Case 5:17-cv-04467-BLF Document 332 Filed 12/22/20 Page 1 of 8
`
`DUANE MORRIS LLP
`D. Stuart Bartow (SBN 233107)
`Email: DSBartow@duanemorris.com
`2475 Hanover Street
`Palo Alto, CA 94304-1194
`Telephone: 650.847.4150
`Facsimile: 650.847.4151
`DUANE MORRIS LLP
`Joseph A. Powers (PA SBN 84590)
`Admitted Pro Hac Vice
`japowers@duanemorris.com
`Jarrad M. Gunther (PA SBN 207038)
`Admitted Pro Hac Vice
`jmgunther@duanemorris.com
`30 South 17th Street
`Philadelphia, PA 19103
`Telephone: 215.979.1000
`Facsimile: 215.979.1020
`
`Attorneys for Defendant
`SONICWALL INC.
`
`DUANE MORRIS LLP
`Matthew C. Gaudet (GA SBN 287759)
`Admitted Pro Hac Vice
`mcgaudet@duanemorris.com
`Robin L. McGrath (GA SBN 493115)
`Admitted Pro Hac Vice
`rlmcgrath@duanemorris.com
`David C. Dotson (GA SBN 138040)
`Admitted Pro Hac Vice
`dcdotson@duanemorris.com
`Jennifer H. Forte (GA SBN 940650)
`Admitted Pro Hac Vice
`jhforte@duanemorris.com
`1075 Peachtree Street, Ste. 2000
`Atlanta, GA 30309
`Telephone: 404.253.6900
`Facsimile: 404.253.6901
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`SAN JOSE DIVISION
`
`FINJAN, LLC, a Delaware Limited Liability
`Company,
`
`Plaintiff,
`
`vs.
`SONICWALL INC., a Delaware
`Corporation
`
`Defendant.
`
`Case No. 5:17-cv-04467-BLF-VKD
`SONICWALL, INC.’S REPLY IN
`SUPPORT OF ITS MOTION TO
`STRIKE NEW THEORIES IN FINJAN,
`LLC’S EXPERT REPORTS
`
`Date: March 11, 2021
`Time: 9:00 a.m.
`Dept: Courtroom 3, Fifth Floor
`Judge: Hon. Beth Labson Freeman
`
`REDACTED
`
`SONICWALL’S REPLY IN SUPPORT OF ITS MOTION TO STRIKE NEW THEORIES IN FINJAN’S EXPERT REPORTS
`CASE NO. 5:17-CV-04467-BLF-VKD
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`

`

`Case 5:17-cv-04467-BLF Document 332 Filed 12/22/20 Page 2 of 8
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`I.
`
`New Infringement Theories Concerning the ’305 Patent
`The Network Traffic Probe Limitation. Finjan does not deny that its contentions never
`identified “Capture ATP’s controller server or its Capture engine” as the claimed network traffic
`probe. Instead, Finjan suggests it was enough to allege that Capture ATP has a traffic probe and that
`it was not required to identify the specific component within Capture ATP that constitutes the network
`traffic probe. Finjan is mistaken. Patent L.R. 3-1(c) requires contentions to identify “specifically
`where and how each limitation of each asserted claim is found within each Accused Instrumentality.”
`See also DCG Sys. v. Checkpoint Techs., LLC, 2012 WL 1309161, at *2 (N.D. Cal. Apr. 16, 2012).
`Finjan’s contentions absolutely were required to identify Finjan’s theory regarding the component of
`Capture ATP that constitutes the claimed network traffic probe for its expert to offer such opinion.
`To be clear, this is not, as Finjan argues, Finjan’s expert simply providing additional evidence
`that Capture ATP’s controller server or Capture engine is the network traffic probe. Op. Br. at 2. This
`is Finjan’s expert report identifying for the first time that Capture ATP’s controller server or Capture
`engine is the network traffic probe. While the former is permissible, the latter is not. The Court should
`thus strike any reference to such assertion from Dr. Medvidovic’s report (¶ 217).
`The Intended Destination Limitation. Finjan concedes it never identified the endpoint client
`computer as the “intended destination” of claims 11 and 12 (which depend from claim 1). Instead,
`Finjan argues SonicWall was on notice that the endpoint computer is the intended destination of claims
`11 and 12 because Finjan’s contentions identified the endpoint computer as the intended destination
`of claim 13 (no longer asserted because it was rendered invalid in another case). Finjan is wrong.
`There is a key difference between the “intended destination” of (invalid) claim 13 and the
`“intended destination” of claims 11 and 12. Specifically, claim 13 places no limitation on what the
`intended destination can be, allowing Finjan to identify the endpoint computer as the destination.
`Claims 11 and 12, on the other hand, require (via dependency on claim 1) the intended destination to
`be the same computer that houses the network interface. Compare claim 13 (“receiving, at the
`computer, incoming content from the Internet on its destination to an Internet application”) with claim
`1 (“a network interface, housed within a computer, for receiving incoming content from the Internet
`on its destination to an Internet application running on the computer.”). Since Finjan did not accuse
`1
`
`SONICWALL’S REPLY IN SUPPORT OF ITS MOTION TO STRIKE NEW THEORIES IN FINJAN’S EXPERT REPORTS
`CASE NO. 5:17-CV-04467-BLF-VKD
`
`
`
`

