Opinion
21-12835
05-08-2023
APPLE INC., Plaintiff-Counter Defendant-Appellant, v. CORELLIUM, INC., Defendant-Counter Claimant-Appellee.
DO NOT PUBLISH
Appeal from the United States District Court for the Southern District of Florida D.C. Docket No. 9:19-cv-81160-RS
Before BRANCH and LUCK, Circuit Judges, and SANDS, [*] District Judge.
PER CURIAM
This is a copyright case. Apple Inc. owns copyrights for iOS-the operating system that the company uses for devices like iPhones, iPads, and iPod Touches-and for some of that operating system's icons and wallpapers. Corellium, Inc. is a technology company. It created a virtualization software-basically a virtual phone-that can run various operating systems (like Android and iOS). The virtualization software includes tools that enable security researchers to gain deeper insights into these operating systems. Looking to stop Corellium from selling its product, Apple sued Corellium alleging copyright infringement.
The district court granted summary judgment for Corellium on Apple's three copyright claims: (1) direct infringement of iOS (count one), (2) direct infringement of Apple's icons and wallpapers (count two), and (3) contributory infringement (count three). As to count one, the district court found that Corellium was not liable for copying iOS because Corellium was shielded by the fair use doctrine. As to counts two and three, the district court entered summary judgment for Corellium without separately addressing those claims.
We agree in part. The U.S. Constitution enshrines the purpose of copyright: "to promote the progress of science and useful arts." U.S. Const. art. I, § 8, cl. 8 (cleaned up). The Copyright Act achieves this "utilitarian goal" by protecting a creator's rights in its original creation while also allowing others to make fair use of the original by creatively building on it. Cambridge Univ. Press v. Patton, 769 F.3d 1232, 1238 (11th Cir. 2014).
As to count one, we agree that Corellium is shielded by the fair use doctrine. First, Corellium's virtualization software is trans-formative-it furthers scientific progress by allowing security research into important operating systems. Second, iOS is functional operating software that falls outside copyright's core. Third, Co-rellium didn't overhelp itself to Apple's software. And fourth, Corellium's product does not substantially harm the market for iOS or iOS derivatives-so Apple's own incentive to innovate remains strong. As to counts two and three, we remand for the district court to independently consider those claims in the first instance.
FACTUAL BACKGROUND
The iPhone
Apple introduced the iPhone in 2007. The iPhone was one of the world's first smartphones and remains one of the most popular consumer electronic devices in the world. The iPhone's operating system-the software that manages the phone's basic functions-is called "iOS." iOS runs the built-in applications, or "apps," that come with the iPhone (like mail, maps, and music). It also runs the phone's graphical user interface (the virtual display iPhone users have become familiar with). Here's what that display looks like:
(Image Omitted)
Apple has sold more than two billion iOS devices. Those devices include iPhones, iPads (until 2019), and iPod Touches.
To improve its product, Apple periodically releases new versions of iOS. When it does, Apple registers each successive version with the U.S. Copyright Office. Apple has also secured separate copyright registrations for its graphic icons and background wallpapers. With each new iOS, Apple bundles its update into what's known as an IPSW file (basically a zip file). Apple then makes that IPSW file available to the public for free. While anyone can download the software for free, Apple has made it somewhat difficult to use iOS on non-Apple devices.
Beyond consumer products, Apple also offers some services to developers and researchers. First, Apple offers a program called "iOS Simulator," which "allows app developers to create and test iOS apps" on a "virtual iOS device." Second, Apple has announced what it calls the "iOS Security Research Device Program." Through this program, Apple plans to provide custom iPhones to "legitimate security researchers" in exchange for a contractual commitment to "find and report bugs to Apple." Third, Apple is developing Xcode Cloud, a program that will allow developers "to remotely access" iOS via "physical devices in an Apple device farm" to help with building and testing apps. Xcode Cloud "is not specifically designed for security research" but it can be used "to test iOS for bugs."
Corellium
Corellium was founded in 2017. It created a virtualization software-CORSEC-that emulates various operating systems like Android, iOS, and Linux. Virtualization is the ability to run software on hardware that the software is not ordinarily able to run on. So, while iOS, for example, is designed to run on Apple devices, CORSEC (the virtualization software) simulates on non-Apple hardware an environment that can run the iOS operating system (the software being virtualized). In effect, CORSEC "enables users to create a virtual iPhone."
Corellium's founders each testified that "[t]he purpose of [CORSEC was] to create a good environment for security researchers to do their work." One founder, for instance, described CORSEC as a "security research platform for mobile devices." Another said that "the purpose[] that Corellium was built for . . . was . . . security research." Apple itself offered to purchase Corellium for about $23 million and "discussed several potential uses" for CORSEC, including "security testing" and "security research." The parties couldn't agree on a price and so talks fell apart. Apple has recognized that CORSEC "can be used for security testing, research, and development."
Corellium sells two versions of its product. The first is a "cloud" version, which is available over the internet. The second is an "on-site" version, where customers receive a physical server that is then installed at the customer's chosen location. The cloud version ranges from $575 to $6,000 per month for a subscription. The on-site version costs thousands-even hundreds of thou-sands-of dollars. The on-site version's premium edition has a base price of $300,000 and requires customers to pay an additional $25,000 to $50,000 per server on top of that. Corellium has sold about twenty on-site accounts and twenty-one cloud accounts.
How does CORSEC work? It starts with Apple's publicly available IPSW file. CORSEC customers can obtain the IPSW file by manually downloading it or through a Corellium program that automatically downloads the IPSW file from Apple's servers. In an early version, Corellium would also provide the IPSW file via "USB [t]humb drive[s]." Once a user selects the IPSW file it wants to use, CORSEC "dynamically unpacks" the file as it is downloading. In doing so, CORSEC "modifies various components" to make iOS "run reliably on Corellium's non-Apple platform." By the end, the virtual device is made up of a combination of Corellium's code and Apple's code.
