Flow Software Trading Limited v Hart

[2020] NZHC 2928

IN THE HIGH COURT OF NEW ZEALAND AUCKLAND REGISTRY

I TE KŌTI MATUA O AOTEAROA TĀMAKI MAKAURAU ROHE

CIV-2020-404-1139

[2020] NZHC 2928

UNDER

the Fair Trading Act 1986

BETWEEN

FLOW SOFTWARE TRADING LIMITED

First plaintiff

FH NUMBER 18 LIMITED
Second plaintiff

FH NUMBER 16 LIMITED
Third plaintiff

AND

CAMERON NELSON HART

First defendant

BREW INTEGRATION LIMITED
Second defendant

VELOX EDI LIMITED

Third defendant

Hearing:

On the papers

Appearances:

E C Gray for the plaintiffs

R J Latton for the defendants

Judgment:

6 November 2020

JUDGMENT OF JAGOSE J

[Costs]

This judgment was delivered by me on 6 November 2020 at 4.00pm.

Pursuant to Rule 11.5 of the High Court Rules.

………………………… Registrar/Deputy Registrar

Counsel/Solicitors:

E C Gray, Barrister, Auckland R J Latton, Barrister, Auckland

Kindrik Partners – Auckland Branch (A J Dickson) Sweetman Law, Auckland (A J Sweetman)

FLOW SOFTWARE TRADING LTD v HART - Costs [2020] NZHC 2928 [6 November 2020]

[1]    Pending trial of the plaintiffs’ claims the defendants threatened to breach confidence, and acted misleadingly and deceptively in trade in breach of s 9 of the Fair Trading Act 1986, the plaintiffs sought interim injunctions to restrain the defendants from publishing particular information or representing any association with the plaintiffs, and to require the defendants to deliver specified material intended to be published first to plaintiffs for inspection.

[2]    Ultimately my judgment was not required, the parties agreeing on interim terms after the day’s hearing, except as to costs. My preliminary view was:1

So far as costs are concerned, although costs on interlocutory applications usually follow the event, to require “the party who fails with respect to … an interlocutory application [to] pay costs to the party who succeeds”, an award of costs nonetheless is to “reflect the complexity and significance of the proceeding”. The present consensual circumstances in combination lead me to the preliminary view costs on this interlocutory application should be reserved for determination consistently with the result of the substantive proceeding – that is to say, for payment by the party who fails at trial.

[3]    The plaintiffs say their interlocutory application nonetheless was necessary to protect their perceived risk, as reflected in the consensual relief’s closeness to the sought orders, rendering them the successful parties for costs purposes. The defendants respond they identified the plaintiffs’ prospective risk and sought information from the plaintiffs to identify if it had substance, to which the plaintiffs’ interlocutory applications were issued instead. The ultimate consensual relief leaves determination of risk in the defendants’ hands, rather than in those of the plaintiffs as was sought. The plaintiffs reply I can make my own assessment of success from the day’s hearing.

Background

[4]    The first defendant, Cameron Nelson Hart (“Mr Hart”) is a software developer and computer programmer. He developed a data integration product under a personal intellectual property licence (the “CNH IP licence”). To commercialise the product, to be known as Flow, he incorporated the second plaintiff and licensed the product to it.

[5]    In 2006, Mr Hart attracted other shareholders to the second plaintiff, while continuing as both director and shareholder. He initially was employed by the second

1 Minute, 2 October 2020, at [3].

plaintiff until August 2014, when he continued until February 2015 independently to contract to it on terms including he may “have an existing business operating in competition to the [second plaintiff] and that IP may transfer both ways”. He was bought out of his shareholding in July 2015.

[6]    In March 2015,  Mr  Hart  incorporated  the  second  defendant  (“Brew”).  He assigned his 2006 property rights in the Flow product to Brew, and sought the second plaintiff update its licence accordingly. In August 2016, in settlement of the consequential dispute, Mr Hart, Brew, and the second plaintiff agreed Mr Hart’s 2006 property rights in the Flow product should be “jointly owned in equal shares” by each Brew and the second plaintiff, who had “the unrestricted right to freely and without reference to each other … use, copy, reproduce, translate, decompile, modify, [and] vary” Mr Hart’s 2006 property rights – as well as to grant licences to third parties, or assign, transfer or otherwise dispose of their interests – in the Flow product.

