Sri International, Inc. v. Cisco Systems, Inc. ( 2019 )

United States Court of Appeals
for the Federal Circuit
______________________
SRI INTERNATIONAL, INC.,
Plaintiff-Appellee
v.
CISCO SYSTEMS, INC.,
Defendant-Appellant
______________________
2017-2223
______________________
Appeal from the United States District Court for the
District of Delaware in No. 1:13-cv-01534-SLR-SRF, Judge
Sue L. Robinson.
______________________
OPINION ISSUED: March 20, 2019
OPINION MODIFIED: July 12, 2019 ∗
______________________
FRANK SCHERKENBACH, Fish & Richardson, PC, Bos-
ton, MA, argued for plaintiff-appellee. Also represented by
PROSHANTO MUKHERJI; DAVID MICHAEL HOFFMAN, Austin,
TX; HOWARD G. POLLACK, Redwood City, CA; FRANCIS J.
ALBERT, JOHN WINSTON THORNBURGH, San Diego, CA.
∗ This opinion has been modified and reissued fol-
lowing a petition for rehearing filed by Defendant-Appel-
lant.
2 SRI INT’L, INC. v. CISCO SYS., INC.
WILLIAM F. LEE, Wilmer Cutler Pickering Hale and
Dorr LLP, Boston, MA, argued for defendant-appellant.
Also represented by ANDREW J. DANFORD, LAUREN B.
FLETCHER, LOUIS W. TOMPROS.
______________________
Before LOURIE, O’MALLEY, and STOLL, Circuit Judges.
Opinion for the court filed by Circuit Judge STOLL.
Dissenting opinion filed by Circuit Judge LOURIE.
STOLL, Circuit Judge.
This is an appeal from a final judgment in a patent
case. Cisco Systems, Inc. (“Cisco”) appeals the district
court’s (1) denial of Cisco’s motion for summary judgment
of patent ineligibility under § 101, (2) construction of the
claim term “network traffic data,” (3) grant of summary
judgment of no anticipation, and (4) denial of judgment as
a matter of law of no willful infringement. Cisco also ap-
peals the district court’s grant of enhanced damages, attor-
neys’ fees, and ongoing royalties.
We affirm the district court’s denial of summary judg-
ment of ineligibility, adopt its construction of “network
traffic data,” and affirm its summary judgment of no antic-
ipation. We vacate and remand the district court’s denial
of judgment as a matter of law of no willful infringement,
and therefore vacate and remand the district court’s en-
hancement of damages and award of attorneys’ fees. Fi-
nally, we affirm the district court’s award of ongoing
royalties on post-verdict sales of products that were actu-
ally found to infringe or are not colorably different. Accord-
ingly, we affirm-in-part, vacate-in-part, and remand for
further proceedings consistent with this opinion.
SRI INT’L, INC. v. CISCO SYS., INC. 3
BACKGROUND
I
While the interconnectivity of computer networks facil-
itates access for authorized users, it also increases a net-
work’s susceptibility to attacks from hackers, malware,
and other security threats. Some of these security threats
can only be detected with information from multiple
sources. For instance, a hacker may try logging in to sev-
eral computers or monitors in a network. The number of
login attempts for each computer may be below the thresh-
old to trigger an alert, making it difficult to detect such an
attack by looking at only a single monitor location in the
network. In an attempt to solve this problem, SRI devel-
oped the inventions claimed in U.S. Patent Nos. 6,484,203
and 6,711,615. The ’615 patent (titled “Network Surveil-
lance”) is a continuation of the ’203 patent (titled “Hierar-
chical Event Monitoring and Analysis”).
II
SRI had performed considerable research and develop-
ment on network intrusion detection prior to filing the pa-
tents-in-suit. In fact, SRI’s Event Monitoring Enabling
Responses to Anomalous Live Disturbances (“EMERALD”)
project had attracted considerable attention in this field.
The Department of Defense’s Defense Advanced Research
Projects Agency, which helped fund EMERALD, called it a
“gem in the world of cyber defense” and “a quantum leap
improvement over” previous technology. J.A. 1272–73
at 272:16–17, 273:7–9. In October 1997, SRI presented a
paper entitled “EMERALD: Event Monitoring Enabling
Responses to Anomalous Live Disturbances”
(“EMERALD 1997”) at the 20th National Information Sys-
tems Security Conference.
EMERALD 1997 is a conceptual overview of the
EMERALD system. It describes in detail SRI’s early re-
search in intrusion detection technology and outlines the
4 SRI INT’L, INC. v. CISCO SYS., INC.
development of next generation technology for detecting
network anomalies. SRI Int’l Inc. v. Internet Sec. Sys., Inc.,
647 F. Supp. 2d 323, 334 (D. Del. 2009). The parties do not
dispute that EMERALD 1997 constitutes prior art under
35 U.S.C. § 102(b). EMERALD 1997 is listed as a reference
on the face of the ’615 patent.
III
The patents share a nearly identical specification and
a priority date of November 9, 1998. At the summary judg-
ment stage, SRI asserted claims 1–4, 14–16, and 18 of the
’615 patent and claims 1–4, 12–15, and 17 of the ’203 pa-
tent. By the time of trial, SRI had narrowed the asserted
claims to claims 1, 2, 12, and 13 of the ’203 patent and
claims 1, 2, 13, and 14 of the ’615 patent. The jury consid-
ered only this narrower set of claims.
The parties identify different representative claims.
Cisco proposes claim 1 of the ’203 patent, while SRI pro-
poses claim 1 of the ’615 patent. The claims are substan-
tially similar, as the minor differences between them are
not material to any issue on appeal. As such, we adopt
SRI’s proposal and use ’615 patent claim 1 as the repre-
sentative claim. 1 It reads:
1. A computer-automated method of hierarchical
event monitoring and analysis within an enterprise
network comprising:
1 The minor differences between the two claims are
in the detecting clause—claim 1 of the ’615 patent allows
for network traffic data selected from “one or more of” the
enumerated categories, and includes two extra categories
in its list: “network connection acknowledgements” and
“network packets indicative of well-known network-service
protocols.” Compare ’203 patent col. 14 ll. 19–35 (claim 1),
with ’615 patent col. 15 ll. 2–21 (claim 1).
