Oracle America, Inc. v. Hewlett Packard Enterprise Co.

FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

ORACLE AMERICA, INC., a Delaware No. 19-15506

Corporation; ORACLE

INTERNATIONAL CORPORATION, a D.C. No.

California Corporation, 4:16-cv-01393-

Plaintiffs-Appellants, JST

v.

OPINION

HEWLETT PACKARD ENTERPRISE

COMPANY, a Delaware Corporation,

Defendant-Appellee.

Appeal from the United States District Court

for the Northern District of California

Jon S. Tigar, District Judge, Presiding

Argued and Submitted June 8, 2020

San Francisco, California

Filed August 20, 2020

Before: MILAN D. SMITH, JR. and ANDREW D.

HURWITZ, Circuit Judges, and C. ASHLEY ROYAL, *

District Judge.

Opinion by Judge Milan D. Smith, Jr.

*

The Honorable C. Ashley Royal, United States District Judge for

the Middle District of Georgia, sitting by designation.

2 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

SUMMARY **

Copyright

The panel affirmed in part and reversed in part the

district court’s grant of summary judgment in favor of

Hewlett Packard Enterprise Co. in a copyright infringement

action brought by Oracle America, Inc., and Oracle

International Co.

Oracle, owner of the proprietary Solaris software

operating system, granted customers a limited use license

and required customers to have a prepaid annual support

contract to access patches for a server. Oracle alleged that

HPE improperly accessed, downloaded, copied, and

installed Solaris patches on servers not under an Oracle

support contract. HPE provided support for all of its

customers’ servers, including servers running Solaris

software, and it subcontracted indirect support to Terix

Computer Co. Oracle asserted direct copyright infringement

claims concerning HPE’s direct support customers, and it

asserted indirect infringement claims concerning joint HPE-

Terix customers.

The panel affirmed the district court’s partial summary

judgment for HPE on claims for copyright infringement and

intentional interference with prospective economic

advantage based upon the statute of limitations. Following

a prior suit by Oracle against Terix, Oracle and HPE entered

into an agreement, effective May 6, 2015, to toll the statute

**

This summary constitutes no part of the opinion of the court. It

has been prepared by court staff for the convenience of the reader.

ORACLE AMERICA V. HEWLETT PACKARD ENTER. 3

of limitations for any claims that Oracle might assert against

HPE. The panel held that under the Copyright Act’s three-

year statute of limitations, Oracle’s copyright infringement

claims were barred for conduct before May 6, 2012. The

panel concluded that Oracle had constructive knowledge and

thus a duty to investigate but did not conduct a reasonable

investigation into the suspected infringement. The panel

held that under a California two-year statute of limitations,

the IIPEA claim was barred for conduct before May 6, 2013.

As to remaining infringement claims, the panel affirmed

in part the district court’s summary judgment on indirect

infringement claims for patch installations by Terix. The

panel reversed the district court’s summary judgment on all

infringement claims for pre-installation conduct and on

direct infringement claims for unauthorized patch

installations by HPE. As to indirect infringement, the panel

held that in interpreting Oracle’s licenses, the district court

erred by failing to consider pre-installation conduct. As to

direct infringement, the panel held that for certain customers,

referred to as “non-Symantec customers,” Oracle possibly

could provide unauthorized installations by HPE. Summary

judgment for HPE on the direct infringement claims

concerning customer Symantec was also improper.

The panel addressed other issues in a concurrently filed

memorandum disposition.

COUNSEL

Gregory G. Garre (argued), Elana Nightingale Dawson, and

Charles S. Dameron, Latham & Watkins LLP, Washington,

D.C.; Christopher S. Yates, Christopher B. Campbell, and

Brittany N. Lovejoy, Latham & Watkins LLP, San

4 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

Francisco, California; Dorian Estelle Daley and Deborah

Kay Miller, Oracle America Inc., Redwood City, California;

Jeffrey S. Ross, Oracle America Inc., Burlington, California;

Dale M. Cendali and Joshua L. Simmons, Kirkland & Ellis

LLP, New York, New York; for Plaintiffs-Appellants.

Mark A. Perry (argued), Gibson Dunn & Crutcher LLP,

Washington, D.C.; Samuel G. Liverside, Joseph A. Gorman,

and Ilissa S. Samplin, Gibson Dunn & Crutcher LLP, Los

Angeles, California; Jeffrey T. Thomas and Blaine H.