`

`Case 5:17-cv-04467-BLF Document 332 Filed 12/22/20 Page 3 of 8
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`the endpoint computer of housing the claimed network interface with claims 11 and 12 (it accused
`only the gateways and Capture ATP), it made sense that Finjan chose not to identify the endpoint
`computer as the intended destination of claims 11 and 12. The only way Finjan’s expert can now do
`so is by asserting the new theory that the gateways, Capture ATP, and the client endpoint computer
`together form a single computer (the subject of SonicWall’s pending summary judgment motion).
`For these reasons, asserting that the endpoint client computer is the intended destination of
`claim 13 did not place SonicWall on notice or preserve Finjan’s right to assert that the endpoint client
`computer is the intended destination of claims 11 and 12. The Court should thus strike any reference
`to the endpoint client computer as the intended destination of claims 11 and 12 (¶ 218).
`The Update Manager Limitation. Finjan does not deny that its Operative Contentions (Third
`Supplemental Infringement Contentions) identify only
` as
`the claimed update manager, and not
`
` as set forth in its expert report. Instead, Finjan argues it “has always alleged that Capture ATP
`infringes the ’305 Patent’s asserted claims by including a rule update engine” which constitutes the
`“rule update manager.” Finjan Br. at 4. This assertion is problematic for a number of reasons.
`First, in asserting it has “always alleged” that the “rule update engine” is the claimed “rule
`update manager,” Finjan cites only to its Initial and First Supplemental Infringement Contentions, not
`to the Operative Contentions. This is critical because during the parties’ April 2, 2020 meet and confer
`regarding the latter, Finjan expressly represented that the Third Supplemental contentions replaced,
`as opposed to supplemented, its early contentions. Ex. 1 (4.2.2020 McGrath Email to Hannah). It did
`so in response to SonicWall’s stated concern that Finjan’s experts would later seek to use Finjan’s
`earlier contentions to support theories Finjan had dropped or amended. Gunther Decl. ¶ 2.
`Second, the “rule update engine” identified in Finjan’s subsequently-replaced infringement
`contentions is different from
` that
`its expert report now identifies. Third, Finjan asserts that paragraph 224 “that SonicWall seeks to
`strike” includes Finjan’s machine learning allegation that was in the Operative Contentions. But
`SonicWall is not seeking to strike that aspect of paragraph 224. Op. Br. at 3
`
` as the rule update manager . . . is not the dispute at issue.”). Because they were not identified
`2
`
`SONICWALL’S REPLY IN SUPPORT OF ITS MOTION TO STRIKE NEW THEORIES IN FINJAN’S EXPERT REPORTS
`CASE NO. 5:17-CV-04467-BLF-VKD
`
`
`
`

`

`Case 5:17-cv-04467-BLF Document 332 Filed 12/22/20 Page 4 of 8
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`II.
`
`in its Operative Contentions, the Court should strike from ¶ 224 of Dr. Medvidovic’s expert report any
`reference to the rule update manager being satisfied by
`
`
`New Infringement Theories Concerning the ’408 Patent
`Dynamically Building a Parse Tree. Finjan admits that the first time it disclosed its theory as
`to how the machine learning module satisfies this limitation is in Dr. Medvidovic’s report (noting the
`report “details the process of dynamically building the parse tree”). Op. Br. at 5. Indeed, it was only
`through Dr. Medvidovic’s report that Finjan explained its theory that a parse tree is dynamically built
`because
` “is an ongoing process that adjusts as more information is received.” There
`is nothing in Finjan’s Operative Contentions from which SonicWall could have gleaned this theory.
`Again, Dr. Medvidovic did not simply provide additional evidence for a theory previously
`disclosed. He offered for the first time a theory as to how the
` purportedly
`dynamically builds a parse tree. Patent L.R. 3-1(c) (requiring a plaintiff to prepare charts “identifying
`specifically where and how each limitation of each asserted claim is found within each Accused
`Instrumentality.”). Because it was not in Finjan’s infringement contentions, the Court should strike
`Dr. Medvidovic’s theory regarding this limitation from his report (¶¶ 146-149)
`Dynamically detecting . . . potential exploits. Finjan also concedes that while its contentions
`mention that the
` dynamically detects based on analyzer rules,” they offer
`no theory as to how it does so while said dynamically building builds the parse tree, as claimed. Op.
`Br. at 6. Finjan further concedes that it only offered its theory as to how this is done through Dr.
`Medvidovic’s report. Id. Nothing in Finjan’s Operative Contentions could possibly have placed
`SonicWall on notice of the theory Dr. Medvidovic’s report details regarding dynamic detection while
`said dynamically building builds the parse tree. Because the theory was not disclosed in Finjan’s
`Operative Contentions, the Court should strike the theory from Dr. Medvidovic’s report. (¶ 158).
`III. New Infringement Theories Regarding the ’780 Patent
`Finjan does not dispute that its Operative Contentions included no theory in which a referenced
`software component is fetched by extracting a file from a compressed or archive file. Op. Br. at 6-7.
`Instead, Finjan argues that its initial contentions – not its Operative Contentions – referenced
`3
`
`SONICWALL’S REPLY IN SUPPORT OF ITS MOTION TO STRIKE NEW THEORIES IN FINJAN’S EXPERT REPORTS
`CASE NO. 5:17-CV-04467-BLF-VKD
`
`
`
`

