Sourcefire, Inc.

Trademark Trial and Appeal Board

Oct 24, 2008

No. 78968186 (T.T.A.B. Oct. 24, 2008)

Mailed: 10/24/08

UNITED STATES PATENT AND TRADEMARK OFFICE
________

Trademark Trial and Appeal Board
________

In re Sourcefire, Inc.
________

Serial No. 78968186
_______

Cynthia K. Nicholson of Posz Law Group for Sourcefire, Inc.

Michael Levy, Trademark Examining Attorney, Law Office 110
(Chris A.F. Pedersen, Managing Attorney).
_______

Before Quinn, Kuhlke and Bergsman, Administrative Trademark
Judges.

Opinion by Quinn, Administrative Trademark Judge:

Sourcefire, Inc. filed, on September 6, 2006, an
intent-to-use application to register the mark UNIFIED
THREAT INSPECTION (in standard character format) for
“computer software for use in computer network security,
intrusion prevention/detection, correlation, network
intelligence and analysis, all the foregoing being in
connection with computer network security.”
The trademark examining attorney refused registration
under Section 2(e)(1) of the Trademark Act, 15 U.S.C.
THIS OPINION
IS NOT A PRECEDENT OF
THE T.T.A.B.
Ser No. 78968186
2
§1052(e)(1), on the ground that applicant’s mark, if used
in connection with applicant’s goods, would be merely
descriptive thereof.
When the refusal was made final, applicant appealed.
Applicant and the examining attorney filed briefs.
The examining attorney maintains that the mark is
merely descriptive of “unified threat management inspection
software.” Although the examining attorney concedes that
the record does not include any examples of uses of
“unified threat inspection,” he argues that the individual
components comprising the mark, specifically “unified
threat” and “inspection” are merely descriptive in the
network security field, and that the combination of these
words remains descriptive, conveying information about the
nature and function of applicant’s software. The examining
attorney points to uses of “unified threat” in combination
with terms such as “products” and “solutions,” as well as
to uses of “unified threat management.” The examining
attorney also relies upon uses of “inspection” in
connection with network security software. In support of
the refusal the examining attorney introduced dictionary
Ser No. 78968186
3
definitions, and excerpts of various web pages, including
some retrieved from applicant’s website.1
Applicant argues that the two-word combination
“unified threat” has no meaning relative to the goods, and
that the widely used combination “unified threat
management,” as relied upon by the examining attorney, is
not necessarily probative to show that UNIFIED THREAT
INSPECTION is merely descriptive. In support of its
arguments, applicant submitted excerpts of web pages, the
results of various searches of the USPTO’s databases, and
copies of two third-party patents.
A term is deemed to be merely descriptive of goods or
services, within the meaning of Section 2(e)(1), if it
forthwith conveys an immediate idea of an ingredient,
quality, characteristic, feature, function, purpose or use

1Some of the websites are of foreign origin. Applicant has
criticized the foreign websites because they “only show
irrelevant use outside the United States.” This criticism is ill
founded. “Information originating on foreign websites or in
foreign news publications that are accessible to the United
States public may be relevant to discern United States consumer
impression of a proposed mark.” In re Bayer Aktiengesellschaft,
488 F.3d 960, 82 USPQ2d 1828, 1835 (TTAB 2007). This does not
mean that in all cases foreign websites will be relevant.
However, in this case, we find that due to the nature of the
software at issue, the foreign websites would be reviewed by
consumers in the United States, and therefore help to form the
commercial impression engendered by the mark. Nevertheless, the
better practice would have been for the examining attorney who
handled the examination (herein a different examining attorney
from the examining attorney who wrote the appeal brief) to
explain during examination why the foreign websites were
relevant.
Ser No. 78968186
4
of the goods or services. In re Bayer Aktiengesellschaft,
supra; and In re Abcor Development, 588 F.2d 811, 200 USPQ
215, 217-18 (CCPA 1978). A term need not immediately
convey an idea of each and every specific feature of the
applicant’s goods or services in order to be considered
merely descriptive; rather, it is sufficient that the term
describes one significant attribute, function or property
of the goods or services. In re H.U.D.D.L.E., 216 USPQ 358
(TTAB 1982); and In re MBAssociates, 180 USPQ 338 (TTAB
1973). Whether a term is merely descriptive is determined
not in the abstract, but in relation to the goods or
services for which registration is sought, the context in
which it is being used on or in connection with the goods
or services, and the possible significance that the term
would have to the average purchaser of the goods or
services because of the manner of its use; contrary to the
gist of a portion of applicant’s argument, that a term may
have other meanings in different contexts is not
controlling. In re Bright-Crest, Ltd., 204 USPQ 591, 593
(TTAB 1979). It is settled that “[t]he question is not
whether someone presented with only the mark could guess
what the goods or services are. Rather, the question is
whether someone who knows what the goods or services are
will understand the mark to convey information about them.”
Ser No. 78968186
5
In re Tower Tech Inc., 64 USPQ2d 1314, 1316-17 (TTAB 2002).
The “average” or “ordinary” consumer is the class or
classes of actual or prospective customers of applicant’s
goods or services. In re Omaha National Corporation, 819
F.2d 1117, 2 USPQ2d 1859 (Fed. Cir. 1987).
When two or more merely descriptive terms are
combined, the determination of whether the composite mark
also has a merely descriptive significance turns on the
question of whether the combination of terms evokes a new
and unique commercial impression. If each component
retains its merely descriptive significance in relation to
the goods or services, the combination results in a
composite that is itself merely descriptive. See, e.g., In
re Tower Tech Inc., supra [SMARTTOWER merely descriptive of
commercial and industrial cooling towers]; and In re Sun
Microsystems Inc., 59 USPQ2d 1084 (TTAB 2001) [AGENTBEANS
merely descriptive of computer programs for use in
development and deployment of application programs].
Applicant is engaged in the development and sale of
open source computer network security products. Applicant,
described as an “intrusion detection/prevention software
(IDS/IPS) developer,” has been involved in the area of
“unified threat management (UTM),” according to Michele
Ser No. 78968186
6
Perry, applicant’s chief marketing officer.
(www.computerwire.com).
“Unified Threat Management refers to a stand-alone
appliance or software package that combines a firewall,
antivirus, spam and content filtering as well as intrusion
detection.” (www.pcmag.com)
Wikipedia describes the designation “unified threat
management (UTM),” in relevant part, as
network firewalls that have many
features in one box, including junk e-
mail filtering, anti-virus capability,
an intrusion detection (or prevention)
system (IDS or IPS), and World Wide Web
content filtering, along with the
traditional activities of a firewall.
These are application-layer firewalls
that use proxies to process and forward
all incoming traffic, though they can
still frequently work in transparent
mode that disguises this fact.
However, if this uses too much
processor time, the higher-level
inspection can be disabled so that the
firewall functions like a much simpler
network address translation (NAT)
gateway.

