`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Case 3:17-cv-05659-WHA Document 435-2 Filed 04/12/19 Page 1 of 3
`
`IRELL & MANELLA LLP
`Jonathan S. Kagan (SBN 166039)
`jkagan@irell.com
`Alan Heinrich (SBN 212782)
`aheinrich@irell.com
`Joshua Glucoft (SBN 301249)
`jglucoft@irell.com
`1800 Avenue of the Stars, Suite 900
`Los Angeles, California 90067-4276
`Telephone: (310) 277-1010
`Facsimile: (310) 203-7199
`
`Rebecca Carson (SBN 254105)
`rcarson@irell.com
`Kevin Wang (SBN 318024)
`kwang@irell.com
`Ingrid M. H. Petersen (SBN) 313927)
`ipetersen@irell.com
`840 Newport Center Drive, Suite 400
`Newport Beach, California 92660-6324
`Telephone: (949) 760-0991
`Facsimile: (949) 760-5200
`
`Attorneys for Defendant
`JUNIPER NETWORKS, INC.
`
`
`UNITED STATES DISTRICT COURT
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`SAN FRANCISCO DIVISION
`
`FINJAN, INC., a Delaware Corporation,
`
`
`Plaintiff,
`
`vs.
`
`
`
`
`JUNIPER NETWORKS, INC., a Delaware
`Corporation,
`
`
`Defendant.
`
`
`
`
`
`
`
`
`
`
`
`
`
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`)
`
`
`
`Case No. 3:17-cv-05659-WHA
`
`DECLARATION OF KHURRAM ISLAH
`IN SUPPORT OF DEFENDANT JUNIPER
`NETWORKS, INC.’S OPPOSITION TO
`PLAINTIFF FINJAN, INC.’S MOTION
`FOR RELIEF FROM JUDGMENT
`PURSUANT TO FED. R. CIV. P. 60(B)
`
`May 9, 2019
`
`Date:
`8:00 a.m.
`Time:
`Courtroom: Courtroom 12, 19th Floor
`Before:
`Hon. William Alsup
`
`DECLARATION OF KHURRAM ISLAH ISO
`JUNIPER’S OPPOSITION TO FINJAN’S
`MOTION FOR RELIEF FROM JUDGMENT
`Case No. 3:17-cv-05659-WHA
`
`

`

`Case 3:17-cv-05659-WHA Document 435-2 Filed 04/12/19 Page 2 of 3
`
`
`
`1
`
`2
`
`
`
`DECLARATION OF KHURRAM ISLAH
`
`I, Khurram Islah, declare as follows:
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`1.
`
`I am an employee of Juniper Networks, Inc. (“Juniper”). I have personal
`
`knowledge of the facts set forth in this declaration, and I could and would testify competently
`
`thereto if called upon to do so. I make this declaration in support of Juniper’s Opposition to
`
`Finjan’s Motion for Relief from Judgment Pursuant to Fed. R. Civ. P. 60(b).
`
`2.
`
`I am a software developer on the Sky ATP team. In developing the product, the
`
`Sky ATP team uses three network repositories to share information: Confluence (which is the
`
`primary repository for design and development documents) and Jira and GNATS (which are bug
`
`10
`
`tracking and project management software).
`
`11
`
`3.
`
`My primary area of focus is Sky ATP’s dynamic analysis. Sky ATP currently uses
`
`12
`
`a third-party product from Joe Security called Joe Sandbox to perform dynamic analysis. Among
`
`13
`
`the Sky ATP team, I have primary responsibility for the integration of the Joe Sandbox product
`
`14
`
`into the Malware Analysis Pipeline of Sky ATP.
`
`15
`
`4.
`
`Because Joe Sandbox is a third-party product that was not developed by Juniper
`
`16
`
`engineers, Juniper does not have access to the Joe Sandbox source code or the technical design or
`
`17
`
`development documents for Joe Sandbox. Rather, Joe Security delivers Joe Sandbox to Juniper as
`
`18
`
`binary code. For example, when there is an update to the Joe Sandbox software, I log into the Joe
`
`19
`
`Security customer portal and download a .zip file containing the updated software to the iWeb
`
`20
`
`server that Juniper uses to deploy Joe Sandbox.
`
`21
`
`5.
`
`In late 2018 or early 2019, I was asked to try to find several specific Joe Security
`
`22
`
`documents. As part of my search, I looked in the .zip file that I had downloaded onto the iWeb
`
`23
`
`servers for the version of Joe Security that was running on those servers. I was able to locate the
`
`24
`
`twelve documents that Juniper produced on February 4, 2019 in one of the .zip files that was still
`
`25
`
`located on the iWeb server.
`
`26
`
`6.
`
`To my knowledge, the iWeb server is not typically used to store technical
`
`27
`
`documents related to Sky ATP. In other words, the Joe Security documents were stored on the
`
`28
`
`
`
`
`
`
`- 1 -
`
`DECLARATION OF KHURRAM ISLAH ISO
`JUNIPER’S OPPOSITION TO FINJAN’S
`MOTION FOR RELIEF FROM JUDGMENT
`Case No. 3:17-cv-05659-WHA
`
`

