FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

ORACLE INTERNATIONAL No. 23-16038

CORPORATION; ORACLE

AMERICA, INC., D.C. No. 2:14-cv-01699- Plaintiffs-counter- MMD-DJA defendants-Appellees,

v. OPINION

RIMINI STREET, INC.; SETH

RAVIN,

Defendants-counter- claimants-Appellants.

Appeal from the United States District Court for the District of Nevada Miranda M. Du, Chief District Judge, Presiding Argued and Submitted June 5, 2024 San Francisco, California Filed December 16, 2024

Before: Jay S. Bybee and Patrick J. Bumatay, Circuit Judges, and Richard D. Bennett, * District Judge.

* The Honorable Richard D. Bennett, United States District Judge for the District of Maryland, sitting by designation. 2 ORACLE INT’L CORP. V. RIMINI ST., INC.

Opinion by Judge Bumatay; Partial Dissent by Judge Bybee

SUMMARY **

Copyright Law

In an action brought by software developer Oracle International Corporation against Rimini Street, Inc., under the Copyright Act and the Lanham Act, the panel vacated in part the district court’s permanent injunction against Rimini, a third-party provider and direct competitor with Oracle in the software support services market. After the district court found that Rimini infringed on Oracle’s copyrights, Rimini changed aspects of its business model and sought a declaratory judgment that its revised process did not infringe Oracle’s copyrights. Oracle counterclaimed for copyright infringement and violations of the Lanham Act. Following a bench trial, the district court entered a permanent injunction ordering Rimini to (1) delete various software files, and (2) issue a press release correcting alleged misstatements and prohibiting Rimini from making similar statements about its services again. The panel vacated the district court’s holding that Rimini created infringing derivative works based solely on Rimini’s programs’ interoperability with Oracle’s programs. The panel explained that a derivative work must actually

** This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.

ORACLE INT’L CORP. V. RIMINI ST., INC. 3

incorporate Oracle’s copyrighted work, either literally or nonliterally. The panel instructed that if the district court concludes on remand that Rimini created an infringing derivative work under the correct legal standard, the district court should then consider whether any of Oracle’s licensing agreements authorized the creation of the specific work. The panel vacated the district court’s ruling striking Rimini’s affirmative defense to copyright infringement under 17 U.S.C. § 117(a), which allows the owner of a copy of a computer program to make another copy for certain purposes, such as when it’s an essential step in using the program. The panel explained that the district court’s ruling seemingly relied only on the labeling of the agreements between Oracle and its customers as a “license,” but that is only one facet of a number of incidents of ownership. The panel vacated the district court’s ruling that Rimini’s creation of 18 “gap customer” environments on its systems containing Oracle’s Database program infringed Oracle’s copyright, because the plain language of the licensing agreement did not prohibit third-party support providers from possessing a copy of Oracle’s software to further a client’s internal business operations. The panel vacated the district court’s ruling that Rimini’s use of automated tools to deliver PeopleSoft program updates from one client to another constituted copyright infringement, to the extent that conclusion rested on the district court’s erroneous view of “derivative work.” The panel also vacated the district court’s ruling that the outright delivery of PeopleSoft updates to clients without further testing in the clients’ environments constituted copyright infringement, for the same reason. The panel instructed the 4 ORACLE INT’L CORP. V. RIMINI ST., INC.

district court to apply the correct legal standard for “derivative work” on remand. The panel reversed the district court’s ruling that Rimini’s security-related statements constitute false advertising under the Lanham Act, except for a statement about “holistic security.” Some of the statements were about the relative security of services offered by Oracle and Rimini, which the panel held were puffery. Some of the statements were about the need for software patching, which the panel could not say were so specific and measurable as to become actionable under the Lanham Act. However, the panel affirmed the district court’s unrefuted finding that Rimini’s offer of holistic security, which the panel accepted to mean multi-layered security protection, was false because Rimini does not offer multi-level security. The panel vacated the injunction as it pertains to the non-actionable statements. Because the panel vacated much of the district court’s ruling, the panel also vacated the portions of the injunction appealed by Rimini, and denied Rimini’s motion to stay enforcement of the permanent injunction as moot. Dissenting in part, Judge Bybee disagreed with the majority’s conclusion that one of Rimini’s statements— “Oracle’s [Critical Patch Updates] provide little or no value to customers and are no longer relevant”—is puffery. Judge Bybee explained that the phrases “little or no value” and “no longer relevant” are absolute characteristics that can be falsified, as opposed to generalized statements of comparison. He would affirm the district court’s finding that this statement is actionable.

ORACLE INT’L CORP. V. RIMINI ST., INC. 5

COUNSEL

Raechel K. Kummer (argued) and David B. Salmons, Morgan Lewis & Bockius LLP, Washington, D.C.; Zachary Hill, Lindsey M. Shinn, and Benjamin P. Smith, Morgan Lewis & Bockius LLP, San Francisco, California; Corey R. Houmand, Morgan Lewis & Bockius LLP, Palo Alto, California; Dorian E. Daley, Oracle Corporation, Redwood City, California; Karen L. Dunn and William A. Isaacson, Paul Weiss Rifkind Wharton & Garrison LLP, Washington, D.C.; Richard J. Pocker, Boies Schiller & Flexner LLP, Las Vegas, Nevada; for Plaintiffs-counter-defendants- Appellees. Mark A. Perry (argued), Weil Gotshal & Manges LLP, Washington, D.C.; Jeremy M. Christiansen, Gibson Dunn & Crutcher LLP, Washington, D.C.; Blaine H. Evanson and Jeffrey T. Thomas, Gibson Dunn & Crutcher LLP, Irvine, California; Joseph A. Gorman, Gibson Dunn & Crutcher LLP, San Francisco, California; Samuel G. Liversidge, Casey J. McCracken, Ilissa S. Samplin, and Eric D. Vandevelde, Gibson Dunn & Crutcher LLP, Los Angeles, California; Defendants-counter-claimants-Appellants. Corynne McSherry, Electronic Frontier Foundation, San Francisco, California, for Amici Curiae Electronic Frontier Foundation, Computer & Communications Industry Association, Foundation for American Innovation, Public Knowledge, Engine Advocacy, Mozilla Corporation, U.S. PIRG Education Fund, Digital Right to Repair Coalition, iFixit, and Creative Commons. Philip H. Cohen, Greenberg Traurig LLP, New York, New York, for Amici Curiae Glynn S. Lunney, Jr. and Betsy Rosenblatt. 6 ORACLE INT’L CORP. V. RIMINI ST., INC.

