1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

FINJAN, INC.,

Plaintiff,

v.

CISCO SYSTEMS INC.,

Defendant.

Case No. 17-cv-00072-BLF (SVK)

ORDER ON CISCO SYSTEMS, INC.’S 

MOTION TO STRIKE PORTIONS OF 

FINJAN’S AMENDED EXPERT 

REPORT ON INFRINGEMENT OF 

PATENT NO. 7,647,633

Re: Dkt. No. 492

Defendant Cisco Systems, Inc. seeks to strike portions of the report of Plaintiff Finjan, 

Inc.’s expert witness Nenad Medvidovic, Ph.D. on the grounds that the report contains theories of 

infringement of Patent No. 7,647,633 that were not disclosed in Finjan’s infringement contentions 

dated November 30, 2017 (the “Operative Contentions”). Dkt. 492. As discussed below, Judge 

Freeman directed Cisco to make this motion to strike to the undersigned. The Court held a 

telephonic hearing on April 21, 2020. After considering the arguments made at the hearing, the 

parties’ briefs, the case file, and relevant law, the Court GRANTS Cisco’s motion to strike for the 

reasons and on the terms set forth below.

I. BACKGROUND

A. Finjan’s Infringement Contentions

Cisco’s present motion to strike is the latest skirmish in a long-running battle between the 

parties over the contours of Finjan’s infringement arguments. On November 30, 2017, Finjan 

served the Operative Contentions concerning its infringement claims. See Dkt. 492-1 at ¶¶ 2-3 

and Exs. 1 and 2. On April 18, 2019, Finjan filed a motion to amend the Operative Contentions to

identify additional evidence in support of its infringement claims, including adding the names of 

subcomponents of the products accused of infringement in this case to its previous contentions 

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 1 of 16
2

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

regarding the associated functionalities. Dkt. 231. Judge Freeman referred the motion to amend 

to the undersigned. Dkt. 238. 

Following a hearing, this Court issued an order denying Finjan’s motion to amend on June 

11, 2019, holding that “[i]t appears from the Court’s careful review of the proposed [supplemental 

infringement chart] and the arguments presented at the hearing that Finjan’s proposed amendments 

to identify components are significantly more complex and prejudicial than Finjan has portrayed 

them.” Dkt. 274 (the “SVK Contentions Order”) at 7. The Court noted that because Finjan had 

not submitted a redline of the contentions showing its extensive proposed amendments, “the Court 

is unable to determine that Finjan’s proposed amendments are limited to clarifying the existing 

contentions rather than expanding them.” Id.

On July 17, 2019, Judge Freeman rejected Finjan’s request for relief from the SVK 

Contentions Order, stating that she “concurs with Judge van Keulen’s determination that the issue 

is more complex than initially presented by Finjan.” Dkt. 304 (the “BLF Contentions Order”) at 

2-3. Judge Freeman noted that “[t]he Court would have expected Finjan to present a list of newly

identified internal code names to be swapped out for less precise designations in the infringement 

contentions” but despite being advised of this “deficiency” by the SVK Contentions Order, 

“Finjan has done nothing to persuade this Court that the true effect of its request is as benign as 

suggested in the moving papers.” Id.

B. Dr. Medvidovic’s July 2019 and December 2019 Reports

After Finjan filed its request for relief from the SVK Contentions Order but before denial 

of that request in the BLF Contentions Order, Finjan served its expert reports on infringement of 

the ’633 Patent, including the July 11, 2019 report of Dr. Medvidovic. See Dkt. 312-1 at ¶ 7; see 

also Dkt. 400-8 (the “July 2019 Report”).

Cisco filed a motion to strike portions of the July 2019 Report and other portions of 

Finjan’s expert reports on infringement. Dkt. 312. Cisco argued that the expert reports “contain 

multiple thousands of references to the very theories Finjan was seeking to add to its infringement 

contentions through its motion to amend, but was precluded from doing so” by the SVK and BLF

Contentions Orders. Dkt. 311-4 at 1. The “internal names or technologies” included in the 

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 2 of 16
3

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

infringement expert reports that Cisco sought to strike included and Id.

at 4. Although the term appeared in the July 2019 Report (see Dkt. 400-8 at 

¶¶ 635, 659, 660), Cisco did not specifically mention that term in its original motion to strike; as 

discussed below, was not one of the terms that Finjan unsuccessfully sought to 

add by way of motion to amend its contentions. See Dkt. 491-8. 

