Bloomberg News is reporting that the jury has been dimissed, and that there will be no third phase of the trial, which was to have focused on damages in the event that Oracle prevailed.

The win for Google in the patent phase comes on top of a narrow but hollow victory for Oracle, in which the enterprise software giant won a part of its argument, but failed to make it stick in a way that would make any difference to either company.

Asked to decide whether Google had infringed upon Oracle’s copyrights to certain parts of the Java programming language, the jury — the same jury that came out in Google’s favor today — agreed that it had. Then asked to decide on four specific examples of that infringement, jurors could agree on only one that cracked the threshold of being sufficiently egregious to warrant any damages. And in that case, the damages amount to no more than $200,000, probably less than it cost to litigate in the first place.

Google shares rose slightly by $2.09 to $602.89 or less than 1 percent. Oracle shares fell slightly by 6 cents to $26.30.

Oracle put out this statement:

Oracle presented overwhelming evidence at trial that Google knew it would fragment and damage Java. We plan to continue to defend and uphold Java’s core write once run anywhere principle and ensure it is protected for the nine million Java developers and the community that depend on Java compatibility.

Meanwhile, here’s Google’s statement, which reads like a victory lap:

Today’s jury verdict that Android does not infringe Oracle’s patents was a victory not just for Google but the entire Android ecosystem.

But even a task that never ends has to have a beginning, and more often than not it goes something like this: What do I have that needs to be protected, and how well or not is it protected now? Sometimes the best thing to do is call in someone from the outside to look at it all with fresh eyes. And sometimes the answers can be shocking.

It’s the sort of thing that Rapid7, a fast-growing security firm based in Boston, specializes in. While some security firms are more the cops on the beat, hired to keep things in check based on established rules and policies, Rapid7 is one you call when you want to know how the bad guys will try — and try they will — to get through whatever security measures are already in place.

The firm also owns Metasploit, an open source service that’s essentially an early-warning system about new vulnerabilities. Twice in the last year, new research by Rapid7 — released to the wider world through Metasploit — has caught my attention: Once it was about Java, and the other item was about how the methods employed in Stuxnet could be used to create new ways to attack public infrastructure.

I recently had a chance to ask Rapid7 CEO Mike Tuchen some questions about his company and the interesting role it’s playing in trying to clear up a lot of ambiguity about IT security that so many CIOs find frustrating. My first question was to ask Tuchen to explain from a high level what Rapid7 does.

AllThingsD: Mike, the thing I always think of when I talk to security companies is that the scope of the problem is constantly moving. If I were to use a football metaphor, it would be that the goalposts are always changing. And yet there’s another metaphor that fits as well: That of a medical triage, because once you know you have problems, there’s the matter of determining which one to fix first. What does Rapid7 do to help companies sort all this out?

Tuchen: We think of the security market as breaking out into “front-end” and “back-end” activities. Front-end activities are the assessments we do to proactively answer questions like: What’s my security posture? Where am I strong, and where am I vulnerable? What should I do to become more secure? That’s where we fit. 

Back-end activities are the enforcement and remediation efforts to protect data or networks that typically act in real time in response to threats detected including firewalls, anti-virus applications and so on.

We’re finding that as the threats are constantly growing and changing, there’s a lot of interest in assessment. The reality is that we’re seeing a new breach on average of once per day for the last 18 months or so. So when things are moving that fast, who wouldn’t want to know where their weaknesses are and what are the most important things they need to do to lower the chance of a being one of those companies breached? Our customers are telling us that once they’ve done the assessment, they’re able to set their priorities for the next 12 to 24 months. If you haven’t done an assessment, there’s a good chance you’ll buy a back-end product that doesn’t solve all your problems because you never knew what all the problems were in the first place. That’s how budgets tend to spin out of control.

So one big question around security is around the shift to the cloud. There are still a lot of people who don’t trust systems they can’t touch, but with the cost savings, the shift is looking more real every day. What does that shift mean for you and for your clients?

The first question you have to ask is “what do I have?” It’s kind of self-evident: You can’t secure what you don’t know about. Cloud services can make this trickier by adding another question into the mix: “Where is it?” And it gets even dicier when you take into consideration all the virtual machines that can be turned on and off at will and moved from one physical machine to another. The boundaries get a lot less well-defined. So the first step is discovery: What do you have, where is it, and what controls are in place? 

The next step is determining what types of threats you’re likely to face and figuring out what’s working to head them off and what’s not. After that you put together a strategy for improvement. 

Generally speaking, the best approaches we’ve seen start with basic hardening techniques. You take some concrete actions that are designed to make it more costly and difficult for attackers to establish a beachhead on your systems. Next, you lock down the perimeter as tightly as possible, and train employees to recognize and resist social engineering attacks.

When it comes to assessing the security of cloud offerings and software-as-a-service applications, it’s a matter of getting comfortable with the security that the vendor has in place. Our own experience with this has been pretty bleak. It’s clear that the industry as a whole has work to do there. 

Like what?

Attackers have the advantage right now. Even the largest and most sophisticated companies are getting breached on a regular basis. I think there are three things that need to happen: We need to do a better job of information-sharing about risks, methods, and actors so that companies don’t have to start from scratch. We also need to make security simpler. Right now it’s way too complex, and there are too many products that target specific problems that tend to be important to only the biggest of companies. And even those companies can barely stitch them all together into a coherent solution. For everyone else in the world it’s pretty much impossible to do that.

