NOTE: Pursuant to Fed. Cir. R. 47.6, this disposition is not citable as precedent. It is a public rec o rd. 

## United States Court of Appeals for the Federal Circuit

06-1182

SAFECLICK, LLC, Plaintiff-Appellant, v. VISA INTERNATIONAL SERVI CE ASSOCIATION and VISA U.S.A., INC., Defendants-Appellees.

______ ____________________ DECIDED: October 23, 2006

______ ____________________ Before BRYSON, Circuit Judge , CLEVENGER, Senior Circuit Judge , and GAJARSA, Circuit Judge

. CLEVENGER, Senior Circuit Judge

. Plaintiff-Appellant Safeclick, LLC ("Safe click") filed this pat ent infringement suit against Defendants-Appellees Visa International Service Assoc. and Visa USA, Inc. (collectively, "Visa") on December 30, 2003, in the United States District Court for the Northern District of California. Safeclick alleges that Visa's "Verified by Visa" service infringes claims 6 and 7 of U. S. Patent No. 5,793, 028 ("the '028 patent" ). On July 19, 2005, Visa filed a motion for summary judgm ent of noninfringement. The motion was granted on December 21, 2005, and judgment was thereafter entered in Visa's favor. Safeclick appeals that judgment. We affirm

.I The invention of the '028 patent is an "e lectronic transaction security system . . . designed to substantially prevent the unaut horized use of transac tion identification codes such as credit card numbers for pl ac ing transaction requests electronically via any suitable communication link, such as the Internet." '028 patent col.1 ll.43-48. So, for example, when a card-holding cons umer ("transactionor" ) wishes to make a purchase over the Internet from an online merchant ("tran sactionee"), the invention attempts to ensure that the parties to the transaction ar e who they purport to be. In order to make a verified purchase usi ng the invention, t he transactionor send s a transaction initiation request from his or her computer to a computer operated by the transactionee. Before proceeding further with the transaction, the transactionee' s computer requests verification from a comp uter operated by an entity such as the bank that issued the credit card ("verifier"). T he verifier's computer does this by sending an acknowledgement request to the transactionor's computer. In response, the verifier' s computer must receive a pr ivate identification code that uniquely identifies the transactionor's computer. If the verifier's co mputer does not receive the code it expects , the transaction will not be verified. Because claims 6 and 7 of the '028 patent are substantia lly similar, only c l a i m 6 is reproduced here (with emphasis on the rel e vant claim limitation): 6. A method comprising the steps of: transmitting a transaction initiation r equest requesting the initiation of an electronic t r ansaction to a transacti onee c o mputer from a transactionor computer, the transaction initiation r equest includ ing a public ident i fication code uniquely identifying the trans actionor computer, and a public identification code uni quely identifying a tran sactionee c o mputer;

06-1182 2receiving by the transactionee computer the transaction initiation request; transmitting a verification reques t requesti ng verification of the transaction from the transactionee computer to a ve rifier computer in res pons e to the transactionee computer receiving the transaction init iation request, the verification request including one of a private identifi cation code and a public identification c ode uniquely identifying the transactionee c o mputer and the public identific ation code uniquely identif yin g the transactionor computer; receiving the verification request by the verifier computer[;] transmitting an acknowledgement r equest requesting a cknowledgement of the electronic transac tion from the veri fier computer to the transactionor computer in respons e to the v e rifier computer receiving the v e rification request; receiving the acknowledgement request by the transactionor computer; transmitting an acknowledgement res ponse indicating one of a vali d electronic transaction and an invali d electronic transaction from the transactionor computer to the verifi er c o mputer in respons e to the transactionor computer receiving the ack nowledgem ent request, the acknowledgement respons e including the private identificat ion code uniquely identifying the transactionor computer ; receiving the acknowledgement respons e by the verifier computer; transmitting a verification response indic a ting one of a valid electronic transaction and an inv a lid el ectronic transac tion from the verifier c o mputer to the transactionee computer in re s p onse to the verifier computer receiving the acknowledgement response; and receiving t he verification response by the transactionee computer and exec uting the electronic transaction in response to the transactionee computer receiving the verification re spons e indicating a valid electronic transaction. '028 patent col.23 l.60 – co l.24 l.41 (emphasis added).

