Background
NGINX began as web server software written by Igor Sysoev. The open source NGINX licence at nginx.org is a short BSD-style licence granting redistribution and use in source and binary forms with or without modification, subject to keeping the copyright notice and disclaimer.[1] NGINX, Inc. built a commercial product, NGINX Plus, on top of the open source server, and F5 acquired NGINX, Inc. in May 2019.[2]
In June 2020 Lynwood Investments CY Limited, a Cyprus holding company, sued F5 and twelve other defendants, including Sysoev, in the Northern District of California. According to F5’s counsel, Lynwood alleged that NGINX had been taken in 2011 from Sysoev’s former employer, the Russian media company Rambler Internet Holding LLC, which had assigned its purported rights to Lynwood in 2015; it asserted 26 causes of action and sought more than $750 million and the rights to NGINX.[2] That account comes from a law firm press release and is used here only for the procedural facts that the court record cited below does not state.
The timeline in the sources is short. Suit was filed in June 2020; selected claims were dismissed in March 2021; the amended complaint was dismissed with prejudice on 2022-08-16; appeals followed from both the dismissal and the fee awards; the panel heard argument on 2023-12-07 and decided on 2024-11-06.[2][3] The defendants named in the copyright count on appeal were six individuals, three NGINX entities and F5, and the memorandum records that the complaint adequately described each one’s role in copying and distributing the NGINX Plus code at issue.[3]
The dispute
The Ninth Circuit’s memorandum identifies the defining questions. Lynwood alleged a copyright interest in what it called “Pre-2012 NGINX Software”, defined as NGINX Plus and open source NGINX, in source and executable form, “conceived and/or developed before the end of 2011, when Sysoev left the employ of Rambler”.[3] The panel treated this as asserting copyright in three categories: open source NGINX, NGINX Plus “conceived” at Rambler, and NGINX Plus “developed” at Rambler.[3] Beyond copyright, the claims on appeal included breach of contract against Konovalov and Sysoev, a statutory claim under the Russian Civil Code, aiding and abetting claims against venture investors and F5 (count 8), tortious interference and fraud.[3]
At the district court, Judge Lucy Koh dismissed ten claims Lynwood selected for early resolution in March 2021, and on 2022-08-16 Judge Maxine Chesney dismissed the amended complaint with prejudice, finding claims failed under Rule 12(b)(6), were untimely, or both; on copyright she found that Lynwood had not identified which works were copied.[2] The district court also granted fee awards to defendants, which Lynwood appealed.[3]
Decision or outcome
A three-judge Ninth Circuit panel (Collins, Forrest and Sung) heard argument on 2023-12-07 and filed a not-for-publication memorandum on 2024-11-06, which is not precedent except as Ninth Circuit Rule 36-3 allows.[3] It affirmed in part, reversed in part and remanded.
Limitations. The panel agreed that California’s last-overt-act doctrine did not extend the limitation period for any claim, applying it claim by claim and finding no plausible conspiracy allegations as to counts 7 and 8, the aiding and abetting claims including the one against F5.[3] It also held that the discovery rule did not toll the claims: by 2014 at the latest Lynwood’s predecessor had reason to suspect wrongdoing, and the later whistleblower supplied details but not notice of the key facts.[3]
Copyright. The panel held that the complaint stated a viable copyright claim only for NGINX Plus code “developed” at Rambler. For open source NGINX, it held the claim implausible because the complaint did not allege that NGINX Plus exceeds the scope of the open source licence, and because the plaintiff “fails to identify any terms in the Open Source NGINX license that Defendants violated by developing NGINX Plus”; the plaintiff only vaguely asserted that Rambler did not license Sysoev to use the open source software commercially, without identifying a licence term barring commercial use.[3] For NGINX Plus merely “conceived” at Rambler, ideas are not copyrightable unless fixed in a tangible medium. For code developed at Rambler, ownership is governed by foreign (Russian) law and infringement by US law, the three-year limitation period did not begin before a “plain and express repudiation” of ownership, and the complaint adequately identified the code by proposing commit dates as a roadmap and did not use impermissible group pleading, including as to F5.[3]
Fees. Because the copyright dismissal was partly reversed, the panel vacated the fee award under 17 U.S.C. s.505 and ordered each side to bear its own appeal costs.[3] Judge Collins concurred in the copyright and fee rulings but dissented in part, would have revived additional contract and fraud claims about secret development of NGINX Plus code at Rambler, and agreed that the aiding and abetting claim against F5 should be dismissed on the merits.[3]
Significance for software licensing and SAM practice
For licensing practice the case is a reminder that the scope of an open source licence is read from its own terms. The panel did not treat commercial exploitation of open-source-derived commercial software as a breach of a BSD-style licence unless a licence term is identified that it violates.[3] It also shows that provenance questions can follow software through acquisitions. F5’s licensing documents continue to treat open source NGINX and subscription NGINX Plus as separately licensed products, the latter under a JWT subscription licence with usage reporting.[4] A memorandum disposition is not a precedent, the allegations are those of the plaintiff, and the remanded copyright claim had not been decided on its merits in the sources cited.
Lessons learned
- Identify the licence term. A claim that commercial software exceeds an open source licence must point to a term that is violated; the NGINX BSD-style licence, as the Ninth Circuit read the complaint, did not by itself restrict commercial use.[3]
- Provenance and employment terms matter. Rights in code written during employment can be disputed years later, under the law of the employment country, and inquiry notice can start limitation periods before the claimant has the full facts.[3]
- Identify the code. Ideas are not protected; claims need fixed, identifiable code, and the court accepted commit dates as a workable way to identify it at the pleading stage.[3]
- Diligence on acquisitions. An acquirer can be named in a dispute about the target’s origins, and early dismissals may be partly revived on appeal, so such disputes can run for years.[2]