Before the Court is defendant-intervenor Idemia Identity & Security USA, LLC's (Idemia) Motion to Compel discovery in the possession of plaintiff Giesecke & Devrient GMBH's (Giesecke) non-party German subsidiary, Security Networks AG (Secunet). Idemia requests the Court compel Giesecke to turn over source code and related documentation in Secunet's possession. Idemia argues, due to Giesecke's majority ownership of Secunet and the entities’ corporate structures, Giesecke exercises sufficient control over Secunet such that it can obtain and produce the requested documents. Giesecke contests Idemia's claims and argues, pursuant to applicable German corporate law, Giesecke lacks the right or ability to obtain proprietary source code and related documentation from Secunet. For the foregoing reasons, the Court denies Idemia's Motion.

I. Factual and Procedural History Relevant to Idemia's Motion to Compel[1]

On 25 September 2023, defendant-intervenor Idemia Identity & Security USA, LLC (“Idemia”) filed a motion to compel plaintiff Giesecke & Devrient GMBH (“Giesecke”) to obtain and disclose source code and related documentation from Giesecke's German subsidiary, Security Networks AG (Secunet). See Idemia's Redacted Mot. Compel (Idemia's MTC) at 1–2, ECF No. 300; see also Idemia's Sealed Mot. Compel, ECF No. 299. Idemia requests an order compelling Giesecke “to permit the inspection of the source code for the Secunet ePassport software used in the accused products” and “to produce Secunet documents responsive to [Idemia's] Requests for Production 65–82.” Idemia's MTC at 1. On 10 October 2023, Giesecke filed its Response, arguing “Giesecke has no right under German law to demand the documents and information Idemia seeks from [non-party] Secunet.” Pl.’s Redacted Resp. at 1 (“Pl.’s Resp.”), ECF No. 302; see also Pl.’s Sealed Resp., ECF No. 301. Instead, Giesecke encouraged Idemia to “pursue [the requested information] through third-party discovery[ ] under the Hague Convention.” Pl.’s Resp. at 1 n.1. On 17 October 2023, Idemia filed its Reply. See Idemia's Redacted Reply (“Idemia's Reply”), ECF No. 304; see also Idemia's Sealed Reply, ECF No. 303.

The Court held a substantive status conference on Idemia's Motion on 15 November 2023, see 26 Oct. 2023 Order, ECF No. 305, at which the parties discussed Giesecke's ability to obtain the information requested by Idemia. At the 15 November 2023 status conference, the parties agreed to “work together ... to pursue the requested discovery via the Hague” Convention of 18 March 1970 on the Taking of Evidence Abroad. See 15 Nov. 2023 Sealed Order at 2, ECF No. 306. The parties accordingly prepared a Hague Letter of Request to be sent to the German Federal Office of Justice. See 22 Nov. 2023 Order, ECF No. 308. On 13 March 2024, with discovery ongoing, Idemia filed a status report, ECF No. 318, notifying the Court the “Düsseldorf Higher Regional Court ... refused Idemia's request under the Hague Convention.” Id. at 2. The Court accordingly held a second status conference on Idemia's Motion on 4 April 2024 to discuss appropriate next steps. See 21 Mar. 2024 Status Conf. Order, ECF No. 319. At the 4 April 2024 status conference, Giesecke reiterated its claim it does not “control Secunet and ... ha[s] no legal right to obtain the[ ]” information Idemia requests. See 4 Apr. 2024 Status Conf. Tr. (“SC Tr.”) at 13:12–18, ECF No. 322. Idemia took this statement “to heart,” stating “we're going to take [Giesecke's] word for” it that Giesecke does not “have the ability to obtain these materials.” SC Tr. at 14:3–8. The parties therefore agreed to have Giesecke send Secunet a “letter ... summarizing Idemia's requests, noting plaintiff does not object thereto, and asking Secunet to provide this information if Secunet believes it appropriate to do so.” See 4 Apr. 2024 Order at 2, ECF No. 320. This mailing included a letter from Idemia “summarizing the scope of” the requested documents. Id. The Court ordered the parties to provide an update via a joint status report (JSR) on the status of Secunet's response, as well as on the parties’ positions regarding the need for supplemental briefing and oral argument on Idemia's Motion, by 26 April 2024. See id.

