Fortinet, Inc. v. Forescout Technologies, Inc.

Opinion

FORTINET, INC., Case No. 20-cv-03343-EMC

Plaintiff, ORDER GRANTING IN PART AND v. DENYING IN PART DEFENDANT’S MOTION TO DISMISS Docket No. 71 Defendant.

In this case, Plaintiff Fortinet, Inc. (“Fortinet”) alleges that Defendant Forescout Technologies, Inc. (“Forescout”) has committed numerous acts of patent infringement. Fortinet brings claims for contributory, induced, and willful infringement against Forescout based on five patents relating to cybersecurity technology. In November 2020, the Court granted in part and denied in part Forescout’s motion to dismiss Fortinet’s original complaint, which asserted three of the patents currently at issue. See Docket No. 55 (“Order”). The Court rejected Forescout’s contention that the three patents claimed ineligible subject matter and were therefore invalid under 35 U.S.C. § 101; it also found that Fortinet sufficiently stated a claim for induced infringement. Order at 1. The Court granted Forescout’s motion with respect to Fortinet’s contributory and willful infringement claims, finding them inadequately pled. Id. Fortinet was given leave to amend, id., and filed its Amended Complaint in December 2020. See Docket No. 67 (“Compl.”). Pending before the Court is Forescout’s motion to dismiss Fortinet’s Amended Complaint. patents claim ineligible subject matter under § 101 and that Fortinet has failed to adequately plead induced, contributory, or willful infringement of any of the five patents in suit. See id. For the reasons given below, the Court GRANTS the motion with respect to Fortinet’s willful infringement claims and DENIES the motion as to all other issues. A. Factual Background According to the Amended Complaint, Fortinet sells “cybersecurity products, software, and services” to large institutional customers. Compl. ¶ 3; see also id. ¶¶ 21-23. Many of Fortinet’s product offerings specifically address “[t]he proliferation of [Internet of Things] devices,” which “has made it necessary for organizations to improve their visibility into what is attached to their networks.” Id. ¶ 25. The company’s products thus “provide[] network visibility to see devices connected to a network as well as the ability to control those devices and users.” Id. ¶ 26. Fortinet is the owner, by assignment, of five patents relating to cybersecurity and network access control. These include United States Patent No. 8,458,314 (“’314 Patent”), titled “System and method for offloading IT network tasks”; No. 9,369,299 (“’299 Patent”), titled “Network access control system and method for devices connecting to network using remote access control methods”; No. 9,948,662 (“’662 Patent”), titled “Providing security in a communication network”; No. 9,894,034 (“’034 Patent”), titled “Automated Configuration of Endpoint Security Management”; and No. 9,503,421 (“’421 Patent”), titled “Security Information and Event Management.” Id. ¶¶ 2, 30-39. Forescout is a competitor of Fortinet, also selling cybersecurity products to businesses. See id. ¶ 6. In February 2020, “Fortinet attempted to initiate licensing discussions with Forescout” on the belief that Forescout's product offerings infringe the aforementioned patents. Id. ¶ 10. Fortinet continued its attempts throughout March and April 2020, eventually providing Forescout with “identification of specific patents that are infringed by Forescout's technology.” Id. ¶¶ 11-12. Forescout has so far refused to engage in licensing negotiations. Id. ¶ 12. B. Procedural Background In its original complaint, Fortinet alleged infringement of the ’314, ’299, and ’662 Patents on theories of induced, contributory, and willful infringement. Docket No. 1 ¶¶ 37, 49, 51, 63, 65, 77. Forescout moved to dismiss for failure to state a claim, arguing primarily that the ’314, ’299, and ’662 Patents are all “directed to an abstract idea that lacks any inventive concept, and are therefore patent-ineligible” under 35 U.S.C. § 101. Order at 4; see also Docket No. 24. More specifically, Forescout contended that the patents focus on “the abstract idea of controlling access” to a computer network “using conventional technology.” Order at 4. Forescout also asserted that the original complaint did not “adequately plead indirect infringement” because it failed to allege “any factual allegations regarding the knowledge and intent elements of Fortinet's claims for contributory and induced infringement,” and that it “fail[ed] to adequately plead willful infringement” since it did not allege facts showing “that Forescout's conduct [was] egregious.” Id. In ruling on the earlier motion to dismiss, the Court declined to invalidate the ’314, ’299, and ’662 Patents on § 101 grounds. The Court agreed with Forescout that the ’314 and ’662 Patents are directed to abstract ideas, id. at 10-12, 17-18, but was unable to conclude, at this early stage of the litigation, that the patents lacked an inventive concept, id. at 12-14, 18-19. The Court also declined to hold that the ’299 Patent is directed to an abstract idea because the invention plausibly recites a technological solution to a technological problem. See id. at 14-16. While the Court expressed its skepticism about the ultimate validity of the ’314, ’299, and ’662 Patents and stated that “the outcome of claim construction,” in particular, “might make it appropriate . . . to revisit the eligibility questions” later in the proceedings, the Court could not conclude that the patents claim ineligible subject matter on a motion to dismiss. See id. at 19. Regarding Forescout’s arguments that Fortinet’s original complaint failed to adequately allege induced, contributory, or willful infringement, the Court disagreed with the first point but agreed with the latter two. It held that the complaint “set forth sufficient facts showing a ‘specific intent to encourage another’s infringement,’” and so stated a claim for inducement. See id. at 22- 23. But the Court ruled that the complaint did not adequately allege contributory infringement infringing use,” as the applicable statute requires. Id. at 24-25. The complaint also failed to state a claim for willful infringement because it alleged only that Forescout knew of the patents in suit and continued to sell its own products—not that Forescout’s conduct was “egregious,” “wanton,” or “malicious.” See id. at 25-27. The Court therefore granted in part and denied in part Forescout’s motion to dismiss, giving Fortinet leave to amend. Id. at 27. Fortinet filed its Amended Complaint in December 2020. See Compl. Forescout then moved to dismiss the Amended Complaint. See Mot. Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A complaint that fails to meet this standard may be dismissed pursuant to Rule 12(b)(6). See Fed. R. Civ. P. 12(b)(6). To overcome a Rule 12(b)(6) motion to dismiss after the Supreme Court's decisions in Ashcroft v. Iqbal, 556 U.S. 662 (2009), and Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007), a plaintiff's “factual allegations [in the complaint] must . . . suggest that the claim has at least a plausible chance of success.” See Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014) (internal quotation omitted). The court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). But “allegations in a complaint . . . may not simply recite the elements of a cause of action [and] must contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend itself effectively.” Levitt, 765 F.3d at 1135 (quoting Starr v. Baca, 652 F.3d 1202, 1216 (9th Cir. 2011)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (quoting Twombly, 550 U.S. at 556). Under the Patent Act of 1952, patents are “presumed valid.” 35 U.S.C. § 282(a). “As proving invalidity by clear and convincing evidence.” Cisco Sys., Inc. v. Uniloc USA, Inc., 386 F. Supp. 3d 1185, 1190 (N.D. Cal. 2019) (citing Microsoft Corp. v. i4i Ltd. P’ship, 564 U.S. 91, 95 (2011)). “Patent eligibility under 35 U.S.C. § 101 is ultimately an issue of law” but “may contain underlying issues of fact.” Berkheimer v. HP Inc., 881 F.3d 1360, 1365 (Fed. Cir. 2018). “Like other legal questions based on underlying facts,” patent eligibility “may be, and frequently has been, resolved on a Rule 12(b)(6) or (c) motion where the undisputed facts . . . require a holding of ineligibility under the substantive standards of law.” SAP Am., Inc. v. InvestPic, LLC, 898 F.3d 1161, 1166 (Fed. Cir. 2018). Thus, “[a]lthough claim construction is often desirable, and may sometimes be necessary, to resolve whether a patent claim is directed to patent-eligible subject matter,” it is not “an inviolable prerequisite to a validity determination under § 101,” and may be eschewed “[w]here the court has a full understanding of the basic character of the claimed subject matter.” Voip-Pal.Com, Inc. v. Apple Inc., 375 F. Supp. 3d 1110, 1124 (N.D. Cal. 2019) (internal quotations omitted). As with Forescout’s earlier motion to dismiss, the parties focus most of their attention on § 101 issues. In the instant motion, Forescout argues that the two patents asserted for the first time in the Amended Complaint, the ’034 and ’421 Patents, claim ineligible subject matter. Forescout contends that both are directed to simple abstract ideas—the ’034 Patent to “selecting a course of action based on a determined condition . . . and then launching predetermined functions,” the ’421 Patent to “performing a set of tasks and collecting data from those tasks.” Mot. at 6. Forescout further argues that neither patent “recite[s] any specialized hardware, technological improvement, or any other allegedly inventive concept.” Id. The patents thus fail both steps of the Supreme Court’s Alice test, see infra, and must be invalidated under § 101. Forescout also maintains that the Amended Complaint fails to state a claim for induced or contributory infringement because the pleading merely recites “legal standards without any supporting factual contentions as to [the accused products’] lack of substantial non-infringing uses.” Mot. at 3. Forescout lastly contends to allege any facts showing that Forescout’s conduct has been in any way