SRI International Inc. v. Cisco Systems Inc.

Filing 420

REDACTED MEMORANDUM OPINION re: D.I. 415 [SEALED] MEMORANDUM OPINION. Signed by Judge Sue L. Robinson on 5/25/2017. (nmfn)

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF DELAWARE

SRI INTERNATIONAL, INC.,
Plaintiff,

v.
CISCO SYSTEMS, INC.
Defendant.

)
)
)
)

)
)
)

Civ. No. 13-1534-SLR

)
)
)

Thomas L. Halkowski, Esquire and Susan E. Morrison, Esquire of Fish & Richardson
P.C., Wilmington, Delaware. Of Counsel: Frank Scherkenbach, Esquire, Joanna M.
Fuller, Esquire, Philip W. Geter, Esquire, David M. Hoffman, Esquire, David Kuznick,
Esquire, David S. Morris, Esquire, Howard G. Pollack, Esquire, and Michael Sobolev,
Esquire of Fish & Richardson P.C. Counsel for Plaintiff.

Jack B. Blumenfeld, Esquire and Michael J. Flynn, Esquire of Morris, Nichols, Arsht &
Tunnell L.L.P., Wilmington, Delaware. Of Counsel: Adam R. Alper, Esquire, Oliver C.
Bennett, Esquire, Steven Cherny, Esquire, Michael W. De Vries, Esquire, Sarah K.
Tsou, Esquire, and Jason M. Wilcox, Esquire of Kirkland & Ellis, L.L.P. and William F.
Lee, Esquire of Wilmer Cutler Pickering Hale and Dorr L.L.P. Counsel for Defendant.

MEMORANDUM OPINION

Dated: May 25, 2017
Wilmington, Delaware

~O~strict

Judge

I. INTRODUCTION

On September 4, 2013, plaintiff SRI International, Inc. ("SRI") filed suit against
defendant Cisco Systems Inc. ("Cisco"), alleging infringement of U.S. Patent No.
6,711,615 ("the '615 patent") and 6,484,203 ("the '203 patent") (collectively, "the
patents"). (D.I. 1) On December 18, 2013, Cisco answered the complaint and
counterclaimed for non-infringement and invalidity. (D.I. 9) SRI answered the
counterclaims on January 13, 2014. (D.I. 11) The court issued a claim construction
order on May 14, 2015. (D.I. 138) In a memorandum opinion and order dated April 11,
2016, the court resolved several summary judgment motions. (D.I. 301; D.I. 302)
The court held an eight-day jury trial from May 2-11, 2016 on infringement,
validity, willfulness, and damages of claims 1, 2, 13, and 14 of the '615 patent and
claims 1, 2, 12, and 13 of the '203 patent ("the asserted claims"). On May 12, 2016, the
jury returned a verdict that Cisco intrusion protection system ("IPS") products, Cisco
remote management services, Cisco IPS services, Sourcefire IPS products, and
Sourcefire professional services directly and indirectly infringe the asserted claims of
the '615 and '203 patents. (D.I. 337 at 1-4) The jury determined that the asserted
claims are not invalid. (D.I. 337 at 6-7) As a consequence of this infringement, the jury
awarded SRI a 3.5% reasonable royalty amounting to $8,680,000 for sales of Cisco
products and services and $14,980,000 for sales of Cisco/Sourcefire products and
services, for a total of $23,660,000. (D.I. 337 at 8) The jury also found that SRI had
established, by clear and convincing evidence, that Cisco's infringement was willful.
(D.I. 337 at 5)
Presently before the court are the following motions: (1) Cisco's motion for
judgment as a matter of law, new trial, and remittitur (D.I. 351); (2) SRl's motion for

attorney fees (D.I. 349); and (3) Cisco's motion to supplement the record (D.I. 385).
The court has jurisdiction pursuant to 28 U.S.C. §§ 1331 and 1338(a).

II. BACKGROUND
A. The Parties
SRI is an independent, not-for-profit research institute incorporated under the
laws of the State of California, with its principal place of business in Menlo Park,
California. (D.I. 1 at 111) SRI conducts client-supported research and development for
government agencies, commercial businesses, foundations, and other organizations.

(Id. at 116) Among its many areas of research, SRI has engaged in research related to
computer security and, more specifically, to large computer network intrusion detection
systems and methods. (Id.) Cisco is a corporation organized and existing under the
laws of the State of California, with its principal place of business in San Jose,
California. (Id. at 112) Cisco provides various intrusion prevention and intrusion
detection products and services. (Id. at 1114)
B. The Technology
The patents relate to the monitoring and surveillance of computer networks for
intrusion detection. In particular, the patents teach a computer-automated method of
hierarchical event monitoring and analysis within an enterprise network that allows for
real-time detection of intruders. Upon detecting any suspicious activity, the network
monitors generate reports of such activity. The claims of the patents focus on methods
and systems for deploying a hierarchy of network monitors that can generate and
receive reports of suspicious network activity.
The '615 patent (titled "Network Surveillance") is a continuation of the '203 patent
(titled "Hierarchical Event Monitoring and Analysis"), and the patents share a common

2

specification and priority date of November 9, 1998. (D.I 179 at 1) The asserted claims
include independent claims 1 and 13 of the '615 patent, which claims read as follows:
1. A computer-automated method of hierarchical event monitoring and
analysis within an enterprise network comprising:
deploying a plurality of network monitors in the enterprise network;
detecting, by the network monitors, suspicious network activity based
on analysis of network traffic data selected from one or more of the
following categories: {network packet data transfer commands,
network packet data transfer errors, network packet data volume,
network connection requests, network connection denials, error
codes included in a network packet, network connection
acknowledgements, and network packets indicative of well-known
network-service protocols};
generating, by the monitors, reports of said suspicious activity; and
automatically receiving and integrating the reports of suspicious activity,
by one or more hierarchical monitors.
('615 patent, 15:1-21)
13. An enterprise network monitoring system comprising:
a plurality of network monitors deployed within an enterprise network,
said plurality of network monitors detecting suspicious network
activity based on analysis of network traffic data selected from one or
more of the following categories: {network packet data transfer
commands, network packet data transfer errors, network packet data
volume, network connection requests, network connection denials,
error codes included in a network packet, network connection
acknowledgements, and network packets indicative of well-known
network-service protocols};
said network monitors generating reports of said suspicious activity;
and
one or more hierarchical monitors in the enterprise network, the
hierarchical monitors adapted to automatically receive and integrate
the reports of suspicious activity.
('615 patent, 15:56-16:6)

3

Ill. STANDARD OF REVIEW
A. Renewed Motion for Judgment as a Matter of Law
The Federal Circuit "review[s] a district court's denial of judgment as a matter of
law under the law of the regional circuit. WBIP, LLC v. Kohler Co., 829 F.3d 1317, 1325
(Fed. Cir. 2016) (citation omitted). In the Third Circuit, a "court may grant a judgment as
a matter of law contrary to the verdict only if 'the record is critically deficient of the
minimum quantum of evidence' to sustain the verdict." Acumed LLC v. Advanced
Surgical Servs., Inc., 561 F.3d 199, 211 (3d Cir. 2009) (citing Gomez v. Allegheny
Health Servs., Inc., 71F.3d1079, 1083 (3d Cir. 1995)); see also McKenna v. City of
Philadelphia, 649 F.3d 171, 176 (3d Cir. 2011). The court should grant judgment as a
matter of law "sparingly" and "only if, viewing the evidence in the light most favorable to
the nonmovant and giving it the advantage of every fair and reasonable inference, there
is insufficient evidence from which a jury reasonably could find liability." Marra v.
Philadelphia Hous. Auth., 497 F.3d 286, 300 (3d Cir. 2007) (citing Moyer v. United
Dominion Indus., Inc., 473 F.3d 532, 545 n.8 (3d Cir. 2007)). "In performing this narrow
inquiry, [the court] must refrain from weighing the evidence, determining the credibility of
witnesses, or substituting [its] own version of the facts for that of the jury. Id. (citing
Lightning Lube, Inc. v. Witco Corp., 4 F.3d 1153, 1166 (3d Cir. 1993)). Judgment as a
matter of law may be appropriate when there is "a purely legal basis" for reversal "that
does not depend on rejecting the jury's findings on the evidence at trial." Acumed, 561
F.3d at 211.

B. Motion for a New Trial
Federal Rule of Civil Procedure 59(a) provides, in pertinent part:
A new trial may be granted to all or any of the parties and on all or part of
the issues in an action in which there has been a trial by jury, for any of
the reasons for which new trials have heretofore been granted in actions
at law in the courts of the United States.

4

Fed. R. Civ. P. 59(a). The decision to grant or deny a new trial is within the sound
discretion of the trial court and, unlike the standard for determining judgment as a
matter of law, the court need not view the evidence in the light most favorable to the
verdict winner. See Allied Chem. Corp. v. Daiflon, Inc., 449 U.S. 33, 36 (1980); Leonard

v. Stemtech lnt'l Inc., 834 F.3d 376, 386 (3d Cir. 2016) (citing Olefins Trading, Inc. v.
Han Yang Chem. Corp., 9 F.3d 282 (3d Cir. 1993)); LifeScan Inc. v. Home Diagnostics,
Inc., 103 F. Supp. 2d 345, 350 (D. Del. 2000) (citations omitted); see also 9A Wright &
Miller, Federal Practice and Procedure§ 2531 (2d ed. 1994) ("On a motion for new trial
the court may consider the credibility of witnesses and the weight of the evidence.").
Among the most common reasons for granting a new trial are: (1) the jury's verdict is
against the clear weight of the evidence, and a new trial must be granted to prevent a
miscarriage of justice; (2) newly-discovered evidence exists that would likely alter the
outcome of the trial; (3) improper conduct by an attorney or the court unfairly influenced
the verdict; or (4) the jury's verdict was facially inconsistent. See Zarow-Smith v. N.J.

Transit Rail Operations, 953 F. Supp. 581, 584-85 (D.N.J. 1997) (citations omitted).
The court must proceed cautiously, mindful that it should not simply substitute its own
judgment of the facts and the credibility of the witnesses for those of the jury. Rather,
the court should grant a new trial "only when the great weight of the evidence cuts
against the verdict and a miscarriage of justice would result if the verdict were to stand."

Leonard, 834 F.3d at 386 (citing Springer v. Henry, 435 F.3d 268, 274 (3d Cir. 2006)
and Williamson v. Consol. Rail Corp., 926 F.2d 1344, 1352-53 (3d Cir. 1991)) (internal
quotation marks omitted).

C. Attorney Fees
Section 285 provides, in its entirety, "[t]he court in exceptional cases may award
reasonable attorney fees to the prevailing party." 35 U.S.C. § 285. "When deciding
whether to award attorney fees under § 285, a district court engages in a two-step

5

inquiry." MarcTec, LLC v. Johnson & Johnson, 664 F.3d 907, 915 (Fed. Cir. 2012).
The court first determines whether the case is exceptional and, if so, whether an award
of attorney fees is justified. Id. at 915-16 (citations omitted). The Supreme Court has
defined "an 'exceptional' case [as] simply one that stands out from others with respect
to the substantive strength of a party's litigating position (considering both the governing
law and the facts of the case) or the unreasonable manner in which the case was
litigated." Octane Fitness LLC v. Icon Health & Fitness, Inc.,_ U.S._, 134 S. Ct.
1749, 1756 (2014).
District courts should consider the "totality of the circumstances" and use their
discretion to determine on a case-by-case basis whether a case is "exceptional." Id.
"[A] 'nonexclusive' list of 'factors,' [to consider] includ[es] 'frivolousness, motivation,
objective unreasonableness (both in the factual and legal components of the case) and
the need in particular circumstances to advance considerations of compensation and
deterrence."' Id. at n.6. Cases which may merit an award of attorney fees include "the
rare case in which a party's unreasonable conduct-while not necessarily independently
sanctionable-is nonetheless so 'exceptional' as to justify an award of fees" or "a case
presenting either subjective bad faith or exceptionally meritless claims." Id. at 1757. A
party seeking attorney fees under § 285 must prove the merits of their contentions by a
preponderance of the evidence. Id. at 1758.
IV. DISCUSSION
A. Cisco's Renewed JMOL - Liability
Cisco renews its motion for judgment as a matter of law as to infringement,
arguing that "[t]he record lacks substantial evidence to support the jury's verdict of direct
infringement, inducement, and contributory infringement." (D.I. 352 at 1)

6

1. Standard
a. Direct Infringement
A patent is infringed when a person "without authority makes, uses or sells any
patented invention, within the United States ... during the term of the patent." 35
U.S.C. § 271 (a). To prove direct infringement, the patentee must establish that one or
more claims of the patent read on the accused device literally or under the doctrine of
equivalents. Advanced Cardiovascular Sys., Inc. v. Scimed Life Sys., Inc., 261 F.3d
1329, 1336 (Fed. Cir. 2001 ). A two-step analysis is employed in making an
infringement determination. Markman v. Westview Instruments, Inc., 52 F.3d 967, 976
(Fed. Cir. 1995), aff'd, 517 U.S. 370 (1996). First, the court must construe the asserted
claims to ascertain their meaning and scope, a question of law. Id. at 976-77; see also

Teva Pharms. USA, Inc. v. Sandoz, Inc.,_ U.S._, 135 S. Ct. 831, 837 (2015). The
trier of fact must then compare the properly construed claims with the accused infringing
product. See Markman, 52 F.3d at 976. This second step is a question of fact.

Spectrum Pharm., Inc. v. Sandoz Inc., 802 F.3d 1326, 1337 (Fed. Cir. 2015) (citing Bai
v. L & L Wings, Inc., 160 F.3d 1350, 1353 (Fed. Cir. 1998)).
"Direct infringement requires a party to perform each and every step or element
of a claimed method or product." Exergen Corp. v. Wal-Mart Stores, Inc., 575 F.3d
1312, 1320 (Fed. Cir. 2009) (quoting BMC Res., Inc. v. Paymentech, L.P., 498 F.3d
1373, 1378 (Fed. Cir. 2007)). "If any claim limitation is absent ... , there is no literal
infringement as a matter of law." Bayer AG v. Etan Pharm. Research Corp., 212 F.3d
1241, 1247 (Fed. Cir. 2000). If an accused product does not infringe an independent
claim, it also does not infringe any claim depending thereon. Ferring B. V. v. Watson

Labs., lnc.-Florida, 764 F.3d 1401, 1411 (Fed. Cir. 2014) (citing Wahpeton Canvas Co.,
Inc. v. Frontier, Inc., 870 F.2d 1546, 1552 (Fed. Cir. 1989) ("One who does not infringe
an independent claim cannot infringe a claim dependent on (and thus containing all the

7

limitations of) that claim.")). However, "[o]ne may infringe an independent claim and not
infringe a claim dependent on that claim." Monsanto Co. v. Syngenta Seeds, Inc., 503
F.3d 1352, 1359 (Fed. Cir. 2007) (quoting Wahpeton Canvas, 870 F.2d at 1552)
(internal quotations omitted). The patent owner has the burden of proving literal
infringement by a preponderance of the evidence. Octane Fitness, 134 S. Ct. at 1758.

b. Indirect Infringement
To establish indirect infringement, a patent owner has available two theories:
active inducement of infringement and contributory infringement. 35 U.S.C. § 271 (b) &
(c). Liability for indirect infringement may arise "if, but only if, [there is] ... direct
infringement." Limelight Networks, Inc. v. Akamai Technologies, Inc.,_ U.S._, 134
S. Ct. 2111, 2117 (2014) (citing Aro Mfg. Co. v. Convertible Top Replacement Co., 365
U.S. 336, 341 (1961) (emphasis omitted)). The patent owner has the burden of proving
infringement by a preponderance of the evidence. Octane Fitness, 134 S. Ct. at 1758.
Under 35 U.S.C. § 271 (b), "whoever actively induces infringement of a patent
shall be liable as an infringer." "To prove induced infringement, the patentee must show
direct infringement, and that the alleged infringer knowingly induced infringement and
possessed specific intent to encourage another's infringement." Toshiba Corp. v.

