
    FINJAN, INC., Plaintiff, v. JUNIPER NETWORKS, INC., Defendant.
    No. C 17-05659 WHA
    United States District Court, N.D. California.
    Signed May 8, 2019 Filed May 29, 2019
    James R. Hannah, Lisa Kobialka, Austin W Manes, Daniel David Williams, Hannah Yunkyung Lee, Kristopher Benjamin Kastens, Linjun Xu, Michael H. Lee, Phuong Diem Nguyen, Paul J. Andre, Yuridia Caire, Kramer Levin Naftalis & Frankel LLP, Menlo Park, CA, Shannon Hedvat, Cristina Lynn Martinez, Kramer Levin Naftalis and Frankel LLP, New York, NY, for Plaintiff.
    Joshua Popik Glucoft, Alan J. Heinrich, Casey May Curran, Jonathan S Kagan, Irell & Manella LLP, Los Angeles, CA, Dennis Joseph Courtney, Ingrid Marie Haslund Petersen, Kevin X. Wang, Rebecca Lyn Carson, Irell & Manella LLP, Newport Beach, CA, Sharon Soohyun Song, Los Angeles, CA, Philip C. Swain, Foley Hoag LLP, Boston, MA, for Defendant.
    ORDER ON SECOND ROUND OF EARLY MOTIONS FOR SUMMARY JUDGMENT AND MOTION TO STRIKE AND ORDER TO SHOW CAUSE
   William Alsup, United States District Judge

INTRODUCTION

In this patent infringement action, each side moves for summary judgment on one asserted claim. For the reasons stated below, the patent owner's motion for summary judgment of infringement is DENIED . The accused infringer's motion for summary judgment of non-infringement and on damages is GRANTED to the extent stated below and motion to strike is DENIED AS MOOT . The parties are ORDERED TO SHOW CAUSE as to why judgment on the patent owner's motion should not be entered in favor of the accused infringer.

STATEMENT

Plaintiff Finjan, Inc. alleges that defendant Juniper Networks, Inc.'s products infringe its patents, including, inter alia , United States Patent Nos. 8,141,154 ("the '154 patent") and 6,804,780 ("the '780 patent"). These patents broadly relate to computer malware protection.

Pursuant to the second round of early motions for summary judgment, Finjan moves on infringement of Claim 1 of the '154 patent and Juniper moves on non-infringement of Claim 9 of the '780 patent and limitation of damages (Dkt. Nos. 369, 371). Juniper also moves to strike certain infringement theories related to the '154 patent (Dkt. No. 391).

1. THE '154 PATENT .

The '154 patent is directed toward a system and method "for protecting a client computer from dynamically generated malicious content" and statically generated conventional viruses ( '154 patent at Abstract). The specification explains that "a newer type of virus" - namely, "dynamically generated viruses" that are "generated only at run-time" - "take advantage of features of dynamic HTML generation, such as executable code or scripts that are embedded within HTML pages" (id. at 3:32-38).

The specification recounts the disadvantages of "conventional reactive content inspection and conventional gateway level behavioral analysis content inspection" and "desktop anti-virus protection" (id. at 3:65-4:8, 4:18-22). According to the patent, conventional gateway level behavior analysis content inspection cannot detect the new type of virus (id. at 3:65-4:1). For example, a content inspector "will only detect the presence of a call to Document.write( ) with input text [which may involve malicious JavaScript not present in the content prior to runtime] that is yet unknown" (id. at 4:1-4). And, desktop anti-virus protection must expose its vulnerabilities to hackers, among other disadvantages (id. at 4:18-21). The specification then announces that "there is a need for a new form of behavioral analysis, which can shield computers from dynamically generated malicious code without running on the computer itself that is being shielded" (id. at 4:23-26). To that end, the '154 patent uses a "security computer" to inspect potentially malicious code (id. at 4:35).

The basic set up of the '154 patent 's purported invention involves "[t]hree major components": (1) gateway computer, (2) client computer, and (3) security computer (id. at 8:45-46). The "present invention operates through a security computer that is preferably remote from a client computer that is being shielded while processing network content" (id. at 4:35-37). A preferred embodiment describes a gateway computer that intercepts content (e.g. , HTML pages, Java applets) being sent to the client computer for processing (id. at 8:48-51). The gateway computer modifies the content by replacing the call to the original function with a corresponding call to a substitute function, which operates to send the input of the original function to a security computer for inspection (id. at 5:10-12). The gateway computer then transmits "the modified content" to the client computer, which processes the modified content (id. at 5:14-16). When the substitute function is invoked, the client computer transmits the input to the security computer for inspection (id. at 5:16-18). The security computer then inspects the input and transmits "an indicator of whether it is safe for the client computer to invoke the original function with the input" (id. at 5:20-22). The client computer invokes the original function "only if the indicator ... indicates that such invocation is safe" (id. at 5:22-25). Figure 2 illustrates a "simple topology" of this set up (id. at 8:41-44, 62):