06-1182 3II More than a decade ago, Visa began deve lopment of an internet-transaction protocol known as "3- D Secure" and marketed it under the name "Ver ified by Visa." Like the invention of t he '028 pat ent, Verified by Visa s e eks to reduce fraud b y verifying the identity of an online consum er who attempts to make a purchase using a registered Visa credit card. The details of Visa's methodology are largely unimportant to the present case. Suffice it to say, a consumer who attempts to make a purchase using the Verified by Visa system must enter a password into his or her computer and send it to the card-issuing bank' s "Access Control Ser v er" ("ACS"). Before that password is sent, however, it goes through a proc ess called "S ecure Socket Layer" ("SSL") encryption. The SSL protocol enables the two communica ting computers to generate a secret key for use during the communication sess ion. If the transmitte d information is not encrypted using this key, then the receiver will b e un able to de crypt the i n formation. Consequently, the password s ent from the consumer to the ACS must be the correct password, and it must have been encrypted usi ng the appropriate key. Upon its receipt of the encrypted password, t he ACS decrypts the password and cross references it with the password on file. If the message c ontaining the password cannot be decrypted— indic a ting a possibility that it may have b een changed accidentally or deliberately in transit—or if the decrypt ed password does not m a tch the one o n file, then the transaction will not be verified.
III In the proceedings below, the district court construed "private identification c o de uniquely identifying the transactionor computer" as "a nonpublic code that singularly

06-1182 4identifies the computer used by the transactionor, but not onl y the transactionor himself or herself." Within thirty days after the i ssuance of that order, Safeclick was permitted, pursuant to the Northern District of California' s Patent Local Rules, to serve Vis a with its Final Infringement Contentions (to replace its Preliminar y Infringement Contentions, discussed infra ) in the form of "[a] chart identifying s pecifica lly where eac h element of each asser t ed claim is found within each Ac cus ed Instrumentality." Patent Local Rules 3-1(c) and 3-6(a). Safeclick took advantage of t he opportunity and timely served Visa with a chart in which it is asserted that The privat e identific a tion code uniquely identifying the c a rdholder computer is the authenticating in formation entered by the cardholder, which includes the cardholder' s pa ssword, and, in some case[s], a personal identific ation statement. (JA at A02948.) Visa subs equently filed a motion for summa ry judgment of noninfringement, arguing that there could be no lit eral infr ingement because Safec lick had not adduced any evidence that Verified by Vis a meets the "private identif ication code" limitation as construed by the court. Safeclick answered with a detailed explana tion of its theory: In Verified by Visa, the cardholder enters a password into his or her computer to verify his or her identity. Bef o re the cardholder s ends the password, the cardholder computer and iss u ing b ank computer (Access Control Server, or ACS) share a unique cry p tographi c key. (Tsudik Decl. ¶¶ 10-11) The cardholder computer us es this unique key to scramble, or encrypt, the typed-in password s o that only the verifier co mputer can read the encrypted pass w ord. (Id. ¶ 11) This encrypted password is t hen sent to the ACS for authentication. (Vis a Br. 11-12) The Verified by Visa password is a "privat e identification c ode" as defined by the Court. It i s undisputedly "nonpublic" becaus e it is not k nown to the merchant, and thus is not known to all of the parties to the transaction. (Tsudik Decl. ¶¶ 13 [sic, ¶ ]; Dominguez Dep. 133:18-25 [;] Mortara De cl. Ex . 5) And this Verified by Visa pass w ord singularly identifies the cardhold e r computer because the ACS c a nnot succes s fully proc ess the encrypted data unless it comes from the cardholder co mputer. (Tsudik Dec l . ¶ 11)

