Michael John. Dean et al.

Patent Trials and Appeals Board

Aug 22, 2019

13665636 - (D) (P.T.A.B. Aug. 22, 2019)

UNITED STATES PATENT AND TRADEMARK OFFICE
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
13/665,636 10/31/2012 Michael John Dean EXP.533A 4668
20995 7590 08/22/2019
KNOBBE MARTENS OLSON & BEAR LLP
2040 MAIN STREET
FOURTEENTH FLOOR
IRVINE, CA 92614
EXAMINER
NGUYEN, TIEN C
ART UNIT PAPER NUMBER
3694
NOTIFICATION DATE DELIVERY MODE
08/22/2019 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
efiling@knobbe.com
jayna.cartee@knobbe.com
PTOL-90A (Rev. 04/07)

UNITED STATES PATENT AND TRADEMARK OFFICE
____________________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
____________________

Ex parte MICHAEL JOHN DEAN and
MARK JOSEPH KAPCZYNSKI
____________________

Appeal 2018–006821
Application 13/665,6361
Technology Center 3600
____________________

Before ST. JOHN COURTENAY III, LARRY J. HUME, and
PHILLIP A. BENNETT, Administrative Patent Judges.

HUME, Administrative Patent Judge.

DECISION ON APPEAL
This is a decision on appeal under 35 U.S.C. § 134(a) of the Final
Rejection of claims 1, 3–6, and 8–16, which are all claims pending in the
application. Appellants have canceled claims 2 and 7. We have jurisdiction
under 35 U.S.C. § 6(b).
We AFFIRM.

1 According to Appellants, the real party in interest is Consumerinfo.com, a
subsidiary of Experian. App. Br. 3.
Appeal 2018–006821
Application 13/665,636

2
STATEMENT OF THE CASE2
The Invention
Appellants’ disclosed embodiments and claimed invention relate to
“pre-breach data monitoring that may be used to detect possible breaches of
personal information, such as information of customers and/or employees of
a company.” Spec. ¶ 4.
Exemplary Claim
Claim 1, reproduced below, is representative of the subject matter on
appeal (limitations numbered and labeled):
1. A method of monitoring online data to determine a
risk of data breach associated with customers of a requesting
entity, the method comprising:
by a computing system having one or more hardware
computer processors executing software instructions stored on a
non-transitory computer readable medium:
[1] accessing, by the computing system, a scan list
comprising one or more pieces of identification information
regarding each of a plurality of customers of a requesting entity,
each of the customers having provided the requesting entity
with personally identifying information in establishing an
account with the requesting entity, wherein the one or more
pieces of identification information include at least a name and
at least partial credit card number of the respective customers;
[2] accessing one or more rules set by the requesting
entity, the one or more rules including at least a frequency
criteria indicating a requested frequency for the computing

2 Our decision relies upon Appellants’ Appeal Brief (“App. Br.,” filed
Jan. 8, 2018); Reply Brief (“Reply Br.,” filed June 19, 2018); Examiner’s
Answer (“Ans.,” mailed April 20, 2018); Final Office Action (“Final Act.,”
mailed Mar. 24, 2017); and the original Specification (“Spec.,” filed
Oct. 31, 2012 ).
Appeal 2018–006821
Application 13/665,636

3
system to provide a risk assessment user interface regarding the
plurality of customers on the scan list;
in accordance with the one or more rules, for each of the
plurality of customers on the scan list:
[3] periodically scanning a plurality of third party data
sources for data items including any of the one or more pieces
of identification information regarding the customer, wherein
the third party data sources include at least:
a public Internet data source,
a dark web data source, and
a social media data source;
[4] for each detected piece of identification information
regarding the customer that is identified in the third party data
sources, categorizing the detected piece of identification
information into one of a plurality of data breach risk
categories;
[5] determining, for each of the plurality of data breach
risk categories, a quantity of detected pieces of identification
information regarding the customer in the plurality of third
party data sources;
for each of the plurality of data breach risk categories:
[6] determining a total quantity of located pieces of
identification information associated with the data breach risk
category across all of the plurality of customers;
[7] accessing a previous total quantity of located pieces
of identification information associated with the data breach
risk category across all of the plurality of customers during a
previous periodic scanning;
[8] determining a category risk score indicating a
percentage change between the total quantity of located pieces
of identification information and the previous total quantity of
located pieces of identification information, wherein positive
category risk scores are indicative of increases in risk of data
breach associated with the requesting entity while negative
Appeal 2018–006821
Application 13/665,636