2. THE '780 PATENT

A prior order has described in detail the '780 patent 's purported invention (Dkt. No. 180). The '780 patent describes generation of an ID for a downloadable ("Downloadable ID") in order to match it against previously encountered suspect downloadables. This saves the malware-protection system from going through an intensive analysis every time that downloadable attempts to enter the user's system. The patent discloses an ID generator that generates a Downloadable ID by fetching components called out by the incoming file, then running a hash function across the combined code.

3. THE ACCUSED PRODUCTS .

A. SRX Gateways.

Juniper's SRX Series Gateways ("SRX") are secure routers that can act as firewalls to protect a computer on a network from receiving malicious content. Once SRX receives content sent from a network such as the Internet, it blocks data already recognized as malicious. If SRX does not recognize the content, it will then send it to the cloud-based Sky Advanced Threat Prevention ("Sky ATP") for analysis.

B. Sky ATP.

Sky ATP, sold as an add-on to SRX, is a cloud-based scanning system that inspects content with its "Malware Analysis Pipeline" to determine the threat level posed by a "Downloadable." The Malware Analysis Pipeline scans an unrecognized Downloadable using static and dynamic analysis. Static analysis involves evaluating the Downloadable's contents without actually running it. Dynamic analysis evaluates the Downloadable's contents by executing and observing the file in a safe environment called the "sandbox." The multi-stage pipeline analysis identifies easily detected malware first (through static analysis), then analyzes progressively harder-to-detect malware process through the pipeline (ending with dynamic analysis). This pipeline renders a "verdict," i.e. , how dangerous the file is.

C. ATP Appliance.

Advanced Threat Prevention Appliance ("ATP Appliance") - a product previously sold by Cyphort (which Juniper acquired in 2017) - operates in a manner similar to Sky ATP. Instead of a cloud-based service, however, ATP Appliance is a local network appliance that includes "collectors" that capture information regarding network traffic by copying files being downloaded from the network such as the Internet. The ATP Appliance hashes a copy of a file being downloaded over the network to determine whether the file has already been analyzed. If the file is not recognized, then it is sent to ATP Appliance's "SmartCore," which performs a multi-stage analysis (including static and dynamic analysis). The results of the analysis are then sent to the system administrator for future reference.

* * *

Finjan now accuses the following products of infringing Claim 1 of the '154 patent : (1) SRX; (2) Sky ATP; and (3) the Advanced Threat Prevention Appliance ("ATP Appliance") (Dkt. No. 369 at 1). Finjan asserts that these products infringe Claim 1 "because they analyze content received over a network using a security computer for advanced analysis" (Dkt. No. 369 at 2). Juniper opposes, arguing that under its proposed constructions of the terms "content processors" and "safe," the accused products do not infringe Claim 1 (Dkt. No. 390 at 13).

Juniper also moves for non-infringement of Claim 9 of the '780 Patent (Dkt. No. 371). Juniper further moves on the issue of damages - that is, because Finjan allegedly failed to provide notice of Juniper's (supposed) infringement of the '780 patent, Finjan is not entitled to any damages. Finjan opposes the motion in connection with ATP Appliance only (see Dkt. No. 393 at 1-2). This order follows full briefing and oral argument.

ANALYSIS

Summary judgment is proper when there is no genuine dispute of material fact and the moving party is entitled to judgment as a matter of law. FRCP 56(a). A genuine dispute of material fact is one that "might affect the outcome of the suit under the governing law." Anderson v. Liberty Lobby, Inc. , 477 U.S. 242, 247-48, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). In deciding a motion for summary judgment, the court must accept the non-movant's non-conclusory evidence and draw all justifiable inferences in its favor. Id. at 255, 106 S.Ct. 2505.

1. FINJAN'S MOTION ON CLAIM 1 OF THE '154 PATENT .

Claim 1 of the '154 patent reads as follows ( '154 patent at 17:32-44):

1. A system for protecting a computer from dynamically generated malicious content, comprising:
a content processor (i) for processing content received over a network, the content including a call to a first function, and the call including an input, and (ii) for invoking a second function with the input, only if a security computer indicates that such invocation is safe ;
a transmitter for transmitting the input to the security computer for inspection, when the first function is invoked; and
receiver for receiving an indicator from the security computer whether it is safe to invoke the second function with the input.