06-1182 5(JA at A03395) (footnote omitted) . Visa objected to this theory of infringement under Patent Local Rule 3-6(a) because it was, in Visa's opinion, a theory that had not been set forth in Safeclick's Final Infringement C ontentions. Specifically , Visa characterized Safeclick's new theory that the encrypted ve rsion of the cardholder 's password satisfies the "private identification code" limitation as being m a terially different than Safeclick's previous theory that the plaintext versio n of the cardholder' s password (i.e., the password " entered by the cardholder") satisfies that limitation. Acco rdingly, Visa, in its reply, urged the cour t to preclude Safec l ick from proceeding wit h its n e w theory. Although the court enterta ined additional briefing on this iss ue, at no time did Safeclick seek leave to amend its Final Infringement Contentions. See Patent Local Rule 3-7 (permitting amendment for good cause shown). The district court considered the su mmary judgment motion on the papers and concluded that Safeclick had in fact violated the local rules by devi ating from its Fin a l Infringement Contentions. In the court's vi ew, Safeclick's old theory of infringement only required the password entered by the cardholder to si ngularly identify the transactionor computer, whereas Safeclick' s new theory of infringement requires both the password entered by the cardholder and the encryption information to singularly identify the transactionor computer. In other words, "it is the entry and the sendin g of [the password] in the manner that Visa ha s chosen that ident ifies the c a rdholder computer." Safeclick, LLC v. Visa U.S.A., Inc. , No. C 03-5865, slip op. at 15 (N.D. Cal. Dec. 21, 2005) (emphasis in or iginal). Thus, the district court refused to consider Safeclick's new theory , and summary judgment was granted in Visa's favor. On appeal, Safeclick urges this court to find that the district court abused its discretion.

06-1182 6IV The Northe rn District of Ca lifornia, like every other dist rict court, h a s its own set of local rules for litig ants. However, pres umably due to the volume of patent cases brought there, the N o rthern Distr ict also has a special set of Patent Local Rules

. Pursuant t o those rules, a party claiming patent infringement—gener ally the plaintiff— must provi de the following: Not later than 10 days after the Initial Cas e Management Conferenc e, a party claiming patent infr ingement must serv e on all parties a "Disc l osure of Asserted Claim s and Preliminary Infringement Contentions." Separately for each oppos ing party, the "Disc l o s ure of Asserted Claims and Preliminary Infr ingement Contentions" shall contain the following information:

. . . (c) A chart identifying specifica lly where each elem ent of each asserted claim is found wit hin each Accused Instru mentality, including for each element that such party contends is governed by 35 U.S.C. § 112(6), the identity of the struct ure(s), act(s), or material(s) in the Accused Instrumentality that perfo rms the claimed function; (d) Whether each element of each a sserted claim is claimed to be literally present or pr esent under the doctrine of equiv a lents in the Accused Instrumentality[.] Patent Local Rule 3-1. The plaintif f is not locked into these Preliminary Infringement Contentions. The Patent Local Rules allow for amendment in two ways: If a party claiming patent infringem ent believes in good faith that (1) the Court's Claim Construction Ru ling or (2) the documents produced pursuant to Patent L.R. 3-4 so r equires, not later than 30 days after service by the Court of its Claim Cons truction Ruling, that party may serve "Final Infringement Contentions" wit hout leave of court that amend its "Preliminary Infringement Contentions" with respect to the information required by Patent L. R. 3-1(c) and (d). Patent Local Rule 3-6(a).

