Case 1:23-cv-00758-JLH-SRF Document 142 Filed 09/11/24 Page 1 of 7 PageID #: 3233
`
`IN THE UNITED STATES DISTRICT COURT
`FOR THE DISTRICT OF DELAWARE
`
`ORCA SECURITY LTD.,
`
`Plaintiff/Counter-Defendant,
`
`C.A. No. 23-758-JLH-SRF
`
`REDACTED PUBLIC VERSION
`
`
`
`v.
`
`
`
`WIZ, INC.,
`
`)
`)
`)
`)
`)
`)
`)
`)
`)
`Defendant/Counter-Plaintiff.
`WIZ, INC.’S REPLY DISCOVERY DISPUTE LETTER TO THE HONORABLE
`SHERRY R. FALLON
`
`Frederick L. Cottrell, III (#2555)
`Kelly E. Farnan (#4395)
`Christine D. Haynes (#4697)
`RICHARDS, LAYTON & FINGER, P.A.
`One Rodney Square
`920 N. King Street
`Wilmington, DE 19801
`(302) 651-7700
`cottrell@rlf.com
`farnan@rlf.com
`haynes@rlf.com
`
`Counsel for Defendant Wiz, Inc.
`
`OF COUNSEL:
`
`Jordan R. Jaffe
`Lisa Zang
`Catherine Lacy
`Callie Davidson
`Alex Miller
`WILSON SONSINI GOODRICH & ROSATI, P.C.
`One Market Plaza
`Spear Tower, Suite 3300
`San Francisco, CA 94105
`(415) 947-2000
`
`Praatika Prasad
`WILSON SONSINI GOODRICH & ROSATI, P.C.
`1301 Avenue of the Americas, 40th Floor
`New York, NY 10019-6022
`(212) 999-5800
`
`Dated: September 4, 2024
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 142 Filed 09/11/24 Page 2 of 7 PageID #: 3234
`
`Dear Judge Fallon:
`
`Background: This is a patent case. D.I. 133 at 1. Still, Orca attempts to argue that everything
`related to Wiz is relevant and must be produced—even that which has nothing to do with any
`asserted patent or accused product. This is improper under the discovery limits of the Federal
`Rules. This Court denied Orca’s prior improper requests (D.I. 62), but Orca’s fishing expedition
`continues. Orca again demands all source code, whether or not it is accused. Orca claims to have
`invented an “agentless” cloud security solution, but seeks broad discovery over agent-based
`technology from a third party. And Orca refuses to substantiate its allegations in response to Wiz’s
`discovery requests, but seeks the production of virtually every document in Wiz’s possession.
`Orca failed in these tactics previously (id.), but is undeterred from trying again.
`Orca once again argues that Wiz has “ignored” discovery obligations and this Court’s orders, even
`though the offender here is Orca. Orca may have produced “thousands of technical documents”
`(D.I. 133 at 1), but none describe how its Accused Products work. Producing reams of irrelevant
`material is not the same as satisfying discovery obligations. In contrast, Wiz has produced
`thousands of responsive documents and relevant technical documents and agreed to supplement
`responses where appropriate. Consistent with this Court’s order, Wiz substantially completed its
`ESI production on August 30, 2024; as Wiz explained to Orca, the production did not include
`documents that hit on the disputed ESI term and unresponsive documents. Ex. 1 at 1.
`Orca’s Refusal to Comply With This Court’s Order: The Parties met and conferred in response
`to this Court’s order to narrow the parties’ disputes (D.I. 123), on August 27, 2024. Ex. 2 at 5-8.
`During that court-ordered meet and confer, Orca refused to comply with this Court’s order that the
`parties actually resolve disputes before resubmitting their most recent joint motion for
`teleconference. Instead, Orca said it was “de-prioritizing” disputes for the September 11 hearing.
`D.I. 129 at n.1. Nevertheless, at the outset of the meet and confer, Orca stated that it would not
`present the ESI term related dispute at the September 11 hearing. Ex. 2 at 6. Despite Orca refusing
`to actually resolve any pending disputes, the parties memorialized the narrowed set of remaining
`disputes for the September 11 hearing in their renewed joint motion, which did not include the ESI
`term dispute. D.I 129 (omitting the ESI term from the list of disputes for the September 11
`hearing) Orca then presented the ESI term for argument anyway. D.I. 133 at 5. When Wiz pointed
`out that Orca was reneging on its representation to Wiz and this Court, Orca incredibly stated that
`such conduct was proper because of its own refusal to comply with the Court’s order by not
`actually resolving disputes. Ex. 3 at 1.
