Case: 18-12004     Date Filed: 05/20/2020   Page: 1 of 53



                                                                        [PUBLISH]



              IN THE UNITED STATES COURT OF APPEALS

                      FOR THE ELEVENTH CIRCUIT
                       _________________________

                              No. 18-12004
                        ________________________

                     D.C. Docket No. 9:16-cv-81942-RLR



COMPULIFE SOFTWARE INC.,

                                                             Plaintiff - Appellant,

                                     versus

MOSES NEWMAN,
AARON LEVY,
DAVID RUTSTEIN,
a.k.a. David Anthony Gordon,
a.k.a. Bob Gordon,
a.k.a. Nate Golden,
BINYOMIN RUTSTEIN,
a.k.a. Ben Rutstein,

                                                          Defendants - Appellees.



                        _________________________

                              No. 18-12007
                        ________________________

                     D.C. Docket No. 9:16-cv-80808-RLR
                Case: 18-12004      Date Filed: 05/20/2020       Page: 2 of 53




COMPULIFE SOFTWARE INC.,

                                                                  Plaintiff - Appellant,

                                           versus

BINYOMIN RUTSTEIN,
a.k.a. Ben Rutstein,
JOHN DOES 1 - 10,
DAVID RUTSTEIN,

                                                                  Defendants - Appellees.

                              ________________________

                     Appeals from the United States District Court
                         for the Southern District of Florida
                            ________________________

                                       (May 20, 2020)

Before JORDAN and NEWSOM, Circuit Judges, and HALL, * District Judge.

NEWSOM, Circuit Judge:

       There’s nothing easy about this case. The facts are complicated, and the

governing law is tangled. At its essence, it’s a case about high-tech corporate

espionage. The very short story: Compulife Software, Inc., which has developed

and markets a computerized mechanism for calculating, organizing, and comparing

life-insurance quotes, alleges that one of its competitors lied and hacked its way


*
 Honorable James Randal Hall, United States District Chief Judge for the Southern District of
Georgia, sitting by designation.

                                               2
              Case: 18-12004     Date Filed: 05/20/2020   Page: 3 of 53



into Compulife’s system and stole its proprietary data. The question for us is

whether the defendants crossed any legal lines—and, in particular, whether they

infringed Compulife’s copyright or misappropriated its trade secrets, engaged in

false advertising, or violated an anti-hacking statute.

      With the parties’ consent, a magistrate judge was tasked with tackling these

thorny issues in a bench trial. He determined that Compulife had failed to prove

any legal violation. We conclude, however, that in finding that Compulife hadn’t

demonstrated either copyright infringement or trade-secret misappropriation, the

magistrate judge made several discrete legal errors and, more generally, failed to

adequately explain his conclusions. Accordingly, we vacate the judgment in part

and remand with instructions to make new findings of fact and conclusions of law.

                                           I

                                          A

      Warning: This gets pretty dense (and difficult) pretty quickly.

      Compulife and the defendants are direct competitors in a niche industry:

generating life-insurance quotes. Compulife maintains a database of insurance-

premium information—called the “Transformative Database”—to which it sells

access. The Transformative Database is valuable because it contains up-to-date

information on many life insurers’ premium-rate tables and thus allows for

simultaneous comparison of rates from dozens of providers. Most of Compulife’s


                                           3
              Case: 18-12004    Date Filed: 05/20/2020   Page: 4 of 53



customers are insurance agents who buy access to the database so that they can

more easily provide reliable cost estimates to prospective policy purchasers.

Although the Transformative Database is based on publicly available

information—namely, individual insurers’ rate tables—it can’t be replicated

without a specialized method and formula known only within Compulife.

      Compulife sells two different kinds of access to the Transformative

Database—a “PC version” and an “internet-engine version”—each run by its own

piece of software and each accompanied by its own type of license. Both pieces of

software contain an encrypted copy of the database. The PC-version software—

called the “PC quoter”—is sold along with a PC license that allows licensees to

install copies of the quoter on their personal computers and other devices for

(depending on the number of devices) a cost of either $180 or $300 per year. The

PC quoter uses its local copy of the Transformative Database to generate

insurance-rate estimates corresponding to demographic information entered by the

end user.

      A PC licensee can purchase an add-on called the “web quoter” for an extra

$96 per year. The web-quoter feature allows the PC licensee to put a quoter on its

own website, which it can then use as a marketing tool to attract customers. Once

a licensee’s website is equipped with the web quoter, prospective life-insurance

purchasers can enter demographic information into fields on the licensee’s site and


                                         4
              Case: 18-12004     Date Filed: 05/20/2020   Page: 5 of 53



receive quotes directly from the licensee. Unlike the PC quoter—which contains

its own local copy of the Transformative Database—the web quoter generates

quotes by communicating with an internet-quote engine hosted on Compulife’s

server. The HTML source code of the web quoter is protected by a registered

copyright.

      A second kind of license—the “internet-engine” license—permits a licensee

to host Compulife’s internet-quote engine, which includes the Transformative

Database, on its own server and to integrate it with additional features of its own

creation. (Naturally, it’s more expensive—it costs $1200 per year.) An internet-

engine licensee can then sell access to “its” product—which is an amalgamation of

Compulife’s internet-quote engine with any accoutrements that the licensee has

seen fit to add. Importantly, though, internet-engine licensees can sell access only

to Compulife’s PC licensees. This arrangement allows an internet-engine licensee

to include Compulife’s internet-quote engine—again, with the Transformative

Database—as a part of its own product, while simultaneously ensuring that it

doesn’t compete with Compulife for potential insurance-agent customers.

Compulife also permits an internet-engine licensee to provide its web-quoter

HTML code to the licensee’s customers so that the customers’ websites can

retrieve quotes from the licensee’s server. This is the same copyrighted HTML

code that Compulife provides to PC licensees with the web quoter add-on.


                                          5
              Case: 18-12004     Date Filed: 05/20/2020   Page: 6 of 53



      In addition to the PC-version and internet-engine products that it licenses to

agents and that contain the Transformative Database, Compulife also provides

consumers with direct access to life-insurance quotes through its Term4Sale

internet site, www.term4sale.com. Term4Sale communicates with essentially the

same internet-quote engine that PC licensees’ web quoters access and that internet-

engine licensees are permitted to maintain on their own servers. Anyone can use

the Terms4Sale site to receive free life-insurance quotes directly from a copy of the

Transformative Database that Compulife hosts on its own server. The Term4Sale

site refers prospective life-insurance purchasers to insurance agents with whom

Compulife partners, who in turn pay Compulife for the referrals.

      Now, to the defendants, who are also in the business of generating life-

insurance quotes—primarily through a website, www.naaip.org. “NAAIP” stands

for National Association of Accredited Insurance Professionals, but as the court

below found, “NAAIP is not a real entity, charity, not-for-profit, or trade

association, and is not incorporated anywhere.” Compulife Software, Inc. v.

Rutstein, No. 9:16-cv-80808, 

, at *15 (Mar. 12,

2018). Through naaip.org, the defendants offer a service similar to—and, the

evidence shows, at least partially copied from—Compulife’s web quoter, which

they call a “Life Insurance Quote Engine.” Any insurance agent can sign up for a

free website located on the domain naaip.org—for example,


                                          6
              Case: 18-12004    Date Filed: 05/20/2020    Page: 7 of 53



“http://naaip.org/tmatteson77.” The defendants host thousands of these sites on a

server in Israel and equip each one with the Life Insurance Quote Engine.

Prospective life-insurance purchasers can then obtain quotes on any of these

NAAIP-hosted websites by entering demographic information, just as they could

on the website of any Compulife PC licensee with a web quoter add-on. Each

NAAIP site includes a link that allows consumers to purchase insurance through

One Resource Group, Inc., a brokerage firm with which the defendants have

partnered. If a visitor to an NAAIP site uses the link to buy insurance, the

defendants receive a part of One Resource’s brokerage fees in exchange for the

referral.

       The defendants also operate the BeyondQuotes website,

www.beyondquotes.com, which includes a Life Insurance Quote Engine like the

ones on participating NAAIP websites. BeyondQuotes operates similarly to

Compulife’s Term4Sale site, generating revenue by selling referrals to affiliated

insurance agents.

                                         B

       Having canvassed Compulife’s and the defendants’ respective businesses,

we should introduce the (complex) cast of individual characters that populate this

case. The first is Robert Barney, the founder and CEO of Compulife. Barney

personally updates Compulife’s Transformative Database. To do so, he draws on


                                          7
               Case: 18-12004       Date Filed: 05/20/2020       Page: 8 of 53



insurers’ publicly available rate information, but he also employs a proprietary

calculation technique—in particular, a secure program to which only he has access

and that only he knows how to use. Other relevant players at Compulife include

Jeremiah Kuhn, its CFO/COO, and Chris Bruner, the programmer who created the

Transformative Database.

       Most significant among the defendants is David Rutstein, the founder of

NAAIP and the owner of BeyondQuotes. He operates naaip.org and

beyondquotes.com with help from his son, defendant Binyomin Rutstein, and their

co-defendants Aaron Levy and Moses Newman. At one point—more on this to

come—the defendants also employed a hacker named Natal, who, it is undisputed,

took Compulife’s data for use in the defendants’ software.1

       There are also several key characters who aren’t directly affiliated with any

of the parties. MSCC is a software company and a Compulife customer with an

internet-engine license. It sells access to a proprietary program for life-insurance

agents called “Vam DB,” which (as is permissible for internet-engine licensees)

includes Compulife’s internet engine. And because MSCC hosts Compulife’s




1
 There is some confusion about the hacker’s name in the record. We don’t know her first name.
As for her last, sometimes it’s rendered Natal, sometimes Matal. For simplicity’s sake, we will
use Natal.