On November 12, 2019, Judge Freeman granted Cisco’s motion to strike portions of the 

July 2019 Report. Dkt. 397 (the “BLF Order re Motion to Strike”). Judge Freeman rejected as 

“meritless” Finjan’s argument that the SVK and BLF Contentions Orders did not forbid Finjan 

from using information learned in discovery to support its existing infringement contentions, 

stating that “Finjan was, of course, prohibited from including in its expert reports the theories it 

sought but failed to add to its infringement contentions by the SVK and BLF [Contentions] 

Orders.” Id. at 3. Judge Freeman also stated that “Finjan ‘may not use an expert report to 

introduce new infringement theories [or] new infringing instrumentalities’ and therefore is 

required to persuade the Court that the additional internal code names and components are ‘the 

identification of additional evidentiary proof’ and not ‘new theories’ of infringement.” Id. at 5 

(quoting Finjan, Inc. v. Symantec Corp., No. 14CV02998HSGJSC, 2018 WL 620169, at *2 

(N.D. Cal. Jan. 30, 2018)). Judge Freeman concluded that “Finjan’s experts were not permitted to 

use the internal code names and software components that Finjan sought and failed to add to its 

infringement contentions.” Id. at 6. Judge Freeman directed Finjan’s experts “to redraft their 

reports to remove the disallowed terminology and adhere their opinions to the disclosures in 

Finjan’s operative infringement contentions.” Id.

Finjan subsequently sent Cisco the amended report of Dr. Medvidovic dated December 13, 

2019. See Dkt. 492-1 at ¶ 4 and Ex. 3 (the “December 2019 Report”).

C. Cisco’s Motion for Summary Judgment on the ’633 Patent

Meanwhile, on October 22, 2019, Cisco filed a motion for summary judgment of noninfringement of the ’633 Patent. Dkt. 378. In both making and opposing Cisco’s motion for 

summary judgment, the parties relied on the July 2019 Report of Dr. Medvidovic. See Dkt. 378-1 

at ¶ 12 and Ex. 9; Dkt. 401-1 at ¶ 3 and Ex. 2. In an attempt to overcome summary judgment, 

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 3 of 16
4

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

Finjan relied on each of seven items to satisfy the mobile protection code (“MPC”) requirement in 

the asserted claim element 14(d) of the ’633 Patent: 

 See Dkt. 400-4 at 14.

At the summary judgment hearing on January 9, 2020, Cisco stated that the BLF Motion to 

Strike Order “struck [Finjan’s] expert reports” and “[s]o right now we have a summary judgement 

record where they are relying on struck expert reports, and they have done nothing to fix that 

summary judgment record.” Dkt. 419 at 27:22-28:1. Judge Freeman noted that “I and Judge van 

Keulen as well did not allow the use of these code names like this and there are others, but 

I allowed the reports to be modified to replace [them] with the terminology used in the 

infringement contentions. Id. at 47:12-15. Finjan responded that in December 2019, following 

the BLF Motion to Strike Order, it sent modified expert reports to Cisco. Id. at 49:24-50:7. 

According to Finjan, the December 2019 expert reports did “exactly what the judge ordered us to 

do, striking through the component names and then replacing it with ... whatever names that were 

in the infringement contentions.” Id. at 50:3-7. But as Finjan explained, Cisco had taken the 

position that Finjan needed to “remove the functionality as well.” Id. at 50:13-16. Judge Freeman 

told Finjan’s counsel:

So let me be clear, and I don’t have the paperwork in front of me, but Judge van Keulen 

did not allow the modification to the infringement contentions that you had suggested to 

her would replace certain alleged functionalities with their code names. And I agreed with 

that because you weren’t able to show me the swap out. And so that’s what I struck. I 

didn’t strike the expert’s opinions generally, it was I allowed the substitution. So this 

substitution needs to happen, and if you can’t agree on it, you will go back to her.

Id. at 50:22-51:6. 

In response, Cisco pointed out that “ is not in their infringement 

contentions.” Dkt. 419 at 120:3-5. Judge Freeman reiterated that “based on my order [Finjan] 

will have to ask Judge van Keulen to allow a substitution from something from the contentions to 

go to the jury in place of all of the arguments about which they are now using 

to defeat summary judgment, because otherwise they have provided me with no evidence.” Id. at 

120:6-11. Judge Freeman indicated that this Court’s order on the substitution issue would be 

implemented by means of a motion in limine. Id. at 159:12-17.

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 4 of 16
5

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

On March 20, 2020, Judge Freeman issued an order granting in part and denying in part 

Cisco’s motion for partial summary judgment of non-infringement. Dkt. 487 (the “SJ Order”). 

The Court granted Cisco’s motion for summary judgment as to four components of Cisco’s Threat 

Grid and that Finjan accuses as MPC: “

 Id. at 20. The Court denied summary judgment as to 

 Id. at 17, 20.