`Wiz’s Response To Orca’s Interrogatory No. 2 Is Not Deficient; Wiz Is Not “Withholding”
`Source Code: Interrogatory No. 2 asks for “[f]or each Product identified in response to
`Interrogatory No. 1, Identify all operating systems, Software, Source Code, applications, and
`firmware (including but not limited to Accused Functionalities) that You design, manufacture,
`support, install, make, use, license, or instruct others to use associated with said Product.” D.I.
`133-1 at 9-10. Wiz complied by producing its source code for the “Accused Products” and
`identifying them pursuant to Rule 33(d). Id. at 10-12.
`Orca identifies no RFP or other production obligation at issue, which should end the inquiry.
`Regardless, Wiz has provided the relevant source code and supplemented its response to
`Interrogatory No. 2 multiple times: first identifying specific responsive documents, and then
`pointing to the source code where relevant features are implemented. Id. at 7-9. Orca now requests
`something further—though it does not state what specifically it asks for. In fact, Orca’s bid is a
`
`1
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 142 Filed 09/11/24 Page 3 of 7 PageID #: 3235
`
`familiar tactic of plaintiffs—seeking to flip the burden to Wiz to chart Orca’s infringement claims
`on its own products. This is improper. See Cirba Inc. v. VMware, Inc., 2023 WL 6799267, at *2
`(D. Del. Mar. 30, 2023) (plaintiff owner’s “burden to prove infringement, including infringement
`of each claim element.”). For example, Wiz disagrees as to what the scope of the “Accused
`Products” and “Accused Instrumentalities” are in this Interrogatory, as this briefing itself bears
`out. If it has a specific request for production of additional code, it should propound that request.
`Orca’s request for all versions of Wiz’s code is another overreach. Wiz produced multiple versions
`of its accused source code based on its then current status and around the time of the issuance of
`the Asserted Patents.1 It offered to meet and confer if there were other specific versions Orca
`sought. Orca never followed up on that offer. Now Orca seeks code related to the entire Wiz
`company, and every single version and revision. Again that is neither required nor proportional to
`the case. In response, Orca again tries to flip the burden by stating it is entitled to all of Wiz’s
`code because its allegations are “core” to Wiz’s product. That is insufficient. Wiz previously
`provided examples of code that is not relevant, it is not required to go line by line. It is Orca that
`must meet its burden to show the requested code is relevant. It has not done so.
`Even for the two examples Orca does address, it has not met its burden. “Supply Chain Security”
`includes “scanning pull requests for security flaws keeping the main codebase safe from new
`threats.” D.I. 133, at 2. Orca has not shown how this is relevant to its claims. Orca points to
`“Supply Chain Security” as a related feature because it is advertised as “using ‘agentless visibility’
`‘to detect vulnerabilities, misconfigurations, and exposed secrets’” (id.), but that conflates one
`module of Wiz’s product using the output of a separate module with both modules performing the
`accused functionality. Merely because they are allegedly part of the same product or service does
`not make them relevant, as Orca suggests. Orca has similarly not shown the Wiz’s “Runtime
`Sensor” functionality is relevant. As discussed below regarding RFPs Nos. 84-90, the sensor–an
`agent–is the opposite of what Orca claims as its invention—a particular solution for agentless
`scanning. Orca then asserts that Wiz’s runtime sensor is charted for infringement and thus relevant
`(D.I. 133-5), but Exhibit E contains no reference to any “sensor.” Exhibit E instead confirms
`Wiz’s argument–that Orca is accusing “agentless” cloud security. Id. (repeatedly and only
`accusing “agentless” scans, e.g., “The Accused Product(s) further includes any similar products or
`services used for implementing Agentless Scanning...”).
`Finally, Orca says that the Court’s prior order does not preclude this request because that order did
`not address this specific Interrogatory and was issued “without prejudice” and before Wiz filed
`counterclaims. D.I. 133 at 1-2. None of these reasons are relevant to the Court’s prior order and
`Orca provides no substantive reasons for why the Court should rule differently here. Orca simply
`seeks a “do over.” First, while Interrogatory No. 2 was not at issue in this Court’s prior order, the
`Court clearly stated that Orca had not explained why the “complete code” is relevant or
`proportional to the needs of the case. (D.I. 62). This decision included a denial of Orca’s demand
`for git history, which is a log of all the changes the code went through to get to its current state.
