`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`__________________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`___________________
`
`PALO ALTO NETWORKS, INC. and
`BLUE COAT SYSTEM LLC,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`
`____________________
`
`Case IPR2016-001591
`Patent No. 8,677,494
`
`__________________________________________________________
`
`PATENT OWNER’S REQUEST FOR REHEARING
`PURSUANT TO 37 C.F.R. § 42.71
`
`
`
`
`1 Case IPR2016-01174 has been joined with this proceeding.
`
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`
`
`I.
`
`INTRODUCTION
`
`Petitioners failed to disclose an inconsistent opinion from their own expert
`
`that directly contradicts the positions they advanced in this matter, thereby
`
`misleading the Board and flouting their discovery obligations. As a result, the
`
`Board misapprehended the claim language and prior art while invalidating claims
`
`1, 2, and 6 of the challenged patent. Specifically, Petitioners argued before this
`
`Board that the emulator disclosed in Swimmer saves a list of all operations
`
`attempted by a downloadable and therefore meets the definition of “a list of
`
`suspicious computer operations.” But just ten days after the Board issued its final
`
`written decision, Petitioners served an expert report that repeatedly and
`
`unequivocally states that a list of all operations attempted by a downloadable
`
`“cannot be a ‘list of suspicious computer operations.’” Indeed, Petitioners’ expert
`
`states that a list of operations – including the exact same types of operations that
`
`Petitioners argued the Swimmer reference disclosed – could not meet the same
`
`claim language. Thus, Petitioners now expressly renounce the very arguments they
`
`made before this Board, on which the Board relied to invalidate claims 1, 2, and 6.
`
`Good cause exists to consider Petitioners’ conflicting expert report on
`
`rehearing. Despite Petitioners’ duty to disclose this evidence during routine
`
`discovery, they waited until after the Board issued its final written decision to do
`
`so. Consequently, Patent Owner could not have submitted this evidence as part of
`
`- 1 -
`
`
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`its original response because it was unaware that Petitioners planned to reverse
`
`their position. But Petitioners knew all along that their expert would present a
`
`contrary opinion in the District Court. And they surely began drafting the highly
`
`technical, 217-page report long before the Board issued its final written decision –
`
`because they disclosed it just ten days later. In light of Petitioners’ gamesmanship,
`
`which also violates their duty of candor when practicing before the U.S.P.T.O., the
`
`Board should rehear this matter and consider Petitioners’ inconsistent positions.
`
`II.
`
`STATEMENT OF REQUESTED RELIEF
`
`Patent Owner requests that the Board reverse its original decision on claims
`
`1, 2, and 6 (Paper 50) and hold that these claims are patentable.
`
`III. BACKGROUND
`
`On November 6, 2015, Palo Alto Networks, Inc. filed a petition (the
`
`“Petition”) requesting inter partes review of claims 1-18 of U.S. Patent No.
`
`8,677,494 (the “‘494 Patent”). On June 10, 2016, Blue Coat Systems, Inc. also
`
`filed a petition requesting inter partes review of claims 1-6 and 10-15 of the ‘494
`
`Patent, along with a motion to join the petition previously filed by Palo Alto
`
`Networks, Inc. The arguments in both petitions filed by Blue Coat Systems, Inc.
`
`and Palo Alto Networks, Inc. are identical with regard to Swimmer and claims 1, 2,
`
`and 6. On August 12, 2016, Patent Owner Finjan, Inc. (“Patent Owner”) filed a
`
`Response to the petition filed by Palo Alto Networks, Inc. On October 4, 2016, the
`
`- 2 -
`
`
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`Patent Trial and Appeal Board (the “Board”) instituted a trial pursuant to 35 U.S.C.
`
`§ 314(a) with respect to claims 1–6 and 10–15 of the ‘494 Patent, and joined the
`
`petitions of both Blue Coat Systems, Inc. and Palo Alto Networks, Inc.
`
`(collectively, “Petitioners”). Petitioners filed a Reply on November 16, 2016
`
`(Paper 26, the “Reply”).
`
`After oral argument on February 16, 2017, the Board issued a final written
`
`decision on April 11, 2017, invalidating claims 1, 2, and 6 of the ‘494 Patent, but
`
`upholding claims 3-5 and 10-15 as valid. Ten days later, on April 21, 2017,
`
`Petitioner Blue Coat Systems, Inc. served the Rebuttal Expert Report of Dr. Seth
`
`Nielson Regarding Noninfringement (the “Report”) in the underlying action
`
`between Patent Owner and Petitioner Blue Coat Systems, Inc. N.D. Cal. Case. No.