Addressing the parties’ dispute regarding Finjan’s expert reports on infringement, Judge 

Freeman reiterated that “the Court struck certain codenames from Finjan’s expert reports—but not 

the experts’ opinions generally” and that she had “allowed Finjan to amend its reports and 

substitute the disallowed codenames with functionalities that were included in Finjan’s 

infringement contentions.” Id. at 4. Because Judge Freeman at the time of the SJ Order was “not 

aware of any amended expert reports,” she decided Cisco’s motion for summary judgment “under 

the assumption that the codenames used in the expert reports (and the parties’ briefing) have a 

corresponding functionality in the infringement contentions and thus, are still in the case.” Id. 

Judge Freeman warned that “[i]f, however, Finjan is unable to show that the functionalities 

corresponding to the codenames were included in its operating infringement contentions, the Court 

would entertain that dispute in a motion in limine.” Id.

D. The Present Motion to Strike

On March 27, 2020, Cisco filed the present motion to strike. Dkt. 492. Cisco’s pending 

motion in limine number 4 asks Judge Freeman to implement this Court’s ruling on Cisco’s 

motion to strike. Dkt. 537.

On March 30, 2020, between the date Cisco filed its motion to strike and the date Finjan 

filed its opposition, Finjan served Cisco with a second amended report by Dr. Medvidovic. 

See Dkt. 507-6 at ¶ 3 and Ex. 2 (the “March 2020 Report”).

At the hearing on April 21, 2020, the Court requested that Cisco promptly file a document 

identifying specific paragraphs in the Medvidovic report(s) that it was asking the Court to strike. 

In response, Cisco provided a chart identifying the paragraphs it seeks to strike in the December 

2019 and March 2020 Reports. Dkt. 558.

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 5 of 16
6

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

II. LEGAL STANDARD

Judge Freeman’s order on Cisco’s previous motion to strike set forth the legal standard

applicable to a motion to strike expert reports. “It is well settled that ‘[e]xpert reports may not 

introduce theories not set forth in contentions.’” BLF Order re Motion to Strike (Dkt. 397) at 3 

(citing Huawei Techs., Co. Ltd v. Samsung Elecs. Co., Ltd., 340 F. Supp. 3d 934, 946 (N.D. Cal. 

2018) and Golden Bridge Tech. Inc. v. Apple, Inc., No. 12-cv-04882-PSG, 2014 WL 1928977, at 

*3 (N.D. Cal. May 14, 2014)). “Given the purpose behind the patent local rules’ disclosure

requirements, a party may not use an expert report to introduce new infringement theories [or] new 

infringing instrumentalities ... not disclosed in the parties’ infringement contentions ...” 

BLF Order re Motion to Strike (Dkt. 397) at 3 (citing Verinata Health, Inc. v. Sequenom, Inc., No. 

C 12-00865 SI, 2014 WL 4100638, at *3 (N.D. Cal. Aug. 20, 2014)). 

III. DISCUSSION

A. Procedural posture

Finjan argues that Cisco’s present motion to strike is procedurally improper “because 

Judge Freeman ordered that any dispute regarding the Infringement Contentions would be decided 

by her in the context of a motion in limine.” Dkt. 507-4 at 5. However, as discussed above, Judge 

Freeman stated at the summary judgment hearing that “[Finjan] will have to ask Judge van Keulen 

to allow a substitution from something from the contentions to go to the jury in place of all of the 

arguments about which they are now using to defeat summary judgment,” and

that if the parties could not agree on the substitution, they would go back to the undersigned.

Dkt. 419 at 50:22-51:6; 120:6-11. Judge Freeman indicated that this Court’s order on the 

substitution issue would be implemented through a motion in limine. Id. at 159:12-17. Moreover, 

Finjan argues in opposition to Cisco’s motion in limine number 4 that the motion in limine 

depends on this Court’s order on the motion to strike and is therefore “too speculative now,” 

thereby appearing to concede that the undersigned may properly decide what portions, if any of 

Dr. Medvidovic’s amended reports will be stricken. Dkt. 576-8 at 2.

Finjan also argues that Cisco’s motion to strike is improper because “instead of seeking to 

strike portions of Dr. Medvidovic’s expert report, it seeks to prevent what it believes 

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 6 of 16
7

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

Dr. Medvidovic might testify about.” Dkt. 507-4 at 5. This Court will decide only whether 

portions of Dr. Medvidovic’s reports will be stricken. The implications of this Court’s order for

Dr. Medvidovic’s trial testimony is an issue that Judge Freeman will decide. 

Accordingly, the Court concludes that Cisco’s motion to strike is procedurally proper. 

B. The operative expert report

Cisco’s present motion to strike focuses on the December 2019 Report. See Dkt. 491-3 at 

1 (“Cisco seeks an order striking [certain theories] from the ‘Amended Expert Report of Nenad 

Medvidovic, Ph.D. ....”). After Cisco filed the motion, Finjan served the March 2020 Report. 