*2 On 26 April 2024, the parties filed a JSR notifying the Court Secunet “decided not to produce the materials requested.” 26 Apr. 2024 JSR at 2, ECF No. 323. As a result, Idemia requested: (1) “the Court rule on” its pending Motion to Compel; and (2) five pages of supplemental briefing per party. Id. Giesecke, on the other hand, argued supplemental briefing and oral argument were not appropriate as the “issue ha[d] been thoroughly briefed and argued” and “the undisputed evidence demonstrates that Giesecke does not control Secunet.” Id. at 3. Giesecke therefore requested “the Court deny Idemia's Motion.” Id. On 26 April 2024, the Court ordered five pages of supplemental briefing per party. See 26 Apr. 2024 Order at 1–2, ECF No. 324. On 1 May 2024, Idemia filed its Supplemental Brief. See Idemia's Suppl. Br., ECF No. 325. Giesecke filed its Supplemental Brief on 8 May 2024. Giesecke's Suppl. Br., ECF No. 326. The Court held oral argument on Idemia's Motion on 22 May 2024 in St. Louis, Missouri. 17 May 2024 Order, ECF No. 327.

II. Party Arguments[2]

As noted supra, Idemia requests the Court compel Giesecke to produce source code and documentation related to Secunet's “ePassport software used in the accused products.” Idemia's MTC at 1. Idemia argues it has “asserted that [Giesecke] is barred from asserting infringement claims against the use of Idemia's B5000 reader,” “at least to the extent these claims rely on functionality performed by software” licensed “to Idemia by ... Secunet.” Id. at 3. As such, Idemia contends this source code is “highly relevant.” Id. at 9. Further, Idemia alleges, because “Giesecke is the parent of Secunet, the majority shareholder of Secunet, and shares executives in a close corporate relationship with Secunet,” Idemia's Suppl. Br. at 1, Giesecke “has control over Secunet's documents and information,” meaning the Court should order Giesecke to produce the information Idemia requests. Idemia's MTC at 13. Specifically, Idemia argues the following demonstrate Giesecke exercises sufficient control over Secunet to warrant granting Idemia's Motion: (1) Giesecke maintains a 75.12% “controlling interest” in Secunet, id. at 3; (2) Giesecke's “Chief Executive Officer ... and Chief Financial Officer ... chair and vice-chair Secunet's Supervisory Board,” id. at 4; (3) Giesecke “handles the preparation of Secunet's consolidated financial disclosures,” id. at 5; (4) Giesecke “holds out the products and services of its various subsidiaries[, including Secunet,] as its own,” id. at 11; and (5) Secunet allegedly has a “close connection to, and benefit[s] from, the accused technology in this case,” id. at 12. Idemia also alleges Secunet may indeed be “participating in this lawsuit behind the scenes,” making the requested discovery appropriate. Id. Idemia notes, despite Giesecke's argument Secunet is not involved in this litigation and is a separate legal entity, Giesecke has exercised the “common interest privilege,” see Idemia Reply at 8, with respect to Secunet information. Id. (noting “[f]or the common-interest doctrine to apply, ‘the parties must make the communication in pursuit of a joint strategy in accordance with some form of agreement.’ ” (quoting 3rd Eye Surveillance, LLC v. United States, 155 Fed. Cl. 355, 360 (2021))). Thus, according to Idemia, Giesecke “can't have it both ways: either Secunet is participating behind the scenes in this litigation, or [p]laintiff's assertion of the common-interest privilege is baseless and its communications with Secunet should be produced.” Id. To the extent Giesecke cannot produce the requested information, Idemia asks the Court to order Giesecke “to file a stipulation (a) that [Giesecke] has exhausted all available legal mechanisms within its power to secure the information from Secunet[ ] but is unable to produce the information ... and (b) confirming that [Giesecke] will not rely on Secunet-related information or the functionality of the Secunet software to support its infringement allegations in this case.” Idemia's Suppl. Br. at 5.

*3 In response, Giesecke concedes, because “the standard for discovery sweeps ... broadly,” the information Idemia requests “is discoverable if in Giesecke's possession, custody, or control.” Pl.’s Resp. at 3 (emphasis added). Giesecke contends, however, it “does not control the requested documents and source code,” id. at 21, and it “has no control over [Secunet] or right to demand the documents and information Idemia seeks” therefrom. Id. at 1. Specifically, Giesecke states despite its “roughly 75% owner[ship] of Secunet, Giesecke has no right under German law to demand the documents and information Idemia seeks.” Id. Giesecke similarly alleges, “[u]nder German law ... neither majority ownership nor members on the supervisory board gives Giesecke the right or ability to require Secunet to give Giesecke the [information].” Id. at 5. Indeed, per Giesecke, although the supervisory board may, “by resolution of the ... board as a whole,” inspect the “books and records” of a German corporation, “[a]ny confidential information received ... during such inspection must be maintained in confidence.” Id. at 8. Further, Giesecke clarifies, similar to any “majority shareholder under German law,” Giesecke receives “consolidated financial information” from Secunet but has no access to “day-to-day business or financial information.” Id. at 17. Finally, Giesecke notes “Secunet does not stand to gain anything by any recovery Giesecke obtains” in this litigation, and “Secunet is not involved in this litigation.” Id. at 19–20. Giesecke thus concludes, as accepted by Idemia at the 4 April 2024 status conference, see SC Tr. at 14:3–8 (“[IDEMIA:] I certainly take ... to heart the comments [Giesecke counsel] made about the fact that they don't have the ability to obtain these materials. I think he's an officer of the Court and we're going to take his word for that, period,”), “Giesecke does not control the requested documents and source code in the possession of Secunet and has no power to compel their disclosure by Secunet.” Pl.’s Resp. at 21; id. at 15–16 (noting “Secunet is a separate, independently operating entity” and all transactions between Giesecke and Secunet “have been at arm's length as with any other commercial counterpart,” meaning Giesecke has no ability to obtain the discovery Idemia seeks.). Giesecke likewise clarifies it has not “relied on th[e common interest] privilege as a reason it cannot obtain the information sought from Secunet.” Giesecke's Suppl. Br. at 3.

