Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 1 of 27
`Case 4:18-cv-07229—YGR Document 192-4 Filed 04/19/21 Page 1 of 27
`
`EXHIBIT 3
`
`EXHIBIT 3
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 2 of 27
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`
`FINJAN, INC.,
`
`Plaintiff,
`
`QUALYS, INC.,
`
`Defendant.
`
`Case No. 4:I8-CV-07229-YGR
`
`EXPERT REPORT OF DR. SYLVIA D. HALL-ELLIS
`REGARDING PUBLIC AVAILABILITY OF CERTAIN PUBLICATIONS
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 3 of 27
`
`Web access to more than 5.1-million full-text documents from some of the world's most highly
`
`cited publications. The content comprises over 180 journals, over 1,400 conference proceedings,
`
`more than 3,800 technical standards, over 1,800 eBooks and over 400 educational courses.
`
`Approximately 20,000 new documents are added to IEEE Xplore each month. Abstracts are free
`
`to access, but access to full text requires a subscription or institutional login.
`
`22.
`
`ResearchGate.3 A social networking site for scientists and researchers to share
`
`papers, ask and answer questions, and find collaborators, ResearchGate is the largest academic
`
`social network in terms of active users. Although other services have more registered users, a
`
`2015–2016 survey suggests that almost as many academics have Google Scholar profiles.
`
`Features available to ResearchGate members include following a research interest and the work
`
`of other individual participants, a blogging feature for users to write short reviews on peer-
`
`reviewed articles, private chat rooms for sharing data, editing documents, or discussing
`
`confidential topics, and a research-focused job board. ResearchGate indexes self-published
`
`information on user profiles and suggests members to connect with others who have similar
`
`interests. Member questions are fielded to others who have identified relevant expertise on their
`
`profiles. As of 2018, ResearchGate had more than 15 million users, with its largest user-bases
`
`coming from Europe and North America. Most of ResearchGate's users are involved in
`
`medicine, biology, engineering, computer science, agricultural sciences, and psychology.
`
`ResearchGate publishes a citation impact measurement in the form of an “RG Score,” which is
`
`reported to be correlated with existing citation impact measures. ResearchGate does not charge
`
`fees for putting content on the site and does not require peer review.
`
`3 http://www.researchgate.net
`
`8
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 4 of 27
`
`23.
`
`Semantic Scholar.4 Developed at the Allen Institute for Artificial Intelligence and
`
`publicly released in November 2015, Semantic Scholar is designed to be an AI-backed search
`
`engine for scientific journal articles which uses a combination of machine learning, natural
`
`language processing, and machine vision to add a layer of semantic analysis to the traditional
`
`methods of citation analysis, and to extract relevant figures, entities, and venues from
`
`papers. Semantic Scholar is designed to highlight important, influential papers, and to identify
`
`the connections between them. As of January 2018, following a 2017 project that added
`
`biomedical papers and topic summaries, the Semantic Scholar corpus included more than 40
`
`million papers from computer science and biomedicine. As of August 2019, the number of
`
`included papers had grown to more than 173 million after the addition of the Microsoft
`
`Academic Graph records, already used by Lens.org.
`
`24.
`
`Google Scholar.5 A freely accessible web search engine that indexes the full text
`
`or metadata of scholarly literature across an array of publishing formats and disciplines
`
`released in November 2004, Google Scholar includes a significant number of peer-reviewed
`
`online academic journals, books, conference papers, selected theses and dissertations, preprints,
`
`abstracts, technical reports, and other scholarly literature. While Google does not publish the
`
`size of Google Scholar's database, scientometric researchers estimated it to contain roughly 389
`
`million documents including articles, citations and patents making it the world's largest academic
`
`search engine in January 2018. Because many Google Scholar search results link to commercial
`
`journal articles, searchers will be able to access only an abstract and the citation details of an
`
`article and may have to pay a fee to access the entire article. The most relevant results for the
`
`4 http://www.semanticscholar.org
`5 https://scholar.google.com
`
`9
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 5 of 27
`
`bibliographic database. I personally identified and retrieved the MARC record that is
`
`Attachment 2a. As previously noted, the library that created the record is recorded in field 040
`
`with a unique library code. For Attachment 2a, that library code is “EQN,” which means that the
`
`MARC record for this manual was created at the Merck, Sharp & Dohme Research Laboratory
`
`Library (Kenilworth, New Jersey). As can be seen in the “Entered” field in the MARC record
`
`for this exhibit, a cataloger at the Merck, Sharp & Dohme Research Laboratory Library created
`
`OCLC record number 34504896 on April 3, 1996.
