# MEMORANDUM

**TO:** Board of Directors, Kestrel Devices
**FROM:** General Counsel / Management Team
**DATE:** October 26, 2023
**SUBJECT:** Strategic Response to Meadowlark Software Foundation Audit Demand and Infringement Claim

## Executive Summary
Kestrel is facing a material legal threat regarding the use of the "OpenTrellis" open-source library in our device firmware. While we have not violated the license terms regarding our cloud backend, we failed to satisfy the distribution conditions for the modified library embedded in 41,000 shipped devices. Furthermore, internal documentation evidences intentional removal of copyright headers, triggering significant statutory damages under anti-circumvention laws.

**Key Risks:**
*   **Infringement Liability:** Past shipments constitute copyright infringement due to missed license conditions (source release).
*   **CMII Statutory Exposure:** Intentional header removal creates a separate claim with statutory damages ($2,500–$25,000 per violation) that bypasses the copyright registration limitations.
*   **Trade Secret Risk:** Complying with the license (releasing "derivative work" source) risks exposing our proprietary sensor-fusion code.
*   **Transaction Risk:** The pending acquisition LOI is jeopardized by potential injunctions or undisclosed IP litigation.

**Recommendation:** We recommend **negotiating a confidential settlement** within 30 days, capping liability at $2.5M–$4.0M, while simultaneously pausing shipment of non-compliant firmware and commencing replacement development. Compliance via source release is not a viable commercial option due to trade secret exposure.

---

## Detailed Legal Analysis

### 1. Firmware Violation: Condition vs. Covenant
**Analysis:** Under the governing law, scope terms of the OpenTrellis license are **conditions**, not covenants. The license explicitly states that conveying software on a physical product is "distribution." Kestrel shipped modified OpenTrellis in 41,000 devices without providing source code or license text.
**Consequence:** This is **Copyright Infringement**, not merely breach of contract. While breach of a covenant allows only contract remedies (damages), infringement supports statutory damages, injunctive relief, and attorney’s fees. Because we missed the "condition" of providing source upon distribution, we are infringers.
**Verdict:** We are liable for infringement regarding all 41,000 shipped devices.

### 2. Cloud Backend: Network Use vs. Distribution
**Analysis:** The license explicitly distinguishes between transfer and access: *"Providing access to the software's functionality over a network, without transferring a copy, is not distribution."*
**Consequence:** Our cloud analytics service links against unmodified OpenTrellis but serves customers via a web dashboard without transferring copies.
**Verdict:** **No infringement.** This component is safe from this specific claim. Meadowlark’s demand for our "cloud codebase" to be released under the reciprocal license has no legal basis under the written text and should be rejected immediately.

### 3. Scope of "Work Based On It" (Derivative Work)
**Analysis:** The obligation to release source applies to "works based on" the licensed software.
*   **Modified Library:** Clearly covered. Releasing this source has low commercial risk.
*   **Full Firmware:** If OpenTrellis is statically linked or "intimately intertwined" with our proprietary sensor-fusion code, the *entire firmware* is a derivative work requiring release. Mere interoperation via stable interface might suffice to isolate them, but given Kestrel modified the library to support its sensors, a court likely finds them intertwined.
*   **Cloud Code:** Not a derivative of the firmwre version and not distributed; no obligation.
**Risk:** If obligated to release "the work," we would lose our principal asset (sensor-fusion code). This makes legal compliance commercially fatal.

### 4. Damages and Exposure Arithmetic
**A. Copyright Infringement (Firmware Distribution)**
*   **Registration Timing:** OpenTrellis was published 4 years ago; registered 14 months after Kestrel began shipping.
*   **Law:** Statutory damages and attorney fees are available *only* if registration occurred before infringement or within three months of publication.
*   **Result:** Meadowlark is limited to **Actual Damages + Profits**. They cannot claim the standard statutory range per infringing unit for the copyright claim itself.
    *   *Estimate:* Reasonable royalty rate (industry avg ~3-5% of software value) on $28M revenue pro-rated over 19 months (~$8.7M relevant revenue). Low-end exposure: **$250k – $500k**.

**B. Copyright Management Information (CMII) Claim**
*   **Law:** Statutory damages ($2,500–$25,000 per violation) apply if headers were knowingly removed to conceal infringement. This claim is **independent of registration timing.**
*   **Evidence:** The engineer's message ("Strip the headers... Nobody diffs") proves knowledge and intent. 63 files had headers removed.
*   **Exposure Calculation:**
    *   *Conservative (Per File):* 63 files × $2,500 = ~$157k.
    *   *Aggressive (Per Device Shipment):* If a court views every device shipment as a violation of CMII: 41,000 devices × 63 files is astronomical ($6B+). Courts often limit this to distinct "acts" or "works," but the risk remains severe.
    *   *Realistic Risk:* Meadowlark will argue per-device liability for negotiation leverage. Even capped at $25k/violation on a per-batch basis, this is significant.
*   **Combined Exposure:** The CMII claim neutralizes our defense regarding registration delay. It forces a settlement well above the "Actual Damages" floor.

**Defensible Exposure Range:** **$2.0 Million – $4.5 Million.**
(This includes legal fees, reasonable royalty for past use, and settlement premium to dismiss the high-variance CMII claim).