III. Legal Standard for a Motion to Compel

This court's application of the Rules of the United States Court of Federal Claims (“RCFC”) is guided by case law interpreting the Federal Rules of Civil Procedure (FRCP). See RCFC at i, 2002 Rules Committee Note Revision (“[I]nterpretation of the court's rules will be guided by case law and the Advisory Committee Notes that accompany the Federal Rules of Civil Procedure.”). Regarding the scope of discovery, the rules of this court provide:

RCFC 26(b)(1). “Questions of the scope and conduct of discovery are ... committed to the discretion of the trial court.” Florsheim Shoe Co., Div. of Interco, Inc. v. United States, 744 F.2d 787, 797 (Fed. Cir. 1984) (citation omitted); see also Schism v. United States, 316 F.3d 1259, 1300 (Fed. Cir. 2002) (noting a “trial court ‘has wide discretion in setting the limits of discovery’ ”) (quoting Moore v. Armour Pharm. Co., 927 F.2d 1194, 1197 (11th Cir. 1991)). The Court of Federal Claims generally “afford[s] a liberal treatment to the rules of discovery.” Securiforce Int'l Am., LLC v. United States, 127 Fed. Cl. 386, 400 (2016), aff'd, 879 F.3d 1354 (Fed. Cir. 2018). “ ‘[T]he [C]ourt must be careful not to deprive a party of discovery that is reasonably necessary to afford a fair opportunity to develop and prepare the case.’ ” Heat & Control, Inc. v. Hester Indus., Inc., 785 F.2d 1017, 1024 (Fed. Cir. 1986) (quoting FED. R. CIV. P. 26(b)(1) advisory committee's note to 1983 amendment).

A. RCFC 34(a) as it Relates to Third-Party Discovery

RCFC 34(a) permits parties to “serve on any other party a request within the scope of RCFC 26(b)” to “produce or permit the requesting party ... to inspect, copy, test, or sample” documents and other items “in the responding party's possession, custody, or control.” RCFC 34(a)(1); see Cormack v. United States, 117 Fed. Cl. 392, 401–02 (2014). “Control is construed broadly,” and where the documents are in the possession of a non-party, RCFC 34(a) “ ‘does not require that the party [to the case] have legal ownership or actual physical possession of the documents at issue, but rather the right, authority, or practical ability to obtain the documents from a nonparty to the action.’ ” Cormack, 117 Fed. Cl. at 401–02 (quoting E.I. DuPont de Nemours & Co v. Kolon Indus., Inc., 286 F.R.D. 288, 292 (E.D. Va. 2012) (additional citation omitted)). “In essence, the inquiry is whether the party has access to the nonparty's documents” at issue. Id. (quoting Gerling Int'l Ins. Co. v. Comm'r, 839 F.2d 131, 141 (3d Cir. 1988)).

*4 Courts consider “a number of factors ... to determine when documents in the possession of one corporation may be deemed under control of another corporation.” Perfect Form Mfg. LLC v. United States, 142 Fed. Cl. 778, 788–89 (2019). A non-exhaustive list of these factors includes:

See id.; see also Cormack, 117 Fed. Cl. at 403 (noting “courts consider a variety of factors when determining whether a party has sufficient control over a nonparty for the purpose of RCFC 34 ... including (1) the corporate structure of the party and nonparty; (2) the nonparty's connection to the transaction at issue in the litigation; and (3) the degree that the nonparty will benefit from the outcome of the case”) (citations omitted). “Where the litigating corporation is the parent of the corporation possessing the records, courts have found the requisite control where ‘a subsidiary corporation acts as a direct instrumentality of and in direct cooperation with its parent corporation, and where the properties and affairs of the two [were] ... inextricably confused as to a particular transaction.’ ” Gerling Int'l Ins. Co., 839 F.2d at 140 (quoting Acme Precision Prods., Inc. v. American Allows Corp., 422 F.2d 1395, 1398 (8th Cir. 1970)).

