FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

PAUL J. ANDRE (State Bar No. 196585)

pandre@kramerlevin.com

LISA KOBIALKA (State Bar No. 191404)

lkobialka@kramerlevin.com

JAMES HANNAH (State Bar No. 237978)

jhannah@kramerlevin.com

BENU WELLS (admitted pro hac vice)

bwells@kramerlevin.com

KRAMER LEVIN NAFTALIS & FRANKEL LLP

990 Marsh Road

Menlo Park, CA 94025

Telephone: (650) 752-1700

Facsimile: (650) 752-1800

Attorneys for Plaintiff

FINJAN, INC.

IN THE UNITED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT OF CALIFORNIA

SAN JOSE DIVISION

FINJAN, INC., a Delaware Corporation,

Plaintiff,

v.

CISCO SYSTEMS, INC., a Delaware 

Corporation,

Defendant. 

Case No.: 5:17-cv-00072-BLF-SVK

PLAINTIFF FINJAN, INC.’S REPLY 

CLAIM CONSTRUCTION BRIEF 

Date: June 15, 2018

Time: 9:00 a.m.

Judge: Hon. Beth Labson Freeman

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 1 of 20
i

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

TABLE OF CONTENTS

Page

I. INTRODUCTION ....................................................................................................................... 1

II. ARGUMENT............................................................................................................................... 1

A. Terms in the ‘844 Patent.................................................................................................. 1

Term 1. “means for receiving a Downloadable” (Claim 43)....................................... 3

Term 2. “means for generating a first Downloadable security profile that identifies 

suspicious code in the received Downloadable” (Claim 43) ......................... 4

Term 3. Term 3. “means for linking the first Downloadable security profile to the 

Downloadable before a web server makes the Downloadable available to 

web clients” (Claim 43) ................................................................................. 5

Term 4. Term 4. “before a web server makes the Downloadable available to web 

clients” (Claims 1, 15, 43) ............................................................................. 6

B. Term in the ‘494 Patent.................................................................................................... 8

Term 5. “Downloadable Scanner” (‘494 Patent, Claim 10)........................................ 8

C. Term in the ‘780 Patent.................................................................................................... 9

Term 6. “performing a hashing function on the Downloadable and the fetched 

software components to generate a Downloadable ID” 

(Claims 1, 9, 17, 18)....................................................................................... 9

D. Terms in the ‘633 Patent................................................................................................ 10

Term 7. “means for determining whether the downloadable-information includes 

executable code” (Claim 13)........................................................................ 10

Term 8. “means for causing mobile protection code to be communicated to at least 

one information-destination of the downloadable-information, if the 

downloadable-information is determined to include executable code” 

(Claim 13).................................................................................................... 11

Term 9. “information-destination of the downloadable-information” / 

“downloadable-information destination” (Claims 1, 8, 13, 14)................... 12

E. Term in the ‘154 Patent.................................................................................................. 14

Term 10. “first function” ............................................................................................. 14

III. CONCLUSION.......................................................................................................................... 15

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 2 of 20
ii

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

TABLE OF AUTHORITIES

Page(s)

Cases

3M Innovative Props. Co. v. Avery Dennison Corp.,

350 F.3d 1365 (Fed. Cir. 2003).........................................................................................................15

Asia Vital Components Co. v. Asetek Danmark A/S,

No. 16-CV-07160-JST, 2018 WL 452109 (N.D. Cal. Jan. 17, 2018) ................................................8

Epos Techs. Ltd. v. Pegasus Techs. Ltd.,

766 F.3d 1338 (Fed. Cir. 2014)...........................................................................................................1

Finjan, Inc. v. Blue Coat Sys., Inc.,

13-cv-03999-BLF, 2015 WL 3630000 (N.D. Cal. June 2, 2015).....................................................10

Finjan, Inc. v. Blue Coat Sys., Inc.,

13-cv-03999-BLF, 2016 WL 3880774 (N.D. Cal. July 18, 2016)......................................................3

Finjan, Inc. v. Blue Coat Sys., Inc.,

879 F.3d 1299 (Fed. Cir. 2018)...........................................................................................................6

Finjan, Inc. v. Blue Coat Sys., LLC,

No. 15-cv-03295-BLF, 2016 WL 7212322 (N.D. Cal. Dec. 13, 2016)..........................................8, 9

Finjan, Inc. v. Eset LLC,

Case No. 3:17-cv-0183-CAB-(BGS), Dkt. No. 195 (S.D. Cal. Nov. 14, 2017).................................7

Finjan, Inc. v. Sophos, Inc.,

244 F. Supp. 3d 1016 (N.D. Cal. 2017)..............................................................................................3

Finjan, Inc. v. Symantec Corp.,

2017 WL 550453 (N.D. Cal. Feb. 10, 2017) ............................................................................ passim

Finjan v. Proofpoint,

13-cv-05808-HSG, 2015 WL 7770208 (N.D. Cal. Dec. 3, 2015)..............................................12, 14

HBAC Matchmaker Media, Inc. v. Google Inc.,

650 F. App’x 990 (Fed. Cir. 2016) ...................................................................................................11

Info-Hold, Inc. v. Applied Media Techs. Corp.,

783 F.3d 1262 (Fed. Cir. 2015).....................................................................................................7, 11

Laitram Corp. v. NEC Corp., 

163 F.3d 1342 (Fed. Cir. 1998).........................................................................................................14

Markman v. Westview Instruments, Inc.,

52 F.3d 967 (Fed. Cir. 1995)...............................................................................................................8

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 3 of 20
iii

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Novatek, Inc. v. Sollami Co.,

559 F. Appx. 1011 (Fed. Cir. 2014)....................................................................................................2