Imation Corp., 681 F.3d 1358, 1363 (Fed. Cir. 2012) (quoting i4i Ltd. P'ship. v. Microsoft
Corp., 598 F.3d 831, 851 (Fed. Cir. 2010)) (internal quotation marks omitted).
"[l]nduced infringement under§ 271 (b) requires knowledge that the induced acts
constitute patent infringement." Global-Tech Appliances, Inc. v. SEB S.A., 563 U.S.
754, 766 (2011 ). The knowledge requirement can be met by a showing of either actual
knowledge or willful blindness. See id. "[A] willfully blind defendant is one who takes
deliberate actions to avoid confirming a high probability of wrongdoing and who can
almost be said to have actually known the critical facts." Id. at 769 (citation omitted).
"[l]nducement requires evidence of culpable conduct, directed to encouraging another's

8

infringement, not merely that the inducer had knowledge of the direct infringer's
activities." DSU Medical Corp. v. JMS Co., Ltd., 471 F.3d 1293, 1306 (Fed. Cir. 2006)
(en bane in relevant part) (citations omitted).
To establish contributory infringement, the patent owner must demonstrate the
following: (1) an offer to sell, a sale, or an import into the United States; (2) a
component or material for use in a patented process constituting a material part of the
invention; (3) knowledge by the defendant that the component is especially made or
especially adapted for use in an infringement of such patents; and (4) the component is
not a staple or article suitable for substantial non-infringing use. Fujitsu Ltd. v. Netgear
Inc., 620 F.3d 1321, 1326 (Fed. Cir. 2010) (citing 35 U.S.C. § 271 (c)). Defendant "must

know 'that the combination for which his component was especially designed was both
patented and infringing."' Global-Tech, 563 U.S. at 763 (citing Aro Mfg., 377 U.S. at
488).

2. Sourcefire IPS products and services
a. Direct infringement - "automatically receiving and
integrating the reports of suspicious activity"
The jury found that the accused Sourcefire IPS products directly infringe the
asserted claims. (D.I. 337 at 2) Cisco argues that no reasonable jury could have found
that the Sourcefire IPS products "integrate reports of suspicious activity" 1 as required by
the asserted claims. (D.I. 352 at 3) Cisco contends that, "[u]nder the court's claim
construction," the claims require "integrating reports of multiple events, not merely
evaluating a report of a single event." 2 (D.I. 352 at 3) SRI does not dispute the

1

Found in claims 1 and 13 of the '615 patent, and claims 1 and 12 of the '203 patent.
The parties agreed to construe these terms as "[w]ithout user intervention, receiving
reports of suspicious activity and combining those reports into a different end product;
i.e., something more than simply collecting and reiterating data." (D.I. 47 at 2)

2

9

"multiple event" limitation and argues that substantial evidence supports the jury's
finding of infringement. (D.I. 370 at 2)
i. SRl's evidence

SRl's expert, Wenke Lee, PhD ("Dr. Lee"), referenced an internal Sourcefire
document entitled "Compliance Rule Overview" and opined that the Sourcefire IPS
products integrate reports of suspicious activity using rule nesting. (D.I. 396 at 959:22961 :9) For example, the referenced document states that:
For each kind of event, the rule can be constrained by related conditions ..
. .Different conditions for a compliance rule can be combined with an AND
or OR operator. One or more conditions can also be subordinated to
another condition, also combined with an AND or OR operator. All this
together allows complex rules to be built.
(PTX 787 at 7) Dr. Lee explained that "these compliance rules can work together to
achieve the result of correlation .... the firing of one compliance rule can become a
condition into another compliance rule." (D.I. 396 at 960:24-961 :2; PTX 787 at 7) Dr.
Lee opined that "with this nesting ability, ... [one can] write very complex logic to
implement very comprehensive correlation analysis." (D.I. 396 at 961 :2-5;
PTX 787 at 7) Referencing the Sourcefire 3D System User Guide, Dr. Lee explained
that the product literature teaches users and deploying organizations how to combine
rules. (D.I. 396 at 961:10-962:6; DTX 840 at 1228)
In his rebuttal testimony, Dr. Lee repeated that rule nesting works by creating a
new rule that includes "the condition []that another rule has to already be satisfied."
(D.I. 399 at 1793:17-18) He explained that rule nesting enables combination of multiple
events because rule nesting "means that you combine ... the events described by
these two rules" into a single event. (D.I. 399 at 1793:18-23) Dr. Lee showed where, in
the Sourcefire source code, rule nesting happens. (D.I. 399 at 1797:1-21)

10

Dr. Lee explained that his infringement opinion was based, in part, on an
independent test of Sourcefire's IPS products by NSS Labs. (D.I. 396 at 963:22-964:17;
PTX 707 at 5, 20-21) Martin Roesch ("Roesch"), Sourcefire's founder and now Cisco's
vice president and chief security architect, testified that NSS Labs is a well-known "thirdparty testing service" that does "functional analysis of things like intrusion prevention
systems, firewalls, advanced malware protection systems and things like that." (D.I.
398 at 1477:19-1478:5) The NSS Labs report states that the Sourcefire IPS products
"provide the means to infer connections between multiple alerts and group them
together as incidents automatically." (PTX 707 at 17) Dr. Lee opined that this means
that the "correlation engine" within the accused Sourcefire products can "infer
connections between multiple alerts." (D. I. 396 at 964: 12-13; 964:22-965:7)
SRI presented deposition testimony from end users such as Kurt Truxal
("Truxal"), manager of global security at TransUnion, a Sourcefire and Cisco user.
When asked "what a correlation rule does," Truxal said that "[i]t allows you to correlate
multiple events and call it a specific singular event." (D.I. 395 at 799:7-8; PTX 774)
Truxal verified that TransUnion uses Sourcefire products to "combine and nest
conditions." (D.I. 395 at 800:3-4) TransUnion, Truxal explained, also generates
correlation events which are used to take "multiple events that happen in a sequence
and rout[e] them together to create one unique individual event ... [so that] they add up
to something that could be more interesting." (D.I. 395 at 807:21-808:4)

ii. Cisco's evidence
Cisco's expert, Paul C. Clark, PhD ("Dr. Clark"), explained the operation of the
"compliance engine feature" of the Sourcefire Defense Center product. (D.I. 398 at
1574:25-1575:1) Dr. Clark opined that the "compliance engine feature" processes
events from sensors serially, "[a]s you'll see here, we're going to take the next event
and match it with the policy just like we did the first event, and then we're going to fire

11

one or more rules. But firing one or more rules is not combining multiple events." (D.I.
398 at 1575:24-1576:3; PTX 787 at 7; See also D.I. 398 at 1600:8-13) Dr. Clark
explained that, in rule nesting, a base event is "going to be processed the same way [as
rules in series], [by] tak[ing] it across, correlat[ing] with a rule one in the policy,
trigger[ing] that rule, and then mov[ing] it along. And now you correlate it with Rule 2,
same event, and just fire a second rule." (D.I. 398 at 1577:11-14; PTX 787 at 7, 21)
Cisco elicited cross examination testimony from Dr. Lee in which he agreed that the
accused Sourcefire IPS products process rules "one event at a time." 3 (D.I. 399 at
1841:20-21)
iii. Analysis
The jury was asked to consider whether SRI presented a preponderance of
evidence to demonstrate that Cisco's Sourcefire IPS products directly infringed the
asserted claims, either literally or under the doctrine of equivalents. (D.I. 336 at 23-25)
Cisco argues that no reasonable jury could find infringement of the "automatically
receiving and integrating the reports of suspicious activity" limitation found in the
asserted claims, either literally or under the doctrine of equivalents. 4 (D.I. 352 at 6)
3

Cisco presented attorney argument that Dr. Lee's claim that "Cisco's 'nested rules'
could combine more than one event" is "inaccurate." (D.I. 352 at 5) This is one of
several arguments related to the "nested rules feature" that Cisco asserts must be
present, independent of the correlation engine. During trial, the so-called "nested rules
feature" was mentioned twice in testimony from Cisco's Edward Bedwell ("Bedwell").
(D.I. 398 at 1493:24; 1498:9) In its briefs, Cisco argues that SRI failed to demonstrate
infringement with respect to this so-called "nested rules feature" on more than a dozen
occasions. (D.I. 352 at 5, 6, 12, 13, 14, 24 & n.4; D.I. 379 at 3, 5, 7, 12, and 13) There
is no evidence in the record that Cisco made any of these arguments to the jury.
4 Cisco argues that "no reasonable jury could have found that the Sourcefire products
satisfy the claim requirement of integrating reports of multiple events under the doctrine
of equivalents." (D.I. 352 at 6) Cisco avers that "SRI offered no evidence that
Sourcefire's accused single-event correlation is insubstantially different from the
integration of multiple events required by all asserted claims." (Id.) There is no
evidence in the record that SRI asserted an equivalents argument with respect to this
claim limitation. Therefore, the court denies Cisco's motions with respect to
equivalents.
12

Cisco contends that Dr. Lee's testimony under cross examination leads to the
conclusion that "the claims undisputedly require[] integrating reports of multiple events,
not merely evaluating a report of a single event." 5 (D.I. 352 at 3, citing D.I. 396 at
1082:20-1083:5)
The court instructed the jury that "automatically receiving and integrating the
reports of suspicious activity" means "[w]ithout user intervention, receiving reports of
suspicious activity and combining those reports into a different end product; i.e.,
something more than simply collecting and reiterating data." (D.I. 336 at 21) Dr. Lee
opined that correlation rules, combined with rule nesting, receive reports of suspicious
activity and combine those reports into a different product. (D.I. 396 at 960:24-961 :2;
PTX 787 at 7; DTX 840 at 1228) Truxal expressed a similar opinion. (D.I. 395 at
807:21-808:4) Dr. Clark opined that this was not possible, because the Sourcefire
products process events serially. (D.I. 398at1577:11-14; PTX 787 at 7, 21)
On the record at bar, SRl's expert provided more than conclusory testimony in
order to explain his conclusions to the jury. SRI also presented a fact witness to
corroborate SRl's expert. The jury credited such testimony over that of Cisco's expert.
The court declines to re-weigh the evidence or the credibility of the witnesses. Viewing
the record in the light most favorable to SRI, substantial evidence supports the jury's
verdict. For these reasons, Cisco's renewed motion for JMOL is denied.
b. Indirect infringement - induced infringement

The jury found that Cisco induced infringement of the asserted claims by
Sourcefire IPS products and services. (D.I. 337 at 4) Cisco argues that no reasonable
jury could have found that Cisco induced infringement of the Sourcefire IPS products
and services. (D.I. 352 at 13) Cisco contends that SRI failed to demonstrate direct

5

This proposed construction was not presented to the jury.
13

infringement, either through customers Home Depot and TransUnion or through survey
results. (Id.) Cisco asserts that a jury could not have concluded the teaching or
encouragement factor because "SRI failed to present substantial evidence that Cisco
actively encouraged its customers to enable or use any allegedly infringing nested
rules." (Id. at 14) Cisco argues that, SRI did not provide evidence that "Cisco 'knew the
acts' of its customers 'were infringing."' (Id.) SRI responds that it "presented extensive
evidence that Cisco induced infringing deployment and use of the Sourcefire IPS
Products and Services by its customers." (D.I. 370 at 12)

i. SRl's evidence
SRI presented evidence of direct infringement by the accused Sourcefire IPS
products as discussed above. For example, when asked "what a correlation rule does,"
TransUnion's Truxal said that "[i]t allows you to correlate multiple events and call it a
specific singular event." (D.I. 395 at 799:7-8; PTX 774) Truxal verified that TransUnion
uses the accused Sourcefire products to "combine and nest conditions." (D.I. 395 at
800:3-4) TransUnion, Truxal explained, also generates correlation events which are
used to take "multiple events that happen in a sequence and rout[e] them together to
create one unique individual event ... [so that] they add up to something that could be
more interesting." (D.I. 395 at 807:21-808:4)
SRI presented circumstantial evidence of direct infringement in the form of the
NSS Labs report. (PTX 707 at 5, 17, 20-21) Dr. Lee's aforementioned analysis of
Cisco source code was also directed at the question of direct infringement by Sourcefire
IPS products. (D.I. 399 at 1793:17-23, 1797:1-21) SRl's survey expert, Ken Van Liere,
PhD ("Dr. Van Liere"), presented the results of a survey of Cisco customers and opined
that, based upon the survey results, "78 percent of the people who have one [Sourcefire
product] in their U.S. network said that [the correlation compliance engine] feature was
enabled." (D.I. 395 at 728:20-729:2) Table 10 of the survey results show that 78% of

14

Sourcefire users selected "Correlation/Compliance Engine" in response to the question:
"which of the following, if any, are enabled in one or more of the Sourcefire Products
that are currently installed within your organization's United States network?" (PTX
1093 at table 10)
Dr. Lee opined that "using the correlation feature" in the Sourcefire IPS products
is "one of the best practices recommended [by Cisco] to customers." (D.I. 396 at 977:16) In reference to various Cisco user guides, Dr. Lee testified that these user guides
teach Sourcefire customers why, and how, to use correlation rules. (Id. at 978: 1-8; PTX
787 at 7 (Compliance Rule Overview); PTX 784 at 62 (Best Practices Guide); DTX 840
at 1228 (Sourcefire 3D System User Guide); PTX 151 at 39-7 (FireSIGHT System User
Guide))
SRI elicited testimony, on cross examination, from Cisco's Roesch that he did not
analyze infringement or read the patents until his deposition in the fall of 2015, which
was two years after the filing of the present suit. (D.I. 398 at 1478:17-1479:13) Roesch
opined that "[w]hen there are deeply technical issues on the table and there has been a
legal application of understanding to those deep technical issues," his general attitude is
that Cisco has not infringed a patent, because people who are bringing suits do not
understand the technology. (Id. at 1481 :22-1482:2) Roesch also testified that his initial
impression about the case at bar was that SRI "[d]idn't understand our technology." (Id.
at 1482: 10-13) SRl's former vice president of legal and business affairs and general
counsel, Richard Abramson ("Abramson"), testified in a deposition that during licensing
discussions (before the case at bar had been filed) Cisco had presented
noninfringement contentions that SRI had rebutted. (D.I. 397 at 1233:15-22)

ii. Cisco's evidence
Cisco points to various aspects of SRl's evidence that it contends are a failure of
proof of direct infringement. For example, SRI deposed Jeffrey Lee Mitchell ("Mitchell"),
15

who is the director of IT security at Home Depot. When asked whether Home Depot
uses correlation rules in the company's "defense center," Mitchell testified "I don't think
so . . . . Because our correlation that we would begin within SOC is not done with the
management console. It's done with correlation rules within Splunk." (D.I. 395 at
681: 10-17) Mitchell repeated "I don't know if[the correlation rules are] enabled on the
defense center. I do know that we are not using it in the SOC for correlation." (D.I. 395
at 682:9-11) Cisco asserts that Mitchell's testimony means that "Home Depot does not
use the accused correlation engine and leaves it disabled." (D.I. 352 at 13) Cisco
argues that "TransUnion uses the correlation engine but not the nested rules feature."
(Id.) In support, Cisco points to Truxal's testimony that TransUnion does not have the

defense center configured to "generate reports based on correlated events." (D.I. 395
at 808:5-13) With respect to Dr. Van Liere's survey, Cisco avers that the "survey failed
to include any questions about the customers' use of the accused nested rules feature."
(D.I. 352 at 13-14, citing PTX 1093 at table 10)
Cisco argues that "SRI failed to present substantial evidence that Cisco actively
encouraged its customers to enable or use any allegedly infringing nested rules." (D.I.
352 at 14) For example, Dr. Lee testified that one of the ways Cisco encouraged its
customers to infringe was by providing customer support for Sourcefire. (D.I. 396 at
980:6-981 :5 (referencing deposition testimony by Cisco employee, Steven Alan Sturges
("Sturges") at D.I. 395 at 759:8-770:2)) Cisco contends that this failure of proof is
supported by Dr. Clark's testimony that "the compliance engine is the accused feature in
the Defense Center" but that the defense center does "[l]ots of other things." 6 (D.I. 398
at 1571 :3-16) Cisco notes that three of the user guides presented by SRI do not
mention Sourcefire's correlation engine or the accused nested rules feature. (D.I. 352

6

In support of this, Cisco cites generally to DTX 840 "Sourcefire 3D System User
Guide," which is a 2,000 page document.
16

at 14) With respect to the user guides that teach rule nesting, Cisco avers that the
teaching is limited to a single statement that "You can nest rules." (D.I. 352 at 14; See

also DTX 840 at 1228, PTX 151 at 39-7). Cisco notes that the relevant Sourcefire User
Guide (DTX 840) is dated July 2011, which it argues is "more than a year" before May
2012, when STI sent a letter informing Cisco of the infringement allegations. 7 (D.I. 352
at 14; D.I. 398 at 1247:15-20) Moreover, Cisco contends that the trial transcript
demonstrates that SRI "attempt[ed] to establish induced infringement without
addressing the reasonableness of Cisco's non-infringement defenses."8 (D.I. 352 at 1415, citing D.I. 400 at 1952:6-1957:15) In its closing argument, Cisco made the following
statement:
Indirect infringement. They're right. Dr. Clark said, our products don't
infringe. If they don't infringe, then no one else who uses them can
infringe. But we also didn't have the intent. They did not show9 you what
Abramson, who was their former general counsel, admitted at deposition:
Do you know if Cisco presented any noninfringement positions in those
license licensing discussions? At some point they did make some
argument as to why they felt they didn't infringe. That shows you we felt
we didn't infringe. That does not add up to that we knowingly told people
to do things knowing that it would infringe. I don't know why they didn't tell
you that. It's their guy. I think you're not going to be terribly surprised, but
I really want you to say no to this one, too.

