Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 1 of 10
`Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 1 of 10
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`EXHIBIT 4
`EXHIBIT 4
`
`
`
`
`
`
`
`
`

`

`Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 2 of 10
`
`Holland, Eileen
`From:
`Sent:
`To:
`Cc:
`
`Subject:
`
`Kastens, Kris <KKastens@KRAMERLEVIN.com>
`Tuesday, October 16, 2018 9:38 AM
`Glucoft, Josh
`Carson, Rebecca; Holland, Eileen; Song, Sharon; Curran, Casey; Wang, Kevin; Kagan,
`Jonathan; ~Andre, Paul; ~Kobialka, Lisa; ~Hannah, James; ~Manes, Austin
`RE: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`Josh,
`
`We are following up on a number of discovery issues. First, you indicated several months ago that Mr.
`Volodymyr Kuznetsov was on paternity leave and unavailable for deposition. Provide dates that he is available
`for deposition.
`
`Finjan also requests that the parties meet and confer on the following 30(b)(6) topics for deposition:
`
`
`• Any efforts by Juniper to incorporate or use any technologies provided by Joe Security LLC into any of
`the Accused Products, including identification of all technologies provided by Joe Security LLC to
`Juniper, a description of how the technologies provided by Joe Security LLC are incorporated by or
`used by the Accused Products, a description of how the technologies provided by Joe Security are
`hosted or managed by Juniper, and identification of the relevant source code.
`• The total number of threats, malware, files detected, classified, analyzed or received by each of the
`Accused Products, including the full bases and supporting information for Juniper’s Responses to
`Interrogatory No. 5, and any costs associated therewith.
`• Development and research costs associated with each of the Accused Products.
`
`
`Additionally, Finjan agrees to narrow its ESI search terms for Bruce Kao and Chandra Nagarajan as set for the
`below in red. Finjan has also provided initial ESI search terms for Frank Jas.
`
`Finally, please confirm that Juniper has not made any additional source code available for inspection since
`Finjan’s last review.
`
`Sincerely,
`Kris
`
`
`Bruce Kao
`
`Behavior /20 profile
`Profile /20 operation
`Hash
`Dropper
`Database
`Express
`Malware /20 (javascript OR “java
`script”)
`
`1
`
`5,436
`8,170
`2,509
`4
`2,141
`1,050
`
`6,426
`
`

`

`Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 3 of 10
`
`Finjan
`
`Feature AND (greyduckling or “grey
`duckling”)
`behavior AND (Argon OR Sky ATP)
`sandbox AND (Argon OR Sky ATP)
`static AND (Argon OR Sky ATP) AND
`analysis
`database AND (Argon OR Sky ATP)
`AND schema
`Dropper
`hash AND (Argon OR Sky ATP)
`Finjan
`
`117
`
`38,785
`3,319
`3,316
`
`10,623
`
`4,955
`163
`4,692
`206
`
`
`
`
`
`Chandra Nagarajan
`
`Frank Jas
`
`Sandbox
`Behavior
`profile
`database
`Static
`payload
`malicious
`Finjan
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Kris Kastens
`Partner
`
`
`Kramer Levin Naftalis & Frankel LLP
`990 Marsh Road, Menlo Park, California 94025
`T 650.752.1715 F 650.752.1815
`
`This communication (including any attachments) is intended solely for the recipient(s) named above and may contain information that is
`confidential, privileged or legally protected. Any unauthorized use or dissemination of this communication is strictly prohibited. If you have received
`this communication in error, please immediately notify the sender by return e-mail message and delete all copies of the original communication.
`Thank you for your cooperation.
`
`
`
`From: Glucoft, Josh [mailto:JGlucoft@irell.com]
`Sent: Sunday, May 20, 2018 5:14 PM
`To: Kastens, Kris; #Finjan-KramerLevin [Ext]
`Cc: #Juniper/Finjan [Int]
`Subject: [EXTERNAL] RE: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`Kris,
`
`
`2
`
`

