1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION 7 8 ENIGMA SOFTWARE GROUP USA LLC, Case No. 17-cv-02915-EJD
9 Plaintiff, ORDER DENYING DEFENDANT’S RENEWED MOTION TO DISMISS 10 v. SECOND AMENDED COMPLAINT
11 MALWAREBYTES INC., Re: ECF No. 179 Defendant. 12
13 Plaintiff Enigma Software Group USA, LLC (“Enigma” or “Plaintiff”) brings this suit 14 alleging that Defendant Malwarebytes Inc. (“Malwarebytes” or “Defendant”) wrongfully 15 categorized Plaintiff’s cybersecurity and anti-malware software as “malicious,” a “threat,” and as a 16 Potentially Unwanted Program (“PUP”). In the operative Second Amended Complaint (the 17 “SAC”), Plaintiff asserts claims for (1) violations of the Lanham Act; (2) violations of New York 18 General Business Law (“NYGBL”) § 349; (3) tortious interference with contractual relations; and 19 (4) tortious interference with business relations. See SAC, ECF No. 140. Now pending before the 20 Court is Defendant’s Renewed Motion to Dismiss Second Amended Complaint (the “Motion”). 21 See Mot., ECF No. 179. For the reasons discussed below, the Court DENIES the Motion. 22 I. BACKGROUND 23 A. Factual Allegations1 24 1. The Parties 25 Enigma is a Florida limited liability company that has developed cybersecurity software to 26
27 1 This Factual Allegations section is taken in large part from the Court’s prior order on Defendant’s initial motion to dismiss the SAC, see ECF No. 162, and included here for clarity. 1 combat malware, ransomware, viruses, Trojans, hackers, and other problematic computer system 2 attacks since at least 2003. SAC ¶¶ 2, 48. Enigma’s flagship anti-malware product, SpyHunter 4, 3 was an adaptive malware detection and removal tool that provided rigorous protection against the 4 latest malware threats. Id. ¶ 48. SpyHunter 4 was available on the market until mid-2018, when 5 an Enigma affiliate introduced a new anti-malware software program, SpyHunter 5. Id. Enigma 6 additionally offers a PC privacy and software optimizer program known as RegHunter 2. Id. ¶ 49. 7 RegHunter 2 is intended to enhance users’ personal privacy by providing certain privacy tools, 8 such as a powerful file-shredding function that ensures secure deletion and prevents unwanted 9 recovery of deleted files. Id. The program also offers a privacy scan which provides for removal 10 of web browsing history, temporary files, and other web browsing remnants. Id. 11 As part of its software offerings, Enigma allowed users to download a free scanning 12 version of SpyHunter 4. SAC ¶ 50. This free version detected whether a computer had malware, 13 spyware, ransomware, Trojans, rootkits, viruses or other malicious or threatening software. Id. 14 SpyHunter 4 also detected PUPs based on defined objective and industry-based criteria. Id. In 15 addition to the free scanning version, Enigma also gave users the option to buy the full version of 16 SpyHunter 4 and provided users with a “Buy Now” link to do so. Id. The full version of 17 SpyHunter 4 included the scanner, tools to remove and remediate malware, and other security 18 protection features. Id. Enigma also previously provided users with a free version of RegHunter 2 19 which, among other features, scanned for and detected privacy and optimization issues and 20 “effected certain repairs.” Id. ¶ 51. As with SpyHunter 4, users had the option of paying for and 21 accessing a full version of RegHunter 2, which included additional privacy tools and registry 22 repair functions. Id. 23 Malwarebytes is a Delaware corporation headquartered in Santa Clara, California. SAC ¶ 24 35. Malwarebytes is a software company that has competed with Enigma in the anti-malware and 25 internet security market since 2008. Id. ¶¶ 6–7. Its flagship anti-malware offerings—collectively 26 known as “MBAM” products—directly competed with Enigma’s SpyHunter 4 product for the 27 entirety of SpyHunter 4’s market life. Id. Moreover, Malwarebytes promotes, markets, and sells 1 its MBAM products as consumer and business solutions that detect and remove malware and other 2 potentially threatening programs on users’ computers. Id. MBAM products detect PUPs, 3 automatically identify and list those purported PUPs as threats, and automatically quarantine those 4 programs, blocking their operation and rendering them inaccessible for users. Id. 5 2. Malwarebytes’s Identification of Enigma’s Products 6 From Malwarebytes’s inception in 2008 until October 4, 2016, MBAM products did not 7 identify any of Enigma’s products as “malicious,” “threats,” “PUPs”, or any other label denoting 8 an unwanted or problematic program. SAC ¶ 10. Malwarebytes also did not quarantine or block 9 businesses or consumers from using any of Enigma’s products, including SpyHunter 4 and 10 RegHunter 2. Id. 11 On October 5, 2016, Malwarebytes revised the criteria it used to identify PUPs. Id. ¶ 12. 