Forensic Telecommunications Services Ltd v West Yorkshire Police & Anor

In these proceedings the Claimant (“FTS”) claims that the Defendants have infringed its copyright, alternatively its database right, in certain tables of data referred to as “the PM Abs Lists” and have misused confidential information consisting of the data in those tables. The First Defendant is sued in his capacity of representing the West Yorkshire Police (“WYP”). The Second Defendant (“Mr Hirst”) was formerly a detective constable employed by WYP.

The following witnesses gave evidence.

Jonathan Clark MBE. Mr Clark is the founder, majority shareholder, Chairman and former Managing Director of FTS. He has worked in the telecommunications industry for the last 30 years. He founded FTS in 2000. He gave evidence regarding FTS’s business and its licensing of FTS’s FTS Hex software. He was a clear and careful witness.

Trevor Fordy. Mr Fordy is a former police officer who is employed by FTS as its Special Telecoms Advisor Manager. This role involves managing a group of former police investigators and liaising with law enforcement agencies. He gave evidence regarding FTS’s dealings with WYP. As Mr Fordy himself emphasised, he is an investigator rather than a technical person, and he had a limited understanding of technical matters. Furthermore, some of his evidence was based on his reading of documents disclosed by the parties rather than first-hand knowledge. Subject to those caveats, he struck me as a reliable witness.

Dominic Kirsten. Mr Kirsten has worked in the telecommunications industry in a variety of capacities for 22 years. He was employed by FTS as Cell Site Engineer from January 2007 to June 2008. Since then he has been employed by FTS as its Research and Development Manager. He has considerable experience as an expert witness in criminal proceedings.

Some of Mr Kirtsen’s evidence was factual evidence regarding the development of the PM Abs Lists. The greater part of his evidence, however, concerned the lists of PM Abs addresses complained of by FTS. In particular, Mr Kirsten compared those lists with FTS’s PM Abs Lists, and drew attention to similarities and differences between them. Counsel for the Defendants submitted in his skeleton argument that the latter evidence was expert evidence. He further submitted that it was inadmissible because (a) Mr Kirsten was employed by FTS and (b) his witness statement did not comply with the requirements for the form of expert reports laid down by CPR r. 35.10, Practice Direction Part 35 – Experts and Assessors and the Protocol for the Instruction of Experts to Give Evidence in Civil Claims. In the event, however, counsel for the Defendants did not apply to have this evidence excluded, but on the contrary cross-examined Mr Kirsten upon it.

I agree with counsel for the Defendants that some of Mr Kirsten’s evidence is properly categorised as expert evidence. In my assessment he is qualified to give that evidence. The mere fact that Mr Kirsten is employed by FTS does not debar him from giving expert evidence on its behalf. In my view, however, the fact that a witness is employed by a party makes it all the more important that the requirements of CPR r. 35.10, Practice Direction Part 35 – Experts and Assessors and the Protocol for the Instruction of Experts to Give Evidence in Civil Claims are adhered to. Accordingly, the relevant part of Mr Kirsten’s evidence ought to have been contained in an expert report complying with those requirements. Having heard Mr Kirsten, however, I am satisfied that he approached his task in a manner that was consistent with the spirit of those requirements, albeit not the letter of them.

In his closing submissions counsel for the Defendants submitted that Mr Kristen’s evidence was partisan. I do not accept that submission. I recognise, of course, that Mr Kirsten’s position as an employee of FTS made it difficult for him to be wholly impartial and objective, and I have made allowances for that. In his witness statement, however, Mr Kirsten drew attention to differences as well as similarities and expressed himself quite neutrally. Furthermore, his oral evidence was balanced and fair. I do not consider it necessary to deal with all of the criticisms of Mr Kristen advanced by counsel for the Defendants, but I will comment on one by way of illustration. In his statement, Mr Kristen drew attention to certain small differences between the PM Abs Lists and the lists complained of, and expressed the opinion that these “could be explained by human error while manually copying data”. Counsel for the Defendants criticised Mr Kirsten for not having mentioned in his statement that FTS’s manuals were available in an electronic format from which it would have been possible to cut-and-paste the PM Abs Lists. In my view this is not a justified criticism. The existence of the differences identified by Mr Kirsten excludes the possibility of such electronic copying having taken place, while the availability of the electronic copies does not exclude the possibility of copying by manual means.

Stephen Miller. Detective Constable Miller is and has at all material times been employed by WYP in its High Tech Crime Unit (“HTCU”). In addition, he has a degree in computing and experience as a computer programmer. DC Miller struck me as a reliable witness for the most part, but it was noticeable that (whether consciously or not) he distanced himself somewhat from Mr Hirst during the course of his oral evidence.

Mr Hirst. Mr Hirst was a police officer employed by WYP from 6 December 1993 to 2 September 2007. From at least July 2005 he was employed by the HTCU. He is not a programmer, and has relatively little technical expertise. I have to say that I found Mr Hirst unconvincing as a witness. In particular, as I shall explain below, his evidence on the key issue of derivation was implausible.

Ronald van der Knijff. Mr van der Knijff is a Scientific Investigator in the Digital Technology and Biometrics Department of the Netherlands Forensic Institute. The Defendants served an expert report from Mr van der Knijff. Counsel for FTS did not cross-examine Mr van der Knijff upon his report. As she submitted, it became clear from the evidence of DC Miller and Mr Hirst that some of the factual material upon which Mr van der Knijff’s evidence was based was (through no fault of Mr van der Knijff) materially incomplete.

Seyton Bradford was employed by FTS from some time in 2003 to October 2009. He was the author of the copyright works relied upon by FTS. He was not called by either side to give evidence at trial. FTS relied instead upon the evidence of Mr Fordy and Mr Kirsten, both of whom had worked with Mr Bradford (and, in Mr Kirsten’s case, was his line manager from June 2008 onwards). Their evidence was that Mr Bradford was not giving evidence for FTS because he had not left on good terms and because he was now working for a competitor to FTS. For their part, the Defendants put in evidence via Mr van der Knijff’s report a note which Mr Bradford sent to Mr van der Knijff on 16 July 2010 setting out an explanation of how he had obtained the data in the PM Abs Lists.

After FTS’s witnesses had given evidence, and in the light of certain questions put to them in cross-examination, FTS waived privilege in a statutory declaration executed by Mr Bradford on 29 September 2009 and gave informal notice out of time of its intention to rely upon the contents of the statutory declaration as hearsay evidence. In response, the Defendants waived privilege in a draft witness statement prepared by WYP’s solicitor Mr Hussain following a meeting with Mr Bradford on 22 December 2009 and gave informal notice out of time of its intention to rely upon the contents of the draft declaration as hearsay evidence. Mr Bradford declined to sign the draft witness statement, but Mr Hussain’s evidence is that Mr Bradford said that he did not disagree with anything in it. As counsel for FTS pointed out, however, Mr Hussain’s attendance notes of his conversations with Mr Bradford have not been disclosed.

The contents of the draft witness statement are not entirely consistent with the contents of the statutory declaration. I attach more weight to the statutory declaration for the following reasons. First, the statutory declaration was duly executed by Mr Bradford before a solicitor. It includes the usual statement that Mr Bradford conscientiously believed it to be true. By contrast, the draft statement is unsigned. Secondly, in the draft statement Mr Bradford says that it “contains information not contained in” the declaration. He does not say that anything in the declaration is untrue. He also says, however, that he was “not asked [by FTS] to explain how I compiled the PM Abs List numbers”. This is contradicted by the declaration, which does contain such an explanation. Thirdly, the statutory declaration and its accompanying annex are clear and detailed. It has every appearance of having been written by Mr Bradford himself in his own words. By contrast the draft statement is short, lacking in detail and not very clearly worded in some respects. The latter may be attributable to a lack of technical understanding on the part of Mr Hussain at the time he drafted the statement.

I have not, however, disregarded the draft statement. On the contrary, I have taken it into account. I have also taken Mr Bradford’s note to Mr van der Knijff into account, albeit that this was not in the form of a signed statutory declaration or witness statement and did not contain a statement of truth.

Data extracted from the memories of mobile phones is often relied on as evidence in criminal prosecutions, and has been particularly important in the ongoing battle against terrorism. It is particularly useful for these purposes to be able to recover data which the user has deleted. As with other sorts of computers, even though the user has deleted the data and therefore it is no longer accessible through ordinary operation of the device, the data remains stored in non-volatile memory until it is overwritten. It is therefore frequently possible to recover at least some deleted data by forensic examination.

There are two categories of methods of extracting data from non-volatile memory. Logical extraction methods only access the memory indirectly. These methods are mostly only able to extract the active user data, or part of it. Physical extraction methods access the memory directly. With these methods, it is possible to recover deleted data from the memory. Such data is stored in binary form, which is conventionally represented for convenience in hexadecimal format. The binary data must then be decoded or translated into comprehensible form.

The present case concerns the physical extraction of data from Nokia mobile phones, which were very popular in the UK at the relevant times, and in particular phones of the DCT4 generation.

In order physically to extract data from mobile phones, it is necessary to have appropriate hardware. A widely used tool is the SaraSoft UFS, which is a “flasher” or “flashbox”. Flasher tools are used by mobile phone service centres and others to update the non-volatile flash memories of phones to re-program the phones, remove lock codes and so on. The SaraSoft UFS can also be used to extract data, particularly from Nokia phones.

In order to carry out physical extraction of all the data from the non-volatile memory of a mobile phone, it is necessary to know the permanent memory absolute (often abbreviated to “PM Abs”) addresses for that phone. These define the part of the memory in which user data is stored. The addresses consist of two hexadecimal numbers which represent the start address and the end address. The PM Abs addresses vary between different models of phone and even vary between different firmware versions of the same model.

Mr van der Knijff distinguishes in his report between what he refers to as “unique” PM Abs addresses and “correct” PM Abs addresses. He defines “unique” PM Abs addresses as the actual start and end addresses where the manufacturer’s engineers mapped the memory area devoted to the storage of PMM blocks (which contain user data). He defines a pair of PM Abs addresses as “correct” if, and only if, it enables all the PMM blocks to be read using the “Rd PM Absolute” command of the SaraSoft UFS tool.

