Finjan, Inc. v. Blue Coat Systems, Inc.

OPPOSITION/RESPONSE

N.D. Cal.December 22, 2017

__________________________________________________________________________________ FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 PAUL J. ANDRE (State Bar No. 196585) pandre@kramerlevin.com LISA KOBIALKA (State Bar No. 191404) lkobialka@kramerlevin.com JAMES HANNAH (State Bar No. 237978) jhannah@kramerlevin.com HANNAH LEE (State Bar No. 253197) hlee@kramerlevin.com KRAMER LEVIN NAFTALIS & FRANKEL LLP 990 Marsh Road Menlo Park, CA 94025 Telephone: (650) 752-1700 Facsimile: (650) 752-1800 Attorneys for Plaintiff FINJAN, INC. IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF CALIFORNIA SAN JOSE DIVISION FINJAN, INC., a Delaware Corporation, Plaintiff, v. BLUE COAT SYSTEMS, LLC, a Delaware Corporation, Defendant. Case No.: 15-cv-3295-BLF-SVK PLAINTIFF FINJAN, INC.’S OPPOSITION TO BLUE COAT SYSTEMS LLC’S PARTIAL RENEWED RULE 50(B) MOTION FOR JUDGMENT AS A MATTER OF LAW Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 1 of 20 i FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TABLE OF CONTENTS Page I. INTRODUCTION ........................................................................................................................ 1 II. LITERAL INFRINGEMENT OF THE ‘844 PATENT ............................................................... 1 Substantial Evidence That The Accused Products Identify Suspicious A. Code. ................................................................................................................................. 1 The Accused Products Link a Downloadable Security Profile to a B. Downloadable Before a Web Server Makes the Content Available to Web Clients. .............................................................................................................................. 4 III. LITERAL INFRINGEMENT OF THE ‘494 PATENT ............................................................... 6 IV. INFRINGEMENT UNDER THE DOCTRINE OF EQUIVALENTS ......................................... 8 V. WILLFUL INFRINGEMENT OF THE ‘844 AND ‘494 PATENTS .......................................... 9 VI. WORLDWIDE DAMAGES ON THE ‘844 AND ‘494 PATENTS .......................................... 12 Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 2 of 20 ii FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 TABLE OF AUTHORITIES Page(s) Cases Card-Monroe Corp. v. Tuftco Corp., No. 1:14-cv-292, 2017 WL 3841878 (E.D. Tenn. Sept. 1, 2017)..................................................... 12 Carnegie Mellon Univ. v. Marvell Tech. Grp. Ltd., 807 F.3d 1283 (Fed. Cir. 2015)......................................................................................................... 12 CNET Networks, Inc. v. Etilize, Inc., 528 F. Supp. 2d 985 (N.D. Cal. 2007) ........................................................................................ 13, 15 Decca Ltd. v. United States, 210 Ct. Cl. 546 (Ct. Cl. 1976) ........................................................................................................... 14 Fr. Telecom S.A. v. Marvell Semiconductor Inc., 39 F. Supp. 3d 1080 (N.D. Cal. 2014) .............................................................................................. 15 Goulds’ Mfg. Co. v. Cowing, 105 U.S. 253 (1881) .......................................................................................................................... 12 Halo Elecs., Inc. v. Pulse Elecs., Inc., 136 S. Ct. 1923 (2016) .................................................................................................................. 9, 10 Honeywell Int’l Inc. v. Universal Avionics Sys. Corp., 347 F. Supp. 2d 114 (D. Del. 2004) ................................................................................................ 8, 9 i4i Ltd. P’ship v. Microsoft Corp., 598 F.3d 831 (Fed. Cir. 2010), aff’d 564 U.S. 91 (2011) ........................................................... 12, 15 Imperium IP Holdings (Cayman), Ltd. v. Samsung Elecs. Co., No. 4:14-cv-371, 2017 WL 4038884 (E.D. Tex. Sept. 13, 2017)..................................................... 10 Micro Motion, Inc. v. Exac Corp., 741 F.Supp. 1426 (N.D. Cal. 1990) .................................................................................................... 8 Microsoft Corp. v. AT&T Corp., 127 S. Ct. 1746 (2007) ...................................................................................................................... 15 NTP, Inc. v. Research in Motion, Ltd., 418 F.3d 1282 (Fed. Cir. 2005)................................................................................................... 14, 15 Roche Palo Alto LLC v. Apotex, Inc., 526 F. Supp. 2d 985 (N.D. Cal. 2007), aff’d 531 F.3d 1372 (Fed. Cir. 2008).................................. 13 Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 3 of 20 iii FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Streck, Inc. v. Research & Diagnostic Sys., Inc., 665 F.3d 1269, 101 U.S.P.Q.2d 1225 (Fed. Cir. 2012) .............................................................. 11, 12 Stryker Corp. v. Zimmer, Inc., 837 F.3d 1268 (Fed. Cir. 2016)......................................................................................................... 12 Tyco Healthcare Grp., LP v. Applied Med. Res. Corp., No. 9:06-cv-151, 2009 WL 5842063 (E.D. Tex. Mar. 30, 2009) ..................................................... 11 WMS Gaming Inc. v. Int’l Game Tech., 184 F.3d 1339 (Fed. Cir. 1999)..................................................................................................... 9, 11 Statutes 35 U.S.C. § 271(a) ...................................................................................................................... 