SRI INT’L, INC. v. CISCO SYS., INC. 5
deploying a plurality of network monitors in
the enterprise network;
detecting, by the network monitors, suspicious
network activity based on analysis of network
traffic data selected from one or more of the fol-
lowing categories: {network packet data trans-
fer commands, network packet data transfer
errors, network packet data volume, network
connection requests, network connection deni-
als, error codes included in a network packet,
network connection acknowledgements, and
network packets indicative of well-known net-
work-service protocols};
generating, by the monitors, reports of said
suspicious activity; and
automatically receiving and integrating the re-
ports of suspicious activity, by one or more hi-
erarchical monitors.
’615 patent col. 15 ll. 2–21.
After SRI sued Cisco for infringement of the ’615 pa-
tent and the ’203 patent, Cisco unsuccessfully moved for
summary judgment on several issues, including that the
claims are ineligible and that the EMERALD 1997 refer-
ence anticipates the claims. 2 SRI Int’l, Inc. v. Cisco Sys.,
2 The patents previously survived multiple anticipa-
tion challenges based on the EMERALD 1997 reference.
The Patent Office considered EMERALD 1997 during the
original prosecution and issued the patents over it.
J.A. 32734 ¶ 47; J.A. 32814–15 ¶ 207. In addition, during
the two reexaminations, the Patent Office again considered
the validity of the asserted claims over EMERALD 1997
and again found the claims valid. J.A. 32734 ¶ 47. Addi-
tionally, in SRI International Inc. v. Internet Security
6 SRI INT’L, INC. v. CISCO SYS., INC.
Inc., 179 F. Supp. 3d 339 (D. Del. Apr. 11, 2016) (“Sum-
mary Judgment Op.”). The district court denied Cisco’s mo-
tions and instead sua sponte granted summary judgment
of no anticipation in SRI’s favor. 3 Id. at 369.
The court then held a jury trial on infringement, valid-
ity, and willful infringement of claims 1, 2, 13, and 14 of
the ’615 patent and claims 1, 2, 12, and 13 of the ’203 pa-
tent, as well as damages. The jury found that Cisco intru-
sion protection system (“IPS”) products, Cisco remote
management services, Cisco IPS services, Sourcefire 4 IPS
products, and Sourcefire professional services directly and
indirectly infringed the asserted claims. The jury awarded
SRI a 3.5% reasonable royalty for a total of $23,660,000 in
compensatory damages. The jury also found by clear and
convincing evidence that Cisco’s infringement was willful.
After post-trial briefing, the district court denied
Cisco’s renewed motion for JMOL of no willfulness. SRI
Systems, Inc., a jury found the patents not anticipated by
EMERALD 1997. 647 F. Supp. 2d at 350. The district
court denied JMOL, concluding that the verdict was sup-
ported by expert testimony that EMERALD 1997 failed to
disclose the claim limitation at issue. Id. We affirmed
without opinion. SRI Int’l Inc. v. Internet Sec. Sys., Inc.,
401 F. App’x 530 (Fed. Cir. 2010).
3 The parties disputed only whether
EMERALD 1997 discloses detection of any of the network
traffic data categories listed in claim 1 of the ’203 and
’615 patents and whether EMERALD 1997 is enabled.
One of the claimed categories of network traffic is “network
connection requests,” which Cisco asserts is disclosed by
EMERALD 1997.
4 “Sourcefire” is a network security company that
Cisco acquired in 2013. J.A. 2467–68. Cisco now markets
network security products and services under the
Sourcefire name.
SRI INT’L, INC. v. CISCO SYS., INC. 7
Int’l, Inc. v. Cisco Sys., Inc., 254 F. Supp. 3d 680, 717
(D. Del. 2017) (“Post-Trial Motions Op.”). Based on the
willfulness verdict, the district court determined that
“some enhancement is appropriate given Cisco’s litigation
conduct,” the “fact that Cisco lost on all issues during sum-
mary judgment,” and “its apparent disdain for SRI and its
business model.” Id. at 723. The court then doubled the
damages award. It also granted SRI’s motion for attorneys’
fees, compulsory license, and prejudgment interest.
Cisco appeals the district court’s claim construction
and denial of summary judgment of ineligibility, 5 as well
as its grant of summary judgment of no anticipation, en-
hanced damages, attorneys’ fees, and ongoing royalties.
We have jurisdiction under 28 U.S.C. § 1295(a)(1).
DISCUSSION
I
We review de novo whether a claim is drawn to patent-
eligible subject matter. Berkheimer v. HP Inc., 881 F.3d
1360, 1365 (Fed. Cir. 2018) (citing Intellectual Ventures I
LLC v. Capital One Fin. Corp., 850 F.3d 1332, 1338
(Fed. Cir. 2017)). Section 101 defines patent-eligible
5 We may review this denial of summary judgment
because “a denial of a motion for summary judgment may
be appealed, even after a final judgment at trial, if the mo-
tion involved a purely legal question and the factual dis-
putes resolved at trial do not affect the resolution of that
legal question.” United Techs. Corp. v. Chromalloy Gas
Turbine Corp., 189 F.3d 1338, 1344 (Fed. Cir. 1999) (citing
Wolfgang v. Mid-Am. Motorsports, Inc., 111 F.3d 1515,
1521 (10th Cir. 1997); Rekhi v. Wildwood Indus., Inc.,
61 F.3d 1313, 1318 (7th Cir. 1995)). Neither party con-
tends that fact issues arise in the patent-eligibility analysis
in this case. Therefore, we may review the purely legal
question of patent eligibility.
8 SRI INT’L, INC. v. CISCO SYS., INC.
subject matter as “any new and useful process, machine,
manufacture, or composition of matter, or any new and
useful improvement thereof.” 35 U.S.C. § 101. Laws of na-
ture, natural phenomena, and abstract ideas, however, are
not patentable. See Mayo Collaborative Servs. v. Prome-
theus Labs., Inc., 566 U.S. 66, 70–71 (2012) (citing Dia-
mond v. Diehr, 450 U.S. 175, 185 (1981)).
To determine whether a patent claims ineligible sub-
ject matter, the Supreme Court has established a two-step
framework. First, we must determine whether the claims
at issue are directed to a patent-ineligible concept such as
an abstract idea. Alice Corp. v. CLS Bank Int’l, 573 U.S.
