Case 4:18-cv-07229-YGR Document 200 Filed 05/25/21 Page 1 of 6
`
`RYAN R. SMITH (SBN 229323)
`rsmith@wsgr.com
`CHRISTOPHER D. MAYS (SBN 266510)
`cmays@wsgr.com
`WILSON SONSINI GOODRICH &
`ROSATI
`Professional Corporation
`650 Page Mill Road
`Palo Alto, CA 94304-1050
`Telephone: (650) 493-9300
`Facsimile: (650) 493-6811
`
`EDWARD G. POPLAWSKI (SBN 113590)
`epoplawski@wsgr.com
`OLIVIA M. KIM (SBN 228382)
`okim@wsgr.com
`TALIN GORDNIA (SBN 274213)
`tgordnia@wsgr.com
`STEPHANIE C. CHENG (SBN 319856)
`stephanie.cheng@wsgr.com
`WILSON SONSINI GOODRICH &
`ROSATI
`Professional Corporation
`633 West Fifth Street, Suite 1550
`Los Angeles, CA 90071
`Telephone: (323) 210-2900
`Facsimile: (866) 974-7329
`
`Attorneys for Defendant
`QUALYS INC.
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`OAKLAND DIVISION
`
`CASE NO.: 4:18-cv-07229-YGR (TSH)
`
`REPLY IN SUPPORT OF
`DEFENDANT QUALYS INC.’S
`RENEWED MOTION TO STRIKE
`PORTIONS OF PLAINTIFF FINJAN
`LLC’S INFRINGEMENT EXPERT
`REPORTS
`
`Judge: Hon. Yvonne Gonzalez
`Rogers
`Date: Tuesday, June 8, 2021
`Time: 2:00pm
`Location: Zoom Teleconference1
`
`))))))))))))))
`
`FINJAN LLC
`
`Plaintiff,
`
`v.
`
`QUALYS INC.,
`
`Defendant.
`
`1 Per the Court’s Notice regarding Civil Law and Motion Calendars and its Order at D.I. 48.
`
`CASE NO. 4:18-cv-07229-YGR
`
`REPLY ISO RENEWED MOTION TO STRIKE
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 4:18-cv-07229-YGR Document 200 Filed 05/25/21 Page 2 of 6
`
`I.
`
`INTRODUCTION
`Finjan’s Opposition says very little about Medvidovic’s Report and the actual opinions
`contained therein. Finjan certainly fails to show how Medvidovic’s opinions disclose a theory of
`infringement involving vulnerability scanning based on client devices’ computer requests. Instead,
`Finjan attempts to distract from Medvidovic’s failure to remain consistent with Finjan’s
`infringement contentions by discussing Qualys’s experts and citing technical documents (none of
`which, of course, appear anywhere in Medvidovic’s Report or Finjan’s infringement contentions).
`Setting these distractions aside, the question for the Court is clear: Do Medvidovic’s
`opinions about the ’408 Patent’s “receiving” limitation exceed the scope of Finjan’s infringement
`contentions? The answer is yes. Finjan’s contentions conditioned infringement upon a claimed
`computer receiving content based on a client device’s request for that content. But even Finjan
`concedes (Opposition at 5) that Medvidovic’s report offers no opinion conditioning infringement
`on a client device requesting content. Rather, what Medvidovic calls the claimed “computer” is
`nowhere shown to perform vulnerability scans “based on” a client device’s request for content but
`instead simply based on customer-configurations directing an automatic process that is
`independent of any end-user devices. For these reasons, discussed more fully below, Qualys’s
`motion should be granted.
`II.
`ARGUMENT
`As an initial point, Finjan nowhere disputes Qualys’s discussion of what a “client device”
`is in the pertinent field, particularly in the context of the Court’s Claim Construction Order in this
`case. Compare Motion at 2-3 with Opposition at 5, fn. 2. Finjan merely argues that because the
`term “client device” does not appear in the claims, the Court should ignore Qualys’s arguments.
`But, of course, it was Finjan who placed the meaning of “client device” at issue by conditioning
`infringement of the ’408 Patent on a client device requesting content. See Exhibit 5, D.I. 158-6,
`at 2-4. In any event, Finjan does not dispute that a client device refers to an end-user’s device that
`requests content.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`CASE NO. 4:18-cv-07229-YGR
`
`1
`
`REPLY ISO RENEWED MOTION TO STRIKE
`
`