`
`58.
`
`The entry in the second field 500 of Attachment 2a indicates that the manual
`
`accompanied a software package. Attachment 2a further includes two locally assigned English
`
`language field 650 entries reading “Software” and “Handbooks.” Thus, as of its cataloging, the
`
`publication corresponding to the MARC record attached hereto as Attachment 2a was indexed
`
`according to its subject matter by virtue of at least two independently sufficient classifications:
`
`the field 650 entries. Further, as of April 3, 1996, the MARC record attached hereto as
`
`Attachment 2a was accessible through any library with access to the OCLC bibliographic
`
`database or the online catalog at a library that added this manual to its collection, which means
`
`that the corresponding publication was publicly available on or before that same date through
`
`any library with access to the OCLC bibliographic database or through an individual library.
`
`59.
`
`Attachment 2a indicates that the manual Dr. Solomon’s Antivirus Toolkit for
`
`Windows and DOS as cataloged at the Merck, Sharp & Dohme Research Laboratory Library is
`
`currently available from 1 library. In view of above, this manual Dr. Solomon’s Antivirus
`
`Toolkit for Windows and DOS was publicly available no later than April 3, 1996, because by that
`
`date it had been received, cataloged, and indexed at the Merck, Sharp & Dohme Research
`
`25
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 6 of 27
`
`Laboratory Library and made part of the OCLC bibliographic database. For these reasons, I find
`
`that Exhibit 1002 was published and accessible to the public no later than April 3, 1996.
`
`60. My review, determination of authenticity, and public availability of the book
`
`titled Dr. Solomon's Anti-Virus Toolkit for Windows and DOS, Edition 3.0, by Solomon, is the
`
`second time that I have examined this document. I examined this book for the following matter:
`
`Finjan, Inc. v. Juniper Networks, Inc., U. S. District Court, Northern District of California, 3:17-
`
`cv-05659-WHA on behalf of Juniper Networks, Inc. in April 2019.
`
`61.
`
`I have been provided by counsel with a document bearing Bates Range
`
`QUALSYS00002805-00003045, which is the book Dr. Solomon's Anti-Virus Toolkit for
`
`Windows and DOS, Edition 3.0, by Alan Solomon. I have compared the document bearing Bates
`
`Range QUALSYS00002805-00003045 with Exhibit 1002. Based on my review, the conference
`
`papers in Bates Range QUALSYS00002805-00003045 and Exhibit 1002 are substantively the
`
`same.
`
`C.
`
`DOCUMENT 3 – “Dynamic Detection and Classification of Computer
`Viruses Using General Behaviour Patterns” by Morton Swimmer, Baudouin
`Le Charlier, and Abdelaziz Mounji (Exhibit 1003) (“Swimmer”)
`
`62.
`
`Attached hereto as Exhibit 1003, is a true and correct copy of the conference
`
`paper, “Dynamic Detection and Classification of Computer Viruses Using General Behaviour
`
`Patterns” by Morton Swimmer, Baudouin Le Charlier, and Abdelaziz Mounji (hereafter
`
`“Swimmer”). This conference paper was published in the Proceedings of the Fifth International
`
`Virus Bulletin Conference on pages 75-88. The Fifth International Virus Bulletin Conference
`
`was held September 20-22, 1995, in Boston, Massachusetts. I was able to find this book in the
`
`University of Washington Libraries (Seattle, Washington). The absence of journal issue cover,
`
`table of contents, etc. does not alter my opinion that Exhibit 1003 is an authentic copy of the
`
`Swimmer conference paper. Specifically, the text is complete; no pages are missing, and the text
`26
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 7 of 27
`
`on each page appears to flow seamlessly from one page to the next; further, there are no visible
`
`alterations to the document. I was able to find the conference proceedings volume within the
`
`custody of a library – a place where an authentic copy of this book would likely be. Exhibit
`
`1003 is a true and correct copy in a condition that creates no suspicion about its authenticity.
`
`63.
`
`Attached hereto as Attachment 3a is a true and correct copy of the MARC record
`
`for the Proceedings of the Fifth International Virus Bulletin Conference from the British Library.
`
`The library ownership is indicated by the presence of the library’s code (Uk) in the 040 field. I
`
`personally identified and retrieved the MARC record that is Attachment 3a.
