SRI International, Inc. v. Internet Security Systems, Inc.

MOORE, Circuit Judge,

dissenting-in-part.

The majority finds that the district court erred in granting summary judgment that the Live Traffic paper invalidates SRI’s four patents under 35 U.S.C. § 102(b). The majority concludes that there are genuine issues of material fact about the public accessibility of the Live Traffic paper. As the district court found, the evidentiary record “indicates that the ftp://ftp.csi.sri.com site was publicly accessible.” SRI Int’l, Inc. v. Internet Sec. Sys., Inc., 456 F.Supp.2d 623, 629 (D.Del.2006). The defendants presented evidence that the Live Traffic paper was posted on the Internet on a public FTP server for seven days and was available to anyone. In contrast, SRI failed to introduce any evidence showing a genuine issue of material fact as to the public accessibility of the Live Traffic paper, and attorney argument, no matter how good, simply cannot fill this void. Therefore, I respectfully dissent.

DISCUSSION

I.

In this case, the defendants supported their summary judgment motion with evidence as required by Rule 56, and SRI presented no evidence to establish that there is a genuine issue of material fact as to whether the publication at issue constitutes a “printed publication” under 35 U.S.C. § 102(b). A party may not overcome a grant of summary judgment by merely offering conclusory statements. Moore U.S.A., Inc. v. Standard Register Co., 229 F.3d 1091, 1112 (Fed.Cir.2000).

Rule 56(e) provides, in relevant part:

When a motion for summary judgment is made and supported as provided in this rule, an adverse party may not rest upon the mere allegations or denials of his pleading, but his response, by affidavits or as otherwise provided in this rule, must set forth specific facts showing that there is a genuine issue for trial. If he does not so respond, summary judgment, if appropriate, shall be entered against him.

Fed.R.Civ.P. 56(e) (emphasis added). When the moving party has carried its burden under Rule 56(c), its opponent “must do more than simply show that there is some metaphysical doubt as to the material facts.” Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 586, 106 S.Ct. 1348, 89 L.Ed.2d 538 (1986).

*1199II.

A.

The majority concludes without any evidence or support in the record that the FTP server “did not contain an index or catalogue or other tools for customary and meaningful research.”1 Maj. op. at 1196. I agree with the district court that all of the evidence of record supports the conclusion that the navigable directory structure of the FTP server rendered the Live Traffic paper publicly accessible. The subject matter of this publication is complex computer software technology on computer security/intrusion detection. There is no dispute that the ordinarily skilled artisan is quite computer savvy. SRI, 456 F.Supp.2d at 630. The defendants introduced evidence indicating that the 1997 version of the FTP server had navigable directories and subdirectories exactly the same as the 2006 version of the FTP server.

The evidence showed that the inventor, Mr. Porras, repeatedly directed people of ordinary skill in the art to the SRI FTP server prior to the critical date as a place to find materials on EMERALD in presentations and emails:

• Dec. 17, 1996 11:35 AM email: “Bill, a copy of our paper can be found on ftp.csl.sri.com under pub/emerald-oak-land97.ps.”
• Dec. 17, 1996 3:45 PM email: “By the way, a postscript version of the paper is also available via anonymous ftp from ftp.csl.sri.com. You can find the file under /pub/emerald-oakland97.ps.”
• Dec. 31, 1996 email: “FYI, we’ve placed an update of our paper and a 1-page executive summary of EMERALD on ftp.csl.sri.com in the pub directory.”
• Jan. 6, 1997 email: “FYI: I mentioned to you that I’d send you a paper on our Intrusion Detection research when it was available. You can find that paper (and an executive summary) at ftp.csl.sri.com under /pub/emerald*.ps.”
• Jan. 8, 1997 email: “ps: I realize folks may not be able to review our paper before the meeting. We have, however, made available on ftp.csl.sri.com (/pub/emerald-positionl.ps) a concise executive summary of our research.”
*1200• Jan. 14, 1997 email: “By the way, this exec summary and a more lengthy paper on EMERALD are available for anonymous ftp at ftp.csl.sri.com under /pub/emerald*.ps.”
• DARPA Presentation slides dated Feb. 5, 1997: This presentation repeatedly directed participants to the EMERALD sub-folder and materials contained therein: “Executive Summary: ftp://ftp.csl.sri.com/pub/emer-ald-position l.ps”2

This record evidence supports the district court’s conclusion that the FTP server was widely known and easily navigable. SRI presents no evidence to the contrary. In fact, SRI’s primary argument on appeal was:

But most importantly, there was no evidence that in 1997, at the time the draft was supposedly placed on the server for one week, SRI’s FTP server was structured to allow an anonymous user to navigate through directories and subdi-rectories to find a specific file without knowing its specific, complete address.