Oatey Co. v. IPS Corp.,

514 F.3d 1271 (Fed. Cir. 2008)...........................................................................................................9

Phillips v. AWH Corp.,

415 F.3d 1303 (Fed. Cir. 2005)...........................................................................................................8

SAS Inst., Inc. v. ComplementSoft, LLC,

825 F.3d 1341 (Fed. Cir. 2016)...........................................................................................................2

Tech. Props. Ltd. LLC v. Huawei Techs. Co.,

849 F.3d 1349 (Fed. Cir. 2017)...........................................................................................................2

Vitronics Corp. v. Conceptronic, Inc.,

90 F.3d 1576 (Fed. Cir. 1996).......................................................................................................1, 12

Williamson v. Citrix Online, LLC,

792 F.3d 1339 (Fed. Cir. 2015)...........................................................................................................5

Statutes

35 U.S.C. § 112.........................................................................................................................................5

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 4 of 20
1

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

I. INTRODUCTION

Finjan’s proposed constructions should be adopted because they adhere to the canons of claim 

construction, are supported by the intrinsic record of the patents, and most have been considered and 

consistently adopted in this Court’s prior claim construction orders, which should be given deference. 

Cisco, on the other hand, simply ignores Finjan’s arguments or rehashes the same misguided arguments 

made by prior defendants that this Court has already rejected. Indeed, in many instances, Cisco’s own 

expert, Dr. Clark, either disagreed with Cisco’s positions or, tellingly, failed to offer an opinion on the 

meaning of a term altogether. Thus, the Court should adopt Finjan’s constructions.

II. ARGUMENT

A. Terms in the ‘844 Patent

For each disputed term of the ‘844 Patent, this Court has already found that Finjan’s construction 

is correct and rejected the exact same arguments that Cisco makes here in decisions that Cisco ignores in 

its Opposition. While Finjan’s constructions are simple, clear, and fully supported by the ‘844 Patent 

specification, Cisco manufactures an artificial distinction between supposed “inspector” claims and 

“gateway” claims in an attempt to support all of its proposed constructions for the ‘844 Patent. This 

purported distinction has no basis in the intrinsic record or claim construction principles, and it has 

already been rejected by this Court. Specifically, this Court found that “this is not a circumstance in 

which it may properly interpret the asserted claims to exclude [] the ‘gateway embodiment,’ because that

embodiment is not ‘inconsistent with unambiguous language in the patent’s specification or prosecution 

history.’” Finjan, Inc. v. Symantec Corp., 2017 WL 550453, at *16 (N.D. Cal. Feb. 10, 

2017)(“Symantec”)(citation omitted).

Indeed, there is no support in the intrinsic record for limiting the scope of the claim terms at issue 

to exclude inspection at the gateway. To the contrary, the specification includes various embodiments 

where the inspector is at different locations, including at the network gateway. See ‘844 Patent, 7:6-8:5, 

2:5-7, Fig. 5. Thus, Cisco’s constructions improperly exclude from the claims these preferred 

embodiments where the system is at the network gateway. See Vitronics Corp. v. Conceptronic, Inc., 90 

F.3d 1576, 1583 (Fed. Cir. 1996) (“[A]n interpretation [excluding a preferred embodiment] is rarely, if 

ever, correct”); Epos Techs. Ltd. v. Pegasus Techs. Ltd., 766 F.3d 1338, 1341, 1343-44 (Fed. Cir. 2014). 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 5 of 20
2

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Cisco’s attempt to limit the scope of Claim 43 by comparing its preamble to the preamble of 

Claim 32 is also improper. Cisco Br. at 2. Because preambles do not limit the scope of the patent by 

default, Cisco cannot rely on it to limit the scope of the claim for the purposes of claim construction. 

Novatek, Inc. v. Sollami Co., 559 F. Appx. 1011, 1015 (Fed. Cir. 2014). Moreover, nothing in claims of 

the ‘844 Patent that refer to the network gateway (e.g., 22, 23, 32, 42, 44) supports importing a limitation 

into claims 1, 15, or 43 that the claimed inspector cannot be at the gateway. The claims referring to the 

network gateway are narrower than claims 1, 15, or 43 and cover an embodiment where the inspection 

has occurred when the Downloadable is received at the gateway. The specification covers both 

scenarios where the linking occurs at the gateway or before the gateway; they are not mutually 

exclusive.

Cisco also fails to show that Finjan disclaimed claim scope during prosecution. Cisco Br. at 2:22–

3:2. Any disclaimer must be clear and unmistakable—i.e., the statement cannot be “amenable to multiple 

reasonable interpretations.” SAS Inst., Inc. v. ComplementSoft, LLC, 825 F.3d 1341, 1349 (Fed. Cir. 

2016). Here, this Court has repeatedly found that there is no disclaimer. In fact, this Court has expressly 

found that “nothing in the prosecution history regarding the patentee’s distinction of the Ji prior art 

requires the inclusion of [the] ‘deployment’ language . . . .The Court does not read this language to 

establish Symantec’s apparent point that an inspector by definition can never be at the gateway....” 

Symantec at *16. Since this Court has already found no disclaimer, at a minimum the statement is subject 

to multiple reasonable interpretations, and thus by definition there can be no disclaimer here. Tech. 

Props. Ltd. LLC v. Huawei Techs. Co., 849 F.3d 1349, 1358 (Fed. Cir. 2017)(no prosecution disclaimer if 

challenged statements are ambiguous or amenable to multiple reasonable interpretations). 

