`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`SYMANTEC CORP., and
`BLUE COAT SYSTEMS, INC.,
`Petitioner
`
`v.
`
`FINJAN, INC.,
`Patent Owner
`
`Case IPR2015-018921
`U.S. Patent No. 8,677,494
`
`CONSOLIDATED FILING:
`
`PETITIONER'S RESPONSE TO PATENT OWNER’S
`OBSERVATIONS ON CROSS-EXAMINATION OF
`DR. JACK W. DAVIDSON
`
`1 Case IPR2016-00890 has been joined with the instant proceeding
`
`
`
`Exhibit No.
`Symantec 1001
`Symantec 1002
`
`Symantec 1003
`Symantec 1004
`
`Symantec 1005
`
`Symantec 1006
`Symantec 1007
`Symantec 1008
`Symantec 1009
`Symantec 1010
`Symantec 1011
`Symantec 1012
`Symantec 1013
`Symantec 1014
`
`Symantec 1015
`
`Symantec 1016
`
`Symantec 1017
`
`Symantec 1018
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`LIST OF EXHIBITS
`
`Description
`U.S. Patent No. 8,677,494 to Edery et al. (“the ‘494 patent”)
`U.S. Provisional Application No. 60/030,639 (“the ‘639
`provisional”)
`U.S. Patent No. 5,313,616 to David C. Cline et al. (“Cline”)
`A Sense of Self for Unix Processes, by Stephanie Forrest et
`al., Proceedings of the 1996 IEEE Symposium on Security
`and Privacy, IEEE Computer Society Press, 1996. (“Forrest”)
`Dynamic Detection and Classification of Computer Viruses
`Using General Behaviour Patterns, by Morton Swimmer et
`al., Virus Bulletin Conference, Virus Bulletin Ltd., September
`1995. (“Swimmer”)
`Declaration by Dr. Sylvia Hall-Ellis
`Curriculum Vitae of Dr. Sylvia Hall-Ellis
`Xplore Digital Library Database printout (Forrest)
`MARC record OCLC record number 34969890 (Forrest)
`1995 Virus Bulletin Proceedings
`MARC record OCLC record number 33834197 (Swimmer)
`U.S. Patent No. 5,623,600 to Shuang Ji et al. (“Ji”)
`U.S. Patent No. 6,092,194 (“the ‘194 patent”)
`Webster’s College Dictionary, 1999 Second Random House
`Edition, p. 339
`Ninth New Collegiate Dictionary, 1991 Merriam-Webster
`Inc., p. 325
`Webster’s New World Dictionary of Computer Terms, 4th
`Edition 1992, Simon & Schuster, Inc., p. 95
`Joint Claim Construction and Pre-Hearing Statement, Dkt. No.
`68, Case No. 3:14cv2998
`Declaration of Jack Davidson in Support of Petition
`(“Davidson Dec.”)
`
`i
`
`
`
`Exhibit No.
`Symantec 1019
`Symantec 1020
`Symantec 1021
`Symantec 1022
`Symantec 1023
`
`Symantec 1024
`
`Symantec 1025
`Symantec 1026
`Symantec 1027
`
`Symantec 1028
`Symantec 1029
`
`Symantec 1030
`
`Symantec 1031
`
`Symantec 1032
`
`Symantec 1033
`Symantec 1034
`
`Symantec 1035
`Symantec 1036
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`Description
`Curriculum Vitae of Jack Davidson
`Advanced MS-DOS
`U.S. Patent No. 5,978,484 to Apperson et al. (“Apperson”)
`U.S. Patent No. 5,892,904 to Atkinson et al. (“Atkinson”)
`Efficient Software-Based Fault Isolation, by Robert Wahbe et
`al., ACM SIGOPS (Special Interest Group on Operating
`Systems) Symposium on Operating Systems Principles,
`December 1993
`Scott and Davidson, “Safe Virtual Execution Using Software
`Dynamic Translation”, 2002
`Affidavit of Alexander Walden
`Virus Bulletin Conference Proceedings Sept. 1995
`Declaration of Dr. Jack Davidson in Support of Petitioner’s
`Reply
`Updated Curriculum Vitae of Dr. Jack Davidson
`Selected Definitions from Microsoft Computer Dictionary 3rd
`Edition, 1997 (“MSCD”)
`D. Comer, “The Flat File Database Generator ffg”, Computer
`Science Technical Reports, Purdue University, 1981
`(“Comer”)
`G. Fowler, “cql - A flat file Database Query Language”, In
`Proceedings of the Winter 1994 USENIX Conference , San
`Francisco, California, Jan. 1994 (“Fowler”)
`D. Denning, “An intrusion detection model”, IEEE
`Transactions on Software Engineering, 13-2:222, Feb 1987
`(“Denning”)
`Intel 8086 Family User’s Manual (“8086 Manual”)
`Transcript of Deposition of Dr. Medvidovic in IPR2015-
`01892 taken on Aug. 19, 2016
`U.S. Patent No. 5,398,196 (“the ‘196 patent”)
`A. Mounji et al. “Distributed Audit Trail Analysis”, In
`
`ii
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`Exhibit No.
