Okta, Inc. v. Biogy, Inc.

Opinion

OKTA, INC., Case No. 25-cv-03329-AMO

Plaintiff, ORDER DENYING MOTION TO v. DISMISS

BIOGY, INC., Re: Dkt. No. 32 Defendant.

Plaintiff Okta, Inc. (“Okta”) brings this action seeking a declaration of patent non- infringement. Defendant Biogy, Inc.’s (“Biogy”) motion to dismiss was heard before this Court on November 6, 2025. Having read the papers filed by the parties and carefully considered their arguments therein and those made at the hearing, as well as the relevant legal authority, the Court hereby DENIES Biogy’s motion for the following reasons. Biogy is the owner of United States Patent No. 7,669,236 (“the ’236 Patent”), entitled “Determining Whether to Grant Access to a Passcode Protected System.” First Am. Compl. (Dkt. No. 29, “FAC”), Ex. A. The ’236 Patent issued on February 23, 2010, and generally relates to a method of issuing passcodes that are only valid for a limited time. Such passcodes are sometimes referred to as Time-Based One-Time Passcodes, which is often abbreviated as “TOTP” or “TOTPs.” Such systems are commonly used as one form of multi-factor or two-factor authentication. After the application that matured into the ’236 Patent was filed, an industry trade group promulgated a standard relating to the issuance of a particular type of TOTP passcodes. The specific method to generate TOTP codes. See Berten Decl., Ex. 1. Biogy asserts that passcodes issued in compliance with the RFC 6238 Standard infringe at least claims 5, 12, 14, and 24 of the ’236 Patent. Biogy does not assert that all TOTP passcodes infringe the ’236 Patent; it has only asserted that passcodes issued to users in conformance with the RFC 6238 Standard infringe the patent. See, e.g., Berten Decl. ¶ 6; Dkt. No. 29-2 at 2 (“To the extent Albertson’s use of two- factor authentication is using one-time passcodes that comply with the TOTP standard, that use infringes the ’236 Patent.”); see also Berten Decl., Ex. 2 (Complaint in Albertson’s Action) ¶ 16 (“The specific solution[s] claimed in the claims of the ’236 Patent do not claim the entire field of ‘multi-factor authentication’ or ‘two factor authentication.’ For example, there are other methods for multifactor authentication that do not involve sending temporary one-time passcodes that are created using a passcode generator that perturbs.”). On April 24, 2024, counsel for Biogy sent to Okta’s customer Albertsons Companies, Inc. (“Albertson’s”) a “Notice of Infringement Letter” regarding the ’236 Patent and Albertson’s suspected use of the RFC 6238 Standard for TOTPs. Compl. ¶ 20; see also id., Ex. B (Dkt. No. 29-2). The letter included a claim chart mapping the ’236 Patent to the TOTP RFC 6238 Standard and cited an example of an Albertson’s temporary one-time passcode. Compl., Ex. C (Dkt. No. 29-3). Albertson’s never responded to the letter. Berten Decl. ¶ 13. After Albertson’s ignored Biogy’s letter for nearly six months, on October 17, 2024, Biogy filed an action for infringement of the ’236 Patent against Albertson’s Companies, Biogy, Inc. v. Albertsons Companies, Inc. et al., No. 2:24-cv-00838 (E.D. Tex.) (the “Albertson’s Action”). Berten Decl. ¶ 14; see also FAC ¶ 12. Okta brings this action for declaratory relief of non-infringement based at least in part on Biogy’s letter-writing campaign to enforce the ’236 Patent against its customers. See generally FAC. Microsoft Corporation (“Microsoft”) brings a similar action seeking a declaration of non- infringement of the ’236 Patent. See Microsoft Corporation v. Biogy, Inc., N.D. Cal. Case No. 3:25-cv-4957. The Court related the two cases and heard Biogy’s identical motions to dismiss in a single hearing. See Dkt. Nos. 34, 50. The Court issues its order in the Microsoft action this same day. Biogy moves to dismiss the declaratory relief action for lack of subject matter jurisdiction – Biogy asserts that Okta lacks Article III standing. The Court sets forth the legal standard for assessing a motion under Federal Rule of Civil Procedure 12(b)(1) before turning to the parties’ arguments. A. Legal Standard The law of the Federal Circuit governs “review as to whether an actual controversy exists under the Declaratory Judgment Act when the underlying merits of an action involve patent infringement and/or validity.” Microchip Tech. Inc. v. Chamberlain Grp., Inc., 441 F.3d 936, 940 (Fed. Cir. 2006). However, for the