Oral argument — TeleSign Corporation v. Twilio, Inc.

The first one is number 19-1312, Telesign Corporation v. Twilio, Inc., Mr. Canaccia. Thank you, Your Honors. May it please the Court. I'm going to focus my arguments today on the 034 patent, which addresses a problem unique to the Internet and improves the security of a computing system. Your Honors, only by the Internet can a single individual, one person, masquerade or hold him or herself out as thousands of individuals or thousands of unique people to millions of people, and this occurs by way of fake website registrations. What happens is one person, one individual, can register for thousands, tens of thousands of fake web accounts at, say, an Amazon or a social networking site. They can then publish what appears to be thousands or hundreds of favorable reviews of low-quality products to exert influence, to cause people to purchase those products. They can publish news articles that are inaccurate news articles, and then in doing so, the people that are viewing this think that what they're seeing are thousands of individuals, but they're not. They're just one person. That is only possible by way of the Internet. So the question became, 15 years ago, how could this be prevented? Obviously, websites, they want legitimate registrants to register for their website. The likes of an Amazon or a New York Times or someone, they want registrants to register for their website. So how in real time, in a split second, how can one make a decision about whether a registration is legitimate or not legitimate? That was the focus of the problem that the founders of TeleSign faced in the 2005-2006 timeframe, and they came up with an idea. That idea was to use a phone number in an unconventional manner, to use a phone number in a way that hadn't been used before. Obviously, people would use phone numbers to make telephone calls. Well, TeleSign came up with the idea. They realized not all phone numbers are created equal. What they realized is that they could use a phone number itself, or more particularly, three attributes associated, three characteristics associated with a phone number, as a trust metric. They realized that because not all telephones are created equal, some telephone numbers are associated with certain geographic areas that might be associated with higher instances of fraud. Some phone numbers are of certain types that lend themselves to fraud. For example, one type of phone number is a landline. Residential addresses typically used to be associated with landlines, so they called them landlines. That's one type of phone. Another type of phone that the founders of TeleSign came up with or realized existed was VOIP. VOIP is an acronym. It stands for What if I have a service where people all around the country get robocalls, they get calls from fraudsters trying to swindle them, and I have a service where I have this massive database I've collected of phone numbers. I've been able, through a lot of legwork, been able to investigate and figure out a whole long list of phone numbers that are associated with fraudsters or robocallers and things like that. And then people can access my website with my database for a fee. Would that be a patent eligible invention? I think, clearly, patent eligibility turns on the claims of a patent. Electronically determining whether a particular phone number is associated with a bad actor. I would need to know the claims of the actual invention at issue. I think if the claims were directed only to that electronically determining that you proposed, that in and of itself, I don't know. It's difficult for me to comment as to whether that would be an abstract idea as much as what would be done with that. What would be a next step? Would there be a step like the last step in our claim that would allow or disallow registering based on determining those characteristics? Here's another one. Another hypothetical. What if I have a website and I only want certain people to access my website? People that I deem to be trustworthy. So you want to access my website and you give me your name, maybe you give me some other personal information. Let's say your social security number. And then through a lookup table, through a massive database I have access to, I have everybody's name and social security number and I can see their associated credit history, criminal record, any litigation they've been involved in, anything like that. And then through that I'm able to electronically determine whether I deem this would-be customer trustworthy to access my website. Would that be patent eligible? I think what I'd want to know more about there, Your Honor, is to what extent was there a technological analysis to determine whether whatever factors you might consider would be factors that would be indicative of fraud? Bad credit history. There's a lien on your house. You have a criminal record. You've been arrested for fraud. And so through those very illuminating indicia, I've concluded that no, you may not access my website. So your proposal is that someone was able to create an extraordinarily massive database with potentially billions of entries that would house an extraordinary amount of information and then in real time query that database upon which to make a registry or some sort of fraudulent decision. Yes, I would think that's patent eligible. Sure, of course. Why is that patent eligible? Well, you're improving the security of a computing system. You found