We’re working on a lot of this. We run an annual conference called UNITED to bring together innovative defenders to share ideas. It stands for “Using New Ideas To Enhance Defense.” We’ve committed $100,000 to sponsor some projects we like to call the “Magnificent7” and there will be no strings attached to the funding.

Washington seems to have finally awakened to the wider IT security threats. We hear a lot of talk coming out of Congress about cybersecurity. What, if anything, do you expect to come out of these efforts?

There are two security bills, SOPA and CISPA, that have gained a fair amount of attention lately. SOPA focuses on the illegal downloading of music, videos, software and other counterfeit goods that affect a wide variety of industries. These are the low-hanging fruit when it comes to online crime.

CISPA focuses on sharing private sector consumer data with the government to protect national security interests. The intent with CISPA is to legally protect private companies when they share consumer information with government and law enforcement entities. This information would not be available to the public at large and is highly scrutinized by privacy advocates. The information would be used to try to protect the country’s critical infrastructure. But if it were to become law, it won’t change the status quo of organizations and consumers fending for themselves when it comes to information security.

Also if they’re passed, they only affect U.S. citizens. These laws will not prevent foreign entities from engaging in piracy or breaching U.S. corporate or civilian assets. Companies will still be under non-stop attacks from persistent adversaries.

You raised a big bunch of funding last fall with a $50 million investment led by TCV. What are you going to do with all that money?

We’ll use it for three major initiatives: First, we’re doubling down on expanding our existing engineering teams. We doubled the team in 2010, nearly doubled it in 2011, and plan to double it again in 2012. Second, we’re accelerating our international expansion. We just hired a regional VP for Europe and are expanding our European and Asia-Pacific operations with new offices in Amsterdam, Hong Kong and Sydney. Finally, we’re looking to acquire terrific companies with passionate teams that want to join forces with Rapid7 to change the security world.

You acquired the Metasploit Project in 2009. How has that deal worked out and what does it say about the companies you may yet acquire? What are your plans for future acquisitions?

Metasploit has been great for Rapid7. We first started thinking about Metasploit when Chad Loder, one of our co-founders, came up with the idea of integrating an existing product with Metasploit. We discussed it with HD Moore, the founder of Metasploit, and he was equally excited about the idea of integrating the products together. In a week or two we had a working prototype. Right then we realized that we’d found something special: A passionate, driven entrepreneur who shared a lot of our vision and values, a product that logically works together with our existing product, a huge and engaged community of expert security insiders and a business that was ready to be commercialized. We asked HD if he’d like to join forces with us, and he agreed. We were able to build a team around HD, and together we’ve built the Metasploit business into a leader in its category. 

In that case we learned that founder and team are critical. It also made it easier to build the rest of the team around HD from the bottom up. Now we’re actively looking for companies that play in markets that make sense for us, and products that have a solid foundation for the future. We haven’t yet found another opportunity that fits all of these areas.

I get that Rapid7 is growing; you’ve got an impressive list of customers that includes Anadarko Petroleum, Teradyne, Liz Claiborne and the U.S. Postal Service. Can you share some basic metric that shows how much you’re growing?

Our revenue for the last seven years is over 90 percent per year, and we’ve grown more than 70 percent in each of the last two years. And we have more than 2,000 customers. We’ve been lucky to be in a market where the demand is increasing because threats are escalating.

Asked to decide whether Google had infringed upon Oracle’s copyrights to certain parts of the Java programming language, the jury agreed that it had. But then, when asked to decide on four specific examples of that infringement, jurors could agree on only one: The rangeCheck method in TimSort.java and ComparableTimSort.java. Don’t ask me to explain exactly what it is, but it is being described widely as “nine lines of code.” And, unfortunately for Oracle, the damages it can collect are limited to somewhere in the neighborhood of $150,000 to $200,000, or less than pocket change for either company, not the $1 billion or more Oracle had said it wanted.

Jurors were also unable to decide if the portions of Java code that it copied could be protected by the long-established doctrine of Fair Use, under which certain infringements can be excused. Google lawyers pounced on this, and said they would move for a mistrial.

The conclusion is that Oracle proved at least part of its argument, but failed to prove the dramatic injury it said it had suffered. It also proved that Google knew that it needed a license to Java in order to use the portions of Java that it did use. The complication there was the fact that one flavor of Java is compatible with other flavors of Java: It still operates under the old “write once, run anywhere” principle that Sun Microsystems envisioned when it created Java. Oracle still wants Google to take out a commercial license that would require Google to maintain Java compatibility with other platforms.

Still undecided — and this is the big issue that has the eyes of the software industry watching this case closely — is whether Oracle can prevail on the issue of protecting software APIs using a copyright in the first place. Jurors were instructed to proceed under the assumption that this was a matter of settled law, when in fact it is not. Judge William Alsup will decide on this issue later, and it is unclear exactly how the jury verdict in the first phase of this case will affect his decision.

Had Oracle won a more ringing endorsement from the jury, that portion of the argument might seem to be stronger. It’s an important point that Google argued against, saying APIs shouldn’t be subject to copyright protection, because they’re more like tools and techniques that programmers use to build software. You can copyright a given program because it’s unique, but you can’t copyright the language it’s written in. The possibly strained analogy I came up with before is this: You can copyright a musical composition like Miles Davis’s “So What,” but you can’t copyright the form of music known as jazz.

Oracle argued at trial that copyright law offers the only proper protection for original expression in software, mainly because software advances are incremental, building upon previous advances and innovations. Laws governing trade secrets and patents don’t get the job done. Oracle lawyers contended that copyright law, while still imperfect, protects innovations and advances at a more granular level, but mainly against copying.

