Opinion
Civil Action No. 1:15-cv-11798-IT
09-27-2017
ARVEST BANK, Plaintiff, v. RSA SECURITY INC., RSA SECURITY LLC, and EMC CORPORATION, Defendants.
MEMORANDUM AND ORDER
I. Introduction
Plaintiff Arvest Bank ("Arvest") entered into a software license agreement with Defendants RSA Security, Inc., RSA Security LLC, and EMC Corporation's (collectively, "RSA") granting Arvest a license to use RSA's software as part of Arvest's online banking business. This action was commenced after Arvest settled a patent infringement lawsuit brought against Arvest by non-party Secure Axcess, LLC (the "Secure Axcess litigation"). In the first three claims for relief, Arvest contends that RSA breached its contractual duties to defend and to indemnify Arvest, as well as the implied covenant of good faith and fair dealing. Compl. [#1]. Arvest also claims unjust enrichment. Id. Now before the court is RSA's Motion for Summary Judgment [#73], which argues that Arvest's three contract-based claims are time-barred by the Agreement's two-year limitation of actions, and that Arvest's unjust enrichment claim is barred under Massachusetts law because the Agreement governs the relationship between the parties.
The full text of the operative contract—captioned "Software License and Support Service Agreement"— is appended as Exhibit 1 to the Declaration of Samuel Brenner [#77], and will hereinafter be referred to as the "Agreement."
Arvest cross-moved for partial summary judgment as to RSA's affirmative limitations defense to Arvest's indemnification claim. Mot. Partial Summ. J. [#89].
Arvest's Motion [#89] also seeks partial summary judgment as to the scope and application of the Agreement's indemnity provision, which this court will address in a separate order.
For the following reasons, RSA's Motion [#73] is ALLOWED IN PART as to the contractual duty to defend and unjust enrichment, and DENIED as to the contractual duty to indemnify. Arvest's Motion [#89] is ALLOWED IN PART as to the duty to indemnify.
II. Facts
In December 2006, the parties executed the Agreement, by which RSA granted Arvest a license to run and use "Licensed Software," described at Exhibit A to the Agreement. Agreement ¶ 3(a). The Agreement includes an "Intellectual Property Indemnity" provision ("Indemnity Provision"), which provides in relevant part that:
RSA shall defend, indemnify and hold Licensee . . . harmless from and against all claims, actions, judgments, awards, expenses (including reasonable attorneys' fees) and awarded damages assessed against Licensee or agreed to be paid by RSA in settlement that arise from a claim that the current, unaltered release of the Licensed Software used in accordance with the terms of this Agreement infringes a third party copyright, trademark or U.S. patent, as long as Licensee gives RSA (1) prompt written notice of such claim or action; (2) the right to control and direct the investigation, preparation, defense, and settlement of the action; and (3) reasonable assistance and information with respect to the claim or action.Id. ¶ 11(d)(1). The Agreement contains the following limitation of liability:
Neither party shall bring any action, whether in contract or tort, including negligence, arising out of or in connection with this Agreement, more than two years after the cause of action has accrued.Id. ¶ 13(d).
On March 3, 2011, Arvest's counsel notified RSA that Arvest had been sued by Secure Axcess, stating that:
[RSA] has an obligation to defend, indemnify and hold Arvest harmless against any and all claims that arise from a claim that the licensed software infringes a U.S. patent. This letter constitutes written notice of the claims against Arvest. Please confirm that you received this letter and that RSA will comply . . . .[#77-12].
The next day, March 4, 2011, RSA's counsel responded, stating:
We have studied the patent-in-suit, and have concluded that RSA's "site-to-user" authentication feature clearly does not infringe, nor does any system that utilizes it in its intended manner. . . . [F]urther, our product is only one piece of the system implementation, so it's not clear that the claim is against RSA's product.[#77-13].
However, we do confirm that if it becomes clear that the claim is against RSA's product, RSA will live up to and fulfill its indemnity obligations under applicable agreements. Further, we will not just stand by, but will actively try to determine what is be accused.