`

`Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 4 of 10
`
`The hit counts for the modified search terms are as follows:
`
`Rakesh Manocha
`• Behavior AND suspicious: 193
`Chandra Nagarajan
`• Feature: 38,785
`• Behavior AND (Argon OR Sky ATP): 3,319
`• Sandbox AND (Argon OR Sky ATP): 3,316
`
`
`For Mr. Kao, Finjan’s indiscriminate search terms yielded almost 26 thousand hits that, when including attachments,
`yielded just shy of 39 thousand documents from Mr. Kao’s email search alone. The overwhelming number of documents
`falling within the scope of Finjan’s search terms demonstrates that Finjan’s terms are not narrowly tailored to particular
`issues, as required by the Court’s ESI Order. Juniper again requests that Finjan meaningfully narrow its search terms for
`these three custodians when Finjan identifies the final list of search terms for these custodians. Should Finjan continue to
`refuse to apply narrowing search criteria, Juniper requests that Finjan agree to pay the costs of such disproportionate
`discovery burden, and Juniper reserves the right to seek appropriate relief from the Court.
`
`Thanks,
`Josh
`
`From: Glucoft, Josh
`Sent: Sunday, May 13, 2018 9:23 PM
`To: ~Kastens, Kristopher
`Cc: #Finjan-KramerLevin [Ext]; #Juniper/Finjan [Int]
`Subject: RE: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`Kris,
`
`Finjan’s “modified” search terms do not meaningfully narrow the scope of the search. For Mr. Kao, you have not
`narrowed your search terms at all, maintaining overly broad terms such as “profile” that yield more than 8,000 hits. You
`similarly maintain unmodified search terms for Mr. Manocha and Mr. Nagarajan that each yield thousands upon
`thousands of hits. These search terms are not narrowly tailored to particular issues, as expressly required by the Court’s
`ESI Order, especially given that internal emails do not define the operation of any of the accused products and therefore
`their relevance to a case of direct patent infringement is dubious.
`
`The ESI Order states “Use of narrowing search criteria…is encourage to limit the production and shall be considered
`when determining whether to shift costs for disproportionate discovery.” Juniper requests that Finjan meaningfully
`narrow its search terms for all three custodians or agree to pay the costs of such disproportionate discovery.
`
`Best,
`Josh
`
`From: Kastens, Kris [mailto:KKastens@KRAMERLEVIN.com]
`Sent: Friday, May 11, 2018 11:33 AM
`To: Glucoft, Josh
`Cc: ~Andre, Paul; ~Kobialka, Lisa; ~Hannah, James; ~Lee, Michael; Wang, Kevin; Carson, Rebecca; Holland, Eileen;
`Curran, Casey
`Subject: RE: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`Josh,
`Finjan modifies its search terms as set forth below.
`
`
`Custodian
`Rakesh Manocha
`
`Keywords
`sandbox
`
`Hits/Results
`1,984
`
`3
`
`

