1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

DUANE MORRIS LLP 

D. Stuart Bartow (CA SBN 233107)

dsbartow@duanemorris.com

Nicole E. Grigg (SBN 307733)

negrigg@duanemorris.com

2475 Hanover Street

Palo Alto, CA 94304-1194

Telephone: 650.847.4146

Facsimile: 650.847.4151

DUANE MORRIS LLP 

Joseph A. Powers (PA SBN 84590) 

Admitted Pro Hac Vice 

japowers@duanemorris.com 

Jarrad M. Gunther (PA SBN 207038) 

Admitted Pro Hac Vice 

jmgunther@duanemorris.com 

30 South 17th Street 

Philadelphia, PA 19103 

Telephone: 215.979.1000 

Facsimile: 215.979.1020 

Attorneys for Defendant 

CISCO SYSTEMS, INC. 

DUANE MORRIS LLP 

L. Norwood Jameson (GA SBN 003970)

Admitted Pro Hac Vice

wjameson@duanemorris.com

Matthew C. Gaudet (GA SBN 287789)

Admitted Pro Hac Vice

mcgaudet@duanemorris.com

David C. Dotson (GA SBN 138040)

Admitted Pro Hac Vice

dcdotson@duanemorris.com

John R. Gibson (GA SBN 454507)

Admitted Pro Hac Vice

jrgibson@duanemorris.com

Jennifer H. Forte (GA SBN 940650)

Admitted Pro Hac Vice

jhforte@duanemorris.com

1075 Peachtree NE, Suite 2000

Atlanta, GA 30309

Telephone: 404.253.6900

Facsimile: 404.253.6901

IN THE UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

SAN JOSE DIVISION

FINJAN, INC., a Delaware Corporation, 

Plaintiff, 

v. 

CISCO SYSTEMS, INC., a California 

Corporation, 

Defendant. 

Case No.: 5:17-cv-00072-BLF-SVK 

CISCO SYSTEMS, INC.’S NOTICE OF 

MOTION AND MOTION TO STRIKE 

PORTIONS OF FINJAN’S AMENDED 

EXPERT REPORT ON INFRINGEMENT 

OF PATENT NO. 7,647,633 

Date: April 21, 2020 

Time: 10:00 a.m. 

Courtroom: 6, 4th Floor 

Judge: Hon. Susan Van Keulen 

REDACTED

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 1 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 i 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT

CASE NO. 5:17-CV-00072-BLF-SVK 

NOTICE OF MOTION AND MOTION 

TO ALL PARTIES AND THEIR ATTORNEYS OF RECORD: 

PLEASE TAKE NOTICE that on April 21, 2020 at 10:00 a.m., in Courtroom 6, 4th Floor, 

United States District Court for the Northern District of California, San Jose Courthouse, 280 South 

1st Street, San Jose, CA 95113, Defendant Cisco Systems, Inc. (“Cisco”) moves for an Order 

striking portions of Finjan, Inc.’s (“Finjan”) Amended Expert Report on Infringement of Patent No. 

7,647,633 for including new theories of infringement that are not contained in Finjan’s Operative 

Infringement Contentions. This motion is supported by the following Memorandum of Points and 

Authorities and the Declaration of Nicole E. Grigg, filed concurrently herewith, and such other 

written or oral argument as may be presented at or before the time this motion is heard by the Court. 

STATEMENT OF RELIEF REQUESTED 

Cisco seeks an order striking from the “Amended Expert Report of Nenad Medvidovic, Ph. D 

Regarding Infringement... of Patent No. 7,647,633” (i) all theories where the “Mobile Protection 

Code” is a component at the sandbox and not transmitted to the sandbox from an AMP Gateway 

Product and (ii) all theories based on the as Mobile 

Protection Code. 