7

May 2012 is less than a year after July 2011.
8 Cisco argues that "the Federal Circuit recently rejected the notion that 'any time a
defendant's products are found to directly infringe, the plaintiff has sufficiently
established the defendant's intent to induce infringement."' (D.I. 352 at 15, citing
Warsaw Orthopedic, Inc. v. NuVasive, Inc., 824 F.3d 1344, 1352 (Fed. Cir. 2016)
(Reyna, J., concurring)) The Federal Circuit took a more nuanced approach, "[t]o be
clear, we do not suggest that inducement liability is [as] broad [as Judge Reyna
suggests in his concurrence]. To show the intent to induce infringement, it is sufficient
that the plaintiff establish that a defendant's asserted belief in non-infringement was
unreasonable." Warsaw Orthopedic, 824 F.3d at 1351 n.2.
9 Cisco appears to argue that SRI did not address the reasonableness of Cisco's
noninfringement belief. (But see D.I. 397 at 1233:15-22 ("Question: Do you know if
Cisco presented any noninfringement positions in those licensing discussions? Answer:
At some point they did make some argument as to why they felt they didn't infringe.")
17

(D.I. 400 at 1988:21-1989:10)

iii. Analysis
The jury was asked to consider whether SRI presented a preponderance of
evidence to demonstrate that Cisco's induced infringement of the asserted claims by
Sourcefire IPS products. (D.I. 336 at 26) The court instructed the jury that SRI bore the
burden to prove:
1. Defendant took some action intending to encourage or instruct its
customers to perform acts that you, the jury, find would directly infringe an
asserted claim;
2. Defendant was aware of the asserted patents at the time of the alleged
conduct and knew that its customer's acts (if taken) would constitute
infringement of an asserted patent, or the defendant believed there was a
high probability that the acts (if taken) would constitute infringement of an
asserted patent but deliberately avoided confirming that belief; and
3. Use by others of the defendant's products or services infringes one or
more of the asserted claims.

(Id.) As to the first factor, SRI presented evidence that Cisco's user guides and
marketing materials teach rule nesting and how to use the correlation engine. (D.I. 370
at 13) Cisco argues that these materials are insufficient to demonstrate that Cisco
encouraged or instructed its customers to enable or use rule nesting or the correlation
engine. 10 (D.I. 352 at 14) Cisco argues that the "Best Practices Guide" (PTX 784)
predates May 2012 (when SRI informed Cisco of its infringement contentions) and
cannot form a basis for inducement, because Cisco could not have had knowledge of
the potential infringement when it made the statement. 11 However, even if Cisco had
made this argument to the jury (which the record shows it did not), Cisco did not
address (either in its briefs or to the jury) the timeliness of the other evidence presented
by SRI. The jury was presented with sufficient evidence to determine whether Cisco
10

There is no evidence that Cisco made this argument to the jury.

11

Metro-Goldwyn-Mayer Studios, Inc. v. Grokster, Ltd., 518 F. Supp. 2d 1197, 1234
(C.D. Cal. 2007), is inapposite.
18

took some action to encourage or instruct its customers to use the Sourcefire IPS
products in an infringing manner.
With respect to the intent factor, for the relevant time period, SRI presented
evidence that Cisco knew about the patents and SRl's belief that Cisco infringed the
patents. SRI also presented evidence that Cisco's Roesch did not read the patents until
his deposition (a period of nearly two years after filing suit) and James Kasper
("Kasper"), a software engineering technical leader at Cisco, was not asked to
investigate the possibility of infringement. (D.I. 398 at 1479:9-13; D.I. 400 at 1953:101957: 15) Cisco argues that its denial of infringement during "[t]he parties' pre-suit
discussions confirm[s] Cisco's reasonable belief in non-infringement." 12 (D.I. 352 at 15)
The parties presented sufficient evidence for a jury to conclude that either Cisco knew
that its customers' acts (if taken) would constitute infringement of the asserted claims or
Cisco believed there was a high probability that its customers' acts (if taken) would
constitute infringement of an asserted claim but that Cisco deliberately avoided
confirming that belief.
On the third factor, direct infringement, SRI presented evidence of infringement
through Cisco customers at Home Depot and TransUnion. Cisco argues that these
customers cannot directly infringe the asserted claims, because they do not use the
relevant aspects (rule nesting and compliance engine) of the accused Sourcefire IPS
products. 13 SRI presented additional evidence of infringement through Dr. Van Liere's
survey, including table 10, which (according to Dr. Van Liere) supports the conclusion
that 78% of Sourcefire IPS customers use the "Correlation/Compliance Engine" feature.
12

See supra, note 10. Moreover, Cisco argues that the exclusion of testimony by
Roesch as to his opinion of noninfringement would have overcome the willful blindness
theory SRI presented in closing arguments. The court declines to reconsider its
decision.
13
See supra, note 10. For example, in its closing argument, Cisco did not mention
Truxal, Mitchell, TransUnion or Home Depot.
19

(PTX 1093 at table 10) Cisco argues that the survey does not address the rule nesting
feature. (D.I. 352 at 13-14) SRI argued to the jury that rule nesting is implicit to the
correlation engine. (See, e.g., D.I. 400 at 1947:10-1948:22) Cisco appears to argue
that rule nesting and the correlation engine are two separate features that must both be
separately shown in order to demonstrate direct infringement. 14 (D.I. 352 at 13-16)
Sufficient evidence was presented to enable the jury to decide whether Cisco's
customers directly infringe the asserted claims by using the Sourcefire IPS products.
On the record at bar, SRI presented more than conclusory evidence of
inducement to the jury. The jury credited the testimony of SRl's witnesses and exhibits
over that of Cisco. The court declines to re-weigh the evidence or the credibility of the
witnesses. Viewing the record in the light most favorable to SRI, substantial evidence
supports the jury's verdict that Cisco induced infringement of the asserted claims by its
customers using Sourcefire IPS products. For these reasons, Cisco's renewed motion
for JMOL is denied.
3. Cisco IPS products

Cisco argues that the asserted claims contain the "hierarchical monitor" limitation
and that no reasonable jury could have found that the accused Cisco IPS products
satisfy this claim limitation. (D.I. 352 at 7) Cisco avers that "[d]espite the express claim
requirement of multiple (i.e., at least two) monitors in a hierarchy, SRI nevertheless
based its infringement theory on the features inside a single Cisco IPS product as being
both the lower-level monitors and the hierarchical monitor required by the claims." (Id.)
At summary judgment, Cisco presented a similar argument "that the SensorApp
processing thread cannot simultaneously be both the alleged 'network monitor and
14

See supra, note 10. Cisco mentioned rule nesting once in its closing argument, "[c]an
a nested rule in a correlation engine be evaluated against multiple intrusion events? It
cannot. How do you know? I [Cisco's Ted Bedwell] have actually reviewed the source
code." (D.I. 400 at 1982:5-7) See supra, note 3.

20

'hierarchical monitor' under the claims because they are not 'separate and distinct
structures."' (D.I. 301 at 32) The court denied summary judgment of noninfringement
and clarified that "[t]he claim language and the parties' constructions do not require that
the 'network monitor' and 'hierarchical monitor' be separate structures." (Id.) The court
found genuine issues of material fact as to "whether the Meta Event generator meets
the ['hierarchical monitor'] claim limitation." (Id.)
Cisco makes two arguments in support of its motion for JMOL: (1) a single Cisco
IPS product cannot satisfy the "plurality of network monitors" 15 limitation; 16 and (2) Dr.
Lee's testimony cannot support a jury finding of infringement of the "hierarchical
monitor" 17 limitation. (D.I. 352 at 7-8)

a. Reconsideration

A motion for reconsideration is the "functional equivalent" of a motion to alter or
amend judgment under Federal Rule of Civil Procedure 59(e). See Jones v. Pittsburgh

Nat'/ Corp., 899 F .2d 1350, 1352 (3d Cir. 1990) (citing Fed. Kemper Ins. Co. v.
Rauscher, 807 F.2d 345, 348 (3d Cir. 1986)). The standard for obtaining relief under
Rule 59(e) is difficult to meet. The purpose of a motion for reconsideration is to "correct
manifest errors of law or fact or to present newly discovered evidence." Max's Seafood

Cafe ex rel. Lou-Ann, Inc. v. Quinteros, 176 F.3d 669, 677 (3d Cir. 1999). A court
should exercise its discretion to alter or amend its judgment only if the movant
demonstrates one of the following: (1) a change in the controlling law; (2) a need to

15

Found in the '615 patent at column 15, lines 5 and 57, and the '203 patent at column
14, line 22 and column 15, line 2.

16

Cisco's argument appears to involve a claim construction in which the "accused
lower-level monitors ... [must] be independently configured or installed." (D.I. 352 at 7)
This claim construction was not presented to the jury. For reasons to be discussed
below, the court addresses these arguments as a motion for reconsideration.
17

Found in the 615 patent at column 15, lines 20-21 and column 16, line 3, and the '203
patent at column 14, lines 34-35 and column 15, line 13.
21

correct a clear error of law or fact or to prevent manifest injustice; or (3) availability of
new evidence not available when the judgment was granted. See id. A motion for
reconsideration is not properly grounded on a request that a court rethink a decision
already made and may not be used "as a means to argue new facts or issues that
inexcusably were not presented to the court in the matter previously decided."

Brambles USA, Inc. v. Blocker, 735 F. Supp. 1239, 1240 (D. Del. 1990); see also
Glendon Energy Co. v. Borough of Glendon, 836 F. Supp. 1109, 1122 (E.D. Pa. 1993).
In support of its request for reconsideration of the denial of summary judgment of
noninfringement, Cisco presents attorney argument related to the "plurality of monitors"
limitations, but these are the same arguments Cisco made at summary judgment, and
Cisco has not presented additional facts or law to support its noninfringement position. 18
(D.I. 352 at 7-8; See also D.I. 301 at 32) Therefore, the court denies Cisco's request for
reconsideration.

b. Direct infringement- "hierarchical monitor"
Cisco argues that "SRI failed to prove that Cisco's IPS Products satisfy the claim
requirement of a 'hierarchical monitor' that integrates reports from two or more lowerlevel monitors," alleging that "Dr. Lee[] changed his infringement theory" during the trial.
(D.I. 352 at 8) SRI agrees that "Dr. Lee misstated ... which box drawn in a marketing
diagram represented the meta event generator," but argues that the location of the meta
18

Cisco cited to testimony from Dr. Lee (SRl's expert), various Cisco employees, and to
one question answered by Dr. Clark (Cisco's expert) opining that sensor apps cannot be
configured independently. (See D.I. 398 at 1593:2-7 ("Q. Okay. Can a sensor app -can you go in and independently configure or install a sensor app? A. It does not make
sense. As I said, it's an execution stream in there. You can't -- you don't even know
how many of them there are going to be. It's dependent upon the hardware that you are
running.")) It is unclear how this testimony relates to Cisco's argument. Moreover, at
summary judgment, the court concluded "that the expert opinions present factual
disputes as to whether the Meta Event Generator meets the claim limitation." (D.I. 301
at 32) These disputes are addressed below with respect to the "hierarchical monitor"
limitation.
22

event generator is not important and that the meta event engine (or generator)
corresponds to the "hierarchical monitor" in the claims. (D.I. 370 at 7)
i. SRl's evidence
Dr. Lee opined that the meta event engine (or meta event generator) meets the
claim limitation of a "hierarchical monitor," because it receives events "from the lower
level sensor app processing thread network monitors" and is "logically separate from the
other inspection engines ... that are in the sensor app threads." (D. I. 396 at 888:6-15;
D. I. 397 at 1189:5-12) Dr. Lee discussed source code, which explains that the meta
engine "allows for definitions of 'META events' that in effect correlate events
automatically .... A META event is defined by other signature events occurring in a
related manner within a sliding time interval." (PTX 677 at 36; D.I. 396 at 888:16890: 18) With reference to the User Guide for Cisco Security Manager 4.4, Dr. Lee
testified that "the lower level sensors take input from network packet produced events
and the meta engine takes those events and correlates them. So there is a hierarchy
here." (D.I. 396 at 891:15-18; See also PTX 94 at 38-25 ("The Meta engine is different
from other engines in that it takes alerts as input where most engines take packets as
input."))
On direct examination, Dr. Lee discussed a Cisco marketing presentation. A
slide entitled "IPS Sensor Architecture," Dr. Lee explained, is an "architectural diagram
of software .... [that] tells you what are the components of the software, how [] they
work together." (D.I. 396 at 864:5-11) Dr. Lee opined that the meta event engine is
located in the "Correlation App" box:
Q. What does this·-- to your understanding, there's a box here, correlation
app. What is that referring to?

A. So this is the, essentially, the correlation engine or the meta event
engine in Cisco's language. That's the upper level hierarchy code
monitor.