The contested terms are italicized. Juniper argues that its accused products do not infringe Claim 1 because (1) they do not include the claimed "content processor," and (2) they do not indicate whether invoking the second function is "safe" (Dkt. No. 390 at 13, 20-23). This order therefore must first construe the disputed terms to determine the scope of Claim 1 before determining whether Claim 1 reads onto Juniper's accused products.

Claim terms "are generally given their ordinary and customary meaning," i.e. , "the meaning that the term would have to a person of ordinary skill in the art in question at the time of the invention." Phillips v. AWH Corp. , 415 F.3d 1303, 1312-13 (Fed. Cir. 2005) (en banc). To properly construe a claim, a court must examine the claim, the rest of the specification, and, if in evidence, the prosecution history. Amgen Inc. v. Hoechst Marion Roussel, Inc. , 314 F.3d 1313, 1324 (Fed. Cir. 2003).

Here, the parties dispute the following terms in connection with the instant motion (Dkt. No. 390 at 5-6):

CLAIM TERM FINJAN JUNIPER Safe Something that is not Security profile does not potentially harmful or violate the client computer's malicious security policy Content processor Plain and ordinary meaning Plain and ordinary meaning (a component that processes (a processor on a client/user content) computer that processes modified content)

Because this order finds construction of "content processor" as dispositive, it need not reach construction of any other term.

A. "Content Processor."

Both parties assert that they propose the "plain and ordinary meaning" of the term "content processor." Of course, both parties disagree as to what the plain and ordinary meaning of the term actually entails. Juniper argues that a person of ordinary skill in the art would understand the term - particularly in light of the specification and file history - as "a processor on a client/user computer that processes modified content." It further argues that Finjan's proposed construction "is redundant and disregards the patent's express description of the 'present invention' " (id. at 7).

A court may not impose improper limitations from the specification into the claims. Phillips , 415 F.3d at 1323. That being said, the specification is "the single best guide to the meaning of a disputed term" and "[u]sually, it is dispositive." Id. at 1315 (citation and quotations omitted). This order concludes that a person of ordinary skill in the art would understand that the "content processor" in Claim 1 processes modified content.

That the "content" being processed in Claim 1 has been modified is made evident by the claim language and specification. The United States Court of Appeals for the Federal Circuit has explained that the '154 patent "has four independent claims (1, 4, 6, and 10), each reciting a system or software program that executes a substitute function.... In the language of the '154 patent, the 'first function' is the inspection step in which the content is assessed for safety, and the 'second function' is when, having been deemed safe, the content is actually run." Palo Alto Networks, Inc. v. Finjan, Inc. , 752 F. App'x 1017, 1018 (Fed. Cir. 2018) ; see also Finjan, Inc. v. Cisco Systems, Inc. , 2018 WL 3537142, at *20-23 (N.D. Cal. July 23, 2018) (Judge Beth Labson Freeman) (construing the terms "first function" to mean "substitute function" and "second function" as "original function, which is different than the first function"). The claimed "first function" then clearly involves the "substitute function," which sends the content's input to the security computer for inspection once invoked. According to the specification, the substitute function exists only after the original content is modified at the gateway computer (see, e.g. , '154 patent at 9:13-28). Accordingly, the claimed "content" necessarily refers to modified content.

This reading is made all the more apparent by the '154 patent 's own description of the "present invention" ( '154 patent at 4:55-60):

To enable the client computer to pass function inputs to the security computer and suspend processing of content pending replies from the security computer, the present invention operates by replacing original function calls with substitute function calls within the content , at a gateway computer, prior to the content being received at the client computer.

"When a patent [ ] describes the features of the 'present invention' as a whole, this description limits the scope of the invention." Regents of Univ. of Minnesota v. AGA Med. Corp. , 717 F.3d 929, 936 (Fed. Cir. 2013) (quoting Verizon Servs. Corp. v. Vonage Holdings Corp. , 503 F.3d 1295, 1308 (Fed. Cir. 2007) ).

As Juniper points out, this construction is consistent with the Patent Trial Appeals Board's ("PTAB") understanding (under the broadest reasonable interpretation) of Claim 1, which understood the '154 patent specification to refer to "three categories of content" (Dkt. No. 390-19 at 9 (emphasis added)):

First, there is the "original content" that is scanned and modified at the gateway computer. Second, there is the "modified content" transmitted to, and received by, the client computer. Third is the "dynamically generated malicious content" that is generated at runtime and, thus, is undetected by the gateway computer in the "original content."