Evanson, Gibson Dunn & Crutcher LLP, Irvine, California;

Vaishali Udupa, Hewlett Packard Enterprise Company,

Reston, Virginia; Deanna L. Kwong, Hewlett Packard

Enterprise Company, San Jose, California; for Defendant-

Appellee.

William A. Isaacson and Samuel S. Ungar, Boies Schiller

Flexner LLP, Washington, D.C.; Keith Kupferschmid and

Terry Hart, Copyright Alliance, Washington, D.C.; for

Amicus Curiae Copyright Alliance.

Mark E. Ferguson, Bartlit Beck LLP, Chicago, Illinois;

Abigail M. Hinchcliff, Bartlit Beck LLP, Denver, Colorado;

for Amici Curiae Repair Association and Electronic Frontier

Foundation.

OPINION

M. SMITH, Circuit Judge:

Oracle America, Inc. and Oracle International

Corporation (together, Oracle) own the proprietary Solaris

software operating system. Oracle periodically releases

patches for this software to address functionality, improve

ORACLE AMERICA V. HEWLETT PACKARD ENTER. 5

performance, and resolve security issues. As is relevant

here, Oracle restricts use of the Solaris software, including

software patches. It grants a customer a limited use license,

and it requires a customer to have a prepaid annual support

contract to access patches for a server.

Oracle brought copyright infringement claims,

California state law intentional interference claims, and a

California Unfair Competition Law (UCL) claim against

Hewlett Packard Enterprise Company (HPE), alleging that

HPE and nonparty Terix Computer Company, Inc. (Terix)

improperly accessed, downloaded, copied, and installed

Solaris patches on servers not under an Oracle support

contract. On cross motions, the district court granted

summary judgment for HPE. We affirm the district court’s

partial summary judgment for HPE on the infringement and

intentional interference claims based upon the statute of

limitations. We affirm in part and reverse in part the

summary judgment on what remains of the infringement

claims. We address all other issues in a concurrently filed

memorandum disposition.

FACTUAL AND PROCEDURAL BACKGROUND

I. The Solaris Software

Oracle has owned federally registered copyrights for the

Solaris software since it purchased Sun Microsystems (Sun)

in January 2010. Various Solaris patches also have code

registered with the United States Copyright Office. Oracle

licenses use of the Solaris software to a customer when the

customer purchases a server with preinstalled software. The

Solaris versions at issue here are Solaris 8, 9, 10 and 11. The

Binary Code License Agreement applies to Solaris 8 and 9.

6 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

The Software License Agreement (SLA) applies to Solaris

10. 1

Customers with a prepaid annual Oracle support contract

can access Solaris patches through the password protected

My Oracle Support (MOS) website. 2 A customer must place

every server for which it desires support on an active support

contract. A support contract is subject to policies that also

define a customer’s right to access patches. With an active

support contract, a customer can create an MOS username

and password. Upon accessing the MOS, the customer must

agree to additional terms of use concerning the software on

the site.

II. Third-Party Support of Solaris Software by HPE and

Terix

As is relevant here, HPE has a multi-vendor support

business that serves as a “one-stop-shop” to support all

servers an HPE customer has, including servers running

Solaris software. HPE provides such support directly and

indirectly. HPE subcontracted indirect support to Terix, a

company which specialized in supporting Oracle software.

For joint HPE-Terix customers, Terix arranged for a server

to have Oracle support in the customer’s name with a prepaid

Terix-supplied credit card and created an MOS credential for

the single-server Oracle support contract. Terix also

provided customers with a form email to send to Oracle.

Terix downloaded patches using the credentials to make

copies for use on off-contract servers as part of the so-called

1

A customer-specific entitlement accompanies the SLA. Solaris 11

is governed by a license similar to the SLA.

2

Oracle ceased Sun’s gratis release of security-related patches,

firmware updates, and new Solaris operating system versions.

ORACLE AMERICA V. HEWLETT PACKARD ENTER. 7

“one-to-many” scheme. When a customer was not yet

supported, Terix created credentials by using fictitious

names, emails addresses, and credit cards.

Oracle sued Terix in July 2013, alleging copyright

infringement concerning the Solaris patches, among other

claims. Oracle Am., Inc. v. Terix Comp. Co., Inc., No. 4:13-

cv-3385-JST, Dkt No. 1 (N.D. Cal. July 19, 2013).

Following summary judgment for Oracle on Terix’s license

affirmative defense there, Oracle Am., Inc. v. Terix Comp.