`Here, Orca has done no better. Instead of explaining why additional code is needed, Orca attempts
`to shoehorn extra, unaccused features under the accused functionalities. Again, Wiz has provided
`all relevant source code for the functionalities that Orca has accused. Second, that Orca’s original
`
`1 Orca’s complaint is truly that Wiz has not identified for Orca the allegedly infringing features—
`i.e., which is Orca’s burden to do. Orca has had access to Wiz’s source code for months and has
`reviewed it over 10 times since the Court’s May 2024 order.
`
`2
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 142 Filed 09/11/24 Page 4 of 7 PageID #: 3236
`
`motion was denied “without prejudice” does not mean additional source code is now relevant with
`no additional rationale. Finally, Wiz’s counterclaims are not relevant to this Interrogatory. Orca
`contends that Wiz’s counterclaims put “development of its product and alleged inventions at issue”
`(D.I. 133 at 2), but fails to tie Wiz’s counterclaims to the scope of the Interrogatory, which seeks
`information regarding Orca’s patent claims. Nor can it, because Wiz’s asserted patents have a
`different scopefrom Orca’s asserted patent claims.2
`Wiz’s identification of WIZ_00032970 as having responsive information does not alone mean that
`every functionality it describes is responsive. Wiz makes this clear in stating that “information
`relating to the names and versions of what Wiz understands to be the Accused Product(s) may be
`found in the following documents…” D.I. 133-1 at 8-9 (emphasis added). Wiz has never
`represented that all information in those documents is responsive. Orca has accused specific
`functionalities of Wiz’s products. That documents describing those functionalities also include
`non-accused functionalities does not alone make non-accused functionalities related or relevant.
`Orca’s cite to Ameranth, Inc. v. Pizza Hut, Inc. is inapposite because Orca “has not shown that it
`needs to fully understand all the operations of Defendants’ products as opposed to understanding
`only those aspects accused in the infringement claims.” 2013 WL 636936, at *5 (S.D. Cal. Feb.
`20, 2013); Uniloc USA, Inc. v. Apple Inc., 2018 WL 2002979, at *2 (N.D. Cal. Apr. 30, 2018)
`(ordering production of only relevant portions of source code). Instead Orca attempts to link
`features that are unrelated to the Accused Functionalities because those features “use” or are “used
`with” agentless scanning. The Court should deny Orca’s request for further supplementation of
`Interrogatory No. 2.
`Wiz’s Response to Interrogatory No. 6 is Not Deficient: Wiz has supplemented its response to
`Interrogatory No. 6 three times (D.I. 133-1 at 23-25), and addressed all of Orca’s purported
`“deficiencies.” It is also not true that Wiz “merely invokes Rule 33(d).” D.I. 133 at 3. Wiz cited
`multiple responsive documents under Rule 33(d) in its responses (D.I. 133-1 at 24-25), and
`supplemented with a narrative response identifying the people involved in the conception and
`development of the Accused Functionalities in response to Orca’s demand for this. Id. at 25. Orca
`has not raised any issues with Wiz’s latest supplement or asked to meet and confer about it (Ex. 4
`at 1), yet vaguely states now that Wiz should “address these deficiencies.” D.I. 133 at 3. But, it is
`unclear what alleged deficiencies exist. Orca must be required to specifically identify what
`information is purportedly missing and meet and confer with Wiz regarding any further
`“deficiencies” in Wiz’s response before raising the dispute with the Court.
`Orca’s Demand for Additional Source Code and Git History Is Improper: Orca identifies no
`request for production or obligation that requires such a broad production. Again this should end
`the inquiry as neither Interrogatory No. 2 nor 6 require such production. Regardless, Orca does
`not dispute that Wiz has already produced multiple versions of its source code which contain the
`relevant code. Orca is not satisfied that the code across multiple versions is sufficient and now
`requests even more versions and git history of what has already been produced. Out-of-Circuit
`HLFIP Holdings, Inc. v. Rutherford Cnty., Tennessee, which Orca cites, is inapposite as the court
`there relied on the patentee’s expert’s opinion that “[t]he set of all source code produced to date
`still does not represent all of the” accused functionality, and Defendant’s failure to contradict it.