egregious.” Id. Fortinet responds that the ’034 and ’421 Patents claim eligible subject matter under § 101 because they are not directed to abstract ideas. Instead, they address “specific problems in the . . . field of network security and endpoint security.” Docket No. 73 (“Opp’n”) at 2. Fortinet also suggests that, even if the patents incorporate abstract ideas, the Court should refrain from invalidating them “at such an early state of litigation,” id., where the Court must accept a complaint’s allegations about a patent’s advances over the prior art “as true and consider them important in [the] determination that [the patent’s] claims are drawn to a technological improvement,” id. at 3-4 (quoting CardioNet, LLC v. InfoBionic, Inc., 955 F.3d 1358, 1367 (Fed. Cir. 2020)). Regarding the sufficiency of Fortinet’s infringement allegations, Fortinet argues that the Amended Complaint adds sufficient factual support to its claims for contributory and willful infringement (which the Court previously found deficient), as well as its claims for induced infringement (which the Court earlier deemed adequate). Id. at 1. A. Patent-Eligible Subject Matter Section 101 of the Patent Act defines the scope of patent-eligible subject matter. It provides: “Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor.” 35 U.S.C. § 101. But the Supreme Court has long excluded from patent protection “laws of nature, natural phenomena, and abstract ideas,” Diamond v. Diehr, 450 U.S. 175, 185 (1981), which are “the basic tools of scientific and technological work,” Gottschalk v. Benson, 409 U.S. 63, 67 (1972). The Court has “described the concern that drives this exclusionary principle as one of pre-emption,” since granting “a monopoly over an abstract idea” would “pre-empt use of [the idea] in all fields” and thus “impede innovation more than it would tend to promote it.” Alice Corp. Pty. Ltd. v. CLS Bank Int’l, 573 U.S. 208, 216 (2014) (internal citations omitted). The Court has also cautioned, however, that lower courts must “tread carefully in construing this exclusionary principle” since, “[a]t some level, ‘all inventions . . . embody, use, reflect, rest upon, or apply laws of nature, natural phenomena, or abstract ideas.’” Id. at 217 (quoting Mayo In Alice, the Court codified a two-part test, first articulated in Mayo, for “distinguishing patents that claim laws of nature, natural phenomena, and abstract ideas from those that claim patent-eligible applications of those concepts.” 573 U.S. at 217. At step one, a court must “determine whether the claims at issue are directed to a patent-ineligible concept,” i.e., a law of nature, natural phenomenon, or abstract idea. Id. at 218. If so, then the court moves to step two, “consider[ing] the elements of each claim both individually and ‘as an ordered combination’ to determine whether [any] additional elements ‘transform the nature of the claim’ into a patent- eligible application” of the ineligible subject matter. Id. at 217 (quoting Mayo, 566 U.S. at 79, 78). The Court has described this second step as “a search for an ‘inventive concept’”—“an element or combination of elements that is ‘sufficient to ensure that the patent in practice amounts to significantly more than a patent upon the [ineligible subject matter] itself.’” Id. at 217-18 (quoting Mayo, 566 U.S. at 72-73). Lower courts have conceded that, in the wake of Mayo and Alice, “precision has been elusive in defining an all-purpose boundary between the abstract and the concrete.” Affinity Labs of Tex., LLC v. DirecTV, LLC, 838 F.3d 1253, 1258 (Fed. Cir. 2016) (internal quotation omitted). Nevertheless, the Supreme Court and the Federal Circuit have established certain parameters for conducting the step-one and step-two inquiries. At step one, courts “look at the ‘focus of the claimed advance over the prior art’ to determine if the patent claim's ‘character as a whole’ is directed to excluded subject matter,” Affinity Labs, 838 F.3d at 1257-58 (internal quotation omitted), such as an abstract idea. While the “Supreme Court has not established a definitive rule to determine what constitutes an ‘abstract idea,’” Enfish, LLC v. Microsoft Corp., 822 F.3d 1327, 1334 (Fed. Cir. 2016), it has identified algorithms, mathematical formulae, “fundamental economic practice[s] long prevalent in our system of commerce,” and other “method[s] of organizing human activity” as impermissibly abstract, Alice, 573 U.S. at 218-20 (citing Bilski v. Kappos, 561 U.S. 593, 599 (2010)). Courts therefore often begin the step-one analysis by simply “compar[ing] claims at issue to those claims already found to be directed to an abstract idea in previous cases.”1 See Enfish, 822 F.3d at 1334. The closer question at step one, however, tends to be not “whether the claims involve a patent-ineligible concept,” but whether they are “directed to excluded subject matter.” See Enfish, 822 F.3d at 1335 (internal quotation omitted) (emphasis added). With computer technology in particular, a typical crux in the step-one analysis is “whether the focus of the claims is on the specific asserted improvement in computer capabilities . . . or, instead, on a process that qualifies as an ‘abstract idea’ for which computers are invoked merely as a tool.” Id. at 1336; see also Ancora Techs., Inc. v. HTC Am., Inc., 908 F.3d 1343, 1347 (Fed. Cir. 2018) (identifying this question as the key issue in cases “involving software innovations”). Merely applying an “abstract idea . . . on a generic computer” does not satisfy step one. BASCOM Global Internet Servs., Inc. v. AT&T Mobility LLC, 827 F.3d 1341, 1348 (Fed. Cir. 2016) (internal quotation omitted). Nor does “[l]imiting the invention to a technological environment” such as the Internet transform an otherwise abstract idea into one satisfying step one. Berkheimer, 881 F.3d at 1367 (internal quotation omitted). The Federal Circuit has also suggested that a computer-based patent should “describe how to solve the problem [it addresses] in a manner that encompasses something more than the principle in the abstract” to claim eligible subject matter at step one. See Dropbox, Inc. v. Synchronoss Techs., Inc., 855 Fed. Appx. 529, 533 (Fed. Cir. 2020) (internal quotation omitted); see also Affinity Labs, 838 F.3d at 1258 (holding an invention abstract at step one where there was “nothing in [the patent] that is directed to how to implement” the claimed idea); Ancora, 908 F.3d at 1348 (holding an invention patentable at step one where the claim “specifically identifies how th[e] functional improvement is effectuated in an assertedly unexpected way”). Put another way, courts at Alice step one seek to determine whether a patent's claimed advance represents a concrete “technological solution to a technological problem.” See Packet Intelligence LLC v. NetScout Sys., Inc., 965 F.3d 1299, 1309 (Fed. Cir. 2020); see also SRI Int'l, Inc. v. Cisco Sys., Inc., 930 F.3d 1295, 1303 (Fed. Cir. 2019) (upholding patent eligibility at step one because “the claims are directed to a technological solution to a technological problem”); Prism Techs., LLC v. T-Mobile USA, Inc., 696 Fed. Appx. 1014, 1017 (Fed. Cir. 2017) (denying eligibility at step one because claims did not “cover a concrete, specific solution to a real-world problem”). In this regard, the focus is placed on a patent’s specificity. If a patent is directed to an abstract idea at Alice step one, then the essential inquiry at Alice step two is whether “the elements of [a] claim both individually and ‘as an ordered combination’” go beyond “‘well-understood, routine, conventional activit[ies]’ previously known to the industry.” Alice, 573 U.S. at 217, 225 (quoting Mayo, 566 U.S. at 79, 73); see also Berkheimer, 881 F.3d at 1367 (“The second step of the Alice test is satisfied when the claim limitations involve more than performance of ‘well-understood, routine, [and] conventional activities previously known to the industry.’”). The Federal Circuit has thus held that, in the case of a computer- implemented invention, any “concrete, tangible components” (e.g., computer hardware) recited in the claims “must involve more than performance of ‘well-understood, routine, conventional activit[ies]’ previously known to the industry” to render an abstract idea patent-eligible. In re TLI Commc’ns LLC, 823 F.3d 607, 613 (Fed. Cir. 2016) (quoting Alice, 573 U.S. at 225). The components themselves, however, may supply an inventive concept if they amount to more than “generic computer components.” See Customedia Techs., LLC v. Dish Network Corp., 951 F.3d 1359, 1366 (Fed. Cir. 2020). And “an inventive concept can be also found in the non- conventional and non-generic arrangement of known, conventional pieces” of computing components. BASCOM, 827 F.3d at 1350. With the step-two analysis, “[t]he question of whether a claim element or combination of elements is well-understood, routine[,] and conventional to a skilled artisan in the relevant field is a question of fact.” Berkheimer, 881 F.3d at 1368. As a result, “whether a claim recites patent eligible subject matter is a question of law which may contain underlying facts,” and it is only “[w]hen there is no genuine issue of material fact regarding whether the claim elements or claimed combination is well-understood, routine, [or] conventional to a skilled artisan in the relevant field” that eligibility “can be decided . . . as a matter of law” on a motion to dismiss or at summary judgment. Id. In other words, if there is a genuine dispute as to whether the claimed combination summary judgment must be denied. A fact-based question such as this one, moreover, “that is pertinent to the invalidity conclusion must be proven by clear and convincing evidence” by the party challenging the patent. Id. 1. The ’034 Patent The ’034 Patent concerns “[s]ystems and methods for managing configuration of a client security application based on a network environment in which the client device is operating.” Compl. ¶ 37 (quoting ’034 Patent at Abstract). Claim 1, one of the patent’s two independent claims and the focus of the parties’ discussion in their moving papers, recites:

1. A method comprising: during initialization of a client security application running on a client device:

[1] determining, by the client security application, a network connection state of the client device with respect to a private network;

[2] selecting, by the client security application, a configuration for the client security application based on the determined network’s connection state; and

[3] launching, by the client security application, one or more functions of the client security application that are designated by the selected configuration to be performed by the client security application, wherein the one or more functions include one or more of web content filtering, anti-virus scanning and network access logging. ’034 Patent at Clm. 1 (bracketed numbers added). According to the patent’s specification, “it is a challenge in network security management to keep a network secure while allowing many different devices to connect to the network.” Compl. ¶ 37 (citing ’034 Patent at 1:23-25). One way that user devices can connect to a network remotely is through a client security application, which must be configured “based on information regarding the network environment in which the user device is operating.” Id. (citing ’034 Patent at 1:50-54). The inventors of the ’034 Patent solved the aforementioned security challenge “by having the client security application [1] determine [the user device’s] network connection state with respect to a private network, [2] select a configuration based on this, and [3] launch “based on [the application’s] determination and selected configuration.” Id. (citing ’034 Patent at 1:56-60) (bracketed numbers added). The invention purportedly represents an advance over the prior art, which “typically required users to change the configuration of their device manually when changing networks or access methods in order for the corresponding functions of the client security application to be launched.” Id. (citing ’034 Patent at 1:44-50). The Amended Complaint states that the patent “solved this problem in a non-conventional way” and that the “ordered combination of the claimed steps is not generic and was neither routine nor conventional at the time of invention.” Id. Forescout argues that the ’034 Patent is “directed to [a] simple abstract idea[]” and therefore fails step one of the Alice test. Mot. at 6. That abstract idea is “selecting a course of action based on a condition”—i.e., a “network connection state to a private network”—“and then launching predetermined functions.” Id. at 8, 6. This process, Forescout insists, represents “a simple type of if/then logic that is a common and well-understood business organization strategy.”2 Id. at 8. Forescout analogizes this process to that of “generating tasks based on rules to be completed upon the occurrence of an event,” which the Federal Circuit has found abstract. See Mot. at 6, 9 (quoting Accenture Glob. Servs., GmbH v. Guidewire Software, Inc., 728 F.3d 1336, 1344 (Fed. Cir. 2013)). “Here,” Forescout concludes, “the ‘event’ is connecting to a network, the ‘rules’ are the selected configuration, and the ‘tasks’ are the functions designated by that configuration.” Id. at 9. Computers are therefore being invoked “merely as tools to execute fundamental economic practices.” Id. at 10 (quoting Smartflash LLC v. Apple Inc., 680 Fed. Appx. 977, 982 (Fed. Cir. 2017)). Forescout also analogizes the ’034 Patent (as well as the ’421 Patent) to network-access- control inventions that the Federal Circuit invalidated in Prism Technologies LLC v. T-Mobile USA, Inc., 696 Fed. Appx. 1014 (Fed. Cir. 2017), Ericsson Inc. v. TCL Communication Technology Holdings Ltd., 955 F.3d 1317 (Fed. Cir. 2020), and Dropbox, Inc. v. Synchronoss

2 The if/then logic runs as follows: “[I]f the network is connected, select configuration X; but if the Technologies, 815 Fed. Appx. 529 (Fed. Cir. 2020). See Mot. at 6-8. In those cases, the Federal Circuit held that “controlling access to, or limiting permission to, resources” is an unpatentable abstract idea. See Ericsson, 955 F.3d at 1326; see also Prism, 696 Fed. Appx. at 1017 (stating that “providing restricted access to resources” is abstract); Dropbox, 815 Fed. Appx. at 532 (stating that “controlling access to data” is abstract). Forescout further argues that, much as in Prism, the claims at issue here “relate to network security functions based on . . . basic mental functions that could be performed by a human” being “keeping a mental or written list of which programs to launch when connecting to a network.” Mot. at 10. And as in Dropbox, the “determination of whether a user is connected to a ‘private network’” amounts to “nothing more than [a] functionally recited ‘black box’” that fails to explain “how the selection of a ‘configuration’ is accomplished or how the one or more ‘functions’ are ‘designated’ by the configuration.” Id. (quoting Dropbox, 815 Fed. Appx. at 532-33). This lack of explanation, Forescout contends, precludes the ’034 Patent from representing a properly technological solution to a technological problem. See id. at 10-11. Fortinet counters that the ’034 Patent “provides a concrete, technological solution” to problems of endpoint security management through “its specialized ‘client security application.’” Opp’n at 4. Specifically, the application responds to specific “problems encountered by client devices that need to connect to multiple network environments, and by computer networks that need to allow many different kinds of devices to connect to a network from both inside and outside of it.” Id. In arguing that the application offers “specific concrete solutions” to network security challenges, Fortinet analogizes this case to Enfish, where a self-referential table for a computer database claimed “multiple benefits” over conventional databases (e.g., “increased flexibility, faster search times, and smaller memory requirements”) and so constituted “an improvement to computer functionality itself.” See 822 F.3d at 1330-33, 1336-37. Enfish thus ruled that the self-referential table was not directed to an abstract idea but to a properly technological solution to a technological problem. See id. at 5 (discussing Enfish, 822 F.3d at 1336-37); see also Order at 11-12 (discussing the same passage from Enfish).3 “Several dependent claims further limit Claim 1,” Fortinet adds, “and recite various means of achieving the specific concrete solutions of the invention.” Id.; see also id. (providing examples from Claims 5- 9). In arguing that the ’034 Patent is directed to more than an abstract idea, Fortinet disputes Forescout’s contention that “the claims could be met by ‘keeping a mental or written list of which programs to launch when connecting to a network.’” Id. at 6 (quoting Mot. at 10). The “client security application’s methods of determining a ‘network connection state,’” Fortinet argues, are far more complicated than the analog comparison would allow, as the claims “may encompass information beyond what is readily accessible to a human operator.” Id. For example, “based on [a] network connection state, the client security application . . . automatically and flexibly implements its configuration by launching various features, such as web content filtering . . . [,] that are more effective at securing large computer networks when automatically deployed at scale across an entire network.” Id. (citing ’034 Patent at 5:48-65). In contrast, “the manual application of security configurations” that Forescout posits as a substitute for the ’034 Patent “is a problem to be addressed,” since “[p]ast reliance on users performing manual security tasks undercut the effectiveness of the computer itself.” Id. at 7 (citing ’034 Patent at 1:35-54) (internal quotation omitted). As with the patents contested in the previous motion to dismiss, the step-one inquiry presents a close question. First, the caselaw that the parties rely on provides only limited guidance, as it does not address technology directly analogous to that which is at issue here. See Enfish, 822 F.3d at 1334. Second, as in many “cases involving computer-related claims,” the step- one and step-two inquiries here overlap, such that “an analysis of whether there are arguably

