Petition for Writ of Certiorari — Cisco Systems, Inc., Petitioner v. SRI International, Inc.

APPENDIX

1a

APPENDIX A

UNITED STATES COURT OF APPEALS

FOR THE FEDERAL CIRCUIT

2020-1685, 2020-1704

SRI INTERNATIONAL, INC.,

Plaintiff-Appellant,

v.

CISCO SYSTEMS, INC.,

Defendant-Cross-Appellant.

Appeals from the United States District Court for the

District of Delaware in No. 1:13-cv-01534-RGA-SRF,

Judge Richard G. Andrews.

Decided: September 28, 2021

*

*

*

Before LOURIE, O’MALLEY, and STOLL, Circuit

Judges. STOLL, Circuit Judge.

SRI International, Inc. appeals the United States

District Court for the District of Delaware’s denial of

its motion to reinstate the jury’s willfulness verdict and

to reinstate the district court’s award of enhanced

damages. Cisco Systems, Inc. cross-appeals the district

court’s award of attorney fees and expenses. Because

substantial evidence supports the jury’s finding of willful infringement, we reverse the district court’s denial

of SRI’s motion to reinstate the willfulness verdict.

Having restored the jury’s willfulness finding, we also

2a

restore the district court’s award of enhanced damages.

Finally, we affirm the district court’s award of attorney

fees.

BACKGROUND

This is the second appeal in this case. SRI filed suit

in the District of Delaware alleging that Cisco infringed

certain claims of U.S. Patent Nos. 6,711,615 and

6,484,203 (the “asserted patents”). The ’615 patent is

titled “Network Surveillance” and is a continuation of

the ’203 patent, which is titled “Hierarchical Event

Monitoring and Analysis.” A jury trial was held on validity, infringement, willful infringement, and damages.

See SRI Int’l, Inc. v. Cisco Sys., Inc. (SRI I), 254

F. Supp. 3d 680 (D. Del. 2017). The jury found that the

accused Cisco products infringed certain claims of the

asserted patents and awarded a 3.5% reasonable royalty for a total of $23,660,000 in compensatory damages.

The jury also found that Cisco’s infringement was willful.

After trial, Cisco moved for judgment as a matter

of law (JMOL) of no willful infringement and SRI

moved for attorney fees and enhanced damages. Regarding the jury’s willfulness finding, the district court

determined that substantial evidence—including that

certain Cisco employees did not read the asserted patents until their depositions, that Cisco designed the

products in an infringing manner, and that Cisco instructed its customers to use those products in an infringing manner—supported the jury’s willfulness finding. Id. at 716-17.

The district court also awarded SRI attorney fees

and costs. Id. at 723. The district court noted that

“Cisco pursued litigation about as aggressively as the

court has seen in its judicial experience” and that this

3a

litigation strategy “created a substantial amount of

work for both SRI and the court, much of which work

was needlessly repetitive or irrelevant or frivolous.”

Id. at 722-23 (footnotes omitted). In awarding fees, the

district court also took into account “the fact that the

jury found that Cisco’s infringement was willful.” Id. at

723.

With respect to enhancement of damages based on

the jury’s willfulness finding, the district court doubled

the damages award. Id. at 723-24. The district court

explained that enhancement was appropriate “given

Cisco’s litigation conduct, its status as the world’s largest networking company, its apparent disdain for SRI

and its business model, and the fact that Cisco lost on

all issues during summary judgment and trial, despite

its formidable efforts to the contrary.” Id. at 723.

Cisco appealed the district court’s denial of JMOL

of no willful infringement and its grant of enhanced

damages and attorney fees. We vacated and remanded

on each of those issues. See SRI Int’l, Inc. v. Cisco Sys,

Inc. (SRI II), 930 F.3d 1295, 1312 (Fed. Cir. 2019).

First, we held that the jury’s verdict of willful infringement before May 8, 2012 was not supported by

substantial evidence because it was undisputed that

Cisco did not know of SRI’s patents until after that

date. Id. at 1309-10. We stated that for the time period

prior to May 8, 2012, “the record is insufficient to establish that Cisco’s conduct rose to the level of wanton,

malicious, and bad-faith behavior required for willful

infringement.” Id. at 1309. We also criticized the evidence the district court identified as supporting the jury’s willfulness verdict. For example, we explained

that “it was unremarkable” that two Cisco employees

identified in the appellate record merely as engineers

did not review the patents until their depositions. Id.

4a

We vacated the district court’s denial of JMOL of no

willful infringement and remanded the case to the district court to decide in the first instance whether the

jury’s finding of willful infringement after May 8, 2012

(the date Cisco received notice) was supported by substantial evidence. Id. We likewise vacated the district

court’s enhanced damages award because it was predicated on the finding of willful infringement. In addition, we vacated the award of attorney fees because it

was partly based on the finding of willful infringement.

On remand, the district court reasonably read our

opinion to require a more stringent standard for willful

infringement than our other cases suggest—conduct

rising to “the level of wanton, malicious, and bad-faith

behavior.” SRI Int’l, Inc. v. Cisco Sys., Inc. (SRI III),

Civil Action No. 13-1534-RGA, 2020 WL 1285915, at

*1 (D. Del. Mar. 18, 2020). Based on this standard, the

district court in SRI III held that substantial evidence

did not support the jury verdict of willful infringement

after May 8, 2012.

The district court in SRI III also reviewed the jury

instructions on willful infringement, which neither party ever challenged on appeal. The instructions directed

the jury to consider whether Cisco “acted despite a

high likelihood that [its] actions infringed a valid and

enforceable patent.” Id. at *2. The jury was further

instructed that, if it answered this question affirmatively, it should also determine whether Cisco “actually

knew or should have known that its actions constituted

an unjustifiably high risk of infringement of a valid and

enforceable patent.” Id. To determine whether Cisco

had this state of mind, the jury was instructed to consider the following factors:

5a

One, whether or not defendant acted in accordance with the standards of commerce for its industry.

Two, whether or not defendant intentionally

copied a product of plaintiff’s that is covered by

the patents-in-suit.

Three, whether or not there is a reasonable basis to believe that defendant did not infringe or

had a reasonable defense to infringement.

Four, whether or not defendant made a goodfaith effort to avoid infringing the patents-insuit, for example, whether defendant attempted to design around the patents-in-suit.

And, five, whether or not defendant tried to

cover up its infringement.

Id. at *2-3.

Regarding attorney fees, the district court noted

that even though it removed the willfulness finding it

had partially relied on in awarding fees, there was nevertheless sufficient reason to maintain the fees award.

Id. at *4. It again found the case “exceptional” and accordingly granted the renewed motion for attorney fees

and expenses. Id. at *5.

SRI appeals the district court’s JMOL of no willful

infringement and the denial of its motion to reinstate

the jury’s willfulness verdict and to reinstate the district court’s award of enhanced damages. Cisco crossappeals the district court’s award of attorney fees. We

have jurisdiction under 28 U.S.C. § 1295(a)(1).

DISCUSSION

We review a grant of JMOL of no willfulness under

the same standard as the district court, for substantial

6a

evidence. Johns Hopkins Univ. v. CellPro, Inc., 152

F.3d 1342, 1354, 1363 (Fed. Cir. 1998); MobileMedia

Ideas LLC v. Apple Inc., 780 F.3d 1159, 1164 (Fed. Cir.

2015) (citing Pitts v. Delaware, 646 F.3d 151, 155 (3d

Cir. 2011)). We review a district court’s decision regarding the amount of enhanced damages for an abuse

of discretion. Halo Elecs., Inc. v. Pulse Elecs., Inc., 136

S. Ct. 1923, 1934 (2016). Likewise, we review an award

of attorney fees pursuant to 35 U.S.C. § 285 for an

abuse of discretion. Highmark Inc. v. Allcare Health

Mgmt. Sys., Inc., 572 U.S. 559, 564 (2014).

I

A

In SRI II, we held that there was no willful infringement as a matter of law before Cisco had notice

on May 8, 2012. We did not decide whether substantial

evidence supported the jury verdict of willful infringement after May 8, 2012. Rather, we remanded for the

district court to determine this issue in the first instance. We now hold that that substantial evidence

supports the jury’s finding of willful infringement after

May 8, 2012. We do not disturb SRI II’s holding that

there was no willful infringement before May 8, 2012.

First, we presume, as we must, that consistent

with the jury instructions, the jury found that Cisco

had no reasonable basis to believe that it did not infringe or that it had a reasonable defense to infringement.1 See SSL Servs., LLC v. Citrix Sys., Inc., 769

1

See jury instructions, supra. The jury was instructed under

the Seagate willful infringement standard, which required both (1)

“clear and convincing evidence that the infringer acted despite an

objectively high likelihood that its actions constituted infringement of a valid patent” and (2) that “this objectively-defined risk

… was either known or so obvious that it should have been

7a

F.3d 1073, 1082 (Fed. Cir. 2014) (generally, “[w]e presume that the jury resolved the underlying factual disputes in favor of the verdict and review those factual

findings for substantial evidence” (citing Kinetic Concepts, Inc. v. Smith & Nephew, Inc., 688 F.3d 1342,

1356-57 (Fed. Cir. 2012))).

SRI presented evidence that Cisco’s invalidity defenses were unreasonable. Cisco’s only assertion of invalidity over the prior art was based on anticipation by

a reference that was twice considered and twice rejected by the Patent Office. See SRI I, 254 F. Supp. 3d at

722 n.52. SRI’s expert testified that this reference was

lacking a key limitation of the claims—the requirement

for multiple network monitors. Moreover, Cisco’s expert had not even seen (let alone distinguished) the Patent Office’s prior analysis rejecting this same prior art

during the reexamination of the asserted patents before that expert opined that this prior art anticipated

the claims.

SRI also presented evidence to the jury that Cisco

did not have any reasonable basis for non-infringement.

For example, as its only non-infringement argument for

one of two sets of product groupings, Cisco maintained

throughout trial that the claims required separate monitors, which its products did not have. Id. at 722. SRI

countered that this non-infringement defense was unknown.” In re Seagate Tech., LLC, 497 F.3d 1360, 1371 (Fed. Cir.

2007). Since that decision, the Supreme Court issued Halo Electronics, Inc. v. Pulse Electronics., Inc., 136 S. Ct. 1923 (2016),

which rejected the objective recklessness requirement. Because

Halo did not disturb the substantive standard for subjective willfulness, we have held that we may review the jury’s verdict for

substantial evidence under that standard. See Arctic Cat Inc. v.

Bombardier Recreational Prods. Inc., 876 F.3d 1350, 1371 (Fed.

Cir. 2017).

8a

tethered to the district court’s claim construction of a

“network monitor,” which expressed no such requirement. See J.A. 22228 (Trial Tr. 1934:13-21) (stating that

“during the entire time that Cisco was putting on its

infringement case … you never once saw the Court’s

construction of network monitor hit the screen, not

once”). In SRI I, the district court noted this disconnect, explaining that although the court “had explained

that ‘[t]he claim language and the parties’ constructions

do not require that the “network monitor” and “hierarchical monitor” be separate structures’ [], Cisco maintained throughout trial that separate monitors were

required.” 254 F. Supp. 3d at 722 (first alteration in

original).

Likewise, as its only non-infringement argument

for the second set of product groupings, Cisco asserted

that while the claims require that the products correlate events, its products process events one at a time,

i.e., they do not correlate events. At trial, SRI presented directly contradictory evidence. For example,

SRI identified an internal Cisco document that shows a

“Meta Event Generator” plainly depicting a hierarchical arrangement of monitors correlating multiple

events. J.A. 38708. Cisco’s own technical witness similarly acknowledged that this “Meta Event Generator”

functions to correlate events. J.A. 21813 (Trial Tr.

1519:3-5) (“Meta is specialized to combine events into a

bigger event.”). Further combined with testimony

from SRI’s expert that the accused products correlate

events, Cisco-customer testimony that Cisco’s product

correlates events, and third-party testing confirming

the same, the jury had a reasonable basis to believe

that Cisco did not have any reasonable defenses to infringement.

9a

In addition, the jury found that Cisco induced infringement of the asserted claims, and Cisco does not

challenge that finding on appeal. See SRI I, 254 F.

Supp. 3d at 700. As explained in SRI I, the court instructed the jury that “Defendant is liable for active

inducement only if plaintiff proves by a preponderance

of the evidence” that, among other things, (1) “Defendant took some action intending to encourage or instruct

its customers to perform acts that you, the jury, find

would directly infringe”; and (2) “Defendant was aware

of the asserted patents at the time of the alleged conduct and knew that its customer’s acts (if taken) would

constitute infringement of an asserted patent.” Id. at

719 (emphasis omitted). Based on these unchallenged

jury instructions, we may presume that the jury found

that Cisco knew of the patent, took action to encourage

its customers to infringe, and knew that its customers

actions (if taken) would infringe. Such unchallenged

findings may support a jury’s finding of willful infringement.

To be clear, a finding of induced infringement does

not compel a finding of willfulness. Indeed, the standard required for willful infringement is different than

that required for induced infringement. Nonetheless,

in this case, the jury’s unchallenged findings on induced

infringement, when combined with Cisco’s lack of reasonable bases for its infringement and invalidity defenses, provide sufficient support for the jury’s finding

of willful infringement for the period after May 8, 2012,

when Cisco had notice of the patent.

Finally, we address the district court’s statement in

SRI III that the Federal Circuit “made clear that the

standard for willfulness” applicable on remand is

“whether ‘Cisco’s conduct rose to the level of wanton,

malicious, and bad-faith behavior required for willful

10a

infringement.’” SRI III, 2020 WL 1285915, at *1 (quoting SRI II, 930 F.3d at 1309). The district court also

noted that “the Court of Appeals is not entirely consistent in its use of adjectives to describe what is required for willfulness.” SRI III, 2020 WL 1285915, at

*1 n.1. To eliminate the confusion created by our reference to the language “wanton, malicious, and bad-faith”

in Halo, we clarify that it was not our intent to create a

heightened requirement for willful infringement. Indeed, that sentence from Halo refers to “conduct warranting enhanced damages,” not conduct warranting a

finding of willfulness. Halo, 136 S. Ct. at 1932 (“The

sort of conduct warranting enhanced damages has been

variously described in our cases as willful, wanton, malicious, bad-faith, deliberate, consciously wrongful, flagrant, or—indeed—characteristic of a pirate.”) As we

said in Eko Brands, “[u]nder Halo, the concept of ‘willfulness’ requires a jury to find no more than deliberate

or intentional infringement.” Eko Brands, LLC v.

Adrian Rivera Maynez Enters., Inc., 946 F.3d 1367,

1378 (Fed. Cir. 2020) (citing Halo, 136 S. Ct. at 1933).

Under the proper test for willfulness, and considering the presumed jury findings above, we conclude that

substantial evidence supports the jury’s willful infringement finding. We thus reverse the district

court’s JMOL of no willful infringement and reinstate

the jury verdict of willful infringement.

B

We next turn to SRI’s request to reinstate the

award of enhanced damages. Although willfulness is a

component of enhancement, “an award of enhanced

damages does not necessarily flow from a willfulness

finding.” Presidio Components, Inc. v. Am. Tech. Ceramics Corp., 875 F.3d 1369, 1382 (Fed. Cir. 2017) (first

11a

citing Halo, 136 S. Ct. at 1932; and then citing WBIP,

LLC v. Kohler Co., 829 F.3d 1317, 1341 n.13 (Fed. Cir.

2016)). Discretion remains with the district court to

determine whether the conduct is sufficiently egregious

to warrant enhanced damages. WBIP, 829 F.3d at 1341

n.13; Halo, 136 S. Ct. at 1934 (“Section 284 gives district courts discretion in meting out enhanced damages.”). We review the district court’s decision to award

enhanced damages for an abuse of discretion. Halo, 136

S. Ct. at 1934. Thus, a decision of enhancement cannot

stand if “it was based on a clear error of fact, an error

of law, or a manifest error of judgment.” Va. Panel

Corp. v. MAC Panel Co., 133 F.3d 860, 867 (Fed. Cir.

1997) (quoting Nat’l Presto Indus., Inc. v. W. Bend Co.,

76 F.3d 1185, 1193 (Fed. Cir. 1996)); see Halo, 136 S. Ct.

at 1934 (“That standard allows for review of district

court decisions informed by ‘the considerations we have

identified.’” (quoting Octane Fitness, LLC v. ICON

Health & Fitness, Inc., 572 U.S. 545, 554 (2014))).

In this case, the district court in SRI I awarded

double damages. The district court explained that enhanced damages were appropriate “given Cisco’s litigation conduct, its status as the world’s largest networking company, its apparent disdain for SRI and its business model, and the fact that Cisco lost on all issues

during summary judgment and trial, despite its formidable efforts to the contrary.” SRI I, 254 F. Supp. 3d at

723-24. In doing so, the district court appropriately

considered the factors laid out in Read Corp. v. Portec,

Inc., including at least “the infringer’s behavior as a

party to the litigation,” the infringer’s “size and financial condition,” the infringer’s “motivation for harm,”

and the “[c]loseness of the case.” 970 F.2d 816, 826-27

(Fed. Cir. 1992), abrogated in part on other grounds by

Markman v. Westview Instruments, Inc., 517 U.S. 370,

12a

116 (1996); see SRI I, 254 F. Supp. 3d. at 721. We discern no clearly erroneous factual findings, erroneous

conclusions of law, or a clear error of judgment amounting to an abuse of discretion. We also conclude that vacating and remanding for the district court to decide

the issue anew would serve little purpose given that

the district court in SRI I already properly considered

this issue.2

We are unpersuaded by Cisco’s arguments that

SRI forfeited its right to enhanced damages by failing

to challenge the district court’s assessment of enhancement in SRI III. Notably, the district court in

SRI III did not conduct an analysis of enhancement because it entered JMOL of no willful infringement.

Though the court stated that it “will deny the motion to

amend the willfulness judgment and award enhanced

damages,” that sentence must be read in context of the

entire opinion. SRI III, 2020 WL 1285915, at *4. The

district court began its analysis by pointing to what it

believed was the standard for willfulness. Id. at *1. It

then conducted its assessment of willfulness, repeatedly mentioning the jury’s willfulness verdict and SRI’s

arguments with regard to willfulness; not once did the

district court discuss enhancement in this assessment.