But CORSEC does more than simply allow users to run iOS on non-Apple devices. CORSEC also "helps security researchers do their work in a way that physical iPhones just can't." So, for example, in modifying iOS, CORSEC adds features that are not available on retail iOS, including: (1) the ability to see and halt running processes; (2) the ability to modify the kernel (which is the core of the operating system that has complete control over all system resources); (3) CoreTrace, a tool to view system calls (i.e., certain processes underlying the software); (4) an app browser; (5) a file browser; and (6) the ability to take and clone live snapshots. CORSEC also modifies iOS by "disabling firmware validation and [federal information processing standards], modifying the trust cache, and generating a[] [cryptographic] ticket [that authorizes installation on non-Apple devices]."
While all of this is quite technical, these features serve as useful tools for security researchers in practice. CoreTrace, for instance, "enables researchers to holistically view and comprehend all system calls made by the operating system and the apps running on it, giving researchers the ability to examine and understand both iOS itself and iOS-based applications in advanced new ways[.]" By taking snapshots, researchers can freeze and clone devices in certain states so that they can run multiple tests in different ways from the same starting point. And modifying the trust cache allows researchers to download software that otherwise would not be permitted on the device-so researchers can, for example, "install a new program on [their] device" that "lets the user . . . perform fuzzing or other kinds of security research." Fuzzing is a way to find bugs in a product's code.
Here's what CORSEC looks like in practice:
(Image Omitted)
CORSEC doesn't entirely replicate an iPhone. Those who use CORSEC can't use their virtual device to (for instance) make phone calls, send text messages, take photos, navigate with GPS, or download apps from Apple's App Store. While Corellium has mentioned plans to integrate some of these functions, the features currently do not exist on the CORSEC software. Corellium views "physical device[s]" like iPhones and Androids as its "biggest competitor" but has explained that "Corellium [really] doesn't have any direct competitors; no one else is offering Android or iOS virtualization."
PROCEDURAL HISTORY
On August 15, 2019, Apple sued Corellium. In its operative second amended complaint, Apple brought three claims: (1) direct copyright infringement of iOS (count one), (2) direct copyright infringement of Apple's icons and wallpapers (count two), and (3) contributory copyright infringement of iOS, the icons, and the wallpapers (count three).
These were the three claims left by the time Apple appealed.
Corellium moved for summary judgment on each of Apple's claims, arguing that its use of iOS and Apple's icons and wallpapers was "categorically fair use." In doing so, Corellium walked through the four statutory fair use factors. First, Corellium explained that CORSEC was "transformative" because of its new features and new purpose:
[CORSEC] is a specialty security research tool. Among its many features, [CORSEC] provides the ability for researchers to 1) visualize in real time the input and output processes of the operating systems running in it; 2) freeze the processes in the operating system and study a specific state for as long as they need to; 3) step backwards and forward in time at will to closely monitor system activity using CoreTrace; 4) make and test their own kernels; [and] 5) run multiple experiments from the same starting point. These features are not available as part of iOS, and
they add something new, with a further purpose or different character[.]
Second, Corellium argued that iOS "is accorded less protection" because of its "functional elements." Third, Corellium asserted that its use of iOS was "necessary to conduct research." Fourth, Corellium maintained that CORSEC "ha[d] no adverse effect on the market for Apple's products" because "[n]o ordinary consumer" would buy a device that can't "be used to make calls, receive text messages, [or] take photos" over an iPhone or iPad. For these reasons, Corellium argued that Apple's "direct and contributory infringement claims fail."
In response, Apple argued that Corellium was not entitled to the fair use defense. First, Apple contended that CORSEC was not transformative because it "merely offer[ed] the [iOS] software in a different medium." Second, Apple asserted that iOS-along with the icons and wallpapers-were "highly creative" and thus entitled to "maximal protection." Third, Apple argued that Corellium copied "all of iOS." Fourth, Apple submitted that there was "market harm." Apple concluded that its direct copyright claims survived. Apple also argued that Corellium "failed to specifically address" Apple's contributory infringement claim, "and thus [Corellium's] motion must be denied outright with respect to that claim."
The district court sided with Corellium, concluding that the company was shielded by the fair use doctrine. First, the district court explained that CORSEC was transformative because it made "several changes to iOS and incorporate[d] its own code to create a product that serve[d] a transformative purpose." Second, the district court "note[d] the limitations on copyright protection for software" but gave this factor little weight. Third, the district court concluded that "Corellium's copying, modifying, and using of iOS [was] reasonable in relation to the purpose of the copying." And fourth, the district court found "no evidence that [CORSEC] ha[d] affected, let alone materially affected, Apple's market or the market value for iOS."
From this, the district court granted summary judgment for Corellium on the direct and contributory copyright claims. The district court, though, focused only on count one-Apple's claim that Corellium directly infringed on iOS. Although the district court granted summary judgment as to all three counts, it didn't separately consider whether Corellium directly infringed on Apple's icons and wallpapers (count two) or whether Corellium was liable for contributory infringement (count three).
Apple timely appealed.
STANDARD OF REVIEW
"We review the district court's grant of summary judgment de novo." Beal v. Paramount Pictures Corp., 20 F.3d 454, 459 (11th Cir. 1994). "Fair use is a mixed question of law and fact." Google LLC v. Oracle Am., Inc., 141 S.Ct. 1183, 1199 (2021) (cleaned up). While we must "leav[e] factual determinations to the jury," the "ultimate question whether those facts show[] a fair use is a legal question for judges to decide de novo." Id. at 1199-200 (cleaned up).