Dkt. 507-6 at ¶ 3 and Ex. 2. 1 For the first time at the hearing on the present motion to strike, 

Cisco argued that “there is one actual operative report, which is the one that was asserted back in 

July 2015 [sic] that was subject to a motion to strike but there has not been any approved amended 

version.” Dkt. 560 at 11:24-12:2.

As Judge Freeman explained at the summary judgment hearing, she permitted substitution 

of certain terms from the July 2019 Report, with any dispute to be decided by the undersigned. 

Dkt. 419 at 120:6-11. The December 2019 Report represents Finjan’s attempt to implement the 

substitution ordered by Judge Freeman, and the parties’ dispute concerning the substitution is now 

presented in Cisco’s motion to strike, as directed by Judge Freeman. With respect to the 

March 2020 Report, Finjan represents that the report was served as a result of meet and confer 

discussions between the parties following the Judge Freeman’s comments at the summary 

judgment hearing. Dkt. 507-4 at 4. Moreover, Cisco addresses Finjan’s “latest amended expert

reports” in its reply on the motion to strike, which was filed several weeks after Finjan served the 

March 2020 Report. See Dkt. 523-3 at 2-3.

In light of the procedural history of Dr. Medvidovic’s reports in this case, Cisco’s 

complaint at the hearing about whether the December 2019 and March 2020 Reports are the 

1 On April 23, 2020, Finjan filed an opposition to Cisco’s motion in limine no. 4, in which Finjan 

states that it has provided Cisco with “Dr. Medvidovic’s April 17, 2020 Third Amended Report, 

which Finjan believes is Dr. Medvidovic’s operative report.” Dkt. 576-8 at 4 n.3. The parties have 

not informed this Court of the April 2020 Medvidovic report or provided a copy in connection 

with the pending motion to strike, and thus the Court will not consider it in ruling on the motion to 

strike.

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 7 of 16
8

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

operative reports and/or whether those reports should be allowed is untimely, was not directly

addressed in the papers, and is denied. Accordingly, the Court will analyze the present motion to 

strike in the context of Dr. Medvidovic’s December 2019 and March 2020 Reports. 

C. Cisco’s motion to strike portions of December 2019 and March 2020 Reports

Cisco’s present motion to strike challenges language in the December 2019 and March 

2020 Reports that replaces the earlier code names 

Dkt. 492. Judge Freeman stated in ruling on Cisco’s original motion to strike that “Finjan was, of 

course, prohibited from including in its expert reports the theories it sought but failed to add to its 

infringement contentions by the SVK and BLF [Contention] Orders.” BLF Order re Motion to 

Strike (Dkt. 397) at 3. As further guidance, Judge Freeman explained in her SJ Order that the 

issue for this Court to decide is whether the replacement language in the amended Medvidovic 

reports has a “corresponding functionality” in the operative infringement contentions. SJ Order 

(Dkt. 487) at 4. As a result of Judge Freeman’s directives, this Court must determine: (1) whether 

the substitute terms used by Finjan in the December 2019 and March 2020 Reports represent

theories that Finjan was denied permission to add to its infringement contentions as a result of the 

SVK and BLF Contention Orders; and (2) whether the Operative Contentions disclosed a 

corresponding functionality for the substitute terms as used in the December 2019 and March 

2020 Reports. In conducting this analysis, the Court focuses only on the substitute terms for the 

three items that survived Cisco’s summary judgment motion: and 

 The parties agree that Finjan’s proposed amendments to the Medvidovic report that 

relate to the other seven terms relied on by Finjan in opposition to summary judgment are now 

moot. See Dkt. 491-3 at 4; Dkt. 507-4 at 6; Dkt. 523-3 at 1.

1. Request to strike replacement language for

Cisco requests that the Court strike paragraphs 632, 656, 657, and 690 of the March 2020 

Report, in which Finjan substitutes the term “virtual environment agent” for the term 

 Dkt. 558-1. 

On the first question to be determined by this Court—whether Finjan’s amendments to the 

term represent theories that Finjan was previously denied permission to add to its 

infringement contentions— the Court concludes that the SVK and BLF Contention Orders did not 

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 8 of 16
9

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

directly prohibit Finjan from replacing the term with “virtual environment agent” 

in its expert reports because Finjan did not use either term in its proposed amended contentions 

regarding the’633 patent. See Dkt. 491-8; Dkt. 492-1 at ¶ 5 and Ex. 4 (see Dkt. 491-8). 

