# MEMORANDUM **To:** Kestrel Devices Board **From:** Outside Counsel **Re:** Meadowlark Software Foundation Demand / OpenTrellis Audit **Date:** Board Meeting Preparation --- ## Executive Summary Kestrel has a real copyright problem, not merely a contract problem. The OpenTrellis license’s source-delivery requirement is a **condition**, and Kestrel distributed modified OpenTrellis in 41,000 devices without providing source code or the license to recipients. That is infringement unless cured or settled. The cloud analytics service is materially different: the license expressly says network access without transferring a copy is **not** distribution, so the cloud backend does **not** trigger the copyleft source obligation. The hardest issue is scope: the modified OpenTrellis library is clearly a covered “work based on” OpenTrellis. The full firmware is at serious risk if OpenTrellis is incorporated into, linked with, or intimately intertwined with the rest of the firmware. The cloud codebase should not be included. Because OpenTrellis was registered after infringement began and more than three months after first publication, Meadowlark cannot recover statutory damages or attorney fees on the copyright claim. It can recover actual damages and attributable profits. But the separate **header-stripping / CMI claim** is not registration-limited and adds a hard statutory exposure of **$2,500 to $25,000 per violation** — likely $157,500 to $1,575,000 if 63 source files count as 63 violations. Defensible exposure range: | Scenario | Copyright damages/profits | CMI exposure | Total | |---|---|---|---| | Best case for Kestrel | $100k–$500k | $157.5k | **~$260k–$660k** | | Likely settlement/litigation zone | $1M–$3M | $475k–$945k | **~$1.5M–$3.9M** | | Worst case | $15.1M if all device profit is attributed | $1.575M | **~$16.7M** | Meadowlark’s $2M demand is within a plausible but aggressive range. Kestrel should not pay it without a global settlement and should not agree to release the full firmware or cloud codebase. **Recommended course:** Begin replacement immediately, negotiate a settlement covering past infringement and the CMI claim, release only the modified OpenTrellis source if required, resist full-firmware/cloud open-sourcing, and prepare to oppose an injunction if Meadowlark files. --- ## 1. The Device Firmware: License Condition Violated The license says: > “You may distribute this software or works based on it only if you provide recipients the complete corresponding source code and this license.” The facts add that these scope terms are **conditions**. Kestrel: - Incorporated OpenTrellis into firmware. - Modified OpenTrellis for its sensor. - Sold 41,000 physical devices containing the modified library. - Never provided source code or the license text to purchasers. - Removed license headers and attribution from 63 files before release. Because selling a physical device with firmware is distribution, and because Kestrel did not provide source or license text, the distribution was **outside the scope of the license**. The condition failed. ### Consequence of condition vs. covenant If the source-delivery term were only a covenant, Meadowlark would be limited to contract damages. But because it is a **condition**, the unauthorized distribution is **copyright infringement**. That matters because Meadowlark can seek: - Infringement damages and disgorgement of attributable profits; - Injunctive relief, subject to the equitable standard; - The separate CMI statutory claim. Kestrel cannot argue that its only exposure is “breach of contract.” The license defense fails for the distribution acts. --- ## 2. Cloud Backend: Not Distribution The license expressly provides: > “Providing access to the software’s functionality over a network, without transferring a copy, is not distribution.” Kestrel’s backend module links against unmodified OpenTrellis, but no copy of the backend is transferred to customers. Customers only access a web dashboard. Under the supplied license, that is **not distribution**, and internal use/modification without distribution does not violate the license. So the cloud backend does **not** trigger the source-code obligation. Meadowlark’s demand to release the cloud codebase has **no license basis**. --- ## 3. How Far Does “Work Based on It” Reach? ### A. Modified OpenTrellis library Clearly a “work based on” OpenTrellis. Kestrel modified it. The source for the modified library must be provided to recipients when the modified library is distributed. ### B. Full firmware This is the central legal risk. The test is whether the firmware “incorporates, adapts, or is intimately intertwined” with OpenTrellis, not whether it merely interoperates through a stable interface. Here, the facts say Kestrel’s **firmware incorporates OpenTrellis** and the modified library was shipped **in** the firmware. If the firmware is one linked image or executable containing OpenTrellis, Meadowlark has a credible argument that the entire firmware is a combined derivative work. If that is true, “complete corresponding source code” may include the proprietary firmware source, including the sensor-fusion code. Kestrel’s best counterargument is that OpenTrellis is a separable library and that the rest of the firmware merely calls it through a stable interface. If the code is not actually intertwined, only the modified OpenTrellis source may be required. But based on the facts as stated, **Kestrel should assume the full firmware is at risk**, while continuing to develop a code map to support the narrower reading. ### C. Cloud codebase No. Even if the backend is a “work based on” OpenTrellis, it is not distributed, and network access is expressly not distribution. So the cloud codebase is outside the reciprocal source obligation. --- ## 4. Damages, Registration, and the Header-Stripping Claim ### A. Copyright claim: no statutory damages or attorney fees OpenTrellis was first published four years ago. Registration occurred 14 months