Co., 2015 WL 2090191 (N.D. Cal. May 5, 2015), Terix

stipulated to a judgment for Oracle on the infringement and

fraud claims without admitting liability. Thereafter, Oracle

and HPE entered into an agreement, effective May 6, 2015,

to toll the statute of limitations for any claims that Oracle

might assert against HPE.

III. This Litigation

Oracle brought this suit against HPE in March 2016 for

copyright infringement pursuant to 17 U.S.C. §§ 101, et seq.,

intentional interference with contractual relations (IICR),

intentional interference with prospective economic

advantage (IIPEA), and violations of the UCL, Cal. Bus. &

Prof. Code § 17200. Among other affirmative defenses,

HPE asserted express and implied license. Following

discovery, Oracle moved for partial summary judgment on

the infringement claims and some affirmative defenses,

including the license defense. HPE cross moved on all

claims. The district court granted summary judgment for

HPE. Oracle timely appealed.

JURISDICTION AND STANDARD OF REVIEW

We have jurisdiction pursuant to 28 U.S.C. § 1291. We

review a grant of summary judgment de novo. Shelley v.

8 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

Geren, 666 F.3d 599, 604 (9th Cir. 2012). “We must

determine, viewing the evidence in the light most favorable

to the nonmoving party, whether there are any genuine issues

of material fact and whether the district court correctly

applied the substantive law.” Zabriskie v. Fed. Nat’l Mortg.

Ass’n, 940 F.3d 1022, 1026 (9th Cir. 2019) (citation and

quotations omitted).

ANALYSIS

I. The Statute of Limitations

It is undisputed that the May 6, 2015 effective date of the

parties’ tolling agreement applies in this case. Thus, we

consider whether the copyright infringement claims are

barred for conduct before May 6, 2012 and the IIPEA claim

is barred for conduct before May 6, 2013. 3

A. The Copyright Infringement Claims

A copyright infringement claim is subject to a three-year

statute of limitations, which runs separately for each

violation. 17 U.S.C. § 507(b); Petrella v. Metro-Goldwyn-

Mayer, Inc., 572 U.S. 663, 671 (2014). “[A] copyright

infringement claim accrues—and the statute of limitations

begins to run—when a party discovers, or reasonably should

have discovered, the alleged infringement.” Media Rights

3

Oracle raised limitations arguments in its opening brief for only

copyright infringement and IIPEA claims. Oracle has waived the IICR

claim limitations argument it raised for the first time in reply. U.S. v.

Alcan Elec. & Eng’g, Inc., 197 F.3d 1014, 1020 (9th Cir. 1999). In any

event, our analysis on the IIPEA claim here would apply equally to the

IICR claim. HPE has also waived its perfunctory argument that the UCL

claims are time-barred. See Cal. Pac. Bank v. Fed. Deposit Ins. Corp.,

885 F.3d 560, 570 (9th Cir. 2018).

ORACLE AMERICA V. HEWLETT PACKARD ENTER. 9

Techs., Inc. v. Microsoft Corp., 922 F.3d 1014, 1022 (9th

Cir. 2019). 4

Although Oracle repeatedly argues that it lacked actual

knowledge of all the wrongdoing by HPE and Terix,

constructive knowledge triggers the statute of limitations.

“The plaintiff is deemed to have had constructive knowledge

if it had enough information to warrant an investigation

which, if reasonably diligent, would have led to discovery of

the [claim].” Pincay v. Andrews, 238 F.3d 1106, 1110 (9th

Cir. 2001) (citation omitted). We have previously explained

that “suspicion” of copyright infringement “place[s] upon

[the plaintiff] a duty to investigate further into possible

infringements of [its] copyrights.” Wood v. Santa Barbara

Chamber of Commerce, Inc., 705 F.2d 1515, 1521 (9th Cir.

1983). 5 Even if the plaintiff “may not actually have

conducted this further investigation, equity will impute to

[the plaintiff] knowledge of facts that would have been

revealed by reasonably required further investigation.” Id.;

4

Oracle waived its argument in reply about the district court’s

treatment of the indirect infringement claims as accruing when Oracle

discovered or could have reasonably discovered direct infringement.

Alcan Elec. & Eng’g, 197 F.3d at 1020.

5

Relying on O’Connor v. Boeing North American, Inc., 311 F.3d

1139 (9th Cir. 2002), Oracle argues that “suspicion alone” is not

sufficient to trigger the limitations period. O’Connor concerned whether

the discovery rule applied to 42 U.S.C. § 9658 preempted the California

discovery rule in the context of personal injury claims for exposure to

hazardous substances. Id. at 1146–49. We rejected “an interpretation of

the federal discovery rule that would commence limitations periods upon

mere suspicion of the elements of a claim” to “forestall” the filing of

unnecessary and preventive claims. Id. at 1148. We did not, however,

discuss Wood. As Oracle recognizes, Wood provides that suspicion of

infringement triggers a duty to investigate. 705 F.2d at 1521. We apply

that standard here.