In claiming there was a disclaimer, Cisco ignores relevant portions of Finjan’s response in which 

Finjan distinguished the claimed embodiment from Ji for many reasons, including that “some of the 

burden [of examining a Downloadable] may be transferred to the inspector,” not that it must be done by 

the inspector only, and that it must be done every time. Dkt. 112-3, Cisco Ex. 1 at 5 (emphasis added). 

Accordingly, Cisco’s assertion that Claim 43 is directed to an inspector system that precludes the 

network gateway is incorrect. 

Cisco also fails to address prior Court decisions that support Finjan’s proposed claim 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 6 of 20
3

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

construction in which Finjan made clear that the inspector system of Claim 43 can include functions 

performed by a network gateway. In fact, this Court affirmed a jury’s finding of infringement of Claims 

1, 7, 11, 15, and 41 of the ‘844 Patent (all of which are directed to an “inspector”) by Blue Coat’s 

network gateway products. Finjan, Inc. v. Blue Coat Sys., Inc., 13-cv-03999-BLF, 2016 WL 3880774, 

at *8 (N.D. Cal. July 18, 2016) (“[W]hether WebPulse meets the linking limitation revolves around 

whether WebPulse is part of the ‘web client’ or an inspector.... In reviewing the record, the Court 

concludes that substantial evidence supports the jury's findings....”); see also Finjan, Inc. v. Sophos, Inc., 

244 F. Supp. 3d 1016, 1048-49 (N.D. Cal. 2017) (Judge Orrick finding the same for Sophos’ gateway 

products); see also Symantec at *16 (discussed above).

Term 1. “means for receiving a Downloadable” (Claim 43)

The intrinsic record of the ‘844 Patent fully supports Finjan’s proposed structure for Term 1, i.e., 

“downloadable file interceptor,” which is the same construction that Judges Orrick and Gilliam adopted 

in Sophos and Symantec, respectively, and that Blue Coat also adopted in Blue Coat. Finjan Br. at 3. 

As this Court found when adopting Finjan’s construction, the specification of the ‘844 Patent 

provides various examples of the Downloadable file interceptor performing the function of receiving a 

Downloadable. Symantec at *4 (“the specification of the ’844 Patent designates the ‘Downloadable file 

interceptor’ as the structure that performs the ‘receiving a Downloadable’ function.”); Sophos, 2015 WL 

890621, at *8–9 (“The clear terms of the patent therefore designate the Downloadable file interceptor as 

the structure that performs the function ‘receiving a Downloadable.’”). For example, the ‘844 Patent 

describes the Downloadable file interceptor as the structure for receiving a Downloadable including 

Downloadable 150 in Figure 1, includes it in a diagram of the “Downloadable file interceptor” in Figure 

5, includes it in a flow chart in Figure 7, and includes it in a description of the structure at Col. 7, lines 

41-48, and Col. 9, lines 19-22. 

As explained above, contrary to Cisco’s claims, there is no basis to limit the structure for this 

term to the inspector 125. Indeed, as shown in Figure 5 of the ‘844 Patent, the Downloadable file 

interceptor can be connected to the content inspection engine, and therefore the claimed inspector system 

can include a Downloadable file interceptor. Thus, Cisco’s arguments are inconsistent with the 

specification of the patent, which does not limit the inspector’s location or components. Id. at 3:47-52. 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 7 of 20
4

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Term 2. “means for generating a first Downloadable security profile that identifies 

suspicious code in the received Downloadable” (Claim 43)

Finjan’s proposed structure for Term 2, i.e., “content inspection engine programmed to perform 

the algorithm disclosed at Col. 8, lines 51-60 of the ‘844 Patent,” is identical to this Court’s prior 

construction by Judge Gilliam, where this Court found that the ‘844 Patent, including the excerpts from 

the lines 51–60, discloses an algorithm of sufficient detail that is independent of the ‘194 Patent and 

supports Finjan’s proposed claim construction for Term 2. Symantec at *6-7.

Cisco ignores this decision and again attempts to limit the structure of this term to the inspector 

125, which is improper for the reasons explained above. Moreover, Cisco is incorrect that the ’844 

Patent lacks “detail of how the content inspection engine 160 generates a DSP.” Cisco Br. at 4. One 

skilled in the art, reading the specification of the ‘844 Patent, would readily identify the detail included 

in Column 8, lines 51–60 as the algorithm. Medvidovic Decl., ¶¶18-20; Finjan Br. at 5-7. In fact, 

Judge Gilliam declined to refer to the ‘194 Patent disclosure because “the ‘844 Patent nowhere 

specifically identifies a particular section of the ‘194 patent as setting out the algorithm for that 

function.” Symantec at *6. As Judge Gilliam further recognized: “The ‘content inspection engine’ is 

mentioned many times in the patent specification. The overall function and structure of the content 

inspection engine is described in the summary of the invention . . . .” Id.

Cisco’s argument that a person of ordinary skill in the art would find a distinction between 

“code” and “operations” is also unavailing. Cisco Br. at 4-5. Indeed, the ‘844 Patent discloses how the 

content inspection engine 160 generates a DSP that identifies suspicious code in the received 

Downloadable. In particular, Finjan’s algorithm discloses that “generating a DSP includes examining 

the Downloadable 205 (and the Downloadable components) for all suspicious operations that will or 

may be performed by the Downloadable, all suspicious code patterns, all known viruses, etc.,” followed 

by an example of how a DSP is formed using a rules base. ‘844 Patent, 8:51–64. It is irrelevant that this 

particular example uses the term “operation” not “code,” because the ‘844 Patent explainsthat this rules 

base that is used to generate the DSP can include a list of “suspicious code patterns.” Id. at 2:3-14 (“The 

inspector includes a content inspection engine that uses a set of rules to generate a Downloadable 

security profile corresponding to a Downloadable....The set of rules may include a list of suspicious 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 8 of 20
5

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

operations, or a list of suspicious code patterns.”)(emphasis added). Therefore, the disclosure in the 

‘844 Patent sufficiently discloses the algorithm for generating a DSP. Finjan Br. at 5–6.1 

Term 3. Term 3. “means for linking the first Downloadable security profile to the 

Downloadable before a web server makes the Downloadable available to web 

clients” (Claim 43)

Finjan’s proposed structure for Term 3, i.e., “content inspection engine programmed to perform 

the algorithm of step 630 disclosed at Fig. 6; col. 8, lines 65-67; and col. 6, lines 13-24,” is consistent 

with the intrinsic record and is the same construction that this Court found in three prior Finjan cases. 