`

`Case 5:17-cv-04467-BLF Document 332 Filed 12/22/20 Page 5 of 8
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`compressed and archive files as Downloadable types. Id. Yet, even the initial contentions failed to
`disclose any theory in which software components are fetched via extraction, see, e.g., Dkt. No. 313-
`9 at 21-27. They only theorize that a software component is fetched from the Internet (by
`downloading) during execution of another file. Id. at 21-23, 25 (“Capture ATP fetchs [sic] components
`of a Downloadable during dynamic analysis in a sandbox received through internet traffic”).
`After being ordered to further supplement its contentions, Finjan served second supplemental
`contentions eliminating all references to compressed/archive files. These second supplemental
`contentions likewise do not cite the source code cited in paragraph 134 in Dr. Mitzenmacher’s report
`in support of this undisclosed theory, i.e., the
` code. See Exs. 2 (Appx. D-1) at 11, 13, 15
`(all referencing source code files discussing dropped files); 3 (Appx. D-2) at 8 (same); 4 (Appx. D-3)
`at 7 (same); 5 (Appx. D-4) at 8 (same). Nor do Finjan’s Operative Contentions cite the source code
`Dr. Mitzenmacher cites. Exs. 6-9. Thus, the Court should strike Dr. Mitzenmacher’s infringement
`theory based on extracting files from a compressed/archive file.
`IV. New Infringement Theories Regarding ’154 Patent
`Gateway and ESA Alone Theories. Dr. Medvidovic – Finjan’s technical expert – opines that
`Gateways and ESAs “individually” infringe. Dkt. 299-9 at ¶¶ 268, 288. Yet Finjan now concedes its
`Gateway and ESA “alone” theories in fact require Capture ATP. Op. Br. at 8 (“Finjan’s . . .
`infringement theory for the Gateway and ESA requires Capture ATP.” . . . “both the so-called ‘alone’
`theory, . . . and the ‘combination’ theory . . . are the same theory.”). Specifically, Finjan’s “alone”
`theories are based on Finjan’s assertion that the Gateways and ESA come with a “free trial” of Capture
`ATP. Id. Because Finjan admits its ESA and Gateway infringement theories all require Capture ATP,
`all statements in its expert report indicating that a Gateway or ESA “individually” infringe should be
`struck, and Dr. Medvidovic should be precluded from offering Gateway/ESA “alone” theories at trial.
`Notably, this is not, as Finjan alleges, a “separate damages issue,” but goes to the heart of what
`is accused of infringement. Op. Br. at 8. Dr. Medvidovic’s report provides no explanation as to how
`a free trial of Capture ATP differs as a technical matter from his Gateway/ESA combined with Capture
`ATP theory. Dr. Medvidovic’s report likewise fails to make clear that when he claims that the
`Gateways/ESA “individually” infringe, he is relying on their use with Capture ATP (albeit via a free
`4
`
`SONICWALL’S REPLY IN SUPPORT OF ITS MOTION TO STRIKE NEW THEORIES IN FINJAN’S EXPERT REPORTS
`CASE NO. 5:17-CV-04467-BLF-VKD
`
`
`
`