                                               8
              Case: 18-12004    Date Filed: 05/20/2020      Page: 9 of 53



internet engine on its Vam DB server, it also hosts (again, as is permissible) a copy

of Compulife’s Transformative Database.

      Brian McSweeney is a life-insurance agent who, during the time of the

defendants’ alleged misconduct, was a Compulife PC licensee who used MSCC’s

Vam DB server. At the same time, McSweeney also had a working relationship

with the defendants—in particular, he was one of the agents who (as already

described) paid the defendants for leads generated from the BeyondQuotes site.

Eric Savage—another Compulife licensee—also had a working relationship with

defendant David Rutstein. McSweeney and Savage are important here because the

defendants used their relationships with them to gain access to Vam DB, and thus

to Compulife’s Transformative Database.

                                         C

      With that background, we turn (at last) to the alleged espionage. Compulife

claims that the defendants’ websites don’t report their own quotes but merely

reproduce Compulife’s own proprietary data. According to Compulife, the

defendants stole its data in two different ways, which form the basis of two

separate lawsuits. These suits—which have been called the “08 case” and the “42

case” throughout these proceedings, to denote their original docket numbers—were

consolidated for trial and remain consolidated on appeal.




                                          9
               Case: 18-12004       Date Filed: 05/20/2020      Page: 10 of 53



       In the 08 case, Compulife contends that the defendants gained access to the

Transformative Database under false pretenses by purporting to work for licensed

Compulife customers. In particular, David Rutstein, using the email address

bob@naaip.org, represented that he was working with Compulife PC licensees

McSweeney and Savage and requested the HTML code for Compulife’s web

quoter, which he said would allow his websites to communicate with the copy of

the Transformative Database hosted on MSCC’s Vam DB server. Compulife

CFO/COO Kuhn responded by sending Rutstein the HTML code, believing that he

was a web designer employed by McSweeney, a licensed customer. 2 A

comparison of the HTML used by the defendants with Compulife’s HTML source

code shows without a doubt that the defendants copied some of it, although (as

we’ll discuss) the legal significance of that copying is disputed.




2
  As already noted, the defendants really did have a professional relationship with McSweeney
and Savage, but Kuhn provided the HTML code only because he misunderstood the nature of
that relationship. Rutstein had partnered with McSweeney and Savage and forwarded them
customer leads from Beyond Quotes, but Beyond Quotes was not owned by McSweeney or
Savage. Nevertheless, when Rutstein requested HTML code for www.beyondquotes.com by
email he claimed to have an “account . . . thru Eric Savage.” He also explained that he intended
to set up a web quoter to forward “leads” to McSweeney, although he planned to set it up on a
website that “would be separate from” McSweeney’s. In context, Kuhn took this to mean that
Rutstein was a web designer helping McSweeney to set up a second website of his own. As
Kuhn had explained to Savage in an email exchange a few months earlier, each customer was
permitted to put the quoter on any website that he owned without an additional license, but an
additional license was required before the quoter could be implemented on a website owned by
someone else. Kuhn testified that he wouldn’t have emailed the HTML code if he had known
that “Beyond Quotes did not belong to Eric Savage or Brian McSweeney or any other authorized
user.”

                                               10
             Case: 18-12004     Date Filed: 05/20/2020    Page: 11 of 53



      For several years, the defendants’ websites enjoyed access to Compulife’s

internet engine—and thus to the Transformative Database—on MSCC’s Vam DB

server. They used this access to generate quotes for all NAAIP websites and for

their own BeyondQuotes site. Compulife eventually discovered the ruse and cut

off the defendants’ unauthorized access, at which point their sites temporarily (and

conspicuously) stopped producing quotes. The defendants don’t deny that they

connected their NAAIP websites and BeyondQuotes to Compulife’s database on

the Vam DB server—they simply claim that their access was innocent.

      In the 42 case, Compulife alleges that the defendants hired a hacker, Natal,

to “scrape” data from its server. Scraping is a technique for extracting large

amounts of data from a website. The concept is simple; a hacker requests

information from a server using ordinary HTTP commands similar to those that a

legitimate client program of the server might employ in the ordinary course.

Although a hacker could obtain the data manually by entering each command as a

line of code and then recording the results, the true power of a scraping attack is

realized by creating a robot—or “bot,” for short—that can make many requests

automatically and much more rapidly than any human could. A bot can request a

huge amount of data from the target’s server—technically one query at a time, but

several queries per second—and then instantaneously record the returned

information in an electronic database. By formulating queries in an orderly fashion


                                          11
               Case: 18-12004        Date Filed: 05/20/2020        Page: 12 of 53



and recording the resulting information, the bot can create a copy—or at least a

partial copy—of a database underlying a website.

       Natal used this scraping technique to create a partial copy of Compulife’s

Transformative Database, extracting all the insurance-quote data pertaining to two

zip codes—one in New York and another in Florida.3 That means the bot

requested and saved all premium estimates for every possible combination of

demographic data within those two zip codes, totaling more than 43 million quotes.

Doing so naturally required hundreds of thousands of queries and would have

required thousands of man-hours if performed by humans—but it took the bot only

four days. The HTML commands used in the scraping attack included variables

and parameters—essentially words (or for that matter any string of characters) used

to designate and store values—from Compulife’s copyrighted HTML code. For

example, the parameter “BirthMonth” in Compulife’s code stores a number

between one and twelve, corresponding to a prospective purchaser’s birth month.)

       Compulife alleges that the defendants then used the scraped data as the basis

for generating quotes on their own websites. The defendants don’t disagree,



3
  David Rutstein testified that he asked Natal to obtain data on New York and California.
Whether he misspoke or Natal simply scraped the wrong data is unclear, but unrebutted
testimony establishes that the defendants set up their quote engines to provide only New York
and Florida quotes—specifically, quotes corresponding to two zip codes: 10458 and 33433.
Moreover, it is undisputed that the defendants received data files from Natal with data for just
those zip codes.

                                                12
             Case: 18-12004     Date Filed: 05/20/2020    Page: 13 of 53



except to claim that they didn’t know the source of the scraped data but, rather,

innocently purchased the data from a third party. Moses Newman testified,

however, that he watched Natal collect the requested data in a manner consistent

with a scraping attack. David Rutstein also testified that when the defendants

instructed Natal to obtain insurance-quote information, they fully intended for her

to “extract[] data” from an existing website.

                                          D

      Compulife filed suit in the United States District Court for the Southern

District of Florida. In both the 08 case and the 42 case, it asserted counts of

copyright infringement and trade-secret misappropriation. In the 08 case,

Compulife alleged that the defendants (1) infringed its copyright in the HTML

source code of its web quoter when they implemented similar quoters on their own

websites and (2) misappropriated its trade secret by accessing the Transformative

Database on MSCC’s Vam DB server to generate quotes without permission. In

the 42 case, Compulife alleged that the defendants (1) infringed its copyright by

copying parameters and variables from the HTML source code in order to carry out

a scraping attack and (2) misappropriated a trade secret by scraping data from its

Term4Sale site. Compulife also asserted false-advertising claims under the

Lanham Act, Florida Deceptive and Unfair Trade Practices Act, and Florida




                                          13
             Case: 18-12004     Date Filed: 05/20/2020    Page: 14 of 53



common law in both cases, as well as a violation of the Florida Computer Abuse

and Data Recovery Act in the 42 case.

      The parties consented to a bench trial before a federal magistrate judge.

Although the judge found, as an initial matter, that Compulife had a valid

copyright in the text of its HTML source code and that its Transformative Database

was a protectable trade secret, he ruled in favor of the defendants. In doing so, he

held that Compulife hadn’t met its burden to prove—as it had to in order to make

out a copyright-infringement claim—that the defendants’ copied code was

“substantially similar” to its own and, further, that the defendants hadn’t

misappropriated any trade secrets. The judge separately rejected Compulife’s

false-advertising claims on the ground that Compulife had failed to identify any

false or misleading advertisement. Finally, he ruled that the defendants hadn’t

violated the Florida Computer Abuse and Data Recovery Act, because Compulife

failed to show that the data that the defendants took was protected by any

“technological access barrier” within the meaning of that statute.

      Compulife contends that all of these determinations were in error,

identifying what it contends are mistakes of both law and fact in the magistrate

judge’s decision. Regarding copyright infringement and trade-secret

misappropriation, we agree with Compulife. As to the false-advertising and

Florida statutory claims, we agree with the magistrate judge’s conclusions.


                                          14
              Case: 18-12004     Date Filed: 05/20/2020    Page: 15 of 53



Accordingly, we will vacate the judgment in part and remand for new findings and

conclusions limited to the issues of copyright infringement and trade-secret

misappropriation.

                                           II

      On appeal from a bench trial, “the district court’s conclusions of law are

reviewed de novo,” but its “findings of fact . . . ‘shall not be set aside unless clearly

erroneous.’” MiTek Holdings, Inc. v. Arce Eng’g Co., 

, 1554 (11th

Cir. 1996) (citation omitted) (quoting Fed. R. Civ. P. 52(a)(6)). “[T]he standard of

review for a mixed question [of law and fact] all depends—on whether answering

it entails primarily legal or factual work.” U.S. Bank Nat. Ass’n ex rel. CWCapital

Asset Mgmt. LLC v. Vill. at Lakeridge, LLC, 

, 967 (2018).

