ENIGMA SOFTWARE GROUP USA LLC, Case No. 5:17-cv-02915-EJD Plaintiff, ORDER GRANTING DEFENDANT’S v. MOTION TO DISMISS SECOND MALWAREBYTES INC., Re: Dkt. No. 147 Defendant.
Plaintiff Enigma Software Group USA, LLC (“Enigma”) alleges that Malwarebytes Inc. (“Malwarebytes”) wrongfully categorized Enigma’s cybersecurity and anti-malware software as “malicious,” a “threat,” and as a Potentially Unwanted Program (“PUP”). In its Second Amended Complaint (“SAC”), Enigma asserts claims for (1) violations of the Lanham Act, (2) violations of New York General Business Law § 349, (3) tortious interference with contractual relations, and (4) tortious interference with business relations. Dkt. No. 140. Malwarebytes moves to dismiss the SAC, asserting that because Enigma’s allegations are insufficient as a matter of law, all of Enigma’s claims should be dismissed. For the reasons set forth below, Malwarebytes’ motion is GRANTED.1
1 The Court took this motion under submission without oral argument pursuant to Civil Local Rule 7-1(b). Case No.: 5:17-cv-02915-EJD I. BACKGROUND2 A. Factual Background i. The Parties Enigma is a Florida limited liability company that designs and develops cybersecurity software to combat malware, ransomware, viruses, Trojans, hackers, and other problematic computer system attacks. SAC ¶¶ 2, 48. Enigma’s flagship anti-malware product, SpyHunter 4, was an adaptive malware detection and removal tool that provided rigorous protection against the latest malware threats. Id. ¶ 48. SpyHunter 4 was available on the market until mid-2018, when an Enigma affiliate introduced a new malware software program, SpyHunter 5. Id. Additionally, Enigma offers a PC privacy and software optimizer program known as RegHunter 2. With RegHunter 2, Enigma’s aim is to enhance users’ personal privacy by providing certain privacy tools such as a powerful file shredding function that ensures secure deletion and prevents unwanted recovery of deleted files. Id. ¶ 49. The program also offers a privacy scan which provides for removal of web browsing history, temporary files, and other web browsing remnants. Id. As part of its software offerings, Enigma allowed users to download a free scanning version of SpyHunter 4 which would detect whether a computer had malware, spyware, ransomware, Trojans, rootkits, viruses or other malicious or threatening software. Id. ¶ 50. SpyHunter 4 also allegedly detected PUPs based on defined objective and industry-based criteria. Id. In addition to the free scanning version, Enigma also gave users the option to buy the full version of SpyHunter 4 and provided users with a “Buy Now” link to do so. Id. The full version of SpyHunter 4 included the scanner, tools to remove and remediate malware, and other security protection features. Id. Enigma also previously provided users with a free version of RegHunter 2 which, among other features, scanned for and detected privacy and optimization issues and
2 The Background is a summary of the allegations in the SAC that are relevant to the issues raised in the motion to dismiss. Case No.: 5:17-cv-02915-EJD “effected certain repairs.” Id. ¶ 51. As it did with SpyHunter 4, Enigma gave users the option of paying for and accessing a full version of RegHunter 2 which included additional privacy tools and registry repair functions. Id. Malwarebytes is a software company that sells, markets, and directly competes with Enigma in the anti-malware and Internet security market. Id. ¶ 7. Its flagship anti-malware offerings (collectively known as “MBAM”) directly competed with Enigma’s SpyHunter 4 product for the entirety of SpyHunter 4’s market life. Id. Moreover, Malwarebytes promotes, markets, and sells its MBAM products as consumer and business solutions that detect and remove malware, PUPs, and other potentially threatening programs on users’ computers. Id. The MBAM products detect PUPs, automatically identify and list those purported PUPs as “threats,” and automatically quarantine those programs, blocking their operation and rendering them inaccessible for users. Id. ii. Malwarebytes’ Identification of Enigma’s Products From its inception in 2008 until October 4, 2016, Malwarebytes’ products did not identify any of Enigma’s products as “malicious,” “threats,” PUPs, or any other label denoting an unwanted or problematic program. SAC ¶ 10. Malwarebytes also did not quarantine or block businesses or consumers from using any of Enigma’s products, including SpyHunter 4 and RegHunter 2. Id. On October 5, 2016, however, Malwarebytes revised the “criteria” it used to identify PUPs. Id. ¶ 12. The new criteria identified SpyHunter 4 and RegHunter 2 as PUPs and “threats.” Id. As a result, if a consumer had SpyHunter 4 or RegHunter 2 on his or her computer and then downloaded or scanned that computer with MBAM products, the MBAM products would automatically quarantine the Enigma products and identify them to the consumer as “threats” and PUPs, denying users access to the products’ protection features. Id. ¶ 117. Once the products were quarantined, the consumer would not be able to automatically launch or use SpyHunter 4 or RegHunter 2, even if the consumer attempted to restore those programs. Id. ¶ 121. The user Case No.: 5:17-cv-02915-EJD would have to access the “Quarantine” window and manually click the “Restore” button. Id. Further, Enigma