208, 217 (2014). Second, if the claims are directed to an
abstract idea, we must “consider the elements of each claim
both individually and ‘as an ordered combination’ to deter-
mine whether the additional elements ‘transform the na-
ture of the claim’ into a patent-eligible application.” Id.
(quoting Mayo, 566 U.S. at 79). To transform an abstract
idea into a patent-eligible application, the claims must do
“more than simply stat[e] the abstract idea while adding
the words ‘apply it.’” Id. at 221 (quoting Mayo, 566 U.S.
at 72 (internal alterations omitted)).
We resolve the eligibility issue at Alice step one and
conclude that claim 1 is not directed to an abstract idea.
See Enfish, LLC v. Microsoft Corp., 822 F.3d 1327, 1337
(Fed. Cir. 2016). The district court concluded that the
claims are more complex than merely reciting the perfor-
mance of a known business practice on the Internet and are
better understood as being necessarily rooted in computer
technology in order to solve a specific problem in the realm
of computer networks. Summary Judgment Op.,
179 F. Supp. 3d at 353–54 (citing ’203 patent col. 1 ll. 37–
40; DDR Holdings, LLC v. Hotels.com, L.P., 773 F.3d 1245,
1257 (Fed. Cir. 2014)). We agree. The claims are directed
to using a specific technique—using a plurality of network
monitors that each analyze specific types of data on the
network and integrating reports from the monitors—to
SRI INT’L, INC. v. CISCO SYS., INC. 9
solve a technological problem arising in computer net-
works: identifying hackers or potential intruders into the
network.
Contrary to Cisco’s assertion, the claims are not di-
rected to just analyzing data from multiple sources to de-
tect suspicious activity. Instead, the claims are directed to
an improvement in computer network technology. Indeed,
representative claim 1 recites using network monitors to
detect suspicious network activity based on analysis of net-
work traffic data, generating reports of that suspicious ac-
tivity, and integrating those reports using hierarchical
monitors. ’615 patent col. 15 ll. 2–21. The “focus of the
claims is on the specific asserted improvement in computer
capabilities”—that is, providing a network defense system
that monitors network traffic in real-time to automatically
detect large-scale attacks. Enfish, 822 F.3d at 1335–36.
The specification bolsters our conclusion that the
claims are directed to a technological solution to a techno-
logical problem. The specification explains that, while
computer networks “offer users ease and efficiency in ex-
changing information,” ’615 patent col. 1 ll. 28–29, “the
very interoperability and sophisticated integration of tech-
nology that make networks such valuable assets also make
them vulnerable to attack, and make dependence on net-
works a potential liability.” Id. at col. 1 ll. 36–39. The
specification further teaches that, in conventional net-
works, seemingly localized triggering events can have glob-
ally disastrous effects on widely distributed systems—like
the 1980 ARPAnet collapse and the 1990 AT&T collapse.
See id. at col. 1 ll. 43–47. The specification explains that
the claimed invention is directed to solving these weak-
nesses in conventional networks and provides “a frame-
work for the recognition of more global threats to
interdomain connectivity, including coordinated attempts
to infiltrate or destroy connectivity across an entire net-
work enterprise.” Id. at col. 3 ll. 44–48.
10 SRI INT’L, INC. v. CISCO SYS., INC.
Cisco argues that the claims are directed to an abstract
idea for three primary reasons. First, Cisco argues that the
claims are analogous to those in Electric Power Group, LLC
v. Alstom S.A., 830 F.3d 1350 (Fed. Cir. 2016), and are
simply directed to generic steps required to collect and an-
alyze data. We disagree. The Electric Power claims were
drawn to using computers as tools to solve a power grid
problem, rather than improving the functionality of com-
puters and computer networks themselves. Id. at 1354.
We conclude that the claims are more like the patent-eligi-
ble claims in DDR Holdings. In DDR, we emphasized that
the claims were directed to more than an abstract idea that
merely required a “computer network operating in its nor-
mal, expected manner.” 773 F.3d at 1258. Here, the claims
actually prevent the normal, expected operation of a con-
ventional computer network. Like the claims in DDR, the
claimed technology “overrides the routine and conventional
sequence of events” by detecting suspicious network activ-
ity, generating reports of suspicious activity, and receiving
and integrating the reports using one or more hierarchical
monitors. Id.
Second, Cisco argues that the invention does not in-
volve “an improvement to computer functionality itself.”
Enfish, 822 F.3d at 1336. In Alice, the Supreme Court ad-
vised that claims directed to independently abstract ideas
that use computers as tools are still abstract. 573 U.S.
at 222–23. However, the claims here are not directed to
using a computer as a tool—that is, automating a conven-
tional idea on a computer. Rather, the representative
claim improves the technical functioning of the computer
and computer networks by reciting a specific technique for
improving computer network security.
Cisco also submits that the asserted claims are so gen-
eral that they encompass steps that people can “go through
in their minds,” allegedly confirming that they are directed
to an abstract concept. Appellant Br. 27–28 (citing Capital
One, 850 F.3d at 1340; Intellectual Ventures I LLC v.
SRI INT’L, INC. v. CISCO SYS., INC. 11
Symantec Corp., 838 F.3d 1307, 1318 (Fed. Cir. 2016); Cy-
berSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366,
1371 (Fed. Cir. 2011)). We disagree. This is not the type
of human activity that § 101 is meant to exclude. Indeed,
we tend to agree with SRI that the human mind is not
equipped to detect suspicious activity by using network
monitors and analyzing network packets as recited by the
claims.
Because we conclude that the claims are not directed
to an abstract idea under step one of the Alice analysis, we
need not reach step two. See Enfish, 822 F.3d at 1339. Ac-
cordingly, we affirm the district court’s summary judgment
that the claims are patent-eligible.
II
A district court’s claim construction based solely on in-
trinsic evidence is a legal question that we review de novo.
See Teva Pharm. USA, Inc. v. Sandoz, Inc., 135 S. Ct. 831,
841 (2015). Claim construction seeks to ascribe the “ordi-
nary and customary meaning” to claim terms as a person
of ordinary skill in the art would have understood them at
the time of invention. Phillips v. AWH Corp., 415 F.3d
1303, 1312–14 (Fed. Cir. 2005) (en banc) (quoting Vitronics
Corp. v. Conceptronic, Inc., 90 F.3d 1576, 1582 (Fed. Cir.