Only after determining that substantial evidence did

2

It may seem inappropriate to reinstate the enhancement

award in SRI I when we held in SRI II that the willfulness finding

should have been limited to willfulness after May 8, 2012. But neither party makes this argument and for good reason. The parties

informed this court for the first time in this appeal that the district

court’s award of double damages in SRI I applied only to damages

for infringing activity after notice was given to Cisco, i.e., after

May 8, 2012. The jury did not award any pre-notice damages to

SRI because it was only instructed to award damages after May 8,

2012.

13a

not support the jury verdict of willful infringement did

the district court also, without analysis, deny enhanced

damages. It is thus clear to us that the district court in

SRI III denied the motion to reinstate the award of enhanced damages only because it denied the motion to

reinstate the jury’s willfulness finding. Because we reinstate the jury’s willfulness verdict, we likewise restore the district court’s award of double damages in

SRI I.

II

We next turn to Cisco’s cross-appeal challenging

the district court’s grant of SRI’s motion for attorney

fees. Under 35 U.S.C. § 285, a “court in exceptional

cases may award reasonable attorney fees to the prevailing party.” An “exceptional” case is “one that

stands out from others with respect to the substantive

strength of a party’s litigating position (considering

both the governing law and the facts of the case) or the

unreasonable manner in which the case was litigated.”

Octane Fitness, 572 U.S. at 554. We review a district

court’s grant or denial of attorney fees for an abuse of

discretion. See Highmark, 572 U.S. at 564; Bayer

CropScience AG v. Dow AgroSciences LLC, 851 F.3d

1302, 1306 (Fed. Cir. 2017). A district court abuses its

discretion when it “base[s] its ruling on an erroneous

view of the law or on a clearly erroneous assessment of

the evidence.” Rothschild Connected Devices Innovations, LLC v. Guardian Prot. Servs., Inc., 858 F.3d

1383, 1387 (Fed. Cir. 2017) (alteration in original) (quoting Highmark, 572 U.S. at 563 n.2).

As we explained in SRI II, we see no error in the

district court’s determination that this was an exceptional case. 930 F.3d at 1310-11. The district court’s

initial findings remain persuasive:

14a

There can be no doubt from even a cursory review of the record that Cisco pursued litigation

about as aggressively as the court has seen in

its judicial experience. While defending a client

aggressively is understandable, if not laudable,

in the case at bar, Cisco crossed the line in several regards.

SRI I, 254 F. Supp. 3d at 722. Moreover, the district

court’s initial decision explained that “Cisco’s litigation

strategies … created a substantial amount of work for

both SRI and the court, much of which work was needlessly repetitive or irrelevant or frivolous.” Id. at 723

(footnotes omitted). Indeed, the district court conducted a thorough inventory of Cisco’s aggressive tactics,

including maintaining nineteen invalidity theories until

the eve of trial but ultimately presenting only two at

trial, presenting weak non-infringement theories that

were contrary to the district court’s claim construction

ruling and Cisco’s own internal documents, exhaustive

summary judgment and sanction efforts, overdesignation of deposition testimony for trial, and asserting “every line of defense post-trial.” Id. at 722-23.

We nonetheless vacated because the district court relied in part on the fact that the jury found that Cisco’s

infringement was willful in its determination to award

attorney fees.

Here, the district court reconsidered attorney fees

in the absence of a willfulness finding, and again found

this case to be “exceptional,” justifying a full award of

attorney fees. SRI III, 2020 WL 1285915, at *4-5. Upon reconsideration, the district court explained that

“Cisco’s entire case was weak, yet it pursued the case

aggressively and in an unreasonable manner anyway.”

Id. at *5. We see no abuse of discretion by the district

15a

court in this regard and affirm its award of attorney

fees.

CONCLUSION

We have considered the parties’ remaining arguments and find them unpersuasive. For the foregoing

reasons, we affirm the district court’s grant of attorney

fees, reverse the district court’s JMOL of no willful infringement, reinstate the jury’s finding of willfulness,

and reinstate the award of enhanced damages.

AFFIRMED-IN-PART AND REVERSED-IN-PART

COSTS

No costs.

17a

APPENDIX B

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF DELAWARE

Civil Action No. 13-1534-RGA

SRI INTERNATIONAL, INC.,

Plaintiff,

v.

CISCO SYSTEMS, INC.,

Defendant.

MEMORANDUM

The Court of Appeals for the Federal Circuit vacated and remanded this Court’s “denial of Cisco’s renewed motion for judgment as a matter of law that Cisco did not willfully infringe the asserted claim,” and vacated and remanded the “awards of enhanced damages

and attorneys’ fees.” SRI Int’l, Inc. v. Cisco Systems,

Inc., 930 F.3d 1295, 1312 (Fed. Cir. 2019) (“FCDec”).

The Court of Appeals further held, “We leave it to the

district court to decide in the first instance whether the

jury’s presumed finding of willful infringement after

May 8, 2012 is supported by substantial evidence. In so

doing, the court should bear in mind the standard for

willful infringement, as well as the above analysis regarding SRI’s evidence of willfulness.” Id. at 1310

(footnote omitted).

The case is now assigned to me. Plaintiff moved (1)

to amend the willfulness judgment and award enhanced

18a

damages, and (2) for attorney’s fees. (D.I. 427,428).

The motions have been fully briefed, and they were

orally argued on February 18, 2020.

The Court of Appeals made clear that the standard

for willfulness that it wanted this Court to apply was

whether “Cisco’s conduct rose to the level of wanton,

malicious, and bad faith behavior required for willful

infringement.” FCDec at 1309.1

In the original briefing on the renewed motion for

judgment as a matter of law that Cisco did not willfully

1

As a side note, the Court of Appeals is not entirely consistent in its use of adjectives to describe what is required for willfulness. For example, in Eko Brands, LLC v. Adrian Rivera

Maynez Enterprises, Inc., 946 F.3d 1367, 1378 (Fed. Cir. 2020), the

Court of Appeals described what was required as being “no more

than deliberate or intentional infringement.” I note, as did SRI at

oral argument, that indirect infringement, which was found in this

case and is not now challenged, required the jury to find that Cisco

“knew that its customer’s acts (if taken) would constitute infringement of an asserted patent, or [that Cisco] believed there

was a high probability that the acts (if taken) would constitute infringement of an asserted patent but deliberately avoided confirming that belief,” SRI Int’l, Inc. v. Cisco Systems, Inc., 254

F.Supp.3d 680, 701 (D.Del. 2017), or that “defendant knew that the

accused product would be used in a manner infringing the patentsin-suit.” Id. at 703. If the standard for willfulness is deliberate or

intentional, it is hard to see how a finding of indirect infringement

would not usually be enough for willfulness. For what it is worth,

I think that when the Supreme Court stated, “The sort of conduct

warranting enhanced damages has been variously described in our

cases as willful, wanton, malicious, bad-faith, deliberate, consciously wrongful, flagrant, or—indeed—characteristic of a pirate,” Halo

Elecs., Inc. v. Pulse Elecs., Inc., 136 S.Ct. 1923, 1932 (2016), the

Court did not purport to be approving the lowest common denominator—deliberate—as being sufficient for enhanced damages.

“Deliberate,” used in its ordinary sense, which I take to be “carefully thought out,” is not a synonym for, nor akin to, the other adjectives used in that string.

19a

infringe, SRI made exactly two points in support of the

willfulness verdict. They were: (1) Cisco designed the

products in an infringing manner and instructed its customers to use them in an infringing manner, and (2)

Cisco did not analyze infringement and its “knowledgeable witnesses” did not read the SRI patents. (D.I. 370

at 27-28; see also D.I. 354 at 5-7 (to the same effect, and

further noting that Cisco did not investigate the infringement allegations)). In this Court’s opinion denying the renewed motion, the Court specifically agreed

with SRI’s arguments: “[K]ey Cisco employees did not

read the patents-in-suit until their depositions. ... Cisco

designed the products and services in an infringing

manner and ... Cisco instructed its customers to use the

products and services in an infringing manner.” SRI

Int’l, Inc. v. Cisco Systems, Inc., 254 F.Supp.3d 680, 717

(D.Del. 2017) (“DelDec”). The Court of Appeals specifically rejected both bases for denying the renewed motion. FCDec at 1308-09. The Court noted that the “key

witnesses” were engineers, not lawyers, and that “it

was unremarkable that the engineers—as opposed to

Cisco’s in-house counsel or outside counsel—did not analyze the patents-in-suit themselves.” Id. at 1309. As

to the other rationale, the Court of Appeals held that

the evidence “is nothing more than proof that Cisco directly infringed and induced others to infringe the patents-in-suit.” Id. SRI’s briefing in the Court of Appeals apparently raised other evidence in support of the

willfulness verdict, and the Court of Appeals rejected

those other arguments. In doing so, the Court of Appeals noted, “Cisco’s decision not to seek an advice-ofcounsel defense is legally irrelevant under 35 U.S.C.

§ 298.” Id. In the context of the opinion, I think this is a

reference to SRI’s argument that the “key engineers”

20a

did not look at the asserted patents until well into the

litigation.

Thus, the reasons advanced by this Court for denying the renewed motion have all been rejected. The

reasons advanced by SRI in the Court of Appeals were

rejected. Has the post-remand briefing raised anything

new?

I went back to SRI’s closing argument.

what SRI argued to the jury about willfulness.

Here’s

All right. Last thing in the case-in-chief

part here is willfulness. I’m just going to tell

you what the legal standard is. Okay? This is

the last issue on the verdict form, willfulness,

and this is sort of what the flavor of infringement is.

Did Cisco act recklessly? And it has to be

proved by clear and convincing evidence. It’s a

high burden. We agree. Did they act recklessly by clear and convincing evidence? Two-part

test.

Number one, did they act despite a high

likelihood that their actions infringed a valid

and enforceable patent? And, second, did they

know, or should they have known that their actions put them in an unjustifiably high risk?

That’s a test.

And the evidence happily we already

looked at in the context of inducement, so I

don’t have to run through it again. The notice

letter, and then the testimony of Mr. Roesch,

it’s all the same content. Testimony of Mr.

Kasper. Okay? And it is very similar conceptually to that mental state requirement for in-

21a

ducement, and we think it satisfies the standard for willfulness. That’s up to you. Okay?

(D.I. 400 at 46-47).

I went back to the jury instruction on willfulness

given at trial. The jury was instructed:

Willfulness requires you to determine that

defendant acted recklessly. To prove that defendant acted recklessly, plaintiff must prove

two things by clear and convincing evidence.

The first part of the testimony is objective:

Plaintiff must persuade you that defendant acted despite a high likelihood that defendant’s actions infringed a valid and enforceable patent.

In making this determination, you may not consider defendant’s state of mind. Legitimate or

credible defenses to infringement, even if not

ultimately successful, demonstrate a lack of

recklessness.

Only if you conclude that the defendant’s

conduct was reckless do you need to consider

the second part of the test. The second part of

the test does depend on defendant’s state of

mind. Plaintiff must persuade you that defendant actually knew or should have known that

its actions constituted an unjustifiably high risk

of infringement of a valid and enforceable patent. To determine whether defendant had this

state of mind, consider all facts which may include, but are not limited, to:

One, whether or not defendant acted in accordance with the standards of commerce for

its industry.

22a

Two, whether or not defendant intentionally copied a product of plaintiffs that is covered

by the patents-in-suit.

Three, whether or not there is a reasonable

basis to believe that defendant did not infringe

or had a reasonable defense to infringement.

Four, whether or not defendant made a

good-faith effort to avoid infringing the patents-in-suit, for example, whether defendant

attempted to design around the patents-in-suit.

And, five, whether or not defendant tried

to cover up its infringement.

Ultimately, you must decide if defendant

was reckless in the infringement of the patentsin-suit under the totality of the circumstances.

(D.I. 400 at 115-16). At oral argument, counsel for SRI

conceded that there was no evidence to support factors

1 and 2, and essentially conceded that there was no

“cover up” and therefore no evidence to support factor

5. On factor 2, the evidence actually supported Cisco,

as the products at issue were “independently developed” and sold years before Cisco learned of SRI’s asserted patents. FCDec at 1309.

The third factor is key from SRI’s point of view.

Was there “a reasonable basis to believe that [Cisco]

did not infringe or had a reasonable defense to infringement”? Essentially, SRI’s argument on this point

is that the jury had sufficient evidence to find Cisco infringed and the asserted claims were not invalid, and

the jury could have further found that the issues were

not close.2

2

I imagine that one logical consequence of this argument, if it

is accepted, would be that almost every jury case in which the al-

23a

In my opinion, there is some evidence that my predecessor on this case believed that Cisco’s infringement

defenses were reasonable.3 First, in real time, the

Court said so. (“Cisco has a good case in connection

with infringement, and a much poorer case when it

comes to invalidity.” (D.I. 399 at 234)). The Court followed that up with, “(I]n my world, this case in terms of

infringement has been like virtually every other case.

There’s nothing remarkable about this case when it

comes to infringement.” (Id. at 236). Second, in the

opinion on the renewed motion, the Court refused to

disturb any of the infringement verdicts, but its opinion

on that aspect of the motion was measured, and, essentially, found that SRI had offered sufficient expert testimony on each disputed point (sometimes in conjunction with fact witness testimony) and that the jury’s

credibility decisions would therefore not be disturbed.

See DelDec at 691-709. That portion of the opinion is in

stark contrast to much of the rest of the opinion, which

lambastes Cisco’s conduct of the litigation. Nevertheless, the lambasting included criticism of Cisco’s “single

[non-infringement] defense” for each of the “two representative product groupings,” that is, that the defense

for the first grouping relied on a defense contrary to

the claim construction, and that the defense for the second grouping was against a significant quantity of evidence to the contrary. DelDec at 722.

leged infringement continues after the infringement suit was filed

would require submission of willfulness to the jury.

3

And, although not relevant to this analysis, Cisco’s damages

defense at trial succeeded in obtaining a 3 ½% royalty rate rather

than SRl’s requested 7 ½% royalty rate, suggesting that Cisco’s

damages defense was at least as reasonable as SRI’s case for damages.

24a

In its current briefing, SRI makes three arguments. First, it paints Cisco’s trial defenses to infringement as being frivolous.4 (D.I. 427 at 5-8). The

parties dispute this point.5 (D.I. 433 at 10-13; D.I. 438

at 2-6). Part of the willfulness charge instructed the

jury to consider whether there was a reasonable basis

to believe that defendant did not infringe. Given that

the jury was the finder of fact, the jury could have answered the question negatively depending upon its

evaluation of credibility and the evidence. I have to

presume that it did.6 In other words, if the jury found

Cisco’s experts not credible, and the evidence presented at trial undercut Cisco’s positions, then the jury

could also find Cisco’s defenses not reasonable.

Second, SRI reprises its emphasis on the testimony

of the “key engineers.” (D.I. 427 at 8-12). One of them

was a vice president and Cisco’s corporate representative at trial. The other was a senior engineer most

knowledgeable about at least one of the accused products, but he was “[kept] in the dark” about the patentsin-suit. (D.I. 427 at 10). In my opinion, SRI’s argument

4

It is true that this Court used the word “frivolous” in its

opinion denying the renewed motion, but that was not in connection with the defenses presented at trial. See DelDec at 723

& n.57.

5

As Cisco points out, SRI had the opportunity to raise this

argument before, in briefing before this Court and the Court of

Appeals, and it did not. Nor did SRI argue it to the jury in closing

argument.

6

The remand to this Court was limited in nature. Were it

broader, I would have to give serious consideration to whether

granting a new trial on willfulness was appropriate, given that, so

far as I am aware, all of SRI’s actual arguments to the jury were

based on considerations that have been rejected by the Court of

Appeals.

25a

on the engineers is simply an unsuccessful attempt to

reargue what has already been foreclosed by the Court

of Appeals’ opinion.

Third, SRl’s final argument is, “Cisco presented no

evidence from either ‘in-house counsel or outside counsel’—nor any fact witness [who] allegedly relied on

such counsel—to provide any good faith rationale for

Cisco’s continued infringement after May 8, 2012.”

(D.I. 427 at 12). This argument seems to fly in the face

of both the Court of Appeals’ opinion and the statute

cited in that opinion. “The failure of an infringer to obtain the advice of counsel with respect to any allegedly

infringed patent, or the failure of the infringer to present such advice to the court or jury, may not be used

to prove that the accused infringer willfully infringed

the patent ... .” 35 U.S.C. §298.

Thus, while two of the three current arguments are

meritless, I believe that SRI has a basis for arguing

that the third factor was proven by Cisco’s lack of reasonable defenses at trial. Nothing in the briefing really

addresses the fourth factor, other than to acknowledge

the obvious, which is that Cisco did not do any designaround before trial. See DelDec at 723 (referring only

to “post-trial remedial actions”).

In my opinion, although the willfulness verdict had

arguable support from factors 3 and 4, the absence of

support from factors 1 and 5, and the opposing weight

of factor 2, tells me that, viewed in totality, there was

not substantial evidence to support the verdict of willful infringement. There is no substantial evidence that

Cisco’s infringement was “wanton, malicious, and badfaith.” Thus, I will deny the motion to amend the willfulness judgment and award enhanced damages.

26a

On the motion for attorney’s fees, Cisco does not

challenge the determination that the case was exceptional. (D.1. 432 at 7). Cisco does argue that the approximately $8,000,000 in attorney’s fees and expenses,

see DelDec at 723 n.58, should be revisited if the willfulness verdict is not reinstated.

In its briefing and at oral argument, Cisco cited In

re Rembrandt Techs LP Patent Lit., 899 F.3d 1254

(Fed. Cir. 2018), for the proposition that an award of

attorney’s fees under §285 is “compensatory, not punitive,” id. at 1278, that “the amount of the award must

bear some relation to the extent of the misconduct,” id.,

and that exceptionality “based on litigation misconduct

usually does not support a full award of attorneys’

fees.” Id. (cleaned up).

The award of attorney’s fees was vacated by the

Court of Appeals. The willfulness underpinning to the

attorney’s fees award has been removed by me. Nevertheless, it seems to me that, other than as instructed

by the Court of Appeals,7 there is no reason to change

the amount of fees awarded. This Court’s opinion

makes clear that it was not only the unreasonable manner in which the case was litigated, but also the lack of

substantive strength that informed the decision to

award attorney’s fees for the whole case, not just individual acts of unreasonable litigation. Nothing in that

regard has changed. In essence, this Court’s opinion

stated that Cisco’s case lacked substantive strength, as

its trial defenses were weak, “all of [its summary judgment defenses] were denied,” and “every line of de7

The Court of Appeals instructed that “attorney hours clearly included by mistake” should be removed from the attorney’s

fees calculation. FCDec at 1311. The parties are ordered to meet

and to confer and to remove any such entries.

