Epic Systems Corp. v. Attachmate Corp. was a 2015 to 2016 lawsuit in the United States District Court for the Western District of Wisconsin between Epic Systems, a healthcare records software company, and Attachmate, the publisher of the Reflection terminal emulation products. Epic sued for a declaration that its use of Attachmate software did not breach the licences or infringe copyright after an audit accused it of widespread unauthorised use. Attachmate counterclaimed for breach of contract and copyright infringement.[1] The court’s rulings on what counts as licensed “use”, and on how damages for unlicensed use should be measured, are among the more detailed published treatments of an audit claim. The case settled before trial.[3]
Background
From 2011 Epic used terminal emulation software so that employees of its hospital and healthcare customers could train on Epic’s software, both on site in Wisconsin and remotely through Epic’s extranet. After discussions with Attachmate, Epic chose Reflection for Unix and OpenVMS version 14.0 (“RUO v. 14.0”). According to the court’s account of the undisputed facts, Epic wanted concurrent licences, but Attachmate’s representative said RUO v. 14.0 was not licensed on a concurrent basis, so Epic bought device-based licences: 10,930 of them between March 2011 and March 2014, for computers at its training centre. Epic also installed RUO v. 14.0 on about 50 servers that provided extranet access. For remote trainees Epic bought concurrent licences for Reflection for the Web (RWeb), which Attachmate did license concurrently.[1]
At some point Attachmate began licensing RUO v. 14.0 concurrently. When Epic noticed in March 2014, it exchanged its 400 concurrent RWeb licences for 400 concurrent RUO v. 14.0 licences and was charged about USD 95,000.[1]
The dispute
In late 2014 Attachmate retained Deloitte & Touche to audit Epic’s compliance. The audit reported that Epic had “over-deployed” the software: more than 190,000 individual users, essentially everyone with an Epic extranet account, had the ability to access RUO v. 14.0 through the extranet. It also reported RUO v. 14.1 on 22 devices and one copy of Extra! X-treme 9.3 without licences.[1] Attachmate demanded USD 66,000,000.[1]
Epic filed suit on 2015-03-19.[3] Besides the declaration, it claimed that the audit and accusations breached the implied duty of good faith and fair dealing under Washington law, which governed the licences, and that Attachmate’s sales representations violated the Wisconsin Deceptive Trade Practices Act.[1]
Decision or outcome
Summary judgment (2016-06-21)
District Judge Barbara B. Crabb granted Epic’s motion in part and denied Attachmate’s motion.[1]
- “Use” means actual use. The RUO v. 14.0 licence defined the software as “used” when it is “installed or loaded in the temporary or permanent memory of a computer or otherwise accessed”, and the product use rights required a desktop licence “for each single computer on which [it] is ‘used’”. The court was “not persuaded” that Epic needed a licence for each individual who could, rather than did, access the program. Attachmate had to show that extranet users actually accessed the software from unlicensed devices. How many did so was left for trial, as was whether the parties had agreed that the RWeb concurrent licences covered RUO v. 14.0.[1]
- No “rental”. Customers’ trainees used the software only incidentally to Epic’s training software and did not pay for it, so their access was not renting or leasing it. That part of Attachmate’s claim was dismissed.[1]
- Concurrent licences cover actual peaks. The concurrent licence model required enough licences for the users who actually accessed the software at the same time, not for all 190,000 who theoretically could. Whether Epic had properly met its duty to “monitor, control, and (on request …) report on concurrent usage”, and its safeguard and record-keeping duties, was a fact question because the agreement did not say how those duties were to be performed.[1]
- Versions and evaluation copies. Whether the RUO v. 14.0 licences also covered the 22 installations of version 14.1, and whether the Extra! copy was a permitted evaluation version, were left for trial.[1]
- Copyright. Merely accessing the program through the extranet did not infringe, but installing it on extranet servers could, if the licences authorised installation only on desktops and devices.[1]
- Good faith in the audit. A reasonable jury could find that Attachmate breached the duty of good faith “by allowing plaintiff to engage in a particular type of use not explicitly authorized under the licensing agreement so that defendant could later audit plaintiff and demand exorbitant licensing fees”. The deceptive practices claim, based on what the sales representative said in 2011 about the scope of the RWeb licences, also went to trial.[1]
The court also called Attachmate’s damages method “dubious”: recovery, if any, would be based on individuals who actually accessed the software without a licence.[1]
Damages standard (2016-07-08)
Ruling on Attachmate’s motion to exclude Epic’s damages expert, the court held that damages for both the copyright and the contract claims should be measured by the “fair market value” of the unauthorised use: the price a willing buyer and willing seller would have agreed in a hypothetical negotiation before the use began. It rejected Attachmate’s premise that the licence required device-based licences, because the same product use rights also provided for concurrent licences, so a licensee had to buy one type or the other. Past device-based prices were relevant but not conclusive. The court treated as relevant evidence that Epic’s Citrix licences capped concurrent remote users at 2,325, and that the list price of a device licence was USD 305 while Epic had paid a discounted USD 118.[2]
Settlement
On 2016-07-22 the court cancelled the trial set for 2016-07-25 “[i]n light of the reported settlement”. It entered its standard order of dismissal on 2016-07-25, and the parties filed a stipulation of dismissal on 2016-07-29. The terms are not in the public record.[3]
Significance for software licensing and SAM practice
The rulings are trial-court decisions on one set of Attachmate terms and bind no other court. They are useful because they test a common audit approach, counting every user who could reach the software, against the licence wording:
- Potential versus actual use. Where a licence defines use as installation, loading or access, the vendor must prove actual access. A count of accounts with the ability to connect is not proof of use.[1]
- Concurrent metrics. Under a concurrent model the licence position is measured against peak simultaneous use, which makes monitoring data central evidence.[1] See concurrent and device licensing.
- Valuing a shortfall. The court looked to what the parties would have agreed for the actual use, not automatically to list price for the most expensive metric.[2]
- Audit conduct. The duty of good faith can apply to how a vendor uses its audit rights where it knew of and tolerated a use it later claims was unlicensed.[1]
See software licence audit for the audit process.
Lessons learned
- Read the licence definition of “use”: here it meant actual installation or access, so users who merely could reach the software did not need licences. The court required Attachmate to show that extranet users actually accessed the program from unlicensed devices.[1]
- A concurrent-use licence needs enough licences for actual peak concurrent use, not for every user who could connect. Epic did not need 190,000 concurrent licences because 190,000 people could theoretically connect at once.[1]
- Keep monitoring and usage records that match the licence’s monitoring and reporting duties, because vague duties become trial issues. Whether Epic’s safeguards, records and concurrency monitoring were adequate could not be decided without a trial.[1]
- Record in writing what the sales team says a licence covers; oral assurances become a credibility contest. The court called the dispute over what the representative said in 2011 “simply a swearing contest” for a jury.[1]
- Installing software on servers can need its own entitlement even when the end devices are licensed. The court held that installing copies on extranet servers without authorisation for that type of installation could be infringement.[1]