Separately, “[w]hen an appellate court discerns that a district court has failed to

make a finding because of an erroneous view of the law, the usual rule is that there

should be a remand for further proceedings to permit the trial court to make the

missing findings.” Pullman-Standard v. Swint, 

, 291 (1982).

      We must also review findings of fact and conclusions of law to ensure that

they satisfy Federal Rule of Civil Procedure 52(a)(1). That rule requires that a

district court “find the facts specially and state its conclusions of law separately.”

Fed. R. Civ. P. 52(a)(1). We will vacate and remand a judgment resulting from a

bench trial where “the findings of the district court do not provide a sufficiently


                                           15
             Case: 18-12004     Date Filed: 05/20/2020   Page: 16 of 53



definite predicate for proper appellate review.” Hydrospace-Challenger, Inc. v.

Tracor/MAS, Inc., 

, 1034 (5th Cir. 1975).

                                    *     *     *

      With that précis, we will consider Compulife’s claims in turn: (1) copyright

infringement; (2) trade-secret misappropriation; (3) false advertising; and

(4) violation of Florida’s Computer Abuse and Data Recovery Act.

                                         III

                                         A

      To succeed on its claim of copyright infringement, Compulife “must prove

‘(1) ownership of a valid copyright, and (2) copying of constituent elements of the

work that are original.’” Bateman v. Mnemonics, Inc., 

, 1541 (11th

Cir. 1996) (quoting Feist Publications, Inc. v. Rural Tel. Serv. Co., 

,

361 (1991)). The existence and validity of Compulife’s copyright are undisputed,

so we can proceed directly to the second prong—copying. Copying comprises two

subparts, “factual and legal copying,” both of which Compulife, as the plaintiff,

has the burden to prove. See BUC Int’l Corp. v. Int’l Yacht Council Ltd., 

, 1148 n.40 (11th Cir. 2007).

      Factual copying—the question “whether the defendant actually used the

plaintiff's material,” id.—may be shown “either by direct evidence, or, in the

absence of direct evidence, it may be inferred from indirect evidence


                                         16
                Case: 18-12004        Date Filed: 05/20/2020       Page: 17 of 53



demonstrating that the defendant had access to the copyrighted work and that there

are probative similarities between the allegedly infringing work and the

copyrighted work.” 

.4 Factual copying isn’t really disputed

here, and we think it has been established, in any event, 5 so we focus here on legal

copying.

       “Legal”—or “actionable”—copying occurs when “those elements of the

[copyrighted work] that have been copied are protected expression and of such

importance to the copied work that the appropriation is actionable.” Peter

Letterese & Assocs. v. World Inst. of Scientology Enters., 

, 1300

(11th Cir. 2008) (alteration in original) (quoting 

). In most

cases, a “‘substantial similarity’ between the allegedly offending program and the

protectable, original elements of the copyrighted works” establishes actionable

copying. 

; see also 

n.42


4
  A warning here: Although “probative similarity” may sound just like “substantial similarity”—
which we’ll encounter momentarily—“[t]here is a vital distinction here between” them.
4 Nimmer on Copyright § 13.02[B] n.70.4 (2019). “[P]robative similarity is but one of several
vehicles to prove copying as a factual matter,” whereas “substantial similarity” is part of the test
for legal copying and “remains an indispensable element of plaintiff’s proof, even in cases . . . in
which defendant does not contest factual copying.”

5
  David Rutstein frankly admits that the defendants had access to Compulife’s copyrighted
HTML. Further, his testimony strongly suggests copying in fact, because he admits that “a life
insurance quote engine [was] put on to Beyond Quote” after “[c]ommunications between myself
and Compulife Software.” The defendants make similar admissions in their brief to us. Finally,
defendant Moses Newman agreed that he modified the HTML on naaip.org “so that it would no
longer be the same” as Compulife’s copyright-protected HTML. All of which is to say that the
defendants have conceded access, at the very least, and they don’t meaningfully dispute factual
copying.

                                                 17
               Case: 18-12004       Date Filed: 05/20/2020       Page: 18 of 53



(“BellSouth established the ‘substantial similarity’ standard as the default mode of

analysis for compilation copyright claims.”). 6

       Substantial similarity “must be assessed with respect to both the quantitative

and the qualitative significance of the amount copied to the copyrighted work as a

whole.” Peter 

. Quantitively insubstantial copying

may still be actionable if it is qualitatively substantial. See Harper & Row

Publishers, Inc. v. Nation Enterprises, 

, 565 (1985). For instance,

because “a small portion of the structure or code of a [computer] program may

nonetheless give it distinctive features or may make the program especially

creative or desirable,” copying of that portion is actionable. 4 Nimmer on

Copyright § 13.03[F][5] (2019).

       Before comparing two works to determine if they display the required

substantial similarity, a court must “eliminate from comparison the unprotectable


6
  In special circumstances, we have required that two works be more than substantially similar
before infringement can be found, but this is not such a case. In MiTek, we adopted a “virtual
identicality” standard for “analyzing claims of compilation copyright infringement of nonliteral
elements of a computer 

. The virtual-identicality standard originated
in the Ninth Circuit. See Apple Computer, Inc. v. Microsoft Corp., 

, 1446 (9th Cir.
1994). Nonliteral elements of a computer program “are the products that are generated by the
code’s interaction with the computer hardware and operating program(s),” of which “screen
displays and the main menu” are illustrative examples. 

n.15. “Source
and object code,” on the other hand, are “literal elements.”

these elements, even
nonliterally—i.e., without verbatim copying—therefore does not fall into the category analyzed
for “virtual identicality” as identified in MiTek. “[A]pplication of ‘virtual identicality’ [is]
limited to a specific factual context” that we have described as “narrow.” 

n.42. Because the copying alleged here concerns source code, the substantial-similarity standard,
rather than the heightened virtual-identicality standard, applies.

                                               18
             Case: 18-12004     Date Filed: 05/20/2020    Page: 19 of 53



elements of” the copyrighted work. 

. This process—

known as “filtration”—is necessary because even substantial similarity between a

copyrighted work’s unprotectable elements and a purportedly infringing work isn’t

actionable, regardless of how many unprotectable elements are copied or how

important they may be.

                                          B

      We conclude that the magistrate judge (sitting as the district court) made

several errors in the course of concluding that Compulife had failed to prove

actionable—or legal—copying. Unpacking those errors will take some doing, but

in short they are as follows. First, the magistrate judge improperly placed the

burden on Compulife to prove, as part of the filtration analysis, that the elements

the defendants copied were protectable; we hold that he should have required the

defendants to prove that those elements were not protectable. Second, the judge

seems to have evaluated the substantiality of the defendants’ copying vis-à-vis

their allegedly infringing work; we hold that he should have judged the

substantiality of the copied material vis-à-vis Compulife’s copyrighted work.

Finally, even if the magistrate judge hadn’t based his decision on these legal errors,

he failed to state on the record sufficient findings of fact and conclusions of law to




                                          19
                Case: 18-12004        Date Filed: 05/20/2020        Page: 20 of 53



permit meaningful appellate review. All of these missteps call for the same

corrective: vacatur of the judgment with respect to copyright infringement.

                                                  1

       First, the misplaced burden. To properly frame this error, a little background

is in order. The magistrate judge misallocated the burden of proof applicable to the

filtration step of the substantial-similarity analysis. Filtration, again, refers to the

process of separating the protectable elements of a copyrighted work from

elements that, for one reason or another, aren’t protected.7

       The notion that unprotected material should be disregarded when comparing

two works is at least a century old. See Int’l News Serv. v. Associated Press, 

, 234 (1918). Conceiving of filtration as a distinct step in the infringement

analysis, however, came into the law relatively recently, in the Second Circuit’s

seminal decision in Computer Assocs. Int’l, Inc. v. Altai, Inc., 

(2d

Cir. 1992). We have adopted a version of Altai’s test, see 

–46, which has three steps: (1) abstraction, (2) filtration, and (3) comparison.

. In order to “ascertain[] substantial similarity under this

approach, a court . . . first break[s] down the allegedly infringed program into its




7
  Filtering “protectable expression from non-protectable expression is . . . a question of law or, at
the very least, a mixed question of law and fact.” Home Design Servs., Inc. v. Turner Heritage
Homes Inc., 

, 1325 (11th Cir. 2016) (alteration in original) (quoting Intervest
Constr., Inc. v. Canterbury Estate Homes, Inc., 

, 920 (11th Cir. 2008)).
                                                 20
               Case: 18-12004   Date Filed: 05/20/2020    Page: 21 of 53



constituent structural parts”—that’s abstraction. 

(quoting 

). Next, the court “sift[s] out all non-protectable

material”—filtration.

step [is] to compare” any remaining “kernels[]

of creative expression” with the “allegedly infringing program” to determine if

there is in fact a substantial similarity—comparison.

have

observed that Altai, by its terms, dealt only with a narrow category of copying, see

n.16, “a parallel type of analysis”—including filtration, or

its equivalent—applies more generally, see 

. Here, we

focus on the filtration step because that’s where we conclude the magistrate judge

went astray.

      Filtration can be tricky because copied material may be unprotectable for a

wide variety of reasons. First, for instance, copyright protection extends only to a

work’s expressive elements, not to any underlying “idea, procedure, process,

system, method of operation, concept, principle, or discovery” expressed therein.

