Case 3:17-cv-05659-WHA Document 442-5 Filed 04/19/19 Page 1 of 4
`Case 3:17-cv-05659-WHA Document 442-5 Filed 04/19/19 Page 1 of 4
`
`
`
`
`
`EXHIBIT 4
`EXHIBIT 4
`
`
`
`
`
`
`
`
`
`
`
`
`
`

`

`Case 3:17-cv-05659-WHA Document 442-5 Filed 04/19/19 Page 2 of 4
`
` Volume 4
` Pages 615 - 831
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`BEFORE THE HONORABLE WILLIAM H. ALSUP, JUDGE
`
`)
`FINJAN, INC.,
` )
` Plaintiff,
`)
` )
` VS. ) No. C 17-5659 WHA
` )
`JUNIPER NETWORKS, INC.,
`)
` )
` Defendant.
`)
` ) San Francisco, California
` Thursday, December 13, 2018
`
`
`TRANSCRIPT OF PROCEEDINGS
`
`
`APPEARANCES:
`
`For Plaintiff: KRAMER, LEVIN, NAFTALIS & FRANKEL LLP
` 990 Marsh Road
` Menlo Park, California 94025
` BY: PAUL J. ANDRE, ESQ.
` LISA KOBIALKA, ESQ.
` JAMES HANNAH, ESQ.
` KRISTOPHER B. KASTENS, ESQ.
`
` KRAMER LEVIN NAFTALIS AND FRANKEL LLP
` 1177 Avenue of the Americas
` New York, New York 10036
` BY: CRISTINA LYNN MARTINEZ, ESQ.
`
`
`(Appearances continued on next page)
`
`
`
`
`Reported By: Katherine Powell Sullivan, CSR No. 5812, RMR, CRR
` Jo Ann Bryce, CSR No. 3321, RMR, CRR
` Official Reporters
`
`I N D E X
`
`
`Thursday, December 13, 2018 - Volume 4
`
` PAGE VOL.
`Plaintiff Rests
`643
`4
`
`PLAINTIFF'S WITNESSES PAGE VOL.
`
`ICASIANO, ALEX
`By Videotaped Deposition
`
`GUPTA, SHELLY
`By Videotaped Deposition
`
`DEFENDANT'S WITNESSES PAGE VOL.
`
`BUSHONG, MICHAEL
`(SWORN)
`Direct Examination by Ms. Carson
`Cross-Examination by Mr. Hannah
`Redirect Examination by Ms. Carson
`
`RUBIN, AVIEL
`(SWORN)
`Direct Examination by Mr. Heinrich
`Cross-Examination by Mr. Andre
`Redirect Examination by Mr. Heinrich
`
`UGONE, KEITH RAYMOND
`(SWORN)
`Direct Examination by Ms. Curran
`Cross-Examination by Ms. Kobialka
`
`642
`
`643
`
`644
`645
`698
`709
`
`710
`711
`771
`796
`
`797
`798
`820
`
`4
`
`4
`
`4
`4
`4
`4
`
`4
`4
`4
`4
`
`4
`4
`4
`
`APPEARANCES (CONTINUED):
`
`For Defendant: IRELL & MANELLA LLP
` 1800 Avenue of the Stars, Suite 900
` Los Angeles, California 90067-4276
` BY: JONATHAN S. KAGAN, ESQ.
` ALAN J. HEINRICH, ESQ.
` JOSHUA GLUCOFT, ESQ.
` CASEY CURRAN, ESQ.
`
` IRELL & MANELLA LLP
` 840 Newport Center Drive, Suite 400
` Newport Beach, California 92660
` BY: REBECCA CARSON, ESQ.
` KEVIN X. WANG, ESQ.
`
`I N D E X
`
` E X H I B I T S
`
`
`TRIAL EXHIBITS IDEN EVID VOL.
`
`
`58
`
`685
`
`4
`
`182
`
`1059
`
`1070
`
`1170
`
`1241, Title Page & Table of Contents
`
`1241, Page 39
`
`1248
`
`1264
`
`1347
`
`1552
`
`2197
`
`686
`
`727
`
`720
`
`690
`
`730
`
`763
`
`760
`
`751
`
`682
`
`726
`
`724
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`

