IP Law Daily, TRADE SECRETS—4th Cir.: Software security company failed to prove existence of trade secrets in dispute with competitor, (Jun 16, 2023)

By Anne Gibson, J.D., LL.M.

Case was not moot, despite covenant not to sue and withdrawal of cease-and-desist letter, because these unilateral documents were conditional and revokable as written.

A software security company could not prevail in misappropriation of trade secrets claims against a competitor, because it did not prove the existence of trade secrets, the U.S. Court of Appeals for the Fourth Circuit has held. In affirming the district court’s grant of summary judgment for the competing software security company, the court of appeals found that Risk Based Security, Inc. (“RBS”) had failed to provide evidence that its alleged trade secrets had independent economic value, and thus they did not meet the statutory definition of a “trade secret.” Further, the district court did not abuse its discretion in excluding certain expert testimony. Finally, the Fourth Circuit found that the issuance of a covenant not to sue and the withdrawal of a cease-and-desist letter by RBS did not make the case moot (Synopsys, Inc. v. Risk Based Security, Inc., June 15, 2023, Agee, G.).

Background. Synopsys, Inc. and RBS are software security companies that identify and share with their customers security vulnerabilities in open-source software. In 2011, RBS created a vulnerabilities database called “VulnDB.” RBS licensed this database to its customers, including to Black Duck Software in 2014. While this license was in force, Black Duck built its own database. RBS believed Black Duck had used VulnDB to do so and sued Black Duck in 2018 in Massachusetts state court. Black Duck was acquired by Synopsys in 2017 and RBS filed a second complaint against Synopsys in 2021.

In March 2021, Synopsys publicly announced that it intended to expand its services, specifically, to participate in a government-sponsored Common Vulnerabilities and Exposures (“CVE”) program and to register as a designated CVE Numbering Authority (“CNA”). RBS sent Synopsys a cease-and-desist letter, claiming that these activities would constitute copyright infringement of RBS’ VulnDB database, misappropriation of RBS’ trade secrets, and tortious interference with RBS’ current and prospective economic relationships.

In response, Synopsys filed the present suit in the federal district court in Richmond, Virginia, seeking declaratory judgment that its conduct did not infringe, misappropriate, or interfere with RBS. Subsequently, RBS filed with the court a covenant not to sue and a withdrawal of its cease-and-desist letter to Synopsys. It then alleged that these documents rendered the case moot and moved to dismiss the suit. The parties filed cross-motions for summary judgment.

The district court determined that the case was not moot, and also denied RBS’ motion for summary judgment. It denied Synopsys’ motion as to the copyright infringement claims, finding that there were material facts in dispute that a jury would have to resolve, and granting it as to the misappropriation of trade secrets and tortious interference claims. It also granted Synopsys’ motion to exclude some of RBS’ expert testimony. RBS appealed as to the decision that the case was not moot, as well as to the exclusion of the expert testimony, and to the findings regarding the misappropriation of trade secrets.

Mootness. The Fourth Circuit first reviewed the district court’s determination that the case was not moot, which it reviewed de novo. RBS argued that the case was moot because it had provided a covenant not to sue and a withdrawal of its cease-and-desist letter. However, the Court of Appeals disagreed. The unilateral promises by RBS were only in relation to “Synopsys’ use or potential use of VulnDB in its role as a CNA,” and did not address any other commercial conduct of Synopsys. They thus did not address the entire dispute between the parties. Additionally, the covenant and withdrawal were conditioned on alleged representations by Synopsys’ counsel that it had not and would not in the future use VulnDB. Further, because “RBS’ unilateral change relied on certain conditions about how Synopsys undertook its role as a CNA, the withdrawal letter and covenant not to sue were revocable at its discretion and thus fell further short of the high benchmark” required to show that a case is moot. The Fourth Circuit thus found that the district court had correctly concluded that the case was not moot and that it had jurisdiction.

Trade secrets. The Court of Appeals next turned to the question of misappropriation of trade secrets. “Failing to prove the existence of a ‘trade secret’ dooms a misappropriation claim.” In order to prove that it had trade secrets to be misappropriated, RBS had to show that the alleged trade secrets had independent economic value, derived from being secret, and that the company had taken reasonable efforts to ensure their secrecy.

The district court found that RBS had not provided evidence showing that its alleged trade secrets had independent economic value, and the Fourth Circuit agreed. Although RBS provided evidence of the price paid during its recent acquisition by another company, and the proportion of its revenue that is derived from VulnDB, it failed to show more specifically the value attributable to any particular trade secrets, or that such value is derived from their secrecy. RBS thus failed to prove that the alleged trade secrets met the statutory definition of a “trade secret,” and so it could not have prevailed on a misappropriation of trade secrets claim.

Exclusion of expert testimony. The Fourth Circuit further found that the exclusion of the expert testimony was appropriate. In addition to issues regarding legal conclusions and speculative foundation, the expert witness “had not demonstrated that he’d reviewed the alleged trade secrets individually.” Although it might have been appropriate to value the trade secrets collectively, the Court of Appeals stated that the expert would have needed to at least evaluate them individually. “Without undertaking that task, [the expert’s] method for formulating his opinions was on shaky ground, and the district court did not abuse its discretion in excluding it.”

The Fourth Circuit held that the district court properly determined that the case was not moot, and it affirmed the district court’s grant of summary judgment to Synopsys on the claim that it had misappropriated RBS’ trade secrets.

The Case is No. 22-1812.

Attorneys: Catherine Emily Stetson (Hogan Lovells US LLP) for Synopsys, Inc. Andrew Evan Samuels (Baker & Hostetler LLP) for Risk Based Security, Inc.

Companies: Synopsys, Inc.; Risk Based Security, Inc.

MainStory: TopStory TradeSecrets TechnologyInternet GCNNews MarylandNews NorthCarolinaNews SouthCarolinaNews VirginiaNews WestVirginiaNews