Because fair use is an affirmative defense, a defendant moving for summary judgment on fair use "must show affirmatively the absence of a genuine issue of material fact: it must support its motion with credible evidence that would entitle it to a directed verdict if not controverted at trial." United States v. Four Parcels of Real Prop. in Greene &Tuscaloosa Cntys., 941 F.2d 1428, 1438 (11th Cir. 1991) (en banc) (cleaned up). "In other words, the [defendant] must show that . . . no reasonable jury could find for the nonmoving party." Id. "If the [defendant] makes such an affirmative showing, it is entitled to summary judgment unless the [plaintiff], in response, comes forward with significant, probative evidence demonstrating the existence of a triable issue of fact." Id. (cleaned up).
DISCUSSION
Here's how we'll proceed. First, we explain that there's no genuine dispute that Corellium made fair use of iOS. Corellium is thus entitled to summary judgment on count one. Second, we remand Apple's remaining claims for the district court to separately consider them in the first instance.
The iOS Copyright Claim (Count One)
The Constitution gives Congress the power "to promote the progress of science and useful arts, by securing for limited times to authors and inventors the exclusive right to their respective writings and discoveries." U.S. Const. art. I, § 8, cl. 8 (cleaned up). This text embodies "copyright's utilitarian goal" of promoting the creation of new works for the public good. Patton, 769 F.3d at 1238. In other words, "copyright is not an inevitable, divine, or natural right that confers on authors the absolute ownership of their creations. It is designed rather to stimulate activity and progress in the arts for the intellectual enrichment of the public." Id. at 1256 (quotation omitted).
Indeed, the Supreme Court has long recognized that copyright "grants an author an exclusive right to produce his work (sometimes for a hundred years or more), not as a special reward, but in order to encourage the production of works[.]" Google, 141 S.Ct. at 1195; see also, e.g., Mazer v. Stein, 347 U.S. 201, 219 (1954) ("The economic philosophy behind the clause empowering Congress to grant patents and copyrights is the conviction that encouragement of individual effort by personal gain is the best way to advance public welfare through the talents of authors and inventors "); Fox Film Corp. v. Doyal, 286 U.S. 123, 127 (1932) ("The sole interest of the United States and the primary object in conferring the monopoly lie in the general benefits derived by the public from the labors of authors.").
To this end, the Copyright Act engages in a balancing act. See Patton, 769 F.3d at 1238 (explaining that the Copyright Act requires courts to "ascertain the appropriate balance"). On one side, "the Copyright Act confers a bundle of exclusive rights to the owner of the copyright." Harper &Row Publishers, Inc. v. Nation Enters., 471 U.S. 539, 546 (1985); accord Patton, 769 F.3d at 1256. It gives creators "the exclusive right[]" to "reproduce," "distribute," and "perform" the copyrighted works. 17 U.S.C. § 106(1), (3)-(4). It's through these protections that Congress has "motivate[d] the creative activity of authors and inventors" so that the public can benefit from "their genius." Sony Corp. of Am. v. Universal City Studios, Inc., 464 U.S. 417, 429 (1984).
On the other side, the Copyright Act limits this exclusive right-including through the "fair use" doctrine. 17 U.S.C. § 107. "From the infancy of copyright protection, some opportunity for fair use of copyrighted materials has been thought necessary to fulfill copyright's very purpose, to promote the progress of science and useful arts." Campbell v. Acuff-Rose Music, Inc., 510 U.S. 569, 575 (1994) (cleaned up). As Justice Story explained, "[i]n truth, in literature, in science and in art, there are, and can be, few, if any, things, which, in an abstract sense, are strictly new and original throughout. Every [invention] in literature, science and art, borrows . . . much which was well known and used before." Emerson v. Davies, 8 F. Cas. 615, 619 (C.C.D. Mass. 1845). So copyright must allow "[s]ome unpaid use of copyrighted materials" so that inventors can build on existing works. Patton, 769 F.3d at 1238.
The fair use doctrine serves this important function. The fair use doctrine "permits [and requires] courts to avoid rigid application of the copyright statute when, on occasion, it would stifle the very creativity which that law is designed to foster." Campbell, 510 U.S. at 577 (alteration in original) (quoting Stewart v. Abend, 495 U.S. 207, 236 (1990)). The doctrine, as codified by Congress, provides:
[T]he fair use of a copyrighted work . . . for purposes such as criticism, comment, news reporting, teaching . . ., scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include-
(1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
(2) the nature of the copyrighted work;
(3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
(4) the effect of the use upon the potential market for or value of the copyrighted work.17 U.S.C. § 107. In sum, the Copyright Act-to promote innovation-balances two competing aims. First, the Act protects those who create original works. This protection gives original creators the financial incentive to innovate. Second, recognizing that most inventions build upon those that came before them, the Act affords follow-on creators some leeway to borrow from originals so that they, too, can create new and important works.
In finding the right balance, courts must remember that the "[f]air use doctrine is an equitable rule of reason; neither the examples of possible fair uses"-like criticism or research-"nor the four statutory factors are to be considered exclusive." Peter Letterese & Assocs., Inc. v. WorldInst. of Scientology Enters., 533 F.3d 1287, 1308 (11th Cir. 2008) (quotation omitted). "All [of the factors] are to be explored, and the results weighed together, in light of the purposes of copyright." Campbell, 510 U.S. at 578. "[B]ecause fair use is an affirmative defense, its proponent bears the burden of proof in demonstrating that it applies." Patton, 769 F.3d at 1259. With that, we turn to the four factors.