10 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

see also Bibeau v. Pac. Nw. Res. Found. Inc., 188 F.3d 1105,

1108 (9th Cir. 1999) (citation omitted), as amended,

208 F.3d 831 (9th Cir. 2000) (explaining that the “twist” of

the discovery rule is that it requires “[t]he plaintiff [to] be

diligent in discovering the critical facts,” i.e., “that he has

been hurt and who has inflicted the injury” (citation

omitted)).

Oracle concedes that it “had concerns” in November

2010 that Terix might purchase support for one system and

reuse the patches for all other systems. Oracle also had

suspicions about HPE as early as 2010 and certainly by

October 2011. Critically, Oracle concedes that “it made

inquiries of Terix and HPE after receiving reports of

potential infringement.” In relevant part, Oracle relies on

inquiries that occurred in 2008 and September 2011. Oracle,

thus, had a duty to conduct a reasonable investigation.

Bibeau, 188 F.3d at 1108; Wood, 705 F.2d at 1521.

The doctrine of fraudulent concealment does not help

Oracle in this case. A plaintiff relying on this doctrine to toll

the limitations period must show “both that the defendant

used fraudulent means to keep the plaintiff unaware of his

cause of action, and also that the plaintiff was, in fact,

ignorant of the existence of his cause of action.” Wood,

705 F.2d at 1521. The doctrine does not apply if the plaintiff

had actual or constructive knowledge of the facts giving rise

to the claim. Hexcel Corp. v. Ineos Polymers, Inc., 681 F.3d

1055, 1060 (9th Cir. 2012). “The plaintiff is deemed to have

had constructive knowledge if it had enough information to

warrant an investigation which, if reasonably diligent, would

have led to the discovery of the fraud.” Id. (citation omitted).

Although Oracle singularly focuses on the means of the

purported concealment, it is not accurate that Oracle “had no

reason to suspect” infringement and thus no duty to inquire.

ORACLE AMERICA V. HEWLETT PACKARD ENTER. 11

Taylor v. Meirick, 712 F.2d 1112, 1118 (7th Cir. 1983).

Oracle concededly suspected infringement of its patches by

Terix and HPE well before May 6, 2012.

The remaining issue is whether Oracle conducted a

reasonable investigation into the suspected infringement.

Although “summary judgment is generally an inappropriate

way to decide questions of reasonableness,” it “is

appropriate ‘when only one conclusion about the conduct’s

reasonableness is possible.’” Gorman v. Wolpoff &

Abramson, LLP, 584 F.3d 1147, 1157 (9th Cir. 2009)

(quoting In re Software Toolworks, Inc., 50 F.3d 615, 622

(9th Cir. 1994)). Oracle’s only evidence of any investigation

concerns Terix. 6 In April 2012—a month before the three-

year lookback from the effective date of the tolling

agreement—an Oracle employee searched the MOS for a

“terix.com” email address to determine whether Terix

downloaded Solaris patches or purchased support contracts.

That search yielded no results.

The district court determined that this investigation was

unreasonable because Oracle failed to use its contractual

right to audit customers, despite knowing that Oracle

customers were working with Terix. The court did not err in

focusing on this issue. Oracle had already identified

customer audits as a tool to protect its intellectual property.

Critically, only a customer with an active support contract

can access the MOS in the first instance. Furthermore,

Oracle requires that its customers ensure that third party

agents comply with the terms of use for the Solaris software.

Oracle does not dispute that it had the right to audit its

customers. It asserts, however, that requiring it to have

6

Oracle does not argue that it investigated HPE.

12 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

exercised that right would be “unprecedented,” “dilute the

value of copyright ownership by increasing the costs of

policing for infringement,” and “subject its clients to a

hostile inquiry for the sake of tolling the statute of

limitations.” Oracle cites no evidence or authority

supporting these assertions, which are insufficient to

preclude summary judgment. S. A. Empresa de Viacao

Aerea Rio Grandense (Varig Airlines) v. Walter Kidde &

Co., Inc., 690 F.2d 1235, 1238 (9th Cir. 1982) (“[A] party

cannot manufacture a genuine issue of material fact merely

by making assertions in its legal memoranda”). Because

Oracle did not raise a triable issue about its investigation,

HPE was entitled to summary judgment on the infringement

claims for pre-May 6, 2012 conduct.

