ANITA B. BRODY, District Judge.
Plaintiff Arkeyo, LLC ("Arkeyo") brings state law claims against Defendant Cummins Allison Corporation ("Cummins") for breach of contract, misappropriation of trade secrets, conversion, and tortious interference.
Currently before me is Arkeyo's motion for a preliminary injunction. Arkeyo alleges that Cummins misappropriated its trade secret software. Arkeyo moves solely on the basis of its misappropriation of trade
During the course of discovery, Cummins informed the Court that Arkeyo's purported trade secret software had been posted on Arkeyo's website on the internet. Cummins now contends that Arkeyo has no protectable trade secret because of its publication of the Arkeyo software on the Internet. On May 2 and 3, 2017, I held an evidentiary hearing to address Arkeyo's motion for a preliminary injunction that was limited to whether Arkeyo can establish a likelihood of success on its claim that Cummins violated the Illinois Trade Secrets Act.
For the reasons set forth below, after consideration of the testimony from the witnesses, the documentary evidence, and the relevant law, I will deny Arkeyo's motion for a preliminary injunction.
At the evidentiary hearing, Cummins presented three witnesses: (1) Expert Dan Schonfeld; (2) Expert Peter Fry; and (3) Cummins engineer Kevin Carrera.
On January 4, 2016, Arkeyo emailed Cummins to inform Cummins that it had posted the Arkeyo software, known as the "Metro Bank UK 2.15 software," on its website on the internet. The Arkeyo software remained posted on Arkeyo's website for the next fifteen months. The software was available at the URL: http://arkeyo.com/new_software/. URL stands for Uniform Resource Locator. As explained by the Third Circuit, "the domain name portion of the URL — everything before the `.com' — instructs a centralized web server to direct the user to a particular website, but post-domain name portions of the URL are designed to communicate to the visited website which webpage content to send the user." In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125, 139 (3d Cir. 2015). Accordingly, the "arkeyo" portion of the URL: http://arkeyo.com/new_software/instructed a centralized web server to direct the user to Arkeyo's website and the "new_software" portion of the URL informed Arkeyo's website to display the webpage that contained the new software.
When a person visited the URL: http://arkeyo.com/new_software/, the following text would appear: "click to download Metro Bank UK 2.15 software." When a user clicked on the text, a zip file
Some of the Arkeyo software that could be downloaded from the zip file appeared as source code. However, much of the Arkeyo software that could be downloaded from the zip file appeared as executable code. Source code is the human readable form of software — it is comprised of human words that are written in a programming language. Whereas executable code is the form of software that can be understood by a computer — it is comprised of zeros and ones. Compilation is the process of taking the human readable source code and translating it into executable code. Decompilation is the process of taking executable code and translating it back into human readable source code.
The Arkeyo software that was available in executable code could easily be decompiled and translated back to source code by using a decompiler such as "Dot Peek." Dot Peek is available on the internet to anyone to download for free. By using a decompiler such as Dot Peek to decompile Arkeyo's executable code, any user could obtain the full functional equivalent of the Arkeyo source code.
Arkeyo identified ten areas of software functionality in its source code that it claimed were trade secrets.
In order to use the Arkeyo software on a computer, a long sequence of installation steps had to be followed. One of the key installation steps was changing the administrator
In addition to needing the installation instructions, a person who wanted to install the Arkeyo software also needed the base operating software referred to by Arkeyo as version 2.8.1. Thus, the Arkeyo software could not properly be installed and would not work if a computer did not already have the base operating software installed. The zip file, however, contained a piece of software called "Arkeyo Updater," that would install base operating software version 2.8 onto the computer and enable a user to then properly install the Arkeyo software. Arkeyo version 2.8 is an earlier version of the base operating software 2.8.1. No discernible differences that would impact the functionality of the Arkeyo software have been identified between these two versions of the base operating software.
The Arkeyo software on the Arkeyo website was a full set of software that could be installed and used immediately in MM2 Machines. All of Arkeyo's source code was readily available from the zip file, which also included the required base operating software and instructions for installing the Arkeyo software.
When Arkeyo placed its full set of software on its website, and made it readily available for download onto any computer, it did not take the standard precautions in the industry to protect the confidentiality of its source code.
In deciding whether to grant a preliminary injunction, a district court should balance the following four factors so long as the moving party meets the requisite showing on the first two: (1) the movant has shown a likelihood of success on the merits; (2) the movant will suffer irreparable harm in the absence of a preliminary injunction; (3) the possibility of harm to other interested persons from a grant or denial of the injunction; and (4) the public interest. Reilly v. City of Harrisburg, 858 F.3d 173, 176 (3d Cir. 2017). Accordingly,
Id. at 179 (footnotes omitted).