27a

fense post-trial ... has been denied.” DelDec at 722-23.

Cisco had a weak case that it over-aggressively defended. Thus, this Court’s original exceptional case determination and award of attorney’s fees was compliant

with Rembrandt. I see no reason to come to a different

conclusion after subtracting out the willfulness finding.

As the Court of Appeals explained in Rembrandt,

“an award of all of a party’s fees, from either the start

or some midpoint of a suit, may be justified in some exceptional cases. But, critically, the amount of the

award must bear some relation to the extent of the

misconduct.” 899 F.3d at 1279 (cleaned up). I find that

this case is such an “exceptional” case and that a full

award of attorneys’ fees is justified here. It would be

impossible to isolate the improper conduct and award

partial fees because the problem is that Cisco’s entire

case was weak, yet it pursued the case aggressively

and in an unreasonable manner anyway. Thus, a full

award of fees and expenses is related “to the extent of

the misconduct” in this case.

The motion to amend the willfulness judgment (D.I.

427) is DENIED. The motion for attorney’s fees and

expenses (D.I. 428) is GRANTED.

The parties are directed to meet and to confer and

to submit an agreed-upon final judgment implementing

this memorandum within two weeks. If the parties

cannot agree on such a final judgment, the parties

should submit a status report describing any disagreements and a proposal for any procedure to resolve

them.

IT IS SO ORDERED this 18th day of March, 2020.

/s/ Richard G. Andrews

United States District Judge

29a

APPENDIX C

UNITED STATES COURT OF APPEALS

FOR THE FEDERAL CIRCUIT

2017-2223

SRI INTERNATIONAL, INC.,

Plaintiff-Appellee,

v.

CISCO SYSTEMS, INC.,

Defendant-Appellant.

Appeals from the United States District Court for the

District of Delaware in No. 1:13-cv-01534-SLR-SRF,

Judge Sue L. Robinson.

OPINION ISSUED: March 20, 2019

OPINION MODIFIED: July 12, 2019*

*

*

*

Before LOURIE, O’MALLEY, and STOLL, Circuit

Judges.

Opinion for the court filed by Circuit Judge STOLL.

Dissenting opinion filed by Circuit Judge LOURIE.

STOLL, Circuit Judge.

*

This opinion has been modified and reissued following a petition for rehearing filed by Defendant-Appellant.

30a

This is an appeal from a final judgment in a patent

case. Cisco Systems, Inc. (“Cisco”) appeals the district

court’s (1) denial of Cisco’s motion for summary judgment of patent ineligibility under § 101, (2) construction

of the claim term “network traffic data,” (3) grant of

summary judgment of no anticipation, and (4) denial of

judgment as a matter of law of no willful infringement.

Cisco also appeals the district court’s grant of enhanced

damages, attorneys’ fees, and ongoing royalties.

We affirm the district court’s denial of summary

judgment of ineligibility, adopt its construction of

“network traffic data,” and affirm its summary judgment of no anticipation. We vacate and remand the district court’s denial of judgment as a matter of law of no

willful infringement, and therefore vacate and remand

the district court’s enhancement of damages and award

of attorneys’ fees. Finally, we affirm the district court’s

award of ongoing royalties on post-verdict sales of

products that were actually found to infringe or are not

colorably different. Accordingly, we affirm-in-part, vacate-in-part, and remand for further proceedings consistent with this opinion.

BACKGROUND

I

While the interconnectivity of computer networks

facilitates access for authorized users, it also increases

a network’s susceptibility to attacks from hackers,

malware, and other security threats. Some of these security threats can only be detected with information

from multiple sources. For instance, a hacker may try

logging in to several computers or monitors in a network. The number of login attempts for each computer

may be below the threshold to trigger an alert, making

it difficult to detect such an attack by looking at only a

31a

single monitor location in the network. In an attempt

to solve this problem, SRI developed the inventions

claimed in U.S. Patent Nos. 6,484,203 and 6,711,615.

The ’615 patent (titled “Network Surveillance”) is a

continuation of the ’203 patent (titled “Hierarchical

Event Monitoring and Analysis”).

II

SRI had performed considerable research and development on network intrusion detection prior to filing

the patents-in-suit. In fact, SRI’s Event Monitoring

Enabling Responses to Anomalous Live Disturbances

(“EMERALD”) project had attracted considerable attention in this field. The Department of Defense’s Defense Advanced Research Projects Agency, which

helped fund EMERALD, called it a “gem in the world

of cyber defense” and “a quantum leap improvement

over” previous technology. J.A. 1272-73 at 272:16-17,

273:7-9. In October 1997, SRI presented a paper entitled “EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances” (“EMERALD 1997”) at the 20th National Information Systems

Security Conference.

EMERALD 1997 is a conceptual overview of the

EMERALD system. It describes in detail SRI’s early

research in intrusion detection technology and outlines

the development of next generation technology for detecting network anomalies. SRI Int’l Inc. v. Internet

Sec. Sys., Inc., 647 F. Supp. 2d 323, 334 (D. Del. 2009).

The parties do not dispute that EMERALD 1997 constitutes prior art under 35 U.S.C. § 102(b). EMERALD

1997 is listed as a reference on the face of the ’615 patent.

32a

III

The patents share a nearly identical specification

and a priority date of November 9, 1998. At the summary judgment stage, SRI asserted claims 1-4, 14-16,

and 18 of the ’615 patent and claims 1-4, 12-15, and 17 of

the ’203 patent. By the time of trial, SRI had narrowed

the asserted claims to claims 1, 2, 12, and 13 of the ’203

patent and claims 1, 2, 13, and 14 of the ’615 patent.

The jury considered only this narrower set of claims.

The parties identify different representative

claims. Cisco proposes claim 1 of the ’203 patent, while

SRI proposes claim 1 of the ’615 patent. The claims are

substantially similar, as the minor differences between

them are not material to any issue on appeal. As such,

we adopt SRI’s proposal and use ’615 patent claim 1 as

the representative claim.1 It reads:

1. A computer-automated method of hierarchical event monitoring and analysis within an

enterprise network comprising:

deploying a plurality of network monitors

in the enterprise network;

detecting, by the network monitors, suspicious network activity based on analysis of

network traffic data selected from one or

more of the following categories: {network

packet data transfer commands, network

1

The minor differences between the two claims are in the detecting clause—claim 1 of the ’615 patent allows for network traffic

data selected from “one or more of” the enumerated categories,

and includes two extra categories in its list: “network connection

acknowledgements” and “network packets indicative of wellknown network-service protocols.” Compare ’203 patent col. 14 ll.

19–35 (claim 1), with ’615 patent col. 15 ll. 2–21 (claim 1).

33a

packet data transfer errors, network packet data volume, network connection requests, network connection denials, error

codes included in a network packet, network connection acknowledgements, and

network packets indicative of well-known

network-service protocols};

generating, by the monitors, reports of said

suspicious activity; and

automatically receiving and integrating the

reports of suspicious activity, by one or

more hierarchical monitors.

’615 patent col. 15 ll. 2-21.

After SRI sued Cisco for infringement of the ’615

patent and the ’203 patent, Cisco unsuccessfully moved

for summary judgment on several issues, including that

the claims are ineligible and that the EMERALD 1997

reference anticipates the claims.2 SRI Int’l, Inc. v. Cisco Sys., Inc., 179 F. Supp. 3d 339 (D. Del. Apr. 11, 2016)

(“Summary Judgment Op.”). The district court denied

Cisco’s motions and instead sua sponte granted sum2

The patents previously survived multiple anticipation challenges based on the EMERALD 1997 reference. The Patent Office considered EMERALD 1997 during the original prosecution

and issued the patents over it. J.A. 32734 ¶ 47; J.A. 32814-15 ¶ 207.

In addition, during the two reexaminations, the Patent Office

again considered the validity of the asserted claims over EMERALD 1997 and again found the claims valid. J.A. 32734 ¶ 47. Additionally, in SRI International Inc. v. Internet Security Systems,

Inc., a jury found the patents not anticipated by EMERALD 1997.

647 F. Supp. 2d at 350. The district court denied JMOL, concluding that the verdict was supported by expert testimony that EMERALD 1997 failed to disclose the claim limitation at issue. Id.

We affirmed without opinion. SRI Int’l Inc. v. Internet Sec. Sys.,

Inc., 401 F. App’x 530 (Fed. Cir. 2010).

34a

mary judgment of no anticipation in SRI’s favor.3 Id. at

369.

The court then held a jury trial on infringement,

validity, and willful infringement of claims 1, 2, 13, and

14 of the ’615 patent and claims 1, 2, 12, and 13 of the

’203 patent, as well as damages. The jury found that

Cisco intrusion protection system (“IPS”) products,

Cisco remote management services, Cisco IPS services,

Sourcefire4 IPS products, and Sourcefire professional

services directly and indirectly infringed the asserted

claims. The jury awarded SRI a 3.5% reasonable royalty for a total of $23,660,000 in compensatory damages.

The jury also found by clear and convincing evidence

that Cisco’s infringement was willful.

After post-trial briefing, the district court denied

Cisco’s renewed motion for JMOL of no willfulness.

SRI Int’l, Inc. v. Cisco Sys., Inc., 254 F. Supp. 3d 680,

717 (D. Del. 2017) (“Post-Trial Motions Op.”). Based on

the willfulness verdict, the district court determined

that “some enhancement is appropriate given Cisco’s

litigation conduct,” the “fact that Cisco lost on all issues

during summary judgment,” and “its apparent disdain

for SRI and its business model.” Id. at 723. The court

then doubled the damages award. It also granted SRI’s

3

The parties disputed only whether EMERALD 1997 discloses detection of any of the network traffic data categories listed

in claim 1 of the ’203 and ’615 patents and whether EMERALD

1997 is enabled. One of the claimed categories of network traffic is

“network connection requests,” which Cisco asserts is disclosed by

EMERALD 1997.

4

“Sourcefire” is a network security company that Cisco acquired in 2013. J.A. 2467-68. Cisco now markets network security

products and services under the Sourcefire name.

35a

motion for attorneys’ fees, compulsory license, and prejudgment interest.

Cisco appeals the district court’s claim construction

and denial of summary judgment of ineligibility,5 as

well as its grant of summary judgment of no anticipation, enhanced damages, attorneys’ fees, and ongoing

royalties.

We have jurisdiction under 28 U.S.C.

§ 1295(a)(1).

DISCUSSION

I

We review de novo whether a claim is drawn to patent-eligible subject matter. Berkheimer v. HP Inc.,

881 F.3d 1360, 1365 (Fed. Cir. 2018) (citing Intellectual

Ventures I LLC v. Capital One Fin. Corp., 850 F.3d

1332, 1338 (Fed. Cir. 2017)). Section 101 defines patenteligible subject matter as “any new and useful process,

machine, manufacture, or composition of matter, or any

new and useful improvement thereof.” 35 U.S.C. § 101.

Laws of nature, natural phenomena, and abstract ideas,

however, are not patentable. See Mayo Collaborative

Servs. v. Prometheus Labs., Inc., 566 U.S. 66, 70-71

(2012) (citing Diamond v. Diehr, 450 U.S. 175, 185

(1981)).

5

We may review this denial of summary judgment because “a

denial of a motion for summary judgment may be appealed, even

after a final judgment at trial, if the motion involved a purely legal

question and the factual disputes resolved at trial do not affect the

resolution of that legal question.” United Techs. Corp. v. Chromalloy Gas Turbine Corp., 189 F.3d 1338, 1344 (Fed. Cir. 1999)

(citing Wolfgang v. Mid-Am. Motorsports, Inc., 111 F.3d 1515,

1521 (10th Cir. 1997); Rekhi v. Wildwood Indus., Inc., 61 F.3d 1313,

1318 (7th Cir. 1995)). Neither party contends that fact issues arise

in the patent-eligibility analysis in this case. Therefore, we may

review the purely legal question of patent eligibility.

36a

To determine whether a patent claims ineligible

subject matter, the Supreme Court has established a

two-step framework. First, we must determine whether the claims at issue are directed to a patent-ineligible

concept such as an abstract idea. Alice Corp. v. CLS

Bank Int’l, 573 U.S. 208, 217 (2014). Second, if the

claims are directed to an abstract idea, we must “consider the elements of each claim both individually and

‘as an ordered combination’ to determine whether the

additional elements ‘transform the nature of the claim’

into a patent-eligible application.” Id. (quoting Mayo,

566 U.S. at 79). To transform an abstract idea into a

patent-eligible application, the claims must do “more

than simply stat[e] the abstract idea while adding the

words ‘apply it.’” Id. at 221 (quoting Mayo, 566 U.S. at

72 (internal alterations omitted)).

We resolve the eligibility issue at Alice step one

and conclude that claim 1 is not directed to an abstract

idea. See Enfish, LLC v. Microsoft Corp., 822 F.3d

1327, 1337 (Fed. Cir. 2016). The district court concluded that the claims are more complex than merely reciting the performance of a known business practice on

the Internet and are better understood as being necessarily rooted in computer technology in order to solve a

specific problem in the realm of computer networks.

Summary Judgment Op., 179 F. Supp. 3d at 353-54 (citing ’203 patent col. 1 ll. 37-40; DDR Holdings, LLC v.

Hotels.com, L.P., 773 F.3d 1245, 1257 (Fed. Cir. 2014)).

We agree. The claims are directed to using a specific

technique—using a plurality of network monitors that

each analyze specific types of data on the network and

integrating reports from the monitors—to solve a technological problem arising in computer networks: identifying hackers or potential intruders into the network.

37a

Contrary to Cisco’s assertion, the claims are not directed to just analyzing data from multiple sources to

detect suspicious activity. Instead, the claims are directed to an improvement in computer network technology. Indeed, representative claim 1 recites using

network monitors to detect suspicious network activity

based on analysis of network traffic data, generating

reports of that suspicious activity, and integrating

those reports using hierarchical monitors. ’615 patent

col. 15 ll. 2-21. The “focus of the claims is on the specific

asserted improvement in computer capabilities”—that

is, providing a network defense system that monitors

network traffic in real-time to automatically detect

large-scale attacks. Enfish, 822 F.3d at 1335-36.

The specification bolsters our conclusion that the

claims are directed to a technological solution to a technological problem. The specification explains that,

while computer networks “offer users ease and efficiency in exchanging information,” ’615 patent col. 1 ll. 2829, “the very interoperability and sophisticated integration of technology that make networks such valuable assets also make them vulnerable to attack, and

make dependence on networks a potential liability.” Id.

at col. 1 ll. 36-39. The specification further teaches that,

in conventional networks, seemingly localized triggering events can have globally disastrous effects on widely distributed systems—like the 1980 ARPAnet collapse and the 1990 AT&T collapse. See id. at col. 1 ll.

43-47. The specification explains that the claimed invention is directed to solving these weaknesses in conventional networks and provides “a framework for the

recognition of more global threats to interdomain connectivity, including coordinated attempts to infiltrate

or destroy connectivity across an entire network enterprise.” Id. at col. 3 ll. 44-48.

38a

Cisco argues that the claims are directed to an abstract idea for three primary reasons. First, Cisco argues that the claims are analogous to those in Electric

Power Group, LLC v. Alstom S.A., 830 F.3d 1350 (Fed.

Cir. 2016), and are simply directed to generic steps required to collect and analyze data. We disagree. The

Electric Power claims were drawn to using computers

as tools to solve a power grid problem, rather than improving the functionality of computers and computer

networks themselves. Id. at 1354. We conclude that

the claims are more like the patent-eligible claims in

DDR Holdings. In DDR, we emphasized that the

claims were directed to more than an abstract idea that

merely required a “computer network operating in its

normal, expected manner.” 773 F.3d at 1258. Here, the

claims actually prevent the normal, expected operation

of a conventional computer network. Like the claims in

DDR, the claimed technology “overrides the routine

and conventional sequence of events” by detecting suspicious network activity, generating reports of suspicious activity, and receiving and integrating the reports

using one or more hierarchical monitors. Id.

Second, Cisco argues that the invention does not

involve “an improvement to computer functionality itself.” Enfish, 822 F.3d at 1336. In Alice, the Supreme

Court advised that claims directed to independently

abstract ideas that use computers as tools are still abstract. 573 U.S. at 222-23. However, the claims here

are not directed to using a computer as a tool—that is,

automating a conventional idea on a computer. Rather,

the representative claim improves the technical functioning of the computer and computer networks by reciting a specific technique for improving computer network security.

39a

Cisco also submits that the asserted claims are so

general that they encompass steps that people can “go

through in their minds,” allegedly confirming that they

are directed to an abstract concept. Appellant Br. 2728 (citing Capital One, 850 F.3d at 1340; Intellectual

Ventures I LLC v. Symantec Corp., 838 F.3d 1307, 1318

(Fed. Cir. 2016); CyberSource Corp. v. Retail Decisions,

Inc., 654 F.3d 1366, 1371 (Fed. Cir. 2011)). We disagree. This is not the type of human activity that § 101

is meant to exclude. Indeed, we tend to agree with SRI

that the human mind is not equipped to detect suspicious activity by using network monitors and analyzing

network packets as recited by the claims.

Because we conclude that the claims are not directed to an abstract idea under step one of the Alice

analysis, we need not reach step two. See Enfish, 822

F.3d at 1339. Accordingly, we affirm the district

court’s summary judgment that the claims are patenteligible.

II

A district court’s claim construction based solely on

intrinsic evidence is a legal question that we review de

novo. See Teva Pharm. USA, Inc. v. Sandoz, Inc., 135

S. Ct. 831, 841 (2015). Claim construction seeks to ascribe the “ordinary and customary meaning” to claim

terms as a person of ordinary skill in the art would have

understood them at the time of invention. Phillips v.

AWH Corp., 415 F.3d 1303, 1312-14 (Fed. Cir. 2005) (en

banc) (quoting Vitronics Corp. v. Conceptronic, Inc., 90

F.3d 1576, 1582 (Fed. Cir. 1996)). “[T]he claims themselves provide substantial guidance as to the meaning

of particular claim terms.” Id. at 1314. In addition,

“the person of ordinary skill in the art is deemed to

read the claim term not only in the context of the par-

40a

ticular claim in which the disputed term appears, but in

the context of the entire patent, including the specification.” Id. at 1313.