`
`15-cv-03295-BLF-SVK. The Report directly contradicts Petitioners’ arguments
`
`before the Board regarding Swimmer and claims 1, 2, and 6.
`
`IV. ARGUMENT
`A. Good Cause Exists to Consider the Nielson Report
`The Board may consider new evidence on a Request for Rehearing where
`
`there is good cause to do so. Office Patent Trial Practice Guide, 77 Fed. Reg.
`
`48,756, 48,768 (Aug. 14, 2012) (“Evidence not already of record at the time of the
`
`decision will not be admitted absent a showing of good cause.”). In Google Inc. v.
`
`SimpleAir, Inc., CBM2014-00170, Paper 14 at 3 (P.T.A.B. Feb. 20, 2015), the
`
`- 3 -
`
`
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`Board acknowledged that a petitioner may submit new evidence with a Request for
`
`Rehearing, but ultimately found no good cause to consider that evidence because
`
`the petitioner could have submitted it with its opening brief. “We cannot discern a
`
`persuasive reason why Petitioner’s declarant could not have offered this testimony
`
`in the original declaration.” Id. at 3.
`
`By contrast, here Patent Owner was unable to cite these inconsistent
`
`statements in its Response because Petitioners hid them from Patent Owner (and
`
`the Board) until ten days after the Board issued its final written decision.
`
`Petitioners certainly knew beforehand that their expert would contradict their
`
`arguments, as the Report consists of 217 pages of detailed technical analysis and it
`
`is unlikely that Petitioners drafted it in those intervening ten days. Further, the
`
`Report was offered to rebut Patent Owner’s own expert report on infringement,
`
`which Patent Owner served on Petitioners on March 29, 2017, two weeks before
`
`the final written decision issued. The Federal Circuit has held that, in patent cases,
`
`a showing of “’good cause’ requires a showing of diligence.” 02 Micro Int'l Ltd. v.
`
`Monolithic Power Sys., Inc., 467 F.3d 1355, 1366 (Fed. Cir. 2006). Here, Patent
`
`Owner was diligent in its discovery and presentation of the evidence. Notably,
`
`Patent Owner has always asserted consistent positions between its infringement
`
`arguments and its arguments before the Board. But Petitioners were not diligent;
`
`they knowingly failed to meet their duty to disclose evidence of an inconsistent
`
`- 4 -
`
`
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`position – and their duty of candor – and as a result they impeded Patent Owner’s
`
`right to a fair hearing. See Office Patent Trial Practice Guide, 77 Fed. Reg. 48,756,
`
`48,761 (Aug. 14, 2012) (holding that parties to an inter partes review have a
`
`routine duty of discovery to disclose inconsistent statements);2 BlackBerry Corp. v.
`
`Wi-Lan USA Inc., IPR2013-00126 (JL), Paper 15 at 2 (P.T.A.B. Aug. 19, 2013)
`
`(holding routine discovery is self-executing and self-enforcing; parties have the
`
`burden to produce it).
`
`Petitioners’ contradictory statements and lack of disclosure terminated
`
`Patent Owner’s rights to enforce claims 1, 2 and 6 of the ‘494 Patent. Petitioners
`
`must not be allowed to severely prejudice Patent Owner in this manner through
`
`improper acts. Accordingly, good cause exists for the Board to rehear this inter
`
`partes review and consider the Report.
`
`
`2 “The following situations exemplify instances where disclosures of inconsistent
`
`statements are to be made. Example 1: where a petitioner relies upon an expert
`
`affidavit alleging that a method described in a patent cannot be carried out, the
`
`petitioner would be required to provide any non-privileged work undertaken by, or
`
`on behalf of, the petitioner that is inconsistent with the contentions in the expert’s
`
`affidavit.” Office Patent Trial Practice Guide, 77 Fed. Reg. 48,756 at 48,761.
`
`- 5 -
`
`
`
`
`
`B.
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`The Nielson Report Denies that Swimmer Disclosed a “List
`of Suspicious Computer Operations”
`1. A list of all operations does not meet the claim language
`
`Petitioners’ expert directly contradicts the position that Petitioners asserted
`
`throughout this inter partes review, and now candidly admits that a list of all
`
`operations performed by a downloadable cannot be considered a “list of suspicious
`
`computer operations.” Ex. 2050, Report at ¶ 332. But in both their original
`
`Petitions and their Reply, Petitioners argued the exact opposite, stating: “Swimmer
`
`identifies a software emulator as an example of an audit system… [that] monitors a
`
`program by deriving and recording activity data, including a list of functions” that
`
`a downloadable attempts to invoke. Reply at 8. Petitioners claimed that these
`
`“audit records ‘represent[] the program behavior in general’” and that “Swimmer’s
`
`emulator monitors program activity.” Id. Petitioners also claimed, “Swimmer’s
`
`VIDES system uses an emulator to monitor the execution of application programs
`
`(Downloadables), generating a stream of ‘activity data’ that can be used to
`
`construct rules for detecting computer viruses.” Petition at 44. Moreover,
`
`Swimmer itself teaches that an “emulation is a program which accepts the entire
`
`instruction set of a processor as input, and interprets the binary code as the original
`
`processor would. All other elements of the machine must be implemented or
`
`emulated.” Ex. 1006, Swimmer at 8 (emphasis added).