a way to make people safer. You found a way to increase, like I said, the security of a computing system and prevent fraud. What if instead of a massive database, it's just a massive book? I think at that point we've moved into a situation where it's not feasible that someone would be able to review a book in the time necessary to make a registration decision. I don't think that would be the type of activity that would... I think your hypothetical has moved into an area that... Well, my prior hypothetical about a massive electronic database, the claim doesn't say anything about the technical act of how you're able to quickly access a given name of a person in that massive database. It just says electronically determined by looking through that massive database, period. The step two of our claim does say that, and it's all to facilitate the last step of our claim. My point is, it claimed at that level of generality, there's no technical activity actually going on there. There's no specificity of what technical act is actually taking place other than the broad notion of, there's a database over here, go look it up. Correct, but that is obviously, as with the proceedings before the PTAB and as with what we explained to the Northern District and even the Central District of California, the money shop, for lack of a better term, is in the registering. Sure, we store stuff in an electronic database, but what we did was we came up with the idea... But it doesn't affect computer functionality, right? It's just a question of what information you put in the database. The claimed invention is putting a supposedly unique kind of information in the database, right? That is incorrect. It does increase the computer functionality. It increases... What does it do other than define what the database consists of? It increases the efficacy of preventing fraudulent registrations. To register based on those characteristics... But it's not an efficacy that's related to computer functionality, it's related to the content of the database. To register based on those attributes increases the security of a system. If it would help, here's what I'll do. I can try to quickly compare and contrast a system that uses this and doesn't. In 2005, people were aware and they were trying to use two-factor authentication. This notion when you try to log into a bank or a bank's website, they want to send you a code... Let's just assume that this doesn't improve the functionality of the computer. Let's assume that the invention is using particular kinds of data to create a database. Is that patent eligible? Sure. Even if it doesn't technically increase the functionality of a computer in the InFISH way, InFISH also says that if a process increases or improves a technological process, then it's patent eligible. That's what this system does. This system works. This system is being used to prevent fraudulent registrations. Facebook last year reportedly attempted to remove 5.4 billion fraudulent registrations. This is a massive problem that even Twilio acknowledges exists. You're honored. When a company registers based on these attributes, they're able to effectively reduce and prevent fraud in a way that has never been done before. If one system just used two-factor authentication, because of VoIP, because of VoIP... You seem to be saying that because it's useful, it's not abstract. I do think that is an element of lack of abstraction. That's the hallmark of 101, any new and useful invention or improvement thereof. This is a very useful invention. Also, we'd say it's not abstract. In the Alice case, that invention was pretty useful, and that went down under 101. Our invention is unique to the Internet. We are not saying there was some historical brick and mortar process that historically has been done, and now you just do it on the Internet. We're not saying that. What we're saying is, hey, the different types and characteristics of a phone number, namely, if it's VoIP, that's one of the biggest ones. Voice-over Internet Protocol allows this. It allows something that hasn't been allowed in the past. It allows someone to obtain phone numbers en masse. Voice-over Internet Protocol allows telephone numbers to be gotten, to be had, en masse. A fraudster can obtain 1,000 or 10,000 phone numbers very cheaply. Now, that fraudster can go to Amazon. They can put in 1,000 fake names. They can put in their 1,000 phone numbers. Amazon can send two-factor authentication codes to all 1,000 of them. The fraudster has access to those because of VoIP. He or she has bought those phone numbers, feeds back, correctly parrots back those codes, and Amazon now has 1,000 fake web accounts and all the problems that are associated with those. Contrast that with Amazon or the likes of Amazon that would implement our invention. Departing from that known approach or that available approach, the fraudster would put in the 1,000 names and addresses, the 1,000 phone numbers, and then Amazon's system would do something that it hadn't done before. It would electronically determine the phone number characteristics and then make a registration decision based on those characteristics. It would realize, for example, that those are VoIP numbers, and if it had a rule that said VoIP numbers aren't allowed, those would be kept out of. Those would be not stored in Amazon's system. That's the claim to fame of this invention. That's where the advancement comes. Your Honor, just to confirm, by way of our blue