Proofpoint, Inc. v. Vade Secure, Inc. was a lawsuit in the United States District Court for the Northern District of California between two email security vendors. Proofpoint and its subsidiary Cloudmark sued the email security company Vade and Olivier Lemarié, Vade’s chief technology officer and formerly Cloudmark’s Vice President of Gateway Technology. They claimed that Vade had misappropriated Cloudmark’s trade secrets under the Defend Trade Secrets Act and “used plaintiffs’ source code in violation of the Copyright Act”.[3] In 2021 a jury found for the plaintiffs, and judgment was entered against Vade for $13,495,659 in unjust enrichment.[6] The court refused exemplary damages, a permanent injunction and attorney’s fees, and the Ninth Circuit affirmed those rulings in 2024.[7]
Background
Cloudmark, which Proofpoint owns, and Vade each develop and market email security products.[1] Proofpoint still sells Cloudmark Authority, Cloudmark Safe Messaging Cloud and the Cloudmark Spam Reporting Service under its Product Terms.[9] The Cloudmark licence is unusual in Proofpoint’s portfolio because it lets service providers use the products for the benefit of their own end user customers.[9] For how those products are licensed today, see Proofpoint Product Terms and licence metrics.
According to the complaint as summarised by the court, Lemarié was involved in many aspects of Cloudmark’s technical development and had access to its technical documents and source code. He resigned from Cloudmark in November 2016 and became Vade’s chief technology officer in February 2017.[1] The asserted secrets were described as source code for Cloudmark’s mail transfer agent (MTA) and its anti-phishing solution, known internally as Trident, together with schematics and other technical and business information.[1] The case was filed on 2019-07-23.[8]
The dispute
Proofpoint and Cloudmark first sought a preliminary injunction to stop the defendants using Cloudmark’s trade secrets and to make them return the material. Judge Maxine M. Chesney denied it in February 2020. The record did not include evidence that “sufficiently identifies the claimed trade secrets”, so the plaintiffs had not shown a likelihood of success.[1]
At trial in 2021, the plaintiffs argued that Lemarié used knowledge of Cloudmark’s trade secrets and source code to build a spear-phishing detection module for Vade. They said Vade used the module in two products it began selling in 2018, Vade for O365 and Content Filter, and later replaced it with a module built by a contractor from specifications that also drew on the trade secrets.[3] They asked the jury for $46,579,641, based on Vade’s revenue from the products said to infringe.[3]
Decision or outcome
Verdict. On 2021-08-20 the jury found that 19 of the 20 asserted items were trade secrets and that Vade had misappropriated 15 of them, willfully and maliciously. It found that Lemarié had misappropriated 14, but not willfully and maliciously. It found no actual loss to the plaintiffs, but unjust enrichment of Vade of $13,495,659, and $480,000 against Lemarié for breach of his Cloudmark employment agreement. “Lastly, the jury found Vade and Lemarié infringed one or more of plaintiffs’ copyrights.”[3]
Post-trial rulings. In November 2021 the court denied the plaintiffs’ motion for exemplary damages for the willful misappropriation.[2] In December 2022 it denied a permanent injunction, because the plaintiffs “failed to demonstrate continuing use” of the trade secrets by Vade. It did grant a final disposition order against Vade covering the copyrighted material, and told the parties to agree a proposal for its disposition.[3]
Judgment. The clerk entered judgment on 2023-01-27 for $13,495,659 jointly and severally against all defendants and $480,000 against Lemarié.[4] In July 2023 the court corrected it. Only the Vade companies were liable for the unjust enrichment award, and there was no evidence for the $480,000 contract award against Lemarié.[5] The amended judgment awarded $13,495,659 against Vade Secure, Incorporated and Vade Secure SASU and $1.00 against Lemarié.[6]
Appeal. Proofpoint and Cloudmark appealed the denials of a jury trial on exemplary damages, an adverse-inference instruction, an injunction and attorney’s fees. The Ninth Circuit affirmed on 2024-08-30. It held that unjust enrichment based on disgorgement of profits is an equitable remedy, so any error about a jury trial on exemplary damages was harmless. It also held that the district court “reasonably concluded that Plaintiffs failed to demonstrate an irreparable injury”, and that willful and malicious misappropriation did not require an award of fees.[7] The mandate issued on 2024-11-05.[8]
Significance for software licensing and SAM practice
The case is about intellectual property in security software, not about customer licence compliance. It shows that a vendor’s source code and design documents can be protected at once as trade secrets and as copyright works, and that a jury can measure the harm by the competitor’s profits from the products built on them.[3] It also shows the limits of such a claim. The plaintiffs did not get a preliminary injunction without precisely identified secrets, and they did not get a permanent injunction without proof that the secrets were still in use.[1][3] Vade’s customers were not parties, and no court order required them to stop using Vade’s products.[3]
Lessons learned
- Code is protected twice. Source code and design documents can be enforced as trade secrets and as copyright works at the same time. Here the jury found both misappropriation and copyright infringement.[3] Organisations that hire engineers from a software vendor should keep that vendor’s code and documents out of their own development.
- Identify the secret precisely. The preliminary injunction failed because the record did not “sufficiently identif[y] the claimed trade secrets”.[1] The same discipline applies when a licensee claims confidentiality over its own data in a licence dispute.
- Damages and injunctions are separate questions. A money award for past unjust enrichment did not lead to an injunction against Vade’s products. The court required evidence of continuing use, and the Ninth Circuit upheld that approach.[3][7]
- Watch for orders that reach the product you run. Customers were not parties here, but the court did order disposition of the copyrighted material held by Vade.[3] When a supplier loses an IP case, check whether any order affects the versions or modules you have deployed.