23

(D.l. 396 at 864:24-865:3; PTX 109 at 19) On cross examination, Dr. Lee confirmed this
opinion. (D.I. 396 at 1048: 19-1049:4) After Cisco presented evidence disputing that the
meta event engine is located within the "Correlation App" box of the software
architecture, on redirect, Dr. Lee explained that the physical location of the meta event
generator is not important. (D.I. 397 at 1188:20-22) Dr. Lee explained his opinion,
showing the preceding slide from the same presentation and identifying that the "Meta
Event Generator for event correlation" is located within the "On-box Correlation Engine"
box in that slide. (D.I. 397 at 1188:23-1189:12; PTX 109 at 18)

ii. Cisco's evidence
On cross examination, Cisco verified Dr. Lee's opinion that the meta event
generator is located in the "Correlation App" box in the Cisco marketing presentation.
(D. I. 396 at 1048: 19-1049:4; PTX 109 at 19) Cisco's Kasper testified that the
"Correlation App" box in the marketing presentation does not have anything to do with
the meta event generator. (D.I. 398 at 1521 :2-4) Kasper explained that the word
correlation does not indicate that it has anything to do with the meta event generation,
because "[c]orrelation is sort of generally used term. So nothing to do with meta." (D.I.
398 at 15:5-9) Cisco questioned Dr. Lee about this inconsistency:
Q. And when you testified last week --

A. Yes.
Q. -- you testified that the meta event generator was this green box, the
correlation app; is that correct?

A. I do recall that.
Q. Okay. And that, sir, you relied on that testimony to establish
infringement?

A. No.
Q. Part of your infringement opinion?

A. I disagree.
Q. Okay?

A. Yes.
24

Q. But that testimony, that was wrong?

A. So -Q. Can you answer my question? That testimony was incorrect?

A. That particular statement was incorrect, that the correlation app is, yes.
(D.I. 399 at 1810:7-24) Dr. Lee also agreed that "[o]n this particular slide, I think I was
wrong in saying the correlation app was the meta event." (D. I. 399 at 1811: 17-18)
Cisco elicited additional testimony from Dr. Lee on cross examination in which he
explained that some sensor "threads acts as network monitors .... [and] [s]ome
threads [act] as meta event generators." (D.I. 399 at 1815:8-17) Meanwhile, Kasper
testified that "[t]he meta event generator ... is part of each of those threads." (D.I. 398
at 1532:5-12; 1533:1-16)

iii. Analysis
The jury was asked to consider whether SRI presented a preponderance of
evidence to demonstrate that Cisco's IPS products directly infringed the asserted claims
either literally or under the doctrine of equivalents. (D.I. 336 at 23-25) SRI did not
assert doctrine of equivalents with respect to the "hierarchical monitor" limitation. (D.I.
396 at 866:20-869:3) The court instructed the jury that "[h]ierarchical monitor" means "a
network monitor that receives data from at least two network monitors that are at a
lower level in the analysis hierarchy." (D.I. 336 at 20)
SRl's expert, Dr. Lee, opined that the meta event engine (or generator) satisfies
the hierarchical monitor claim limitation. The parties disputed the location of the meta
event engine in Cisco's marketing materials, and Cisco was able to elicit testimony from
Dr. Lee that his opinion in this regard was "incorrect" and "wrong." Cisco did not dispute
the existence or role of the meta event engine. Dr. Lee opined that the meta event
engine was a software thread distinct from other software threads. Kasper explained

25

that the meta event engine was part of each software thread but that in the context of a
virtual sensor, the meta event generator would read events from multiple threads.
On the record at bar, SRl's expert provided more than conclusory testimony in
order to explain his conclusions to the jury. The jury credited such testimony over that
of Cisco's expert and fact witnesses. The court declines to re-weigh the evidence or the
credibility of the witnesses. Viewing the record in the light most favorable to SRI,
substantial evidence supports the jury's verdict. For these reasons, Cisco's renewed
motion for JMOL is denied.

c. Indirect infringement - induced infringement
The jury found that Cisco induced infringement of the asserted claims by the
accused Cisco IPS products and services. (D.I. 337 at 4) Cisco contends that no
reasonable jury could have determined that Cisco induced infringement of the asserted
claims by Cisco's IPS products and services, because "no reasonable jury could have
found that Cisco knew that any use of the accused Cisco IPS Products and Services
would be infringing." (D.I. 352 at 16) Addressing the first prong of intent, Cisco argues
that its "good-faith, reasonable belief in non-infringement since first learning of SRl's
patents defeats the intent requirement for inducement." (Id. at 17) As to the second
prong, Cisco avers that Kasper's testimony is insufficient to establish willful blindness.

(Id.)

i. SRl's evidence
SRI presented testimony from Roesch that he did not review the patents-in-suit
until after his deposition in the fall of 2015, some two years after the filing of the
complaint. (D.I. 398 at 1479:3-13) SRI also presented the following testimony from
Kasper:
Q. Between the time that Cisco received that notice [of SRl's infringement
contentions] mentioned in 2012 and when I took your deposition in 2015,

26

did anyone from Cisco ever approach you and say, take a look at these
patents. We want to make sure that we don't infringe them?
A. No, sir.
Q. In fact, even though you just said you were one of the most

knowledgeable people at Cisco on its IPS system, and, in fact, the one
here testifying, at the time of your deposition in 2015, you had never even
seen the patents-in-suit, had you?
A. That is correct.
(D.I. 398 at 1535:3-14)

ii. Cisco's evidence
Cisco points to the noninfringement defenses it presented at trial as evidence of
its "reasonable belief that the accused Cisco IPS Products and Services do not
infringe." (D.I. 352 at 16, citing D.I. 394 at 400:18-25; D.I. 397 at 1233:15-22; D.I. 399
at 1899:20-21 and 1900:8-9) Moreover, Cisco argues that the jury had no basis to
conclude that Cisco was willfully blind as to infringement, because "Kasper's testimony
confirmed the absence of the claimed 'hierarchical' relationship between the accused
features in Cisco's IPS Products, which supports Cisco's noninfringement defense."
(D.I. 352 at 17, citing D.I. 398 at 1509:7-1512:6, 1516:24-1518:15 and 1545:16-23)

iii. Analysis
The jury was asked to consider whether SRI presented a preponderance of
evidence to demonstrate that Cisco induced infringement of the asserted claims by
Cisco's IPS products and services. (D.I. 336 at 26) The court instructed the jury that
SRI bore the burden to prove, among other things, that:
2. Defendant was aware of the asserted patents at the time of the alleged
conduct and knew that its customer's acts (if taken) would constitute
infringement of an asserted patent, or the defendant believed there was a
high probability that the acts (if taken) would constitute infringement of an
asserted patent but deliberately avoided confirming that belief. 19

19

Cisco only disputes this second factor (intent) relevant to Cisco's inducement with
respect to the Cisco IPS products and services.
27

(D.I. 336 at 26) SRI presented evidence that SRI notified Cisco of infringement in 2012
and that neither Roesch nor Kasper (who are among the most knowledgeable
individuals within the company about the operation of Cisco's IPS products and
services) read the patents-in-suit until some point in time after their depositions in the
fall of 2015. SRI also presented evidence that Cisco did not ask Kasper to investigate
the patents-in-suit or potential infringement. SRI argued that these actions establish
willful blindness under the intent factor. (D.I. 370 at 15) Cisco argues that the
noninfringement arguments that Roesch and Kasper presented at trial establish the
company's good faith belief in noninfringement. (D.I. 352 at 16-17) Sufficient evidence
was presented to enable the jury to decide whether Cisco's actions satisfied the intent
factor.
On the record at bar, SRI presented more than conclusory evidence of
inducement to the jury. The jury credited the testimony of SRl's witnesses and exhibits
over that of Cisco. The court declines to re-weigh the evidence or the. credibility of the
witnesses. Viewing the record in the light most favorable to SRI, substantial evidence
supports the jury's verdict that Cisco induced infringement of the asserted claims by its
customers using Cisco IPS products and services. For these reasons, Cisco's renewed
motion for JMOL is denied.
d. Indirect infringement - contributory infringement

The jury found that Cisco contributed to the infringement of the asserted claims
by the accused Cisco IPS products. (D.I. 337 at 5) Cisco argues that "[n]o reasonable
jury could have found Cisco liable for contributory infringement with respect to the
accused Cisco IPS Products," because SRI failed to demonstrate that "Cisco's IPS
Products have 'no substantial non-infringing uses"' and SRI failed to establish the intent
requirement. (D.I. 352 at 17)

28

i. SRl's evidence
"SRI offered testimony and Cisco documents showing that the infringing meta
engine and critical signatures are enabled by default, that the meta engine handles all
signature events, and that Cisco encourages its customers' use of the features by
enabling the features and promoting their value." (D.I. 370 at 16) For example, Cisco's
Kasper verified that the meta event generator on Cisco IPS devices is enabled by
default. (D.I. 395 at 644:15-18) Dr. Lee explained that Cisco's documentation indicates
that the meta event generator is enabled by default. (See D.I. 396 at 898:6-15
(referencing PTX 555 at SRl-CIS0041424); 900:5-10 (referencing PTX 94 at 39-22)) Dr
Van Liere presented an opinion (based upon survey evidence) that, of the Cisco IPS
customers, "60 to 64 percent are aware of the meta event generator and know that it's
enabled in one or more of the devices in their U.S. network." (D.I. 395 at 736:15-23)
Dr. Lee opined that this number could be higher "because the default [setting is] on and
some customers may not even pay attention to the default setting. They just, you know,
leave them on." (D.I. 395 at 911 :21-912:5) With respect to intent, SRI relies on the
aforementioned statements by Roesch and Kasper.

ii. Cisco's evidence
Cisco questioned SRl's damages expert Dr. Stephen Prowse ("Dr. Prowse"), who
acknowledged that the percentage of users who have the meta event engine enabled is
"probably less than a hundred." (D. I. 397 at 1339:5-25) Cisco also elicited testimony
from Dr. Van Liere that "36 percent [of users] said they don't enable [the meta event
engine] ... or don't know if they enabled [it]." (D.I. 395 at 743:24-744:2) As to these 36
percent of users, both Dr. Van Liere and Dr. Lee were unable to answer Cisco's
question about the precise number of users who said "I don't know" to the question but
who actually have the meta event engine enabled. (D.I. 396 at 741 :11-25; D.I. 397 at
1165:7-1166:20 (Dr. Lee)) According to Cisco, these statements indicate that "SRI

29

provided the jury no basis to infer whether those specific users represented a negligible
or a substantial portion of the respondents." (D.I. 352 at 17-18) As to substantial
noninfringing uses for Cisco IPS products, Dr. Clark opined that "a lot of what [Cisco]
do[es] is not accused." (D.I. 398 at 1601 :4) At closing, Cisco attempted to focus the
jury on the 36 percent number:
Substantial noninfringing uses. Their own survey expert, I think he was
almost shocked. I heard Mr. Scherkenbach actually admit, yes, not all do
this. Their own survey guy says 36 percent said they don't enable those
features or they don't know if they enable those features. That's right. We
don't have to get here. If you find, as I think you will, that the products
don't infringe, then we don't have to get to the whole point of whether
there's substantial noninfringing uses, because all uses would infringe.
This is only somewhere in the case if you need to get to contributory
infringement to find that our customers infringe. No, please.
(D.I. 400 at 1989:11-22) On the intent factor, Cisco argues that, as with inducement, it
lacked the intent to infringe. (D. I. 352 at 18)
iii. Analysis
The jury was asked to consider whether SRI presented a preponderance of
evidence to demonstrate that Cisco contributed to infringement of the asserted claims
by Cisco's IPS products. (D.I. 336 at 27) The court instructed the jury that SRI bore the
burden to prove, among other things, that:
First, that defendant knew of the patents-in-suit.

Second, that the accused product is: (a) for system claims, a material
component of the claimed system; or (b) for the method claims, a material
component for use in practicing the claimed method. In other words, that
the accused product must be especially made or adapted for use in a
manner that infringes the patent.
Third, that defendant knew that the accused product would be used in a
manner infringing the patents-in-suit.
Fourth, that the accused product is not a staple or commodity article, in
other words, the accused product does not have a substantial noninfringing use. Providing a staple or commodity article is not contributory
infringement.

30

Fifth, the accused product was actually used in a manner that you, the
jury, find infringes the asserted claims.
(Id.) The court has addressed the intent factor with respect to inducement. 20 (See, e.g.,
D.I. 379 at 10) Cisco argues that SRI has failed to demonstrate that there are no
substantial noninfringing uses. Cisco contends that SRl's expert, Dr. Lee, based his
substantial noninfringing uses opinion on the Cisco IPS products "as a whole" (D.I. 352
at 18, citing D.I. 396 at 918:15-920:12) and that SRI is now arguing that "the particular
tools at issue" (i.e. meta event engine and critical signatures) have no substantial
noninfringing uses. (D.I. 370 at 16, citing Lucent Techs, Inc. v. Gateway, Inc., 580 F.3d
1301, 1320 (Fed. Cir. 2009))
"[N]on-infringing uses are substantial when they are not unusual, far-fetched,
illusory, impractical, occasional, aberrant, or experimental." Vita-Mix Corp. v. Basic
Holding, Inc., 581 F.3d 1317, 1327 (Fed. Cir. 2009). Dr. Lee expressed the opinion that
the potential noninfringing uses of the accused Cisco IPS products are impractical and,
therefore, not substantial:
So, in substantial [sic] use, it would be a customer only uses a single
hardware interface. As we have discussed before, this is very, very
unusual. Typically, a customer I would suspect would have at least two
interfaces in a box, one for incoming, one for outbound traffic, and then
the default signatures at a sensor level and also the default on meta event
generator, they infringe.
The vast majority of the customers, the evidence is they actually use the
default settings.
Really, if a customer goes to the length to disable these [infringing] default
settings, that would mean that they actually essentially are rendering the
IPS apps not very useful. That doesn't make sense, after they paid so
much money. And, you know, also, we actually have not seen any
evidence that there is a substantial number of customers actually disabling
these infringing features.

20

As with inducement, sufficient evidence was presented to enable the jury to decide
whether Cisco's actions satisfied the intent factor for contributory infringement.
31

(D.I. 396 at 919:21-920:12) Dr. Clark disagreed and opined that "a lot of what [Cisco
IPS sensors] do is not accused." (D.I. 398 at 1601 :4) Cisco argued to the jury that 36%
of survey respondents may have turned off the "Correlation/Compliance Engine" or may
not have known if the "Correlation/Compliance Engine" was enabled. (D.I. 399 at
1989:11-22) For the Cisco IPS products "as a whole," SRI presented sufficient
evidence for a jury to conclude that there are no substantial noninfringing uses.
On the record at bar, SRI presented more than conclusory evidence of
contributory infringement to the jury. The jury credited the testimony of SRl's witnesses
and exhibits over that of Cisco. The court declines to re-weigh the evidence or the
credibility of the witnesses. Viewing the record in the light most favorable to SRI,
substantial evidence supports the jury's verdict that Cisco contributed to the
infringement of the asserted claims by its customers using Cisco IPS products. For
these reasons, Cisco's renewed motion for JMOL is denied.

4. Accused services
Cisco repeats its direct infringement arguments from the accused products with
respect to the accused services, reasoning that "SRl's infringement theory for those
services is derivative of its [direct] infringement claim[s] with respect to the ... [accused]
products." 21 (D.I. 352 at 9) Cisco presents additional attorney argument22 with respect
to SRl's failure to provide substantial evidence of infringement with respect to Sourcefire
professional services, Sourcefire's support services (Standard, Gold, and Platinum),
Cisco IPS Services, and Cisco Remote Management Services. 23 (D.I. 352 at 10-11)
21
22

For the reasons stated above, the court denies Cisco's motion on these grounds.
See supra, note 10.

23

Cisco correctly points out that, at trial, SRI did not address two services (i.e., Cisco
IPS Industrial Control Protection, Security lntelliShield Alert Manager). (D. I. 352 at 11)
SRI argues that this is moot, because these two services are not included in the
damages base. (D.I. 370 at 11 n.11) Cisco did not respond to this argument. (D.I. 379
at 6-7) The court denies Cisco's motion with respect to these two services.
32

Dr. Lee opined that the accused services infringe whenever a service updates a
customer's software and signatures because, "when we update, you essentially
redeploy by enabling all these infringing features." (D.I. 397 at 1172:12-18; See also
D.I. 396 at 922:14-923:22) SRI contends that this aspect of Dr. Lee's opinion is the
primary dispute between the parties. (D.I. 370 at 8)

a. Sourcefire Professional Services
i. SRl's evidence
As discussed above, SRI presented evidence that Sourcefire IPS products
infringe the asserted claims. 24 Dr. Lee reviewed the Sourcefire 3D System user guide
and opined that the Sourcefire IPS products ship with default compliance rules that
infringe the asserted claims. (D.I. 396 at 968:24-970:3; DTX 840 at 1267) Dr. Lee
evaluated marketing materials for Sourcefire's professional services. (D.I. 396 at 981 :6984: 16; PTX 799; PTX 61) For example, Dr. Lee testified that the Pre-Deployment and
Kickstart services include a "best practice review." (D.I. 396 at 982:5-6) Dr. Lee opined
that "the best practice guide is addressed to" the value demonstrated by the correlation
feature and that the professional services would include recommending and
implementing the infringing correlation feature. (D. I. 396 at 983:24-984: 11)

ii. Cisco's evidence
Cisco argues that the Sourcefire Best Practices Guide "never mentions the
accused nested rules feature at all, let alone using them to combine multiple events
(which is not provided for in the underlying source code 25 , as discussed above)." (D.I.