06-1182 7Amendment or modificati on of the Preliminar y or Final Infringement Contentions or the Prelim inary or Final Inv a lidity Cont entions, other than as express l y permitted in Patent L.R. 3-6, may be made only by order of the Court, which shall be entered onl y upon a showing of good cause. Patent Local Rule 3-7. Our standard of review for a district c ourt's application of such rules is very deferential. In Genentec h, Inc. v. Amgen, Inc. , we stated: "[U]nlike the liberal policy for amendi ng ple adings, the philosophy behind amending claim charts . . . is decid edly conservative and designed to prevent the 'shifting sands' approac h t o claim c onstruction." Atmel Corp. v. Info. Storage Devices, Inc. , 1998 U.S. Dist. LEXIS 17564, 1998 WL 775115, at *2 (N. D . Cal. Nov. 5, 1998). Furthermore, this court defers to the district court when interpreting and enforcing local rules s o as not to frustrate local attempts to manage pat ent cases according to prescribed guidelines. In reviewing a distric t cour t's exercise of discretion, this court determines "whether (1) the decision wa s clearly unreasonabl e, arbitrary, or fanciful; (2) the deci s ion was bas ed on an erroneous conclusion of law; (3) the court's findings were clearly erroneous; or (4) the record contains no evidence upon which the court rationally could have based its decision." In re Cambridge Biotech Cor p

. , 186 F. 3d 1356, 1369, 51 USPQ2d 1321, 1329 (Fed. Cir. 1999). . . . [Even where] the record shows ample reasons for the district court to permit [a party] to amend its claim chart, our standard of review on th is issue does not require reversal in the presence of reasons to pe rmit amendments. Even a determination that the district court's ruling was erroneous does not require reversal. Only if the ruling is found to be cl early erroneous is reversal mandated. Genentech , 289 F.3d 761, 774 (Fed. Cir. 2002). Safeclick argues that the di strict court clearly erred in finding that "Safeclick did not disclos e the act of 'sendi ng' the password in its Final Infringement Contentions"
because t he claim language it self provides fo r the act of "transmitting" the private identification code, and further more, because Safeclic k explained in its cont entions that "the cardholder enters required authentication information and pres ses the 'Purchase' or similar button in the br owser window to transmit that information." Appellant's Br. at 37- 38 (emphasis amended).

06-1182 8Safeclick's argument mischaracterizes t he district court's reasoning. The act of transmitting (or sending) the inf o rmation is not the part of the th eory that changed after service of the Final Infringement Cont entions, but rather it was the content of what get s transmitted (or sent) that changed. Safec lick explained in it s Final Inf r ingement Contentions that infor m ation ent ered by the us er (e.g., a password) is transmitted. In subsequent briefing, however, Safeclick went beyond the statem ent in its final contentions . It explained that the privat e identification code was not merely the password entered by the user but that password as mathematically transformed for transmission by the SSL features of the us er's web browser. This new argument had the advantage of indicating how the merchant 's computer could in s o me sense "identify[]" the consum er's computer as r equired by the claim. When the password is considered outside its SSL wrapping, the only entity identified is t he cardho lder, not any particular computer. While it might have been reasonable fo r the district court to interpret Safeclick's latest infringement c ontentions as a restat ement of its earlier infringement contention with a mere change of "scope and clarit y," see Ori on IP, LLC v. Staples, Inc. , 407 F. Supp. 2d 815 (E.D. T e x. Jan. 9, 2006), it was also reasonable for the district court to interpret Safeclick's latest contentions as impermissibly different than its previous contentions. Cons equently, we are unable to conclu de that the district court erred by adopting one of two re asonable interpretations. See G enentech , 289 F.3d at 774 ("[Even where] the record shows ample reas ons for the di strict court to permit [a party] to amend its claim chart, our standard of review on th is issue does not require reversal in the presence of reasons to permi t amendments.").