claims that subsequent attempts by the user to “re-launch” the Enigma product would result in it being automatically quarantined, once again, by Malwarebytes’ MBAM products. Id. Enigma alleges that if the user restarted the computer, she would still not be able to launch the Enigma program upon reboot because Malwarebytes continued to block the operation of necessary Enigma files. Id. Alternatively, if a user had MBAM products on her computer and then attempted to download or install SpyHunter 4 or RegHunter 2, the MBAM products would block the installation of the programs regardless of whether the consumer tried to “restore” them from quarantine. Id. ¶ 123. Malwarebytes also acquired an anti-adware product called “AdwCleaner,” in October 2016. Id. ¶ 15. According to Enigma, AdwCleaner “identif[ies] for removal PUPs, adware, toolbars, and other unwanted software for its users.” Id. At the time Malwarebytes acquired AdwCleaner, the product did not identify SpyHunter 4 or RegHunter 2 as PUPs and “threats.” Id. Enigma alleges this changed following Malwarebytes’ acquisition, as AdwCleaner began identifying, detecting, and pre-selecting for removal SpyHunter 4 and RegHunter 2 as PUPs and “threats.” Id. ¶ 16. AdwCleaner would then quarantine and block these products in a similar way as Malwarebytes’ MBAM products. Id. After Malwarebytes began identifying and blocking Enigma’s products as “threats” and PUPs, Enigma attempted to mitigate the issue by providing its users with an option to download an alternative SpyHunter 4 installer that disabled Malwarebytes’ MBAM products and allowed the user to use SpyHunter 4 instead. Id. ¶ 165. In December 2016, Enigma issued a press release to announce this “Countermeasure” informing its customers that it had developed the alternative installer to allow those customers who wished to use SpyHunter instead of MBAM to do so. Id. ¶ 166. Thereafter, MBAM products began blocking all *.enigmasoftware.com domains and designating them “Malicious Website[s].” Id. ¶ 167. Enigma also became aware of a Malwarebytes’ “Trusted Advisor” identified as “Aura” Case No.: 5:17-cv-02915-EJD who wrote on Malwarebytes’ message board forum that Malwarebytes was “now flagging SpyHunter products following a more aggressive stance against PUP” and that “SpyHunter fits in many of the [PUP] criterias [sic].” Id. ¶ 141. After another forum user mentioned that they would be cancelling their subscription to SpyHunter, Aura replied: “[m]ake sure that your subscription gets cancelled for real when you do, since there’s been a lot of report[s] in the past (and even today) of users still being charged by [Enigma] for SpyHunter[.]” Id. In June 2018, EnigmaSoft, an Enigma affiliate, released SpyHunter 5, an adaptive malware detection and removal software designed to target a wide range of threats and potential problems to protect users’ cybersecurity. Id. ¶ 171. According to Enigma, two months after SpyHunter 5’s introduction, MBAM products began to detect, quarantine, and block SpyHunter 5 as an identified PUP and “threat.” Id. ¶ 172. Enigmasoft contacted Malwarebytes requesting an explanation for why SpyHunter 5 had been designated as a PUP and “threat” and for Malwarebytes to reconsider its designation. Id. ¶ 173. Malwarebytes never provided Enigmasoft with a formal explanation nor did it respond by changing the designations of any Enigma products. Id. B. Procedural History Enigma first brought this action in the Southern District of New York alleging that Malwarebytes’ actions (1) violated the Lanham Act § 43(a), (2) violated New York General Business Law § 349, (3) constituted tortious interference with Enigma’s contractual relations, and (4) constituted tortious interference with Enigma’s business relations. After Enigma amended its complaint, Malwarebytes moved to transfer the case under 28 U.S.C. § 1404, and in the alternative, to dismiss Enigma’s complaint pursuant to Federal Rules of Civil Procedure 12(b)(2) and 12(b)(6). In May 2017, the court held that transfer of venue to the Northern District of California was warranted for the convenience of the parties and witnesses, and in the interest of justice. See Enigma Software Grp. USA, LLC v. Malwarebytes Inc., 260 F. Supp. 3d 401, 413 (S.D.N.Y. 2017). Although the court granted Malwarebytes’ motion to transfer venue, it declined to rule on Malwarebytes’ motion to dismiss for lack of personal jurisdiction and for failure to state Case No.: 5:17-cv-02915-EJD a claim. Therefore, Malwarebytes renewed its motion to dismiss all of Enigma’s claims once the case was before this Court. The Court entered an order granting Malwarebytes’ motion finding that Malwarebytes was entitled to immunity under 47 U.S.C. § 230(c)(2)(B) of the Communications Decency Act of 1996 with respect to all of Enigma’s claims. See Order Granting Defendant’s Motion to Dismiss (“Order”), Dkt. No. 105. Enigma appealed the Court’s Order, and the Ninth Circuit considered the extent of the Communications Decency Act’s immunity provision. The Ninth Circuit panel reversed and remanded the Court’s Order, holding that § 230 does not immunize blocking a competitor for anticompetitive reasons. See Enigma Software Group USA, LLC v. Malwarebytes, Inc., 946 F.3d 1040, 1053-54 (9th Cir. 2019), cert. denied, 141 S. Ct. 13, 2020. Following the Ninth Circuit’s denial