after Kestrel’s first device shipped. Therefore: - Registration was **not** before infringement began; - Registration was **not** within three months of first publication; - Meadowlark is limited to **actual damages plus attributable profits** on the copyright infringement claim; - Meadowlark cannot recover statutory damages or attorney fees on that claim. ### B. Attributable profits: the arithmetic Kestrel’s device revenue: - $28M/year × 19/12 ≈ **$44.3M** - At 34% margin, device profit over the period ≈ **$15.1M** Meadowlark will try to use the 41,000 devices as infringing sales and argue that all or most of the device profit is attributable to the infringing firmware. Kestrel’s response must be **apportionment**: OpenTrellis is one firmware component; the product value comes from hardware, sensors, industrial design, sales channel, and the rest of the firmware. The modified OpenTrellis component, standing alone, has little competitive value. The court will require Meadowlark to show gross revenue, then Kestrel can prove deductible costs and that profits are attributable to non-infringing factors. The outcome is uncertain. A defensible range: - **Low:** $100k–$500k, treating OpenTrellis as a small component and using a reasonable-license / replacement-cost approach. - **Medium:** $1M–$3M, based on a meaningful but not dominant share of the device profit. - **High:** $15.1M, if the court attributes the entire device profit to the infringing firmware and Kestrel fails to prove apportionment. ### C. Header-stripping / CMI claim changes the arithmetic The facts say: > Knowingly removing or altering copyright management information, including license headers and author attributions, with intent to conceal infringement, supports a separate claim carrying statutory damages of $2,500 to $25,000 per violation, independent of registration timing. The repository history confirms headers and attributions were deleted from **63 source files**. If each file is a violation: - Minimum: 63 × $2,500 = **$157,500** - Maximum: 63 × $25,000 = **$1,575,000** This is independent of the copyright registration problem. Even if Meadowlark’s copyright damages are modest, the CMI claim gives it a real statutory floor and a plausible path to seven figures. If a court counts the entire header-stripping episode as one violation, the CMI exposure is much smaller. If it counts per file, the exposure is above. Kestrel should argue “one coordinated act” while assuming per-file exposure for settlement purposes. ### D. Evidentiary effect of the “strip the headers” message The internal message is powerful adverse evidence: > “Strip the headers before we ship. Nobody diffs firmware.” It will be used to show: - **Knowledge** of the OpenTrellis license; - **Intent to conceal** infringement; - **Willfulness**, which supports a high CMI award; - Bad faith, which hurts Kestrel in injunction and settlement discussions. It is likely an admission of a company employee within the scope of employment. Kestrel should not try to explain it away as an isolated joke. It should assume Meadowlark will use it. --- ## 5. Injunction: Can Meadowlark Halt Device Sales? Under the stated law, injunctive relief requires: - Irreparable harm; - Inadequacy of legal remedies; - Harm is **not presumed** from infringement. Meadowlark is not automatically entitled to a sales halt just because it wins on infringement. ### Meadowlark’s best arguments - Kestrel is continuing to distribute infringing firmware after notice; - Each new device sale is a new unauthorized distribution; - The source-delivery obligation is not just money; recipients have already been denied source code and license rights; - The header-stripping shows Kestrel knew and tried to hide the problem; - If Kestrel is allowed to keep selling while paying later, it can effectively force a license on Meadowlark. ### Kestrel’s strongest arguments against irreparable harm 1. **Money damages are adequate.** Meadowlark is not a direct competitor. It does not sell devices. The harm can be valued as a royalty, damages, or attributable profits. 2. **The $2M demand itself prices the injury.** A party demanding a specific dollar amount undercuts a claim that no legal remedy exists. 3. **Kestrel can replace OpenTrellis in six weeks.** A limited transition period can be protected by a bond or escrow; a blanket sales halt is not needed. 4. **A device sales halt would cause disproportionate harm.** It would disrupt customers, destroy near-term revenue, and jeopardize the pending acquisition. 5. **Harm cannot be presumed.** Meadowlark must show actual, non-compensable harm, not simply that infringement occurred. **Bottom line:** A court may issue a **narrowly tailored injunction** — for example, requiring Kestrel to stop distributing OpenTrellis until it provides source or obtains a license. A **blanket device-sales halt** is less likely if Kestrel offers a credible compliance plan and bond, but it remains a real risk because of the bad-faith header stripping. --- ## 6. Audit Demand: What to Accept, Resist, Counterpropose ### Accept - A **limited audit** focused on whether OpenTrellis or derivatives appear in distributed products. - Production of source code and license compliance information for the **modified OpenTrellis component**, and potentially the firmware if it is truly a combined work. - An independent examiner under an NDA and a privilege-protected protocol. ### Resist - Release of the **entire firmware** source under the reciprocal license — especially the proprietary sensor-fusion code. - Release of the **cloud codebase** — there is no license basis. - An unrestricted audit of **all Kestrel repositories** by Meadowlark’s own chosen examiner. - An audit that would expose attorney-client privileged material or unrelated trade secrets. ### Counterpropose - A neutral, mutually agreed examiner or outside counsel. - Audit scope limited to identifying OpenTrellis code, derivatives, and distribution records. - No copying of unrelated