`
`Symantec 1037
`Symantec 1038
`Symantec 1039
`
`Symantec 1040
`Symantec 1041
`Symantec 1042
`Symantec 1043
`Symantec 1044
`
`Symantec 1045
`
`Symantec 1046
`Symantec 1047
`Symantec 1048
`
`Description
`Proceedings of the Internet Society Symposium on Network
`and Distributed System Security (ISOC'95), San Diego,
`California, Feb 1995, IEEE (“Mounji”)
`Supplemental Declaration of Dr. Sylvia Hall-Ellis
`Declaration of Dr. Richard Ford
`Exhibit C to Declaration of Dr. Richard Ford - Excerpts from
`Virus Bulletin Conference Proceedings Sept. 1995
`Exhibit E to Declaration of Dr. Richard Ford – Photograph
`Declaration of Joseph Kiegel
`MARC Record - Denning
`MARC Record - Fowler
`Declaration of John Hawes of Virus Bulletin, dated October
`15, 2015
`Declaration of John Hawes of Virus Bulletin, dated October
`7, 2016
`The Delegates, 1995 Virus Bulletin International Conference
`Brochure - 1995 Virus Bulletin
`Virus Bulletin magazine, November 1995
`
`iii
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`Petitioner respectfully responds as follows to Patent Owner’s observations2
`
`(Paper No. 42) regarding the November 2, 2016 cross-examination testimony of
`
`Petitioner’s Reply declarant, Dr. Jack W. Davidson (Exhibit 2041):
`
`Response to Observation #1:
`
`Petitioner disputes that Dr. Davidson’s testimony regarding the sequential
`
`nature of Swimmer’s audit trail supports Patent Owner’s assertion that the audit
`
`trail is a log file or event log and, therefore, not a database. In fact, in the
`
`immediately preceding but uncited testimony, Dr. Davidson testified that a
`
`sequentially stored file may be in the form of a database. Ex. 2041, p. 75:11-
`
`76:11; see also Reply, p. 15 and Davidson Rep., ¶112-14 (addressing Patent
`
`Owner’s asserted distinction between an “event log” and a database in the ‘494
`
`patent). Further, during his deposition, Dr. Davidson explained that the concepts
`
`of log files and databases are not mutually exclusive, and that a log file may be a
`
`2 Petitioner notes that Patent’s Owner’s observations fail to comply with the
`
`Board’s rules regarding the format and content of observations because they lack
`
`any cites to the portions of the record for which the cited cross-examination
`
`testimony is allegedly relevant. See Trial Practice Guide, 77 Fed. Reg. 48756
`
`(Aug. 14, 2012)
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`database if it is appropriately structured. Ex. 2041, p. 48:19-52:23; see also Ex.
`
`2013, p. 18 (limitation 1c) and p. 21 (limitation 10c) (Patent Owner’s expert Dr.
`
`Medvidovic referring to an allegedly infringing component of a WebSense product
`
`as a “log database.”) In addition, Dr. Davidson testified that storing data
`
`sequentially in a file does not mean the file is a “log file,” which undermines the
`
`basis for Patent Owner’s assertion that Swimmer’s audit trail cannot be a database.