12, 14, 15 35 U.S.C. § 271(f) ................................................................................................................................... 15 Other Authorities Fed. R. Civ. P. 50(a)(2) ........................................................................................................................... 10 Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 4 of 20 1 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 I. INTRODUCTION Finjan, Inc. (“Finjan”) presented more than sufficient evidence at trial to support its infringement and damages claims, including sworn testimony on the stand from numerous fact witnesses, deposition testimony of Blue Coat Systems LLC’s (“Blue Coat”) employees, source code, testing of the accused products, numerous Finjan and Blue Coat documents that were admitted into evidence, and testimony of highly reputable expert witnesses. When all reasonable inferences are drawn in Finjan’s favor, the Court should deny Blue Coat’s motion for judgment as a matter of law (“Motion”).1 II. LITERAL INFRINGEMENT OF THE ‘844 PATENT Finjan presented substantial evidence that Blue Coat is liable for infringement of Claim 15 of U.S. Patent No. 6,154,844 (“’844 Patent”), both literally and under the doctrine of equivalents. See generally Trial Tr. at 469:16-539:9, 560:9-23, 565:14-591:9, 603:18-605:11; PTX-49; PTX-105; PTX- 211; PTX-216; PTX-290; PTX-295; PTX-368; PTX-423; PTX-427; PTX-499; PTX-516; PTX-564; PTX-575; PTX-1025; PTX-1274; JTX-3001; JTX-3043; JTX-3050; and JTX-3060. Blue Coat’s assertions otherwise lack merit. Substantial Evidence That The Accused Products Identify Suspicious Code. A. Finjan presented substantial evidence that Blue Coat’s accused GIN/WebPulse product meets all elements of Claim 15 of the ‘844 Patent, including “a first content inspection engine for using the first rule set to generate a Downloadable security profile that identifies suspicious code in a Downloadable” in accordance with the Court’s claim construction. See ‘844 Patent, Claim 15; Trial Tr. at 514:18-515:3, 517:11-537:13. In doing so, Finjan’s expert Dr. Cole applied the Court’s claim construction for this element that the downloadable security profile generated by the inspector “identifies code in the received Downloadable that performs hostile or potentially hostile operations” and supported his opinion with substantial evidence of source code, testimony of Blue Coat engineers, 1 Finjan incorporates by reference the arguments and evidence set forth in its (i) Opposition to Blue Coat’s Rule 50(a) Motion for Judgment as a Matter of Law (Dkt. No. 459) (ii) Motion for Judgment as a Matter of Law Pursuant to Fed. R. Civ. P. 50(a) (Dkt. No. 423) and (iii) oral opposition to Blue Coat’s motion for JMOL regarding doctrine of equivalents. Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 5 of 20 2 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 and technical documents. Trial Tr. at 518:3-519:12 (citing deposition testimony of Blue Coat’s engineer, Mr. Bjorn Andersen). Dr. Cole fully explained using Blue Coat’s documents and his own testing how GIN/WebPulse inspects the downloadable using dynamic analysis to identify any suspicious code that is contained within the downloadable. PTX-368 (Blue Coat’s MAA Center Guide “so Blue Coat’s own document is showing you that it generates, it looks for and attracts these suspicious operations which forms [sic] the security profile . . . the suspicious operations map back to the code that actually performs those suspicious functions” (see Trial Tr. at 519:13-521:16)); PTX-564 (describing Dr. Cole’s testing of the MAA and the summary that the MAA generated discussing suspicious operations, including “contains compressed section of code” (see Trial Tr. at 521:17- 522:24)); PTX-499 (describing static analysis of code and creation of security profile (see Trial Tr. at 423:12-425:15)); PTX-1025 at BC2_SC_000862 (source code describing the suspicious code and operations identified in the security profile (see Trial Tr. at 525:16-527:7)); PTX-427 (MAA Report showing security profile with list of suspicious operations and code (see Trial Tr. at 527:9-529:8)). First, Dr. Cole cited evidence showing specific examples of the suspicious code that GIN/WebPulse identified that Blue Coat does not deny is “code,” such as listing that the presence of the Javascript: Eval method, the JavaScript: from CharCode method, and the Javascript: Unescape function (PTX- 575), and identified in Blue Coat’s source code where GIN identifies code within PDFs (PTX-1025; PTX-427). Multiple Blue Coat witnesses even confirmed that these types of JavaScript functions are code. Trial Tr. at 1484:17-1485:4 (JavaScript is code, including functions are code); Trial Tr. at 1552:21-1553:3 (JavaScript eval function is code). Second, Dr. Cole also identified operations like changing files or creating or terminating processes, which also identify suspicious code because they directly map back to the suspicious code that performed the operations. Trial Tr. at 520:18-16; PTX- 564 at FINJAN-BLCT 495475 (“Creates process in suspicious location” and “Terminates process under Windows subfolder”). As such, Blue Coat’s argument that GIN/WebPulse does not “identify suspicious code” is without basis. Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 6 of 20 3 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Further, Blue Coat does not dispute that listing the presence of particular JavaScript functions does in fact “identify” code in the downloadable. Dkt. No. 4642 at 9-10 (stating Dr. Nielson’s testimony that MAA reports list “JavaScript: Eval method”, and “JavaScript: Unescape function.”) A jury and the Court already addressed this argument in the Finjan, Inc. v. Blue Coat Sys., Inc., Case No. 13-cv-03999-BLF (N.D. Cal.) litigation (“Blue Coat I”), and determined that identifying JavaScript functions like “eval” and “unescape” in a DSP was sufficient evidence to meet this element of Claim 15 of the ‘844 Patent. See Blue Coat I, Dkt. No. 543 at 13. Instead, Blue Coat argues that because it decided to give these functions a specific rating level on their 1-10 rating system (10 being most likely to be malicious), that these JavaScript functions are not “suspicious.” Dkt. No. 464 at 10. Yet Blue Coat’s own witnesses admit that these types of JavaScript functions are suspicious. Trial Tr. at 1534:2-1536:2 (Mr. Larson testifying that the JavaScript eval method is a suspicious operation). Moreover, this argument is nonsensical because it would allow Blue Coat to avoid infringement simply by labeling a result with a term other than “suspicious.” The JavaScript functions that GIN/WebPulse identifies are suspicious because they are used to block content, including for JavaScript functions that are inherently suspicious because they exhibit “[r]are behavior, mostly used by malware . . . ” Trial Tr. at 1485:2-1486:1 (stating Mr. Rohan’s testimony that operations associated with risk score 6 are potentially malicious); PTX 368 at BC2-0003663 (showing that content with a rating of above “1” indicates the presence of code typically found in malware). As such, Blue Coat’s argument based on whether it labels a particular rule as “suspicious” is irrelevant to infringement. Dr. Cole explained during trial that “suspicious operations map back to the code that actually performs those suspicious operations.” Trial Tr. at 521:11-16; see also id. at 582:13-25. This is exactly what is set forth in the Court’s claim construction from Blue Coat I, which was adopted by the parties here. That construction requires that the accused product “identifies code in the received Downloadable that performs hostile or potentially hostile operations.” Contrary to Blue Coat’s arguments, this mapping of operations to code does not merely detect the presence of suspicious code, but identifies specific “characteristics” of the suspicious code by identifying particular details about the 2 Unless indicated otherwise, all “Dkt. No.” cites herein are to the filed pleadings in this litigation. Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 7 of 20 4 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 operation the code performed, and additional details about the operation. PTX-564. The Court expressly rejected Blue Coat’s current argument during claim construction in Blue Coat I, stating that suspicious code can be “identified” in different ways, and gave the example of identifying suspicious code by “by listing ‘all potentially hostile or suspicious code operations that may be attempted by the Downloadable’ . . . .” Blue Coat I, Dkt. No. 118 at 16. During his testimony, Dr. Cole identified different operations that are performed by the code, and the Court’s claim construction anticipated and rejected Blue Coat’s argument that suspicious code can only be identified a single way and gave guidance that code can be identified by listing information on the operation the code performs. As such, Blue Coat’s argument that Finjan did not present substantial evidence is without basis. Blue Coat also failed to rebut the evidence Finjan presented. Blue Coat’s non-infringement expert, Dr. Nielson admits that MAA generates reports that identify suspicious operations, functions, and behavior, but simply disagrees that identifying behavior is the same as identifying code. Trial Tr. at 1618:16-18, 1626:8-11. On cross-examination, however, Dr. Nielson admitted that MAA does identify code, including Javascript Unescape and Eval code, and admitted that Dr. Cole went through his testing and identified where in Blue Coat’s source code he located the exact code functions he testified about. Trial Tr. at 1770:11-1771:16, 1772:4-10, 1772:23-1773:1. Thus, Finjan presented substantial and unrebutted evidence that Blue Coat’s GIN/WebPulse product satisfies this limitation of Claim 15 of the ‘844 Patent. The Accused Products Link a Downloadable Security Profile to a Downloadable B. Before a Web Server Makes the Content Available to Web Clients. Finjan presented substantial evidence—including expert testimony from Dr. Cole, Blue Coat documents and source code, and product testing—that Blue Coat’s accused GIN/WebPulse product performs the limitation of “linking the first Downloadable security profile to the Downloadable before a web server makes the Downloadable available to web clients.” Dr. Cole explained that the linking is performed by creating an ID for the downloadable based on a hash function that generates a unique ID. See e.g., PTX-564 (“the way [linking] is done is by taking a fingerprint or a cryptographic hash of that file which both SHA and MD5 are hashes, and that’s linking those together. So that has now links that downloadable to that security profile” (see Trial Tr. at 522:2-523:7)); PTX-427 (MAA Report showing Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 8 of 20 5 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 linking hashes to the Downloadable (see Trial Tr. at 527:13-528:8)). Furthermore, Dr. Cole explained how this linking occurred before the web server makes the downloadable available to Blue Coat’s protected client systems. Trial Tr. at 528:9-529:8 (explaining operation of Blue Coat’s MAA engines, FRS service and dynamo database and how security profile is linked before Downloadable made available to web client); JTX-3050 (architectural document demonstrating that FRS queries the Dynamo database that was populated by the MAA’s in order to make a decision