`
`64.
`
`The MARC record for the Proceedings of the Fifth International Virus Bulletin
`
`Conference shows that it was cataloged in the British Library on July 25, 1996, as shown in field
`
`008 (“960725”). The library continues to update this MARC record and enhanced the MARC
`
`record to meet current cataloging rules. Therefore, this volume would have been available to
`
`users in the British Library on or shortly after July 25, 1996.
`
`65.
`
`Attached hereto as Attachment 3b is a true and correct copy of the MARC record
`
`for the Proceedings of the Fifth International Virus Bulletin Conference obtained from the
`
`OCLC bibliographic database. I personally identified and retrieved the MARC record that is
`
`Attachment 3b. As previously noted, the library that created the record is recorded in field 040
`
`with a unique library code. For Attachment 3b, that library code is “WAU,” which means that
`
`the MARC record for this volume was created at the University of Washington Libraries
`
`(Seattle, Washington). The library continues to update this MARC record and enhanced the
`
`MARC record to meet current cataloging rules. As can be seen in the “Entered” field in the
`
`MARC record for Exhibit 1003, a cataloger at the University of Washington Libraries created
`
`OCLC record number 33834197 on December 1, 1995.
`
`27
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 8 of 27
`
`66.
`
`Attachment 3b further includes an entry in field 050 (“QA76.76.C68 $b I57
`
`1995”)—as described above, this includes a subject matter classification number consistent with
`
`the Library of Congress classification system (analogous to the Dewey Decimal classification
`
`system). Attachment 3b further includes an English language descriptor term reading “Computer
`
`viruses $v Congresses” (see Attachment 1c, Library of Congress subject heading sh88004897
`
`and Attachment 1d, Library of Congress subject heading sh88031115) in the 650 field. Thus, as
`
`of its cataloging, the publication corresponding to the MARC record attached hereto as
`
`Attachment 3b was indexed according to its subject matter by virtue of at least two
`
`independently sufficient classifications: the field 050 entry and the field 650 entry. Further, as of
`
`December 1, 1995, the MARC record attached hereto as Attachment 3b was accessible through
`
`any library with access to the OCLC bibliographic database or the online catalog at a library that
`
`acquired this volume, which means that the corresponding publication was publicly available on
`
`or before that same date through any library with access to the OCLC bibliographic database or
`
`through an individual library.
`
`67.
`
`Attachment 3b indicates that the Proceedings of the Fifth International Virus
`
`Bulletin Conference as cataloged at the University of Washington Library is currently available
`
`from 2 libraries. In view of above, this volume of the Proceedings of the Fifth International
`
`Virus Bulletin Conference was publicly available no later than December 1, 1995, because by
`
`that date it had been received, cataloged, and indexed at the University of Washington Libraries
`
`and made part of the OCLC bibliographic database. For these reasons, it is my opinion that
`
`Exhibit 1003 was published and accessible to the public no later than December 1, 1995.
`
`68. My review, determination of authenticity, and public availability of the
`
`conference paper “Dynamic Detection and Classification of Computer Viruses Using General
`
`28
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 9 of 27
`
`Behavior Patterns” by Swimmer is the sixth time that I have examined this document. I
`
`examined this conference paper for the following matters: a Petition for Inter Partes Review,
`
`Patent 8,677,494, Finjan, Inc. v. Symantec Corporation on behalf of Symantec Corporation in
`
`May 2016; Finjan, Inc. v. Symantec Corporation, U. S. District Court, Northern District of
`
`California, 3:14-cv-02998 on behalf of Symantec Corporation in July 2017; Finjan, Inc. v.
`
`Juniper Networks, Inc., U. S. District Court, Northern District of California, 3:17-cv-05659-
`
`WHA (two reviews) on behalf of Juniper Networks, Inc. in April 2019 and July 2019; and,
`
`Finjan, Inc. v. Cisco Systems, Inc., U. S. District Court, Northern District of California, 5:17-cv-
`
`00072-BLF-SVK on behalf of Cisco Systems, Inc. in August 2019.
`
`69.