STATEMENT OF ISSUES TO BE DECIDED 

1) Whether assertions in “Amended Expert Report of Nenad Medvidovic, Ph. D Regarding 

Infringement... of Patent No. 7,647,633” asserting components at the Cisco sandboxes that are not 

transmitted to the sandboxes as “Mobile Protection Code” exceed the scope of the Operative 

Contentions; 

2) Whether assertions in “Amended Expert Report of Nenad Medvidovic, Ph. D Regarding 

Infringement... of Patent No. 7,647,633” asserting 

as “Mobile Protection Code” exceed the scope of the Operative Contentions. 

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 2 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 1 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

MEMORANDUM OF POINTS AND AUTHORITIES 

I. INTRODUCTION 

At Judge Freeman’s direction, Cisco asks this Court for relief on a procedural dispute 

regarding Finjan’s expert report on infringement of the ’633 Patent (the “Amended Expert Report of 

Nenad Medvidovic, Ph.D. Regarding Infringement . . . of Patent No. 7,647,633” (“Amended ’633 

Report”)), which includes improper infringement theories that were not disclosed in Finjan’s 

operative infringement contentions dated November 30, 2017 (“Operative Contentions”). Finjan 

served the Amended ’633 Report after Judge Freeman granted Cisco’s motion to strike Finjan’s 

original reports in an Order dated November 12, 2019, because they exceeded the scope of the 

Operative Contentions. Finjan then served the Amended ’633 Report (along with other amended 

reports, collectively “Amended Reports”) while summary judgment motions were pending. Cisco 

files this motion because the Amended ’633 Report still exceeds the Operative Contentions. 

At the January 9 summary judgement hearing, disputes arose about the scope of the 

Amended Reports. Judge Freeman directed the parties to confer and referred to this Court any 

dispute regarding whether the Operative Contentions disclosed the theories advanced by Finjan in its 

Amended Experts Reports. Judge Freeman made clear that she would consider Cisco’s summary 

judgment motion on the merits, while the parties concurrently addressed the expert reports with this 

Court, and that this Court’s ruling on the reports would be enforced at trial via a motion in limine. 

On March 20, the Court granted in part Cisco’s summary judgment motion on the “mobile 

protection code” (“MPC”) element of claim 14 of the ’633 Patent (the only asserted claim). (Dkt. 

388). Finjan advanced 7 different components as the alleged “MPC” in response to Cisco’s motion, 

and Judge Freeman granted Cisco’s motion as to 4 of those 7 components, leaving 3 for trial. 

The issue before this Court relates to the 3 remaining components that Finjan accuses as 

MPC, and whether Finjan made such allegations in the Operative Contentions. Judge Freeman 

construed MPC as “code that, at runtime, monitors or intercepts actually or potentially malicious 

code operations without modifying the executable code, where the mobile protection code itself must 

be executable.” 4/30/19 Order (Dkt. 247). The only alleged MPC in the Operative Contentions 

were items that are transmitted to a sandbox from a device such as a gateway (which receives an 

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 3 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 2 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

incoming file). Then, Finjan’s original and Amended ’633 Reports added a new theory, which 

accused pre-existing components of the sandbox that are not transmitted at all. By summary 

judgment, Finjan abandoned its original theory in toto, and only accused 7 pre-existing (and untransmitted) components of the sandbox as MPC. Thus, all 7 of the components that the Court 

considered at summary judgment were part of this new theory, i.e., items that are not transmitted to 

the sandbox, but that were already components of the sandbox. Neither this theory nor the 7 specific 

components (3 of which survived summary judgment) were disclosed in the Operative Contentions. 

II. BACKGROUND 

A. Prior Orders 

The dispute on the Amended ’633 Report has a long history, with Finjan already having lost 

two rounds of motion practice. Finjan sought to make numerous amendments to each of its patent 

contentions at the close of fact discovery, including the ’633 Patent. Finjan argued that its proposed 

amendments merely added component names. Dkt. 322-47 at 6. This Court rejected these attempted 

amendments, as they did not appear to correspond to previous infringement theories: 

It appears from the Court’s careful review of the proposed SIC [Supplemental 

Infringement Contentions] and the arguments presented at the hearing that Finjan’s proposed 

amendments to identify components are significantly more complex and prejudicial than 

Finjan has portrayed them. . . . At the hearing, the Court pressed Finjan on its suggestion that 

it was merely inserting specific names for a previously described functionality. . . . 