On April 21, 2011, RSA's counsel wrote again to Arvest (after discussing Secure Axcess' suit with Secure Axcess), stating:
For the reasons discussed below, we are not convinced there is a claim against an RSA product (e.g. the Passmark product, or any other product). Thus, we believe it is premature to confirm indemnity and assume defense of this case. . . . [I]f it becomes clear in the future that there is a claim against an RSA product, and the other indemnification conditions are met, we will fulfill our indemnity obligations.[#77-16].
Just shy of two years later, on April 17, 2013, Arvest's counsel notified RSA that Arvest intended to settle the Secure Axcess ligation, stating:
Arvest Bank previously provided notice to [RSA] that Arvest believe that the claim made by Secure Axcess is within the scope of the indemnity obligations set forth in the [Agreement]. Arvest also required that [RSA] fulfill its obligation and defend and indemnify Arvest Bank. [RSA] declined to do so. . . .
[I] provided you this information [about Arvest's intention to settle with Secure Axcess] and the opportunity to object. You indicated that the position of [RSA] has not changed and that because you believe no indemnification obligation exists [RSA] does not object to Arvest's settlement of this case on terms as outlined or similar thereto. Arvest intends to move forward with this settlement effort and if a settlement is reached will be seeking recovery of the settlement amount along with all of its attorneys' fees and costs incurred in the lawsuit.[#77-21].
On May 10, 2013, Arvest and Secure Axcess formally executed their settlement, and on May 15, 2013, Secure Axcess dismissed its claims against Arvest. Pl.'s Statement of Fact [#91] ¶¶ 80, 81. On August 19, 2013, Arvest's counsel again wrote to RSA, stating:
The case filed by Secure Axcess, L.L.C. against Arvest Bank has now been settled and dismissed with prejudice as evidenced by the attached notice. Arvest spent significant sums of money in defense and settlement of the lawsuit. Because the case has now been resolved, Arvest asked me to reach out again on its behalf to request that RSA fulfill its indemnity obligations. RSA was placed on notice of its obligations by a letter dated March 3, 2011, and again in correspondence dated April 17, 2013.[#77-22].
On September 12, 2013, RSA's counsel responded, stating:
As we explained in my letter of April 21, 2011, the only function of the Passmark software (i.e. Licensed Software) is to look up the user's preselected image/caption in a look-up table and provide it to the bank's site server when so requested. As confirmed by Secure Axcess, this functionality is not alleged to infringe the patent-in-suit. Rather, Secure Axcess alleges infringement by the overall system that includes software in the bank's site server and located on the customer's computer. Thus, there was no claim that the Licensed Software infringes a third-party claim. . . .[#77-23].
[F]or the reasons discussed above, we do not believe that RSA has an obligation to indemnify RSA bank.
The present action commenced on May 7, 2015.
III. Discussion
a. Limitation of Liability
A Massachusetts cause of action for breach of contract accrues at the breach. Int'l Mobiles Corp. v. Corroon & Black/Fairfield & Ellis, Inc., 560 N.E.2d 122, 126 (Mass. App. Ct. 1990). The parties' motions require this court to determine when the alleged breaches of contract occurred.
Contractual duties to defend and to indemnify are, as their names suggest, distinct, and are subject to distinct analyses, including distinct accrual dates. Cf. John Beaudette, Inc. v. Sentry Ins. A. Mut. Co., 94 F. Supp. 2d 77, 100 (D. Mass. 1999) ("The contractual duty to defend is dependent upon commencement of a lawsuit, and is measured by the allegations of the underlying complaint. In contrast, the duty to indemnify is dependent upon the entry of a final judgment, settlement or final resolution by other means. In short, whereas the duty to defend is measured by the allegations of the underlying complaint, the duty to indemnify is measured by the facts as they unfold at trial or are inherent in the settlement agreement.") (internal quotations and citations omitted) (citing Travelers Ins. Co. v. Waltham Industrial Labs. Corp., 883 F.2d 1092, 1100 (1st Cir. 1989); Boston Symphony Orchestra, Inc. v. Commercial Union Ins. Co., 545 N.E.2d 1156, 1158 (Mass. 1989) ("It is axiomatic that an insurance company's duty to defend is broader than its duty to indemnify. An insurer must indemnify its insured when a judgment within the policy coverage is rendered against that insured. The duty to defend, however, is antecedent to, and independent of, the duty to indemnify."); see also Sheehan v. Modern Continental/Healy, 822 N.E.2d 305, 306-07 (Mass. App. Ct. 2005) (noting that even where a subcontractor's duty to indemnify may be void by statute, its duty to defend may still exist—a proposition that would be meaningless unless the duties were distinct).