The PTAB further noted that "[n]otwithstanding the variety of content described in the Specification, the term 'content' is recited broadly in all challenged claims as 'content including a call to a first function' " (ibid. ). It then explained that (id. at 10 (first emphasis and alteration in original, second emphasis added)):

Because the recited "first function" is the substituted function whose input is verified, the claimed "content," in the context of the surrounding claim language, must refer to the modified content received at the client computer. See id. at 17:39-40 ("transmitting the input [of the first function call] to the security computer for inspection, when the first function is invoked"). The claimed content cannot refer to the "original content" that is received by the gateway computer and over the Internet because that content, according to the Specification, would be capable of generating the undetected dynamically generated malicious content from which the client computer is to be protected.

As such, the PTAB concluded that the claimed "content" refers to "data or information, which has been modified and is received over a network" (id. at 14 (emphasis added)). This order agrees with the PTAB's understanding to the extent that it found that the claimed "content" "has been modified." Markman v. Westview Instruments, Inc. , 517 U.S. 370, 389, 116 S.Ct. 1384, 134 L.Ed.2d 577 (1996) (claims are to be construed "in a way that comports with the instrument as a whole").

In light of the foregoing, Finjan's assertion that Juniper's proposed construction "makes no sense in the context of the claims because it would have the content processor processing both modified and unmodified content simultaneously" is unpersuasive (Dkt. No. 415 at 2). The claimed "content" refers to the modified content, and the content processor processes that modified content. There is no incongruity.

Finjan's contention that the "modified content" limitation would read out preferred embodiments is similarly unpersuasive, as it misapprehends the context of those embodiments. Finjan argues that because the patent "describ[es] that 'content' received for processing has the 'original' function," the content in that embodiment is unmodified (ibid. (citing '154 patent at 6:4-14)). But read in context, the described "content" in that citation containing the "original" function clearly refers to the (unclaimed) first category of content the PTAB identified - i.e. , the content that is intially "scanned and modified at the gateway computer" before it is transmitted to the client computer (id. at 9). Finjan further points out that the patent describes a "content processor" "for processing content received over a network," and thus contends that this is "an example where unmodified content is processed using a content processor" (ibid. (citing '154 patent at 7:22-23)). Again, when read in context, that citation clearly refers to the second category of content identified by the PTAB - i.e. , "the 'modified content' transmitted to, and received by, the client computer." Finjan also recites various examples of unmodified content disclosed in the specification, such as "HTML web page, XML document, a Java applet, an EXE file, JavaScript, ... or any such data container that can be rendered by a client web browser" (id. at 2-3 (citing '154 patent at 13:49-52)). Again, these examples refer to the unclaimed unmodified content received by the gateway.

Finjan also argues that the '154 patent "is explicit when something is 'modified' from its original form" (id. at 3 (citing '154 patent at 3:9-12)). It further asserts that "the content being 'modified' was not intended to be in the claims" because it removed the word "modified" from the claim language during prosecution (ibid. ). That is, Finjan struck out the word "modified" from "content" from dependent Claim 2 (Dkt. No. 415-3). While this argument has some force, it is ultimately unpersuasive in light of the claim language and specification as a whole. Nor is Finjan's citation to other claims that include the word "modified" helpful, as those terms refer to modified input variable , which is distinct from Claim 1's modified content.

Finjan further asserts that Juniper's expert witness, Dr. Aviel Rubin, had taken an inconsistent position during a prior IPR proceeding (Dkt. No. 369 at 7). Specifically, Dr. Rubin previously opined that the term "content processor" should be given its plain and ordinary meaning (Dkt. No. 390 at 10). This order, however, does not necessarily find the inconsistency Finjan complains of. Dr. Rubin testified during the IPR proceeding that he interpreted the claim terms the petitioner did not specifically propose for construction (including "content processor") under their ordinary meaning "in light of [the '154 patent 's] specification" (Dkt. No. 389-6 ¶ 23 n.1). He now makes explicit Claim 1's clear implication. And, even assuming Dr. Rubin's testimony contains an inconsistency, this order does not find it fatal to Juniper's current proposed construction under these circumstances.