In fact, as the defendants point out, SRI presents no evidence that any FTP server was not navigable in 1997. See Oral Arg. at 22:42-23:38, available at http://www. cafc.useourts.gov/oralarguments/mp3/2007-1065.mp3. In contrast, the defendants presented evidence that the FTP server was navigable in 2006 (which SRI does not dispute), and the emails and presentations indicate that the FTP server was similarly navigable in 1997. In fact in the December 31, 1996 email, Mr. Porras directed Ms. Lunt to ftp.csl.sri.com and told her to go to the “pub directory.” If this FTP server was not navigable, this email would be meaningless. Moreover, SRI never responds to the evidence indicating widespread use of the FTP server by the cyber security community at the relevant time including citations, and evidence that the FTP server was referenced seventy times by individuals on Google Groups and other on-line newsgroup forums. SRI, 456 F.Supp.2d at 629. SRI does not respond to the fact that many of the USENET references from 1997 just cite the FTP server leaving individuals to navigate to the material of interest.3 See Oral Arg. at 20:44-21:25, available at http://www.cafc. uscourts.gov/oralarguments/mp3/2007-1065.mp3. In the face of all this evidence, SRI offers nothing other than a hollow claim that defendants did not prove it navigable in 1997. It must also be acknowledged that this FTP server was at all times within SRI’s control. Hence, if contrary to all the evidence, it was not navigable in 1997, SRI should be able to proffer some proof.

In light of the mountain of evidence presented by the defendants and the com-*1201píete absence of any contrary evidence presented by SRI, the district court’s determination that the FTP server was publicly accessible by virtue of the navigable directory structure must be affirmed.

B.

I agree with the majority that this case, placing a paper on an FTP server, is not clearly governed by either our library cases, such as In re Bayer, 568 F.2d 1357 (Fed.Cir.1978), In re Hall, 781 F.2d 897 (Fed.Cir.1986), or In re Cronyn, 890 F.2d 1158 (Fed.Cir.1989), or our dissemination cases, such as In re Klopfenstein, 380 F.3d 1345, 1350 (Fed.Cir.2004).

1. Library Cases

Like a thesis in a library, the Live Traffic paper was placed on the FTP server. However, unlike the library cases, the Live Traffic paper was in a navigable directory structure. As the district court held, once at the FTP server, to get to the Live Traffic paper, one only needed to enter the directory entitled PUBS (there were only two directories to choose from PUBS and DEV) and once in PUBS enter the subdi-rectory EMERALD. SRI, 456 F.Supp.2d at 629-30. It was undisputed that people of skill in the art were aware of the EMERALD project to which the Live Traffic paper pertained prior to the critical date. Id. at 630. The district court concluded from the extensive record evidence that “a person of ordinary skill in this art, having the FTP host address available to him/her, could readily navigate through two sub-folders on a simple website and access the Live Traffic paper.” Id.