24

The jury found infringement, and the court has denied Cisco's motion for a JMOL.
25
This is the same argument (that the correlation engine processes only one event at a
time) that was presented to the jury and that the jury rejected with respect to direct
infringement.
33

352 at 10, citing PTX 784 at 62-67 26 ) Cisco points out that Dr. Lee explained that the
"compliance correlation rules" are not enabled by default. 27 (D.I. 396 at 970:4-8) With
respect to marketing materials for Sourcefire Pre-Deployment and Kickstart professional
services, when asked whether the materials specifically advised or recommended any
configuration information "relating to the compliance engine," Dr. Lee testified on cross
examination that the materials "didn't specifically say which Sourcefire products" would
be included in the professional services. (D.I. 379 at 5, citing D.I. 397 at 1152:211153:9)
iii. Analysis
Dr. Lee opined that the Sourcefire Pre-Deployment and Kickstart services would
naturally include configuration of the correlation rules and the compliance engine, which
infringe the asserted claims. Cisco cross examined Dr. Lee and identified potential
gaps in his testimony. On the record at bar, Dr. Lee provided more than conclusory
testimony in order to explain his conclusions to the jury. The jury credited his direct
testimony over the testimony Cisco was able to elicit on cross examination. The court
declines to re-weigh the evidence or the credibility of the witness. Viewing the record in
the light most favorable to SRI, substantial evidence supports the jury's verdict. For
these reasons, Cisco's renewed motion for JMOL is denied.
b. Sourcefire Standard, Gold, and Platinum support services
Cisco argues that SRI presented no evidence related to these services. (D.I. 352
at 11) These support services were not specifically identified in the jury instructions or
26

See supra, note 3. While aspects of this argument are discussed elsewhere in
Cisco's brief, Cisco provided no testimony or other evidence to support its specific
assertion with respect to PTX 784, the Sourcefire Best Practices Guide. Moreover, it is
unclear how Cisco expects a jury (or the court) to identify a critical argument in five
pages of a user guide without any examination of a witness on the subject supported by
an argument (i.e., a closing argument) in the record.
27
See supra, note 10.
34

the verdict form, but Cisco contends that a JMOL is appropriate. (D.I. 352 at 11; See

also D.I. 336 at 13, D.I. 337 at 1)

i. SRl's evidence
Dr. Lee reviewed Sourcefire 3D System user guide and opined that the
Sourcefire IPS products ship with default compliance rules that infringe the asserted
claims. (D.I. 396 at 968:24-970:3; DTX 840 at 1267) Truxal testified that TransUnion
purchases maintenance services from Sourcefire, which "allows [TransUnion] to get
support from Sourcefire and also to get signature updates and access to new code
provisions and support manuals." (D.I. 395 at 789:12-790:2; See also D.I. 395 at
788: 10-17; PTX 305 (documenting invoices to TransUnion for Sourcefire support
services 28 )) Referencing the "Cisco Services Q&A for Sourcefire Customers" materials,
Dr. Lee explained that "a customer typically pays for these maintenance services so
they can receive continuous updates to their operating systems, the IPS software and
more importantly, the signature rules, basically, you want to keep up with the newer
attacks. So you receive updates of signatures." (D.I. 396 at 922:14-21; PTX 35 at 3, 56, 8-9) The Q&A materials address, among other things, the "Mapping of Sourcefire
services to Cisco Services" which include Sourcefire "Kickstart Service (standard),"
"Gold Support," and "Platinum Support" and their corresponding post-acquisition Cisco
services. (PTX 35 at 3; See also D.I. 397 at 1272:8-21 (discussing Cisco's acquisition
of Sourcefire in 2013))

ii. Cisco's evidence
Cisco argues that SRI did not mention "Sourcefire's Standard, Gold, and
Platinum support services" at trial. (D.I. 352 at 11) Cisco contends that Dr. Lee's

28

These invoices appear to be for "Sourcefire Gold" support services, but there is no
evidence in the record to explain precisely which support service TransUnion
purchases.
35

opinion that "maintenance services involving reconfiguration of the products" infringe the
asserted claims cannot apply to these Sourcefire support services, because this
"testimony relates to Cisco's IPS products, not Sourcefire products." 29 (D.I. 379 at 6,
citing D.I. 396 at 922:14-21, 923:17-22; D.I. 397 at 1172:12-18)

iii. Analysis
The jury was asked to consider whether SRI had proven by a preponderance of
the evidence that "Sourcefire Professional Services" infringed the asserted claims. (D. I.
336 at 13; D.I. 337 at 1) This is the extent of the instruction, and Cisco now argues that
no reasonable jury could have concluded that "Sourcefire Professional Services"
infringe the asserted claims, because SRI failed to present detailed argument as to
Sourcefire Standard support services, Sourcefire Gold support services, and Sourcefire
Platinum support services. (D.I. 379 at 6) Cisco has not contested the jury instruction
or the verdict form on these grounds. Meanwhile, SRI presented documentary evidence
related to the accused "Sourcefire Professional Services" and evidence of infringement
by various Sourcefire professional services, including Sourcefire support services as
evidenced by testimony from TransUnion's Truxal and relevant invoices. The record
includes materials related to Sourcefire Pre-Deployment and Kickstart services as well
as Sourcefire Standard, Gold, and Platinum support services. (PTX 35 at 3; PTX 799;
PTX 61)
On the record at bar, Dr. Lee provided more than conclusory testimony in order
to explain his opinions to the jury. SRI presented additional documentary evidence and
testimony to corroborate Dr. Lee's conclusions. Cisco presented no evidence and
made no arguments to the jury. The court declines to re-weigh the evidence or the

29

See supra, note 10. The record shows otherwise - that Dr. Lee expressed these
opinions specifically with respect to Sourcefire IPS products and Sourcefire Professional
Services.
36

credibility of the witnesses. Viewing the record in the light most favorable to SRI,
substantial evidence supports the jury's verdict. For these reasons, Cisco's renewed
motion for JMOL is denied.
c. Cisco IPS Services
i. SRl's evidence
As discussed above, SRI presented evidence that Cisco IPS products infringe
the asserted claims. 30 Dr. Lee discussed Cisco's documentation that characterize
Cisco's IPS services as relating to maintenance and operation (PTX 587 at 5) and
including signature and software updates. (PTX 628 at 4) Dr. Lee opined that services
that involve software updates and signature updates infringe the asserted claims each
time the software or a signature is updated. (D.I. 396 at 922:14-923:22) He further
explained that "typically when you update ... you ... restart or reconfigure, in a sense
redeploy[] the products. So the product by default has all these meta engines, meta
event rules being provided and enabled. The point is [that] when [you] update, you
essentially redeploy by enabling all these infringing features." (D.I. 397 at 1172:12-18)
ii. Cisco's evidence
Cisco identifies no evidence in the record supporting its position.
iii. Analysis
Cisco argues that, as a matter of law, JMOL is appropriate because "SRI
introduced no evidence of how providing a signature update could 'redeploy' a sensor,
let alone enable any feature covered by the asserted claims." (D. I. 352 at 10) In
support, Cisco cites Brooke Grp. Ltd. v. Brown & Williamson Tobacco Corp., 509 U.S.
209, 242 (U.S. 1993) ("When an expert opinion is not supported by sufficient facts to
validate it in the eyes of the law, or when indisputable record facts contradict or

30

The jury found infringement, and the court has denied Cisco's motion for a JMOL.
37

otherwise render the opinion unreasonable, it cannot support a jury's verdict."); Regents

of Univ. of Minnesota v. AGA Med. Corp., 717 F.3d 929, 941 (Fed. Cir. 2013)
("Conclusory expert assertions cannot raise triable issues of material fact on summary
judgment."); 31 Wechsler v. Macke Int'! Trade, Inc., 486 F.3d 1286, 1294 (Fed. Cir. 2007)
(overturning the trial court's denial of a JMOL because plaintiff's "expert presented little
more than conclusory evidence" of lost profit damages); and Seal-Flex, Inc. v. Athletic

Track & Court Const., 172 F.3d 836, 842 (Fed. Cir. 1999) ("To show infringement of a
patent, a patentee must supply sufficient evidence to prove that the accused product or
process contains, either literally or under the doctrine of equivalents, every limitation of
the properly construed claim."). (D. I. 352 at 1O; D. I. 379 at 5-6) Cisco does not explain
its citations or its arguments but, taken together, Cisco appears to argue that SRI failed
to prove literal infringement by the services, because Dr. Lee's testimony is conclusory
and, therefore, is insufficient as a matter of law.
As SRI has pointed out, the parties have already argued the "hierarchical
monitors" limitation with respect to direct infringement, and the operative question is
whether or not Cisco's IPS services satisfy the "deploying a plurality of network
monitors" limitation found in the asserted method claims and the "plurality of network
monitors deployed" limitation found in the asserted system claims. (D.I. 370 at 8) SRI
presented testimony from Dr. Lee that a software or signature update is essentially a
redeployment of the infringing features. Through these cases, Cisco contends that Dr.
Lee's opinion is conclusory. "Conclusory" is defined as "consisting of or relating to a
conclusion or assertion for which no supporting evidence is offered." Merriam-Webster

Unabridged (2016). The record shows that Dr. Lee offered supporting evidence in the
form of his detailed arguments as to direct infringement, various Cisco materials relating
31

Cisco only gives a pin cite in its brief (D.I. 352 at 10), and even though the case
appears to be inapposite, this quotation appears to be most relevant to the argument
Cisco appears to be making.
38

to services for updating software and signatures, and his explanation of what an update
would entail. Cisco was able to examine Dr. Lee, to challenge the sufficiency of his
conclusions, and to present evidence to rebut his opinions. 32
On the record at bar, Dr. Lee provided more than conclusory testimony in order
to explain his "redeployment" opinion to the jury. SRI presented additional documentary
evidence to corroborate Dr. Lee's conclusions. Cisco presented no evidence and made
no arguments to the jury. The court declines to re-weigh the evidence or the credibility
of the witnesses. Viewing the record in the light most favorable to SRI, substantial
evidence supports the jury's verdict. For these reasons, Cisco's renewed motion for
JMOL is denied.

d. Cisco Remote Management Services
i. SRl's evidence
SRI presented evidence of infringement by Cisco's Remote Management
Services ("RMS"). Dr. Lee discussed various Cisco materials and opined that RMS
infringe the asserted claims. (D.I. 396 at 924:9-929:6 (referencing PTX 586 (Cisco
Security Remote Management Services for Intrusion Prevention Systems (IPS) At-AGlance); PTX 755 (Service Description: Cisco Remote Management Services); PTX
810 (Splunk Ticket Integration Document))) Cisco's Kasper (the software engineering
technical leader) testified that:
RMS ... Remote Management Service. So I confirmed that they [Cisco's
RMS team] are using Cisco [IPS] sensors on the customer premise and
those will send up events to a central monitoring station where a human
analyst is watching them, uses some tools to investigate and then will
create tickets, just like an action ticket.
So if a customer got attacked the sensor sees it, it's transported up to the
central Cisco site, the analyst checks it out, cross-references some things
and says, oh, they got attacked. I will make a ticket. The ticket will tell the

32

See supra, note 10.
39

customer, you got attacked. Here's what happened. Here's what we have
got to do to fix it. So it's a full end-to-end service.
(D.I. 395 at 627:21-628:15) Dr. Van Liere surveyed a group of security professionals
who "had Cisco or Sourcefire network security products currently in use in their U.S.
network." (D.I. 395 at 715:1-5) Of these individuals whose organizations purchase
Cisco services, Dr. Van Liere expressed the opinion (based upon his survey) that "Cisco
remote management services were reported being used by 72 percent of the
respondents." (D.I. 395 at 727:13-22; PTX 1093, table 8)

ii. Cisco's evidence
Cisco argues that SRI failed to provide substantial evidence of infringement by
Cisco Remote Management Services. (D.I. 352 at 11) Cisco contends that RMS
supports a variety of third-party (non-Cisco) products and that SRI did not present
evidence that any Cisco RMS customers had connected Cisco IPS products connected
to the RMS services. (Id.) With respect to the survey, Cisco argues that the survey did
not ask whether the "customers ... used Cisco's IPS products and RMS together."
(D. I. 379 at 6)

iii. Analysis
SRI asserts that it presented circumstantial evidence of direct infringement,
which is sufficient under the law. See Lucent, 580 F.3d at 1317-19 (upholding the
district court's denial of JMOL with respect to infringement based upon circumstantial
evidence of direct infringement of a method claim). Cisco argues that Fujitsu Ltd. v.
Netgear Inc., 620 F.3d 1321, 1328-29 (Fed. Cir. 2010), requires SRI to "show evidence

of specific instances of direct infringement." (D.I. 352 at 11) SRI argues that Fujitsu is
inapposite, because the case related to a product for which the infringing feature was
turned off by default, and SRI offered evidence from Kasper that the meta event
generator is turned on by default in the Cisco IPS devices. (D.I. 370 at 9 n.8; D.1.395 at

40

644:15-18) Cisco counters that "[p]roof that customers use RMS is insufficient to
demonstrate infringement because RMS undisputedly can be used with many
unaccused products." (D.I. 379 at 6, citing PTX-755 at 41-42, 46) While SRI must
"show evidence of specific instances of direct infringement," Fujitsu, 620 F.3d at 1329,
that evidence of direct infringement may be circumstantial. Lucent, 580 F.3d at 1318;
see also Moleculon Research Corp. v. CBS, Inc., 793 F.2d 1261, 1272 (Fed. Cir. 1986).
The parties agree that all Cisco IPS devices have the (infringing) meta event
engine enabled by default, and that the infringing combination for RMS is when Cisco's
RMS manages a Cisco IPS sensor. Cisco contends that SRl's survey does not provide
examples of this scenario and that, therefore, a JMOL is appropriate. Dr. Van Liere's
survey determined that, of the 595 individuals surveyed, 306 (or 51 percent) have Cisco
IPS sensors employed in their organization's U.S. network. (PTX 1093, table 1) The
survey also determined that, of the 350 survey respondents who use Cisco services in
their organization's U.S. network, 252 (or 72 percent) use Cisco Remote Management
Services. (PTX 1093, table 8) Cisco is correct that the survey results do not provide a
single example of an organization that has Cisco IPS sensors and that uses Cisco RMS
services. 33
Additional evidence, however, tips the scales. Dr. Lee presented documentary
evidence in the form of Cisco's customer-facing materials, and he expressed his
conclusion that Cisco RMS infringes. See Lucent, 580 F.3d at 1318 ("circumstantial
documentary evidence, supplementing the experts' testimony, was just barely sufficient
to permit the jury to find direct infringement by a preponderance of the evidence.").

33

In order to reach the conclusion that the survey results in the record give evidence of
an infringing combination (Cisco RMS service managing one or more Cisco IPS
sensors), the jury would need to speculate.
41

Moreover, Kasper (a Cisco employee) testified that Cisco employs RMS in conjunction
with Cisco IPS sensors for an "end-to-end service."
On the record at bar, SRI presented evidence of Cisco RMS deployed in an
infringing combination with Cisco IPS sensors. This evidence included Dr. Lee's
testimony, documents, Kasper's testimony, Dr. Van Liere's testimony, and the survey
results. Cisco presented no evidence and made no arguments to the jury. The court
declines to re-weigh the evidence or the credibility of the witnesses. Viewing the record
in the light most favorable to SRI, substantial evidence supports the jury's verdict. For
these reasons, Cisco's renewed motion for JMOL is denied.

5. Direct infringement by Cisco
Cisco argues that a JMOL is appropriate with respect to direct infringement by
Cisco, because "SRI [] failed to present substantial evidence that Cisco actually
practiced the claimed methods or configured and deployed a system in an accused
manner." (D.I. 352 at 11-12) SRI contends that "certain services Cisco provides
include installation, configuration and 'tune-ups,' of the Cisco and Sourcefire IPS
Products, through which Cisco is directly configuring an infringing system and
performing the infringing method." (D.I. 370 at 12) Cisco avers that, because there is
no basis for concluding that the accused services infringe, Cisco cannot directly infringe.
(D.I. 379 at 7) Cisco's argument with respect to direct infringement by Cisco hinges on
the infringement by the accused services. The court has denied Cisco's renewed
motion for JMOL with respect to the accused services; therefore, the court also denies
Cisco's renewed motion for JMOL with respect to direct infringement by Cisco.

6. New trial - liability
In the alternative, Cisco requests a new trial on liability should the court deny the
renewed motion for JMOL. (D.I 352 at 28) Cisco's request is premised on the same

42

arguments as its renewed motion for JMOL with respect to liability. (Id.) Cisco asks the
court to "exercise[] its own judgment in assessing the evidence," and reach the opposite
conclusion as the jury. (Id.) For the reasons discussed above, the jury's verdict is not
against the clear weight of the evidence; therefore, the court denies Cisco's request for
a new trial on liability.

