Apple Inc. lost its copyright claims against a Florida company that makes “virtual iPhones” used by security researchers to test for vulnerabilities to its system.
Apple contended Corellium LLC copied the operating system, graphical user interface and other aspects of the devices without permission. It accused Corellium of acting under the guise of helping discover bugs in the iPhone’s operating system but then selling the information “on the open market to the highest bidder.”
Corellium’s actions fell under an exception to copyright law because it “creates a new, virtual platform for iOS and adds capabilities not available on Apple’s iOS devices,” District Court Judge Rodney Smith in West Palm Beach ruled Tuesday. That Corellium sells its product “does not undermine its fair use defense, particularly considering the public benefit of the product.”
Apple has a “bounty program” where it rewards so-called white hat hackers who discover flaws in its system. The Cupertino, California-based company argued that the Corellium product went far beyond that, though Corellium said it evaluates potential customers and rejects some.
Corellium has said its customers are government agencies, financial institutions and security researchers and accused Apple of trying to control security research to limit what the public learns about vulnerabilities. Apple had been in talks to buy the company but the two sides couldn’t agree on a price, Smith said. Apple sued a year later.
Corellium’s virtual product is used on a desktop computer and can’t make phone calls, send text messages, access iTunes or do any of the other things an iPhone can.
“There is evidence in the record to support Corellium’s position that its product is intended for security research and, as Apple concedes, can be used for security research,” the judge said. “Further, Apple itself would have used the product for internal testing had it successfully acquired the company.”
Officials with the two companies didn’t immediately respond to queries seeking comment.
Apple argued that the case is similar to the billion-dollar dispute between Oracle Corp. and Alphabet Inc.’s Google unit, in which an appeals court rejected Google’s arguments that it had the right to copy Oracle code for inclusion into the Android operating system. The Supreme Court is considering the issue.
Smith said they aren’t comparable — Corellium transforms iOS and adds new content, and it isn’t a direct competitor. He said it was instead more like the case in which an appeals court ruled that Google’s creation of digital copies of books and display of snippets in search results was a fair use of copyrighted works.
The judge said that Corellium may still be in violation of the Digital Millennium Copyright Act, which prohibits tools to circumvent security measures, so he declined to dismiss that aspect of the case at this stage. He ordered the two sides to submit a status report by Jan. 11 to determine how the case proceeds.
The ruling was reported earlier by the Washington Post.
The case is Apple Inc. v. Corellium LLC, 19-81160, U.S. District Court for the Southern District of Florida (West Palm Beach).