Finjan Br. at 7. 

Cisco ignores these prior rulings by this Court and proposes a construction that is inconsistent 

with the specification of the ‘844 Patent. While Cisco’s construction requires “attaching,” Cisco’s own 

expert admits that the ‘844 Patent does not require “attaching” to perform this function, testifying instead 

that the function can also be done by linking. Ex. 12

, Clark Tr. at 83:3–85:9 (linking via a pointer just 

uses an address rather than attaching the DSP to the Downloadable); id. at 151:17–20. Cisco’s proposed 

construction also requires that the content inspection 160 must be a part of the inspector 125. Cisco Br. 

at 5-6. However, this contradicts the ‘844 Patent’s specification which states the content inspection 

engine can be a part of other components, such as a protection engine on the gateway. See, e.g., ‘844 

Patent, Fig. 5, 7:62–8:5.

Further, Cisco’s attempt to limit the algorithm for this term to only two examples of linking and 

exclude “association” is incorrect. The ‘844 Patent specifically refers to “association” as another way of 

performing the function of linking the first Downloadable security profile to the Downloadable. ‘844 

Patent, 6:20–24; Cisco Br. at 6. As such, one skilled in the art would recognize that the DSP 215 can be 

linked to the Downloadable 205 using other techniques such as association. Medvidovic Decl., ¶26. It 

would be improper to limit this term to only the examples of linking by attaching the DSP and attaching 

the pointer. See Williamson v. Citrix Online, LLC, 792 F.3d 1339, 1346–47 (Fed. Cir. 2015) (“This 

court has repeatedly ‘cautioned against limiting the claimed invention to preferred embodiments specific 

 1 For these reasons, there is also no merit to Cisco’s assertion that this term may be invalid under 35 

U.S.C. § 112, ¶2, for lack of corresponding structure in the specification.” Cisco Br. at 5, n.5. 2 Unless otherwise noted, all exhibits are attached to Declaration of James Hannah in Support of Reply 

Claim Construction Brief.

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 9 of 20
6

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

examples in the specification.”).

Term 4. Term 4. “before a web server makes the Downloadable available to web 

clients” (Claims 1, 15, 43)

Finjan’s proposed construction of Term 4, i.e., plain and ordinary meaning, is consistent with 

various decisions within this District, whereas Cisco’s construction is contrary to each of these decisions. 

Finjan Br. at 9. Moreover, the Federal Circuit has recently issued a decision that confirms these prior 

interpretations of this term. Finjan, Inc. v. Blue Coat Sys., Inc., 879 F.3d 1299, 1305 (Fed. Cir. 2018). 

While, as Cisco notes, the Federal Circuit did not specifically review this Court’s claim construction, the 

Federal Circuit in its findings made determinations regarding what a proper and reasonable interpretation 

of the claim language is in the context of an infringement analysis. Specifically, the Court found that this 

term could “reasonably be understood to require that linking occur at some point before users are 

permitted to access that downloadable—but not necessarily before the downloadable is made available 

on the Internet.” Id. at 1306.

Here, Cisco advances the very same arguments rejected in these various prior decisions. As with 

prior defendants, Cisco attempts to exclude from the claims the “gateway” embodiment, i.e., the 

embodiment where the inspection of the Downloadable occurs at the gateway. In doing so, as explained 

above, Cisco improperly limits its proposed claim construction to a single embodiment described in the 

‘844 Patent at Figure 1. Cisco Br. at 8. There is no basis for this limitation since the ‘844 Patent does 

not limit an inspector to inspection before a web server “deploys the Downloadable.” ‘844 Patent at 2:3-

19. The specification describes an inspector in broader terms. For example, the “Summary of the 

Invention” describes the invention as a having “a content inspection engine” that “generate[s] a 

Downloadable security profile corresponding to a Downloadable” and “links the Downloadable security 

profile to the Downloadable” using “a Downloadable ID that identifies the Downloadable.” Id. This 

description in the Summary of the Invention does not require or describe generating a Downloadable 

security profile before a web server deploys a Downloadable, as Cisco contends. Id. 

As Finjan explained in its Opening Brief, the language of this claim is clear and consistent with 

the purpose of the ‘844 Patent by protecting against malware using behavior-based profiles before the 

malware can infect the web client, such that there is no need to deviate from the plain and ordinary 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 10 of 20
7

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

meaning. Finjan Br. at 10. Moreover, the ‘844 Patent describes an inspector in terms that would allow it 

to be at multiple locations in a network architecture, including at the gateway. See ‘844 Patent, 7:6-8:5, 

2:5-7, Fig. 5. Additionally, Judge Gilliam already rejected the same arguments set forth by Cisco that 

the specification limits the claim to require deployment. Symantec at *15 (“the intrinsic record does not 

support the ‘deployment’ limitation”). And contrary to Cisco’s claims, its construction is not 