Also still ahead is the patent phase of the trial, where Oracle will assert that Google violated Java patents in building Android. After that, there will be a third phase, where the two parties will wrangle over damages. So far, it seems — unless Oracle prevails in the patent portion — that there won’t be much to wrangle over.

At least for now, it appears that Google has escaped the worst of Oracle’s accusations. That was the conclusion of shareholders of both companies. Google shares rose by more than 2 percent on the news of the verdict yesterday, closing at $607.55 a share. Oracle shares fell by more than 1 percent to close at $27.92 a share. The case isn’t over, and Google hasn’t exactly come out of it looking virtuous. But if the point of defending against a lawsuit is to escape paying huge monetary damages, Google won the day.

Embedded below is the filled-out jury questionnaire:

Verdict

As the AP has it, the jury has decided against Google on Oracle’s copyright claim, but has reached an impasse on some key questions. There’s obviously more to this story as it develops. I’ll be updating as soon as I know more.

Update: The jury sided in part with Oracle, ruling that the Android mobile operating system infringes on some Java copyrights. However, it was deadlocked over the question of whether that use constituted “fair use,” and was therefore protected. This impasse appears to be the basis for a mistrial motion that Google lawyers say they intend to file.

Oracle has not prevailed on every point and, in fact, it’s looking like a messy victory. The jury found code in two files to be infringing, and that some elements of Android application programming interfaces or APIs were similar to Oracle’s Java APIs.

Attorneys for Google told Judge William Alsup that they intend to file a motion for a mistrial because of the impasse over the “fair use” question. Alsup told both sides to be prepared to argue that motion, which will come later.

A few other things are coming up: Judge Alsup still has to rule on whether APIs can be copyrighted as a matter of law. Jurors were instructed to deliberate, assuming that they could be copyrighted.

There is a clear finding that Google has infringed on nine lines of code. This came in Question 3A, concerning something called RangeCheck in Java. They decided that Google hadn’t infringed on two other blocks of code. With the jury out of the room, Judge Alsup said that there is “zero finding of copyright liability” on anything other than the nine lines.

That’s good for Google, because Oracle’s own expert at trial said they’re not worth much. An Oracle attorney suggested that the company should receive a share of Google’s profits on top of regular damages. Judge Alsup rejected that as “bordering on the ridiculous.”

From Google:

“We appreciate the jury’s efforts, and know that fair use and infringement are two sides of the same coin. The core issue is whether the APIs here are copyrightable, and that’s for the court to decide. We expect to prevail on this issue and Oracle’s other claims.”

And here’s Oracle’s statement:

“Oracle, the nine million Java developers, and the entire Java community thank the jury for their verdict in this phase of the case. The overwhelming evidence demonstrated that Google knew it needed a license and that its unauthorized fork of Java in Android shattered Java’s central write once run anywhere principle. Every major commercial enterprise — except Google — has a license for Java and maintains compatibility to run across all computing platforms.”

For reference, I’ve embedded the questionnaire that the jurors were required to fill out:

Jury Questions

Judge William Alsup is starting to talk about opening arguments for phase two of the trial, which will focus on patents. A third phase, assuming Oracle prevails, will focus on determining damages.

There was a false alarm late Friday when CNET and Bloomberg News reported that a partial verdict had been reached, when in fact it hadn’t. This happened after it became relatively clear that jurors were stuck and unable to agree on all four questions they have been tasked with answering.

Jurors have been asked to decide if Google’s use of 37 sections of Java source code — which Oracle owns, having acquired Sun Microsystems in 2010 — constitutes copyright infringement; or if, as Google argues, the copied sections are so insignificant as to amount to “no big deal.”

Oracle sued Google in 2010, after closing the Sun deal. Google stands accused of using some parts of Java to create Android without having first obtained the relevant licenses — first from Sun, then from Oracle — that, among other things, required compatibility with other flavors of Java.

Jurors have reached no conclusion in the case and Judge William Alsup has sent them home for the weekend with instructions to try again on Monday.

The jury had indicated Thursday in a note to Alsup that it was stuck on some point. Alsup warned lawyers for both sides that they might have to prepare for a deadlocked jury. Obviously, the situation here is fluid. I’ll have more in this post as it comes in.

There are four questions the jurors are tasked to answer, and they’re said to be unanimously agreed on three of them, but unable to reach consensus on the fourth, though its unclear which are which.

For what its worth, below is the form with the four questions the jurors have to answer.

Jury Questions

The Associated Press reported that a note to Judge William Alsup asked what would happen if jurors were unable to come to a conclusion, and indicated that some jurors are not budging from their positions.

Alsup called jurors into the courtroom for a talk, then sent them home so they could “start fresh” today. Bloomberg Businessweek reported that Alsup told lawyers that it’s possible the jury is deadlocked. If that’s what happens, Alsup said, the parties would move immediately into the second phase of the trial, which covers patents.

Jurors have been asked to decide if Google’s use of 37 sections of Oracle-owned Java source code constitutes a copyright infringement, or if, as Google has argued, the copied sections are so insignificant as to amount to “no big deal.”

Oracle sued Google in 2010, after acquiring Sun Microsystems and becoming the owner of the Java programming language. Google stands accused of using some parts of Java to create Android without having first obtained the relevant licenses — first from Sun, then from Oracle — that, among other things, required compatibility with other flavors of Java.

The jury has been deliberating since lawyers for Google and Oracle wound up their arguments on Monday.

(Image courtesy of Icanhascheezburger)

The jury has had the case since Monday, and as yet there’s no indication of when its deliberations will be complete.

