The complaint
Harbingers, LLC v. The Escal Institute of Advanced Technologies, Inc., No. 8:26-cv-04683 (D. Md.), is a 16-page complaint filed November 10, 2026, by Harbingers, LLC and Robert T. Lee, both of Lexington, Massachusetts. The defendant is The Escal Institute of Advanced Technologies, Inc., doing business as SANS Institute, which the complaint describes as a Delaware corporation with its principal place of business in Montgomery County, Maryland, that sells cybersecurity training courses, including digital forensics and incident response courses. The complaint says Mr. Lee is the sole owner of Harbingers. The case is assigned to Judge Paula Xinis.
The SIFT mark
The complaint alleges that Mr. Lee created the SIFT Workstation, a collection of open-source digital forensics and incident response tools, in 2007, and that since at least October 2007 Mr. Lee and Harbingers have used the SIFT mark, as a word mark and in a stylized design form, for the SIFT Workstation software and its instructional materials. It says the toolkit is distributed through an open-source project hosted in a GitHub organization Mr. Lee created. United States Patent and Trademark Office records list two Principal Register registrations for SIFT owned by Harbingers LLC, Registration No. 5,701,053 (standard characters) and Registration No. 5,701,175 (word and design), both registered March 19, 2019, for open source computer software for use with incident responses and forensic tools designed to perform digital examinations and instructional user guides sold as a unit, in International Class 9, with a claimed first use of October 11, 2007. Those records show both registrations cancelled on October 3, 2025, because the registrant did not file an acceptable declaration under Section 8. The complaint says Harbingers keeps rights in the mark from its prior and continuous use. USPTO records also show four new intent-to-use applications by Harbingers LLC, filed November 6 and November 9, 2026, for SIFT WORKSTATION (Serial Nos. 50204380 and 50204390) and SIFT (Serial Nos. 50207438 and 50207421), for "downloadable software for digital forensic examination, analysis of digital evidence, and incident response investigations, distributed under an open source license," in Class 9, each awaiting examination.
The dispute
The complaint alleges that SANS used the SIFT mark in its courses with Harbingers' permission, and that SANS' Courseware Licensing Agreement states that SIFT is a registered trademark of Harbingers, LLC, used with permission. It says a 2013 Author Agreement licensed Mr. Lee's course materials to SANS without granting any trademark rights, and that an August 31, 2021 Modification & Transition Agreement transferred two courses, FOR500 and FOR508, and their delivery materials to SANS without naming SIFT, the SIFT mark, or related digital assets, and without Harbingers as a party. It alleges that SANS ended Mr. Lee's employment on October 23, 2026, that six days later SANS claimed SIFT as one of its "Company Marks" and demanded that Mr. Lee surrender all SIFT-related assets, and that SANS removed his access to the TeamDFIR GitHub organization and a faculty Slack workspace. It says that on November 3, 2026, the plaintiffs demanded that SANS stop using the mark in new materials immediately and remove it from existing materials within 30 days, and that SANS has not responded in writing. The complaint alleges that SANS continues to use the mark for paid courses and for course virtual machines and materials labeled "SANS SIFT Workstation," "SANS Windows SIFT Workstation," and "SANS Linux SIFT Workstation," which it says causes confusion over source, sponsorship, or approval. It also alleges, on information and belief, that SANS claimed the mark to appropriate Harbingers' goodwill and to gain leverage in the parties' dispute over Mr. Lee's separation, not because it believed it owned the mark.
Counts and relief
The plaintiffs plead four counts against SANS. The first cause of action alleges false designation of origin and unfair competition under 15 U.S.C. § 1125(a)(1)(A), based on Harbingers' ownership of the mark. The second alleges common-law trademark infringement under Maryland law. The third alleges common-law unfair competition under Maryland law. The fourth seeks a declaratory judgment under 28 U.S.C. §§ 2201 and 2202. The prayer asks for compensatory and punitive damages, pre-judgment and post-judgment interest, and attorneys' fees and costs; a declaration that Harbingers owns the SIFT mark and its goodwill, that SANS owns no right, title, or interest in it, that SANS' prior use inured to Harbingers' benefit, that neither the Author Agreement nor the Transition Agreement assigned or licensed the mark to SANS, and that any permission SANS had has terminated; preliminary and permanent injunctions against SANS using the SIFT mark or any confusingly similar mark, including "SANS SIFT Workstation," across courses, training, downloadable virtual machines, courseware, and third-party platforms, and against representing that SANS owns or controls the mark; removal of the mark from SANS' courseware, virtual machines, websites, and marketing materials and delivery of materials bearing it for destruction under 15 U.S.C. § 1118; an order restoring the plaintiffs' access to and control over the SIFT Workstation GitHub account and their other digital assets; a sworn compliance report under 15 U.S.C. § 1116(a); SANS' profits, actual damages, and enhanced damages under 15 U.S.C. § 1117(a); and other relief. The plaintiffs demand a jury trial.