“consistent” with an out-of-district court decision, which ordered a different construction for this term 

than that proposed by Cisco here.3

Further, Cisco’s reliance on the statements made before the Patent Office do not support its 

position and actually provides further support for Finjan’s proposed claim construction. In fact, Finjan 

described the inspector in broad terms during prosecution. Dkt. 112-3, Cisco Ex. 1 at 2-5 (“In 

Applicant’s system, some of the burden may be transferred to the inspector, and generation of the 

Downloadable security profile may be performed only once.”). Specifically, Finjan explained that, in 

contrast to “Ji,” “some” of the burden of performing inspections “may” be shared between the gateway 

and the inspector—this is not unequivocal language that could result in any disclaimer of the gateway 

embodiment. Indeed, this Court has expressly rejected the argument that these remarks constitute a 

disclaimer, recognizing that nowhere in the prosecution history does the patentee nor the examiner 

disclaim that the DSP has to be linked “before any server that provides web content in response to a 

request from a web client.” Symantec at *14–16. As described above, because at a minimum, this 

statement is open to multiple reasonable interpretations, including those in various prior orders in this 

District, it cannot be a clear and unmistakable disclaimer under the law. Id. at *16 (rejecting same 

disclaimer argument); Info-Hold, Inc. v. Applied Media Techs. Corp., 783 F.3d 1262, 1267 (Fed. Cir. 

2015) (plain and ordinary meaning applies unless there is a clear, intentional disavowal of claim scope). 

There is no merit to Cisco’s conclusory assertion that inclusion of “any” will assist the jury in 

understanding the “true” scope of the claim and prevent a debate about claim scope at trial. See Cisco 

 3 The single prior claim construction order that Cisco cites as purportedly supporting its proposed 

construction is an out-of-district decision from the Southern District of California. Finjan, Inc. v. Eset 

LLC, Case No. 3:17-cv-0183-CAB-(BGS), Dkt. No. 195 (S.D. Cal. Nov. 14, 2017). In contrast, the 

various prior orders that Finjan cites are within this District, and as noted by Judge Gilliam, “the degree 

of deference...should be greater where the prior claim construction order was issued in the same 

jurisdiction.” Symantec at *3-4.

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 11 of 20
8

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Br. at 9. In fact, Dr. Clark disagrees with Cisco and recognized that the claim does not require “any” or 

any other additional language—confirming there is no need to rewrite the claim language. Ex. 1, Clark 

Tr. at 81:6–82:15. Further, to replace “a” with “any” would render the claims nonsensical, as it could 

imply that anything that accesses the Downloadable is a “web client,” including, presumably, the 

inspector. 

Thus, Cisco has fallen far short of providing any justification to deviate from the plain and 

ordinary meaning of this term and fails to stay true to the claims, unlike Finjan’s construction. See Asia 

Vital Components Co. v. Asetek Danmark A/S, No. 16-CV-07160-JST, 2018 WL 452109, at *4-5 (N.D. 

Cal. Jan. 17, 2018); Markman v. Westview Instruments, Inc., 52 F.3d 967, 976 (Fed. Cir. 1995); see also 

Phillips v. AWH Corp., 415 F.3d 1303, 1316 (Fed. Cir. 2005).

B. Term in the ‘494 Patent

Term 5. “Downloadable Scanner” (‘494 Patent, Claim 10)

Finjan’s proposed claim construction of the plain and ordinary meaning for Term 5 should be 

adopted because it is a simple term that persons having ordinary skill in the art would readily understand 

and there has been no express disavowal of this term. Finjan Br. at 13–14. Cisco fails to address the fact 

that Cisco’s proposed construction excludes embodiments disclosed in the specification—namely, that 

Downloadables include scripting languages, which are not machine code. Id. Nor does Cisco provide 

any evidence that demonstrates that Finjan unequivocally disavowed the full scope of this basic term 

either in the specification or during prosecution. Cisco Br. at 11–12; see Asia Vital, 2018 WL 452109, at 

*2. In fact, Cisco’s expert failed to offer any opinion with regard to this term, highlighting the infirmities 

in its position. See generally, Dkt. 112-1, Clark Decl. 

Cisco’s reliance on this Court’s prior decision in Blue Coat finding that the ‘494 Patent is 

directed to patent-eligible subject matter under Section 101 is misplaced because the Court was not 

considering claim construction, let alone this claim term, which Cisco concedes. Cisco Br. at 11. The 

standard for claim construction and a Section 101 analysis are different as a finding that a claim is nonabstract by looking at the specification to determine the problem to be solved does not mean there has 

been a clear and unmistakable disclaimer in the intrinsic record. Finjan, Inc. v. Blue Coat Sys., LLC, No. 

15-cv-03295-BLF, 2016 WL 7212322, at *9–12 (N.D. Cal. Dec. 13, 2016). Indeed, the Court even used 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 12 of 20
9

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

the term “code” generally, which contradicts Cisco’s proposed construction that requires machine code. 

Id., at *11 (“deriving security profile data that it discloses involves a precise process of decomposing 

code and extracting operations”). Finally, because Claim 10 already describes what the “Downloadable 

scanner” does, there is no reason to adopt Cisco’s construction. ‘494 Patent, Claim 10 (“a 

Downloadable scanner coupled with said receiver, for deriving security profile data for the 

Downloadable, including a list of suspicious computer operations that may be attempted by the 

Downloadable”). Accordingly, there was no unequivocal disavowal of the claim scope, and there is no 

basis to adopt Cisco’s construction.