`

`Case 4:18-cv-07229-YGR Document 200 Filed 05/25/21 Page 3 of 6
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`A.
`
`This Motion Seeks to Strike Only Those Paragraphs of the Medvidovic
`Report Pertaining to His New Theory for the “Receiving” Limitation.
`Finjan takes issue with the fact that the instant motion identifies additional paragraphs of
`Medvidovic’s report from Qualys’s previous motion. But Qualys seeks to strike those
`paragraphs—and only those paragraphs—that pertain to Medvidovic’s “receiving” limitation for
`the Vulnerability Management line of products. See Exhibit 13, D.I. 194-2, at ¶¶184-196. Qualys
`has correctly identified, based on the Court’s Order, those paragraphs where Medvidovic renders
`opinions about infringement of the “receiving” limitation that are not based on a client device’s
`request for content (and therefore exceed the scope of Finjan’s infringement contentions). See D.I.
`188 at 7. Therefore, these paragraphs each fall within the scope of the Court’s Order and are
`properly the subject of this Renewed Motion.
`B.
`Finjan’s Infringement Contentions Do Not Disclose Medvidovic’s Theory for
`the “Receiving” Limitation.
`The parties agree that Medvidovic’s theory of infringement is that Qualys scanners receive
`content. Where the parties disagree is that Medvidovic’s opinions do not premise the receipt of
`that content on a client device’s request. Finjan argues that both its infringement contentions and
`Medvidovic’s report identify Qualys’s scanners as being part of the claimed “computer.” But that
`straw man argument fails to address the core issue: Finjan’s infringement contentions specifically
`state that the claimed computer receives content “based on a client device requesting the content
`from a source computer.” Exhibit 5, D.I. 158-6, at 2-3. Meanwhile, Finjan concedes that
`Medvidovic “did not expressly opine that a client device must request content for there to be
`infringement.” Opposition at 5. Medvidovic’s opinions no longer require any client device
`whatsoever, and thus jettison a foundational condition for infringement disclosed in Finjan’s
`infringement contentions. Medvidovic’s opinions are thus necessarily broader than the scope of
`the contentions and should be struck.
`C.
`Finjan and Medvidovic Fail to Show that Vulnerability Scanning is Based on
`Client Device’s Requests for Content.
`Finjan argues that Qualys’s motion should be denied because Qualys cannot prove that
`Vulnerability Scanning is not based on Requests from a client device. This argument is incorrect:
`as discussed in its opening brief, Medvidovic’s report shows that vulnerability scanning occurs
`
`CASE NO. 4:18-cv-07229-YGR
`
`2
`
`REPLY ISO RENEWED MOTION TO STRIKE
`
`

`

`Case 4:18-cv-07229-YGR Document 200 Filed 05/25/21 Page 4 of 6
`
`based on customer configurations as to when and where scans will occur. See Motion at 3-5. Any
`content requests come from Qualys’s scanners, not an end-user device. See id. at 4. Finjan does
`not dispute these facts. Moreover, Finjan improperly shifts the burden of infringement and the
`local rules – Finjan bears the burden of disclosing its infringement theories and ensuring that its
`experts’ opinions on infringement are consistent with those disclosures, not Qualys. And, of
`course, it is Finjan that bears the ultimate burden of proving infringement. Finjan’s argument that
`Qualys cannot prove a negative—i.e., that vulnerability scanning is not based on requests from a
`client device—merely obfuscates the fact that Finjan cannot point to a portion of Medvidovic’s
`report opining that vulnerability scans are based on a client device’s request for content.
`Finjan also argues that the claims do not require vulnerability scans to be based on a client
`device requesting content. But that argument is legally immaterial, because this motion pertains
`to Finjan’s disclosed infringement theory and whether Medvidovic’s opinions are consistent with
`that theory. Specifically, what matters here is that (a) Finjan’s infringement theory required a
`computer to receive content based on a client device’s content request, and (b) Medvidovic’s
`opinions are inconsistent with the original theory because his infringement opinions no longer
`involve client devices requesting content, let alone such a request being the basis of a vulnerability
`scan. See Exhibit 5, D.I. 158-6, at 2-3; Opposition at 5 (conceding point). Put another way,
`because Medvidovic opines that infringement can occur even if no client device requests content,
`his opinions go beyond the scope of Finjan’s contentions and should be struck.
`Finjan next argues that Qualys’s products necessarily include a “client device,” citing
`portions of Qualys’s expert’s report as well as several technical documents. There are two
`problems with this argument. First, Finjan makes no attempt to show that these materials (or the
`information disclosed therein) appear anywhere in either its infringement contentions or were ever
`considered or discussed in Medvidovic’s report. The issue here is the scope of Medvidovic’s
`opinions, not how Finjan’s attorneys may interpret documents appearing nowhere in Medvidovic’s
`report. Such extrinsic materials are not probative of whether Medvidovic’s opinions are consistent
`with Finjan’s infringement contentions.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`CASE NO. 4:18-cv-07229-YGR
`
`3
`
`REPLY ISO RENEWED MOTION TO STRIKE
`
`