Finally, this order rejects Finjan's proposition that because another court in our district has already construed the term "content processor" under the plain and ordinary meaning, it needs no further construction (Dkt. No. 369 at 6). Finjan cites three claim construction decisions by Judge Haywood Gilliam Jr., who adopted Finjan's proposed construction (id. at 6-7). Judge Gilliam, however, adopted Finjan's proposed construction because those defendants unsuccessfully attempted to either construe the term as a means-plus-function or limit the term to one specific embodiment. See Finjan, Inc. v. Proofpoint, Inc. , 2015 WL 7770208, at *9-11 (N.D. Cal. Dec. 3, 2015) (rejecting defendant's construction of "content processor" as a means-plus-function claim); Finjan, Inc. v. Bitdefender Inc. , Case No. C 17-04790 HSG, 2019 WL 634985, at *11-12 (N.D. Cal. Feb. 14, 2019) (also rejecting defendant's construction of "content processor" as a means-plus-function claim); Finjan, Inc. v. Symantec Corp. , Case No. C 14-02998 HSG, 2017 WL 550453, at *10-11 (N.D. Cal. Feb. 10, 2017) (rejecting defendant's proposed limiting of "content processor" to the specific embodiment describing "software that renders the content for interactive viewing on a display monitor"). At no point during those proceedings did Judge Gilliam have the opportunity to address the specific issues raised in the instant motion.

Accordingly, this order construes the term " content processor" as "a processor that processes modified content."

B. Accused Products Do Not Infringe.

Under the adopted construction, Juniper's accused products (SRX, Sky ATP, and ATP Appliance) do not infringe Claim 1 of the '154 patent. Finjan offers no evidence that the accused products' alleged content processor processes modified content. Rather, the current record shows that those products process only unmodified content. Specifically, Dr. Rubin, Juniper's expert witness, affirmatively declared that "the accused products and the technology claimed ... do not modify or 'instrument' content; as a result, they all process unmodified content received from the web server" (Dkt. No. 390-1 ¶ 38; see also id. at ¶¶ 28, 31, 34). Because the foregoing construction excludes SRX, Sky ATP, and ATP Appliance from infringement for this reason, Finjan's motion for summary judgment of infringement of Claim 1 of the '154 patent is DENIED .

In light of the foregoing, even though Juniper did not itself cross-move for summary judgment on Claim 1 of the '154 patent, both sides are ORDERED TO SHOW CAUSE in writing by MAY 13 AT NOON why summary judgment should not be granted in favor of Juniper with replies by MAY 16 AT NOON .

2. JUNIPER'S MOTION ON CLAIM 9 OF THE '780 PATENT .

The '780 patent makes yet another showing in the second round of early motions for summary judgment. During the first round, a prior order found that Juniper's SRX and Sky ATP products did not infringe Claim 1 of the '780 patent after construing the term "performing a hashing function on the Downloadable and the fetched software components to generate a Downloadable ID" (Dkt. No. 180 at 10).

Juniper now moves for summary judgment of non-infringement on Claim 9 regarding all three accused products (i.e. , SRX, Sky ATP, and ATP Appliance). Finjan argues that ATP Appliance (which was not at issue in the first round of early motions for summary judgment) infringes Claim 9, which substantially overlaps with Claim 1, of the '780 patent.

Juniper also moves on the issue of damages - that is, according to Juniper, Finjan is not entitled to any damages in connection with ATP Appliance because it failed to provide actual or constructive notice of infringement in compliance with 35 U.S.C. § 287 before the '780 patent 's expiration date on November 6, 2017 (Dkt. No. 371 at 2). Section 287 provides that:

Patentees ... may give notice to the public that [an article] is patented, either by fixing thereon the word "patent" or the abbreviation "pat.", together with the number of the patent.... In the event of failure so to mark, no damages shall be recovered by the patentee in any action for infringement, except on proof that the infringer was notified of the infringement and continued to infringe thereafter, in which event damages may be recovered only for infringement occurring after such notice.

This order agrees with Juniper and thus holds that Finjan cannot recover any damages on the ATP Appliance. Further, because Finjan does not oppose Juniper's motion in connection with SRX or Sky ATP under the Court's present construction of Claim 1 (and only opposes in connection with ATP Appliance), this order finds non-infringement of Claim 9 of the '780 patent regarding SRX and Sky ATP.

A. Actual Notice.

Finjan failed to provide Juniper or Cyphort (from whom Juniper acquired ATP Appliance) actual notice. Actual notice requires an affirmative communication by the patentee to be "sufficiently specific to support an objective understanding that the recipient may be an infringer," including a "charge of infringement of specific patents by a specific product or group of products." Funai Elec. Co. v. Daewoo Elecs. Corp. , 616 F.3d 1357, 1373 (Fed. Cir. 2010) (citations omitted).

Finjan first generally states that Finjan and Cyphort began licensing discussions in February 2015, with a follow up letter sent in January 2016 "identifying certain Finjan patents" (Dkt. No. 393 at 10-11, 32). That letter, however, did not mention the '780 patent (see Dkt. No. 392-12). The draft license Finjan relies on similarly failed to specifically mention the '780 patent (see Dkt. Nos. 392-24, 392-26).

