Free Answering Brief in Opposition - District Court of Delaware - Delaware

Case 1:04-cv-01199-SLR

Document 541

Filed 09/10/2008

Page 1 of 9

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF DELAWARE SRI INTERNATIONAL, INC., a California Corporation, Plaintiff and Counterclaim-Defendant, v. INTERNET SECURITY SYSTEMS, INC., a Georgia Corporation, and SYMANTEC CORPORATION, a Delaware corporation, INTERNET SECURITY SYSTEMS, INC., a Delaware corporation, Defendants and Counterclaim- Plaintiffs. DEFENDANTS' RESPONSE TO PLAINTIFF'S BENCH MEMORANDUM REQUESTING JURY INSTRUCTIONS RE: PLURALITY OF NETWORK MONITORS I. INTRODUCTION Faced with unambiguous trial testimony from Defendants' expert Todd Heberlein that the "DIDS" 1991 paper and system disclosed each limitation of the claims of the `203 and `615 patents in 1991, SRI has suddenly found fault with a claim construction issued by this Court almost two years ago. In a bench memorandum submitted on September 8, SRI claims that, through Mr. Heberlein's testimony, "Defendants are now raising a new claim construction at this late date,"1 and requests a jury instruction that defies the common sense meaning of "plurality" such that "plurality of network monitors" requires "a minimum of three monitors, not two."2 In fact, the only claim construction raised by Mr. Heberlein, or Defendants, is the one previously urged by SRI and issued by the Court on October 17, 2006. In that construction, the Civil Action No. 04-CV-1199 (SLR)

1

Plaintiff's Bench Memo. Requesting Jury Instructions Re: Plurality of Network Monitors ("Bench Memo.") at 3. 2 Bench Memo. at 5. 1

Case 1:04-cv-01199-SLR

Document 541

Filed 09/10/2008

Page 2 of 9

Court applied the common sense meaning of "plurality" by holding that "deploying a plurality of network monitors" means "configuring and/or installing two or more network monitors."3 The Court further defined "network monitors" as "[s]oftware and/or hardware that can collect, analyze and/or respond to data"4 and a "hierarchical monitor" as one of the "two or more network monitors": "a network monitor that receives data from at least one network monitor that is at a lower level in the analysis hierarchy."5 Mr. Heberlein's testimony applied these constructions accurately, making clear that both the DIDS paper and system disclose the deployment of a "LAN monitor" and "DIDS Director" that comprise the two or more network monitors required by the Court's construction of the "deploying a plurality of network monitors" limitation. Although styled as a "bench memorandum" requesting a jury instruction, SRI's request is in fact nothing less than a motion for reconsideration of this Court's previous construction. A motion for reconsideration is the "functional equivalent" of a motion to alter or amend the judgment under Fed. R. Civ. P. 59(e),6 and such motions should not be employed "to accomplish [the] repetition of arguments that were or should have been presented to the court previously."7 SRI's request identifies no error or evidence and does little more than present claim construction arguments that contradict those presented by SRI over two years ago. SRI's request also would

3 4 5 6

10/17/06 Memorandum Order Regarding Claim Construction ("Order") at 3 (emphasis added). Order at 2.

Id. at 3 (emphasis added). See Smith v. Evans, 853 F.2d 155, 158-159 (3d Cir.1988); see also Turner v. Evers, 726 F.2d 112, 114 (3d Cir.1984) (the function of the motion, rather than the caption, dictates which Rule applies). 7 See Tristata Tech., Inc. v. ICN Pharms., Inc., 313 F. Supp. 2d 405, 407 (D. Del. 2004) (citation omited); see also Geatti v. AT&T, 232 Fed. Appx. 101, 104 (3rd Cir. 2007) ("disagreement with the outcome of the District Court's opinion is not the proper basis for a motion for reconsideration").

