internet security gentlemen just stay right there for a second court doesn't see how this arrangement can work today splitting a initial presentation with two re with letting you make your arguments as you need to in both of those would give you a little b nine minutes for line of questioning if there's three minutes and then you're sitting down and so let's at least start this direction mr jones for we'll start with you thinking you're going to speak for nine minutes and mr galvin you'll have six coming back bach i suppose you are permitted a cerebral but we're putting some restrictions on your opposing counsel we're hoping that your cerebral if necessary at all will be will concentrate your argument on your initial time before the court if we can proceed from that and if at some point you get an issue you simply cannot address the court will understand that and allow mr galban to quickly substitute for you at the podium you may proceed thank you your honor i do apologize to the different hues products that led to the issue but if i could we understood that we have also i mean i do understand we just want to help you out here ok i'd also like to start with real secure because that's i assessed its own prior work product that did exactly what the patents claim the for only issue about real secure is whether it automatically received and integrated reports when it's one excuse me one it combined in organized reports into the activity tree that's reprinted in our briefs and that issues especially straightforward because everyone agrees the correlating the evidence on which the jury might have relied was the testimony of their expert but their experts testimony was flatly contrary to the claim construction the the court construed correlating to be combining reports to reflect underlying commonalities nothing more and i don't believe that there is a factual dispute about whether real secure did that combined reports reflect underlying commonalities when it combined reports into the activity tree according to the source the destination or the type of events and what it also combine into a single entry there are experts testimony was well that's not sufficiently meaningful but that's wrong as a matter of law because the claim construction doesn't call for meaningfulness beyond combining reports to reflect underlying commonalities and they also don't as far as i can tell they don't argue that this combining of reports the people paid for bought this products they would have that is completely meaningless for random their argument seems to be that well it's not sufficiently meaningful but that's certainly not a cla term and as in cases like i have eight or as in the first appeal in this case i mean the problem with coralie for wednesday well that's why the court construed it to be combining reports putting reports together in a way that reflects integrating and correlating is just combining reports reflect underlying commonalities nothing more under the undisputed claim construction and their expert didn't dispute that yes real secure combined reporters at it in a room disputed that these are commonalities in fact the source and destination are what he test their expert testified to the commonalities for purposes of infringement so we know that these are commonalities and the reports are being combined in this way and under the undisputed claim construction of correlation as a type of integration that's all that's required as a matter of law also i think it might be important or sound what reiterated means these patent claims all they call for is reorganizing data in a way that's helpful to the user there are some other unassertive dependent claims the call for can the system to actually do something to invoke countermeasures for example with what about and real ninety seven again that was the issue the mr galvin was planning on addressing but our basic point there is that from this court's first decision in this case it's undisputed that emerald ninety seven it's a space all but one of the elements and that element is the categories of network traffic data we have several basic points on that first if you just look at the categories of network traffic  there so forth here they include network connection requests network connection denials before you even get into specific references those are obvious to try and in fact some of these categories are necessary to try because there's no other way to do some of these things and will ninety seven then specifically references as related are for this purpose intrusive activity ninety one and intrusive activity again specifically it sets forth some of these network categories so i think the only place that they can even try to go is to say well with there have been a reasonable expectation of success but on that issue there were prior products that actually were using these categories to monitor not works and that's why when you take this of the case from the first decision and you put it together with what we have with with with the references i just mention it seems to us to be an overwhelming case for obviousness which especially considering the obviousness is when you take those historical facts obvious trotting out an appeal for the most part was they did not rely on before the jury do you agree that on the systems on the old records could be absolutely not and here's why the system claims require that the hierarchical monitor which in our case a s network yes but our point is that a p c does have to be installed because if the p c is not it's not just the purchase of a p c that adapts site protector and makes a protector capable of performing the relevant functions but there are documents that say it was  not yet which is wrong this is one of the key points at the forfeit of that theory twice a trial which is why we don't ever evidence in on it at trial they only argue that the capability is required they never argue to trial never produce a notice of this period of this c the two relevant components of fusion have to be separately installed such that a p c is not automatically install of the use of the two documents work these are both documents are more than thirty pages long and the documents are in there for example spec to intent that we intended that a p c would be installed in some fashion and therefore they view that is as relevant to intent with respect to inducement but their expert admitted the trial that there was no automatic installation and he was right and this is the thing about it he was right we don't have the evidence in the record to show that precisely because we weren't on theory a notice that this was their theory but under case but first they forfeited the theory by not presenting it and second under decisions of this court such as for xenia us if they want to defend a jury verdict by