B. Damages
1. Standard
"A party challenging a jury damages verdict must show that the award is, in view
of all of the evidence, either so outrageously high or so outrageously low as to be
unsupportable as an estimation of a reasonable royalty." Spectralytics, Inc. v. Cordis

Corp., 649F.3d1336, 1345 (Fed. Cir. 2011) (citing Rite-Hite Corp. v. Kelley Co., 56
F.3d 1538, 1554 (Fed.Cir.1995) (en bane) (internal quotation omitted)). This court must
"scrutinize the evidence carefully to ensure that the 'substantial evidence' standard is
satisfied, while keeping in mind that a reasonable royalty analysis necessarily involves
an element of approximation and uncertainty." Id. (citation and internal quotation
omitted).

2. JMOL
a. Running Royalty
At trial, SRI presented testimony from Dr. Prowse in which he discussed
licensing agreements with Oki, IBM, and

. Dr. Prowse expressed the opinion

that damages should be calculated at a 7.5% running royalty rate for the time period
running from May 2012 until trial, which (based upon the apportioned revenues) would
account for damages of $50.7 million. (D.I. 397 at 1250:10-1251 :7) Cisco's expert, Dr.
Leonard, evaluated these same agreements and explained that damages should take
the form of an $8.6 million "paid-up lump sum of royalty." (D.I. 399 at 1694:15-1696:15)

43

The jury awarded SRI damages of $23.66 million, representing a 3.5% running royalty
on the accused products and services during the relevant time period. (D.I. 337 at 8)
Cisco argues that:
[T]he jury adopted the running-royalty analysis proposed by SRl's expert,
Dr. Prowse, with a downward adjustment of the rate from 7.5% to 3.5%.
But SRl's previous licenses do not support the jury's decision to award a
running royalty or to set the royalty rate at 3.5% of the apportioned base.
On the contrary, the only probative licensing evidence in the record
supports granting a lump-sum payment that is substantially lower than the
jury's award.
(D.I. 352 at 9) SRI responds that substantial evidence supports the 3.5% running
royalty as well as a higher (7.5%) royalty, and that "the jury was free to make up its own
mind as to whether to accept [Dr. Prowse's or] Dr. Leonard's analysis." 34 (D.I. 370 at
17-21)
i. Oki license

SRI presented evidence that, beginning in 2000, it granted Oki Electric Industry
Co. ("Oki") a six-year license to distribute SRl's EMERALD software in Japan for "a
$250,000 up-front fee, plus a 7.5% royalty rate applied to net sales." (D.I. 397 at
1254:9-10; PTX 30) Dr. Prowse explained that, among other things, the agreement
referred to the patents-in-suit as documentation. (D. I. 397 at 1253:23-1254:5
(identifying the '203 patent and U.S. Patent Application No. 10/254,457, which resulted
in the '615 patent); PTX 30, ex. A at SRI 018470) Dr. Prowse opined that, under the
agreement, "Oki didn't have the right to go make its own products." (D.I. 398 at
1404:11-13)

34

SRI argues that "Cisco ignores significant evidence and instead focuses only on three
license agreements; Oki, IBM, and
. The evidence Cisco ignores alone
constitutes substantial evidence supporting the verdict, and even the licenses it chooses
to discuss support the jury award." (D.I. 370 at 18) SRI does not identify any evidence
beyond these license agreements and their comparisons to Cisco. (D.I. 370 at 21)
44

Dr. Prowse testified that the Oki license is "informative, because ... while in the
hypothetical negotiation Cisco would be getting less than Oki ... , Oki is actually paying
more." (D.I. 397 at 1254:24-1255:5) Dr. Prowse explained that Oki paid more than
Cisco would in a hypothetical negotiation, even at the same royalty rate, for several
reasons: (1) Oki paid 7.5% royalty on net sales, "not some apportioned value;" (2) Oki
paid $250,000 up front in addition to the royalty; (3) Oki's license was limited to the
Japanese market, which is smaller and affords much less "scope for sales and profits"
in comparison to the U.S. market; and (4) the license did not include a "presumption of
validity and infringement" as would exist in a hypothetical negotiation. (D.I. 397 at
1255:6-1256:2) On redirect, Dr. Prowse opined that in comparison with Oki (which was
not able to develop its own products under its license), "Cisco would have come out of
the hypothetical negotiation with the rights to use the ... '203 and '615 patent[s], in any
way that it wanted to in terms of making products or providing services .... [which is]
more valuable than the Oki license." (D.I. 398 at 1404:4-25) SRl's Patrick Lincoln, PhD
("Dr. Lincoln"), testified that Oki paid SRI "just under $1.6 million" under the license.
(D.I. 394 at 341:13-15)
Cisco presented evidence from Dr. Leonard, who opined that "the substance of
the [Oki] agreement is not a patent license .... [, instead] SRI ... provide[d] fully
functional software product to Oki." (D.I. 399 at 1699:5-11) Dr. Leonard expressed the
opinion that, in a hypothetical negotiation, Cisco would not have received software and
would have instead had "a bare patent license, where they only get the rights to practice
the claims that are in the patent." (0.1. 399 at 1703:18-23) Cisco elicited testimony
from Dr. Prowse on cross examination that the Oki agreement included a software
license, trademark rights, and rights to use SRl's name that would not have been
included in a hypothetical negotiation with Cisco. (D. I. 397 at 1291 :2-18) Dr. Prowse

45

agreed with the statement that, "Oki couldn't go out and develop its own products and
sell them." (D.I. 397 at 1294:9-11; 1291:24-1293:17)
Cisco argues that the Oki license is '"radically different from' any patent license
agreement Cisco and SRI would have entered into" and is "therefore not comparable to
the agreement that Cisco and SRI would have reached in a hypothetical negotiation."
(D.I. 352 at 19-20, citing Lucent, 580 F.3d at 1327) SRI responds that "Oki received
'rights to the patents under the license.' And the jury even heard evidence that Cisco
would have received even more rights under a license at the hypothetical negotiation
than Oki received in its actual license, thus making Cisco's license more valuable." (D.I.
370 at 18) SRI contends the Oki license "explicitly mentions both the '203 patent and
the application that led to the '615 patent. It is therefore at least related to the patentsin-suit." (Id., citing Vimetx, Inc. v. Cisco Sys., Inc., 767 F.3d 1308, 1330 (Fed. Cir.
2014)) The Oki agreement directly relates to (and references as "documentation") the
patents-in-suit. 35 (PTX 30, ex. A at SRI 018470) Moreover, Dr. Prowse explained in
detail the differences between the Oki agreement and a hypothetical negotiation over a
patent license between Cisco and SRI. Dr. Prowse opined that the hypothetical
negotiation would be more valuable than the license to which Oki agreed. Dr. Leonard
expressed a contrary opinion and noted the elements present in the license that would
not be found in a hypothetical negotiation. Based upon this record, sufficient evidence
was presented to the jury to enable it to compare the Oki license to a hypothetical
patent license negotiation between Cisco and SRI.

35

Cisco argues elsewhere that the "EMERALD 1997" reference is invalidating prior art
to the patents-in-suit. (D.I. 352 at 33-34) SRl's EMERALD software is an outcome of
the project initiated as a result of the EMERALD 1997 reference.
46

ii. IBM and
SRI presented deposition testimony from Abramson in which he detailed two
licenses of a portfolio that included the '203 and '615 patents and took the form of lumpsum payments of

from

and

from IBM. (D.I. 397 at

1217:19-1218:8; PTX 22 (

D.I. 397 at 1225:2-1227:16; PTX 905 (IBM))

Abramson testified that the

license "reflects a compromise between positions

that started on SRl's side with the assertion that a 7.5 percent royalty ought to apply
and an assertion on

part that a lower rate ought to apply." (D.I. 397 at 1218:3-

8) Abramson testified that, based upon

revenues, a 7.5% royalty on net

product revenues would be approximately

but that

negotiated a

lump sum payment that "was much less" than the proposed royalty. (D.I. 397 at
1220:24-1224:25; PTX 1092) With respect to IBM, Abramson discussed e-mails
documenting aspects of the negotiation and explained that, while a 7.5% royalty on net
revenues would amount to "something in the range of

," calculating a royalty

would require apportioning revenues to infringing features, calculating U.S.-only
revenues, estimating future revenue growth, and applying a discount rate. (D.I. 397 at
1225:2-1229:1; PTX 1091) When asked how SRI and IBM arrived at "the
number," Abramson replied:
I mean, we started with, you know, our usual methodology. We used a
7.5 percent royalty rate. We applied that to the revenue. We made some
very conservative, from IBM's point of view, assumptions. We provided a
litigation risk discount, and then we negotiated back and forth to arrive at
an agreed upon number.
(D.I. 397 at 1229:24-1230:6) When comparing the lump sum to a reasonably royalty,
Abramson explained that "one thing you need to understand is that when you're
negotiating on a lump sum, eventually, it just becomes a negotiation over numbers, so
it's a little bit hard to say that it's any particular royalty rate or discount rate or
apportionment rate." (D.I. 397 at 1231 :4-8)

47

SRI presented evidence from Dr. Prowse, who explained that his $50.7 million
damages number reflects a 7.5% royalty on $676.2 million dollars, which is the
"apportioned value of Cisco's revenue ... from May 2012 to the date of trial." (D.I. 397
at 1250:10-1251:7) As to the IBM license, Dr. Prowse explained that "the takeaway ...
is that the

arose in the negotiation around a 7.5% rate applied to

apportioned revenue after taking into account a litigation risk discount for the uncertainty
about whether the patents were valid and infringed." 36 (D.I. 397 at 1258:6-11) Dr.
Prowse expressed a similar opinion related to the

license. (D. I. 397 at 1258: 15-

1261 :1)
Cisco presented evidence from Dr. Leonard in which he explained that his $8.6
million lump sum damages opinion was based upon a series of adjustments made to
the IBM and

licenses of 2013 and 2014. Dr. Leonard opined that the IBM and

licenses "were a good starting place" and that he made "adjustments of various
types to account for various differences between the economic situation of those
agreements on one hand and the hypothetical license on the other." (D.I. 399 at
1724: 10-21) Dr. Leonard testified that, in contrast to a lump-sum payment where the
parties do not assume that the patents are valid and infringed, in a hypothetical
negotiation between Cisco and SRI, the parties would "assume that the patents have
been found to be valid and infringed with regard to Cisco." (D.I. 399 at 1726:9-20) Dr.
Leonard's adjustments included: removing litigation risk (which increases the lump
sum); accounting for the greater risk and uncertainty associated with a hypothetical
negotiation that would have taken place in 2005 37 (which decreases the lump sum); and

36

SRI elicited testimony from Dr. Leonard, on cross examination, in which he affirmed
that a scaling, by relative market share, of IBM's
lump-sum payment to
account for Cisco's greater revenues would amount to a lump-sum payment by Cisco of
. (D.I. 399 at 1752:7-1754:1)
37 The parties agree that the hypothetical negotiation would have taken place in the
spring of2005. (D.I. 399at1714:18-23)
48

scaling by revenues (increase) to reflect that "Cisco and also Sourcefire []were bigger
than both IBM and

in terms of sales or market share." (D.I. 399 at 1726:23-

1727:9; 1727:20-1728:2; 1728:17-21; 1730:11-1731:14; DTX879)
Cisco argues that "[u]nlike the jury's award, [Dr. Leonard's] approach avoids
speculative assumptions about royalty rates, the revenue base, and how to apportion
between the various features." (D.I. 352 at 21) Cisco contends that the IBM and
licenses cannot support a running royalty, because "the jury [] had almost no
testimony with which to recalculate in a meaningful way the value of any of the lumpsum agreements to arrive at the running royalty damages award." (D.I. 379 at 11, citing
Lucent, 580 F.3d at 1330 (quotation marks omitted)) SRI avers that "the IBM and

licenses [] support a running royalty" and that the jury heard sufficient evidence
from Dr. Prowse and Dr. Leonard "to make up its own mind." (D.I. 370 at 19-21)
The jury heard testimony from Abramson on the differences between a
reasonable royalty and a lump sum, including the calculations employed in converting
from one to another. (D.I. 397 at 1229:24-1230:6) The jury was presented with
documentary evidence of those calculations. (PTX 1092) Abramson explained that a
running royalty would be based on apportioned U.S. revenues. (D.I. 397 at 1228:2-10)
Dr. Prowse testified that a 7.5% royalty on Cisco's apportioned U.S. revenues would
amount to $50.7 million. (D.I. 397at1250:10-1251:7) Dr. Prowse and Dr. Leonard
testified extensively about the IBM and

licenses and their revenues relative to

the negotiated licenses. Dr. Leonard detailed the four adjustments he made to convert
the IBM and

licenses to reach the $8.6 million damages number he presented.

(D.I. 399 at 1724:10-1732:18) Dr. Leonard agreed that, without making any additional
discounts, the IBM license (scaled by Cisco's relative revenues) would amount to a
lump sum of

. (D.I. 399 at 1752:7-1754:1) The jury was instructed on

reasonable royalty calculations, including the factors employed in their calculation. (D.I.

49

336 at 35-39) Based upon the record, the jury had sufficient evidence to determine a
running royalty based upon the IBM and

lump-sum licenses.

iii. Analysis
Dr. Prowse presented damages, based upon the Oki license, in the form of a
7.5% running royalty for the time from May 2012 until trial. This amounted to $50.7
million in damages. SRl's witnesses explained that lump-sum license negotiations with
IBM and

had begun with a 7.5% royalty as the departure point, with the

counter-party revising the numbers downwards based upon a number of factors. Dr.
Leonard evaluated the IBM and

licenses and made four adjustments to those

numbers to arrive at a lump-sum damages amount for Cisco of $8.6 million. The jury
was entitled to credit testimony from both experts and arrive at a 3.5% running royalty in
the amount of $23.66 million, which is lower than the 7.5% rate proposed by SRI and
above the $8.6 million lump sum proposed by Cisco. The court declines to re-weigh the
evidence or the credibility of the witnesses. Viewing all of the evidence in the light most
favorable to SRI, substantial evidence supports the jury's damages verdict. Cisco has
not demonstrated that, in view of all the evidence, this verdict is either so outrageously
high or so outrageously low as to be unsupportable as an estimation of a reasonable
royalty. Spectralytics, 649 F.3d at 1345. For these reasons, Cisco's renewed motion
for JMOL is denied.

b. Royalty base
SRl's expert, Dr. Prowse, testified that he calculated damages based upon a
running royalty applied to 100% of the apportioned revenues of the accused products
and services. (D.I. 397 at 1277:19-1280:2; 1337:10-20; 1339:5-25) Dr. Prowse
explained that this was because "if you have that many meta event generators and the
default is on, then it's very likely all of them are on." (D.I. 397 at 1339:5-8)

50

Cisco cross examined Dr. Van Liere, who confirmed that, of the Cisco customers
he surveyed, "36% said that they don't enable [the meta event] features or they don't
know if they enable [the meta event] features." 38 (D.I. 395 at 743:24-744:2) With
respect to the Cisco customers in Dr. Van Liere's survey, Dr. Prowse testified, "[i]f you
multiply my damages number by 64%, the number would go down." 39 (D.I. 397 at
1336:10-14) Cisco presented evidence in which Dr. Leonard disagreed with Dr.
Prowse's royalty base and opined that Dr. Prowse should have taken "the sales and []
multiplied by 60%, or whatever the right number is," before apportioning revenues.
(D.I. 399 at 1739:12-1740:7 (emphasis added)) At closing, Cisco argued that SRl's
royalty base was incorrect. (D.I. 400 at 1992:6-1994:15)
Cisco has asked for remittitur to an $8.6 million lump sum or a new trial, based
upon the royalty base. (D.I. 352 at 18) Cisco contends that SRl's survey evidence
suggests that the royalty base is "significantly lower than the 100% figure that Dr.
Prowse used and that the jury adopted." (D.I. 352 at 22; PTX 1093, table 10) Cisco
argues that SRI carries "the burden to establish the appropriate royalty base by reliably
identifying the percentage of Cisco's sales that lead to an instance of direct
infringement." (D.I. 352 at 21, citing Lucent, 580 F.3d at 1334-35) SRI points out that,
in a hypothetical negotiation, validity and infringement are presumed. (D.I. 370 at 21
(citing D.I. 397 at 1244:6-1246:2)) SRI contends that Cisco's reading of the case law is
"misguided," and that Lucent only requires "that the damages award 'be correlated, in