4
category risk scores are indicative of decreases in risk of data
breach associated with the requesting entity; and
[9] in response to determining that the category risk score
exceeds a threshold, including the category risk score in a real-
time alert transmission to the requesting entity, the alert
providing an early breach notification to the requesting entity,
wherein the alert includes a hyperlink to connect to the
computing system over the Internet to obtain additional
information regarding the data breach risk category; and
[10] generating an assessment user interface including an
assessment of potential or actual data breach associated with the
requesting entity, the assessment user interface indicating the
plurality of category risk scores, wherein the assessment is
usable to determine changes over time in exposure of respective
types of personal information, including names and credit card
numbers, of the plurality of customers on the scan list.
Rejection on Appeal
Claims stand rejected under 35 U.S.C. § 101 as being directed to
patent-ineligible subject matter. Final Act. 2.
CLAIM GROUPING
Based on Appellants’ arguments (App. Br. 9–22) and our discretion
under 37 C.F.R. § 41.37(c)(1)(iv), we decide the appeal of the patent-
ineligible subject matter rejection of claims 1, 3–6, and 8–16 on the basis of
representative claim 1.

Appeal 2018–006821
Application 13/665,636

5
ISSUE
Appellants argue (App. Br. 9–22; Reply Br. 2–8) the Examiner’s
rejection of claim 1 under 35 U.S.C. § 101 as being directed to patent-
ineligible subject matter is in error. These contentions present us with the
following issue:
Under the USPTO’s Revised Guidance, informed by our governing
case law concerning 35 U.S.C. § 101, is claim 1 patent-ineligible under
§ 101?
PRINCIPLES OF LAW
A. 35 U.S.C. § 101
“Eligibility under 35 U.S.C. § 101 is a question of law, based on
underlying facts.” SAP America, Inc. v. InvestPic, LLC, 898 F.3d 1161,
1166 (Fed. Cir. 2018).
An invention is patent-eligible if it claims a “new and useful process,
machine, manufacture, or composition of matter.” 35 U.S.C. § 101.3
However, the Supreme Court has long interpreted 35 U.S.C. § 101 to include
implicit exceptions: “[l]aws of nature, natural phenomena, and abstract
ideas” are not patentable. Mayo Collaborative Servs. v. Prometheus Labs.,
Inc., 566 U.S. 66, 70 (2012) (brackets in original) (citing Diamond v. Diehr,
450 U.S. 175, 185 (1981)).

3 This threshold analysis of whether a claim is directed to one of the four
statutory categories of invention, i.e., a process, machine, manufacture, or
composition of matter, is referred to as “Step 1” in the USPTO’s patent-
eligibility analysis under § 101. MPEP § 2106.
Appeal 2018–006821
Application 13/665,636

6
In determining whether a claim falls within an excluded category, we
are guided by the Supreme Court’s two-step framework, described in Mayo
and Alice. Alice Corp. v. CLS Bank Int’l, 573 U.S. 208, 217–18 (2014)
(citing Mayo, 566 U.S. at 75–77). In accordance with that framework, we
first determine what concept the claim is “directed to.” See Alice, 573 U.S.
at 219 (“On their face, the claims before us are drawn to the concept of
intermediated settlement, i.e., the use of a third party to mitigate settlement
risk.”); see also Bilski v. Kappos, 561 U.S. 593, 611 (2010) (“Claims 1 and 4
in petitioners’ application explain the basic concept of hedging, or protecting
against risk . . . .”).
Concepts determined to be abstract ideas, and thus patent ineligible,
include certain methods of organizing human activity, such as fundamental
economic practices (Alice, 573 U.S. at 219–20; Bilski, 561 U.S. at 611);
mathematical formulas (Parker v. Flook, 437 U.S. 584, 594–95 (1978)); and
mental processes (Gottschalk v. Benson, 409 U.S. 63, 67 (1972)). Concepts
determined to be patent eligible include physical and chemical processes,
such as “molding rubber products” (Diehr, 450 U.S. at 191); “tanning,
dyeing, making water-proof cloth, vulcanizing India rubber, smelting ores”
(id. at 182 n.7 (quoting Corning v. Burden, 56 U.S. 252, 267–68 (1853)));
and manufacturing flour (Benson, 409 U.S. at 69 (citing Cochrane v.
Deener, 94 U.S. 780, 785 (1876))).
In Diehr, the claim at issue recited a mathematical formula, but the
Supreme Court held “[a] claim drawn to subject matter otherwise statutory
does not become nonstatutory simply because it uses a mathematical
formula.” Diehr, 450 U.S. at 187; see also id. at 191 (“We view
respondents’ claims as nothing more than a process for molding rubber
Appeal 2018–006821
Application 13/665,636