of Malwarebytes’ petition for panel and en banc rehearing, Malwarebytes filed a petition to the United States Supreme Court for a writ of certiorari. The Supreme Court denied Malwarebytes’ petition and the case was then remanded to this Court for further proceedings. Following remand, Enigma filed its SAC asserting the same four claims as its earlier complaint. Malwarebytes has moved to dismiss all claims with prejudice. See Defendant Malwarebytes’ Motion to Dismiss Second Amended Complaint (“Mot.”), Dkt. No. 147. Enigma has filed an opposition (“Opp’n”) to the motion to dismiss and Malwarebytes has also filed its reply (“Reply”). See Dkt. Nos. 153, 155. Federal Rule of Civil Procedure 8(a) requires a plaintiff to plead each claim with sufficient specificity to “give the defendant fair notice of what the . . . claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (internal quotations omitted). The factual allegations in the complaint “must be enough to raise a right to relief above the speculative level” such that the claim “is plausible on its face.” Id. at 556-57. A complaint that falls short of the Rule 8(a) standard may be dismissed if it fails to state a claim upon which relief can be Case No.: 5:17-cv-02915-EJD granted. Fed. R. Civ. P. 12(b)(6). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). A. Request for Judicial Notice The Court first addresses Malwarebytes’ request for judicial notice. Although a district court generally may not consider any material beyond the pleadings in ruling on a Rule 12(b)(6) motion, the Court may take judicial notice of documents referenced in the complaint, as well as matters in the public record, without converting a motion to dismiss into one for summary judgment. See Lee v. City of Los Angeles, 250 F.3d 668, 688-89 (9th Cir. 2001), overruled on other grounds by Galbraith v. Cty. of Santa Clara, 307 F.3d 1119, 1125-26 (9th Cir. 2002). In addition, the Court may take judicial notice of matters that are either “generally known within the trial court’s territorial jurisdiction” or “can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). Public records for instance, including judgments and other court documents, are proper subjects of judicial notice. See, e.g., United States v. Black, 482 F.3d 1035, 1041 (9th Cir. 2007). Malwarebytes requests for the Court to take judicial notice of two sets of exhibits. Dkt. No. 147-12, (“RJN”). Malwarebytes firsts asks the Court to take judicial notice of Exhibits A through J attached to the declaration of Moez M. Kaba (“Kaba Decl.”). Exhibits A and B are copies of previous complaints filed by Enigma. See Kaba Decl. ¶¶ 2-3, Exs. A-B. Exhibit C is a consumer class action complaint filed against Enigma. Id. ¶ 4, Ex. C. Enigma opposes Malwarebytes’ request for the Court to take judicial notice of Exhibits A-C believing they are not relevant to its claims. The Court GRANTS Malwarebytes’ request, as these are filings in related federal court proceedings and relevant to what Malwarebytes knew about Enigma. See Black, 482 F.3d at 1041. Second, Malwarebytes requests judicial notice of a collection of press releases and cease Case No.: 5:17-cv-02915-EJD and desist letters issued by Enigma and obtained from its website, www.enigmasiftware.com. Kaba Decl. ¶¶ 5-6, Exs. D-E. Specifically, Malwarebytes requests that the Court take judicial notice of Enigma publicly stating it has sent “several Cease and Desist letters” to other security software providers based on their classification of Enigma’s SpyHunter program “as a security threat.” Kaba Decl. ¶ 5, Ex. D. Although Enigma disputes the purpose of the press releases, courts in the Ninth Circuit have previously taken judicial notice of press releases. See, e.g., In re Netflix, Inc. Sec. Litig., No. C 04–2978 WHA, 2005 WL 3096209, at *1 (N.D. Cal. Nov. 18, 2005); In re Ligand Pharms., Inc. Sec. Litig., No. 04CV1620DMS(LSP), 2005 WL 2461151, at *2 n. 1 (S.D. Cal. Sept. 27, 2005); In re Homestore.com. Inc. Sec. Litig., 347 F. Supp. 2d 814, 816–17 (C.D. Cal. 2004) (stating that the court can take judicial notice of press releases). Moreover, the Court finds that the press releases and cease and desist letters are relevant to Enigma’s allegations that Malwarebytes had “no objective or good faith” basis to believe Enigma software was a potential threat. See, e.g., SAC ¶¶ 179-80, 196 (asserting that Malwarebytes’ classification of Enigma software was “pretextual”); see also Veronica Foods Co. v. Ecklin, No. 16-CV-07223- JCS, 2017 WL 2806706, at *4 (N.D. Cal. June 29, 2017) (judicially noticing documents which were relevant because they undermined plaintiff’s allegations of misappropriation of trade secrets by demonstrating that the plaintiff had publicly disclosed those supposed secrets). The Court therefore GRANTS Malwarebytes’ request and takes judicial notice of Exhibits D and E. For the same reasons, the Court will also take judicial notice of publicly available letters between Enigma and an individual who referred to Enigma’s software as “ransomware,” “rouge,” and “malicious.” See Kaba Decl. ¶¶ 7-9, Exs. F, G, H.3 The letters directly relate to Enigma’s allegations that Malwarebytes designations and complaints about Enigma’s programs were “pretextual.” See SAC ¶ 196. Therefore, Malwarebytes’ request for judicial notice of Exhibits F, G, and H is GRANTED.