`

`Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 5 of 10
`
`Behavior AND suspicious
`profile AND security
`hash AND security
`dropper
`database AND security
`malware AND security
`Finjan
`
`behavior
`profile
`hash
`dropper
`database
`express
`malware
`Finjan
`
`Sandbox feature
`behavior AND (Argon OR Sky ATP)
`dynamic sandbox AND (Argon OR Sky
`ATP)
`static AND (Argon OR Sky ATP)
`database AND (Argon OR Sky ATP)
`dropper
`hash AND (Argon OR Sky ATP)
`Finjan
`
`30,275
`9,307
`2,193
`17
`6,155
`1,849
`65
`
`5,436
`8,170
`2,509
`4
`2,141
`1,050
`6,426
`117
`
`10,383
`16,692
`
`3,650
`10,623
`4,955
`163
`4,692
`206
`
`Bruce Kao
`
`Chandra Nagarajan
`
`
`
`
`
`
`
`
`
`Kris Kastens
`Associate
`
`
`Kramer Levin Naftalis & Frankel LLP
`990 Marsh Road, Menlo Park, California 94025
`T 650.752.1715 F 650.752.1815
`
`This communication (including any attachments) is intended solely for the recipient(s) named above and may contain information that is
`confidential, privileged or legally protected. Any unauthorized use or dissemination of this communication is strictly prohibited. If you have received
`this communication in error, please immediately notify the sender by return e-mail message and delete all copies of the original communication.
`Thank you for your cooperation.
`
`
`
`From: Glucoft, Josh [mailto:JGlucoft@irell.com]
`Sent: Wednesday, May 09, 2018 4:13 PM
`To: Kastens, Kris; #Finjan-KramerLevin [Ext]
`Cc: #Juniper/Finjan [Int]
`Subject: [EXTERNAL] RE: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`Kris,
`
`Below are the email hit counts for the search terms that Finjan selected. As you can see, the terms generated an enormous
`number of hits because the terms are not narrowly tailored to particular issues. For example, the indiscriminate term
`
`4
`
`

`

`Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 6 of 10
`
`“behavior” generated more than 30,000 hits for Mr. Manocha. Finjan’s search terms are inappropriate. Pursuant to the
`anticipated ESI Order, you may provide a modified list of search terms, so please let us know your modified search terms
`for each custodian.
`
`Juniper provides these hit counts without any waiver of potentially applicable objections, including, but not limited to,
`relevance and privilege. See Dkt. No. 75 at p. 3 n. 1.
`
`
`Keywords
`sandbox
`behavior
`profile AND security
`hash AND security
`dropper
`database AND security
`malware AND security
`Finjan
`
`Hits/Results
`1,984
`30,275
`9,307
`2,193
`17
`6,155
`1,849
`65
`
`Custodian
`
`
`
`
`
`Rakesh Manocha
`
`Bruce Kao
`
`Chandra Nagarajan
`
`behavior
`profile
`hash
`dropper
`database
`express
`malware
`Finjan
`
`5,436
`8,170
`2,509
`4
`2,141
`1,050
`6,426
`117
`
`sandbox
`behavior
`dynamic AND (Argon OR Sky ATP)
`static AND (Argon OR Sky ATP)
`database AND (Argon OR Sky ATP)
`dropper
`hash AND (Argon OR Sky ATP)
`Finjan
`
`10,383
`16,692
`3,650
`10,623
`4,955
`163
`4,692
`206
`
`5
`
`
`
`
`From: Kastens, Kris [mailto:KKastens@KRAMERLEVIN.com]
`Sent: Monday, April 30, 2018 5:43 PM
`To: Glucoft, Josh
`Cc: ~Andre, Paul; ~Kobialka, Lisa; ~Hannah, James; Carson, Rebecca; Wang, Kevin; Curran, Casey
`Subject: RE: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`Josh,
`
`We disagree that using “or” is inappropriate when it is only used to further limit another single term. However, we’ve
`modified the search terms based on your request. Confirm that Juniper will not object to producing the additional
`document that will be identified as a result of your request. Regarding the number of search terms, the ESI order
`requires Juniper to search for Finjan’s name and an additional 7 terms. Dkt. No. 75, Par. 8(c). We included “Finjan” for
`your convenience but have removed it from the search terms to avoid further confusion and even though Juniper must
`still search for “Finjan”.
`
`
`

