DCT

3:19-cv-00771

Secure Controls Framework Council LLC v. Network Frontiers LLC

Log In
Key Events
Complaint

I. Executive Summary and Procedural Information

  • Parties & Counsel:
  • Case Identification: 3:19-cv-00771, D. Or., 05/15/2019
  • Venue Allegations: Plaintiff alleges venue is proper in the District of Oregon because Defendant conducts business in the state, including offering and selling products and services, and because a substantial part of the events giving rise to the claims occurred in the district.
  • Core Dispute: Plaintiff seeks a declaratory judgment that its cybersecurity guidance spreadsheet does not infringe five of the Defendant’s patents and/or that the patents are invalid, following Defendant's allegations of infringement.
  • Technical Context: The technology relates to computer-based systems for managing and harmonizing compliance with multiple, often overlapping, regulatory and industry standards documents in fields like IT security.
  • Key Procedural History: The dispute arose from a series of communications in April and May 2019, where Defendant allegedly accused Plaintiff of infringement, requested Plaintiff add a licensing notice to its website, and ultimately threatened a patent complaint. Plaintiff contends that Defendant failed to provide a specific infringement analysis or identify the claims at issue, with the exception of a query regarding two independent claims of one patent.

Case Timeline

Date Event
2012-11-05 Priority Date for ’059, ’197, and ’608 Patents
2014-02-25 ’059 Patent Issued
2015-04-14 ’197 Patent Issued
2015-04-20 Priority Date for ’954 and ’775 Patents
2017-02-21 ’954 Patent Issued
2018-05-22 ’775 Patent Issued
2018-06-12 ’608 Patent Issued
2019-04-09 Defendant allegedly contacts Plaintiff by phone to allege infringement
2019-04-14 Defendant emails Plaintiff regarding proposed website changes
2019-05-06 Defendant allegedly threatens a patent complaint via email
2019-05-13 Defendant allegedly emails Plaintiff asking about infringement of claims 1 and 7 of the ’608 patent
2019-05-15 Complaint for Declaratory Relief Filed

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 8,661,059 - "Compliance Framework Database Schema"

The Invention Explained

  • Problem Addressed: Organizations face significant inefficiency and difficulty when being audited for compliance against multiple, overlapping authority documents (e.g., policies, regulations, guidelines), which are typically written for humans in a hierarchical format and are not easily processed by computers (Compl. ¶20; ’059 Patent, col. 1:21-33).
  • The Patented Solution: The invention provides a computer-implemented method and database schema for harmonizing these disparate authority documents. It involves converting the hierarchical information from source documents into a modular, computer-readable format (e.g., XML) and storing it in a database with unique, persistent identifiers for each citation. This allows for efficient management, comparison, and analysis of compliance obligations from multiple sources (’059 Patent, col. 2:51-62, Abstract).
  • Technical Importance: The invention purports to solve a data management problem for Governance, Risk, and Compliance (GRC) tools by creating a structured, relational database from unstructured, human-readable compliance documents, enabling automated analysis (’059 Patent, col. 2:41-49).

Key Claims at a Glance

  • The complaint does not specify which claims of the ’059 Patent are asserted, but seeks a declaratory judgment of non-infringement for the entire patent (Compl. ¶3, First Claim for Relief). The first independent claim of each type is presented for analysis.
  • Independent Claim 1 (Method):
    • A computer-implemented method, comprising:
    • aggregating a plurality of authority documents;
    • identifying a plurality of citations in at least one of the plurality of authoritative documents;
    • identifying, in the plurality of citations, content that includes at least one noun-verb pair;
    • assigning a unique control ID to represent each unique noun-verb pair from the plurality of citations.
  • Independent Claim 10 (Computer-Readable Media):
    • At least one instance of tangible, computer-readable media having contents that cause a computing system to perform a method, including:
    • accessing a first set of citations sourced from one or more authoritative sources;
    • assigning a parent ID and a sort ID to each citation;
    • generating a Citation Table.
  • Independent Claim 14 (Data Structure):
    • Computer readable media storing a unified compliance framework data structure, comprising:
    • an authority document table with references to authority documents; and
    • a citation table comprising fields for authority documents, guidance, citations, control IDs, noun IDs, and citation IDs.

U.S. Patent No. 9,009,197 - "Methods and Systems for a Compliance Framework Database Schema"

The Invention Explained

  • Problem Addressed: The patent identifies a "lack of harmonized governance processes to support an organization's efforts in gathering evidentiary support when being audited" (’197 Patent, col. 2:40-44). Existing technology struggles to parse audit questions from the surrounding context in authority documents.
  • The Patented Solution: The invention describes systems and methods for a unified compliance framework that generates audit-based questions from an aggregation of hierarchical authority documents. The system converts these documents into a modular format (e.g., XML) that can be integrated into various GRC tools and other operating environments, thereby streamlining the process of locating evidence for an audit (’197 Patent, col. 2:50-61, Abstract).
  • Technical Importance: This technology aims to automate the creation of specific, actionable audit questions from a large corpus of compliance literature, making the audit process more efficient and rigorous (’197 Patent, col. 2:18-24).

