The opinion
FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
ORACLE INTERNATIONAL No. 23-16038
CORPORATION; ORACLE
AMERICA, INC., D.C. No.
2:14-cv-01699-
Plaintiffs-counter- MMD-DJA
defendants-Appellees,
v. OPINION
RIMINI STREET, INC.; SETH
RAVIN,
Defendants-counter-
claimants-Appellants.
Appeal from the United States District Court
for the District of Nevada
Miranda M. Du, Chief District Judge, Presiding
Argued and Submitted June 5, 2024
San Francisco, California
Filed December 16, 2024
Before: Jay S. Bybee and Patrick J. Bumatay, Circuit
Judges, and Richard D. Bennett, * District Judge.
*
The Honorable Richard D. Bennett, United States District Judge for the
District of Maryland, sitting by designation.
2 ORACLE INT’L CORP. V. RIMINI ST., INC.
Opinion by Judge Bumatay;
Partial Dissent by Judge Bybee
SUMMARY **
Copyright Law
In an action brought by software developer Oracle
International Corporation against Rimini Street, Inc., under
the Copyright Act and the Lanham Act, the panel vacated in
part the district court’s permanent injunction against Rimini,
a third-party provider and direct competitor with Oracle in
the software support services market.
After the district court found that Rimini infringed on
Oracle’s copyrights, Rimini changed aspects of its business
model and sought a declaratory judgment that its revised
process did not infringe Oracle’s copyrights. Oracle
counterclaimed for copyright infringement and violations of
the Lanham Act. Following a bench trial, the district court
entered a permanent injunction ordering Rimini to (1) delete
various software files, and (2) issue a press release
correcting alleged misstatements and prohibiting Rimini
from making similar statements about its services again.
The panel vacated the district court’s holding that Rimini
created infringing derivative works based solely on Rimini’s
programs’ interoperability with Oracle’s programs. The
panel explained that a derivative work must actually
**
This summary constitutes no part of the opinion of the court. It has
been prepared by court staff for the convenience of the reader.
ORACLE INT’L CORP. V. RIMINI ST., INC. 3
incorporate Oracle’s copyrighted work, either literally or
nonliterally. The panel instructed that if the district court
concludes on remand that Rimini created an infringing
derivative work under the correct legal standard, the district
court should then consider whether any of Oracle’s licensing
agreements authorized the creation of the specific work.
The panel vacated the district court’s ruling striking
Rimini’s affirmative defense to copyright infringement
under 17 U.S.C. § 117(a), which allows the owner of a copy
of a computer program to make another copy for certain
purposes, such as when it’s an essential step in using the
program. The panel explained that the district court’s ruling
seemingly relied only on the labeling of the agreements
between Oracle and its customers as a “license,” but that is
only one facet of a number of incidents of ownership.
The panel vacated the district court’s ruling that Rimini’s
creation of 18 “gap customer” environments on its systems
containing Oracle’s Database program infringed Oracle’s
copyright, because the plain language of the licensing
agreement did not prohibit third-party support providers
from possessing a copy of Oracle’s software to further a
client’s internal business operations.
The panel vacated the district court’s ruling that Rimini’s
use of automated tools to deliver PeopleSoft program
updates from one client to another constituted copyright
infringement, to the extent that conclusion rested on the
district court’s erroneous view of “derivative work.” The
panel also vacated the district court’s ruling that the outright
delivery of PeopleSoft updates to clients without further
testing in the clients’ environments constituted copyright
infringement, for the same reason. The panel instructed the
4 ORACLE INT’L CORP. V. RIMINI ST., INC.
district court to apply the correct legal standard for
“derivative work” on remand.
The panel reversed the district court’s ruling that
Rimini’s security-related statements constitute false
advertising under the Lanham Act, except for a statement
about “holistic security.” Some of the statements were about
the relative security of services offered by Oracle and
Rimini, which the panel held were puffery. Some of the
statements were about the need for software patching, which
the panel could not say were so specific and measurable as
to become actionable under the Lanham Act. However, the
panel affirmed the district court’s unrefuted finding that
Rimini’s offer of holistic security, which the panel accepted
to mean multi-layered security protection, was false because
Rimini does not offer multi-level security. The panel vacated
the injunction as it pertains to the non-actionable statements.
Because the panel vacated much of the district court’s
ruling, the panel also vacated the portions of the injunction
appealed by Rimini, and denied Rimini’s motion to stay
enforcement of the permanent injunction as moot.
Dissenting in part, Judge Bybee disagreed with the
majority’s conclusion that one of Rimini’s statements—
“Oracle’s [Critical Patch Updates] provide little or no value
to customers and are no longer relevant”—is puffery. Judge
Bybee explained that the phrases “little or no value” and “no
longer relevant” are absolute characteristics that can be
falsified, as opposed to generalized statements of
comparison. He would affirm the district court’s finding that
this statement is actionable.
ORACLE INT’L CORP. V. RIMINI ST., INC. 5
COUNSEL
Raechel K. Kummer (argued) and David B. Salmons,
Morgan Lewis & Bockius LLP, Washington, D.C.; Zachary
Hill, Lindsey M. Shinn, and Benjamin P. Smith, Morgan
Lewis & Bockius LLP, San Francisco, California; Corey R.
Houmand, Morgan Lewis & Bockius LLP, Palo Alto,
California; Dorian E. Daley, Oracle Corporation, Redwood
City, California; Karen L. Dunn and William A. Isaacson,
Paul Weiss Rifkind Wharton & Garrison LLP, Washington,
D.C.; Richard J. Pocker, Boies Schiller & Flexner LLP, Las
Vegas, Nevada; for Plaintiffs-counter-defendants-
Appellees.
Mark A. Perry (argued), Weil Gotshal & Manges LLP,
Washington, D.C.; Jeremy M. Christiansen, Gibson Dunn &
Crutcher LLP, Washington, D.C.; Blaine H. Evanson and
Jeffrey T. Thomas, Gibson Dunn & Crutcher LLP, Irvine,
California; Joseph A. Gorman, Gibson Dunn & Crutcher
LLP, San Francisco, California; Samuel G. Liversidge,
Casey J. McCracken, Ilissa S. Samplin, and Eric D.