The Purpose and Character of the Use
The first factor-the purpose and character of the use-"focuses on (1) the extent to which the use is a transformative rather than merely superseding use of the original work and (2) whether the use is for a nonprofit educational purpose, as opposed to a commercial purpose." MidlevelU, Inc. v. ACI Info. Grp., 989 F.3d 1205, 1221 (11th Cir. 2021) (quotation omitted). We'll take each prong in turn.
a. Transformative
In assessing whether a new work is transformative, we ask "whether the new work merely supersedes the objects of the original creation or instead adds something new, with a further purpose or different character, altering the first with new expression, meaning, or message." Campbell, 510 U.S. at 579 (cleaned up). Transformative works include "an artistic painting that incorporates an advertising logo to make a comment [on] consumerism," 4 Nimmer on Copyright § 13.05[A][1][b] (2022) (quotation omitted), or a "parody [that] transforms a work by appropriating elements of [that] work for purposes of comment or criticism," Patton, 769 F.3d at 1262. "Even verbatim copying may be transformative so long as the copy serves a different function than the original work." Id. (quotation omitted).
Transformative works "lie at the heart of the fair use doctrine's guarantee of breathing space within the confines of copy-right[.]" Campbell, 510 U.S. at 579 That's because they help strike the balance copyright law is after:
[T]ransformative works possess a comparatively large share of the novelty copyright seeks to foster. At the same time, transformative uses are less likely, generally speaking, to negatively impact the original creator's bottom line, because they do not merely supersede the objects of the original creation and therefore are less likely to supplant the market for the copyrighted work by fulfilling demand for the original.
Patton, 769 F.3d at 1262 (cleaned up). Some works fulfill this aim- of creating something novel without supplanting the original-better than others. And so some works are "more transformative" than others. Campbell, 510 U.S. at 579.
Turning to our case, we agree with the district court that Corellium's software is moderately transformative. First, CORSEC alters iOS by adding features that aren't ordinarily available on the iOS operating system, including: (1) the ability to see and halt running processes; (2) the ability to modify the kernel; (3) CoreTrace, a tool to view system calls; (4) an app browser; (5) a file browser; and (6) the ability to take live snapshots. CORSEC also modifies iOS by "disabling firmware validation and [federal information processing standards], modifying the trust cache, and generating a[] [cryptographic] ticket."
Second, Corellium not only "add[ed] something new" but also created a product with "further purpose or different character." Campbell, 510 U.S. at 579. There's no dispute that CORSEC "helps security researchers do their work in a way that physical iPhones just can't." In other words, Corellium isn't geared towards the same consumer-oriented function as iOS but instead "giv[es] researchers the ability to examine and understand both iOS itself and iOS-based applications in advanced new ways." CORSEC thus "provide[s] social benefit, by shedding light on an earlier work, and, in the process, creating a new one." Id.; see also 17 U.S.C. § 107 (listing "research" and "criticism" as paradigmatic fair uses).
Third, CORSEC does not supersede iOS running on iPhones. CORSEC creates a virtual phone-not a physical phone in your pocket. As the product currently stands, CORSEC can't be used to make phone calls, send texts, take photos, navigate with GPS, or download apps from the App Store. And these are all crucial features that lead ordinary consumers to purchase an iPhone equipped with iOS. While Apple has suggested that Corellium has "plans" to integrate some of these features into its product in the future, these hypothetical future plans are irrelevant to Apple's current claim. See Authors Guild, Inc. v. Hathi Trust, 755 F.3d 87, 101 (2d Cir. 2014) ("Without foreclosing a future claim based on circumstances not now predictable, and based on a different record, we hold that the balance of relevant factors in this case favors [fair use].").
In similar cases, courts have found that products are transformative. Take Google LLC v. Oracle America, Inc., for example. There, Google, when creating the Android platform, copied 11,500 lines of code from Oracle's Java software. Google, 141 S.Ct. at 1191. This code from Java-a platform developers use to write computer programs-allowed programmers to use "shortcuts" to build certain functions into their programs, rather than writing code from scratch. Id. at 1191-92. While creating Android, Google decided that Java's code would prove useful to programmers working on Android apps-since programmers were already familiar with Java's code. Id. at 1193-94.
The Supreme Court held that Google deployed this code for a transformative purpose. Id. at 1202-04. On the one hand, Google used Java's code "in part for the same reason that [Oracle] created those portions, namely, to enable programmers to call up implementing programs that would accomplish particular tasks." Id. at 1203. Still, Google's use, the Supreme Court said, was "transformative." Id. at 1204. That's because Google was using the code to create a "new product [that] offer[ed] programmers a highly creative and innovative tool for a smartphone environment" and to "further the development of computer programs." Id. at 1203. Google's "use was [thus] consistent with that creative 'progress' that is the basic constitutional objective of copyright itself." Id. (quoting U.S. Const. art. I, § 8, cl. 8).
The same is true here. As in Google, Corellium invented a creative and innovative tool that furthered the very creative progress that copyright seeks to achieve. Corellium created a new product with new features. This new product opened the door for deeper security research into operating systems like iOS-dissecting those programs, discovering vulnerabilities, and exploring possible patches. While CORSEC, it's fair to say, isn't the creative leap that the Android platform was, CORSEC still offers new features, serves new purposes, and furthers the progression of technology through research and development.
Our case also looks a lot like Authors Guild v. Google, Inc., 804 F.3d 202 (2d Cir. 2015). There, Google, again-as part of the Google Books project-made digital copies of tens of millions of books. Id. at 207. Google Books worked as a "search engine" that allowed "researchers to comb over the tens of millions of books" and view "snippets" of passages. Id. at 209. Through these tools, researchers could "identify [books] that contain a word or term of interest" and "learn the frequency of usage of selected words . . . in different historical periods." Id. at 217. In finding fair use, the court explained that Google's use of the digital copies was "transformative" because the engine "augment[ed] public knowledge by making available information about [the] books." Id. at 207, 217-19 (emphasis in original).