B. The IIPEA Claim

An IIPEA claim is subject to a two-year statute of

limitations. See Cal. Civ. Proc. Code § 339(1). A cause of

action does not accrue under California law “until the

plaintiff discovers, or has to discover, the cause of action.”

Fox v. Ethicon Endo-Surgery, Inc., 110 P.3d 914, 920 (Cal.

2005). A “potential plaintiff who suspects that an injury has

been wrongfully caused must conduct a reasonable

investigation of all potential causes of that injury.” Id. at

921. A defendant’s fraudulent concealment will toll the

statute of limitations “for that period during which the claim

is undiscovered by a plaintiff or until such time as plaintiff,

by the exercise of reasonable diligence, should have

discovered it.” Bernson v. Browning-Ferris Indus., 873 P.2d

613, 615 (Cal. 1994) (citation omitted).

In concluding that Oracle’s pre-May 6, 2013 IIPEA

claims were time-barred, the district court analyzed evidence

concerning Comcast, one of Oracle’s support customers, and

determined that Oracle constructively knew of HPE’s

ORACLE AMERICA V. HEWLETT PACKARD ENTER. 13

interference with the Comcast relationship as early as 2011.

Oracle has not challenged that finding here, and thus has

waived that issue. Paladin Assocs., Inc. v. Mont. Power Co.,

328 F.3d 1145, 1164 (9th Cir. 2003). Oracle nonetheless

argues that it could not have known about the “broader one-

to-many scheme to interfere with Oracle’s relationships.”

Relying on El Pollo Loco, Inc. v. Hashim, 316 F.3d 1032,

1040 (9th Cir. 2003), Oracle further argues that it could rely

on the truth of HPE’s and Terix’s assurances that “they were

not engaged in misconduct” even if an investigation would

have disclosed the falsity of those assurances.

Although fraudulent concealment tolls a statute of

limitations for the time that a plaintiff cannot discover its

claim, Bernson, 873 P.2d at 615, 619, Oracle was aware, at

a minimum, of enough facts well before May 6, 2013 to

discover its IIPEA claim against HPE. Oracle identified

HPE and Terix in 2010, among others, as third-party

maintainers of Solaris software who sought to attract

customers from Oracle in the manner challenged here. And,

in 2011, Comcast indicated that it would leave Oracle for

HPE and Terix after HPE and Terix had made purported

assurances to Oracle. In short, Oracle, was not “ignorant” of

its IIPEA claim against HPE before May 6, 2013. Weatherly

v. Universal Music Publ’g Grp., 23 Cal. Rptr. 3d 157, 161–

62 (Ct. App. 2004). Thus, the claim is time-barred for pre-

May 6, 2013 conduct.

II. The Copyright Infringement Claims

Oracle asserted direct infringement claims concerning

HPE’s direct support customers, and indirect infringement

claims concerning joint HPE-Terix customers. The claimed

infringing acts were unauthorized downloading, copying,

and delivery of patches, and patch installations. We consider

separately the indirect and direct infringement claims,

14 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

mindful that “[t]he test for summary judgment in a copyright

case must comport with the standard applied to all civil

actions.” Shaw v. Lindheim, 919 F.2d 1353, 1358–59 (9th

Cir. 1990), overruled in part on other grounds by, Skidmore

v. Led Zeppelin, 952 F.3d 1051, 1066 (9th Cir. 2020) (en

banc).

A. Indirect Infringement Claims

A defendant may be held vicariously and contributorily

liable for copyright infringement carried out by another.

Luvdarts, LLC v. AT & T Mobility, LLC, 710 F.3d 1068,

1071 (9th Cir. 2013). But a plaintiff must show “[a]s a

threshold matter . . . that there has been direct infringement

by third parties.” Perfect 10, Inc. v. Amazon.com, Inc.,

508 F.3d 1146, 1169 (9th Cir. 2007). The district court

concluded that Oracle could not prove direct infringement

by Terix in the form of unauthorized patch installations. 7

Oracle challenges the court’s failure to consider evidence of

Terix’s pre-installation conduct. We briefly address that

evidence and then discuss the deficiencies in the district

court’s analysis.

Direct infringement requires: “(1) ownership of a valid

copyright, and (2) copying of constituent elements of the

work that are original.” Seven Arts Filmed Entm’t Ltd. v.

Content Media Corp. PLC, 733 F.3d 1251, 1254 (9th Cir.