Finjan’s showing of diligence is insufficient given the apparent significance of its 

proposed amendment/supplementation which defy redlining its existing contentions. 

Dkt. 274 at 7. Judge Freeman maintained that decision: 

Having reviewed the parties’ arguments with respect to the internal code names issue, the 

Court . . . concurs with Judge van Keulen’s determination that the issue is more complex than 

initially presented by Finjan. The Court would have expected Finjan to present a list of newly 

identified internal code names to be swapped out for less precise designations in the 

infringement contentions. Having been advised of this deficiency by Judge van Keulen, 

Finjan has done nothing to persuade this Court that the true effect of its request is as benign 

as suggested in the moving papers. 

7/17/19 Order at 2-3. Finjan served its expert reports as if it had been granted leave to amend. Cisco 

moved to strike, and Judge Freeman rejected Finjan’s argument that these theories were not new: 

Thus, as Finjan recognized, its argument was more properly raised in a motion for leave to 

amend infringement contentions—not after expert reports are served. The problem for Finjan 

is that it has tried and failed twice to amend its infringement contentions to add these 

component names. See SVK Order at 7; BLF Order at 2-3. Finjan failed to carry its burden of 

showing diligence and lack of prejudice. See Apple Inc. v. Samsung Elecs. Co., No. CF 12-

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 4 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 3 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

00630 LHK, 2012 WL 5632618, at *2 (N.D. Cal. Nov. 15, 2012) (“The good cause inquiry” 

considers (1) whether the party seeking leave to amend acted with diligence and (2) whether 

there would be undue prejudice to the non-moving party). The Court declines to give Finjan a 

third bite at this apple. 

11/12/19 Order at 4 (emphasis in original). Judge Freeman twice noted that the examples in the 

briefs confirmed that the codenames did not correspond to previously disclosed theories. Id. at 4, 6. 

B. Finjan’s Amended Reports, MSJ Proceedings and Meet-and-Confer 

On December 13 and 16, Finjan served the Amended Reports. The question of whether the 

Amended Reports properly conformed to the Operative Contentions arose at the January 9, 2020 

summary judgment hearing, primarily in the context of the ’633 Patent. In the briefing and at the 

hearing, Finjan relied exclusively on 7 specific items as the alleged MPC, which Finjan alleged were 

located at the accused sandboxes. Judge Freeman’s MSJ Order identified each of these 7 

components as the

 and described the function of each. MSJ Order at 14-15. 

She noted that these 7 are “all components of ThreatGrid and Id. 

At the January 9th hearing, Judge Freeman referred to this Court any dispute about whether 

these 7 items (and, more generally, the Amended Reports) should be struck: 

[Cisco’s Counsel]: . . . is not in their infringement contentions. It’s not just 

these other six, is not in there.

The Court: So based on my Order they will have to ask Judge Van Keulen to allow a 

substitution form something from the contentions to got to the jury in place of all of the 

arguments about , which they are now using to defeat summary judgment 

because otherwise they have provided me no evidence. 

1/9/20 Trans., 119:20 - 120:11; see also id. at 51:19-22. In an effort to expedite the process, Cisco 

identified the specific issues to which it objected that are sufficiently material to warrant Court 

resolution, beginning with an email dated January 30, 2020. Multiple meet-and-confer sessions 

ensued, the last of which was on March 5, 2020. As to the ’633 Patent, there were two 

disagreements during the meet-and-confer. First, the parties disputed whether the Operative 

Contentions disclosed any theory directed to components of ThreatGrid or , i.e., a 

theory in which the alleged MPC is already at the sandbox, as opposed to being transmitted from 

another device. Second, the parties disputed whether the 7 specific components were disclosed. 

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 5 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 4 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

Following the meet-and-confers, the Court granted Cisco summary judgment as to 4 of the items: (i) 

 (ii) (iii) ; and (iv) This leaves only 3 

components remaining: (i) (ii) ; and (iii) . MSJ Order at 33. 