`

`Case 3:17-cv-05659-WHA Document 442-5 Filed 04/19/19 Page 3 of 4
`
`RUBIN - DIRECT / HEINRICH
` 756
`each run can produce data that's very, very different; and so
`it's much better suited to a schema-less database than to a
`database that has a schema.
`So the engineers made the decision saying "This isn't the
`type of data that I would put into a database with a schema,"
`and so they chose DynamoDB and S3.
`Q. So I want to read to you some of Dr. Cole's testimony
`yesterday on page --
`THE COURT: Read it exactly now. Don't summarize.
`BY MR. HEINRICH:
`Q. On page 432 of yesterday's transcript, Dr. Cole testified,
`quote, (reading):
`"So both the static analysis and the dynamic analysis
`perform that security profile, and then to make it easy to
`look up, if somebody else uses that same downloadable,
`Juniper puts it in a structured database with a schema so
`they can quickly look up the information to make it go
`quicker in the future."
`Do you agree with that?
`A.
`I disagree with several things in that.
`Q. And what do you disagree with?
`A.
`I disagree that it's put into a database with a schema
`because it's put into DynamoDB, which does not have a schema.
`I disagree that it's being done to make anything faster in
`any way. That is actually not a requirement, and this is what
`
`RUBIN - DIRECT / HEINRICH
` 758
`And so the table -- one of the tables after the analysis engine
`runs, those results that are produced are put into that table.
`When a verdict is calculated, that verdict goes into a
`different table. Neither one of those tables has a schema.
`THE COURT: Okay. Thank you.
`BY MR. HEINRICH:
`Q. Now, does Dr. Cole say that any one of these individual
`storage components is the claimed database for purposes of
`Claim 10?
`A.
`I -- in court he didn't seem to remember if DynamoDB was,
`but I reviewed his expert report very carefully and he did not
`accuse any one of these as being the claimed database.
`Q. And what's his theory?
`A. He draws a box around all three of them and he says,
`"Well, this is the database and it has a schema."
`Q. And this is from Exhibit 1179, which is in evidence.
`Whose annotations were these on this exhibit?
`A. So this is what you've seen before. Dr. Cole in his
`deposition was asked which is the database from Claim 10 in the
`accused product, and so he couldn't point to DynamoDB or S3 or
`MySQL so he just drew a box around the entire thing and said,
`"Well, this is the database."
`Q. Does Dr. Cole refer to this as a single unified database?
`A. He does.
`Q. Do you agree with that?
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 755
`
`RUBIN - DIRECT / HEINRICH
`THE COURT: Okay. Next question.
`BY MR. HEINRICH:
`Q. Now, is it true that Juniper only uses Amazon's physical
`servers and not Amazon software?
`A. No. A lot of the running of the system is based on a lot
`of Amazon code that is providing the interface to DynamoDB and
`S3. They provide a lot of tools and functionality to people
`who want to build applications that use those systems. I
`believe I have some source code to go to for that.
`Q. For time reasons, why don't we skip that.
`A. Okay.
`Q. So does Sky ATP have a database under the definition that
`applies here that stores a security profile including a list of
`suspicious computer operations?
`A. So in my answer I'm going to apply the definition of a
`database that's for the claim, which is that it has to have a
`schema. And so my answer is, no, there is no database that has
`a schema and stores a list of suspicious computer operations in
`Sky ATP.
`Q.
`Is there a technological reason why Juniper doesn't use a
`database with a schema to store that security profile with the
`list?
`A. Yes. There's a very good one.
`So the list of suspicious operations, which is the results
`of running all of the analysis engines, is very, very large and
`
`RUBIN - DIRECT / HEINRICH
` 757
`I was talking about earlier, which is that the list of
`suspicious operations does not ever need to be consulted again
`when the product is running. And so there's not going to be
`retrieval of it and it makes a lot more sense to put it in a
`database without a schema than to put it into a database that
`has a schema, which is exactly what they do.
`Q.
`Is Dr. Cole correct that when a downloadable comes in
`that's been seen before, Sky ATP looks up the security profile?
`A. No. Sky ATP just looks up the verdict.
`THE COURT: Of these three -- well, while we've got it
`on the screen. Which one of those three storage places is the
`verdict stored?
`THE WITNESS: It's the one on the left. The one
`that's called Amazon DynamoDB.
`THE COURT: And which is the one where the list of
`suspicious operations is stored?
`THE WITNESS: The list of suspicious operations is
`stored in a different table within the same database, you know,
`within Amazon DynamoDB.
`THE COURT: They're both in DynamoDB but you're saying
`it's in a different table?
`THE WITNESS: Right. So this is a schema-less
`database and even though it's a schema-less database, it has
`tables. Tables are a construct in databases that allow you to
`store multiple different types of things in different tables.
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`