Arkeyo cannot prevail on its motion for preliminary injunction because it cannot meet the threshold requirement of a demonstration of likelihood of success on the merits under the Illinois Trade Secrets Act ("ITSA"), 765 Ill. Comp. Stat. Ann. 1065/1 et seq. "To prevail on a claim for misappropriation of a trade secret under the Act, the plaintiff must demonstrate that the information at issue was a trade secret, that it was misappropriated and that it was used in the defendant's business." Learning Curve Toys, Inc. v. PlayWood Toys, Inc., 342 F.3d 714, 721 (7th Cir. 2003). Under the ITSA, a trade secret means:
765 Ill. Comp. Stat. Ann. 1065/2(d). These two requirements for a trade secret focus on different aspects of secrecy:
Learning Curve, 342 F.3d at 722 (citation omitted). In determining whether a trade secret exists, "the most important [consideration] is whether and how an employer acts to keep the information secret." Alpha Sch. Bus Co. v. Wagner, 391 Ill.App.3d 722, 331 Ill.Dec. 378, 910 N.E.2d 1134, 1152 (2009). A court need not reach the first requirement — whether a purported trade secret derives economic value from not being generally known — if the plaintiff has not met the second requirement because it failed to take reasonable measures to maintain secrecy. Seng-Tiong Ho v. Taflove, 648 F.3d 489, 504-05 (7th Cir. 2011) (declining to decide whether the purported trade secret had economic value because the plaintiffs had not taken reasonable steps to maintain secrecy and thus could not succeed on the ITSA claim).
In order to meet the second requirement, a plaintiff must take "affirmative measures to prevent others from using its proprietary information." Glob. Material Techs., Inc. v. Dazheng Metal Fibre Co., No. 12-1851, 2016 WL 4765689, at *10 (N.D. Ill. Sept. 13, 2016). While the ITSA requires that a plaintiff take reasonable measures under the circumstances to maintain the secrecy of a purported trade secret, "it does not require perfection." Learning Curve, 342 F.3d at 725. Considerations of "the size and sophistication of the parties, as well as the relevant industry"
Cummins contends that Arkeyo's decision to make its software publicly available on the internet for fifteen months without taking standard precautions to protect its confidentiality demonstrates that it did not take reasonable steps to protect its trade secrets. Arkeyo counters that it did not make its software publicly available on the internet, and that even if it did so, it took reasonable efforts to protect its trade secrets.
Because the zip file contained mostly executable code and not human readable source code, Arkeyo claims that it did not publicly disclose its trade secret software on the internet. Arkeyo's executable code, however, could be translated into source code through the relatively simple process of decompilation — a process as simple as translating French into English. Arkeyo's contention that its software was not publicly available because it only appeared on the internet in executable code and not in source code is unjustifiable. It is no different than arguing that a trade secret posted on the internet in French would not be publicly available to an English speaker because it would require translation. Arkeyo misses the point when it argues that its trade secret software was not publicly available because it was immediately understood by computers and not by people. The Arkeyo software was immediately ready to install and download onto any computer, and could be used in any MM2 Machine without modification, precisely because it was available in executable code on the zip file.
Arkeyo also claims that its source code was not publicly available because the URL: http://arkeyo.com/new_software/ was not linked to the main Arkeyo website and would not appear on any internet search engines. Although the URL was unlisted, Arkeyo named the URL "new_software," which described exactly what was posted at that internet address. The URL was guessable to anyone who wanted to access the zip file because Arkeyo did not take the basic precaution of giving the URL a random name, and the website was publicly available to anyone who typed the URL into the address bar. The evidence refutes Arkeyo's contention that it did not make its trade secrets publicly available on the internet.
Alternatively, Arkeyo argues that even if its software was on the internet, it took reasonable measures to protect its secrecy, and that its publication on the internet does not destroy the software's trade secret status. Arkeyo argues that regardless of publication, its software was protected because the zip file did not contain the installation instructions or the base operating software necessary to deploy the Arkeyo software and therefore, the source code could not be used by a
Arkeyo also points to its non-disclosure agreements with Cummins and Metro Bank as evidence that it took reasonable measures to protect its trade secrets. "Although a confidentiality agreement is a factor to consider, it is not the only factor." Arcor, Inc. v. Haas, 363 Ill.App.3d 396, 299 Ill.Dec. 526, 842 N.E.2d 265, 271 (2005). These agreements became ineffectual once Arkeyo published its trade secrets on the internet because Arkeyo made its software publicly available to individuals who owed no duty of non-disclosure to Arkeyo. Arcor, 299 Ill.Dec. 526, 842 N.E.2d at 271 (holding that the plaintiff did not take reasonable steps to keep customer information secret and it did not qualify as a trade secret where plaintiff had employees sign a confidentiality agreement, but did not "take[ ] additional measures such as limiting access to its customer information by computer password or keeping track of the hard copies of the information").
Arkeyo published a full set of its software on the internet without employing any of the industry standard protections for its source code — it did not use encryption, password protection, code obfuscation, confidentiality provisions, or require users to abide by any terms of use for its software.
