Free Letter - District Court of Delaware - Delaware

Case 1:04-cv-01199-SLR

)LVK

5LFKDUGVRQ SF

Document 502

Filed 04/29/2008

Page 1 of 3
6XLWH 1 0DUNHW 6WUHHW SR %R[ :LOPLQJWRQ 'HODZDUH 7HOHSKRQH )DFVLPLOH :HE 6LWH ZZZIUFRP

! % $ %! ¤9¤ 8"¤ ¤§¤5¢© ¨310 )( 7 6 ¥¡4 2

FB"9CTRS @ C @

¢#Ip8gfi#qVpA F U AI DI

¤ ¤#"¤ '& % $!! ¢© ¤¦§¦¤¢ ¨ ¨¡£ ¥£¡

BY ELECTRONIC FILING April 29, 2008 The Honorable Sue L. Robinson United States District Court 844 King Street Wilmington, DE 19801 Re:

a
§A3DB"BAB@ @ @ C D Q A Q RBHFGBP DI A E 8BHFGB@

SRI International Inc. v. Internet Security Systems, Inc., et al. USDC-D. Del. - C. A. No. 04-1199 (SLR)

Dear Judge Robinson: This letter responds to Symantec's letter of April 25, 2008, regarding its effort to reargue a summary judgment motion seeking a ruling that two of the three patents-insuit would have been obvious at the time of the inventions based upon a combination of certain prior art. Symantec's letter ­ presenting unsolicited substantive argument regarding its contentions ­ is not what SRI understands the Court to have requested, and in any event provides nothing new that would warrant a second look. To the extent the Court needs to hear anything further on these issues, SRI respectfully offers the following brief response to summarize the relevant factual disputes. Symantec relies upon two references: "EMERALD 1997" and "Intrusive Activity 1991" and asserts that EMERALD 1997 discloses all but one of the elements in the asserted claims. Symantec then argues the existence of two purportedly "undisputed" facts: (i) a motivation to combine the two references exists because the 1997 reference cites the 1991 reference; and (ii) the 1991 reference discloses the one element missing from 1997 reference. Symantec's assertions are at odds with the record and, hence, disputed by SRI. A few of the material disputes are noted below. First, Symantec minimizes the importance of the element admittedly missing from the EMERALD 1997 reference. As explained by SRI's prior submissions to the Court, EMERALD 1997 provided an overview of an intrusion detection system under development. See generally D.I. 300, 301, 339, 340, 348. The `203 and `615 patents, which were filed later, disclosed and claimed additional information learned by the inventors concerning the use of particular network traffic data that was critical to the practical implementation and success of the approach set forth in SRI's patents. This vitally important information is absent from the EMERALD 1997 reference. Second, EMERALD 1997 briefly references Intrusive Activity 1991 for its discussion of the "Network Security Monitor" (NSM). D.I. 301, Ex. E at 364. NSM was a system for use with Local Area Networks (LAN) that allowed for monitoring the established connections among a relatively limited number of host computers on a

U X @ @ C TBWVB"¢U3S §9T¢iGQg8I9#"F ` U C C @ h D f CI fGYuvRQBgY8tHFTrV S D A e DI s @ b X Q ` TR¢aV§YD U Q e U S D @ R§#I3dBcF

Case 1:04-cv-01199-SLR

)LVK

5 L F K D U G V R Q SF

Document 502

Filed 04/29/2008

Page 2 of 3

The Honorable Sue L. Robinson April 29, 2008 Page 2 LAN. This approach is neither practical nor scalable for use in the enterprise network of the claimed inventions, where an overwhelming amount of information from innumerable sources is continuously being transferred. This fundamental difference in technology lies at the heart of the disputes between the parties, including the extensive briefing and expert reports that have addressed both sides of these and related issues. See generally D.I. 300, 301, 339, 340, 348. Because the claimed inventions and NSM work in completely different ways and are fundamentally incompatible, a brief notation in one reference to the other does not provide a reason for importing the substantive teachings from one to the other ­ much less constitute a basis for concluding as a matter of law that any such motivation existed. Indeed, the details of the literature concerning the NSM system which SRI' s expert both provided and explained, in fact establish that the NSM approach teaches away from the claimed inventions and that the NSM could not have been combined with the very different technology described in the EMERALD paper. Third, focusing on the actual text of the 1991 paper, the excerpted citation Symantec now relies upon from Intrusive Activity 1991 actually concerns the syntax for creating a descriptive language that provided the general framework for the NSM. The cited language says literally nothing about using packet data volume to detect suspicious activity ­ nor does any other portion of the 1991 reference. Indeed, the 1991 paper nowhere describes specifically what type of data might be (or are) examined by the described system in order to determine whether activity is suspicious. Thus, the opinion of SRI' s expert, Dr. Kesidis, concerning these references, far from being " unsupported" as Symantec alleges, is a well-reasoned analysis of the entire reference, based on: (i) an understanding of how the NSM system actually worked; (ii) critical context available elsewhere in the paper Symantec cites: as well as (iii) the many papers providing salient details on the NSM system which are omitted from Symantec' s analysis and letter. Lastly, Symantec' s attempt to dismiss the secondary considerations considerations evidence mischaracterizes KSR' s holding. As the Court is aware, KSR actually reemphasized the importance of secondary considerations to guard against hindsight determinations of "prima facie" obviousness. Here, SRI' s evidence on secondary considerations, if credited by the fact-finder, would be sufficient to defeat Symantec' s obviousness contentions, at least when coupled with the factually-supported analysis of Dr. Kesidis. Thus, given that SRI has presented credible evidence that would amply support a reasonable juror' s rejection of Symantec' s validity attack, there are substantial disputes of material fact that preclude ruling that, as a matter of law, the `203 and

Case 1:04-cv-01199-SLR

)LVK

5 L F K D U G V R Q SF

Document 502

Filed 04/29/2008

Page 3 of 3

The Honorable Sue L. Robinson April 29, 2008 Page 3 `615 would have been obvious to one of ordinary skill based on the single combination of references which Symantec wants the Court to reconsider. Respectfully, /s/ Thomas L. Halkowski Thomas L. Halkowski TLH/dob cc: Richard L. Horwitz, Esq. Richard K. Herrmann Esq.