3 As with the previous motion to dismiss, Fortinet also relies on Ancora and Packet Intelligence, where the Federal Circuit held, respectively, that method patents recited “a specific technique that depart[ed] from earlier approaches to solve a specific computer problem” and provided a “granular, nuanced, and useful” advance over previous approaches “rather than an abstract result.” Opp’n at 5-6 (quoting Ancora, 908 F.3d at 1348; Packet Intelligence, 965 F.3d at 1310); see also concrete improvements in the recited computer technology could take place under step two.” See id. at 1339; see also Ancora, 908 F.3d at 1349 (recognizing “overlaps between . . . step one and step two considerations”). The Court therefore adopts a flexible approach in “characteriz[ing] what the claims are directed to,” taking both step-one and step-two considerations into account below. See Enfish, 822 F.3d at 1339. Third, a question underlying much of the parties’ dispute concerns the role of a patent’s specification in determining whether the invention is directed to eligible subject matter at step one. The parties addressed this issue at some length during the hearing on Forescout’s motion. See, e.g., Docket No. 79 (“Hearing Tr.”) at 8-22, 37-41. The Court has reviewed the authorities cited by the parties and concludes that there exist two conflicting lines of Federal Circuit caselaw—one that stresses the role of the specification in the step-one analysis and another that minimizes it. With respect to the first line of caselaw, Enfish established that a patent’s specification can be relevant at Alice step one. There, the Federal Circuit stated that “the ‘directed to’ inquiry applies a stage-one filter to claims, considered in light of the specification, based on whether their character as a whole is directed to excluded subject matter.” 822 F.3d at 1335 (internal quotation omitted) (emphasis added). Elsewhere in the discussion, the court focused primarily on the claim language of the disputed patent, asking “whether the claims are directed to an improvement to computer functionality versus being directed to an abstract idea.” Id. (emphasis added). The Enfish court emphasized, however, that its “conclusion that the claims [were] directed to an improvement to an existing technology [was] bolstered by the specification’s teachings that the claimed invention achieves other benefits over conventional” technology in the field. Id. at 1337 (emphasis added). Enfish therefore made clear that a specification may serve, at a minimum, to “bolster[]” or “confirm” a court’s interpretation of standalone claim language.4 See id. at 1337, 4 As Forescout observed during the motion hearing, Hearing Tr. at 40, the patent at issue in Enfish was a means-plus-function invention under 35 U.S.C. § 112(f), which requires that courts first “determine the claimed function” and then “identify the corresponding structure in the written description of the patent that performs the function.” See 822 F.3d at 1336 & n.3 (internal quotation omitted). While the Enfish court may therefore have been unusually solicitous of the specification given the nature of the disputed patent, the court did not expressly limit its analysis 1339. The Federal Circuit went further in CardioNet, where it reversed a district court’s invalidation, on § 101 grounds, of a patent related to cardiac monitoring technology. See 955 F.3d at 1362. In framing the “directed to” inquiry, the court stated that while it looks first to claim language it “also consider[s] the patent’s written description, as it informs [the court’s] understanding of the claims.” Id. at 1367-68; see also id. at 1368 (quoting Chamberlain Group, Inc. v. Techtronic Industries Co., 935 F.3d 1341, 1346 (Fed. Cir. 2019), for the principle that a “specification [is] helpful in illuminating what a claim is ‘directed to’”). And when the court performed the step-one analysis, it devoted less attention to the claim language than to the specification, particularly its explanation of how “the claimed invention achieves multiple technological improvements” over the prior art. See id. at 1368-69. The court also emphasized the role of the dependent claims in showing that the invention satisfied Alice step one, “as they further specif[ied] the physical features or operations” of the patented device. Id. at 1369. In upholding the disputed patent on § 101 grounds, the CardioNet court analogized to earlier cases in which the Federal Circuit did likewise. Specifically, it pointed to Visual Memory LLC v. NVIDIA Corp., 867 F.3d 1253 (Fed. Cir. 2017), where the court ruled that the contested claims were “directed to an improved computer memory system, not to [an] abstract idea.” CardioNet, 955 F.3d at 1369 (quoting Visual Memory, 867 F.3d at 1257, 1259). The CardioNet court then noted (without any discussion of the actual claim language at issue in Visual Memory): “Important to our determination was the fact that the written description described technical ‘advantages offered by’ the claimed memory system,” such as the system’s ability “to accommodate ‘different types of processors.’” Id. (quoting Visual Memory, 867 F.3d at 1259-60). “Weighing ‘all factual inferences drawn from the specification . . . in favor of Visual Memory, the non-moving party,’ [the court] reversed the district court’s decision that the claims were ineligible.” Id. (quoting Visual Memory, 867 F.3d at 1362). Visual Memory was therefore analogous to CardioNet, where the patent’s “written description identifie[d] a number of advantages gained by the elements recited in the claimed cardiac monitoring device.” Id. The [its] determination that the claims [were] drawn to a technological improvement” and thus satisfied Alice step one. Id. at 1370. Taken together, CardioNet and Visual Memory seem to stand for the proposition that a patent’s specification may play an “important” role in the step-one, or “directed to,” inquiry and that a district court should consider the specification when deciding whether the patent is focused more on an abstract idea or a technological solution to a technological problem. See id. at 1367- 70. These cases also stress that “all factual inferences drawn from the specification” are to be resolved in favor of the nonmoving party at the pleadings stage. See id. at 1369. And unlike other recent cases such as Ericsson and Dropbox, which suggest that computer-based inventions must “describe how to solve the [technological] problem” they address in meaningful detail, see Dropbox, 815 Fed. Appx. at 533 (emphasis in original), neither CardioNet nor Visual Memory focus on this issue in upholding subject-matter eligibility at step one. See CardioNet, 955 F.3d at 1368-69; see also Visual Memory, 867 F.3d at 1260-61 (drawing inferences about “how to implement the claimed invention” in favor of the non-moving party on a motion to dismiss and stating that such a question is, in any event, “an enablement issue under 35 U.S.C. § 112, not an eligibility issue under § 101”). In American Axle & Manufacturing, Inc. v. Neapco Holdings LLC, 967 F.3d 1285 (Fed. Cir. 2020), however, the Federal Circuit minimized the role of the specification at Alice step one and instead emphasized “the failure of the claims to designate how to achieve the desired result.” Id. at 1302. There, the court held that a patent claim concerning driveline propeller shafts was directed to ineligible subject matter. Specifically, the claim was “directed to the mere application” of a law of nature “to achieve the [invention’s] desired result” and failed to “provid[e] [a] particular means of how . . . to do so.” See id. at 1291; see also id. at 1294-95 (reaching the same conclusion).5 In conducting the step-one inquiry, the American Axle court stated that relevant 5 In developing this argument, the American Axle majority refuted the dissent’s objection that the majority had “improperly merg[ed] enablement and eligibility” inquiries. See 967 F.3d at 1302. Section 101, the court stated, “is concerned with whether the claims are directed to” ineligible subject matter, “not whether the specification has adequately described how to make and use the Supreme Court caselaw “focus[es] on the claims, not the specification, to determine section 101 eligibility,” and that, according to Federal Circuit precedent, “features that are not claimed are irrelevant as to step 1 or step 2 of the Mayo/Alice analysis.” Id. at 1293 (emphasis added); see also Accenture, 728 F.3d at 1345 (“[T]he level of detail in the specification does not transform a claim reciting only an abstract concept into a patent-eligible system or method.”). Accordingly, the court’s “directed to” inquiry focused almost exclusively on “the face of the claim,” not the specification, in concluding that the claim was entirely functional and lacked the requisite specificity to satisfy § 101. See Am. Axle, 967 F.3d at 1294; see id. at 1298 (referring to the “claim on its face”). American Axle thus provides that a patent’s claimed limitations are paramount at Alice step one, and that limitations contained only in a specification are “irrelevant” to the § 101 analysis. See id. at 1293. Given the Federal Circuit’s ambiguous caselaw on the question of the specification’s precise role at step one of the Alice test, as well as the level of detail the invention must provide in explaining how it functions, the Court believes it prudent, at this still-early stage of the litigation, to construe the focus of the ’034 Patent “in light of the specification,” Enfish, 822 F.3d at 1335, and to credit the specification’s account of whether and how “the claimed invention achieves multiple technological improvements” over the prior art, CardioNet, 955 F.3d at 1368-69. The Court nevertheless agrees with Forescout that Claim 1 of the ’034 Patent appears, on its face, to be abstract. According to Claim 1, the method entails a client security application enabling a client device (1) to “determin[e]” its “network connection state,” (2) to “select[] . . . a configuration for the client security application” based on this network connection state, and (3) to “launch[] . . . one or more” predetermined “functions of the client security application,” including “web content filtering, anti-virus scanning, [or] network access logging.” See’034 Patent at Clm. As Forescout argues, this relatively simple three-step process seems directed to little more than “the abstract idea of making a selection based on a condition.” Docket No. 74 (“Reply”) at 1. The claim language also lacks the kind of technological specificity concerning how the invention’s desired result (i.e., improved endpoint security management) is achieved that the Federal Circuit has oftentimes required to satisfy step one. See, e.g., Dropbox, 815 Fed. Appx. at 532-33; Ericsson, 955 F.3d at 1326 (holding an invention abstract at step one where, inter alia, it did “not specify how the claim” achieved its desired result). Restricted solely to the language of Claim 1, therefore, the Court would have little trouble concluding that the ’034 Patent recites ineligible subject matter at Alice step one. As Fortinet contends, however, other features of the ’034 Patent suggest that it may satisfy the step-one inquiry, at least in light of cases such as CardioNet and Visual Memory. First, several dependent claims refer to specific technological features that plausibly restrict the invention to the realm of the technologically concrete rather than the abstract. Claim 5, for example, comprises a limitation of dependent Claim 3, and entails a “Dynamic Host Configuration Protocol (DHCP) client of the client device” sending a “DHCP packet to a network appliance” and then “receiving . . . an acknowledgment DHCP packet” that contains the appliance’s “identification information.” ’034 Patent at Clm. 5. Claim 8 then further limits Claim 5 so that the aforementioned functions “include one or more of Secure Sockets Layer (SSL)/Internet Protocol Security Protocol (IPSec) Virtual Private Networking (VPN), application firewalling, two-factor authentication, vulnerability scanning and Wide Area Network (WAN) optimization.” Id. at Clm. 8. While Forescout insists that such features are merely “conventional,” Reply at 4, the Court is unable to deduce as much from the claims themselves or the specification. Rather, these dependent-claim limitations seem to “further specif[y] the physical features or operations” of the patented device, suggesting that it is directed to something that is technologically concrete. See CardioNet, 955 F.3d at 1369. Additionally, the ’034 Patent’s specification provides reasonably detailed explanations of how the invention functions in preferred embodiments and suggests “that the claimed invention achieves [multiple] benefits over conventional” technology in the field. See Enfish, 822 F.3d at 1337. Describing Figure 5, for instance, the specification explains that “[a]fter the appropriate configuration is selected based on the client device’s network environment state . . . the client associated with the corresponding configuration.” ’034 Patent at 8:55-59. The specification then provides a more detailed example of how the startup procedure works: “[W]hen an off-net configuration is selected and SSL/IPsec VPN and web filtering are enabled . . . the client security application launches a VPN dial-up module and establishes a VPN connection with a gateway of a private network using predefined VPN parameters.” Id. at 8:59-65. Based on details like these in the specification, it may be argued that the’034 Patent is “more effective at securing large computer networks when automatically deployed at scale across an entire network,” and that the manual version of patent’s security tasks “reduc[es] the security of the entire network by limiting compliance with security protocols to that provided by human users.” See id. at 6-7 (citing ’034 Patent at 1:35-54). Absent further developments in this case (e.g., claim construction or expert testimony), the Court is reluctant to reach a conclusion at this stage as to whether “the claimed invention achieves multiple technological improvements” over the prior art. See CardioNet, 955 F.3d at 1368-69. Nevertheless, even if the Court were to find the ’034 Patent directed to ineligible subject matter at step one, it would be hard pressed to reach the same conclusion at step two— recognizing, again, that “an analysis of whether there are arguably concrete improvements in the recited computer technology could take place under” either step one or step two. See Enfish, 822 F.3d at 1339. The step-two inquiry, as stated above, focuses on whether the claims contain an “inventive concept,” i.e., “a claim element or combination of elements” that goes beyond that which is “well-understood, routine[,] and conventional to a skilled artisan in the relevant field.” Berkheimer, 881 F.3d at 1368. Here, Fortinet plausibly argues that “fact questions exist as to whether the limitations of at least Claims [1 and 5] contain features, either individually or in an ordered combination, that are non-generic, not well understood, and not well known.” Opp’n at 15. Claim 5, as noted above, involves “sending, by a [DHCP] client of the client device, a DHCP packet to a network appliance of the one or more network appliances,” and then “receiving[,] by the DHCP client, an acknowledgement DHCP packet containing . . . identification information.” ’034 Patent at Clm. 5. value of the serial number of the one or more network appliances, (ii) a unique name of the one or more network appliances or (iii) a hash value of a plurality of serial numbers of the one or more network appliances.” Id. at Clm. 14. Again, the Court cannot conclude at this stage of the litigation that clear and convincing evidence proves this combination of claim elements to be “well-understood, routine[,] and conventional to a skilled artisan in the relevant field.” See Berkheimer, 881 F.3d at 1368. The Court therefore declines, at this time, to hold the ’034 Patent invalid on the grounds of § 101, whether viewed in light of the step-one or step-two analyses, or as a consolidation thereof. The Court clarifies that its ruling here is not prejudicial to Forescout’s ability to renew its subject- matter-eligibility arguments at a later stage of the litigation, such as at summary judgment. The Court also observes that, as with the ’314, ’299, and ’662 Patents, it remains skeptical of the ultimate validity of ’034 Patent, especially given Fortinet’s failure, to this point, to articulate meaningful differences between the patent’s independent and dependent claims. For now, however, the Court DENIES Forescout’s motion to dismiss on the grounds that the ’034 Patent claims ineligible subject matter. 2. The ’421 Patent The ’421 Patent claims “[s]ystems and methods . . . for conducting work flows by [a Security Information and Event Management (“SIEM”)] device to carry out a complex task automatically.” ’421 Patent at Abstract. Claim 1, one of the patent’s two independent claims and the focus of the parties’ discussion in their moving papers, recites:

1. A method comprising:

[1] creating, by a security information and event management (SIEM) device associated with a private network, a work flow, said work flow including information defining a plurality of security tasks that are to be performed by one or more security devices associated with the private network and managed by the SIEM device, wherein the plurality of security tasks include operations that are intended to protect the private network against attacks;

[2] starting, by the SIEM device, the work flow by scheduling the one or more security devices to perform the plurality of security tasks defined in the work flow; and security tasks after they are performed by the one or more security devices. Id. at Clm. 1 (bracketed numbers added). According to the patent’s specification, contemporary computer networks “may comprise hundreds of . . . devices located in different places, including multiple security devices deployed to protect the network from attacks.” Compl. ¶ 39 (citing ’421 Patent at 1:21-25). As part of these networks, SIEM devices “may be deployed to aggregate results of tasks performed by the various security devices on a network and alert network administrators” in event of a security breach. Id. (citing ’421 Patent at 1:30-35). But “problems arise in that the tasks conducted by these disparate security devices are independent,” and so may involve “different parameters” and “different configurations depending on the device . . . and its manufacturer.”6 Id. (citing ’421 Patent at 1:35- 36). There was thus “a need for improved SIEM devices that may schedule multiple complex tasks of various security devices to achieve comprehensive management of multiple security devices.” Id. (citing ’421 Patent at 1:43-55). The ’421 Patent allegedly solved this problem “in a non-conventional way by having the SIEM configured to allow users [1] to create a work flow that includes multiple security tasks to be performed by one or more security devices, [2] performing these tasks, and [3] collecting the results of these tasks after they are performed.” Id. (citing ’421 Patent at 1:50-60, 18:17-42) (bracketed numbers added). As with the ’034 Patent, the Amended Complaint asserts that “[t]he claims of the ’421 Patent include inventive concepts” and that “the ordered combination of the recited limitations is not generic and was neither routine nor conventional at the time of invention.” Id. In arguing that the ’421 Patent is directed to ineligible subject matter, Forescout argues that the “idea of ‘conducting work flows’ to carry out tasks and then collecting data about those tasks is a longstanding human activity,” and that the patent merely automates this abstract idea. Mot. at 11; see also id. at 12 (asserting that the ’421 Patent is directed to the idea of “organizing a list of tasks and collecting data related to them,” which is “a basic mental process that could be

6 At the motion hearing, Fortinet offered, as a simple example of the problem the ’421 Patent was performed” manually).7 Forescout analogizes the claims at issue here those in Yodlee, Inc. v. Plaid Technologies Inc., 2016 WL 2982503 (D. Del. May 23, 2016), where the court observed that “individuals have long identified sub-tasks of a more complex undertaking, managed the completion of such sub-tasks, and conveyed the results to the requesting party.” Id. (quoting 2016 WL 2982503, at *17). To illustrate its point, the court offered the example of “a travel agent planning a trip,” which involves identifying sub-tasks (such as booking flights and reserving hotel rooms), contacting third parties (such as airlines and hotels) to complete those tasks, and relaying the results of those tasks back to the customer. Id. (quoting 2016 WL 2982503 at *17). “The ’421 Patent,” Forescout concludes, “merely takes this concept and limits it to the field of network security”—a maneuver that does not make otherwise abstract ideas patentable under § 101. Id. (citing SAP, 898 F.3d at 1169). Forescout further argues that the ’421 Patent is infected with the same “black box” problem identified in Dropbox, as the key terms of Claim 1 (e.g., “work flow,” “functions,” and “security tasks”) are “described in functional language” and the patent “fail[s] to limit how” they work. Id. at 13. Forescout lastly urges that all of the dependent claims “are directed to the same abstract idea as claim 1.” Id. Fortinet counters that the ’421 Patent solves the technological problem of a “need for improved SIEM devices that may schedule multiple tasks of various security devices to automatically achieve comprehensive management.” Opp’n at 8 (quoting ’421 Patent at 1:43-46). Fortinet explains that the SIEM device “presents advancements over the prior art” by, for example, “allow[ing] for ‘the results of previous tasks in the work flow [to] be transferred to subsequent tasks’”; earlier SIEM devices, in contrast, “could not take the results of one security task and transfer them to another task.” Id. at 9 (quoting ’421 Patent at 1:37-39, 2:40-42). Fortinet also disputes Forescout’s analogy to the Yodlee court’s travel-agent example, arguing that the ’421 Patent does not claim the work flow, but “the transformation of it into specific tasks by a specialized SIEM device coordinating with a variety of security devices, and then executing those