Vandevelde, Gibson Dunn & Crutcher LLP, Los Angeles,
California; Defendants-counter-claimants-Appellants.
Corynne McSherry, Electronic Frontier Foundation, San
Francisco, California, for Amici Curiae Electronic Frontier
Foundation, Computer & Communications Industry
Association, Foundation for American Innovation, Public
Knowledge, Engine Advocacy, Mozilla Corporation, U.S.
PIRG Education Fund, Digital Right to Repair Coalition,
iFixit, and Creative Commons.
Philip H. Cohen, Greenberg Traurig LLP, New York, New
York, for Amici Curiae Glynn S. Lunney, Jr. and Betsy
Rosenblatt.
6 ORACLE INT’L CORP. V. RIMINI ST., INC.
OPINION
BUMATAY, Circuit Judge:
For over a decade, Oracle International Corporation and
Rimini Street, Inc., have waged a pitched copyright war.
This dispute has been fought up and down all levels of the
federal judiciary. This appeal is the latest battle.
At issue is Rimini’s ability to service its clients who use
Oracle’s software programs. Past rulings have determined
that Rimini’s processes infringe on Oracle’s copyrights—at
least in part. Those rulings ordered Rimini to halt this
infringement. In response, Rimini developed new processes
for servicing its Oracle-using clients. After a bench trial, the
district court ruled that many of these new processes still
infringe Oracle’s copyrights and issued a permanent
injunction against Rimini’s infringement.
On appeal, Rimini raises a host of issues. It claims that
the district court erred by (1) applying the wrong definition
of “derivative work” under 17 U.S.C. § 101; (2) striking
Rimini’s affirmative defense under 17 U.S.C. § 117(a);
(3) incorrectly construing licenses for two Oracle software
programs; (4) misapplying the Lanham Act to its security-
related statements; and (5) ordering an impermissibly
overbroad injunction.
We vacate in part, reverse in part, and remand for further
proceedings consistent with this opinion.
I.
Background
Oracle develops software programs for businesses and
other organizations. These programs help manage day-to-
ORACLE INT’L CORP. V. RIMINI ST., INC. 7
day business functions—things like financials, human
resources, procurement, project and risk management, and
supply chain operations. One of Oracle’s products is
PeopleSoft. PeopleSoft is a flexible tool; it can be
customized to manage all sorts of business processes. Some
use it to manage HR processes, like timekeeping, benefits
administration, and recruitment. Others use it to manage
financial processes, like expense tracking and payroll. Some
use it for both and more. Oracle also provides optional
software support for PeopleSoft. For those using its support
services, Oracle provides PeopleSoft updates to reflect
changes to tax laws and other regulations. But customers
need not use Oracle’s support program to stay up-to-date;
customers can also modify and customize the software
themselves or through third-party providers.
Rimini Street is a third-party provider and direct
competitor with Oracle in the support-services market. It
offers various products, including troubleshooting support
and software updates. When troubleshooting Oracle
programs or creating updates for its clients, Rimini uses
Oracle’s products and creates files that only work with
Oracle’s products.
Oracle first sued Rimini for copyright infringement in
2010. Rimini was found to have infringed Oracle’s
copyrights in its PeopleSoft, Database, and other programs
by engaging in “cross-use” and creating copies of Oracle’s
materials on Rimini’s computer systems. The district court
entered a permanent injunction against Rimini, which we
largely affirmed. See Oracle USA, Inc. v. Rimini St., Inc.,
879 F.3d 948 (9th Cir. 2018); Oracle USA, Inc. v. Rimini St.,
Inc., 783 F. App’x 707 (9th Cir. 2019). The district court
later found that Rimini violated the injunction and held it in
contempt on five issues, four of which we upheld on appeal.
8 ORACLE INT’L CORP. V. RIMINI ST., INC.
Oracle USA, Inc. v. Rimini St., Inc., 81 F.4th 843 (9th Cir.
2023).
After the finding of infringement, Rimini changed
aspects of its business model and sought declaratory
judgment that its revised process, called “Process 2.0,” did
not infringe Oracle’s copyrights. Oracle counterclaimed for
copyright infringement and violations of the Lanham Act,
seeking more than one billion dollars in damages.
At the pleadings stage, the district court struck Rimini’s
affirmative defense to copyright infringement under
§ 117(a). At summary judgment, the district court held that
Rimini had infringed Oracle’s PeopleSoft copyrights by
engaging in cross-use prohibited by PeopleSoft license
agreements. Rimini St., Inc. v. Oracle Int’l Corp., 473 F.
Supp. 3d 1158, 1181–213 (D. Nev. 2020). The district court
also held that the update created for the City of Eugene’s
PeopleSoft software environment was a “derivative work.”
Id. at 1209–12.
After Oracle abandoned its claims for monetary relief on
the eve of trial, the case proceeded to a bench trial solely on
declaratory and equitable relief. The district court ruled that
Rimini (1) created infringing derivative works, (2) violated
Oracle’s PeopleSoft and Database licensing agreements, and
(3) made several statements violating the Lanham Act. See
Oracle Int’l Corp. v. Rimini St., Inc., No. 2:14-cv-1699, 2023
WL 4706127, at *1 (D. Nev. July 24, 2023). The district
court then entered a permanent injunction against Rimini,
ordering it to delete various software files. The district court
also ordered Rimini to issue a press release correcting the
alleged misstatements and prohibited Rimini from making
similar statements about its services again.
ORACLE INT’L CORP. V. RIMINI ST., INC. 9
Rimini moved to stay the enforcement of the permanent
injunction pending appeal. The district court denied that
motion. Oracle Int’l Corp. v. Rimini St., Inc., No. 2:14-cv-
1699, 2023 WL 5221947, at *6 (D. Nev. Aug. 15, 2023). It
granted, however, a temporary administrative stay to allow
this court to consider the stay factors. Id. at *5–6. Rimini
also moved to stay the permanent injunction in this court.