### 5. Evidentiary Effect of the "Strip Headers" Message
The internal message is admissible corporate communications (not privileged unless sent to counsel). It definitively proves **willfulness** and **intent to conceal**. This:
1.  Eliminates the "innocent infringement" defense.
2.  Secures Meadowlark's right to statutory damages under the CMII statute regardless of copyright registration status.
3.  Weakens our position in seeking injunctive relief (courts balance equities; willful misconduct weighs against us).

### 6. Injunctive Relief Analysis
**Can they halt sales?** Yes, if they prove irreparable harm and inadequacy of monetary damages.
*   **Meadowlark's Argument:** Monetary damages cannot compensate the loss of "freedom" to enforce their license terms; continued infringement harms their open-source mission.
*   **Kestrel's Defense:**
    1.  **Monetary Adequacy:** Since statutory damages are barred (except for CMII), monetary damages are a complete remedy for the copyright claim.
    2.  **Public Interest:** Halting sales disrupts critical warehouse infrastructure; Kestrel is not a "troll," but a hardware startup providing jobs and services.
    3.  **Irreparable Harm to Kestrel:** An injunction kills the company and the pending acquisition, causing irreparable harm *to us* that outweighs Meadowlark's harm (which can be monetized).
**Risk:** If we refuse to release source code (due to trade secrets), the court may find monetary damages inadequate for the open-source foundation and grant an injunction.

### 7. Audit Demand Strategy
Meadowlark seeks audit of "all Kestrel repositories."
*   **Resist:** Total repository access reveals our proprietary sensor-fusion code (Trade Secrets).
*   **Counterproposal:**
    1.  Scope limited to OpenTrellis files and build scripts only.
    2.  Examiner must be an independent third-party firm, under a strict NDA with Kestrel's counsel present.
    3.  Meadowlark cannot copy or store the data; they may only view compliance evidence.

### 8. Remediation Paths Comparison

| Path | Pros | Cons | Recommendation |
| :--- | :--- | :--- | :--- |
| **Release Full Firmware Source** | Legal compliance; stops infringement claim. | Destroys IP moat (sensor-fusion); kills valuation. | **Reject.** |
| **Replace OpenTrellis (6 Weeks)** | Long-term fix; cleans the codebase. | Takes 6 weeks; doesn't resolve past liability; sales pause during transition is risky. | **Do, but in parallel to settlement.** |
| **Commercial License** | Legalizes future use; cleans record. | Likely requires high premium for retroactive coverage; may still require settlement on past infringement. | **Consider as part of deal.** |
| **Negotiated Settlement** | Cap liability; avoid injunction; protect trade secrets; satisfy investors. | Costs $2M+ cash now. | **Preferred Primary Strategy.** |

### 9. Impact of Pending Acquisition
*   **Disclosure:** The LOI likely contains representations regarding IP compliance and pending litigation. Failure to disclose this demand (now that we know) constitutes material breach, allowing the acquirer to terminate or clawback funds.
*   **Leverage:** The acquirer is also at risk. If an injunction halts our shipments *after* closing, they buy a broken company. We must disclose this immediately to negotiate a hold-harmless provision or indemnity cap in the final agreement.
*   **Timing:** We must close this legal matter (or reach a definitive settlement) before the due diligence deadline of the acquirer to prevent termination.

---

## Recommended Course of Action (30-Day Sequence)

**Days 1–5 (Board Meeting & Immediate Triage)**
1.  **Authorize Settlement Budget:** Board approval to settle for up to $3.5M + legal fees, pending counsel recommendation.
2.  **Notify Acquirer:** Disclose the claim and the settlement strategy to the acquirer’s counsel immediately. Frame it as a "material contingency being managed," not a deal-breaker. Request an indemnity cap or price adjustment if settlement exceeds $3.5M.
3.  **Cease & Contain:** Immediately halt shipment of devices containing the modified OpenTrellis library until the replacement code is validated (Day 20). Switch existing inventory to a "do not ship" hold if possible.

**Days 6–15 (Negotiation)**
4.  **Engage Meadowlark Counsel:** Do not send an email. Engage via counsel. Admit no liability beyond the facts of use, but offer good-faith settlement to resolve the matter "without admission of willfulness."
5.  **Audit Scope Negotiation:** Reject the broad audit demand. Offer a limited "compliance verification" performed by a neutral third party focused *only* on OpenTrellis files in the firmware.
6.  **Settlement Target:** Offer $1.5M upfront + 3 years of future open-source licensing compliance support (to satisfy their mission) or a paid proprietary license for future versions.

**Days 16–30 (Operational Execution)**
7.  **Code Remediation:** Finalize the replacement of OpenTrellis with commercial alternative ($180k cost, 6-week timeline). Ensure no CMII violations in new code.
8.  **Finalize Acquisition Language:** Ensure the purchase agreement includes an indemnity for this specific claim if settled under $3M; if settled above, trigger price adjustment.
9.  **Close Settlement:** Execute release and dismissal of claims before Day 30 to clear due diligence path.

## Conclusion
While we have technically infringed OpenTrellis in our firmware and violated the CMII clause via header stripping, our exposure is capped by the late registration on the primary claim. The Cloud backend is safe. Compliance is impossible without sacrificing our trade secrets. Therefore, a negotiated settlement is the only rational path that preserves the business for the pending acquisition. We recommend immediate execution of the strategy outlined above to cap liability at $3.5M and remove the injunction threat prior to the acquirer's final diligence.