1996)). “[T]he claims themselves provide substantial guid-
ance as to the meaning of particular claim terms.” Id.
at 1314. In addition, “the person of ordinary skill in the art
is deemed to read the claim term not only in the context of
the particular claim in which the disputed term appears,
but in the context of the entire patent, including the speci-
fication.” Id. at 1313.
The district court construed “[n]etwork traffic data” to
mean “data obtained from direct examination of network
packets.” SRI Int’l, Inc. v. Dell Inc., No. CV13-1534-SLR,
2015 WL 2265756, at *1–2 (D. Del. May 14, 2015). After
reviewing the parties’ pleadings on summary judgment,
the district court determined that its construction would
12 SRI INT’L, INC. v. CISCO SYS., INC.
benefit from clarification. The district court explained that
“[t]o say that the data ‘is obtained from direct examination
of network packets’ means to differentiate the original
source of the data, not how or where the data is ana-
lyzed. . . . The fact that the data may be stored before anal-
ysis is performed on the data does not detract from its
lineage.” Summary Judgment Op., 179 F. Supp. 3d at 363.
The district court explicitly rejected the opinion of Cisco’s
expert, Dr. Clark, that the court’s claim construction
should require that the analysis of data obtained from net-
work packets take place without any further manipulation
whatsoever. Id.
On appeal, Cisco offers a more nuanced construction,
asserting that term should instead be construed as “detect-
ing suspicious network activity based on ‘direct examina-
tion of network packets,’ where such ‘direct examination’
does not include merely examining data that has been ob-
tained, generated, or gleaned from network packets.” Ap-
pellant Br. 42. According to Cisco, based on SRI’s express
prosecution disclaimer during reexamination, the claims
require detecting suspicious activity based on “direct exam-
ination” of network packets, not data “generated” or
“gleaned” from packets. Cisco would thus construe the
term to exclude a process that decodes the network packet.
We conclude that Cisco’s proposed construction goes
too far in limiting the amount of preprocessing encom-
passed by the claim. The specification shows that prepro-
cessing is a contemplated and expected part of the claimed
invention. Indeed, the specification specifically mentions
different forms of preprocessing network packets prior to
examination, including decryption (’615 patent col. 3
ll. 61–63), parsing (id. at col. 8 ll. 10–12), and decoding (id.
at col. 8 ll. 7–9).
Cisco’s argument that SRI disclaimed preprocessing
during reexamination of its patents is also not persuasive.
To invoke argument-based estoppel, “the prosecution
SRI INT’L, INC. v. CISCO SYS., INC. 13
history must evince a ‘clear and unmistakable surrender’”
of this kind of preprocessing. Deering Precision Instru-
ments v. Vector Distrib. Sys., 347 F.3d 1314, 1326 (Fed. Cir.
2003) (quoting Eagle Comtronics, Inc. v. Arrow Commc’n
Labs., Inc., 305 F.3d 1303, 1316 (Fed. Cir. 2002)); see also
Krippelz v. Ford Motor Co., 667 F.3d 1261, 1267 (Fed. Cir.
2012) (applying prosecution history disclaimer from reex-
amination proceedings). Here, SRI’s statements during
reexamination reflect that SRI drew the line between what
does and does not comprise “direct examination” by exclud-
ing information derived from network packet data (for ex-
ample, network traffic measures and network traffic
statistics). At the same time, SRI explained that “direct
examination” includes the data from which the network
traffic measures and network traffic statistics are derived
(that is, the data in the network packets). For example,
SRI explained that the specification:
[D]emonstrates that the term “network traffic
data” requires information obtained by direct
packet examination by using the distinctly differ-
ent terms “network traffic measures” and “network
traffic statistics” when discussing information de-
rived from network traffic observation, as com-
pared to the data from which the measures and
statistics are derived.
Brief for the Patentee on Appeal at 7, In re Porras, Reexam
No. 90/008,125 (B.P.A.I. Jan. 14, 2010) (citing ’203 patent
col. 4 ll. 55–60 (discussing “network traffic statistics”) and
col. 5 ll. 28–30 (discussing “network traffic measures”)).
We read SRI’s statements during reexamination as
simply explaining that “network traffic statistics,” such as
number of packets and number of kilobytes transferred,
are statistics derived from the network packet data—not
the underlying data itself. SRI did not argue that the ac-
tual data underlying the measures and statistics—the data
in the network packets—could not be subject to direct
14 SRI INT’L, INC. v. CISCO SYS., INC.
examination. Nor did SRI take the position that “direct ex-
amination” must take place before any or all processing.
SRI did not mention processing at all during reexamina-
tion. Moreover, as the specification makes clear, the sys-
tem may need to decrypt, parse, or decode the data
packets—all forms of preprocessing—in order to directly
examine the network packet data underlying the network
traffic statistics.
We hold that SRI’s statements in the prosecution his-
tory do not invoke a clear and unmistakable surrender of
all preprocessing, including decryption, decoding, and
parsing. Accordingly, we agree with the district court’s
construction of “network traffic data” to mean “data ob-
tained from direct examination of network packets.”
III
We also hold that the district court did not err in grant-
ing summary judgment that the asserted claims are not an-
ticipated by SRI’s own EMERALD 1997 reference. We
review the district court’s summary judgment of no antici-
pation under regional circuit law. See MAG Aerospace In-
dus., Inc. v. B/E Aerospace, Inc., 816 F.3d 1374, 1376
(Fed. Cir. 2016). The Third Circuit reviews a grant of sum-
mary judgment de novo, applying the same standard as the
district court. See Gonzalez v. Sec’y of Dep’t of Homeland
Sec., 678 F.3d 254, 257 (3d Cir. 2012). Summary judgment
is appropriate when, drawing all justifiable inferences in
the nonmovant’s favor, there exists no genuine issue of ma-
terial fact and the movant is entitled to judgment as a mat-
ter of law. Fed. R. Civ. P. 56(a); see also Anderson v. Liberty
Lobby, Inc., 477 U.S. 242, 255 (1986). Anticipation re-
quires that a single prior art reference disclose each and
every limitation of the claimed invention, either expressly
or inherently. See Verdegaal Bros. v. Union Oil Co. of Cal.,
814 F.2d 628, 631 (Fed. Cir. 1987).
EMERALD 1997 discloses a tool for tracking malicious
activity across large networks. The question before us is
SRI INT’L, INC. v. CISCO SYS., INC. 15
whether the district court erred in concluding on summary
judgment that EMERALD 1997 does not disclose detection
of any of the network traffic data categories listed in
claim 1 of the ’203 and ’615 patents. The Patent Office con-
sidered EMERALD 1997 during the original examination
of the ’615 patent, and the patentability of the claims over
the reference was confirmed in multiple reexamination and
litigation proceedings. Indeed, during reexamination, the
Patent Office accepted SRI’s argument that the claim lim-
itation requires detecting suspicious activity based on “di-
rect examination” of network packets to distinguish
EMERALD 1997. J.A. 26402 (“[T]he closest prior art of
record, Emerald 1997, fails to teach direct examination of
packet data.”); J.A. 27101 (same).