`

`Case 3:17-cv-05659-WHA Document 435-2 Filed 04/12/19 Page 3 of 3
`
`
`
`1
`
`iWeb server simply because they happened to be contained in the .zip file with the binary code for
`
`2
`
`Joe Sandbox.
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`7.
`
`As a general matter, I do not upload any third-party documentation from Joe
`
`Security (e.g., User Manuals, etc.) into the technical document repositories for Sky ATP. This is
`
`because these documents are not frequently used by Juniper engineers, and only need to be
`
`accessed if something appears to be broken or if we are considering adding a new functionality
`
`offered by Joe Sandbox (neither of which is common).
`
`8.
`
`I am not aware of any search tool on the Juniper network that would allow one to
`
`search the third-party iWeb server for documents. To find the documents on the iWeb server, I
`
`10
`
`specifically navigated to the .zip files to look for them.
`
`11
`
`9.
`
`As I noted above, Joe Sandbox is used to perform dynamic analysis. Sky ATP uses
`
`12
`
`the “deception adapter” to interface with the Joe Sandbox binary code by way of a Web API,
`
`13
`
`which allows Sky ATP to submit a sample to Joe Sandbox and then retrieve the results from Joe
`
`14
`
`Sandbox when the analysis is completed.
`
`15
`
`10.
`
`Joe Sandbox’s dynamic analyzer is part of the “Malware Analysis Pipeline” of Sky
`
`16
`
`ATP; the dynamic analyzer is not found within the “ResultsDB” portion of Sky ATP, as
`
`17
`
`“ResultsDB” is a separate part of Sky ATP that coordinates storing the results from the various
`
`18
`
`analyses performed by the Malware Analysis Pipeline. The other components of the Malware
`
`19
`
`Analysis Pipeline (e.g, static analysis, antivirus engine, etc.) do not send results to the Joe
`
`20
`
`Sandbox database for storage. Rather, the results from the Malware Analysis Pipeline are sent to
`
`21
`
`DynamoDB or S3 for storage.
`
`22
`
`I declare under penalty of perjury under the laws of the United States of America that the
`
`23
`
`foregoing is true and correct to the best of my knowledge. Executed this 12th day of April, 2019
`
`24
`
`at Sunnyvale, California.
`
`25
`
`26
`
`27
`
`28
`
`
`
`
`
`
`
`
`By: /s/ Khurram Islah
`Khurram Islah
`
`
`- 2 -
`
`DECLARATION OF KHURRAM ISLAH ISO
`JUNIPER’S OPPOSITION TO FINJAN’S
`MOTION FOR RELIEF FROM JUDGMENT
`Case No. 3:17-cv-05659-WHA
`
`