`

`Case 4:18-cv-07229-YGR Document 200 Filed 05/25/21 Page 5 of 6
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Second, Finjan now suggests that devices like the Qualys Cloud Platform and the Qualys
`scanners are “client devices” that request content. To be clear, there is no dispute that Qualys’s
`scanners can make content requests. See Motion at 4-5 (citing Exhibit 13, D.I. 194-2 at ¶¶ 186,
`188, and 190). But Medvidovic did not opine that these scanners or the Cloud Platform are the
`“client devices.” Rather, Medvidovic specifically opined that these components were the claimed
`“computer” that receives content. See Motion at 4-5; Exhibit 13, D.I. 194-2 at ¶¶ 185 (“At a high
`level, the Qualys Cloud Platform relies on different techniques for scanning content that results in
`the receipt, by a computer (the scanner engine of Qualys Cloud Platform used by the Vulnerability
`Features, the WAS scanner of the Qualys Cloud Platform, or the Qualys Cloud Platform working
`with a Cloud Agent)”) and 196 (“Thus, in this example of the Vulnerability Features, the Qualys
`Cloud Platform includes a ‘computer,’ such as the scanner engine, and the collected data by that
`scanner engine…”). Thus, Finjan’s argument is not probative because it is unconnected to the
`scope of Medvidovic’s opinions. Indeed, given Medvidovic’s opinion that the scanners and Cloud
`Platform are the “computer” of the ‘408 Patent’s claims, the materials Finjan cites actually support
`Qualys’s point that Medvidovic opined that the claimed computer—not a client device—requests
`content.
` Finjan’s Cloud Agent Arguments Miss the Point
`D.
`Finjan finally argues that some of the challenged paragraphs contain opinions about the
`“Cloud Agent” and should therefore be excluded. This, again, misses the point. Although the
`Court determined that Finjan sufficiently disclosed Cloud Agents as an accused product in its
`infringement contentions for the ’408 Patent, the Court did not find that Medvidovic opined about
`the Cloud Agents in a manner consistent with Finjan’s infringement contentions. Similar to
`Medvidovic’s opinions involving scanners, Medvidovic’s Cloud Agent opinions do not discuss or
`involve any vulnerability scans being based on a client device requesting content. See Motion at
`4-5.
`
`Finjan’s argument that “Qualys does not dispute the client devices request content, which
`is the relevant inquiry” is also flawed. Opposition at 8. Both parties agree that Cloud Agents are
`software installed on end-user computers. See D.I 194 at 4-5. Medvidovic nowhere opines that
`
`CASE NO. 4:18-cv-07229-YGR
`
`4
`
`REPLY ISO RENEWED MOTION TO STRIKE
`
`

`

`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 4:18-cv-07229-YGR Document 200 Filed 05/25/21 Page 6 of 6
`
`such an end-user computer ever requests content, and certainly never opines that a Cloud Agent is
`involved in the process even if such a content request occurs (which is precisely the problem).
`Finjan injects pure attorney speculation that “new data” is “received at the client device” “in
`response to a request for that data,” but this is problematic for two reasons. Opposition at 8. First,
`attorney speculation is not evidence, and Finjan offers no evidence that Medvidovic ever opined
`about such end-user devices ever making content requests. Second, even if a hypothetical end-
`user device did request content at some point, Finjan presents no evidence that Medvidovic ever
`opined that such content requests are at all involved in a vulnerability scan using a Cloud Agent.
`Tellingly, Finjan fails to point to a single passage in Medvidovic’s report supporting its argument.2
`
`III.
`
`CONCLUSION
`For the foregoing reasons, the Court should grant Qualys’s motion to strike the opinions of
`Dr. Nenad Medvidovic regarding the Receiving limitation for vulnerability scans (Paragraphs 184-
`185 (to the extent discussing vulnerability scans) and 186-196) as being a different theory from
`the one disclosed in Finjan’s infringement contentions.
`Respectfully submitted,
`
`WILSON SONSINI GOODRICH & ROSATI
`
`Dated: May 25, 2021
`
`By:
`
`/s/ Christopher D. Mays
`CHRISTOPHER D. MAYS
`
`Counsel for
`QUALYS INC.
`
`2 Finjan quotes a passage of Medvidovic’s report discussing the Qualys Cloud Platform
`receiving data sent by a Cloud Agent. This, of course, says nothing about any client device ever
`making a content request or whether any information sent to the Cloud Platform occurs “based
`on” such a request.
`
`CASE NO. 4:18-cv-07229-YGR
`
`5
`
`REPLY ISO RENEWED MOTION TO STRIKE
`
`