Nevertheless, Finjan must still demonstrate that the Operative Contentions disclosed the 

functionality of a “virtual environment agent” as that term is used (as a replacement for 

) in the March 2020 Report. Finjan asserts that the March 2020 Report “tracked Finjan’s 

infringement contentions nearly verbatim, where any discrepancies are de minimis.” Dkt. 507-4 at 

4. Finjan’s citation in support of this statement asks the Court to compare paragraphs 632, 656-57,

690, 4319, 4346, 4358, 4369, 4381, 4392, and 4403 of the March 2020 Report to the following: 

(1) paragraphs 4322, 4349, 4351, 4372, 4384, 4395, and 4406 of the July 2019 Report, and

(2) Appendix C1 to the Operative Infringement Contentions at 35. Id.

A careful analysis of this citation reveals the sleight-of-hand inherent in Finjan’s argument. 

To be sure, the term “virtual environment agent” appears in Finjan’s Operative Contentions. 

However, Finjan’s invitation to the Court to compare paragraphs numbered in the 4000s in the 

March 2020 and July 2019 Reports to the Operative Contentions is irrelevant to Cisco’s present 

motion to strike. Two redlines prepared by Finjan—one of which (Dkt. 507-8) shows changes 

from the July 2019 to December 2019 Reports, and the other of which (Dkt. 507-10) shows 

changes from the December 2019 to March 2020 Reports—reveal that the relevant language in the

cited 4000-series paragraphs has never changed; in other words, those paragraphs have contained 

references to “virtual environment agent” since the original July 2019 Report and need not be 

stricken. For example, paragraph 4319 of the March 2020 Report states:

Cisco Threat Grid meets the recited claim language because Cisco Threat Grid causes a 

virtual environment agent (e.g., mobile protection code) to be executed within the virtual 

environment running Windows operating system, Java Runtime Environment and/or 

Internet Explorer (mobile code executor) at a downloadable-information destination (e.g., 

Cisco cloud products such as Threat Grid and/or Talos). Additionally, the virtual 

environment agent will process one or more operations attempted by executable code in 

the form of exploits (e.g. drive-by downloads or heapspray attack) hidden within 

webpages. Cisco Threat Grid will determine whether the code is executable code. If the 

code is executable, Cisco Threat Grid packages information pertaining to the executable 

and information pertaining to tasks and relevant parameters and transmits it to Cisco cloud 

products (e.g., Threat Grid and/or Talos) for further analysis. The code and information 

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 9 of 16
10

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

pertaining to the task and parameters relevant to the downloadable-information destination 

is the mobile protection code. This information includes information using RESTful API’s 

(e.g., HTTP POST commands which run, execute, and/or process a file or URL in a 

sandbox), parameters to run the sample file or URL, a hash of the file, information 

contained in a file which includes information regarding the sample or URL (e.g., 

metadata of the sample, description of the sample, indicators of compromise, and/or 

warnings that the information-destination should be aware of). Furthermore, Cisco Threat 

Grid creates dynamic security content based on the analysis of web traffic that determines 

executable code.

Dkt. 507-32 (excerpts of March 2020 Report) at ¶ 4319 (emphasis added). Identical language 

appears in paragraph 4318 of the December 2019 Report, and in paragraph 4449 of the original 

July 2019 Report. Dkt. 507-8 (redline showing changes from July 2019 to December 2019 

Reports) at ¶ 4318 (redlined number). Finjan is correct that this language tracks the Operative 

Contentions nearly verbatim. See Dkt. 491-6 (Appx. C3 to Operative Contentions) at 37.

However, as pointed out by Cisco at the hearing and confirmed in Cisco’s post-hearing 

submission, the issue is Finjan’s new use of the term “virtual environment agent” as a replacement 

for the term in paragraphs 632, 656, 657, and 690 of the March 2020 Report. 

Dkt. 558-1. The discussion of functionality in those 600-series paragraphs remains from Dr. 

Medvidovic’s earlier reports. For example, a redline submitted by Finjan shows how the language 

in paragraph 656 of the March 2020 Report changed from the corresponding paragraph 655 in the 

December 2019 Report:

Dkt. 507-10 at ¶ 656; see also Dkt 491-7 (December 2019 Report) at ¶ 655. 

The question for this Court is: Do the Operative Contentions disclose the functionality 

described in this and the other 600-series paragraphs challenged by Cisco? Cisco argues that there 

is no allegation in the Operative Contentions that a “virtual environment agent,”

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 10 of 16
11

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

or anything else that is already at a sandbox (and never transmitted to it) is MPC. Dkt. 491-3 at 5-

7. Moreover, Cisco cites to numerous references in the Operative Contentions for Claim 14(d) of

the ’633 patent that relate to MPC that is transmitted to the sandbox. Dkt. 491-3 at 9-10; Dkt. 

523-3 at 4-5.