17 U.S.C. § 102; see also Baker v. Selden, 

, 102 (1879) (“[T]here is a

clear distinction between the book, as such, and the art which it is intended to

illustrate.”). Courts call this the “idea-expression” dichotomy, with the term “idea”

standing in “as a metonym for all eight categories” of unprotectable material.

1 Nimmer on Copyright § 2A.06; see, e.g., Oravec v. Sunny Isles Luxury Ventures,

L.C., 

, 1224 (11th Cir. 2008). Second, and separately, some


                                          21
              Case: 18-12004     Date Filed: 05/20/2020    Page: 22 of 53



expression may be so intrinsic to the communication of an idea—or procedure,

process, etc.—that it is considered to have “merged” into the idea. According to

the merger doctrine, where there are sufficiently “few ways of expressing an idea,

not even the expression is protected by copyright.” 

. In one

seminal example, the First Circuit determined that a written rule governing a

sweepstakes—requiring, for instance, that “[e]ntrants should print name, address

and social security number on a boxtop, or a plain paper”—wasn’t protectable

because the ideas it expressed were “so straightforward and simple” that “at best

only a limited number” of possible modes of expression could exist to convey

them. Morrissey v. Procter & Gamble Co., 

, 678–79 (1st Cir. 1967).

      Third—and this is easier to understand—material taken from the public

domain is unprotected, even if incorporated into a copyrighted work. See Stewart

v. Abend, 

, 234 (1990) (holding that an author “may receive

protection only for his original additions,” not “elements . . . already in the public

domain”). Fourth, material may be unprotected if it constitutes scènes à faire—

that is “[i]ncidents, characters, or settings that are indispensable or standard in the

treatment of a given topic.” Corwin v. Walt Disney Co., 

, 1251 (11th

Cir. 2007) (alteration in original) (quoting Herzog v. Castle Rock Entm't, 

, 1248 (11th Cir. 1999)); see also Beal v. Paramount Pictures Corp., 

, 459 (11th Cir. 1994) (describing scènes à faire as “stock scenes that naturally


                                           22
             Case: 18-12004     Date Filed: 05/20/2020    Page: 23 of 53



flow from a common theme”). For example, we have noted that there is “no

protection for common elements in police fiction, such as ‘drunks, prostitutes,

vermin and derelict cars’ and ‘foot chases and the morale problems of policemen,

not to mention the familiar figure of the Irish cop.’” 

(quoting Walker v. Time Life Films, Inc., 

, 50 (2d Cir. 1986)). Finally,

certain ways of arranging information—say, alphabetically—are entirely

unoriginal, and therefore unprotectable. See 

(explaining that

presenting data in alphabetical order is “so commonplace that it has come to be

expected as a matter of course”).

      How might these categories of unprotectability apply in a case like this one?

Well, for one, by analogy to merger and scènes à faire, elements of computer

source-code expression “dictated by external factors” aren’t entitled to copyright

protection. 

. Frequently, “compatibility requirements

and industry demands . . . [can make it] ‘virtually impossible to write a program to

perform particular functions in a specific computing environment without

employing standard techniques.’”

(quoting 

).

The author of a copyrighted code can’t obtain protection for such standard modes

of expression, lest he effectively monopolize an underlying “idea.”

      In any event, many species of unprotectability may be at issue in a single

case, and the filtration process must eliminate all of them so that only protectable


                                          23
              Case: 18-12004     Date Filed: 05/20/2020    Page: 24 of 53



material is considered when deciding—at the comparison step—whether two

works are substantially similar. 

(“[F]iltration should

eliminate from comparison the unprotectable elements of ideas, processes, facts,

public domain information, merger material, scènes à faire material, and other

unprotectable elements.” (alteration in original)).

      With that background, we come to the magistrate judge’s first error. In his

opinion, the magistrate judge implicitly placed on Compulife the burden of proving

that the elements of its HTML code that the defendants copied were protectable.

In particular, he faulted Compulife for having “made no attempt to identify the

protectable elements of the 2010 HTML Source Code.” Compulife Software, 

, at *38. Although we haven’t previously done so, we now

clarify that after an infringement plaintiff has demonstrated that he holds a valid

copyright and that the defendant engaged in factual copying, the defendant bears

the burden of proving—as part of the filtration analysis—that the elements he

copied from a copyrighted work are unprotectable. That is so for two main

reasons. First, assigning this burden to the defendant is consonant with our

existing precedent, and it enjoys the support of the foremost copyright treatise. See

(“[T]he plaintiff must also respond to any proof

advanced by the defendant that the portion of the copyrighted work actually taken

does not satisfy the constitutional requirement of originality as set forth in Article


                                          24
                Case: 18-12004   Date Filed: 05/20/2020   Page: 25 of 53



I, § 8, cl. 8.” (emphasis added)); 4 Nimmer on Copyright § 13.03[F][3] (“Although

[a] plaintiff’s failure to present proof about [merger and scènes à faire] could

defeat a plaintiff’s application for a preliminary injunction, it would seem that

defendant must go forward at trial with appropriate evidence as to those

doctrines.”).

      Second, placing the burden to prove protectability on the infringement

plaintiff would unfairly require him to prove a negative. Protectability can’t

practicably be demonstrated affirmatively but, rather, consists of the absence of the

various species of unprotectability. If the plaintiff had the burden of proving

protectability, he would have to preemptively present evidence negating all

possible theories of unprotectability just to survive a motion for summary

judgment. Cf. Fitzpatrick v. City of Atlanta, 

, 1116 (11th Cir. 1993)

(noting that a summary-judgment movant “simply may . . . point[ ] out . . . that

there is an absence of evidence to support the non-moving party’s case” where the

non-moving party bears the burden of proof). And, of course, some types of

unprotectability can be negated only by presenting practically infinite evidence. A

plaintiff, for instance, can’t be expected to present the entirety of the public domain

as it existed when he authored his copyrighted material in order to show that no

elements of his work were taken from it. Nor could a plaintiff reasonably

introduce the entire corpus of relevant, industry-standard techniques just to prove


                                          25
             Case: 18-12004       Date Filed: 05/20/2020   Page: 26 of 53



that none of the material copied from his work constituted scènes à faire. Placing

the burden of proving protectability on the plaintiff would seemingly require just

these kinds of impossibilities.

      Placing the burden on the defendant, by contrast, merely requires him to

identify the species of unprotectability that he is alleging and to present supporting

evidence where appropriate. If, for instance, the defendant believes that some part

of the copyrighted work is in the public domain, he must narrow the inquiry by

indicating where in the public domain that portion of the work can be found.

Similarly, if he thinks that what he copied amounts to usual industry practice, he

must indicate the standards that dictate that technique. The plaintiff then faces the

manageable task of “respond[ing],” 

, to the appropriately

narrowed issue. Placing the burden on the defendant, therefore, isn’t just

consistent with our own precedent and leading scholarly commentary, but also

fairer and more efficient.

      In light of these considerations, copyright-infringement analysis should

proceed as follows: Once the plaintiff has proven that he has a valid copyright and

that the defendant engaged in factual copying, the defendant may seek to prove

that some or all of the copied material is unprotectable. If the defendant carries

this burden as to any portion of the copied material, that material should be filtered

out of the analysis before comparing the two works. After filtration is complete,


                                           26
                Case: 18-12004        Date Filed: 05/20/2020        Page: 27 of 53



the burden shifts back to the plaintiff to prove substantial similarity between any

remaining (i.e., unfiltered) protectable material and the allegedly infringing work.

If the defendant demonstrates—at the filtration stage—that it copied only

unprotectable material, such that no substantial similarities remain after filtration,

the defendant is entitled to summary judgment. See Home Design Servs., Inc. v.

Turner Heritage Homes Inc., 

, 1322 (11th Cir. 2016). But because

the defendant bears the burden to demonstrate unprotectability, the mere failure of

the plaintiff to present evidence of protectability—assuming that a valid copyright

and factual copying have already been established—isn’t a sufficient reason to give

judgment to the defendant. Rather, where the defendant’s evidence is insufficient

to prove that a particular element is unprotectable, the court should simply assume

that the element is protectable and include that element in the final substantial-

similarity comparison between the works.8


8
  That is not to say that the defendant must always introduce evidence in order to enable the
district court to filter. The defendant may sometimes be able to demonstrate by argument alone
that an element of a copyrighted work is unprotected. For example, no evidence would be
necessary to convince a court that alphabetization is an entirely unoriginal method of arranging
data and thus unprotectable as a structural element of a work. See 

. But
where evidence is required to determine whether some element is protectable, it is the defendant
who must advance it or risk abandoning the issue.
        One other thing: A plaintiff may concede that some element of code is unprotectable, in
which case a district court will not err in filtering that element. When, for instance, the plaintiff
provides a list of features it believes to be protectable, he implicitly concedes that elements not
included on the list are unprotectable. See 

(“After submitting a
specification of the elements that it deemed to be protectable, [a plaintiff] cannot now argue that
the district court failed to abstract further the elements of its own designation of protectable
features.”).

                                                 27
             Case: 18-12004     Date Filed: 05/20/2020   Page: 28 of 53



      Accordingly, the magistrate judge here erred by placing on Compulife the

burden of proving protectability. For the reasons we have explained, Compulife

didn’t have to affirmatively prove that the copied portions of its code were

protectable. Rather, the defendants had the burden to demonstrate that the copied

elements were unprotectable. If the magistrate judge believed that the record

contained insufficient evidence to make a conclusive finding about the

protectability of any element, he should have proceeded to the comparison step—

i.e., proceeded to determine substantial similarity—without filtering anything out.