`

`Case 3:17-cv-05659-WHA Document 442-5 Filed 04/19/19 Page 4 of 4
`
`RUBIN - DIRECT / HEINRICH
` 760
`A. So JSON is a standard produced by the IETF. It's the
`Internet Engineering Task Force, which is the organization that
`put out standards like TCP, IP, all of the Internet protocols
`that define how we communicate.
`Q. So if you look in your notebook at Exhibit 1248.
`A.
`(Witness examines document.) Oh, I'm sorry. Which
`exhibit?
`Q. 1248.
`A.
`(Witness examines document.) Oh. It's the first one.
`Q. And what is this?
`A. So this is the standards document from the IETF defining
`JSON.
`
`MR. HEINRICH: We move 1248 in evidence.
`MR. ANDRE: No objection.
`THE COURT: Thank you. Received.
`(Trial Exhibit 1248 received in evidence)
`BY MR. HEINRICH:
`Q. And if we can turn to --
`THE COURT: How much longer do you have on direct?
`MR. HEINRICH: I think about ten minutes.
`THE COURT: All right. We're going to break and let
`our jury have a break here.
`Remember the admonition. We'll see you back here in 15
`minutes.
`THE COURT: All right.
`
`PROCEEDINGS
` 762
`THE COURT: Okay. Thank you for being so kind.
`Okay. I'm going to take my break. See you in a minute.
`(Recess taken at 11:20 a.m.)
`(Proceedings resumed at 11:32 a.m.)
`(Proceedings were heard in the presence of the jury:)
`THE COURT: Are we ready to go?
`MR. HEINRICH: Yes, Your Honor.
`THE COURT: Tracy, let's bring in our jury, please.
`(Proceedings were heard in the presence of the jury:)
`THE COURT: Welcome back and please be seated.
`I just want to -- before we get started, I asked Tracy to
`say this to you and I'll say it myself. We're going to make
`efforts to get the case to you tomorrow. You may or may not
`have enough time to decide it tomorrow. That will be up to
`you.
`But I cannot -- I don't want you making plans for Monday,
`Tuesday, or Wednesday because we may need you here. I can't be
`positive that the case will go to you for decision tomorrow.
`It may have to be Monday. And even if it does go tomorrow, it
`may be that you can't reach a verdict until Monday, Tuesday, or
`Wednesday because of the deliberations that you need to do.
`So please keep those days open -- Monday, Tuesday, and
`Wednesday -- but also keep Friday available so that you'll have
`that opportunity and we'll see.
`All right. Back to work. You may continue with your
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 759
`
`RUBIN - DIRECT / HEINRICH
`A.
`I don't agree with that.
`Q. And why is that?
`A. Because these are three different separate storage
`solutions. They have different purposes. They are
`communicated with in different programming languages, and so
`you can't just draw a box and say, "This is a database."
`Q. So we saw that the definition of "database" that applies
`here requires a database organized according to a schema.
`A. Right.
`Q.
`Is this, what Dr. Cole is calling ResultsDB database,
`organized according to a database schema as required?
`A. No. I mean, that notion is actually kind of ridiculous
`because you've got these different storage solutions, two of
`which are schema-less and one of which doesn't have any list of
`security operations. And so they use different languages so
`you couldn't possibly have a schema for three things that are
`so different.
`Q. So what does Dr. Cole point to as the schema for what he
`calls the ResultsDB database?
`A. So he points to something called the JSON schema, which is
`JSON is a text format that's used to format information in a
`computer system.
`Q.
`Is there a standard that governs JSON format?
`A. Yes.
`Q. And what is that standard?
`
`PROCEEDINGS
` 761
`(Proceedings were heard out of the presence of the jury:)
`THE COURT: All right. You may step down and have
`your break too.
`Any -- oh, I forgot to ask the jury something. I'm going
`to have Tracy go into the jury room and tell them that I meant
`to tell them that even though we're trying to close out the
`case on Friday maybe, maybe not, they should definitely keep
`Monday, Tuesday, and Wednesday ready to come back here.
`Can you make sure? I don't want them making plans to go
`out of town or something. Okay?
`Is that all right, Counsel?
`MR. ANDRE: That's fine, Your Honor.
`MR. KAGAN: Yes.
`THE COURT: All right. Good. Please do that.
`All right. Well, you-all have almost used exactly the
`same amount of time. Defendants have used 335 of your 390 and
`the other side has used 338. This takes into account -- please
`be seated -- takes into account the mistake I made so that --
`so you both are down to roughly an hour of time left. That
`means that by going into tomorrow, we won't have more than an
`hour, an hour and ten minutes worth of testimony, and then
`we'll be ready to take -- so just be aware of that. Okay?
`All right. Anything more?
`MR. ANDRE: I'm sorry.
`MR. HANNAH: No. We thought you were leaving.
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`