If either the start or the end address given to the Rd PM Absolute command differs from the unique address, one of the following scenarios will occur:

It follows that for any given model/firmware combination:

Nokia does not publish its PM Abs addresses. Accordingly, people who wish to know the PM Abs addresses for any particular model/firmware combination will need to discover the address data for themselves. Two methods of doing this feature in the present case.

The first method is trial and error: just start by guessing an address range and then increase or decrease each address until a boundary is found. If this is done manually in a naïve way, it can be very time-consuming. It can be speeded up by what Mr van der Knijff describes as “a clever ‘divide and try’ approach” and speeded up further by automation. The trial and error approach can result in correct addresses, but it can also result in usable addresses that return some but not all data. It will not necessarily result in the determination of unique PM Abs addresses.

The second method is to flash the mobile phone, that is to say, use SaraSoft UFS to execute a complete update of the firmware in the phone. This involves erasing the data held in the non-volatile memory. As the old data is erased from the memory, the SaraSoft UFS displays address information. The informed user can identify the unique PM Abs addresses from this displayed information.

Flashing is both quicker than trial and error, and more accurate in that it enables the examiner to obtain the unique PM Abs addresses. It cannot be used on an exhibit or potential exhibit in a criminal investigation, however, because the process of flashing always erases the firmware and thus permanently changes the phone. It also carries a risk of damaging the phone. It follows that, if a phone arrives for forensic examination and the PM Abs address data for that model and firmware version is unknown, it cannot be determined from that phone by flashing. If an identical model running identical firmware is available, that handset can be flashed and the unique PM Abs addresses used to analyse the exhibit or potential exhibit. If no such identical model running identical firmware is available, the only viable approach (or at least the only one relevant to this case) is trial and error.

FTS was set up to recover digital evidence from mobile telecommunications devices, in particular mobile phones, and to conduct cell site analysis of the locations of mobile devices, in both cases for forensic purposes. From 2000 to 2002 FTS developed manual techniques physically to extract and recover data from mobile phones. These techniques were labour-intensive and time-consuming, however. Accordingly, in 2003 FTS set up a Research and Development department to develop software to extract and decode data from, in particular, Nokia mobile phones. Mr Bradford was recruited and employed by FTS for this purpose until October 2009. He was responsible for developing software known as FTS Hex.

As part of this development, Mr Bradford ascertained PM Abs addresses for a considerable number of Nokia mobile phones and compiled lists of those addresses. These are the PM Abs Lists. It appears that Mr Bradford was assisted by John Barwell and Alan Mills, but that their role was to validate Mr Bradford’s results. I shall describe Mr Bradford’s work in more detail below, but at this stage it should be noted that the lists were progressively added to and corrected over time as FTS received more mobile phones for examination.

In 2004 the first version of FTS Hex was released for internal use only by FTS’s forensic examiners. As is common with computer software, FTS developed successive versions of this software. The version that is most relevant to this case is version 3.8, which dates from May 2006.

At an early stage of the development of FTS Hex, FTS agreed that it would only supply the software to the UK’s security agencies and not to the UK’s law enforcement agencies, including the police. In early 2006, FTS granted a licence to the Security Service. Mr Bradford developed a licence application and dongle locking mechanism that only permitted use of FTX Hex if the user accepted the terms of the licence and then only on a specified laptop with each dongle. Later FTS granted licences to other agencies. FTS has also granted licences to security agencies in other countries.

Mr Bradford produced manuals to accompany FTS Hex. These manuals included the PM Abs Lists. Thus page 25 of the manual for FTS Hex version 3.8 contains the PM Abs List for Nokia DCT4 phones as at May 2006.

In July 2005 WYP transferred the examination of mobile phones to the HTCU from the Communications Support Unit, which had previously handled this work. Starting in about October 2005, DC Miller and Mr Hirst (then DC Hirst) started working on the development of an in-house facility for extracting and translating mobile phone data. Their purpose in doing so was to save WYP money: DC Miller’s evidence was that it is not unusual in a serious police investigation to seize upwards of 100 mobile phones, and commercial forensic providers charge up to £750 per examination. DC Miller and Mr Hirst did this work mainly in their own time.

Initially, they started using service centre tools such as SaraSoft UFS to obtain the live data from Nokia mobile phones. They then moved on to extracting the raw hexadecimal data. DC Miller’s evidence, however, was that at this time examiners in the HTCU had to photograph the phone screens of certain Nokia handsets to record live data as there was no other way of getting the information.

In November 2005 DC Miller and Mr Hirst attended a Cell Phone Forensics course at Guidance Software in Liverpool. They became aware that many other people were experiencing the same difficulties as they were. As a result, they set up a website at www.phone-forensics.com (“the PF Website”) to act as an information exchange for those interested in the subject. The PF Website was set up with several levels of access to it, one of which was restricted to law enforcement officers. Access was granted by the site administrator or moderators such as Mr Hirst.

On 24 January 2006 Mr Fordy attended a meeting at Belle Vue Police Station in Leeds. The meeting was also attended by a number of representatives of WYP’s HTCU including its manager Inspector Michael Crampton. The HTCU’s ability to extract and decode hexadecimal data was discussed at the meeting. Mr Fordy was given to understand that, although the HTCU had had some success in extracting hexadecimal data, its capabilities were limited and it had no software.

From 28 to 30 March 2006 Mr Fordy and other FTS representatives ran a Telecoms Liaison Officers training course for WYP in Wakefield. The course was attended by officers from WYP including Sgt Andrew Hill. Sgt Hill said that the HTCU could extract data but not analyse it, and was working on a solution.

In May 2006 DC Miller and Mr Hirst had what DC Miller described as “a breakthrough in our researches”. A contact of theirs at the National High Tech Crime Training Centre (now part of the National Policing Improvement Agency), Kevin Mansell, attended a meeting of an Interpol working group on mobile phone forensics on 10-12 May 2006, where he met Mr van der Knijff. Mr Mansell mentioned the difficulty that DC Miller and Mr Hirst were experiencing with regard to translating extracted data to Mr van der Knijff. Mr van der Knijff told Mr Mansell that he had an NFI research document which set out how to decode the hexadecimal data from some mobile phones into a readable form which he would be willing to share with WYP. On 17 May 2006 Mr van der Knijff sent the document and a short program to Mr Mansell by email. Mr Mansell forwarded the email to Mr Hirst on 6 June 2006, but Mr Hirst could not open the attachment. On 11 July 2006 Mr van der Knijff sent the attachment directly to Mr Hirst at his request.

In the meantime, in about early June 2006 Mr Fordy was contacted by Detective Inspector Crampton, who asked if FTS would be willing to translate hexadecimal data that had been extracted from 20 or so mobile phones by the HTCU as part of a major counter-terrorism investigation which Mr Fordy later learnt was code-named Operation Praline and led by Detective Superintendant Steve Fear. DI Crampton said he had been advised that only FTS and the Security Service, as FTS’s licensee, had the capability of automatically translating the data. Mr Fordy on behalf of FTS declined this request, but said that FTS would be willing to carry out the entire examination of the phones i.e. both extracting and translating the data using FTS Hex.

Starting on Friday 9 June 2011 and continuing over the following weekend, Mr Hirst worked together with a member of the Security Service on examining the phones seized during Operation Praline. I shall have to consider what happened during this period in more detail below, but at this stage it is sufficient to note two points. First, it is common ground that the Security Service officer had FTS Hex installed on his laptop and used it to produce some reports. Mr Hirst asked the officer to put his name on the reports so that they could be used as exhibits in any future prosecution, but he declined to do so, presumably because that would entail him giving evidence at any trial. Accordingly, Mr Hirst put his own name on the reports. Secondly, according to Mr Hirst’s evidence, the Security Service officer wrote down three or four pairs of PM Abs numbers on a post-it note and gave it to Mr Hirst. It is not disputed that those numbers must have come from one of FTS’s PM Abs Lists.

On 20 June 2006 Mr Hirst posted a list of PM Abs addresses onto the PF Website. This included the PM Abs addresses obtained by Mr Hirst from the Security Service officer. Mr Hirst invited other members of the PF Website to add to the list. On 23 June 2006 one M. Roeloffs posted a list of nine pairs of PM Abs addresses on the PF Website, but it is not clear if all the entries in his list were additional to those already posted by Mr Hirst. The best evidence as to what was contained in the list posted by Mr Hirst on 20 June 2006 is a list of 39 pairs of PM Abs addresses disclosed by the Defendants which bears a last modified date of 4 July 2006. If those common to this list and M. Roeloffs’ list are omitted, one is left with 30 pairs.

DC Miller completed the first build of his software, which he and Mr Hirst called CLiVE, on 17 July 2006. CLiVE was only capable of translating data from four Nokia phone models, namely the 1100, 1101, 1110 and 1600.

In late July 2006 Mr Fordy was asked by DS Fear if FTS would examine three mobile phones seized in Operation Praline for quality assurance purposes. DS Fear told Mr Fordy that WYP’s HTCU had extracted and translated the data from these phones and he wanted FTS to validate the results. FTS agreed to do this. On 10 August 2006 Mr Fordy returned the three handsets to WYP. On that occasion he was told by Detective Sergeant Chris Williams that not only were the data recovered by FTS identical to those recovered by the HTCU, but also that the format of the reports was the same. Mr Fordy expressed concern about this to DS Fear: if the reports had been produced by the HTCU, WYP was not a licensee of FTS Hex; while if the reports had (as Mr Fordy suspected) in fact been produced by the Security Service, then WYP should not be claiming to have produced them. Shortly afterwards, Mr Fordy was told by DS Fear that there had been a misunderstanding, and that the reports in question had indeed been produced by the Security Service using FTS Hex. Furthermore, since the reports produced by the Security Service were not to be relied on as evidence, FTS was asked by WYP to re-examine some 23 phones to produce reports for evidential purposes.

On 28 November 2006 Mr Fordy received an email from Detective Chief Inspector Malcom Whiteley of WYP’s Professional Standards Department (“PSD”) requesting that Mr Fordy contact him by telephone. When Mr Fordy did so, DCI Whiteley told him that the PSD had received information from a source that the HTCU had “stolen” FTS Hex. Subsequently DCI Whiteley identified the source as Phil Cocking, formerly of WYP and latterly of MD5, a competitor to FTS.