before the web content is made available to the client” (see Trial Tr. at 529:9-530:17)); PTX-49 (discussing blocking of threats before they reach the client computer (see Trial Tr. at 532:19-533:25)); Trial Tr. at 532:19- 533:25 (Dr. Cole’s product testing confirmed content blocked before it was made available to the client); PTX-423 (“real-time decision” means decision regarding content made as the content comes in in real time and before the content is made available to a client (see Trial Tr. at 534:1-535:11)). As such, Finjan presented substantial evidence that GIN/WebPulse meets this element because it proactively pulls in content for analysis, generating profiles for this content before its protected web clients can access the information. Blue Coat’s argument that the “linking” must be before anyone on the Internet can get the file was already rejected during two claim constructions and during post-trial motions in Blue Coat I. First, during claim construction in Blue Coat I, Blue Coat argued that linking must be done at the “server from which web pages originate,” i.e. before the downloadable is ever published. Blue Coat I, Dkt. No. 118 at 18-19. The Court explicitly rejected this limitation. Id. Next, Blue Coat raised this argument in Finjan, Inc. v. Symantec Corp, Case No. 14-cv-02998-HSG (N.D. Cal.) (“Finjan v. Symantec”).3, where Judge Gilliam rejected that the claims required linking before the downloadable is “deployed” by the originating server as inconsistent with the intrinsic record. Finjan v. Symantec, Dkt. 170 at 25. Finally, Blue Coat raised this argument again during post-trial motions in Blue Coat I, which the Court rejected by finding that Finjan presented sufficient evidence to support a jury verdict of infringement finding that linking occurred as specified in the claims. See Blue Coat I, Dkt. No. 498 at 9; Dkt. No. 499 at 8-9; Dkt. No. 543 at 12-13 (Court finding substantial evidence). As such, Blue 3 As Blue Coat stated during trial, Blue Coat and Symantec are the same entity. Trial Tr. at 194:17-19. Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 9 of 20 6 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Coat has already raised and lost this argument on three separate occasions, barring it from again raising this rejected interpretation of the claim. III. LITERAL INFRINGEMENT OF THE ‘494 PATENT Finjan presented substantial evidence that Blue Coat literally, and under the doctrine of equivalents, infringes Claim 10 of U.S. Patent No. 8,677,494 (“‘494 Patent”). See generally Trial Tr. at 469:16–496:21, 540:18–560:8, 565:14-605:11; PTX-49; PTX-105; PTX-211; PTX-216; PTX-290; PTX-295; PTX-368; PTX-423; PTX-427; PTX-499; PTX-516; PTX-564; PTX-575; PTX-1025; JTX- 3001; JTX-3043; JTX-3050; JTX-3060. Finjan presented substantial evidence demonstrating that GIN/WebPulse satisfies Element 2 of Claim 10 of the ‘494 Patent, which is the only limitation Blue Coat disputes, requiring “a Downloadable scanner coupled with said receiver, for deriving security profile data for the Downloadable, including a list of suspicious computer operations that may be attempted by the Downloadable.” Finjan presented substantial evidence—including expert testimony from Dr. Cole, Blue Coat documents and Blue Coat source code— that GIN/WebPulse contains a scanner for deriving security profile information from downloadables, and that this profile includes a list of suspicious operations that the downloadable can perform. Trial Tr. at 546:14-552:17; PTX-211 (showing that YARA looks for suspicious operations (see Trial Tr. at 546:23-548:6)). In particular, Dr. Cole showed how GIN/WebPulse uses Yara rules to record suspicious operations, such as obfuscation and injection, performed by a downloadable. PTX-516 (YARA rules source code confirming YARA looks for suspicious operations such as Javascript obfuscation and identifies the specific code and operations being looked for (see Trial Tr. at 548:12-550:21)); JTX-3060 (Cookie2 security profile with list of all suspicious operations found within a file and concatenated string of the labels of the YARA rules that were fired (see Trial Tr. at 550:22-552:17)). Thus, contrary to Blue Coat’s assertion, Finjan presented substantial evidence identifying where in the YARA rules operations and code were identified, for example VBS_create rules and code (PTX-516); identification of riles that identify code and operations (id.); where operations of Javascript inject code into the system (id.); and Javascript obfuscation and associated code (id.). Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 10 of 20 7 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Blue Coat does not dispute that GIN/WebPulse will generate a list of the different Yara Rules that have triggered for a downloadable. Instead, Blue Coat argues that a person could not match back to the specific code that triggered listing these suspicious operations because some Yara rules can be triggered by more than one condition. Dkt. No. 464 at 13. However, Blue Coat does not identify why this is required or relevant to the claim, as the claim language of the ‘494 Patent requires a “list of suspicious operations,” and does not require listing or identifying code whatsoever. Furthermore, there are Yara rules that only have a single condition that could have triggered the Yara rule. See, for example, PTX-516 at BC2-1884578-79 (JPEG_EXIF_Contains_eval rule with a single “condition”). Blue Coat argues that two example Yara rule operations that Finjan identified do not, in fact, list suspicious operations that the downloadable can perform. Motion at 7. In doing so, Blue Coat makes entirely new attorney arguments about what “obfuscation” and “injection” are that were not supported