`
`Ex. 2041, p. 34:2-19; see also Ex. 1034, p. 107:16-108:21 (Dr. Medvidovic
`
`describing the sequential nature of flat-file databases).
`
`Response to Observation #2:
`
`Here, Patent Owner mischaracterizes Petitioner’s argument. Petitioner did
`
`not assert that Swimmer’s audit trail was not a log file. Rather, Petitioner
`
`explained that Swimmer’s audit trail is not a “generic log file or ‘event log’” –
`
`because “it is a list of audit records (i.e., suspicious computer operations) that are
`
`organized in a particular format with each record having the same number and
`
`order of fields (i.e., a flat-file database).” Reply, p. 15 and Davidson Rep., ¶112-
`
`14 (addressing Patent Owner’s asserted distinction between an “event log” and a
`
`database in the ‘494 patent). Indeed, during his cross-examination, Dr. Davidson
`
`provided detailed testimony explaining why Swimmer’s audit trail meets the
`
`Board’s construction for the claimed database. Ex. 2041, p. 29:1-30:7, p. 19:21-
`
`2
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`21:10, p. 33:1-13, p. 45:16-54:3. Additionally, Patent Owner draws an overbroad
`
`and faulty conclusion from the cited testimony. As can be seen from the
`
`surrounding exchange, Dr. Davidson clearly testified that storing data sequentially
`
`in a file does not make the file a “log file” and, conversely, sequential ordering is
`
`not a “requirement” for all log files. Ex. 2041, p. 34:2-19.
`
`Response to Observation #3:
`
`In this observation, Patent Owner appears to be suggesting that Dr. Davidson
`
`acknowledged that it is always more efficient to use a log file rather than a
`
`database. This is incorrect. In the cited testimony, Dr. Davidson merely explains
`
`that there is a potential efficiency with regard to performing one particular task
`
`(i.e., writing data) when using log files and other sequentially-ordered files because
`
`it may be easier to add new data to the end of a file rather than inserting it in the
`
`middle. Moreover, Dr. Davidson and Dr. Medvidovic both agreed that databases
`
`themselves may be stored in sequentially-ordered files meaning that this same
`
`efficiency benefit would apply to such databases. Ex. 2041, p. 22:24-23:10; Ex.
`
`1034, p. 113:5-114:2; see also Reply, p. 18 (“the proper inquiry is simply whether
`
`a POSITA would have had an expectation of success when choosing to use a
`
`relational database”); see also Pet., p. 24-25 and Davidson Dec., ¶111 (describing
`
`various other advantages to using databases).
`
`3
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`Response to Observation #4:
`
`Once again, Patent Owner mischaracterizes Dr. Davidson’s testimony and
`
`disregards the immediately preceding testimony. In the uncited testimony, Dr.
`
`Davidson makes clear that the ‘194 patent merely distinguishes the type of data
`
`stored in the event log from the type of data stored in the security database.
`
`So you agree that the event log is distinct from a security
`Q.
`database in the '194 patent, correct?
`A.
`Yeah. In terms of what's being, you know, recorded
`there. I mean, it's the events as the system processes downloadable,
`you know, incoming downloadables.
`
`Ex. 2041, p. 85:16-86:8; see also Reply, p. 15 and Davidson Rep., ¶112-14
`
`(addressing Patent Owner’s asserted distinction between an “event log” and a
`
`database in the ‘494 patent). Contrary to Patent Owner’s assertion, this testimony
`
`does not contradict Petitioner’s interpretation of the claimed database. Instead, Dr.
`
`Davidson’s testimony is entirely consistent with Petitioner’s position throughout
`
`this proceeding, i.e., that Swimmer’s audit trail satisfies the claimed database under
`
`the construction proposed by Patent Owner and adopted by the Board. Pet., p. 19-
`
`20; Rep., p. 13-19; Davidson Pet., ¶107-13; Davidson Rep., ¶21-40.