7
products and not as an attempt to patent a mathematical formula.”). Having
said that, the Supreme Court also indicated that a claim “seeking patent
protection for that formula in the abstract . . . is not accorded the protection
of our patent laws, and this principle cannot be circumvented by attempting
to limit the use of the formula to a particular technological environment.”
Id. (citation omitted) (citing Benson and Flook); see, e.g., id. at 187 (“It is
now commonplace that an application of a law of nature or mathematical
formula to a known structure or process may well be deserving of patent
protection.”).
Abstract ideas may include, but are not limited to, fundamental
economic practices, methods of organizing human activities, and
mathematical formulas or relationships. Alice, 573 U.S. at 217–21. Under
this guidance, we must therefore ensure at step one that we articulate what
the claims are directed to with enough specificity to ensure the step one
inquiry is meaningful. Id. at 217 (“[W]e tread carefully in construing this
exclusionary principle lest it swallow all of patent law.”).
If the claim is “directed to” an abstract idea, we turn to the second
step of the Alice and Mayo framework, where “we must examine the
elements of the claim to determine whether it contains an ‘“inventive
concept”’ sufficient to ‘transform’ the claimed abstract idea into a patent-
eligible application.” Alice, 573 U.S. at 221 (citation omitted). “A claim
that recites an abstract idea must include ‘additional features’ to ensure ‘that
the [claim] is more than a drafting effort designed to monopolize the
[abstract idea].’” Id. (alterations in original) (quoting Mayo, 566 U.S. at 77).
“[M]erely requir[ing] generic computer implementation[] fail[s] to transform
that abstract idea into a patent-eligible invention.” Id.
Appeal 2018–006821
Application 13/665,636

8
B. USPTO Revised Guidance
The PTO recently published revised guidance in the Federal Register
concerning the application of § 101. 2019 Revised Patent Subject Matter
Eligibility Guidance, 84 Fed. Reg. 50 (January 7, 2019) (hereinafter
“Revised Guidance”) (https://www.govinfo.gov/content/pkg/FR-2019-01-
07/pdf/2018-28282.pdf).
Under the Revised Guidance, we first look to whether the claim
recites:
(1) any judicial exceptions, including certain groupings
of abstract ideas (i.e., mathematical concepts, certain methods
of organizing human activity such as a fundamental economic
practice, or mental processes);4 and
(2) additional elements that integrate the judicial
exception into a practical application (see Manual for Patent
Examining Procedure (“MPEP”) §§ 2106.05(a)–(c), (e)–(h)).5
See Revised Guidance 52–53.
Only if a claim (1) recites a judicial exception and (2) does not
integrate that exception into a practical application, do we then look to
whether the claim:
(3) adds a specific limitation beyond the judicial
exception that is not “well-understood, routine, conventional”
in the field (see MPEP § 2106.05(d)); or

4 Referred to as “Revised Step 2A, Prong 1” in the Revised Guidance
(hereinafter “Step 2A(i)”).
5 Referred to as “Revised Step 2A, Prong 2” in the Revised Guidance
(hereinafter “Step 2A(ii)”).
Appeal 2018–006821
Application 13/665,636

9
(4) simply appends well-understood, routine,
conventional activities previously known to the industry,
specified at a high level of generality, to the judicial exception.6
See Revised Guidance 56.
Step 2A(i) – Abstract Idea
Informed by our judicial precedent, the Revised Guidance extracts and
synthesizes key concepts identified by the courts as abstract ideas to explain
that the abstract idea exception includes the following groupings of subject
matter, when recited as such in a claim limitation:
(a) Mathematical concepts—mathematical relationships,
mathematical formulas or equations, mathematical calculations;
(b) Certain methods of organizing human activity —
fundamental economic principles or practices (including
hedging, insurance, mitigating risk); commercial or legal
interactions (including agreements in the form of contracts;
legal obligations; advertising, marketing or sales activities or
behaviors; business relations); managing personal behavior or
relationships or interactions between people (including social
activities, teaching, and following rules or instructions); and
(c) Mental processes—concepts performed in the human
mind (including an observation, evaluation, judgment, opinion).
Under the Revised Guidance, if the claim does not recite a judicial
exception (a law of nature, natural phenomenon, or subject matter within the
enumerated groupings of abstract ideas above), then the claim is patent-

6 Items (3) and (4) continue to be collectively referred to as “Step 2B” of the
Supreme Court’s two-step framework, described in Mayo and Alice.
Appeal 2018–006821
Application 13/665,636

