Antitrust Law Daily Wrap Up, STATE UNFAIR TRADE PRACTICES—N.D. Cal.: Failure to disclose theft of source code could constitute California law violations, (Jun 3, 2014)

By Edward L. Puzzo, J.D.

California consumer protection claims against a software company for selling antivirus software, while failing to disclose that it's source code had been breached by hackers, could be maintained by a software purchaser once the complaint was amended to provide the particularity required by Federal Rules of Civil Procedure Rule 9(b), the federal district court in San Francisco has ruled (Haskins v. Symantec Corporation, December 1, 2013, Tigar, J.).

Kathleen Haskins alleged that Symantec, a developer of anti-virus software, experienced the infiltration of its network and theft of its software source code by hackers in 2006, but neither performed a reasonable investigation into the breach nor informed consumers until 2012 that its source code had been stolen in 2006.

She alleged that she purchased Symantec's Norton Antivirus software, containing the breached software code, in 2007 or 2008. Haskins, on behalf of a class, alleged that Symantec fraudulently and knowingly falsely represented the efficacy of its antivirus products by failing to disclose the security breach to its customers, in violation of the California Unfair Competition Law (UCL) and the California Consumer Legal Remedies Act (CLRA).

Rule 9(b) particularity. Symantec moved to dismiss on the grounds that the claims had not been pleaded with the particularity required by Rule 9(b) for claims of false advertising brought under the UCL and CLRA. Symantec stated that Haskins failed to specify the specific advertisement or representation she relied upon in making her purchase. The court stated that, to adequately allege a fraudulent misrepresentation claim under the UCL and the CLRA without pleading that she saw a specific misrepresentation, a plaintiff must allege that the long-term advertising campaign to which she was exposed affected her decision to purchase the product. Symantec also argued that certain statements identified in the complaint were non-actionable puffery that cannot form the basis of a misrepresentation claim.

Under Rule 9(b), the court explained, the pleadings must allege the "who, what, when, where, and how" of the misconduct charged, and set forth what is false or misleading about a statement, and why it is false. Haskins’ complaint failed this standard, the court ruled. She appended to her complaint Symantec's advertisements, but failed to explain why the statements therein were false. Even if her claim was one for fraud by omission, she failed to identify which information Symantec communicated that was rendered misleading by the failure to disclose the 2006 source code theft. She failed to make at least a prima facie case for how the statements constituted fraud. Thus, the court ruled, Haskins' UCL and CLRA claims were insufficiently pleaded under Rule 9(b) and must be dismissed for that reason.

Rule 8 and 12(b)(6) requirements. Since the claims were being dismissed without prejudice, and assuming that plaintiff could amend the complaint to cure the aforementioned defects, the requirements for stating UCL and CLRA claims under Rule 8 and Rule 12(b)(6) were also addressed.

Regarding the UCL claim, Symantec alleged that plaintiff lacked the standing required under the UCL because she did not demonstrate economic injury as a result of the transaction. The court rejected this objection, stating that she could potentially demonstrate economic injury, for both UCL and CLRA purposes, by purchasing a product she would not have purchased but for the misrepresentation. Symantec also alleged that Haskins failed to allege unlawful or unfair conduct under the UCL. However, the court ruled that Haskins did sufficiently plead the unfair practices claim, because it is a cognizable harm to pay more for a product than one would have otherwise paid.

Tangible chattels. Symantec claimed that, since the product was downloaded from Symantec's website, the software was neither a good nor service as defined by the CLRA, and therefore fell outside the statute's reach. The court rejected this line of thinking, stating that no matter how software was delivered, it worked a physical change on a physical hard drive and therefore possessed a corporal form. At least where the same software can be purchased both in a store and online, the court continued, construing the statute to exempt only the version purchased online would not be a liberal construction consistent with the CLRA’s purposes.

The case is Civil Action No. 13-cv-01834-JST.

Attorneys: Timothy G. Blood (Blood Hurst & O'Rearden, LLC) for Kathleen Haskins. Laurence F. Pulgram (Fenwick & West LLP) for Symantec Corporation.

Companies: Symantec Corporation

Cases: Advertising StateUnfairTradePractices CaliforniaNews