pointing to isolated snippets there somewhere in the record they had to actually call the jury's attention to that and call our attention to it so that it actually might have on a plausible basis for the jury verdict as that we would have been a notice of it it's important understand that a jury can get any number of very long documents with attachments and whatnot but if the jury didn't actually have the opportunity but it but if you don't put anybody in notice of that you lose the jury trial it or say oh look there's something buried somewhere in the record by three nobody else knew about that's not a fair trial anymore that's the the record that's the problem that i have there there are there are other theory on infringement that ends up being that well surely somebody must have frenched but this court's never been willing to just presume infringement in circumstances like this where the product is intended and marketed but actual evidence of a specific instance of direct infringement the court's never been willing to simply presume infringement in those circumstances the court has no further questions all give right thank you thank you in the in the absence sorry in the abstract that's true yes there were prior systems that analyzed some of the types of network traffic data they were different systems they operated in different ways than the claim to system so this is this is a case like many of the obviousness cases where the defendant points to the ability to find an element in the prior art here one over there and say well what about obvious to combine them just to clarify your honor i think you're asking me about the combination of intrusive activity in emerald simple to go look at these other kinds of traffic in the context of this system number of questions not simple question is whether it would have been obvious for somebody to try to use this kind of practice and that was so we'll know the right to turn architectural paper emerald ninety seven these were people with extreme skill in the art they had done that they had done keep prior art systems the ide systems the night systems and they said to the truce you got intrusive article they know about it  did but it's new it's never been as far as i know the lot of it because one reference sites and other reference error go motivation to combine those references to yield a later claimed invention it's relevant sure that's relevant to their case that that there was a citation it's by no means dispositive and there was there was testimony live an enterprise system is twenty to fifty computers why does that present scale ability problems with respect to a local area network well twenty to forty is probably a local area network the big enterprise networks the sort of context we're talking about for these patents is thousands and thousands of computers but the prior art and i didn't are experts tell us could be twenty or more in the other fifty or more there will if we look at the bottom end of that twenty to fifty computers why is that doesn't seem as you see the present scale ability problems with regard to land well again i don't i'm not entirely sure what you mean by scale ability is it that the issue that your expert use primarily to avoid the obviousness well no no he didn't actually whether you whether you focus on what an enterprise is on the number of computers or not this intrusive activity article the other prior art didn't have all the elements of the claim anyway so it didn't that the prior art wasn't distinguished on the basis of enterprise network me this is an argument that actually didn't even come up until during the course of trial this is this is something defendants with the fans and that is that this thing if it's not skill building what is that what is the reason she wouldn't do this prior well it's because it's a fundamentally different kind of system that was that was in the case of intrusive activity in particular and that's the combination they rely on intrusive activity plus emerald that paper if you look at it is about it says don't look at the network traffic data because there's too much of it the paper in fact says we tried that the author of that was their expert todd haver line he tried looking directly at network traffic data too much data couldn't deal with it the intrusive activity paper is actually about looking at something else looking at abstract objects that represent characteristics about the network so it's actually a file and it was testimony about this again from dr c d s and other folks at trial it's a fundamentally different approach to the problem of detecting intrusive activity is it of some relevance sure we can't we can't say otherwise i mean the inventors of our system cited you know if these are academic folks they're very generous in citing related work but that's a far cry from saying go look there for a specific kind of network traffic and look at look at how they might analyze it and use that in our system so it wouldn't but but but it's not intrusive activity  through this kind of network or what have they say about that if it's not scalable of the what is well i don't think the inventors themselves directly testified as to why it wasn't obvious to look at that kind of traffic ok what the said that it would not be obvious to if you're faced with the problem of emerald to look to the monitoring of the kind of traffic that was that was discussed in intrusive activity because fundamentally they're they're different  with without a concrete example i don't have a kind of creepy answer for your honor because again the only combination they relied on was general plus intrusive activity i mean it was known as our eyes on prior art real security there were systems out there that looked at some of the categories of network traffic recited in the claims for different purposes in the context of different systems the question is whether looking at that activity in the context of an enterprise network system where you have multiple monitors you can't point me to any testimony where they thought it would be obvious to look at these other kinds of network at the moment no we'll see if we can find you a site but please allow me to finish that i want to answer the question you asked before because it's directly related to this issue ok the inventors themselves testify it was certain it was surely not obvious to them because when they again they were familiar with a lot of these prior systems they were the architects of two of the premier systems ides and nights they had done monitoring of traffic and in their emerald paper when they when they were thinking of adapting it to a larger enterprise they listed a number of things that they thought would be the most promising none of those worked out none of them ended up being among the claimed categories of traffic none