10
eligible at Step 2A(i). This determination concludes the eligibility analysis,
except in situations identified in the Revised Guidance.7
However, if the claim recites a judicial exception (i.e., an abstract idea
enumerated above, a law of nature, or a natural phenomenon), the claim
requires further analysis for a practical application of the judicial exception
in Step 2A(ii).
Step 2A(ii) – Practical Application
If a claim recites a judicial exception in Step 2A(i), we determine
whether the recited judicial exception is integrated into a practical
application of that exception in Step 2A(ii) by: (a) identifying whether there
are any additional elements recited in the claim beyond the judicial
exception(s); and (b) evaluating those additional elements individually and
in combination to determine whether they integrate the exception into a
practical application.
The seven identified “practical application” sections of the MPEP,8
cited in the Revised Guidance under Step 2A(ii), are:
(1) MPEP § 2106.05(a) Improvements to the Functioning of
a Computer or To Any Other Technology or Technical
Field

7 In the rare circumstance in which an examiner believes a claim limitation
that does not fall within the enumerated groupings of abstract ideas should
nonetheless be treated as reciting an abstract idea, the procedure described in
of the Guidance for analyzing the claim should be followed. See Revised
Guidance, Section III.C.
8 See MPEP §§ 2106.05(a)–(c), (e)–(h). Citations to the MPEP herein refer
to revision [R-08.2017]. Sections 2106.05(a), (b), (c), and (e) are indicative
of integration into a practical application, while §§ 2106.05(f), (g), and (h)
Appeal 2018–006821
Application 13/665,636

11
(2) MPEP § 2106.05(b) Particular Machine
(3) MPEP § 2106.05(c) Particular Transformation
(4) MPEP § 2106.05(e) Other Meaningful Limitations
(5) MPEP § 2106.05(f) Mere Instructions To Apply An
Exception
(6) MPEP § 2106.05(g) Insignificant Extra-Solution Activity
(7) MPEP § 2106.05(h) Field of Use and Technological
Environment
See Revised Guidance 55.
If the recited judicial exception is integrated into a practical
application as determined under one or more of the MPEP sections cited
above, then the claim is not directed to the judicial exception, and the patent-
eligibility inquiry ends. See Revised Guidance 54. If not, then analysis
proceeds to Step 2B.
Step 2B – “Inventive Concept” or “Significantly More”
Under our reviewing courts’ precedent, it is possible that a claim that
does not “integrate” a recited judicial exception under Step 2A(ii) is
nonetheless patent eligible. For example, the claim may recite additional
elements that render the claim patent eligible even though a judicial
exception is recited in a separate claim element.9 The Federal Circuit has
held claims eligible at the second step of the Alice/Mayo test (USPTO Step
2B) because the additional elements recited in the claims provided
“significantly more” than the recited judicial exception (e.g., because the

relate to limitations that are not indicative of integration into a practical
application.
9 See, e.g., Diehr, 450 U.S. at 187.
Appeal 2018–006821
Application 13/665,636

12
additional elements were unconventional in combination).10 Therefore, if a
claim has been determined to be directed to a judicial exception under
Revised Step 2A, we must also evaluate the additional elements individually
and in combination under Step 2B to determine whether they provide an
inventive concept (i.e., whether the additional elements amount to
significantly more than the exception itself).11
Under the Revised Guidance, we must consider in Step 2B whether an
additional element or combination of elements: (1) “Adds a specific
limitation or combination of limitations that are not well-understood,
routine, conventional activity in the field, which is indicative that an
inventive concept may be present;” or (2) “simply appends well-understood,
routine, conventional activities previously known to the industry, specified
at a high level of generality, to the judicial exception, which is indicative
that an inventive concept may not be present.” See Revised Guidance,
III.B.12

10 See, e.g., Amdocs (Israel), Ltd. v. Openet Telecom, Inc., 841 F.3d 1288,
1300, 1304 (Fed. Cir. 2016); BASCOM Global Internet Services, Inc. v.
AT&T Mobility LLC, 827 F.3d 1341, 1349–52 (Fed. Cir. 2016); DDR
Holdings v. Hotels.com, L.P., 773 F.3d 1245, 1257–59 (Fed. Cir. 2014).
11 The patent eligibility inquiry may contain underlying issues of fact.
Mortg. Grader, Inc. v. First Choice Loan Servs. Inc., 811 F.3d 1314, 1325
(Fed. Cir. 2016). In particular, “[t]he question of whether a claim element or
combination of elements is well-understood, routine and conventional to a
skilled artisan in the relevant field is a question of fact.” Berkheimer v. HP
Inc., 881 F.3d 1360, 1368 (Fed. Cir. 2018).
12 In accordance with existing Step 2B guidance, an Examiner’s finding that
an additional element (or combination of elements) is well understood,
routine, conventional activity must be supported with at least one of the four
specific types of evidence required by the USPTO Berkheimer
Memorandum, as shown above. For more information concerning evaluation
Appeal 2018–006821
Application 13/665,636

