Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 1 of 20
`
`
`
`
`PAUL J. ANDRE (State Bar No. 196585)
`pandre@kramerlevin.com
`LISA KOBIALKA (State Bar No. 191404)
`lkobialka@kramerlevin.com
`JAMES HANNAH (State Bar No. 237978)
`jhannah@kramerlevin.com
`HANNAH LEE (State Bar No. 253197)
`hlee@kramerlevin.com
`KRAMER LEVIN NAFTALIS
`& FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`Telephone: (650) 752-1700
`Facsimile: (650) 752-1800
`
`Attorneys for Plaintiff
`FINJAN, INC.
`
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`FINJAN, INC., a Delaware Corporation,
`
`
`
`
`
`
`Plaintiff,
`
`v.
`
`SAN JOSE DIVISION
`
`
`Case No.: 15-cv-3295-BLF-SVK
`
`PLAINTIFF FINJAN, INC.’S
`OPPOSITION TO BLUE COAT
`SYSTEMS LLC’S PARTIAL RENEWED
`RULE 50(B) MOTION FOR JUDGMENT
`AS A MATTER OF LAW
`
`
`
`
`BLUE COAT SYSTEMS, LLC, a Delaware
`Corporation,
`
`
`
`
`Defendant.
`
`
`
`
`
`
`
`
`
`__________________________________________________________________________________
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 2 of 20
`
`TABLE OF CONTENTS
`
`Page
`
`INTRODUCTION ........................................................................................................................ 1 
`
`LITERAL INFRINGEMENT OF THE ‘844 PATENT ............................................................... 1 
`
`A.
`
` 
`
`B.
`
` 
`
`Substantial Evidence That The Accused Products Identify Suspicious
`Code. ................................................................................................................................. 1 
`
`The Accused Products Link a Downloadable Security Profile to a
`Downloadable Before a Web Server Makes the Content Available to Web
`Clients. .............................................................................................................................. 4 
`
`LITERAL INFRINGEMENT OF THE ‘494 PATENT ............................................................... 6 
`
`INFRINGEMENT UNDER THE DOCTRINE OF EQUIVALENTS ......................................... 8 
`
`
`
`I. 
`
`II. 
`
`III. 
`
`IV. 
`
`V.  WILLFUL INFRINGEMENT OF THE ‘844 AND ‘494 PATENTS .......................................... 9 
`
`VI.  WORLDWIDE DAMAGES ON THE ‘844 AND ‘494 PATENTS .......................................... 12 
`
`i
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 3 of 20
`
`TABLE OF AUTHORITIES
`
`
`
`Page(s)
`
`
`
`Cases
`
`Card-Monroe Corp. v. Tuftco Corp.,
`No. 1:14-cv-292, 2017 WL 3841878 (E.D. Tenn. Sept. 1, 2017)..................................................... 12
`
`Carnegie Mellon Univ. v. Marvell Tech. Grp. Ltd.,
`807 F.3d 1283 (Fed. Cir. 2015)......................................................................................................... 12
`
`CNET Networks, Inc. v. Etilize, Inc.,
`528 F. Supp. 2d 985 (N.D. Cal. 2007) ........................................................................................ 13, 15
`
`Decca Ltd. v. United States,
`210 Ct. Cl. 546 (Ct. Cl. 1976) ........................................................................................................... 14
`
`Fr. Telecom S.A. v. Marvell Semiconductor Inc.,
`39 F. Supp. 3d 1080 (N.D. Cal. 2014) .............................................................................................. 15
`
`Goulds’ Mfg. Co. v. Cowing,
`105 U.S. 253 (1881) .......................................................................................................................... 12
`
`Halo Elecs., Inc. v. Pulse Elecs., Inc.,
`136 S. Ct. 1923 (2016) .................................................................................................................. 9, 10
`
`Honeywell Int’l Inc. v. Universal Avionics Sys. Corp.,
`347 F. Supp. 2d 114 (D. Del. 2004) ................................................................................................ 8, 9
`
`i4i Ltd. P’ship v. Microsoft Corp.,
`598 F.3d 831 (Fed. Cir. 2010), aff’d 564 U.S. 91 (2011) ........................................................... 12, 15
`
`Imperium IP Holdings (Cayman), Ltd. v. Samsung Elecs. Co.,
`No. 4:14-cv-371, 2017 WL 4038884 (E.D. Tex. Sept. 13, 2017)..................................................... 10
`
`Micro Motion, Inc. v. Exac Corp.,
`741 F.Supp. 1426 (N.D. Cal. 1990) .................................................................................................... 8