of them worked out that's pretty powerful evidence that though it did they didn't even think to try them themselves and the only evidence in the record that it would have been obvious to try comes from defense expert who of course the jury wasn't required to believe who obama wait himself happened to have been the author of the paper they want to use to combine with emerald so you've got a bias in and a systems yes not all of them i mean i don't want to overstate generally but he did but there there there is the case that some of the reciting categories were monitored by prior systems different systems used for different purposes  again that don't you couldn't it's not as though you could take an aspect of that system and combine it with the rest of the disclosure of emerald and while you wind up with the with the patented invention not all these systems are incompatible they're fundamentally different in terms of their architecture and you can't do that so if i can go on to i don't know if you want to comment on real secure but i do want to get to my infringement issues just quickly on a real secure this is a fundamental  invalidity argument and the fundamental problem with it is they actually ignore the claim construction for receiving and integrating they made the same argument to judge robinson and judge robinson properly rejected it they focus only on the construction of the dependent claim correlating and they ignore that independent claim requires that receiving receiving an integrating requires combining reports into a different and product something more than simply collecting and reiterating data there's no different end product they've never identified one no witness testified that there was one that's the end of the story on real security all right now let me get to please if i can infringement because this obviously is our of great importance to us the fundamental issue here is whether capability alone is enough and these claims clearly it is these claims used the phrase adapted to it really couldn't be clearer for the system  claims it actually turns out that this court very recently construed that language adapted to in the power one case and said yes capability is enough if you did so beautifully trial whether the a p c was installed by the full well we didn't but this is this is an interesting turn of events here the defendants never raised the issue of capability or that they had no known infringement defense at trial period that the other the n use it was all about use it was all about the method claims they never contested that they had the capability upon these products being installed since they never raised it why would we have affirmatively addressed that we didn't have the burden of proof  and we did put in the evidence though your honor right we did put in quite a bit of product manuals and brochures and instructions that that do talk about installing necessary components that they are installed that they are designed to work together that they in fact work together that the defendants teach their customers how to use them together in the infringing way all of that suit the record and i don't think it's incumbent by us and i'm certainly not aware of any of any authority of this court that says we have to anticipate a context of showing intent to induce infringement and we use that more broadly in the context of establishing in infringement generally even direct infringement by in this case would be i assess itself because of course in addition to whatever customers do with these things there's quite a bit of evidence in this record that the defendants themselves used the products as in the claimed arrangement demonstrated them for their for their customers i remember that place in the enabled by default both pieces of the fusion product of those two pieces of this product i a c and a p c they're both enabled by default there's another there's another site the document talking about the fusion installer the process of installing fusion over all says that it installs a p c these are in our brief that one is in a three zero four six seven so you've got you've got evidence in the record that these these are installed by default   cannot in a position to say that the case is wrong i don't think that case presents an issue for us and these facts what is the somewhat similar in the sense that there was a reference to the stepper motors or whatever was  there somewhere in the record but we said no you know why on that because it was never called the jury's attention never or you the jury in so far is it talks about allying on a document specifically argued to the jury i suppose you could say it's you know it's in the ballpark but but you know the jury the jury gets the evidence the evidence is in the room the documents were were talked about for another purpose you know it isn't as though this is a needle in a haystack kind of thing as to be in these documents show how the products work they say you install it when you install it's enabled by default it's multiple documents it's not just one document they didn't call a witness to dispute the document and they couldn't i mean the piece of evidence after all that they're relying on here is a leading quickly sink leading question of our expert which we say lacks foundation and he says  i don't really know maybe i saw that in equivocal statement by our expert we've got a jury verdict in our favor i just don't see how under under any case i'm familiar with from this courthouse that can mean that that's jame all and that verdict gets thrown out when there is there is far more evidence in the record of the contrary and they know this happens i mean with all due respect there's no question these products are installed there's no question these products infringe when they're installed in the way they're intended to be installed and used  then you know that this set of facts distinguishes this case from really any of the other indirect infringement cases on which they're trying to rely court like to start with the issue of emerald one hundred seventy because the court of the court and raise some issues with that in particular i think it's important to stress that the undisputed evidence of record both from  sri sexpert as well as from the from the inventor is that others had successfully monitored network connection requests prior to the filing of this pad that is undisputed therefore these categories were no and were used successfully beyond dispute and in particular the evidence that was submitted to trial was that the i assess real secure product itself which is the mic used that will subsequent versions enterprise networking system monitored network connection requests to detect syn flood attacks that's the testimony from the inventor the syn flood attacks are an example contained in the