`
`I have been provided by counsel with a document bearing Bates Range
`
`QUALSYS00003327-00003340, which is the conference paper “Dynamic Detection and
`
`Classification of Computer Viruses Using General Behavior Patterns” by Swimmer. I have
`
`compared the document bearing Bates Range QUALSYS00003327-00003340 with Exhibit
`
`1003. As I noted previously, Swimmer was published in the Proceedings of the Fifth
`
`International Virus Bulletin Conference. Based on my review, the conference papers in Bates
`
`Range QUALSYS00003327-00003340 and Exhibit 1003 are substantively the same.
`
`D.
`
`DOCUMENT 4 – Automated Assistance for Detecting Malicious Code by Rick
`Crawford, P. Kerchen, Karl N. Levitt, Roland Olsson, Myla Archer, and M.
`A. Izaguirre Casillas. (Exhibit 1004) (“Crawford”)
`
`70.
`
`Document 4 is a technical report, Automated Assistance for Detecting Malicious
`
`Code by Rick Crawford, P. Kerchen, Karl N. Levitt, Roland Olsson, Myla Archer, and M. A.
`
`Izaguirre Casillas (hereafter “Crawford”) and issued by the Office of Scientific and Technical
`
`Information of the U. S. Department of Energy in 1993. The exhibit filed in this proceeding as
`
`Exhibit 1004 is a true and correct copy of Document 4, which I obtained from the U. S.
`
`29
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 10 of 27
`
`Department of Energy website.14 Specifically, the text is complete; no pages are missing, and
`
`the text on each page appears to flow seamlessly from one page to the next; further, there are no
`
`visible alterations to the document. Exhibit 1004 was found within the custody of the issuing
`
`federal agency – a place where, if authentic, a copy of this technical report would likely be.
`
`Exhibit 1004 is a true and correct copy in a condition that creates no suspicion about its
`
`authenticity.
`
`71.
`
`The website indicates 13 descriptor terms for searching the database: mathematics,
`
`computing, and information science; computers; security; detection; M codes; damage; design;
`
`automation; computer networks; personal computers; programming languages; implementation;
`
`and, mathematics and computers. Based on finding a digital copy of Document 4 and seeing the
`
`metadata record on its website, it is my opinion that Automated Assistance for Detecting
`
`Malicious Code by Crawford, et al. was available to the public on June 18, 1993.
`
`72. My review, determination of authenticity, and public availability of the
`
`conference paper “Automated Assistance for Detecting Malicious Code” by Crawford, et al. is
`
`the second time that I have examined this document. I examined this conference paper for the
`
`following matter: Finjan, Inc. v. Juniper Networks, Inc., U. S. District Court, Northern District of
`
`California, 3:17-cv-05659-WHA on behalf of Juniper Networks in April 2019.
`
`73.
`
`I have been provided by counsel with a document bearing Bates Range
`
`QUALSYS00008090-00008105, which is the conference paper “Automated Assistance for
`
`Detecting Malicious Code” by Crawford, et al. I have compared the document bearing Bates
`
`Range QUALSYS00008090-00008105 with Exhibit 1004. As I noted previously, Crawford was
`
`published in the Proceedings of the Sixth International Computer Security & Virus Conference.
`
`14 https://www.osti.gov/biblio/10176903/
`
`30
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 11 of 27
`
`Based on my review, the conference papers in Bates Range QUALSYS00008090-00008105 and
`
`Exhibit 1004 are substantively the same.
`
`E.
`
`DOCUMENT 5 – “A Flexible Security Model for Using Internet Content,”
`by Nayeem Islam, Rangachari Anand, Trent Ray Jaeger, and Josyula R. Rao
`(“Islam”)
`
`74.
`
`Attached hereto as Exhibit 1005 is a is a true and correct copy of a conference
`
`paper, “A Flexible Security Model for Using Internet Content,” by Nayeem Islam, Rangachari
`
`Anand, Trent Ray Jaeger, and Josyula R. Rao (hereafter “Islam”) published in the Proceedings:
`
`16th IEEE Symposium on Reliable Distributed Systems found in the Linda Hall Library. The
`
`Anand conference paper appears beginning on page 89. Exhibit 1005 is a true and correct copy
`
`of the title page, verso of the title page, and the conference paper (pages 89-96). I obtained this
`
`copy of the conference paper from the Linda Hall Library which comprises Exhibit 1005.
`
`Specifically, the text of the conference paper is complete; no pages are missing, and the text on
`
`each page appears to flow seamlessly from one page to the next; further, there are no visible
`
`alterations to the document. Exhibit 1005 was found within the custody of a library – a place
`
`where, if authentic, a copy of this proceedings volume would likely be. Exhibit 1005 is a true
`
`and correct copy in a condition that creates no suspicion about its authenticity.