`
`- 6 -
`
`
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`Based on Petitioners’ arguments, the Board invalidated claims 1, 2, and 6 of
`
`the ‘494 Patent, finding that the “list of suspicious computer operations” disclosed
`
`in claim 1 does not require that the list consist only of suspicious operations. In
`
`doing so, the Board rejected Patent Owner’s argument that a limitation requiring a
`
`“list of suspicious operations” cannot be met simply by listing all operations that a
`
`downloadable attempts. Paper 50, Final Written Decision at 30.
`
`Less than six months after Petitioners filed their Reply – and just ten days
`
`after the Board issued its final written decision – Petitioner Blue Coat Systems,
`
`Inc. submitted the Report, which completely reverses its position. The Report
`
`contends that a list of all events recorded by an emulator cannot comprise a list of
`
`suspicious computer operations. As Dr. Nielson plainly states: “Event data cannot
`
`be ‘a list of suspicious computer operations’ – it is a list of all computer operations
`
`performed by a sample. Most of these events are not suspicious – in fact, it may be
`
`that none are.” Ex. 2050, Report at ¶ 332 (emphasis in original). Thus,
`
`Petitioners’ expert concedes that the log of event data described in Swimmer does
`
`not teach the “list of suspicious computer operations” limitation.
`
`A quick review of the Report’s subject matter emphasizes the conflict
`
`between Petitioners’ duplicitous arguments. Petitioner Blue Coat Systems, Inc.
`
`sells a product called the Malware Analysis Appliance (MAA). In his Report, Dr.
`
`Nielson explains that the MAA performs dynamic analysis through emulation,
`
`- 7 -
`
`
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`which allows a downloadable to run while monitoring the events it performs
`
`(sometimes called “detonation”). Id. at ¶ 67. “As the sample is running, MAA
`
`keeps track of its behavior, called ‘events,’ such as network events and file system
`
`events.” Id. at ¶ 328 (emphasis added). These network and file system “events”
`
`are then “saved to a disk in a ‘Google Protocol Buffers’ serialization format.” Id.
`
`Later, the event logs are matched to analyst-created “patterns” and this pattern-
`
`matching renders a risk score between 1 and 10. Id.; see also Ex. 2051 at 64-65,
`
`Blue Coat Malware Analysis Appliance 4.2.11 Admin. Guide (discussing pattern
`
`matching and risk scores); Ex. 2052 at 4, Blue Coat MAA Datasheet (same).
`
`Dr. Nielson argues that the list of captured events (including network and
`
`file system events), which MAA generates and “save[s] to a disk in a ‘Google
`
`Protocol Buffers’ serialization format” is not a list of suspicious computer
`
`operations.” Ex. 2050, Report at ¶¶ 328, 332 (stating the only thing that MAA’s
`
`data-stores can store is “a log of all events generated during detonation”). Dr.
`
`Nielson states that MAA’s log of events is not a “list of suspicious computer
`
`operations.”3 Id. at ¶ 333 (“As stated above, a listing of all events observed during
`
`
`3 It should be noted that Finjan disagrees with Dr. Nielson’s characterization of the
`
`operation of MAA and the information that MAA stores. However, Finjan’s
`
`disagreement with the operation of the MAA is inconsequential to Dr. Nielson’s
`
`- 8 -
`
`
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`detonation is not ‘a list of suspicious operations,’ and therefore does not comprise
`
`the claimed security profile data.”).