IV. The Secunet Source Code's Relationship to this Case

At the outset, the Court notes the parties could not coherently articulate the following at oral argument: (1) the functionality of the Secunet source code at issue in Idemia's Motion; and (2) the source code's importance to this case. Regarding the latter, in its Motion, Idemia argues the “software [is important to] several key issues in this case.” Idemia's MTC at 1. In contrast, although conceding this information is relevant because “discovery ... sweeps broadly,” Pl.’s Resp. at 3, Giesecke argues this information “will [not] be relevant or admissible at trial” and relates only to Idemia's potential “license defense” and “indemnity demand” to Secunet. Id. at 2–3.[3] At the same time, however, Giesecke suggested at oral argument the Secunet source code “could have [broader] implications” for Giesecke's infringement claims. 22 May 2024 Oral Arg. Tr. (Tr.) at 23:13–23 (“[GIESECKE:] [T]o try ... to parse [the product] into ‘this is the Secunet functionality,’ or ‘this is not the Secunet functionality’ could have implications [for Giesecke's infringement claims]. I mean, we're looking at the product as a whole a[t] what it does, and we're not looking at it component by component and getting into the code.”) (emphasis added), ECF No. 333; see also Tr. at 24:4–8.

Turning to the source code's functionality, Idemia and Giesecke agreed at oral argument the Secunet code at issue is a “black box.” See Tr. at 11:7–12:12 (“[IDEMIA:] Our software relies exclusively on the Secunet, I will call it an API, to interact or interface with the [e-passport] chip. And so what our source code does, at a high level, is say ‘Hey, Secunet software, go get this data from the chip.’ ... And the Secunet software is exclusively responsible for opening up a connection with that chip. ... From our perspective, how those interactions take place is 100 percent in black box. We don't know.”); see also Tr. at 14:7–15:8 (“[GIESECKE:] [I]n the Idemia product, it shows exactly what it's doing[, but it's] unclear what happens in the black box ...”). To the extent the Court attempted to understand the role the Secunet code plays in the functioning of Idemia's products via a simple hypothetical, neither party could provide insight:

Tr. at 12:24–18:20. The parties likewise could not point the Court to a figure or diagram in the briefs or patents-in-suit capable of elucidating the relationship between the Secunet source code, Idemia's products, and Giesecke's infringement contentions. See Tr. at 17:25–18:17; see also Tr. at 23:13–23; see also Tr. at 24:4–8. Thus, at this time, the Court is unable to adequately determine the importance of the Secunet source code to this case. See RCFC 26(b) (listing “the importance of the discovery in resolving the issues” as a consideration when determining whether information is within the scope of discovery).

V. Whether Giesecke Controls Secunet

Idemia argues “[t]he record is clear that Giesecke's relationship with Secunet shows the requisite ‘control’ such that the production of Secunet-related materials is proper.” Idemia's Suppl. Br. at 1. In contrast, Giesecke contends, “[i]t is undisputed that Giesecke is a distinct corporate entity from Secunet under German law and has no legal right to force Secunet to produce any documents in this litigation.” Giesecke's Suppl. Br. at 2; id. at 4 (“Giesecke is constrained by German law and ordering it to produce documents over which it has no control is futile.”). The Court must accordingly determine whether Giesecke has “the right, authority, or practical ability to obtain the [requested] documents from” Secunet. Cormack v. United States, 117 Fed. Cl. 392, 401–02 (2014) (quoting E.I. DuPont de Nemours & Co v. Kolon Indus., Inc., 286 F.R.D. 288, 292 (E.D. Va. 2012)); see supra Section III.A.[4]

A. Whether Giesecke's 75% Ownership Stake in Secunet Demonstrates Control

With an approximately 75% interest, it is undisputed Giesecke is Secunet's majority shareholder. See Idemia's MTC at 3; Pl.’s Resp. at 1. According to Idemia, this “direct [majority] ownership ... demonstrates that [Giesecke] possess ample control over Secunet for purposes of” this Motion. Idemia's MTC at 10. Citing German law, In re Uranium Antitrust Litig., 480 F. Supp. 1138, 1145 (N.C. Il. 1979), and McAllister-Lewis v. Goodyear Dunlop Tires N. Am., Ltd., No. 4:1-cv-0413, 2015 WL 5794697, at *5–7 (S.D.S.D. Oct. 1, 2015), Idemia contends “[o]ther courts have ruled that parent corporations possess the necessary control when they own more than 50% of their foreign subsidiary's stock.” Id. (quoting Cormack, 117 Fed. Cl. at 403 n.11). Giesecke disputes Idemia's claims, arguing “[w]hile [a] roughly 75% owner of Secunet, Giesecke has no right under German law to demand the documents ... Idemia seeks from Secunet.” Pl.’s Resp. at 1; see id. at 12–13 (citing Declaration of Dr. Markus Moertel at ¶ 12 (“Moertel Decl.”), ECF No. 301-2) (“[T]he rules governing [German corporations, known as AGs] under German law do not allow the shareholder to demand the disclosure of confidential information from the AG, such as the additional documents and source code Idemia seeks.”).