C. Term in the ‘780 Patent

Term 6. “performing a hashing function on the Downloadable and the fetched software 

components to generate a Downloadable ID” (Claims 1, 9, 17, 18)

The Court should adopt Finjan’s construction of Term 6 as “performing a hashing function on 

the Downloadable together with its fetched software components to generate a Downloadable ID” 

because the specification supports such a construction, and multiple courts—including this Court and the 

PTAB—have adopted this proposed construction. It is consistent with how a person skilled in the art 

would understand the term. Finjan Br. at 14–15; Medvidovic Decl., ¶40. Cisco’s proposed construction, 

on the other hand, proposes a lengthy construction that will offer no clarity to a jury. Finjan Br. at 15. 

Cisco concedes that previous Courts have adopted and applied Finjan’s proposed claim 

construction to Term 6, and tellingly, its expert fails to provide any analysis for this term. See 

generally, Dkt. 112-1, Clark Decl. Cisco’s proposed claim interpretation is wrong because it 

unnecessarily limits the full claim scope of Term 6 to one embodiment described in the specification. 

Oatey Co. v. IPS Corp., 514 F.3d 1271, 1277 (Fed. Cir. 2008)(“At lease where claims can reasonably to 

interpreted to include a specific embodiment, it is incorrect to construe the claims to exclude that 

embodiment, absent probative evidence on the contrary.”); Cisco Br. at 13–14. For example, Figure 8 

describes an additional embodiment in which some, but not all (as Cisco contends), components 

referenced in the Downloadable are fetched. See Medvidovic Decl., ¶41; ‘780 Patent, Fig. 8 and 9:60–

67. 

While Cisco attempts to rely on the prosecution history to establish that the “complete 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 13 of 20
10

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Downloadable [is] always hashed,” that is irrelevant. Cisco Br. at 14. Cisco’s proposed construction 

does not even state that the complete Downloadable must be hashed. Id. at 13. Nonetheless, there is no 

requirement that the complete Downloadable be hashed—to the contrary, the ’780 Patent states that 

“[t]he ID generator 315 in step 840 performs a hashing function on at least a portion of the 

Downloadable code to generate a Downloadable ID.” ‘780 Patent, 9:65–67 (emphasis added). 

Finally, in relying on this Court’s summary judgment order in Blue Coat, Cisco misleadingly 

cherry picks one portion of the order, omitting the portion in which the Court recognized that “the more 

sensible reading would be that the ID generator performs ‘one or more’ hashing functions to generate 

‘one or more’ Downloadable IDs for ‘one or more’ Downloadables.” Finjan, Inc. v. Blue Coat Sys., 

Inc., 13-cv-03999-BLF, 2015 WL 3630000, at *6-7 (N.D. Cal. June 2, 2015). Thus, this Court’s 

decision actually undermines Cisco’s proposed construction that attempts to limit Downloadable ID. 

D. Terms in the ‘633 Patent

Term 7. “means for determining whether the downloadable-information includes 

executable code” (Claim 13)

Finjan’s proposed structure for Term 7, i.e., “code detection engine to perform the algorithm of 

col. 2 at 63-66, col. 14, line 58 to col. 15, line 8 or col. 16, lines 16-27,” is consistent with how a person 

of ordinary skill in the art would understand this term. Finjan Br. at 16; Medvidovic Decl., ¶¶45-48. In 

contrast, Cisco’s proposed construction fails because it includes additional elements and extraneous 

limitations.

Finjan’s proposed structure more fully and accurately captures the algorithm by providing the 

alternative structures for performing the claimed function of determining whether the downloadableinformation includes executable code. Specifically, Finjan’s construction includes the code detection 

engine as described in Column 2 at lines 63-66, which captures the two types of alternative 

functionality—the first described in Columns 14, line 58 to Column 15, line 8 and the second described 

at Column 16, lines 16-27. Indeed, Cisco agrees that both these algorithms are correct, but claims that 

both techniques are required for the claimed function. Cisco Br. at 15. In making this claim, Cisco 

identifies Figure 10 as purportedly “succinctly encapsulate[ing] the use of both file type detection (step 

1001) and content analysis (step 1003) to determine whether the downloadable include[s] executable 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 14 of 20
11

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

code.” Id. However, Cisco’s reliance on Figure 10 is improper because it is an attempt to limit the 

algorithm to a single embodiment in the specification. HBAC Matchmaker Media, Inc. v. Google Inc., 

650 F. App’x 990, 993 (Fed. Cir. 2016) (“we have repeatedly ‘cautioned against limiting the claimed 

invention to preferred embodiments or specific examples in the specification.’”). Indeed, the two 

algorithms are disclosed at different portions of the ‘633 Patent—which means that the two do not need 

to both occur to perform the function. 

Although it is unclear, Cisco seems to argue that the claimed function actually be “determining 

whether [or not] the downloadable-information includes executable code.” 4 Yet this is not the claimed 

function, which Cisco agrees is simply “determining whether the downloadable-information includes 

executable code.” Cisco Br. at 15–16. There is also no support in the prosecution history for Cisco’s 

interpretation. Finjan’s statements regarding Ji are in reference to an exemplary embodiment and do 

not establish that the claimed function includes any more than determining whether the downloadableinformation includes executable code. Id. at 16–17. Specifically, nothing in Finjan’s statements during 

prosecution constitutes a disclaimer of either of the two methods—i.e., file type detection or content 

analysis—taking place independently to determine whether the downloadable-information includes 

executable code. Info-Hold, 783 F.3d at 1267.

Term 8. “means for causing mobile protection code to be communicated to at least one 

information-destination of the downloadable-information, if the downloadableinformation is determined to include executable code” (Claim 13)

The Court should adopt Finjan’s proposed claim construction for Term 8, i.e., “transfer engine 

programmed to perform the algorithm of col. 14, lines 24-36,” because the specification of the ‘633 

Patent unambiguously identifies the transfer engine as the structure for performing the function. Finjan 

Br. at 18–19; see also Medvidovic Decl., ¶51. 