2013) (citation omitted). On the second element, we have

made clear that “[b]oth uploading and downloading

copyrighted material are infringing acts.” Columbia

Pictures Indus. v. Fung, 710 F.3d 1020, 1034 (9th Cir.

7

Oracle does not challenge the district court’s ruling concerning

patch installations by Terix. Thus, we affirm the partial summary

judgment for HPE on the indirect infringement claims as to that issue.

ORACLE AMERICA V. HEWLETT PACKARD ENTER. 15

2012). Oracle provided evidence of Terix’s downloading

and copying of patches for joint HPE-Terix customers.

Terix downloaded some 11,500 copies of Solaris patches,

including thousands of copies of registered protectable code

by using customers’ MOS credentials. Terix employees

copied patches to internal Terix repositories as well as to

Terix-provided laptops so that it could provide patches on

demand to joint customers. Terix reproduced and distributed

patches on its servers so that customers could access patch

copies.

Although this evidence appears to show direct

infringement, the district court did not consider it because

the court read “Oracle’s support contracts to grant an Oracle

customer, or an agent of the customer, a license to download,

deliver, and install Solaris patches.” Reasoning that Terix

was an agent of a customer with a license, the court thought

that only patch installations could constitute infringing

conduct.

An applicable license may be dispositive of an

infringement claim. “Anyone who is authorized by the

copyright owner to use the copyrighted work in a way

specified in [the Copyright Act] . . . is not an infringer of the

copyright with respect to such use.” Sony Corp. of Am. v.

Universal City Studios, Inc., 464 U.S. 417, 433 (1984).

Thus, an infringement claim “fails if the challenged use of

the work falls within the scope of a valid license.” Great

Minds v. Office Depot, Inc., 945 F.3d 1106, 1110 (9th Cir.

2019). And “[t]he existence of a license creates an

affirmative defense to” an infringement claim. Worldwide

Church of God v. Phila. Church of God, Inc., 227 F.3d 1110,

1114 (9th Cir. 2000). But “[w]hen a licensee exceeds the

scope of the license granted by the copyright holder, the

licensee is liable for infringement.” LGS Architects, Inc. v.

16 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

Concordia Homes of Nev., 434 F.3d 1150, 1156 (9th Cir.

2006).

A court must construe the license to evaluate its effect on

a claim of copyright infringement. “A copyright license

‘must be construed in accordance with the purposes

underlying federal copyright law.’” Great Minds, 945 F.3d

at 1110 (quoting S.O.S., Inc. v. Payday, Inc., 886 F.2d 1081,

1088 (9th Cir. 1989)); see also Cohen v. Paramount Pictures

Corp., 845 F.2d 851, 854 (9th Cir. 1988) (same). “Chief

among these purposes is the protection of the author’s

rights.” S.O.S., 886 F.2d at 1088. “Federal courts ‘rely on

state law to provide the canons of contractual construction to

interpret a license, but only to the extent such rules do not

interfere with federal copyright law or policy.’” Great

Minds, 945 F.3d at 1110 (quoting S.O.S., 886 F.2d at 1088).

The district court here, however, opined on Oracle’s

licenses without applying these principles, and it never

identified a license provision that authorized the challenged

pre-installation conduct. 8 That was error. At summary

judgment, “[t]he district court must not only properly

consider the record . . . but must consider that record in light

of the ‘governing law.’” Zetwick v. County of Yolo, 850 F.3d

8

HPE avers that the district court “held” HPE to its burden to

identify a license provision authorizing the pre-installation conduct,

pointing to an order in Oracle’s case against Terix. Oracle, 2015 WL

2090191, at *1. But, in that order, the magistrate judge granted summary

judgment for Oracle on the affirmative license defense, reasoning that

Terix “violated the terms of the relevant licenses by using a customer’s

credential’s to . . . download patches for any number of that customer’s

machines, whether covered by the license terms or not” because “[t]his

type of use is clearly not contemplated on the face of the license

agreements.” Id. at *6. And unlike the district court here, the magistrate

judge there applied the relevant principles to construe the licenses for

Solaris versions 7, 8, 9 and 10. Id. at *1, 7–9.

ORACLE AMERICA V. HEWLETT PACKARD ENTER. 17

436, 441 (9th Cir. 2017) (quoting Anderson v. Liberty Lobby,

Inc., 477 U.S. 242, 248 (1986)). “[W]here application of

incorrect legal standards may have influenced the district

court’s conclusion, remand is appropriate.” Id. at 442. By

applying no legal standard to interpret the licenses, the

district court failed to apply the correct one. In doing so, the

court excluded pre-installation conduct from its analysis.