III. LEGAL STANDARD 

The standard for a motion to strike an expert report based on new theories in a case is set 

forth in Judge Freeman’s Order striking Finjan’s original expert reports as follows: 

“Given the purpose behind the patent local rules’ disclosure requirements, a party may not use 

an expert report to introduce new infringement theories [or] new infringing instrumentalities... 

not disclosed in the parties’ infringement contentions ....” Verinata Health, Inc. v. Sequenom, 

Inc., No. C 12-00865 SI, 2014 WL 4100638, at *3 (N.D. Cal. Aug. 20, 2014) (citation 

omitted). Finjan was, of course, prohibited from including in its expert reports the theories it 

sought but failed to add to its infringement contentions by the SVK and BLF Orders. 

11/12/19 Order (Dkt. No. 397) at 3. Any infringement theory found in an expert report that finds 

only vague support in the operative infringement contentions must be struck from the expert report: 

Reading this contention in isolation, it is not clear that DSS intended to limit claim element 1.8 

to a sniff subrating code sequence. However, it is in this vagueness that DSS has a problem. 

What is clear when reading through the Amended PICs is that it is unclear whether DSS’s 

contentions refer to both Sniff Mode and Sniff Subrating Mode as infringing modes or to just 

Sniff Subrating Mode. Bluetooth Sniff Mode is the underlying technology, so it is certainly 

mentioned throughout the Amended PICs, but there are no specific limitations that refer to 

Sniff Mode. Without any specific limitations referring to Sniff Mode, the Court cannot 

construe the contentions as covering both modes... 

Because “[t]he purpose of Patent Local Rule 3-1 . . . is in fact to be nit-picky, to require a 

plaintiff to crystalize its theory of the case and patent claims,” the Court concludes that the 

Amended PICs did not put Apple on notice of the theory that the accused products operating in 

both Bluetooth Sniff Mode and Bluetooth Sniff Subrating Mode infringed the ‘290 patent. 

Although to operate in Bluetooth Sniff Subrating Mode, products necessarily must operate in 

Sniff Mode, this fact alone, without any clear contentions or limitation, is insufficient to put 

Apple on notice that Sniff Mode is an infringing mode. 

DSS Tech. Mgmt. v. Apple, Inc., 2020 U.S. Dist. LEXIS 6177 at *23-25 (N.D. Cal. 1/14/20). 

IV. FINJAN’S EXPERT REPORT SHOULD BE STRUCK 

A. Finjan’s Ever-Evolving Theory on the ’633 Patent 

The Markman Order in this case provided the following background on the ’633 Patent: 

At a high level, some embodiments include a protection engine that resides on a network 

server and monitors incoming information for executable code. Id. at 2:20–3:4. Upon 

detection of executable code, the protection engine deploys a “mobile protection code” and 

protection policies to a downloadable-destination. Id. col. 3:5–21. At the destination, the 

Downloadable is executed, typically within a sandboxed environment, and malicious or 

potentially malicious operations that run or attempt to run are intercepted and neutralized by 

the mobile protection code according to set protection policies. See id. at 3:22–40. 

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 6 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 5 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

7/23/18 Order (Dkt. 134) at 2-3. The Operative Contentions alleged that MPC is transmitted from 

other devices (such as a gateway) to a sandbox via an Application Programming Interface (“API”). 

Finjan realized its theory was not viable because the API (and the files it transmits) cannot be MPC. 

Indeed, Judge Freeman rejected an API-based infringement theory in Blue Coat II, 283 F. Supp. 3d 

839, 871 (N.D. Cal. 2017). In the summary judgment briefing here, Finjan disclaimed any theory 

where MPC is sent to the sandbox (e.g., from the AMP Gateway Products), per footnote 6 of the 

MSJ Order. Instead, Finjan relied only on the new theory that each of the 7 components were MPC. 

The question Judge Freeman referred to this Court is whether Finjan disclosed this theory in the 

Operative Contentions. It did not. There is no accusation that a pre-existing component of a 

sandbox is MPC, and the words do not appear. 