The basic questions jurors are wrestling with concern whether and how it is or isn’t okay for a company to copy portions of software code that would otherwise require a commercial license. Also looming large over the proceedings is whether or not a programming language can by itself by protected by copyright. Oracle lawyers argued at trial that it can, but this is by no means a legal slam dunk.

Google lawyers, for their part, argued that the copying was insignificant, or “no big deal whatsoever.”

Oracle sued Google in 2010, after acquiring Sun Microsystems and becoming the owner of the Java programming language. Google stands accused of using some parts of Java to create Android without having first obtained the relevant licenses, first from Sun, then from Oracle, a license that among other things required compatibility with other flavors of Java.

Once the jury comes back, which could be as soon as today (but we thought that earlier this week), the trial will shift to a second phase over patents. After that, assuming Oracle prevails in one or both of the first two phases, a third phase will determine the amount of damages, if any. The full trial is expected to last two months.

Lots of people are waiting on the outcome of this first phase, however. To all of them, I dedicate Tom Petty’s “The Waiting.”

In his appearance, McNealy said that, as he remembers it, Google was asked to take out a commercial license on Java. “There is a Java specification license document available,” he said, that didn’t contain any financial requirements, but it did require compatibility.

McNealy had been called as a witness by Oracle, and on the stand he said that it was Sun’s practice to let other companies use Java, but only with a commercial license, and that its primary requirement was that the licensee ensure that Java remain compatible.

While numerous other phones from the likes of Nokia, Research In Motion and Motorola were compatible with Java applications, those on Android weren’t. Compatibility is one of the main points over which Oracle has been arguing with Google. Oracle contends that not only did Google violate its patents and copyrights, but it then went on to build its own incompatible version of Java, fracturing one of the oldest premises of Java’s existence: Write once, run anywhere.

McNealy is also running a poll on Twitpolls, asking people to vote for which side they agree with. (Google is ahead as of this morning.)

Who is right in the Oracle vs. Google lawsuit? reply w/ #oracle #google #neither #both http://t.co/aWdhzPbO

May 1, 2012 1:44 pm via GetTwitPollsReplyRetweetFavorite

@scottmcnealy

Scott McNealy

And he promotes a similar poll on his own new venture’s site, Wayin.com, where, as of this morning, the vote is favoring Oracle.

Meanwhile, the jury is still out, and the world is still waiting for a verdict. It could come today.

Anyhow, here’s the video of McNealy’s six-minute TV interview:

The jury in the Oracle-Google trial will begin its second day of deliberations today, following a round of closing arguments by lawyers for both sides.

From Oracle’s perspective, the basic question jurors will have to answer, as its lawyer Michael Jacobs put it, is whether it’s okay for one company to use another company’s intellectual property without permission. (See Jacobs’ slide deck, embedded below.)

Google attorney Robert Van Nest argued that the amount of Oracle IP that it used was so small as to be “no big deal whatsoever.”

Oracle sued Google in 2010, after Oracle acquired Sun Microsystems and thus became the owner of its Java programming language. Google is accused of using some parts of Java to create Android without having first obtained the relevant licenses, first from Sun, then from Oracle.

Monday’s closing arguments constituted the end of the first phase of the trial, which has also turned into a closely watched battle of the proper use of copyrights over software.

Once the jury comes back, which could be as soon as today, the trial will shift to a second phase concerning patents, after which a third phase will determine the amount of damages, if any. The full trial is expected to last two months.

Judge William Alsup, in his final instructions to the jury, reiterated the parameters of the case, telling panelists that copyright protection covers the “expression of ideas,” but not methods of operation. He said the copyrights Oracle has exerted cover the “structure, sequence and organization” of software code.

Google has argued that APIs shouldn’t be subject to copyright protection because they’re more akin to tools and techniques that programmers use to build software.

Oracle has argued that copyright protections should apply because they’re more granular and targeted than trade-secret law or patents.

day11-closing-1609612

(Image courtesy of icanhascheezburger.com)

Of the two, Jonathan Schwartz, Sun’s last CEO, spent the most time on the witness stand. Called by lawyers for Google, he bolstered Google’s argument that it was free to use parts of Java as it assembled its Android mobile operating system.

Scott McNealy, called by Oracle, said it was Sun’s practice to let other companies use Java, but only with a commercial license, the primary requirement of which was that the licensee ensure that Java remain compatible.

While numerous other phones from the likes of Nokia, Research In Motion and Motorola were compatible with Java applications, those on Android weren’t. Compatibility is one of the main points over which Oracle has been arguing with Google. Oracle contends that not only did Google violate its patents and copyrights, but it then went on to build its own incompatible version of Java, fracturing one of the oldest premises of Java’s existence: Write once, run anywhere.

Schwartz said he had hoped that Google would take out a commercial license, but in the end, he said, according to a report on CNet News, Sun opted “to grit our teeth” and support it as part of the Java community. He said that he opted not to sue Google over the issue.

Oracle also presented as evidence an email from Schwartz, describing Google as having taken Java “without attribution or contribution,” and then went on: “This is why I love scroogle,” referring to a now-defunct Web-search service that served up Google-like search results anonymously. See it below.

HP sued Oracle over what it says is an agreement to continue to create software that will run on HP systems running Intel’s Itanium chip, an agreement that HP argues was struck as part of the settlement that ended a suit stemming from former HP CEO Mark Hurd’s joining Oracle in 2010. Oracle, for its part, has argued that Intel plans to phase out the Itanium chip, a specialized server chip that never saw any real success in the marketplace, in order to focus more on its mainstream Xeon line of server chips and has only been producing them because HP has been paying it to do so.