`
`2. Petitioners’ expert admits that Swimmer does
`not teach the claim language
`
`Even more egregious are the events that Petitioners’ expert identifies in his
`
`report as not being suspicious operations even though Petitioners took the exact
`
`opposite position during the IPR proceedings. See Reply at 9 (identifying “Open
`
`File,” “Close File,” creating a file, modifying a file, write to file operations,
`
`making calls to a file system, making calls to a network, and making calls to a
`
`memory as examples of events that meet the claim language). Indeed, Dr. Nielson
`
`states that MAA logs those same types of events: “As the sample is running, MAA
`
`keeps track of its behavior, called ‘events,’ such as network events and file system
`
`events.” Ex. 2050, Report at ¶ 328 (emphasis added); id. at ¶ 67 (stating MAA
`
`logs “various actions performed both in user programs (such as Adobe) and in the
`
`operating system kernel”); see also Ex. 2051 at 28-29, 64-65, Blue Coat Malware
`
`Analysis Appliance 4.2.11 Admin. Guide (showing that MAA logs file system
`
`events and registry events). But again, Dr. Nielson maintains that MAA does not
`
`opinion that an emulator that generates a list of all operations is not a list of
`
`suspicious operations, which is directly contrary to Petitioners’ position during the
`
`IPR proceedings.
`
`- 9 -
`
`
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`store a “list of suspicious computer operations,” thereby admitting Swimmer does
`
`not teach that limitation in the claim language.
`
`C.
`
`Petitioners Violated Their Duty of Candor
`
`All attorneys have a duty of candor when practicing before the U.S.P.T.O.
`
`See 37 C.F.R. § 11.303 - Candor toward the tribunal. Petitioners violated this
`
`duty, among others, when they failed to inform the Board of their pending,
`
`conflicting Report. The Board cannot condone such actions and should rehear this
`
`matter.
`
`V. CONCLUSION
`
`Throughout these proceedings, and across all actions involving the ‘494
`
`Patent, Patent Owner has maintained consistent infringement positions and claim
`
`language interpretations. In order to avoid substantial prejudice to Patent Owner as
`
`a result of improper gamesmanship by Petitioners, the Board should grant this
`
`Request for Rehearing, consider the inconsistent statements in the Report, and
`
`validate claims 1, 2, and 6 of the ‘494 Patent.
`
`- 10 -
`
`
`
`
`
`Dated: May 11, 2017
`
`
`(Case No. IPR2016-00159)
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`Respectfully submitted,
`
`
`
`
`
`/James Hannah/
`
`James Hannah (Reg. No. 56,369)
`jhannah@kramerlevin.com
`Kramer Levin Naftalis & Frankel LLP
`990 Marsh Road
`Menlo Park, CA 94025
`Tel: 650.752.1700 Fax: 212.715.8000
`
`Jeffrey H. Price (Reg. No. 69,141)
`jprice@kramerlevin.com
`Kramer Levin Naftalis & Frankel LLP
`1177 Avenue of the Americas
`New York, NY 10036
`Tel: 212.715.7502 Fax: 212.715.8302
`
`Attorneys for Patent Owner
`
`- 11 -
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`CERTIFICATE OF SERVICE
`
`Pursuant to 37 C.F.R. § 42.6(e), the undersigned certifies that a true and
`
`correct copy of the foregoing Patent Owner’s Request for Rehearing was served
`
`May 11, 2017, by filing this document through the PTAB E2E system as well as
`
`delivering via electronic mail upon the following counsel of record for Petitioner:
`
`Orion Armon
`Brian Eutermoser
`COOLEY LLP
`380 Interlocken Crescent, Suite 900
`Broomfield, Colorado 80021
`oarmon@cooley.com
`beutermoser@cooley.com
`zpatdcdocketing@cooley.com
`
`Max Colice
`COOLEY LLP
`500 Boylston Street, 14th Floor
`Boston, Massachusetts 02116-3736
`mcolice@cooley.com
`zpatdcdocketing@cooley.com
`
`Jennifer Volk-Fortier
`COOLEY LLP
`One Freedom Square
`Reston Town Center
`11951 Freedom Drive
`Reston, Virginia 2019
`jvolkfortier@cooley.com
`zpatdcdocketing@cooley.com
`
`
`- 12 -
`
`
`
`Patent Owner’s Request for Rehearing
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`Michael T. Rosato
`Andrew. S. Brown
`WILSON SONSINI GOODRICH & ROSATI
`701 Fifth Avenue, Suite 5100
`Seattle, WA 98104-7036
`mrosato@wsgr.com
`asbrown@wsgr.com
`
`Neil N. Desai
`WILSON SONSINI GOODRICH & ROSATI
`633 West Fifth Street, 15th Floor
`Los Angeles, CA 90071-2027
`ndesai@wsgr.com
`
`
`
`
`
`
`
`
`
` /James Hannah/
`James Hannah (Reg. No. 56,369)
`Kramer Levin Naftalis & Frankel LLP
`990 Marsh Road,
`Menlo Park, CA 94025
`(650) 752-1700
`
`
`
`- 13 -
`
`
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