The receipt of this information led to a complaint by FTS to WYP that CLiVE had been copied from FTS Hex. Although the PSD investigated the allegation, the investigation appears to have been both drawn-out and inconclusive. It ended with a report prepared by Detective Chief Superintendant Ian Kennedy of the PSD dated 1 April 2008 in which he concluded that it was not possible to determine whether plagiarism had taken place without an independent expert examination of the two programs, and suggested a without prejudice meeting between FTS and WYP as a way forward.

WYP’s position in these proceedings had been that Mr Cocking is not a credible witness, while FTS’s position has been that the PSD’s investigation was inadequate and unprofessional. It is not necessary for me to express any view about either contention.

On 8 July 2008 there was a meeting between Mr Fordy and Mr Bradford on behalf of FTS and DC Miller and DCS Kennedy. At this time this was held on a without prejudice basis, but subsequently the parties have agreed to waive the without prejudice privilege. During the course of the meeting the FTS representatives were shown the list of PM Abs addresses being used by the HTCU, although they were not permitted to take a copy. Mr Bradford expressed the opinion that it was substantially copied from FTS’s PM Abs Lists.

Shortly after 8 July 2008, DC Miller wrote a short program to identify PM Abs start addresses by an automated trial and error method. The program did not identify the end address, but instead relied on SaraSoft UFS’s ability to read the memory until an error message is encountered. FTS makes no complaint about this program or about PM Abs addresses identified using it.

As counsel for FTS pointed out, when Mr van der Knijff asked DC Miller for a description of how he identified the PM Abs addresses, DC Miller sent Mr van der Knijff a description of the program he wrote in July 2008 (although he did not send the actual program when Mr van der Knijff asked for it). DC Miller did not provide Mr van der Knijff with a description of how Mr Hirst had identified the PM Abs addresses posted to the PF Website on 20 June 2006 and used by the HTCU for the following two years. In cross-examination, DC Miller attributed this to a misunderstanding of Mr van der Knijff’s request (which was communicated via Mr Hussain).

On 29 May 2009 FTS commenced these proceedings. It principal claims in these proceedings have always related to the PM Abs Lists, although it initially relied on an allegation that CLiVE was copied from FTS Hex as similar fact evidence. FTS has not pursued the allegation that CLiVE was copied from FTS Hex.

FTS’s principal claim in these proceedings concerns the PM Abs addresses which Mr Hirst and other members of the HTCU posted on the PF Website and used in the period from mid June 2006 to around July 2008 (“the WYP Lists”). FTS also claims in respect of a list of PM Abs addresses which has been distributed in conjunction with another program called Pandora’s Box (“the Pandora’s Box List”). This was developed by an American company called Innovative Digital Forensic Solutions LLC (“IDFS”). IDFS is controlled by a former US police officer called Michael Harrington. It is common ground that Mr Hirst and DC Miller assisted Mr Harrington to develop Pandora’s Box. That apart, there is very little connection between Pandora’s Box and the Defendants. I shall return to this point below.

In this section of the judgment I shall set out the legislation, and the applicable principles of interpretation of that legislation, which are relevant to the copyright and database right claims.

Berne Convention. The International Convention for the Protection of Literary and Artistic works signed at Berne on 9 September 1886 (Paris Act of 1971 as amended in 1979) (“the Berne Convention”), to which all Member States of the European Union are parties, includes the following provisions:

“Article 2

(1)

The expression ‘literary and artistic works’ shall include every production in the literary, scientific and artistic domain, whatever may be the mode or form of its expression, such as books, pamphlets and other writings; lectures, addresses, sermons and other works of the same nature; dramatic or dramatico-musical works; choreographic works and entertainments in dumb show; musical compositions with or without words; cinematographic works to which are assimilated works expressed by a process analogous to cinematography; works of drawing, painting, architecture, sculpture, engraving and lithography; photographic works to which are assimilated works expressed by a process analogous to photography; works of applied art; illustrations, maps, plans, sketches and three-dimensional works relative to geography, topography, architecture or science.

…

(5)

Collections of literary or artistic works such as encyclopaedias and anthologies which, by reason of the selection and arrangement of their contents, constitute intellectual creations, shall be protected as such, without prejudice to the copyright in each of the works forming part of such collections.

…

Article 9

(1)

Authors of literary and artistic works protected by this Convention shall have the exclusive right of authorising the reproduction of these works, in any manner or form.

(2)

It shall be a matter for legislation in the countries of the Union to permit the reproduction of such works in certain special cases, provided that such reproduction does not conflict with a normal exploitation of the work and does not unreasonably prejudice the legitimate interests of the author.

…

Article 20

The Governments of the countries of the Union reserve the right to enter into special agreements among themselves, in so far as such agreements grant to authors more extensive rights than those granted by the Convention, or contain other provisions not contrary to this Convention. The provisions of existing agreements which satisfy these conditions shall remain applicable.”

TRIPS. The Agreement on Trade-Related Aspects of Intellectual Property Rights (commonly known as “TRIPS”) which forms Annex 1C to the Agreement establishing the World Trade Organisation signed in Morocco on 15 April 1994, to whom the European Union and all its Member States are parties, includes the following provisions:

“Article 9

Relation to the Berne Convention

1.

Members shall comply with Articles 1 through 21 of the Berne Convention (1971) and the Appendix thereto. However, Members shall not have rights or obligations under this Agreement in respect of the rights conferred under Article 6bis of that Convention or of the rights derived therefrom.

2.

Copyright protection shall extend to expressions and not to ideas, procedures, methods of operation or mathematical concepts as such.

Article 10

Computer Programs and Compilations of Data

…

2.

Compilations of data or other material, whether in machine readable or other form, which by reason of the selection or arrangement of their contents constitute intellectual creations, shall be protected as such. Such protection, which shall not extend to the data or material itself, shall be without prejudice to any copyright subsisting in the data or material itself.

…

Article 13

Limitation and Exceptions

Members shall confine limitations or exceptions to exclusive rights to certain special cases which do not conflict with a normal exploitation of the work and do not unreasonably prejudice the legitimate interests of the author.”

WIPO Copyright Treaty. The World Intellectual Property Organisation Copyright Treaty agreed in Geneva on 20 December 1996 (“the WIPO Copyright Treaty”), to which the European Union and all its Member States are parties, includes the following provisions:

“Article 1

Relation to the Berne Convention

At the Diplomatic Conference at which the WIPO Copyright Treaty was adopted, a number of statements concerning its interpretation were agreed. These include the following statement:

“Concerning Article 5

The scope of protection for compilations of data (databases) under Article 5 of this Treaty, read with Article 2, is consistent with Article 2 of the Berne Convention and on a par with the relevant provisions of the TRIPS Agreement.”

Although the WIPO Copyright Treaty was approved by the Council of the European Community on behalf of the European Community by Council Decision 2000/278/EC of 16 March 2000, the European Union and many of its Member States, including the United Kingdom, did not ratify the Treaty until 14 December 2009, although some Member States ratified it at an earlier date. The Treaty entered into force with respect to the European Union and the United Kingdom on 14 March 2010.

Software Directive. Council Directive 91/250/EEC of 14 May 1991 on the legal protection of computer programs (“the Software Directive”) was recently replaced by a codified (i.e. consolidated) version, European Parliament and Council Directive 2009/24/EC of 23 April 2009 in which both the sequence of the recitals and the numbering of some of the Articles has been changed. Since the original version was in force at the time of the alleged infringing activity by the Defendants and since the case law discussed below refers to the original version, however, it is convenient to continue to refer to the original version. There is no relevant difference of substance between the two versions.

The Software Directive includes the following recitals (numbering added for ease of reference):

“[13] Whereas, for the avoidance of doubt, it has to be made clear that only the expression of a computer program is protected and that ideas and principles which underlie any element of a program, including those which underlie its interfaces, are not protected by copyright under this Directive;

[14] Whereas, in accordance with this principle of copyright, to the extent that logic, algorithms and programming languages comprise ideas and principles, those ideas and principles are not protected under this Directive;

[15] Whereas, in accordance with the legislation and jurisprudence of the Member States and the international copyright conventions, the expression of those ideas and principles is to be protected by copyright;”.

The Software Directive includes the following operative provisions:

“Article 1

Object of protection

1.

In accordance with the provisions of this Directive, Member States shall protect computer programs, by copyright, as literary works within the meaning of the Berne Convention for the Protection of Literary and Artistic Works. For the purposes of this Directive, the term 'computer programs' shall include their preparatory design material.

2.

Protection in accordance with this Directive shall apply to the expression in any form of a computer program. Ideas and principles which underlie any element of a computer program, including those which underlie its interfaces, are not protected by copyright under this Directive.

3.

A computer program shall be protected if it is original in the sense that it is the author's own intellectual creation. No other criteria shall be applied to determine its eligibility for protection.

…”

Database Directive. European Parliament and Council Directive 96/9/EC of 11 March 1996 on the legal protection of databases (“the Database Directive”) includes the following recitals:

“(5)

Whereas copyright remains an appropriate form of exclusive right for authors who have created databases;

…

(13)

Whereas this Directive protects collections, sometimes called 'compilations', of works, data or other materials which are arranged, stored and accessed by means which include electronic, electromagnetic or electro- optical processes or analogous processes;

(14)

Whereas protection under this Directive should be extended to cover non-electronic databases;

(15)

Whereas the criteria used to determine whether a database should be protected by copyright should be defined to the fact that the selection or the arrangement of the contents of the database is the author's own intellectual creation; whereas such protection should cover the structure of the database;

(16)

Whereas no criterion other than originality in the sense of the author's intellectual creation should be applied to determine the eligibility of the database for copyright protection, and in particular no aesthetic or qualitative criteria should be applied;

(17)

Whereas the term 'database' should be understood to include literary, artistic, musical or other collections of works or collections of other material such as texts, sound, images, numbers, facts, and data; whereas it should cover collections of independent works, data or other materials which are systematically or methodically arranged and can be individually accessed; whereas this means that a recording or an audiovisual, cinematographic, literary or musical work as such does not fall within the scope of this Directive;

…

(19)

Whereas, as a rule, the compilation of several recordings of musical performances on a CD does not come within the scope of this Directive, both because, as a compilation, it does not meet the conditions for copyright protection and because it does not represent a substantial enough investment to be eligible under the sui generis right;”.