Key Claims at a Glance

  • The complaint does not specify which claims of the ’197 Patent are asserted, but seeks a declaratory judgment of non-infringement for the entire patent (Compl. ¶3, Second Claim for Relief). The independent claims are presented for analysis.
  • Independent Claim 1 (System):
    • A computer system, comprising: at least one processor; memory with instructions to cause the processor to:
    • identify a plurality of citations in at least one of a plurality of authoritative documents;
    • identify, in the plurality of citations, a content, wherein the content includes at least one noun-verb pair;
    • assign a unique noun ID to represent each unique noun from the plurality of citations; and
    • store, in a table, data indicating the content, the corresponding citation, and one or more unique noun IDs.
  • Independent Claim 10 (Computing Devices):
    • One or more computing devices programmed to execute a method to determine a unified compliance framework, the method comprising:
    • accessing a first set of citations, wherein each citation is associated with content and has a position in a hierarchy;
    • assigning a parent ID and a sort ID to each citation based on its position;
    • populating a citation table with rows for each citation including the parent ID and sort ID.

U.S. Patent No. 9,575,954 - "Structured Dictionary"

  • Technology Synopsis: This patent describes a dictionary data structure designed for natural language processing within a specific regulatory domain. The structure uses multiple linked tables to manage terms, definitions, and complex relationships (e.g., hierarchies, synonyms) to improve the accuracy of automated tools in understanding authority documents (’954 Patent, Abstract).
  • Asserted Claims: The complaint seeks a declaratory judgment of non-infringement for the entire patent (Compl. ¶3, Third Claim for Relief).
  • Accused Features: The complaint makes a general allegation that its "products and services do not infringe" the ’954 patent (Compl. ¶11).

U.S. Patent No. 9,977,775 - "Structured Dictionary"

  • Technology Synopsis: As a continuation related to the ’954 patent, this patent also discloses a dictionary data structure for use in natural language processing of compliance documents. It is composed of first, second, and third tables that respectively store terms, definitions, and the correspondence between them, allowing software to identify definitions for a given term (’775 Patent, Abstract).
  • Asserted Claims: The complaint seeks a declaratory judgment of non-infringement for the entire patent (Compl. ¶12, Fourth Claim for Relief).
  • Accused Features: The complaint makes a general allegation that its "products and services do not infringe" the ’775 patent (Compl. ¶12).

U.S. Patent No. 9,996,608 - "Methods and Systems for a Compliance Framework Database Schema"

  • Technology Synopsis: This patent, related to the ’059 and ’197 patents, describes methods for improving authority document processing by identifying content through a process of selecting a noun and matching it to a verb of which it is the subject, creating a "noun-verb pair." This pair is then associated with a unique control ID and stored in a database (’608 Patent, Claim 1).
  • Asserted Claims: The complaint alleges that Defendant specifically asked if Plaintiff infringed "any element of independent claims 1 and 7" of this patent (Compl. ¶34).
  • Accused Features: The complaint makes a general allegation that its "products and services do not infringe" the ’608 patent (Compl. ¶13).

III. The Accused Instrumentality

Product Identification

  • The "SCF Spreadsheet" or "Spreadsheet," which is titled "Secure Controls Framework" (Compl. ¶17-18).

Functionality and Market Context

  • The complaint describes the accused product as a "manually-generated, flat-file database (i.e., an Excel spreadsheet)" (Compl. ¶18). Its content is allegedly based on contributions from human "subject-matter experts" who have knowledge of laws, regulations, and industry best-practices (Compl. ¶18). The content is "directly input into a table (having rows and columns) by a human" (Compl. ¶24).
  • Functionally, the spreadsheet provides cybersecurity and privacy control guidance to help organizations identify compliance requirements across various frameworks (Compl. ¶16, ¶19). It is offered for free under a Creative Commons public license (Compl. ¶17). The complaint emphasizes that the spreadsheet "does not directly analyze compliance" and that its use of computer implementation is limited to a human inputting content into a table on a computer (Compl. ¶19, ¶26).