1. Finjan’s Operative Infringement Contentions on the ’633 Patent 

The Operative Contentions asserted that the MPC consists of various items “transmitted” via 

an API from (i) “AMP Gateway Products” to (ii) a sandbox. They further alleged that the AMP 

Gateway Products send to the sandbox the file that was downloaded from the Internet (the “mobile 

code”), and that the sandbox then executes the MPC together with the mobile code. The AMP 

Gateway Products typically are located on the edge of a network, receive incoming files, and, in 

certain circumstances, send a received file to a sandbox for further analysis. MSJ Order at 2. 

Finjan focused on chart C1 from its Operative Contentions in the meet-and-confer. Cisco 

will do likewise, and attaches that chart as Exhibit 1. Cisco respectfully submits that the Court 

review the contentions for claim 14, spanning from pages 30-39. Such a review will confirm there is 

no allegation that something that is already at a sandbox (and never transmitted to it) is MPC. As the 

Court will see, Finjan explains the relationship between AMP for Networks and ThreatGrid: 

 

As shown below, Cisco AMP for Networks is a system for computer security which includes 

an information re-communicator (e.g., network components and proxy software) which 

receives downloadable-information. Cisco AMP for Networks also uploads an executable to 

a sandbox environment (e.g., Threat Grid). 

Id. Then, Finjan states that MPC is transmitted from Cisco AMP for Networks to ThreatGrid: 

 

Cisco AMP for Networks includes a protection agent engine which causes mobile protection 

code to be transmitted to the sandbox based upon the determination that the downloadableinformation includes executable code. 

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 7 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 6 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

Id at 33. This is repeatedly stated in the element relating to MPC (element 14d, starting on page 35): 

 “If the code is executable, Cisco AMP for Networks packages information pertaining to the 

executable and information pertaining to tasks and relevant parameters and transmits it to 

Threat Grid and/or Talos for further analysis. The code and information pertaining to the task 

and parameters relevant to Threat Grid and/or Talos is the mobile protection code.” (Id. at 35) 

 “Cisco AMP for Networks contain or connects to a virtual machine/sandbox and configures it to 

mimic a destination device then transmits it to the analysis environment, thereby causing 

mobile protection code to be communicated to at least one information-destination of the 

downloadable-information.” (Id.) 

 “Cisco AMP for Networks contain a scheduler which retrieves, from a virtual environment 

component pool, a virtual environment agent for monitoring and detecting code that perform 

suspicious changes to the operating system and sends it to the virtual environment, thereby 

causing mobile protection code to be communicated to at least one information-destination of the 

downloadable-information.” (Id.) 

 “As shown below, Cisco AMP for Networks will receive downloadable-information. Cisco AMP 

for Networks include components which analyze and detect executable code within the 

downloadable-information by performing extension analysis, byte detection, Magic byte, 

Libmagic, File Magic, or byte distribution analysis and provide an option to transmit the 

mobile protection code to a sandbox environment such as Threat Grid, which causes the 

mobile protection code to be executed in Threat Grid’s sandbox.” (Id.) 

 “As shown below, Cisco AMP for Networks transmits mobile protection code to a number of 

sandboxes for analysis based upon the determination that the downloadable-information 

includes executable code, thereby causing the mobile protection code to be executed in Threat 

Grid’s sandbox.” (Id. at 36) 

 “Cisco AMP for Networks operates with Threat Grid, which includes a virtual machine 

environment known as Glovebox (mobile code executor). Cisco AMP for Networks includes a 

network interface and transmitter software which transmits mobile protection code to the 

sandbox based upon the determination that the downloadable-information includes executable 

code, which will cause the mobile protection code to be executed and thereby detonate the 

malicious code in a safe environment that monitors and intercepts malicious code.” (Id.) 

