1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

CISCO’S REPLY IN SUPPORT OF MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

DUANE MORRIS LLP 

D. Stuart Bartow (CA SBN 233107)

dsbartow@duanemorris.com

Nicole E. Grigg (SBN 307733)

negrigg@duanemorris.com

2475 Hanover Street

Palo Alto, CA 94304-1194

Telephone: 650.847.4146

Facsimile: 650.847.4151

DUANE MORRIS LLP 

Joseph A. Powers (PA SBN 84590) 

Admitted Pro Hac Vice 

japowers@duanemorris.com 

Jarrad M. Gunther (PA SBN 207038) 

Admitted Pro Hac Vice 

jmgunther@duanemorris.com 

30 South 17th Street 

Philadelphia, PA 19103 

Telephone: 215.979.1000 

Facsimile: 215.979.1020 

Attorneys for Defendant 

CISCO SYSTEMS, INC. 

DUANE MORRIS LLP 

L. Norwood Jameson (GA SBN 003970)

Admitted Pro Hac Vice

wjameson@duanemorris.com

Matthew C. Gaudet (GA SBN 287789)

Admitted Pro Hac Vice

mcgaudet@duanemorris.com

David C. Dotson (GA SBN 138040)

Admitted Pro Hac Vice

dcdotson@duanemorris.com

John R. Gibson (GA SBN 454507)

Admitted Pro Hac Vice

jrgibson@duanemorris.com

Jennifer H. Forte (GA SBN 940650)

Admitted Pro Hac Vice

jhforte@duanemorris.com

1075 Peachtree NE, Suite 2000

Atlanta, GA 30309

Telephone: 404.253.6900

Facsimile: 404.253.6901

IN THE UNITED STATES DISTRICT COURT 

NORTHERN DISTRICT OF CALIFORNIA 

SAN JOSE DIVISION

FINJAN, INC., a Delaware Corporation, 

Plaintiff, 

v. 

CISCO SYSTEMS, INC., a California 

Corporation, 

Defendant. 

Case No.: 5:17-cv-00072-BLF-SVK 

REPLY IN SUPPORT OF CISCO 

SYSTEMS, INC.’S MOTION TO STRIKE 

PORTIONS OF FINJAN’S AMENDED 

EXPERT REPORT ON INFRINGEMENT 

OF PATENT NO. 7,647,633 

Date: April 21, 2020 

Time: 10:00 a.m. 

Courtroom: 6, 4th Floor 

Judge: Hon. Susan Van Keulen 

REDACTED

Case 5:17-cv-00072-BLF Document 524 Filed 04/15/20 Page 1 of 8
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

CISCO’S REPLY IN SUPPORT OF MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

TABLE OF ABBREVIATIONS 

Plaintiff Finjan, Inc. Finjan or Plaintiff 

Defendant Cisco Systems, Inc. Cisco or Defendant 

Operative Infringement Contentions OICs 

Mobile Protection Code MPC 

Cisco’s Motion for Summary Judgment (Dkt. 378) Cisco MSJ 

Cisco’s Motion to Strike Portions of Finjan’s Amended Expert Report on 

Infringement of Patent No. 7,647,633 (Dkt. 492) 

Motion 

Sealed Order Granting In Part And Denying In Part Ciscos Motion For 

Partial Summary Judgment Of Non-Infringement (Dkt. 487) 

MSJ Order 

Transcript of the February 19, 2019 Deposition of Matthew Watchinski Ex. 1 

Declaration of Nicole Grigg in Support of Defendant Cisco Systems, Inc.’s 

Reply in Support of Motion to Strike Portions of Finjan’s Amended Expert 

Report on Infringement of Patent No. 7,647,633 

Grigg Decl.1

 

1

 All exhibits are attached to the Grigg Declaration unless otherwise stated. 

Case 5:17-cv-00072-BLF Document 524 Filed 04/15/20 Page 2 of 8
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 1 

CISCO’S REPLY IN SUPPORT OF MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

Despite the confusion sown by Finjan’s Opposition, the issue before this Court is 

straightforward. The question Judge Freeman referred to this Court is whether Finjan’s OICs have 

disclosures corresponding to each of the 7 items on which Finjan relied at summary judgment. In 

response to the parties’ dispute over whether these are new theories beyond the scope of Finjan’s 

OICs, Judge Freeman instructed Finjan to return to this Court for permission to make what it alleges 

are simple substitutions from its OICs. Dkt. 419, 1/9/20 Trans. at 120:6-11. In its Opposition, 

Finjan concedes that the 4 items on which summary judgment was granted are “moot,” and makes 

no showing of corresponding disclosures in the OICs. Remarkably, Finjan extends its “mootness” 

argument to the 3 surviving components: “arguments regarding the phrases 

 are moot issues because Finjan has served amended expert reports 

that use language that track the operative infringement contentions.” Opp. at 10. This is precisely 

the dispute that Judge Freeman referred to this Court to address—whether the 3 remaining 

component theories “have a corresponding functionality in the [OICs].” MSJ Order at 4.. 