3 The letters are available on a “publicly accessible website[],” which is a “[p]roper subject[] of judicial notice.” Minor v. Fedex Off. & Print Servs., Inc., 182 F. Supp. 3d 966, 974 (N.D. Cal. 2016). Case No.: 5:17-cv-02915-EJD Next, Malwarebytes requests the Court take judicial notice or incorporate by reference Exhibits I and J, which are publicly available webpages on Malwarebytes’ website. Kaba Decl. ¶¶ 10-11, Exs. I-J. Exhibit I is a webpage which purports to explain Malwarebytes’ characterization of SpyHunter as a “PUP.Optional” program. Id. ¶ 10. Relatedly, Exhibit J displays a webpage informing users what it means when Malwarebytes blocks a website. Id. ¶ 11. It is well- established that “[c]ourts may take judicial notice of publications introduced to indicate what was in the public realm at the time, not whether the contents of those articles were in fact true.” Von Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 960 (9th Cir. 2010) (internal quotations omitted); see also Packsys, S.A. de C.V. v. Exportadora de Sal, S.A. de C.V., 899 F.3d 1081, 1087 n.2 (9th Cir. 2018) (“We take notice of the fact of publication, but do not assume the truth of the article’s contents.”). The Court therefore takes judicial notice of Malwarebytes making the statements and publishing them on the webpages, does not assume the truth of those statements. The request for judicial notice of Exhibits I and J is GRANTED; the Court need not decide whether the blog post was incorporated by reference. See In re Google Assistant Priv. Litig., 457 F. Supp. 3d 797, 813 (N.D. Cal. 2020). Lastly, Malwarebytes requests that the Court take judicial notice of Exhibits 1 through 3 attached to the declaration of Nathan Scott (“Scott Decl.”). See Dkt. Nos. 98-10, -11, -12. Exhibits 1 through 3 are screenshots of Enigma’s SpyHunter 4 product taken on November 14, 2016, showing the program’s scanning and purchasing functionalities shortly after Enigma filed its complaint against Malwarebytes. These documents are judicially noticeable because they are capable of accurate and ready determination using sources whose accuracy cannot reasonably be questioned. See Fed. R. Evid. 201(b). Malwarebytes notes that Enigma cannot dispute the accuracy of the screenshots because they depict its own program. Further, the alleged contents of the screenshots are in Enigma’s SAC, thus demonstrating the importance of the depictions to the case as it relates to Malwarebytes’ reasoning for labeling Enigma’s software as a PUP and “threat.” See Datel Holdings Ltd. v. Microsoft Corp., 712 F. Supp. 2d 974, 985 (N.D. Cal. 2010). Case No.: 5:17-cv-02915-EJD Accordingly, the Court GRANTS Malwarebytes’ request for judicial notice of Exhibits 1 through 3. B. Appropriate State Substantive Law i. Legal Standard Ordinarily, a federal court exercising diversity jurisdiction must apply the substantive law of the state in which the court sits, except in matters governed by the U.S. Constitution or federal statutes. Erie R. Co. v. Tompkins, 304 U.S. 64, 78 (1938). The Supreme Court has identified an exception to that principle for cases transferred pursuant to 28 U.S.C. § 1404(a), requiring the transferee district court to apply the state law of the original transferor court. Atl. Marine Constr. Co. v. U.S. Dist. Ct. for W. Dist. of Texas, 571 U.S. 49, 59 (2013) (citing Van Dusen v. Barrack, 376 U.S. 612, 639 (1964)). This exception is inapplicable to cases transferred pursuant to 28 U.S.C. § 1406 because transfer was effectuated in part to cure a lack of personal jurisdiction. See Muldoon v. Tropitone Furniture Co., 1 F.3d 964, 966–67 (9th Cir. 1993); Nelson v. Int’l Paint Co., 716 F.2d 640, 643 (9th Cir. 1983) (“In [§ 1406(a)] cases, however, it is necessary to look to the law of the transferee state, also to prevent forum shopping, and to deny plaintiffs choice-of-law advantages to which they would not have been entitled to in the proper forum.”). Here, the parties dispute the appropriate state substantive law that governs Enigma’s claims. Malwarebytes contends that California law applies because the district court in New York lacked personal jurisdiction. Mot. at 8-11. On the other hand, Enigma argues that New York substantive law must apply because personal jurisdiction was proper in New York and the case was transferred pursuant to § 1404(a). Opp’n. at 14-18. Because the district court in New York did not rule on the propriety of jurisdiction, “the [Court] must determine whether . . . jurisdiction would have been proper in the transferor court in order to decide which forum state’s law will apply under Erie.” Davis v. Costa–Gavras, 580 F. Supp. 1082, 1086 (S.D.N.Y. 1984) (citing Roofing & Sheet Metal Servs., Inc. v. La Quinta Motor Inns, Inc., 689 F.2d 982, 992–93 (11th Cir. 1982)); Ellis v. Great Sw. Corp., 646 F.2d 1099, 1107 (5th Cir. 1981); Martin v. Stokes, 623 F.2d Case No.: 5:17-cv-02915-EJD 469, 474 (6th Cir.1980). Thus, the Court must apply the personal jurisdiction laws of New York to determine whether the Southern District of New York had personal jurisdiction over Malwarebytes. In assessing whether personal jurisdiction is proper, “the court must look first to the long- arm statute of the forum state, in this instance, New York.” See Bensusan Rest. Corp. v. King, 126 F.3d 25, 27 (2d Cir. 1997) (citation omitted). “If the exercise of jurisdiction is appropriate under that statute, the court then must decide whether such exercise comports with the requisites of due process.” Id. In the present case, Enigma contends that jurisdiction over Malwarebytes is proper pursuant to New York’s long-arm statute, which provides as follows:
(a) Acts which are the basis of jurisdiction. As to a cause of action arising from any of the acts enumerated in this section, a court may exercise personal jurisdiction over any non-domiciliary, or his executor or administrator, who in person or through an agent: (1) transacts any business within the state or contracts anywhere to supply goods or services in the state; (2) commits a tortious act within the state, except as to a cause of action for defamations of character arising from the act; or (3) commits a tortious act without the state causing injury to person or property within the state, except as to a cause of action for defamation of character arising from the act, if he (i) regularly does or solicits business, or engages in any other persistent course of conduct, or derives substantial revenue from goods used or consumed or services rendered, in the state, or (ii) expects or should reasonably expect the act to have consequences in the state and derives substantial revenue from interstate or international commerce; or (4) owns, uses or possesses any real property situated within the state. N.Y. C.P.L.R. § 302(a)(1)-(4).4 As the New York Court of Appeals has explained, § 302(a)(1) is a
4 In this case, Malwarebytes correctly points out, and Enigma does not dispute, that there is no general jurisdiction over Malwarebytes under N.Y. C.P.L.R. § 301, because it is clear that Malwarebytes is not conducting “continuous and systematic” business in New York to warrant a finding of their “presence” in New York. See McGowan v. Smith, 52 N.Y.2d 268, 272–73 (1981). Case No.: 5:17-cv-02915-EJD “single act” statute pursuant to which “proof of one transaction in New York is sufficient to invoke jurisdiction, even though the defendant never enters New York, so long as the defendant’s activities [in New York] were purposeful and there is a substantial relationship between the transaction and the claim asserted.” Kreutter v. McFadden Oil Corp., 71 N.Y.2d 460, 467 (1988) (citations omitted). In determining whether a defendant “transacts business” in New York as contemplated by § 302(a)(1), the Court may consider a variety of factors, including: (i) whether the defendant has an on-going contractual relationship with a New York corporation; (ii) whether the contract was negotiated or executed in New York, and whether, after executing a contract with a New York business, the defendant has visited New York for the purpose of meeting with parties to the contract regarding the relationship; (iii) what the choice-of-law clause is in any such contract; and (iv) whether the contract requires [defendants] to send notices and payments into the forum state or subjects them to supervision by the corporation in the forum state. Agency Rent A Car Sys., Inc. v. Grand Rent A Car Corp., 98 F.3d 25, 29 (2d Cir. 1996) (internal citations omitted). “Although all are relevant, no one factor is dispositive. Other factors may also be considered, and the ultimate determination is based on the totality of the circumstances.” Id. (citation omitted). ii. Malwarebytes’ Contacts with New York To establish that the Southern District of New York had personal jurisdiction over Malwarebytes, Enigma claims Malwarebytes “regularly transacts business” in New York by offering and selling its programs on its website to customers who include New York residents, “has committed tortious acts in [the state],” has “misled and deceived consumers and businesses in New York,” and has “disrupted and disabled use of [Enigma’s] program” in New York. SAC ¶¶ 37-42. Enigma also alleges that at least thirty-one Enigma customers who reside in New York have reported to Enigma that Malwarebytes’ products have detected, quarantined, and/or blocked Enigma’s programs as PUPs and “threats.” Id. ¶ 38. This, in turn, prompted some of those Case No.: 5:17-cv-02915-EJD customers to request refunds from Enigma. Id. Moreover, Enigma alleges that at least five Malwarebytes employees currently work in New York, including a director of channel sales and development, a senior sales engineer, and a senior researcher. Id. ¶ 37.5 Based on the foregoing contacts, the Court finds that Malwarebytes does not have sufficient minimum contacts with New York to satisfy the state’s long-arm statute or constitutional due process. First, Enigma’s allegations do not establish that Malwarebytes purposefully directed its alleged activity towards New York. Under subsection 302(a)(1), the Court “looks to: (1) whether a defendant has transacted business in such a way that it constitutes purposeful activity; and (2) whether there is an articulable nexus, or a substantial relationship, between the claim asserted and the actions that occurred in New York.” Megna v. Biocomp Lab’ys Inc., 166 F. Supp. 3d 493, 497–98 (S.D.N.Y. 2016). Maintenance of an “interactive” website that is available to, but does not “specifically target,” New York users does not establish jurisdiction under § 302(a)(1). Seldon v. Direct Response Techs., Inc., No. 03 CIV.5381 (SAS), 2004 WL 691222, at *5 (S.D.N.Y. Mar. 31, 2004). Enigma does not allege any facts showing that Malwarebytes’ website specifically targeted New York residents. Rather, Enigma relies on the alleged existence of some users of Malwarebytes’ MBAM software in New York. But the Supreme Court held that specific jurisdiction must be based on “contacts that the ‘defendant himself’ creates with the forum State.” Walden v. Fiore, 571 U.S. 277, 284 (2014) (citation omitted). The Supreme Court explained that it has “consistently rejected attempts to satisfy the defendant-focused ‘minimum contacts’ inquiry by demonstrating contacts between the plaintiff (or third parties) and the forum State.” Id. (citations omitted). The Second Circuit has reiterated that courts must focus on “the relationship