2

Case 1:04-cv-01199-SLR

Document 541

Filed 09/10/2008

Page 3 of 9

effectively reset the Court's construction long after expert witnesses have already testified about the construction and its application. For all these reasons, SRI's requests should be denied. II. ARGUMENT SRI's claim that the issue of the proper construction of the "deploying a plurality of network monitors" limitation "was not joined in the claim construction proceeding"8 is plainly wrong. Even a passing glance at the Court's October 17, 2006 order, and the extensive briefing and argument behind it, shows that the parties and the Court squarely addressed what "deploying a plurality of network monitors" means. "As it raises no new arguments and its purpose is clearly to relitigate the original issue, [SRI's] motion is properly construed as a motion for reconsideration under Rule 59(e)."9 "The purpose of granting motions for reconsideration is to "correct manifest errors of law or fact or to present newly discovery evidence."10 SRI undisputably points to no error of fact or any newly discovered evidence relevant to claim construction to support its position that the Court's previous construction is erroneous. Thus, the only question before the Court is whether SRI has identified any manifest error of law. As set forth below, the Court's previous construction of the "deploying a plurality of network monitors limitation" contains no error of law whatsoever, let alone any manifest error justifying the upending of a week-and-a-half of witness testimony and documentary evidence predicated on the prior construction. A. THE COURT PREVIOUSLY CONSTRUED THE "DEPLOYING A PLURALITY OF NETWORK MONITORS" AND RELATED LIMITATIONS IN ACCORDANCE WITH SRI'S OWN PROPOSED CONSTRUCTIONS AND ESTABLISHED FEDERAL CIRCUIT
PRECEDENT

Over two years ago, SRI and Defendants submitted extensive briefing on the meaning of

8 9

Bench Memo. at 2. Hazel v. Smith, 190 Fed. Appx. 137, 138 (3rd Cir. 2006). 10 Tristrata Tech., Inc. 313 F. Supp. 2d at 407 (quoting Harsco Corp. v. Zlotnicki, 779 F.2d 906,

3

Case 1:04-cv-01199-SLR

Document 541

Filed 09/10/2008

Page 4 of 9

various claim limitations in the asserted claims. The Court considered over 137 pages from the parties addressing 20 claim limitations in dispute, including not only "deploying a plurality of network monitors"--the claim limitation for which SRI now seeks a new construction-- but also the limitations implicated by the "deploying a plurality" limitation: "network monitor," and "hierarchical monitor/hierarchically higher network monitor."11 In its prior claim construction briefing, SRI insisted that the "deploying a plurality of network monitors" limitation did not need construction.12 According to SRI, the limitation did not require construction because it "do[es] not involve technical terminology and/or [its] plain English-language meaning is clear and unambiguous."13 SRI nevertheless proposed that if the limitation were to be construed, it should be defined as "locating two or more network monitors so as to allow them to receive data to be monitored and/or send information."14 SRI further urged that "network monitor" be defined to include monitors that analyze "reports" as follows: "process or component in a network that can analyze data; depending on the context in specific claims the network monitor may analyze network traffic data, reports of suspicious network activity or both. Service monitors, domain monitors, and enterprise monitors are examples of network monitors."15 SRI similarly urged that "hierarchical monitor/hierachically higher network monitor" be defined as "process or component in a network that receives reports from at least one lower-level

909 (3rd Cir. 1985)). 11 Rather than supporting SRI's argument, O2 Micro Intern. Ltd. v. Beyond Innovation Tech. Co., Ltd., 521 F.3d 1351, 1362 (Fed. Cir. 2008) undermines it. In O2 Micro, the Federal Circuit held that the district court had a duty to resolve any "fundamental dispute regarding the scope of a claim term." That is precisely what this Court did over two years ago when it construed the "deploying a plurality of network monitors" limitation.
12 13

SRI's Opening Claim Construction Br. ("SRI's Opening Br.") at 20-21. SRI's Opening Br. at 20. 14 Id..(emphasis added). Even before briefing, in the parties' Joint Claim Construction Statement, SRI agreed that "plurality" should be defined as "more than one." Joint Claim Construction Statement at 7. 15 Id. at 7. (emphasis added).

4

Case 1:04-cv-01199-SLR

Document 541

Filed 09/10/2008

Page 5 of 9

monitor."16 During oral argument on August 26, 2006, SRI's counsel agreed to a number of modifications to its originally proposed constructions. For example, with respect to the "network monitor" limitation, SRI agreed that the limitation could be construed as "software or hardware" that "collects, analyzes and/or responds to" data.17 Similarly, SRI's counsel agreed that a "hierarchical monitor" is "a network monitor" that "automatically receives and integrates the reports."18 In light of SRI's agreements, on October 17, 2006 the Court issued its constructions of these disputed terms. First, the Court defined "deploying a plurality of network monitors" as "configuring and/or installing two or more network monitors." The Court further noted that "[c]onsistent with the above construction of `network monitor,' software is configured and hardware is installed."19 Second, "network monitors" was defined as "[s]oftware and/or hardware that can collect, analyze and/or respond to data."20 Third, the Court defined "hierarchical monitor/hierarchically higher network monitor" as "[a] network monitor that receives data from at least one network monitor that is at a lower level in the analysis hierarchy."21 The net result of all of this is that the Court adopted the very constructions of the