Cisco improperly uses the conditional phrase “if the downloadable-information is determined to 

include executable code” to attempt to contort the actual disclosure in the ‘633 Patent in order to rely on 

the packaging engine for this function. Thus, rather than rely on the straightforward disclosure in the 

‘633 Patent, Cisco is forced to rely on a causal connection to attempt to establish that packaging engine 

403 causes MPC to be communicated to at least one information-destination. Cisco Br. at 18. Cisco 

 4 The bolded and underlined language shows Cisco’s additions to the claim language.

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 15 of 20
12

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

fails to provide any support in the specification that demonstrates that the packaging engine itself

communicates, or transfers, mobile protection code to at least one information-destination. Medvidovic 

Decl., ¶53. Rather, it is the transfer engine, not the packaging engine, that causes mobile protection code 

to perform the function disclosed in this term.

Indeed, under Cisco’s own interpretation, if the downloadable-information is determined to 

include executable code, the packaging engine 403 would have no way of communicating the MPC 

without the assistance of transfer engine 406. See ‘633 Patent, Fig. 5. Further, although Cisco claims 

that the transfer engine “operates blindly,” that is not the case because the specification of the ‘633 Patent 

describes the transfer engine performing queueing operations using a server transfer queue. See ‘633 

Patent, 14:29-36. Moreover, the claim limitation does not specify how the transfer engine must perform 

the function of communicating mobile protection code. Cisco Br. at 19, n.16. And in fact, as detailed 

above, the ‘633 Patent is explicit that that the transfer engine performs this function. 

Term 9. “information-destination of the downloadable-information” / “downloadableinformation destination” (Claims 1, 8, 13, 14)

Finjan’s proposed construction for Term 9, i.e., plain and ordinary meaning (a device or process 

that is capable of receiving and initiating or otherwise hosting a mobile code execution), is the same as 

this Court’s prior construction and is consistent with the intrinsic evidence. Finjan Br. at 19; Finjan v. 

Proofpoint, 13-cv-05808-HSG, 2015 WL 7770208, at *5 (N.D. Cal. Dec. 3, 2015)(quoting Vitronics, 90 

F.3d at 1582)(“The specification acts as a dictionary when it expressly defines terms used in the claims 

or when it defines terms by implication.”). Here, the specification provides explicit support for Finjan’s 

construction of this term. ‘633 Patent, 7:58-62 (“A suitable information destination ... capable of 

receiving and initiating or otherwise hosting a mobile code execution.”). 

There is no basis for Cisco’s assertion that because the Court’s prior construction for the ‘633 

Patent did not account for the language “of the downloadable-information,” it does not apply here. 

Cisco Br. at 20–22. Tellingly, Cisco does not specify how this language changes the construction of this 

term. Notwithstanding this hollow argument, Cisco cannot provide any intrinsic or extrinsic support for 

its proposed construction. Cisco relies on portions from the ‘633 Patent specification that fail to even 

mention the words “client,” “request,” “original,” much less describe how anything in the cited portions 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 16 of 20
13

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

requires that this term be “the client that originally requested the downloadable.”5 See ’633 Patent, 9:44-

57. Further, the portion of the specification that Cisco emphasizes—“a destination-address of the 

received information”—does not support its construction because the specification does not limit the 

destination-address to the source-address. Cisco Br. at 20. 

Cisco’s proposed construction contradicts the purpose of the ‘633 Patent, which is to send mobile 

protection code to a downloadable-information destination (or information-destination of the 

downloadable-information), including a sandbox—i.e., not the client that originally requested the 

downloadable. See, e.g., ‘633 Patent, 3:5–21; id. at 3:51–62 (“causing the sandboxed package to be 

communicated to and installed by a receiving device or process (“user device”)”); Cisco Br. at 19–22. 

Further, Cisco excludes embodiments where MPCs can be delivered to multiple destinations—e.g., “the 

same or another destination” and “different Downloadable-destinations or destination capabilities.” 

‘633 Patent, 10:11-24 (emphasis added).

The other portions of the specification that Cisco relies on are equally unavailing because they 

just use the term “destination” or recite language similar to the claims without any explicit or implicit 

references to a client that originally requested the downloadable.6 Moreover, in claiming that its 

proposed claim construction includes processes (Cisco Br. at 21 n.19), Cisco cites a portion of the 

specification that explicitly states that “[a] suitable information-destination or ‘user device’ can further 

include one or more devices or processes (such as email, browser or other clients) that are capable of 

receiving and initiating or otherwise hosting a mobile code execution.” ’633 Patent, 7:58-62 (emphasis 

added). In doing so, Cisco actually provides additional support that the claim scope of Term 9 is not 

limited to just a client that originally requested the downloadable because “other” devices, i.e., clients 

other than the client that originally requested the downloadable, can be information-destinations. 

Cisco’s reliance on the prosecution history of the ‘633 Patent is also misguided because Cisco 

again fails to show how the “intended destination computer” is the computer that originally requested the 

 5 In an attempt to establish a link between “destination-address” and “the client that originally requested 

the downloadable,” Cisco simply relies on vague assumptions that it “must be the client that originally 

requested the downloadable-information (and is the final destination for the downloadable-information.” 

Cisco Br. at 21 (emphasis added).

6 It should be noted that the term “final destination” does not appear in specification, thereby making it 

even more difficult to understand the logic behind Cisco’s proposed claim construction.