12 The new criteria identified SpyHunter 4 and RegHunter 2 as PUPs and threats. Id. As a result, if 13 a consumer had SpyHunter 4 or RegHunter 2 on his or her computer and then downloaded or 14 scanned that computer with MBAM products, the MBAM products would automatically 15 quarantine the Enigma products and identify them to the consumer as threats and PUPs, denying 16 users access to the products’ protection features. Id. ¶ 117. Once the products were quarantined, 17 the consumer would not be able to automatically launch or use SpyHunter 4 or RegHunter 2, even 18 if the consumer attempted to restore those programs. SAC ¶ 121. The user would have to access 19 the “Quarantine” window and manually click the “Restore” button. Id. Further, Enigma alleges 20 that subsequent attempts by the user to re-launch the Enigma product would result in another 21 automatic quarantine by Malwarebytes’s MBAM products. Id. Enigma alleges that if the user 22 restarted the computer, she would still not be able to launch the Enigma program upon reboot 23 because Malwarebytes continued to block the operation of necessary Enigma files. Id. 24 Alternatively, if a user had MBAM products on her computer and then attempted to download or 25 install SpyHunter 4 or RegHunter 2, the MBAM products would block the installation of the 26 programs regardless of whether the consumer tried to restore them from quarantine. Id. ¶ 123. 27 Also in October 2016, Malwarebytes acquired AdwCleaner, an anti-adware product. SAC 1 ¶ 15. AdwCleaner “identif[ies] for removal PUPs, adware, toolbars, and other unwanted software 2 for its users.” Id. At the time Malwarebytes acquired AdwCleaner, the product did not identify 3 SpyHunter 4 or RegHunter 2 as PUPs and threats. Id. Following Malwarebytes’s acquisition of 4 AdwCleaner, the program began identifying and detecting SpyHunter 4 and RegHunter 2 as PUPs 5 and threats, and began pre-selecting them for removal. Id. ¶ 16. Like MBAM products, 6 AdwCleaner would then quarantine and block Enigma’s programs. Id. 7 In December 2016, Enigma issued a press release announcing the launch of a 8 “Countermeasure” to Malwarebytes’s responses to Enigma’s programs. See SAC ¶¶ 165–66. The 9 Countermeasure provided users with an option to download an alternative SpyHunter 4 installer 10 that disabled Malwarebytes’s MBAM products and allowed use of SpyHunter 4 instead. Id. ¶ 165. 11 Immediately after the press release, MBAM products began blocking all *.enigmasoftware.com 12 domains and designating them “Malicious Website[s].” Id. ¶ 167. 13 Malwarebytes’s official company website includes a “Malwarebytes Forum” (the 14 “Forum”) which Malwarebytes designs and advertises as a place where users can “get advice from 15 tech experts” and “get personalized help removing adware, malware, spyware, ransomware, 16 trojans, viruses, and more from tech experts.” SAC ¶ 138 (internal alteration omitted). 17 Malwarebytes’s company representatives, spokespersons, and agents regularly post on the Forum 18 to market, advertise, and promote Malwarebytes’s products. Id. Enigma alleges that an individual 19 associated with Malwarebytes in a “Trusted Advisor” role posted under the name “Aura” on the 20 Forum, writing that Malwarebytes was “now flagging SpyHunter products following a more 21 aggressive stance against PUP” and that “SpyHunter fits in many of the [PUP] criterias [sic].” Id. 22 ¶ 141. After another Forum user mentioned that they would be canceling their subscription to 23 SpyHunter, Aura replied: “[m]ake sure that your subscription gets [canceled] for real when you 24 do, since there’s been a lot of report[s] in the past (and even today) of users still being charged by 25 [Enigma] for SpyHunter[.]” Id. Enigma alleges that Aura’s statement was an example of 26 Malwarebytes using the Forum to deliberately make deceptive, false, and misleading statements 27 about Enigma. See id. ¶¶ 138–41. 