It next argues that it provided Cyphort notice during a presentation Finjan gave in 2016 given during their licensing discussions (Dkt. No. 393 at 32). This presentation "introduced Finjan and its technology to Cyphort and gave a complete overview of Finjan's history and patents" and "the identification of Finjan's patent portfolio" (including the '780 patent ) (Dkt. No. 392-4 at 11). As Juniper points out, however, that presentation merely noted in general the '780 patent as one of the patents previously asserted against other third party defendants (see Dkt. No. 392-16). At no point during the presentation (under the current record) did Finjan specifically charge infringement of the '780 patent against ATP Appliance.

During oral argument, Finjan attempted to cobble together a showing of actual notice by pointing to the various letters, draft license, and presentation. Its attempt falls short. Finjan argued that the draft license was meant for the entire patent portfolio, which included the '780 patent (as called out in the presentation). But that draft license agreement covered patent rights that were so broad that they could not provide meaningful notice. Specifically, the draft license stated that (Dkt. No. 392-26):

"Finjan's Patent Rights" means any issued patent and any pending patent application anywhere in the world that Finjan owns or controls at any time during the term of this Agreement where such patent or patent application was filed, or claims priority to an application filed on, or before the Effective Date, including but not limited to all of the patents identified in Exhibit C.

Incredibly, Finjan thus would have Cyphort on notice of future patents it does not yet own and patents Finjan did not bother to identify in "Exhibit C" under its logic.

Moreover, Finjan's reliance on Novo Nordisk A/S v. Becton Dickinson & Co. , 96 F. Supp. 2d 309, 319-20 (S.D.N.Y. 2000), aff'd , 304 F.3d 1216 (Fed. Cir. 2002), for the proposition that actual notice may be satisfied "in the context of the overall dealings between the parties" is unpersuasive for two reasons (Dkt. No. 393 at 33). First , the out-of-district decision is not binding. Contrary to Finjan's representations during oral argument, the United States Court of Appeals for the Federal Circuit did not affirm the district court's decision regarding the issue of notice, as it was not specifically at issue before the appellate court. Second , Novo Nordisk concerned whether accused products must be specifically identified as a matter of law under Section 287. Novo Nordisk , 96 F. Supp. 2d at 319-20. In contrast, at issue in the instant motion is whether Finjan sufficiently identified a specific patent. This issue does not raise similar factual inquiries as in Novo Nordisk .

Ultimately, Finjan cites no authority blessing such vague "notice" as sufficient. And, this order finds Finjan's argument particularly unpersuasive where Finjan was perfectly capable of specifically calling out other patents in its correspondence with Cyphort (see Dkt. No. 392-12). Finjan thus fails to raise a genuine issue of material fact. Accordingly, this order finds that Finjan failed to provide either Cyphort or Juniper actual notice.

B. Constructive Notice.

Nor did Finjan provide constructive notice. An accused infringer bears only "an initial burden of production to articulate the products it believes are unmarked 'patented articles.' " Arctic Cat Inc. v. Bombardier Recreational Prod. Inc. , 876 F.3d 1350, 1368 (Fed. Cir. 2017), cert. denied , --- U.S. ----, 139 S. Ct. 143, 202 L.Ed.2d 34 (2018). "Once the alleged infringer meets its burden of production, however, the patentee bears the burden to prove the products identified do not practice the patented invention." Ibid. "A patentee's licensees must also comply with [ Section] 287, because the statute extends to 'persons making or selling any patented article for or under the patentee.' " Id. at 1366 (quoting Maxwell v. J. Baker, Inc. , 86 F.3d 1098, 1111 (Fed. Cir. 1996) ). "Recognizing that it may be difficult for a patentee to ensure his licensees' compliance with the marking provisions ... where third parties are involved, courts may consider 'whether the patentee made reasonable efforts to ensure compliance with the marking requirements.' " Ibid. (quoting Maxwell , 86 F.3d at 1111-12). "[T]o satisfy the constructive notice provision of the marking statute," a patent owner must show that "substantially all of [the products covered by the patent] being distributed were marked, and that once marking was begun, the marking was substantially consistent and continuous." Nike, Inc. v. Wal-Mart Stores, Inc. , 138 F.3d 1437, 1446 (Fed. Cir. 1998) (emphasis added).