7 As with the ’034 Patent, Forescout associates the claimed method with the abstract idea in tasks.” Id. (citing ’421 Patent at 12:23-25). Fortinet offers that the ’421 Patent “improve[s] the functioning of large networks comprising many security devices.” Id. at 10; see also Enfish, 822 F.3d at 1339 (upholding subject-matter eligibility at Alice step one where the invention was directed to “concrete improvements in the recited computer technology” rather than an abstract idea). Fortinet also rejects Forescout’s contention that the claims describe “black boxes,” as the claims recite specific technological components (e.g., a SIEM device and “work flow templates”), id., and the specification further “explain[s] how the elements recited in the claims refer to specific technological features,” id. (quoting Packet Intelligence, 965 F.3d at 1310). The Court again conducts the step-one inquiry in light of the Federal Circuit’s forgiving standard for subject-matter eligibility, as articulated in CardioNet and Visual Memory. To start, the language of Claim 1 of the ’421 Patent is again abstract. The claim “on its face” involves three straightforward steps performed by a SIEM device: (1) “creating . . . a work flow” that includes “security tasks” performed by other “security devices” on a computer network, (2) “starting . . . the work flow . . . by scheduling” the security devices “to perform” the security tasks, and (3) “collecting . . . results” of the security tasks after the security devices perform those tasks. See ’421 Patent at Clm. 1; see also Am. Axle, 967 F.3d at 1294, 1298 (focusing on “the face of the claim”). Whether or not the abstract idea to which the method is directed is merely “organizing and monitoring the completion of tasks,” as Forescout suggests, Claim 1 is written in functional terms and lacks the kind of specific “limiting detail that confines the claim to a particular solution to an identified problem.” See Affinity Labs, 838 F.3d at 1269; cf. Am. Axle, 967 F.3d at 1298 (stating that an invention may successfully incorporate ineligible subject matter where it provides “a specific and detailed series of steps . . . that limit[] the possibility of preempting the [ineligible subject matter] itself”). Additionally, Forescout’s analogy between the three-step process of Claim 1 and the travel-agent example in Yodlee is revealing, suggesting that the conversion of work flows in Claim 1 “into specific tasks [monitored] by a specialized [actor] coordinating with a variety of [other actors], and then executing those tasks,” closely resembles longstanding analog versions of work Claim 1 patent-eligible, as limiting otherwise abstract “claims to a particular field of invention”— e.g., network security—“does not move the claims out of the realm of abstract ideas.” See SAP, 898 F.3d at 1169; see also Credit Acceptance Corp. v. Westlake Servs., 859 F.3d 1044, 1055 (Fed. Cir. 2017) (stating that “mere automation of manual processes using generic computers does not constitute a patentable improvement in computer technology”). As with the ’034 Patent, however, Fortinet raises colorable arguments in favor of finding the ’421 Patent non-abstract at step one. Fortinet notes, first, the greater degree of technological specificity contained in some of the patent’s dependent claims. For example, Claim 11 derives from Claim 1 but limits the aforementioned work flow to “a website automatic discovery work flow” and the aforementioned security tasks to “a service discovery, a test Hypertext Transfer Protocol (HTTP) service and a website scan.” ’421 Patent at Clm. 11. And Claim 13, which also depends from Claim 1, confines the work flow to “a closed-loop security event processing work flow,” which in turn “comprises event collecting, leakage verification and emergency response processing.” Id. at Clm. 13. This level of computer-oriented detail suggests that the ’421 Patent—at least in its dependent claims—may be “understood as being necessarily rooted in computer technology in order to solve a specific problem in the realm of computer networks.” See SRI Int’l, 930 F.3d at 1303. Fortinet also looks to the specification, which asserts that the specialized SIEM device “presents significant advancements over the prior art.” Opp’n at 9. The specification states that earlier SIEM devices could perform many of the tasks claimed by the’421 Patent but that they were hindered by the “different parameters” of “security devices from different manufacturers” and could not transfer the results of one security task to another. ’421 Patent at 1:30-43. “Thus, there is a need,” the specification concluded, “for improved SIEM devices that may schedule multiple tasks of various security devices to automatically achieve comprehensive management.” Id. at 1:43-46. And in one preferred embodiment of the invention, the SIEM device schedules a work flow in which the constituent security tasks are “sequentially or concurrently executed by multiple security devices despite the security devices being from different manufacturers and/or Patent’s specification therefore “identifies a number of advantages gained by the elements recited in the claimed” invention, and the Court must “accept those statements as true and consider them important” in conducting the step-one inquiry. See CardioNet, 955 F.3d at 1369-70. The specification also mitigates concerns that the ’421 Patent is merely a “black box,” see Dropbox, 815 Fed. Appx. at 533, as it contains lengthy explanations about how the invention’s preferred embodiments function. The discussion of Figure 2, for example, runs from the middle of column 6 to the top of column 12, and identifies such specific components as a “device adapter layer,” “a WAF,” “an IPS/IDS,” and “a vulnerability scanner.” ’421 Patent at 11:62-65. This level of detail in identifying the embodiment’s hardware components arguably suggests that the patent provides specific guidance on how it operates and achieves its intended result. On the other hand, it is not clear that this type of specificity actually provides “a specific and detailed series of steps” for performing the claimed method sufficient to satisfy step one. See Am. Axle, 967 F.3d at 1298. As noted above with respect to the ’034 Patent, that determination would benefit from further developments in the case, such as claim construction and expert testimony. Further, if the Court were to find the ’421 Patent directed to an abstract idea at step one, it would once more have difficulty concluding, on a motion to dismiss, that the patent lacks an inventive concept at step two. Fortinet argues, for instance, that the ’421 Patent’s “specialized SIEM device” was “neither well-understood, routine, nor conventional” in the prior art, as it achieved novel benefits by scheduling and executing security tasks automatically and comprehensively. See Opp’n at 15-16 (citing, e.g., ’421 Patent at 1:37-46). Fortinet further contends that even if the ordered combination of Claim 1’s elements was generic, routine, or conventional, the dependent claims’ elements are not. Claims 2 and 13, for example, “introduce additional elements into [the patent’s] ordered combination, including the ability to create template work flows” and “the use of a closed-loop security event processing work flow.” Id. at 16 (citing ’421 Patent at Clms. 2 and 13). As Fortinet again emphasizes, “the question of whether the recited steps and features constitute an inventive concept is a fact question that must be decided in Fortinet’s favor at th[e] motion to dismiss stage.” Id. (citing Berkheimer, 881 F.3d at the parties’ dispute, especially “given, for example, Forescout’s sweeping interpretation of the claim term ‘security tasks.’” Id. The Court therefore declines to hold, at this stage of the litigation, that the ’421 Patent claims ineligible subject matter. It notes, however, that it remains doubtful of the patent’s ultimate validity on § 101 grounds, and that Fortinet will face a higher bar in demonstrating as much as the case progresses. The Court thus DENIES Forescout’s motion to dismiss the ’421 Patent on the grounds of subject-matter eligibility, but its ruling here is without prejudice to Forescout’s ability to re-raise the § 101 issue later in the proceedings. B. Infringement Allegations Section 271(a) of the Patent Act provides that “whoever without authority makes, uses, offers to sell, or sells any patented invention . . . during the term of the patent therefor, infringes the patent.” 35 U.S.C. § 271(a). Infringement may be either direct or indirect but “liability for indirect infringement of a patent requires direct infringement” by a third party. See In re Bill of Lading Transmission & Processing Sys. Patent Litig., 681 F.3d 1323, 1333 (Fed. Cir. 2012). Based on the Court’s resolution of Forescout’s earlier motion to dismiss, the parties do not dispute that Fortinet has sufficiently alleged direct infringement of the asserted patents by Forescout’s “customers, purchasers, users[,] and developers.” See Order at 21. The parties instead contest the sufficiency of the Amended Complaint’s factual allegations in stating claims for induced, contributory, and willful infringement. 1. Induced Infringement Under § 271(b) of the Patent Act, “[w]hoever actively induces infringement of a patent shall be liable as an infringer.” 35 U.S.C. § 271(b). Addressing the intent element of this provision, the Supreme Court has held that induced infringement “requires knowledge that the induced acts constitute patent infringement.” Glob.-Tech Appliances, Inc. v. SEB S.A., 563 U.S. 754, 766 (2011). Thus, a plaintiff alleging inducement must show that the defendant “both (1) ‘knew of the patent’ and (2) knew as well ‘that the induced acts constitute patent infringement.’” Google LLC v. Princeps Interface Techs., 2020 WL 1478352, at *3 (N.D. Cal. Mar. 26, 2020) Glob.-Tech, 563 U.S. at 766 (first holding that “induced infringement under § 271(b) requires knowledge that the induced acts constitute patent infringement”). The Supreme Court has further clarified, however, that a defendant’s good-faith “belief regarding validity cannot negate the scienter required under § 271(b),” as the statutory language requiring that a defendant “actively induce[d] infringement” requires only an “intent to ‘bring about the desired result,’ which is infringement.” See Commil, 575 U.S. at 642 (quoting Glob-Tech, 563 U.S. at 760) (emphasis added); cf. id. at 648 (“Because only valid patents can be infringed, anyone with a good-faith belief in a patent’s invalidity necessarily believes the patent cannot be infringed. And it is impossible for anyone who believes that a patent cannot be infringed to induce actions that he knows will infringe.”) (Scalia, J., dissenting). In its prior order, the Court found that Fortinet’s allegations of inducement were sufficiently pled. The Court first noted that Forescout possessed knowledge of its allegedly infringing activity at least as of the filing of the original complaint; as a result, “the crux of the inducement question [was] whether Fortinet ha[d] set forth sufficient facts showing a specific intent to encourage another’s infringement.” Order at 22 (internal quotation omitted). The original complaint stated that “Forescout ‘instruct[s], direct[s], and/or requir[es] others, including customers, purchasers, users and developers, to perform some of the steps of the method claims’ via specific instructional materials on Forescout’s website.” See id. (quoting, e.g., Docket No. 1 ¶ 39). The complaint also described the content of Forescout’s instructional materials (specifically in their teaching of how to infringe the asserted patents) in additional detail and provided URLs for those materials. See id. at 23 (citing, e.g., Docket No. 1 ¶¶ 72-73). The Court held that the first set of allegations, standing alone, was insufficient to state a claim for inducement because it failed to show that the defendant possessed the requisite specific intent. Id. (citing Hypermedia Navigation v. Google LLC, 2019 WL 1455336, at *3 (N.D. Cal. Apr. 2, 2019)). But the Court found that Fortinet’s second set of allegations was adequate to plead inducement because the “numerous references to public material on [the defendant’s] website . . . give rise to an inference of specific intent,” and suggest that Forescout’s materials “actively coached customers to use the 316 F. Supp. 3d 1112, 1135 (N.D. Cal. 2018) and Firstface Co., Ltd. v. Apple, Inc., 2019 WL 1102374, at *1 (N.D. Cal. Mar. 8, 2019)). The Court nevertheless encouraged Fortinet to “provide greater clarity and specificity in its inducement allegations” in any future pleading. Id. at 23-24. In the instant motion, Forescout acknowledges that the Court previously sustained Fortinet’s inducement claims but argues that “Fortinet did not comply” with the Court’s instructions to allege more specific facts in its Amended Complaint. Mot. at 22. Fortinet responds that it complied with the earlier order, pointing to new paragraphs 48, 63, and 78 in the Amended Complaint, which concern the three previously asserted patents, and paragraphs 93 and 104, which concern the two newly asserted patents. See Opp’n at 20-21 & n.3. Fortinet thus argues that it has “further bolstered” factual allegations already deemed sufficient to survive a motion to dismiss. See id. at 22. Fortinet has sufficiently pled inducement with respect to both the original and newly asserted patents. For example, Paragraphs 93 and 94 of the Amended Complaint, concerning the ’034 Patent, read as follows:

Forescout's technical documentation evidences specific intent, at least as of the filing [of] this Amended Complaint, to encourage infringement of the ’034 Patent. Forescout's CounterACT Admin Guide (https://www.forescout.com/wp- content/uploads/2018/11/counteract administration-guide-8.0.1.pdf), its HPS Inspection Engine Configuration Guide (https://www.forescout.com/company/resources/hps-inspection- engine-configuration-guide-10-7-1/), its SecureConnector Advanced Features How-to Guide (https://www.forescout.com/company/resources/secure-connector- advanced-features-how-to-guide-8-0/), and its Forescout Windows Applications Configuration Guide (https://www.forescout.com/company/resources/windows- applications-19-0-12/) instruct users on how to infringe the claims of ’034 Patent. These materials actively coach users to use the ’034 Accused Products in an infringing manner. Indeed, these materials instruct customers to infringe each and every element of at least claim 1 of the ’034 Patent and, on their own, fully support Fortinet's allegations of infringement.

By at least the filing of this Amended Complaint, Fortinet disclosed the existence of the ’034 patent and identified at least some of Forescout's and others' activities that infringe the ’034 patent. Thus, based on this disclosure, Forescout had knowledge of the ’034 patent, including claim 1, and that its activities infringe the ’034 known or should have known since at least the filing of this Amended Complaint that its customers, distributors, suppliers, and other purchasers of the ’034 Accused Products are infringing the ’034 patent, including claim 1. Compl. ¶¶ 93-94 (emphasis added). Fortinet’s inducement allegations with respect to the ’421 Patent contain a similar amount of factual detail. See id. ¶¶ 103-04, 108. These references to particular instructional materials, inclusion of URLs for those materials, and allegations that Fortinet “disclosed the existence of the [asserted patents]” to Forescout and that the materials “instruct customers to infringe each and every element of at least claim 1 of [each] Patent,” id. ¶ 93, plausibly state a claim for induced infringement. Forescout protests that Fortinet fails to “link[] any specific part of a manual to any specific patent claim infringement allegation.” Reply at 12-13. But that information can be “further detailed in Fortinet’s infringement contentions” as the litigation proceeds. See Opp’n at 21. At present, the Amended Complaint gives Forescout adequate notice of the nature of Fortinet’s inducement claims and the specific instructional materials that Fortinet will use to support those claims, which is all that is required by Rule 8. The Court therefore DENIES Forescout’s motion with respect to Fortinet’s claim for induced infringement. 2. Contributory Infringement Under § 271(c) of the Patent Act, a plaintiff pleading contributory infringement must show that the defendant sells (or offers to sell) a component of a patent, “knowing the same to be especially made or especially adapted for use in an infringement of such patent, and not a staple article or commodity of commerce suitable for substantial noninfringing use.” 35 U.S.C. § 271(c). The plaintiff must “provide factual underpinnings for its allegations” that the accused products are made or especially adapted for an infringing use and “that there are no substantial noninfringing uses of the accused devices.” Uniloc USA, Inc. v. Logitech, Inc., 2018 WL 6025597, at *3 (N.D. Cal. Nov. 17, 2018). A complaint that “merely paraphrases the contributory infringement statute and presents no factual underpinnings” fails to satisfy Rule 8 and must be dismissed. Google, 2020 WL 1478352, at *5. plead contributory infringement. The complaint contained only a single paragraph, repeated for each asserted patent, that simply “parrot[ed]” the contributory infringement statute. See Order at 24. While the Court allowed that these statements could suggest that the accused products are “especially made or especially adapted for an infringing use,” the statements failed to “allege facts establishing that Forescout’s products are not suitable for a substantial non-infringing use.” Id. at 24-25. The Court thus granted Forescout’s motion to dismiss with leave to amend. Id. at 25. Forescout observes that Fortinet’s Amended Complaint still “includes only a single . . . paragraph alleging contributory infringement,” repeated five times for each asserted patent and with the name of Forescout’s accused product substituted accordingly. The relevant paragraph reads:

On information and belief, Forescout further contributes to the infringement of one or more claims of the ’314 patent under 35 U.S.C. § 271(c) by offering to sell, selling, and/or importing into the United States a component of the ’314 Accused Products, or a material or apparatus for use in practicing a process claimed in the ’314 patent, that constitutes a material part of the invention, knowing the same to be especially made or especially adapted for use in an infringement of the ’314 patent, including claim 1, and is not a staple article or commodity of commerce suitable for substantial noninfringing use. The Forescout CounterACT software as sold by Forescout includes software components (e.g., the Guest Management Portal) which are programmed to be used to infringe the methods for delegating limited admin control through the use of sets of profiles and templates. These software components, sold as part of CounterACT, are especially made for an infringing use, and have no substantial noninfringing use other than to practice the claimed methods. Compl. ¶ 50 (emphasis added); see also id. ¶¶ 65, 80, 95, 110. The paragraph’s first sentence is a verbatim repetition of the sentence that comprised the entirety of the contributory-infringement allegation in the original complaint. The second and third sentences (italicized above) have been newly added to the Amended Complaint. The issue, therefore, is whether Fortinet’s new allegation that each accused product “includes software components . . . which are programmed to be used to infringe the [patented] methods” suffices to state a claim for contributory infringement. Forescout argues that the statement “at most relates to the first prong of the contributory infringement test, i.e., that ‘the Forescout contends, the statement “contains no ‘factual underpinnings’ for any allegation ‘that there are no substantial noninfringing uses of the accused products,’” which was the basis for the Court’s dismissal of Fortinet’s earlier contributory infringement claims. Id. (quoting Order at 24). Fortinet responds by comparing its new allegation to those that have been found sufficient to state a claim for contributory infringement in this District and elsewhere. In Software Research, this Court found the allegation that an accused product, “when used in its normal and intended usage . . . , infringes” adequate to show “that there are no other substantial uses of” the accused product “that do not infringe.” Opp’n at 18 (quoting Software Rsch., 316 F. Supp. 3d at 1136). Similarly, in Firstface the court held the allegation that accused products were “specifically programmed and/or configured to implement” the asserted patents sufficient for pleading contributory infringement. Id. at 19 (quoting Firstface, 2019 WL 1102374 at *2). And in PanOptis Patent Management LLC v. BlackBerry Corp., the court found the allegation that accused products were “installed and configured” by the defendant “to practice the patented operations and structures” adequate for showing that the products had no substantial non- infringing uses. See id. (discussing PanOptis, 2017 WL 780885, at *5 (E.D. Tex. Feb. 10, 2017)). Fortinet thus concludes that while a “plaintiff must ‘plead facts that allow an inference that the components sold or offered for sale have no substantial non-infringing uses’ in order to state a contributory infringement claim,” id. at 20 (quoting In re Bill of Lading, 681 F.3d at 1337) (emphasis added), a plaintiff need not “prove that the accused products have no substantial non- infringing uses at the pleading stage,” id. at 18 (quoting Software Research, 316 F. Supp. 3d at 1136) (emphasis added). While the issue is a close one, the Court finds the Amended Complaint’s allegations sufficient. Under Twombly and Iqbal, a complaint must allege facts sufficient to make the plaintiff’s entitlement to relief plausible (rather than probable, on the one hand, or merely possible, on the other). See, e.g., Iqbal, 556 U.S. at 678. The new allegations state a plausible claim that the accused products are “made or especially adapted” for an infringing use and that they lack any “substantial noninfringing use.” See 35 U.S.C. § 271(c). The Amended Complaint substantial noninfringing use other than to practice the claimed methods.” See, e.g., Compl. ¶ 50. It also identifies the specific “component” of each accused product that is alleged to infringe Fortinet’s patents. See id. Admittedly, some degree of conclusory pleading is inherent where a plaintiff seeks to “prove a negative,” i.e., that an accused product is incapable of a substantial non- infringing use. See Hearing Tr. at 42. But the allegations that Forescout’s software components are “programmed . . . to infringe,” Compl. ¶ 50, are sufficient to “allow an inference that the components . . . have no substantial non-infringing uses.” See In re Bill of Lading, 681 F.3d at 1337 (emphasis added). The Court therefore DENIES Forescout’s motion with respect to Fortinet’s contributory infringement claim. 3. Willful Infringement Section 284 of the Patent Act directs courts to award a prevailing claimant “damages adequate to compensate for the infringement” and “may increase the damages up to three times the amount found or assessed.” 35 U.S.C. § 284. The Supreme Court has held that while district courts should “take into account the particular circumstances of each case in deciding whether to award [enhanced] damages,” “such punishment should generally be reserved for egregious cases typified by willful misconduct.” See Halo Elecs., Inc. v. Pulse Elecs., Inc., 136 S. Ct. 1923, 1934 (2016). Enhanced damages, that is, “are not to be meted out in a typical infringement case, but are instead designed as a ‘punitive’ or ‘vindictive’ sanction for egregious infringement behavior,” i.e., behavior that is “willful, wanton, malicious, bad-faith, deliberate, consciously wrongful, flagrant, or . . . characteristic of a pirate.” Id. at 1932. “Since Halo, courts in this District have required willful infringement claims to show both knowledge of the . . . [p]atents and egregious’ conduct in order to survive a motion to dismiss.” Google, 2020 WL 1478352, at *2 (emphasis in original) (internal quotation omitted). A defendant’s culpability for egregious conduct “is generally measured against the knowledge of the actor at the time of the challenged conduct.” Halo, 136 S. Ct. at 1933 (emphasis added). “The subjective willfulness of a patent infringer,” therefore, “may warrant enhanced damages, without regard to whether his infringement was objectively reckless.” In its prior order, the Court ruled that Fortinet’s original complaint failed to offer “factual allegations supporting [the theory] that Forescout has engaged in ‘egregious conduct.’” Order at 25. Fortinet’s previous willful infringement claim was pled in a single paragraph (repeated for each asserted patent), which stated that “Forescout [has] act[ed] recklessly and continues to willfully, wantonly, and deliberately engage in acts of infringement of the’ asserted patents.” Id. at 26 (quoting Docket No. 1 ¶ 9). The Court analogized Fortinet’s allegations to those in Finjan, Inc. v. Cisco Systems, Inc., 2017 WL 2462423, at *12-15 (N.D. Cal. June 7, 2017), and Google v. Princeps, supra, where courts held that “conclusory allegations of knowledge and infringement could not satisfy” Halo’s egregious-conduct requirement. See Order at 26-27. While the original complaint established that “Forescout had knowledge of its infringement once the complaint was filed,” it failed to establish that Forescout had engaged in “egregious” misconduct. Id. at 27. In its Amended Complaint, Fortinet again seeks “increased damages under 35 U.S.C. § 284.” See, e.g., Compl. ¶¶ 57. The pleading again includes a single allegation of willful infringement, repeated almost verbatim for each of the asserted patents, which reads:

Despite outreach from Fortinet seeking to inform Forescout of its infringement of Fortinet patents and discuss potential remedies, Forescout refused to participate with [sic] any discussion with Fortinet for months, while continuing to infringe by selling the Accused Products and services. This refusal to received [sic] information related to its infringement constitutes egregious conduct by Forescout and willful blindness to its own infringement, making this an exceptional case and justifying an award to Fortinet of increased damages under 35 U.S.C. § 284 . . . . Compl. ¶ 57 (emphasis added); see also id. at ¶¶ 72, 87, 102, 117. Forescout argues that Fortinet “has not identified any new factual allegation that would support a willful infringement claim; it is simply parroting the exact same willfulness claim that the Court already dismissed.” Mot. at 24. In response, Fortinet emphasizes that the Amended Complaint’s “willfulness allegations are based not simply on continued infringement following notice of the asserted patents, but rather on [Forescout’s] refusal to participate in discussions regarding its infringement,” and that the allegations are sufficient to sustain a willfulness claim. Opp’n at 22 (citing TC Tech. LLC v. Spring Corp., 2019 WL 529678, at *3 (D. Del. Feb. 11, alia, the defendant allegedly “received a patent offering from plaintiff prior to litigation and ‘made no effort to design around [the patent] . . . or negotiate a license with [plaintiff.]’” Id. at 22-23 (quoting TC Tech., 2019 WL 529678, at *3). Fortinet also argues that its allegations are sufficient to plead Forescout’s willful blindness (which may suffice to state a claim for willful infringement) because they plausibly show that Forescout took “deliberate actions to avoid confirming a high probability of wrongdoing.” Id. (quoting Glob.-Tech, 563 U.S. at 769). Fortinet’s arguments regarding both traditional willful infringement and willful blindness are unavailing. The Amended Complaint alleges the following facts: (1) that in late February 2020 “Fortinet attempted to initiate licensing discussions with Forescout”; (2) that “Fortinet continued [to] make substantial attempts to engage with Forescout, including [via] correspondence,” from March to May of 2020; (3) that Forescout “delayed progressing the discussions” during this period; (4) that “Forescout has refused to have its internal business employees discuss this matter with business representative of Fortinet,” instead making available “Forescout’s outside counsel” for an important phone call on April 24, 2020; and (5) that “Forescout still has not indicated a willingness” to license the contested patents. See Compl. ¶¶ 10-12. While the Amended Complaint thus contains statements to the effect that Forescout declined to engage in serious licensing negotiations during the early months of 2020, its account is far more redolent of a run-of-the-mill patent dispute than the “egregious infringement behavior” that the Supreme Court has identified as meriting enhanced damages for infringement.8 See Halo, 136 S. Ct. at 1932. In particular, Fortinet’s generalized allegations that Forescout “delayed progressing [licensing] discussions” in early 2020 do not plausibly show that Forescout knew its conduct to be egregious, i.e., “wanton, malicious, [or] bad-faith.” See id. Nor do they establish willful blindness, which requires that Forescout “subjectively believe[d] that there [was] a high

8 Fortinet’s allegation that Forescout has permitted only its legal representatives, rather than “internal business employees,” to discuss a licensing agreement, for example, falls short of the mark, as “[r]etaining counsel is not ‘egregious conduct’” within the meaning of Halo. See Mot. at probability that” it was infringing Fortinet’s asserted patents. See Reply at 14-15 (quoting Global- Tech Appliances, 563 U.S. at 769). In this respect, Fortinet’s allegations are far less probative of subjective willfulness than those in TC Technology, the case on which Fortinet most heavily relies. There, the court found that the plaintiff adequately pled willful blindness where it alleged that the defendant, inter alia, “did not conduct a patent search,” “had an in-house counsel policy of not reviewing patent sale offerings,” and “received a patent offering” from the plaintiff “six months before launching its [allegedly infringing] services.” 2017 WL 529678 at *3 (emphasis added). Fortinet’s allegations here simply do not show culpable knowledge of likely infringement, as they plausibly did in TC Technology. The Court therefore GRANTS Forescout’s motion to dismiss Fortinet’s claims for willful infringement. Because Fortinet was previously given leave to amend and failed to add new factual allegations to its complaint, the Court denies Fortinet further leave to amend. See, e.g., Bonin v. Calderon, 59 F.3d 815, 845 (9th Cir. 1995) (stating that “a district court does not abuse its discretion in denying a motion to amend where the movant presents no new facts . . . and provides no satisfactory explanation for his failure to fully develop his contentions”). For the reasons given above, the Court DENIES Forescout’s motion to dismiss Fortinet’s Amended Complaint on the grounds that the ’034 and ’421 Patents claim ineligible subject matter under 35 U.S.C. § 101. The Court also DENIES Forescout’s motion with respect to Fortinet’s claims for induced and contributory infringement. The Court GRANTS the motion with respect to Fortinet’s willful infringement claims without further leave to amend. This order disposes of Docket No. 71. Dated: June 14, 2021 ______________________________________