brief on page 3, yes? You're running into your rebuttal time. Do you want to save it? Yes. Is this my rebuttal? Yes. Yes, I'll save my rebuttal. Okay. Thank you, Mr. Camacho. Mr. Stacey? Good morning, Your Honors. May it please the Court? So I wanted to start, unless you had an immediate question. I apologize for my voice, getting over a cold. But I wanted to talk about the claims themselves. We heard a lot about the industry, a lot about the history in the past, but that's not what the claim of the 034 that matters, Claim 1, actually recites. And if you look at the claim language, one issue that's kept coming up is this is not a fraud-restricted claim. This is a claim that the judge identified as verifying identity. That's the limit. Nowhere does it say anything about fraud. And in fact, the specification talks about multiple reasons. Targeted advertising. I like the Nebraska Exclusion Clause on Column 8. We don't want to service warranties out of Nebraska, so we're going to exclude Nebraska. And then fraud is the preferred embodiment. But when you really get down to it, the claim is not fraud-limited. So this is the real problem with 034, Claim 1, is its breadth. And that was one of the issues that was coming up here. What are the restrictions on that claim? And if you look, it's not limited to fraud. And then look at the next step on how the information is determined. So we go to the prosecution. It was originally just determined. And then in response to a 101 rejection, they put in electronically determined. That means nothing. It means looking it up in a database. And in fact, the patent itself discloses what electronically determining means. And in Column 8, it talks about using the 10-digit phone number. All of this special information that Mr. Camacho talked about is already in that phone number. It has been for all of history. You can look at the phone number and understand geography. Area code tells me where I'm from. 806 tells me I'm from Amarillo, Texas, or at least the panhandle. You can look at the next digits and you know whether it's southwestern. And even they have been portable for a decade or more. I call people all the time who have Texas cell phones at least. Maybe this is only on the mobile side. I don't actually think it is only on the mobile side, is it? Well, even on the mobile side, there are signs to specific carriers. Right, but you have no idea where they live. They grew up in Texas and they haven't been in Texas for 20 years. Correct, except my accent maybe kicks it out. But what you can see is from the database, you know what carrier owns the phone numbers. And that's admitted in the patent. That's what enables portability. You know what carrier owns what number. In the old days, the next three digits, 806 and 396, would tell you it was Southwestern Bell. And now there are two. There's a 753 that tells you it's the local co-op. But the patent itself admits that. But when you look, there's nothing in the claim that we're talking about, about VoIP, about this modern time, about changing from landlines to cell phones. It's just generic. So there's nothing about determining. And then you look at the next piece about the analysis step. Did registering get a claim construction here? No, it did not. And first of all, no claim construction was requested at the district court. Is there a dispute here? I don't remember here about what registering might mean. So a small issue in the briefing, and I think it's two ships passing in the night. At the district court, the judge separated and talked about registering and then based on, two separate things. And then in the briefing, I believe, Telesign talked about registering based on, with a dot dot dot in there. Registering is the act of storing. And you can see that in their complaint. I believe it's paragraph 140 of their complaint. Where they actually put in the EG, when they're accusing us of infringement, they explain, under the pleading standard, what registering means. It means just storing. So there's nothing special about registering. And then based on... I mean, the limitation says registering the user. So what does that... it doesn't mean storing the user. And you can find that in the appendix. I believe it's paragraph 140 of the complaint. It gives you that exact site. So it just means you're... I mean, according to the storing user-specific information, appendix 73, paragraph 140. And that's straight out of the complaint, perfectly usable here. And it shows that registering has been used in its broadest sense. It's just storing information about the user. And then the next piece, based on, there's no definition of what based on means. All it means is that we have to use those three pieces of information and the verification code. The verification code, this court's already said, was abstract in the Asgari case. And TeleCite admits in its brief that people were using verification codes. It was routine before 2005. This may or may not be relevant to the claims in this case. But do you think the first person who came up with two-factor authentication had a patent-eligible invention? No. The idea of two-factor authentication, minus the technology, is nothing except an abstract idea. I'm going to verify you based on one thing and then another thing. That's all two-factor authentication. But now we're bringing in telephones, and now you're, I guess, texting some... After someone's accessed or attempted to access a website and used a password of some