`
`Microsoft Corp. v. AT&T Corp.,
`127 S. Ct. 1746 (2007) ...................................................................................................................... 15
`
`NTP, Inc. v. Research in Motion, Ltd.,
`418 F.3d 1282 (Fed. Cir. 2005)................................................................................................... 14, 15
`
`Roche Palo Alto LLC v. Apotex, Inc.,
`526 F. Supp. 2d 985 (N.D. Cal. 2007), aff’d 531 F.3d 1372 (Fed. Cir. 2008).................................. 13
`
`ii
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 4 of 20
`
`
`
`Streck, Inc. v. Research & Diagnostic Sys., Inc.,
`665 F.3d 1269, 101 U.S.P.Q.2d 1225 (Fed. Cir. 2012) .............................................................. 11, 12
`
`Stryker Corp. v. Zimmer, Inc.,
`837 F.3d 1268 (Fed. Cir. 2016)......................................................................................................... 12
`
`Tyco Healthcare Grp., LP v. Applied Med. Res. Corp.,
`No. 9:06-cv-151, 2009 WL 5842063 (E.D. Tex. Mar. 30, 2009) ..................................................... 11
`
`WMS Gaming Inc. v. Int’l Game Tech.,
`184 F.3d 1339 (Fed. Cir. 1999)..................................................................................................... 9, 11
`
`Statutes
`
`35 U.S.C. § 271(a) ...................................................................................................................... 12, 14, 15
`
`35 U.S.C. § 271(f) ................................................................................................................................... 15
`
`Other Authorities
`
`Fed. R. Civ. P. 50(a)(2) ........................................................................................................................... 10
`
`iii
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 5 of 20
`
`
`INTRODUCTION
`
`
`
`I.
`
`Finjan, Inc. (“Finjan”) presented more than sufficient evidence at trial to support its
`
`infringement and damages claims, including sworn testimony on the stand from numerous fact
`
`witnesses, deposition testimony of Blue Coat Systems LLC’s (“Blue Coat”) employees, source code,
`
`testing of the accused products, numerous Finjan and Blue Coat documents that were admitted into
`
`evidence, and testimony of highly reputable expert witnesses. When all reasonable inferences are
`
`drawn in Finjan’s favor, the Court should deny Blue Coat’s motion for judgment as a matter of law
`(“Motion”).1
`
`II.
`
`LITERAL INFRINGEMENT OF THE ‘844 PATENT
`Finjan presented substantial evidence that Blue Coat is liable for infringement of Claim 15 of
`
`U.S. Patent No. 6,154,844 (“’844 Patent”), both literally and under the doctrine of equivalents. See
`
`generally Trial Tr. at 469:16-539:9, 560:9-23, 565:14-591:9, 603:18-605:11; PTX-49; PTX-105; PTX-
`
`211; PTX-216; PTX-290; PTX-295; PTX-368; PTX-423; PTX-427; PTX-499; PTX-516; PTX-564;
`
`PTX-575; PTX-1025; PTX-1274; JTX-3001; JTX-3043; JTX-3050; and JTX-3060. Blue Coat’s
`
`assertions otherwise lack merit.
`
`
`A.
`Substantial Evidence That The Accused Products Identify Suspicious Code.
`Finjan presented substantial evidence that Blue Coat’s accused GIN/WebPulse product meets
`
`all elements of Claim 15 of the ‘844 Patent, including “a first content inspection engine for using the
`
`first rule set to generate a Downloadable security profile that identifies suspicious code in a
`
`Downloadable” in accordance with the Court’s claim construction. See ‘844 Patent, Claim 15; Trial
`
`Tr. at 514:18-515:3, 517:11-537:13. In doing so, Finjan’s expert Dr. Cole applied the Court’s claim
`
`construction for this element that the downloadable security profile generated by the inspector
`
`“identifies code in the received Downloadable that performs hostile or potentially hostile operations”
`
`and supported his opinion with substantial evidence of source code, testimony of Blue Coat engineers,
`
`
`1 Finjan incorporates by reference the arguments and evidence set forth in its (i) Opposition to Blue
`Coat’s Rule 50(a) Motion for Judgment as a Matter of Law (Dkt. No. 459) (ii) Motion for Judgment as
`a Matter of Law Pursuant to Fed. R. Civ. P. 50(a) (Dkt. No. 423) and (iii) oral opposition to Blue
`Coat’s motion for JMOL regarding doctrine of equivalents.