The Live Traffic paper was in the EMERALD subdirectory under the name “ndss98.ps.” The majority refers to the filename as “relatively obscure.” Maj. op. at 1197. There is no evidence to suggest that the filename was obscure — it is the acronym for a conference (1998 Network and Distributed System Security Symposium) sponsored by the Internet Society. By 1997, the NDSS Symposium was in its fifth year and the record evidence demonstrated that its program committee included representatives from important government, corporate and academic institutions in the intrusion detection field, such as the National Security Agency, DARPA, AT & T Labs, Bellcore, 3Com, Purdue University, and Cambridge University. The Internet Society website’s “call for papers” referred to the 1998 conference as “NDSS” and the link to the website’s call for papers used “ndss” in its file path (“http://www. isoc.org/conferences/ndss/98/cfp.shtml.”). Further, even if the filename were obscure and did not convey the nature of the subject matter, the file existed in the EMERALD subdirectory. In this case, members of the relevant cyber community had been repeatedly directed to the EMERALD subdirectory to find files related to computer intrusion detection and the cyber community had repeatedly cited the EMERALD subdirectory in USENET and other articles as a source for intrusion detection materials. If a librarian directed a researcher to a particular shelf of books on intrusion detection, even if a book on that shelf had an obscure title, the fact that the librarian referred to the shelf as containing books on intrusion detection would provide enough direction for the researcher to know that the book was related to intrusion detection. The standard enunciated in our caselaw is “research aid” or “customary research tool.” Cronyn, 890 F.2d at 1161; In re Howarth, 654 F.2d 103, 105 (CCPA 1981). The navigable directory meets this standard. The paper “ndss98.ps” was located in a subdirectory, EMERALD, which was known to be a source for materials related to intrusion detection.

*1202This case is quite unlike the uncatalogued, unshelved thesis in a general university library in Application of Bayer, 568 F.2d 1357 (CCPA 1978). In this case, the Live Traffic paper existed on an FTP server that was used for cyber security work, in a subdirectory named for a specific, well-known cyber security project (EMERALD). As the district court pointed out, it is ironic that SRI, which is in the intrusion detection business, argues that those skilled in the art of intrusion detection could not detect information purposefully posted on the internet by a member of the cyber security community.

This case is also unlike Cronyn, where the court held that three theses in a shoebox in the chemistry department library filed by author’s name did not make them readily accessible to the public. 890 F.2d at 1161. The court held that “the only research aid was the student’s name, which, of course, bears no relationship to the subject matter of the student’s thesis.” Id. In contrast to Cronyn, the Live Traffic paper was located in a navigable directory in a subdirectory entitled EMERALD, which the record evidence indisputably shows people in the industry understood as a project related to computer software for intrusion detection — the same subject matter as the Live Traffic paper. SRI, 456 F.Supp.2d at 630-31. Under the library cases, it is my view that the district court properly ruled on summary judgment because the navigable directory was a research aid which rendered the Live Traffic paper readily accessible to the computer security community (the relevant public).

2. Dissemination Cases

“[Djistribution and indexing are not the only factors to be considered in a § 102(b) ‘printed publication’ inquiry.” Klopfenstein, 380 F.3d at 1350; see also Bruckelmyer, 445 F.3d at 1378 (reference is publicly accessible if it has been “disseminated or otherwise made available to the extent that persons interested and ordinarily skilled in the subject matter or art exercising reasonable diligence, can locate it and recognize and comprehend therefrom the essentials of the claimed invention”). As the majority recognizes, the determination of whether a reference is a “printed publication” under 35 U.S.C. § 102(b) involves a case-by-case inquiry into the facts and circumstances surrounding the reference’s disclosure to the public.

Klopfenstein articulates several factors that guide our case-by-case inquiry. See Klopfenstein, 380 F.3d at 1350. The factors to consider include: (1) the length of time the reference was available; (2) the expertise of the target audience; (3) the existence (or lack) of reasonable expectations that the reference would not be copied; and (4) the simplicity with which the reference could have been copied. See id. at 1350-51.

a. Length of Time the Live Traffic Paper was Available

The more transient the display, the less likely it is to be considered a “printed publication.” Klopfenstein, 380 F.3d at 1350. Conversely, the longer a reference is displayed, the more likely it is to be considered a printed publication. Id.