`

`Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 7 of 10
`
`Chandra Nagarajan
`1. sandbox
`2. behavior
`3. dynamic and (Argon or “Sky ATP”)
`4. static and (Argon or “Sky ATP”)
`5. database and (Argon or “Sky ATP”)
`6. dropper
`7. hash and (Argon or “Sky ATP”)
`
`
`Bruce Kao
`1. behavior
`2. profile
`3. hash
`4. dropper
`5. database
`6. express
`7. malware
`
`
`Rakesh Manocha
`1. sandbox
`2. behavior
`4. profile AND security
`4. hash AND security
`5. dropper
`6. database AND security
`7. malware AND security
`
`
`
`
`
`
`
`Kris Kastens
`Associate
`
`
`Kramer Levin Naftalis & Frankel LLP
`990 Marsh Road, Menlo Park, California 94025
`T 650.752.1715 F 650.752.1815
`
`This communication (including any attachments) is intended solely for the recipient(s) named above and may contain information that is
`confidential, privileged or legally protected. Any unauthorized use or dissemination of this communication is strictly prohibited. If you have received
`this communication in error, please immediately notify the sender by return e-mail message and delete all copies of the original communication.
`Thank you for your cooperation.
`
`
`
`From: Glucoft, Josh [mailto:JGlucoft@irell.com]
`Sent: Monday, April 30, 2018 5:27 PM
`To: Kastens, Kris
`Cc: Andre, Paul; Kobialka, Lisa; Hannah, James; Carson, Rebecca; Wang, Kevin; Curran, Casey; #Juniper/Finjan [Int]
`Subject: [EXTERNAL] RE: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`Kris,
`
`6
`
`

`

`Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 8 of 10
`
`
`The parties agreed on 7 search terms per custodian, not 8.
`
`Additionally, SRX and Junos OS are not synonymous; as such, terms such as “hash AND (SRX or ‘Junos OS’)” constitute
`two distinct search terms. See ESI Order at ¶ 8(c) (“A disjunctive combination of multiple words or phrases (e.g.,
`‘computer’ or ‘system’) broadens the search, and thus each word or phrase shall count as a separate search term unless
`they are variants, abbreviations, or acronyms of the same word.”).
`
`Please revise and re-circulate your search terms.
`
`Thanks,
`Josh
`
`From: Kastens, Kris [mailto:KKastens@KRAMERLEVIN.com]
`Sent: Monday, April 30, 2018 3:40 PM
`To: Glucoft, Josh <JGlucoft@irell.com>
`Cc: ~Andre, Paul <pandre@kramerlevin.com>; ~Kobialka, Lisa <lkobialka@kramerlevin.com>; ~Hannah, James
`<jhannah@kramerlevin.com>; Carson, Rebecca <RCarson@irell.com>; Wang, Kevin <kwang@irell.com>; Curran, Casey
`<ccurran@irell.com>
`Subject: RE: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`Josh,
`
`Finjan is not seeking the emails of Ms. Tenorio at this time. However, Finjan identifies the below three custodians and
`search terms according to Paragraph 8 of the ESI Order, and all of which Finjan has requested for deposition in May. All
`terms identified include all variants that have the identified term as a root. For example, “sandbox” should return a hit
`for all of the following: “sandbox,” “sandboxes,” and “sandboxing.”
`
`Sincerely,
`Kris
`
`Chandra Nagarajan
`1. Finjan
`2. sandbox
`3. behavior
`4. dynamic and (Argon or “Sky ATP”)
`5. static and (Argon or “Sky ATP”)
`6. database and (Argon or “Sky ATP”)
`7. dropper
`8. hash and (Argon or “Sky ATP”)
`
`
`Bruce Kao
`1. Finjan
`2. behavior
`3. profile
`4. hash AND (SRX or “Junos OS”)
`5. dropper
`6. database AND (SRX or “Junos OS”)
`7. express AND (SRX or “Junos OS”)
`8. malware AND (SRX or “Junos OS”)
`
`
`
`7
`
`