Instead, the judge found for the defendants—seemingly without undertaking any

comparison of the parties’ codes—in effect treating the entirety of Compulife’s

code as unprotectable. That was an error.

      To be sure, some filtration is warranted here. Some elements of

Compulife’s code are unprotectable—and indeed, are so obviously so that no proof

is necessary. For example, in order to calculate insurance quotes, Compulife’s

code has to collect each consumer’s state of residence, and in organizing that

information Compulife has chosen to alphabetize the 50 states and assign each

state a number. Although the decision to order the states in this way may have

originated with Compulife, mere alphabetization is unoriginal and unprotectable.

See 

. As a result, although the defendants copied the




                                         28
                Case: 18-12004       Date Filed: 05/20/2020        Page: 29 of 53



alphabetization, that particular structural element should be filtered out and

excluded when analyzing the similarities between the works. 9

       But the magistrate judge never even reached the filtration issue. Instead,

having placed the burden on Compulife to prove that the copied elements of its

code were protectable—and found its evidence lacking—he gave judgment for the

defendants without ever undertaking a filtration analysis. In so doing, he failed to

make required factual findings and legal conclusions “because of an erroneous

view of the law.” 

. Accordingly, we must vacate and

“remand for further proceedings” to give the district court a chance to make the

missing findings.

attempt a comprehensive filtration analysis from

scratch—“[w]e are, after all, a court of review, not a court of first view.” Callahan

v. United States Dep't of Health & Human Servs. through Alex Azar II, 

, 1266 (11th Cir. 2019). 10

9
  A closer question, however, is whether Compulife’s inclusion of the District of Columbia in the
list of states and the bifurcation of New York into business and non-business categories are
protectable elements of structure. We don’t reach the question, but rather leave all specific
filtering questions for the district court to consider in the first instance on remand.
10
   It is enough to remand for new findings and conclusions rather than an entirely new trial. See,
e.g., Ionmar Compania Naviera, S. A. v. Olin Corp., 

, 905 (Former 5th Cir. 1982)
(Tjoflat, J.); Golf City, Inc. v. Wilson Sporting Goods, Co., 

, 438 & n.20 (5th Cir.
1977). Like the rest of this case, though, the procedural history here is complicated. The
magistrate judge retired just days after issuing his decision and wasn’t available even to consider
Compulife’s motion for a new trial. In his absence, the district court encouraged Compulife to
withdraw the motion and file this appeal, noting that it would take considerable time for a new
magistrate to get sufficiently up to speed on the technical facts of this case to rule on its motion
for a new trial, a suggestion that Compulife seems to have followed. Federal Rule of Civil
Procedure 63 allows one judge to substitute for another in conducting a hearing or trial “upon

                                                29
               Case: 18-12004       Date Filed: 05/20/2020       Page: 30 of 53



                                                2

       Explaining the magistrate judge’s second legal error is more straightforward.

(A low bar.) As we will explain, he implicitly evaluated the significance of the

defendants’ copying vis-à-vis their offending work, rather than Compulife’s

copyrighted work. In so doing, the magistrate judge called his ultimate conclusion

into doubt. The law is clear that both the quantity of the appropriation and the

qualitative importance of the appropriated portion are properly judged by their

significance to the copyrighted work, not their significance to the allegedly

infringing work. As the Supreme Court has said—and as we have reaffirmed—“a

taking may not be excused merely because it is insubstantial with respect to the

infringing work.” Harper & 

(emphasis in original); see also

Peter 

(explaining that “it is the relative portion of the

copyrighted work—not the relative portion of the infringing work—that is the

relevant comparison”).

       The magistrate judge evinced this error in stating that Compulife “provided

no basis on which to evaluate what quantity of the HTML code from the


certifying familiarity with the record and determining that the case may be completed without
prejudice to the parties,” but “[i]n a hearing or a nonjury trial, the successor judge must, at a
party’s request, recall any witness whose testimony is material and disputed and who is available
to testify again without undue burden.” Because the issues are technical and complicated, new
findings will be necessary here, and the parties will likely be entitled to recall many witnesses
should they wish, the substitute judge may be “satisfied that he cannot perform the duties we
have given him.” Golf 

n.20 (5th Cir. 1977). If so, the judge “may in his
discretion grant a new trial.”

18-12004     Date Filed: 05/20/2020   Page: 31 of 53



www.naaip.org agent’s website, which spans twenty-five pages, is copied from

[Compulife’s] 2010 HTML code, which spans just over nine pages.” Compulife

Software, 

, at *39–40. In addition to being wrong as

a matter of fact—the full texts of both codes are in the record, and a side-by-side

comparison reveals the extent of the defendants’ copying—this statement implies a

mistaken view of law. A 25-page work could, of course, reproduce the entirety of

a 9-page work verbatim, even though it also necessarily includes some material not

taken from the shorter work. Seemingly, then, by pointing to the disparity in

lengths here, the magistrate judge meant to suggest that the defendants’ inclusion

of additional material could undercut or even preclude a finding of infringement.

But, under controlling law, adding new material to copied material doesn’t negate

(or even ameliorate) the copying. See Harper & 

. That the

accused work is significantly longer than the copyrighted work is irrelevant

because the substantiality of copying is evaluated only with respect to the

copyrighted work. See Peter 

. The magistrate judge’s

ultimate determination that the works are not substantially similar therefore

implicitly rests on another misunderstanding of law. Remand is necessary to allow

fresh findings, untainted by this error.




                                           31
               Case: 18-12004        Date Filed: 05/20/2020      Page: 32 of 53



                                                3

       Finally—with respect to copyright infringement, anyway—even if the

magistrate judge hadn’t based his determination on the foregoing legal errors, his

analysis was insufficient to permit meaningful appellate review. Rule 52 requires a

district court conducting a bench trial to “find the facts specially and state its

conclusions of law separately” and to include these findings and conclusions on the

record. Fed. R. Civ. P. 52(a)(1). A court’s failure to “to state [findings of fact]

with sufficient detail to indicate the factual basis for [the] ultimate conclusions of

law” requires us to vacate the judgment and remand for a new bench trial because

it renders appellate review “practically impossible.” Ionmar Compania Naviera, S.

A. v. Olin Corp., 

, 903 (Former 5th Cir. 1982) (Tjoflat, J.). 11 Vacatur

and remand are also warranted where the district court fails to reach a sufficiently

important conclusion of law necessary to support its judgment. Gechter v.

Davidson, 

, 1458 (Fed. Cir. 1997) (“The same rule governs when a

conclusion on a crucial issue of law is omitted.”). Rule 52 violations require us to

vacate and remand for new findings and conclusions because “[w]e are . . . a court

of review, not a court of first view.” 

.


11
  Ionmar was decided by a non-unit panel of the Former Fifth Circuit and is therefore binding
on us. See 

n.*; Stein v. Reynolds Sec., Inc., 

, 34 (11th Cir.
1982) (explaining that a decision “made by a non-unit panel of the Former Fifth, the full en banc
court of the Former Fifth, or Unit B panel of the Former Fifth Circuit” is “binding precedent
which we would have to follow absent Eleventh Circuit en banc consideration”).

                                               32
               Case: 18-12004        Date Filed: 05/20/2020        Page: 33 of 53



       To allow meaningful appellate review, a district court must indicate which

elements of the copyrighted work it considers to be unprotectable in more detail

than was given here. The magistrate judge didn’t filter—or even specifically

identify—any protectable or unprotectable elements of Compulife’s copyrighted

code. 12 Nor did he evaluate the importance of any copied elements of that code as

part of a substantial-similarity analysis. Nor, finally, did he even identify, at the

threshold, which elements of Compulife’s code the defendants had copied as a

factual matter. Instead of making these necessary determinations, the magistrate

judge merely stated that Compulife “failed to prove that ‘th[e] elements of the

program that have been copied are protected expression,’” Compulife Software,

, at *38 (quoting 

), that

Compulife had “failed to provide any basis on which to conclude that the copied

portions of the 2010 HTML Source Code . . . are important,”

quotation marks omitted), and that Compulife “provided no basis on which to

evaluate what quantity of the HTML code from the www.naaip.org agent’s

website . . . is copied from [its] 2010 HTML code,”

We can’t


12
  As already noted, which elements should be filtered is a question of law, or at least a mixed
question of law and fact, to be determined by a judge before a factfinder decides whether
copying was substantial. See supra note 7. We would likely review the filtration determination
de novo—based on our case law and because it requires primarily legal work—but we needn’t
definitively settle on a standard of review here. Even if this determination is reviewed for clear
error, the magistrate judge’s failure to make a specific determination frustrates our ability to
meaningfully review the ultimate determination of actionable copying.

                                                33
               Case: 18-12004    Date Filed: 05/20/2020     Page: 34 of 53



effectively review the magistrate judge’s ultimate conclusion—that Compulife

failed to prove its case—without answers to the important prerequisite questions

that he left unaddressed. And we decline to answer such questions as a matter of

“first view.” 

. Accordingly, vacatur and remand are

appropriate.