by its own expert. Finjan’s expert’s unrebutted testimony is that “obfuscation” and “injection” are both suspicious operations, because they identify what type of operations the content performs. Trial Tr. at 485:5-486:16. In particular, obfuscation refers to the process of hiding material, and then dynamically generating it at the user’s computer. Id. at 486:8-12. As discussed above, Finjan presented evidence that “obfuscation” is a suspicious operation, because it identifies that the content will perform operations related to this obfuscation. Id. at 549:10-12. Injection relates to injecting malware code into another process, and Dr. Cole also stated that “injection” is another suspicious operation. Id. at 486:13-15. As such, Blue Coat’s argument that these cannot be suspicious operations is without merit. Blue Coat’s non-infringement expert, Dr. Nielson, failed to offer a single document to support his disagreement with the substantial evidence Finjan offered. Moreover, on cross-examination, Dr. Nielson conceded that functions such as Javascript eval, among others, are suspicious operations, despite the Yara rules being included that specifically identified “eval”. PTX-516 at BC2-1884578-79 (JPEG_EXIF_Contains_eval rule); Trial Tr. at 1770:12-21. He further admitted that evidence of Javascript eval or unescape operations is evidence that there was also Javascript eval or unescape code. Trial Tr. at 1771:14-16; 1772:8-14. Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 11 of 20 8 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 IV. INFRINGEMENT UNDER THE DOCTRINE OF EQUIVALENTS As set forth in Finjan’s opposition to Blue Coat’s motion for JMOL regarding the doctrine of equivalents, Finjan presented substantial evidence that Blue Coat’s accused GIN/WebPulse product infringes Claim 15 of the ’844 Patent under the doctrine of equivalents. (Element 2) (Trial Tr. at 469:16-496:21, 537:14-539:9; PTX-49; JTX-3007; PTX-423; JTX-3050; PTX-54; PTX-216; PTX- 199; PTX-460; PTX-1025; PTX-575; PTX 368; PTX 564; PTX 499; PTX 1025; PTX 427). Finjan also presented substantial evidence that Blue Coat’s accused GIN/WebPulse product infringes Claim 10 of the ’494 Patent under the doctrine of equivalents. (Element 2) (Trial Tr. at 469:16-496:21, 540:18-542:13, 552:18-554:10, 559:11-560:8; PTX-211; PTX-516; JTX-3060; PTX-1274; PTX-368; PTX-564; PTX-499; PTX-1025; PTX-427; JTX-3050; PTX-423; JTX-3043; PTX-49; PTX-216; JTX- 3001). Finjan’s expert Dr. Eric Cole testified at length about the background of the invention and the function of the GIN/WebPulse product, before ever beginning his element-by-element analysis of literal infringement, and later, infringement under the doctrine of equivalents. Dr. Cole’s testimony on the function of the accused GIN/WebPulse product and Blue Coat’s literal infringement may be used to support his analysis under the doctrine of equivalents, as stated by the non-precedential authority cited by Blue Coat. See Micro Motion, Inc. v. Exac Corp., 741 F.Supp. 1426, 1432 (N.D. Cal. 1990) (discussing the standard for doctrine of equivalents); Honeywell Int’l Inc. v. Universal Avionics Sys. Corp., 347 F. Supp. 2d 114, 116 n.21 (D. Del. 2004) (“evidence and argument on literal infringement . . . may also bear on equivalence”). Throughout Dr. Cole’s testimony on how GIN/WebPulse infringes the ‘844 and ‘494 Patents, Dr. Cole presented scores of Blue Coat’s technical documents, testimony from Blue Coat witnesses, and his own testing to demonstrate how the ’844 and the ’494 Patents are infringed by GIN/WebPulse. His testimony includes evidence demonstrating that if there are differences between the claimed inventions and GIN/WebPulse, those differences are so insubstantial that GIN/WebPulse infringe these claims under the doctrine of equivalents. For example, Dr. Cole presented evidence of Blue Coat’s own witness, Mr. Andersen, testifying to Blue Coat performing functions that would satisfy infringement of the second element of the ’844 Patent under the doctrine Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 12 of 20 9 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 of equivalents. Trail Tr. at 518:3-519:12 (Dr. Cole recounting Mr. Andersen’s testimony of the functionality of GIN/WebPulse.) Dr. Cole presented particularized testimony regarding how the accused GIN/WebPulse products infringe the ’844 and ‘494 Patents under the Federal Circuit’s function/way/result test for infringement under the doctrine of equivalents, including providing particularized testimony on an element-by-element bases. Honeywell, 347 F. Supp. 2d at 116 (“[t]he evidentiary requirements necessary to prove infringement under the doctrine of equivalents [include] . . . the need to provide equivalency on a limitation-by-limitation bases . . . [and] require[es] equivalency to be proven with particularized testimony and linking argument.”); Trial Tr. at 537:14-539:9; 552:18-554:10. Throughout Dr. Cole’s testimony on how the accused GIN/WebPulse products infringe the ‘844 and ‘494 Patents under the function/way/result standard, Dr. Cole provides particularized testimony that is linked to the relevant limitation. Finjan is able to rely on the same evidence for doctrine of equivalents that it used for literal infringement. Blue Coat’s only purported support to the contrary is a single out-of-district and non- precedential case, Honeywell Int’l Inc. v. Universal Avionics Sys. Corp., which directly contradicts Blue Coat’s conclusion. In particular, Honeywell states that “evidence and argument on literal infringement . . . may also bear on equivalence.” 