The pair lobbed dueling filings at each other yesterday. In Oracle’s filing, which is the first of the pair embedded below, its lawyers accuse HP of trying to have the court write the contract it says it never agreed to in the first place: “HP has now been forced to admit that the fuzzy, feel-good language in the Reaffirmation Provision would fail as a porting contract on its own — unless the Court supplies numerous detailed terms inferred from the parties’ course of dealing.”

In the second of the two filings embedded below, HP makes the point that Hurd, once HP’s CEO and now Oracle’s co-president, had previously worked with Intel on Itanium-related matters. The key quote from the introduction:

“When asked point blank at his deposition whether it was misleading for HP not to publicly disclose the ICA [Itanium Collaboration Agreement], Oracle’s Co-President stated definitively: “No.” Thus, to prevail on its false advertising claims, Oracle must establish that its own Co-President was responsible for a fraudulent scheme while he was the CEO at HP, and that Mr. Hurd perjured himself at deposition. Although, and somewhat incredibly, Oracle recently stated on the record in response to this Court’s question that Mr. Hurd was part and parcel of this alleged scheme and pattern of lying, Oracle has no evidence to support this claim against Mr. Hurd. In any case, the fact that Oracle is even going down this path against its current Co-President reveals the absurdity of its entire claim.

Here, you can read them in the original, Oracle’s first:

Oracle Reply Msa 1599529

And now HP’s filing:

HP Reply in Support of Cross Claim MSJ

Andy Rubin, Google’s senior vice president of mobile, was shown during his testimony at a trial in San Francisco a series of emails he wrote about six years ago advising others at Google that the company should buy the right to use Sun Microsystems’ Java technology in Android.

Read the rest of this post on the original site »

The testimony came on the third day of the companies’ intellectual property trial in San Francisco. Oracle has accused Google’s Android mobile software of infringing the patents and copyrights protecting Oracle’s Java technology. Software company Oracle is seeking some $1 billion in damages. The trial is expected to last about two months.

Read the rest of this post on the original site »

Oracle CEO Larry Ellison will take the witness stand today in his company’s lawsuit against the search giant Google. In what has been described as the World Series of intellectual property lawsuits, Ellison will be examined by Oracle lawyers in the case, in which Oracle has accused Google of infringing both patents and copyrights on Java while it was working to create the Android mobile operating system.

Ellison’s testimony will come after Oracle lawyers make their opening arguments. You can get a pretty good idea of what they’re going to say from this 91-page PDF posted overnight to the Oracle Web site.

Oracle sued Google in 2010, alleging that the Android mobile operating system violated seven different Java patents. Five of those patents have since been tossed out since they were reexamined, leaving two. That reduces the potential amount of damages Oracle might be entitled to should it prevail. Google offered Oracle a share of Android revenue and $2.8 million in damages in the event that it prevails; Oracle declined. Oracle has also accused Google of infringing copyrights on Java APIs.

Google has denied the infringement claims, and is expected to argue that Java APIs can’t be protected by copyright because they’re more akin to programming languages. Software developers everywhere are paying close attention to this part of the trial.

The parties are the software giant Oracle and the Internet concern Google. At issue is Java, the software platform Oracle became owner of when it acquired Sun Microsystems in 2010. And the witness list will be interesting: Both Google CEO Larry Page and Oracle CEO Larry Ellison are expected to take the witness stand during the trial; as will former Sun CEO Jonathan Schwartz and Andy Rubin, the Google senior vice president who runs its Android and mobile operations.

The allegations are fairly simple, but the case could have some significant impact if Oracle prevails in some of its arguments. Oracle sued Google in the summer of 2010, alleging that the Android mobile operating system violated seven different Java patents.

Five of those patents have since been tossed out since they were reexamined, leaving two. That reduces the potential amount of damages that Oracle might be entitled to, should it prevail. Google even went so far as to offer to cut Oracle in on Android and $2.8 million in damages, in the event that it prevails. Oracle declined.

The other issue, and the one that has the potential for more lasting impact, is over copyright. Oracle will argue in court that Google violated copyrights on Java. Specifically, Oracle alleges that when Google was creating Android, it copied a lot of material — more than 37 Java application programming interfaces (APIs), and 11 lines of Java source code — and that these are subject to copyright protection like other intellectual property.

This is a new and controversial legal argument that has software developers watching the trial closely. Google has argued that APIs shouldn’t be subject to copyright protection, because they’re more akin to tools and techniques that programmers use to build software. I may be simplifying it a little too much here, but one way of thinking might be to ask if it’s possible to copyright the technique and instructions for hammering a nail or fitting a door.

Google has argued that APIs and programming languages aren’t entitled to copyright protection, for exactly that reason: You can copyright a given program because it’s unique, but you can’t copyright the language it’s written in. Perhaps I’m straining my skills at analogy here, but the way I understand Google’s argument, as put forth in an April 12 brief, is that you can copyright “So What?” but you can’t copyright “jazz.”

As Google puts it in that brief, which is the first two of two legal filings I’ve embedded below:

“That is a classic attempt to improperly assert copyright over an idea rather than expression.” And earlier in the brief, it argues: “Without a computer programming language, the set of statements or instructions cannot be understood by the computer. As such, a computer language is inherently a utilitarian, nonprotectable means by which computers operate. … The protectable material is the computer program (the set of statements or instructions); the unprotectable material is the method or system (the language). So understood, original computer programs may be protected, but the medium for expression in which they are created is not.”