`1
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 6 of 20
`
`
`
`
`and technical documents. Trial Tr. at 518:3-519:12 (citing deposition testimony of Blue Coat’s
`
`engineer, Mr. Bjorn Andersen). Dr. Cole fully explained using Blue Coat’s documents and his own
`
`testing how GIN/WebPulse inspects the downloadable using dynamic analysis to identify any
`
`suspicious code that is contained within the downloadable. PTX-368 (Blue Coat’s MAA Center Guide
`
`“so Blue Coat’s own document is showing you that it generates, it looks for and attracts these
`
`suspicious operations which forms [sic] the security profile . . . the suspicious operations map back to
`
`the code that actually performs those suspicious functions” (see Trial Tr. at 519:13-521:16)); PTX-564
`
`(describing Dr. Cole’s testing of the MAA and the summary that the MAA generated discussing
`
`suspicious operations, including “contains compressed section of code” (see Trial Tr. at 521:17-
`
`522:24)); PTX-499 (describing static analysis of code and creation of security profile (see Trial Tr. at
`
`423:12-425:15)); PTX-1025 at BC2_SC_000862 (source code describing the suspicious code and
`
`operations identified in the security profile (see Trial Tr. at 525:16-527:7)); PTX-427 (MAA Report
`
`showing security profile with list of suspicious operations and code (see Trial Tr. at 527:9-529:8)).
`
`First, Dr. Cole cited evidence showing specific examples of the suspicious code that GIN/WebPulse
`
`identified that Blue Coat does not deny is “code,” such as listing that the presence of the Javascript:
`
`Eval method, the JavaScript: from CharCode method, and the Javascript: Unescape function (PTX-
`
`575), and identified in Blue Coat’s source code where GIN identifies code within PDFs (PTX-1025;
`
`PTX-427). Multiple Blue Coat witnesses even confirmed that these types of JavaScript functions are
`
`code. Trial Tr. at 1484:17-1485:4 (JavaScript is code, including functions are code); Trial Tr. at
`
`1552:21-1553:3 (JavaScript eval function is code). Second, Dr. Cole also identified operations like
`
`changing files or creating or terminating processes, which also identify suspicious code because they
`
`directly map back to the suspicious code that performed the operations. Trial Tr. at 520:18-16; PTX-
`
`564 at FINJAN-BLCT 495475 (“Creates process in suspicious location” and “Terminates process
`
`under Windows subfolder”). As such, Blue Coat’s argument that GIN/WebPulse does not “identify
`
`suspicious code” is without basis.
`
`2
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 7 of 20
`
`
`
`
`Further, Blue Coat does not dispute that listing the presence of particular JavaScript functions
`does in fact “identify” code in the downloadable. Dkt. No. 4642 at 9-10 (stating Dr. Nielson’s
`testimony that MAA reports list “JavaScript: Eval method”, and “JavaScript: Unescape function.”) A
`
`jury and the Court already addressed this argument in the Finjan, Inc. v. Blue Coat Sys., Inc., Case No.
`
`13-cv-03999-BLF (N.D. Cal.) litigation (“Blue Coat I”), and determined that identifying JavaScript
`
`functions like “eval” and “unescape” in a DSP was sufficient evidence to meet this element of Claim
`
`15 of the ‘844 Patent. See Blue Coat I, Dkt. No. 543 at 13. Instead, Blue Coat argues that because it
`
`decided to give these functions a specific rating level on their 1-10 rating system (10 being most likely
`
`to be malicious), that these JavaScript functions are not “suspicious.” Dkt. No. 464 at 10. Yet Blue
`
`Coat’s own witnesses admit that these types of JavaScript functions are suspicious. Trial Tr. at
`1534:2-1536:2 (Mr. Larson testifying that the JavaScript eval method is a suspicious operation).
`
`Moreover, this argument is nonsensical because it would allow Blue Coat to avoid infringement simply
`
`by labeling a result with a term other than “suspicious.” The JavaScript functions that GIN/WebPulse
`
`identifies are suspicious because they are used to block content, including for JavaScript functions that
`
`are inherently suspicious because they exhibit “[r]are behavior, mostly used by malware . . . ” Trial Tr.