That motion remains pending.
Our review of legal questions and contract interpretation
is de novo. Desire, LLC v. Manna Textiles, Inc., 986 F.3d
1253, 1259 (9th Cir. 2021); MDY Indus., LLC v. Blizzard
Ent., Inc., 629 F.3d 928, 937–38, 955 (9th Cir. 2010). We
review factual findings underlying an injunction for clear
error, and the grant of a permanent injunction and its scope
for abuse of discretion. Columbia Pictures Indus., Inc. v.
Fung, 710 F.3d 1020, 1030 (9th Cir. 2013). Oracle bears the
burden of proving copyright infringement. Petrella v.
Metro-Goldwyn-Mayer, Inc., 572 U.S. 663, 683 (2014).
II.
A.
Derivative Works
A copyright owner has the exclusive right to prohibit or
authorize the preparation of derivative works. 17 U.S.C.
§ 106(2). The district court held Rimini-written files and
updates developed during the “Process 2.0” period were
infringing derivative works because they “only interact[] and
[are] useable with” Oracle software. Oracle Int’l Corp.,
2023 WL 4706127, at *66. In effect, the district court
adopted an “interoperability” test for derivative works—if a
product can only interoperate with a preexisting copyrighted
work, then it must be derivative. But neither the text of the
10 ORACLE INT’L CORP. V. RIMINI ST., INC.
Copyright Act nor our precedent supports this
interoperability test for derivative works.
The Copyright Act defines a “derivative work” as:
a work based upon one or more preexisting
works, such as a translation, musical
arrangement, dramatization, fictionalization,
motion picture version, sound recording, art
reproduction, abridgment, condensation, or
any other form in which a work may be
recast, transformed, or adapted.
17 U.S.C. § 101.
While the Copyright Act uses broad language to describe
derivative works, there are limits to its scope. After all,
almost every work “borrows and must necessarily borrow”
from other works and uses what was “well known and used
before.” Micro Star v. Formgen Inc., 154 F.3d 1107, 1110
(9th Cir. 1998); see also 1 Nimmer on Copyright § 3.01
(2024) (“In a broad sense, almost all works are derivative
works in that in some degree they are derived from pre-
existing works.”). So focusing only on whether a work is
“based upon” a preexisting work would make the derivative-
works definition “hopelessly overbroad.” Micro Star, 154
F.3d at 1110.
Luckily, Congress provided several textual clues limiting
its definition. First, Congress gave examples of work “based
upon” preexisting work—things “such as” translations,
movie adaptations, and reproductions. 17 U.S.C. § 101.
And so “derivative work” must have a meaning related to
those examples. While the term “such as” means the list of
examples isn’t exhaustive, Congress provides the kind of
ORACLE INT’L CORP. V. RIMINI ST., INC. 11
works that fall into the derivative-work category. See Easom
v. US Well Servs., Inc., 37 F.4th 238, 243 (5th Cir. 2022)
(holding that a statute listing examples “such as” “floods,
earthquakes, and droughts” limited the term “natural
disaster” to disasters of the “same kind”). So to be “based
upon” another work requires copying of the kind exhibited
in translations, movie adaptations, and reproductions. Mere
interoperability isn’t enough.
Next, we have the canon of noscitur a sociis, which
means we define a term by “the company it keeps.” Yates v.
United States, 574 U.S. 528, 543 (2015). We use this canon
when “a word is capable of many meanings in order to avoid
the giving of unintended breadth to the Acts of Congress.”
Dubin v. United States, 599 U.S. 110, 124–25 (2023)
(simplified). The effect of the canon is to “limit a general
term to a subset of all the things or actions that it covers.”
Antonin Scalia & Bryan A. Garner, Reading Law: The
Interpretation of Legal Texts 196 (2012). So when “several
items in a list share an attribute,” it favors “interpreting the
other items as possessing that attribute as well.” Beecham v.
United States, 511 U.S. 368, 371 (1994).
Here, “[t]he examples of derivative works provided by
the Act all physically incorporate the underlying work or
works.” Lewis Galoob Toys, Inc. v. Nintendo of Am., Inc.,
964 F.2d 965, 967 (9th Cir. 1992). Take a “translation.”
Translating a novel from English incorporates the original
expression of the novel in a new language. A motion picture
takes elements of the novel’s original expression and
incorporates them into an audio-visual experience. The
same goes for an abridgment—it incorporates the novel’s
original expression into a condensed version. Thus,
Congress’s list of examples suggests that a “derivative work”
must be in the subset of works substantially incorporating
12 ORACLE INT’L CORP. V. RIMINI ST., INC.
the preexisting work. Once again, whether a work is
interoperable with another work doesn’t tell us if it
substantially incorporates the other work.
Based on this textual analysis, we’ve said that “a work is
not derivative unless it has been substantially copied from
the prior work.” Litchfield v. Spielberg, 736 F.2d 1352, 1357
(9th Cir. 1984); see also 1 Nimmer on Copyright § 3.01
(2024) (“A work is not derivative unless it has substantially
copied from a prior work.”). And we have held that “[a]
derivative work must incorporate a protected work in some
concrete or permanent ‘form.’” Lewis Galoob Toys, Inc.,
964 F.2d at 967.
To be sure, the incorporation of a preexisting work can
take several forms. First, the incorporation can be “literal.”
See Best Carpet Values, Inc. v. Google, LLC, 90 F.4th 962,
971 (9th Cir. 2024) (holding that a website’s source code is
a “copyrightable literal element[]”). So copying substantial
portions of PeopleSoft’s copyrighted code outright would be
an example of literal incorporation.
Second, the incorporation can be nonliteral, such as
copying the “total concept and feel” of a preexisting work.