A similar thing is true here. Like Google Books, CORSEC adds new features to copyrighted works. CORSEC allows researchers to visualize in real time iOS's processes, freeze those processes and study them for as long as they need to, step backward and forward in time at will to closely monitor system activity, and run multiple experiments from the same starting point. CORSEC also adds file and app browsers. There's no dispute that these features assist researchers and enable them to do their work in new ways. Corellium has thus "augment[ed] public knowledge by making available information about [iOS]." Id. at 207; see also A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630, 639 (4th Cir. 2009) (finding that copying student assignments into a database to detect plagiarism was "transformative" because the database's "use of [the students'] works had an entirely different function and purpose than the original works"); Perfect 10, Inc. v. Amazon.com, Inc., 508 F.3d 1146, 1165 (9th Cir. 2007) (finding that Google image search's "use of thumbnails [was] highly transformative" because the "use of the images served a different function" than the original pictures by "improving access to information on the internet versus artistic expression" (cleaned up)); Sony Comput. Ent., Inc. v. Connectix Corp., 203 F.3d 596, 606 (9th Cir. 2000) (finding that a PlayStation emulator was "modestly transformative" because the emulator "create[d] a new platform, the personal computer, on which consumers can play games designed for the Sony PlayStation").
Apple tries to distinguish Authors Guildby arguing that Google Books was not "a potential substitute for the original books." But the same is true here. CORSEC is not a realistic substitute for iOS on iPhones because users can't use CORSEC to make phone calls, send text messages, take photos, navigate with GPS, or download apps from the App Store.
Against all this, Apple advances three arguments-all unpersuasive. First, Apple argues that "making verbatim copies of a copyrighted work and converting [those works] into a different format is not transformative." Apple is right. In Patton, for example, we found no transformative use where "verbatim copies of portions of . . . original books . . . ha[d] merely been converted into a digital format." 769 F.3d at 1262. Similarly, the Ninth Circuit held that it was not transformative to convert copyrighted songs from CDs to MP3 files for download because the "original work[s] [were] merely retransmitted in a different medium." See A&M Recs., Inc. v. Napster, Inc., 239 F.3d 1004, 1015 (9th Cir. 2001).
But this isn't a case in which the original is simply repackaged in a different format. Corellium adds several features that are not normally available on iOS. These include (1) the ability to see and halt running processes; (2) the ability to modify the kernel; (3) CoreTrace, a tool to view system calls; (4) an app browser; (5) a file browser; and (6) the ability to take live snapshots. They also include, for example, the ability to modify the trust cache so that researchers can install new programs on the device that allow the user to perform fuzzing (a way to find bugs in a product's code) or other types of security research. The record, in other words, shows that there wasn't verbatim copying here. And even if there were, Patton itself recognized that "verbatim copying may be transformative so long as the copy serves a different function than the original work." 769 F.3d at 1262. Here, Corellium used iOS to serve a research function, and not as a consumer electronic device.
Second, Apple contends that "[s]ecurity research is not a transformative purpose because it is one of the purposes already served by Apple's works." Apple says that "security researchers have long used Apple-licensed versions of iOS to do their work." Corellium (in our view) rightly points out the flaw in this argument: it's "like saying Google Books was not transformative because scholars could manually search books for keywords by going to the library." In other words, there's no dispute that CORSEC "adds features that are not available on retail iOS that are useful for security research." These features make security research far more efficient. See Fox News Network, LLC v. TVEyes, Inc., 883 F.3d 169, 177 (2d Cir. 2018) (noting "the transformative purpose of enhancing efficiency"). They also make possible deeper insights into the software. The fact that iOS itself allowed for some security research before, then, can't negate Corellium's innovation (just like sifting through books at the library didn't negate Google Books's transformativeness).
Third, Apple asserts that "the district court was wrong to find-on summary judgment-that the purpose of [CORSEC] is security research." For this, Apple mostly points to evidence showing that customers can use CORSEC for multiple purposes. For example, Corellium's expert testified that security research wasn't CORSEC's "exclusive use." But transformativeness does not require unanimity of purpose-or that the new work be entirely dis-tinct-because works rarely have one purpose. In assessing whether a work is transformative, the question has always been "whether a [transformative use] may reasonably be perceived." Campbell, 510 U.S. at 582 (emphasis added) (finding that a parody was transformative even though both a song and its parody serve the same function of entertainment). We don't ask whether the new product's only purpose is transformative.
The Supreme Court made this point in Google. In that case, Google used Java's code "for the same reason that [Oracle] created those portions, namely, to enable programmers [to use shortcuts] that would accomplish particular tasks." Google, 141 S.Ct. at 1203. But, at a higher level, the purpose was to create a "new product [that] offer[ed] programmers a highly creative and innovative tool for a smartphone environment." Id. This higher-order purpose was what made Google's product transformative. Id. As in Google, the mere fact that some purposes overlap does not preclude a finding of transformative use.
b. Commercial
"[W]e must also consider under the first factor whether [the defendant's] use is for a nonprofit educational purpose, as opposed to a commercial purpose." Patton, 769 F.3d at 1263. In general, a noncommercial purpose weighs in favor of fair use and a commercial purpose weighs against fair use. Id. But "the commercial or nonprofit educational character of a work is not conclusive." Campbell, 510 U.S. at 585 (quotation omitted); see also Nimmer on Copyright § 13.05[A][1][c] ("Labeling a use as 'commercial,' in other words, should not end the analysis.").