38

SRI presented survey evidence from Dr. Van Liere that, for "Cisco devices, 60% to
64% [of users] are aware of the meta event generator and know that it's enabled in one
or more of the devices in their U.S. network. And 78% of the[] people who have
Sourcefire devices indicate that the correlation compliance engine is enabled in one or
more of the devices in their U.S. network." (D.I. 395 at 736:15-737:2)
39 When asked about the corresponding 78% of Sourcefire customers in Dr. Van Liere's
survey, Dr. Prowse acknowledged that if he had taken this 78% into account, it would
decrease his damages number "[b]y 20%, you multiply by 78%." (D.I. 397 at 1336:4-9)
51

some respect, to the extent the infringing method is used by consumers." (D.I. 370 at
22, citing Lucent, 580 F.3d at 1334) In Lucent, the Federal Circuit wrote:
Consideration of evidence of usage after infringement started can, under
appropriate circumstances, be helpful to the jury and the court in
assessing whether a royalty is reasonable. Usage (or similar) data may
provide information that the parties would frequently have estimated
during the negotiation. Such data might, depending on the case, come
from sales projections based on past sales, consumer surveys, focus
group testing, and other sources .... This quantitative information,
assuming it meets admissibility requirements, ought to be given its proper
weight, as determined by the circumstances of each case.
On the other hand, we have never laid down any rigid requirement that
damages in all circumstances be limited to specific instances of
infringement proven with direct evidence. Such a strict requirement could
create a hypothetical negotiation far-removed from what parties regularly
do during real-world licensing negotiations.
Lucent, 580 F.3d at 1333-34 (citations omitted). "The damages award ought to be

correlated, in some respect, to the extent the infringing method is used by consumers.
This is so because this is what the parties to the hypothetical negotiation would have
considered." Id.
Dr. Prowse opined that a hypothetical negotiation would have relied on a 100%
royalty base of apportioned revenue. Dr. Leonard disagreed with this opinion but did
not express an opinion as to what the percentage should be. Based upon this record,
the court declines to re-weigh the evidence or the credibility of the witnesses. Viewing
all of the evidence in the light most favorable to SRI, substantial evidence exists for the
jury to determine a damages verdict reasonably correlated to the infringement by Cisco
and Cisco's customers. Cisco has not demonstrated that, in view of all the evidence,
this verdict is either so outrageously high or so outrageously low as to be unsupportable
as an estimation of a reasonable royalty. Spectralytics, 649 F.3d at 1345. Cisco's
motion for remittitur is denied.

52

c. Apportionment
SRI presented evidence of Dr. Lee's opinion on apportionment, in which he
explained his calculation for each accused product and service. (D.I. 396 at 984:171006:9) Cisco cross examined Dr. Lee on the subject. (D.1 397 at 1155:16-1160:13)
Dr. Prowse applied Dr. Lee's 49.3% apportionment in his damages calculation. (D.I.
397 at 1250: 10-1251 :7) Dr. Leonard disagreed with one of the apportionment numbers
for one group of products in Dr. Lee's apportionment calculation, because for certain
firewalls "the amount that's apportioned to IPS and to the patented functionality should
get less and less as you get to more and more complex and bigger firewalls." (D.I. 399
at 1735:9-1738:25) Dr. Leonard did not express an opinion as to what the appropriate
apportionment percentage should be. At closing, Cisco argued that SRl's
apportionment was incorrect and focused its argument on the royalty base. (D.I. 400 at
1992:6-1994: 15) Cisco now argues that a JMOL or new trial is appropriate, citing
numerous alleged deficiencies in Dr. Lee's apportionment analysis and various legal
propositions that support the court's intervention. 40 (D.I. 352 at 23-25)
Dr. Lee provided more than conclusory testimony in order to explain his
apportionment calculation to the jury. The jury credited such testimony over that of Dr.
Leonard, who expressed no alternative apportionment calculation. Based upon this
record, the court declines to re-weigh the evidence or the credibility of the witnesses.
Viewing all of the evidence in the light most favorable to SRI, substantial evidence
exists for the jury to determine a damages verdict. Cisco has not demonstrated that, in
view of all the evidence, this verdict is either so outrageously high or so outrageously

4

°Cisco re-argues its position that Dr. Lee is not an economist and, therefore, is not

qualified to testify as to apportionment. (D.I. 379 at 13; D.I. 352 at 24) As discussed,
below, the court declines to reconsider its decision to allow Dr. Lee to testify.
53

low as to be unsupportable as an estimation of a reasonable royalty. Spectralytics, 649
F.3d at 1345. Cisco's motion for remittitur is denied.
d. Accounting

Cisco requests "an accounting to subtract from the jury's award any sales to
SRl's licensees." (D.I. 352 at 25) SRI argues that "Cisco waived any license defense,
and has presented no evidence [] to show that such a defense has any merit, let alone
evidence as to any specific 'licensed' sales." (D.I. 370 at 26) Cisco did not raise
licensed sales as an affirmative defense, nor did it raise the need for an accounting in
the pretrial order or during trial. 41 (D.I. 9 at 6-7; D.I. 292) At trial, Cisco examined Dr.
Prowse about whether sales to IBM and the U.S. government were included in his
royalty base. (D.I. 379 at 15 n.9, citing D.I. 398 at 1395:22-1396:13, 1397:7-1398:23)
Dr. Prowse responded, "I can't remember. But whatever I did, [Dr.] Leonard obviously
did, too." (D.I. 398 at 1398:22-23) Earlier, Dr. Prowse had testified that there are "very
small differences42 between myself and Dr. Leonard in calculating the accused product
revenue," but that the two experts had otherwise agreed on the revenue numbers. (D.I.
397 at 1276:16-17) On direct examination, Dr. Leonard did not discuss government or
licensee sales in his revenue numbers, nor did he substantially disagree with Dr.
Prowse's revenue base. Based upon the record, the court concludes that Cisco is
raising its license revenues defense for the first time in its post-trial brief. For these
reasons, the court denies Cisco's request for an accounting.

41

Cisco claimed "government sales" as an affirmative defense in the pretrial order but
did not argue government sales at trial. (D.I. 292 at~ 4)
42
The differences are primarily the date on which calculated damages end (February
2016 for Dr. Leonard, and May 2, 2016 for Dr. Prowse). (D.I. 397 at 1276:9-25)
54

3. New trial - damages
In the alternative, Cisco requests a new trial on damages should the court deny
the renewed motion for JMOL or the motion for remittitur. (D.I 352 at 28) Cisco's
request is premised on the same arguments as its renewed motion for JMOL with
respect to damages and its motion for remittitur. (Id.) Cisco asks the court to
"exercise[] its own judgment in assessing the evidence," and reach the opposite
conclusion as the jury. (Id.) For the reasons discussed above, the jury's verdict is not
against the clear weight of the evidence, therefore, the court denies Cisco's request for
a new trial on damages.

C. Willfulness
The jury returned a verdict of willful infringement by Cisco under the Seagate
standard. 43 (D.I. 336 at 28-29; D.I. 337 at 6) Cisco moves for the court to set aside the
jury's willfulness verdict or to grant a JMOL of no willfulness. (D.I. 352 at 25-26) Cisco
argues that "the Supreme Court recently overturned the Federal Circuit's willfulness
standard" and that the "jury now has no role in the determination of willfulness." 44 (Id.,
citing Halo Elecs., Inc. v. Pulse Elecs., Inc., 136 S. Ct. 1923, 1932 (2016)) Cisco
contends that a JMOL is appropriate, "because the record contains no evidence on
which a jury could reasonably find willful infringement." (D.I. 352 at 26) SRI responds
that sufficient evidence of Cisco's acts support a finding of willfulness, because "[a] jury
verdict of willfulness under the old, stricter, Seagate standard thus plainly satisfies the
standard under Halo." (D.I. 370 at 27-28, citing WBIP, LLC v. Kohler Co., 2016 WL

43

In re Seagate Tech., LLC, 497 F.3d 1360 (Fed. Cir. 2007) abrogated by Halo Elecs.,
Inc. v. Pulse Elecs., Inc., 136 S. Ct. 1923 (2016).
44
In light of Halo, Cisco suggests the court should "set[] aside the willfulness verdict."
(D.I. 352 at 26)
55

3902668, at *15-16 (Fed. Cir. July 19, 2016) (upholding a jury's willfulness finding,
under Halo, originally reached under the Seagate standard))
At trial, Cisco presented testimony from Kasper supporting a noninfringement
defense. (D.I. 398at1509:7-1512:6, 1516:24-1518:15, 1545:16-23) Under the prior

Seagate standard, this noninfringement defense would have been sufficient for the court
to grant a JMOL of no willfulness. See Halo, 136 S. Ct. at 1933 ("The Seagate test
aggravates the problem by making dispositive [of the willfulness claim] the ability of the
infringer to muster a reasonable (even though unsuccessful) defense at the
infringement trial."). However, Halo eliminated Seagate's objective prong. WBIP, 829
F. 3d at 1341 ("[p ]roof of an objectively reasonable litigation-inspired defense to
infringement is no longer a defense to willful infringement"). "At the same time, Halo did
not disturb the ... second prong of Seagate, subjective willfulness .... Halo
emphasized that subjective willfulness alone-i.e., proof that the defendant acted
despite a risk of infringement that was either known or so obvious that it should have
been known to the accused infringer-can support an award of enhanced damages."45

WesternGeco L.L.C. v. ION Geophysical Corp., 837 F.3d 1358, 1362 (Fed. Cir. 2016)
(quotations and citations omitted).
The record at bar shows that the jury46 heard evidence (as discussed above with
respect to liability) that key Cisco employees did not read the patents-in-suit until their
depositions. The jury also heard evidence that Cisco designed the products and
services in an infringing manner and that Cisco instructed its customers to use the
products and services in an infringing manner. Viewing the record in the light most

45

The subjective prong is evaluated under a preponderance of the evidence standard.
Halo, 136 S. Ct. at 1934.
46 See WBIP, 829 F.3d at 1341 ("We do not interpret Halo as changing the established
law that the factual components of the willfulness question should be resolved by the
jury.").
56

favorable to SRI, substantial evidence supports the jury's subjective willfulness verdict.
For these reasons, Cisco's renewed motion for JMOL is denied.

D. Other Motions for a New Trial
Cisco moves for new trial "to address several errors that severely prejudiced
Cisco and rendered the trial unfair, including: (i) misleading statements during SRl's
closing argument [and] (ii) erroneous jury instructions." (D.I. 352 at 28)

1. SRl's closing arguments
Cisco moves for a new trial on the basis that "SRI twice made statements in
closing that were unfairly prejudicial and misleading ... [and that] irreversibly tainted the
jury's verdict." (D.I. 352 at 29) In the first statement, Cisco argues that "SRl's counsel
told the jury in his rebuttal closing that the mere 'capability' to infringe is enough to
satisfy the asserted system (but not the method) claims, [which is] ... an argument this
court had rejected during claim construction and during SRl's previous suit against
Symantec and ISS." (Id.) In response, SRI points to the "installed and deployed"
language in the statement. (D.I. 370 at 29) During closing arguments, SRl's counsel
discussed claim 12 of the '203 patent and said:
The system claims are infringed when a system with all the required
elements is installed in a network and configured. In other words, when
it's in place. It does not matter how much a customer uses it. If it has the
infringing capability and it's installed and deployed, it infringes. That's
not disputed, and you are going to see that in the jury instructions.
(D.I. 400 at 1999:14-20 (emphasis added)) Cisco objected to this statement after
closing arguments and requested a curative instruction. (D.I. 400 at 2009:9-20) The
statement "[i]f it has the infringing capability and it's installed and deployed, it infringes"
is neither contrary to the law, nor is it prejudicial.
Cisco argues that, in a second statement, SRI "inappropriately asked the jury to
infer that Cisco infringes because Roesch-a fact witness-did not testify about Cisco's

57

non-infringement during the trial." (D.I. 352 at 30) SRI contends that its "closing
statement merely recited the undisputed fact that Cisco did not chose to bring to trial
any witness-save its expert-to explain why it did not infringe." (D.I. 370 at 29) SRI
argues that this is an outgrowth of Cisco's trial strategy, which included not naming
Roesch as a 30(b)(6) witness, and which led to the exclusion of his testimony that was
"'anything close to expert testimony' including ... noninfringement." (D.I. 370 at 30
(citing D.I. 397 at 1341 :4-8)) Cisco contends that "[b]ecause [] Roesch's testimony on
technical issues was excluded on SRl's own motion ... , it was misleading and unfairly
prejudicial for SRI to ask the jury to draw a negative inference from [] Roesch's failure to
testify on that subject."47 (D.I. 379 at 17)
During closing arguments, SRl's counsel made the following statement about
Cisco's proof of noninfringement: "Shoe on the other foot. Mr. Roesch, Mr. Kasper,
they have all of the information. They, in fact, generated the information. They wrote
the code. They know the documents. They could have told you what they thought and
they didn't."48 (D.I. 400 at 2006:14-18) Cisco contends that this "statement made it
reasonably probable that the verdict was influenced by prejudicial statements, and by
itself justifies a new trial on all liability and damages issues." (D.I. 352 at 31, citing

Greenleaf v. Garlock, Inc., 174 F.3d 352, 363-64 (3d Cir. 1999) (quotation marks
omitted))
In the Third Circuit, when "a closing address to the jury contains such numerous
and serious violations of so many rules of proper argument ... , [a court] must conclude
that it is more than 'reasonably probable' that the verdict was influenced by the
47

The parties document the evidentiary issues in their briefs, but these matters were
never before the jury and cannot, therefore, be prejudicial. This reduces the dispute to
a single statement made before the jury during closing arguments.
48
Cisco avers that this statement is prejudicial based upon case law from Missouri.
(D.I. 379 at 17, citing Bairv. Faust, 408 S.W.3d 98, 103 (Mo. 2013)) Cisco has not
explained why this case should be persuasive to the court.
58

prejudicial statements." Draper v. Airco, Inc., 580 F.2d 91, 96-97 (3d Cir. 1978) (citation
omitted). Courts should not "rely on any of the individual instances or types of
impropriety" and should instead determine whether "the closing argument [], when
considered in its entirety, was so constantly and effectively addressed to the prejudices
of the jury." Id. at 97. For example, the Third Circuit has identified prejudice when
counsel:
(1) [] attempted to prejudice the jurors through repeated inappropriate
references to the defendants' wealth; (2) [] asserted his personal opinion
of the justness of his client's cause; (3) [] prejudicially referred to facts not
in evidence; and (4) without provocation or basis in fact, [] made several
prejudicial, vituperative and insulting references to opposing counsel.
Id. at 95. Aside from this individual instance of alleged impropriety, Cisco has not

explained how SRl's entire closing argument constantly and effectively addressed the
prejudices of the jury. For the above reasons, the court denies Cisco's motion for a new
trial based upon SRl's closing argument.
2. Jury instructions

Cisco moves for a new trial and argues that "the jury should have been instructed
that if Cisco reasonably believed the acts it induced did not infringe, then it cannot be
liable for inducement or contributory infringement." (D.I. 352 at 31) At the second
charge conference, Cisco objected to the jury instructions on inducement, which did not
include Cisco's alternative construction. (D.I. 399 at 1913:8-13) Cisco avers that
"[t]hese instructions fell short of the 'full and complete' instructions necessary to reach a
reliable verdict," and Cisco was prejudiced. (D.I. 352 at 31-32) Under Cisco's theory,
given the evidence presented, "a properly instructed jury[] likely would have returned a
different verdict." (D.I. 352 at 32). SRI contends that "the court's instruction exactly
lines up with Supreme Court precedent." (D.I. 370 at 30, citing Cammi! USA, LLC v.
Cisco Sys., Inc., 135 S. Ct. 1920 (2015)) The court instructed the jury that:

59

Defendant is liable for active inducement only if plaintiff proves by a
preponderance of the evidence that:
1. Defendant took some action intending to encourage or instruct its
customers to perform acts that you, the jury, find would directly infringe an
asserted claim;
2. Defendant was aware of the asserted patents at the time of the
alleged conduct and knew that its customer's acts (if taken) would
constitute infringement of an asserted patent, or the defendant
believed there was a high probability that the acts (if taken) would
constitute infringement of an asserted patent but deliberately avoided
confirming that belief; and

3. Use by others of the defendant's products or services infringes one or
more of the asserted claims.
(D.I. 336 at 26 (emphasis added)) The language provided by Cisco in its argument is a
restatement of the instruction read to the jury. The court denies Cisco's request for a
new trial based upon the inducement instruction.
Cisco also moves for a new trial, because "the jury should not have been
instructed on all fifteen Georgia-Pacific factors for calculating reasonable royalty
damages." (D.I. 352 at 32) At the first charge conference, Cisco asked to reduce the
number of Georgia-Pacific factors presented to the jury and agreed to "go through the
transcript and identify and work with SRI on what we think are the appropriate factors to
give to the jury based on Dr. [Prowse's] testimony and what we expect to come from Dr.
Leonard." (D. I. 398 at 1658: 16-20) The court clarified "I want you all to [under]stand
though unless it's clear, the fact [is that] it will stay in." (Id. at 1658:21-22) In the
second charge conference, all fifteen Georgia-Pacific factors remained in the final jury
instructions, and Cisco did not seek to correct the Georgia-Pacific instruction. (D.I. 399
at 1907:3-1919: 11) For this reason, Cisco waived its argument, and the court denies
Cisco's motion for a new trial based upon the Georgia-Pacific instruction.