`
`at 1485:2-1486:1 (stating Mr. Rohan’s testimony that operations associated with risk score 6 are
`
`potentially malicious); PTX 368 at BC2-0003663 (showing that content with a rating of above “1”
`
`indicates the presence of code typically found in malware). As such, Blue Coat’s argument based on
`
`whether it labels a particular rule as “suspicious” is irrelevant to infringement.
`
`Dr. Cole explained during trial that “suspicious operations map back to the code that actually
`
`performs those suspicious operations.” Trial Tr. at 521:11-16; see also id. at 582:13-25. This is
`
`exactly what is set forth in the Court’s claim construction from Blue Coat I, which was adopted by the
`
`parties here. That construction requires that the accused product “identifies code in the received
`
`Downloadable that performs hostile or potentially hostile operations.” Contrary to Blue Coat’s
`
`arguments, this mapping of operations to code does not merely detect the presence of suspicious code,
`
`but identifies specific “characteristics” of the suspicious code by identifying particular details about the
`
`
`2 Unless indicated otherwise, all “Dkt. No.” cites herein are to the filed pleadings in this litigation.
`3
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 8 of 20
`
`
`
`
`operation the code performed, and additional details about the operation. PTX-564. The Court
`
`expressly rejected Blue Coat’s current argument during claim construction in Blue Coat I, stating that
`
`suspicious code can be “identified” in different ways, and gave the example of identifying suspicious
`
`code by “by listing ‘all potentially hostile or suspicious code operations that may be attempted by the
`
`Downloadable’ . . . .” Blue Coat I, Dkt. No. 118 at 16. During his testimony, Dr. Cole identified
`
`different operations that are performed by the code, and the Court’s claim construction anticipated and
`
`rejected Blue Coat’s argument that suspicious code can only be identified a single way and gave
`
`guidance that code can be identified by listing information on the operation the code performs. As
`
`such, Blue Coat’s argument that Finjan did not present substantial evidence is without basis.
`
`Blue Coat also failed to rebut the evidence Finjan presented. Blue Coat’s non-infringement
`
`expert, Dr. Nielson admits that MAA generates reports that identify suspicious operations, functions,
`
`and behavior, but simply disagrees that identifying behavior is the same as identifying code. Trial Tr.
`
`at 1618:16-18, 1626:8-11. On cross-examination, however, Dr. Nielson admitted that MAA does
`
`identify code, including Javascript Unescape and Eval code, and admitted that Dr. Cole went through
`
`his testing and identified where in Blue Coat’s source code he located the exact code functions he
`
`testified about. Trial Tr. at 1770:11-1771:16, 1772:4-10, 1772:23-1773:1. Thus, Finjan presented
`
`substantial and unrebutted evidence that Blue Coat’s GIN/WebPulse product satisfies this limitation of
`
`Claim 15 of the ‘844 Patent.
`
`
`B.
`
`The Accused Products Link a Downloadable Security Profile to a Downloadable
`Before a Web Server Makes the Content Available to Web Clients.
`Finjan presented substantial evidence—including expert testimony from Dr. Cole, Blue Coat
`
`documents and source code, and product testing—that Blue Coat’s accused GIN/WebPulse product
`
`performs the limitation of “linking the first Downloadable security profile to the Downloadable before
`
`a web server makes the Downloadable available to web clients.” Dr. Cole explained that the linking is
`
`performed by creating an ID for the downloadable based on a hash function that generates a unique ID.
`
`See e.g., PTX-564 (“the way [linking] is done is by taking a fingerprint or a cryptographic hash of that
`
`file which both SHA and MD5 are hashes, and that’s linking those together. So that has now links that
`
`downloadable to that security profile” (see Trial Tr. at 522:2-523:7)); PTX-427 (MAA Report showing
`4
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 9 of 20
`
`
`
`
`linking hashes to the Downloadable (see Trial Tr. at 527:13-528:8)). Furthermore, Dr. Cole explained
`
`how this linking occurred before the web server makes the downloadable available to Blue Coat’s
`
`protected client systems. Trial Tr. at 528:9-529:8 (explaining operation of Blue Coat’s MAA engines,
`
`FRS service and dynamo database and how security profile is linked before Downloadable made
`
`available to web client); JTX-3050 (architectural document demonstrating that FRS queries the
`
`Dynamo database that was populated by the MAA’s in order to make a decision before the web
`
`content is made available to the client” (see Trial Tr. at 529:9-530:17)); PTX-49 (discussing blocking
`
`of threats before they reach the client computer (see Trial Tr. at 532:19-533:25)); Trial Tr. at 532:19-
`
`533:25 (Dr. Cole’s product testing confirmed content blocked before it was made available to the
`
`client); PTX-423 (“real-time decision” means decision regarding content made as the content comes in
`
`in real time and before the content is made available to a client (see Trial Tr. at 534:1-535:11)). As
`
`such, Finjan presented substantial evidence that GIN/WebPulse meets this element because it
`
`proactively pulls in content for analysis, generating profiles for this content before its protected web
`
`clients can access the information.