RSA contends that these cases are inapplicable because they construe defense and indemnity in the insurance context, rather than the general commercial context, and because courts routinely decline to apply law across this divide. But it is more accurate to say courts caution against exportation of specific aspects of insurance law that are in fact unique to the insurance law context. For example, in Johnson v. Modern Continental Const. Co., Inc., 731 N.E.2d 96, 99 (Mass. App. Ct. 2000), on which RSA relies for this argument, the Massachusetts Appeals Court declined to import into the construction law context a First Circuit case construing law in the insurance context, because that First Circuit decision was construing a unique iteration of insurance law regarding a general favoring of the insured in policy interpretation, whereas in Massachusetts indemnity provisions in contracts are afforded no special treatment. See Caldwell Tanks, Inc. v. Haley & Ward, Inc., 471 F.3d 210, 215 (1st Cir. 2006). In Great Northern Ins. Co. v. Paino Associates, 457 F. Supp. 2d 104, 106-07 (D. Mass. 2006), also cited by RSA, the court analyzed whether a unique insured-insurer exception to the "America Rule" on fees should extend to contractual indemnitors. And Fidelity Nat. Title Ins. Co. of New York v. Crowley, 2015 WL 4887598, *2 n.4 (Mass. App. Ct. Aug. 18, 2018), on which RSA also relies, the Massachusetts Appeals Court simply noted that (as here) a breach of a contractual duty accrues at the breach, and that one must first suffer indemnifiable damages before bringing an action for indemnity. None of these cases cautions against application of the principle articulated in John Beaudette into the instant case, and RSA does not otherwise demonstrate why the distinguishing of defense and indemnity in the insurance context is unique to that context and should be inapplicable generally. See Air Brake Systems, Inc. v. TUV Rheinland of North America, Inc., 699 F. Supp. 2d 462, 472 (D. Conn. 2010) ("[Plaintiff] first attempts to distinguish most of the cases cited by [defendant] by emphasizing that such cases arose in the context of a suit to enforce coverage under an insurance policy. That is an accurate characterization, so far as it goes, but it does not diminish the breadth of the general contract-law proposition that those cases endorse.") (citation omitted).
RSA argues that the claim for both the breach of the duty to defend and the breach of the duty to indemnify accrued with RSA's April 21, 2011, letter. RSA is correct as to the duty to defend, for that duty was (i) allegedly triggered by Arvest's notifying RSA of the lawsuit, and (ii) allegedly breached by RSA's refusal to defend (regardless of the suit's merits), which left Arvest to defend itself (at least until RSA changed positions, which it never did). Further, "accrual of an action for defense costs is not postponed until their full extent can be determined." See OneBeacon Am. Ins. Co. v. Narragansett Elec. Co., 31 N.E.3d 1143, 1154 (Mass. App. Ct. 2015) ("Accordingly, we decline to follow those jurisdictions that require resolution of the underlying litigation before the insured's claim for breach of the duty to defend accrues.") Arvest's breach of contract claim as to the duty to defend is therefore time-barred.