[7]    In September 2019, in exercise of that right, Mr Hart initially proposed to sell Brew’s share in the Flow product, of which the plaintiffs were an obvious potential purchaser to secure sole ownership of the Flow product. After those negotiations were postponed by COVID-19’s circumstances in March 2020, he decided instead to use his 2006 property rights to develop a competing product, to be known as Flold, for which purpose Brew licenced the third defendant (“Velox”) to use them.

[8]    For that development, in June 2020, Mr Hart proposed disclosing portions of the Flow product’s computer code on a publicly accessible website for other software developers’ input. Such disclosure necessarily includes the mechanisms by which licensed use of the Flow product is secured. Mr Hart apprehended he was entitled to disclose those public/private and symmetric keys as forming part of his 2006 property rights in the Flow product, and it was for the plaintiffs to change them if they were to maintain security of the Flow product.

[9]    The plaintiffs disputed Mr Hart was entitled to disclose their confidential information, which they contended was made up by the security keys and other customer information said to be embedded in the Flow product’s 2006 source code. Mr Hart’s apparent approach to the Flow product’s security left them concerned for

his disregard of the alleged confidential information in his possession. Flold’s intended website collateral also raised the plaintiffs’ concerns for their fairness of its prospective competition with the Flow product.

[10]   The parties’ subsequent correspondence was vexed by (mis)apprehensions the plaintiffs had access to the Flow product’s 2006 source code, and the plaintiffs’ public/private keys were embedded in that source code. As became apparent after this proceeding’s issue on 15 July 2020, the plaintiffs’ public/private keys differed from those in the 2006 source code, to which they did not have access. The plaintiffs’ anxiety the Flow product’s security risked compromise – and their inability to know what other of their confidential information risked disclosure, together with the prospect of Flold’s unfair competition with Flow – led to their original application for interim injunctions restraining the defendants from publishing particular information or representing any association with the plaintiffs.

[11]   In advance of the interlocutory application’s one-hour hearing scheduled for 23 July 2020, the defendants undertook to the plaintiffs – largely in terms of the application’s sought order – not to publish “any part of the encryption keys or security information contained in the plaintiffs’ software products” (including particularised components), or to represent any association with or diminution of the plaintiffs, pending the application’s resolution at the one-day hearing subsequently scheduled before me. Prior to that hearing, the plaintiffs enlarged their application to extend to non-publication of “any other material that could compromise the security of Flow Software or its customers” and of “anything that could be used to reconstruct” any of the particularised components, and to require the defendants’ delivery to the plaintiffs’ solicitors of “a copy of the 2006 source code and other CNH IP licence works or material the defendants intend to release via open source or otherwise”. That enlargement came for hearing before me on 28 September 2020.

Discussion

[12]   Had I to have determined the application – having regard to the standard principles for determination of interim injunction applications, by which interlocutory

injunctions lie to protect plaintiffs from “irreparable damage” for which they cannot adequately be compensated2 – I would have dismissed it for the following reasons.

—serious questions for trial

[13]   For the defendants, Rob Latton strongly disputed there was any serious confidentiality or FTA question for trial. The plaintiffs’ misapprehension the 2006 source code included their public/private keys removed the foundation for any claim in relation to their misuse and other material claimed confidential already was published on the internet by the plaintiffs.

[14]   I doubted the limited and particular availability of the published material was sufficient to waive any confidentiality inherent in its substance. Whether the substance truly was confidential, imparted in circumstances importing that obligation, and subject to unauthorised and detrimental use are questions for trial.3 Mr Latton contended the last indisputably was answered by the defendants’ undertakings, but that is to put cart before horse. Absent the undertakings, the defendants clearly intended publishing portions of the 2006 source code, which – even leaving aside the parties’ different public/private keys – does not address the prospect other of the plaintiffs’ confidential information risked misuse.

[15]   Similarly, the Flold website’s references to Flow were enough to justify trial of if those references are misleading and deceptive. Mr Latton only pointed to some literal individual accuracy, but their overall potential impact in the particular circumstances required examination at trial.4

[16]   I therefore would have held the plaintiffs to have established serious questions for trial.

2      American Cyanamid Co v Ethicon Ltd [1975] AC 396 (HL) at 406, endorsed in Klissers Farmhouse Bakeries Ltd v Harvest Bakeries Ltd [1985] 2 NZLR 129 (CA) at 133; Wellington International Airport Ltd v Air New Zealand Ltd HC Wellington CIV 2007-485-1756, 30 July 2008 at [4], citing [Cayne] v Global Natural Resources Plc [1984] 1 All ER 225 (CA) at 237, and [6]–[14].