`
`Blue Coat’s argument that the “linking” must be before anyone on the Internet can get the file
`
`was already rejected during two claim constructions and during post-trial motions in Blue Coat I.
`
`First, during claim construction in Blue Coat I, Blue Coat argued that linking must be done at the
`
`“server from which web pages originate,” i.e. before the downloadable is ever published. Blue Coat I,
`
`Dkt. No. 118 at 18-19. The Court explicitly rejected this limitation. Id. Next, Blue Coat raised this
`
`argument in Finjan, Inc. v. Symantec Corp, Case No. 14-cv-02998-HSG (N.D. Cal.) (“Finjan v.
`Symantec”).3, where Judge Gilliam rejected that the claims required linking before the downloadable is
`“deployed” by the originating server as inconsistent with the intrinsic record. Finjan v. Symantec, Dkt.
`
`170 at 25. Finally, Blue Coat raised this argument again during post-trial motions in Blue Coat I,
`
`which the Court rejected by finding that Finjan presented sufficient evidence to support a jury verdict
`
`of infringement finding that linking occurred as specified in the claims. See Blue Coat I, Dkt. No. 498
`
`at 9; Dkt. No. 499 at 8-9; Dkt. No. 543 at 12-13 (Court finding substantial evidence). As such, Blue
`
`
`3 As Blue Coat stated during trial, Blue Coat and Symantec are the same entity. Trial Tr. at 194:17-19.
`5
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 10 of 20
`
`
`
`
`Coat has already raised and lost this argument on three separate occasions, barring it from again raising
`
`this rejected interpretation of the claim.
`III. LITERAL INFRINGEMENT OF THE ‘494 PATENT
`Finjan presented substantial evidence that Blue Coat literally, and under the doctrine of
`
`equivalents, infringes Claim 10 of U.S. Patent No. 8,677,494 (“‘494 Patent”). See generally Trial Tr.
`
`at 469:16–496:21, 540:18–560:8, 565:14-605:11; PTX-49; PTX-105; PTX-211; PTX-216; PTX-290;
`
`PTX-295; PTX-368; PTX-423; PTX-427; PTX-499; PTX-516; PTX-564; PTX-575; PTX-1025; JTX-
`
`3001; JTX-3043; JTX-3050; JTX-3060.
`
`Finjan presented substantial evidence demonstrating that GIN/WebPulse satisfies Element 2 of
`
`Claim 10 of the ‘494 Patent, which is the only limitation Blue Coat disputes, requiring “a
`
`Downloadable scanner coupled with said receiver, for deriving security profile data for the
`
`Downloadable, including a list of suspicious computer operations that may be attempted by the
`
`Downloadable.” Finjan presented substantial evidence—including expert testimony from Dr. Cole,
`
`Blue Coat documents and Blue Coat source code— that GIN/WebPulse contains a scanner for deriving
`
`security profile information from downloadables, and that this profile includes a list of suspicious
`
`operations that the downloadable can perform. Trial Tr. at 546:14-552:17; PTX-211 (showing that
`
`YARA looks for suspicious operations (see Trial Tr. at 546:23-548:6)). In particular, Dr. Cole showed
`
`how GIN/WebPulse uses Yara rules to record suspicious operations, such as obfuscation and injection,
`
`performed by a downloadable. PTX-516 (YARA rules source code confirming YARA looks for
`
`suspicious operations such as Javascript obfuscation and identifies the specific code and operations
`
`being looked for (see Trial Tr. at 548:12-550:21)); JTX-3060 (Cookie2 security profile with list of all
`
`suspicious operations found within a file and concatenated string of the labels of the YARA rules that
`
`were fired (see Trial Tr. at 550:22-552:17)). Thus, contrary to Blue Coat’s assertion, Finjan presented
`
`substantial evidence identifying where in the YARA rules operations and code were identified, for
`
`example VBS_create rules and code (PTX-516); identification of riles that identify code and
`
`operations (id.); where operations of Javascript inject code into the system (id.); and Javascript
`
`obfuscation and associated code (id.).