`2021 WL 6498853, at *5 (M.D. Tenn. Feb. 5, 2021). Orca offers no such expert opinion, and there
`
`2 Contrary to Orca’s suggestion, Wiz’s revenue, its funding, or any potential acquisition have no
`bearing on whether irrelevant source code is proportional to the needs of the case.
`
`3
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 142 Filed 09/11/24 Page 5 of 7 PageID #: 3237
`
`is no reason to believe all code is relevant or proportional to the needs of the case. This does not
`support Orca’s demand that Wiz produce all git history for the code when it has already produced
`multiple versions. Also, in HLFIP, the moving party established relevance of revision history after
`learning of a “legacy” version of the accused product. Id. at *6. Wiz has produced source code as
`of the issuance of the patents and a recent version. Orca has not identified any reason more is
`required. And, its reliance on RoboticVISIONTech, Inc. v. ABB Inc. quotes not the court, but the
`parties’ description of what git mirrors show and can explain. D.I. 133-12 at 4. Neither of these
`cases supports Orca’s position.
`Despite identifying documents relating to Wiz’s source code development, Orca claims that no
`such documents have been produced. Instead, Orca uses these documents to conflate Wiz
`competing with Orca to mean Wiz copied Orca. This is in no way supported. Orca claims that
`because Orca produced git history for its platform, Wiz should do the same, and that the burden is
`low given Wiz’s resources. Irrespective of burden, Orca has made no showing that Wiz’s complete
`git history and additional source code are relevant and proportional to the needs to the case and,
`until/unless it does (which it cannot), Wiz should not be required to produce it. Similarly, the
`difficulty or ease of using an “export command” (D.I. 133 at 4), to collect irrelevant information
`does not mean Wiz must produce such information to its competitor. Orca’s repeated request for
`additional versions of source code and git history lacks relevance and proportionality, and should
`be denied.
`Orca’s Demand for Additional JIRA Documents Is Not Ripe: Wiz does not believe there is a
`dispute for this issue, even though Orca has not identified a relevant discovery request other than
`Interrogatory No. 6. Orca first proposed a mutual exchange of search terms to be run against JIRA
`tickets during the parties’ most recent meet and confer on August 27, 2024 and Wiz agreed to
`evaluate the proposal. Ex. 2 at 4. Orca also raises brand new disputes the parties have not even
`met and conferred about. Orca’s request should be denied without prejudice so that the parties can
`properly meet and confer as required.3
`Orca’s RFP Nos. 84-90 Seek Irrelevant Information: Orca contends that Wiz copied its
`advancement of a “novel agentless cloud security platform.” D.I. 15, ¶ 14. Still, Orca repeatedly
`demands information from Wiz related to agent-based technology from a third party where Wiz
`does not offer the ThreatOptix product. Wiz has asked Orca at least 4 times in writing (D.I. 132-
`2 at 1, 8, 15, 22) and many more times verbally, but Orca refused to explain how discovery
`regarding third party ThreatOptix’s “agent-based technology” can be relevant to Orca’s claims
`relating to a “novel agentless cloud security platform.” D.I. 15, ¶ 14 (emphasis added); id., ¶ 10.
`Agent-based technology is by definition not relevant to claims relating to agentless technology.
`Orca still has not provided an explanation of whether its claims encompass ThreatOptix’s agent-
`based technology. Contrary to Orca’s representations, the fact that Orca is ThreatOptix’s “sole
`customer” or that ThreatOptix’s agent-based technology is “used with agentless technology” does
`not make it relevant where Wiz does not offer said product. D.I. 133 at 5. As explained above,
`Orca cannot unilaterally claim that everything integrated with Orca, regardless of whether it is
`relevant to any Asserted Patent, is relevant simply because Orca itself is based on “agentless”
`technology; this would greatly overstate proportionality and relevance. Also, information related
`to the valuation or acquisition of other cloud security products is generally not relevant where, as
`
`3 Wiz will not address Orca’s baseless representations about what each JIRA ticket “indicates.” As
`shown in Wiz’s counterclaims, it is Orca that has been repeatedly copying Wiz.