standards to assess legal issues that are not patent specific, such as the standards applicable for analyzing Rule 12(b)(1) motions, the district court still relies on the law of the regional circuit – here, the Ninth Circuit. Mitek Sys., Inc. v. United Servs. Auto. Ass’n, 139 F.4th 1340, 1347 (Fed. Cir. 2025) (“Mitek II”). Motions to dismiss pursuant to Federal Rule of Procedure 12(b)(1) challenge a court’s subject matter jurisdiction and may be facial or factual. A facial attack presumes the truth of the plaintiff’s allegations but asserts that they “are insufficient on their face to invoke federal jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Facial attacks are reviewed akin to Rule 12(b)(6) motions in that all allegations of the complaint are taken as true, and all reasonable inferences are drawn in favor of the plaintiff. Love v. United States, 915 F.2d 1242, 1245 (9th Cir. 1990). A factual attack “contests the truth of the plaintiff’s factual allegations, usually by introducing evidence outside the pleadings.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014) (quoting Safe Air for Everyone, 373 F.3d at 1039). In resolving a factual challenge, once the defendant contests the truth of the plaintiff’s factual allegations, the plaintiff has the burden to support its allegations with competent proof. Friends of the Earth v. Sanderson Farms, Inc., 992 F.3d 939, 944 (9th Cir. 2021) (quoting Leite, 749 F.3d at 1121). In resolving such a challenge, when the “jurisdictional issues are ‘intertwined with an element of the merits of the plaintiff’s claim,’ the court must treat the motion like a motion for summary Energizer Holdings, Inc., 118 F.4th 1134, 1143 (9th Cir. 2024) (quoting Leite, 749 F.3d at 1122). But when allegations relating to standing are “separable from the merits of the case,” the court is free to “resolv[e] factual disputes if necessary.” Jones v. L.A. Cent. Plaza LLC, 74 F.4th 1053, 1057 n.2 (9th Cir. 2023). B. Patent Infringement Under the Declaratory Judgment Act, courts only have jurisdiction over matters that present an “actual controversy.” 28 U.S.C. § 2201(a). “[T]he phrase ‘case of actual controversy’ in the Act refers to the types of ‘Cases’ and ‘Controversies’ that are justiciable under Article III of the Constitution.” MedImmune v. Genentech, Inc., 549 U.S. 118, 127 (2007) (citation omitted). An Article III controversy may exist where a party seeks a declaration that its product does not infringe a patent. See, e.g., Danisco U.S. Inc. v. Novozymes A/S, 744 F.3d 1325, 1330 (Fed. Cir. 2014). It is the plaintiff’s burden to show an actual controversy existed at the time the declaratory action was filed. AIDS Healthcare Found., Inc. v. Gilead Scis., Inc., 890 F.3d 986, 990 (Fed. Cir. 2018). “[L]ater events may not create jurisdiction where none existed at the time of filing.” GAF Building Materials Corp. v. Elk Corp. of Dallas, 90 F.3d 479, 483 (Fed. Cir. 1996). A “case of actual controversy” is one that is “substantial . . . between parties having adverse legal interests, of sufficient immediacy and reality to warrant the issuance of a declaratory judgment.” Allied Min. Prods., Inc. v. Osmi, Inc., 870 F.3d 1337, 1139 (Fed. Cir. 2017) (quoting MedImmune, 549 U.S. at 127). The dispute must be “definite and concrete,” not based on “a hypothetical state of facts.” Id. at 1339, 1341. Courts must determine whether “the facts alleged, under all the circumstances, show that there is a substantial controversy, between parties having adverse legal interests, of sufficient immediacy and reality to warrant the issuance of a declaratory judgment.” MedImmune, 549 U.S. at 127. The Federal Circuit has explained that “jurisdiction generally will not arise merely on the basis that a party learns of the existence of a patent owned by another or even perceives such a patent to pose a risk of infringement, without some affirmative act by the patentee.” Prasco, LLC v. Medicis Pharm. Corp., 537 F.3d 1329, 1339 (Fed. Cir. 2008) (citation omitted). In essence, a controversy exists where a patentee’s actions Balsam Brands Inc., 787 F. App’x 691, 700 (Fed. Cir. 2019). Specifically, declaratory judgment jurisdiction requires “both (1) an affirmative act by the patentee related to the enforcement of his patent rights” directed at the plaintiff and “(2) meaningful preparation to conduct potentially infringing activity.” Finisar