splunk Enterprise to discover the functional requirements for compatibility and to build its own software with a distinct purpose, rather than to duplicate or replace Splunk Enterprise. The court also considered the public benefit from interoperability and found that this factor favored Cribl.

For the second factor, the court found that software is functional and contains aspects that copyright does not protect. Because those unprotected aspects could not be examined without copying the software, the court found that this factor also favored Cribl.

For the third factor, the court recognized that Cribl necessarily downloaded and ran the entire Splunk Enterprise program to reverse engineer the S2S protocol and support that protocol. This factor therefore weighed against Cribl, but the court gave it very little weight because the copying was an intermediate step toward a limited ultimate use. The opinion describes the copying as involving object code loaded into memory and running the software, along with analyzing network packets and decompiling JAR files, not copying Splunk source code into Cribl Stream.

For the fourth factor, the jury found it unknown whether Splunk would have earned more money without Cribl’s copying and use. The court noted evidence that Cribl Stream could reduce some Splunk customers’ licensing fees by filtering junk data, while also potentially increasing fees when customers routed more useful data into Splunk Enterprise. The fourth factor did not favor either party.

Considering all four factors, the court found that they clearly favored Cribl. Relying particularly on the reasoning that intermediate copying may be fair use when it is necessary to access unprotected functional elements of software, the court concluded that Cribl’s reverse engineering and interoperability-related uses were fair use.

Ruling

The court ruled that Cribl’s copying and use of Splunk Enterprise to reverse engineer the uncopyrighted S2S protocol was fair use. It also ruled that Cribl’s copying and use of Splunk Enterprise to test and troubleshoot Cribl software for interoperability with Splunk Enterprise was fair use.

The court ruled that Cribl’s copying and use of Splunk Enterprise to market Cribl software was not fair use. The court explained that running Splunk Enterprise in a sandbox to show a potential customer how Cribl Stream worked with Splunk Enterprise was not necessary to access Splunk’s functional elements or develop Cribl’s interoperable software.

The opinion concludes with these fair-use rulings and states, “IT IS SO ORDERED.”