For its part, Oracle outlined its position on the issue in a trial brief filed on April 5, which is the second of the two documents embedded below. Here’s a meaty paragraph summing it up:

“Allowing copyright protection for computer interfaces makes sense because original expressions in software are innovations of an incremental sort that Congress meant to encourage. Trade secrecy law cannot achieve this goal because interfaces can be reverse-engineered. Patent law, because of its novelty and non-obviousness requirements and examination process, protects those substantial innovations, claimed as broadly and generically as possible, and in return gives strong protection against even those who independently develop the same technology. Copyright law protects innovations at a much finer level of detail (where original expression can be found) than patents ever could, but only offers protection against the copyist.”

Obviously, it’s going to be an interesting trial, provided the parties don’t find some way to settle before it’s all over. They tried settlement talks once. It didn’t work.

Google Brief

Oracle Brief

By my scorecard, the article amounts to the first public comment Apple has made on the subject, period. And it’s very interesting indeed, especially in light of all the flak the company had been taking over what appeared, to some eyes, to have been an inadequate response.

First and foremost, Apple says, it is working on software to detect and remove the malware from an infected machine. Secondly, the company says it is working with Internet service providers around the world to disable the servers that are being used as the “command and control” network that’s basically telling compromised machines what to do.

Apparently it’s this effort that has caused trouble for the security outfit Dr. Web, which originally discovered the vulnerability in the first place: In working on shutting down the C&C servers, Apple apparently got servers that Dr. Web had used to track the spread of the outbreak shut down as well, according to this report on Forbes.com.

The vulnerability that allowed the malware to get through in the first place wasn’t in Apple’s Mac OS X itself, but in Oracle’s Java. Apple agrees with me at least with regard to machines running older versions of Mac OS: Disable it.

Anyway, here’s Apple’s article, in its entirety:

About Flashback malware
Summary

A recent version of malicious software called Flashback exploits a security flaw in Java in order to install itself on Macs.

Products Affected

Java, Mac OS X 10.6, OS X Lion

A recent version of malicious software called Flashback exploits a security flaw in Java in order to install itself on Macs.

Apple released a Java update on April 3, 2012 that fixes the Java security flaw for systems running OS X v10.7 and Mac OS X v10.6. By default, your Mac automatically checks for software updates every week, but you can change that setting in Software Update preferences. You can also run Software Update at any time to manually check for the latest updates.

Apple is developing software that will detect and remove the Flashback malware.

In addition to the Java vulnerability, the Flashback malware relies on computer servers hosted by the malware authors to perform many of its critical functions. Apple is working with ISPs worldwide to disable this command and control network.

Additional Information

For Macs running Mac OS X v10.5 or earlier, you can better protect yourself from this malware by disabling Java in your web browser(s) preferences.

Naturally, Windows apologists, sick of being the target of a decade of malware-based ridicule, were quick to jump up and down and scream that the Mac’s newfound market success has made it the next natural target for malware creators.

One thing that has been lacking of yet is a course of action for the 1 percent of Macs in use that have been hit with the malware. Kaspersky Labs, which did a thorough analysis of the malware today launched a Web-based tool to determine if your Mac is among those known to have contracted it.

The tool checks the Mac’s UUID number against a database of machines known to be affected and tells you if you have it, and if you don’t know what a UUID number is, it shows you how to find it.

If your machine turns out to be among the anointed 1 percent who some say are the harbingers of a new apocalyptic phase for Mac security, there is a removal tool.

So now that we’re nearing the end of this kerfuffle, what can we glean from this incident on the state of Mac security? First off, it’s necessary, as always, to include a hedging statement. In the investing world we often hear the phrase “Past performance is not an indication of future results.” It means that unknown, unforseen circumstances can always bring about a substantial variation in a known and established pattern.

On the subject of security the pattern has been this: Occasionally, a vulnerability, sometimes nothing more than a proof of concept, sometimes something a little more threatening, such as this Flashback malware or the MacDefender one that occurred last year, appears and re-opens the discussion. After years of marginal market share, the Mac now represents a juicy new target for malware creators, and Mac users are in for a rude awakening.

Indeed, various pundits have been saying that some onset of significant serious trouble for Mac owners is just over the horizon. This indeed could happen. A new supervirus could emerge tomorrow that causes all kinds of unforseen troubles. But it hasn’t yet.

Windows still remains a target. As recently as 11 months ago, Microsoft’s own data showed that of the 420,000 Windows users who downloaded a then-new malware removal tool, those who had infections averaged 3.5 threats per machine. And of the top 10 threats seen at that time, seven were the result of vulnerabilities in Java, something you should probably consider turning off, whether your computer runs Windows or Mac OS.

As of today, for those 600,000 people whose Macs are infected, they’re averaging only one threat per machine.

One is still too many, especially if it’s a bad one. And clearly Apple can’t act like it’s impervious to security concerns, yet there’s no evidence that it is. Just slow. Some critics have said Apple didn’t respond quickly enough to this latest outbreak, especially in light of the fact that Flashback/Flashfake took advantage of a Java vulnerability that has been known for about a month. Apple clearly could have and should have responded faster.

Apple last year hired David Rice, a former U.S. Navy Information warrior, so it has at the top of its security team a well-respected executive with a history of thought leadership on the subject.

The current state and future of Mac security will be a topic I hope AllThingsD’s Kara Swisher and Walt Mossberg ask Apple CEO Tim Cook about on the stage at D:10 next month. One hopes he’ll give us some visibility into the urgency or lack thereof with which Apple views the evolving threat landscape.