06-1182 9Safeclick argues in the alternativ e that even if it did violate the Patent Local Rules, "a c a se-ending sanction is not appropr iate when the opp o sing party suffers no prejudice." Appellant 's Br. at 42. Accordi ng to Safeclick, the Patent Loc al Rules at issue here are intended to supp lement the disclosures requir ed by Fed. R. Civ. P. 26,
and bec ause it is impermissible f o r local rules to conflict with the F ederal Rules of Civil Procedure, the district court should have looked to Rule 37—whic h is the mechanism b y which cour ts enforce Rule 26—f o r the proper re medy to Safeclic k's infraction. Rule 37 provides in relevant part: A party that without subs tantial justifica t ion fails to disclos e information required by Rule 26(a) or 26(e)(1), or to amend a prior response to discover y as required by Rule 26(e)(2), i s not, unless such failure is h a rmless , permitted to use as evidence at a trial, at a h earing, or on a motion any witness or info rmation not so disclosed. Fed. R. Civ. P. 37(c)(1) (emphasis added). H ad the dis t rict court followed the mandates of this rule, Safeclick contends that it w ould have been able to s how that Visa was not prejudiced by Safeclic k's failure t o disc lose its new theory of infringement. As such, the district court would not have struck Safeclic k' s theory. Safeclick f u rther argues that the district court was required to provide notic e that it was considering striking Safeclick ' s theory altogether. The court need not address the Rule 37 iss ue becaus e Safeclick did not present that argument to the district court. Sage Prods., Inc. v. Devon Indus., Inc. , 126 F.3d 1420, 1426 (Fed. Cir. 1997) (explain ing that "this court does not 'r eview' that which wa s not presented to the district court"); Ec ologica l Rig hts Found. v. Pac. Lumber Co. , 230 F.3d 1141, 1154 (9th Cir. 2000) ("It is to assu re two-level consideration that issues usually cannot be raised in appel late courts in the first in stance, but instead are waived

06-1182 10(or reviewed only for plain e rror) if not rais ed before the dist rict court."). To be sure, Safeclick did point out in its s u r-reply brie f that "Visa does not even allege that it suffered prejudice in this respect

. " (JA at A04132.) T h is single sentence s i mply does not suffice to show t hat Safeclick raised Rule 37 before this appea l. At best, that sentence was merely a make-weight argum ent to support the br oader argument that Visa was on notice of Safeclick's theory of infringement. Moreover, although we do not decide her e whether Safeclick had a duty to seek leave to amend its Final I n fringement Contentions pursuant to Patent Local Rule 3-7, we do note that Safeclick's failure to do so was another foregone opportunity make it s Rule 37 argument to the district court. The Ninth Circuit precedent cited by Safe click stating that purely legal iss ues may sometimes be considered for the first ti me on appeal is of no consequence in this case. See, e.g., In re Am. W. Airlines, Inc. , 217 F.2d 1161, 1165 (9th Cir. 2000);
Bolker v. C.I.R. , 760 F.2d 1039, 1042 (9th Cir . 1985). Assuming arguendo that we would abide by our sister circuit's precede nt in this context, the question of whether there must be a s howing of prejudice (o r, to be more p r ecise, a showing o f harmlessness) is a factual iss ue that is not appropriate for us to resolve on appeal. The plain language of Rule 37 requir es the district court to first find that the offending party was "without substantial just ification" for its noncomplianc e with the discov e ry rules. Although Safeclick certainly attempted to shift the blame by arguing that Visa's discovery r e sponses were inadequate (JA at A04132-33), the district court's written opinion is devoid of any findings with regard to substantial just ification. Therefore, it would be inappropriat e for us to make fi ndings regarding the question of prejudice

06-1182 11(harmlessness) when that hi ghly factual issue has not b een presented to, or a ddressed by, the district court. As to Safeclick's further argument that the district court should have provided notice that it was c onsidering striking Safe click's theory altogether, we disagr ee. Safeclick was provided with notice. On August 26, 2005, Visa argued in its reply brief that the district court should not consider Sa feclick's lat e st infringement contentions for failure to comply with the local r u les. Safe click was t hen giv en an opportunity to file a sur-reply brief, which it did on November 8, 2005. Thus, Safeclick's claim that the
district court's action was somehow "out of the blue" is demonstrably false.
V Accordingly, we hold that the district court did not abuse its discretion by refusing to consider Safeclick's new infringement cont ention. The judgment of the district court is affirmed.

06-1182 12