The district court construed “[n]etwork traffic data” to mean “data obtained from direct examination of

network packets.” SRI Int’l, Inc. v. Dell Inc., No.

CV13-1534-SLR, 2015 WL 2265756, at *1-2 (D. Del.

May 14, 2015). After reviewing the parties’ pleadings

on summary judgment, the district court determined

that its construction would benefit from clarification.

The district court explained that “[t]o say that the data

‘is obtained from direct examination of network packets’ means to differentiate the original source of the data, not how or where the data is analyzed. … The fact

that the data may be stored before analysis is performed on the data does not detract from its lineage.”

Summary Judgment Op., 179 F. Supp. 3d at 363. The

district court explicitly rejected the opinion of Cisco’s

expert, Dr. Clark, that the court’s claim construction

should require that the analysis of data obtained from

network packets take place without any further manipulation whatsoever. Id.

On appeal, Cisco offers a more nuanced construction, asserting that term should instead be construed as

“detecting suspicious network activity based on ‘direct

examination of network packets,’ where such ‘direct

examination’ does not include merely examining data

that has been obtained, generated, or gleaned from

network packets.” Appellant Br. 42. According to Cisco, based on SRI’s express prosecution disclaimer during reexamination, the claims require detecting suspicious activity based on “direct examination” of network

packets, not data “generated” or “gleaned” from packets. Cisco would thus construe the term to exclude a

process that decodes the network packet.

41a

We conclude that Cisco’s proposed construction

goes too far in limiting the amount of preprocessing encompassed by the claim. The specification shows that

preprocessing is a contemplated and expected part of

the claimed invention. Indeed, the specification specifically mentions different forms of preprocessing network packets prior to examination, including decryption (’615 patent col. 3 ll. 61-63), parsing (id. at col. 8 ll.

10-12), and decoding (id. at col. 8 ll. 7-9).

Cisco’s argument that SRI disclaimed preprocessing during reexamination of its patents is also not

persuasive. To invoke argument-based estoppel, “the

prosecution history must evince a ‘clear and unmistakable surrender’” of this kind of preprocessing. Deering

Precision Instruments v. Vector Distrib. Sys., 347 F.3d

1314, 1326 (Fed. Cir. 2003) (quoting Eagle Comtronics,

Inc. v. Arrow Commc’n Labs., Inc., 305 F.3d 1303, 1316

(Fed. Cir. 2002)); see also Krippelz v. Ford Motor Co.,

667 F.3d 1261, 1267 (Fed. Cir. 2012) (applying prosecution history disclaimer from reexamination proceedings). Here, SRI’s statements during reexamination

reflect that SRI drew the line between what does and

does not comprise “direct examination” by excluding

information derived from network packet data (for example, network traffic measures and network traffic

statistics). At the same time, SRI explained that “direct examination” includes the data from which the

network traffic measures and network traffic statistics

are derived (that is, the data in the network packets).

For example, SRI explained that the specification:

[D]emonstrates that the term “network traffic

data” requires information obtained by direct

packet examination by using the distinctly different terms “network traffic measures” and

“network traffic statistics” when discussing in-

42a

formation derived from network traffic observation, as compared to the data from which the

measures and statistics are derived.

Brief for the Patentee on Appeal at 7, In re Porras,

Reexam No. 90/008,125 (B.P.A.I. Jan. 14, 2010) (citing

’203 patent col. 4 ll. 55-60 (discussing “network traffic

statistics”) and col. 5 ll. 28-30 (discussing “network traffic measures”)).

We read SRI’s statements during reexamination as

simply explaining that “network traffic statistics,” such

as number of packets and number of kilobytes transferred, are statistics derived from the network packet

data—not the underlying data itself. SRI did not argue

that the actual data underlying the measures and statistics—the data in the network packets—could not be

subject to direct examination. Nor did SRI take the

position that “direct examination” must take place before any or all processing. SRI did not mention processing at all during reexamination. Moreover, as the

specification makes clear, the system may need to decrypt, parse, or decode the data packets—all forms of

preprocessing—in order to directly examine the network packet data underlying the network traffic statistics.

We hold that SRI’s statements in the prosecution

history do not invoke a clear and unmistakable surrender of all preprocessing, including decryption, decoding,

and parsing. Accordingly, we agree with the district

court’s construction of “network traffic data” to mean

“data obtained from direct examination of network

packets.”

43a

III

We also hold that the district court did not err in

granting summary judgment that the asserted claims

are not anticipated by SRI’s own EMERALD 1997 reference. We review the district court’s summary judgment of no anticipation under regional circuit law. See

MAG Aerospace Indus., Inc. v. B/E Aerospace, Inc.,

816 F.3d 1374, 1376 (Fed. Cir. 2016). The Third Circuit

reviews a grant of summary judgment de novo, applying the same standard as the district court. See Gonzalez v. Sec’y of Dep’t of Homeland Sec., 678 F.3d 254, 257

(3d Cir. 2012). Summary judgment is appropriate

when, drawing all justifiable inferences in the nonmovant’s favor, there exists no genuine issue of material fact and the movant is entitled to judgment as a matter of law. Fed. R. Civ. P. 56(a); see also Anderson v.

Liberty Lobby, Inc., 477 U.S. 242, 255 (1986). Anticipation requires that a single prior art reference disclose

each and every limitation of the claimed invention, either expressly or inherently. See Verdegaal Bros. v.

Union Oil Co. of Cal., 814 F.2d 628, 631 (Fed. Cir.

1987).

EMERALD 1997 discloses a tool for tracking malicious activity across large networks. The question before us is whether the district court erred in concluding

on summary judgment that EMERALD 1997 does not

disclose detection of any of the network traffic data

categories listed in claim 1 of the ’203 and ’615 patents.

The Patent Office considered EMERALD 1997 during

the original examination of the ’615 patent, and the patentability of the claims over the reference was confirmed in multiple reexamination and litigation proceedings. Indeed, during reexamination, the Patent

Office accepted SRI’s argument that the claim limitation requires detecting suspicious activity based on “di-

44a

rect examination” of network packets to distinguish

EMERALD 1997. J.A. 26402 (“[T]he closest prior art

of record, Emerald 1997, fails to teach direct examination of packet data.”); J.A. 27101 (same).

EMERALD 1997 describes detecting a DNS/NFS

attack in “real-time.” J.A. 5004. To achieve this, EMERALD 1997 explains:

The subscription list field is an important facility for gaining visibility into malicious or

anomalous activity outside the immediate environment of an EMERALD monitor. The most

obvious examples where relationships are important involve interdependencies among network services that make local policy decisions.

Consider, for example, the interdependencies

between access checks performed during network file system [“NFS”] mounting and the IP

mapping of the DNS service. An unexpected

mount monitored by the network file system

service may be responded to differently if the

DNS monitor informs the network file system

monitor of suspicious updates to the mount requester’s DNS mapping.

J.A. 5008. EMERALD 1997 further explains that:

Above the service layer, signature engines scan

the aggregate of intrusion reports from service

monitors in an attempt to detect more global

coordinated attack scenarios or scenarios that

exploit interdependencies among network services. The DNS/NFS attack discussed [above]

is one such example of an aggregate attack scenario.

J.A. 5010.

45a

Cisco’s expert submitted a report concluding that a

person of ordinary skill in the art would understand

from this disclosure that “monitoring specific network

services, such as HTTP, FTP, network file systems,

finger, Kerberos, and SNMP would require detecting

and analyzing packets indicative of those well-known

network service protocols, one of the enumerated categories in claim 1 of the ’615 patent.” J.A. 30347 (emphasis added). During deposition, however, Cisco’s expert retreated from this position, admitting that a person of ordinary skill reading EMERALD 1997 would

have understood that it was not necessary to directly

examine the packets, although that would be “one very

good way” to prevent attacks. J.A. 50040 at 159:12-21.

On this record, we conclude that summary judgment was appropriate. EMERALD 1997 does not expressly disclose directly examining network packets as

required by the claims—especially not to obtain data

about network connection requests. Nor does Cisco’s

expert testimony create a genuine issue of fact on this

issue. Rather, we agree with the district court that

Cisco’s expert’s testimony is both inconsistent and

“based on [] multiple layers of supposition.” Summary

Judgment Op., 179 F. Supp. 3d at 358. Because the evidence does not support express or inherent disclosure

of direct examination of packet data, we conclude that

the district court did not err in holding that there was

no genuine issue of fact regarding whether EMERALD

1997 disclosed analyzing the specific enumerated types

of network traffic data recited in the claims.

Cisco next argues that the district court erred by

granting summary judgment for SRI sua sponte despite SRI’s failure to move for such relief. We disagree. Under Third Circuit law, a district court may

properly enter summary judgment sua sponte “so long

46a

as the losing party was on notice that she had to come

forward with all of her evidence.” Gibson v. Mayor &

Council of City of Wilmington, 355 F.3d 215, 222 (3d

Cir. 2004) (quoting Celotex Corp. v. Catrett, 477 U.S.

317, 326 (1986)). By filing its own motion for summary

judgment, Cisco was on notice that anticipation was before the court, and Cisco had the opportunity to put

forth its best evidence. Additionally, SRI did argue, in

opposition to Cisco’s summary judgment motion, that

the district court should outright reject Cisco’s assertion of invalidity. J.A. 31650 (“Cisco’s assertion of invalidity should be rejected … .”). Indeed, SRI expressly

took the position that EMERALD 1997 “does not anticipate any claim of the ’203 or ’615 patents.” J.A. 31678.

Thus, any notice requirement was satisfied because

Cisco itself indicated that the issue was ripe for summary adjudication and SRI took the position that the

claims were not anticipated. Accordingly, we see no

error in the sua sponte nature of the district court’s order and we affirm the summary judgment of no anticipation.

IV

Cisco also appeals the district court’s denial of

JMOL that it did not willfully infringe the asserted patents because the jury’s willfulness finding is not supported by substantial evidence. We agree that the jury’s finding that Cisco willfully infringed the patents-insuit prior to receiving notice thereof is not supported

by substantial evidence and therefore vacate and remand.

We review decisions on motions for JMOL under

the law of the regional circuit. Energy Transp. Grp.

Inc. v. William Demant Holding A/S, 697 F.3d 1342,

1350 (Fed. Cir. 2012). The Third Circuit reviews dis-

47a

trict court decisions on such motions de novo. Acumed

LLC v. Adv. Surgical Servs., Inc., 561 F.3d 199, 211 (3d

Cir. 2009) (citing Monteiro v. City of Elizabeth, 436

F.3d 397, 404 (3d Cir. 2006)). In the Third Circuit, a

“court may grant a judgment as a matter of law contrary to the verdict only if ‘the record is critically deficient

of the minimum quantum of evidence’ to sustain the

verdict.” Id. (citing Gomez v. Allegheny Health Servs.,

Inc., 71 F.3d 1079, 1083 (3d Cir. 1995)). The court

should grant JMOL “sparingly” and “only if, viewing

the evidence in the light most favorable to the nonmovant and giving it the advantage of every fair and

reasonable inference, there is insufficient evidence from

which a jury reasonably could find liability.” Marra v.

Phila. Hous. Auth., 497 F.3d 286, 300 (3d Cir. 2007)

(quoting Moyer v. United Dominion Indus., Inc., 473

F.3d 532, 545 n.8 (3d Cir. 2007)).

As the Supreme Court stated in Halo, “[t]he sort of

conduct warranting enhanced damages has been variously described in our cases as willful, wanton, malicious, bad-faith, deliberate, consciously wrongful, flagrant, or—indeed—characteristic of a pirate.” Halo

Elecs., Inc. v. Pulse Elecs., Inc., 136 S. Ct. 1923, 1932

(2016). While district courts have discretion in deciding

whether or not behavior rises to that standard, such

findings “are generally reserved for egregious cases of

culpable behavior.” Id. Indeed, as Justice Breyer emphasized in his concurrence, it is the circumstances that

transform simple “intentional or knowing” infringement into egregious, sanctionable behavior, and that

makes all the difference. Id. at 1936 (Breyer, J., concurring). A patentee need only show by a preponderance of the evidence the facts that support a finding of

willful infringement. Id. at 1934.

48a

In denying Cisco’s motion for JMOL on willfulness,

the district court concluded that the jury’s willfulness

determination was supported by two evidentiary bases.

First, the court identified evidence that “key Cisco employees did not read the patents-in-suit until their depositions.” Post-Trial Motions Op., 254 F. Supp. 3d at

717. Second, the court identified evidence that Cisco

designed the products and services in an infringing

manner and that Cisco instructed its customers to use

the products and services in an infringing manner.

Based on these two facts, the district court denied Cisco’s renewed motion for JMOL on willfulness, stating

that “[v]iewing the record in the light most favorable to

SRI, substantial evidence supports the jury’s subjective willfulness verdict.” Id.

On appeal, SRI identifies additional evidence that

purportedly supports the jury’s willfulness verdict.

Specifically, SRI presented evidence that Cisco expressed interest in the patented technology and met

with SRI’s inventor in 2000 before developing its infringing products. J.A. 1484-86; J.A. 5027. Additionally, SRI submitted evidence that Cisco received a notice

letter from SRI’s licensing consultant on May 8, 2012,

informing Cisco of the asserted patents (a year before

SRI filed the complaint). Finally, like the district court,

SRI makes much of the fact that “key engineers” did

not look at SRI’s patents until SRI took their depositions during this litigation. In particular, Cisco engineers Martin Roesch and James Kasper did not look at

the patent until their depositions in 2015.

Even accepting this evidence as true and weighing

all inferences in SRI’s favor, we conclude that the record is insufficient to establish that Cisco’s conduct rose

to the level of wanton, malicious, and bad-faith behavior

required for willful infringement. First, it is undisput-

49a

ed that the Cisco employees who did not read the patents-in-suit until their depositions were engineers

without legal training. Given Cisco’s size and resources, it was unremarkable that the engineers—as

opposed to Cisco’s in-house or outside counsel—did not

analyze the patents-in-suit themselves. The other rationale offered by the district court—that Cisco designed the products and services in an infringing manner and that Cisco instructed its customers to use the

products and services in an infringing manner—is nothing more than proof that Cisco directly infringed and

induced others to infringe the patents-in-suit.

It is undisputed that Cisco did not know of SRI’s

patent until May 8, 2012, when SRI sent its notice letter to Cisco.

Oral Arg. at 23:46, available at

http://oralarguments.cafc.uscourts.gov/default.aspx?fl=

2017-2223.mp3. It is also undisputed that this notice

letter was sent years after Cisco independently developed the accused systems and first sold them in 2005

(Cisco) and 2007 (Sourcefire). As SRI admits, the patents had not issued when the parties met in May 2000.

Indeed, the patent application for the parent ’203 patent was not even filed until several months after the

parties met. Thus, Cisco could not have been aware of

the patent application.

While the jury heard evidence that Cisco was

aware of the patents in May 2012, before filing of the

lawsuit, we do not see how the record supports a willfulness finding going back to 2000. As the Supreme

Court recently observed, “culpability is generally

measured against the knowledge of the actor at the

time of the challenged conduct.” Halo, 136 S. Ct. at

1933. Similarly, Cisco’s allegedly aggressive litigation

tactics cannot support a finding of willful infringement

going back to 2000, especially when the litigation did

50a

not start until 2012. Finally, Cisco’s decision not to

seek an advice-of-counsel defense is legally irrelevant

under 35 U.S.C. § 298.

Viewing the record in the light most favorable to

SRI, the jury’s verdict of willful infringement before

May 8, 2012 is not supported by substantial evidence.

Given the general verdict form, we presume the jury

also found that Cisco willfully infringed after May 8,

2012. When reviewing a denial of JMOL, “where there

is a black box jury verdict, as is the case here, we presume the jury resolved underlying factual disputes in

favor of the verdict winner and leave those presumed

findings undisturbed if supported by substantial evidence.” Arctic Cat Inc. v. Bombardier Recreational

Prods. Inc., 876 F.3d 1350, 1358 (Fed. Cir. 2017), (citing

WBIP, LLC v. Kohler Co., 829 F.3d 1317, 1326 (Fed.

Cir. 2016)), cert. denied, 139 S. Ct. 143 (2018). We leave

it to the district court to decide in the first instance

whether the jury’s presumed finding of willful infringement after May 8, 2012 is supported by substantial evidence.6 In so doing, the court should bear in

mind the standard for willful infringement, as well as

the above analysis regarding SRI’s evidence of willfulness. Accordingly, we vacate and remand the district

6

We recognize that, ideally, it should not fall to the district

court to determine when, if ever, willful infringement began

through the mechanism of JMOL. Rather, the question of when

willful infringement began is a fact issue that would have been

best presented to the jury in a special verdict form with appropriate jury instructions. Better yet, perhaps SRI could have recognized the shortcomings in its case and presented a more limited

case of willful infringement from 2012 onwards. Or perhaps Cisco

could have filed a motion for summary judgment of no willful infringement prior to May 8, 2012.

51a

court’s denial of Cisco’s renewed motion for JMOL of no

willful infringement.

Cisco also argues that the district court abused its

discretion by doubling damages. Enhanced damages

under § 284 are predicated on a finding of willful infringement. Because we conclude that the jury’s finding of willfulness before 2012 was not supported by

substantial evidence, we do not reach the propriety of

the district court’s award of enhanced damages. Instead, we vacate the award of enhanced damages and

remand for further consideration along with willfulness.

V

We next turn to the district court’s award of attorneys’ fees under § 285, which we vacate and remand for

further consideration. Under § 285, a “court in exceptional cases may award reasonable attorney fees to the

prevailing party.” An “exceptional” case under § 285 is

“one that stands out from others with respect to the

substantive strength of a party’s litigating position

(considering both the governing law and the facts of the

case) or the unreasonable manner in which the case was

litigated.” Octane Fitness, LLC v. ICON Health

& Fitness, Inc., 572 U.S. 545, 554 (2014). The party

seeking fees must prove that the case is exceptional by

a preponderance of the evidence, and the district court

makes the exceptional case determination on a case-bycase basis considering the totality of the circumstances.

See id. at 554, 557.