`
`75.
`
`The Anand conference paper is also available in the IEEE Xplore database,15 the
`
`ACM Digital Library,16 and the digital repository Semantic Scholar.17
`
`76.
`
`Attached hereto as Attachment 5a is a true and correct copy of the MARC record
`
`for the Proceedings: 16th IEEE Symposium on Reliable Distributed Systems in the Linda Hall
`
`Library. The library ownership is indicated by the presence of the library’s code (LHL) in the
`
`15 https://ieeexplore.ieee.org/document/632802
`16 https://dl.acm.org/doi/10.5555/829522.830930
`31
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 12 of 27
`
`049 field. The library continues to update this MARC record and enhanced the MARC record to
`
`meet current cataloging rules. I personally identified and retrieved the MARC record that is
`
`Attachment 5a.
`
`77.
`
`Based on finding a print copy of Exhibit 1005 in the Linda Hall Library and
`
`MARC record in its online library catalog attached as Attachment 5a, it is my opinion that the
`
`Anand conference paper was available in the Linda Hall Library as of November 20, 1997.
`
`Attachment 5a further includes that the metadata record was created with three English language
`
`field 650 entries reading “Electronic data processing $x Distributed processing $v Congresses”
`
`(see Attachment 5b, Library of Congress subject heading sh2008102927), “Database
`
`management $x Reliability $v Congresses” (see Attachment 5c, Library of Congress subject
`
`heading sh85035848, Attachment 5d, Library of Congress subject heading sh85112510, and
`
`Attachment 1d, Library of Congress subject heading sh85031115), and “Reliability
`
`(Engineering) $v Congresses” (see Attachment 5e, Library of Congress subject heading
`
`sh2008110659).
`
`78.
`
`In view of the MARC record for Exhibit 1005, the Anand conference paper was
`
`publicly available no later than November 20, 1997, because the proceedings volume had been
`
`received, cataloged, and indexed at the Linda Hall Library and made part of its online catalog
`
`database.
`
`79.
`
`Attached hereto as Attachment 5f is a true and correct copy of the MARC record
`
`for the Proceedings: 16th IEEE Symposium on Reliable Distributed Systems obtained from the
`
`OCLC bibliographic database. I personally identified and retrieved the MARC record that is
`
`17 https://www.semanticscholar.org/paper/A-flexible-security-model-for-using-Internet-Anand-
`Islam/a3fc1c51b57de6833d2a1ad054e5293682e1bc1b
`32
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 13 of 27
`
`attached hereto as Attachment 5f. As previously noted, the library that created the record is
`
`recorded in field 040 with a unique library code. For Attachment 5f, that library code is “FUG,”
`
`which means that the MARC record for this conference proceedings volume was created at the
`
`University of Florida Libraries (Gainesville, Florida). The library continues to update this
`
`MARC record and enhanced the MARC record to meet current cataloging rules. As can be seen
`
`in the “Entered” field in the MARC record identified as Attachment 5f, a cataloger at the
`
`University of Florida Libraries created OCLC record number 37979497 on November 20, 1997.
`
`80.
`
`Attachment 5f includes an entry in field 050 (“QA76.9.D5 $b S95 1997”)—as
`
`described above, this includes a subject matter classification number consistent with the Library
`
`of Congress classification system (analogous to the Dewey Decimal classification system).
`
`Further, Attachment 5f includes an entry in field 082 (“004.36”)—as described above, this
`
`includes a subject matter classification number consistent with the Dewey Decimal classification
`
`system. Attachment 5f further includes three English language field 650 entries reading
`
`“Electronic data processing $x Distributed processing $v Congresses” (see Attachment 5b,
`
`Library of Congress subject heading sh2008102927), “Database management $x Reliability $v
`
`Congresses” (see Attachment 5c, Library of Congress subject heading sh85035848, Attachment
`
`5d, Library of Congress subject heading sh85112510, and Attachment 1d, Library of Congress
`
`subject heading sh85031115), and “Reliability (Engineering) $v Congresses” (see Attachment
`
`5e, Library of Congress subject heading sh2008110659). Thus, as of its cataloging, the
`
`publication corresponding to the MARC record attached hereto as Attachment 5f was indexed
`
`according to its subject matter by virtue of at least three independently sufficient classifications:
`
`the field 050 entry, the field 082 entry, and the field 650 entry. Further, as of November 20,
`
`1997, the MARC record attached hereto as Attachment 5f was accessible through any library
`
`33
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 14 of 27
`
`with access to the OCLC bibliographic database or the online catalog at a library that acquired
`
`this proceedings volume, which means that the corresponding publication was publicly available
`
`on or before that same date through any library with access to the OCLC bibliographic database
`
`or through an individual library.