*6 Despite repeated claims Giesecke's majority ownership of Secunet demonstrates “ample control” for purposes of the instant Motion, see Idemia's MTC at 10, Idemia fails to point to a single case from this circuit granting a motion to compel information from a party's foreign, nonparty, non-wholly owned subsidiary. Tr. at 57:5–58:8. Indeed, while Idemia points to In re Uranium, in which the Northern District of Illinois noted in passing “if the parent owns more than 50% of the foreign subsidiary's stock, it possesses the necessary control” for purposes of a motion to compel, Idemia ignores important context from this decision. In re Uranium Antitrust Litig., 489 F. Supp. at 1145. To begin, contrary to here, where both Giesecke and Secunet are German corporations governed by German corporate law, see Idemia's MTC at 3 (“As German entities, [Giesecke] and Secunet each follow German Corporate Governance.”), the court in In re Uranium was discussing “[t]he test for determining whether an American court can order an American parent corporation to produce the documents of its foreign subsidiary.” In re Uranium Antitrust Litig., 489 F. Supp. at 1144 (emphasis added); Tr. at 34:25–35:19 (Giesecke) (noting Giesecke is prevented from obtaining the Secunet information by the German “Stock Corporation Act, which is abbreviated as the AKTG” and “provisions of the [German] commercial code”). As such, the case provides little insight into the level of control a German parent corporation holds over its non-wholly owned German subsidiary. In re Uranium Antitrust Litig., 489 F. Supp. at 1145; Tr. at 43:1–24 (“THE COURT: [In In re Uranium, t]here was an American court with an American parent ... [and a] foreign subsidiary. Here Giesecke's a German corporation. Is that not a key difference? [IDEMIA:] ... I don't see any significance or materiality to whether the party to the case is a foreign entity.”). Indeed, while the In re Uranium court stated, “[t]he existence of a ... foreign law which prohibits the disclosure of the requested documents does not prevent the exercise of” an American court's power to order international discovery, this statement referred to “penal [and similar] laws” punishing otherwise possible disclosures and presupposed the existence of control. Id. at 1145–46 (discussing Societe Internationale v. Rogers, 357 U.S. 197, 205 (1958)); see Tr. at 48:3–50:4. Further, to the extent Idemia argued at oral argument In re Uranium stands for the proposition “the question is whether the party in the case is within the jurisdiction ... of the Court,” Tr. at 43:15–24, Idemia overlooks that court's statement “[o]nce personal jurisdiction ... and control over the documents by the person [is] present, a United States court has power to order production” in a foreign country. In re Uranium Antitrust Litig., 489 F. Supp. at 1145 (emphasis added). Idemia's argument personal jurisdiction and control under American corporate law are alone sufficient to find control, see Tr. at 38:4–12, therefore mischaracterizes the discussion in In re Uranium. In re Uranium Antitrust Litig., 489 F. Supp. at 1145. In fact, rather than suggesting personal jurisdiction and control under American corporate law are enough, the In re Uranium court acknowledged “control is ... a question of fact” resting on “a determination of whether the [party] has ... actual managerial control over ... its affiliate.” Id. at 1145.