We review a district court’s grant or denial of attorneys’ fees for an abuse of discretion, which is a highly deferential standard of review. Highmark Inc. v.

Allcare Health Mgmt. Sys., Inc., 572 U.S. 559, 564

(2014); Bayer CropScience AG v. Dow AgroSciences

LLC, 851 F.3d 1302, 1306 (Fed. Cir. 2017) (citing Men-

52a

tor Graphics Corp. v. Quickturn Design Sys., Inc., 150

F.3d 1374, 1377 (Fed. Cir. 1998)). To meet the abuse-ofdiscretion standard, the appellant must show that the

district court made “a clear error of judgment in weighing relevant factors or in basing its decision on an error

of law or on clearly erroneous factual findings.” Bayer,

851 F.3d at 1306 (quoting Mentor Graphics, 150 F.3d at

1377); see also Highmark, 572 U.S. at 563 n.2.

We see no such error in the district court’s determination that this was an exceptional case. The district

court found:

There can be no doubt from even a cursory review of the record that Cisco pursued litigation

about as aggressively as the court has seen in

its judicial experience. While defending a client

aggressively is understandable, if not laudable,

in the case at bar, Cisco crossed the line in several regards.

Post-Trial Motions Op., 254 F. Supp. 3d at 722.

The district court further explained that “Cisco’s

litigation strategies in the case at bar created a substantial amount of work for both SRI and the court,

much of which work was needlessly repetitive or irrelevant or frivolous.” Id. at 723 (footnotes omitted). Indeed, the district court inventoried Cisco’s aggressive

tactics, including maintaining nineteen invalidity theories until the eve of trial but only presenting two at trial and pursuing defenses at trial that were contrary to

the court’s rulings or Cisco’s internal documents. Id. at

722. Nevertheless, the district court relied in part on

the fact that the jury found that Cisco’s infringement

was willful in its determination to exercise its discretion pursuant to § 285 to award SRI its attorneys’ fees

and costs. Id. at 723. Accordingly, we vacate the dis-

53a

trict court’s award of attorneys’ fees and remand for

further consideration along with willfulness.

We take no issue with the district court’s award of

attorneys’ fees at the attorneys’ billing rates without

adjusting them to Delaware rates. At the same time,

however, the district court erred in granting all of

SRI’s fees. Section 285 permits a prevailing party to

recover reasonable attorneys’ fees, but not fees for

hours expended by counsel that were “excessive, redundant, or otherwise unnecessary.” Hensley v. Eckerhart, 461 U.S. 424, 434 (1983). We accordingly conclude that the district court should have reduced SRI’s

total hours to eliminate clear mistakes. For example,

one billing entry reads “DON’T RELEASE, CLIENT

MATTER NEEDS TO BE CHANGED.” J.A. 32384.

Accordingly, should the district court award attorneys’

fees on remand, it must remove attorney hours clearly

included by mistake in its calculation of reasonable attorneys’ fees.

VI

We review for abuse of discretion a district court’s

grant of an ongoing royalty. Whitserve, LLC v. Comput. Packages, Inc., 694 F.3d 10, 35 (Fed. Cir. 2012).

Here, the district court did not abuse its discretion in

awarding “a 3.5% compulsory license for all postverdict sales.” Post-Trial Motions Op., 254 F. Supp. 3d

at 724. The district court’s ongoing royalty rate equals

the rate found by the jury and the base is limited to the

“accused products and services.” J.A. 182.

On appeal, Cisco argues that the district court

abused its discretion in awarding the 3.5% ongoing royalty on “all post-verdict sales” without considering Cisco’s design-arounds. According to Cisco, the court was

obligated to assess whether Cisco’s redesigned prod-

54a

ucts and services were more than colorably different

from those products and services adjudicated at trial,

and if not, whether those redesigned products and services infringe. To this end, Cisco moved to supplement

its post-trial briefing with declarations describing its

redesign efforts. Cisco argues that the district court

abused its discretion by denying its motion to supplement.7 We disagree. The district court properly exercised its discretion in denying Cisco’s motion to supplement the record regarding alleged post-verdict design-around activity. Cisco did not redesign its products until after trial, and Cisco did not file its motion to

supplement until after completion of post-trial briefing.

Given the stage of the proceedings and SRI’s opposition, the trial court acted within its discretion when

denying Cisco’s motion to supplement.

To the extent the district court’s order is unclear—

and we think it is not—we reconfirm that the ongoing

royalty on post-verdict sales is limited to products that

were actually found to infringe and products that are

not colorably different. We discern no error in the district court’s determination that Cisco’s submissions

were untimely. Nevertheless, we acknowledge that the

district court has not yet determined whether products

7

Finally, Cisco argues that, in the same order in which the

court stated that “[t]here are no post-verdict royalties,” the court

awarded a post-verdict royalty—an internal inconsistency. J.A.

175. We do not ascribe weight to the apparent clerical error creating the inconsistency. The district court’s final judgment order is

clear that “Cisco shall pay a 3.5% compulsory license on all postverdict sales of the accused products and services.” J.A. 182. To

the extent that clear statement conflicts with the single sentence

in the memorandum opinion, we think the court made its intentions clear in its final judgment and we see no error by the district

court.

55a

and services that were not accused (that is, changed

after the jury verdict) are colorably different for purposes of ongoing royalty calculations. Such an issue

could be resolved in a future proceeding.

CONCLUSION

For the reasons above, we affirm the district

court’s denial of summary judgment that the asserted

claims are patent-ineligible. We also agree with the

district court’s construction of “network traffic data”

and affirm the district court’s grant of summary judgment of no anticipation. We vacate and remand the district court’s denial of Cisco’s renewed motion for judgment as a matter of law that Cisco did not willfully infringe the asserted claims. Accordingly, we vacate and

remand the district court’s awards of enhanced damages and attorneys’ fees. Finally, we affirm the district

court’s orders granting enhanced damages and ongoing

royalties.

AFFIRMED-IN-PART, VACATED-IN-PART,

AND REMANDED

COSTS

No costs.

56a

UNITED STATES COURT OF APPEALS

FOR THE FEDERAL CIRCUIT

2017-2223

SRI INTERNATIONAL, INC.,

Plaintiff-Appellee,

v.

CISCO SYSTEMS, INC.,

Defendant-Appellant.

Appeals from the United States District Court for the

District of Delaware in No. 1:13-cv-01534-SLR-SRF,

Judge Sue L. Robinson.

LOURIE, Circuit Judge, dissenting.

I respectfully dissent from the majority’s decision

upholding the eligibility of the claims. In my view, they

are clearly abstract. In fact, they differ very little from

the claims in Electric Power Group, LLC v. Alstom

S.A., 830 F.3d 1350, 1355 (Fed. Cir. 2016), where we

found the claims to be abstract.

The majority opinion focuses on claim 1 of U.S. Patent 6,711,615 (“the ’615 patent”), which recites:

1. A computer-automated method of hierarchical event monitoring and analysis within an

enterprise network comprising:

deploying a plurality of network monitors

in the enterprise network;

detecting, by the network monitors, suspicious network activity based on analysis of

57a

network traffic data selected from one or

more of the following categories: {network

packet data transfer commands, network

packet data transfer errors, network packet data volume, network connection requests, network connection denials, error

codes included in a network packet, network connection acknowledgements, and

network packets indicative of well-known

network-service protocols};

generating, by the monitors, reports of said

suspicious activity; and

automatically receiving and integrating the

reports of suspicious activity, by one or

more hierarchical monitors.

Similarly, the claim we reviewed in Electric Power

Group recited “[a] method of detecting events on an interconnected electric power grid in real time over a

wide area and automatically analyzing the events on

the interconnected electric power grid,” with the method comprising eight steps, including “receiving data,”

“detecting and analyzing events in real time,” “displaying the event analysis results and diagnoses of events,”

“accumulating and updating measurements,” and “deriving a composite indicator of reliability.” 830 F.3d at

1351-52.

While that claim was lengthy, with eight steps, it

merely described selecting information by content or

source for collection, analysis, and display. Id. at 1351.

In finding the claim directed to an abstract idea, we

reasoned that “collecting information, including when

limited to particular content (which does not change its

character as information)” was an abstract idea. Id. at

1353. Limiting the claim to a particular technological

58a

environment—power-grid monitoring—was insufficient

to transform it into a patent-eligible application of the

abstract idea at its core. Id. at 1354. The claim was

rooted in computer technology only to the extent that

the broadly-recited steps required a computer. At step

two, we noted that the claim did not require an “inventive set of components or methods … that would

generate new data,” and did not “invoke any assertedly

inventive programming.” Id. at 1355.

This case is hardly distinguishable from Electric

Power Group. The claims in that case are said in the

majority opinion to only be drawn to using computers

as tools to solve a problem, rather than improving the

functionality of computers and computer networks.

The claims here recite nothing more than deploying

network monitors, detecting suspicious network activity, and generating and handling reports. The detecting

of the suspicious activity is based on “analysis” of traffic data, but the claims add nothing concerning specific

means for doing so. The claims only recite the moving

of information. The computer is used as a tool, and no

improvement in computer technology is shown or

claimed. There is no specific technique described for

improving computer network security.

I would find the claims directed to the abstract idea

of monitoring network security and proceed to step two

of Alice. As in Electric Power Group, however,

“[n]othing in the claims, understood in light of the specification, requires anything other than off-the-shelf,

conventional computer, network, and display technology … .” 830 F.3d at 1355. The claims recite “types of

information and information sources,” id., but such selection of information by content or source does not

provide an inventive concept. Id. The specification fur-

59a

ther makes clear that the claims only rely on generic

computer components, including a computer, memory,

processor, and mass storage device. See ’615 patent,

col. 14 ll. 50-57. Indeed, the specification even deems

the relevant memory bus and peripheral bus “customary components.” Id. col. 14 l. 55.

Finally, the majority opinion quotes from and paraphrases language from the specification that only recites results, not means for accomplishing them. See,

e.g., Majority Op. at 9. The claims as written, however,

do not recite a specific way of enabling a computer to

monitor network activity. As we noted in Electric

Power Group, result-focused, functional claims that effectively cover any solution to an identified problem,

like those at issue here, frequently run afoul of Alice.

830 F.3d at 1356.

Thus, I would find the claims to be directed to an

abstract idea at Alice step one, without an inventive

concept at step two, and reverse the district court’s

finding of eligibility. Because I would find the claims at

issue to be ineligible, I would not reach the remaining

issues in the case.

61a

APPENDIX D

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF DELAWARE

[Redacted]

Civ. No. 13-1534-SLR

SRI INTERNATIONAL, INC.,

Plaintiff,

v.

CISCO SYSTEMS, INC.

Defendant.

Filed: June 1, 2017

MEMORANDUM OPINION

SIGNED.

Dated: May 25, 2017

Wilmington, Delaware

[Written Signature]

Sue L. Robinson, Senior District Judge

I.

INTRODUCTION

On September 4, 2013, plaintiff SRI International,

Inc. (“SRI”) filed suit against defendant Cisco Systems

Inc. (“Cisco”), alleging infringement of U.S. Patent No.

6,711,615 (“the ‘615 patent”) and 6,484,203 (“the ‘203 pa-

62a

tent”) (collectively, “the patents”). (D.I. 1) On December 18, 2013, Cisco answered the complaint and counterclaimed for non-infringement and invalidity. (D.I. 9)

SRI answered the counterclaims on January 13, 2014.

(D.I. 11) The court issued a claim construction order on

May 14, 2015. (D.I. 138) In a memorandum opinion and

order dated April 11, 2016, the court resolved several

summary judgment motions. (D.I. 301; D.I. 302)

The court held an eight-day jury trial from May 211, 2016 on infringement, validity, willfulness, and damages of claims 1, 2, 13, and 14 of the ‘615 patent and

claims 1, 2, 12, and 13 of the ‘203 patent (“the asserted

claims”). On May 12, 2016, the jury returned a verdict

that Cisco intrusion protection system (“IPS”) products, Cisco remote management services, Cisco IPS

services, Sourcefire IPS products, and Sourcefire professional services directly and indirectly infringe the

asserted claims of the ‘615 and ‘203 patents. (D.I. 337 at

1-4) The jury determined that the asserted claims are

not invalid. (D.I. 337 at 6-7) As a consequence of this

infringement, the jury awarded SRI a 3.5% reasonable

royalty amounting to $8,680,000 for sales of Cisco products and services and $14,980,000 for sales of Cisco/Sourcefire products and services, for a total of

$23,660,000. (D.I. 337 at 8) The jury also found that

SRI had established, by clear and convincing evidence,

that Cisco’s infringement was willful. (D.I. 337 at 5)

Presently before the court are the following motions: (1) Cisco’s motion for judgment as a matter of

law, new trial, and remittitur (D.I. 351); (2) SRl’s motion for attorney fees (D.I. 349); and (3) Cisco’s motion

to supplement the record (D.I. 385). The court has jurisdiction pursuant to 28 U.S.C. §§ 1331 and 1338(a).

63a

II. BACKGROUND

A. The Parties

SRI is an independent, not-for-profit research institute incorporated under the laws of the State of California, with its principal place of business in Menlo

Park, California. (D.I. 1 at ¶ 1) SRI conducts clientsupported research and development for government

agencies, commercial businesses, foundations, and other organizations. (Id. at ¶ 6) Among its many areas of

research, SRI has engaged in research related to computer security and, more specifically, to large computer

network intrusion detection systems and methods.

(Id.) Cisco is a corporation organized and existing under the laws of the State of California, with its principal

place of business in San Jose, California. (Id. at ¶ 2)

Cisco provides various intrusion prevention and intrusion detection products and services. (Id. at ¶ 14)

B. The Technology

The patents relate to the monitoring and surveillance of computer networks for intrusion detection. In

particular, the patents teach a computer-automated

method of hierarchical event monitoring and analysis

within an enterprise network that allows for real-time

detection of intruders. Upon detecting any suspicious

activity, the network monitors generate reports of such

activity. The claims of the patents focus on methods

and systems for deploying a hierarchy of network monitors that can generate and receive reports of suspicious network activity.

The ‘615 patent (titled “Network Surveillance”) is a

continuation of the ‘203 patent (titled “Hierarchical

Event Monitoring and Analysis”), and the patents

share a common specification and priority date of No-

64a

vember 9, 1998. (D.I 179 at 1) The asserted claims include independent claims 1 and 13 of the ‘615 patent,

which claims read as follows:

1. A computer-automated method of hierarchical event monitoring and analysis within an enterprise network comprising:

deploying a plurality of network monitors in

the enterprise network;

detecting, by the network monitors, suspicious

network activity based on analysis of network traffic data selected from one or more

of the following categories: {network packet data transfer commands, network packet

data transfer errors, network packet data

volume, network connection requests, network connection denials, error codes included in a network packet, network connection acknowledgements, and network

packets indicative of well-known networkservice protocols};

generating, by the monitors, reports of said

suspicious activity; and

automatically receiving and integrating the reports of suspicious activity, by one or more

hierarchical monitors.

(‘615 patent, 15:1-21)

13. An enterprise network monitoring system

comprising:

a plurality of network monitors deployed within an enterprise network, said plurality of

network monitors detecting suspicious

network activity based on analysis of net-

65a

work traffic data selected from one or more

of the following categories: {network packet data transfer commands, network packet

data transfer errors, network packet data

volume, network connection requests, network connection denials, error codes included in a network packet, network connection acknowledgements, and network

packets indicative of well-known networkservice protocols};

said network monitors generating reports of

said suspicious activity; and

one or more hierarchical monitors in the enterprise network, the hierarchical monitors

adapted to automatically receive and integrate the reports of suspicious activity.

(‘615 patent, 15:56-16:6)

III. STANDARD OF REVIEW

A. Renewed Motion for Judgment as a Matter of

Law

The Federal Circuit “review[s] a district court’s

denial of judgment as a matter of law under the law of

the regional circuit. WBIP, LLC v. Kohler Co., 829

F.3d 1317, 1325 (Fed. Cir. 2016) (citation omitted). In

the Third Circuit, a “court may grant a judgment as a

matter of law contrary to the verdict only if ‘the record

is critically deficient of the minimum quantum of evidence’ to sustain the verdict.” Acumed LLC v. Advanced Surgical Servs., Inc., 561 F.3d 199, 211 (3d Cir.

2009) (citing Gomez v. Allegheny Health Servs., Inc., 71

F.3d 1079, 1083 (3d Cir. 1995)); see also McKenna v.

City of Philadelphia, 649 F.3d 171, 176 (3d Cir. 2011).

The court should grant judgment as a matter of law

66a

“sparingly” and “only if, viewing the evidence in the

light most favorable to the nonmovant and giving it the

advantage of every fair and reasonable inference, there

is insufficient evidence from which a jury reasonably

could find liability.” Marra v. Philadelphia Hous.

Auth., 497 F.3d 286, 300 (3d Cir. 2007) (citing Moyer v.

United Dominion Indus., Inc., 473 F.3d 532, 545 n.8 (3d

Cir. 2007)). “In performing this narrow inquiry, [the

court] must refrain from weighing the evidence, determining the credibility of witnesses, or substituting [its]

own version of the facts for that of the jury. Id. (citing

Lightning Lube, Inc. v. Witco Corp., 4 F.3d 1153, 1166

(3d Cir. 1993)). Judgment as a matter of law may be

appropriate when there is “a purely legal basis” for reversal “that does not depend on rejecting the jury’s

findings on the evidence at trial.” Acumed, 561 F.3d at

211.

B. Motion for a New Trial

Federal Rule of Civil Procedure 59(a) provides, in

pertinent part:

A new trial may be granted to all or any of the

parties and on all or part of the issues in an action in which there has been a trial by jury, for

any of the reasons for which new trials have

heretofore been granted in actions at law in the

courts of the United States.

Fed. R. Civ. P. 59(a). The decision to grant or deny a

new trial is within the sound discretion of the trial

court and, unlike the standard for determining judgment as a matter of law, the court need not view the

evidence in the light most favorable to the verdict winner. See Allied Chem. Corp. v. Daiflon, Inc., 449 U.S.

33, 36 (1980); Leonard v. Stemtech Int’l Inc., 834 F.3d

376, 386 (3d Cir. 2016) (citing Olefins Trading, Inc. v.

67a

Han Yang Chem. Corp., 9 F.3d 282 (3d Cir. 1993));

LifeScan Inc. v. Home Diagnostics, Inc., 103 F. Supp.