`
`4
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`Response to Observation #5:
`
`Patent Owner’s observation is based on its mischaracterization and
`
`misunderstanding of Petitioner’s arguments concerning Swimmer. Contrary to
`
`Patent Owner’s assertion, Petitioner did not rely on any “converting step” in
`
`Swimmer as disclosing the claimed step of “storing … in a database.” Rather,
`
`Petitioner position – which has been consistent throughout this proceeding – is that
`
`Swimmer teaches that the audit trail data generated by the emulator is stored in
`
`“files” that are organized in a particular format (i.e., a flat-file database) and,
`
`therefore, satisfy the claimed “database.” Pet., p. 20; Reply, p. 14-15; Davidson
`
`Pet., ¶107-10; Davidson Rep., ¶11-19. Additionally, the fact that Swimmer teaches
`
`conversion from one type of flat-file database to another does nothing to contradict
`
`that those files are “stored,” as asserted by Petitioner. Indeed, Dr. Davidson
`
`provided reasons for why Swimmer teaches converting the data from one flat-file
`
`database to another. Ex. 2041, p. 24:16-30:7.
`
`Response to Observation #6:
`
`In this observation, Patent Owner mischaracterizes the cited testimony by
`
`concluding that Dr. Davidson recognizes that the claimed list of suspicious
`
`operations cannot be created without the additional step of deeming certain
`
`operations as suspicious. In the cited testimony, however, Dr. Davidson does not
`
`5
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`even mention any “additional step of deeming,” much less state that the claim
`
`language requires any such step. In fact, in the surrounding testimony, Dr.
`
`Davidson testified that: (i) the claims do not require deeming a subset of operations
`
`as suspicious; and (ii) even assuming this was required, Swimmer teaches deeming
`
`certain types of computer operations as suspicious.
`
`So you agree that computer operations must be first
`Q.
`deemed suspicious in order to qualify as a list of suspicious computer
`operations, correct?
`A. What I'm saying is that what Swimmer teaches is that
`these operating system calls are suspicious operating -- he's deeming
`those suspicious and he's writing those to his, you know, database.
`
`Ex. 2041, p. 80:24-81:9.
`
`Q. Why did you write this sentence that Swimmer's audit
`trail lists a subset of operations if it's not required?
`A.
`Because, and again, this is the reference here, that in the
`response there was an argument that it had to be a subset. The claims
`don't say that. I mean, it turns out that Swimmer, you know, he's again
`emulating the thing, the downloadable thing, and what he's writing to
`this is what's being deemed potentially suspicious. Turns out is a
`subset of the operations that are executed by the --when he does an
`emulation -- emulated execution of the downloadable. It is a subset.
`He's not recording everything. He's only recording the things that have
`been, you know, deemed to be suspicious. Namely, you know, the
`
`6
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`operating system calls. He's not recording every add, subtract, divide
`kind of operation.
`
`Ex. 2041, p. 77:13-78:6.
`
`So in your opinion the claimed list of suspicious
`Q.
`computer operations for a downloadable can be all possible computer
`operations, correct?
`A.
`I think the way the claim reads it says includes, and so as
`long as you include them, you know, the potentially suspicious
`operations, that you meet the claim language. It turns out Swimmer's
`actually storing in the database essentially exactly the same operations
`that are discussed in the '194 patent, things like open file, read, write,
`those things. And he's not recording things -- I mean, again, you can
`look at the example and he tells you that things like add and subtract,
`those operations.
`
`Ex. 2041, p. 78:18-79:7.
`
`So a listing of all possible computer operations without
`Q.
`deeming any computer operations suspicious...
`A. Well, the fact that you're recording them means that
`they're suspicious.
`
`Ex. 2041, p. 79:22-80:1; see also Ex. 2014, p. 18:4-16; Ex. 1034, p. 92:16-
`
`95:3. Contrary to Patent Owner’s assertions, this testimony is also entirely
`
`consistent with Petitioner’s positions as set forth in the reply. Reply, p. 5-6,
`
`11.