Finally, Finjan labels Chart C3 as a “Cisco ThreatGrid” chart, but it confusingly defines 

“Cisco ThreatGrid” to include AMP Gateway Products. Ex. 2 at 1 (“For purposes of this chart, 

‘Cisco Threat Grid are the Cisco Threat Grid appliances and its virtual variations, either alone, or 

when used in conjunction with the following products, services, or technologies: ... Cisco Threat 

Grid in combination with other Cisco appliance and/or cloud-based products and/or services (such as 

Cisco AMP for Networks, Cisco AMP for ASA, Cisco AMP for CWS, Cisco AMP for ESA, Cisco 

AMP for WSA, Cisco AMP for Meraki MX, and Talos technology)”). Stated differently, while 

Finjan labels Chart C3 as a ThreatGrid-only infringement chart, the allegations quickly morph into 

allegations that depend on other Cisco appliances, such as AMP. As a result, the citations are 

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 8 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 7 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

substantively identical to those just quoted, containing the exact same MPC allegations as the AMP 

Gateway Cloud product contentions (as set forth above for claim 14) but with Finjan mechanically 

substituting the term “Cisco Threat Grid” for “AMP for Networks”. Compare Ex. 1 (C1) at 5-6 with

Ex. 2 (C3) at 5 (claim 1), and Ex. 1 (C1) at 34 with Ex. 2 (C3) at 37 (claim 14). Thus, these 

contentions likewise do not disclose any Cisco Sandbox-only MPC theories. 

2. Finjan’s Amended Expert Report on Infringement of ’633 Patent 

The Amended ’633 Report alleges that the 7 sandbox components identified in the MSJ 

Order constitute MPC. The Amended ’633 Report changed the terminology for some of those 

components. Ex. 3 at ¶¶ 655, 4402, 4486-88. These changes included the terminology for 2 of the 3 

remaining components: became “script used to emulate certain user action” (id. at ¶ 

4486); and became “preset configurations for the sandbox in Talos.” (Id. at ¶ 4488). 

Reflecting the moving target, the components identified in the MSJ Order and the Amended ’633 

Report only partially overlapped with the components Finjan identified in April 2019 when it served 

a proposed ’633 claim chart (“’633 Proposed Supplement”) in connection with its unsuccessful 

motion for leave to amend. See generally Ex. 4 at 43-48 (treatment of element 14d). That rejected 

claim chart identified at least 25 new items as MPC for claim 14. Id. Two of these – including 

 that are the subject of this motion – still found their way into the 

Amended ’633 Report. Remarkably, which is the third item subject to this 

motion, was not even identified in the proposed claim chart served in April 2019. 

B. The Court Should Strike the Sandbox-only Theories 

1. No “MPC” Theory Involving Components Of A Sandbox 

Cisco asks the Court to strike any MPC theory involving existing components of a sandbox, 

i.e., any items not transmitted to a sandbox. This covers the three surviving theories, and also 

ensures that Finjan does not attempt to use DOE to revive the other four components. 

In response, Finjan asserts – with the benefit of hindsight – that several phrases in its 

Operative Contentions could encompass the Amended ’633 Report theory. There are two problems. 

First, Finjan has the process backwards. If this were Finjan’s theory when it served its 

Operative Contentions, Finjan was obligated to express that theory in clear language that would have 

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 9 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 8 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

provided Cisco unmistakable notice of the theory it was pursuing. The service of amended expert 

reports is not supposed to be an “aha moment” when seemingly random phrases sprinkled through 

infringement contentions come together into a cognizable infringement theory for the first time in 

the case. Finjan’s effort to debut a new and categorically broader infringement theory long after the 

invalidity contention process (and now simply target the basic software and items already resident at 

a sandbox, which is prior art functionality) would turn the local patent rules on their head. 