sort, now the website is communicating to that user, or hopefully communicating to that user through text, some verification code that then the user enters into the website. That's how two-factor authentication works? That would be an SMS implementation of two-factor authentication, yes. And I think this court had the opportunity to look at that in the Asgari case and said that was abstract. And I think that patent dated back to 1998. Was Asgari two-factor authentication? Yes, it was related to verification codes. So I don't think it uses the word two-factor authentication, but it is related to the concept of two-factor authentication. What is that one-factor authentication? It's the authentication code piece of it. So my apologies, it would be one-factor authentication. It matches this claim in the 034, which is similar to one-factor authentication. Was Asgari a Rule 36? Yes. Yes, it was. And that patent had a priority date of 2001 compared to the 2005 priority date here. So when you're looking at the breadth of these claims, that separates it from all of the story about what was going on in the art and the world. Basically what they're trying to do is preempt the use of those three pieces of information along with an SMS code. Those three pieces of information are embedded in the phone number. So if you're using the phone number and looking up information in publicly available databases, then that's going to be preempted because there are no other restrictions on Claim 1. The other issue that came up in the questions was whether the computer functionality was changed. And if you look at these claims, it does not do anything with computer functionality other than use the computers in the way they are intended to be used. Compare this to Ancora, for example. And you can see where in Ancora you were modifying the BIOS and where you were putting information. And it was important on using these parts of the computer and interacting. And if you look at DDR, for example, DDR was basically spoofing the computer to make it operate in a specific way that it didn't want to operate. I think that's the language DDR uses, and that follows in Fair Warning and Bridge and Post about making the computer operate in an abnormal way. Nothing about these claims makes the computer operate in an abnormal way. What it's doing is just using the computer to do things. And I think that was illustrated wonderfully with the example about, what if my database is really big? Well, the answer was that would keep it from being an abstract idea because you'd have to have a computer. But that's not what the case law has held here. This court said that speed provided by a computer is not sufficient to get past abstract idea. And that's what we're really looking at here. This idea of real time doesn't get past abstract idea. And what they're wanting to do is say, well, because there are a lot of phone numbers to look up, and we have to go in this database and look at all of this information, that keeps it from being an abstract idea. Well, you could do that from a phone book. And in fact, these claims are so broad, they let you do it from a phone book or from a small database. It could be just Amarillo, Texas, and that doesn't take long to get through. So this case looks a lot like several others that the court's already seen. You notice the district court criticized Tell-A-Sign for avoiding claim-to-claim comparison. It's been kind of an ongoing fight in this case, is to match the 034 claim, the actual language, which you didn't hear much about in the opening, to the other cases. And if you look, content extraction is a wonderful case that fits very closely to these claims. In content extraction, there was collection of data. There was recognizing certain data within that collected data. So I pick up my phone number. I recognize my information that's in that phone number, the geography, the carrier, the phone type, which is all described in the patent as prior knowledge. And then I store something based on what I'm recognizing. That was content extraction. And this court found that to be an abstract idea. Another one that I think is very close is Bridge and Post. When you look at Bridge and Post, it had that same kind of idea about using identifiers. And information within identifiers. Again, it was abstract. This court's had that chance to look at this data that is not different. It's just typical data. The one that I think comes up in the briefing that... When you say typical data, does your argument go so far as to say, for example, that a registration system that demands the submission of a fingerprint or other biometric information, presumably one per account, that that would be ineligible? It would depend on the claim. If the claim was broad to just using biometric information to confirm identity, then yes. But if it was something specific about how you were doing that, say the fingerprint, using a fingerprint to confirm identity, that would be the definition of abstract at that level if you're going that broad. If you're looking at something specific in there about the techniques, about looking at the ridges and mapping one ridge to the next, if you study your fingerprint analysis, it's an art form. Not a science. Is that because fingerprint identification was well-known? The concept of fingerprint identification is well-known. But this court has a case that talks about if you're taking something that used to be subjective and moving it to something