2d 345, 350 (D. Del. 2000) (citations omitted); see also

9A Wright & Miller, Federal Practice and Procedure

§ 2531 (2d ed. 1994) (“On a motion for new trial the

court may consider the credibility of witnesses and the

weight of the evidence.”). Among the most common

reasons for granting a new trial are: (1) the jury’s verdict is against the clear weight of the evidence, and a

new trial must be granted to prevent a miscarriage of

justice; (2) newly-discovered evidence exists that would

likely alter the outcome of the trial; (3) improper conduct by an attorney or the court unfairly influenced the

verdict; or (4) the jury’s verdict was facially inconsistent. See Zarow-Smith v. N.J. Transit Rail Operations, 953 F. Supp. 581, 584-85 (D.N.J. 1997) (citations

omitted). The court must proceed cautiously, mindful

that it should not simply substitute its own judgment of

the facts and the credibility of the witnesses for those

of the jury. Rather, the court should grant a new trial

“only when the great weight of the evidence cuts

against the verdict and a miscarriage of justice would

result if the verdict were to stand.” Leonard, 834 F.3d

at 386 (citing Springer v. Henry, 435 F.3d 268, 274 (3d

Cir. 2006) and Williamson v. Consol. Rail Corp., 926

F.2d 1344, 1352-53 (3d Cir. 1991)) (internal quotation

marks omitted).

C. Attorney Fees

Section 285 provides, in its entirety, “[t]he court in

exceptional cases may award reasonable attorney fees

to the prevailing party.” 35 U.S.C. § 285. “When deciding whether to award attorney fees under § 285, a district court engages in a two-step inquiry.” MarcTec,

LLC v. Johnson & Johnson, 664 F.3d 907, 915 (Fed.

Cir. 2012). The court first determines whether the case

68a

is exceptional and, if so, whether an award of attorney

fees is justified. Id. at 915-16 (citations omitted). The

Supreme Court has defined “an ‘exceptional’ case [as]

simply one that stands out from others with respect to

the substantive strength of a party’s litigating position

(considering both the governing law and the facts of the

case) or the unreasonable manner in which the case was

litigated.” Octane Fitness LLC v. Icon Health & Fitness, Inc., __ U.S.__, 134 S. Ct. 1749, 1756 (2014).

District courts should consider the “totality of the

circumstances” and use their discretion to determine on

a case-by-case basis whether a case is “exceptional.”

Id. “[A] ‘nonexclusive’ list of ‘factors,’ [to consider] includ[es] ‘frivolousness, motivation, objective unreasonableness (both in the factual and legal components of

the case) and the need in particular circumstances to

advance considerations of compensation and deterrence.’ ” Id. at n.6. Cases which may merit an award of

attorney fees include “the rare case in which a party’s

unreasonable conduct—while not necessarily independently sanctionable—is nonetheless so ‘exceptional’

as to justify an award of fees” or “a case presenting either subjective bad faith or exceptionally meritless

claims.” Id. at 1757. A party seeking attorney fees under § 285 must prove the merits of their contentions by

a preponderance of the evidence. Id. at 1758.

IV. DISCUSSION

A. Cisco’s Renewed JMOL – Liability

Cisco renews its motion for judgment as a matter of

law as to infringement, arguing that “[t]he record lacks

substantial evidence to support the jury’s verdict of direct infringement, inducement, and contributory infringement.” (D.I. 352 at 1)

69a

1.

Standard

a.

Direct Infringement

A patent is infringed when a person “without authority makes, uses or sells any patented invention,

within the United States … during the term of the patent.” 35 U.S.C. § 271(a). To prove direct infringement, the patentee must establish that one or more

claims of the patent read on the accused device literally

or under the doctrine of equivalents. Advanced Cardiovascular Sys., Inc. v. Scimed Life Sys., Inc., 261 F.3d

1329, 1336 (Fed. Cir. 2001). A two-step analysis is employed in making an infringement determination.

Markman v. Westview Instruments, Inc., 52 F.3d 967,

976 (Fed. Cir. 1995), aff’d, 517 U.S. 370 (1996). First,

the court must construe the asserted claims to ascertain their meaning and scope, a question of law. Id. at

976-77; see also Teva Pharms. USA, Inc. v. Sandoz,

Inc., __ U.S.__, 135 S. Ct. 831, 837 (2015). The trier of

fact must then compare the properly construed claims

with the accused infringing product. See Markman, 52

F.3d at 976. This second step is a question of fact.

Spectrum Pharm., Inc. v. Sandoz Inc., 802 F.3d 1326,

1337 (Fed. Cir. 2015) (citing Bai v. L & L Wings, Inc.,

160 F.3d 1350, 1353 (Fed. Cir. 1998)).

“Direct infringement requires a party to perform

each and every step or element of a claimed method or

product.” Exergen Corp. v. Wal-Mart Stores, Inc., 575

F.3d 1312, 1320 (Fed. Cir. 2009) (quoting BMC Res.,

Inc. v. Paymentech, L.P., 498 F.3d 1373, 1378 (Fed. Cir.

2007)). “If any claim limitation is absent …, there is no

literal infringement as a matter of law.” Bayer AG v.

Etan Pharm. Research Corp., 212 F.3d 1241, 1247 (Fed.

Cir. 2000). If an accused product does not infringe an

independent claim, it also does not infringe any claim

70a

depending thereon. Ferring B.V. v. Watson Labs., lnc.Florida, 764 F.3d 1401, 1411 (Fed. Cir. 2014) (citing

Wahpeton Canvas Co., Inc. v. Frontier, Inc., 870 F.2d

1546, 1552 (Fed. Cir. 1989) (“One who does not infringe

an independent claim cannot infringe a claim dependent

on (and thus containing all the limitations of) that

claim.”)). However, “[o]ne may infringe an independent

claim and not infringe a claim dependent on that claim.”

Monsanto Co. v. Syngenta Seeds, Inc., 503 F.3d 1352,

1359 (Fed. Cir. 2007) (quoting Wahpeton Canvas, 870

F.2d at 1552) (internal quotations omitted). The patent

owner has the burden of proving literal infringement

by a preponderance of the evidence. Octane Fitness,

134 S. Ct. at 1758.

b. Indirect Infringement

To establish indirect infringement, a patent owner

has available two theories: active inducement of infringement and contributory infringement. 35 U.S.C.

§ 271(b) & (c). Liability for indirect infringement may

arise “if, but only if, [there is] … direct infringement.”

Limelight Networks, Inc. v. Akamai Technologies, Inc.,

_ U.S. _, 134 S. Ct. 2111, 2117 (2014) (citing Aro Mfg.

Co. v. Convertible Top Replacement Co., 365 U.S. 336,

341 (1961) (emphasis omitted)). The patent owner has

the burden of proving infringement by a preponderance

of the evidence. Octane Fitness, 134 S. Ct. at 1758.

Under 35 U.S.C. § 271(b), “whoever actively induces infringement of a patent shall be liable as an infringer.” “To prove induced infringement, the patentee

must show direct infringement, and that the alleged infringer knowingly induced infringement and possessed

specific intent to encourage another’s infringement.”

Toshiba Corp. v. Imation Corp., 681 F.3d 1358, 1363

(Fed. Cir. 2012) (quoting i4i Ltd. P’ship. v. Microsoft

71a

Corp., 598 F.3d 831, 851 (Fed. Cir. 2010)) (internal quotation marks omitted). “[I]nduced infringement under

§ 271(b) requires knowledge that the induced acts constitute patent infringement.” Global-Tech Appliances,

Inc. v. SEB S.A., 563 U.S. 754, 766 (2011). The

knowledge requirement can be met by a showing of either actual knowledge or willful blindness. See id. “[A]

willfully blind defendant is one who takes deliberate

actions to avoid confirming a high probability of

wrongdoing and who can almost be said to have actually known the critical facts.” Id. at 769 (citation omitted). “[I]nducement requires evidence of culpable conduct, directed to encouraging another’s infringement,

not merely that the inducer had knowledge of the direct

infringer’s activities.” DSU Medical Corp. v. JMS Co.,

Ltd., 471 F.3d 1293, 1306 (Fed. Cir. 2006) (en banc in

relevant part) (citations omitted).

To establish contributory infringement, the patent

owner must demonstrate the following: (1) an offer to

sell, a sale, or an import into the United States; (2) a

component or material for use in a patented process

constituting a material part of the invention; (3)

knowledge by the defendant that the component is especially made or especially adapted for use in an infringement of such patents; and (4) the component is

not a staple or article suitable for substantial noninfringing use. Fujitsu Ltd. v. Netgear Inc., 620 F.3d

1321, 1326 (Fed. Cir. 2010) (citing 35 U.S.C. § 271(c)).

Defendant “must know ‘that the combination for which

his component was especially designed was both patented and infringing.’ ” Global-Tech, 563 U.S. at 763

(citing Aro Mfg., 377 U.S. at 488).

72a

2.

Sourcefire IPS products and services

a. Direct infringement – “automatically

receiving and integrating the reports of

suspicious activity”

The jury found that the accused Sourcefire IPS

products directly infringe the asserted claims. (D.I. 337

at 2) Cisco argues that no reasonable jury could have

found that the Sourcefire IPS products “integrate reports of suspicious activity”1 as required by the asserted claims. (D.I. 352 at 3) Cisco contends that, “[u]nder

the court’s claim construction,” the claims require “integrating reports of multiple events, not merely evaluating a report of a single event.”2 (D.I. 352 at 3) SRI

does not dispute the “multiple event” limitation and argues that substantial evidence supports the jury’s finding of infringement. (D.I. 370 at 2)

i.

SRI’s evidence

SRl’s expert, Wenke Lee, PhD (“Dr. Lee”), referenced an internal Sourcefire document entitled “Compliance Rule Overview” and opined that the Sourcefire

IPS products integrate reports of suspicious activity

using rule nesting. (D.I. 396 at 959:22-961:9) For example, the referenced document states that:

For each kind of event, the rule can be constrained by related conditions … . Different

1

Found in claims 1 and 13 of the ‘615 patent, and claims 1 and

12 of the ‘203 patent.

2

The parties agreed to construe these terms as “[w]ithout

user intervention, receiving reports of suspicious activity and

combining those reports into a different end product; i.e., something more than simply collecting and reiterating data.” (D.I. 47 at

2)

73a

conditions for a compliance rule can be combined with an AND or OR operator. One or

more conditions can also be subordinated to another condition, also combined with an AND or

OR operator. All this together allows complex

rules to be built.

(PTX 787 at 7) Dr. Lee explained that “these compliance rules can work together to achieve the result of

correlation … the firing of one compliance rule can become a condition into another compliance rule.” (D.I.

396 at 960:24-961:2; PTX 787 at 7) Dr. Lee opined that

“with this nesting ability, … [one can] write very complex logic to implement very comprehensive correlation

analysis.” (D.I. 396 at 961:2-5; PTX 787 at 7) Referencing the Sourcefire 3D System User Guide, Dr. Lee explained that the product literature teaches users and

deploying organizations how to combine rules. (D.I. 396

at 961:10-962:6; DTX 840 at 1228)

In his rebuttal testimony, Dr. Lee repeated that

rule nesting works by creating a new rule that includes

“the condition [] that another rule has to already be satisfied.” (D.I. 399 at 1793:17-18) He explained that rule

nesting enables combination of multiple events because

rule nesting “means that you combine … the events described by these two rules” into a single event. (D.I.

399 at 1793:18-23) Dr. Lee showed where, in the

Sourcefire source code, rule nesting happens. (D.I. 399

at 1797:1-21)

Dr. Lee explained that his infringement opinion

was based, in part, on an independent test of

Sourcefire’s IPS products by NSS Labs. (D.I. 396 at

963:22-964:17; PTX 707 at 5, 20-21) Martin Roesch

(“Roesch”), Sourcefire’s founder and now Cisco’s vice

president and chief security architect, testified that

74a

NSS Labs is a well-known “third­party testing service”

that does “functional analysis of things like intrusion

prevention systems, firewalls, advanced malware protection systems and things like that.” (D.I. 398 at

1477:19-1478:5) The NSS Labs report states that the

Sourcefire IPS products “provide the means to infer

connections between multiple alerts and group them

together as incidents automatically.” (PTX 707 at 17)

Dr. Lee opined that this means that the “correlation

engine” within the accused Sourcefire products can “infer connections between multiple alerts.” (D.I. 396 at

964:12-13; 964:22-965:7)

SRI presented deposition testimony from end users

such as Kurt Truxal (“Truxal”), manager of global security at TransUnion, a Sourcefire and Cisco user. When

asked “what a correlation rule does,” Truxal said that

“[i]t allows you to correlate multiple events and call it a

specific singular event.” (D.I. 395 at 799:7-8; PTX 774)

Truxal verified that TransUnion uses Sourcefire products to “combine and nest conditions.” (D.I. 395 at

800:3-4) TransUnion, Truxal explained, also generates

correlation events which are used to take “multiple

events that happen in a sequence and rout[e] them together to create one unique individual event … [so

that] they add up to something that could be more interesting.” (D.I. 395 at 807:21-808:4)

ii. Cisco’s evidence

Cisco’s expert, Paul C. Clark, PhD (“Dr. Clark”),

explained the operation of the “compliance engine feature” of the Sourcefire Defense Center product. (D.I.

398 at 1574:25-1575:1) Dr. Clark opined that the “compliance engine feature” processes events from sensors

serially, “[a]s you’ll see here, we’re going to take the

next event and match it with the policy just like we did

75a

the first event, and then we’re going to fire one or more

rules. But firing one or more rules is not combining

multiple events.” (D.I. 398 at 1575:24-1576:3; PTX 787

at 7; See also D.I. 398 at 1600:8-13) Dr. Clark explained

that, in rule nesting, a base event is “going to be processed the same way [as rules in series], [by] tak[ing] it

across, correlat[ing] with a rule one in the policy, trigger[ing] that rule, and then mov[ing] it along. And now

you correlate it with Rule 2, same event, and just fire a

second rule.” (D.I. 398 at 1577:11-14; PTX 787 at 7, 21)

Cisco elicited cross examination testimony from Dr.

Lee in which he agreed that the accused Sourcefire IPS

products process rules “one event at a time.”3 (D.I. 399

at 1841:20-21)

iii. Analysis

The jury was asked to consider whether SRI presented a preponderance of evidence to demonstrate

that Cisco’s Sourcefire IPS products directly infringed

the asserted claims, either literally or under the doctrine of equivalents. (D.I. 336 at 23-25) Cisco argues

that no reasonable jury could find infringement of the

“automatically receiving and integrating the reports of

suspicious activity” limitation found in the asserted

3

Cisco presented attorney argument that Dr. Lee’s claim

that “Cisco’s ‘nested rules’ could combine more than one event” is

“inaccurate.” (D.I. 352 at 5) This is one of several arguments related to the “nested rules feature” that Cisco asserts must be present, independent of the correlation engine. During trial, the socalled “nested rules feature” was mentioned twice in testimony

from Cisco’s Edward Bedwell (“Bedwell”). (D.I. 398 at 1493:24;

1498:9) In its briefs, Cisco argues that SRI failed to demonstrate

infringement with respect to this so-called “nested rules feature”

on more than a dozen occasions. (D.I. 352 at 5, 6, 12, 13, 14, 24 &

n.4; D.I. 379 at 3, 5, 7, 12, and 13) There is no evidence in the record that Cisco made any of these arguments to the jury.

76a

claims, either literally or under the doctrine of equivalents.4 (D.I. 352 at 6) Cisco contends that Dr. Lee’s

testimony under cross examination leads to the conclusion that “the claims undisputedly require[] integrating

reports of multiple events, not merely evaluating a report of a single event.”5 (D.I. 352 at 3, citing D.I. 396 at

1082:20-1083:5)

The court instructed the jury that “automatically

receiving and integrating the reports of suspicious activity” means “[w]ithout user intervention, receiving

reports of suspicious activity and combining those reports into a different end product; i.e., something more

than simply collecting and reiterating data.” (D.I. 336

at 21) Dr. Lee opined that correlation rules, combined

with rule nesting, receive reports of suspicious activity

and combine those reports into a different product.

(D.I. 396 at 960:24-961:2; PTX 787 at 7; DTX 840 at

1228) Truxal expressed a similar opinion. (D.I. 395 at

807:21-808:4) Dr. Clark opined that this was not possible, because the Sourcefire products process events serially. (D.I. 398 at 1577:11-14; PTX 787 at 7, 21)

On the record at bar, SRl’s expert provided more

than conclusory testimony in order to explain his con4

Cisco argues that “no reasonable jury could have found that

the Sourcefire products satisfy the claim requirement of integrating reports of multiple events under the doctrine of equivalents.”

(D.I. 352 at 6) Cisco avers that “SRI offered no evidence that

Sourcefire’s accused single-event correlation is insubstantially different from the integration of multiple events required by all asserted claims.” (Id.) There is no evidence in the record that SRI

asserted an equivalents argument with respect to this claim limitation. Therefore, the court denies Cisco’s motions with respect to

equivalents.

5

This proposed construction was not presented to the jury.

77a

clusions to the jury. SRI also presented a fact witness

to corroborate SRl’s expert. The jury credited such

testimony over that of Cisco’s expert. The court declines to re-weigh the evidence or the credibility of the

witnesses. Viewing the record in the light most favorable to SRI, substantial evidence supports the jury’s

verdict. For these reasons, Cisco’s renewed motion for

JMOL is denied.

b. Indirect infringement – induced infringement

The jury found that Cisco induced infringement of

the asserted claims by Sourcefire IPS products and

services. (D.I. 337 at 4) Cisco argues that no reasonable jury could have found that Cisco induced infringement of the Sourcefire IPS products and services. (D.I.

352 at 13) Cisco contends that SRI failed to demonstrate direct infringement, either through customers

Home Depot and TransUnion or through survey results. (Id.) Cisco asserts that a jury could not have

concluded the teaching or encouragement factor because “SRI failed to present substantial evidence that

Cisco actively encouraged its customers to enable or

use any allegedly infringing nested rules.” (Id. at 14)

Cisco argues that, SRI did not provide evidence that

“Cisco ‘knew the acts’ of its customers ‘were infringing.’ ” (Id.) SRI responds that it “presented extensive

evidence that Cisco induced infringing deployment and

use of the Sourcefire IPS Products and Services by its

customers.” (D.I. 370 at 12)

i.