Litchfield, 736 F.2d at 1357; see also SAS Inst., Inc. v. World
Programming Ltd., 64 F.4th 1319, 1326 (Fed. Cir. 2023)
(stating that the nonliteral elements of a computer program
“include the program architecture, structure, sequence and
organization, operational modules, and user interface”).
Take the case of Duke Nukem 3D, a popular video game. A
third-party distributor sold software that continued the video
game’s story by creating extra levels of gameplay. Micro
Star, 154 F.3d at 1109. The third-party distributor argued its
product was not a copyright infringement because it didn’t
incorporate any of Duke Nukem’s protected expression. Id.
ORACLE INT’L CORP. V. RIMINI ST., INC. 13
at 1112. As a technical matter, the distributor explained that
its product “reference[d]” Duke Nukem’s “source art
library” but did “not actually contain any art files.” Id. We
held that these new Duke Nukem levels were derivative
works because they copied the video game’s “story itself,”
including the “plot, theme, dialogue, mood, setting,
characters, etc.” Id. We likened the extra game levels to a
book version of the game that recasts the central character
even though it doesn’t copy pictures or code of the game. Id.
Here, we’re mostly concerned with nonliteral copying.
Although the district court found several examples of Rimini
literally copying Oracle’s source code, Rimini doesn’t
challenge that ruling on appeal. Instead, we focus on the
district court’s ruling that Rimini’s software programs are
derivative works “even if the work[s] do[] not contain any of
[Oracle’s] copyrighted code.” Oracle Int’l Corp., 2023 WL
4706127, at *3. It determined that Rimini created
“infringing derivative works because they interact only with
PeopleSoft.” Id. at *72. The district court relied on the fact
that “Rimini’s PeopleSoft updates are extensions to and
modifications of Oracle’s copyrighted software” and they
“cannot be used with any software programs other than
PeopleSoft.” Id. Rimini claims that thousands of its files
fall into this category—programs that are interoperative with
Oracle’s PeopleSoft but do not contain Oracle’s copyrighted
code.
Without more, mere interoperability isn’t enough to
make a work derivative. Both the text of the Copyright Act
and our case law teach that derivative status does not turn on
interoperability, even exclusive interoperability, if the work
doesn’t substantially incorporate the preexisting work’s
copyrighted material. Another video-game case makes the
point. Nintendo made a well-known gaming console. Lewis
14 ORACLE INT’L CORP. V. RIMINI ST., INC.
Galoob Toys, Inc., 964 F.2d at 967. Another company then
developed the Game Genie, which allowed players to alter
several features of Nintendo games. Id. The Game Genie
worked by being inserted in between a Nintendo game
cartridge and a Nintendo gaming console. Id. It then
blocked the value for a single data byte sent from the game
cartridge to the gaming console, thereby altering parts of the
game. Id. The Game Genie was “useless by itself” and it
“c[ould] only enhance . . . a Nintendo game’s output.” Id. at
969. Despite this exclusive interoperability with the
Nintendo system, the Game Genie was not a derivative
work. Instead, a “derivative work must incorporate a
protected work in some concrete or permanent form” and the
“Game Genie does not physically incorporate a portion of a
copyrighted work.” Id. Because it didn’t “duplicate or
recast[]” any of Nintendo’s copyrighted material, it couldn’t
be a derivative work. See id.
In sum, the district court erred by concluding that Rimini
created infringing “derivative works” just because its
programs “only interact[] and [are] useable with” Oracle
software. Oracle Int’l Corp., 2023 WL 4706127, at *66.
Something more is needed under the Copyright Act. Instead,
a derivative work must actually incorporate Oracle’s
copyrighted work, either literally or nonliterally. And as
Galoob Toys shows, simply being an extension or
modification of a copyrighted work without any
incorporation is not enough to create a derivative work.
Aside from concluding that a limited number of Rimini files
copied Oracle’s code, the district court made no finding that
Rimini incorporated nonliteral copyrighted material in its
PeopleSoft updates or programs.
We thus vacate the district court’s holding that Rimini
created infringing derivative works based solely on Rimini’s
ORACLE INT’L CORP. V. RIMINI ST., INC. 15
programs’ interoperability with Oracle’s programs. As the
issue was not briefed by the parties, we do not decide which
specific parts of Oracle’s programs are protectable nonliteral
elements or how to determine whether Rimini’s programs
incorporate any of those elements. See SAS Inst., Inc., 64
F.4th at 1326 (“Court decisions vary in the methods used to
identify and analyze copyrightability for nonliteral elements
of computer programs.”).
Finally, because the district court applied the wrong legal
standard in determining whether Rimini created derivative
works, we do not reach Rimini’s alternative argument that
Oracle’s licensing agreements nonetheless authorize any
derivative work. If the district court concludes that Rimini
created an infringing derivative work, the district court
should then consider whether any of Oracle’s licensing
agreements authorized the creation of the specific work.
B.
Ownership of a Copy of the Computer Program
Under the Copyright Act, no copyright infringement
exists if an “owner of a copy of a computer program . . .
mak[es] . . . another copy or adaptation of that computer
program” for certain purposes, such as when it’s an
“essential step” in using the program. 17 U.S.C. § 117(a).
We’ve described this provision as an “affirmative defense to
infringement.” Vernor v. Autodesk, Inc., 621 F.3d 1102, 1109
(9th Cir. 2010). At the pleadings stage, the district court
struck Rimini’s assertion of this affirmative defense because
it found that “Oracle’s customers only license, rather than
buy, Oracle’s copyrighted software.” Rimini St., Inc. v.
Oracle Int’l Corp., No. 2:14-cv-01699, 2015 WL 4139051,
at *2 (D. Nev. July 9, 2015). In the district court’s view,
because none of Oracle’s customers “owned” a copy of
16 ORACLE INT’L CORP. V. RIMINI ST., INC.
PeopleSoft, Rimini could not step into their shoes to claim
the defense. Rimini challenges this categorical ruling.