Id. at 11. 17 8/23/06 Hearing Tr. at 4:17-5:16. 18 8/23/06 Hearing Tr. at 15:2-6 ("Is a hierarchical monitor a type of network monitor? Yes, it is, using our definition, absolutely."). During his deposition, Dr. Kesidis agreed: "Q: so a network monitor can monitor just reports of suspic - suspicious - suspicious activity? ["Same objections."] A: certain network monitors may." 5/26/06 Kesidis Dep. Tr. at 392:21-25. See also 9/4/08 Trial Tr. at 611:2-7 ("Can you read for us the definition of hierarchial monitor also applies to hierarchically higher network monitor? A. It means a network monitor that receives data from at least one network monitor that is at a lower level in the analysis hierarchy."). 19 Order at 3. 20 Id. at 2. 21 Id. at 3.

16

5

Case 1:04-cv-01199-SLR

Document 541

Filed 09/10/2008

Page 6 of 9

"plurality network monitor," "network monitor" and" "hierarchical monitor/hierarchically higher network monitor" that SRI urged. SRI's newly proposed construction would not only ignore SRI's previous arguments upon which the Court relied, it would introduce legal error where none currently exists. For example, SRI would have this Court construe the "deploying a plurality of network monitors" limitation to require that each of the plurality of network monitors be "lower-level monitors" that "directly monitor network traffic data."22 But this construction would ignore the plain language of the "deploying a plurality of network monitors" limitation that SRI was previously so eager to urge on this Court.23 In particular, the claim limitation does not, as SRI urges, read "deploying a plurality of lower-level monitors." Even a passing glance at the asserted claims confirms that the "lower-level" language appears nowhere in any of the asserted claims. Indeed, the only support for SRI's new construction comes from selected portions of the specification that address particular embodiments of the claimed invention.24 As SRI itself put so well in its claims construction brief, "characteristics of embodiments described in the specification cannot be read as limitations of the claims."25 SRI's newly proposed construction also conflates the construction of a "network monitor" with the Court's previous construction of "service monitor": "a network monitor that provides local real-time analysis of network packets transmitted by a network entity, such as a

Bench Memo. at 5. SRI's Opening Br. at 20. See also Johnson Worldwide Assocs., Inc. v. Zebco Corp., 175 F.3d 985, 989 (Fed. Cir. 1999) (holding that claims having plain English-language meanings are presumed to "mean what they say"). 24 See Bench Memo. at 5 (citing `615 patent, at 3:40-50; 6:43-46; 7:43-47; 8:50-56; 9:18-21; 10:14-17; and 12:24-27). 25 SRI's Opening Br. at 6 (quoting Phillips, 415 F.3d at 1316 and TurboCare, 264 F.3d at 1123).
23

22

6

Case 1:04-cv-01199-SLR

Document 541

Filed 09/10/2008

Page 7 of 9

gateway, router, firewall or proxy server."26 As this Court is well aware, "[d]ifferent claim terms are presumed to have different meanings."27 SRI certainly could have chosen to draft its claims to require "deploying a plurality of service monitors" rather than "network monitors." But it chose not to do so, and this Court should not do so at this eleventh hour by adopting an entirely different construction from the one tendered in the October 17, 2006 order.

B.

MR. HEBERLEIN HAS AT ALL TIMES APPLIED THE CLAIM CONSTRUCTION URGED BY SRI AND ORDERED BY THE COURT

SRI predicates its entire motion on a single question and answer from Mr. Heberlein's trial testimony, and complains that it reveals a "new theory" that the "plurality of network monitors" can include the DIDS director that was not revealed in Mr. Heberlein's expert report: Q. So let's go onto the next limitation. Deploying a plurality of network monitors in the enterprise network. A. So once again, just looking at the figure, plurality means two or more. So in this particular case, we have two network monitors, the lower LAN monitor on the right, and the upper DIDS director, which is also called the network monitor, per the Court's definitions.28 But in fact, this testimony was disclosed almost verbatim in Mr. Heberlein's report and supporting claims charts. There Mr. Heberlein specifically addressed the "deploying a plurality of network monitors" limitation and opined that "[t]hese components include a DIDS director, a collection of host monitors, and at least one LAN monitor."29 The report further notes that

although Mr. Heberlein--like SRI's own expert Dr. Kesidis-- disclosed his invalidity opinions