OPINION

BUMATAY, Circuit Judge:

For over a decade, Oracle International Corporation and Rimini Street, Inc., have waged a pitched copyright war. This dispute has been fought up and down all levels of the federal judiciary. This appeal is the latest battle. At issue is Rimini’s ability to service its clients who use Oracle’s software programs. Past rulings have determined that Rimini’s processes infringe on Oracle’s copyrights—at least in part. Those rulings ordered Rimini to halt this infringement. In response, Rimini developed new processes for servicing its Oracle-using clients. After a bench trial, the district court ruled that many of these new processes still infringe Oracle’s copyrights and issued a permanent injunction against Rimini’s infringement. On appeal, Rimini raises a host of issues. It claims that the district court erred by (1) applying the wrong definition of “derivative work” under 17 U.S.C. § 101; (2) striking Rimini’s affirmative defense under 17 U.S.C. § 117(a); (3) incorrectly construing licenses for two Oracle software programs; (4) misapplying the Lanham Act to its security- related statements; and (5) ordering an impermissibly overbroad injunction. We vacate in part, reverse in part, and remand for further proceedings consistent with this opinion. I. Background Oracle develops software programs for businesses and other organizations. These programs help manage day-to-

ORACLE INT’L CORP. V. RIMINI ST., INC. 7

day business functions—things like financials, human resources, procurement, project and risk management, and supply chain operations. One of Oracle’s products is PeopleSoft. PeopleSoft is a flexible tool; it can be customized to manage all sorts of business processes. Some use it to manage HR processes, like timekeeping, benefits administration, and recruitment. Others use it to manage financial processes, like expense tracking and payroll. Some use it for both and more. Oracle also provides optional software support for PeopleSoft. For those using its support services, Oracle provides PeopleSoft updates to reflect changes to tax laws and other regulations. But customers need not use Oracle’s support program to stay up-to-date; customers can also modify and customize the software themselves or through third-party providers. Rimini Street is a third-party provider and direct competitor with Oracle in the support-services market. It offers various products, including troubleshooting support and software updates. When troubleshooting Oracle programs or creating updates for its clients, Rimini uses Oracle’s products and creates files that only work with Oracle’s products. Oracle first sued Rimini for copyright infringement in 2010. Rimini was found to have infringed Oracle’s copyrights in its PeopleSoft, Database, and other programs by engaging in “cross-use” and creating copies of Oracle’s materials on Rimini’s computer systems. The district court entered a permanent injunction against Rimini, which we largely affirmed. See Oracle USA, Inc. v. Rimini St., Inc., 879 F.3d 948 (9th Cir. 2018); Oracle USA, Inc. v. Rimini St., Inc., 783 F. App’x 707 (9th Cir. 2019). The district court later found that Rimini violated the injunction and held it in contempt on five issues, four of which we upheld on appeal. 8 ORACLE INT’L CORP. V. RIMINI ST., INC.

Oracle USA, Inc. v. Rimini St., Inc., 81 F.4th 843 (9th Cir. 2023). After the finding of infringement, Rimini changed aspects of its business model and sought declaratory judgment that its revised process, called “Process 2.0,” did not infringe Oracle’s copyrights. Oracle counterclaimed for copyright infringement and violations of the Lanham Act, seeking more than one billion dollars in damages. At the pleadings stage, the district court struck Rimini’s affirmative defense to copyright infringement under § 117(a). At summary judgment, the district court held that Rimini had infringed Oracle’s PeopleSoft copyrights by engaging in cross-use prohibited by PeopleSoft license agreements. Rimini St., Inc. v. Oracle Int’l Corp., 473 F. Supp. 3d 1158, 1181–213 (D. Nev. 2020). The district court also held that the update created for the City of Eugene’s PeopleSoft software environment was a “derivative work.” Id. at 1209–12. After Oracle abandoned its claims for monetary relief on the eve of trial, the case proceeded to a bench trial solely on declaratory and equitable relief. The district court ruled that Rimini (1) created infringing derivative works, (2) violated Oracle’s PeopleSoft and Database licensing agreements, and (3) made several statements violating the Lanham Act. See Oracle Int’l Corp. v. Rimini St., Inc., No. 2:14-cv-1699, 2023 WL 4706127, at *1 (D. Nev. July 24, 2023). The district court then entered a permanent injunction against Rimini, ordering it to delete various software files. The district court also ordered Rimini to issue a press release correcting the alleged misstatements and prohibited Rimini from making similar statements about its services again.