60

E. Reconsideration

Cisco includes in its JMOL brief several arguments the court addressed at
summary judgment. These motions are essentially requests for reconsideration.
1. Dr. Lee's apportionment testimony

At summary judgment, Cisco moved to exclude SRl's technical expert, Dr. Lee,
from presenting his survey results for purposes of apportionment. (D.I. 216; D.I. 217 at
3-6) The court denied Cisco's motion, reasoning that "Cisco is free to challenge the
conclusions and analysis provided by Dr. Lee on cross examination." (D.I. 301 at 4142; D.I. 302at1J 4) Cisco now moves for reconsideration and requests a new trial. (D.I.
352 at 32-33) Cisco has failed to demonstrate any grounds sufficient to warrant a
reconsideration of the court's April 11, 2016 order. See Max's Seafood Cafe, 176 F.3d
at 677.
2. Summary judgment of no anticipation

At summary judgment, Cisco moved for summary judgment of anticipation of the
asserted claims by the EMERALD 1997 reference. (D.I. 182 at 10) SRI did not file a
cross motion for summary judgment of no anticipation by the EMERALD 1997 reference
and instead argued that issues of material fact made summary judgment inappropriate.
(D.I. 220 at 35-36) The court, sua sponte, granted summary judgment of no
anticipation, concluding "that no reasonable jury could find that EMERALD 1997
discloses all the limitations arranged as in the asserted claims." (D. I. 301 at 19) Cisco
presently requests a new trial, because "Cisco did not receive notice of the court's
intention to grant summary judgment ... and ... did not have any meaningful
opportunity to respond." (D.I. 352 at 33) Cisco contends that "[h]ad SRI moved for
summary judgment or had the Court given notice of its intent to consider a sua sponte
grant of summary judgment, Cisco would have presented additional arguments

61

establishing the genuine dispute over this factual question and would have pointed to
other factual disputes that precluded summary judgment." (D.I. 352 at 34) Here, Cisco
does not identify any of the factors that could justify reconsideration; therefore, the court
denies reconsideration of its grant of summary judgment of no anticipation by the
EMERALD 1997 reference. See Max's Seafood Cafe, 176 F.3d at 677.
F. Cisco's Motion To Supplement the Record
On November 18, 2016, Cisco moved to supplement the record to include
evidence of its post-verdict activities to allegedly design around the asserted patents.
(D.I. 385) SRI argues that the supplemented evidence is untimely, and "would therefore
require significant discovery into the alleged re-designs." (D.I. 387 at 3) The proffered
evidence is also irrelevant, SRI contends, because "it adds nothing that will help the
court to assess SRl's motion for fees and enhanced damages." (D.I. 387 at 4) Cisco
responds that the proffered "declarations relate to the post-trial issues of enhanced
damages and ongoing royalties" and that "ongoing royalties are based on a post-verdict
hypothetical negotiation that necessarily takes into account facts and circumstances
arising after trial." (D.I. 389 at 2, citing Fresenius USA, Inc. v. Baxter Int'/, Inc., 582 F.3d
1288, 1303 (Fed. Cir. 2009)). In Fresenius, the court awarded an ongoing royalty that
ran past trial and until the expiration of the patents. Fresenius, 582 F.3d at 1303. On
the record at bar, the jury awarded a lump sum based upon a 3.5% running royalty on
revenues for the infringing products and services for the time period between filing of
the suit in May 2012 and trial in May 2016. (D.I. 337 at 8; D.I. 397at1276:2-25) There
are no post-verdict royalties; therefore, evidence of Cisco's post-verdict actions is not
relevant to the jury's calculation of royalties.
Cisco argues that evidence of its post-verdict efforts to design around the
patents-in-suit is relevant to the court's determination of enhanced damages. (D.I. 389
at 2) According to the Federal Circuit, district courts may consider a number of factors,
62

including "[r]emedial action by the defendant." Read Corp. v. Portee, Inc., 970 F.2d
816, 827 (Fed. Cir. 1992) (citing Intra Corp. v. Hamar Laser Instruments, Inc., 662 F.
Supp. 1420, 1439 (E.D. Mich. 1987)). After a bench trial, the Intra court found willful
infringement and awarded double (but not treble) damages, because defendant
"voluntarily ceased manufacture and sale of infringing systems during the pendency of[]
litigation, and presented an arguable basis for a finding of obviousness." Intra Corp.,
662 F. Supp. at 1439. Cisco identifies Spectralytics, Inc. v. Cordis Corp., 834 F. Supp.
2d 920 (D. Minn. 2011 ), as supporting its argument. In Spectralytics, the plaintiff did not
"dispute that [defendant] stopped using the infringing device ... shortly after trial but
before the Court entered a permanent injunction and while the parties' post-trial motions
were still pending." Id. at 928. In the case at bar, Cisco did not redesign its products
and services until after trial, and SRI contends that "significant discovery into the alleged
re-designs" is necessary "to enable SRI to assess ... whether the re-designed products
contain new infringing features." (D.I. 387 at 3) Moreover, SRI identifies numerous
potential factual disputes related to the evidence Cisco seeks to introduce. (D. I. 387 at
4-8) Given the stage in the proceedings and SRl's opposition, the court denies Cisco's
motion.

G. Attorney Fees and Enhanced Damages
Once a defendant's infringement has been deemed willful by a jury and judgment
entered in favor of a plaintiff, the court has been given discretion to award damages
over and above that amount found to be appropriate by the jury. Pursuant to 35 U.S.C.

§ 284, the court may "increase the damages up to three times the amount found or
assessed" by the jury, so long as the court exercises it discretion '"in light of the
considerations' underlying the grant of that discretion." Halo, 136 S.Ct. at 1926 (quoting

Octane Fitness, 134 S.Ct. at 1756). The Federal Circuit, in Read Corp., 970 F.2d at
826-27, offered the obligatory series of factors that a court should review in determining

63

how to exercise its discretion, including the following most relevant to the record at bar:
(1) whether the infringer investigated the scope of the patent and had a good faith belief
that it was not infringing or that the patent was invalid; 49 (2) the infringer's behavior
during litigation; 50 (3) the infringer's size and financial condition; (4) the closeness of the
case; (5) the duration of the infringing conduct; (6) any remedial actions taken; and (7)
defendant's motivation for harm.
As noted above, 35 U.S.C. § 285 provides an opportunity for the court to award
attorney fees and costs to the prevailing party in "exceptional" cases, that is, those
cases that, in view of the totality of the circumstances, "stand[] out from others" with
respect to the "substantive strength" of the losing party's litigating position and the
"unreasonable manner in which the case was litigated." Octane Fitness, 134 S. Ct. at
1751. Among the factors posited by SRI in this case are the jury's finding of willful
infringement and Cisco's conduct during litigation. (D.I. 354 at 15-21) Given the
overlap in the considerations the court should review under both statutes, as well as the
discretionary nature of both awards, the court will review the overall litigation before
exercising its discretion under either§ 284 or § 285.
There can be no doubt from even a cursory review of the record that Cisco
pursued litigation about as aggressively as the court has seen in its judicial experience.
While defending a client aggressively is understandable, if not laudable, in the case at
bar, Cisco crossed the line in several regards. First, Cisco maintained its reliance on
nineteen invalidity theories to the eve of trial, 51 and then at trial presented only a single

49

A factor which strikes the court as being the essence of whether infringement was
willful in the first instance and, therefore, should not be double-counted.
50

A factor that overlaps with those that are routinely scrutinized in making exceptional
case determinations under 35 U.S.C. § 285.
5

1

(D.I. 292, ex. 2.2 at 5-8)
64

defense of anticipation 52 and a single claim of invalidity under§ 112. 53 With respect to
its non-infringement defenses, Cisco presented a single defense for each of the two
representative product groupings, to wit: Although the court had explained that "[t]he
claim language and the parties' constructions do not require that the 'network monitor'
and 'hierarchical monitor' be separate structures" (D.I. 301 at 32), Cisco maintained
throughout trial that separate monitors were required. (D.I. 393 at 201 :11-14; see also
D.I. 398 at 1594:2-4 ("the infringement theory that has been advanced [by SRI] is that
the individual threads are separate monitors, and that is simply not the case.") As to the
Sourcefire products, the only defense that remained for trial was that the accused
products did not perform correlation on multiple network intrusion events, despite
contrary characterizations found in internal product literature (DTX 840 at 114),
customer testimony (D.I. 395 at 807:14-808:10), and third party documents (PTX 707 at
20-21).
In addition to pursuing defenses to trial that were contrary to the court's rulings or
Cisco's internal documents, Cisco asserted many more defenses through the summary
judgment exercise, causing SRI to expend its resources on responding to such motions,
all of which were denied. Having waded through the summary judgment labyrinth, 54 the
court was presented with yet another motion filed by Cisco seeking sanctions against
SRI based on the claim that SRl's royalty-sharing program violated the criminal bribery
statute; again, SRI was forced to respond and the motion was denied. (D.I. 280; D.I.
281; D.I. 289; D.I. 300) During pre-trial preparations, Cisco designated 53 separate
52

Based on a prior art reference that has been twice considered by the Patent Office
and by this court in prior litigation. (See D.I. 398 at 1607:5-1622:3; DTX 116 ("DIDS
reference"))
53 The less than fulsome evidence presented in this regard was a single conclusory
question to Cisco's expert. (D.I. 398 at 1606:17-25)
54 Including four summary judgment motions and three subsequent letter briefs
disputing portions of the summary judgment order. (D.I. 158; D.I. 182; D. I. 213; D.I.
216; D.I. 219)
65

transcripts consisting of nearly 48,000 lines of testimony (D.I. 292, ex. 5.2 at 3-146)
which SRI was forced to review for objections and counter-designations; Cisco
affirmatively presented 22 lines of testimony from a single transcript at trial. (D.I. 398 at
1637:9-1638:4) Cisco pursued every line of defense post-trial, as represented in the
motions it filed and briefed, requiring both SRI and the court to address the issues
presented. Once again, every motion for post-trial relief has been denied.
In sum, the court understands the need for flexibility in terms of allowing
attorneys to vigorously pursue the best interests of their clients; as a consequence, the
court has rarely awarded fees pursuant to § 285. However, Cisco's litigation strategies
in the case at bar created a substantial amount of work for both SRI and the court,
much of which work was needlessly repetitive 55 or irrelevant56 or frivolous. 57 Of course,
55

Rearguing claim construction and the significance of certain prior art references that
had been considered before. (See, e.g., D.I. 356, ex. 2 (finding, by the USPTO in a
2006 ex parte reexamination, that the patents are not obvious in light of combinations
including the EMERALD 97, Net Ranger, and 1991 paper on the DIDS system)

56

The assertion of a multitude of invalidity arguments and prior art references pre-trial
that were dropped late in the case.
57

Presenting arguments post-trial that had not been presented to the jury. For
example, Cisco argued for the first time in its post-trial brief that SRI failed to
demonstrate infringement by Sourcefire IPS products and services with respect to the
"nested rules" feature. (D.I. 352 at 5, 6, 12, 13, 14, 24 & n.4; D.I. 379 at 3, 5, 7, 12, 13)
Numerous other arguments were not presented to the jury. (See D.I. 352 at 14 (Cisco's
user guides and marketing materials are insufficient to demonstrate inducement); D.I.
352 at 15 (Cisco's denial of infringement during pre-suit discussions precludes a finding
of inducement); D. I. 352 at 13 (Cisco could not have induced infringement of the
Sourcefire IPS product and services, because there was no direct infringement); D.I.
352 at 12 (the accused configuration of the Sourcefire products is not enabled by
default); D.I. 379 at 6 (Dr. Lee's opinion about maintenance services involving
reconfiguration of the products infringing the claims cannot apply to Sourcefire support
services, because the testimony only relates to Cisco's IPS products); D.I. 352 at 11
(SRI failed to present evidence related to Sourcefire Standard, Gold, and Platinum
support services); D.I. 352 at 10 (Cisco IPS services cannot infringe, because a
signature update cannot "redeploy" a sensor)); D.I. 352 at 11 (SRI did not present
evidence that any Cisco RMS customers had connected Cisco IPS products to the
services); D.I. 352 at 25 (an accounting is needed to subtract SRI licensees from the
sales factored into the jury's award))

66

the fact that the jury found that Cisco's infringement was willful is yet another factor to
be considered. For all of these reasons, the court exercises its discretion pursuant to
§ 285 to award SRI its attorney fees and costs. 58
With respect to the willfulness award under§ 284, some enhancement is
appropriate given Cisco's litigation conduct, its status as the world's largest networking
company, its apparent disdain for SRI and its business model, and the fact that Cisco
lost on all issues during summary judgment and trial, despite its formidable efforts to the
contrary. Even assuming for purposes of the record that Cisco has undertaken some
post-trial remedial actions, 59 the court concludes that a doubling of the damages award
is appropriate. Similarly, the court concludes that it is appropriate to order a 3.5%
compulsory license for all post-verdict sales. See Active Video Networks, Inc. v. Verizon
Commc'ns, Inc., 694 F.3d 1312, 1343 (Fed. Cir. 2012); Amanda v. Microsoft Corp., 517
F.3d 1353, 1361 (Fed. Cir. 2008). Moreover, the court concludes that an award of
prejudgment interest at the prime rate, compounded quarterly, is appropriate. 60 See
Gen. Motors Corp. v. Devex Corp., 461 U.S. 648, 657 (1983) ("prejudgment interest
should be awarded under § 284 absent some justification 61 for withholding such an
award.").

58

The court finds that the amounts requested - $7,934,881.75 in fees and $104,640 in
related expenses - are consistent with both counsel's usual and customary fixed
preferred hourly rates as applied to SRI, and the amount of work performed
commensurate with the demands of litigation imposed by Cisco. (See 0.1. 355 at i15
(explaining the fees and expenses), see also id., ex. 4 at 1-108 (documenting mean
patent litigation costs in the Philadelphia CMSA, which includes the court)
59 The court is not prepared to undertake the kind of extensive proceeding that would be
required to determine whether such remedial actions were sufficient to avoid
infringement.
60 The amount requested - $1 ,595,309, which represents the prime interest rate as
applied to the apportioned revenues and compounded quarterly - is reasonable and
consistent with the court's past awards.
61 Cisco's justification is that SRI "delayed eight years before discussing its patents with
Cisco[] and waited until September 2013 to file this lawsuit." (0.1. 362 at 31) "Laches
67

V. CONCLUSION
For the foregoing reasons, the court denies Cisco's motion for judgment as a
matter of law, new trial, and remittitur (D.I. 351); denies Cisco's motion to supplement
the record (D.I. 385); and grants SRl's motion for attorney fees, enhanced damages,
compulsory license, and prejudgment interest. (D.I. 349).
An appropriate order shall issue.

cannot be interposed as a defense against damages when the infringement occurred
within the period prescribed by§ 286." SCA Hygiene Prods. Aktiebolag v. First Quality
Baby Prods., LLC, No. 15-927, slip op. at 16 (U.S. Mar. 21, 2017).
68