347 F. Supp. 2d at 116. As such, Dr. Cole’s use of evidence for both literal infringement and infringement under DOE is sufficient to satisfy the Federal Circuit’s standards. Moreover, the only evidence Blue Coat presented to rebut Finjan’s substantial evidence is statements from Dr. Nielson, without citing any exhibits or witness testimony, that what Finjan accused is not equivalent. Trial Tr. at 1601:15-1602:20, 1626:12-1630:5, 1640:2-11, 1653:6- 22, 1683:22-1684:23. V. WILLFUL INFRINGEMENT OF THE ‘844 AND ‘494 PATENTS Finjan proved by a preponderance of evidence that Blue Coat willfully infringed the ‘844 and ‘494 Patents. WMS Gaming Inc. v. Int’l Game Tech., 184 F.3d 1339, 1354 (Fed. Cir. 1999); Halo Elecs., Inc. v. Pulse Elecs., Inc., 136 S. Ct. 1923, 1934 (2016). The evidence that Finjan presented at trial was more than legally sufficient for a jury to find that Blue Coat knew of the ‘844 and ‘494 Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 13 of 20 10 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Patents and engaged in egregious behavior by infringing in a manner that is malicious, deliberate, consciously wrongful or in bad faith. Halo Elecs., 136 S. Ct. at 1934; Fed. R. Civ. P. 50(a)(2). As an initial matter, Blue Coat concedes in its Motion that it had pre-suit knowledge of the ‘844 and ‘494 Patents. Motion at 17. Indeed, Blue Coat stipulated in the Final Pretrial Order that it has been aware of the ‘844 Patent since at least August 28, 2013 when Finjan filed its complaint in Blue Coat I, and that it has been aware of the ‘494 Patent since at least May 1, 2014 when the parties filed a Second Joint Case Management Statement in Blue Coat I. Dkt. No. 359 at 8. Thus, there is no dispute that Blue Coat was aware of both the ‘844 and ‘494 Patents long before Finjan filed the instant action on July 15, 2015. FInjan also presented substantial evidence that Blue Coat's behavior was egregious. Despite the fact Blue Coat had known of the ‘844 and ‘494 Patents for years, and a jury found on August 4, 2015 that Blue Coat infringed the ‘844 Patent in Blue Coat I, Blue Coat chose to take affirmative steps to continue to infringe the ‘844 Patent by implementing new technology in GIN (FRS), and infringe the ‘494 Patent by implementing new technology in WebPulse (YARA). Trial Tr. at 471:3-17; 482:5- 483:23; 486:19-487:23, 488:24-491:12, 496:25-497:3, 539:11-24, 542:14-24, 543:13-19, 547:3-13, 548:12-549:12, 551:1-23, 553:25-554:10, 555:12-25, 560:18-23, 587:21-25, 590:8-591:1, 595:1-14, 1411:4-1414:12, PTX-55; PTX-48; PTX-49; PTX-211; PTX-516; JTX-3060; PTX-55; JTX-3043; JTX-3050; Imperium IP Holdings (Cayman), Ltd. v. Samsung Elecs. Co., No. 4:14-cv-371, 2017 WL 4038884, at *3 (E.D. Tex. Sept. 13, 2017) (“Following a jury verdict and entry of judgment of infringement and no invalidity, a defendant’s continued infringement will be willful absent very unusual circumstances”) (citing Affinity Labs of Tex., LLC v. BMW N. Am., LLC, 783 F. Supp. 2d 891, 899 (E.D. Tex. 2011)). Blue Coat’s arguments that it thought the Blue Coat I verdict gave it a right to use GIN/WebPulse without taking a license to the ‘844 and ‘494 Patents is directly contradicted by the trial testimony of Mr. Schoenfeld, Blue Coat’s Senior Vice President of Product Management, who confirmed that Blue Coat knew it did not receive a portfolio license to all of Finjan’s patents and the Blue Coat I verdict was limited to the specific products at issue in that case which are different from Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 14 of 20 11 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 the products accused here. Trial Tr. at 1406:12-1407:5. Blue Coat provided no evidence, from fact or expert witnesses, that the infringing technology in Blue Coat I was purportedly identical to the accused technology. Rather, the evidence showed that Blue Coat implemented new technology, and did not have a license to all of Finjan’s patents by way of the jury verdict in Blue Coat I. Moreover, there is no dispute that Blue Coat did not attempt to design around the ‘844 or ‘494 Patents. WMS Gaming, 184 F.3d at 1354 (finding willfulness based on totality of circumstances when infringer knew of the patent and its significance and made no effort to design around it). In fact, Mr. Schoenfeld testified that Blue Coat did nothing to substantively change its products following the jury’s verdict of infringement in Blue Coat I. Trial Tr. at 1404:17-1405:4, 1406:15-1407:5, 1409:24-1410:16, 2005:9- 13. Finjan also presented unrebutted expert testimony from Dr. Cole that no reasonable company in the computer security industry would have increased its infringement, as Blue Coat did, while a patent case is pending against it. Trial Tr. at 464:20-469:11, 562:12-16; Tyco Healthcare Grp., LP v. Applied Med. Res. Corp., No. 9:06-cv-151, 2009 WL 5842063, at *2-3 (E.D. Tex. Mar. 30, 2009) (holding evidence of standard industry practice is relevant to analysis of willful infringement). Rather than act as Blue Coat did, Dr. Cole testified that a reasonable computer security company would get a license, reduce the infringing technology or create next generation products that do not infringe. Trial Tr. at 562:12-18. Dr. Cole provided further unrebutted testimony that a reasonable company would not continue developing and releasing products containing infringing technologies after a verdict of infringement against the company. Trial Tr. at 562:24-564:5. Dr. Cole’s opinion has no similarity to the conclusory expert opinion that was found insufficient in the Streck case cited by Blue Coat, where the expert admitted he had “never been involved” in developing controls that he claimed would be unduly laborious, he provided conflicting deposition testimony and there was ample contrary record evidence. Here, Dr. Cole provided an opinion that Blue Coat has entirely failed to