SRI’s evidence

SRI presented evidence of direct infringement by

the accused Sourcefire IPS products as discussed

above. For example, when asked “what a correlation

rule does,” TransUnion’s Truxal said that “[i]t allows

78a

you to correlate multiple events and call it a specific

singular event.” (D.I. 395 at 799:7-8; PTX 774) Truxal

verified that TransUnion uses the accused Sourcefire

products to “combine and nest conditions.” (D.I. 395 at

800:3-4) TransUnion, Truxal explained, also generates

correlation events which are used to take “multiple

events that happen in a sequence and rout[e] them together to create one unique individual event … [so

that] they add up to something that could be more interesting.” (D.I. 395 at 807:21-808:4)

SRI presented circumstantial evidence of direct infringement in the form of the NSS Labs report. (PTX

707 at 5, 17, 20-21) Dr. Lee’s aforementioned analysis

of Cisco source code was also directed at the question of

direct infringement by Sourcefire IPS products. (D.I.

399 at 1793:17-23, 1797:1-21) SRl’s survey expert, Ken

Van Liere, PhD (“Dr. Van Liere”), presented the results of a survey of Cisco customers and opined that,

based upon the survey results, “78 percent of the people who have one [Sourcefire product] in their U.S.

network said that [the correlation compliance engine]

feature was enabled.” (D.I. 395 at 728:20-729:2) Table

10 of the survey results show that 78% of Sourcefire

users selected “Correlation/Compliance Engine” in response to the question: “which of the following, if any,

are enabled in one or more of the Sourcefire Products

that are currently installed within your organization’s

United States network?” (PTX 1093 at table 10)

Dr. Lee opined that “using the correlation feature”

in the Sourcefire IPS products is “one of the best practices recommended [by Cisco] to customers.” (D.I. 396

at 977:1-6) In reference to various Cisco user guides,

Dr. Lee testified that these user guides teach

Sourcefire customers why, and how, to use correlation

rules. (Id. at 978:1-8; PTX 787 at 7 (Compliance Rule

79a

Overview); PTX 784 at 62 (Best Practices Guide); DTX

840 at 1228 (Sourcefire 3D System User Guide); PTX

151 at 39-7 (FireSIGHT System User Guide))

SRI elicited testimony, on cross examination, from

Cisco’s Roesch that he did not analyze infringement or

read the patents until his deposition in the fall of 2015,

which was two years after the filing of the present suit.

(D.I. 398 at 1478:17-1479:13) Roesch opined that

“[w]hen there are deeply technical issues on the table

and there has been a legal application of understanding

to those deep technical issues,” his general attitude is

that Cisco has not infringed a patent, because people

who are bringing suits do not understand the technology. (Id. at 1481:22-1482:2) Roesch also testified that

his initial impression about the case at bar was that

SRI “[d]idn’t understand our technology.” (Id. at

1482:10-13) SRl’s former vice president of legal and

business affairs and general counsel, Richard Abramson (“Abramson”), testified in a deposition that during

licensing discussions (before the case at bar had been

filed) Cisco had presented noninfringement contentions

that SRI had rebutted. (D.I. 397 at 1233:15-22)

ii. Cisco’s evidence

Cisco points to various aspects of SRl’s evidence

that it contends are a failure of proof of direct infringement. For example, SRI deposed Jeffrey Lee

Mitchell (“Mitchell”), who is the director of IT security

at Home Depot. When asked whether Home Depot uses correlation rules in the company’s “defense center,”

Mitchell testified “I don’t think so … . Because our correlation that we would begin within SOC is not done

with the management console. It’s done with correlation rules within Splunk.” (D.I. 395 at 681:10-17)

Mitchell repeated “I don’t know if [the correlation rules

80a

are] enabled on the defense center. I do know that we

are not using it in the SOC for correlation.” (D.I. 395 at

682:9-11) Cisco asserts that Mitchell’s testimony means

that “Home Depot does not use the accused correlation

engine and leaves it disabled.” (D.I. 352 at 13) Cisco

argues that “TransUnion uses the correlation engine

but not the nested rules feature.” (Id.) In support,

Cisco points to Truxal’s testimony that TransUnion

does not have the defense center configured to “generate reports based on correlated events.” (D.I. 395 at

808:5-13) With respect to Dr. Van Liere’s survey, Cisco

avers that the “survey failed to include any questions

about the customers’ use of the accused nested rules

feature.” (D.I. 352 at 13-14, citing PTX 1093 at table

10)

Cisco argues that “SRI failed to present substantial

evidence that Cisco actively encouraged its customers

to enable or use any allegedly infringing nested rules.”

(D.I. 352 at 14) For example, Dr. Lee testified that one

of the ways Cisco encouraged its customers to infringe

was by providing customer support for Sourcefire.

(D.I. 396 at 980:6-981:5 (referencing deposition testimony by Cisco employee, Steven Alan Sturges (“Sturges”)

at D.I. 395 at 759:8-770:2)) Cisco contends that this

failure of proof is supported by Dr. Clark’s testimony

that “the compliance engine is the accused feature in

the Defense Center” but that the defense center does

“[l]ots of other things.”6 (D.I. 398 at 1571:3-16) Cisco

notes that three of the user guides presented by SRI do

not mention Sourcefire’s correlation engine or the accused nested rules feature. (D.I. 352 at 14) With re6

In support of this, Cisco cites generally to DTX 840

“Sourcefire 3D System User Guide,” which is a 2,000 page document.

81a

spect to the user guides that teach rule nesting, Cisco

avers that the teaching is limited to a single statement

that “You can nest rules.” (D.I. 352 at 14; See also DTX

840 at 1228, PTX 151 at 39-7). Cisco notes that the relevant Sourcefire User Guide (DTX 840) is dated July

2011, which it argues is “more than a year” before May

2012, when STI sent a letter informing Cisco of the infringement allegations.7 (D.I. 352 at 14; D.I. 398 at

1247:15-20) Moreover, Cisco contends that the trial

transcript demonstrates that SRI “attempt[ed] to establish induced infringement without addressing the

reasonableness of Cisco’s non-infringement defenses.”8

(D.I. 352 at 14-15, citing D.I. 400 at 1952:6-1957:15) In

its closing argument, Cisco made the following statement:

Indirect infringement. They’re right. Dr.

Clark said, our products don’t infringe. If they

don’t infringe, then no one else who uses them

can infringe. But we also didn’t have the intent. They did not show9 you what Abramson,

7

May 2012 is less than a year after July 2011.

8

Cisco argues that “the Federal Circuit recently rejected the

notion that ‘any time a defendant’s products are found to directly

infringe, the plaintiff has sufficiently established the defendant’s

intent to induce infringement.’ ” (D.I. 352 at 15, citing Warsaw

Orthopedic, Inc. v. NuVasive, Inc., 824 F.3d 1344, 1352 (Fed. Cir.

2016) (Reyna, J., concurring)) The Federal Circuit took a more

nuanced approach, “[t]o be clear, we do not suggest that inducement liability is [as] broad [as Judge Reyna suggests in his concurrence]. To show the intent to induce infringement, it is sufficient

that the plaintiff establish that a defendant’s asserted belief in

non-infringement was unreasonable.” Warsaw Orthopedic, 824

F.3d at 1351 n.2.

9

Cisco appears to argue that SRI did not address the reasonableness of Cisco’s noninfringement belief. (But see D.I. 397 at

82a

who was their former general counsel, admitted at deposition: Do you know if Cisco presented any noninfringement positions in those

license licensing discussions? At some point

they did make some argument as to why they

felt they didn’t infringe. That shows you we

felt we didn’t infringe. That does not add up to

that we knowingly told people to do things

knowing that it would infringe. I don’t know

why they didn’t tell you that. It’s their guy. I

think you’re not going to be terribly surprised,

but I really want you to say no to this one, too.

(D.I. 400 at 1988:21-1989:10)

iii. Analysis

The jury was asked to consider whether SRI presented a preponderance of evidence to demonstrate

that Cisco’s induced infringement of the asserted claims

by Sourcefire IPS products. (D.I. 336 at 26) The court

instructed the jury that SRI bore the burden to prove:

1. Defendant took some action intending to encourage or instruct its customers to perform acts

that you, the jury, find would directly infringe an

asserted claim;

2. Defendant was aware of the asserted patents

at the time of the alleged conduct and knew that its

customer’s acts (if taken) would constitute infringement of an asserted patent, or the defendant

believed there was a high probability that the acts

(if taken) would constitute infringement of an as1233:15-22 (“Question: Do you know if Cisco presented any noninfringement positions in those licensing discussions? Answer: At

some point they did make some argument as to why they felt they

didn’t infringe.”)

83a

serted patent but deliberately avoided confirming

that belief; and

3. Use by others of the defendant’s products or

services infringes one or more of the asserted

claims.

(Id.) As to the first factor, SRI presented evidence

that Cisco’s user guides and marketing materials teach

rule nesting and how to use the correlation engine.

(D.I. 370 at 13) Cisco argues that these materials are

insufficient to demonstrate that Cisco encouraged or

instructed its customers to enable or use rule nesting or

the correlation engine.10 (D.I. 352 at 14) Cisco argues

that the “Best Practices Guide” (PTX 784) predates

May 2012 (when SRI informed Cisco of its infringement

contentions) and cannot form a basis for inducement,

because Cisco could not have had knowledge of the potential infringement when it made the statement.11

However, even if Cisco had made this argument to the

jury (which the record shows it did not), Cisco did not

address (either in its briefs or to the jury) the timeliness of the other evidence presented by SRI. The jury

was presented with sufficient evidence to determine

whether Cisco took some action to encourage or instruct its customers to use the Sourcefire IPS products

in an infringing manner.

With respect to the intent factor, for the relevant

time period, SRI presented evidence that Cisco knew

about the patents and SRl’s belief that Cisco infringed

the patents. SRI also presented evidence that Cisco’s

10

There is no evidence that Cisco made this argument to the

jury.

11

Metro-Goldwyn-Mayer Studios, Inc. v. Grokster, Ltd., 518

F. Supp. 2d 1197, 1234 (C.D. Cal. 2007), is inapposite.

84a

Roesch did not read the patents until his deposition (a

period of nearly two years after filing suit) and James

Kasper (“Kasper”), a software engineering technical

leader at Cisco, was not asked to investigate the possibility of infringement. (D.I. 398 at 1479:9-13; D.I. 400 at

1953:10-1957:15) Cisco argues that its denial of infringement during “[t]he parties’ pre-suit discussions

confirm[s] Cisco’s reasonable belief in noninfringement.”12 (D.I. 352 at 15) The parties presented

sufficient evidence for a jury to conclude that either

Cisco knew that its customers’ acts (if taken) would

constitute infringement of the asserted claims or Cisco

believed there was a high probability that its customers’ acts (if taken) would constitute infringement of an

asserted claim but that Cisco deliberately avoided confirming that belief.

On the third factor, direct infringement, SRI presented evidence of infringement through Cisco customers at Home Depot and TransUnion. Cisco argues that

these customers cannot directly infringe the asserted

claims, because they do not use the relevant aspects

(rule nesting and compliance engine) of the accused

Sourcefire IPS products.13 SRI presented additional

evidence of infringement through Dr. Van Liere’s survey, including table 10, which (according to Dr. Van

Liere) supports the conclusion that 78% of Sourcefire

IPS customers use the “Correlation/Compliance En12

See supra, note 10. Moreover, Cisco argues that the exclusion of testimony by Roesch as to his opinion of noninfringement

would have overcome the willful blindness theory SRI presented

in closing arguments. The court declines to reconsider its decision.

13

See supra, note 10. For example, in its closing argument,

Cisco did not mention Truxal, Mitchell, TransUnion or Home Depot.

85a

gine” feature. (PTX 1093 at table 10) Cisco argues that

the survey does not address the rule nesting feature.

(D.I. 352 at 13-14) SRI argued to the jury that rule

nesting is implicit to the correlation engine. (See, e.g.,

D.I. 400 at 1947:10-1948:22) Cisco appears to argue that

rule nesting and the correlation engine are two separate features that must both be separately shown in order to demonstrate direct infringement.14 (D.I. 352 at

13-16) Sufficient evidence was presented to enable the

jury to decide whether Cisco’s customers directly infringe the asserted claims by using the Sourcefire IPS

products.

On the record at bar, SRI presented more than

conclusory evidence of inducement to the jury. The jury credited the testimony of SRl’s witnesses and exhibits over that of Cisco. The court declines to re-weigh

the evidence or the credibility of the witnesses. Viewing the record in the light most favorable to SRI, substantial evidence supports the jury’s verdict that Cisco

induced infringement of the asserted claims by its customers using Sourcefire IPS products. For these reasons, Cisco’s renewed motion for JMOL is denied.

3.

Cisco IPS products

Cisco argues that the asserted claims contain the

“hierarchical monitor” limitation and that no reasonable

jury could have found that the accused Cisco IPS products satisfy this claim limitation. (D.I. 352 at 7) Cisco

avers that “[d]espite the express claim requirement of

multiple (i.e., at least two) monitors in a hierarchy, SRI

14

See supra, note 10. Cisco mentioned rule nesting once in its

closing argument, “[c]an a nested rule in a correlation engine be

evaluated against multiple intrusion events? It cannot. How do

you know? I [Cisco’s Ted Bedwell] have actually reviewed the

source code.” (D.I. 400 at 1982:5-7) See supra, note 3.

86a

nevertheless based its infringement theory on the features inside a single Cisco IPS product as being both

the lower-level monitors and the hierarchical monitor

required by the claims.” (Id.)

At summary judgment, Cisco presented a similar

argument “that the SensorApp processing thread cannot simultaneously be both the alleged ‘network monitor and ‘hierarchical monitor’ under the claims because

they are not ‘separate and distinct structures.’ ” (D.I.

301 at 32) The court denied summary judgment of noninfringement and clarified that “[t]he claim language

and the parties’ constructions do not require that the

‘network monitor’ and ‘hierarchical monitor’ be separate structures.” (Id.) The court found genuine issues

of material fact as to “whether the Meta Event generator meets the [‘hierarchical monitor’] claim limitation.”

(Id.)

Cisco makes two arguments in support of its motion for JMOL: (1) a single Cisco IPS product cannot

satisfy the “plurality of network monitors”15 limitation;16 and (2) Dr. Lee’s testimony cannot support a jury finding of infringement of the “hierarchical monitor”17 limitation. (D.I. 352 at 7-8)

15

Found in the ‘615 patent at column 15, lines 5 and 57, and

the ‘203 patent at column 14, line 22 and column 15, line 2.

16

Cisco’s argument appears to involve a claim construction in

which the “accused lower-level monitors … [must] be independently configured or installed.” (D.I. 352 at 7) This claim construction

was not presented to the jury. For reasons to be discussed below,

the court addresses these arguments as a motion for reconsideration.

17

Found in the 615 patent at column 15, lines 20-21 and column 16, line 3, and the ‘203 patent at column 14, lines 34-35 and

column 15, line 13.

87a

a.

Reconsideration

A motion for reconsideration is the “functional

equivalent” of a motion to alter or amend judgment under Federal Rule of Civil Procedure 59(e). See Jones v.

Pittsburgh Nat’l Corp., 899 F.2d 1350, 1352 (3d Cir.

1990) (citing Fed. Kemper Ins. Co. v. Rauscher, 807

F.2d 345, 348 (3d Cir. 1986)). The standard for obtaining relief under Rule 59(e) is difficult to meet. The

purpose of a motion for reconsideration is to “correct

manifest errors of law or fact or to present newly discovered evidence.” Max’s Seafood Cafe ex rel. LouAnn, Inc. v. Quinteros, 176 F.3d 669, 677 (3d Cir. 1999).

A court should exercise its discretion to alter or amend

its judgment only if the movant demonstrates one of

the following: (1) a change in the controlling law; (2) a

need to correct a clear error of law or fact or to prevent

manifest injustice; or (3) availability of new evidence

not available when the judgment was granted. See id.

A motion for reconsideration is not properly grounded

on a request that a court rethink a decision already

made and may not be used “as a means to argue new

facts or issues that inexcusably were not presented to

the court in the matter previously decided.” Brambles

USA, Inc. v. Blocker, 735 F. Supp. 1239, 1240 (D. Del.

1990); see also Glendon Energy Co. v. Borough of Glendon, 836 F. Supp. 1109, 1122 (E.D. Pa. 1993).

In support of its request for reconsideration of the

denial of summary judgment of noninfringement, Cisco

presents attorney argument related to the “plurality of

monitors” limitations, but these are the same arguments Cisco made at summary judgment, and Cisco has

not presented additional facts or law to support its non-

88a

infringement position.18 (D.I. 352 at 7-8; See also D.I.

301 at 32) Therefore, the court denies Cisco’s request

for reconsideration.

b. Direct Infringement – “hierarchical

monitor”

Cisco argues that “SRI failed to prove that Cisco’s

IPS Products satisfy the claim requirement of a ‘hierarchical monitor’ that integrates reports from two or

more lower­level monitors,” alleging that “Dr. Lee []

changed his infringement theory” during the trial.

(D.1. 352 at 8) SRI agrees that “Dr. Lee misstated …

which box drawn in a marketing diagram represented

the meta event generator,” but argues that the location

of the meta event generator is not important and that

the meta event engine (or generator) corresponds to

the “hierarchical monitor” in the claims. (D.I. 370 at 7)

i.

SRI’s evidence

Dr. Lee opined that the meta event engine (or meta

event generator) meets the claim limitation of a “hierarchical monitor,” because it receives events “from the

lower level sensor app processing thread network mon18

Cisco cited to testimony from Dr. Lee (SRl’s expert), various Cisco employees, and to one question answered by Dr. Clark

(Cisco’s expert) opining that sensor apps cannot be configured independently. (See D.I. 398 at 1593:2-7 (“Q. Okay. Can a sensor

app -- can you go in and independently configure or install a sensor

app? A. It does not make sense. As I said, it’s an execution

stream in there. You can’t -- you don’t even know how many of

them there are going to be. It’s dependent upon the hardware that

you are running.”)) It is unclear how this testimony relates to Cisco’s argument. Moreover, at summary judgment, the court concluded “that the expert opinions present factual disputes as to

whether the Meta Event Generator meets the claim limitation.”

(D.I. 301 at 32) These disputes are addressed below with respect

to the “hierarchical monitor” limitation.

