Case 3:17-cv-05659-WHA Document 390-2 Filed 03/14/19 Page 1 of 2
`Case 3:17-cv-05659-WHA Document 390-2 Filed 03/14/19 Page 1 of 2
`REDACTED VERSION OF DOCUMENT SOUGHT TO BE SEALED
`REDACTED VERSION OF DOCUMENT SOUGHT TO BE SEALED
`
`DECLARATION OF FRANK JAS
`
`I, Frank Jas, declare as follows:
`
`Ls
`
`I have personal knowledge of the facts set forth in this declaration, and I could and
`
`would testify competently thereto if called upon to doso.
`
`2.
`
`I am a Distinguished Engineer with Juniper Networks, Inc. (“Juniper”). Prior to
`
`working at Juniper, I was Chief Technology Officer with Cyphort Inc. (“Cyphort”). Cyphort was
`
`acquired by Juniper in September 2017 and the Cyphort product catalog was rebranded in March
`
`2018 to Juniper Advanced Threat Protection Appliance (collectively, “ATP Appliance”). During
`
`my time with Juniper and Cyphort, I have been responsible for the developmentofvarious different
`
`components of the ATP Appliance.
`
`I understand how the ATP Appliance operates and I am
`
`familiar with its source code.
`
`3.
`
`I described the general operation of the ATP Appliance in my previous declaration.
`
`Dkt. No. 371-2 at J 3-7 (incorporated herein by reference). Notably, ATP Applianceis a passive
`
`device that connects to a network to observe traffic and provides threat information to system
`
`administrators. The ATP Appliance does not do “in line” blocking, like the SRX; instead, ATP
`
`Appliance provides threat information to system administrators who then decide what action to
`
`take after the fact. ATP Appliance does not modify or “instrument”the files that it receives.
`
`4.
`
`To use the ATP Appliance with an SRX, the following steps must be performed:
`
`(1) on the ATP Appliance, a customer must click the “SRX Enrollment URL” and copy the URL
`
`displayed, which points to a script and contains configuration information that is needed to
`
`complete the connection; (2) on the SRX, the customer must enter the URL obtained from the
`
`ATP Appliance into the CLI “OP URL” command;(3) the SRX will then download an
`
`executable (SLAX) script from that URL (whichis not on the SRX when the SRX isoriginally
`
`shipped) and run the script; and (4) the script executes and completes the various configuration
`
`steps on both the SRX and ATP Appliance to enable the SRX to transmit information to the ATP
`
`Appliance and receive information back from the ATP Appliance.
`
`S,
`
`I understand that Finjan attached the document bearing Bates
`
`JNPR-
`
`FNJN_29040_01042912 through _01042914 as Exhibit 4 to its motion for summary judgment.
`
`ay |
`
`DECL, OF FRANK JAS ISO
`JUNIPER’S MOTION FOR SUMMARY JUDGMENT
`Case No, 3:17-cv-05659-WHA
`
`

`

`Case 3:17-cv-05659-WHA Document 390-2 Filed 03/14/19 Page 2 of 2
`Case 3:17-cv-05659-WHA Document 390-2 Filed 03/14/19 Page 2 of 2
`REDACTED VERSION OF DOCUMENT SOUGHT TO BE SEALED
`REDACTED VERSION OF DOCUMENT SOUGHT TO BE SEALED
`
`Dkt. No. 368-12. This design document relates to a project that explored the use of Cyphort’s
`
`malicious JavaScript detector in the SRX. The JavaScript detector is a standalone program that in
`
`theory could be run inside the SRX. However,this functionality was never implemented because
`testing showed that the program consumed too much memory for practical application.
`
`6.
`
`The source code for the ATP Appliance is stored in a git repository that contains
`
`several sub-repositories. Each sub-repository also has different branches contained withinit.
`
`These repositories and branches contain a variety of different source code. Somerepositories and
`
`branches contain research and development code. Other repositories and branches contain the
`
`code for particular releases of ATP Appliance.
`
`7.
`
`The{Jsub-repository stores research codethat is developed as part of
`
`our research lab.
`
`It does not reflect the code of a released product.
`
`8.
`
`The{Jrepository houses additional development code that has never
`
`been deployed, but also contains release branchesof codethat reflect the source codefor the actual
`
`releases of the ATP Appliance product. For example, theJ contained in the
`
`GEcepository doesnotreflect the source codefor any released version ofthe product.
`
`9.
`
`Whenone looksat the git repository on a computer, one can easily identify the
`
`branches within the{Jrepository that contain the code for particular ATP Appliance
`
`releases. The release code branchesare clearly delineated in the repository by denoting them as,
`
`for example,iD2s shown in the screenshot below:
`foregoing is true and correct. DECE.. OF FRANKJAS ISO
`
`aD
`
`JUNIPER’S MOTION FOR SUMMARY JUDGMENT
`Case No, 3:17-cv-05659-WHA
`
`Executedthis [Sw day ofMarch, 2019,at Sy» n wyale 4 CAL
`
`I declare under penalty of perjury under the laws of the United States of America that the
`
`