Thus, we remand for the court to properly analyze the

licenses. The court must reconsider all infringement claims

for pre-installation conduct, including the direct

infringement claims for which the court also limited its focus

to unauthorized installations. 9

B. The Direct Infringement Claims

As is relevant here, direct infringement requires copying

of a protected work by the defendant. Seven Arts, 733 F.3d

at 1254. It is undisputed that HPE’s installation of patches

on unsupported servers would constitute infringement. But

the parties dispute whether Oracle’s evidence showed that

HPE performed such installations for its direct customers.

We address separately the non-Symantec customers and

Symantec and conclude that triable issues remain.

1. Non-Symantec Customers

The district court reasoned that, to survive summary

judgment on the direct infringement claims for non-

Symantec customers, Oracle had to provide: “(1) evidence

that HPE installed a patch on a server that was not supported

by an Oracle support contract, and (2) evidence that the

9

We decline to resolve in the first instance whether Oracle produced

sufficient evidence on the additional elements of secondary liability

because the district court never considered those issues. Shirk v. U.S. ex

rel. Dep’t of Interior, 773 F.3d 999, 1007 (9th Cir. 2014).

18 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

patch was released and downloaded while that server was

not on contract.” Oracle does not challenge this application

of the copying element, and thus, it guides us here.

Oracle relied on an analysis by its expert, Christian

Hicks, of HPE-produced spreadsheet data for 35 HPE direct

customers to show that HPE performed unauthorized patch

installations. The spreadsheets had an “Installed on Date”

column and a column identifying the hardware serial

number. Hicks treated the “Installed on Date” column as

showing actual installation dates. He found 210 instances of

patching where “the ‘Installed on Date’ in HPE’s data

occurred after Oracle support for that server had ended.” He

found that for 188 of those instances, Oracle had not released

the patches until after Oracle support for the server expired.

Crediting HPE’s arguments, the district court concluded that

Oracle could not prove with this data (a) unauthorized

installations (b) by HPE. We disagree.

a. Unauthorized Patch Installations

The district court found an insurmountable “ambiguity”

about whether the “Installed on Date” column reflected

actual patch installations. The “ambiguity” stemmed from

testimony by David Jensen, HPE’s Rule 30(b)(6) witness

and a former HPE employee. In considering this testimony,

the court failed to draw all reasonable inferences in Oracle’s

favor.

Jensen testified that the “Installed on Date” column had

three possible meanings. It could mean the date that: (1) a

kernel patch was installed, (2) a patch was released from the

vendor, or (3) a file was updated on the system, such as a

deletion, modification, or change to the file. Although

Jensen testified that one could not know which meaning

applied, he explained that the field prioritized the first

ORACLE AMERICA V. HEWLETT PACKARD ENTER. 19

meaning. Only if actual installation data was unavailable

would the entry reflect another meaning. This testimony

supported the actual installation date meaning that Hicks

attributed to “Installed on Date,” and it showed that that

meaning was prioritized. 10 In light of this evidence, the

district court could not properly assume in HPE’s favor that

no entries reflected an actual installation.

The court also reasoned that even if all entries reflected

installations, “Oracle could not identify any particular non-

supported server on which a protected patch was improperly

installed.” That conclusion stemmed from what the court

viewed as a concession by Oracle during the summary

judgment hearing. Oracle, however, effectively explained

that it would prove unauthorized installations

circumstantially. “Proof of copyright infringement is often

highly circumstantial,” Loomis v. Cornish, 836 F.3d 991,

994 (9th Cir. 2016) (citation omitted), “[b]ecause direct

evidence of copying is rarely available,” Baxter v. MCA,

Inc., 812 F.2d 421, 423 (9th Cir. 1987). Here, Oracle could

identify protected patches and the spreadsheets showed

installations that post-dated the release of a given patch.

Drawing all reasonable inferences in Oracle’s favor, a jury

could find that at least one entry reflected an actual patch

installation.

10

The district court also stated that the data had a “false positive”

because Oracle identified a patch installation on an off-contract server

before Oracle had released that patch. Such an entry can be explained as

the date of a file update, consistent with Jensen’s third meaning of

“Installed on Date.” That “false positive” would not preclude that other

entries reflect actual installations.