EMERALD 1997 describes detecting a DNS/NFS at-
tack in “real-time.” J.A. 5004. To achieve this,
EMERALD 1997 explains:
The subscription list field is an important facility
for gaining visibility into malicious or anomalous
activity outside the immediate environment of an
EMERALD monitor. The most obvious examples
where relationships are important involve interde-
pendencies among network services that make lo-
cal policy decisions. Consider, for example, the
interdependencies between access checks per-
formed during network file system [“NFS”] mount-
ing and the IP mapping of the DNS service. An
unexpected mount monitored by the network file
system service may be responded to differently if
the DNS monitor informs the network file system
monitor of suspicious updates to the mount re-
quester’s DNS mapping.
J.A. 5008. EMERALD 1997 further explains that:
Above the service layer, signature engines scan the
aggregate of intrusion reports from service moni-
tors in an attempt to detect more global
16 SRI INT’L, INC. v. CISCO SYS., INC.
coordinated attack scenarios or scenarios that ex-
ploit interdependencies among network services.
The DNS/NFS attack discussed [above] is one such
example of an aggregate attack scenario.
J.A. 5010.
Cisco’s expert submitted a report concluding that a per-
son of ordinary skill in the art would understand from this
disclosure that “monitoring specific network services, such
as HTTP, FTP, network file systems, finger, Kerberos, and
SNMP would require detecting and analyzing packets in-
dicative of those well-known network service protocols, one
of the enumerated categories in claim 1 of the ’615 patent.”
J.A. 30347 (emphasis added). During deposition, however,
Cisco’s expert retreated from this position, admitting that
a person of ordinary skill reading EMERALD 1997 would
have understood that it was not necessary to directly ex-
amine the packets, although that would be “one very good
way” to prevent attacks. J.A. 50040 at 159:12–21.
On this record, we conclude that summary judgment
was appropriate. EMERALD 1997 does not expressly dis-
close directly examining network packets as required by
the claims—especially not to obtain data about network
connection requests. Nor does Cisco’s expert testimony cre-
ate a genuine issue of fact on this issue. Rather, we agree
with the district court that Cisco’s expert’s testimony is
both inconsistent and “based on [] multiple layers of suppo-
sition.” Summary Judgment Op., 179 F. Supp. 3d at 358.
Because the evidence does not support express or inherent
disclosure of direct examination of packet data, we con-
clude that the district court did not err in holding that
there was no genuine issue of fact regarding whether
EMERALD 1997 disclosed analyzing the specific enumer-
ated types of network traffic data recited in the claims.
Cisco next argues that the district court erred by grant-
ing summary judgment for SRI sua sponte despite SRI’s
failure to move for such relief. We disagree. Under Third
SRI INT’L, INC. v. CISCO SYS., INC. 17
Circuit law, a district court may properly enter summary
judgment sua sponte “so long as the losing party was on
notice that she had to come forward with all of her evi-
dence.” Gibson v. Mayor & Council of City of Wilmington,
355 F.3d 215, 222 (3d Cir. 2004) (quoting Celotex Corp. v.
Catrett, 477 U.S. 317, 326 (1986)). By filing its own motion
for summary judgment, Cisco was on notice that anticipa-
tion was before the court, and Cisco had the opportunity to
put forth its best evidence. Additionally, SRI did argue, in
opposition to Cisco’s summary judgment motion, that the
district court should outright reject Cisco’s assertion of in-
validity. J.A. 31650 (“Cisco’s assertion of invalidity should
be rejected . . . .”). Indeed, SRI expressly took the position
that EMERALD 1997 “does not anticipate any claim of the
’203 or ’615 patents.” J.A. 31678. Thus, any notice require-
ment was satisfied because Cisco itself indicated that the
issue was ripe for summary adjudication and SRI took the
position that the claims were not anticipated. Accordingly,
we see no error in the sua sponte nature of the district
court’s order and we affirm the summary judgment of no
anticipation.
IV
Cisco also appeals the district court’s denial of JMOL
that it did not willfully infringe the asserted patents be-
cause the jury’s willfulness finding is not supported by sub-
stantial evidence. We agree that the jury’s finding that
Cisco willfully infringed the patents-in-suit prior to receiv-
ing notice thereof is not supported by substantial evidence
and therefore vacate and remand.
We review decisions on motions for JMOL under the
law of the regional circuit. Energy Transp. Grp. Inc. v. Wil-
liam Demant Holding A/S, 697 F.3d 1342, 1350 (Fed. Cir.
2012). The Third Circuit reviews district court decisions
on such motions de novo. Acumed LLC v. Adv. Surgical
Servs., Inc., 561 F.3d 199, 211 (3d Cir. 2009) (citing Mon-
teiro v. City of Elizabeth, 436 F.3d 397, 404 (3d Cir. 2006)).
18 SRI INT’L, INC. v. CISCO SYS., INC.
In the Third Circuit, a “court may grant a judgment as a
matter of law contrary to the verdict only if ‘the record is
critically deficient of the minimum quantum of evidence’ to
sustain the verdict.” Id. (citing Gomez v. Allegheny Health
Servs., Inc., 71 F.3d 1079, 1083 (3d Cir. 1995)). The court
should grant JMOL “sparingly” and “only if, viewing the
evidence in the light most favorable to the nonmovant and
giving it the advantage of every fair and reasonable infer-
ence, there is insufficient evidence from which a jury rea-
sonably could find liability.” Marra v. Phila. Hous. Auth.,
497 F.3d 286, 300 (3d Cir. 2007) (quoting Moyer v. United
Dominion Indus., Inc., 473 F.3d 532, 545 n.8 (3d Cir.