Further, in McAllister, which Idemia similarly cites in arguing Giesecke's “majority ownership ... demonstrates control,” see Idemia's MTC at 10, the District of South Dakota first clarified “legal ownership is not determinative of whether a party has ... control of a document” for purposes of a motion to compel. McAllister, 2015 WL 5794697, at *6 (quoting Ice Corp. v. Hamilton Sundstrand Corp., 245 F.R.D. 513, 517 (D. Kan. 2007); then citing Resolution Trust Corp. v. Deloitte & Touche, 145 F.R.D. 108, 110 (D. Colo. 1992)) (emphasis added). Reviewing the relationship between the party, Goodyear, and its non-party 75%-owned subsidiary, GDTF, the court then acknowledged the evidence did not indicate Goodyear and GDTF “share officers, employees or facilities.” See id. at *5–*6. Ultimately, however, because Goodyear failed to “clarify whether [it] as GDTF's parent company ... ha[d] the ‘legal right, authority, or ability to obtain upon demand documents in the possession of” GDTF,” the court granted a motion to compel Goodyear to do so. Id. at *6–*7. Here, Giesecke has repeatedly argued, “[p]rovided that the AG is not a party to a contractual agreement giving a shareholder the right to instruct management,” which is not the case here, see Tr. at 36:3–37:17 (Giesecke noting there is not “an agreement” granting “Giesecke ... access to Secunet confidential information”), “the shareholders of the AG do not have any right to instruct the management board members in connection with the conduct of the business or to receive access to trade secrets or confidential information based on their position as shareholders, even if a shareholder holds the majority of the registered share capital or voting rights of the AG.” Moertel Decl. at ¶ 12. Thus, unlike in McAllister, where Goodyear failed to clarify whether it had the legal right, authority, or ability to demand GDTF's documentation, Giesecke has expressly stated it lacks this power over Secunet under German law. See id. As such, and because there is no indication German law permits Giesecke as Secunet's majority shareholder to demand the requested information, Giesecke's 75% ownership does not demonstrate Giesecke has “the right, authority, or practical ability to obtain the [requested] documents from” Secunet. Cormack, 117 Fed. Cl. at 401–02 (citation omitted).

B. Whether the Intermingling of Giesecke and Secunet Executives Demonstrates Control

*7 In a related argument, Idemia points out Giesecke's “key officers serve on Secunet's Supervisory Board.” Idemia's MTC at 10. Specifically, Idemia states because Giesecke's CEO and CFO “serve as the Chair and Vice Chair of Secunet's Supervisory Board,” respectively, this “overlap ... weighs heavily in favor of [a] conclusion that [Giesecke] has access to Secunet's information.” Id. at 10–11 (noting Giesecke's “top executives cooperate with both Secunet's CEO ... and Secunet's Management Board on the basis of mutual trust” (internal quotation marks omitted)). Again citing “German law governing ... stock corporations, like Secunet,” Pl.’s Resp. at 5, Giesecke contends “neither majority ownership,” see supra, “nor the presence of members on the supervisory board gives Giesecke the right or ability to require Secunet to give Giesecke the source code or documents Idemia seeks.” Id. (citing Moertel Decl. at ¶ 16). According to Giesecke, a German corporation “is governed by its management board, which conducts the AG's business and operations on its own.” Id. The management board “is appointed by the supervisory board, not the shareholders,” and its members can only be removed “upon a majority vote of the supervisory board for cause.” Id. (citing Moertel Decl. at ¶ 8). Further, both the management board and supervisory board, the latter of which “has very limited influence over the operations of the company,” are subject to strict duties of confidentiality such that “[a]ny confidential information received ... must be maintained in confidence ... and may generally not be shared with third parties including the shareholders.” See id. at 5–6, 8 (citing Moertel Decl. at ¶¶ 23, 24). Thus, to the extent Secunet's supervisory board contains two Giesecke executives, Giesecke contends these “two of the six members of Secunet's supervisory board” do “not establish control over the requested source code and documents.” Id. at 8 (explaining “[u]nder German law, the supervisory board provides high-level supervision”).

As “courts consider a variety of factors when determining whether a party has sufficient control over a nonparty for the purpose of RCFC 34 ... including (1) the corporate structure of the party and nonparty,” Cormack, 117 Fed. Cl. at 403, the presence of Giesecke executives on Secunet's supervisory board is significant to the extent it provides Giesecke “access to the [Secunet's] documents.” Id. (quoting Gerling Int'l Ins. Co. v. Comm'r, 839 F.2d 131, 141 (3d Cir. 1988)). There is not any indication, however, the intermingling here provides such access. Indeed, as explained by Giesecke, the Secunet Supervisory Board on which Giesecke's CEO and CFO sit has limited opportunity to “inspect the books and records of the AG” and can do so only when “necessary as part of [the board's high-level] supervisory function” and upon “resolution of the supervisory board as a whole.” Pl.’s Resp. at 8 (citing Moertel Decl. at ¶ 20); Tr. at 50:16–51:4 (“[GIESECKE:] [T]he supervisory board has a very high level sort of supervisory role with respect to the company and does not have the power ... to either control the ... actual [management] board of the company that makes these day-to-day decisions.”). Any information received by the board “must be maintained in confidence.” Pl.’s Resp. at 8 (citing Moertel Decl. at ¶¶ 23, 24); id. at 15 (citing Moertel Decl. at ¶ 24 (“[E]ven if Secunet's management board were to decide to provide the documents and source code Idemia seeks to the supervisory board, the supervisory board, due to the confidentiality obligations of its members, still would not be entitled to provide them to Giesecke without a decision of the management board ... allowing such disclosure.”)). Further, German corporate law does not provide shareholders—even majority shareholders—any “right or ability to instruct members of [a] management board how to conduct the AG's business or to disclose or provide any specific information or documentation.” Id. at 6 (citing Moertel Decl. at ¶¶ 7, 15). Although such might be possible were there an agreement “between [Giesecke] and [Secunet] giving such rights to” Giesecke, id. (citing Moertel Decl. at ¶¶ 7, 15), no such agreement exists here. Tr. at 36:3–37:17. There is therefore no reason for the Court to conclude Giesecke's executives on Secunet's Supervisory Board can obtain the source code information at issue here or, were they able to do so, could disclose it to Giesecke for purposes of this litigation.[5] See Perfect Form Mfg. LLC v. United States, 142 Fed. Cl. 778, 788–89 (2019) (explaining the intermingling of executives and officers is one factor to consider in determining whether “control” exists for purposes of non-party discovery).