13
In the Step 2B analysis, an additional element (or combination of
elements) is not well-understood, routine or conventional unless the
examiner finds an evidentiary basis, and expressly supports a rejection in
writing with, one or more of the following:
1. A citation to an express statement in the
specification or to a statement made by an applicant during
prosecution that demonstrates the well-understood, routine,
conventional nature of the additional element(s). . . .
2. A citation to one or more of the court decisions
discussed in MPEP § 2106.05(d)(II) as noting the well-
understood, routine, conventional nature of the additional
element(s).
3. A citation to a publication that demonstrates the
well-understood, routine, conventional nature of the additional
element(s). . . .
4. A statement that the examiner is taking official
notice of the well-understood, routine, conventional nature of
the additional element(s). . . .
See Berkheimer Memo.
The analysis in Step 2B further determines whether an additional
element or combination of elements:
(a) Adds a specific limitation or combination of
limitations that are not well-understood, routine, conventional
activity in the field, which is indicative that an inventive
concept may be present; or

of well-understood, routine, conventional activity, see MPEP § 2106.05(d),
as modified by the USPTO Berkheimer Memorandum (USPTO
Commissioner for Patents Memorandum dated Apr. 19, 2018, “Changes in
Examination Procedure Pertaining to Subject Matter Eligibility, Recent
Subject Matter Eligibility Decision (Berkheimer v. HP, Inc.)” (hereinafter
“Berkheimer Memo”).
Appeal 2018–006821
Application 13/665,636

14
(b) simply appends well-understood, routine,
conventional activities previously known to the industry,
specified at a high level of generality, to the judicial exception,
which is indicative that an inventive concept may not be
present.
Revised Guidance, and see Berkheimer Memo.
If the Examiner or the Board determines under Step 2B that the
element (or combination of elements) amounts to significantly more than the
exception itself, the claim is eligible, thereby concluding the eligibility
analysis.
However, if a determination is made that the element and combination
of elements does not amount to significantly more than the exception itself,
the claim is ineligible under Step 2B, and the claim should be rejected for
lack of subject matter eligibility.
ANALYSIS
Step 1 – Statutory Category
Claim 1, as a method (process) claim, recites one or more of the
enumerated categories of eligible subject matter in 35 U.S.C. § 101.
Therefore, the issue before us is whether it is directed to a judicial exception
without significantly more.
Step 2A(i): Does the Claim Recite a Judicial Exception?
The Examiner determined that claim 1 is directed to monitoring online
data to determine a risk of data breach associated with customers of a
requesting entity” (Final Act. 2), and further determined “[t]hese steps are
directed to the concept of determining and comparing information to
determine a risk of data breach associated with customers. In addition, it is
Appeal 2018–006821
Application 13/665,636

15
similar to other concepts that have been identified as abstract by the courts,
such as comparing data to determine a risk level (Perkin-Elmer). Thus, the
claim is directed to an abstract idea.” Final Act. 3–4.
We conclude claim 1 does not recite the judicial exceptions of either
natural phenomena or laws of nature. We evaluate, de novo, whether
claim 1 recites an abstract idea based upon the Revised Guidance.
As quoted, supra, claim 1 recites, in pertinent part, [1] “[a]accessing
. . . information;” [2] “accessing . . . rules;” [3] “periodically scanning . . .
data sources;” [4] “categorizing . . . identification information;”
[5] “determining . . . a quantity of detected pieces of information;”
[6] “determining a total quantity of locate pieces of identification
information;” [7] “accessing . . . information;” [8] “determining a category
risk score;” [9] “including the category risk score in a real-time alert
transmission to the requesting entity;” and [10] “generating an assessment
user interface.”
Claims App’x.
The Specification provides context as to what the claimed invention is
directed to. In this case, the Specification discloses that the invention is
directed to:
[S]ystems and methods for enabling a requesting entity to
request that a pre-breach system monitors one or more data
sources in order to identify information associated with
consumers affiliated with the requesting entity (e.g., customers
and/or employees), and to then generate one or more data
breach risk score that are usable to predict portions of the
requesting entity's data that may not be secured well enough. In
one embodiment, the requesting entity provides the pre-breach
system with a file including identification information of a
Appeal 2018–006821
Application 13/665,636

16
plurality of consumers (e.g., employees and/or customers of the
requesting entity) and requests a comparative scan from a
plurality of data sources. One or more breach risk scores may
be generated based on the results from the comparative scan.
The risk scores may then be provided to the requesting entity.
Spec. ¶5.
Appellants’ Abstract describes the invention as: “[a] method for
providing pre-data breach monitoring provides information to businesses
that is useful to predict portions of the company data that may not be secured
well enough and other risks associated with data breaches, such as
employees that may not be trustworthy.” Spec. 30.
We determine that claim 1 generally recites mental processes, i.e.,
concepts performed in the human mind, including making observations,
evaluations and judgments. This type of activity, i.e., accessing rules sets,
determining a category risk score based on accessing data, as recited in each
of limitations (3) through (9), for example, include methods of mitigating the
risk of data breach. See Bancorp. 687 F.3d at 1280 (concluding that
“managing a stable value protected life insurance policy by performing
calculations and manipulating the results” is an abstract idea.)13