Finjan acknowledges that the Operative Contentions “describe infringement where the 

MPC is transmitted,” but argues that “did not state in its infringement contentions that MPC must 

be transmitted.” Dkt. 507-4 at 7 (emphasis in original). However, a standard that would permit a 

patentee to pursue any infringement theory not disclosed in, but not expressly excluded by, its 

infringement contentions would undermine the fundamental disclosure obligations of the patent 

local rules. Patent Local Rule 3-1 requires the patentee to provide as part of its infringement 

contentions “[a] chart identifying specifically where each limitation of each asserted claim is 

found within each Accused Instrumentality.” The contentions “must be sufficient to provide 

reasonable notice to the defendant why the plaintiff believes it has a reasonable chance of proving 

infringement.” Finjan, Inc. v. Symantec Corp., No. 14-CV-02998-HSG-JSC, 2018 WL 620169, at 

*2 (N.D. Cal. Jan. 30, 2018) (internal quotation marks and citations omitted). A “party may not

use an expert report to introduce new infringement theories, or new prior art references not 

disclosed in the parties’ infringement contentions or invalidity contentions.” Id. (internal 

quotation marks and citation omitted). “The dispositive inquiry in a motion to strike is thus 

whether the allegedly undisclosed ‘theory’ is in fact a new theory or new element of the accused 

product alleged to practice a particular claim that was not previously identified in the plaintiff’s 

contentions, or whether the ‘theory’ is instead the identification of additional evidentiary proof 

showing that the accused element did in fact practice the limitation.” Id. (citation omitted); see 

also BLF Order re Motion to Strike (Dkt. 397) at 4-5. Thus, Finjan must show that it disclosed in 

its Operative Contentions the theory that a “virtual environment agent” is MPC. It is not enough 

for Finjan to argue that the contentions did not expressly exclude such a theory.

Finjan has not met this disclosure standard. In the March 2020 Report, Finjan uses the 

term “virtual environment agent” (which appears in the Operative Contentions) as a replacement 

for the term (which does not). However, Finjan has presented no evidence that 

the “virtual environment agent” described in the Operative Contentions is in any way related to the 

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 11 of 16
12

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

functionality now described as a “virtual environment agent” in the March 2020 Report and 

previously described as a in the July 2019 and December 2019 Reports. 

Although Finjan asserts that this functionality “clearly map[s] to a virtual environment agent 

residing in a sandbox,” it fatally cites no evidence in the Operative Contentions or elsewhere in 

support of this assertion. Dkt. 507-4 at 6; see also id. at 7 (stating, without citation to evidence, 

that Dr. Medvidovic described another way of infringement for Claim 14 as “a stationary virtual 

environment agent within a virtual environment (e.g., a sandbox)”). 

The Court therefore STRIKES the replacement language in paragraphs 632, 656, 657, and 

690 of the March 2020 Report.

2. Request to strike replacement language for and 

Cisco requests that the Court strike numerous portions of the December 2019 and March 

2020 Reports, in which Finjan uses replacement language for the terms and 

 Dkt. 558-1. In the December 2019 Report, Finjan replaced with “scripts 

used to emulate certain user actions.” See, e.g., Dkt. 507-8 at ¶¶ 4330, 4331, 4333, 4478, 4479; 

see also Dkt. 558-1 and citations therein. In the March 2020 Report, some references to “script” 

remained (Dkt. 507-10 at ¶¶ 629, 630, 904), whereas in other places the language of the December 

2019 Report was changed to “parameters to run the sample file or URL” (see, e.g., id. at ¶¶ 4331, 

4333, 4334, 4479, 4490; see also Dkt. 558-1 and citations therein). In the December 2019 Report, 

Finjan changed to “present configurations for the sandbox in Talos.” See, e.g., 

Dkt. 507-8 at ¶¶ 463, 4489, 4316; see also Dkt. 558-1 and citations therein. In the March 2020 

Report, Finjan replaced with “parameters to run the sample file or URL.” See, e.g., 

Dkt. 507-10 at ¶¶ 463, 4317, 4490; see also Dkt. 558-1 and citations therein. 

The Court first examines Finjan’s April 2019 proposed amendments to its infringement 

contentions to determine whether the substitute terms used by Finjan in the December 2019 and 

March 2020 Reports represent theories that Finjan sought but failed to add to its infringement 

contentions as a result of the SVK and BLF Contention Orders. See BLF Order re Motion to 

Strike (Dkt. 397) at 3. Finjan’s rejected proposed amended contentions sought to add the term 

 which was defined as “a way to emulate certain user actions, which can be 

transmitted as mobile protection code” under certain circumstances. Dkt. 491-8 at 46 (internal 

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 12 of 16
13

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

quotation marks and citation omitted). Finjan also sought to amend its contentions to add a 

reference to with an explanation that “Talos includes that 

define the parameters that a malware sample or URL are run under.” Id.at 47 (internal quotation 

marks and citation omitted). The terms and their explanatory definitions 

do not appear in Finjan’s Operative Contentions. See Dkt. 491-5 at 35-39. This analysis supports 

a conclusion that Finjan previously sought but was denied permission to add and 

 to its infringement contentions, which supports Cisco’s argument that Finjan’s 

replacement language for those terms should be stricken.