3      Skids Programme Management Ltd v McNeill [2012] NZCA 314, [2013] 1 NZLR 1 at [76], citing

Coco v A N Clark (Engineers) Ltd [1969] RPC 41 (Ch) at 47.

4      Red Eagle Corporation Ltd v Ellis [2010] NZSC 20, [2010] 2 NZLR 492 at [28]; AMP Finance NZ Ltd v Heaven (1997) 8 TCLR 144 (CA) at 152.

—balance of convenience

[17]   The precise terms of the defendants’ previous undertaking to the plaintiffs were:

[T]he defendants will not and will not assist any other person to, directly or indirectly:

(a)    publish in any way to any person any part of the encryption keys or security information contained in the plaintiffs’ software products, including without limitation (i) private and public keys[;] (ii) third party licence code; (iii) symmetric keys used to protect access to Flow Software’s servers and to protect the private information of users of Flow Software; (iv) encrypted usernames and passwords used to connect to Flow servers; (v) hashed default passwords for the FloAdmin user; (vi) the encryption key used by Flow Software to protect the credentials saved by users at each Flow Product installation; (vii) any other hashed or encrypted data;

(b)    represent or suggest that any product offered or to be offered by them is or is the equivalent of current Flow products, or is authorised by or is associated with the plaintiffs or any of them;

(c)    represent or suggest that current Flow products … are old or are legacy, or have not undergone significant change since 2006;

(d)    use any of the plaintiffs’ logos or branding or anything that suggests that they or any product they offer is associated with any of the plaintiffs;

(e)    use the FLOLD logo or any other logo that closely resembles the plaintiffs’ logos, and not to use the FLOUEN logo for any commercial purpose or otherwise in trade.

The defendants’ undertaking was to “subsist until agreement to the contrary by the plaintiffs and the defendants, or until resolution of the proceeding or further order of the court”. On my enquiry at the hearing, Mr Latton confirmed after taking instructions the defendants undertook in those terms to the Court.

[18]   Nonetheless, the plaintiffs sought interim injunctions issue also against the defendants’ “related companies, directors, servants and agents”. Mr Latton resisted that formula as of unspecified entities (although at least ‘related company’ and ‘director’ would appear to call in their Companies Act 1986 definitions, and ‘servants’ and ‘agents’ to recognise corporate entities act ultimately through human beings).

[19]   The sought orders also would have expanded the undertaking’s (a) reference to “software products” to “the plaintiff’s past and current software products or any other material that could compromise the security of Flow Software or its customers”,

and similarly would additionally have specified “(viii) anything that could be used to reconstruct any of the items in (i) to (vii)”. (The sought orders also would have amplified the undertaking’s (d) to include is “authorised by” any of the plaintiffs, and

(e) to “replicate” the plaintiffs’ logos.) Last, the plaintiffs additionally sought an order:

The defendants forthwith deliver to the plaintiffs’ solicitors, in an electronic form able to be analysed using publicly available standard analytical tools, a copy of the 2006 source code and other CNH IP licence works or material the defendants intend to release via open source or otherwise.

[20]   For the plaintiffs, Earl Gray had explained the expansions were sought for clarity, to avoid any ‘tricksy’ interpretation essayed by Mr Hart, as he was said to have attempted in construing the undertaking’s reference to ‘software products’ to be only to those currently offered by the plaintiffs. However, as undertakings to the Court, the defendants bore the risk of any uncertainty as to the undertaking’s scope in subject or object. This Court already had indicated ‘software products’ are not obviously to be construed only as the plaintiffs’ current offering. If prior clarification was not sought and obtained, contempt findings and penalties may have been be a consequence.

[21]   The point of interim injunctions generally is to restore the status quo: “the last peaceable state between the parties”;5 if required to enable determination and any remedy of the parties’ contested rights at trial: “to enable substantial justice to be done between the parties”.6 (Hence, where damages provide adequate compensation, “no interim injunction should normally be granted”.7) Thus interim injunctions are to prevent specified actions alleged irremediably to change the status quo in reliance on one party’s contention as to those rights. They are not intended in themselves to require compliance with the other party’s contention as to those rights. Injunctions to ‘obey the law’ – here, to not compromise Flow’s or its customers’ security – are empty.

