Elasticsearch v. floragunn was a copyright case in the Northern District of California between Elastic, the developer of Elasticsearch and Kibana, and floragunn GmbH, a Berlin company that sold Search Guard, a security plugin for Elasticsearch and Kibana. Elastic alleged that floragunn had copied code from Elastic’s X-Pack security features, whose source Elastic had published in 2018 under the “Elastic License”, into Search Guard, and that users and services distributing Search Guard infringed as a result.[1] The case settled in 2022 without a ruling on the merits; Amazon.com, Inc. and Amazon Web Services, Inc., which were not parties, also signed the settlement agreement.[6]
Background
According to Elastic’s amended complaint, X-Pack was a set of add-on features for the Elastic Stack, including security, alerting, monitoring and reporting, whose predecessor was called Shield. In late April 2018 Elastic opened the source code of X-Pack version 6.2.x on GitHub “pursuant to the ‘Elastic License’”, and Elastic alleged that this licence did not grant anyone the right to create copies or prepare derivative works “for use in any production capacity”. Elastic also alleged that any rights floragunn had acquired under the licence terminated automatically on breach.[1]
Search Guard was offered as a free Community Edition for certain uses and as paid Enterprise and Compliance editions, and floragunn published its source under several licence agreements.[1]
The dispute
Elastic filed suit on 2019-09-04 and amended its complaint on 2019-11-26, claiming copyright infringement and contributory infringement.[8] It alleged that on 2018-06-07, just over a month after X-Pack’s source was opened, floragunn committed a large change to Search Guard that copied the document level security methods getLiveDocs and numDocs from X-Pack’s DocumentSubsetReader.java, and it set the two implementations side by side in the complaint. It further alleged copying back to at least 2015 from code Elastic had released only in binary form, which would have required decompilation. On contributory infringement, Elastic named the Amazon Elasticsearch Service, Open Distro for Elasticsearch, Rackspace’s ObjectRocket for Elasticsearch and IBM’s Cloud Databases for Elasticsearch as including infringing code.[1]
floragunn denied infringement and counterclaimed for a declaratory judgment of non-infringement. It argued that Elasticsearch, Kibana and Shield are built on code not original to Elastic, such as Lucene, Netty, AngularJS, Lodash and Node.js, that much of the code at issue was dictated by the need to work as a plugin, and that Elastic had kept Apache 2.0 licensed code and Elastic licensed code in the same GitHub repository, which floragunn said caused confusion over which licence applied to which files.[2]
On 2020-10-26 Elastic filed a second action asserting additional X-Pack copyrights it had since registered, and the court consolidated it with the first case on 2020-11-05.[3][8] By then Elastic alleged that nineteen code segments in Search Guard infringed its copyrights. In January 2022 the magistrate judge denied Elastic’s motion for issue sanctions over floragunn’s failure to produce its former chief technology officer for deposition.[4]
Decision or outcome
There was no judgment on the merits. On 2022-05-11 the court noted that the action had settled in principle, vacated all trial dates and denied the remaining motions as moot.[5] In a joint statement of 2022-09-02 the parties reported that Elastic, floragunn and nonparties Amazon.com, Inc. and Amazon Web Services, Inc. had executed a settlement agreement.[6] The parties stipulated on 2022-09-15 to dismiss both actions and all claims, counterclaims and defences with prejudice, each bearing its own fees and costs.[7] The settlement terms were not filed.
Significance for software licensing and SAM practice
The case is an example of a vendor relying on a source-available licence to restrict reuse of published code. The court did not decide what the Elastic License permitted, so the case is not authority on its meaning, but the pleadings show how the dispute arose: code that could be read on GitHub was alleged to have been copied into a competing commercial product and then into cloud services built on it.[1] Elastic’s current distribution and source licences are described in Elastic licensing.
Lessons learned
- Visible source is not open source. Elastic’s claim rested on the allegation that the Elastic License allowed inspection and contribution but not production use of copies or derivative works.[1] Before engineers reuse code from a vendor’s public repository, check the licence that applies to it.
- Third-party add-ons can carry risk to their users. Elastic’s contributory infringement claim was directed at the plugin vendor, but its complaint named cloud services that included the plugin and said Elastic might seek to add third-party users as defendants.[1] Record the provenance of plugins in the software inventory.
- Mixed-licence repositories need file-level review. floragunn’s pleading argued that keeping Apache 2.0 and Elastic licensed files in one repository made it hard to tell which licence applied.[2] Open-source scanning should report licences per file and per directory, not only per project.