that's scientific, mathematical, and I think that's what fingerprint analysis was. The examiners were subjective before because you were comparing smudges to smudges. When the first fingerprint systems came out, they actually looked at ridges and did a mathematical algorithm. So if you were doing the algorithm and using the computer system, you'd have something very different. But if it's just the broad idea of using a computer to analyze biometric data, it would be abstract. I think that takes us to SRI, which is the case they lean on a lot. SRI is very distinguishable from this current case. They like SRI because it uses this broad based-on type of language and a list of events, kind of like they use looking at a phone number or looking at geography. But SRI, which is the only eligible case that they really rely on heavily, doesn't map up nicely. There are a couple of reasons, and this court pointed out, one, that SRI actually is limited to detecting suspicious data. It's in the claim. The court specifically found that the human mind isn't geared or capable of looking at the type of data that they were detecting and determining whether or not it was suspicious because the type of data here was something very specific to the nature of the fraud, things like network packet data transfer commands, network packet data transfer errors. And then the SRI court went on and said, by the way, you're doing more than just storing that information. You're actually integrating those reports, and that was a specific comment about integrating the reports into a hierarchical monitor. Suppose you had a claim that said to identify a fraudulent phone call, we've discovered that if there's a two-second delay in the person answering the phone, picking it up to talk to you, plus another beep that occurs or something like that, there are several different identifiers which weren't known before. Would that be patent eligible as a method of detecting a fraudulent phone call? If written in a specific way, that gets a lot closer because you're dealing with the technology. I'm listening, and that idea actually shows up in their patent. They talk about looking for signal quality and going down that level of true computer detail, but that's not what shows up in the 034 claim. It's much broader than that. If we had that level of specificity, we'd be having a different discussion. I thought, it's been a while since I read SRI, doesn't SRI cover the use of the information, the content, the payload of the packet, and not just characteristics of the packet and its transmission history? I thought it did. I'm looking at the claim here. It's talking about deploying a plurality of network monitors in an enterprise network, and then it detects, with those network monitors, suspicious network activity, and then based on an analysis of network traffic data, select it from the following categories. Then it gives that very specific list of information. I haven't looked at it recently, so maybe you don't know, but I thought that those categories did not exclude, which meant the claim covered the use of the payload of packets and not any of the, essentially, technological transmission information. I'm just looking at the claim here. At that level, I just can't answer your question. That would begin to perhaps seem rather like selecting information that you have decided from your knowledge of the world is a pretty good indicator of undesirable communicants. Possible, but the way SRI was written, it talks about that this type of activity is not something that the human mind would ever detect or understand looking at this network data. It is an unusual type of data that we're not used to dealing with. Compare that to what's going on with the 034 patent, where they admit that the phone number itself contains all of the information that we're looking at. Geography, phone type, carrier. You just need to get it out of there. Either you can do it through looking it up in a book, or you can look it up in a big database, and that would make it fast. Just because it's fast, you're dealing with lots of data. Okay, thank you, Mr. Staston. Your Honor, counsel is incorrect that all the information is just in the phone number. There's a lot that goes into actually determining those attributes. That's in the patent at column one. We call out the notion that someone with a 310 area code might not really be in L.A. precisely because of VOID. But counsel Petualio led off with a key point. He argued that this patent might not be related to fraud. And therein lies the problem. It's that the lower court, the Northern District, never did a directed-to analysis. And, Your Honors, four groups of people have looked at this patent. TeleSign, Twilio, the Central District of California, and the PTAB. Twilio argued all four of these. All four agree that this patent is related to reducing fraud. Twilio, in its own words, in its red brief, page 24, said, This patent is directed to reducing fraudulent account creation. This isn't just storing information. This has to do with not storing information at all, keeping bad stuff off the books. Reducing fraudulent account creation by using characteristics of the user's telephone number. Your Honors, that is not abstract. The PTAB said something similar. We put it on our blue brief on page three. The Central District said the same thing. That's what our blue brief on page 24. And, obviously, we said something similar. Okay. Thank you. Thank you. Thank you.