13 Alternatively, claim 1 may also reasonably be construed as reciting
certain methods of organizing human activity, including mitigating risk and
business relations. However, our reviewing court recognizes that “[a]n
abstract idea can generally be described at different levels of abstraction.”
Apple, Inc. v. Ameranth, Inc., 842 F.3d 1229, 1240 (Fed. Cir. 2016). That
need not and, in this case does not, “impact the patentability analysis.” Id. at
1241. Further, “[t]he Board’s slight revision of its abstract idea analysis does
not impact the patentability analysis.” Id. Moreover, merely combining
several abstract ideas does not render the combination any less abstract.
RecogniCorp, LLC v. Nintendo Co., 855 F.3d 1322, 1327 (Fed. Cir. 2017)
(“Adding one abstract idea (math) to another abstract idea . . . does not
Appeal 2018–006821
Application 13/665,636

17
Under the broadest reasonable interpretation standard,14 we conclude
limitations (3) through (9) recite steps that would ordinarily occur when
determining a risk of data breach. See Final Act. 2–4. For example,
accessing and scanning data, and categorizing and manipulating data are
operations that generally occur in breach risk determinations. Further,
calculating a risk score and comparing it to a threshold value as a method is
a mental process, whether initiated on paper, or using a computer.
Thus, under Step 2A(i), we conclude that claim 1’s method of
monitoring online data to determine a risk of data breach is a method of
mitigating risk or in the alternative, observation, evaluation, and judgment.
We conclude claim 1, as a whole, under our Revised Guidance, recites a
judicial exception of mental processes or, in the alternative, recites certain
methods of organizing human activity, and thus is an abstract idea.
Step 2A(ii): Judicial Exception Integrated into a Practical Application?
If the claims are directed to a patent-ineligible concept, as we
conclude above, we proceed to the “practical application” Step 2A(ii) in

render the claim non-abstract.”); see also FairWarning IP, LLC v. Iatric
Sys., Inc., 839 F.3d 1089, 1093–94 (Fed. Cir. 2016) (determining the
pending claims were directed to a combination of abstract ideas).
14 During prosecution, claims must be given their broadest reasonable
interpretation when reading claim language in light of the specification as it
would be interpreted by one of ordinary skill in the art. In re America Acad.
of Sci. Tech. Ctr., 367 F.3d 1359, 1364 (Fed. Cir. 2004). Under this
standard, we interpret claim terms using “the broadest reasonable meaning
of the words in their ordinary usage as they would be understood by one of
ordinary skill in the art, taking into account whatever enlightenment by way
of definitions or otherwise that may be afforded by the written description
contained in the applicant’s specification.” In re Morris, 127 F.3d 1048,
1054 (Fed. Cir. 1997).
Appeal 2018–006821
Application 13/665,636

18
which we determine whether the recited judicial exception is integrated into
a practical application of that exception by: (a) identifying whether there are
any additional elements recited in the claim beyond the judicial exception(s);
and (b) evaluating those additional elements individually and in combination
to determine whether they integrate the exception into a practical
application.
We determine each of limitations (3) through (9) of claim 1 recite
abstract ideas as identified in Step 2A(i), supra, and none of the limitations
integrate the judicial exception of certain methods of organizing human
activity and mental processes into a practical application as determined
under one or more of the MPEP sections cited above.
In particular, we conclude the “generating an assessment” limitation
(10) recites insignificant post-solution activity. The Supreme Court guides
that the “prohibition against patenting abstract ideas ‘cannot be
circumvented’ [by] adding ‘insignificant postsolution activity.’” Bilski, 561
U.S. at 610–11 (quoting Diehr, 450 U.S. at 191–92). We also find, to the
extent the “accessing” limitations are limitations of data gathering, we find
limitations (1) and (2) are examples of insignificant extra solution activity.
See MPEP § 2106.05(g). Data gathering, as performed by the steps or
function in Appellants’ claims, is a classic example of insignificant extra-
solution activity. See, e.g., In re Bilski, 545 F.3d 943, 963 (Fed. Cir. 2008)
(en banc), aff’d sub nom, Bilski v. Kappas, 561 U.S. 593 (2010).
On this record, we are of the view that Appellants’ claims do not
operate the recited generic computer components in an unconventional
Appeal 2018–006821
Application 13/665,636