To determine whether a party is an “owner of a copy” of
a computer program, we look to whether the party has
“sufficient incidents of ownership” over the copy of the
software program. See UMG Recordings, Inc. v. Augusto,
628 F.3d 1175, 1183 (9th Cir. 2011) (simplified). And the
question is not about ownership of the copyrighted
material—it’s about ownership of a copy of the copyrighted
material. See 17 U.S.C. § 202 (“Ownership of a copyright
. . . is distinct from ownership of any material object in
which the work is embodied.”). In deciding this question,
we review the totality of the parties’ agreement. See Vernor,
621 F.3d at 1109.
Over the years, we’ve looked at several factors to
determine the “incidents of ownership.”
First, we’ve started with “whether the copyright owner
. . . specifies that a user is granted a license.” Id. at 1110. A
licensing agreement, rather than an outright bill of sale, may
show the lack of a transfer of ownership. Of course, the
“mere labeling of an arrangement as a license rather than a
sale, although it [i]s a factor to be considered, [i]s not by
itself dispositive of the issue.” UMG Recordings, 628 F.3d
at 1180. After all, “some purported software licensing
agreements may actually create a sale.” Adobe Sys. Inc. v.
Christenson, 809 F.3d 1071, 1078 (9th Cir. 2015).
Second, we’ve considered whether the parties’
arrangement “significantly restricts the user’s ability to
transfer the software.” Vernor, 621 F.3d at 1110–11. “The
right to transfer is one of the most essential sticks in the
bundle of rights that are commonly characterized as
property.” Shackleford v. United States, 262 F.3d 1028, 1032
ORACLE INT’L CORP. V. RIMINI ST., INC. 17
(9th Cir. 2001) (simplified). So generally, for a copy of a
computer program to become the “property” of a user, that
user must be able to transfer the copy. Thus, if users are
“entitled to use or dispose of [the copies] in any manner they
s[ee] fit,” then that’s a strong sign of ownership. See UMG
Recordings, 628 F.3d at 1180. On the other hand, significant
restrictions on transfer may indicate a license rather than
ownership.
Third, we’ve looked at whether the agreement “imposes
notable use restrictions.” Vernor, 621 F.3d at 1111. Again,
the concern is ownership of the copy of the copyright—not
of the copyright itself. So use restrictions that only protect
against the infringement of the copyrighted material are less
relevant here. Instead, we’re interested in use restrictions
that affect using the copy of the computer program, such as
limiting the user to “one working and one back up copy of
the software,” forbidding the “examination, disclosure,
copying, modification, adaptation, and visual display of the
software,” and permitting the “software use on [a] single
computer, [while] prohibit[ing] multicomputer and multi-
user arrangements, and permitt[ing] transfer to another
computer no more than once every thirty days.” Id. at 1111
n.11.
Other “incidents of ownership” may be considered.
Relevant considerations are whether the user paid
“significant consideration to develop the programs for [the
user’s] sole benefit” and whether the user could use the
“programs ‘forever,’ regardless of whether the parties’
relationship terminated.” Id. at 1114 (quoting Krause v.
Titleserv, Inc., 402 F.3d 119, 124–25 (2d Cir. 2005)).
The district court’s ruling on the pleadings seemingly
relied only on the labeling of the agreements between Oracle
18 ORACLE INT’L CORP. V. RIMINI ST., INC.
and its customers as a “license.” This is not enough. That
Oracle only provides PeopleSoft and its other programs
through licensing agreements is an important but not
dispositive fact. It reflects only one facet of the “incidents
of ownership.” Whether other incidents of ownership can be
proven is undetermined. Both sides of this dispute agree that
this is a fact-bound question, and we don’t undertake an
analysis of the purported 375 agreements involved in this
case in the first instance. We thus vacate the district court’s
ruling striking Rimini’s § 117(a) affirmative defense and
remand for reconsideration under this opinion. We take no
position on whether Oracle’s customers are ultimately
owners or licensees of the copies of Oracle’s software. And
we do not reach whether Rimini can establish the other
elements of the “essential step” defense under § 117(a)(1),
which the district court did not reach.
C.
Database and PeopleSoft Copyrights
Rimini next appeals from the district court’s conclusions
that it infringed Oracle’s copyrights for both Database and
PeopleSoft. We address each argument in turn.
1. Database
Rimini challenges the district court’s ruling that it
infringed the Oracle Database licensing agreement by
creating “18 ‘gap customer’ environments on its systems . . .
that included copies of Oracle Database.” Oracle Int’l
Corp., 2023 WL 4706127, at *79. The district court ruled
that the creation of these environments violated rulings from
the Rimini I litigation because Rimini maintained a copy of
Oracle Database on its computers.
ORACLE INT’L CORP. V. RIMINI ST., INC. 19
But we recently held that the plain language of the Oracle
Database licensing agreement did not prohibit third-party
support providers, like Rimini, from possessing a copy of
Oracle’s software to further a client’s “internal business
operations.” Rimini St., 81 F.4th at 854–55. In the appeal of
the contempt proceedings, “Oracle [could not] point[] to
[any] location restriction” in the Oracle Database licensing
agreement. Id. at 855. Nor did the district court here identify
a “location restriction” in the use of Oracle Database. While
we affirmed any activity that directly fell within Rimini I’s
injunction, we declined to extend it to a “different situation.”
See id.
We thus vacate the district court’s ruling that the 18 “gap
customer” environments containing Oracle Database
violated Oracle’s licensing agreement.
2. PeopleSoft
Rimini next challenges the district court’s ruling that
both (1) its use of “automated tools” to deliver PeopleSoft
updates from one client to another and (2) the “outright”
delivery of PeopleSoft updates to clients without further
testing in the clients’ environments constitute copyright
infringement.