ORACLE INT’L CORP. V. RIMINI ST., INC. 9

Rimini moved to stay the enforcement of the permanent injunction pending appeal. The district court denied that motion. Oracle Int’l Corp. v. Rimini St., Inc., No. 2:14-cv- 1699, 2023 WL 5221947, at *6 (D. Nev. Aug. 15, 2023). It granted, however, a temporary administrative stay to allow this court to consider the stay factors. Id. at *5–6. Rimini also moved to stay the permanent injunction in this court. That motion remains pending. Our review of legal questions and contract interpretation is de novo. Desire, LLC v. Manna Textiles, Inc., 986 F.3d 1253, 1259 (9th Cir. 2021); MDY Indus., LLC v. Blizzard Ent., Inc., 629 F.3d 928, 937–38, 955 (9th Cir. 2010). We review factual findings underlying an injunction for clear error, and the grant of a permanent injunction and its scope for abuse of discretion. Columbia Pictures Indus., Inc. v. Fung, 710 F.3d 1020, 1030 (9th Cir. 2013). Oracle bears the burden of proving copyright infringement. Petrella v. Metro-Goldwyn-Mayer, Inc., 572 U.S. 663, 683 (2014).

II.

A. Derivative Works A copyright owner has the exclusive right to prohibit or authorize the preparation of derivative works. 17 U.S.C. § 106(2). The district court held Rimini-written files and updates developed during the “Process 2.0” period were infringing derivative works because they “only interact[] and [are] useable with” Oracle software. Oracle Int’l Corp., 2023 WL 4706127, at *66. In effect, the district court adopted an “interoperability” test for derivative works—if a product can only interoperate with a preexisting copyrighted work, then it must be derivative. But neither the text of the 10 ORACLE INT’L CORP. V. RIMINI ST., INC.

Copyright Act nor our precedent supports this interoperability test for derivative works. The Copyright Act defines a “derivative work” as:

a work based upon one or more preexisting works, such as a translation, musical arrangement, dramatization, fictionalization, motion picture version, sound recording, art reproduction, abridgment, condensation, or any other form in which a work may be recast, transformed, or adapted.

17 U.S.C. § 101. While the Copyright Act uses broad language to describe derivative works, there are limits to its scope. After all, almost every work “borrows and must necessarily borrow” from other works and uses what was “well known and used before.” Micro Star v. Formgen Inc., 154 F.3d 1107, 1110 (9th Cir. 1998); see also 1 Nimmer on Copyright § 3.01 (2024) (“In a broad sense, almost all works are derivative works in that in some degree they are derived from pre- existing works.”). So focusing only on whether a work is “based upon” a preexisting work would make the derivative- works definition “hopelessly overbroad.” Micro Star, 154 F.3d at 1110. Luckily, Congress provided several textual clues limiting its definition. First, Congress gave examples of work “based upon” preexisting work—things “such as” translations, movie adaptations, and reproductions. 17 U.S.C. § 101. And so “derivative work” must have a meaning related to those examples. While the term “such as” means the list of examples isn’t exhaustive, Congress provides the kind of

ORACLE INT’L CORP. V. RIMINI ST., INC. 11

works that fall into the derivative-work category. See Easom v. US Well Servs., Inc., 37 F.4th 238, 243 (5th Cir. 2022) (holding that a statute listing examples “such as” “floods, earthquakes, and droughts” limited the term “natural disaster” to disasters of the “same kind”). So to be “based upon” another work requires copying of the kind exhibited in translations, movie adaptations, and reproductions. Mere interoperability isn’t enough. Next, we have the canon of noscitur a sociis, which means we define a term by “the company it keeps.” Yates v. United States, 574 U.S. 528, 543 (2015). We use this canon when “a word is capable of many meanings in order to avoid the giving of unintended breadth to the Acts of Congress.” Dubin v. United States, 599 U.S. 110, 124–25 (2023) (simplified). The effect of the canon is to “limit a general term to a subset of all the things or actions that it covers.” Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 196 (2012). So when “several items in a list share an attribute,” it favors “interpreting the other items as possessing that attribute as well.” Beecham v. United States, 511 U.S. 368, 371 (1994). Here, “[t]he examples of derivative works provided by the Act all physically incorporate the underlying work or works.” Lewis Galoob Toys, Inc. v. Nintendo of Am., Inc., 964 F.2d 965, 967 (9th Cir. 1992). Take a “translation.” Translating a novel from English incorporates the original expression of the novel in a new language. A motion picture takes elements of the novel’s original expression and incorporates them into an audio-visual experience. The same goes for an abridgment—it incorporates the novel’s original expression into a condensed version. Thus, Congress’s list of examples suggests that a “derivative work” must be in the subset of works substantially incorporating 12 ORACLE INT’L CORP. V. RIMINI ST., INC.

the preexisting work. Once again, whether a work is interoperable with another work doesn’t tell us if it substantially incorporates the other work. Based on this textual analysis, we’ve said that “a work is not derivative unless it has been substantially copied from the prior work.” Litchfield v. Spielberg, 736 F.2d 1352, 1357 (9th Cir. 1984); see also 1 Nimmer on Copyright § 3.01 (2024) (“A work is not derivative unless it has substantially copied from a prior work.”). And we have held that “[a] derivative work must incorporate a protected work in some concrete or permanent ‘form.’” Lewis Galoob Toys, Inc., 964 F.2d at 967. To be sure, the incorporation of a preexisting work can take several forms. First, the incorporation can be “literal.” See Best Carpet Values, Inc. v. Google, LLC, 90 F.4th 962, 971 (9th Cir. 2024) (holding that a website’s source code is a “copyrightable literal element[]”). So copying substantial portions of PeopleSoft’s copyrighted code outright would be an example of literal incorporation. Second, the incorporation can be nonliteral, such as copying the “total concept and feel” of a preexisting work. Litchfield, 736 F.2d at 1357; see also SAS Inst., Inc. v. World Programming Ltd., 64 F.4th 1319, 1326 (Fed. Cir. 2023) (stating that the nonliteral elements of a computer program “include the program architecture, structure, sequence and organization, operational modules, and user interface”). Take the case of Duke Nukem 3D, a popular video game. A third-party distributor sold software that continued the video game’s story by creating extra levels of gameplay. Micro Star, 154 F.3d at 1109. The third-party distributor argued its product was not a copyright infringement because it didn’t incorporate any of Duke Nukem’s protected expression. Id.

