In a case originally based on a false advertising claim under § 43(a) of the Lanham Act, the US Court of Appeals for the Ninth Circuit affirmed in part, reversed in part and remanded the district court’s dismissal of the claim. The Ninth Circuit concluded that the defendant’s description of a competitor’s software product was plausibly alleged as an element of false advertising. Enigma Software Group USA, LLC v. Malwarebytes, Inc., Case No. 21-16466 (9th Cir. June 2, 2023) (Clifton, Bumatay, Baker, JJ.) (Baker, J., concurring) (Bumatay, J., dissenting).
Enigma is a security software company whose products detect and remove malicious software such as viruses, spyware, adware and ransomware. Malwarebytes is a direct competitor of Enigma and sells products aimed at detecting and removing malware and other potentially threatening programs on users’ computers. Enigma originally brought this action in the US District Court for the Southern District of New York, but the case was moved to the Northern District of California on a motion to transfer filed by Malwarebytes. The California court ruled that Enigma’s claims were barred by § 230 of the Communications Decency Act, a ruling that the Ninth Circuit reversed, holding that § 230 did not apply to “blocking and filtering decisions that [we]re driven by anticompetitive animus.” The Ninth Circuit remanded the case.
On remand, Enigma asserted four causes of action:
- False advertising in violation of the Lanham Act
- Violation of New York General Business Law (NYGBL) § 349, which prohibits deceptive and unlawful business practices
- Tortious interference with contractual relations
- Tortious interference with business relations.
On Malwarebytes’s motion to dismiss for failure to state a claim, the district court found that (for the Lanham Act claim) Enigma’s allegation that Malwarebytes’s designations were “just [nonactionable] subjective opinions” rather than “verifiably false.” On appeal, Enigma argued that designations of its products as malicious, threats and potentially unwanted programs were factually false and misrepresented the very purpose of the software.
To state a claim for false advertising under § 43(a) of the Lanham Act, Enigma had to plausibly allege the following:
- Malwarebytes made a false statement of fact in a commercial advertisement.
- The statement deceived or had the tendency to deceive a substantial segment of its audience.
- The deception was material, in that it was likely to influence the purchasing decision.
- The false statement entered interstate commerce.
- Enigma was or was likely to be injured as a result.
To show falsity, Enigma had to allege that the statement was literally false, either on its face or by necessary implication, or that the statement was literally true but likely to mislead or confuse consumers.
The Ninth Circuit found that, taken as true at the motions stage, Enigma’s allegations were sufficient to state a Lanham Act claim because Malwarebytes’s designations employed terminology that was substantively meaningful and verifiable in the cybersecurity context. While terms such as “malicious” and “threatening” are adjectives subject to numerous interpretations, the Court found that in the context of software competitors, a reasonable person would plausibly interpret these designations as identification of malware. However, the term “potentially unwanted program” was found to be too unspecific to provide a basis for a Lanham Act claim.
The district court dismissed Enigma’s New York state tort claim under NYGBL § 349 because Malwarebytes was not properly subject to personal jurisdiction in New York. Enigma also brought actions for tortious interference with contractual relations and tortious interference with business relations, claims that are recognized as actionable under both California and New York law. However, the district court found that Enigma failed to allege essential elements for these claims under California law.
In evaluating the false claims issue, the Ninth Circuit recognized “the First Amendment overlay here” in terms of “delineating what constitutes ‘fact’ versus ‘opinion.’” While statements of fact are actionable under the Lanham Act, “[s]tatements of opinion and puffery . . . are not.” As the Court noted, “it makes no difference if the statements of opinion are made for the purpose of anticompetitive gain. After all, the suppression of ‘opinions’—even in the commercial space—gets into murky constitutional waters.” Rather, “boiled down, whether commercial speech is actionable depends on whether the statement implies something that can be proven false.”
The Ninth Circuit held that without a “core of objective evidence” to assess the accuracy of the use of the warnings, no reasonable factfinder could say that Malwarebytes made a false representation of fact in labeling Enigma’s products or website as a “threat,” “malicious” or “potentially unwanted.” Consequently, the Ninth Circuit ruled that the Lanham Act and NYGBL § 349 claims should not have been dismissed and that consequently the tortious interference with business relations claim should similarly not have been dismissed. However, the Ninth Circuit affirmed the dismissal of the contractual relations claim as Enigma did not identify a specific contractual obligation with which Malwarebytes interfered.
Court of International Trade Judge Baker wrote separately to concur and address the choice of law issue. Baker noted that ordinarily, the application of law from a transferor jurisdiction carries with it the choice-of-law rules of that jurisdiction. However, since the parties did not address the choice of law issue, the Ninth Circuit applied New York substantive law applies to Enigma’s state-law claims, save for the claims based on Malwarebytes’ transactions with customers outside of New York.
Judge Bumatay dissented, writing that a description of a competitor’s products as “potentially unwanted,” a “threat” or “malicious” is not an expression of fact, as these are subjective statements and not readily verifiable (i.e., opinions). According to Judge Bumatay, treating these terms as actionable statements of fact under the Lanham Act “sends a chilling message to cybersecurity companies—civil liability may now attach if a court later disagrees with your classification of a program as ‘malware.’”