Automated Tools
Rimini’s “automated tools” allow Rimini to enter one
customer’s environment, generate an update, and then
deliver it to other customers. The district court considered
these tools to be “impermissible cross-use” because they
require copying Rimini’s PeopleSoft updates in one client’s
environment and then distributing those copies to other
customers. See Oracle Int’l Corp., 2023 WL 4706127, at
*24. If these distributed Rimini files contained Oracle’s
20 ORACLE INT’L CORP. V. RIMINI ST., INC.
code or nonliteral protected material, we would have no
problem affirming. As the district court found, these copies
don’t benefit the original client at all, and so they don’t fall
under the copying allowed for the client’s “internal data
processing operations” permitted under Oracle’s licensing
agreement. See id. at *20. Rimini protests that there would
be no functional difference between using these “automated
tools” and manually recreating the files in the other clients’
environment, which the district court said would be non-
infringing. Id. at *96. While the end result may be the same
under the two methods, the difference is significant under
copyright law because the “automated tools” may require the
extra copying of Oracle’s protected expression with no
benefit to the initial client.
In the end, however, we vacate the district court’s ruling
on the “automated tools” to the extent that its conclusion
rests on its erroneous view of “derivative work.” The district
court ruled that Rimini’s “automated tools” required the
copying of Oracle’s protected expression, including “the
copying of individual PeopleSoft files, derivative works
thereof, and RAM copies of the prototype files or
PeopleTools.” Id. at *74. The district court also found that
“the files and documentation Rimini claims it created [as
part of its “automated tools”], even those without Oracle
code, and then distributed to multiple customers, were
derivative works because they leveraged portions of existing
Oracle programs and were created in PeopleSoft
environments with PeopleSoft tools for use in PeopleSoft
environments.” Id. at *22. On remand, the district court
should apply the legal standard articulated above for
“derivative work” before deciding whether Rimini’s
“automated tools” violate copyright laws.
ORACLE INT’L CORP. V. RIMINI ST., INC. 21
Outright Delivery
Next, the district court found that Rimini violated
Oracle’s copyright when it developed an update in the City
of Eugene’s PeopleSoft environment and then delivered it
“outright” to three other clients. Id. at *2. Rimini argues
that this was not cross-use because the City of Eugene
needed the update itself and it was free to deliver the update
to other clients when multiple clients have the same problem.
Oracle counters that this was impermissible cross-use
because the distribution of an update “outright” necessarily
means that Rimini used the City’s environment to
“prototype” the update for multiple clients rather than only
for the City’s “internal data processing operations.”
Once again, we vacate this ruling based on the district
court’s erroneous view of “derivative work.” The district
court’s decision presumed that this individual update was a
“derivative work” because it “only interacts and is useable
with PeopleSoft,” even if the update “contained only Rimini
written expression.” Id. at *66. As discussed above, this
analysis is incomplete. The district court must first
determine whether this update copies Oracle’s protected
expression, either literally or nonliterally. If the district court
finds protected expression in this update, it would be
relevant to know if any extra copies of the update were
created in the City’s environment solely because Rimini
planned to distribute the update to other clients. In other
words, further explanation is required of why “prototyping”
the update in the City’s environment for non-City clients
“necessarily” violates the “internal data processing
operations” provision.
22 ORACLE INT’L CORP. V. RIMINI ST., INC.
D.
The Lanham Act
The Lanham Act prohibits any person from making a
“false or misleading” description or representation of fact
about “goods or services” in “commercial advertising or
promotion.” 15 U.S.C. § 1125(a)(1)(B). But false
advertising doesn’t extend to statements of opinion and
puffery—that is, “exaggerated advertising, blustering, and
boasting upon which no reasonable buyer would rely.”
Southland Sod Farms v. Stover Seed Co., 108 F.3d 1134,
1145 (9th Cir. 1997) (simplified). When “the question of
truth or falsity is a close one,” we should “err on the side of
nonactionability.” Partington v. Bugliosi, 56 F.3d 1147,
1159 (9th Cir. 1995) (simplified).
The district court ruled that Rimini made several
statements that constitute false advertising under the
Lanham Act. See Oracle Int’l Corp., 2023 WL 4706127, at
*40–41 (listing statements). On appeal, Rimini only
challenges whether 12 statements about its security services
were misleading.
As a background, Oracle provides periodic security
patches, known as “Critical Patch Updates,” to customers
who purchase Oracle software support. Oracle develops and
releases security patches that fix vulnerabilities in its
products’ source code that hackers may exploit. Rimini
offers its own security service using a technology called
“virtual patching.” Unlike Oracle’s patches, virtual patching
does not modify the software program’s source code.
Instead, virtual patching acts as a firewall for software
programs, attempting to intercept and block any
vulnerabilities from reaching the program.
ORACLE INT’L CORP. V. RIMINI ST., INC. 23
Rimini’s 12 security-related statements can be divided
into three subgroups: (1) statements about the relative
security of the services offered by Oracle and Rimini;
(2) statements that Rimini offers “holistic” security; and
(3) statements about the need for software patching. We
consider each category in turn.
1. Relative Security of Services
In this category are Rimini’s statements that customers
can be more secure if they use Rimini’s security services
than if they remain with Oracle support. We take this
subcategory to include the following statements:
• “Security professionals have found that
traditional vendor security patching
models are outdated and provide
ineffective security protection.”
• Oracle’s [Critical Patch Updates] are
unnecessary to be secure.
• It is not risky to switch to Rimini and
forgo receiving [Critical Patch Updates]
from Oracle.
• Virtual patching can serve as a
replacement for [Oracle] patching.
• “Virtual patching can be more
comprehensive, more effective, faster,
safer, and easier to apply than traditional
[Oracle] patching.”
• “Rimini Security Support Services helps
clients proactively maintain a more
secure application compared to [Oracle’s]
24 ORACLE INT’L CORP. V. RIMINI ST., INC.
support program which offers only
software package-centric fixes.”
• Rimini provides more security as
compared to Oracle.
• Rimini’s [Global Security Services] can
“pinpoint and circumvent vulnerabilities
months and even years before they are
discovered and addressed by the software
vendor.”