ORACLE INT’L CORP. V. RIMINI ST., INC. 13

at 1112. As a technical matter, the distributor explained that its product “reference[d]” Duke Nukem’s “source art library” but did “not actually contain any art files.” Id. We held that these new Duke Nukem levels were derivative works because they copied the video game’s “story itself,” including the “plot, theme, dialogue, mood, setting, characters, etc.” Id. We likened the extra game levels to a book version of the game that recasts the central character even though it doesn’t copy pictures or code of the game. Id. Here, we’re mostly concerned with nonliteral copying. Although the district court found several examples of Rimini literally copying Oracle’s source code, Rimini doesn’t challenge that ruling on appeal. Instead, we focus on the district court’s ruling that Rimini’s software programs are derivative works “even if the work[s] do[] not contain any of [Oracle’s] copyrighted code.” Oracle Int’l Corp., 2023 WL 4706127, at *3. It determined that Rimini created “infringing derivative works because they interact only with PeopleSoft.” Id. at *72. The district court relied on the fact that “Rimini’s PeopleSoft updates are extensions to and modifications of Oracle’s copyrighted software” and they “cannot be used with any software programs other than PeopleSoft.” Id. Rimini claims that thousands of its files fall into this category—programs that are interoperative with Oracle’s PeopleSoft but do not contain Oracle’s copyrighted code. Without more, mere interoperability isn’t enough to make a work derivative. Both the text of the Copyright Act and our case law teach that derivative status does not turn on interoperability, even exclusive interoperability, if the work doesn’t substantially incorporate the preexisting work’s copyrighted material. Another video-game case makes the point. Nintendo made a well-known gaming console. Lewis 14 ORACLE INT’L CORP. V. RIMINI ST., INC.

Galoob Toys, Inc., 964 F.2d at 967. Another company then developed the Game Genie, which allowed players to alter several features of Nintendo games. Id. The Game Genie worked by being inserted in between a Nintendo game cartridge and a Nintendo gaming console. Id. It then blocked the value for a single data byte sent from the game cartridge to the gaming console, thereby altering parts of the game. Id. The Game Genie was “useless by itself” and it “c[ould] only enhance . . . a Nintendo game’s output.” Id. at 969. Despite this exclusive interoperability with the Nintendo system, the Game Genie was not a derivative work. Instead, a “derivative work must incorporate a protected work in some concrete or permanent form” and the “Game Genie does not physically incorporate a portion of a copyrighted work.” Id. Because it didn’t “duplicate or recast[]” any of Nintendo’s copyrighted material, it couldn’t be a derivative work. See id. In sum, the district court erred by concluding that Rimini created infringing “derivative works” just because its programs “only interact[] and [are] useable with” Oracle software. Oracle Int’l Corp., 2023 WL 4706127, at *66. Something more is needed under the Copyright Act. Instead, a derivative work must actually incorporate Oracle’s copyrighted work, either literally or nonliterally. And as Galoob Toys shows, simply being an extension or modification of a copyrighted work without any incorporation is not enough to create a derivative work. Aside from concluding that a limited number of Rimini files copied Oracle’s code, the district court made no finding that Rimini incorporated nonliteral copyrighted material in its PeopleSoft updates or programs. We thus vacate the district court’s holding that Rimini created infringing derivative works based solely on Rimini’s

ORACLE INT’L CORP. V. RIMINI ST., INC. 15

programs’ interoperability with Oracle’s programs. As the issue was not briefed by the parties, we do not decide which specific parts of Oracle’s programs are protectable nonliteral elements or how to determine whether Rimini’s programs incorporate any of those elements. See SAS Inst., Inc., 64 F.4th at 1326 (“Court decisions vary in the methods used to identify and analyze copyrightability for nonliteral elements of computer programs.”). Finally, because the district court applied the wrong legal standard in determining whether Rimini created derivative works, we do not reach Rimini’s alternative argument that Oracle’s licensing agreements nonetheless authorize any derivative work. If the district court concludes that Rimini created an infringing derivative work, the district court should then consider whether any of Oracle’s licensing agreements authorized the creation of the specific work. B. Ownership of a Copy of the Computer Program Under the Copyright Act, no copyright infringement exists if an “owner of a copy of a computer program . . . mak[es] . . . another copy or adaptation of that computer program” for certain purposes, such as when it’s an “essential step” in using the program. 17 U.S.C. § 117(a). We’ve described this provision as an “affirmative defense to infringement.” Vernor v. Autodesk, Inc., 621 F.3d 1102, 1109 (9th Cir. 2010). At the pleadings stage, the district court struck Rimini’s assertion of this affirmative defense because it found that “Oracle’s customers only license, rather than buy, Oracle’s copyrighted software.” Rimini St., Inc. v. Oracle Int’l Corp., No. 2:14-cv-01699, 2015 WL 4139051, at *2 (D. Nev. July 9, 2015). In the district court’s view, because none of Oracle’s customers “owned” a copy of 16 ORACLE INT’L CORP. V. RIMINI ST., INC.