But if this is the worst that the malware creators can dish out, I still like my chances on the Mac. The apocalypse isn’t here yet.

That remains the reality, even after a bunch of media reports on how a vulnerability in Java has led to the creation of a Mac botnet about 600,000 strong.

Today I’ve been getting calls from people who say something roughly in line with the following: “I thought you said Macs didn’t get viruses? What about this?”

No, I explain, I never said Macs will never get viruses or other Malware. But historically its record versus other platforms compares favorably. As is the case with investment instruments, past results are no guarantee of future performance, and let’s face it, there’s no such thing as a perfectly secured computing platform.

But let’s look closely at the facts around the Flashback Trojan causing all this consternation, and clear up what it is versus what it is not, and put the results of the incident in perspective.

Yes it’s true that some 600,000 Macs are confirmed to have been infected. The claim, first made by Dr. Web, an outfit I had never heard of, has since been corroborated by Kaspersky Labs, whose research and analysis capabilities are well-respected. More than half of the compromised machines are in the U.S., 95,000 in Canada, 47,000 in the U.K., and 41,000 in Australia.

The trojan targets a vulnerability in software that is not even an Apple product: Java. You’ll recall that Java is add-on software created by Sun Microsystems and now the property of the software giant Oracle. Rather common, it is no longer shipped as a default add-on to Apple’s Mac OS X beginning in 2011, when Apple first shipped Lion.

Through this hole in Java, certain Web sites are serving up malicious Java applets. Once inserted on the machine, the software then prompts the user to enter the password they use to run the machine. It attempts to trick the user by appearing as an update to Adobe’s Flash video and animation software.

If the user doesn’t fall for the trick, it tries something else. Here again it checks to see if there are any Microsoft Office applications on the machine, or Skype. If there are, it deletes itself.

Then it does something interesting. It scans the contents of the Mac’s hard drive to determine if certain applications are present, and if they are, it deletes itself. Among those applications are security tools such as Little Snitch, a networking security tool, or Packet Peeper, another security tool. It also deletes itself if it sees the user has installed XCode Mac developers tools, and any kind of anti-virus software.

Presuming it finds none of them, it proceeds to contact a command-and-control server for the purpose of downloading and installing more malware. That malware is being used to commandeer the Macs and generate Web traffic to boost revenue for some pay-per-click ads on Web sites, making money for someone who’s behind the scheme. Nothing surprising there.

Apple has issued a fix to Mac OS X that closes the hole in Java, and you can protect yourself by running Software Update from within your machine’s System Preferences. Today would be a good day to do that if you haven’t already. Once you’ve done this you’re no longer vulnerable to the attack.

If you’re among the 600,000 already compromised you can turn to third parties to help you remove it. F-Secure has some instructions here for determining if your machine is affected. If you’re comfortable running some commands in the Mac’s terminal program, there are also some good instructions here at ArsTechnica.

So what does all this say about the state of security on the Mac? Nothing that wasn’t true already. No system is perfectly secure, and this, along with MacDefender, amounts to exactly the second security incident worth mentioning to hit the Mac in about a year. The number of machines affected is less than 1 percent of the 63 million Macs currently in use around the world.

The conventional wisdom has often held that Macs are targeted by malware less often than Windows machines because of their relatively small market share. This still has some merit, but the fact is that Windows is also where the vulnerabilities are. Historically, Mac OS X has been substantially less vulnerable to this sort of thing than Windows.

Does that let Apple off the hook entirely? No, though to its credit, Apple had a fix ready within a week of learning of this vulnerability. That’s not exactly a pokey response, especially when the problem lies not directly within Apple’s software, but in Oracle’s.

Here’s a thought: Turn off Java in your Web browsers. You probably won’t miss it. Here’s some instructions for that.

Though the companies technically have until April 9th to continue negotiations, their differences are evidently so profound that the presiding judge, U.S. Magistrate Judge Paul Grewal, feels it would be fruitless to use the extra week. And so he’s concluded the negotiations.

“Despite their diligent efforts and those of their able counsel, the parties have reached an irreconcilable impasse in their settlement discussions,” Grewal said in an order filed Monday. “No further conferences shall be convened.”

So come Monday, April 16, the two companies will square off in court with Google doing its damnedest to defend itself against Oracle’s claims that the Android operating system infringes its Java patents. At stake is potentially billions of dollars in damages and no end of gloating if Oracle should win.

Details of the back-and-forth emerged in a filing made by lawyers for the two companies, proposing ways to speed up the trial process. (See the filing embedded below.) Their trial over Java — of which Oracle became owner when it acquired Sun Microsystems in 2010 — is set to begin in less than three weeks.

There are basically two patents left at issue in the case, and Google proposed to forgo fighting Oracle in the event it won and proved infringement. Oracle said the $2.8 million figure Google offered — $2.72 million for one patent, and $80,000 for the other, for past damages — was too low: “Oracle cannot agree to unilaterally give up its rights, on appeal and in this Court, to seek full redress for Google’s unlawful conduct,” the company says in the filing.

Google also offered Oracle a 0.5 percent of Android revenue through the end of this year, when one of the disputed patents expires; and 0.015 percent of revenue for the other, when it expires in 2018. “Under such a stipulation, Oracle would be assured a recovery without proving damages, but could not obtain an injunction based on these patents,” Google says in the filing.