The Database Directive includes the following operative provisions:

“CHAPTER I

SCOPE

Article 1

Scope

1.

This Directive concerns the legal protection of databases in any form.

2.

For the purposes of this Directive, 'database' shall mean a collection of independent works, data or other materials arranged in a systematic or methodical way and individually accessible by electronic or other means.

…

CHAPTER II

COPYRIGHT

Article 3

Object of protection

1.

In accordance with this Directive, databases which, by reason of the selection or arrangement of their contents, constitute the author's own intellectual creation shall be protected as such by copyright. No other criteria shall be applied to determine their eligibility for that protection.

2.

The copyright protection of databases provided for by this Directive shall not extend to their contents and shall be without prejudice to any rights subsisting in those contents themselves.

…

CHAPTER III

SUI GENERIS RIGHT

Article 7

Object of protection

1.

Member States shall provide for a right for the maker of a database which shows that there has been qualitatively and/or quantitatively a substantial investment in either the obtaining, verification or presentation of the contents to prevent extraction and/or re-utilization of the whole or of a substantial part, evaluated qualitatively and/or quantitatively, of the contents of that database.

2.

For the purposes of this Chapter:

(a)

'extraction' shall mean the permanent or temporary transfer of all or a substantial part of the contents of a database to another medium by any means or in any form;

(b)

're-utilization' shall mean any form of making available to the public all or a substantial part of the contents of a database by the distribution of copies, by renting, by on-line or other forms of transmission. The first sale of a copy of a database within the Community by the rightholder or with his consent shall exhaust the right to control resale of that copy within the Community;

Public lending is not an act of extraction or re-utilization.

3.

The right referred to in paragraph 1 may be transferred, assigned or granted under contractual licence.

4.

The right provided for in paragraph 1 shall apply irrespective of the eligibility of that database for protection by copyright or by other rights. Moreover, it shall apply irrespective of eligibility of the contents of that database for protection by copyright or by other rights. Protection of databases under the right provided for in paragraph 1 shall be without prejudice to rights existing in respect of their contents.

5.

The repeated and systematic extraction and/or re-utilization of insubstantial parts of the contents of the database implying acts which conflict with a normal exploitation of that database or which unreasonably prejudice the legitimate interests of the maker of the database shall not be permitted.”

Information Society Directive. European Parliament and Council Directive 2001/29/EC of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society (“the Information Society Directive”) includes the following recitals:

“(15)

The Diplomatic Conference held under the auspices of the World Intellectual Property Organisation (WIPO) in December 1996 led to the adoption of two new Treaties, the ‘WIPO Copyright Treaty’ and the ‘WIPO Performances and Phonograms Treaty’, dealing respectively with the protection of authors and the protection of performers and phonogram producers. Those Treaties update the international protection for copyright and related rights significantly, not least with regard to the so-called ‘digital agenda’, and improve the means to fight piracy world-wide. The Community and a majority of Member States have already signed the Treaties and the process of making arrangements for the ratification of the Treaties by the Community and the Member States is under way. This Directive also serves to implement a number of the new international obligations.

…

(20)

This Directive is based on principles and rules already laid down in the Directives currently in force in this area, in particular Directives 91/250/EEC, 92/100/EEC, 93/83/EEC, 93/98/EEC and 96/9/EC, and it develops those principles and rules and places them in the context of the information society. The provisions of this Directive should be without prejudice to the provisions of those Directives, unless otherwise provided in this Directive.

…

(32)

This Directive provides for an exhaustive enumeration of exceptions and limitations to the reproduction right and the right of communication to the public. …

…

(42)

When applying the exception or limitation for non-commercial educational and scientific research purposes, including distance learning, the non-commercial nature of the activity in question should be determined by that activity as such. The organisational structure and the means of funding of the establishment concerned are not the decisive factors in this respect.

…

(44)

When applying the exceptions and limitations provided for in this Directive, they should be exercised in accordance with international obligations. Such exceptions and limitations may not be applied in a way which prejudices the legitimate interests of the rightholder or which conflicts with the normal exploitation of his work or other subject-matter. The provision of such exceptions or limitations by Member States should, in particular, duly reflect the increased economic impact that such exceptions or limitations may have in the context of the new electronic environment. Therefore, the scope of certain exceptions or limitations may have to be even more limited when it comes to certain new uses of copyright works and other subject-matter.

…”

The Information Society Directive includes the following operative provisions:

“Article 1

Scope

…

2.

Except in the cases referred to in Article 11, this Directive shall leave intact and shall in no way affect existing Community provisions relating to:

…

(d)

the legal protection of databases;

Article 2

Reproduction right

Member States shall provide for the exclusive right to authorise or prohibit direct or indirect, temporary or permanent reproduction by any means and in any form, in whole or in part:

(a)

for authors, of their works;

…

Article 5

Exceptions and limitations

...

3.

Member States may provide for exceptions or limitations to the rights provided for in Articles 2 and 3 in the following cases:

(a)

use for the sole purpose of illustration for teaching or scientific research, as long as the source, including the author's name, is indicated, unless this turns out to be impossible and to the extent justified by the non- commercial purpose to be achieved;

…

5.

The exceptions and limitations provided for in paragraphs 1, 2, 3 and 4 shall only be applied in certain special cases which do not conflict with a normal exploitation of the work or other subject-matter and do not unreasonably prejudice the legitimate interests of the rightholder.”

The Copyright, Designs and Patents Act 1988 was amended pursuant to section 2(2) of the European Communities 1972 Act by the Copyright (Computer Programs) Regulations 1992, SI 1992/3233, to implement the Software Directive. The 1988 Act was amended pursuant to section 2(2) of the 1972 Act by the Copyright and Rights in Databases Regulations 1997, SI 1997/3032, to implement the Database Directive. The 1988 Act was amended pursuant to section 2(2) of the 1972 Act by the Copyright and Related Rights Regulations 2003, SI 2003/2498, to implement the Information Society Directive.

As amended by the 1992 Regulations, the 1997 Regulations and the 2003 Regulations, and other legislation, the 1988 Act includes the following provisions:

“Copyright and copyright works

1.(1) Copyright is a property right which subsists in accordance with this Part in the following descriptions of work-

(a)

original literary, dramatic, musical or artistic works,

….

Literary, dramatic and musical works

3.(1) In this Part:

‘literary work’ means any work, other than a dramatic or musical work, which is written, spoken or sung, and accordingly includes:

(a)

a table or compilation other than a database,

…

(d)

a database.

…

Databases

3A.(1) In this Part ‘database’ means a collection of independent works, data or other materials which—

(a)

are arranged in a systematic or methodical way, and

(b)

are individually accessible by electronic or other means.

(2)

For the purposes of this Part a literary work consisting of a database is original if, and only if, by reason of the selection or arrangement of the contents of the database the database constitutes the author's own intellectual creation.

…

The acts restricted by copyright in a work

16.(1) The owner of the copyright in a work has, in accordance with the following provisions of this Chapter, the exclusive right to do the following acts in the United Kingdom –

(a)

to copy the work (see section 17);

…

(2)

Copyright in a work is infringed by a person who without the licence of the copyright owner does, or authorises another to do, any of the acts restricted by the copyright.

(3)

References in this Part to the doing of an act restricted by the copyright in a work are to the doing of it –

(a)

in relation to the work as a whole or any substantial part of it

(b)

either directly or indirectly;

and it is immaterial whether any intervening acts themselves infringe copyright.

(4)

This Chapter has effect subject to-

(a)

the provisions of Chapter III (acts permitted in relation to copyright works)

…

Infringement of copyright by copying

17.(1) The copying of the work is an act restricted by the copyright in every description of copyright work; and references in this Part to copying and copies shall be construed as follows.

(2)

Copying in relation to a literary, dramatic, musical or artistic work means reproducing the work in any material form. This includes storing the work in any medium by electronic means.

…

Research and private study

29.(1) Fair dealing with a literary, dramatic, musical or artistic work for the purposes of research for a non-commercial purpose does not infringe any copyright in the work provided that it is accompanied by a sufficient acknowledgement.

(1B) No acknowledgement is required in connection with fair dealing for the purposes mentioned in subsection (1) where this would be impossible for reasons of practicality or otherwise.

…

Provisions as to damages in infringement action

97.(1) Where in an action for infringement of copyright it is shown that at the time of the infringement the defendant did not know, and had no reason to believe, that copyright subsisted in the work to which the action relates, the plaintiff is not entitled to damages against him, but without prejudice to any other remedy.

…

Minor definitions

178.

In this Part-

…

‘sufficient acknowledgement’ means an acknowledgement identifying the work in question by its title or other description, and identifying the author unless –

…

(b)

in the case of an unpublished work, it is not possible for a person to ascertain the identity of the author by reasonable inquiry.”

The WTO Agreement, which includes TRIPS, was declared to be an EU Treaty pursuant to section 1(3) of the 1972 Act by the European Communities (Definition of Treaties) (The Agreement Establishing the World Trade Organisation) Order 1995, SI 1995/265. The WIPO Copyright Treaty was declared to be an EU Treaty by the European Communities (Definition of Treaties) (WIPO Copyright Treaty and WIPO Performances and Phonograms Treaty) Order 2005, SI 2005/3431. It does not appear, however, that the 1988 Act has been amended in any respect relevant to the present case as a consequence of either of these Orders.

Chapter III of the Database Directive is implemented by Part III of the 1997 Regulations. This includes the following regulations:

“Interpretation

12.(1) In this Part—

‘database’ has the meaning given by section 3A(1) of the 1988 Act (as inserted by Regulation 6);

‘extraction’, in relation to any contents of a database, means the permanent or temporary transfer of those contents to another medium by any means or in any form;

‘insubstantial’, in relation to part of the contents of a database, shall be construed subject to Regulation 16(2);

‘investment’ includes any investment, whether of financial, human or technical resources;

…

‘re-utilisation’, in relation to any contents of a database, means making those contents available to the public by any means;

‘substantial’, in relation to any investment, extraction or re-utilisation, means substantial in terms of quantity or quality or a combination of both.

…

Database right

13.(1) A property right (‘database right’) subsists, in accordance with this Part, in a database if there has been a substantial investment in obtaining, verifying or presenting the contents of the database.