1 In June 2018, an Enigma affiliate called EnigmaSoft released the SpyHunter 5 program, 2 which is an adaptive malware detection and removal software designed to target a wide range of 3 threats and potential problems to protect users’ cybersecurity. Id. ¶ 171. According to Enigma, 4 two months after SpyHunter 5’s introduction, MBAM products began to detect, quarantine, and 5 block SpyHunter 5 as a PUP and a threat. SAC ¶ 172. EnigmaSoft contacted Malwarebytes, 6 requesting an explanation for and reconsideration of the designations. Id. ¶ 173. Malwarebytes 7 neither provided EnigmaSoft with a formal explanation nor changed the designations of any 8 Enigma products. Id. 9 B. Procedural History 10 1. Transfer from S.D.N.Y. 11 Enigma initiated this action in the Southern District of New York on October 7, 2016. See 12 Compl., ECF No. 1. Enigma filed a First Amended Complaint (“FAC”) on December 7, 2016. 13 See FAC, ECF No. 33. Malwarebytes moved to dismiss the FAC for lack of personal jurisdiction 14 and failure to state a claim or, in the alternative, to transfer the case to the Northern District of 15 California under 28 U.S.C. § 1404. See ECF No. 37. The district court granted the motion to 16 transfer and declined to reach the motion to dismiss. See ECF No. 67. 17 2. First N.D. Cal. Motion to Dismiss and Appeal 18 After the case was transferred to this district, Malwarebytes renewed its motion to dismiss 19 the FAC, arguing that Enigma failed to state a claim and, in the alternative, that Malwarebytes was 20 immune from suit as all of Enigma’s claims were barred by Section 230 of the Communications 21 Decency Act of 1996 (“Section 230”), 47 U.S.C. § 230(c)(2). See ECF No. 105. The Court 22 granted the motion, holding that Malwarebytes was immune from suit under Section 230. See 23 Order Granting Deft.’s Mot. Dismiss FAC (“First MTD Order”), ECF No. 105. The Court did not 24 reach the issue of whether Enigma failed to state a claim. See id. Enigma appealed, and the Ninth 25 Circuit reversed and remanded, holding that Section 230 did not apply to “blocking and filtering 26 decisions that [we]re driven by anticompetitive animus.” Enigma Software Grp. USA, LLC v. 27 Malwarebytes, Inc. (“Enigma I”), 946 F.3d 1040, 1050 (9th Cir. 2019). 1 3. Second N.D. Cal. Motion to Dismiss and Appeal 2 On remand, Enigma filed the SAC, asserting causes of action for (1) false advertising in 3 violation of the Lanham Act, 15 U.S.C. § 1125(a)(1)(B); (2) deceptive and unlawful business 4 practices in violation of NYGBL § 349; (3) tortious interference with contractual relations; and (4) 5 tortious interference with business relations. See SAC ¶¶ 213–50. Malwarebytes moved to 6 dismiss for failure to state a claim, and the Court dismissed all four claims without leave to amend. 7 See Order Granting Deft.’s Mot. Dismiss SAC (“Second MTD Order”), ECF No. 162. Regarding 8 the Lanham Act claim, the Court reasoned that Malwarebytes’s challenged designations of 9 Enigma’s products were nonactionable subjective opinions rather than verifiably false statements. 10 See id. at 16–17. In evaluating Enigma’s remaining three claims, the Court first determined that 11 California law applied to the claims because New York lacked personal jurisdiction over 12 Malwarebytes. Id. at 15. The Court held the NYGBL § 349 claim failed for that reason alone, and 13 reasoned that even if New York law applied, the claim failed for the same reasons as the Lanham 14 Act claim. See id. at 17–18. The Court further held that the contractual relations interference 15 claim failed to identify “a specific contractual obligation with which Malwarebytes interfered,” 16 and that the business relations interference claim failed because Enigma did not “allege any other 17 independently wrongful conduct” beyond the unsuccessful Lanham Act and NYGBL § 349 18 claims. See id. at 18–19. 19 Enigma appealed, and the Ninth Circuit affirmed in part, reversed in part, and remanded 20 for further proceedings. See Enigma Software Grp. USA, LLC v. Malwarebytes, Inc. (“Enigma 21 II”), 69 F.4th 665 (9th Cir. 2023). On the Lanham Act claim, the circuit court held that 22 Malwarebytes’s designations of “malicious” and “threat” were actionable statements of fact, while 23 the designation of “potentially unwanted program”—i.e., “PUP”—was too vague to be actionable. 