PeopleSoft, Rimini could not step into their shoes to claim the defense. Rimini challenges this categorical ruling. To determine whether a party is an “owner of a copy” of a computer program, we look to whether the party has “sufficient incidents of ownership” over the copy of the software program. See UMG Recordings, Inc. v. Augusto, 628 F.3d 1175, 1183 (9th Cir. 2011) (simplified). And the question is not about ownership of the copyrighted material—it’s about ownership of a copy of the copyrighted material. See 17 U.S.C. § 202 (“Ownership of a copyright . . . is distinct from ownership of any material object in which the work is embodied.”). In deciding this question, we review the totality of the parties’ agreement. See Vernor, 621 F.3d at 1109. Over the years, we’ve looked at several factors to determine the “incidents of ownership.” First, we’ve started with “whether the copyright owner . . . specifies that a user is granted a license.” Id. at 1110. A licensing agreement, rather than an outright bill of sale, may show the lack of a transfer of ownership. Of course, the “mere labeling of an arrangement as a license rather than a sale, although it [i]s a factor to be considered, [i]s not by itself dispositive of the issue.” UMG Recordings, 628 F.3d at 1180. After all, “some purported software licensing agreements may actually create a sale.” Adobe Sys. Inc. v. Christenson, 809 F.3d 1071, 1078 (9th Cir. 2015). Second, we’ve considered whether the parties’ arrangement “significantly restricts the user’s ability to transfer the software.” Vernor, 621 F.3d at 1110–11. “The right to transfer is one of the most essential sticks in the bundle of rights that are commonly characterized as property.” Shackleford v. United States, 262 F.3d 1028, 1032

ORACLE INT’L CORP. V. RIMINI ST., INC. 17

(9th Cir. 2001) (simplified). So generally, for a copy of a computer program to become the “property” of a user, that user must be able to transfer the copy. Thus, if users are “entitled to use or dispose of [the copies] in any manner they s[ee] fit,” then that’s a strong sign of ownership. See UMG Recordings, 628 F.3d at 1180. On the other hand, significant restrictions on transfer may indicate a license rather than ownership. Third, we’ve looked at whether the agreement “imposes notable use restrictions.” Vernor, 621 F.3d at 1111. Again, the concern is ownership of the copy of the copyright—not of the copyright itself. So use restrictions that only protect against the infringement of the copyrighted material are less relevant here. Instead, we’re interested in use restrictions that affect using the copy of the computer program, such as limiting the user to “one working and one back up copy of the software,” forbidding the “examination, disclosure, copying, modification, adaptation, and visual display of the software,” and permitting the “software use on [a] single computer, [while] prohibit[ing] multicomputer and multi- user arrangements, and permitt[ing] transfer to another computer no more than once every thirty days.” Id. at 1111 n.11. Other “incidents of ownership” may be considered. Relevant considerations are whether the user paid “significant consideration to develop the programs for [the user’s] sole benefit” and whether the user could use the “programs ‘forever,’ regardless of whether the parties’ relationship terminated.” Id. at 1114 (quoting Krause v. Titleserv, Inc., 402 F.3d 119, 124–25 (2d Cir. 2005)). The district court’s ruling on the pleadings seemingly relied only on the labeling of the agreements between Oracle 18 ORACLE INT’L CORP. V. RIMINI ST., INC.

and its customers as a “license.” This is not enough. That Oracle only provides PeopleSoft and its other programs through licensing agreements is an important but not dispositive fact. It reflects only one facet of the “incidents of ownership.” Whether other incidents of ownership can be proven is undetermined. Both sides of this dispute agree that this is a fact-bound question, and we don’t undertake an analysis of the purported 375 agreements involved in this case in the first instance. We thus vacate the district court’s ruling striking Rimini’s § 117(a) affirmative defense and remand for reconsideration under this opinion. We take no position on whether Oracle’s customers are ultimately owners or licensees of the copies of Oracle’s software. And we do not reach whether Rimini can establish the other elements of the “essential step” defense under § 117(a)(1), which the district court did not reach. C. Database and PeopleSoft Copyrights Rimini next appeals from the district court’s conclusions that it infringed Oracle’s copyrights for both Database and PeopleSoft. We address each argument in turn. 1. Database Rimini challenges the district court’s ruling that it infringed the Oracle Database licensing agreement by creating “18 ‘gap customer’ environments on its systems . . . that included copies of Oracle Database.” Oracle Int’l Corp., 2023 WL 4706127, at *79. The district court ruled that the creation of these environments violated rulings from the Rimini I litigation because Rimini maintained a copy of Oracle Database on its computers.

ORACLE INT’L CORP. V. RIMINI ST., INC. 19

But we recently held that the plain language of the Oracle Database licensing agreement did not prohibit third-party support providers, like Rimini, from possessing a copy of Oracle’s software to further a client’s “internal business operations.” Rimini St., 81 F.4th at 854–55. In the appeal of the contempt proceedings, “Oracle [could not] point[] to [any] location restriction” in the Oracle Database licensing agreement. Id. at 855. Nor did the district court here identify a “location restriction” in the use of Oracle Database. While we affirmed any activity that directly fell within Rimini I’s injunction, we declined to extend it to a “different situation.” See id. We thus vacate the district court’s ruling that the 18 “gap customer” environments containing Oracle Database violated Oracle’s licensing agreement. 2. PeopleSoft Rimini next challenges the district court’s ruling that both (1) its use of “automated tools” to deliver PeopleSoft updates from one client to another and (2) the “outright” delivery of PeopleSoft updates to clients without further testing in the clients’ environments constitute copyright infringement. Automated Tools Rimini’s “automated tools” allow Rimini to enter one customer’s environment, generate an update, and then deliver it to other customers. The district court considered these tools to be “impermissible cross-use” because they require copying Rimini’s PeopleSoft updates in one client’s environment and then distributing those copies to other customers. See Oracle Int’l Corp., 2023 WL 4706127, at *24. If these distributed Rimini files contained Oracle’s 20 ORACLE INT’L CORP. V. RIMINI ST., INC.