(2)

For the purposes of paragraph (1) it is immaterial whether or not the database or any of its contents is a copyright work, within the meaning of Part I of the 1988 Act.

…

Acts infringing database right

16.(1) Subject to the provisions of this Part, a person infringes database right in a database if, without the consent of the owner of the right, he extracts or re-utilises all or a substantial part of the contents of the database.

(2)

For the purposes of this Part, the repeated and systematic extraction or re-utilisation of insubstantial parts of the contents of a database may amount to the extraction or re-utilisation of a substantial part of those contents.

…

Exceptions to database right

20.(1) Database right in a database right which has been made available to the public in any manner is not infringed by fair dealing with a substantial part of its contents if -

(a)

that part is extracted from the database by a person who is apart from this paragraph a lawful user of the database;

(b)

it is extracted for the purpose of illustration for teaching or research and not for any commercial purpose; and

(c)

the source is indicated.

…

Application of copyright provisions to database right

23.

The following provisions of the 1988 Act apply in relation to database right and databases in which that right subsists as they apply in relation to copyright and copyright works -

…

sections 96 to 102 (right and remedies of copyright owner and exclusive licensee)

…”

It is well established that domestic legislation, and in particular legislation specifically enacted or amended to implement a European directive, must be construed so far as is possible in conformity with, and to achieve the result intended by, the directive: Case C-106/89 Marleasing SA v La Comercial Internacional de Alimentación SA [1990] ECR I-4135 at [8]; Litster v Forth Dry Dock and Engineering Co Ltd [1990] 1 AC 546, HL at 558C-H (Lord Templeman) and 576E-577D (Lord Oliver of Aylmerton); Cases C-397/01 to C-403/01 Pfeiffer v Deutsches Rotes Kreuz, Kreisverband Waldshut eV [2004] ECR I-8835 at [113]-[117]; R (IDT Card Services Ireland Ltd) v Commissioners for Her Majesty’s Revenue and Customs [2006] EWCA Civ 29, [2006] STC 1252 at [73]-[92] (Arden LJ); Joined Cases C-378/07 to C-380/07 Angelidaki v Organismos Nomarkhiaki Aftodiikisi Rethimnis [2009] ECR I-3071 at [197]-[202]; and Churchill Insurance Co Ltd v Wilkinson [2010] EWCA Civ 556, [2010] Lloyds Rep IR 591 at [14] (Waller LJ). This is a strong duty of interpretation. Indeed, at the end of the passage in her judgment in IDT that I have referred to, Arden LJ suggests that there is little difference between the Court’s duty under the Marleasing principle and its duty under section 3 of the Human Rights Act 1998 to interpret domestic legislation as far as possible in a manner which is compatible with Convention rights under the European Convention on Human Rights.

A European directive falls to be interpreted according to principles of interpretation of European Union legislation developed by the Court of Justice of the European Union. The basic rule of interpretation, which has been frequently reiterated by the European Court of Justice, is that stated in Case C-306/05 Sociedad General de Autores y Editores de Españav Rafael Hoteles SA [2006] ECR I-11519 at [34]:

“According to settled case-law, in interpreting a provision of Community law it is necessary to consider not only its wording, but also the context in which it occurs and the objectives pursued by the rules of which it is part (see, in particular, Case C-156/98 Germany v Commission [2000] ECR I-6857, paragraph 50, and Case C-53/05 Commission v Portugal [2006] ECR I-6215, paragraph 20)”.

As is well known, in applying this rule the ECJ routinely refers to the recitals of the measure as well as its operative provisions and frequently refers to pre-legislative materials such as the Explanatory Memoranda which accompany the Commission’s legislative proposals.

Another rule of interpretation applied by the ECJ is that stated in SGAE at [35]:

“Moreover, Community legislation must, so far as possible, be interpreted in a manner that is consistent with international law, in particular where its provisions are intended specifically to give effect to an international agreement concluded by the Community (see, in particular, Case C-341/95 Bettati [1998] ECR I-4355, paragraph 20 and the case-law cited).”

In that case the Court interpreted Article 3(1) of the Information Society Directive in accordance with Article 8 of the WIPO Copyright Treaty.

It follows that, in a field of intellectual property law where the European Union has legislated, national courts must interpret both European and domestic legislation as far as possible in the light of the wording and purpose of relevant international agreements to which the EU is a party, such as TRIPS and the WIPO Copyright Treaty: see Case C-53/96 Hermès International v FHT Marketing Choice BV [1998] ECR I-3603 at [28];Joined Cases C-300/98 and C-392/98 Parfums Christian Dior SA v Tuk Consultancy BV [2000] ECR I-11307 at [47]; Case C-89/99 Schieving-Nijstad VOF v Groeneveld [2001] ECR I-5851 at [35]; Case C-245/02 Anheuser-Busch Inc v Budejovicky Budvar NP [2004] ECR I-10989 at [55]-[57]; and Case C-431/05 Merck Genéricos – Produtos Farmacêuticos Lda v Merck & Co Inc [2007] ECR I-7001 at [35].

In summary, FTS claims that it owns copyright in its PM Abs Lists and that both the WYP Lists and the Pandora’s Box List reproduce a substantial part of one or more of the PM Abs Lists. The Defendants dispute that copyright subsists in the PM Abs Lists, deny infringement and advance a defence of fair dealing.

Although FTS relies upon a number of PM Abs Lists, it is only necessary to consider the PM Abs List contained in the manual for FTS Hex version 3.8, which I will refer to in the remainder of this judgment simply as “the PM Ab List”. This consists of a list of 33 pairs of PM Abs addresses covering 25 different Nokia models. Each address consists of eight alphanumeric digits, representing four bytes of binary data in hexadecimal notation. For example, for model 1100 the addresses are 017F0000 (start) and 01FFFFFF (end). In the case of model 6230 there are three pairs of addresses, one each for firmware revisions identified as 3.xx, 3.40 and 5.xx. In the case of some other models, such as 6510 and 7260, more than one pair of addresses is given, but without identifying the relevant firmware revisions.

By the end of the trial, there was not a great deal of difference between the parties as to the manner in which Mr Bradford had ascertained the PM Abs addresses contains in the PM Abs List. It is common ground that he employed both the trial and error method and the flashing method. Counsel for FTS submitted that the evidence showed that he had ascertained the majority of addresses by the trial and error method. Counsel for the Defendants submitted that the evidence showed that he had ascertained the majority by the flashing method. Having considered all the evidence, I find that Mr Bradford ascertained the majority of the addresses by the trial and error method. While this finding is based on my assessment of the evidence as a whole, I will emphasise three particular points which I consider support this conclusion. First, the evidence indicates that Mr Bradford began his work by using just the trial and error method, and only started using the flashing method later. Secondly, there is evidence that Mr Bradford subsequently found a number of errors in the PM Abs List. I infer that he initially determined the addresses in question by the trial and error method, and later discovered the errors when he used the flashing method. Thirdly, for the reasons explained above, the flashing method depends on the availability of at least one test phone in addition to the phone under examination. This makes it likely that Mr Bradford sometimes had to resort to trial and error even after he had begun to use the flashing method.

Counsel for FTS submitted that copyright subsisted in the PM Abs List since (i) it was a table, alternatively a compilation, other than a database, (ii) it was Mr Bradford’s own intellectual creation and (iii) Mr Bradford satisfied the qualification requirements under the 1988 Act. Counsel for the Defendants disputed points (i) and (ii), but not point (iii). In relation to point (i), he submitted that the PM Abs List was a database. Before addressing these contentions, it is necessary to put them in context.

In SAS Institute Inc v World Programming Ltd [2010] EWHC 1829 (Ch), [2011] RPC 1 at [199]-[207] I considered the impact of the distinction drawn by Article 9(2) of TRIPS and Article 2 of the WIPO Copyright Treaty between “expressions” and “ideas, procedures, methods of operation and mathematical concepts as such” on domestic copyright law. My conclusion at [207] was as follows:

“Skill, judgement and labour in devising ideas, procedures, methods of operation and mathematical concepts is not protected by the copyright in a literary work. What is protected by copyright in a literary work is the skill, judgement and labour in devising the form of expression of the literary work.”

I went on in SAS v WPL at [208]-[238] to consider the copyright protection of computer programming languages, interfaces and functionality in the light of this general principle and in the light of recitals [13]-[156] and Article 1(2) of the Software Directive. My provisional conclusion was that copyright in computer programs did not protect programming languages, interfaces or functionality, but that these matters were not acte clair. I therefore referred questions to the Court of Justice of the European Union. That reference is presently pending before the Court as Case C-406/10. Neither counsel suggested that the answers given by the Court were likely to be of significance to the present case.

I then went on in SAS v WPL at [239]-[244] to consider the test for reproduction of a substantial part of a literary work. In this context I held at [244]:

“… it is important to be clear as to the basis upon which a compilation of unprotectable subject-matter can be protected as a copyright work. As can be seen from Article 2(5) of the Berne Convention, Article 10(2) of TRIPS and Article 5 of the WIPO Copyright Treaty, compilations are protected (whether or not the items compiled are protected) which ‘by reason of the selection or arrangement of their contents constitute intellectual creations’. Similarly, EU legislation adopts the test of ‘intellectual creation’ for the originality of computer programs (Article 1(3) of the Software Directive), databases for the purposes of copyright (Article 3(1) of [the Database Directive]) and photographs (Article 6 of Council Directive 93/98/EEC of 29 October 1993 harmonizing the terms of protection of copyright and certain related rights, now codified as Directive 2006/116/EC). It is now clear from [Case C-5/08 Infopaq International A/S v Danske Dagblades Forening [2009] ECR I-0000] at [31]-[48] that there will only be reproduction of a substantial part of a literary work, including a compilation, where what has been reproduced represents the expression of the intellectual creation of the author of that literary work.”

Consistently with the distinction drawn by Article 9(2) of TRIPS and Article 2 of the WIPO Copyright Treaty, and with Article 2(5) of the Berne Convention, Article 10(2) of TRIPS and Article 5 of the WIPO Copyright Treaty make it clear that:

For the reasons given above, Article 3 of the Database Directive must be interpreted consistently with Article 10(2) of TRIPS and Article 5 of the WIPO Copyright Treaty. More importantly, sections 3 and 3A of the 1988 Act must be interpreted consistently with Article 10(2) of TRIPS, Article 5 of the WIPO Copyright Treaty and Article 3 of the Database Directive.