89a

itors” and is “logically separate from the other inspection engines … that are in the sensor app threads.”

(D.I. 396 at 888:6-15; D.I. 397 at 1189:5-12) Dr. Lee discussed source code, which explains that the meta engine “allows for definitions of ‘META events’ that in

effect correlate events automatically … . A META

event is defined by other signature events occurring in

a related manner within a sliding time interval.” (PTX

677 at 36; D.I. 396 at 888:16-890:18) With reference to

the User Guide for Cisco Security Manager 4.4, Dr. Lee

testified that “the lower level sensors take input from

network packet produced events and the meta engine

takes those events and correlates them. So there is a

hierarchy here.” (D.I. 396 at 891:15-18; See also PTX 94

at 38-25 (“The Meta engine is different from other engines in that it takes alerts as input where most engines take packets as input.”))

On direct examination, Dr. Lee discussed a Cisco

marketing presentation. A slide entitled “IPS Sensor

Architecture,” Dr. Lee explained, is an “architectural

diagram of software … [that] tells you what are the

components of the software, how [] they work together.” (D.I. 396 at 864:5-11) Dr. Lee opined that the meta

event engine is located in the “Correlation App” box:

Q. What does this -- to your understanding,

there’s a box here, correlation app. What is

that referring to?

A. So this is the, essentially, the correlation

engine or the meta event engine in Cisco’s language. That’s the upper level hierarchy code

monitor.

(D.I. 396 at 864:24-865:3; PTX 109 at 19) On cross examination, Dr. Lee confirmed this opinion. (D.I. 396 at

1048:19-1049:4) After Cisco presented evidence disput-

90a

ing that the meta event engine is located within the

“Correlation App” box of the software architecture, on

redirect, Dr. Lee explained that the physical location of

the meta event generator is not important. (D.I. 397 at

1188:20-22) Dr. Lee explained his opinion, showing the

preceding slide from the same presentation and identifying that the “Meta Event Generator for event correlation” is located within the “On-box Correlation Engine” box in that slide. (D.I. 397 at 1188:23-1189:12;

PTX 109 at 18)

ii. Cisco’s evidence

On cross examination, Cisco verified Dr. Lee’s

opinion that the meta event generator is located in the

“Correlation App” box in the Cisco marketing presentation. (D.I. 396 at 1048:19-1049:4; PTX 109 at 19) Cisco’s Kasper testified that the “Correlation App” box in

the marketing presentation does not have anything to

do with the meta event generator. (D.I. 398 at 1521:24) Kasper explained that the word correlation does not

indicate that it has anything to do with the meta event

generation, because “[c]orrelation is sort of generally

used term. So nothing to do with meta.” (D.I. 398 at

15:5-9) Cisco questioned Dr. Lee about this inconsistency:

Q. And when you testified last week −

A. Yes.

Q. -- you testified that the meta event generator was this green box, the correlation app; is

that correct?

A. I do recall that.

Q. Okay. And that, sir, you relied on that testimony to establish infringement?

91a

A. No.

Q. Part of your infringement opinion?

A. I disagree.

Q. Okay?

A. Yes.

Q. But that testimony, that was wrong?

A. So -Q. Can you answer my question? That testimony was incorrect?

A. That particular statement was incorrect,

that the correlation app is, yes.

(D.I. 399 at 1810:7-24) Dr. Lee also agreed that “[o]n

this particular slide, I think I was wrong in saying the

correlation app was the meta event.” (D.I. 399 at

1811:17-18)

Cisco elicited additional testimony from Dr. Lee on

cross examination in which he explained that some sensor “threads acts as network monitors … [and] [s]ome

threads [act] as meta event generators.” (D.I. 399 at

1815:8-17) Meanwhile, Kasper testified that “[t]he meta event generator … is part of each of those threads.”

(D.I. 398 at 1532:5-12; 1533:1-16)

iii. Analysis

The jury was asked to consider whether SRI presented a preponderance of evidence to demonstrate

that Cisco’s IPS products directly infringed the asserted claims either literally or under the doctrine of equivalents. (D.I. 336 at 23-25) SRI did not assert doctrine

of equivalents with respect to the “hierarchical monitor” limitation. (D.I. 396 at 866:20-869:3) The court in-

92a

structed the jury that “[h]ierarchical monitor” means “a

network monitor that receives data from at least two

network monitors that are at a lower level in the analysis hierarchy.” (D.1. 336 at 20)

SRl’s expert, Dr. Lee, opined that the meta event

engine (or generator) satisfies the hierarchical monitor

claim limitation. The parties disputed the location of

the meta event engine in Cisco’s marketing materials,

and Cisco was able to elicit testimony from Dr. Lee that

his opinion in this regard was “incorrect” and “wrong.”

Cisco did not dispute the existence or role of the meta

event engine. Dr. Lee opined that the meta event engine was a software thread distinct from other software

threads. Kasper explained that the meta event engine

was part of each software thread but that in the context of a virtual sensor, the meta event generator

would read events from multiple threads.

On the record at bar, SRl’s expert provided more

than conclusory testimony in order to explain his conclusions to the jury. The jury credited such testimony

over that of Cisco’s expert and fact witnesses. The

court declines to re-weigh the evidence or the credibility of the witnesses. Viewing the record in the light

most favorable to SRI, substantial evidence supports

the jury’s verdict. For these reasons, Cisco’s renewed

motion for JMOL is denied.

c. Indirect infringement – induced infringement

The jury found that Cisco induced infringement of

the asserted claims by the accused Cisco IPS products

and services. (D.I. 337 at 4) Cisco contends that no

reasonable jury could have determined that Cisco induced infringement of the asserted claims by Cisco’s

IPS products and services, because “no reasonable jury

93a

could have found that Cisco knew that any use of the

accused Cisco IPS Products and Services would be infringing.” (D.I. 352 at 16) Addressing the first prong of

intent, Cisco argues that its “good-faith, reasonable belief in non-infringement since first learning of SRl’s patents defeats the intent requirement for inducement.”

(Id. at 17) As to the second prong, Cisco avers that

Kasper’s testimony is insufficient to establish willful

blindness. (Id.)

i.

SRI’s evidence

SRI presented testimony from Roesch that he did

not review the patents-in-suit until after his deposition

in the fall of 2015, some two years after the filing of the

complaint. (D.I. 398 at 1479:3-13) SRI also presented

the following testimony from Kasper:

Q. Between the time that Cisco received that

notice [of SRl’s infringement contentions] mentioned in 2012 and when I took your deposition

in 2015, did anyone from Cisco ever approach

you and say, take a look at these patents. We

want to make sure that we don’t infringe them?

A. No, sir.

Q. In fact, even though you just said you were

one of the most knowledgeable people at Cisco

on its IPS system, and, in fact, the one here

testifying, at the time of your deposition in

2015, you had never even seen the patents-insuit, had you?

A. That is correct.

(D.I. 398 at 1535:3-14)

94a

ii. Cisco’s evidence

Cisco points to the noninfringement defenses it

presented at trial as evidence of its “reasonable belief

that the accused Cisco IPS Products and Services do

not infringe.” (D.I. 352 at 16, citing D.I. 394 at 400:1825; D.I. 397 at 1233:15-22; D.I. 399 at 1899:20-21 and

1900:8-9) Moreover, Cisco argues that the jury had no

basis to conclude that Cisco was willfully blind as to infringement, because “Kasper’s testimony confirmed the

absence of the claimed ‘hierarchical’ relationship between the accused features in Cisco’s IPS Products,

which supports Cisco’s noninfringement defense.” (D.I.

352 at 17, citing D.I. 398 at 1509:7-1512:6, 1516:241518:15 and 1545:16-23)

iii. Analysis

The jury was asked to consider whether SRI presented a preponderance of evidence to demonstrate

that Cisco induced infringement of the asserted claims

by Cisco’s IPS products and services. (D.I. 336 at 26)

The court instructed the jury that SRI bore the burden

to prove, among other things, that:

2. Defendant was aware of the asserted patents at the time of the alleged conduct and

knew that its customer’s acts (if taken) would

constitute infringement of an asserted patent,

or the defendant believed there was a high

probability that the acts (if taken) would constitute infringement of an asserted patent but

deliberately avoided confirming that belief.19

19

Cisco only disputes this second factor (intent) relevant to

Cisco’s inducement with respect to the Cisco IPS products and

services.

95a

(D.I. 336 at 26) SRI presented evidence that SRI notified Cisco of infringement in 2012 and that neither

Roesch nor Kasper (who are among the most knowledgeable individuals within the company about the operation of Cisco’s IPS products and services) read the

patents-in-suit until some point in time after their depositions in the fall of 2015. SRI also presented evidence

that Cisco did not ask Kasper to investigate the patents-in-suit or potential infringement. SRI argued

that these actions establish willful blindness under the

intent factor. (D.I. 370 at 15) Cisco argues that the

noninfringement arguments that Roesch and Kasper

presented at trial establish the company’s good faith

belief in noninfringement. (D.I. 352 at 16-17) Sufficient

evidence was presented to enable the jury to decide

whether Cisco’s actions satisfied the intent factor.

On the record at bar, SRI presented more than

conclusory evidence of inducement to the jury. The jury credited the testimony of SRl’s witnesses and exhibits over that of Cisco. The court declines to re-weigh

the evidence or the credibility of the witnesses. Viewing the record in the light most favorable to SRI, substantial evidence supports the jury’s verdict that Cisco

induced infringement of the asserted claims by its customers using Cisco IPS products and services. For

these reasons, Cisco’s renewed motion for JMOL is denied.

d. Indirect infringement – contributory

infringement

The jury found that Cisco contributed to the infringement of the asserted claims by the accused Cisco

IPS products. (D.I. 337 at 5) Cisco argues that “[n]o

reasonable jury could have found Cisco liable for contributory infringement with respect to the accused Cis-

96a

co IPS Products,” because SRI failed to demonstrate

that “Cisco’s IPS Products have ‘no substantial noninfringing uses’ ” and SRI failed to establish the intent

requirement. (D.I. 352 at 17)

i.

SRI’s evidence

“SRI offered testimony and Cisco documents showing that the infringing meta engine and critical signatures are enabled by default, that the meta engine handles all signature events, and that Cisco encourages its

customers’ use of the features by enabling the features

and promoting their value.” (D.I. 370 at 16) For example, Cisco’s Kasper verified that the meta event generator on Cisco IPS devices is enabled by default. (D.I.

395 at 644:15-18) Dr. Lee explained that Cisco’s documentation indicates that the meta event generator is

enabled by default. (See D.I. 396 at 898:6-15 (referencing PTX 555 at SRI-CIS0041424); 900:5-10 (referencing

PTX 94 at 39-22)) Dr Van Liere presented an opinion

(based upon survey evidence) that, of the Cisco IPS

customers, “60 to 64 percent are aware of the meta

event generator and know that it’s enabled in one or

more of the devices in their U.S. network.” (D.I. 395 at

736:15-23) Dr. Lee opined that this number could be

higher “because the default [setting is] on and some

customers may not even pay attention to the default

setting. They just, you know, leave them on.” (D.I. 395

at 911:21-912:5) With respect to intent, SRI relies on

the aforementioned statements by Roesch and Kasper.

ii. Cisco’s evidence

Cisco questioned SRl’s damages expert Dr. Stephen Prowse (“Dr. Prowse”), who acknowledged that

the percentage of users who have the meta event engine enabled is “probably less than a hundred.” (D.I.

397 at 1339:5-25) Cisco also elicited testimony from Dr.

97a

Van Liere that “36 percent [of users] said they don’t

enable [the meta event engine] … or don’t know if they

enabled [it].” (D.I. 395 at 743:24-744:2) As to these 36

percent of users, both Dr. Van Liere and Dr. Lee were

unable to answer Cisco’s question about the precise

number of users who said “I don’t know” to the question but who actually have the meta event engine enabled. (D.I. 396 at 741:11-25; D.I. 397 at 1165:7-1166:20

(Dr. Lee)) According to Cisco, these statements indicate that “SRI provided the jury no basis to infer

whether those specific users represented a negligible or

a substantial portion of the respondents.” (D.I. 352 at

17-18) As to substantial noninfringing uses for Cisco

IPS products, Dr. Clark opined that “a lot of what [Cisco] do[es] is not accused.” (D.I. 398 at 1601:4) At closing, Cisco attempted to focus the jury on the 36 percent

number:

Substantial noninfringing uses. Their own survey expert, I think he was almost shocked. I

heard Mr. Scherkenbach actually admit, yes,

not all do this. Their own survey guy says 36

percent said they don’t enable those features or

they don’t know if they enable those features.

That’s right. We don’t have to get here. If you

find, as I think you will, that the products don’t

infringe, then we don’t have to get to the whole

point of whether there’s substantial noninfringing uses, because all uses would infringe. This

is only somewhere in the case if you need to get

to contributory infringement to find that our

customers infringe. No, please.

(D.I. 400 at 1989:11-22) On the intent factor, Cisco argues that, as with inducement, it lacked the intent to

infringe. (D.I. 352 at 18)

98a

iii. Analysis

The jury was asked to consider whether SRI presented a preponderance of evidence to demonstrate

that Cisco contributed to infringement of the asserted

claims by Cisco’s IPS products. (D.I. 336 at 27) The

court instructed the jury that SRI bore the burden to

prove, among other things, that:

First, that defendant knew of the patents-insuit.

Second, that the accused product is: (a) for system claims, a material component of the

claimed system; or (b) for the method claims, a

material component for use in practicing the

claimed method. In other words, that the accused product must be especially made or

adapted for use in a manner that infringes the

patent.

Third, that defendant knew that the accused

product would be used in a manner infringing

the patents-in-suit.

Fourth, that the accused product is not a staple

or commodity article, in other words, the accused product does not have a substantial noninfringing use. Providing a staple or commodity article is not contributory infringement.

Fifth, the accused product was actually used in

a manner that you, the jury, find infringes the

asserted claims.

99a

(Id.) The court has addressed the intent factor with respect to inducement.20 (See, e.g., D.I. 379 at 10) Cisco

argues that SRI has failed to demonstrate that there

are no substantial noninfringing uses. Cisco contends

that SRl’s expert, Dr. Lee, based his substantial noninfringing uses opinion on the Cisco IPS products “as a

whole” (D.I. 352 at 18, citing D.I. 396 at 918:15-920:12)

and that SRI is now arguing that “the particular tools

at issue” (i.e. meta event engine and critical signatures)

have no substantial noninfringing uses. (D.I. 370 at 16,

citing Lucent Techs, Inc. v. Gateway, Inc., 580 F.3d

1301, 1320 (Fed. Cir. 2009))

“[N]on-infringing uses are substantial when they

are not unusual, far-fetched, illusory, impractical, occasional, aberrant, or experimental.” Vita-Mix Corp. v.

Basic Holding, Inc., 581 F.3d 1317, 1327 (Fed. Cir.

2009). Dr. Lee expressed the opinion that the potential

noninfringing uses of the accused Cisco IPS products

are impractical and, therefore, not substantial:

So, in substantial [sic] use, it would be a customer only uses a single hardware interface.

As we have discussed before, this is very, very

unusual. Typically, a customer I would suspect

would have at least two interfaces in a box, one

for incoming, one for outbound traffic, and then

the default signatures at a sensor level and also

the default on meta event generator, they infringe.

The vast majority of the customers, the evidence is they actually use the default settings.

20

As with inducement, sufficient evidence was presented to

enable the jury to decide whether Cisco’s actions satisfied the intent factor for contributory infringement.

100a

Really, if a customer goes to the length to disable these [infringing] default settings, that

would mean that they actually essentially are

rendering the IPS apps not very useful. That

doesn’t make sense, after they paid so much

money. And, you know, also, we actually have

not seen any evidence that there is a substantial number of customers actually disabling

these infringing features.

(D.I. 396 at 919:21-920:12) Dr. Clark disagreed and

opined that “a lot of what [Cisco IPS sensors] do is not

accused.” (D.I. 398 at 1601:4) Cisco argued to the jury

that 36% of survey respondents may have turned off

the “Correlation/Compliance Engine” or may not have

known if the “Correlation/Compliance Engine” was enabled. (D.I. 399 at 1989:11-22) For the Cisco IPS products “as a whole,” SRI presented sufficient evidence for

a jury to conclude that there are no substantial noninfringing uses.

On the record at bar, SRI presented more than

conclusory evidence of contributory infringement to the

jury. The jury credited the testimony of SRl’s witnesses and exhibits over that of Cisco. The court declines to

re-weigh the evidence or the credibility of the witnesses. Viewing the record in the light most favorable to

SRI, substantial evidence supports the jury’s verdict

that Cisco contributed to the infringement of the asserted claims by its customers using Cisco IPS products. For these reasons, Cisco’s renewed motion for

JMOL is denied.

4.

Accused services

Cisco repeats its direct infringement arguments

from the accused products with respect to the accused

services, reasoning that “SRl’s infringement theory for

101a

those services is derivative of its [direct] infringement

claim[s] with respect to the … [accused] products.”21

(D.I. 352 at 9) Cisco presents additional attorney argument22 with respect to SRl’s failure to provide substantial evidence of infringement with respect to

Sourcefire professional services, Sourcefire’s support

services (Standard, Gold, and Platinum), Cisco IPS

Services, and Cisco Remote Management Services.23

(D.I. 352 at 10-11)

Dr. Lee opined that the accused services infringe

whenever a service updates a customer’s software and

signatures because, “when we update, you essentially

redeploy by enabling all these infringing features.”

(D.I. 397 at 1172:12-18; See also D.I. 396 at 922:14923:22) SRI contends that this aspect of Dr. Lee’s opinion is the primary dispute between the parties. (D.I.

370 at 8)

a.

Sourcefire Professional Services

i.

SRI’s evidence

As discussed above, SRI presented evidence that

Sourcefire IPS products infringe the asserted claims.24

21

For the reasons stated above, the court denies Cisco’s motion on these grounds.

22

See supra, note 10.

23

Cisco correctly points out that, at trial, SRI did not address

two services (i.e., Cisco IPS Industrial Control Protection, Security lntelliShield Alert Manager). (D.I. 352 at 11) SRI argues that

this is moot, because these two services are not included in the

damages base. (D.I. 370 at 11 n.11) Cisco did not respond to this

argument.

This text is long and has been trimmed here. Open the source document for the complete record.