In fact, while "a finding that copying was not commercial in nature tips the scales in favor of fair use," the "inverse is not necessarily true, as many common fair uses are indisputably commercial." Google, 141 S.Ct. at 1204. "Many of the most universally accepted forms of fair use, such as news reporting and commentary, quotation in historical or analytic books, reviews of books, and performances, as well as parody, are all normally done commercially for profit." Authors Guild, 804 F.3d at 219.
Like these uses, Corellium's use was commercial. Corellium sold its product for steep prices. But many fair uses are commercial. "So even though [Corellium's] use was a commercial endeavor," that fact "is not dispositive of the first factor, particularly in light of [CORSEC's] inherently transformative role[.]" Google, 141 S.Ct. at 1204; see also Campbell, 510 U.S. at 579 ("The more transformative the new work, the less will be the significance of other factors, like commercialism, that may weigh against a finding of fair use.").
In sum, CORSEC is moderately transformative. It alters iOS in meaningful ways and makes possible new and improved forms of security research. Corellium's commercial use does little to change our analysis. The first factor favors a finding of fair use.
The Nature of the Copyrighted Work
The second factor-the nature of the copyrighted work- "calls for recognition that some works are closer to the core of intended copyright protection than others, with the consequence that fair use is more difficult to establish when the former works are copied." Campbell, 510 U.S. at 586. "Under this factor, the more creative a work, the more protection it should be accorded from copying; correlatively, the more informational or functional the plaintiff's work, the broader should be the scope of the fair use defense." Nimmer on Copyright § 13.05[A][2][a].
The Supreme Court has explained that "computer programs are primarily functional[,] mak[ing] it difficult to apply traditional copyright concepts in that technological world." Google, 141 S.Ct. at 1208; see also Sega Enters. Ltd. v. Accolade, Inc., 977 F.2d 1510, 1524 (9th Cir. 1992) (explaining that "computer programs are, in essence, utilitarian articles"); Comput. Assocs. Int'l, Inc. v. Altai, Inc., 982 F.2d 693, 712 (2d Cir. 1992) (noting that "a computer program . . . is . . . a highly functional, utilitarian component in the larger process of computing"); Connectix, 203 F.3d at 603 ("[T]he fair use doctrine preserves public access to the ideas and functional elements embedded in copyrighted computer software programs.").
Like many computer programs, iOS is primarily functional. As Apple has explained, "[a]n operating system is the software that manages a computer's most basic functions, including the user's interaction with the device." And "iOS is Apple's operating system" for its iPhone, iPad, and other devices. We have no doubt that iOS embodies a great deal of creativity. But it's still a functional program meant to run consumer electronic devices.
For these reasons, we conclude that iOS is "further . . . from the core of copyright" than protected works like paintings, movies, and books. Google, 141 S.Ct. at 1202 (finding that the nature of the copyrighted work weighed in favor of fair use where, as here, the computer program's "new creative expression" was "inherently bound together with uncopyrightable ideas"). This factor also favors fair use.
The Amount and Substantiality
The third factor-the amount and substantiality of the portion used-"examines whether defendants have 'helped themselves overmuch' to the copyrighted work in light of the purpose and character of the [defendant's] use." Peter Letterese, 533 F.3d at 1314 (quoting Campbell, 510 U.S. at 587). The point, in other words, is that inventors should not needlessly copy from the original and take away from the original's market. "The 'substantiality' factor will generally weigh in favor of fair use where . . . the amount of copying was tethered to a valid, and transformative, purpose." Google, 141 S.Ct. at 1205.
Corellium's use of iOS wasn't just tethered to its transformative purpose; it was necessary to achieving that purpose. Apple has said so itself: "Full access to iOS is needed for Corellium's virtualization because if you're going to run a virtualization environment, realistically you cannot do so without the entire operating system available." Apple is right. Security research requires the use of the entire work because flaws may be found anywhere in the code; anything less would risk vulnerabilities going undetected. Because Corellium's use was tethered to its transformative purpose, the third factor favors fair use.
In response, Apple raises three arguments. None are convincing. First, Apple claims that our case is like Fox News Network, LLC v. TVEyes, Inc. In Fox News, TVEyes, a media company, "redistribute[d] Fox's news programming in ten-minute clips, which . . . likely provide[d] TVEyes's users with all of the Fox programming that they [would] seek." 883 F.3d at 179. The Second Circuit found that "[t]his factor clearly favor[ed] Fox because TVEyes ma[de] available virtually the entirety of the Fox programming that TVEyes users want[ed] to see and hear." Id.
We don't find Fox News persuasive. That's because the question here is not (as the Fox News court supposed) whether there was a large amount of copying. Instead, the question (at this stage) is whether the "copying was tethered to a valid, and transformative, purpose." See Google, 141 S.Ct. at 1205; see also Authors Guild, 804 F.3d at 221 (noting that "[c]omplete unchanged copying has repeatedly been found justified as fair use" when tethered to fair use and not substitutive). In any event, our case differs from Fox News on the facts. Corellium has not made available "virtually the entirety" of what users would "want" with iOS. For example, CORSEC users cannot make phone calls, send texts, take photos, or download apps. By contrast, TVEyes gave consumers everything they would want from Fox News. Fox News doesn't help.
Second, Apple argues that CORSEC "customers care only about the function and ideas of the portions of iOS they are analyz-ing-not its many creative elements." For this reason, Apple suggests that Corellium has over helped itself to iOS by including parts of iOS in its program that individual researchers may not need. But that would be like arguing that Google should make only a portion of its millions of Google Books available to each searcher based on what each particular searcher was interested in. Fair use doesn't require inventors to "follow the least efficient solution" or engage in "wasted effort[s]" simply to avoid liability. Connectix, 203 F.3d at 605 (emphasis omitted) (quotation omitted).