As can be seen, section 3A provides that a database is only original if, by reason of the selection and arrangement of its contents, the database is its author’s own intellectual creation. By contrast, section 3 contains no corresponding provision in relation to a table or compilation other than a database. This difference is a consequence of the amendments made to the 1988 Act when the United Kingdom implemented the Database Directive. Counsel for FTS nevertheless conceded that, even if (as FTS contended) the PM Abs List was a table or compilation other than a database, it followed from the judgment of the Court of Justice in Infopaq at [37] that copyright only subsisted in it if it was “original in the sense that it is its author’s own intellectual creation”. In the light of that concession, it may be asked why it matters whether the PM Abs List is correctly classified as a table or compilation other than a database or as a database. The answer is that it matters because it bears on the question of whether the PM Abs List is protected by (a) copyright or (b) database right or (c) neither, although it is not determinative of that question.

It is clear that the PM Abs List is a collection of items of numerical data. Where one has a collection of items of data, it seems to me that the first question to consider is whether the individual items of data are copyright works in themselves. In the case of the PM Abs List, the items of data are the individual PM Abs addresses. Counsel for FTS did not concede that no copyright subsisted in the individual addresses, but nor did she argue to the contrary. In my judgment no copyright subsists in the individual addresses for two reasons which probably amount to different ways of saying the same thing. First, although I accept that some skill, judgement and labour was expended by Mr Bradford in ascertaining the addresses, at least when he used the trial and method, it was not the right kind of skill, judgement and labour to attract copyright protection: it was not skill, judgement and labour in devising the form of expression of the addresses. Secondly, I do not consider that the individual PM Abs addresses constitute Mr Bradford’s own intellectual creations. To the extent that they are intellectual creations at all, in substance they are Nokia’s intellectual creations.

The next question is whether copyright subsists in the collection of data. As noted above, counsel for FTS submitted that the PM Abs List was a table, alternatively a compilation, other than a database, whereas counsel for the Defendants submitted that it was a database. Counsel for FTS accepted that the PM Abs List was a collection of independent data arranged in a systematic or methodical way, but argued that those data were not “individually accessible by electronic or other means”. Counsel for the Defendants argued that it was sufficient for this purpose that the data were individually accessible by the eye of the reader. In support of this argument he relied upon recital (19) of the Database Directive and upon the judgment of the Court of Justice in Case C-444/02 Fixtures Marketing Ltd v Organismos Prognostikon Agonon Podosfairou [2004] ECR I-10549.

So far as recital (19) is concerned, this says that a compilation of recordings of musical performances on a CD does not qualify for database right because it does not represent a substantial investment. As counsel for the Defendants pointed out, this appears to imply that it is a database.

As for the Fixtures Marketing case, in that case the Court of Justice held that a list of football fixtures was a database. The whole section of the judgment at [18]-[36] is relevant, but the key passage for present purposes is as follows:

“30.

Classification of a collection as a database then requires that the independent materials making up that collection be systematically or methodically arranged and individually accessible in one way or another. While it is not necessary for the systematic or methodical arrangement to be physically apparent, according to the 21st recital, that condition implies that the collection should be contained in a fixed base, of some sort, and include technical means such as electronic, electromagnetic or electro-optical processes, in the terms of the 13th recital of the preamble to the directive, or other means, such as an index, a table of contents, or a particular plan or method of classification, to allow the retrieval of any independent material contained within it.

31.

That second condition makes it possible to distinguish a database within the meaning of the directive, characterised by a means of retrieving each of its constituent materials, from a collection of materials providing information without any means of processing the individual materials which make it up.

32.

It follows from the above analysis that the term database as defined in Article 1(2) of the directive refers to any collection of works, data or other materials, separable from one another without the value of their contents being affected, including a method or system of some sort for the retrieval of each of its constituent materials.”

In my judgment the PM Abs List is a table which is a database, albeit a very simple one. The PM Abs addresses in it are both systematically arranged and individually accessible, because the List is arranged into columns and rows. The first column lists the model number (and in the case of model 6230 the firmware revision), the second column lists the start address and the third column lists the end address. Thus one can use the notional column headings and row labels as primitive indices or keys to retrieve a particular start or end address for a particular model of phone.

I would add that in my view the PM Abs List is not a true compilation in any event. It was not planned and there was no overall design. It is simply an accretion of data acquired by happenstance over time: see Navitaire Inc v easyJet Airline Co Ltd [2004] EWHC 1725 (Ch), [2006] RPC 3 at [92] and SAS v WPL at [261] and [322].

Counsel for FTS conceded that, if the PM Abs List was a database, it was not protected by copyright since it was not Mr Bradford’s own intellectual creation by virtue of the selection and arrangement of its contents. In my judgment this concession was rightly made. Mr Bradford did not select the contents, they were acquired as a matter of happenstance over time, and the arrangement was the most obvious and basic one possible. To put what may be the same point another way, recital (15) of the Database Directive indicates that copyright in a database covers the structure of the database. The PM Abs List has no structure which merits copyright protection.

Although strictly unnecessary in view of my previous conclusions, it is nevertheless worth considering whether the PM Abs List would be protected by copyright if it was a table other than a database. Counsel for FTS argued that Mr Bradford had expended sufficient skill, judgement and labour in ascertaining the list of addresses in the PM Abs List for it to constitute his own intellectual creation. In support of this argument she relied upon the decision of the Court of Appeal in Sawkins v Hyperion Records Ltd [2005] EWCA Civ 565, [2005] 1 WLR 3281.

In that case the Court of Appeal upheld the decision of Patten J (as he then was) that three performing editions created by Dr Sawkins were original musical works in which copyright subsisted even though they were editions of compositions by Michel-Richard de Lalande, that those compositions were long out of copyright and that Dr Sawkins’ intention was not to create any new music. This was because of the very considerable skill, judgment and labour which Dr Sawkins had put into researching, reconstructing and presenting the source material. As Jacob LJ explained:

“78.

… But in the end, in my opinion it is essential to consider exactly what the claimant did to decide (both qualitatively and quantitatively) whether he created an original music work within the meaning of the Act. For, whilst it is trite that mere servile copying (for instance tracing or photocopying) does not amount to originality, there are clearly forms of ‘copying’ which do - the shorthand writer's copyright is a paradigm example which has stood since Walter v Lane [1900] AC 539.

…

83.

… I think the true position is that one has to consider the extent to which the ‘copyist’ is a mere copyist - merely performing an easy mechanical function. The more that is so the less is his contribution likely to be taken as ‘original’. Professor Jane C Ginsburg (‘The Concept of Authorship in Comparative Copyright Law’ 10 January 2003, Columbia Law School, Public Law Research Paper No 03-51, http://ssrn.com/abstract=368481) puts it this way, at p 21:

‘reproductions requiring great talent and technical skill may qualify as protectable works of authorship, even if they are copies of pre-existing works. This would be the case for photographic and other high quality replicas of works of art.’

In the end the question is one of degree - how much skill, labour and judgment in the making of the copy is that of the creator of that copy? Both individual creative input and sweat of brow may be involved and will be factors in the overall evaluation.”

Although that was a case involving musical works, it is clear that the same approach applies to literary works: see Eisenman v Qimron [2001] ECDR 6 (the Dead Sea Scrolls case), a decision of the Israeli Supreme Court under the Copyright Act 1911 which Sawkins v Hyperion indicates would be decided in the same manner under the 1988 Act.

I do not accept this argument. In my judgment the present case is to be distinguished from cases like Sawkins v Hyperion and Eisenman v Qimron. Those cases were concerned with the reconstruction of musical and literary texts. In each case, the reconstruction required the exercise of sophisticated musical or literary judgement as well as other relevant kinds of skill and labour. In each case, it was possible to say that the later author had devised the form of expression of the work even though he was attempting to reconstruct the form of expression of the earlier author’s work. As I have already pointed out, however, the present case is concerned with a collection of numerical data. For the reasons given above, the individual items of data are not protected by copyright. It follows that the collection of data does not attract copyright unless the selection and arrangement of the data makes the collection the author’s own intellectual creation. For the reasons given above, however, the selection and arrangement of the data did not make the PM Abs List Mr Bradford’s own intellectual creation. He exercised no literary judgment even in the widest sense of the word literary, and he did not devise the form of expression of the work to any material extent.

Finally, I should record that neither counsel submitted that the determination of this issue depended on the answer to be given by the Court of Justice to the first question which had been referred to it by the Court of Appeal in Football Dataco Ltd v Yahoo UK Ltd [2010] EWCA Civ 1380 (reported sub nomFootball Dataco Ltd v Stan James (Abingdon) Ltd), [2011] RPC 9). The reference is presently pending before the Court as Case C-604/10. In essence, the first question asks whether selection and arrangement carried out when the data contained in a database is being created can be relied upon in support of a claim to copyright in the database. In the present case, by contrast with that case, there was no selection and arrangement either when the individual items of data were being created or when the individual items of data where being compiled into the database (the fixture list in that case).

Although my conclusion that no copyright subsists in the PM Abs List makes it unnecessary to consider the remaining issues relating to the claim for infringement, I shall nevertheless do so in case that conclusion is wrong. Furthermore, some of the facts that I shall need to find are also relevant to the claims for database right infringement and breach of confidence. I shall deal with some of the issues more shortly than I otherwise would, however.

The question of infringement involves two issues. First, were the WYP Lists and the Pandora’s Box List derived from the PM Abs List? Secondly, if so, did they reproduce a substantial part of the PM Abs List?

Derivation. Counsel for FTS submitted that (i) the similarities between the PM Abs List and the lists of PM Abs addresses complained of raised a strong inference of copying, and (ii) the Defendants had failed to rebut that inference.

In support of the first submission, she particularly relied in opening upon the following similarities identified by Mr Kirsten between the PM Abs List and a WYP List contained in three documents of varying dates disclosed by the Defendants:

Counsel for the Defendants relied upon the evidence of Mr van der Knijff that the similarities identified by Mr Kirsten are “exactly what you would expect” if two parties independently attempted to ascertain PM Abs addresses for Nokia phones. I am unimpressed by this evidence, since Mr van der Knijff did not rebut the detailed points made by Mr Kirsten. Furthermore, Mr van der Knijff also stated that he was unable in the light of the information provided to him to give an opinion as to whether or not the WYP List was copied from the FTS List.