`

`Case 5:17-cv-04467-BLF Document 332 Filed 12/22/20 Page 6 of 8
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`trial). In other words, the representations in Finjan’s opposition brief alleviate any doubt that, Dr.
`Medividovic’s report notwithstanding, Finjan has no Gateway/ESA “alone” theory.
`“URL Rewriting” Theory. In its Opposition, Finjan attempts to shift the focus from “URL
`rewriting” to “URL processing,” presumably because Finjan’s contentions do not disclose URL
`rewriting. According to Finjan, its Operative Contentions disclose the URL rewriting feature by
`stating “[ESA] has a content processor . . . [which] will send the URL . . . for analysis after
`deobfuscation.” Op. Br. at 9-10. However, the ellipsis misleadingly replaces the part of this statement
`showing that the statement relates to Capture ATP, not the separate URL rewriting feature in the ESA
`(which is unrelated to Capture ATP): “Email Security Appliance will send the URL or file input to
`Capture ATP Sandbox for analysis after.” Dkt. 299-17 at 11 (emphasis added).
`Because Finjan did not accuse the URL rewriting feature, Finjan resorts to citing Wikipedia
`ostensibly to show that one of ordinary skill would have understood “URL rewriting to refer to a
`method for modifying URLs.” What Wikipedia says about URL rewriting and what that does or does
`not teach to one of ordinary skill has no bearing on and is of no relevance to whether Finjan’s Operative
`Contentions accused the URL rewriting feature, which it did not. Finjan’s Operative Contentions
`likewise did not reference “modifying URLs.” This is most plainly illustrated by the argument in its
`expert report that a rewritten URL in an email is the “first function” of the claim (Dkt. 299-9 at ¶ 293),
`which appears nowhere in Finjan’s Operative Contentions. Dkt. 299-17 at 2-6.
`V.
`THE ’494 PATENT GATEWAY-ONLY THEORY VIOLATES PRIOR ORDERS
`Claim 10 of the ’494 Patent requires DSP data to be stored in a database. Finjan appears to
`argue that Dr. Cole is not relying on the
` (not on a gateway).
`Yet that is the very database Dr. Cole cites in his report and explicitly identified in his deposition:
`Q. So the database you’ve identified is located in the
`; correct?
`A. Okay, let me just confirm. Yes, that appears to be the case for that database, yes.
`See Ex. 10 (10.22.2020 Cole Dep.) at 201:1-203:9 (emphasis added). Thus, Dr. Cole’s Gateway alone
`theory requires storing data in a cloud database, violating the Court’s November 20 Order. It should
`thus be struck.
`
`
`
`5
`
`SONICWALL’S REPLY IN SUPPORT OF ITS MOTION TO STRIKE NEW THEORIES IN FINJAN’S EXPERT REPORTS
`CASE NO. 5:17-CV-04467-BLF-VKD
`
`

`

`Case 5:17-cv-04467-BLF Document 332 Filed 12/22/20 Page 7 of 8
`
`Respectfully submitted,
`/s/ Nicole E. Grigg
`
`Nicole E. Grigg
`Email: NEGrigg@duanemorris.com
`DUANE MORRIS LLP
`D. Stuart Bartow (SBN 233107)
`2475 Hanover Street
`Palo Alto, CA 94304-1194
`Tel.: 650.847.4150
`Fax: 650.847.4151
`
`Matthew C. Gaudet (admitted pro hac vice)
`Email: mcgaudet@duanemorris.com
`Robin L. McGrath (admitted pro hac vice)
`Email: rlmcgrath@duanemorris.com
`David C. Dotson (admitted pro hac vice)
`Email: dcdotson@duanemorris.com
`Jennifer H. Forte (admitted pro hac vice)
`Email: jhforte@duanemorris.com
`1075 Peachtree Street, Ste. 2000
`Atlanta, GA 30309
`Telephone: 404.253.6900
`Joseph A. Powers (admitted pro hac vice)
`Email: japowers@duanemorris.com
`Jarrad M. Gunther (admitted pro hac vice)
`Email: jmgunther@duanemorris.com
`30 South 17th Street
`Philadelphia, PA 19103
`Telephone: 215.979.1000
`Attorneys for Defendant
`SONICWALL, INC.
`
`Dated: December 22, 2020
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`6
`
`SONICWALL’S REPLY IN SUPPORT OF ITS MOTION TO STRIKE NEW THEORIES IN FINJAN’S EXPERT REPORTS
`CASE NO. 5:17-CV-04467-BLF-VKD
`
`

`

`Case 5:17-cv-04467-BLF Document 332 Filed 12/22/20 Page 8 of 8
`
`
`
`
`
`
`
`
`
`
`/s/ Nicole E. Grigg
` Nicole E. Grigg
`
`
`
`CERTIFICATE OF SERVICE
`The undersigned hereby certifies that a true and correct copy of the above and foregoing
`document has been served on December 22, 2020, to all counsel of record who are deemed to have
`consented to electronic service via the Court’s CM/ECF system.
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`7
`
`SONICWALL’S REPLY IN SUPPORT OF ITS MOTION TO STRIKE NEW THEORIES IN FINJAN’S EXPERT REPORTS
`CASE NO. 5:17-CV-04467-BLF-VKD
`
`