5 Enigma also argued that Malwarebytes has additional contacts with New York residents that, while not discussed in the SAC, are “reasonable inferences therefrom” that help establish personal jurisdiction. See Opp’n at 16. The Court, however, will not consider these conclusory allegations in its analysis. See Byun v. Amuro, No. 10 CIV. 5417 DAB, 2011 WL 10895122, at *3 (S.D.N.Y. Sept. 6, 2011) (on a 12(b)(2) motion, “conclusory allegations lacking factual specificity do not satisfy plaintiff's burden” and “the Court will not draw argumentative inferences in the plaintiff’s favor” (quoting Robinson v. Overseas Mil. Sales Corp., 21 F.3d 502, 507 (2d Cir. 1994))). Case No.: 5:17-cv-02915-EJD among the defendant, the forum, and the litigation,” rather than a plaintiff’s or third party’s contacts with the forum. Waldman v. Palestine Liberation Org., 835 F.3d 317, 335-37 (2d Cir. 2016). The Court must look to “defendants’ suit-related conduct,” or “conduct that could have subjected them to liability,” to evaluate whether the defendant itself created ties with the forum. Id. The conduct at issue here is not “sufficiently connected” to New York because Malwarebytes’ potential liability does not arise from its actions in the forum state. Id. Malwarebytes’ “suit-related conduct” occurred in California, where it developed and executed its criteria for PUPs. See Decl. of Mark Harris (“Harris Decl.”), Dkt. No. 39 ¶ 13. Further, Malwarebytes maintains its website from which its software is distributed in California and its programs are accessible throughout the United States. Id. ¶¶ 6, 13. Therefore, Enigma’s reliance on its claim that thirty-one users of both parties’ programs reside in New York is insufficient to establish jurisdiction. See Walden, 571 U.S. at 286 (“Due process requires that a defendant be haled into court in a forum State based on his own affiliation with the State, not based on the ‘random, fortuitous, or attenuated’ contacts he makes by interacting with other persons affiliated with the State.”). Next, Enigma argues that the Southern District of New York has personal jurisdiction over Malwarebytes pursuant to N.Y. C.P.L.R. § 302(a)(2). Under § 302(a)(2), a court may exercise personal jurisdiction over a non-domiciliary if the non-domiciliary “commits a tortious act within the state, except as to a cause of action for defamation of character arising from the act.” N.Y. C.P.L.R. § 302(a)(2). The defendant, however, must actually be present in New York to be subject to personal jurisdiction under N.Y. C.P.L.R. § 302(a)(2). See, e.g., 7 W. 57th St. Realty Co., LLC v. Citigroup, Inc., No. 13 CIV. 981 PGG, 2015 WL 1514539, at *7 (S.D.N.Y. Mar. 31, 2015) (“‘[T]he New York Court of Appeals has interpreted [this] subsection to reach only tortious acts performed by a defendant who was physically present in New York when he committed the act.’”); Elsevier, Inc. v. Grossman, 77 F. Supp. 3d 331, 345 (S.D.N.Y. 2015) (“A ‘defendant’s physical presence in New York is a prerequisite to jurisdiction under § 302(a)(2).’”). Because Case No.: 5:17-cv-02915-EJD Malwarebytes is not physically present in New York, § 302(a)(2) is not a basis for personal jurisdiction. Lastly, the Court turns to N.Y. C.P.L.R. § 302(a)(3). Here, Enigma argues a New York court’s exercise of personal jurisdiction over Malwarebytes would be appropriate. Enigma again relies on alleged cancellation, non-renewal, and/or refund requests it has received from customers residing in New York who were unable to use Enigma’s programs because Malwarebytes designated its programs as PUPs and “threats.” Opp’n at 15-16 (citing SAC ¶¶ 38, 159, 162). Even if Enigma’s allegations properly established injury within New York, subjecting Malwarebytes to personal jurisdiction based on the injury to a third-party in New York would violate due process. Walden, 571 U.S. at 290 (“The proper question is not where the plaintiff experienced a particular injury or effect but whether the defendant’s conduct connects him to the forum in a meaningful way”); see also Waggaman v. Arauzo, 117 A.D.3d 724, 725 (2014) (provision of medical services to a New York resident’s mother was “attenuated connection” to forum under Walden). In addition to this alleged injury, Enigma needed to establish that New York was the “focal point of the torts alleged” and that Malwarebytes “expressly aimed” its conduct toward the state to confer jurisdiction. See Waldman, 835 F.3d at 337-340. As the Court indicated above, Malwarebytes asserts that it does not develop the relevant PUPs criteria in New York. Further, Malwarebytes is not incorporated, headquartered, or operated out of the state of New York and neither its advertisements nor its websites specifically target the state of New York. Mot. at 9; Harris Decl. ¶¶ 4, 5, 6, 11. Accordingly, Enigma has not demonstrated a sufficient basis for the