2007)).
As the Supreme Court stated in Halo, “[t]he sort of con-
duct warranting enhanced damages has been variously de-
scribed in our cases as willful, wanton, malicious, bad-
faith, deliberate, consciously wrongful, flagrant, or—in-
deed—characteristic of a pirate.” Halo Elecs., Inc. v. Pulse
Elecs., Inc., 136 S. Ct. 1923, 1932 (2016). While district
courts have discretion in deciding whether or not behavior
rises to that standard, such findings “are generally re-
served for egregious cases of culpable behavior.” Id. In-
deed, as Justice Breyer emphasized in his concurrence, it
is the circumstances that transform simple “intentional or
knowing” infringement into egregious, sanctionable behav-
ior, and that makes all the difference. Id. at 1936 (Breyer,
J., concurring). A patentee need only show by a preponder-
ance of the evidence the facts that support a finding of will-
ful infringement. Id. at 1934.
In denying Cisco’s motion for JMOL on willfulness, the
district court concluded that the jury’s willfulness determi-
nation was supported by two evidentiary bases. First, the
court identified evidence that “key Cisco employees did not
read the patents-in-suit until their depositions.” Post-Trial
Motions Op., 254 F. Supp. 3d at 717. Second, the court
identified evidence that Cisco designed the products and
services in an infringing manner and that Cisco instructed
SRI INT’L, INC. v. CISCO SYS., INC. 19
its customers to use the products and services in an infring-
ing manner. Based on these two facts, the district court
denied Cisco’s renewed motion for JMOL on willfulness,
stating that “[v]iewing the record in the light most favora-
ble to SRI, substantial evidence supports the jury’s subjec-
tive willfulness verdict.” Id.
On appeal, SRI identifies additional evidence that pur-
portedly supports the jury’s willfulness verdict. Specifi-
cally, SRI presented evidence that Cisco expressed interest
in the patented technology and met with SRI’s inventor in
2000 before developing its infringing products. J.A. 1484–
86; J.A. 5027. Additionally, SRI submitted evidence that
Cisco received a notice letter from SRI’s licensing consult-
ant on May 8, 2012, informing Cisco of the asserted patents
(a year before SRI filed the complaint). Finally, like the
district court, SRI makes much of the fact that “key engi-
neers” did not look at SRI’s patents until SRI took their
depositions during this litigation. In particular, Cisco en-
gineers Martin Roesch and James Kasper did not look at
the patent until their depositions in 2015.
Even accepting this evidence as true and weighing all
inferences in SRI’s favor, we conclude that the record is in-
sufficient to establish that Cisco’s conduct rose to the level
of wanton, malicious, and bad-faith behavior required for
willful infringement. First, it is undisputed that the Cisco
employees who did not read the patents-in-suit until their
depositions were engineers without legal training. Given
Cisco’s size and resources, it was unremarkable that the
engineers—as opposed to Cisco’s in-house or outside coun-
sel—did not analyze the patents-in-suit themselves. The
other rationale offered by the district court—that Cisco de-
signed the products and services in an infringing manner
and that Cisco instructed its customers to use the products
and services in an infringing manner—is nothing more
than proof that Cisco directly infringed and induced others
to infringe the patents-in-suit.
20 SRI INT’L, INC. v. CISCO SYS., INC.
It is undisputed that Cisco did not know of SRI’s patent
until May 8, 2012, when SRI sent its notice letter to Cisco.
Oral Arg. at 23:46, available at http://oralarguments.cafc.
uscourts.gov/default.aspx?fl=2017-2223.mp3. It is also un-
disputed that this notice letter was sent years after Cisco
independently developed the accused systems and first sold
them in 2005 (Cisco) and 2007 (Sourcefire). As SRI admits,
the patents had not issued when the parties met in
May 2000. Indeed, the patent application for the parent
’203 patent was not even filed until several months after
the parties met. Thus, Cisco could not have been aware of
the patent application.
While the jury heard evidence that Cisco was aware of
the patents in May 2012, before filing of the lawsuit, we do
not see how the record supports a willfulness finding going
back to 2000. As the Supreme Court recently observed,
“culpability is generally measured against the knowledge
of the actor at the time of the challenged conduct.” Halo,
136 S. Ct. at 1933. Similarly, Cisco’s allegedly aggressive
litigation tactics cannot support a finding of willful in-
fringement going back to 2000, especially when the litiga-
tion did not start until 2012. Finally, Cisco’s decision not
to seek an advice-of-counsel defense is legally irrelevant
under 35 U.S.C. § 298.
Viewing the record in the light most favorable to SRI,
the jury’s verdict of willful infringement before May 8, 2012
is not supported by substantial evidence. Given the gen-
eral verdict form, we presume the jury also found that
Cisco willfully infringed after May 8, 2012. When review-
ing a denial of JMOL, “where there is a black box jury ver-
dict, as is the case here, we presume the jury resolved
underlying factual disputes in favor of the verdict winner
and leave those presumed findings undisturbed if sup-
ported by substantial evidence.” Arctic Cat Inc. v. Bom-
bardier Recreational Prods. Inc., 876 F.3d 1350, 1358
(Fed. Cir. 2017), (citing WBIP, LLC v. Kohler Co., 829 F.3d
1317, 1326 (Fed. Cir. 2016)), cert. denied, 139 S. Ct. 143
SRI INT’L, INC. v. CISCO SYS., INC. 21
(2018). We leave it to the district court to decide in the first
instance whether the jury’s presumed finding of willful in-
fringement after May 8, 2012 is supported by substantial
evidence. 6 In so doing, the court should bear in mind the
standard for willful infringement, as well as the above
analysis regarding SRI’s evidence of willfulness. Accord-
ingly, we vacate and remand the district court’s denial of
Cisco’s renewed motion for JMOL of no willful infringe-
ment.
Cisco also argues that the district court abused its dis-
cretion by doubling damages. Enhanced damages under
§ 284 are predicated on a finding of willful infringement.
Because we conclude that the jury’s finding of willfulness
before 2012 was not supported by substantial evidence, we
do not reach the propriety of the district court’s award of
enhanced damages. Instead, we vacate the award of en-
hanced damages and remand for further consideration
along with willfulness.