rebut regarding standards of behavior in the industry, which is based on Dr. Cole’s vast experience in the industry, including as Chief Technology Officer of McAfee. Thus, Blue Coat’s attempt to discredit Dr. Cole’s Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 15 of 20 12 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 testimony is unavailing. Trial Tr. at 464:20-469:11; Streck, Inc. v. Research & Diagnostic Sys., Inc., 665 F.3d 1269, 101 U.S.P.Q.2d 1225, 1290-91 (Fed. Cir. 2012). Other circumstantial evidence at trial showed that Blue Coat willfully infringed Finjan’s ‘844 and ‘494 Patents. Finjan presented evidence, including Blue Coat’s internal e-mails in 2011, demonstrating that Blue Coat had secretly obtained Finjan’s patented technology in its M86 licensee’s product and, after analysis, identified the features in Finjan’s technology that Blue Coat should incorporate into its products. Trial Tr. at 1414:15-1420:23; PTX-929; PTX-113. This included evidence regarding Blue Coat’s attempt to “cover up” its behavior by creating a “fake” company to pretend to purchase Finjan’s products. PTX 929; Trial Tr. at 1414:15-1420:14. Willfulness can be established by circumstantial evidence particular where, as here, the infringing party had knowledge of the ‘844 and ‘494 Patents. i4i Ltd. P’ship v. Microsoft Corp., 598 F.3d 831, 860 (Fed. Cir. 2010), aff’d 564 U.S. 91 (2011); Stryker Corp. v. Zimmer, Inc., 837 F.3d 1268, 1278-79 (Fed. Cir. 2016). VI. WORLDWIDE DAMAGES ON THE ‘844 AND ‘494 PATENTS Finjan presented substantial evidence to support damages for the ‘844 and ‘494 Patents based on worldwide users of GIN/WebPulse.4 GIN and each of its components are made and used in the United States, and thus they infringe under 35 U.S.C. § 271(a). Carnegie Mellon Univ. v. Marvell Tech. Grp. Ltd., 807 F.3d 1283, 1306-7 (Fed. Cir. 2015) (35 U.S.C. § 271(a) “states a clear definition of what conduct Congress intended to reach—making or using or selling in the United States or importing into the United States, even if one or more of these activities also occur abroad”). Under 35 U.S.C. § 271(a), “[w]hen [the accused infringer] made the [accused products] in this country, it infringed [the claim at issue] . . . [and] [w]hether those [accused products] were sold in the U.S. or elsewhere is therefore irrelevant . . . .” See Card-Monroe Corp. v. Tuftco Corp., No. 1:14-cv-292, 2017 WL 3841878, at *43-45 (E.D. Tenn. Sept. 1, 2017) (quoting Railroad Dynamics, Inc. v. A. Stuki Co., 727 F.2d 1506, 1519 (Fed. Cir. 1984) (holding that a royalty award could reach units made in the U.S.—valued at their sale price—regardless of whether they were sold abroad)); see also Goulds’ Mfg. 4 Finjan incorporates its Response to Blue Coat’s November 2, 2017 Objections Regarding Infringement Under § 271(a) by its Manufacture and Use of GIN. Dkt. No. 405. Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 16 of 20 13 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Co. v. Cowing, 105 U.S. 253, 256 (1881) (approving an award based on defendant’s profits, reaching units made in the U.S. where some were to be used only abroad). As a preliminary matter, Blue Coat, in Blue Coat I, failed to make any argument that GIN/WebPulse was made outside of the United States until its post-trial motion, and the Court held that Blue Coat waived this argument. Blue Coat I, Dkt. No. 543 at 9-10. There are no new circumstances here since Blue Coat I that have changed the fact that GIN/WebPulse code is developed and compiled in the U.S. Importantly, Blue Coat did not appeal the Court’s JMOL Order in Blue Coat I to the Federal Circuit, and is now collaterally estopped from arguing that WebPulse is not made in the U.S. Dkt. No. 276 at 22-23 (collaterally estopping Blue Coat from re-litigating the “identical” issues); see also Roche Palo Alto LLC v. Apotex, Inc., 526 F. Supp. 2d 985, 995 (N.D. Cal. 2007), aff’d, 531 F.3d 1372 (Fed. Cir. 2008) (finding that issue preclusion (collateral estoppel) prevented accused infringer from re-litigating issues it previously raised and lost). Moreover, Finjan presented substantial evidence at trial establishing that the GIN/WebPulse product used abroad is made (compiled) in the United States. As set forth in the Court’s final jury instructions, the jury “may award damages [] if [it] finds that Finjan has proved that each of the claim elements of an Asserted Claim is made and combined in the United States.” Dkt. No. 428 at 40 (Instruction No. 30-1). Software is made when the source code is compiled into a program. CNET Networks, Inc. v. Etilize, Inc., 528 F. Supp. 2d 985, 994 (N.D. Cal. 2007). It was undisputed at trial that every component of GIN/WebPulse is developed in the United States. Dkt. No. 424 at 11-12; Motion at 20. Finjan presented the expert testimony of Dr. Medvidović, relying upon Blue Coat documents and witness testimony, that Blue Coat makes and compiles in the United States GIN/WebPulse, including all of its subcomponents, and that all MAA code is made in and pushed out of the United States. Trial Tr. at 982:22-987:2; PTX-216. Another of Finjan’s technical experts, Dr. Mitzenmacher, testified to the same. Trial Tr. at 765:10-12. Finjan also offered further evidence through Dr. Cole, Blue Coat documents and Blue Coat witness testimony that all development, maintenance, enhancement, and work on GIN/WebPulse is done in Draper, Utah. Trial Tr. at 495:7-496:21; 536:6-10; PTX-216. Dr. Mitzenmacher also testified that the GIN/WebPulse Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 17 of 20 14 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 product is developed in Draper, Utah, all GIN/WebPulse updates are pushed out of that location, and if the GIN/Webpulse service