`
`6
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 11 of 20
`
`
`
`
`Blue Coat does not dispute that GIN/WebPulse will generate a list of the different Yara Rules
`
`that have triggered for a downloadable. Instead, Blue Coat argues that a person could not match back
`
`to the specific code that triggered listing these suspicious operations because some Yara rules can be
`
`triggered by more than one condition. Dkt. No. 464 at 13. However, Blue Coat does not identify why
`
`this is required or relevant to the claim, as the claim language of the ‘494 Patent requires a “list of
`
`suspicious operations,” and does not require listing or identifying code whatsoever. Furthermore, there
`
`are Yara rules that only have a single condition that could have triggered the Yara rule. See, for
`
`example, PTX-516 at BC2-1884578-79 (JPEG_EXIF_Contains_eval rule with a single “condition”).
`
`Blue Coat argues that two example Yara rule operations that Finjan identified do not, in fact,
`
`list suspicious operations that the downloadable can perform. Motion at 7. In doing so, Blue Coat
`
`makes entirely new attorney arguments about what “obfuscation” and “injection” are that were not
`
`supported by its own expert. Finjan’s expert’s unrebutted testimony is that “obfuscation” and
`
`“injection” are both suspicious operations, because they identify what type of operations the content
`
`performs. Trial Tr. at 485:5-486:16. In particular, obfuscation refers to the process of hiding material,
`
`and then dynamically generating it at the user’s computer. Id. at 486:8-12. As discussed above, Finjan
`
`presented evidence that “obfuscation” is a suspicious operation, because it identifies that the content
`
`will perform operations related to this obfuscation. Id. at 549:10-12. Injection relates to injecting
`
`malware code into another process, and Dr. Cole also stated that “injection” is another suspicious
`
`operation. Id. at 486:13-15. As such, Blue Coat’s argument that these cannot be suspicious operations
`
`is without merit.
`
`Blue Coat’s non-infringement expert, Dr. Nielson, failed to offer a single document to support
`
`his disagreement with the substantial evidence Finjan offered. Moreover, on cross-examination, Dr.
`
`Nielson conceded that functions such as Javascript eval, among others, are suspicious operations,
`
`despite the Yara rules being included that specifically identified “eval”. PTX-516 at BC2-1884578-79
`
`(JPEG_EXIF_Contains_eval rule); Trial Tr. at 1770:12-21. He further admitted that evidence of
`
`Javascript eval or unescape operations is evidence that there was also Javascript eval or unescape code.
`
`Trial Tr. at 1771:14-16; 1772:8-14.
`
`7
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 12 of 20
`
`
`INFRINGEMENT UNDER THE DOCTRINE OF EQUIVALENTS
`As set forth in Finjan’s opposition to Blue Coat’s motion for JMOL regarding the doctrine of
`
`
`IV.
`
`equivalents, Finjan presented substantial evidence that Blue Coat’s accused GIN/WebPulse product
`
`infringes Claim 15 of the ’844 Patent under the doctrine of equivalents. (Element 2) (Trial Tr. at
`
`469:16-496:21, 537:14-539:9; PTX-49; JTX-3007; PTX-423; JTX-3050; PTX-54; PTX-216; PTX-
`
`199; PTX-460; PTX-1025; PTX-575; PTX 368; PTX 564; PTX 499; PTX 1025; PTX 427). Finjan
`
`also presented substantial evidence that Blue Coat’s accused GIN/WebPulse product infringes Claim
`
`10 of the ’494 Patent under the doctrine of equivalents. (Element 2) (Trial Tr. at 469:16-496:21,
`
`540:18-542:13, 552:18-554:10, 559:11-560:8; PTX-211; PTX-516; JTX-3060; PTX-1274; PTX-368;
`
`PTX-564; PTX-499; PTX-1025; PTX-427; JTX-3050; PTX-423; JTX-3043; PTX-49; PTX-216; JTX-
`
`3001).