These statements are puffery. Whether a statement is
factual or mere puffery often turns on the “specificity or
generality of the claim.” Newcal Indus., Inc. v. Ikon Off. Sol.,
513 F.3d 1038, 1053 (9th Cir. 2008). A statement is factual
if it is “specific and measurable, . . . capable of being proved
false or of being reasonably interpreted as a statement of
objective fact.” Ariix, LLC v. NutriSearch Corp., 985 F.3d
1107, 1121 (9th Cir. 2021) (simplified). In other words, “a
statement that is quantifiable, that makes a claim as to the
specific or absolute characteristics of a product” may be
actionable under the Lanham Act. Newcal Indus., 513 F.3d
at 1053 (simplified). In contrast, puffery is characterized by
subjective claims, including “merely stat[ing] in general
terms that one product is superior.” Cook, Perkiss and Liehe,
Inc. v. N. Cal. Collection Serv. Inc., 911 F.2d 242, 246 (9th
Cir. 1990) (simplified); see also Southland Sod Farms, 108
F.3d at 1145 (“[P]roduct superiority claims that are vague or
highly subjective often amount to nonactionable puffery.”).
Take the example we used in Cook. Saying that a lamp
was “far brighter than any lamp ever before offered for home
movies” was a generalized statement of puffery. Cook, 911
F.2d at 246 (simplified). But making the claim more specific
and quantifiable, like saying that the lamp was superior
ORACLE INT’L CORP. V. RIMINI ST., INC. 25
because of its “35,000 candle power and 10-hour life,” made
the statements factual. Id.
Comparative assertions about effectiveness, riskiness,
and security are the kinds of generalized statements of
product superiority that we have routinely found to be
nonactionable. Here, neither Oracle nor the district court
provided any objective, quantifiable metric to measure
software’s security, risk to vulnerabilities, or security
protocols’ effectiveness to prove the falsity of Rimini’s
statements. Indeed, the possibility of exploitation by hackers
always exists. No product can offer complete “security” or
eliminate all “risk.” Without an objective measure of the
difference between perfect security and the security
programs offered by Rimini’s and Oracle’s products, any
statement about comparative security is necessarily tinged
with subjectivity. As Oracle’s security expert
acknowledged, “security experts can reasonably disagree on
what constitutes adequate security.”
The district court also ruled that Rimini’s statement that
its security services could “pinpoint” future vulnerabilities
“before they even exist” was literally false because such
technology is “not technically feasible.” Oracle Int’l Corp.,
2023 WL 4706127, at *45. But that is a misreading of
Rimini’s statement. Rimini never claimed clairvoyance in
spotting vulnerabilities; instead, it was merely claiming that
its products can spot problems before they are “discovered
and addressed by the software vendor.” So it was again
making a comparative statement of superiority—not a
statement of psychic ability. Indeed, Rimini presented
evidence that it had identified and addressed specific
vulnerabilities before Oracle released a patch to address
them.
26 ORACLE INT’L CORP. V. RIMINI ST., INC.
We thus reverse the district court’s ruling on these
statements.
2. Holistic Security
In the next subcategory is Rimini’s statement about
“holistic” security. The subcategory contains only one
statement:
• Rimini offers “holistic security” solutions
for Oracle software for enterprises.
The district court determined that “holistic security” is a
term of art within the world of software security that refers
to “a comprehensive approach to security at all layers of a
system, and includes security patching at the software level.”
Id. at *44. It is true that industry standards can provide
objective meaning to otherwise subjective or ambiguous
terms in particular contexts. See Enigma Software Grp.
USA, LLC v. Malwarebytes, Inc., 69 F.4th 665, 672 (9th Cir.
2023) (holding that a term may become “substantively
meaningful and verifiable in the cybersecurity context”). On
appeal, Rimini doesn’t challenge the district court’s context-
specific definition of “holistic security” or the factual
conclusion that it doesn’t provide source-code level
protection. That makes the statement actionable.
Look to Ariix. In that case, a company created a
certification award for nutritional-supplement
manufacturers. Ariix, 985 F.3d at 1122. The company
described its certification as “a binary determination” based
on two “falsifiable criteria.” When the company did not give
the award to a particular manufacturer, we held that the
company made “specific and measurable statements” about
the manufacturer—it was “falsely impl[ying] to consumers”
ORACLE INT’L CORP. V. RIMINI ST., INC. 27
that the manufacturer did not meet the standards
undergirding the certification. Id. Because “[t]hese
implications are specific, measurable, and capable of being
falsified,” they were actionable statements under the
Lanham Act. Id.
Whether a support service provides “holistic security,”
which we accept means multi-layered security protection
including at the source-code level, is a type of “binary
determination” with “falsifiable criteria.” Id. Either the
product provides protection at multiple layers or it doesn’t.
The district court found that Rimini doesn’t offer multi-level
security. And since Rimini doesn’t refute either the
definition or the facts here, we affirm the district court.
3. Need for Software Patching
In the last subcategory are statements about the need for
software patching. This subcategory includes Rimini’s
statements that:
• Oracle’s [Critical Patch Updates] provide
little to no value to customers and are no
longer relevant.
• Once an Oracle ERP platform is stable,
there is no real need for additional
patches from Oracle.
• If you are operating a stable version of an
Oracle application platform, especially
with customizations, you probably cannot
apply or do not even need the latest
patches.
The district court held that these statements were
misleading because the “security community recognizes that
28 ORACLE INT’L CORP. V. RIMINI ST., INC.
software-level patching is one of the most important aspects
of any modern IT security strategy.” Oracle Int’l Corp.,
2023 WL 4706127, at *41.
While a closer case, Rimini’s statements about what
customers “need” or “value” resemble the “type of
generalized boasting upon which no reasonable buyer would
rely.” Southland Sod Farms, 108 F.3d at 1145; see also
Coastal Abstract Serv., Inc. v. First Am. Title Ins., 173 F.3d
725, 731 (9th Cir. 1999) (A statement “was puffery because
a reasonable consumer would not interpret the statement as
a reliably factual claim.”). The record shows that Oracle’s
customers are “some of the most sophisticated companies in
the world” and “take the security of their systems seriously.”