Arvest contends that even were the limitation applicable to the duty to defend, RSA should be equitably estopped from asserting it, and that in any event, the limitation period should be deemed non-enforceable as unreasonable. As to equitable estoppel: it is true, as Arvest notes, that "[t]he doctrine of equitable estoppel . . . is available when a defendant lulls a plaintiff into a false belief that it is not necessary to commence suit within the statutory period," and works to prevent such a defendant from "benefiting from its own wrongdoing." Springfield Library and Museum Ass'n, Inc. v. Knoedler Archivum, Inc., 341 F. Supp. 2d 32, 41 (D. Mass. 2004). But putting aside whether this doctrine applies to bargained-for limitations periods in contracts—see Air Brake Systems, Inc., 699 F. Supp. 2d at 474 ("As previously noted, periods of limitation that the parties create by contract are not susceptible to statutes and doctrines that toll the relevant period of limitation that arises by statute.") (emphasis original)—the more essential point is that the record does not allow for summary judgment that RSA wrongfully lulled Arvest, via relied-upon representations or promises, into a false sense of security as to RSA's defense obligations such that equitable estoppel would be appropriate. As stated, Massachusetts law states that a breach of the duty to defend accrues when defense is refused, and it appears RSA put Arvest on transparent notice of its refusal to defend by in fact not assuming defense of the Secure Axcess litigation. As to unreasonableness: the court does not find the two-year limitations period, bargained-for by sophisticated parties, to be sufficiently contrary to public policy as to justify its being non-enforceable: there is nothing to indicate an unconscionably short limitations period, a particular type of underlying agreement that would caution against enforcement, or unequal bargaining power between the parties. See Creative Playthings Franchising, Corp. v. Reiser, 978 N.E.2d 765, 763-64 (Mass. 2012).
In contrast, a duty to indemnify contemplates reimbursement of loss suffered. See Indemnify, Black's Law Dictionary (10th ed. 2014) ("To reimburse (another) for a loss suffered because of a third party's or one's own act or default . . . to promise to reimburse (another) for such a loss.") (emphasis added); cf. 275 Washington Street Corp. v. Hudson River Inter., LLC, 987 N.E.2d 194, 199 (Mass. 2013) ("Because an indemnification clause reimburses a landlord for actual losses arising from termination of the lease after the tenant's default, and because the precise amount of those losses cannot be ascertained until the end of the period specified in the lease, a landlord cannot recover losses under an indemnification clause until the end of the period specified in the lease."); Narragansett Bay Ins. Co. v. Kaplan, 146 F. Supp. 3d 364, 372 (D. Mass. 2015) ("Accordingly, a declaratory judgment is not yet ripe for consideration regarding the duty to indemnify where, as here, the underlying action has not determined liability or adjudicated factual disputes."). Thus, although a refusal of one's duty to defend accrues when one so refuses (even if the full extent of damages is not yet determinable, as articulated in OneBeacon Am. Ins. Co., 31 N.E.3d at 1154), a categorical distinction attends an obligation to reimburse a party—an obligation tied to resolution of the underlying dispute. The contours of this point are implicit in OneBeacon Am. Ins. Co., 31 N.E.3d at 1154. There, the Massachusetts Appeals Court stated that an action for breach of a duty to defend accrues with the insurer's failure to defend. But the court employed a different analysis as to indemnity, acknowledging the principle in Jean Beaudette that indemnification requires that damages be "established." Although the court's analysis centered on whether administrative action by the EPA (untested by litigation and not yet formally adjudicated) was sufficiently final to trigger an indemnification obligation by the insurer, such actually reaffirms that finality is a component of an indemnification action.
Arvest argues that, as to both claims, the April 21, 2011, letter, was equivocal, and thus did not trigger the limitations date. RSA asserted in that letter that it was not convinced that Secure Axcess' claim was against an RSA product, that it was thus "premature to confirm indemnity and assume defense," but that RSA would fulfill its "indemnity obligations" if future circumstances so demand. As noted above, as to the duty to defend, this letter leaves no question that Arvest needed to undertake its own defense. But as to the duty to indemnify, this letter left RSA's obligations open—consistent with the distinction between the two claims recognized by courts that a final determination of a claim for indemnification should wait "for the facts as they unfold . . . ." See John Beaudette, Inc., 94 F. Supp. 2d at 100.
Stated differently, it appears Arvest made a timely demand to RSA to defend the Secure Axcess suit with its March 3, 2011, letter notifying RSA of the action; but its demand for RSA's indemnification was premature until the August 19, 2013, letter, where Arvest stated it "spent significant sums of money in defense and settlement of the lawsuit" and demanded that "RSA fulfill its indemnity obligations." (emphasis added). Indeed, to conclude that RSA breached its indemnity obligation upon refusing indemnity at the underlying litigation's outset would appear to say that RSA is liable for anticipatory breach, which is a doctrine Massachusetts rejects. See 23 Williston on Contracts § 63:30 (4th ed.) ("[M]assachusetts simply does not accept the doctrine of anticipatory repudiation as giving rise to an immediate cause of action for damages.").