Corp. v. Capella Photonics, Inc., No. 20-cv-07629-EMC, 2021 WL 810227, at *4 (N.D. Cal. Mar. 3, 2021). Given that declaratory judgment jurisdiction requires “some affirmative act by the patentee” to enforce its patents against the plaintiff, a plaintiff’s “fear of a future infringement suit is insufficient to confer jurisdiction.” Allied Min., 870 F.3d at 1139. There is no bright-line rule that any particular conduct is either necessary or sufficient for a showing of an affirmative act. Proofpoint, Inc. v. InNova Pat. Licensing, LLC, 2011 WL 4915847, at *3 (N.D. Cal. Oct. 17, 2011). For example, while “[a]n affirmative act requires more than a communication from a patent owner to another party,” Finisar, 2021 WL 810227 at *4, “direct communication between a patentee and a declaratory plaintiff is not necessary to confer standing,” Arris Grp., Inc. v. Brit. Telecomms. PLC, 639 F.3d 1368, 1378 (Fed. Cir. 2011); see also UCP Int’l, 787 F. App’x at 700 (“[J]urisdiction does not turn on whether the patentee specifically communicated with the declaratory judgment plaintiff.”). Through two opinions invoked in the papers here, the Federal Circuit somewhat recently considered a district court’s exercise of jurisdiction over an action in which a plaintiff sought a declaratory judgment establishing its non-infringement of the defendant’s patent. See Mitek Sys., Inc. v. United Servs. Auto. Ass’n, 34 F.4th 1334, 1343 (Fed. Cir. 2022) (“Mitek I”); Mitek Sys., Inc. v. United Servs. Auto. Ass’n, 139 F.4th 1340, 1347 (Fed. Cir. 2025) (“Mitek II”). In Mitek I, the Federal Circuit reversed and remanded the lower court’s determination that the plaintiff lacked standing to pursue such declaratory relief on the basis that the lower court failed to fully assess the existence of a dispute between the parties, the scope of the plaintiff’s indemnification obligations to its customers arising from the potentially infringing product, and a declination of jurisdiction. Mitek I, 34 F.4th at 1341-48. In Mitek II, after the district court permitted jurisdictional discovery and conducted a more exacting analysis of the plaintiff’s purported basis for standing, the Federal court stated that a determination of whether the declaratory judgment plaintiff “reasonably might be liable for infringement requires ‘look[ing] to the elements of the potential cause of action’ and considering both the patent claims at issue and the alleged facts concerning Mitek and its customers in light of those elements.” Id. at 1343 (citing Microsoft Corp. v. DataTern, Inc., 755 F.3d 899, 903-05 (Fed. Cir. 2014)). Further, the Mitek II court identified that district courts are required to consider whether there exist allegations by the patentee establishing a “reasonable potential” that infringement claims could be brought against the plaintiff, including under each of the separate types of infringement. Mitek II, 139 F.4th at 1343.1 Finally, the Mitek II court considered and affirmed the district court’s determination that, even if a live controversy existed, it would decline to exercise jurisdiction over the declaratory judgment action as a matter of discretion. Id. at 1355-57. A party who “makes, uses, offers to sell, or sells” a patented invention “without authority” directly infringes a patent. 35 U.S.C. § 271(a). To state a claim for direct infringement, a plaintiff must plead facts that give the alleged infringer fair notice of the claim and the accused misconduct. Disc Disease Sols. Inc. v. VGH Sols., Inc., 888 F.3d 1256, 1260 (Fed. Cir. 2018). Here, Biogy’s alleged infringement “claim charts” included in “Notice of Infringement” letters sent to Okta’s customers explicitly accuse them of infringing by using TOTPs. Okta FAC ¶¶ 20-28; cf. SanDisk Corp. v. STMicroelectronics, Inc., 480 F.3d 1372, 1381-83 (Fed. Cir. 2007) (holding there is a “substantial controversy” warranting declaratory judgement jurisdiction where a patentee “assert[ed] rights” through written accusations of infringement). Biogy’s motion to dismiss does not dispute or acknowledge Biogy’s identification of Okta’s source code as alleged evidence of infringement in Biogy’s claim charts. Further, Biogy alleges that Okta’s products use RFC 6238 to generate one-time passcodes, and Biogy also alleges that all such uses of RFC 6238 infringe the ’236 Patent. FAC ¶¶ 29-30. Indeed, even the exhibits Biogy cites in its motions to