The term “Unified Threat,” as reflected by the
evidence of record, most often has been used in connection
with the term “management,” as in “Unified Threat
Management.” However, the record shows other uses such as
“Unified Threat Products” and “Unified Threat Solutions” in
connection with computer network security software.
Ser No. 78968186
7
Contrary to the gist of a portion of applicant’s arguments,
the deletion of the term “management” does not transform
the words “unified threat” into an inherently distinctive
term in the context of network security software.
Also of record are examples of uses of the term
“inspection” in connection with software:
Inspection Software
High Detection Enhancement (HDE)
software
HDE inspection software increases
security for higher threats
(www.gesecurity.com)

Hifn Pattern Matching
accelerates...content inspection of
packets traveling through network.
Applications include unified threat
management appliances...and deep packet
inspection firewalls.
(www.thomasnet.com)

Finjan’s SurfinGate, a gateway-level
content-inspection software solution...
(www.checkpoint.com)

The record includes information regarding unified
threat management software that includes an inspection
application utilized in computer network security. For
example, the following excerpts are illustrative:
These third generation firewalls run on
general purpose operating systems that
have been specially modified and
hardened against network and
application layer attacks...These third
generation firewalls are also know as
Unified Threat Management (UTM)
devices. The third generation firewall
Ser No. 78968186
8
is able to perform stateful filtering
(like second generation hardware
firewalls) and perform stateful
application layer inspection. By
perform[ing] stateful application layer
inspection, the third generation
firewall is able to fully inspect HTTP,
FTP, POP3, SMTP, NNTP, instant
messenger, peer to peer, VoIP and other
application layer protocol
communications. The third generation
firewall UTM device performs the basic
stateful filter that all firewalls
perform today, and then provides the
real protection required for 21st
century networks by exposing the
application layer protocols to deep
inspection.
(www.everywherenetworks.com)

Long associated with smaller
organizations, unified threat
management (UTM) technology is now on
the cusp of widespread adoption by
large enterprises...UTM describes a
suite of deep-packet inspection
technologies that include threat
prevention, anti-virus, anti-spyware,
anti-spam and content filtering. It
differs from a traditional firewall by
its ability to inspect at the
application, rather than network,
layer.
(www.telecomasia.net)

UTM is the evolution of the traditional
Firewall into a Swiss Army product that
not only includes a firewall but also
content inspection and filtering, spam
filtering, intrusion detection and
anti-virus...There is no doubt that
enterprises require best-in-class
security. From a UTM appliance this
means a platform with high-speed
content inspection supporting the
following: firewall; high-quality
email and web filtering; intrusion
Ser No. 78968186
9
detection and prevention; antivirus
scanning; antispyware; spam filtering.
(www.itsecurity.com)

This article explores the next-
generation of Unified Threat Management
(UTM) security systems--advancements
that inspect Layers 3-7 to provide
complete protection in a single,
easily-managed multi-layered platform.
(www.convergedigest.com)

Fortinet is the confirmed leader of
[the] Unified Threat Management
market...customers benefit from their
ability to customize SSl VPN into one
or more complete content inspection
applications including antivirus,
firewall, IPSec VPN, intrusion
detection and prevention (IDP), content
filtering, anti-spam and traffic
filtering into a single Unified Threat
Management security appliance.
(www.fortinet.com)

As part of applicant’s unified threat management software
package, its product “provides packet decoding and
inspection, allowing you to see which rule was activated by
the attack.” (www.scmagazine.com).
Based on the meanings of the individual components
“unified threat” and “inspection” as they are understood in
the computer network security field, we find that the
combination UNIFIED THREAT INSPECTION is merely
descriptive. The record establishes that the designation
UNIFIED THREAT INSPECTION merely describes unified threat
management software that includes an inspection
Ser No. 78968186
10
application. The individual merely descriptive components,
“unified threat” and “inspection,” retain their descriptive
character when combined to form the composite UNIFIED
THREAT INSPECTION. No imagination is required to discern
the nature and purpose of the goods. The fact that
applicant may be the first or only user of the merely
descriptive designation is outweighed by the weight of the
evidence of mere descriptiveness. In re Acuson, 225 USPQ
790, 792 (TTAB 1985).
Decision: The refusal to register is affirmed.