Finjan cannot show where its OICs put Cisco on notice that its experts might opine that 

something corresponding to a are the MPC. Under 

the case law, infringement contentions are the roadmap for what Cisco must defend itself against. 

Simply put, Finjan did not put Cisco on fair notice that Finjan was accusing 

 as being the MPC in Claim 14. Nothing in the OICs maps to these 

new theories. Finjan should not be allowed to accuse these components in this case. 

A. Cisco’s Motion is Procedurally Proper 

Finjan is incorrect that Cisco’s motion is procedurally improper. Judge Freeman’s summary 

judgment Order states, “If, however, Finjan is unable to show that the functionalities 

corresponding to the codenames were included in its operative infringement contentions, the 

Court would entertain that dispute in a motion in limine.” MSJ Order at 4 (citing to Dkt. 419, 1/9/20 

SJ hearing transcript at 159:14-17) (emphasis added). During the summary judgment hearing, Judge 

Freeman stated, and Finjan counsel confirmed, that this Court would make that initial determination 

whether the functionality corresponding to the codenames were included in the operative 

infringement contentions. For example, Finjan’s counsel (Paul Andre) stated, “We have an issue 

Case 5:17-cv-00072-BLF Document 524 Filed 04/15/20 Page 3 of 8
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 2 

CISCO’S REPLY IN SUPPORT OF MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

obviously with the expert reports. We will be bringing that to Judge Van Keulen, obviously, unless 

we can work it out.” Dkt. 419, 1/9/20 Trans., 158:23-25. Judge Freeman then stated, “I am hoping 

there are a limited number of disputed areas, and you will just give her [Judge Van Keulen] chapter 

and verse, as you will to Mr. Jameson, of where your reference is to the contentions.” Id. at 159:7-

10. See also id. at 51:4-6 (“So this substitution needs to happen, and if you can’t agree on it, you 

will go back to her [Judge Van Keulen].”), 51:19-21 (“So that’s just the way it is. It will go to Judge 

Van Keulen if there’s an objection...”), 120:6-11 (quoted above). It is clear from the summary 

judgment proceedings that this Court is to decide this dispute, the outcome of which is to be 

enforced via a motion in limine before Judge Freeman. Finjan is also incorrect that Cisco’s motion 

“seeks to prevent what [Cisco] believes Dr. Medvidovic might testify about.” Opp. at 5. The dispute 

is precisely what Judge Freeman described: whether the three MPC infringement theories that 

survived summary judgment are disclosed in the OICs. 

B. The OICs Do Not Support The Theories That Survived Summary Judgment 

Finjan attempt to reframe the dispute as an issue of whether any of the expert reports contains 

language that “tracks” the OICs. In other words, Finjan seeks a way out by having its expert retreat 

to generic language that can be located somewhere in Finjan’s OICs. This effort simply ignores the 

long procedural history of this dispute, including Finjan’s earlier motion to amend, and the effect of 

Judge Freeman’s MSJ Order. Only 3 specific components are still alive in this case as accused 

MPC. Finjan did not rely on the generic language in its reports to avoid summary judgment, but on 

the specific items at issue in this motion. The issue now before the Court is whether the generic 

placeholders cherry picked from the OICs are sufficient under the law and in the context of the OICs 

themselves to have put Cisco on notice of the three MPC component theories that survived summary 

judgment. The answer is no. 

1. The Dispute Regarding The 3 Surviving Items Is Not “Moot”. 

Finjan is wrong that Finjan’s latest amended expert reports – in which it just pasted the 

generic language from its operative contentions verbatim into the report – resolved all issues 

regarding the codename phrases. Opp. at 10. Finjan concedes, as it must, that only three of the 

seven items – – survived Cisco’s motion for summary 

Case 5:17-cv-00072-BLF Document 524 Filed 04/15/20 Page 4 of 8
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 3 

CISCO’S REPLY IN SUPPORT OF MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

judgment (Opp. at 6). Judge Freeman’s MSJ Order confirmed that Finjan must “show that the 

functionalities corresponding to the codenames were included in its operative infringement 

contentions” (MSJ Order at 4), which it cannot. 