`
`81.
`
`Attachment 5f indicates that the Proceedings: 16th IEEE Symposium on Reliable
`
`Distributed Systems as cataloged at the University of Florida Libraries is currently available from
`
`101 libraries. In view of above, this volume Proceedings: 16th IEEE Symposium on Reliable
`
`Distributed Systems was publicly available no later than November 20, 1997, because by that
`
`date it had been cataloged and indexed at the University of Florida Libraries, made part of the
`
`OCLC bibliographic database, and received at the Linda Hall Library. For these reasons, it is my
`
`opinion that Exhibit 1005 was published and accessible to the public no later than November 20,
`
`1997.
`
`82.
`
`Not only was Exhibit 1005 accessible and available to others in the field as of
`
`October 1997, researchers actually obtained and cited this article in other works, which is still
`
`further confirmation of its availability and accessibility. For example, Google Scholar indicates
`
`that this conference paper has been cited 23 times. Attachment 5g reports the number of citing
`
`references shown in Google Scholar for Exhibit 1005.
`
`83. My review, determination of authenticity, and public availability of the
`
`conference paper “A Flexible Security Model for Using Internet Content” by Islam, et al. is the
`
`second time that I have examined this document. I examined this conference paper for the
`
`following matter: Finjan, Inc. v. Sonicwall, Inc., U. S. District Court, Northern District of
`
`California, 5:17-cv-04467-BLF-HRL on behalf of Sonicwall, Inc. in September 2020; for
`
`Petitions for Inter Partes Review, Patent 7,975,305; 8,225,408; 6,154,844; 7,058,822;
`
`34
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 15 of 27
`
`6,804,780; 6,965,968; 7,613,926; 7,647,633; 8,141,154; 8,667,494 Finjan, Inc. v. Sonicwall,
`
`Inc., on behalf of Sonicwall, Inc. in August 2020.
`
`84.
`
`I have been provided by counsel with a document bearing Bates Range
`
`QUALSYS00009435-00009449, which is the conference paper “A Flexible Security Model for
`
`Using Internet Content” by Islam, et al. I have compared the document bearing Bates Range
`
`QUALSYS00009435-00009449 with Exhibit 1005. As I noted previously, Islam was published
`
`in the Proceedings: 16th IEEE Symposium on Reliable Distributed Systems. Based on my
`
`review, the conference papers in Bates Range QUALSYS00009435-00009449 and Exhibit 1005
`
`are substantively the same.
`
`F.
`
`DOCUMENT 6 – “Scanners of the Year 2000: Heuristics” by Dmitry O.
`Gryaznov (Exhibit 1006) (“Gryaznov”)
`
`85.
`
`Document 6 is a true and correct copy of the conference paper “Scanners of the
`
`Year 2000: Heuristics” by Dmitry O. Gryaznov (hereafter “Gryaznov”). This conference paper
`
`was published in the Proceedings of the Fifth International Virus Bulletin Conference on pages
`
`225-234. The Fifth International Virus Bulletin Conference was held September 20-22, 1995, in
`
`Boston, Massachusetts. I was able to find this book in the University of Washington Libraries
`
`(Seattle, Washington). The absence of journal issue cover, table of contents, etc. does not alter
`
`my opinion that Exhibit 1006 is an authentic copy of the Gryaznov conference paper.
`
`Specifically, the text is complete; no pages are missing, and the text on each page appears to
`
`flow seamlessly from one page to the next; further, there are no visible alterations to the
`
`document. I was able to find the conference proceedings volume within the custody of a library
`
`– a place where an authentic copy of this book would likely be. Exhibit 1006 is a true and
`
`correct copy in a condition that creates no suspicion about its authenticity.
`
`35
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 16 of 27
`
`86.
`
`Attached hereto as Attachment 6a is a true and correct copy of the MARC record
`
`for the Proceedings of the Fifth International Virus Bulletin Conference from the British Library.