Finjan has not met its burden here. First , Finjan seemingly attempts to backtrack from its prior admission that Juniper gave adequate Arctic Cat notice in connection with United States Patent No. 8,677,494 ("the '494 patent") (which notice was given at the same level of detail as for the '780 patent ). Specifically, during trial over Claim 10 of the '494 patent, Finjan explicitly stipulated as follows (Dkt. No. 336 at 289:18-290:1 (emphasis added)):

The Court: I'm asking [about] this Arctic notice ... can you both agree that that was given so that we don't have to complicate the trial with yet another issue?
Ms. Kobialka: Yeah , and that's not a jury issue to decide whether or not that notice was given in the litigation.
THE Court: All right. So if I just tell you right now that you've got to prove notice, you are okay with that?
Ms. Kobialka: Yes.

Second , none of Finjan's newly raised arguments are persuasive. It first contends that Juniper failed to meet its burden of production because Juniper did not provide any "specific unmarked products" that it believes practice the '780 patent (Dkt. No. 393 at 34). Not so. This order finds that Juniper met its burden of production when it notified Finjan of the following products it believed practiced the '780 patent (Dkt. No. 371-11 at 3):

Finjan, Inc. : Vital Security Products
WebWasher (currently owned by McAfee, Inc.): WebWasher SCM Suite Products
Sophos, Inc. : Sophos Live Protection Products
Aladdin Knowledge Systems, Inc. : eSafe Products
Webroot Inc. : Webroot Web Security Software Products, Webroot Email Security Products
Licensed products from Veracode, Inc., Avira Holding GmbH & Co. KG, Panda Security, Barracuda Networks, Inc., AVAST, F-Secure Corporation, Microsoft Corporation, Intel Corporation, McAfee, Inc., M86 Security, and Trustwave

Finjan complains that all Juniper provided was a list of "one third party entity that was found to have infringed the '780 Patent in the district court and the appellate court (Secure Computing), two of Finjan's licensees (Sophos and Webroot) and a non-licensee third party (Aladdin), and generally describe[d] some product categories that they offer" (Dkt. No. 393 at 34). It asserts that Juniper should have provided more specific information, such as "the versions of the products and the relevant timeframe during which the products were allegedly available" (ibid. ). But Finjan offers no authority requiring that level of detail in satisfying the initial burden of production.

In fact, meeting this initial burden of production "is a low bar." Arctic Cat , 876 F.3d at 1368. The point of requiring an accused infringer to notify a patent owner of "specific unmarked products" it believes practice the asserted patent is to avoid "a large scale fishing expedition and gamesmanship," as otherwise a patent owner's "universe of products for which it would have to establish compliance would be unbounded." Ibid. Here, at least with respect to the first five specific parties and their products listed by Juniper, Finjan does not sufficiently show how that the list of products provided by Juniper risks gamesmanship. Finjan merely asserts that those product categories "include hundreds of different versions" (Dkt. No. 393 at 34). But versions of products are often easily grouped together and addressed by patent owners themselves.

Finjan next argues that even assuming Juniper met its initial burden of production, it is still not entitled to summary judgment because the third parties identified by Juniper "either do not offer products that practice ... or flatly deny that they practice" the '780 patent (despite Finjan's allegations that those licensees did practice the patent at the time during the relevant litigation) (ibid. ). But whether a licensee does not believe it is practicing the asserted patent is irrelevant to Finjan's burden of proving that the identified products do not practice the patent (and were thus not required to be marked). Finjan's conclusory assertion that "[a]t a minimum, there is a factual dispute regarding whether a licensee was required to mark because it denied infringement in the license" is thus unpersuasive (as are the district court decisions Finjan cites, as they all pre-date Arctic Cat , which shifted the burden of proof from the alleged infringer to the patent owner) (ibid. ). And, Finjan gives no authority for the proposition that simply because certain licensees denied admission of liability when it entered into licensing agreements with Finjan, those licensees were not required to mark as a matter of law (ibid. ). Rather, the appellate court in Arctic Cat held that where the accused infringer "identified fourteen unmarked [third party licensed products], which it argued fell within the patent claims, it was the patentee's burden to establish compliance with the marking statute - that these products did not fall within the patent claims." Arctic Cat , 876 F.3d at 1367 (emphasis added). This burden was imposed despite the fact that the licensing agreement between the patent owner and third party licensee "specifically state[d] [that the third party licensee] 'shall have no obligation or requirement to mark' its licensed products." Id. at 1366. Nor did the appellate court provide any caveats to the patent owner's burden of proof where the accused infringer denies infringement.