C. Whether the Remaining Factors Demonstrate Control

*8 As explained in Section III.A, supra, courts consider multiple factors in deciding “when documents in the possession of one corporation may be deemed under control of another corporation.” Perfect Form Mfg. LLC, 142 Fed. Cl. at 788–89. Beyond those discussed above, supra Sections V.A.–B., such factors also include: (1) “exchange of documents between the corporations in the ordinary course of business[;]” (2) “any benefit or involvement by the nonparty corporation in the transaction” at issue; and (3) “involvement of the non-party corporation in the litigation.” Id.

Beginning with the “exchange of documents between the corporations in the ordinary course of business,” id., Giesecke concedes “[u]nder German law, Secunet must disclose consolidated financial information” to Giesecke. Pl.’s Resp. at 17. Giesecke clarifies, however, “this information does not include any day-to-day business or financial information,” rather it is “simply the same information that any other company would disclose to any other majority shareholder under German law.” Id. (citing Declaration of Dr. Reinhard Warmke at ¶ 13 (“Warmke Decl.”), ECF No. 301-1). Thus, although Idemia contends, “Secunet routinely shares financial documents and information with” Giesecke as “evident from the fact that [Giesecke's] consolidated financial statements include the financial results of Secunet,” Idemia's MTC at 11, Giesecke alleges “none of the information disclosed ... shows any right, authority, or ability of Giesecke to obtain any ... information including the documents and source code Idemia seeks.” Pl.’s Resp. at 17. The Court must accordingly determine whether the periodic exchange of consolidated financial statements is a sufficient “exchange of documents ... in the ordinary course of business,” Perfect Form Mfg. LLC, 142 Fed. Cl. at 788–89, to suggest Giesecke possesses the right, authority, or ability to obtain Secunet source code information. Cormack, 117 Fed. Cl. at 403.

Black's Law Dictionary defines the “[ordinary] course of business” as events occurring as part of “[t]he normal routine in managing a trade or business.” Course of Business, BLACK'S LAW DICTIONARY (11th ed. 2019); see also UNIFORM COMMERCIAL CODE § 1-201 (defining “[b]uyer in ordinary course of business” as one who “buys goods ... with the usual or customary practices in the kind of business in which the seller is engaged or with the seller's own usual or customary practices”); cf. Pacific Gas & Elec. Co. v. United States, 69 Fed. Cl. 784, 790 (2006) (explaining, in the context of the work product doctrine, the “ordinary course of business” includes actions undertaken “routinely” and “for business reasons”). Here, it is undisputed Secunet shares periodic financial reports with Giesecke. See Pl.’s Resp. at 17; see also Tr. at 55:17–56:2. These regular disclosures, required by German corporate law, are by definition “in the ordinary course of business” as they occur as part of the “normal routine in managing” the financial obligations of the two corporations. Course of Business, BLACK'S LAW DICTIONARY (11th ed. 2019). The Court is unable to conclude from this exchange of documents, however, Giesecke exercises control over Secunet's proprietary or other similar information for purposes of this Motion. Rather, at most, Giesecke receives “high-level financial information” for the sole purpose of compliance with German corporate financial disclosure laws. See Tr. at 56:1–2; Pl.’s Resp. at 17. Indeed, although Idemia contends in its Motion, see Idemia's MTC at 11, “Secunet routinely shares financial documents and information with” Giesecke—a fact Giesecke concedes—there is no evidence this exchange of documents in the ordinary course of business extends beyond limited disclosures for purposes of compliance with German corporate law, and there is therefore no suggestion Giesecke possesses the right, authority, or ability to obtain Secunet source code information. Cormack, 117 Fed. Cl. at 403. In contrast, in Perfect Form Manufacturing, in which Judge Sweeney concluded the plaintiff, Perfect Form, controlled nonparty Elite, there was evidence individuals serving as executives of both corporations “had access to the business records’ ... of both entities.” Perfect Form Mfg. LLC, 142 Fed. Cl. at 789; see id. (stating “the IRS noted during [an] audit that [the two entities’ parent company] was responsible” for record management of at least one of the companies). The Court is therefore unable to conclude here, where Secunet only provides Giesecke periodic “high-level financial information” as required by German law for the publication of “consolidated reports,” see Warmke Decl. at ¶ 13, Giesecke has the ability to obtain the information sought by Idemia. See Cormack, 117 Fed. Cl. at 403.[6]