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 17 of 20
14

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

downloadable-information. Cisco Br. at 21–22. Cisco’s expert stated that the information-destination is 

the client that requested the Downloadable, but did not state that it must be the client that originally 

requested the downloadable-information. Ex. 1, Clark Tr. at 248:1–249:19. Accordingly, there is no 

support for Cisco’s proposed construction. 

E. Term in the ‘154 Patent

Term 10. “first function”

Again, Finjan’s proposed construction of the plain and ordinary meaning is the appropriate 

construction because it is consistent with the specification and with this Court’s prior orders. Finjan Br. 

at 20. In particular, Judge Gilliam adopted the plain and ordinary meaning of “first function” and 

specifically rejected that “first function” was limited to either the “original” or “substitute” functions. 

Proofpoint, 2015 WL 7770208, at *8-9. Indeed, this Court recognized that the second function “can be

the ‘original function’ identified in the specification” (and thus, conversely, that the first function can 

be the substitute function) but is not limited to this embodiment. Id. at 9 (emphasis added).

Specifically, this Court declined to rewrite the claim language because the “Federal Circuit has 

repeatedly warned courts that ‘it is the claims, not the written description, which define the scope of the 

patent right.” Id. at n.4 (citing Laitram Corp. v. NEC Corp., 163 F.3d 1342, 1347 (Fed. Cir. 1998)). 

Cisco fails to identify support for its proposed claim construction or demonstrate that Finjan 

disclaimed any particular embodiment. Instead, Cisco focuses on one particular embodiment identified 

in the specification—namely, an embodiment in which the first and second function are different 

functions. Cisco Br. at 22–23. Contrary to Cisco’s assertions, the claim would not be facially 

nonsensical under Finjan’s construction because the specification of the ‘154 Patent provides an 

embodiment that describes how a first and second function can be the same and still be well-understood 

by one skilled in the art. Id. at 23–25; see also Medvidovic Decl., ¶61. 

For instance, contrary to Cisco’s characterization of the Tables (Cisco Br. at 25), the ‘154 Patent 

describes an embodiment that includes a first function, such as “Document.write(‘<h1>hello</h1>’)”, 

and a second function, such as “Document.write(text).” Medvidovic Decl., ¶62. In the example shown 

in Table III, the second function calls the same first function, “Document.write().” Accordingly, Cisco’s 

construction is incorrect because the expressed example embodiment uses the same function, 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 18 of 20
15

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Document.write() as the first and second function, and is accordingly not a substitute function as Cisco 

proposes. Id. Further, the ‘154 Patent also describes a recursive function—which is a function that calls 

itself— “Document.write(“<h1>Document.write(“<h1><SCRIPT>Some JavaScript</SCRIPT></h1>”) 

</h1>”).” ‘154 Patent, 12:28–36; Medvidovic Decl., ¶62. Accordingly, the outer Document.write() 

function is the first function and the inner Document.write() function is the second function or vice versa. 

The security computer can inspect both levels to determine whether it is safe to invoke. ‘154 Patent, 

12:43–13:7. 

Cisco mischaracterizes Dr. Medvidovic’s testimony by claiming that he could not “identify any 

contrary teaching in the specification” to Cisco’s proposed construction. Cisco Br. at 24. First, Cisco 

never asked Dr. Medvidovic whether he could identify any contrary teaching. Further, Cisco 

conveniently omits the next question and answer where Dr. Medvidovic explicitly states “[t]hat may 

have been the original function if the exact embodiment is what you see in Figure 2, but Claim 1 does 

not restrict it to that embodiment at all.” Dkt. 112-5, Cisco Ex. 3 (Medvidovic Tr.) at 172:15–18 

(emphasis added). 

Cisco also mischaracterizes the statements that Finjan made in IPR proceedings, which do not 

contradict Finjan’s proposed construction and certainly do not serve as a clear and unequivocal 

prosecution disclaimer. Cisco Br. at 24. Specifically, Finjan stated that “[t]he ‘154 talks about a call to a 

first function” and also specified that the use of a substitute function is an example, not that it is the sole 

embodiment in the ‘154 Patent. Dkt. 112-13, Cisco Ex. 11 at 35:3–5; id. at 64:8–10. 

Finally, Cisco’s reliance on 3M is inapposite. Cisco Br. at 23. Here, the use of the “first” and 

“second” modifiers before the term “function” is not used in a superfluous manner, but is used as a 

conventional patent law technique that distinguishes between repeated instances of the term “function” 

recited in Claim of the ‘154 Patent. See 3M Innovative Props. Co. v. Avery Dennison Corp., 350 F.3d 

1365, 1371 (Fed. Cir. 2003) (the use of the terms “first” and “second” is a common patent-law 

convention to distinguish between repeated instances of an element or limitation).

III. CONCLUSION

For the reasons set forth above, Finjan respectfully requests that the Court construe all of the 

disputed terms of the Finjan Patents in accordance with Finjan’s constructions. 

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 19 of 20
16

FINJAN’S REPLY CLAIM CONSTRUCTION BRIEF CASE NO.: 17-cv-00072-BLF

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Dated: May 1, 2018

Respectfully submitted,

By: /s/ James Hannah

Paul J. Andre (State Bar No. 196585)

Lisa Kobialka (State Bar No. 191404)

James Hannah (State Bar No. 237978)

KRAMER LEVIN NAFTALIS

& FRANKEL LLP

990 Marsh Road

Menlo Park, CA 94025

Telephone: (650) 752-1700

Facsimile: (650) 752-1800

pandre@kramerlevin.com

lkobialka@kramerlevin.com

jhannah@kramerlevin.com

Attorneys for Plaintiff

FINJAN, INC.

Case 5:17-cv-00072-BLF Document 127 Filed 05/14/18 Page 20 of 20