In cross-examination of Mr Hirst and in her closing submissions, counsel for FTS particularly relied upon comparisons between the PM Abs List and the WYP List dated 4 July 2006 referred to in paragraph 41 above. If the two lists are compared as they stand, they are virtually identical. The differences are that one pair of addresses found in the FTS List is not found in the WYP List and vice-versa, and in four cases there are similarities of the kind described above. If one excludes the M. Roeloffs entries from the WYP List and compares the remaining 30 entries with the FTS List, there remains a high degree of similarity.

In my judgment the similarities between the WYP Lists and the PM Abs List do raise an inference of copying. I therefore turn to consider whether the Defendants have rebutted that inference. DC Miller’s evidence was to the effect that he unable to say where the entries in the WYP List posted by Mr Hirst on 20 June 2006 had come from, since at that time this was Mr Hirst’s area, although he did remember seeing the post-it note which Mr Hirst obtained. Mr Hirst’s evidence was to the effect that he was unable to say how many entries he had posted on 20 June 2006, although he thought that about 10 was a fair estimate, and that he was unable to explain where the entries had come from other than those on the post-it note other than suggesting that he ascertained some himself by an unspecified method. Although it is the Defendants’ case that many of the PM Abs addresses which were posted on the PF Website after 20 June 2006 were posted by third parties such as M. Roeloffs and that such addresses were freely available on the internet, there is simply no evidence that any of the PM Abs addresses on the 4 July 2006 WYP List other than possibly the nine posted by M. Roeloffs came from a third party or were available on the internet before 20 June 2006.

It is common ground that Mr Hirst had the opportunity to copy the PM Abs List during the period 9 to 11 June 2006 when he was working with the Security Service officer on Operation Praline, since the Security Service officer had FTS Hex installed on his laptop and may also have had an electronic and/or hard copy of the manual. Mr Hirst steadfastly denied having surreptitiously copied the PM Abs List either from the laptop or a manual without the officer’s knowledge. I am prepared to accept that denial. That leaves the question, however, of what the officer gave Mr Hirst. As noted above, Mr Hirst’s evidence is that the officer wrote down three or four pairs of addresses on a post-it note and gave this to Mr Hirst. Mr Hirst had no convincing explanation as to why the officer should have done this. The best he could come up with was the suggestion that it was as a result of a conversation they had had in which Mr Hirst had said that he and DC Miller were working on a program to extract and decode binary data from mobile phones (i.e. CLiVE). But this does not explain why the officer would have given Mr Hirst addresses from the PM Abs List or, if he did, why he would only have given Mr Hirst three or four pairs of addresses.

As Mr Hirst accepted, the Security Service officer and Mr Hirst were working under considerable pressure that weekend to extract information from at least 23 mobile phones for a high-profile counter-terrorism operation. On Mr Hirst’s own account, the officer declined to sign the reports the officer had produced using FTS Hex as exhibits and so Mr Hirst himself produced them as exhibits in the case. Considering all the evidence and the inherent probabilities of the situation, I conclude that the officer gave Mr Hirst a list of PM Abs addresses so that Mr Hirst could assist him to extract and decode data (including deleted data) from the phones under examination as quickly as possible. I do not accept that the list consisted of only three or four pairs of addresses, or even 10 pairs of addresses. I find that it consisted of rather more pairs, probably close to 30 pairs. I am prepared to accept that the addresses were written on a post-it note; but post-it notes come in different sizes. Either at this stage, or when the addresses were typed up by Mr Hirst subsequently, errors of transcription were made resulting in the small differences noticed by Mr Kirsten.

There is no dispute that the WYP List posted by Mr Hirst on 20 June 2006 formed the basis of the WYP Lists used by Mr Hirst and DC Miller, and others in the HTCU, until July 2008.

As for the Pandora’s Box List, Mr Kirsten carried out a similar comparison between this List and the PM Abs List to that discussed above, with similar results. Accordingly, I conclude that the similarities again raise an inference of copying. Furthermore, there is no dispute that Mr Harrington had access to the WYP List posted on 20 June 2006, as subsequently added to, via the PF Website. There is no evidence to rebut the inference of copying.

Reproduction of a substantial part. If, but only if, the PM Abs List was Mr Bradford’s own intellectual creation so as to attract copyright, then I consider that the WYP List posted by Mr Hirst on 20 June 2006, and the WYP Lists used subsequently by WYP down to July 2008, reproduced a substantial part of it. The degree of reproduction was substantial both quantitatively and qualitatively. On the assumption I have stated, what was reproduced was the expression of Mr Bradford’s intellection creation. My conclusion is the same in relation to the Pandora’s Box List.

As recital (32) of the Information Society Directive makes clear, the list of permissible exceptions and limitations to the reproduction and communication to the public rights contained in Article 5 of the Directive is exhaustive. The Court of Justice has held that such exceptions and limitations must be construed (i) strictly, (ii) in the light of Article 5(5) of the Information Society Directive (which requires the application of the three-step test contained in Article 9(2) of the Berne Convention) and (iii) in the light of the need for legal certainty for authors with regard to the protection of their works: see Infopaq at [56]-[59] and Case C-462/09 Stichting de Thuiskopie v Opus Supplies Deutschland GmbH [2011] ECR I-0000 at [21]-[22], [33]-[34]. On the other hand, they must be interpreted so as to enable the effectiveness of the exception to be established and permit observance of the exception’s purpose: Joined Cases C-403/08 and C-429/08 Football Association Premier League Ltd v QC Leisure [2011] ECR I-0000 at [164].

For the purposes of research. As counsel for the Defendants conceded, section 29(1) of the 1988 Act must be construed in conformity with Article 5(3)(a) of the Information Society Directive. It follows that, as the authors of Laddie, Prescott and Vitoria, The Modern Law of Copyright and Designs (4^th ed, Lexis Nexis) point out at §21.33, the words “for the purposes of research” must be narrowly interpreted as meaning “for the purposes of scientific research”. It is not clear whether the exception must also be interpreted as being restricted to “illustration for … scientific research”. This depends on whether Article 5(3)(a) is properly to be interpreted as excepting (1) illustration for teaching and (2) scientific research or as excepting illustration for (1) teaching and (2) scientific research. This point was not addressed in argument, and I will therefore assume without deciding that the former interpretation is correct. Counsel for the Defendants submitted that, if the Defendants had reproduced the PM Abs List, they had done so for the purpose of scientific research. I do not accept that submission. The Defendants reproduced the PM Abs List for the forensic purpose of enabling themselves and others to extract data from mobile phones for use in criminal investigations. While it is close to the line, in my judgment that does not amount to scientific research.

For a non-commercial purpose. It is common ground that, as indicated by recital (42) of the Information Society Directive, the fact that WYP is a public-funded law enforcement agency is not determinative of whether the use was a non-commercial purpose. Counsel for FTS submitted that the Defendants’ purpose in reproducing the PM Abs List was commercial because it was competitive with commercial suppliers, in particular FTS. I do not accept that submission. In my judgment the use was for a non-commercial purpose, namely law enforcement.

Fair dealing. Although Article 5(3)(a) does not use the expression “fair dealing”, it does say “to the extent justified by the non-commercial purpose to be achieved”. In my view this involves similar considerations to those which domestic courts have traditionally considered in the context of deciding whether the use was fair dealing. Current domestic law on whether dealing is fair is summarised in Copinger and Skone James on Copyright (16^th ed, Sweet & Maxwell) at §9-55 as follows:

“Relevant considerations. Relevant factors to be taken into account in judging whether the dealing was fair have been identified in various cases. None is determinative and the weight to be attached to them will vary from case to case. In particular, the various factors will carry different weight according to the type of dealing. Cases of fair dealing for purposes of criticism, review and the reporting of current events usually raise more difficult problems than cases of non-commercial research and private study. The three most important factors have been identified to be: [Ashdown v Telegraph Group Ltd [2001] EWCA Civ 1142; [2002] Ch.149…]

(1)

The degree to which the alleged infringing use competes with exploitation of the copyright work by the owner. This is likely to be a most important factor. …

(2)

Whether the work has been published or not….

(3)

The extent of the use and the importance of what has been taken. In many cases this will be a highly important factor…”

In my judgment the Defendants’ reproduction of the PM Abs List was not fair dealing. The Defendants’ acts were competitive with FTS, the PM Abs List was unpublished and the extent of the reproduction was considerable.

In the current state of the case law of the Court of Justice, it is not clear to what extent the court must consider whether the application of the exception or limitation relied on satisfies the three-test in the particular circumstances of the case before it. Even if the court is required to conduct a three-step analysis, however, it seems clear that the effect will not be to widen what amounts to fair dealing, but if anything to narrow it. It follows that, even if I am required to conduct a three-step analysis, it would not alter the conclusion that the Defendants’ use was not fair dealing.

Sufficient acknowledgement. It is common ground that no acknowledgement was given. The Defendants contend that it was impossible to do so. I do not accept this. In the light of my findings of fact there is no reason why FTS could not have been credited as the source of the data.

Conclusion. I therefore conclude that the fair dealing defence is not made out.

There is no dispute that, if copyright subsists in the PM Abs List and has been reproduced in the WYP List posted by Mr Hirst on the PF Website, then Mr Hirst is liable as a primary infringer. Nor is there is any dispute that WYP is vicariously liable as Mr Hirst’s employer for acts of infringement committed by him prior to his departure on 2 September 2007. To the extent that DC Miller and other members of the HTCU reproduced the WYP List posted by Mr Hirst before or after that date, then again WYP is vicariously liable for those acts of infringement. In those circumstances it is not necessary to consider the alternative bases on which FTS contends that WYP is liable in respect of such acts.