code or nonliteral protected material, we would have no problem affirming. As the district court found, these copies don’t benefit the original client at all, and so they don’t fall under the copying allowed for the client’s “internal data processing operations” permitted under Oracle’s licensing agreement. See id. at *20. Rimini protests that there would be no functional difference between using these “automated tools” and manually recreating the files in the other clients’ environment, which the district court said would be non- infringing. Id. at *96. While the end result may be the same under the two methods, the difference is significant under copyright law because the “automated tools” may require the extra copying of Oracle’s protected expression with no benefit to the initial client. In the end, however, we vacate the district court’s ruling on the “automated tools” to the extent that its conclusion rests on its erroneous view of “derivative work.” The district court ruled that Rimini’s “automated tools” required the copying of Oracle’s protected expression, including “the copying of individual PeopleSoft files, derivative works thereof, and RAM copies of the prototype files or PeopleTools.” Id. at *74. The district court also found that “the files and documentation Rimini claims it created [as part of its “automated tools”], even those without Oracle code, and then distributed to multiple customers, were derivative works because they leveraged portions of existing Oracle programs and were created in PeopleSoft environments with PeopleSoft tools for use in PeopleSoft environments.” Id. at *22. On remand, the district court should apply the legal standard articulated above for “derivative work” before deciding whether Rimini’s “automated tools” violate copyright laws.

ORACLE INT’L CORP. V. RIMINI ST., INC. 21

Outright Delivery Next, the district court found that Rimini violated Oracle’s copyright when it developed an update in the City of Eugene’s PeopleSoft environment and then delivered it “outright” to three other clients. Id. at *2. Rimini argues that this was not cross-use because the City of Eugene needed the update itself and it was free to deliver the update to other clients when multiple clients have the same problem. Oracle counters that this was impermissible cross-use because the distribution of an update “outright” necessarily means that Rimini used the City’s environment to “prototype” the update for multiple clients rather than only for the City’s “internal data processing operations.” Once again, we vacate this ruling based on the district court’s erroneous view of “derivative work.” The district court’s decision presumed that this individual update was a “derivative work” because it “only interacts and is useable with PeopleSoft,” even if the update “contained only Rimini written expression.” Id. at *66. As discussed above, this analysis is incomplete. The district court must first determine whether this update copies Oracle’s protected expression, either literally or nonliterally. If the district court finds protected expression in this update, it would be relevant to know if any extra copies of the update were created in the City’s environment solely because Rimini planned to distribute the update to other clients. In other words, further explanation is required of why “prototyping” the update in the City’s environment for non-City clients “necessarily” violates the “internal data processing operations” provision. 22 ORACLE INT’L CORP. V. RIMINI ST., INC.

D. The Lanham Act The Lanham Act prohibits any person from making a “false or misleading” description or representation of fact about “goods or services” in “commercial advertising or promotion.” 15 U.S.C. § 1125(a)(1)(B). But false advertising doesn’t extend to statements of opinion and puffery—that is, “exaggerated advertising, blustering, and boasting upon which no reasonable buyer would rely.” Southland Sod Farms v. Stover Seed Co., 108 F.3d 1134, 1145 (9th Cir. 1997) (simplified). When “the question of truth or falsity is a close one,” we should “err on the side of nonactionability.” Partington v. Bugliosi, 56 F.3d 1147, 1159 (9th Cir. 1995) (simplified). The district court ruled that Rimini made several statements that constitute false advertising under the Lanham Act. See Oracle Int’l Corp., 2023 WL 4706127, at *40–41 (listing statements). On appeal, Rimini only challenges whether 12 statements about its security services were misleading. As a background, Oracle provides periodic security patches, known as “Critical Patch Updates,” to customers who purchase Oracle software support. Oracle develops and releases security patches that fix vulnerabilities in its products’ source code that hackers may exploit. Rimini offers its own security service using a technology called “virtual patching.” Unlike Oracle’s patches, virtual patching does not modify the software program’s source code. Instead, virtual patching acts as a firewall for software programs, attempting to intercept and block any vulnerabilities from reaching the program.

ORACLE INT’L CORP. V. RIMINI ST., INC. 23

Rimini’s 12 security-related statements can be divided into three subgroups: (1) statements about the relative security of the services offered by Oracle and Rimini; (2) statements that Rimini offers “holistic” security; and (3) statements about the need for software patching. We consider each category in turn. 1. Relative Security of Services In this category are Rimini’s statements that customers can be more secure if they use Rimini’s security services than if they remain with Oracle support. We take this subcategory to include the following statements:

• “Security professionals have found that traditional vendor security patching models are outdated and provide ineffective security protection.” • Oracle’s [Critical Patch Updates] are unnecessary to be secure. • It is not risky to switch to Rimini and forgo receiving [Critical Patch Updates] from Oracle. • Virtual patching can serve as a replacement for [Oracle] patching. • “Virtual patching can be more comprehensive, more effective, faster, safer, and easier to apply than traditional [Oracle] patching.” • “Rimini Security Support Services helps clients proactively maintain a more secure application compared to [Oracle’s] 24 ORACLE INT’L CORP. V. RIMINI ST., INC.

support program which offers only software package-centric fixes.” • Rimini provides more security as compared to Oracle. • Rimini’s [Global Security Services] can “pinpoint and circumvent vulnerabilities months and even years before they are discovered and addressed by the software vendor.”