Court’s exercise of personal jurisdiction in this action under New York’s long-arm statute because it does not comport with due process protections established under the Constitution. Because New York lacked personal jurisdiction over Malwarebytes, California law applies. The Court will now turn to Enigma’s individual claims. C. Enigma’s Claims i. Lanham Act § 43(a) Case No.: 5:17-cv-02915-EJD Malwarebytes contends that Enigma has not alleged the requisite elements to state a claim for violation of § 43(a) of the Lanham Act. Fundamentally, Malwarebytes argues that Enigma has not alleged and cannot allege that Malwarebytes made actionable false statements. To state a claim under § 43(a) of the Lanham Act, a plaintiff must allege that: (1) the defendant made a false statement of fact in a commercial advertisement, (2) the statement actually deceived or has the tendency to deceive a substantial segment of its audience, (3) the statement is material, (4) the defendant caused the statement to “enter interstate commerce,” and (5) the plaintiff has been or is likely to be injured as a result of the false statement. Southland Sod Farms v. Stover Seed Co., 108 F.3d 1134, 1139 (9th Cir. 1997). Statements of opinion that are not capable of being proven false do not give rise to civil liability. Coastal Abstract Serv., Inc. v. First Am. Title Ins. Co., 173 F.3d 725, 731 (9th Cir. 1999) (holding that vague and subjective statement that the plaintiff was “too small” to handle certain business did not give rise to liability under the Lanham Act or a claim of defamation under California law). As mentioned, the focus of Enigma’s § 43(a) claim is Malwarebytes’ allegedly false and misleading labeling of Enigma’s software programs and domains as “malicious,” “threats,” and PUPs. See SAC ¶¶ 214-23; see also Opp’n at 18-19. Enigma contends that these labels and categorizations are objectively verifiable statements and actionable, whereas Malwarebytes argues they are opinions and non-actionable. Malwarebytes adds that the challenged labels are based on criteria that it has developed and refined but that Enigma itself alleges is “subjective” and “vague.” Mot. at 12 (citing SAC ¶ 12) (“Malwarebytes’ new criteria rejected specific objective or scientific standards in favor of subjective characteristics.”). In Asurvio LP v. Malwarebytes Inc., this Court was asked to consider a similar scenario after Malwarebytes categorized Asurvio’s software products as PUPs and stated that the products used “false positives,” were “bogus,” and a “scam.” Asurvio LP v. Malwarebytes Inc., No. 5:18-CV-05409-EJD, 2020 WL 1478345, at *6 (N.D. Cal. Mar. 26, 2020). The Court found that Asurvio’s Lanham Act claims failed as a matter of law because Asurvio did not allege sufficient facts to show that Malwarebytes’ labels and warnings Case No.: 5:17-cv-02915-EJD about Asurvio’s products were verifiably false rather than subjective opinions. Id. The present case is indistinguishable. Like in Asurvio LP, Enigma has not pleaded that Malwarebytes’ alleged labels are verifiably false rather than just subjective opinions. Enigma’s allegations that users view statements categorizing Enigma’s programs and domains as “malicious,” “threats,” and PUPs as statements of fact rather than subjective opinions are not supported by the facts presented. The allegations ignore that users of Malwarebytes are aware of why it opines that a given software program may be a PUP based on Malwarebytes’ disclosed criteria and can choose to quarantine or un-quarantine the detected program. See, e.g., SAC, Ex. 15 at 22; Kaba Decl. ¶¶ 10-11, Exs. I, J; see also ZL Techs., Inc. v. Gartner, Inc., 709 F. Supp. 2d 789, 797-98 (N.D. Cal. 2010) (finding that an information technology analyst’s assessment and ranking of a software company in an industry report distributed to potential customers of the software company is a “non-actionable opinion”). Furthermore, Enigma’s allegations that Malwarebytes knew the labels used to describe Enigma’s programs were false are conclusory and need not be accepted as true. See ZL Techs., Inc., 709 F. Supp. 2d at 796 (holding that “[e]ven on a motion to dismiss, the Court need not accept as true” the plaintiff’s conclusory allegations that a statement is actionable). Because Enigma has not alleged sufficient facts to establish the falsity of Malwarebytes’ labels and related statements about Enigma’s software programs, the Lanham Act claim is subject to dismissal and the Court need not address Malwarebytes’ remaining legal challenges to this claim. ii. New York General Business Law § 349 (Claim II) The statements and labels discussed above are the predicate for Enigma’s claim under New York General Business Law (“NYGBL”) § 349. Still, because the Court has found that New York law does not apply in this case, Enigma’s NYGBL claims must be dismissed. Even if New York law did apply, however, Enigma’s claim under NYGBL § 349 would fail because Enigma relies on the same allegations underlying its Lanham Act claim. To state a claim under NYGBL § 349, “a plaintiff must allege that a defendant has engaged in (1) consumer-oriented conduct that is (2) Case No.: 5:17-cv-02915-EJD materially misleading and that (3) plaintiff suffered injury as a result of the allegedly deceptive act or practice.” Orlander v. Staples, Inc., 802 F.3d 289, 300 (2d Cir. 2015) (quoting Koch v. Acker, Merrall & Condit Co., 18 N.Y.3d 940, 941 944 (2012). The