`
`7
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`Response to Observation #7:
`
`Patent Owner asserts that Patent Owner has mapped Swimmer’s
`
`functionality of generating an audit trail to both the “deriving” and “storing”
`
`aspects of the challenged claims. This is simply not true. See Pet., p. 16-18
`
`(discussing derivation by emulator) and 19-20 (discussing audit records stored in a
`
`“sequential file”); Reply, p. 14-15 (storing in a file); Davidson Pet., ¶98-106
`
`(discussing derivation by emulator) and ¶107-13 (discussing audit records stored in
`
`a “sequential file”); Davidson Rep., ¶41, 49-52, 110 (discussing emulator) and ¶11-
`
`19 (discussing storage in files). To the extent Patent Owner is asserting that the
`
`entire security profile must be derived before it is stored, Swimmer also teaches
`
`this. Reply, p. 17; Davidson Rep., ¶ 46. Also, Dr. Davidson repeatedly testified
`
`that the emulator derives the audit trail data and that it is also then stored in a file,
`
`contrary to Patent Owner’s contention.
`
`What's happening is there's -- in terms of Swimmer, the
`emulator is emulating the downloadable and observing, you know,
`and then writing to the audit trail, the suspicious operations which are,
`in this case, the operating -- typically the operating system commands.
`Q.
`So just to be clear, I'm asking about two terms,
`Swimmer's stream of data and then another term in Swimmer called
`the audit trail. My question is, are you saying that these two are
`completely different from each other?
`
`8
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`No. The stream of data that the emulator is producing and
`A.
`then, you know, is stored, it's stored in the audit trail. So there's this
`process of emulating and that's creating this, determining this data that
`then is stored in the audit trail.
`Q.
`In your opinion, how is a stream of data different from
`Swimmer's audit trail?
`A.
`The stream of data is what's being stored in audit trail, it's
`being created, you know, by the emulator and stored in the audit trail.
`So in that, you know -- I mean, what's being stored is what's being
`created. It's being created and then stored.
`
`Ex. 2041, p. 17:1-18:3.
`Q.
`Isn't Swimmer's stream of data in the form of a file?
`A.
`The audit trail is in the form of a file.
`Q.
`How about the stream of data?
`A.
`Again, in terms of Swimmer, you know, you kind of
`distinguish between this data has to be created, it has to be derived
`and then, you know, written to the audit trail. And so the audit trail,
`you know, would distinguish like when something is created and then
`it's stored in this audit trail, which is a file.
`Q.
`So in what form is Swimmer's stream of data?
`A.
`It's internally in the emulator, they're again storing
`information as they're emulating this downloadable and emulating the
`instructions that are being, you know, done. They're keeping track of
`the operations, they're keeping track of the arguments. And so that's
`being created, that's the stream of data. And then it's being written to
`the audit trail.
`
`9
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`Just to be clear, the stream of data is different from an
`Q.
`audit trail in your opinion, correct?
`A.
`The stream of data is being created and then, you know,
`what that is, it's being written to the audit trail.
`Ex. 2041, p. 18:17-19:20.; see also Ex. 2041, p. 33:1-13; p. 45:4-15; p. 58:8-
`17, p. 59:25-60:11, p. 61:25-66:8, and p. 71:25-73:17 (discussing
`Swimmer’s code scanner/emulator for deriving); Ex. 2041, p. 66:9-71:18
`(discussing Swimmer’s database manager components for storing).
`
`Response to Observation #8:
`
`In this observation, Patent Owner asserts that, because Swimmer’s emulator
`
`can only execute binary code, it cannot be used to emulate program scripts (as
`
`required by claims 5 and 14). This conclusion is flawed and not supported by the
`
`cited testimony. Indeed, as set forth in the Petition and Reply, one of ordinary skill
`
`in the art would have found it obvious to use Swimmer’s emulator to generate,
`
`store, and analyze an audit trail for a program script by using a binary script
`
`interpreter program. Pet., p. 22; Reply, p. 19; Davidson Dec., ¶121-124; Davidson
`
`Rep., ¶101-11; Davidson 1st Tr., p. 116:15-118:15.