Finjan attempts to map to the generic “virtual environment agent”. Finjan 

cites to no evidence (from documents, or from fact or expert witness) that the disclosure of the 

genericized phrase “virtual environment agent” corresponds to Counsel’s say-so 

cannot be enough; otherwise, the Local Rules would have no teeth. Nor could Finjan have presented 

such evidence, as Finjan twice proves in its own Opposition. First, Finjan confirms that its expert 

reports actually included the phrase “virtual environment agent,” but those cites never link the 

“virtual environment agent” with the Opp. at 3. Second, Finjan cites its expert’s 

testimony that “Cisco may not transmit the entire virtual environment agent, but it transmits things 

used to configure . . .” Opp. at 3. Again, that testimony says nothing about a 

Moreover, far from helping Finjan, this is classic expert deposition equivocation, between what may 

or may not be transmitted and what might be the “virtual environment agent,” confirming that the 

“viral environment agent” (whatever it is) is partially transmitted. This soundbite sheds no light on 

the very specific component called a (which is never transmitted, even in part). 

Cisco MSJ at 15. Ironically, even Finjan’s use of this broad language would not encompass the 

or. Cisco’s engineer Matthew Watchinski explained that Threat Grid does not have an 

 See Ex. 1 at 48:17-23. In other words, even in genericized form, 

Finjan is using a term that would not capture something in Threat Grid, much less correspond to a 

very specific component like the Finjan’s detour to its expert reports and 

deposition testimony only hurts its cause, and it certainly does not answer the questions of whether 

the OICs put Cisco on notice that Finjan was accusing the , either by name or 

function. Likewise, Finjan had no answer to the fact that the Court specifically rejected (by name) 

any attempt to amend the expert reports to include elements specific to Motion at 10. 

Finjan’s argument on the other two elements is even weaker. Finjan attempts to map 

 to the generic “parameters to run the sample file or URL.” Opp. at 10. 

Case 5:17-cv-00072-BLF Document 524 Filed 04/15/20 Page 5 of 8
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 4 

CISCO’S REPLY IN SUPPORT OF MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

As explained in Cisco’s Motion, “parameters to run the sample file or URL” could be sent from 

anywhere, and they encompass the API theory Finjan abandoned. It does not denote any component 

with specificity, and certainly not an existing component of a sandbox. And, again the proof is in 

the MSJ Order: this is the same generic phrase that Finjan said also disclosed 3 of the items on 

which summary judgement was granted: 

Motion at 10. These items are of such different character that some were eliminated as a matter of 

law. 

2. No Disclosure of Alleged MPC Already resident at the Cisco sandbox. 

Finjan argues the transmission of MPC is only “one way infringement occurs for Claim 14” 

but another way is “a stationary virtual environment agent within a virtual environment (e.g., a 

sandbox).” Id. at 7. Again, this one-off reference in the OICs to “virtual environment agent” is not 

notice of a standalone sandbox-only theory apart from Finjan’s MPC transmission theories. Motion 

at 9-10. Finjan has no answer to the fact that the OICs disclose the “virtual environment agent” 

(like everything else) as being transmitted to the sandbox and then executed there. 

Finally, Finjan’s reference to the ruling in the March 20, 2020 MSJ Order that Claim 14 does 

not require MPC to be transmitted does not retroactively create an accusation against such an 

accused product in the OICs. Indeed, at the time of the OICs, Finjan was telling the Court the 

opposite, namely that “because Claim 14 specifically recites a ‘mobile code executor’ ... the mobile 

aspect of the code is written in the claims already, [and] the construction does not require the term 

‘mobile.’” Dkt. 155 at 1; Cisco MSJ at 13. This position is consistent with the OIC’s claim 14 

treatment of the “virtual environment agent”. The OIC’s reference the phrase only three times, and 

none asserts that the virtual environment agent is a component already at the Cisco sandbox. The 

first reference in the OIC’s to “virtual environment agent” in the context of claim 14 is that the 

“virtual environment agent (mobile protection code)” is caused to be executed within the virtual 

environment. See, e.g., Opp. Ex. 4 (Appx. C1) at 35 (“Cisco AMP for Networks meet the recited 

claim language because Cisco AMP for Networks cause a virtual environment agent (mobile 

protection code) to be executed within the virtual environment running Windows operating system 

...)”. The second reference follows immediately after the first and states only that “the virtual 

Case 5:17-cv-00072-BLF Document 524 Filed 04/15/20 Page 6 of 8
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 5 