In Harleysville Insurance Company v. Holding Funeral Home, Inc., the district court addressed whether the plaintiff had waived attorney-client privilege with regard to information it had posted for six months on an internet-based electronic file sharing service referred to as Box Site. 2017 WL 1041600, at *1 (W.D. Va. Feb. 9, 2017). The information was not password protected and "any person who had access to the internet could have accessed the Box Site by simply typing in the url address in a web browser." Id. at *1. The district court concluded that the plaintiff had not taken any precautions to prevent disclosure of the information and held that the plaintiff had waived attorney-client privilege. Id. at *4-5. In reaching this decision, the district court reasoned:
Id. at *5.
Similar to the plaintiff in Harleysville, Arkeyo committed the cyber equivalent of leaving its software on a park bench. It posted its software for fifteen months on the internet and made it publicly available to anyone who simply typed the "new_software" URL into a web browser, without taking any affirmative measures to prevent others from using its proprietary information. As the Ninth Circuit has explained:
Oja v. U.S. Army Corps of Engineers, 440 F.3d 1122, 1131 (9th Cir. 2006) (footnotes omitted). The posting of materials on the internet without any confidentiality protections makes the information publicly available and renders the materials incapable of trade secret status. See Delaware Cty. Chamber of Commerce v. USI Ins. Servs., LLC, No. 12-2280, 2013 WL 6847001, at *11 (E.D. Pa. Dec. 30, 2013) (holding that a member list was not a trade secret because it was publicly available on the internet and in a membership directory); Am. Hearing Aid Assocs., Inc. v. GN Resound N. Am., 309 F.Supp.2d 694, 706 (E.D. Pa. 2004) (holding that materials readily available on the plaintiff's website were available to the public and did not qualify as trade secrets). Arkeyo published its software on the internet without taking any reasonable measures to protect its confidentiality. Because Arkeyo publicly disclosed its software, it is not a trade secret. See Ruckelshaus, 467 U.S. at 1002, 104 S.Ct. 2862; Kewanee, 416 U.S. at 484, 94 S.Ct. 1879. Therefore, Arkeyo is not likely to succeed on its claim that Cummins violated the ITSA.
For the reasons set forth above, I will deny Arkeyo's motion for a preliminary injunction because Arkeyo has not demonstrated a likelihood of success on the merits of its ITSA claim.
Rule 37(c) provides: "If a party fails to provide information or identify a witness as required by Rule 26(a) or (e), the party is not allowed to use that information or witness to supply evidence on a motion, at a hearing, or at a trial, unless the failure was substantially justified or is harmless." Fed. R. Civ. P. 37(c)(1). In determining whether to exclude testimony for failure to comply with discovery requirements, a court considers four factors:
Nicholas v. Pa. State Univ., 227 F.3d 133, 148 (3d Cir. 2000).
On April 25, 2017, the parties exchanged responses to discovery requests, and Cummins disclosed to Arkeyo that its expert witnesses would testify regarding eight listed topics. On April 29, 2017, the parties exchanged initial witness and exhibit lists, and summaries of their intended expert testimony. Arkeyo provided Cummins with a thirteen page summary of its intended expert testimony; whereas Cummins again referred to the list of eight topics its experts intended to cover. The parties agreed to exchange demonstrative exhibits one day before the hearing. Accordingly, on May 1, 2017, Cummins provided Arkeyo with a copy of the demonstrative slides that it intended to present in Court.
Arkeyo objects to the last minute receipt of the demonstrative slides, and claims that the slide deck contained expert opinion that was not previously disclosed. The parties agreed, however, not to exchange demonstrative exhibits until the day before the hearing. Although Cummins provided Arkeyo with only a terse summary of its intended expert testimony, the slides addressed the eight topics that Cummins had previously informed Arkeyo would be the subject of its expert testimony. There is no evidence that Cummins failed to comply with any discovery requirements. Regardless, even if Cummins disregarded a disclosure obligation when it failed to provide a more comprehensive expert summary to Arkeyo, consideration of the factors detailed in Nicholas weigh against exclusion of Cummins' expert testimony. There is no evidence that Cummins acted in bad faith and Arkeyo suffered little to no prejudice because it received the list of expert topics in advance.
"Spoliation occurs where: the evidence was in the party's control; the evidence is relevant to the claims or defenses in the case; there has been actual suppression or withholding of evidence; and, the duty to preserve the evidence was reasonably foreseeable to the party." Bull v. United Parcel Serv., Inc., 665 F.3d 68, 73 (3d Cir. 2012). Additionally, "a finding of bad faith is pivotal to a spoliation determination." Id. at 79.
Daniel Taylor, the President of Arkeyo, removed the URL from the Arkeyo website to protect the materials on the zip file because he noticed a sudden increase in traffic to the website that he was concerned might be driven by nefarious motives to steal the Arkeyo software or hack into the website. When he removed the URL and placed the zip file from the referenced webpage into a password protected folder on the Arkeyo server, he did not intend to destroy any evidence because he knew Cummins already had downloaded a copy of the zip file from the internet. Taylor never received a document hold notice that informed him of his duty to preserve documents and no one ever informed him of his obligation to preserve documents. Arkeyo did not spoliate evidence because Taylor did not act in bad faith when he removed the URL: http://arkeyo.com/new_software/and placed the zip file from the referenced webpage into a password protected folder on the Arkeyo server.