The position is different with regard to the Pandora’s Box List. As explained above, this was produced and distributed by IDFS. In her closing submissions counsel for FTS put the claim against Mr Hirst on basis that he had authorised the reproduction by IDFS of the WYP List which he posted on the PF Website. She conceded that WYP could not be liable for this infringement, since the reproduction by IDFS occurred some time after Mr Hirst’s departure from WYP. The only basis for the claim of authorisation is the fact, which is common ground, that Mr Hirst posted the WYP List on the PF Website as part of an information exchange with other users of the website, and in particular law enforcement agencies. In my judgment this is not enough to amount to authorisation of reproduction of IDFS, for at least two reasons. First, it is far from clear that IDFS derived the Pandora’s Box List from this source. It is possible that IDFS copied the PM Abs List by another route. Secondly and in any event, I do not consider that by posting the WYP List on the PF Website Mr Hirst authorised third party commercial organisations to reproduce it for their own purposes. At most, he authorised its use by other law enforcement agencies for their own forensic purposes.

Finally, the Defendants contend that they have a defence to damages under section 97(1) of the 1988 Act on the ground that, at the time of the infringement, they did not know, and had no reason to believe, that copyright subsisted in the PM Abs List. The “no reason to believe” test is not easily satisfied where the basis of the defence is that the material in question is not of a character that is entitled to protection: see Copinger and Skone James at §21-79. Nor is it easy to apply in circumstances where I have held that copyright does not subsist in the PM Abs List, but for present purposes I have to assume that it does. On that assumption, I do not consider that this defence is established. I find that Mr Hirst did have reason to believe that copyright subsisted in the PM Abs List, because he knew it was a table of data collated by FTS through the exercise of at least some skill, judgement and labour. The fact that I have concluded that the skill, judgement and labour was not of the right kind to attract copyright as opposed to database right does not alter that.

FTS’s claim for copyright infringement fails on the ground that copyright does not subsist in the PM Abs List. If copyright did subsist, the Defendants would have infringed it and would have no innocence defence to damages.

FTS contends that, if the Defendants are right to say that the PM Abs List is a database and therefore no copyright subsists in it, then it is protected by database right which the Defendants have infringed. The Defendants dispute that database right subsists and deny infringement. They do not advance a defence of fair dealing to this claim, accepting that not all of the requirements of regulation 20(1) of the 1997 Regulations are satisfied. By the end of the trial the issues between the parties with respect to database right were quite narrow, and I can therefore deal with them relatively briefly.

Counsel for the Defendants submitted in his skeleton argument that:

“The effort, if any, expended in determining the PM Abs addresses for particular mobile phones is unrelated to the selection or arrangement of the contents of the PM Abs [Lists]. That effort is effort expended in ‘obtaining’ the contents of the database, and is effort which counts towards the subsistence of sui generis database right under reg. 13 of the Copyright and Rights in Databases Regulations (which gives effect to Art. 7 of the Database Directive), and not towards copyright.”

As can be seen from paragraphs 88-94 above, I have accepted the submission that the skill, judgement and labour expended by Mr Bradford in ascertaining the addresses and collating them in the PM Abs List was not the right kind of skill and labour to attract copyright. As counsel for the Defendants rightly conceded in this paragraph, however, it was an investment in the obtaining of data which counts towards subsistence of database right. I would add that there is also evidence of verification of the data by Mr Bradford and other FTS employees.

In his closing submissions counsel for the Defendants submitted that the investment made by FTS in obtaining the data was not sufficiently substantial, either quantitatively or qualitatively, for database right to subsist. I do not accept this submission. In the light of my findings of fact, I consider that FTS did make a substantial investment in obtaining and verifying the data. Each pair of addresses obtained by the trial and error method took skill and effort. Cumulatively, considerable skill and effort was expended even though much less skill and effort was required to obtain pairs of addresses by the flashing method.

Counsel for the Defendants did not dispute that, if and to the extent that Mr Hirst had copied the PM Abs List and posted it on the PF Website, he had extracted and re-utilised the contents of the database comprised by the PM Abs List. He submitted that any such extraction and re-utilisation was not of a substantial part, evaluated quantitatively or qualitatively, of the contents of the database. Again, I do not accept this submission. In the light of my findings of fact, I consider that Mr Hirst did extract and re-utilise a substantial part of the contents of the database both quantitatively and qualitatively. Similarly, I consider that the production and distribution of the Pandora’s Box List involved the extraction and re-utilisation of a substantial part of the contents of the database.

Again, there is no dispute that WYP is vicariously liable for the acts of infringement committed by Mr Hirst down to 2 September 2007. It is also vicariously liable for any other acts of infringement by DC Miller and other members of the HTCU.

As I think counsel for FTS conceded, FTS has no claim against either of the Defendants in respect of the Pandora’s Box List, since authorisation is not an infringing act in the case of database right. In any event I would reject any claim for authorisation for the reasons given in paragraph 117 above.

The position here is the same as in relation to copyright. Even if I had concluded that Mr Hirst had no reason to believe that copyright subsisted in the PM Abs List, I would still conclude that he did have reason to believe that database right subsisted in it.

FTS succeeds in its claim for infringement of database right against both Defendants in respect of the WYP Lists, but not in respect of the Pandora’s Box List.

Breach of confidence was only briefly argued by both counsel. In the light of my preceding conclusion I shall follow their example.

The clearest statement of the elements necessary to found an action for breach of confidence remains that of Megarry J in Coco v A.N. Clark (Engineers) Ltd [1969] RPC 41 at 47:

“First, the information itself ... must ‘have the necessary quality of confidence about it’. Secondly, that information must have been communicated in circumstances importing an obligation of confidence. Thirdly, there must have been an unauthorised use of the information to the detriment of the party communicating it.”

This statement of the law has repeatedly been cited with approved at the highest level: see Lord Griffiths in Attorney General v Guardian Newspapers Ltd (No 2) [1990] 1 AC 109 at 268, Lord Nicholls of Birkenhead in Campbell v MGN Ltd [2004] UKHL 22, [2004] AC 457 at [13] and Lord Hoffmann in Douglas v Hello! Ltd (No 3) [2007] UKHL 21, [2008] 1 AC 1 at [111].

The expression “the necessary quality of confidence” was coined by Lord Greene MR in Saltman Engineering Co Ltd v Campbell Engineering Co Ltd (1948) 65 RPC 203 at 215. Lord Greene defined this quality by antithesis: “namely, it must not be something which is public property and public knowledge”. Confidentiality is a relative concept: see Vestergaard Frandsen A/S v Bestnet Europe Ltd [2009] EWHC 1456 (Ch), [2010] FSR 2 at [77] and the authorities cited there.

In my judgment the PM Abs List did have the necessary quality of confidence as at June 2006, which is the date that matters, since it was valuable information collated by FTS through the exercise of skill, judgement and labour which was not in the public domain. Counsel for the Defendants mounted an argument to the effect that the PM Abs List did not have the necessary quality of confidence because FTS had not taken sufficient steps to protect the confidentiality of the information. In my judgment that is immaterial, because this is not a case where FTS has to establish that the information had the status of a trade secret. In case the matter goes further, however, I should make the necessary findings of fact.

As indicated above, as at June 2006, FTS Hex and the PM Abs List were being used by FTS itself and by the Security Service under licence. There was no other licensee. Mr Clark’s evidence, which I accept, was that, when he discussed licensing FTS Hex with the Security Service, he emphasised that the product was confidential to FTS. In any event, given the purpose for which the Security Service was seeking to licence the use of FTS Hex, it is manifest that both parties would have wanted to keep the details of FTS Hex (including the PM Abs List) confidential. Counsel for FTS pointed out that the terms and conditions of the licence entered into by the Security Service in respect of FTS Hex do not explicitly contain any obligation of confidentiality in respect of FTS Hex, let alone the PM Abs List. In my view that is immaterial.

Mr Fordy gave evidence, which I accept, that in his discussions with DI Crampton in early June 2006, he also emphasised the confidentiality of FTS Hex. As I understood his evidence, his reason for doing this was partly to explain why FTS was not willing merely to translate data extracted by the HTCU. (Another reason was that HTCU could easily have missed data given that it did not have a list of PM Abs addresses.)

It may be correct, as counsel for the Defendants submitted, that by June 2006 FTS had disclosed in general terms the capabilities of its FTS Hex software to third parties otherwise than on terms as to confidentiality. That is immaterial to the confidentiality of the PM Abs List, however.

It was common ground between counsel that an equitable obligation of confidence will arise as a result of the receipt of confidential information if, but only if, the recipient either knows or has notice (objectively assessed by reference to a reasonable person standing in the shoes of the recipient) that the information is confidential. It is therefore unnecessary to cite authority in support of this proposition.

I have already found that Mr Hirst received at least a substantial copy of the PM Abs List from the Security Service officer during the period of 9-11 June 2006 and that the officer gave it to Mr Hirst in order that Mr Hirst could assist him to extract and decode data from the mobile phones under examination in Operation Praline. At that time, Mr Hirst was aware that (i) FTS was a commercial supplier of forensic services and (ii) FTS Hex was licensed to the Security Service, but not to WYP. In these circumstances, it is at least arguable that a reasonable person standing in the shoes of Mr Hirst would have appreciated that the information was confidential and that it was being disclosed to him in breach of confidence. It is not necessary for me to go that far, however, because I consider that a reasonable person standing in the shoes of Mr Hirst would in any event have appreciated that the information was confidential and that it was being disclosed to him for a limited purpose. Accordingly, Mr Hirst came under an equitable obligation of confidence to use the information only for that limited purpose.

It follows from my previous conclusions that Mr Hirst misused FTS’s confidential information when he posted the WYP List on the PF Website on 20 June 2006 and when he made copies of it for his own and his colleagues’ use within the HTCU.

Again there is no dispute that WYP is vicariously liable for Mr Hirst’s acts of breach of confidence in relation to the WYP Lists down to 2 September 2007. There is no basis for holding either of the Defendants liable in respect of the Pandora’s Box List, however.

FTS succeeds in its claim for breach of confidence in respect of the WYP Lists, but not the Pandora’s Box List.

For the reasons given above, I conclude as follows:

Apart perhaps from the fair dealing defence, counsel for the Defendants did not advance any defence to FTS’s claims arising out of WYP’s status as a public authority or law enforcement agency. It follows that the lawfulness of its actions falls to be assessed on the same bases as those of other kinds of persons and bodies. That is, of course, in accordance with the rule of law. Nevertheless, I cannot part from this case without expressing my concern that it should have come this far. I fear that the costs will have been out of all proportion to what is at stake. That is regrettable in any litigation, but particularly so where public money is involved.