      It bears noting that the magistrate judge’s reasoning would have been

sufficient if it really were true that, in seeking to demonstrate substantial similarity,

Compulife had provided “no basis” to evaluate either the quantity or the quality of

the defendants’ copying. Although “[t]he burden is on the copyright owner to

demonstrate the significance of the copied features,” 

, and

“both the quantitative and the qualitative significance of the amount copied” must

be assessed, Peter 

, the plaintiff needn’t prove both the

quantitative and qualitative substantiality of copying—it’s enough to prove one or

the other. See

qualitatively important copying may be actionable

even where “the amount of expression copied [is] quantitatively small with respect

to the length” of the copyrighted work). If Compulife had failed in both respects,

that failure would have been fatal. In fact, though, Compulife provided at least

some evidence of both quantitative and qualitative significance.

      To start, Compulife provided the texts of both works, and the court could

easily have analyzed the similarities between them to ascertain the quantitative


                                           34
              Case: 18-12004      Date Filed: 05/20/2020    Page: 35 of 53



extent of copying. So too, the qualitative significance could have been evaluated

solely on the basis of the two texts. Although the copyright owner has the burden

to prove qualitative significance, 

, nothing requires him to

introduce extrinsic evidence of that significance. Qualitative significance is often

apparent on the face of the copied portion of a copyrighted work. See Peter

(inferring the qualitative significance of “the way

[concepts] were ‘selected, coordinated, or arranged’” from statements within the

work itself). Moreover, and in any event, Compulife actually did provide extrinsic

evidence of the qualitative significance of some copied elements. Chris Bruner

testified that part of the code copied by the defendants includes variable names and

parameters that must be formatted exactly for the web quoter to communicate with

the Transformative Database at all. At a minimum, this testimony is some

evidence of the qualitative significance of the copied portion of Compulife’s work.

A district court is free not to credit such testimony, but it can’t ignore it.

      The magistrate judge’s failure to look more closely at the texts of the two

codes is particularly concerning given the similarities apparent on their faces.

Even a cursory comparison of the two segments suggests that the defendants’ work

copied material from nearly every page of the copyrighted work. The defendants’

code includes nine of the eleven basic sections of Compulife’s code, arranged in

almost exactly the same order. The defendants’ code even reproduces


                                            35
             Case: 18-12004     Date Filed: 05/20/2020   Page: 36 of 53



idiosyncratic elements of Compulife’s work, like treating New York as two

separate jurisdictions—one for business and another for non-business—an element

of the code that was obsolete by the time the defendants copied it. Perhaps the

magistrate judge had good reasons to discount these and other similarities, but his

failure to explain himself prevents any meaningful review.

      Accordingly, the magistrate judge’s conclusions that Compulife failed to

present necessary evidence were unwarranted. At the least, the judge should have

engaged with the evidence presented by Compulife and explained why he found it

unconvincing. He then should have explained what elements of Compulife’s work

he had filtered out and why the defendants’ code was not substantially similar to

whatever material survived filtration. The omission of these details from the

magistrate judge’s findings of fact and conclusions of law precludes meaningful

review and requires vacatur and remand.

                                         IV

      And now for something completely different—trade-secret law. To prove a

claim under the Florida Uniform Trade Secrets Act (FUTSA), Compulife “must

demonstrate that (1) it possessed a trade secret and (2) the secret was

misappropriated.” Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 

               Case: 18-12004       Date Filed: 05/20/2020      Page: 37 of 53



1279, 1297 (11th Cir. 2018) (quotation and quotation marks omitted).13 Florida

law defines a trade secret as

       information . . . that: (a) [d]erives independent economic value . . .
       from not being generally known to, and not being readily
       ascertainable by proper means by, other persons who can obtain
       economic value from its disclosure or use; and (b) [i]s the subject of
       efforts that are reasonable under the circumstances to maintain its
       secrecy.

Fla. Stat. § 688.002(4). “[W]hether something is a trade secret is a question

typically ‘resolved by a fact finder after full presentation of evidence from each

side.’” Yellowfin 

–99 (quoting Lear Siegler, Inc. v. Ark-

Ell Springs, Inc., 

, 288–89 (5th Cir. 1978)). The magistrate judge

found that Compulife’s Transformative Database was a trade secret, a finding that

is not clearly erroneous and that, in any event, doesn’t seem to be contested on

appeal. We can therefore move straight to the question of misappropriation.




13
   Compulife also alleges a violation of the Defend Trade Secrets Act (DTSA). DTSA creates a
federal cause of action that largely mirrors FUTSA. See 18 U.S.C. § 1836(b)(1) (“An owner of a
trade secret that is misappropriated may bring a civil action.”). Indeed, DTSA’s definitions of
“misappropriation” and “improper means” are largely identical to those discussed in text, with
one important difference. See 18 U.S.C. § 1839(5), (6). In DTSA, “reverse engineering,
independent derivation, or any other lawful means of acquisition” are expressly exempted from
the definition of “improper means.” 18 U.S.C. § 1839(6)(b). The definition of “trade secret,”
while not identical to FUTSA’s definition, is substantially equivalent. 18 U.S.C. § 1839(3). We
assume, as the parties seem to, that the substantive standard for misappropriation is identical
under FUTSA and DTSA, at least as they apply here. Accordingly, we won’t undertake a
separate analysis of Compulife’s DTSA claim.


                                              37
             Case: 18-12004    Date Filed: 05/20/2020    Page: 38 of 53



      One party can misappropriate another’s trade secret by either acquisition,

disclosure, or use. See Fla. Stat. § 688.002(2). Compulife alleges

misappropriation both by acquisition and by use—but not by improper disclosure.

A person misappropriates a trade secret by acquisition when he acquires it and

“knows or has reason to know that the trade secret was acquired by improper

means.” Id.§ 688.002(2)(a). A person misappropriates a secret by use if he uses it

“without express or implied consent” and either:

      1. Used improper means to acquire knowledge of the trade secret; or

      2. At the time of disclosure or use, knew or had reason to know that
      her or his knowledge of the trade secret was:

            a. Derived from or through a person who had utilized improper
            means to acquire it;

            b. Acquired under circumstances giving rise to a duty to
            maintain its secrecy or limit its use; or

            c. Derived from or through a person who owed a duty to the
            person seeking relief to maintain its secrecy or limit its use; or

      3. Before a material change of her or his position, knew or had reason
      to know that it was a trade secret and that knowledge of it had been
      acquired by accident or mistake.

      The concept of “improper means”—which under FUTSA may apply in both

the acquisition and use contexts—is significant here, so we should pause to unpack

it. As used in FUTSA, “[i]mproper means” is defined to include “theft, bribery,


                                         38
               Case: 18-12004       Date Filed: 05/20/2020      Page: 39 of 53



misrepresentation, breach or inducement of a breach of a duty to maintain secrecy,

or espionage through electronic or other means.”

In the law of

trade secrets more generally, “theft, wiretapping, or even aerial reconnaissance”

can constitute improper means, but “independent invention, accidental disclosure,

or . . . reverse engineering” cannot. Kewanee Oil Co. v. Bicron Corp., 

, 476 (1974).14 Actions may be “improper” for trade-secret purposes even if

not independently unlawful. See E. I. duPont deNemours & Co. v. Christopher,

, 1014 (5th Cir. 1970) (rejecting the argument “that for an

appropriation of trade secrets to be wrongful there must be a trespass, other illegal

conduct, or breach of a confidential relationship”). Moreover, the inadequacy of

measures taken by the trade-secret owner to protect the secret cannot alone render

a means of acquisition proper. So long as the precautions taken were reasonable, it

doesn’t matter that the defendant found a way to circumvent them. Indeed, even if

the trade-secret owner took no measures to protect its secret from a certain type of

reconnaissance, that method may still constitute improper means.

       In one case from the former Fifth Circuit, for example, DuPont claimed that

trade secrets had been misappropriated by photographers who took pictures of its

methanol plant from a plane. See 

. These aerial



14
  The defendants here don’t argue that they reverse-engineered any trade secret, so we needn’t
address the reverse-engineering question.

                                              39
              Case: 18-12004     Date Filed: 05/20/2020    Page: 40 of 53



photographs, DuPont contended, threatened to reveal its secret method of

manufacturing methanol. See

The photographers sought summary

judgment, emphasizing that “they conducted all of their activities in public

airspace, violated no government aviation standard, did not breach any confidential

relation, and did not engage in any fraudulent or illegal conduct.”

The

Fifth Circuit rejected their contention and held that the aerial photography

constituted improper means even though DuPont had left the its facility open to

inspection from the air. See

Under the broad definition adopted in

Christopher, misappropriation occurs whenever a defendant acquires the secret

from its owner “without his permission at a time when he is taking reasonable

precautions to maintain its secrecy.”

   *

      Although the magistrate judge found Compulife’s Transformative Database

to be a trade secret, he determined that the defendants hadn’t misappropriated it.

The magistrate judge’s analysis, however, contains two flaws. First, in both in the

08 case and in the 42 case, he failed to consider the several alternative varieties of

misappropriation contemplated by FUTSA. Second, in the 42 case, he erred in

reasoning that the public availability of quotes on Compulife’s Term4Sale site

automatically precluded a finding that scraping those quotes constituted

misappropriation.


                                            40
                Case: 18-12004        Date Filed: 05/20/2020        Page: 41 of 53



                                                 A

       The magistrate judge rejected the misappropriation-by-use claims in the 08

case because he found that Compulife had “failed to prove the existence of the

duty critical to its claims of trade secret misappropriation through use.” Compulife

Software, 

, at *50. The judge erred in considering

only varieties of misappropriation by use that require a violation of some legal

“duty” external to the statute.15 To be sure, some types of use-misappropriation do

require proof of an external duty under the Florida statute, see Fla. Stat.