IV. Analysis of Infringement Allegations

The complaint, an action for declaratory judgment of non-infringement, does not set forth a detailed infringement theory from the Defendant or provide a claim chart. Instead, it alleges that Defendant failed to provide any specific infringement analysis and that its infringement allegations are "meritless" (Compl. ¶31, ¶36). The complaint’s central argument for non-infringement is a fundamental technological mismatch between the accused product and the patents-in-suit. Plaintiff characterizes its product as a "manually-generated, flat-file" spreadsheet (Compl. ¶18), whereas it alleges the patents "pertain to computer-implemented, computer-processed, computer-generated, and/or computer-populated database for automatic compliance analysis" (Compl. ¶37).

No probative visual evidence provided in complaint.

  • Identified Points of Contention:
    • Scope Questions: A primary legal question is whether the claims, which recite "computer-implemented method[s]" and systems for processing data (e.g., ’059 Patent, Claim 1; ’197 Patent, Claim 1), can be construed to read on a product that is alleged to be a "manually-generated, flat-file database" created by human experts (Compl. ¶18).
    • Technical Questions: A key factual question will be the extent to which the SCF Spreadsheet is created and operates. The complaint suggests the product does not perform the claimed automated steps of "aggregating" authority documents or using natural language processing to identify "noun-verb pair[s]" (Compl. ¶20; ’059 Patent, Claim 1). The dispute may focus on whether the creation of the spreadsheet, even if by humans using computers, constitutes the claimed "computer-implemented" processes.

V. Key Claim Terms for Construction

  • The Term: "computer-implemented method" (’059 Patent, Claim 1)

    • Context and Importance: This term is central to the dispute, as Plaintiff's core non-infringement argument rests on its product being "manually-generated" and using computer implementation "only to the extent that the human inputs the content of the Spreadsheet in a table on a computer" (Compl. ¶18, ¶26). The definition of what constitutes "computer-implemented" will be critical.
    • Intrinsic Evidence for Interpretation:
      • Evidence for a Broader Interpretation: The plain meaning of the term could arguably encompass any method that utilizes a computer at any stage. Parties arguing for this view might suggest that using software like Microsoft Excel to create and structure the database is sufficient to meet this limitation.
      • Evidence for a Narrower Interpretation: The specification describes a specific technical solution involving converting hierarchical information into a "modular format (e.g., markup language, such as XML)" for integration into various database environments (’059 Patent, col. 2:51-62). This context suggests the term requires more than mere data entry by a human into a generic spreadsheet, but rather a specific automated processing of source documents.

  • The Term: "aggregating a plurality of authority documents" (’059 Patent, Claim 1)

    • Context and Importance: This term is critical for determining if the SCF Spreadsheet is created in an infringing manner. Plaintiff contends its spreadsheet is based on "contributions from subject-matter experts having knowledge of the relevant authoritative sources," a process distinct from the automated "aggregating" potentially required by the claim (Compl. ¶18).
    • Intrinsic Evidence for Interpretation:
      • Evidence for a Broader Interpretation: A party could argue that "aggregating" simply means collecting information from multiple sources and combining it into a single resource, a process that could be performed by humans whose work product is then entered into the spreadsheet.
      • Evidence for a Narrower Interpretation: The patent's detailed description discusses converting "hierarchical information... from the authority documents) into a modular format" as part of the framework (’059 Patent, col. 2:54-58). This may suggest that "aggregating" is not just a synthesis of knowledge, but a direct, computer-aided process of combining and reformatting the source documents themselves.

VI. Other Allegations

  • Indirect Infringement: The complaint seeks a judgment that Plaintiff has not "induced infringement of, or contributed to the infringement of any valid, properly construed claim" of the patents-in-suit (Compl. ¶44, ¶54). No specific factual allegations related to inducement or contributory infringement are detailed.
  • Willful Infringement: The complaint does not allege willful infringement. However, it includes a "Sixth Claim for Relief" for "Patent Infringement Claim Made in Bad Faith," alleging that Defendant communicated its infringement demand knowing it was "without merit" and without providing a reasonable basis for its claims (Compl. ¶92, ¶97). This allegation centers on Defendant's state of mind in asserting its patents.

VII. Analyst’s Conclusion: Key Questions for the Case

  • A central issue will be one of technological operation: does the creation and function of the Plaintiff's "manually-generated, flat-file" spreadsheet, which relies on human expert input, practice the "computer-implemented methods" for automatically aggregating, parsing, and harmonizing compliance documents that are central to the Defendant's patents?
  • The case will also likely turn on a definitional question: can the claim term "aggregating a plurality of authority documents" be construed to cover a process where human experts synthesize knowledge from various sources into a new work product, or is its scope limited to an automated, computer-driven combination and reformatting of the source documents as described in the patent specifications?
  • A further question relates to patent holder conduct: did the Defendant, as alleged, assert its patent rights in bad faith by threatening suit without conducting a reasonable pre-suit investigation or providing a basis for its infringement claims, potentially making this an exceptional case?