As an additional ground for striking Finjan’s replacement language for and 

 in the December 2019 and March 2020 Reports, the Court notes that although similar 

language appears in Operative Contentions (see, e.g., Dkt. 491-5 at 35 (references to “parameters 

to run the sample file or URL”)), as with the replacement language for discussed 

above, Finjan has failed to show how that language in the Operative Contentions is linked to the 

functionality now associated with that language in Dr. Medvidovic’s amended reports.

Cisco also points out that Finjan uses the language “parameters to run the sample file or 

URL” as a substitute to describe multiple items, including not only the and 

 items that survived summary judgment but also three of the items on which summary 

judgment was granted: ” and Dkt. at 523-3 at 

4. In other words, the phrase “parameters to run the sample file or URL” does not uniquely

describe or This is further evidence that the “parameters” phrase is 

somewhat generic and does not disclose the functionality Finjan now seeks to link to that term.

Again, Finjan has failed to identify any portion of the Operative Contentions that link the 

functionality associated with the terms or in the earlier reports of 

Dr. Medvidovic to the replacement terms “scripts,” “scripts used to emulate certain user actions,” 

or “parameters to run the sample file or URL.” The Court therefore STRIKES the replacement 

language for in the following paragraphs:

• December 2019 Report: ¶¶ 452, 453, 460, 461, 462, 463, 464, 465, 467, 902, 903,

1362, 1505, 1506, 1507, 1509, 1510, 1511, 1512, 1513, 2358, 2503, 2504, 2505,

2506, 2507, 2508, 2509, 2510, 3398, 3543, 3544, 3545, 3546, 3547, 3548, 3549,

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 13 of 16
14

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

3550, 4316, 4487, 4488, 4489, 4490, 4491, 4492, 4493, 4494, Section heading 

X.A.3.

• March 2020 Report: ¶¶ 452, 453, 460, 461, 462, 463, 464, 465, 468, 903, 904,

1363, 1507, 1508, 1509, 1510, 1511, 1512, 1513, 1514, 2359, 2504, 2505, 2506,

2507, 2508, 2509, 2510, 2511, 3399, 3544, 3551, 4317, 4489, 4490, 4491, 4492,

4493, 4494, 4495, 4496, Section heading X.A.3.

The Court also STRIKES the replacement language for in the following 

paragraphs:

• December 2019 Report: ¶¶ 629, 630, 903, 1362, 1497, 1498, 1499, 1500, 1501,

1502, 1503, 1504, 1576, 1594, 1595, 1596, 1598, 1599, 1600, 1601, 1602, 1613,

2358, 2493, 2494, 2495, 2573, 2496, 2497, 2498, 2499, 2500, 2501, 2602, 2619,

2620, 2622, 2623, 2624, 2625, 2627, 2638, 3398, 3533, 3534, 3535, 3536, 3537,

3538, 3539, 3540, 3541, 3635, 3648, 3649, 3650, 3651, 3652, 3653, 3654, 3655,

3656, 3671, 4316, 4328, 4329, 4330, 4331, 4332, 4333, 4334, 4335, 4336, 4338,

4478, 4479, 4480, 4481, 4482, 4483, 4484, 4485, 4486, 4496.

• March 2020 Report: ¶¶ 1363, 1498, 1499, 1500, 1501, 1502, 1503, 1504, 1505,

1506, 1507, 1508, 1509, 1510, 1511, 1512, 1513, 1514, 1595, 1596, 1597, 1599,

1600, 1601, 1602, 1603, 2494, 2495, 2496, 2497, 2498, 2499, 2500, 2501, 2502,

2504, 2505, 2506, 2507, 2508, 2509, 2510, 2511, 2620, 2621, 2622, 2623,2624,

2625, 2626, 2627, 2628, 3399, 3534, 3535, 3536, 3537, 3538, 3539, 3540, 3541,

3542, 3544, 3545, 3546, 3547, 3548, 3549, 3550, 3551, 3649, 3650, 3651, 3652,

3653, 3654, 3655, 3656, 3657, 4328, 4330, 4331, 4332, 4333, 4334, 4335, 4336,

4337, 4479, 4480, 4481, 4482, 4483, 4484, 4485, 4486, 4487, 4489, 4490, 4491,

4492, 4493, 4494, 4495, 4496.