20 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

b. By HPE

A “direct infringement claim turn[s] on ‘who made’ the

copies[.]” Fox Broad. Co. v. Dish Network L.L.C., 747 F.3d

1060, 1067 (9th Cir. 2014) (quoting Cartoon Network LP,

LLLP v. CSC Holdings, Inc., 536 F.3d 121, 130 (2d Cir.

2008)) (emphasis in original). Oracle must “show causation

(also referred to as ‘volitional conduct’) by the defendant.”

Perfect 10, Inc. v. Giganews, Inc., 847 F.3d 657, 666 (9th

Cir. 2017), cert denied, 138 S. Ct. 504 (2017). This requires

conduct by the defendant “that can reasonably be described

as the direct cause of the infringement.” Id. (citation

omitted) (emphasis in original).

Relying on Jensen’s testimony, HPE avers that some

entity other than it—Oracle, the customer, or some unknown

third party—could have installed patches for its direct

support customers. Jensen’s testimony, however, could not

foreclose that HPE installed patches. Indeed, he testified

that when the data indicated that a patch was applied to a

server, it “could mean” that a customer updated the patch, a

customer-hired third party did it, or—critically—that HPE

applied the patch if HPE had the responsibility to do so. HPE

evades and the district court failed to acknowledge this third

scenario, which plainly goes to causation by HPE. 11

HPE further contends that Oracle cannot prove causation

because Hicks did not know who performed any patch

installations. Hicks, however, relied on the fact that HPE

supported the servers identified in HPE’s data and that

11

We reject Oracle’s assertion that Jensen’s testimony suffices to

award summary judgment for it. Although Oracle cross moved for

summary judgment on its infringement claims, we must view the

evidence in the light most favorable to HPE. At the very least, the

testimony creates a dispute of material fact.

ORACLE AMERICA V. HEWLETT PACKARD ENTER. 21

customers specifically paid HPE to support their Solaris

software to conclude that HPE made installations. We see

no reason why a reasonable jury could not rely on these same

circumstances. Viewing the evidence in the light most

favorable to Oracle, a reasonable jury could find that HPE

performed patch installations for direct customers. Thus,

summary judgment was improper on the direct infringement

claims concerning non-Symantec customers.

2. Symantec

Summary judgment for HPE on the direct infringement

claims concerning Symantec was also improper. The

testimony from HPE’s employees permitted the reasonable

inference that HPE installed a patch on an unsupported

Symantec server. Indeed, the court acknowledged that

testimony from HPE employees showed that HPE “had a

practice of . . . installing patches downloaded from and

delivered through Terix for Symantec’s off-contract

servers.” Because Oracle may prove infringement

circumstantially, Loomis, 836 F.3d at 994, Oracle did not

need to further show that a particular patch was installed on

a particular off-contract server to survive summary

judgment. 12

HPE also argues that the district court held that Oracle

did not show that any patch delivered to Symantec was

protectable. If true, Oracle could not press infringement

claims for such patches. Seven Arts, 733 F.3d at 1254

(observing that “ownership of a valid copyright” is a “basic

12

HPE argues that “many” Symantec servers ran older versions of

Solaris that are not at issue and that Symantec also asked HPE to install

patches received from Terix onto servers covered by Oracle support

contracts. This would not preclude the reasonable inference that HPE

performed an unauthorized patch installation.

22 ORACLE AMERICA V. HEWLETT PACKARD ENTER.

element” of infringement) (citation omitted). The district

court, however, does not appear to have granted summary

judgment for HPE on this basis, but instead to have merely

acknowledged HPE’s argument. Although we may affirm

on any ground supported by the record, Johnson v. Riverside

Healthcare Sys., LP, 534 F.3d 1116, 1121 (9th Cir. 2008),

the record supplied by the parties is insufficient for us do so.

We have no obligation to mine the extensive district court

record, and we decline to do so here. See In re Oracle Corp.

Sec. Litig., 627 F.3d 376, 386 (9th Cir. 2010) (“It behooves

litigants, particularly in a case with a record of this

magnitude, to resist the temptation to treat judges as if they

were pigs sniffing for truffles.”). The district court may

revisit and clarify this issue on remand.

CONCLUSION

We affirm the partial summary judgment for HPE on the

copyright infringement and IIPEA claims as time-barred.

We affirm in part summary judgment on the indirect

infringement claims for patch installations by Terix. We

reverse summary judgment on all infringement claims for

pre-installation conduct, and on the direct infringement

claims for unauthorized patch installations by HPE.

AFFIRMED IN PART, REVERSED AND

VACATED IN PART, and REMANDED. EACH

PARTY SHALL BEAR ITS OWN COSTS.