§ 688.002(2)(b)2.b., c. Just as surely, though, the same statute describes other

kinds of use-misappropriation that do not depend on the existence of an external

duty. When, for instance, a defendant knows that his knowledge of a trade secret

was acquired using “improper means,” or that he has acquired knowledge of a

trade secret “by accident or mistake” and still uses it, such use is actionable

misappropriation. Fla. Stat. § 688.002(2)(b)1., 2.a., 3. Moreover, while not

defined in the statute, the bar for what counts as “use” of a trade secret is generally

low. See Penalty Kick Mgmt. v. Coca Cola Co., 

, 1292 (11th Cir.

2003) (“[A]ny exploitation of the trade secret that is likely to result in injury to the



15
   Compulife doesn’t concede that it failed to prove a preexisting duty, which it locates in its
licensing agreements. We needn’t address the contractual-duty issue because we vacate the
judgment on other grounds.



                                                 41
             Case: 18-12004     Date Filed: 05/20/2020   Page: 42 of 53



trade secret owner or enrichment to the defendant is a ‘use.’” (quoting Restatement

(Third) of Unfair Competition § 40 cmt. c (1995))). Even assuming that the

defendants had no external “duty” not to use Compulife’s trade secret, they

nonetheless may have used the secret in violation of the statute.

      The magistrate judge never considered these possibilities, although they are

plainly contemplated in the Florida statute. And there was clearly enough evidence

of these other, non-duty-based varieties of use-misappropriation that the magistrate

judge should have discussed them before dismissing them. In the 08 case, the

defendants plausibly engaged in “misrepresentation”—and thus “improper means”

within meaning of the statute—given the way that David Rutstein explained the

defendants’ affiliation with McSweeney and Savage to Compulife’s Jeremiah

Kuhn when Rutstein initially sought access to the Transformative Database. Fla.

Stat. § 688.002(1), (2)(b)1. Alternatively, even if the email exchange between

Rutstein and Kuhn didn’t amount to “improper means,” it could have been

understood as an “accident or mistake” of which the defendants knew or had

reason to know and by which they gained knowledge of the Transformative

Database.

In either case, the defendants’ use would amount to

misappropriation—without respect to the presence (or absence) of any external

duty. The magistrate judge’s failure to consider either possibility requires vacatur

and remand. See 

(explaining that failure “to make a finding


                                         42
              Case: 18-12004     Date Filed: 05/20/2020    Page: 43 of 53



because of an erroneous view of the law” generally requires remand “to permit the

trial court to make the missing findings”).

      The magistrate judge should also have considered misappropriation by use

in the 42 case. The judge seems to have considered only misappropriation by

acquisition as to that case—more on that momentarily—but there was no

justification for truncating the analysis in this way. If the scraping attack

constituted “improper means”—a question that the magistrate judge also failed to

address—it would be difficult to escape the conclusion that the defendants either

(1) used a trade secret of which they had improperly acquired knowledge or

(2) used a trade secret of which they had acquired knowledge from a person whom

they knew or had reason to know had improperly acquired the knowledge. See Fla.

Stat. § 688.002(2)(b)1., 2.a. The defendants admitted both to hiring the hacker and

to observing her take actions consistent with a scraping attack. It’s hard to see how

the defendants didn’t at least “have reason to know” that Natal had acquired

knowledge of a trade secret for them by improper means—if, indeed, the scraping

attack amounted to improper means. The magistrate judge’s failure to consider

this possibility must also be rectified on remand.

                                           B

      In addition to improperly ignoring the possibility of misappropriation by use

in the 42 case, the magistrate judge erred in his treatment of misappropriation by


                                          43
              Case: 18-12004     Date Filed: 05/20/2020    Page: 44 of 53



acquisition. He reasoned—improperly, we conclude—that the Transformative

Database couldn’t have been misappropriated by acquisition in the 42 case because

the individual quotes that Natal scraped were freely available to the public. True,

the quotes’ public availability is important to the first prong of trade-secret

misappropriation—the initial determination whether a protectable secret exists.

Public availability creates a vulnerability, which—if unreasonable—could be

inconsistent with the reasonable precautions requisite to trade-secret protection.

See Fla. Stat.§ 688.002(4)(b). But here the magistrate judge found that the

Transformative Database was a trade secret; he gave judgment for the defendants

because he believed that the public availability of the quotes precluded a finding of

misappropriation. The magistrate judge reasoned that all “claims in the 42 case,

alleging misappropriation of these quotes, necessarily fail” simply because the

individual quotes were available to the public and thus did “not constitute trade

secrets.” Compulife Software, 

, at *45.

      That is incorrect. Even granting that individual quotes themselves are not

entitled to protection as trade secrets, the magistrate judge failed to consider the

important possibility that so much of the Transformative Database was taken—in a

bit-by-bit fashion—that a protected portion of the trade secret was acquired. The

magistrate judge was correct to conclude that the scraped quotes were not

individually protectable trade secrets because each is readily available to the


                                           44
              Case: 18-12004     Date Filed: 05/20/2020     Page: 45 of 53



public—but that doesn’t in and of itself resolve the question whether, in effect, the

database as a whole was misappropriated. Even if quotes aren’t trade secrets,

taking enough of them must amount to misappropriation of the underlying secret at

some point. Otherwise, there would be no substance to trade-secret protections for

“compilations,” which the law clearly provides. See Fla. Stat. § 688.002(4)

(“‘Trade secret’ means information, including a . . . compilation.”); Unistar Corp.

v. Child, 

, 734 (Fla. Dist. Ct. App. 1982) (holding that a “distillation

of” publicly available information was a protectable trade secret). And total, stem-

to-stern appropriation is unnecessary to establish liability; appropriation of a

“substantial portion” is sufficient. Cf. Penalty Kick 

–1293

(“The unauthorized use need not extend to every aspect or feature of the trade

secret; use of any substantial portion of the secret is sufficient to subject the actor

to liability.” (quoting Restatement (Third) of Unfair Competition § 40 cmt. c

(1995))).

      Nor does the fact that the defendants took the quotes from a publicly

accessible site automatically mean that the taking was authorized or otherwise

proper. Although Compulife has plainly given the world implicit permission to

access as many quotes as is humanly possible, a robot can collect more quotes than

any human practicably could. So, while manually accessing quotes from

Compulife’s database is unlikely ever to constitute improper means, using a bot to


                                           45
               Case: 18-12004        Date Filed: 05/20/2020       Page: 46 of 53



collect an otherwise infeasible amount of data may well be—in the same way that

using aerial photography may be improper when a secret is exposed to view from

above. See 

. In the most closely analogous case of

which we are aware, a district court held that hacking a public-facing website with

a bot amounted “improper means.” Physicians Interactive v. Lathian Sys., Inc.,

No. CA 03-1193-A, 

, at *8 (E.D. Va. Dec. 5, 2003) (“There

can be no doubt that the use of a computer software robot to hack into a computer

system and to take or copy proprietary information is an improper means to obtain

a trade secret, and thus is misappropriation under the VUTSA.”). 16 In that case,

the trade-secret owner’s “failure to place a usage restriction on its website” did not

automatically render the hacking proper.

So too, here.

       Consider how broadly the magistrate judge’s reasoning would sweep. Even

if Compulife had implemented a technological limit on how many quotes one

person could obtain, and even if the defendants had taken all the data, rather than a

subset of it, each quote would still be available to the public and therefore not

entitled to protection individually. On the magistrate judge’s logic, Compulife

16
  VUTSA—the Virginia Uniform Trade Secrets Act—is sufficiently similar to FUTSA that
Physicians Interactive provides a persuasive indication that similar hacking would constitute
improper means under FUTSA, as well. Compare Va. Code § 59.1-336 (“‘Improper means’
includes theft, bribery, misrepresentation, use of a computer or computer network without
authority, breach of a duty or inducement of a breach of a duty to maintain secrecy, or espionage
through electronic or other means.”) with Fla. Stat. § 688.002(1) (“‘Improper means’ includes
theft, bribery, misrepresentation, breach or inducement of a breach of a duty to maintain secrecy,
or espionage through electronic or other means.”).

                                                46
                 Case: 18-12004   Date Filed: 05/20/2020   Page: 47 of 53



couldn’t recover even in that circumstance, because even there—in the magistrate

judge’s words—“any member of the public [could] visit the website of a

Compulife customer to obtain a quote” with “no restriction” on the subsequent use

of the quote. Compulife Software, 

, at *45. But

under the plain terms of the governing statute, the defendants would be liable in

this scenario; they would have acquired a compilation of information that

“[d]erives independent economic value . . . from . . . not being readily

ascertainable” and “[i]s the subject of efforts that are reasonable under the

circumstances to maintain its secrecy” by means which plainly amount to

“espionage through electronic . . . means.” Fla. Stat.§ 688.002(1), (4).

      The magistrate judge treated the wrong question as decisive—namely,

whether the quotes taken were individually protectable. He left undecided the truly

determinative questions: (1) whether the block of data that the defendants took was

large enough to constitute appropriation of the Transformative Database itself, and

(2) whether the means they employed were improper. Having found that the

Transformative Database was protectable generally, the magistrate judge was not

free simply to observe that the portions taken were not individually protectable

trade secrets.