`
`Response to Observation #9:
`
`Petitioner objects to this observation on the basis that it attempts to argue
`
`that certain evidence (Denning and Comer) submitted with Petitioner’s reply was
`
`10
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`outside the scope of a proper reply under 37 C.F.R. § 42.23(b). See Order Conduct
`
`of the Proceedings, paper 37 (directing Patent Owner to file a two page paper
`
`without any argument listing citations to portions of the reply alleged to be
`
`outside the scope). Moreover, contrary to Patent Owner’s assertions, the fact that
`
`evidence could have been submitted with a Petition does not mean the evidence
`
`cannot be submitted with a reply. See e.g., Altaire Pharm., Inc. v. Pargaon
`
`Bioteck, Inc., PGR2015-00011, Paper 38 (PTAB May 18, 2016), p. 1. Moreover,
`
`Dr. Davidson made clear that, in forming his opinions in support of the Petition, he
`
`considered Denning and Comer as part of the background knowledge of one of
`
`ordinary skill in the art. Ex. 2041, p. 10:4-14, p. 12:6-19. Dr. Davidson also
`
`testified that this evidence was then included in the reply to clarify and rebut
`
`specific issues raised in Patent Owner’s response. Ex. 2041, p. 8:20-10:3, p. 11:7-
`
`12:5. Further, Patent Owner was put on notice in the Petition as to the issues this
`
`evidence was directed to namely, whether Swimmer’s audit trail is a flat file
`
`database (Comer) and whether it would have obvious to use a relational database to
`
`store audit records (Denning). Pet., p. 19, 24-25. Additionally, Patent Owner’s
`
`objections to Petitioner’s reliance on the Denning reference is unreasonable, given
`
`that Patent Owner itself already cited to and discussed Denning in its response as
`
`well as in Dr. Medvidovic’s supporting declaration. PO Resp., p. 25; Medvidovic
`
`Decl., ¶98.
`
`11
`
`
`
`Date: November 22, 2016
`
`Respectfully submitted,
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`By: /Joseph J. Richetti/
`Joseph J. Richetti (Reg. No. 47,024)
`BRYAN CAVE LLP
`Attorney for Petitioner – Symantec
`Corporation
`
`By: /Michael T. Rosato/
`Michael T. Rosato (Reg. No. 52,182)
`WILSON SONSINI GOODRICH & ROSATI
`Attorney for Petitioner – Blue Coat
`Systems, Inc.
`
`12
`
`
`
`Case IPR2015-01892
`U.S. Patent No. 8,677,494
`
`CERTIFICATE OF SERVICE
`
`The undersigned hereby certifies that the foregoing PETITIONER'S
`RESPONSE TO PATENT OWNER’S OBSERVATIONS ON CROSS-
`EXAMINATION OF DR. JACK W. DAVIDSON, was served electronically via e-
`mail on November 22, 2016, in its entirety on the following counsel for Patent
`Owner:
`
`James Hannah
`KRAMER LEVIN NAFTALIS &
`FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`jhannah@kramerlevin.com
`
`Michael Kim
`Finjan, Inc.
`2000 University Ave., Ste. 600
`E. Palo Alto, CA 94303
`mkim@finjan.com
`
`Respectfully submitted,
`
`By: /Joseph J. Richetti/
`Joseph J. Richetti (Reg. No. 47,024)
`BRYAN CAVE LLP
`1290 Avenue of the Americas
`New York, NY 10104
`Tel: (212) 541-1092
`Fax: (212) 541-4630
`joe.richetti@bryancave.com
`
`Attorney for Petitioner– Symantec
`Corporation
`
`Date: November 22, 2016
`
`Jeffrey H. Price
`KRAMER LEVIN NAFTALIS &
`FRANKEL LLP
`1177 Avenue of the Americas
`New York, NY 10036
`jprice@kramerlevin.com
`
`By: /Michael T. Rosato/
`Michael T. Rosato (Reg. No. 52,182)
`WILSON SONSINI GOODRICH &
`ROSATI
`701 Fifth Avenue, Suite 5100
`Seattle, WA 98104
`Tel: (206) 883-2529
`Fax: (206) 883-2699
`mrosato@wsgr.com
`
`Attorney for Petitioner– Blue Coat
`Systems, Inc.