IP Law Daily, TECHNOLOGY/INTERNET—N.D. Cal.: Enigma Software’s three remaining claims about Malwarebytes’ in-app statements survive dismissal on remand, (Jun 7, 2024)

By Justin Marcus Smith, J.D.

Malwarebytes urged that statements challenged under the Lanham Act were made within Malwarebytes’s own products, but the court responded there is no categorical rule that in-product statements are immune from Lanham Act claims.

On remand from the United States Court of Appeals for the Ninth Circuit, a federal district court in San Jose, California, denied security software defendant Malwarebytes’ renewed motion to dismiss the second amended complaint (SAC) of competing software provider Enigma Software Group USA LLC’s (Enigma). The SAC alleged that Malwarebytes falsely advertised Enigma’s products as “malicious” and a “threat” to computer users (the challenged statements). Enigma’s claims for violation of the Lanham Act, violation of New York General Business Law (NYGBL) 349, and tortious interference with business relations, will all remain in contention because Enigma sufficiently alleged that Malwarebytes engaged in materially false commercial speech within Malwarebytes’ own products (Enigma Software Group USA, LLC v. Malwarebytes Inc., No. 5:17-cv-02915-EJD (N.D. Cal. June 6, 2024)).

Background. In its initial complaint, Enigma alleged that, in October 2016, Malwarebytes revised its MBAM threat detection criteria to identify SpyHunter and other Enigma products as threats to consumers. The district court initially dismissed on the basis that Malwarebytes was immune from suit under Section 230. Enigma appealed, the Ninth Circuit reversed and remanded. Enigma Software Grp. USA, LLC v. Malwarebytes, Inc. (Enigma I), 946 F.3d 1040, 1050 (9th Cir. 2019). Enigma filed its second amended complaint (SAC). The SAC asserted four causes of action: (1) false advertising in violation of the Lanham Act, 15 U.S.C. § 1125(a)(1)(B); (2) a violation of NYGBL § 349, prohibiting deceptive and unlawful business practices; (3) tortious interference with contractual relations; and (4) tortious interference with business relations.

The district court granted Malwarebytes’ Fed. R. Civ. P. 12(b)(6) motion to dismiss the SAC on the basis that all of Enigma’s claims were insufficient as a matter of law, but primarily on the basis that Malwarebytes’ designations of Enigma products were “non-actionable statements of opinion.” Enigma appealed again.

The United States Court of Appeals for the Ninth Circuit affirmed in part, reversed in part, and remanded for further proceedings. Enigma Software Grp. USA, LLC v. Malwarebytes, Inc. (Enigma II), 69 F.4th 665 (9th Cir. 2023). On the Lanham Act claim, the Ninth Circuit held that Malwarebytes’ designations of “malicious” and “threat” were actionable statements of fact, whereas the designation of “potentially unwanted program” (PUP) was too vague to be actionable. The Ninth Circuit declined to assess the other elements of a Lanham Act claim in the first instance and remanded for further proceedings. The Ninth Circuit also held New York law applied to Enigma’s state law claims, without deciding choice of law outside New York, thus reversing the dismissal of the NYGBL claim. The Ninth Circuit reversed the court’s dismissal of the tortious interference with business relations claim and affirmed dismissal of the tortious interference with contractual relations claim.

On defendant Malwarebytes’ renewed motion to dismiss the claims remaining after Enigma II, the district court on remand denied dismissal. The court mainly found, at this stage of the litigation, that the Bolger factors indicated that the challenged in-app designations of “malicious” and “threats” were commercial speech for Lanham Act purposes.

Judicial notice. The court took judicial notice of the existence of a certain Malwarebytes webpage purporting to explain the Malwarebytes Website Protection [M]odule. The court did not take judicial notice of any disputed fact therein, or of the case, or difficulty of accessing webpage contents.

The court explained that courts in the district regularly take judicial notice of the existence of publicly available webpages. Malwarebytes did not ask the court to take judicial notice of the truth of the webpage contents, and Enigma did not challenge the authenticity of the webpage. Malwarebytes simply argued that the webpage was judicially noticeable for the existence of information in the public realm, and that it had incorporated the webpage into its complaint by reference as pertinent to its use of the word “malicious.” Enigma countered that the court should be skeptical of a party’s own website, that it was not relevant to Enigma claims about the deceptiveness of in-app designations, and the second amended complaint’s references to certain pages of the Malwarebytes website were insufficient to establish incorporation by reference. The court credited Malwarebytes’ arguments for judicial notice.