Second, under any standard, Finjan’s effort fails. Finjan relies on the following paragraph on 

page 35, which states that the MPC is “code and information” (referred to in many ways, including 

“virtual environment agent”) that AMP for Networks packages with the downloaded file (i.e., the 

sample) and transmits to a sandbox, where the MPC and downloaded file are both executed: 

Cisco AMP for Networks meet the recited claim language because Cisco AMP for Networks 

cause a virtual environment agent (mobile protection code) to be executed within the virtual 

environment running Windows operating system, Java Runtime Environment and/or Internet 

Explorer (mobile code executor) at a downloadable-information destination (e.g., Threat Grid 

and/or Talos). Additionally, the virtual environment agent will process one or more operations 

attempted by executable code in the form of exploits (e.g. drive-by downloads or heapspray 

attack) hidden within webpages. Cisco AMP for Networks will determine whether the code is 

executable code. If the code is executable, Cisco AMP for Networks packages information 

pertaining to the executable and information pertaining to tasks and relevant parameters 

and transmits it to Threat Grid and/or Talos for further analysis. The code and information 

pertaining to the task and parameters relevant to Threat Grid and/or Talos is the mobile 

protection code. This information includes information using RESTful API’s (e.g., HTTP 

POST commands which run, execute, and/or process a file or URL in a sandbox), parameters 

to run the sample file or URL, a hash of the file, information contained in a which 

includes information regarding the sample or URL (e.g., metadata of the sample, description of 

the sample, indicators of compromise, and/or warnings that the information-destination should 

be aware of). Furthermore, Cisco AMP for Networks creates dynamic security content based 

on the analysis of web traffic that determines executable code. Additionally, Threat Grid may 

also transmit mobile protection code to Talos based on the determination, and vice versa (e.g., 

Talos may also transmit mobile protection code to Threat Grid), for further analysis. 

Ex. 1 (C1) at 35 (emphasis added). Nothing about this passage discloses that something already 

resident at the sandbox is the MPC. Any reasonable reading reflects that, while alleged MPC will be 

executed at a sandbox (which is required because MPC must be “executable”), the MPC was 

transmitted from the gateway. The next paragraph confirms that “Cisco AMP for Networks contain 

or connects to a virtual machine/sandbox and configures it to mimic a destination device then 

transmits it to the analysis environment, thereby causing mobile protection code to be communicated 

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 10 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 9 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

to at least one information-destination of the downloadable-information.” This is followed by the 

litany of paragraphs that all confirm the accused MPC is transmitted to a sandbox, as quoted above. 

Against this backdrop, Finjan seizes on two things to recast these contentions. 

First, Finjan points to the passage’s reference (highlighted in yellow above) to “parameters to 

run the sample file or URL”. As explained above, the paragraph states that these “parameters” are 

one of the several examples of the “information pertaining to tasks and relevant parameters” that 

AMP for Networks transmits to the Cisco Sandbox, and thus these parameters are not something 

already resident at the Cisco Sandbox. See id. (“Cisco AMP for Networks packages information 

pertaining to the executable and information pertaining to task and relevant parameters and 

transmits it to [the Cisco Sandbox] for further analysis. The code and information pertaining to the 

task and parameters relevant to Threat Grid and/or Talos is the mobile protection code. This 

information includes ... parameters to run the sample file or URL...”). 

Second, Finjan points to the reference to the “virtual environment agent” in the first sentence 

of the claim 14 passage above as support for its Cisco Sandbox-only MPC theory: “Cisco AMP for 

Networks meet the recited claim language because Cisco AMP for Networks cause a virtual 

environment agent (mobile protection code) to be executed within the virtual environment 

running Windows operating system, Java Runtime Environment and/or Internet Explorer (mobile 

code executor) at a downloadable-information destination (e.g., Threat Grid and/or Talos).” Ex. 1 

(C1) at 35. This assertion fares no better. The sentence says that Cisco AMP for Networks cause 

the undefined “virtual environment agent” to be executed (which is a basic requirement of MPC) – it 

does not say that the “virtual environment agent” is something that was already resident at the 

sandbox. To the contrary, the remainder of the paragraph (and, indeed, all of the contentions) 

explain how this happens, confirming that MPC is transmitted to the sandbox where it is executed: 

If the code is executable, Cisco AMP for Networks packages information pertaining to the 

executable and information pertaining to tasks and relevant parameters and transmits it to 

Threat Grid and/or Talos for further analysis. The code and information pertaining to the task 

and parameters relevant to Threat Grid and/or Talos is the mobile protection code. 