in Draper, Utah is shut down, GIN/WebPulse in its entirety would cease to function. Trial Tr. at 765:3-22. Furthermore, at trial, Finjan presented Blue Coat’s responses to Finjan’s requests for admission that GIN/WebPulse, including DRTR, is developed in the United States, and that updates for WebPulse, including DRTR, are pushed out of the United States. Id. at 889:9-23. Thus, Finjan presented substantial evidence at trial showing that all of GIN/WebPulse’s source code is maintained in the U.S., it is compiled in the U.S., and all updates of GIN/WebPulse are made in the U.S. and are pushed out to all of its data centers. Accordingly, every version of GIN/WebPulse running on any of Blue Coat’s worldwide data centers are made in the U.S. Finjan also presented substantial evidence that the GIN/WebPulse system as a whole is controlled in the U.S. and that the benefit of GIN/WebPulse is for Blue Coat in the U.S. See NTP, Inc. v. Research in Motion, Ltd., 418 F.3d 1282, 1317 (Fed. Cir. 2005) (“The use of a claimed system under section 271(a) is the place at which the system as a whole is put into service, i.e., the place where control of the system is exercised and beneficial use of the system obtained”); Decca Ltd. v. United States, 210 Ct. Cl. 546, 567-68 (Ct. Cl. 1976) (finding use in the United States of accused system where transmission from a Norwegian station was controlled by the U.S. in the sense that activity in the U.S. established and continuously monitored signals and ensured synchronization with the Norwegian station). Dr. Medvidović also offered testimony and evidence that GIN/WebPulse used overseas is controlled by Blue Coat from the United States, and that Blue Coat’s U.S. and worldwide users receive the beneficial use of GIN/WebPulse from the United States. Trial Tr. at 1051:24- 1055:20; PTX-52. Finjan also presented substantial evidence that FRS, the component that infringes the ‘844 Patent, is in GIN/WebPulse, which is developed in the United States, and the results of the Malware Analysis Appliances are fed into FRS in the United States and for the benefit and use within the United States. Trial Tr. at 513:6-514:3; 529:9-532:18; 534:8-536:16; 916:15-918:2; 919:7-922:14; 981:23-982:16; 1042:3-18; 1043:11-19; 1051:24-1055:20; 1120:11-1120:21; JTX-3050; PTX-54. This benefit and control test is not the “incorrect” standard as Blue Coat claims (Motion at 20)—rather, it Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 18 of 20 15 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 establishes use of GIN/WebPulse in the United States even if any component of GIN/WebPulse is used outside the United States. NTP, 418 F.3d at 1316-17. As such, Finjan presented more than sufficient evidence for a jury to find damages based on worldwide users, since GIN/WebPulse infringes under 35 U.S.C. § 271(a) both because it is made in the U.S. and because it is used in the U.S. Rather than refuting any of this evidence in its Motion, Blue Coat misstates the governing law. Blue Coat relies heavily on Microsoft Corp. v. AT&T Corp., 127 S. Ct. 1746 (2007), yet this case is not relevant to § 271(a) here. The Microsoft case relates to 35 U.S.C. § 271(f) and finds that exporting a component that would later be assembled into an infringing system did not amount to infringement. Microsoft, 127 S. Ct. at 1755-60. Unlike Microsoft, here, the parties do not agree that infringement only occurs when software is installed abroad. To the contrary, in this case, GIN/WebPulse is undisputedly made (compiled) in the U.S and GIN/WebPulse itself infringes without the need for any additional hardware or components to be installed outside of the U.S. As such, Microsoft is inapplicable, because the complete infringing product, GIN/WebPulse, and components like WebPulse, FRS, DRTR, and MAA, are all made and used in the U.S. Notably, this Court in CNET Networks, Inc. v. Etilize, Inc. considered Microsoft and concluded that an infringing product was made in the U.S. when it was “expressed and stored as machine- readable object code, e.g. burned on a CD– ROM or written to a server hard drive such that it is capable of being downloaded from the internet…[and the] software become an actual, physical component amenable to combination.” 528 F. Supp. 2d at 994 (citing Microsoft, 127 S. Ct. at 1756). CNET mirrors this case because Finjan provided evidence that GIN and it subcomponents were developed, compiled and stored on a computer readable medium in the U.S. as a complete infringing system. See NTP, 418 F.3d at 1316-17. Similarly, nothing in Fr. Telecom S.A. v. Marvell Semiconductor Inc. extends the holding in Microsoft in a way to discredit all the evidence of infringement by GIN/WebPulse within the U.S, as the accused product in Fr. Telecom was never made, used or sold within the U.S. 39 F. Supp. 3d 1080, 1102–03 (N.D. Cal. 2014) (recognizing that accused infringer established “undisputed evidence that the manufacturing, sale, and delivery of the accused chips all occurred outside the United States”). Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 19 of 20 16 FINJAN’S OPPOSITION TO BLUE COAT’S PARTIAL CASE NO. 15-cv-03295-BLF-SVK RENEWED RULE 50(B) MOTION FOR JMOL 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 Dated: December 22, 2017 Respectfully submitted, By: /s/ Paul J. Andre Paul J. Andre (SBN 196585) Lisa Kobialka (SBN 191404) James Hannah (SBN 237978) Hannah Lee (SBN 253197) KRAMER LEVIN NAFTALIS & FRANKEL LLP 990 Marsh Road Menlo Park, CA 94025 Telephone: (650) 752-1700 Facsimile: (650) 752-1800 pandre@kramerlevin.com lkobialka@kramerlevin.com jhannah@kramerlevin.com hlee@kramerlevin.com Attorneys for Plaintiff FINJAN, INC. Case 5:15-cv-03295-BLF Document 477 Filed 12/22/17 Page 20 of 20