`
`4
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 142 Filed 09/11/24 Page 6 of 7 PageID #: 3238
`
`here, the two technologies are not comparable. See Roche Diagnostics Corp. v. Meso Scale
`Diagnostics, LLC., 2019 WL 5310220, at *1 (D. Del. Oct. 21, 2019) (precluding damages expert’s
`reliance on overall company valuation where patents at issue were a small portion of the
`company’s portfolio); LaserDynamics, Inc. v. Quanta Comput., Inc., 694 F.3d 51, 79 (Fed. Cir.
`2012) (“alleging a loose or vague comparability between different technologies or licenses does
`not suffice.”); Zimmer Surgical, Inc. v. Stryker Corp., 365 F. Supp. 3d 466, 496 (D. Del. 2019)
`(requiring “technological comparability” for information to be relevant to damages). Orca’s cite
`to E-Contact Techs., LLC v. Apple, Inc., 2013 WL 12143967 (E.D. Tex. Feb. 6, 2013) is easily
`distinguishable. There, the court held that the valuation of a very similar technology, also offered
`by the defendant, was relevant. Id. at *3. Unlike Apple, however, Wiz’s accused agentless
`functionality is not comparable to a third-party’s unrelated agent-based technology. Finally, the
`irrelevance of ThreatOptix to this case has nothing to do with Wiz’s request for Orca to produce
`documents related to its competitors for Orca’s allegedly practicing products. D.I. 132 at 3. Orca’s
`attempt to conflate the issues is improper. Wiz should not be required to produce documents
`relating to ThreatOptix because of the irrelevance of such documents, regardless of what burden
`is involved in collecting or producing such documents.
`Orca’s Improper “Cloud Native” Search Term: Orca’s “cloud native” search “term” is not
`relevant or proportional to the needs of the case or compliant with the stipulated ESI Order. Orca
`likely knows it is improper, as it initially objected to including the entire text of its term in the
`parties’ joint statement and only included it upon Wiz’s repeated insistence. D.I. 133-9 at 1-2.
`First, the “term” comprises multiple terms and would improperly circumvent the agreed limit of
`10 terms per custodian. Id. at 7. In addition to the investment-related terms, the “term” also
`disjunctively uses other terms related to completely different concepts, such as “discount*” and
`“compet*.” Id. Second, most terms used in the compound search term, including “invest*,”
`“acqui*,” “fund*,” “invest*,” and “seed,” relate to acquisitions and investments (id.) which, as
`described above, is not relevant or proportional to the needs of the case. Third, Orca’s search
`terms are unduly burdensome in general (id. at 3), and this particular term—unlike those for which
`Wiz agreed to search and review documents—hits on an exceptional number of documents. Wiz
`has never “agreed” that Orca’s terms were not overbroad. Id. (“The very language from my prior
`emails you quote belies that we ‘conceded’ your characterization of the term is accurate . . . it only
`became clearer with Orca’s further revisions that Orca wanted to focus the term on irrelevant
`information.”). Finally, Orca’s argument that Wiz should be forced to produce documents in
`response to a plainly overbroad and irrelevant search “term” simply because Orca’s total hit count
`is “lower” than Wiz’s total hit count is disingenuous. Orca has purported to reserve at least 9
`search terms across the priority custodians for later requests. See Ex. 5; D.I. 133-9 at 8-18 . There
`is no way of knowing whether those “reserved” search terms will result in under 30,000
`documents.4 * * *
`In light of the above, Wiz respectfully requests that this Court deny Orca’s requests.
`
`
`
`
`
`4 Orca cites Prism Techs. and VirnetX for the notion that a patentee must tie damages to the claimed
`invention. D.I. 133 at 5. Wiz agrees. That is why information regarding the acquisition of an entire
`company is irrelevant—it is not closely tied to the claimed invention. See Roche, 2019 WL
`5310220 at *1.
`
`5
`
`

`

`Case 1:23-cv-00758-JLH-SRF Document 142 Filed 09/11/24 Page 7 of 7 PageID #: 3239
`
`
`
`
`
`
`
`Attachments
`
`cc:
`
`
`
`
`
`
`
`Respectfully,
`
`/s/ Frederick L. Cottrell, III
`
`Frederick L. Cottrell, III (#2555)
`
`All Counsel of Record (via email)
`
`
`
`6
`
`