24 See id. at 672. The court declined to assess the other elements of a Lanham Act claim in the first 25 instance, and remanded to this Court for further proceedings. See id. at 671 & n.2. The Ninth 26 Circuit additionally held that Malwarebytes is subject to personal jurisdiction in New York with 27 respect to its sales to New York customers, and accordingly concluded that New York law applied 1 to Enigma’s state-law claims based on those transactions. See id. at 675–76. The court did not 2 decide whether New York law applies to Malwarebytes’s transactions with customers outside 3 New York. See id. at 676. Because these two holdings removed the Court’s two bases for 4 dismissing the NYGBL claim, the Ninth Circuit also reversed that dismissal. See id. The Ninth 5 Circuit also held that the SAC sufficiently pleads a claim for tortious interference with business 6 relations, and reversed the Court’s dismissal of that claim. Id. at 677–78. The court affirmed the 7 dismissal of Enigma’s claim for tortious interference with contractual relations. Id. at 678. 8 4. Present Motion to Dismiss 9 Following the Ninth Circuit’s decision, Malwarebytes renewed its motion to dismiss the 10 SAC by filing the instant Motion. See Mot. Enigma filed an opposition, Malwarebytes filed a 11 reply, and the Court heard oral argument on January 17, 2024. See Opp’n, ECF No. 183; Reply, 12 ECF No. 185. 13 II. LEGAL STANDARD 14 Under Federal Rule of Civil Procedure 12(b)(6), a court must dismiss a complaint if it fails 15 to state a claim upon which relief can be granted. To survive a Rule 12(b)(6) motion, a plaintiff 16 must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. 17 Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when the plaintiff pleads facts 18 permitting the court to “draw the reasonable inference that the defendant is liable for the 19 misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citation omitted). The 20 allegations must show “more than a sheer possibility that a defendant has acted unlawfully.” Id. 21 Mere “conclusory allegations of law and unwarranted inferences are insufficient to defeat a 22 motion to dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir. 2004). 23 When determining whether a claim has been stated, a district court’s review is limited to 24 the face of the complaint and judicially noticeable information. MGIC Indem. Corp. v. Weisman, 25 803 F.2d 500, 504 (9th Cir. 1986); N. Star Int’l v. Ariz. Corp. Comm’n, 720 F.2d 578, 581 (9th 26 Cir. 1983). The court must accept as true all well-pleaded factual allegations and construe them in 27 the light most favorable to the plaintiff. Reese v. BP Expl. (Alaska) Inc., 643 F.3d 681, 690 (9th 1 Cir. 2011). The Court need not, however, “assume the truth of legal conclusions merely because 2 they are cast in the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 3 2011) (per curiam). 4 III. REQUEST FOR JUDICIAL NOTICE 5 Malwarebytes requests that the Court take judicial notice of Exhibit 1 to the Declaration of 6 Michael H. Todisco filed in support of the instant Motion. See Req. Jud. Not. (“RJN”) 1, ECF No. 7 179-1. The exhibit at issue is a copy of a public webpage from Malwarebytes’s website titled 8 “Explained: the Malwarebytes Website Protection [M]odule” and dated August 30, 2016. See id. 9 at 2; Todisco Decl., Exh. 1 (the “MWB Webpage”), ECF No. 179-3. 10 A district court may consider material outside the pleadings without converting a motion to 11 dismiss into a motion for summary judgment under either (1) the doctrine of judicial notice 12 codified in Federal Rule of Evidence 201 or (2) the judicially-created doctrine of incorporation by 13 reference. See Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 998, 1002 (9th Cir. 2018). 