It is undisputed that the Live Traffic paper was available on the FTP server for seven days. This is more than double the amount of time found sufficient in Klopfen-stein. Further, the paper was available twenty-four hours a day, as opposed to the poster in Klopfenstein, which was only available during conference hours. Moreover, because the Live Traffic paper was available on an FTP server, it could be accessed from anywhere, as opposed to Klopfenstein where the display was at a conference in a single physical location. *1203SRI failed to introduce any evidence that seven days was not sufficient time to give the public the opportunity to capture information conveyed by the Live Traffic paper.

b. Expertise of the Target Audience of the Live Traffic Paper

The expertise of the target audience “can help determine how easily those who viewed it could retain the displayed material.” Klopfenstein, 380 F.3d at 1351. In this case, the defendants introduced evidence to show that the target audience of the Live Traffic paper is persons interested and skilled in cyber security. Counsel for SRI conceded at oral argument that the target audience included sophisticated members of the internet security community. See Oral Arg. at 6:12-32, available at http://www.cafc.uscourts.gov/ oralarguments/mp3/2007-1065.mp3; SRI, 456 F.Supp.2d at 630. The defendants presented evidence showing that in 1996 and 1997, the inventor advertised the FTP server to let people of ordinary skill in the art locate his research in the field of cyber security, using both emails to colleagues in the field and presentations to the cyber security community. The defendants presented evidence showing the cyber security community included sophisticated computer scientists who knew how to use the FTP server, and who in fact often used the FTP server to share information. SRI presented no evidence to the contrary.

c. Expectation That the Live Traffic Paper Would Not Be Copied

If “professional and behavioral norms entitle a party to a reasonable expectation that the information displayed will not be copied, we are more reluctant to find something a ‘printed publication.’ ” Klopfenstein, 380 F.3d at 1351. When parties have taken protective measures, such as license agreements, non-disclosure agreements, anti-copying software, or even simple disclaimers, those protective measures may be considered to the extent they create a reasonable expectation on the part of the inventor that the information will not be copied. Id.

The defendants introduced evidence that the public FTP server where the Live Traffic paper was posted was widely known in the cyber security community and accessible to any member of the public. The defendants even introduced evidence that the inventor had specifically advertised the FTP server to persons particularly interested in his research and skilled in the art, using emails and presentations. Moreover, the evidence is undisputed that the inventor took absolutely no protective measures with regard to the FTP server or the Live Traffic paper, such as license agreements, nondisclosure agreements, anti-copying software, or even simple disclaimers. Id. As counsel for SRI conceded during oral argument, the Live Traffic paper was not even labeled confidential. See Oral Arg. at 9:40-46, available at http://www.cafc.uscourts.gov/ oralarguments/mp3/2007-1065.mp3.

The majority analogizes the Live Traffic paper to “posters at an unpublicized conference with no attendees.” Maj. op. at 1197. This analogy is incorrect. The evidence showed that: (1) the inventor publicized the FTP server to the cyber security community (hence the conference was publicized), and (2) the FTP server was widely known and frequently used in the cyber security community (there were lots of attendees), in direct contrast to an “unpublicized conference with no attendees.”4

*1204The majority accepts SRI’s argument that “this record does not evince that the Live Traffic paper was accessible to anyone other than the peer-review committee.” Maj. op. at 1197. But the record shows the Live Traffic paper was available to any member of the general public, and not just the peer-review committee. There are two different disclosures of the Live Traffic paper.5 The first, via email to the peer-review committee, and the second, posted to the public FTP server. While the inventor may have had a reasonable expectation the copy of the Live Traffic paper that he sent to the peer-review committee would not be copied, the record does not indicate the inventor could have any expectation of confidentiality with respect to the copy of the Live Traffic paper he posted on the publicly accessible FTP server, which was the same FTP server the cyber security community frequently used. The inventor took no precautions to restrict access to the Live Traffic paper on the FTP server, and based on the record, no reasonable person would expect something posted on the FTP server to be confidential. The record even shows that in December of 1996 and January of 1997, the inventor directed multiple members of the cyber security community (outside the peer-review committee) to the EMERALD subdirectory of the FTP server to read about his intrusion detection research — the same subdirectory where the inventor posted the Live Traffic paper.

d. Simplicity of Copying the Live Traffic Paper

“The more complex a display, the more difficult it will be for members of the public to effectively capture its information.” Klopfenstein, 380 F.3d at 1351. The defendants introduced evidence that the FTP server existed for the sole purpose of allowing members of the cyber security community to post and retrieve information relevant to their research. FTP — which stands for “File Transfer Protocol” — is an Internet tool which exists for the purpose of moving files from one computer to another — copying. The inventor “stuck a copy” of the Live Traffic paper on the FTP server for seven days where others could view and copy the paper with great ease.