code; no access to unrelated repositories. - Findings delivered to counsel, with Kestrel able to challenge scope. - If Meadowlark insists on access to the full firmware source, use an escrow arrangement pending a legal determination, rather than public open-sourcing. --- ## 7. Remediation Paths Compared ### A. Release modified OpenTrellis source only - **Pros:** Low cost; reveals little competitive value; may satisfy the minimum license obligation if the rest of the firmware is not a derivative work. - **Cons:** If the full firmware is a derivative work, this does **not** fully comply. It also does not resolve past damages or the CMI claim. - **Use:** Offer as part of a settlement, not necessarily as a complete cure. ### B. Six-week replacement with commercial alternative - **Cost:** $180,000 and six weeks. - **Pros:** Stops future infringement; preserves proprietary sensor-fusion code; reduces injunction risk; clean long-term position. - **Cons:** Does not fix past infringement or CMI; new firmware releases pause; devices shipped during the six-week transition may still contain OpenTrellis and need a transition license or source compliance. ### C. Paid commercial license - **Pros:** If Meadowlark is willing, it preserves current firmware and avoids engineering replacement. - **Cons:** Meadowlark is an open-source foundation and may not offer commercial licenses. It may view the violation as non-monetary and demand source compliance instead. - **Use:** Only as a settlement component, not a fallback that can be assumed. ### D. Negotiated global settlement - **Pros:** Caps exposure, resolves the CMI claim, avoids litigation/injunction, protects the acquisition, and can include a transition period. - **Cons:** Requires payment and some concessions. Kestrel must avoid agreeing to open-source the entire firmware or cloud codebase. ### Recommended combination Kestrel should pursue a **negotiated settlement plus replacement**. The settlement should: 1. Resolve past infringement and CMI claims; 2. Include a short transition license for devices shipped while replacement is completed; 3. Include a limited audit; 4. Release only the modified OpenTrellis source, not the full firmware or cloud codebase; 5. Include a mutual release and no admission of liability, if possible. --- ## 8. Effect of the Pending Acquisition The outstanding letter of intent makes this significantly more urgent. Kestrel likely has, or will be asked to give, representations that: - Its products do not infringe third-party IP; - It has complied with all licenses; - There are no undisclosed liabilities or claims; - No material adverse change has occurred. Meadowlark’s demand and the “strip the headers” message are **material**. Kestrel must disclose this to the acquirer before signing a definitive agreement. If Kestrel does not, the acquirer may: - Terminate; - Reduce the purchase price; - Require indemnity or escrow; - Bring a fraud claim later. Kestrel should **not** delete or alter the repository history. That would be spoliation and would make matters dramatically worse. The evidence is already there; the board should preserve it and prepare a remediation narrative. The acquisition also creates leverage for Meadowlark. They know Kestrel needs a clean exit. Kestrel should not overpay purely out of deal panic, but it should be willing to buy certainty if the terms are reasonable. --- ## 9. Recommended 30-Day Course of Action ### Days 1–2 - Retain outside IP counsel with open-source license experience. - Issue a litigation hold; preserve all repository history, logs, and communications. - **Do not delete the “strip the headers” message or any related evidence.** - Restore license headers and attribution in all current source files immediately. - Assume new device shipments containing OpenTrellis are additional infringement. The safest position is to stop further distributions unless Kestrel either: - Provides compliant source to recipients, or - Obtains a written transition license / settlement from Meadowlark. ### Days 3–5 - Prepare a response to Meadowlark. - Do not make false statements, but do not concede liability unnecessarily. - Propose a 30-day compliance plan: - Limited audit; - Replacement project; - Source release for the modified OpenTrellis component if necessary; - Settlement discussion covering damages and CMI. ### Days 6–15 - Build a code map: exactly where OpenTrellis appears, what was modified, and whether the rest of the firmware is arguably a derivative or a separable interoperating module. - Begin the six-week replacement engineering work immediately. - Negotiate with Meadowlark. Aim for a global settlement in the **$500,000–$1,500,000 range** plus a limited audit and source release, if that avoids opening the full firmware and cloud codebase. - If Meadowlark insists on full firmware source, Kestrel should seriously consider replacement and litigation rather than giving away its principal asset. ### Days 16–30 - Complete settlement terms or prepare for litigation. - If no settlement is reached: - Prepare opposition to any injunction motion; - Preserve the argument that legal remedies are adequate and that Kestrel is replacing the component; - Prepare disclosure materials for the acquirer; - Model damages with an expert if necessary. --- ## Bottom Line Kestrel should not agree to Meadowlark’s demand as written. The cloud codebase should not be released. The full firmware should be open-sourced only if a court decides it is a derivative work or as a last-resort settlement term. The practical solution is: 1. **Stop the bleeding** — either stop distributing OpenTrellis or get a transition license. 2. **Run the replacement** in parallel. 3. **Settle the past**, including the CMI claim, for a defensible amount. 4. **Keep the proprietary firmware and cloud codebase closed.** The board should be prepared for a settlement in the low-to-mid seven figures if necessary, but should not surrender the company’s principal asset to avoid a lawsuit.