Put another way, in Authors Guild, Google had no way of knowing which books-or which portions of books-individual researchers would be interested in. So it was "necessary" for it to copy millions of books so that it could "advise searchers reliably whether their searched term appears in a book (or how many times)." Authors Guild, 804 F.3d at 221. A similar thing is true here. Corellium can't know which parts of iOS any given customer will be interested in studying or where a customer's initial research might lead. So Corellium must make iOS broadly available so that researchers can target the portions of iOS relevant to their work. Apple's alternative-giving each researcher access to only a portion of iOS based on what each particular researcher needs-is infeasible. Copyright doesn't require such inefficiencies.
Third, Apple contends that the district court was wrong to conclude it was "necessary for Corellium to copy entire IPSW files." But Apple conceded that it was necessary for Corellium to use all of iOS: "Full access to iOS is needed for Corellium's virtualization because if you're going to run a virtualization environment, realistically you cannot do so without the entire operating system available." Corellium's expert agreed, testifying that "you could not provide a realistic research environment by picking and choosing parts of iOS to emulate." The evidence-and common sense-supports this undisputed fact.
The Effect on Market Value
The fourth (and final) fair use factor looks to the secondary use's effect on the potential market for or value of the copyrighted work. This factor "requires courts to consider not only the extent of market harm caused by the particular actions of the alleged infringer, but also whether unrestricted and widespread conduct of the sort engaged in by the defendant would result in a substantially adverse impact on the potential market for the original." Campbell, 510 U.S. at 590 (cleaned up).
"The central question," in evaluating this factor, "is not whether [the defendant's] use of [the plaintiff's] works caused [the plaintiff] to lose some potential revenue." Patton, 769 F.3d at 1276. "Rather, it is whether [the defendant's] use-taking into account the damage that might occur if everybody did it-would cause substantial economic harm such that allowing it would frustrate the purposes of copyright by materially impairing [the plaintiff's] incentive to [create] the work." Id. (cleaned up).
In assessing the effect on market value, our inquiry "must take account not only of harm to the original but also of harm to the market for derivative works." Campbell, 510 U.S. at 590 (quoting Harper &Row, 471 U.S. at 568). The relevant market is the market for the original copyrighted work-in this case, iOS. So we look to whether CORSEC would cause substantial economic harm to the iOS market or any of iOS's derivative markets in a way that would materially impair Apple's incentive to innovate.
We'll start with the iOS market. We agree with the district court that, even if it were widespread, CORSEC would not cause any substantial harm to iOS's market. That's because CORSEC makes for a poor substitute for iOS on a real iPhone. For example, customers can't use CORSEC to make phone calls, send texts, take photos, navigate with GPS, connect to Bluetooth devices, or download apps from the App Store. These are crucial features that lead consumers to buy iPhones running iOS. Nor is a virtual phone a reasonable substitute for iOS running on a real phone.
Unsurprisingly, Corellium's software-geared toward security researchers and costing up to hundreds of thousands of dollars-hasn't exactly flown off the shelves. The record shows that Corellium has sold only forty or so units of its product. Apple, by contrast, has sold over two billion iOS devices. Even if CORSEC has had some minor effect on Apple's iOS market, it hasn't caused substantial economic harm to the iOS market such that it would materially impair Apple's incentive to innovate. See Suntrust Bank v. Houghton Mifflin Co., 268 F.3d 1257, 1275-76 (11th Cir. 2001) (concluding that "the fourth . . . factor weigh[ed] in favor of" fair use where the evidence suggested there was no "significant[] harm" to the market).
We'll now turn to iOS's derivative market, which presents a somewhat closer question. Apple argues that-even if CORSEC doesn't substantially harm the iOS market-CORSEC does substantially harm Apple's derivative market for security products. For example, CORSEC (Apple says) competes with Apple's (1) iOS Simulator, which "allows developers to work on a virtual iOS device"; (2) Security Research Device Program, which gives "customized iPhone[s] loaded with iOS to legitimate security researchers"; and (3) Xcode Cloud, a forthcoming program that will enable researchers "to remotely access iOS."
While we must, in assessing market harm, "take account not only of harm to the original but also of harm to the market for derivative works," Campbell, 510 U.S. at 590 (quotation omitted), the Copyright Act doesn't afford creators a monopoly over transformative markets. "[A] copyright holder cannot prevent others from entering fair use markets merely 'by developing . . . a market for parody, news reporting, educational or other transformative uses of its own creative work.'" Bill Graham Archives v. Dorling Kindersley Ltd., 448 F.3d 605, 614-15 (2d Cir. 2006) (emphasis added) (quoting Castle Rock Ent., Inc. v. Carol Publ'g Grp., Inc., 150 F.3d 132, 146 n.11 (2d Cir. 1998)); see also Ty, Inc. v. Publications Int'l Ltd., 292 F.3d 512, 520-21 (7th Cir. 2002) ("[O]wnership of a copyright does not confer a legal right to control public evaluation of the copyrighted work."). In other words, a copyright holder can't prevent others from entering transformative markets. See Dorling Kindersley, 448 F.3d at 614-15 ("Copyright owners may not preempt exploitation of transformative markets." (alteration omitted)). "[B]ecause [transformative works] do not merely supersede the objects of the original creation," they "are less likely to supplant the market for the copyrighted work by fulfilling demand for the original." Patton, 769 F.3d at 1262 (cleaned up).