Whether to deploy or skip software patching is a matter of
subjective discretion. One Oracle customer testified that it
made the decision not to apply Oracle’s Critical Patching
Updates because it focused on its firewall security and
believed that the patches could introduce new problems—all
before it considered signing up with Rimini.
Thus, it is doubtful that any of Oracle’s customers would
be fooled about its own security needs merely based on
Rimini’s fanciful but vague statements. Indeed, Oracle
could not identify “any customers that left Oracle and went
to Rimini because of a statement about security.” Nor did
Oracle present any evidence of a security breach suffered by
a Rimini client. So while these statements border on
falsehood, we cannot say that they are so specific and
measurable to become actionable under the Lanham Act. We
thus reverse.
* * *
In sum, we reverse the district court’s ruling that
Rimini’s security-related statements constitute false
ORACLE INT’L CORP. V. RIMINI ST., INC. 29
advertising under the Lanham Act, except for the statement
about “holistic security.” We also vacate the injunction as it
pertains to these nonactionable statements.
E.
Scope of the Permanent Injunction
Rimini asks us to vacate or narrow the district court’s
permanent injunction for four reasons. First, it argues that
injunctive relief itself is improper because damages are the
appropriate remedy for past infringement, and any infringing
acts were in the past. Second, it argues that the district court
improperly required it to delete all its software files with the
prefixes “RS” or “RSI,” despite finding that only some of
those files were infringing. Third, it argues that the district
court wrongly required it to delete “any version” of the
TAX960ST.SQR file, even though that file is a standard
Oracle component of PeopleSoft. And fourth, it argues that
the district court’s injunction improperly applies to certain
DAT files, despite the district court’s holding that Oracle
didn’t meet its burden of proving infringement.
Because we vacate the district court’s ruling on
“derivative works” and the § 117(a) affirmative defense, we
also vacate the portions of the injunction appealed by
Rimini. On remand, should the district court conclude that
Rimini committed any copyright infringement, it should
consider the arguments in this appeal in fashioning any
injunction.
III.
For the above reasons, we vacate the district court’s
holding that (1) Rimini created infringing derivative works,
(2) Rimini could not invoke the § 117(a) affirmative defense,
and (3) Database and PeopleSoft infringed Oracle’s
30 ORACLE INT’L CORP. V. RIMINI ST., INC.
copyrights. We reverse the district court’s ruling that
Rimini’s security-related statements constitute false
advertising under the Lanham Act, except for the statement
about “holistic security.” Because we vacate much of the
district court’s ruling, we also vacate the portions of the
injunction appealed by Rimini. Rimini’s motion to stay the
enforcement of the permanent injunction pending appeal
(Dkt. No. 7) is denied as moot. Each party shall bear its own
costs on appeal.
VACATED in part, REVERSED in part, and
REMANDED.
Bybee, Circuit Judge, dissenting in part:
I join the majority opinion except for a portion of Part
II.D.3. In subpart D.3, the majority opinion discusses
whether certain statements made by Rimini constitute false
advertising under the Lanham Act or if they are merely
puffery and therefore not actionable under the Act. I
disagree with the majority’s conclusion that one of these
statements—“Oracle’s [Critical Patch Updates] provide
little or no value to customers and are no longer relevant”—
is puffery.
The Lanham Act prohibits any person from making a
“false or misleading” description or representation of a fact
about “goods or services” in “commercial advertising or
promotion.” 15 U.S.C. § 1125(a)(1)(B). “Statements of
opinion and puffery, however, are not actionable.” Ariix,
LLC v. NutriSearch Corp., 985 F.3d 1107, 1121 (9th Cir.
2021) (internal citation omitted).
ORACLE INT’L CORP. V. RIMINI ST., INC. 31
“Puffing is exaggerated advertising, blustering, and
boasting upon which no reasonable buyer would rely . . . .”
Southland Sod Farms v. Stover Seed Co., 108 F.3d 1134,
1145 (internal quotations marks and citation omitted) (9th
Cir. 1997). “A statement is considered puffery if the claim
is extremely unlikely to induce customer reliance.
Ultimately, the difference between a statement of fact and
mere puffery rests in the specificity or generality of the
claim.” Newcal Indus. v. Ikon Off. Sol., 513 F.3d 1038, 1053
(9th Cir. 2008) (internal citation omitted). A quantifiable
statement that makes a claim “as to the specific or absolute
characteristics of a product[] may be an actionable statement
of fact while a general, subjective claim about a product is
non-actionable puffery.” Id. (internal quotation and citation
omitted).
The majority admits that Rimini’s Critical Patch Updates
statement is a “closer case” but deems it puffery, construing
it as “generalized boasting upon which no reasonable buyer
could rely.” See Southland Sod Farms, 108 F.3d at 1145. In
this statement, Rimini says Oracle’s product provides “little
or no value” and is “no longer relevant.” These are “absolute
characteristics,” Newcal Indus., 513 F.3d at 1053, and can
be “falsified”—Oracle’s product is either valueless and
irrelevant or not, Ariix, 985 F.3d at 1122. This is true even
if, as the majority suggests, using software patching is a
discretionary decision, and Oracle’s “sophisticated”
customers would not be “fooled” by this statement. As the
district court explained, Rimini “internally acknowledges
that patching . . . is necessary,” and has said that “no one is
thinking of not applying patches at all.”
I join the majority in finding that most of the statements
by Rimini are puffery because those statements use
qualifiers—words like “probably,” “can,” and “more”—and
32 ORACLE INT’L CORP. V. RIMINI ST., INC.
make generalized statements as to why Rimini’s products are
superior to Oracle’s. This statement, on the other hand, lacks
qualifiers, and instead opts for absolute language (“no longer
relevant”) and does not compare the two products. Labeling
Oracle’s product irrelevant moves this statement beyond
“generalized boasting” and is sufficiently specific and
absolute to be actionable under the Lanham Act.
I respectfully dissent from the majority’s decision on this
statement and would affirm the district court’s decision
finding it actionable.