These statements are puffery. Whether a statement is factual or mere puffery often turns on the “specificity or generality of the claim.” Newcal Indus., Inc. v. Ikon Off. Sol., 513 F.3d 1038, 1053 (9th Cir. 2008). A statement is factual if it is “specific and measurable, . . . capable of being proved false or of being reasonably interpreted as a statement of objective fact.” Ariix, LLC v. NutriSearch Corp., 985 F.3d 1107, 1121 (9th Cir. 2021) (simplified). In other words, “a statement that is quantifiable, that makes a claim as to the specific or absolute characteristics of a product” may be actionable under the Lanham Act. Newcal Indus., 513 F.3d at 1053 (simplified). In contrast, puffery is characterized by subjective claims, including “merely stat[ing] in general terms that one product is superior.” Cook, Perkiss and Liehe, Inc. v. N. Cal. Collection Serv. Inc., 911 F.2d 242, 246 (9th Cir. 1990) (simplified); see also Southland Sod Farms, 108 F.3d at 1145 (“[P]roduct superiority claims that are vague or highly subjective often amount to nonactionable puffery.”). Take the example we used in Cook. Saying that a lamp was “far brighter than any lamp ever before offered for home movies” was a generalized statement of puffery. Cook, 911 F.2d at 246 (simplified). But making the claim more specific and quantifiable, like saying that the lamp was superior

ORACLE INT’L CORP. V. RIMINI ST., INC. 25

because of its “35,000 candle power and 10-hour life,” made the statements factual. Id. Comparative assertions about effectiveness, riskiness, and security are the kinds of generalized statements of product superiority that we have routinely found to be nonactionable. Here, neither Oracle nor the district court provided any objective, quantifiable metric to measure software’s security, risk to vulnerabilities, or security protocols’ effectiveness to prove the falsity of Rimini’s statements. Indeed, the possibility of exploitation by hackers always exists. No product can offer complete “security” or eliminate all “risk.” Without an objective measure of the difference between perfect security and the security programs offered by Rimini’s and Oracle’s products, any statement about comparative security is necessarily tinged with subjectivity. As Oracle’s security expert acknowledged, “security experts can reasonably disagree on what constitutes adequate security.” The district court also ruled that Rimini’s statement that its security services could “pinpoint” future vulnerabilities “before they even exist” was literally false because such technology is “not technically feasible.” Oracle Int’l Corp., 2023 WL 4706127, at *45. But that is a misreading of Rimini’s statement. Rimini never claimed clairvoyance in spotting vulnerabilities; instead, it was merely claiming that its products can spot problems before they are “discovered and addressed by the software vendor.” So it was again making a comparative statement of superiority—not a statement of psychic ability. Indeed, Rimini presented evidence that it had identified and addressed specific vulnerabilities before Oracle released a patch to address them. 26 ORACLE INT’L CORP. V. RIMINI ST., INC.

We thus reverse the district court’s ruling on these statements. 2. Holistic Security In the next subcategory is Rimini’s statement about “holistic” security. The subcategory contains only one statement:

• Rimini offers “holistic security” solutions for Oracle software for enterprises.

The district court determined that “holistic security” is a term of art within the world of software security that refers to “a comprehensive approach to security at all layers of a system, and includes security patching at the software level.” Id. at *44. It is true that industry standards can provide objective meaning to otherwise subjective or ambiguous terms in particular contexts. See Enigma Software Grp. USA, LLC v. Malwarebytes, Inc., 69 F.4th 665, 672 (9th Cir. 2023) (holding that a term may become “substantively meaningful and verifiable in the cybersecurity context”). On appeal, Rimini doesn’t challenge the district court’s context- specific definition of “holistic security” or the factual conclusion that it doesn’t provide source-code level protection. That makes the statement actionable. Look to Ariix. In that case, a company created a certification award for nutritional-supplement manufacturers. Ariix, 985 F.3d at 1122. The company described its certification as “a binary determination” based on two “falsifiable criteria.” When the company did not give the award to a particular manufacturer, we held that the company made “specific and measurable statements” about the manufacturer—it was “falsely impl[ying] to consumers”

ORACLE INT’L CORP. V. RIMINI ST., INC. 27

that the manufacturer did not meet the standards undergirding the certification. Id. Because “[t]hese implications are specific, measurable, and capable of being falsified,” they were actionable statements under the Lanham Act. Id. Whether a support service provides “holistic security,” which we accept means multi-layered security protection including at the source-code level, is a type of “binary determination” with “falsifiable criteria.” Id. Either the product provides protection at multiple layers or it doesn’t. The district court found that Rimini doesn’t offer multi-level security. And since Rimini doesn’t refute either the definition or the facts here, we affirm the district court. 3. Need for Software Patching In the last subcategory are statements about the need for software patching. This subcategory includes Rimini’s statements that:

• Oracle’s [Critical Patch Updates] provide little to no value to customers and are no longer relevant. • Once an Oracle ERP platform is stable, there is no real need for additional patches from Oracle. • If you are operating a stable version of an Oracle application platform, especially with customizations, you probably cannot apply or do not even need the latest patches.

