Apple loses copyright infringement claims against security startup Corellium

(Reuters) — A federal judge in Florida on Tuesday dismissed Apple’s copyright infringement claims against a Florida startup whose software helps security researchers find vulnerabilities in Apple products, including the iPhone.

U.S. District Judge Rodney Smith ruled in favor of Corellium, saying its software emulating the iOS operating system that runs on the iPhone and iPad amounted to “fair use” because it was “transformative” and helped developers find security flaws.

Apple accused Corellium of essentially replicating iOS to create “virtual” iOS-operated devices whose “sole function” was to run unauthorized copies of the system on non-Apple hardware.

But the Fort Lauderdale-based judge said Corellium “adds something new to iOS” by letting users see and halt running processes, take live snapshots, and conduct other operations.

“Corellium’s profit motivation does not undermine its fair use defense, particularly considering the public benefit of the product,” Smith wrote.

The judge also rejected Apple’s argument that the Delray Beach startup acted in bad faith by selling its product indiscriminately, including potentially to hackers, and by not requiring users to report bugs to Apple.

He said that argument appeared “puzzling, if not disingenuous,” saying Cupertino, California-based Apple did not impose a reporting requirement under its own Bug Bounty Program.

Apple did not immediately respond to requests for comment.

Corellium has denied wrongdoing. Justin Levine, one of its lawyers, said in an email the decision made “proper findings in connection with fair use.”

Smith said Apple may still pursue a separate federal law claim that Corellium circumvented its security measures when creating its software.

Corellium was founded in August 2017. According to court records, Apple tried to buy Corellium starting in January 2018, but talks had broken down by that summer. Apple sued Corellium in August 2019.

The case is Apple Inc v. Corellium LLC, U.S. District Court, Southern District of Florida, No. 19-81160.

(Reporting by Jonathan Stempel in New York. Editing by David Gregorio.)