26

Order at 3. SRI's expert Dr. Kesidis himself applied this definition of service monitor: "What is the service monitor looking at? A. They're looking at network packets, that kind of data. That's what they analyze." 9/4/08 Trial Tr. at 581:13-15. 27 Board of Regents of the Univ. of Texas Sys. v. BENQ Am. Corp., 533 F.3d 1362, 1371 (Fed. Cir. 2008). 28 Bench Memo. at 2 (citing 9/5/08 Trial Tr. at 1012:16-23.). 29 4/21/06 Invalidity Expert Report of L. Todd Heberlein , Ex. D at 64. 7

Case 1:04-cv-01199-SLR

Document 541

Filed 09/10/2008

Page 8 of 9

before the Court's October 17 Order (in accordance with the Court's Scheduling Order), he was asked "for purposes of this analysis to assume that the Court adopts the claim construction position advanced by SRI."30 If SRI had any doubts about this opinion regarding the DIDS Director as one of the deployed plurality of network monitors, SRI could have asked questions of Mr. Heberlein in either or both of the two days of his deposition. SRI chose not to do so. That SRI may now regret its decision not to ask even a single question about this limitation is no reason to revisit the Court's construction of the "deploying a plurality of network monitors" in the middle of trial.

C.

IF THE COURT ADOPTS SRI'S PROPOSED NEW CONSTRUCTION, DEFENDANTS WOULD BE ENTITLED TO JUDGMENT OF NON-INFRINGEMENT AS A MATTER OF LAW

As both Defendants have made clear in their respective motions for judgment as a matter of law, SRI's proposed new construction is impossible to reconcile with SRI's theories of infringement. In particular, if the claimed methods and systems require the deployment of not just two but three network monitors, SRI has failed to offer any evidence either that Defendants' products necessarily practice the limitation or do so in any specific instance.31 For example, SRI failed to identify any specific instance where either Symantec or any Symantec customer deployed two or more Symantec Gateway Security ("SGS") product and one Symantec Manager product (let alone a Manager product adapted to automatically receive and integrate events

Id. at 22. See Acco Brands, Inc. v. ABA Locks Manufacturer Co., Ltd., 501 F.3d 1307, 1313 (Fed. Cir. 2007) (citing Dynacore Holdings Corp. v. U.S. Philips Corp., 363 F.3d 1263, 1275-76 (Fed. Cir. 2004)) (emphasis added).
31

30

8

Case 1:04-cv-01199-SLR

Document 541

Filed 09/10/2008

Page 9 of 9

generated by the two SGS products) in an enterprise network.32 Similarly, SRI has not introduced any evidence that ISS or any ISS customer deployed two or more of the accused Proventia or RealSecure sensors in combination with the Fusion 2.0 add-on module of SiteProtector with the optional Attack Pattern Component ("APC") configured and installed.33 III. CONCLUSION SRI's proposal for a new and fundamentally different claim construction would lead to an error of law and juror confusion at any time, let alone almost two years after this Court's claim construction order. The Court should decline this invitation to revisit issues that should have been put to rest before trial began, not after.

Dated: September 10, 2008 /s/ Richard K. Herrmann Richard K. Herrmann (#405) MORRIS JAMES LLP 500 Delaware Avenue, Suite 1500 Wilmington, DE 19801 Telephone: (302) 888-6800 [email protected] _ /s/ Richard L. Horwitz _ Richard L. Horwitz (#2246) POTTER ANDERSON & CORROON LLP 1313 North Market Street Wilmington, DE 19801 Telephone: (302) 984-6000 [email protected] Holmes J. Hawkins, III (pro hac vice) Kyle Wagner Compton (pro hac vice) Charles A. Pannell, III (pro hac vice) KING & SPALDING LLP 1180 Peachtree Street Atlanta, GA 30309 Telephone: (404) 572-4600 Attorneys for Defendant/Counterclaim-Plaintiff INTERNET SECURITY SYSTEMS, INC.

Robert M. Galvin (pro hac vice) Paul S. Grewal (pro hac vice) Renee DuBord Brown (pro hac vice) DAY CASEBEER MADRID & BATCHELDER LLP 20300 Stevens Creek Boulevard, Suite 400 Cupertino, CA 95014 Telephone: (408) 873-0110 Attorneys for Defendant/Counterclaim-Plaintiff SYMANTEC CORPORATION

See 9/4/08 Tr. 740:11-15, 741:3-742:8 (Kesidis); see also PTX-156 (no SGS or Manager Products at Marsh); 9/4/08 Tr. 562:5-21, 565:12-20 (Agbabian) (no proof of combination at Aetna). 33 9/4/08 Trial Tr. at 705:11-706:5.

32

9