IV. CONCLUSION

For the reasons discussed above, the Court ORDERS as follows:

1. Cisco’s motion to strike is procedurally proper.

2. Cisco’s complaint at the hearing about whether Dr. Medvidovic’s

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 14 of 16
15

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

December 2019 and March 2020 Reports are the operative reports and/or 

whether those reports should be allowed is untimely, was not directly 

addressed in the papers, and is denied, and the Court therefore analyzes the 

present motion to strike in the context of the December 2019 and 

March 2020 Reports. 

3. Finjan has failed to identify any language in the Operative Contentions that

links the functionality associated with the term in the

earlier reports of Dr. Medvidovic with the now-substituted term “virtual

environment agent, and the Court therefore STRIKES the replacement

language in paragraphs 632, 656, 657, and 690 of the March 2020 Report.

4. Finjan’s previous attempt to amend its infringement contentions to add

contentions regarding and was denied, and Finjan 

has failed to identify any language in the Operative Contentions that 

supports the functionality attributed to the replacement language for 

 and The Court therefore STRIKES the 

replacement language for in the following paragraphs:

o December 2019 Report: ¶¶ 452, 453, 460, 461, 462, 463, 464, 465, 467,

902, 903, 1362, 1505, 1506, 1507, 1509, 1510, 1511, 1512, 1513, 2358,

2503, 2504, 2505, 2506, 2507, 2508, 2509, 2510, 3398, 3543, 3544, 3545,

3546, 3547, 3548, 3549, 3550, 4316, 4487, 4488, 4489, 4490, 4491, 4492,

4493, 4494, Section heading X.A.3.

o March 2020 Report: ¶¶ 452, 453, 460, 461, 462, 463, 464, 465, 468, 903,

904, 1363, 1507, 1508, 1509, 1510, 1511, 1512, 1513, 1514, 2359, 2504,

2505, 2506, 2507, 2508, 2509, 2510, 2511, 3399, 3544, 3551, 4317, 4489,

4490, 4491, 4492, 4493, 4494, 4495, 4496, Section heading X.A.3.

5. For the same reasons, the Court also STRIKES the replacement language

for in the following paragraphs:

o December 2019 Report: ¶¶ 629, 630, 903, 1362, 1497, 1498, 1499, 1500,

1501, 1502, 1503, 1504, 1576, 1594, 1595, 1596, 1598, 1599, 1600, 1601,

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 15 of 16
16

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

United States District Court

Northern District of California

1602, 1613, 2358, 2493, 2494, 2495, 2573, 2496, 2497, 2498, 2499, 2500, 

2501, 2602, 2619, 2620, 2622, 2623, 2624, 2625, 2627, 2638, 3398, 3533, 

3534, 3535, 3536, 3537, 3538, 3539, 3540, 3541, 3635, 3648, 3649, 3650, 

3651, 3652, 3653, 3654, 3655, 3656, 3671, 4316, 4328, 4329, 4330, 4331, 

4332, 4333, 4334, 4335, 4336, 4338, 4478, 4479, 4480, 4481, 4482, 4483, 

4484, 4485, 4486, 4496.

o March 2020 Report: ¶¶ 1363, 1498, 1499, 1500, 1501, 1502, 1503, 1504,

1505, 1506, 1507, 1508, 1509, 1510, 1511, 1512, 1513, 1514, 1595, 1596,

1597, 1599, 1600, 1601, 1602, 1603, 2494, 2495, 2496, 2497, 2498, 2499,

2500, 2501, 2502, 2504, 2505, 2506, 2507, 2508, 2509, 2510, 2511, 2620,

2621, 2622, 2623,2624, 2625, 2626, 2627, 2628, 3399, 3534, 3535, 3536,

3537, 3538, 3539, 3540, 3541, 3542, 3544, 3545, 3546, 3547, 3548, 3549,

3550, 3551, 3649, 3650, 3651, 3652, 3653, 3654, 3655, 3656, 3657, 4328,

4330, 4331, 4332, 4333, 4334, 4335, 4336, 4337, 4479, 4480, 4481, 4482,

4483, 4484, 4485, 4486, 4487, 4489, 4490, 4491, 4492, 4493, 4494, 4495,

4496.

By this ruling on Cisco’s motion to strike, the Court does not make or imply any ruling as 

to the proper scope of Dr. Medvidovic’s testimony at trial or as to the viability or merits of 

Finjan’s claim that Cisco infringes the ’633 patent. Those issues are left to Judge Freeman to 

determine.

SO ORDERED.

Dated: April 28, 2020

SUSAN VAN KEULEN

United States Magistrate Judge

Case 5:17-cv-00072-BLF Document 616 Filed 05/11/20 Page 16 of 16