To be sure, the line between what is derivative and what is transformative isn't always clear. But we're not without guidance. On one side, "[p]aradigmatic examples of derivative works include the translation of a novel into another language, the adaptation of a novel into a movie or a play, or the recasting of a novel as an ebook or an audiobook." Hathi Trust, 755 F.3d at 95. Copyright's protection over derivative works generally reflects that a creator's "right to control and profit from the dissemination of her work ought not to be evaded by conversion of the work into a different form." Authors Guild, 804 F.3d at 225. On the other side, paradigmatic transformative uses include using a copyrighted work "for purposes such as criticism, comment, news reporting, teaching[], scholarship, or research." 17 U.S.C. § 107; see also Dorling Kindersley, 448 F.3d at 614-15 (same).
As we've explained, Corellium's product falls on the transformative side of the line. Corellium not only "add[ed] something new" to iOS but also created a product with "further purpose or different character." Campbell, 510 U.S. at 579. Corellium added new features that gave "researchers the ability to examine and understand both iOS itself and iOS-based applications in advanced new ways[.]" By opening up the door for further research into operating systems, Corellium created something transformative. See 17 U.S.C. § 107 (listing "research" as a paradigmatic "fair use"). And the Copyright Act doesn't give creators, like Apple, a monopoly over transformative inventions that enable research into their product. Cf. Patton, 769 F.3d at 1276 ("The goal of copyright is to stimulate the creation of new works, not to furnish copyright holders with control over all markets.").
The Second Circuit's decision in Authors Guild is on point. There, the plaintiff-book-authors argued that they had a "derivative right" to use their books to create a search database like Google Books, and that Google "usurped their exclusive market for such derivatives." Authors Guild, 804 F.3d at 225. The Second Circuit disagreed, explaining that "derivative works generally involve . . . changes ofform," like turning a book into a movie. Id. at 215. "By contrast, copying from an original for the purpose of . . . [the] provision of information about it" is a transformative use. Id. (emphasis added, footnotes omitted). The authors did not have "an exclusive right to furnish the kind of information about the works that Google's programs provide[d] to the public." Id. at 225. The same applies here. Apple doesn't have a monopoly over transformative research tools that supply information about its operating system. That doesn't fall within its derivative market. Because there's no substantial harm to iOS's market or its derivative market, the fourth factor favors fair use.
Apple makes two main arguments in response. First, turning away from the market for the copyrighted work and its derivatives, Apple argues that CORSEC harms the market for iPhones (rather than iOS itself) because CORSEC "can replace racks of physical devices" for software development and testing. But "the relevant question . . . is whether the infringement impacted the market for the copyrighted work itself." Lexmark Int'l, Inc. v. Static Control Components, Inc., 387 F.3d 522, 544 (6th Cir. 2004) (emphasis added). Apple's iPhone market is a different market from the iOS market. So Apple is focusing on the wrong market. And even if the iPhone market were the relevant market for the fourth fair use factor, it's entirely speculative that Corellium's soft-ware-with no call, text, or other capabilities-would substantially harm that market.
Second, Apple argues that "[t]he fourth factor cuts sharply against fair use for an additional reason: ample evidence shows Corellium's activities inflict harm to the public without providing a countervailing benefit." Apple hypothesizes that nefarious actors may do bad things with Corellium's software. But, even if this were a relevant consideration under the fair use test, Apple has offered no non-speculative evidence that CORSEC has ever harmed the public. See Cordoba v. Dillard's, Inc., 419 F.3d 1169, 1181 (11th Cir. 2005) ("[U]nsupported speculation does not meet a party's burden of producing some defense to a summary judgment motion." (alteration omitted)).
Balancing the Factors
The Supreme Court has explained that "the four statutory factors [may not] be treated in isolation, one from another. All are to be explored, and the results weighed together, in light of the purposes of copyright." Campbell, 510 U.S. at 578. Here, the fair use factors, weighed together, favor Corellium. First, Corellium's software is a transformative product that furthers copyright's aims in advancing science through research. Second, iOS is primarily functional, so it falls outside the core of copyright's protection. Third, Corellium didn't overhelp itself to iOS. And fourth, we can't say, as things stand, that CORSEC substantially harms the iOS market or any iOS derivative market. In the end, by creating an innovative product that advances scientific progress without superseding iOS, Corellium has captured the balance that copyright is after. Without foreclosing a future claim based on different facts, we conclude that Corellium-on this record-made fair use of iOS.
The Icon-and-Wallpaper Infringement Claim (Count Two) and the Contributory Infringement Claim (Count Three)
While we agree with the district court that Corellium is entitled to summary judgment on count one, we remand as to the remaining counts. "It is the general rule, of course, that a federal appellate court does not consider an issue not passed upon below." Singleton v. Wulff, 428 U.S. 106, 120 (1976). "An appellate court does, however, review summary judgment decisions de novo, and we may in our discretion resolve questions not addressed by the district court." Clarkv. Coats &Clark, Inc., 929 F.2d 604, 609 (11th Cir. 1991) (cleaned up).
Here, the district court, after carefully analyzing the first count, did not separately consider counts two and three. "Given the extent of the record below, and the comparatively minor attention that [these] issue[s] had in appellate briefing, we exercise our discretion not to address [those claims] in the first instance." Mamaniv. Sanchez Bustamante, 968 F.3d 1216, 1240 n.26 (11th Cir. 2020); see also, e.g., Clark, 929 F.2d at 609 (electing "not to exercise our discretion to address in the first instance the question whether [the defendant] met its initial [r]ule 56 burden").
CONCLUSION
We affirm the district court's summary judgment for Corel-lium on count one. But we vacate the summary judgment for Corellium on the remaining counts and remand for further proceedings.
AFFIRMED in part, VACATED in part, and REMANDED.
[*] Honorable W. Louis Sands, United States District Judge for the Middle District of Georgia, sitting by designation.