19
manner to achieve an improvement in computer functionality. See MPEP
§ 2106.05(a).
Further, Appellants have not shown technical improvements under the
guidance of Manual of Patent Examining Procedure section 2106.05(a)
(“Improvements to the Functioning of a Computer or to Any Other
Technology or Technical Field”) or section 2106.05(e)(“Other Meaningful
Limitations”). Nor do Appellants advance any arguments in the Brief(s) that
are directed to the Bilski machine-or-transformation test, which would only
be applicable to the method (process) claims on appeal. See MPEP
§§ 2106.05(b) (Particular Machine) and 2106.05(c) (Particular
Transformation).
Therefore, we conclude the abstract idea is not integrated into a
practical application, and thus the claim is directed to the judicial exception.
Step 2B – “Inventive Concept” or “Significantly More”
If the claims are directed to a patent-ineligible concept, as we
conclude above, we proceed to the “inventive concept” step. For Step 2B we
must “look with more specificity at what the claim elements add, in order to
determine ‘whether they identify an “inventive concept” in the application of
the ineligible subject matter’ to which the claim is directed.” Affinity Labs
of Texas, LLC v. DIRECTV, LLC, 838 F.3d 1253, 1258 (Fed. Cir. 2016)
(quoting Elec. Power Grp., 830 F.3d at 1353).
In applying step two of the Alice analysis, our reviewing court guides
we must “determine whether the claims do significantly more than simply
describe [the] abstract method” and thus transform the abstract idea into
patentable subject matter. Ultramercial, Inc. v. Hulu, LLC, 772 F.3d 709,
Appeal 2018–006821
Application 13/665,636

20
715 (Fed. Cir. 2014). We look to see whether there are any “additional
features” in the claims that constitute an “inventive concept,” thereby
rendering the claims eligible for patenting even if they are directed to an
abstract idea. Alice, 573 U.S. at 221. Those “additional features” must be
more than “well-understood, routine, conventional activity.” Mayo, 566
U.S. at 79.
Limitations referenced in Alice that are not enough to qualify as
“significantly more” when recited in a claim with an abstract idea include, as
non-limiting or non-exclusive examples: adding the words “apply it” (or an
equivalent) with an abstract idea15; mere instructions to implement an
abstract idea on a computer16; or requiring no more than a generic computer
to perform generic computer functions that are well-understood, routine and
conventional activities previously known to the industry.17
Evaluating representative claim 1 under step 2 of the Alice analysis,
we conclude it lacks an inventive concept that transforms the abstract idea of
methods of mitigating the risk of data breach into a patent-eligible
application of that abstract idea.
The patent eligibility inquiry may contain underlying issues of fact.
Mortg. Grader, 811 F.3d at 1325. In particular, “[t]he question of whether a
claim element or combination of elements is well-understood, routine and

15 Alice, 573 U.S. at 221–23.
16 Alice, 573 U.S. at 221, e.g., simply implementing a mathematical
principle on a physical machine, namely a computer (citing Mayo, 566 U.S.
at 84–85).
17 Alice, 573 U.S. at 225, e.g., using a computer to obtain data, adjust
account balances, and issue automated instructions.
Appeal 2018–006821
Application 13/665,636

21
conventional to a skilled artisan in the relevant field is a question of fact.”
Berkheimer, 881 F.3d at 1368.
Appellants argue their claims are similar to Trading Technologies,
where the claimed method reduced the time it takes for a trader to place a
trade. App. Br. 20. Appellants argue, as a corollary, their claims reduce the
time it takes to view information regarding potential or actual breaches.
App. Br. 21. However, we are not persuaded that packaging information for
a viewer on a user interface is at all similar to reducing the time for a trade to
take place. Merely presenting information to an end-user has no quantifiable
time reduction as the user himself has to evaluate and makes judgments on
the presented data. The amount of time it takes the end-user to make a
decision while monitoring potential breaches is not quantified or claimed by
Appellants.
In the Reply Brief, for the first time, Appellants argue the Examiner
has not established that each claim element is “routine or conventional.”
Reply Br. 7. The additional elements recited in claim 1 merely include “a
computing system having one or more hardware computer processors
executing software instructions stored on a non-transitory computer readable
medium.” Claims App’x.
Appellants’ Specification provides an exemplary computing system,
and describes that each of the claimed elements are, in fact, routine and
conventional components. See Spec. ¶¶ 88–91.18 Thus, because the

18 For example, and as evidence of the WURC nature of the additional
elements, the Specification discloses:
The pre-breach system 130 includes, for example, a
personal computer that is IBM, Macintosh, or Linux/Unix
Appeal 2018–006821
Application 13/665,636