V
We next turn to the district court’s award of attorneys’
fees under § 285, which we vacate and remand for further
consideration. Under § 285, a “court in exceptional cases
may award reasonable attorney fees to the prevailing
6 We recognize that, ideally, it should not fall to the
district court to determine when, if ever, willful infringe-
ment began through the mechanism of JMOL. Rather, the
question of when willful infringement began is a fact issue
that would have been best presented to the jury in a special
verdict form with appropriate jury instructions. Better yet,
perhaps SRI could have recognized the shortcomings in its
case and presented a more limited case of willful infringe-
ment from 2012 onwards. Or perhaps Cisco could have
filed a motion for summary judgment of no willful infringe-
ment prior to May 8, 2012.
22 SRI INT’L, INC. v. CISCO SYS., INC.
party.” An “exceptional” case under § 285 is “one that
stands out from others with respect to the substantive
strength of a party’s litigating position (considering both
the governing law and the facts of the case) or the unrea-
sonable manner in which the case was litigated.” Octane
Fitness, LLC v. ICON Health & Fitness, Inc., 572 U.S. 545,
554 (2014). The party seeking fees must prove that the
case is exceptional by a preponderance of the evidence, and
the district court makes the exceptional case determination
on a case-by-case basis considering the totality of the cir-
cumstances. See id. at 554, 557.
We review a district court’s grant or denial of attorneys’
fees for an abuse of discretion, which is a highly deferential
standard of review. Highmark Inc. v. Allcare Health Mgmt.
Sys., Inc., 572 U.S. 559, 564 (2014); Bayer CropScience AG
v. Dow AgroSciences LLC, 851 F.3d 1302, 1306 (Fed. Cir.
2017) (citing Mentor Graphics Corp. v. Quickturn Design
Sys., Inc., 150 F.3d 1374, 1377 (Fed. Cir. 1998)). To meet
the abuse-of-discretion standard, the appellant must show
that the district court made “a clear error of judgment in
weighing relevant factors or in basing its decision on an er-
ror of law or on clearly erroneous factual findings.” Bayer,
851 F.3d at 1306 (quoting Mentor Graphics, 150 F.3d
at 1377); see also Highmark, 572 U.S. at 563 n.2.
We see no such error in the district court’s determina-
tion that this was an exceptional case. The district court
found:
There can be no doubt from even a cursory review
of the record that Cisco pursued litigation about as
aggressively as the court has seen in its judicial ex-
perience. While defending a client aggressively is
understandable, if not laudable, in the case at bar,
Cisco crossed the line in several regards.
Post-Trial Motions Op., 254 F. Supp. 3d at 722.
SRI INT’L, INC. v. CISCO SYS., INC. 23
The district court further explained that “Cisco’s litiga-
tion strategies in the case at bar created a substantial
amount of work for both SRI and the court, much of which
work was needlessly repetitive or irrelevant or frivolous.”
Id. at 723 (footnotes omitted). Indeed, the district court in-
ventoried Cisco’s aggressive tactics, including maintaining
nineteen invalidity theories until the eve of trial but only
presenting two at trial and pursuing defenses at trial that
were contrary to the court’s rulings or Cisco’s internal doc-
uments. Id. at 722. Nevertheless, the district court relied
in part on the fact that the jury found that Cisco’s infringe-
ment was willful in its determination to exercise its discre-
tion pursuant to § 285 to award SRI its attorneys’ fees and
costs. Id. at 723. Accordingly, we vacate the district court’s
award of attorneys’ fees and remand for further considera-
tion along with willfulness.
We take no issue with the district court’s award of at-
torneys’ fees at the attorneys’ billing rates without adjust-
ing them to Delaware rates. At the same time, however,
the district court erred in granting all of SRI’s fees. Sec-
tion 285 permits a prevailing party to recover reasonable
attorneys’ fees, but not fees for hours expended by counsel
that were “excessive, redundant, or otherwise unneces-
sary.” Hensley v. Eckerhart, 461 U.S. 424, 434 (1983). We
accordingly conclude that the district court should have re-
duced SRI’s total hours to eliminate clear mistakes. For
example, one billing entry reads “DON’T RELEASE,
CLIENT MATTER NEEDS TO BE CHANGED.”
J.A. 32384. Accordingly, should the district court award
attorneys’ fees on remand, it must remove attorney hours
clearly included by mistake in its calculation of reasonable
attorneys’ fees.
VI
We review for abuse of discretion a district court’s
grant of an ongoing royalty. Whitserve, LLC v. Comput.
Packages, Inc., 694 F.3d 10, 35 (Fed. Cir. 2012). Here, the
24 SRI INT’L, INC. v. CISCO SYS., INC.
district court did not abuse its discretion in awarding “a
3.5% compulsory license for all post-verdict sales.” Post-
Trial Motions Op., 254 F. Supp. 3d at 724. The district
court’s ongoing royalty rate equals the rate found by the
jury and the base is limited to the “accused products and
services.” J.A. 182.
On appeal, Cisco argues that the district court abused
its discretion in awarding the 3.5% ongoing royalty on “all
post-verdict sales” without considering Cisco’s design-
arounds. According to Cisco, the court was obligated to as-
sess whether Cisco’s redesigned products and services were
more than colorably different from those products and ser-
vices adjudicated at trial, and if not, whether those rede-
signed products and services infringe. To this end, Cisco
moved to supplement its post-trial briefing with declara-
tions describing its redesign efforts. Cisco argues that the
district court abused its discretion by denying its motion to
supplement. 7 We disagree. The district court properly ex-
ercised its discretion in denying Cisco’s motion to supple-
ment the record regarding alleged post-verdict design-
around activity. Cisco did not redesign its products until
after trial, and Cisco did not file its motion to supplement
until after completion of post-trial briefing. Given the
7 Finally, Cisco argues that, in the same order in
which the court stated that “[t]here are no post-verdict roy-
alties,” the court awarded a post-verdict royalty—an inter-
nal inconsistency. J.A. 175. We do not ascribe weight to
the apparent clerical error creating the inconsistency. The
district court’s final judgment order is clear that “Cisco
shall pay a 3.5% compulsory license on all post-verdict
sales of the accused products and services.” J.A. 182. To
the extent that clear statement conflicts with the single
sentence in the memorandum opinion, we think the court
made its intentions clear in its final judgment and we see
no error by the district court.