The court does not find the above distinction contradicted by Fall River Housing Authority v. H.V. Collins Co., 604 N.E.2d 1310, 1312-13 (Mass. 1992). There, in what appears principally dicta, the Supreme Judicial Court recites the general proposition that "[w]hen there is an express agreement of indemnity in a contract, a claim for indemnity accrues when there is a breach of that provision." Id. at 1312. (emphasis omitted). The Court then provides a general example that "if a person were injured due to Cape Cod's negligence, then a breach of contract would occur when Collins pays damages to the injured person because Cape Cod expressly agreed to pay such damages." Id. at 1313. But there is no reason not to think the Court there articulated this hypothetical within the context of Collins paying out a total amount that Cape Cod was then obligated to pay, and there is nothing dissonant between this proposition and the one articulated in Jean Beaudette, which stands for the separate point that one's agreement to indemnify is not identical to one's agreement to defend, and that breaches may therefore occur non-conterminously.
The uncontroverted record demonstrates that Arvest executed its settlement with Secure Axcess on May 10, 2013. It was upon RSA's refusal to indemnify Arvest's losses in the context of the resolution of the Secure Axcess litigation that Arvest obtained a ripe cause of action for indemnity; consequently, Arvest's claim for breach of the duty to indemnify is timely.
In sum, RSA's Motion [#73] is ALLOWED as to the duty to defend claim (Count I) and DENIED as to the duty to indemnify claim (Count II). Arvest's Motion [#89] is ALLOWED as to the timeliness of its claim under the duty to indemnify.
Because the claim for breach of the duty to indemnify is not barred, RSA's Motion [#73] as to Arvest's claim for beach of the implied covenant of good faith and fair dealing is also DENIED. --------
b. Unjust Enrichment
"Ordinarily, a claim of unjust enrichment will not lie where there is a valid contract that defines the obligations of the parties." Metropolitan Life Ins. Co. v. Cotter, 984 N.E.2d 835, 849 (Mass. 2013). This is because an aspect of unjust enrichment, as a claim in equity, is a lack of remedy at law—and a breach of contract claim is such a remedy. See Infinity Fluids Corp. v. Gen. Dynamic Land Sys., Inc., 210 F. Supp. 3d 294, 309 (D. Mass. 2016). As a result, damages between the two theories are mutually exclusive, despite the fact that courts will often allow a party to proceed in the alternative as a case develops. See Lass v. Bank of America, N.A., 695 F.3d 129, 140 (1st Cir. 2012); Whitman & Co., Inc. v. Longview Partners (Guernsey) Ltd., 140 F. Supp. 3d 138, 140-41 (D. Mass. 2015).
Here, Arvest's claim for unjust enrichment is premised on its having paid RSA the licensing fee contemplated by the Agreement, but having not received the benefit of RSA's duty to indemnify or defend. Compl. [#1] 11. Arvest claims such is distinct from its claims in contract. But Arvest has not demonstrated how such a claim that RSA failed to perform its duty under a contract, and that Arvest is entitled to fees it paid pursuant to that contract, is not simply a claim for breach with a demand for restitution damages. In other words, RSA's duties to Arvest with regard to RSA's indemnification/defense and Arvest's obligations with regard to licensing payments are all governed by the Agreement and, as such, are remediable at law to the exclusion of unjust enrichment's remedy in equity. There is no indication that further evidence would sustain an unjust enrichment theory so as to prefer allowing Arvest to proceed in the alternative, and thus RSA's Motion [#73] as to unjust enrichment (Count IV) is ALLOWED.
IV. Conclusion
For the foregoing reasons, RSA's Motion [#73] is ALLOWED IN PART as to Count I (Breach of the Duty to Defend) and Count IV (Unjust Enrichment). The motion is otherwise DENIED.
Arvest's Motion [#89] is ALLOWED as to the timeliness of the indemnity claim, and will be further addressed by the court separately.
IT IS SO ORDERED.
September 27, 2017
/s/ Indira Talwani
United States District Judge