Finjan, LLC v. Qualys Inc.

Background

Finjan, Inc. brought a patent-infringement case against Qualys Inc., alleging direct and indirect infringement of several patents, including U.S. Patent No. 8,225,408. That patent concerns scanning program code for security vulnerabilities using programming-language-specific scanners, token analysis, parse trees, and exploit detection.

Qualys moved to strike portions of Finjan’s infringement and damages expert reports. Qualys argued that Finjan’s expert, Dr. Nenad Medvidovic, introduced six theories that were not disclosed in Finjan’s infringement contentions: theories involving the Cloud Agent; dynamically building a parse tree and detecting exploits; receiving content; the date of first infringement; the doctrine of equivalents; and foreign sales. The court applied the Patent Local Rules, which require parties to disclose their infringement theories early and generally prohibit using expert reports to introduce new theories. The court distinguished a new theory from additional evidence supporting a theory that was already disclosed.

Rulings on the challenged theories

The court denied the motion to strike the Cloud Agent theories. Although Finjan’s contentions did not specifically identify the Cloud Agent for each limitation, the court found that Finjan had sufficiently disclosed its overall theory and that the expert report applied the disclosed theory rather than introducing a new one.

The court allowed the expert’s additional evidence concerning XML parse trees and dynamic exploit detection, finding that it supported the theory that the trees were built during scans. But it struck the theories based on Qualys’s Unified Dashboard and Mandate Based Reporting, which the court found appeared to be new theories or components not disclosed in the contentions.

The court denied the motion to strike the opinions concerning Vulnerability Features and the receiving limitation. It stated that it could not determine that those opinions presented a new theory or that the features did not involve a client device requesting content. The denial was without prejudice to renewal if Qualys could show that vulnerability scanning was not based on such content requests.

The court struck the opinion that infringement occurred “no earlier than 2005,” because Finjan’s contentions had identified November 29, 2018 as the theoretical date of first infringement. The court struck paragraphs 21 and 22 of Dr. Medvidovic’s report but did not strike opinions concerning the current functionality of Qualys products that were unrelated to infringement dates.

The court denied the request to strike Finjan’s doctrine-of-equivalents theory. The court found that Finjan’s contentions had disclosed the same theory: that software components performed the same function, in the same way, with the same result as a programming-language-specific physical scanner.

The court struck the experts’ opinions concerning foreign sales. It relied on earlier rulings that Finjan’s disclosed infringement theories did not make products sold abroad relevant to its claims. The court also rejected the argument that foreign customers’ benefits from U.S.-based development, research, or security information made foreign sales relevant to damages. The struck material included specified portions of the Medvidovic and Cole reports and specified portions, tables, and attachments of the McDuff damages report concerning global sales.

Disposition

The court granted in part and denied in part Qualys’s motion to strike. It struck Dr. Medvidovic’s date-of-first-infringement paragraphs, the Unified Dashboard and Mandate Based Reporting theories, and the identified foreign-sales and global-sales opinions. The remainder of Qualys’s motion to strike was denied. The opinion also states that the parties’ administrative motions to seal were granted to the extent indicated in the supporting declarations. Judge Yvonne Gonzalez Rogers signed the order on April 5, 2021.