`
`Finjan’s expert Dr. Eric Cole testified at length about the background of the invention and the
`
`function of the GIN/WebPulse product, before ever beginning his element-by-element analysis of
`
`literal infringement, and later, infringement under the doctrine of equivalents. Dr. Cole’s testimony on
`
`the function of the accused GIN/WebPulse product and Blue Coat’s literal infringement may be used
`
`to support his analysis under the doctrine of equivalents, as stated by the non-precedential authority
`
`cited by Blue Coat. See Micro Motion, Inc. v. Exac Corp., 741 F.Supp. 1426, 1432 (N.D. Cal. 1990)
`
`(discussing the standard for doctrine of equivalents); Honeywell Int’l Inc. v. Universal Avionics Sys.
`
`Corp., 347 F. Supp. 2d 114, 116 n.21 (D. Del. 2004) (“evidence and argument on literal infringement .
`
`. . may also bear on equivalence”). Throughout Dr. Cole’s testimony on how GIN/WebPulse infringes
`
`the ‘844 and ‘494 Patents, Dr. Cole presented scores of Blue Coat’s technical documents, testimony
`
`from Blue Coat witnesses, and his own testing to demonstrate how the ’844 and the ’494 Patents are
`
`infringed by GIN/WebPulse. His testimony includes evidence demonstrating that if there are
`
`differences between the claimed inventions and GIN/WebPulse, those differences are so insubstantial
`
`that GIN/WebPulse infringe these claims under the doctrine of equivalents. For example, Dr. Cole
`
`presented evidence of Blue Coat’s own witness, Mr. Andersen, testifying to Blue Coat performing
`
`functions that would satisfy infringement of the second element of the ’844 Patent under the doctrine
`
`8
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-SVK
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 13 of 20
`
`
`
`
`of equivalents. Trail Tr. at 518:3-519:12 (Dr. Cole recounting Mr. Andersen’s testimony of the
`
`functionality of GIN/WebPulse.)
`
`Dr. Cole presented particularized testimony regarding how the accused GIN/WebPulse
`
`products infringe the ’844 and ‘494 Patents under the Federal Circuit’s function/way/result test for
`
`infringement under the doctrine of equivalents, including providing particularized testimony on an
`
`element-by-element bases. Honeywell, 347 F. Supp. 2d at 116 (“[t]he evidentiary requirements
`
`necessary to prove infringement under the doctrine of equivalents [include] . . . the need to provide
`
`equivalency on a limitation-by-limitation bases . . . [and] require[es] equivalency to be proven with
`
`particularized testimony and linking argument.”); Trial Tr. at 537:14-539:9; 552:18-554:10.
`
`Throughout Dr. Cole’s testimony on how the accused GIN/WebPulse products infringe the ‘844 and
`
`‘494 Patents under the function/way/result standard, Dr. Cole provides particularized testimony that is
`
`linked to the relevant limitation.
`
`Finjan is able to rely on the same evidence for doctrine of equivalents that it used for literal
`
`infringement. Blue Coat’s only purported support to the contrary is a single out-of-district and non-
`
`precedential case, Honeywell Int’l Inc. v. Universal Avionics Sys. Corp., which directly contradicts
`
`Blue Coat’s conclusion. In particular, Honeywell states that “evidence and argument on literal
`
`infringement . . . may also bear on equivalence.” 347 F. Supp. 2d at 116. As such, Dr. Cole’s use of
`
`evidence for both literal infringement and infringement under DOE is sufficient to satisfy the Federal
`
`Circuit’s standards. Moreover, the only evidence Blue Coat presented to rebut Finjan’s substantial
`
`evidence is statements from Dr. Nielson, without citing any exhibits or witness testimony, that what
`
`Finjan accused is not equivalent. Trial Tr. at 1601:15-1602:20, 1626:12-1630:5, 1640:2-11, 1653:6-
`
`22, 1683:22-1684:23.
`
`V. WILLFUL INFRINGEMENT OF THE ‘844 AND ‘494 PATENTS
`Finjan proved by a preponderance of evidence that Blue Coat willfully infringed the ‘844 and
`
`‘494 Patents. WMS Gaming Inc. v. Int’l Game Tech., 184 F.3d 1339, 1354 (Fed. Cir. 1999); Halo
`
`Elecs., Inc. v. Pulse Elecs., Inc., 136 S. Ct. 1923, 1934 (2016). The evidence that Finjan presented at
`
`trial was more than legally sufficient for a jury to find that Blue Coat knew of the ‘844 and ‘494
`
`9
`FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL
`RENEWED RULE 50(B) MOTION FOR JMOL
`
`CASE NO. 15-cv-03295-BLF-