The district court held that these statements were misleading because the “security community recognizes that 28 ORACLE INT’L CORP. V. RIMINI ST., INC.

software-level patching is one of the most important aspects of any modern IT security strategy.” Oracle Int’l Corp., 2023 WL 4706127, at *41. While a closer case, Rimini’s statements about what customers “need” or “value” resemble the “type of generalized boasting upon which no reasonable buyer would rely.” Southland Sod Farms, 108 F.3d at 1145; see also Coastal Abstract Serv., Inc. v. First Am. Title Ins., 173 F.3d 725, 731 (9th Cir. 1999) (A statement “was puffery because a reasonable consumer would not interpret the statement as a reliably factual claim.”). The record shows that Oracle’s customers are “some of the most sophisticated companies in the world” and “take the security of their systems seriously.” Whether to deploy or skip software patching is a matter of subjective discretion. One Oracle customer testified that it made the decision not to apply Oracle’s Critical Patching Updates because it focused on its firewall security and believed that the patches could introduce new problems—all before it considered signing up with Rimini. Thus, it is doubtful that any of Oracle’s customers would be fooled about its own security needs merely based on Rimini’s fanciful but vague statements. Indeed, Oracle could not identify “any customers that left Oracle and went to Rimini because of a statement about security.” Nor did Oracle present any evidence of a security breach suffered by a Rimini client. So while these statements border on falsehood, we cannot say that they are so specific and measurable to become actionable under the Lanham Act. We thus reverse. * * * In sum, we reverse the district court’s ruling that Rimini’s security-related statements constitute false

ORACLE INT’L CORP. V. RIMINI ST., INC. 29

advertising under the Lanham Act, except for the statement about “holistic security.” We also vacate the injunction as it pertains to these nonactionable statements. E. Scope of the Permanent Injunction Rimini asks us to vacate or narrow the district court’s permanent injunction for four reasons. First, it argues that injunctive relief itself is improper because damages are the appropriate remedy for past infringement, and any infringing acts were in the past. Second, it argues that the district court improperly required it to delete all its software files with the prefixes “RS” or “RSI,” despite finding that only some of those files were infringing. Third, it argues that the district court wrongly required it to delete “any version” of the TAX960ST.SQR file, even though that file is a standard Oracle component of PeopleSoft. And fourth, it argues that the district court’s injunction improperly applies to certain DAT files, despite the district court’s holding that Oracle didn’t meet its burden of proving infringement. Because we vacate the district court’s ruling on “derivative works” and the § 117(a) affirmative defense, we also vacate the portions of the injunction appealed by Rimini. On remand, should the district court conclude that Rimini committed any copyright infringement, it should consider the arguments in this appeal in fashioning any injunction.

III.

For the above reasons, we vacate the district court’s holding that (1) Rimini created infringing derivative works, (2) Rimini could not invoke the § 117(a) affirmative defense, and (3) Database and PeopleSoft infringed Oracle’s 30 ORACLE INT’L CORP. V. RIMINI ST., INC.

copyrights. We reverse the district court’s ruling that Rimini’s security-related statements constitute false advertising under the Lanham Act, except for the statement about “holistic security.” Because we vacate much of the district court’s ruling, we also vacate the portions of the injunction appealed by Rimini. Rimini’s motion to stay the enforcement of the permanent injunction pending appeal (Dkt. No. 7) is denied as moot. Each party shall bear its own costs on appeal. VACATED in part, REVERSED in part, and

REMANDED.

Bybee, Circuit Judge, dissenting in part:

I join the majority opinion except for a portion of Part II.D.3. In subpart D.3, the majority opinion discusses whether certain statements made by Rimini constitute false advertising under the Lanham Act or if they are merely puffery and therefore not actionable under the Act. I disagree with the majority’s conclusion that one of these statements—“Oracle’s [Critical Patch Updates] provide little or no value to customers and are no longer relevant”— is puffery. The Lanham Act prohibits any person from making a “false or misleading” description or representation of a fact about “goods or services” in “commercial advertising or promotion.” 15 U.S.C. § 1125(a)(1)(B). “Statements of opinion and puffery, however, are not actionable.” Ariix, LLC v. NutriSearch Corp., 985 F.3d 1107, 1121 (9th Cir. 2021) (internal citation omitted).

ORACLE INT’L CORP. V. RIMINI ST., INC. 31

“Puffing is exaggerated advertising, blustering, and boasting upon which no reasonable buyer would rely . . . .” Southland Sod Farms v. Stover Seed Co., 108 F.3d 1134, 1145 (internal quotations marks and citation omitted) (9th Cir. 1997). “A statement is considered puffery if the claim is extremely unlikely to induce customer reliance. Ultimately, the difference between a statement of fact and mere puffery rests in the specificity or generality of the claim.” Newcal Indus. v. Ikon Off. Sol., 513 F.3d 1038, 1053 (9th Cir. 2008) (internal citation omitted). A quantifiable statement that makes a claim “as to the specific or absolute characteristics of a product[] may be an actionable statement of fact while a general, subjective claim about a product is non-actionable puffery.” Id. (internal quotation and citation omitted). The majority admits that Rimini’s Critical Patch Updates statement is a “closer case” but deems it puffery, construing it as “generalized boasting upon which no reasonable buyer could rely.” See Southland Sod Farms, 108 F.3d at 1145. In this statement, Rimini says Oracle’s product provides “little or no value” and is “no longer relevant.” These are “absolute characteristics,” Newcal Indus., 513 F.3d at 1053, and can be “falsified”—Oracle’s product is either valueless and irrelevant or not, Ariix, 985 F.3d at 1122. This is true even if, as the majority suggests, using software patching is a discretionary decision, and Oracle’s “sophisticated” customers would not be “fooled” by this statement. As the district court explained, Rimini “internally acknowledges that patching . . . is necessary,” and has said that “no one is thinking of not applying patches at all.” I join the majority in finding that most of the statements by Rimini are puffery because those statements use qualifiers—words like “probably,” “can,” and “more”—and 32 ORACLE INT’L CORP. V. RIMINI ST., INC.

make generalized statements as to why Rimini’s products are superior to Oracle’s. This statement, on the other hand, lacks qualifiers, and instead opts for absolute language (“no longer relevant”) and does not compare the two products. Labeling Oracle’s product irrelevant moves this statement beyond “generalized boasting” and is sufficiently specific and absolute to be actionable under the Lanham Act. I respectfully dissent from the majority’s decision on this statement and would affirm the district court’s decision finding it actionable.