CoStar v. Field is a lawsuit in the United States District Court for the District of Maryland over access to CoStar’s commercial real estate database, a subscription service licensed to named authorised users. CoStar sued a subscriber, Mark Field (trading as Alliance Valuation Group), and third parties who had used Alliance’s logins. The court held that those users were bound by CoStar’s click-through Terms of Use, found breach of contract and copyright infringement, and after a bench trial measured contract damages by the subscription fees the users would have paid for CoStar’s minimum one-year terms.[2][3]
Background
CoStar licensed access to its database to authorised users under individually negotiated licence agreements and charged a subscription fee. Each authorised user received a username and passcode for use on a single computer, and CoStar recorded the IP address of every login. Its Terms of Use, which users had to accept on first login and at intervals afterwards, defined an authorised user as an employee or independent contractor of a CoStar customer who was listed under a licence agreement, and prohibited sharing logins or giving access to unauthorised users.[2]
Alliance’s licence agreement listed as authorised users people who were not its employees or contractors. Russell Gressett, a Houston broker and appraiser, bought access from Alliance for his own business and in turn gave his login to other companies for fees. Brad Christensen, president of Pathfinder Mortgage Company, had been listed as an Alliance user; after CoStar terminated his account in 2005, logins from Pathfinder’s IP addresses continued through Field’s account until 2008.[2]
The dispute
CoStar filed suit on 2008-03-13 for breach of contract, copyright infringement, fraud and violation of the Computer Fraud and Abuse Act (CFAA).[3] On 2009-03-31 the court held that defendants who accepted the Terms of Use had consented to the forum selection clause in them, so the Maryland court had jurisdiction, and it refused to dismiss the copyright and CFAA counts.[1]
Decision or outcome
In its summary judgment opinion of 2010-08-23 the court entered default judgment against Field for failing to take part in discovery. It held that a third party who uses a contracting party’s online account is bound by the same user agreement even without clicking “agree” itself, and granted CoStar summary judgment against Gressett for breach of contract, rejecting his defences of ratification and waiver. It allowed the direct copyright claims to go to trial on the basis that viewing copyrighted photographs creates copies in computer memory, but dismissed the CFAA claims because lost licence fees were not a “loss” under the statute unless caused by an interruption of service.[2]
After a bench trial on 2010-10-28, the court found on 2010-12-20 that Gressett and Pathfinder had directly infringed CoStar’s copyrights, though not wilfully, and that Pathfinder had breached the Terms of Use by accessing CoStar as an unauthorised user.[3] It measured contract damages by CoStar’s expectation interest: the monthly list rate for CoStar’s national COMPS service multiplied by whole years, because “CoStar licenses for year-long commitments” and its minimum licence term was one year. Gressett’s own access over 47 months was valued at 48 months at $2,500, and the court added the fees each company using his login would have paid, totalling $683,280; Pathfinder’s 26 months of access was valued at 36 months at $12,170, or $438,120.[3] For copyright, CoStar could elect between actual damages equal to those fees or statutory damages of $3,000 per work infringed.[3]
Significance for software licensing and SAM practice
The case shows how a vendor of a subscription service with named authorised users can enforce the user count against both the subscriber and those who use shared logins. The court relied on login and IP address records to rebuild usage over several years, held non-signatory users to click-through terms, and priced unlicensed use at list rates rounded up to the vendor’s minimum term.[2][3] The general licence concepts are covered in Software license and License compliance.
Lessons learned
- Shared credentials are unlicensed users. Gressett admitted sharing his login with third parties, which the court called a clear breach of the prohibition on sharing login information and on use by unauthorised users.[2]
- Click-through terms bind the people who use the account. The court held that a third party using a contracting party’s online account is bound by the same user agreement, and that accepting the Terms of Use also meant accepting their forum selection clause.[1][2]
- Minimum terms shape the damages. Because CoStar licensed only for year-long commitments, 26 months of use was charged as 36 months and 47 months as 48.[3]
- Usage logs outlast the subscription. CoStar matched logins to IP addresses, including simultaneous sessions from different offices, to show who was using each account.[2]