Goog Orcl Streamline

Noting that some 700,000 Android devices are activated every day — each one built around Oracle’s copyrighted Java APIs — the company figures “each day’s worth of activations likely generates approximately $10 million in annual mobile advertising revenue for Google.”

So $3.65 billion — which is over $1 billion more than the $2.5 billion Google claimed Android was generating in ad revenues last October.

Why the discrepancy? That’s tough to say, as Oracle doesn’t explain the calculation used to arrive at that figure or the numbers it plugged into it, aside from the 700,000 Android activations per day metric that was provided by Android boss Andy Rubin last December. Over at FOSS Patents, Florian Mueller speculates that Oracle’s number is based on the assumption of annual advertising revenues of $14 per Android user, though again no rationale for it is offered.

In any event, $3.65 billion is a far cry from the up to $6.1 billion in damages Oracle has claimed Google could owe it for the alleged violations, though that first sum doesn’t reflect Android’s full value. Said Oracle, “This revenue does not even include all the other value Android generates for Google, ranging from Android Market revenue, to other Android-related services, to ensuring that Google will not be locked out of the mobile business, to lucrative relationships with manufacturers of myriad devices on which Android can and does run, to the inordinately valuable access Android provides to customers for its new social network service, Google+.”

UPDATE: Looks like that $2.5 billion run rate I mentioned earlier is not exclusive to Android. Rather, it includes all mobile revenues. So the discrepancy between Oracle’s number and revenue generated by Android is even larger than originally though.

The reason? A scary vulnerability in Java that was detected over the summer, and which Oracle has subsequently fixed, is being exploited by people who create the malware and crimeware that causes so many headaches for home users and corporate IT departments.

The risk is especially acute at large companies with big fleets of desktops and notebooks to manage. If you’re a home user, the patch is easy to install. But most employees don’t have administrative privileges on their work desktops or notebooks, so someone from the IT department has to come and install the patch for them.

That’s a big, time-consuming process, says HD Moore, chief security officer at Rapid7, a Cambridge, Mass-based company that specializes in helping companies stay ahead of new computer security vulnerabilities. He’s also the chief architect of Metasploit, which Rapid7 owns.

One of the reasons this particular vulnerability is so bad is that even after it was detected and fixed, it wasn’t fully understood how dangerous it is, Moore says. Crimeware creators somehow figured it out ahead of most security researchers, and started adding code to Web sites designed to take advantage of it. And that’s especially dangerous at this time of the year, when people are shopping online both at home and the office. “It’s kind of like a perfect storm,” Moore told me yesterday. Add to that the fact that many companies have IT staff taking vacation during the holiday season, and the timing couldn’t be worse.

Enterprise is historically bad at patching Java vulnerabilities anyway, because it doesn’t have the same automatic update tools that Windows or Adobe Flash does. “The tools for patching Java aren’t that great,” Moore told me. “A Java update just isn’t treated with the same fervor as a Windows update.”

So how bad is this one? The National Vulnerability Database rates it a 10 out of 10 on the severity scale, and also rates it as “low” on the access complexity scale — meaning it’s really easy for the bad guys to carry out an attack using it.

Security blogger Brian Krebs discovered the vulnerability being “weaponized,” that is, built into the software that computer criminals buy on the black market. For instance, those who have bought something called the Blackhole Exploit Kit, a $4,000 software toolkit used to target Windows machines, are getting automatic updates that include tools to take advantage of the Java vulnerability.

What to do until you can get all your machines updated with the latest version of Java? Simple, really: Disable it and block it at the firewall, until all the machines on the network that need the update have it, Moore says.

Rapid7, incidentally, is a security company on the rise. Just last month it raised a $50 million series C round of funding, led by Technology Crossover Ventures and joined by previous investors Bain Capital Ventures; Tim McAdam, a TCV partner, joined Rapid7′s board.

News of the meeting comes after Reuters reported that, after exploring options for the unit, HP has been leaning toward a sale.

HP had shut down its webOS hardware business on Aug. 18, after sales of the much-ballyhooed TouchPad tablet failed to gain traction at major retailers.

The Reuters story listed several potential buyers, representing more or less the wishful thinking of HP’s advisers at Bank of America: Amazon, Research In Motion, IBM, Oracle and Intel.

I can knock two off that list: Oracle and IBM. I’ve checked with sources at both companies today, and they slapped down the idea of buying webOS from HP. Neither company would have anything useful do with it, other than milk webOS for patent royalties.

Intel might have made a sliver of sense, until it walked away from its own Meego mobile OS in September and instead threw in its lot with Samsung on an Android variant called Tizen.

That leaves Research In Motion, which has problems so numerous that an acquisition seems unlikely; and Amazon, whose flagship tablet, coming later this month, runs a version of Android.

According to reports, the companies’ CEOs, Larrys Ellison and Page, are still at an impasse over how to settle Oracle’s patent-infringement lawsuit against Google over the use of Java in its Android operating system.

The latest sticking point: A recommendation from Oracle’s damages expert arguing the company is owed more than $2 billion for copyright infringement and $201.8 million more for patent infringement.

That’s significantly less than the $6.1 billion Oracle claimed Google owes it in court papers, but it’s still far too heady a figure for the search giant.

Reuters reports that in a Tuesday letter to the judge presiding over the case, Google attorney Robert Van Nest urged the court to reject that recommendation, slagging it as deficient. According to Van Nest, its failure to explain just how the figure was calculated and the forecast for how much revenue Oracle might have earned by partnering with Google on Android are grounds enough for ignoring it.

Meanwhile, talks between the dueling Larrys drag on, with an October trial date looming if they fail to reach a settlement.