CISCO’S REPLY IN SUPPORT OF MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

environment agent will process one or more operations ...” Id. There is no assertion that this 

“virtual environment agent” is a fixed part of the sandbox. And in fact, as explained in Cisco’s 

motion, these vague references to the virtual environment agent are directly followed by Finjan’s 

contentions that MPC is not something that is already resident at the sandbox but rather something 

transmitted to the sandbox, for example by the AMP Gateway products: 

If the code is executable, Cisco AMP for Networks packages information pertaining to the 

executable and information pertaining to tasks and relevant parameters and transmits it to 

Threat Grid and/or Talos for further analysis. The code and information pertaining to the task 

and parameters relevant to Threat Grid and/or Talos is the mobile protection code.” 

Id. Consistent with this statement, Finjan’s third reference is where MPC is transmitted: 

Cisco AMP for Networks contain a scheduler which retrieves, from an virtual environment 

component pool, a virtual environment agent for monitoring and detecting code that perform 

suspicious changes to the operating system and sends it to the virtual environment, thereby 

causing mobile protection code to be communicated to at least one information-destination of 

the downloadable-information. 

Id. Whether viewed individually or in their larger context, Finjan’s one-off references to a “virtual 

environment agent” in the contentions did not put Cisco on notice of a sandbox-only theory in 

compliance with the local patent rules. DSS Tech. Mgmt. v. Apple, Inc., 2020 U.S. Dist. LEXIS 

6177 at *23-25 (N.D. Cal. 1/14/20).

Finally, Finjan asserts it provided notice via a “separate infringement chart in its 

Infringement Contentions that accused Threat Grid alone of infringing.” Opp. at 9 (citing Opp. Ex. 

6). But the chart itself contradicts this position, as the accusations in that chart involve Cisco 

Gateway Products, just like the other charts. As Cisco explained in its Motion, this Threat Grid 

contention defines “Cisco Threat Grid” as including (i) “any related subscriptions such as AMP”, (ii) 

“Cisco Threat Gird in combination with outer Cisco appliances and/or cloud-based products and/or 

services (such as Cisco AMP for Networks ...”) and (iii) Cisco Threat Grid in combination with 

Talos technology.” Opp., Ex. 6 at 1. As shown in Cisco’s Motion, while Finjan labels Chart C3 as a 

ThreatGrid-only infringement chart, the allegations quickly morph into allegations that depend on 

other Cisco appliances, such as AMP. The citations in Finjan’s Threat Grid contention are 

substantively identical to the allegations in the AMP Gateway Cloud product contentions, and do not 

disclose any Cisco Sandbox-only MPC theories. Motion at 6-7. 

Case 5:17-cv-00072-BLF Document 524 Filed 04/15/20 Page 7 of 8
1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 

21 

22 

23 

24 

25 

26 

27 

28 

 6 

CISCO’S REPLY IN SUPPORT OF MTN. TO STRIKE AMENDED EXPERT REPORT ON INFRINGEMENT 

CASE NO. 5:17-CV-00072-BLF-SVK 

Dated: April 15, 2020 Respectfully submitted, 

/s/ Nicole E. Grigg 

Nicole E. Grigg 

DUANE MORRIS LLP 

Email: negrigg@duanemorris.com 

D. Stuart Bartow 

Email:dsbartow@duanemorris.com 

2475 Hanover Street 

Palo Alto, CA 94304-1194 

Telephone: 650.847.4146 

Facsimile: 650.847.4151 

L. Norwood Jameson (admitted pro hac vice) 

Email: wjameson@duanemorris.com 

Matthew C. Gaudet (admitted pro hac vice) 

Email: mcgaudet@duanemorris.com 

David C. Dotson (admitted pro hac vice) 

Email: dcdotson@duanemorris.com 

Jennifer H. Forte (admitted pro hac vice) 

Email: jhforte@duanemorris.com 

1075 Peachtree Street, Ste. 2000 

Atlanta, GA 30309 

Telephone: 404.253.6900 

Facsimile: 404.253.6901 

Joseph A. Powers (admitted pro hac vice) 

Email: japowers@duanemorris.com 

Jarrad M. Gunther (admitted pro hac vice) 

jmgunther@duanemorris.com 

30 South 17th Street 

Philadelphia, PA 19103 

Telephone: 215.979.1000 

Facsimile: 215.979.1020 

Attorneys for Defendant 

CISCO SYSTEMS, INC. 

Case 5:17-cv-00072-BLF Document 524 Filed 04/15/20 Page 8 of 8