SRI INT’L, INC. v. CISCO SYS., INC. 25
stage of the proceedings and SRI’s opposition, the trial
court acted within its discretion when denying Cisco’s mo-
tion to supplement.
To the extent the district court’s order is unclear—and
we think it is not—we reconfirm that the ongoing royalty
on post-verdict sales is limited to products that were actu-
ally found to infringe and products that are not colorably
different. We discern no error in the district court’s deter-
mination that Cisco’s submissions were untimely. Never-
theless, we acknowledge that the district court has not yet
determined whether products and services that were not
accused (that is, changed after the jury verdict) are colora-
bly different for purposes of ongoing royalty calculations.
Such an issue could be resolved in a future proceeding.
CONCLUSION
For the reasons above, we affirm the district court’s de-
nial of summary judgment that the asserted claims are pa-
tent-ineligible. We also agree with the district court’s
construction of “network traffic data” and affirm the dis-
trict court’s grant of summary judgment of no anticipation.
We vacate and remand the district court’s denial of Cisco’s
renewed motion for judgment as a matter of law that Cisco
did not willfully infringe the asserted claims. Accordingly,
we vacate and remand the district court’s awards of en-
hanced damages and attorneys’ fees. Finally, we affirm the
district court’s orders granting enhanced damages and on-
going royalties.
AFFIRMED-IN-PART, VACATED-IN-PART,
AND REMANDED
COSTS
No costs.
United States Court of Appeals
for the Federal Circuit
______________________
SRI INTERNATIONAL, INC.,
Plaintiff-Appellee
v.
CISCO SYSTEMS, INC.,
Defendant-Appellant
______________________
2017-2223
______________________
Appeal from the United States District Court for the
District of Delaware in No. 1:13-cv-01534-SLR-SRF, Judge
Sue L. Robinson.
______________________
LOURIE, Circuit Judge, dissenting.
I respectfully dissent from the majority’s decision up-
holding the eligibility of the claims. In my view, they are
clearly abstract. In fact, they differ very little from the
claims in Electric Power Group, LLC v. Alstom S.A., 830
F.3d 1350, 1355 (Fed. Cir. 2016), where we found the
claims to be abstract.
The majority opinion focuses on claim 1 of U.S. Patent
6,711,615 (“the ’615 patent”), which recites:
1. A computer-automated method of hierarchical
event monitoring and analysis within an enterprise
network comprising:
2 SRI INT’L, INC. v. CISCO SYS., INC.
deploying a plurality of network monitors
in the enterprise network;
detecting, by the network monitors, suspi-
cious network activity based on analysis of
network traffic data selected from one or
more of the following categories: {network
packet data transfer commands, network
packet data transfer errors, network
packet data volume, network connection
requests, network connection denials, error
codes included in a network packet, net-
work connection acknowledgements, and
network packets indicative of well-known
network-service protocols};
generating, by the monitors, reports of said
suspicious activity; and
automatically receiving and integrating
the reports of suspicious activity, by one or
more hierarchical monitors.
Similarly, the claim we reviewed in Electric Power
Group recited “[a] method of detecting events on an inter-
connected electric power grid in real time over a wide area
and automatically analyzing the events on the intercon-
nected electric power grid,” with the method comprising
eight steps, including “receiving data,” “detecting and ana-
lyzing events in real time,” “displaying the event analysis
results and diagnoses of events,” “accumulating and updat-
ing measurements,” and “deriving a composite indicator of
reliability.” 830 F.3d at 1351–52.
While that claim was lengthy, with eight steps, it
merely described selecting information by content or source
for collection, analysis, and display. Id. at 1351. In finding
the claim directed to an abstract idea, we reasoned that
“collecting information, including when limited to particu-
lar content (which does not change its character as
SRI INT’L, INC. v. CISCO SYS., INC. 3
information)” was an abstract idea. Id. at 1353. Limiting
the claim to a particular technological environment—
power-grid monitoring—was insufficient to transform it
into a patent-eligible application of the abstract idea at its
core. Id. at 1354. The claim was rooted in computer tech-
nology only to the extent that the broadly-recited steps re-
quired a computer. At step two, we noted that the claim
did not require an “inventive set of components or meth-
ods . . . that would generate new data,” and did not “invoke
any assertedly inventive programming.” Id. at 1355.
This case is hardly distinguishable from Electric Power
Group. The claims in that case are said in the majority
opinion to only be drawn to using computers as tools to
solve a problem, rather than improving the functionality of
computers and computer networks.
The claims here recite nothing more than deploying
network monitors, detecting suspicious network activity,
and generating and handling reports. The detecting of the
suspicious activity is based on “analysis” of traffic data, but
the claims add nothing concerning specific means for doing
so. The claims only recite the moving of information. The
computer is used as a tool, and no improvement in com-
puter technology is shown or claimed. There is no specific
technique described for improving computer network secu-
rity.
I would find the claims directed to the abstract idea of
monitoring network security and proceed to step two of Al-
ice. As in Electric Power Group, however, “[n]othing in the
claims, understood in light of the specification, requires an-
ything other than off-the-shelf, conventional computer,
network, and display technology . . . .” 830 F.3d at 1355.
The claims recite “types of information and information
sources,” id., but such selection of information by content
or source does not provide an inventive concept. Id. The
specification further makes clear that the claims only rely
on generic computer components, including a computer,
4 SRI INT’L, INC. v. CISCO SYS., INC.
memory, processor, and mass storage device. See ’615 pa-
tent, col. 14 ll. 50–57. Indeed, the specification even deems
the relevant memory bus and peripheral bus “customary
components.” Id. col. 14 l. 55.
Finally, the majority opinion quotes from and para-
phrases language from the specification that only recites
results, not means for accomplishing them. See, e.g., Ma-
jority Op. at 9. The claims as written, however, do not re-
cite a specific way of enabling a computer to monitor
network activity. As we noted in Electric Power Group, re-
sult-focused, functional claims that effectively cover any
solution to an identified problem, like those at issue here,
frequently run afoul of Alice. 830 F.3d at 1356.
Thus, I would find the claims to be directed to an ab-
stract idea at Alice step one, without an inventive concept
at step two, and reverse the district court’s finding of eligi-
bility. Because I would find the claims at issue to be ineli-
gible, I would not reach the remaining issues in the case.