SRI does not contend that papers on an FTP server are difficult for a user to copy or print. It is undisputed that at the touch of a button, the entire Live Traffic paper could be downloaded or printed. Copying could not be simpler. Unlike Klopfen-stein, where members of the public would have to quickly transcribe the text or graphics of the poster during a conference, members of the public could download or print the Live Traffic paper immediately upon accessing the paper, and at any time of the day or night during the seven days it was posted on the FTP server.

*1205Whether the case is analyzed under the rubric of the library thesis cases or the temporary dissemination cases, the result is the same. The defendants carried their burden under Rule 56(c). Because SRI presented no evidence showing genuine issues of material fact for trial, I would affirm the district court’s ruling of invalidity based on the Live Traffic paper.

. The majority bases this conclusion on a number of "facts” not supported by the record or even argued by the parties. First, the majority implies that a sophisticated computer security researcher would need a "README” file to find a file in an FTP server. Maj. op. at 1196. There is no support in the record for this suggestion and the parties never argued it. The majority also states, without record support, that "[i]t is doubtful that anyone outside the review committee looking for papers submitted to the Internet Society’s Symposium would search a subfolder of an SRI server” and "[i]t is also doubtful that anyone outside the review committee would have been aware of the paper or looked for it at all in early August 1997.” Id. at 1196-97. Neither of these "doubts” are supported by any record evidence. Moreover, the relevant inquiry for public accessibility is not whether a reference is available to people looking specifically for that reference, but rather whether the reference is publicly available to someone looking for information relevant to the subject matter. Bruckelmyer v. Ground Heaters, Inc., 445 F.3d 1374, 1378 (Fed.Cir.2006) (reference is publicly accessible upon a showing that reference "has been disseminated or otherwise made available to the extent that persons interested and ordinarily skilled in the subject matter or art exercising reasonable diligence, can locate it”). Given that the EMERALD subdirectory was publicized to the cyber security community as a source of information related to projects on intrusion detection, this paper, like everything else in the EMERALD subdi-rectory, was publicly accessible to anyone interested in material on intrusion detection.

. The majority repeatedly relies for support upon its claims that "[i]n every instance, Mr. Porras directed the people to a specific paper, which included the term 'emerald' in the file name.” Maj. op. at 1191, 1197. With all due respect to the majority, that simply is not accurate. In a presentation Mr. Porras gave on EMERALD, he presented slides with at least six references to SRI’s FTP server and the EMERALD subdirectory. In two such references, the slides directed people to the EMERALD subdirectory and to materials in that subdirectory that did not contain the 'emerald' name in the title, but nonetheless related to the EMERALD project.

. Without addressing most of this evidence, the majority claims that Mr. Porras provided Dr. Bishop with the full FTP address for the file because “Dr. Bishop apparently would not have found the reference without Mr. Porras's precise directions.” Maj. op. at 1196. There is no support in the record for this determination by the majority. And again the parties do not argue this. Of course, it is easier to locate something with a precise address, rather than general instructions.

. The majority's focus on whether the paper was publicized or whether the existence of the paper was known beyond the peer-review committee for the conference ignores the fact *1204that the FTP server and the particular subdi-rectory where the paper was located, EMERALD, were well known as a source for information related to intrusion detection. There has never been a requirement that the publication itself be publicized. Unpublicized books, articles, or theses have always been printed publications provided they were publicly accessible. Bruckelmyer, 445 F.3d at 1378; In re Wyer, 655 F.2d 221, 226 (CCPA 1981).

. The majority contends that the Live Traffic paper, unlike the thesis in Bayer, was incom-píete and not "ready for public consumption.” Maj. op. at 1196. Virtually no changes (other than the removal of references to SRI and the EMERALD project name to facilitate blind review) exist between the version of the Live Traffic paper posted on the FTP server and the final version of the Live Traffic paper. Further, this issue is irrelevant to our inquiry of whether the paper as posted on the FTP server was publicly accessible for all that it disclosed.