standards for bringing a NYGBL § 349 claim “are substantially the same as those applied to claims brought under” § 43(a) of the Lanham Act. Avon Prod., Inc. v. S.C. Johnson & Son, Inc., 984 F. Supp. 768, 800 (S.D.N.Y. 1997). Further, an opinion that is not actionable under the Lanham Act is also not actionable under NYGBL § 349. ONY, Inc. v. Cornerstone Therapeutics, Inc., 720 F.3d 490, 498 (2d Cir. 2013). Therefore, Enigma’s NYGBL § 349 claim shall be dismissed. iii. Tortious Interference with Contractual Relations (Claim III) To state a claim for tortious interference with contractual relations, a plaintiff must allege: “(1) a valid contract between plaintiff and a third party; (2) defendant’s knowledge of this contract; (3) defendant’s intentional acts designed to induce a breach or disruption of the contractual relationship; (4) actual breach or disruption of the contractual relationship; and (5) resulting damage.” Quelimane Co. v. Stewart Title Guar. Co., 19 Cal. 4th 26, 55 (1998). Enigma’s tortious interference with contractual relations claim fails for two reasons. Enigma first fails to identify a specific contractual obligation with which Malwarebytes interfered. Enigma also fails to adequately plead that Malwarebytes engaged in any independently wrongful act which interfered with a specific contractual obligation under its at-will agreements with users. See Cuba v. Pylant, 814 F.3d 701, 717 (5th Cir. 2016) (requiring “some evidence that the defendant knowingly induced one of the contracting parties to breach its obligations under a contract”); see also Ixchel Pharma, LLC v. Biogen, Inc., 9 Cal. 5th 1130, 1148 (2020) (“We therefore hold that to state a claim for interference with an at-will contract by a third party, the plaintiff must allege that the defendant engaged in an independently wrongful act.”). Instead, Enigma recognizes that Malwarebytes identifies Enigma’s software programs as PUPs yet provides instructions which allow the user to choose whether to continue using those products. See SAC ¶ 120, Ex. 15 at 22-23, 30-31, 46 (providing instructions for how to ignore detected Case No.: 5:17-cv-02915-EJD threats); Kaba Decl. ¶ 11, Ex. J (providing link to instructions to “[e]xclude detections in Malwarebytes on Windows devices”). Thus, Enigma’s tortious interference with contractual relations claim is dismissed. iv. Tortious Interference with Business Relations (Claim IV) Enigma’s final claim asserts that by labeling Enigma’s software programs and domains as “malicious,” “threats,” and PUPs, Malware tortiously interfered with Enigma’s “prospective business relationships between [Enigma’s] users and Enigma” because it induces users not to complete the installation or purchase of licenses for its software. SAC ¶ 246. To state a claim for tortious interference with business relations under California law, a plaintiff must show “(1) an economic relationship between the [claimant] and some third party, with the probability of future economic benefit to the [claimant], (2) that the opposing party knew of the relationship, (3) an intentional, wrongful act designed to disrupt the relationship, (4) actual disruption of the relationship, and (5) that the act caused economic harm to the claimant.” Korea Supply Co. v. Lockheed Martin Corp., 29 Cal. 4th 1134, 1153 (2003). Further, to satisfy the third element of an intentional interference claim—i.e., intentional, wrongful conduct designed to disrupt a business relationship—a claimant “must plead that the alleged interference was independently wrongful by some measure beyond the fact of the interference itself.” See Manwin Licensing Int’l S.A.R.L. v. ICM Registry, LLC, No. CV119514PSGJCGX, 2013 WL 12123772, at *8 (C.D. Cal. Feb. 25, 2013). The claimant can do so by pleading that the conduct was “proscribed by some constitutional, statutory, regulatory, common law, or other determinable legal standard.” Id. at *9. Here, Malwarebytes argues that since Enigma’s Lanham Act and NYGBL § 349 claims fail, Enigma’s tortious interference claim must also fail because Enigma does not allege any other independently wrongful conduct. Mot. at 20-21. The Court agrees, and, therefore, grants Malwarebytes’ motion to dismiss the claim for tortious interference with business relations on this ground. Case No.: 5:17-cv-02915-EJD 2 For the reasons set forth above, Malwarebytes’ motion to dismiss is GRANTED. Under 3 Federal Rule of Civil Procedure 15(a), leave to amend “should be freely granted when Justice so 4 requires.” When dismissing a complaint for failure to state a claim, a court should grant leave to 5 amend “unless it determines that the pleading could not possibly be cured by the allegation of 6 other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000). The Court finds that leave to 7 amend would be futile in this case for several reasons. First, Enigma has already had the 8 opportunity to amend its claims in the SAC. Second, the Court’s analysis is based in large part on 9 Malwarebytes’ labels, which are non-actionable statements of opinion. Accordingly, there are no 10 further facts Enigma can allege to cure the complaint. For these reasons, Enigma’s claims are 11 DISMISSED without leave to amend. a 12 IT IS SO ORDERED.
13 Dated: August 9, 2021
EDWARD J. DAVILA 15 United States District Judge 16
it
18 19 20 21 22 23 24 25 26 27 Case No.: 5:17-cv-02915-EJD 28 ORDER GRANTING DEFENDANT?’S MOTION TO DISMISS SECOND AMENDED COMPLAINT