Ex. 1 (C1) at 35. Moreover, the term “virtual environment agent” is an empty placeholder – the term 

“virtual environment” is meaningless in its generality, and the term “agent” could be anything sent to 

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 11 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

10 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

a virtual environment. This is reflected by the laundry list of 25 components in the ’633 Proposed 

Supplement from April 2019, see supra § IV.A.2, most of which did not even find their way into the 

Amended ’633 Report. Moreover, this would not disclose a standalone infringement theory in any 

context, and certainly not in a paragraph that clearly says MPC is packaged with 

information/parameters and transmitted by AMP for Networks to Threat Grid, which is the sandbox. 

2. The Three Surviving Items that Finjan Identified

Even if Finjan could show its Operative Contentions accused something already present at 

the sandbox, it did not accuse (using this or any other terminology) any of the following: (i) 

, (ii) or (iii) None are identified by name or function, and 

certainly not as MPC. The phrase did not even make the cut for Finjan’s Proposed 

Supplement in April of 2019, and is not in the Operative Contentions. Nor is any analogous 

component for Indeed, was addressed in the motions to amend, and leave 

was denied; there is no reference it in the treatment of claim 14 in the Operative Contentions. 

For the other two items the meet-and-confer highlights the lack 

of notice in the Operative Contentions. Finjan asserted that the generic phrase “parameters to run 

the sample file or URL” in the Operative Contentions was the notice that it was accusing two 

specific components that were already part of the sandboxes: Of 

course, “parameters to run the sample file or URL” could be sent from anywhere, and they 

encompass the API theory Finjan abandoned. It does not denote any specificity, and certainly not an 

existing component of a sandbox. Indeed, this is the same generic phrase that Finjan said also 

disclosed 3 of the items on which summary judgement was granted: 

See Ex. 5 (3/6/20 Email from J. Hannah); Ex. 6 (2/27/20 Email from

J. Hannah). The MSJ Order confirms that the differences between these items matter. That is, Judge

Freeman analyzed individually, and not as a group, the 7 different MPC items contained in Finjan’s

Original ’633 Report. 3-20-20 MSJ Order. The generic and vague recitation of “parameters to run

the sample file or URL” is hardly the specificity required under the local rules to put Cisco on notice

of the specific infringement theories for these 3 alleged MPC items that survived summary judgment. 

These items are so different that Judge Freeman eliminated some as a matter of law.

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 12 of 13
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 11 

DEFENDANT CISCO SYSTEMS, INC.’S MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

Dated: March 27, 2020 Respectfully submitted, 

/s/ Nicole E. Grigg 

Nicole E. Grigg 

DUANE MORRIS LLP 

Email: negrigg@duanemorris.com 

D. Stuart Bartow 

Email:dsbartow@duanemorris.com 

2475 Hanover Street 

Palo Alto, CA 94304-1194 

Telephone: 650.847.4146 

Facsimile: 650.847.4151 

L. Norwood Jameson (admitted pro hac vice) 

Email: wjameson@duanemorris.com 

Matthew C. Gaudet (admitted pro hac vice) 

Email: mcgaudet@duanemorris.com 

David C. Dotson (admitted pro hac vice) 

Email: dcdotson@duanemorris.com 

Jennifer H. Forte (admitted pro hac vice) 

Email: jhforte@duanemorris.com 

1075 Peachtree Street, Ste. 2000 

Atlanta, GA 30309 

Telephone: 404.253.6900 

Facsimile: 404.253.6901 

Joseph A. Powers (admitted pro hac vice) 

Email: japowers@duanemorris.com 

Jarrad M. Gunther (admitted pro hac vice) 

jmgunther@duanemorris.com 

30 South 17th Street 

Philadelphia, PA 19103 

Telephone: 215.979.1000 

Facsimile: 215.979.1020 

Attorneys for Defendant 

CISCO SYSTEMS, INC. 

Case 5:17-cv-00072-BLF Document 492 Filed 03/27/20 Page 13 of 13