[22]   For those reasons I would not have ordered in terms of the expansions sought on the undertaking.

5      Wellington International Airport Ltd v Air New Zealand Ltd, above n 2, at [10], citing R & M Wright Ltd v Ellerslie Gateway Motels Ltd HC Auckland CP188/90, 11 July 1990, at 8.

6      Commerce Commission v Viagogo AG [2019] NZCA 472, [2019] 3 NZLR 559 at [81].

7      Wellington International Airport Ltd v Air New Zealand Ltd, above n 2, at [6].

[23]   Mr Gray explained the mandatory order sought was to give the plaintiffs opportunity  to  “vet”  the  defendants’  intended  releases  for   any  security  risk. He explained, as demonstrated by their previous interactions with the defendants on disputed security issues, the plaintiffs would have acted swiftly and without collateral purpose in responding to such intentions. He said I could have been confident the order would have been made at trial, because Mr Hart was obliged earlier to transfer at least a copy of the 2006 source code and CNH IP licence works to the second plaintiff.

[24]   I was less sure the plaintiffs then could demand the defendants’ delivery up of the 2006 source code and CNH IP licence works on that basis. The issue appeared compromised by the 11 August 2016 settlement agreement between Mr Hart, Brew, and the second plaintiff, which fully and finally settled the second plaintiff’s claim against Mr Hart for that failure to transfer. Neither was the sought delivery-up “simple and summary”. To the contrary, it anticipated deferral of the defendants’ intentions, for their consideration of the plaintiffs’ objections, without certainty as to whether or how those should be accommodated, and in a climate of prospective competition between the parties. No machinery was proposed for the plaintiffs’ intervention. The sought order illustrated why such mandatory interim relief should only be given in special circumstances.8 Here it was to disturb the status quo, to give the plaintiffs an advance on the last settled position with the defendants.

[25]   Mr Gray argued any disclosure of security material would be devastating to the plaintiffs and their customers. Because they lack the 2006 source code and CNH IP licence works, they could not identify the scope of their exposure or take steps to have the defendants secure it. It would be too late if the defendants’ undertaking did not cover the contemplated disclosure.

[26]   I was aware of the plaintiffs’ anxiety. It was precisely because, in allowing under the 11 August 2016 settlement agreement Brew and the second plaintiff each had “the unrestricted right to freely and without reference to each other … use, copy, reproduce, translate, decompile, modify, [and] vary” their jointly-owned 2006 source code and CNH IP licence works, the plaintiffs did not take steps to safeguard any

8      Precast NZ Ltd v Anystep Ltd [2016] NZHC 377 at [44] citing A C Beck and others (eds) McGechan on Procedure (online ed, Thomson Reuters) at [HR7.53.23] (presently 7.53.16).

security detail in that data. They were wholly (although then possibly uncomprehendingly) reliant instead on operation of the law on confidence, and the defendants’ adherence to it.

[27]   So far as I could tell from the correspondence between the parties, despite its misfiring, there appeared no ground to contemplate the defendants would disregard any confidentiality obligation. There was significant dispute if the parties’ unrestricted rights to their jointly-owned material meant any inherent confidentiality was spent. The correspondence engaged on security, not confidentiality. And the defendants then had undertaken to the Court not to “publish in any way to any person any part of the

… security information contained in the plaintiffs’ software products”.

[28]   In terms of the balance of convenience, I would have assessed it would be harder on the defendants to have their actions intermediated by the plaintiffs if ultimately successful at trial, than it would be on the prospectively successful plaintiffs belatedly then to have advance opportunity to secure any security information as might be disclosed by the defendants (despite their undertaking not to disclose).

[29]I would not have made the mandatory order sought.

—overall justice

[30]   Standing back, I would have held leaving the plaintiffs to rely on the defendants’ undertaking to the Court also accorded with overall justice. The plaintiffs had not recognised the risk presented to their security by the settlement arrangement. It should not have been for the defendants then to make up for that oversight.

[31]   Thus, on costs, the combination of the plaintiffs’ failure with the defendants’ undertaking would have led me to the preliminary view costs should be reserved for determination consistently with the result of the substantive proceeding. That obviously would have been the same result as my preliminary view in “the present consensual circumstances in combination” on the costs application now.

Result

[32]   For those reasons, I am confirmed in my preliminary view, and reserve costs for determination consistently with the result of the substantive proceeding.

—Jagose J