*9 Finally, Idemia argues, “Secunet's close connection to, and benefit from, the accused technology” in this case, and the potential that Secunet “is participating in this lawsuit behind the scenes,” “weigh[ ] heavily in favor of Idemia's [M]otion.” See Idemia's MTC at 12–13. At the outset, the Court notes there is no indication Secunet is involved in this lawsuit. See Pl.’s Resp. at 20 (“Secunet is not involved in this litigation.”). Idemia's speculation “[i]t is unclear the extent to which Secunet is participating in this lawsuit” without citing to or providing evidence of any Secunet involvement is therefore unavailing. Idemia's MTC at 12.[7] Further, as Giesecke points out in its Response, there is no reason to “conclude that Secunet's licensing revenue from any past software licenses to Idemia, which were granted unrelated to this litigation, in some way gives rise to a close connection” between Secunet and this case. Pl.’s Resp. at 19. Indeed, the Court is without evidence Secunet stands to benefit from this litigation any more than any other third party whose software or hardware is used as a component of an accused product in a lawsuit. As a result, unlike in Cormack, where this court granted a motion to compel because the “collaboration [between the party and non-party on the project in question] equip[ped the party] with both access to” the non-party's documents and “the requisite power to obtain them,” Cormack, 117 Fed. Cl. at 404, here the collaboration between Giesecke and Secunet in the record is limited to: (1) arm's length transactions; and (2) the minimal communication and information sharing required by a parent and its subsidiary under German corporate law. See id. at 401–02, 404; see also supra; Tr. at 48:3–50:4, 50:16–51:8, 56:8–57:4.

The Court has accordingly reviewed the parties’ arguments related to whether Giesecke exercises the level of control over Secunet sufficient to warrant granting Idemia's Motion to Compel. Despite Giesecke's corporate relationship with Secunet, there is no indication Giesecke has the right, authority, or practical ability to obtain the source code-related documents Idemia seeks. Cormack, 117 Fed. Cl. at 401–02 (citation omitted); see supra.

VI. Stipulation Related to the Secunet Source Code

In its Supplemental Brief, Idemia conceded the instant motion would be moot if Giesecke “file[d] a stipulation (a) that it has exhausted all available legal mechanisms within its power to secure the information from Secunet, but is unable to produce the information in this proceeding and (b) confirming that it will not rely on Secunet-related information or the functionality of the Secunet software to support its infringement allegations in this case.” Idemia Suppl. Br. at 5; supra Section II. In response, in Exhibit B to its Supplemental Brief, Giesecke offered the following “draft stipulation”:

Giesecke's Suppl. Br., Ex. B, ECF No. 326-2. Idemia did not agree to this language, however, and in an email sent to the Court and parties on 10 May 2024 offered the following modified version:

*10 See Tr. at 7:21–8:3.

To the extent it is useful to the parties in resolving this and any related discovery disputes that may arise, the Court enters the following stipulation, which the parties partially agreed upon at oral argument, see Tr. at 27:19–28:13:

Should this stipulation not resolve the discovery issues related to Secunet source code, the Court will allow a renewed motion to address the stipulation language at the close of discovery as necessary. Despite Idemia's request for the inclusion of functionality language in this stipulation, see supra; Tr. at 28:21–29:5; Tr. at 9:21–10:12 (“[IDEMIA:] [O]ur concern ... [is that Giesecke] will be able to point to passages in our source code where we call into Secunet functionality and say ‘there's the infringing step’ [when this step is a black box.]”), the Court withholds a prohibition on the use of Secunet software functionality pending clarity regarding the infringement issues in this case. See supra Section IV.

VII. Conclusion

For the foregoing reasons, the Court is unable to conclude Giesecke possesses “the right, authority, or practical ability to obtain the” requested source code and information from Secunet. Cormack v. United States, 117 Fed. Cl. 392, 401–02 (2014) (quoting E.I. DuPont de Nemours & Co v. Kolon Indus., Inc., 286 F.R.D. 288, 292 (E.D. Va. 2012)); see supra Section V. The Court accordingly DENIES Idemia's Motion to Compel, ECF No. 299.

IT IS SO ORDERED.