Commercial speech. Turning to whether the challenged statements were actionable commercial speech under the Lanham Act, the court observed, in rejecting Malwarebytes’ arguments that it had only spoken within its own products, that there is “no categorical rule that in-product statements are immune from Lanham Act claims.”

Next, the court determined the first Bolger factor, under Bolger v. Youngs Drug Prods. Corp., 463 U.S. 60, 66–67 (1983), as to whether the statements were an advertisement, fell slightly in favor of the conclusion that the challenged designations were commercial speech. Although the words “malicious” and “threat” were not themselves advertisements, Enigma alleged facts permitting an inference that Malwarebytes used these words in an advertising context. The court found scan results, depicted with the word “threats” placed near an upgrade button, were essentially part of an in-app marketing mechanism touting the purported superiority of Malwarebytes products.

The court found the second and third Bolger factors, as to whether the speech referred to a particular product and whether the speaker had an economic motivation, also weighed in favor of a finding of commercial speech. Enigma alleged Malwarebytes applied the challenged designations to two of Enigma’s products within Malwarebytes’ own products. Enigma also alleged economic motive to persuade users to buy Malwarebytes products rather than Enigma’s. The court found Malwarebytes’ cites in response were inapposite because they did not deal with statements about competitors.

Competition. The court held Enigma easily established commercial competition between the parties. Enigma alleged it directly competed with Malwarebytes in the market for anti-malware and cybersecurity software.

Commercial purpose. The court found Enigma established that the challenged statements had a commercial purpose by alleging that Malwarebytes made the speech at issue with the purpose of influencing consumers in its favor.

Dissemination. The court found that Malwarebytes disseminated the challenged designations to the relevant public of buyers. Enigma alleged the Malwarebytes free version included malicious website protection features for only 14 days. Enigma also alleged that Malwarebytes scans would find, quarantine, and label Enigma’s products as a “threat.” The court inferred from this that the relevant public included consumers who sought to use products from both Malwarebytes and Enigma, and Malwarebytes had disseminated its statements to those users.

Material deception. The court agreed with Enigma that it sufficiently alleged the designations of “threat” and “malicious” were materially deceptive to a substantial segment of the relevant buying population. The court reached this conclusion despite Malwarebytes’ arguments to the contrary that it disclosed its definitions and criteria for the two words; that it had designated Enigma’s products as Potentially Unwanted Programs (PUPs), rather than malware; and, that the Ninth Circuit had already held the “PUP” classification was not actionable under the Lanham Act.

Enigma countered that the SAC alleged that it received hundreds of complaints from users after they saw Malwarebytes’ statements reflecting a belief that Enigma’s products were cybersecurity threats and malware; that the PUP criteria were no longer relevant after the Ninth Circuit’s decision in Enigma II; and that Malwarebytes disclosures were entirely disconnected from the presentation of the challenged designations to users.

The court sided with Enigma here largely based on the user complaints. The complaints included statements of the users’ belief that Malwarebytes had identified Enigma’s products as malware. These users sometimes canceled orders and requested refunds. The court said it could infer from this that the Malwarebytes statements had influenced user’s buying decisions. The court said it could not reach further into the efficacy of Malwarebytes disclosures, such as on the judicially noticed webpage, at this stage of the proceedings. The court accordingly held Enigma sufficiently alleged the challenged designations of “threat” and “malicious” were materially deceptive.

New York law. The court rejected Malwarebytes’ arguments against Enigma’s claim under New York General Business Law § 349 for the same reasons the court applied to the Lanham Act claim.

Tortious interference. The court denied the motion to dismiss the tortious interference with business relations claim that the Ninth Circuit had already held to be sufficiently pleaded in Enigma II.

The Case is No. 5:17-cv-02915-EJD5.

Judge: Davila, E.

Attorneys: Edward Patrick Sangster (K&L Gates LLP) and Terry Budd (Budd Law PLLC) for Enigma Software Group USA, LLC. Bradley Thomas Meissner (Fenwick and West LLP) and John Charles Hueston (Hueston Hennigan LLP) for Malwarebytes Inc.

Companies: Enigma Software Group USA LLC; Malwarebytes Inc.

Cases: TechnologyInternet CaliforniaNews