There is no dispute that Finjan did not require any of its licensees to mark - it readily admits that "none of Finjan's licenses contain a marking requirement" (Dkt. No. 357 at 15). Nor is there any dispute that none of Finjan's licensees actually marked their products. And, Finjan does not even attempt to offer evidence that the identified products do not practice the '780 patent in support of its burden of proof. Accordingly, this order finds that Finjan failed to give constructive notice of the '780 patent.

* * *

In its opposition Finjan only argues that it provided notice for the ATP Appliance (see Dkt. No. 393 at 31-36). Because Finjan failed to provide actual or constructive notice of infringement as to the '780 patent regarding the ATP Appliance product, notice of infringement could only occur at the filing of the complaint. See 35 U.S.C. § 287(a) ("Filing an action for infringement shall constitute such notice."). Finjan filed the instant action in September 2017. The '780 patent expired November 6, 2017. Finjan, however, did not move for leave to add the ATP Appliance to the instant action until May 2018. As such, this order agrees with Juniper that Finjan did not provide actual notice regarding the ATP Appliance until it served its infringement contentions in March 2018 - four months after the '780 patent expired - and is accordingly barred from recovering any damages as to the ATP Appliance. Juniper's motion for summary judgment of non-infringement in connection with SRX and Sky ATP and on damages in connection with ATP Appliance is therefore GRANTED .

3. JUNIPER'S MOTION TO STRIKE .

Juniper concurrently moves to strike Finjan's allegedly new infringement theories in connection with the '154 patent (Dkt. No. 391). In light of this order's holding of non-infringement, Juniper's motion to strike is DENIED AS MOOT . In the event another '154 patent claim becomes at issue, Juniper may bring a fresh motion to strike.

CONCLUSION

For the foregoing reasons, Finjan's motion for summary judgment of infringement of Claim 1 of the '154 patent is DENIED . Juniper's motion for summary judgment on Claim 9 of the '780 patent and damages is GRANTED to the extent stated above and its motion to strike is DENIED AS MOOT . Both sides are ORDERED TO SHOW CAUSE in writing by MAY 13 AT NOON why summary judgment should not be granted in favor of Juniper with replies by MAY 16 AT NOON .

Further, the trial currently set for July 29 is hereby VACATED . Instead, a final pretrial conference is hereby SET for OCTOBER 9 AT 2 P.M. and trial on all remaining patents and issues is hereby SET for OCTOBER 21 AT 7:30 A.M. The Court invites counsel to submit to the Court by MAY 15 AT NOON what issues must be addressed in the October trial.

IT IS SO ORDERED. 
      
      During oral argument, Finjan argued that Juniper's reasoning regarding the substitute function described the claims of United States Patent No. 7,757,289 ("the '289 patent"), of which the '154 patent is a continuation, "to a tee" (Dkt. No. 457 at 21:15-17). This order finds the argument unpersuasive. First , Claim 1 of the '154 patent differs from the '289 patent claims in that Claim 1 does not claim the whole system - including the gateway, client, and security computer - as the '289 patent does. Claim 1 of the '154 patent as construed thus does not track the '289 patent 's claims "to a tee." Second , given that the '154 patent is a continuation the '289 patent, significant overlap in the substance of the claims is not surprising.
     
      
      In construing the term "content processor," this order finds the issue of "processing modified content" dispositive to this instant motion. Therefore, though Juniper makes a strong argument for the proposition that the content processor resides on the client computer, this order need not and does not reach that issue in construing the term.
     
      
      Finjan does not to argue that SRX and Sky ATP infringe Claim 9 under the Court's previously construed term. This order thus only considers ATP Appliance as the accused product in connection with the instant motion.
     
      
      Finjan argues that the issue of damages is outside the scope of the showdown procedure. This order disagrees. Damages are part and parcel to Finjan's claim of infringement. Juniper does not raise the Section 287 issue as a defense against infringement, but rather, now properly moves on the Section 287 issue.
     
      
      Though the United States Court of Appeals for the Federal Circuit in Arctic Cat found that the accused infringer met its initial burden of production where it "identified fourteen [third party licensee products] from three versions of its Aquatrax series sold between 2002 and 2009," the appellate court explicitly noted that it was not determining "the minimum showing needed to meet the initial burden of production." Arctic Cat , 876 F.3d at 1368.
     
      
      In fact, a jury did find that Sophos's products infringe the '780 patent, and Finjan merely asserts that it "entered into a patent license agreement on March 30, 2017 before the Federal Circuit heard Sophos's appeal of infringement" (Dkt. Nos. 371 at 24; 393 at 36).
     
      
      In light of this holding, this order finds moot the issue of non-infringement as to ATP Appliance.
     