`

`Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 9 of 10
`
`Rakesh Manocha
`1. Finjan
`2. sandbox
`3. behavior
`4. profile AND security
`5. hash AND security
`6. dropper
`7. database AND security
`8. malware AND security
`
`
`
`
`
`Kris Kastens
`Associate
`
`
`Kramer Levin Naftalis & Frankel LLP
`990 Marsh Road, Menlo Park, California 94025
`T 650.752.1715 F 650.752.1815
`kkastens@kramerlevin.com
`
`
`Bio
`
`This communication (including any attachments) is intended solely for the recipient(s) named above and may contain information that is
`confidential, privileged or legally protected. Any unauthorized use or dissemination of this communication is strictly prohibited. If you have received
`this communication in error, please immediately notify the sender by return e-mail message and delete all copies of the original communication.
`Thank you for your cooperation.
`
`
`From: Glucoft, Josh [mailto:JGlucoft@irell.com]
`Sent: Monday, April 30, 2018 3:31 PM
`To: Kastens, Kris; #Finjan-KramerLevin [Ext]
`Cc: #Juniper/Finjan [Int]
`Subject: [EXTERNAL] RE: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`Kris,
`
`It has been nearly two weeks since we asked you to provide search terms for Ms. Tenorio. During our meet-and-confer on
`April 17, you told me that you would provide search terms by April 23, and we still have not heard anything from you
`despite our repeated requests for search terms. Given that Ms. Tenorio’s deposition is coming up in just over a week, if
`we do not immediately receive from you the proposed search terms, then we will not have sufficient time to review and
`produce her emails in advance of her deposition, and we can only understand your complete non-response to our repeated
`requests as confirmation that you do not need emails in order to depose Ms. Tenorio.
`
`
`Thanks,
`Josh
`
`
`From: Glucoft, Josh
`Sent: Tuesday, April 24, 2018 9:30 AM
`To: Kristin White (Kristin.White@discoverready.com) <Kristin.White@discoverready.com>; #Finjan-KramerLevin [Ext]
`<Finjan-KramerLevin@irell.com>
`Cc: #Juniper/Finjan [Int] <Juniper-Finjan@irell.com>
`Subject: RE: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`
`Kris,
`
`8
`
`

`

`Case 3:17-cv-05659-WHA Document 435-7 Filed 04/12/19 Page 10 of 10
`
`
`
` A
`
` week ago, Casey asked you to immediately provide search terms for Yuly Tenorio so that we could begin processing
`her email in advance of her deposition. During our meet-and-confer last Tuesday, you indicated that you would provide
`search terms for custodians by April 23, even though I indicated that waiting until April 23 was unnecessary and
`burdensome to Juniper. It is now April 24 and we still have not received your search terms. Finjan’s delay in providing
`search terms is prejudicing Juniper’s ability to produce documentation in advance of Ms. Tenorio’s deposition. Her
`deposition may have to be rescheduled to account for Finjan’s delay. We ask again: Please immediately provide Juniper
`with the requested search terms for Ms. Tenorio.
`
`
`Thanks,
`Josh
`
`
`From: Curran, Casey
`Sent: Tuesday, April 17, 2018 11:19 AM
`To: #Finjan-KramerLevin [Ext]
`Cc: #Juniper/Finjan [Int]
`Subject: Finjan/Juniper-Joint Response re ESI Discovery Process
`
`
`Counsel,
`
`
`Please find attached Juniper’s proposed Joint Response concerning the stipulated ESI discovery process. Consistent with
`the terms of this agreement, if Finjan plans to select Yuly Tenorio as a custodian please provide Juniper with the
`requested search terms immediately in light of her expected deposition on May 9th.
`
`
`Best,
`Casey
`
`
`Casey Curran | Irell & Manella LLP
`1800 Avenue of the Stars | Los Angeles, CA 90067
`Direct: (310) 203-7963 | Fax: (310) 203-7199
`ccurran@irell.com | www.irell.com
`
`
`
`
`
`PLEASE NOTE: This message, including any attachments, may include privileged, confidential and/or inside
`information. Any distribution or use of this communication by anyone other than the intended recipient(s) is
`strictly prohibited and may be unlawful. If you are not the intended recipient, please notify the sender by
`replying to this message and then delete it from your system. Thank you.
`
`9
`
`