Federal Circuit Affirms PTAB Ruling That All 25 Claims of BT Americas' Network Intrusion Monitoring Patent Are Unpatentable.

The appeal

The case is BT Americas, Inc. v. Palo Alto Networks, Inc., No. 2025-1572 (Fed. Cir. Oct. 29, 2026) (nonprecedential). In IPR2023-00889, Palo Alto Networks, Inc. was the petitioner and BT Americas Inc. was the patent owner. The Board issued its final written decision on November 7, 2024, holding claims 1-25 unpatentable, and denied BT Americas' request for rehearing on January 15, 2025. BT Americas appealed, and the court had jurisdiction under 28 U.S.C. 1295(a)(4)(A).

What the claims recite

The '641 patent is titled "Method and System for Dynamic Network Intrusion Monitoring, Detection and Response." Independent claim 1 recites a system for operating a probe as part of a security monitoring system for a computer network. The system has a sensor that collects status data from at least one monitored component of the network; a filtering subsystem that analyzes the status data to identify potentially security-related events, where the analysis includes filtering followed by an analysis of post-filtering residue, meaning data neither discarded nor selected by filtering; a communications system that transmits information about the identified events to an analyst system; a receiver for receiving feedback at the probe; and "a modification control system for dynamically modifying an analysis capability of the probe during operation thereof based on the received feedback." Claim 6, through claim 2, requires a multi-stage analysis that "includes analysis at the probe and analysis at a secure operations center configured to receive data from the probe."

The Board's decision

According to the opinion, the Board determined that claims 1-7 and 15-17 would have been obvious over Duvall, U.S. Patent 5,884,033, and Chu, a 1997 M.I.T. paper titled "Trust Management for the World Wide Web." The Board held the remaining claims unpatentable on other grounds, which BT Americas did not challenge on appeal. The Board noted the parties' agreement that claim 1 requires only that the modification control system be "reasonably capable of" dynamic modification.

Dynamic modification of the probe

BT Americas argued that neither Duvall nor Chu teaches dynamically modifying an analysis capability of the probe during operation, and that Palo Alto Networks' expert addressed only dynamic modification of Duvall's filter database. The court was "not persuaded." It pointed to the Board's finding that Duvall's system is "not only at least capable of, but configured to, perform dynamic modification via online editing," and to expert testimony the Board credited that a database entry is "queried (i.e., read) [during the analysis] while simultaneously being written to." "In other words," the court wrote, "as soon as the filter database is updated, the probe's analysis capability, through use of that updated database, is likewise altered during operation." The court also upheld the Board's rejection of BT Americas' arguments that the combined system would have to be significantly altered and that Duvall relies on a cached copy of the database, noting that Duvall "does not require using a cached copy of the database." It affirmed the Board's motivation-to-combine findings as supported by substantial evidence.

Analysis at a secure operations center

On claim 6, BT Americas argued that the Board never identified the claimed analysis at a secure operations center. The court said BT Americas "misunderstands" the petition. Palo Alto Networks relied on two analyst systems: one at a secure operations center that takes part in Duvall's multi-stage analysis to identify residue data, and a second at the probe that receives the residue data and later modifies Duvall's filter database. The court held that the Board did identify the claimed analysis at a secure operations center and reasonably credited Palo Alto Networks' discussion of a skilled artisan's understanding that "it was common in the industry at the time to provide off-site security."

Review of an expired patent

BT Americas also argued that the Board lacked jurisdiction over the '641 patent because it expired before the petition was filed and expired patents "no longer implicate any public rights." The court noted that it rejected that argument in Apple Inc. v. Gesture Technology Partners, 127 F.4th 364 (Fed. Cir. 2025), as incompatible with the Supreme Court's reasoning in Oil States Energy Services v. Greene's Energy Group, 584 U.S. 325 (2018). "We are not permitted to deviate from our precedential holding in Gesture Technology and anyway see no persuasive reason to do so," the court wrote.

What to watch next

Watch for any petition for rehearing.