patent of the kind of attacks a kind of intrusion detection that the patent system was designed to go after so you have a clear teaching in the art the other succeeded in using these in these categories they are the most obvious to try there is a predictable set of these categories when you're defining a set of network protocols for moving information across the internet you need to have a well defined set of categories such as network connection requests and niall's i want to connect your network you reject it you need to measure network packet data volume those that precise kinds of attacks that were going to be that the systems were designed to detect secondly on the issue of skill ability that i fear the argument was made here that that wasn't the distinction that seemed to be the only distinction that was offered by dr considers that that to argue that the interests of activity system was not scalable but as this court noted they aren't they didn't argue that into enterprise networks to rip were reduced to systems that required thousands of nodes that even their even their experts said a system of fifty computers could be sufficient to constitute an enterprise network method for detecting suspicious activity in an enterprise network so that was already resolved the only question was was there sufficient was there evidence in the record that was undisputed that established success in monitoring these categories and there was and this question of obviousness is ultimately an issue of law on the undisputed evidence this court can conclude as a matter of law that the claims are invalid what about  order to satisfy the system claim under a surprise on theory the license authorization that is cited to by sri was not a license to use the products in conjunction with each other the license was a license used as a firewall it could be used for intrusion detection this was sort of the selling point of the box if you will that it could do multiple things a user had to provide a purchaser had to separately license which functionality they wanted to use so the testimony of twenty five percent is only that is lower level monitor the accused lower level mine that only twenty five percent at most of the semantic customers even turned on that intrusion detection system functionality but that is not sufficient to establish infringement under the system claim because it would still only prove that there was a deployment of two s t s low level monitors as well as the manager product and there's no evidence in the record there simply  no evidence in the record of any customer purchasing and manager product into s t s products they rested their case in chief on infringement without submitting any evidence of sales so they obviously regret that make sense to to license this feature without making the combination and using the things together yes you're out of the can be the boxes can be used as it was undisputed from a surprise own expert that the s t s monitor can be used in depend it could be used to detect and respond to a trace of the tax so you could deploy the s t s monitor at the gateway to your network if you detected the syn flood attack or a denial of service attack the box would detect it and it could take action you could close the network connection so it didn't keep getting bombarded with information on its own the box itself could store information that a user could log in and see reports of intrusion detection it doesn't need to be used in conjunction with a manager product and there's no evidence on this record that it ever was i also want to dress briefly this issue of an adaptive vs capability we think that the claims are clear the claims require for the system claims that the monitors be deployed to claim language says that the monitors must be deployed so a signal is insufficient and the claim language clearly says that the hierarchical monitor must be adapted to automatically receive an integrated reports and the core district court in its opinion found that there is no evidence of any configuration of any semantic products to work in that in that way adapted and the court district court properly rejected the notion that it was simply enough that it was capable of being adapted because there is no evidence that the configuration necessary to ensure that those in those two modes could talk together actually occurred briefly one last point there's an argument made in a surprise briefing that the manager product out of the box somehow could communicate with the s t s monitor that is simply not true the evidence of the record stablish is that the only monitors that out of the box on the box functionality that the manager product could communicate with were third party products there is a checkpoint product p i x product other products there's no documentation in the record that the stablish is that the u s g s monitor occurred could  and capability again do a back to the at to the evidence as opposed to the argument they want to make this this issue boils down very simply to was the jury entitled to believe what their documents showed or is it enough for them to be able to say that there is no direct evidence of a specific customer doing x and again under this court's case law the answer to that question is clear capability is enough let me give you a couple of record sites because i think they're really critical to correct a few of the arguments you just heard correlation of the higher level monitors in the symantec system is an out of the box capability it is the air out of the box appendix three  ninety one three zero one ten three zero one twenty eight and there are other examples in the appendix where the where the jury saw this the sensors and this is particularly important in light of what you just heard these sensors yes you have to have two or more which many of their documents show which they teach their customers the sensors can generate i d s advance for correlation instantly their own witness testified to this alleged testimony that's in a one zero five four he said and i quote the software is the air you have to buy a license to run it to use it their argument might have some force for the method claims for the system claims it is neither here nor there that's the end of the story on the system claims for the symantec for the symantec system as for use itself just turning to use in the method claims in the few seconds i have left again there is very substantial circumstantial evidence of use their marketing materials their product manuals the fact that they sell special licenses to use the functionality is judged said why some are going to buy that if they're not going to use them together council had an answer to that but there is no that's not evidence in the record that's an argument but there is no evidence in the record thank you thank you