      We express no opinion as to whether enough of the Transformative Database

was taken to amount to an acquisition of the trade secret, nor do we opine as to


                                           47
               Case: 18-12004        Date Filed: 05/20/2020       Page: 48 of 53



whether the means were improper such that the acquisition or use of the quotes

could amount to misappropriation. We merely clarify that the simple fact that the

quotes taken were publicly available does not automatically resolve the question in

the defendants’ favor. These issues must be addressed on remand. 17

                                                V

       That concludes the hard part. We turn now to the more straightforward

issues, both of which the magistrate judge got exactly right: false advertising and

Florida’s anti-hacking statute.

                                               A

       To recover for false advertising under the federal Lanham Act, 15 U.S.C.

§ 1051 et seq., Compulife had the burden to prove five elements:

       (1) the ads of the opposing party were false or misleading, (2) the ads
       deceived, or had the capacity to deceive, consumers, (3) the deception
       had a material effect on purchasing decisions, (4) the misrepresented

17
   The magistrate judge rejected the acquisition-based claims in the 08 case because it found that
the nature of the defendants’ access to the Transformative Database couldn’t amount to
acquisition. This question should also be reconsidered on remand, however, because the
magistrate judge’s misunderstanding of the location of the Transformative Database was clear
error and may have played a dispositive role in that determination. The magistrate judge found
that “[e]nd users can access the Transformative Database only through . . . www.term4sale.com.”
Compulife Software, 

, at *6–7. But in so doing, the judge cited to
trial testimony in which Chris Bruner said the opposite. Bruner explained that the internet
“engine is set up to use data files locally to itself” and users therefore can’t normally access
“files on Compulife’s server.” The “internet engine software” accesses “data” put into
Compulife’s “database” when it uses “data files locally to itself.” This indicates the basic fact
that the magistrate judge misunderstood: Compulife provides an encrypted copy of its
Transformative Database to each licensed user as part of its software. Robert Barney even
testified squarely that “[t]he PC version delivers the database.” Indeed, the defendants don’t
appear to contest that point; they acknowledge in their brief that MSCC’s Vam DB sever
contained the Transformative Database.

                                               48
               Case: 18-12004        Date Filed: 05/20/2020       Page: 49 of 53



       product or service affects interstate commerce, and (5) the movant has
       been—or is likely to be—injured as a result of the false advertising.

Johnson & Johnson Vision Care, Inc. v. 1-800 Contacts, Inc., 

, 1247

(11th Cir. 2002). 18

       Compulife bore the burden of proving that the defendants had actually

advertised falsely or misleadingly, and the magistrate judge did not clearly err in

determining that Compulife failed to prove the existence of any false or misleading

advertisement. See Osmose, Inc. v. Viance, LLC, 

, 1309 (11th Cir.

2010) (“Literal falsity is a finding of fact reviewed for clear error.”). As the

magistrate judge observed, Compulife didn’t clearly identify at trial any particular

statement alleged to constitute false advertising. In its proposed findings of fact

and conclusions of law, Compulife asserted that “[e]nticing . . . users” with “quotes

for term life insurance where the source of those quotes is infringing software and



18
   Compulife also asserts false advertising in violation of the Florida Deceptive and Unfair Trade
Practices Act (FDUTPA) and Florida common law, but these aren’t truly distinct allegations.
Compulife admits that “[t]he legal standards for Florida statutory and common law claims of
trademark infringement and unfair competition under . . . [FDUTPA] are the same as those for
federal claims of trademark infringement and unfair competition.” Br. of Appellant at 69
(quoting Rain Bird Corp. v. Taylor, 

, 1267 (N.D. Fla. 2009)). Accordingly,
Compulife has waived any claim under FDUTPA or Florida common law that doesn’t rise or fall
with its Lanham Act claims, and we won’t analyze either separately. See also Crystal Entm’t &
Filmworks, Inc. v. Jurado, 

, 1323 (11th Cir. 2011) (“[T]he legal standards we
apply to [the FDUPTA] claim are the same as those we have applied under section 43(a) of the
Lanham Act.”); Sovereign Military Hospitaller Order of Saint John of Jerusalem of Rhodes & of
Malta v. Fla. Priory of Knights Hospitallers of Sovereign Order of Saint John of Jerusalem,
Knights of Malta, Ecumenical Order, 

, 1296 (11th Cir. 2012) (“The success of . . .
state unfair competition and FDUTPA claims is tied to the federal Lanham Act claims for
infringement and false advertising.”).

                                               49
              Case: 18-12004      Date Filed: 05/20/2020     Page: 50 of 53



stolen trade secrets is . . . unquestionably unfair competition and false advertising.”

The bare fact that the defendants hosted a quote engine on their website without

providing notification that Compulife was the ultimate source of the quotes,

though, doesn’t imply the existence of any advertisement, let alone a false one.

And just because the defendants stipulated that the quote engine was a “key

benefit” doesn’t mean, as Compulife seems to imply, that the defendants made any

particular advertisement regarding that engine, and, again, it certainly doesn’t

imply any misleading advertisement. Although before us Compulife singles out an

advertisement on NAAIP’s website, it didn’t present that ad to the magistrate

judge. Accordingly, it has waived any argument predicated on that ad. See CSX

Transportation, Inc. v. Gen. Mills, Inc., 

, 1336–37 (11th Cir. 2017)

(“[I]f a party hopes to preserve a[n] . . . argument, . . . [it] must first clearly present

it to the district court . . . in such a way as to afford the district court an opportunity

to recognize and rule on it.” (alterations in original)).

       Even if the issue had been properly preserved, we wouldn’t find clear error

here. The language from NAAIP’s website on which Compulife now focuses

likely doesn’t qualify as false advertising under the statute because it has no

capacity to deceive and wasn’t material to any purchasing decision. See 1-800

Contacts, 

. Compulife claims that the defendants advertised

their quote engine as a “key benefit” on their website, but the contents of this


                                            50
              Case: 18-12004     Date Filed: 05/20/2020    Page: 51 of 53



advertisement aren’t so clear in the record. The defendants stipulated before the

magistrate judge that the quote engine was a key benefit of their site, not that they

had advertised it as such. And while David Rutstein testified that NAAIP

“advertises that it has a quote engine” on its home page, he refused to say that it

was advertised as “a great quote engine” or that it was “an important selling point.”

If credited, Rutstein’s testimony would indicate that the web advertisement lacked

materiality and the “capacity to deceive” consumers. 1-800 Contacts, 

Compulife insists that the ad was deceiving because it held out

Compulife’s technology as NAAIP’s, but merely claiming to have a quote engine

is unlikely to mislead anyone into assuming anything about the ultimate source of

the software or the quotes that it generates. Moreover, even if consumers were

misled, it is still difficult to see why that deception would have “had a material

effect on purchasing decisions.”

good reason to care about

the quality of the quote engine, but not the identity of its author or the host of the

server with which it communicates.

      We find no error—much less clear error—in the magistrate judge’s

determination that Compulife failed to prove false advertising. To make its case,

Compulife needed to identify a particular statement or set of statements that

amount to a false advertisement, which it failed to do. And Compulife’s belated




                                           51
              Case: 18-12004    Date Filed: 05/20/2020    Page: 52 of 53



argument before this Court is both unpreserved and unconvincing. We affirm as to

this issue.

                                          B

       At long last, we reach the final issue in this appeal—the Florida Computer

Abuse and Data Recovery Act, which provides a cause of action for certain kinds

of hacking. As relevant here, it states: “A person who knowingly and with intent

to cause harm or loss . . . [o]btains information from a protected computer without

authorization . . . [or] [c]auses the transmission of a program, code, or command to

a protected computer without authorization . . . caus[ing] harm or loss . . . is

liable to. . . the owner of information stored in the protected computer.” Fla. Stat.

§ 668.803(1) & (2) (emphasis added). A “protected computer” is one that “can be

accessed only by employing a technological access barrier.” Fla. Stat.

§ 668.802(6).

       Compulife doesn’t attempt to argue that the defendants penetrated a

“technological access barrier.” Instead, Compulife maintains that this showing

was unnecessary because it did not allege a violation of Fla. Stat. § 668.803(3)—

which imposes liability for “[t]raffic[king] in any technological access barrier

through which access to a protected computer may be obtained without

authorization”—but only of § 668.803(1) & (2). On this point, Compulife simply

misreads the law, overlooking the fact that a “protected computer”—as used in


                                          52
             Case: 18-12004      Date Filed: 05/20/2020   Page: 53 of 53



subsections (1) & (2)—is statutorily defined as one that can be accessed only “by

employing a technological access barrier.” Fla. Stat. § 668.802(6). All CADRA

violations—not just those arising under § 668.803(3)—therefore require proof of

access through a “technological access barrier.” Compulife’s undisputed failure to

prove the presence of a “technological access barrier” is fatal to its claim. We

affirm as to CADRA.

                                         VI

      The magistrate judge committed errors of law and made insufficient

findings, which tainted his conclusion that Compulife’s copyright was not

infringed. He also erred in his analysis of trade-secret misappropriation, both by

failing to consider the application of several species of misappropriation and by

committing legal error. Accordingly, we vacate the judgment as to copyright

infringement and trade-secret misappropriation and remand for new findings of

fact and conclusions of law. We find no reversible error in the magistrate judge’s

rejection of Compulife’s other claims and affirm the remainder of the judgment.

      AFFIRMED in part, VACATED in part, and REMANDED for new

findings of fact and conclusions of law on the claims of copyright infringement and

trade-secret misappropriation.




                                          53