`
`The library ownership is indicated by the presence of the library’s code (Uk) in the 040 field. I
`
`personally identified and retrieved the MARC record that is Attachment 6a.
`
`87.
`
`The MARC record for the Proceedings of the Fifth International Virus Bulletin
`
`Conference shows that it was cataloged in the British Library on July 25, 1996, as shown in field
`
`008 (“960725”). The library continues to update this MARC record and enhanced the MARC
`
`record to meet current cataloging rules. Therefore, this volume would have been available to
`
`users in the British Library on or shortly after July 25, 1996.
`
`88.
`
`Attached hereto as Attachment 6b is a true and correct copy of the MARC record
`
`for the Proceedings of the Fifth International Virus Bulletin Conference obtained from the
`
`OCLC bibliographic database. I personally identified and retrieved the MARC record that is
`
`Attachment 6b. As previously noted, the library that created the record is recorded in field 040
`
`with a unique library code. For Attachment 6b, that library code is “WAU,” which means that
`
`the MARC record for this volume was created at the University of Washington Libraries
`
`(Seattle, Washington). The library continues to update this MARC record and enhanced the
`
`MARC record to meet current cataloging rules. As can be seen in the “Entered” field in the
`
`MARC record for Exhibit 1006, a cataloger at the University of Washington Libraries created
`
`OCLC record number 33834197 on December 1, 1995.
`
`89.
`
`Attachment 6b further includes an entry in field 050 (“QA76.76.C68 $b I57
`
`1995”)—as described above, this includes a subject matter classification number consistent with
`
`the Library of Congress classification system (analogous to the Dewey Decimal classification
`
`system). Attachment 6b further includes an English language descriptor term reading “Computer
`
`36
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 17 of 27
`
`viruses $v Congresses” (see Attachment 1c, Library of Congress subject heading sh88004897
`
`and Attachment 1d, Library of Congress subject heading sh88031115) in the 650 field. Thus, as
`
`of its cataloging, the publication corresponding to the MARC record attached hereto as
`
`Attachment 6b was indexed according to its subject matter by virtue of at least two
`
`independently sufficient classifications: the field 050 entry and the field 650 entry. Further, as of
`
`December 1, 1995, the MARC record attached hereto as Attachment 6b was accessible through
`
`any library with access to the OCLC bibliographic database or the online catalog at a library that
`
`acquired this volume, which means that the corresponding publication was publicly available on
`
`or before that same date through any library with access to the OCLC bibliographic database or
`
`through an individual library.
`
`90.
`
`Attachment 6b indicates that the Proceedings of the Fifth International Virus
`
`Bulletin Conference as cataloged at the University of Washington Library is currently available
`
`from 2 libraries. In view of above, this volume of the Proceedings of the Fifth International
`
`Virus Bulletin Conference was publicly available no later than December 1, 1995, because by
`
`that date it had been received, cataloged, and indexed at the University of Washington Libraries
`
`and made part of the OCLC bibliographic database. For these reasons, it is my opinion that
`
`Exhibit 1006 was published and accessible to the public no later than December 1, 1995.
`
`91. My review, determination of authenticity, and public availability of the
`
`conference paper “Scanners of the Year 2000: Heuristics” by Gryaznov is the third time that I
`
`have examined this document. I examined this conference paper for the following matters: a
`
`Petition for Inter Partes Review, Patent 7,613,926, Finjan, Inc. v. Juniper Networks, Inc., on
`
`behalf of Juniper Networks, Inc. in September 2018; Finjan, Inc. v. Symantec Corporation, U. S.
`
`District Court, Northern District of California, 3:14-cv-02998 on behalf of Symantec
`
`37
`
`

`

`Case 4:18-cv-07229-YGR Document 192-4 Filed 04/19/21 Page 18 of 27
`
`Corporation in July 2017; Finjan, Inc. v. Juniper Networks, Inc., U. S. District Court, Northern
`
`District of California, 3:17-cv-05659-WHA on behalf of Juniper Networks, Inc., in July 2019.
`
`92.
`
`I have been provided by counsel with a document bearing Bates Range
`
`QUALSYS00017719-00017730, which is the conference paper “Scanners of the Year 2000:
`
`Heuristics” by Dmitry O. Gryaznov. I have compared the document bearing Bates Range
`
`QUALSYS00017719-00017730 with Exhibit 1006. As I noted previously, Gryaznov was
`
`published in the Proceedings of the Fifth International Virus Bulletin Conference. B