1 At the hearing, counsel for both sides confirmed that the Court need not address each of the potential theories of patent infringement in making this assessment – if Plaintiffs establish standing to pursue direct patent infringement, for example, the Court need not also address dismiss establish that Biogy has charged infringement in this form. Compare, e.g., FAC ¶ 35 with Dkt. No. 32-5 at 6-8 (supporting the allegation that Biogy’s counsel alleged that use of “the algorithm standardized at RFC 6238 infringe[s] the patent” and that “[a]mong the algorithms Okta uses to supply codes are those based on the FRC-6238 [sic] standard”). Biogy’s motion concedes that Okta’s complaint “allege[s] that Biogy asserts that” the one-time passcodes issued by Okta comply with the standard that Biogy accuses of infringement. Mot. at 7. Plaintiffs thus properly allege that Biogy accuses them of directly infringing the ’236 patent. Biogy’s letter writing campaign alleging patent infringement establishes Okta’s standing to proceed in this declaratory relief action. C. Defense and Indemnity Obligations Declaratory judgment plaintiffs may establish that a live case or controversy exists where indemnity agreements create a “reasonable potential” for their indemnification liability. See Mitek II, 139 F.4th at 1345-47 (citing Mitek I, 34 F.4th at 1346) (focusing on whether there was “a ‘reasonable potential’ of [the declaratory judgment plaintiff’s] indemnification liability, with that potential giving [the declaratory judgment plaintiff] the required concrete stake in litigating the underlying customers’ freedom from infringement liability to [the patent holder]”). Here, Okta alleges in the FAC that “[m]ultiple Okta customers have made indemnity requests to Okta, requesting that Okta defend and indemnify these customers against Biogy’s infringement allegations.” FAC ¶ 32. “Biogy’s infringement allegations against Okta’s customers are effectively accusations that Okta itself infringes the ’236 patent, both directly (through use of the Okta Accused Products.” FAC ¶ 36. In its opposition brief, Okta identifies Parker Hannifin Corporation (“Parker”) as a customer that received a Biogy letter and seeks indemnification. See Dkt. No. 43 at 9. Okta provides the letter that Biogy sent to Parker and the “Master Subscription Agreement” between Okta and Parker containing the “Okta Indemnification Obligation” at § 9.1 of that agreement. See Brenckman Decl. ¶¶ 2-4, Exs. A-B; see also FAC at ¶¶ 25-26. As laid out in the Master Subscription Agreement, “Okta will defend Customer from any and all claims, demands, suits or proceedings brought against Customer by a third party alleging that the Service, indemnify Customer . . . in connection with an Infringement Claim.” Brenckman Decl., Ex. B (“Master Subscription Agreement”) § 9.1 (“Okta Indemnification Obligation”). This includes allegations that an Okta Product “infringe[s] any patent” – the very accusations that Biogy has leveled against Parker due to Parker’s use of an Okta product, which Biogy identifies in its claim chart. See Brenckman Decl. ¶ 2, Ex. A (“Notice of Apparent Infringement of U.S. Patent Number 7,669,236” with accompanying “claim chart”). Okta therefore shows a “reasonable potential of indemnification liability” based on Biogy’s allegations against Okta to its customers. See Mitek II, 139 F.4th at 1353. This is sufficient to establish Okta’s standing to bring this declaratory relief action. D. Discretionary Declination of Jurisdiction Over Declaratory Action “Given the Declaratory Judgment Act’s use of the word ‘may,’ 28 U.S.C. § 2201(a), the Supreme Court has stated that a district court has ‘unique and substantial discretion in deciding whether to declare the rights of litigants.’ ” Mitek I, 34 F.4th at 1347 (quoting Wilton v. Seven Falls Co., 515 U.S. 277, 286 (1995)). “[A]s long as a district court acts in accordance with the purposes of the Declaratory Judgment Act and the principles of sound judicial administration, [it] has broad discretion to refuse to entertain a declaratory judgment action.” Mitek I, 34 F.4th at 1347 (citation and internal quotation marks omitted). However, “[t]here must be well-founded reasons for declining to entertain a declaratory judgment action.” Mitek I, 34 F.4th at 1347 (quoting Capo, Inc. v. Dioptics Medical Products, 387 F.3d 1352, 1355 (Fed. Cir. 2004)). For example, “[w]hile the existence of another adequate remedy does not necessarily bar a declaratory judgment, district courts may refuse declaratory relief where an alternative remedy is better or more effective.” Mitek I, 34 F.4th at 1347 (quoting Ford Motor Co. v. United States, 811 F.3d 1371, 1379-80 (Fed. Cir. 2016)). Here, Biogy avers that the Court should follow the course set by the district court in Mitek II and dismiss Okta’s declaratory relief case to instead permit Okta to intervene in the next litigation, if any, brought by Biogy against an Okta customer. See Dkt. No. 12 at 18; see also Mitek II, 139 F.4th at 1355 (affirming the district court’s determination that “the ‘best’ way for ] litigation, if any, brought by USAA against a Mitek customer which asserts the [patents-in-suit].’ ” 2 (citation omitted)). Okta distinguishes the facts here from those in Mitek, noting that Biogy’s 3 claims of infringement challenge its products as they currently stand, unlike the charges of 4 infringement based on a customer’s customization of a software product in Mitek. See Dkt. No. 43 5 at 21-22. Indeed, in Mitek, to assess whether the accused products potentially infringed, a factual 6 analysis of the products’ customization for an end user was necessary, requiring at least one of the 7 plaintiff's customers to be involved in the case — the district court and the Federal Circuit 8 determined that the dispute would prove better suited for adjudication if the declaratory judgment 9 plaintiff waited for the patentee to bring an enforcement action against one of the customers. 10 Mitek IT, 139 F.4th at 1347. Given this distinction and the claims of direct infringement Biogy has 11 lobbed against Okta’s TOTP products as distributed (not as customized), this case is already ripe 12 for adjudication. The Court does not decline jurisdiction as a matter of discretion.

13 I. CONCLUSION

Y 14 For the foregoing reasons, the Court finds that Okta has standing to pursue this action

15 seeking a declaration of patent non-infringement. The Court therefore DENIES Biogy’s motion A 16 to dismiss.

Z 18 IT IS SO ORDERED. 19 Dated: February 23, 2026 20 □□ 21 : ARACELI MARTINEZ-OLGUIN 22 United States District Judge 23 24 25 26 27 28