22
Specification describes the additional elements in general terms, without
describing the particulars, we conclude the claim limitations may be broadly
but reasonably construed as reciting conventional computer components and
techniques, particularly in light of Appellants’ Specification, as cited
above.19
The Manual of Patent Examining Procedure, based upon our
precedential guidance, provides additional considerations with respect to
analysis of the well-understood, routine, and conventional nature of the
claimed computer-related components.
Another consideration when determining whether a claim
recites significantly more than a judicial exception is whether
the additional elements amount to more than a recitation of the
words “apply it” (or an equivalent) or are more than mere
instructions to implement an abstract idea or other exception on
a computer. As explained by the Supreme Court, in order to
transform a judicial exception into a patent-eligible application,
the additional element or combination of elements must do
“‘more than simply stat[e] the [judicial exception] while adding
the words ‘apply it’”. Alice Corp. v. CLS Bank, 573 U.S. __,
134 S. Ct. 2347, 2357, 110 USPQ2d 1976, 1982-83 (2014)

compatible or a server or workstation. In one embodiment, the
pre-breach system 130 comprises a server, a laptop computer, a
cell phone, a personal digital assistant, a kiosk, or an audio
player, for example. In one embodiment, the exemplary pre-
breach system 130 includes one or more central processing unit
(“CPU”) 155, which may each include a conventional or
proprietary microprocessor.
Spec. ¶ 88.
19 Claim terms are to be given their broadest reasonable interpretation, as
understood by those of ordinary skill in the art and taking into account
whatever enlightenment may be had from the Specification. In re Morris,
127 F.3d 1048, 1054 (Fed. Cir. 1997).
Appeal 2018–006821
Application 13/665,636

23
(quoting Mayo Collaborative Servs. v. Prometheus Labs., Inc.,
566 U.S. 66, 72, 101 USPQ2d 1961, 1965). Thus, for example,
claims that amount to nothing more than an instruction to apply
the abstract idea using a generic computer do not render an
abstract idea eligible. Alice Corp., 134 S. Ct. at 2358, 110
USPQ2d at 1983. See also 134 S. Ct. at 2389, 110 USPQ2d at
1984 (warning against a § 101 analysis that turns on “the
draftsman’s art”) . . . .
In Alice Corp., the claim recited the concept of
intermediated settlement as performed by a generic computer.
The Court found that the recitation of the computer in the claim
amounted to mere instructions to apply the abstract idea on a
generic computer. 134 S. Ct. at 2359-60, 110 USPQ2d at 1984.
The Supreme Court also discussed this concept in an earlier
case, Gottschalk v. Benson, 409 U.S. 63, 70, 175 USPQ 673,
676 (1972), where the claim recited a process for converting
binary-coded decimal (BCD) numerals into pure binary
numbers. The Court found that the claimed process had no
substantial practical application except in connection with a
computer. Benson, 409 U.S. at 71–72, 175 USPQ at 676. The
claim simply stated a judicial exception (e.g., law of nature or
abstract idea) while effectively adding words that “apply it” in a
computer. Id.
MPEP § 2106.05(f) (“Mere Instructions To Apply An Exception”).
With respect to the Step 2B analysis, we conclude, similar to Alice, the
recitation of a method of monitoring online data that includes “a computing
system having one or more hardware computer processors executing
software instructions stored on a non-transitory computer readable medium”
(claim 1) as argued by Appellants, and similarly for claim 16, is simply not
enough to transform the patent-ineligible abstract idea here into a patent-
eligible invention under Step 2B. See Alice, 573 U.S. at 221 (“[C]laims,
which merely require generic computer implementation, fail to transform
[an] abstract idea into a patent-eligible invention.”).
Appeal 2018–006821
Application 13/665,636

24
We conclude the claims fail the Step 2B analysis because claim 1, in
essence, merely recites various computer-based elements along with no
more than mere instructions to implement the identified abstract idea using
the computer-based elements.
Therefore, in light of the foregoing, we conclude, under the 2019
Revised Guidance, that each of Appellants’ claims 1, 3–6, and 8–16,
considered as a whole, is directed to a patent-ineligible abstract idea that is
not integrated into a practical application and does not include an inventive
concept. Accordingly, we sustain the Examiner’s § 101 rejection of
independent claim 1, and grouped claims 3–6, and 8–16 which fall
therewith.
CONCLUSION
Under our Revised Guidance, governed by relevant case law, we
conclude claims 1, 3–6, and 8–16, rejected under 35 U.S.C. § 101, are
directed to patent-ineligible subject matter, and we sustain the rejection.
DECISION
We affirm the Examiner’s decision rejecting claims 1, 3–6, and 8–16.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(1)(iv). See 37
C.F.R. § 41.50(f).
AFFIRMED