14 Federal Rule of Evidence 201 provides that a court may judicially notice a fact “not subject to 15 reasonable dispute,” i.e., a fact that is “generally known” or that “can be accurately and readily 16 determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 17 201(b)(1)–(2). If a judicially noticeable document contains disputed facts, the court may notice 18 the existence of the document, but not the disputed facts therein. See Khoja, 899 F.3d at 999 (“[A] 19 court cannot take judicial notice of disputed facts contained in [judicially noticeable] public 20 records.”) (citation omitted). The incorporation by reference doctrine “treats certain documents as 21 though they are part of the complaint itself.” Id. at 1002. The doctrine applies “if the plaintiff 22 refers extensively to the document or the document forms the basis of the plaintiff's claim.” 23 United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003). A court generally “may assume an 24 incorporated document's contents are true for purposes of a motion to dismiss under Rule 25 12(b)(6),” but “it is improper to assume the truth of an incorporated document if such assumptions 26 only serve to dispute facts stated in a well-pleaded complaint.” Khoja, 899 F.3d at 1003 (internal 27 quotations omitted). 1 Malwarebytes argues that courts may take judicial notice of a publication, including 2 publicly available websites, to indicate what was in the public realm at a given time, although 3 courts may not accept as true the publication’s contents. See RJN 2. Malwarebytes argues that the 4 MWB Webpage is thus judicially noticeable for the purpose of introducing the existence of the 5 information in the public realm, and that the MWB Webpage has been incorporated by reference 6 into the SAC because the SAC alleges that Malwarebytes’s use of the term “malicious” 7 necessarily communicated to users that the designated website was harmful. Id. (citing SAC ¶¶ 4, 8 14, 224, 230). Enigma argues that the Court should decline to take judicial notice of the MWB 9 Webpage because (1) courts are properly skeptical of information on a party’s own website; (2) 10 the MWB Webpage is not relevant to Enigma’s claims about the deceptiveness of Malwarebytes’s 11 in-app designations; and (3) the SAC’s references to certain pages of Malwarebytes’s website is 12 not sufficient to establish incorporation by reference. See RJN Opp’n 2–5, ECF No. 184. 13 Malwarebytes does not request that the Court take judicial notice of the truth of the MWB 14 Webpage’s contents, and Enigma does not challenge the authenticity of the MWB Webpage. See 15 generally RJN; RJN Opp’n. The Court was able to verify that the page link copied at the bottom 16 of the MWB Webpage—https://www.malwarebytes.com/blog/news/2016/08/explained-the- 17 malwarebytes-website-protection-module—does in fact lead to the article provided by 18 Malwarebytes, so that the MWB Webpage is publicly accessible. Courts in this district regularly 19 take judicial notice of the existence of publicly available webpages, and the Court will likewise 20 take judicial notice of the existence of the MWB Webpage, though not of any disputed fact therein 21 or of the ease or difficulty of accessing its contents. See, e.g., In re Meta Pixel Tax Filing Cases, - 22 -- F. Supp. 3d ----, 2024 WL 1251350, at *3 (N.D. Cal. Mar. 25, 2024) (taking judicial notice of 23 existence and contents of terms of service available on defendant’s website “because the document 24 is publicly available from a source whose accuracy cannot reasonably be questioned and its 25 contents can be accurately determined”); Vizcarra v. Michaels Stores, Inc., --- F. Supp. 3d ----, 26 2024 WL 64747, at *5 n.2 (N.D. Cal. Jan. 5, 2024) (“The Court takes judicial notice of the 27 existence and contents of the webpages Michaels has submitted which show certain Michaels 1 private brand products for sale on Amazon.com and Walmart.com.”). 2 IV. DISCUSSION 3 Malwarebytes moves to dismiss each of the three claims remaining after Enigma II. See 4 Mot. 1. The Court turns to each in turn. 5 A. Lanham Act 6 “To state a claim for false advertising under Section 43(a) of the Lanham Act, Enigma had 7 to allege that (1) Malwarebytes made a false statement of fact in a commercial advertisement; (2) 8 the statement deceived or had the tendency to deceive a substantial segment of its audience; (3) the 9 deception was material, in that it was likely to influence the purchasing decision; (4) the false 10 statement entered interstate commerce; and (5) Enigma has been or is likely to be injured as a 11 result of the false statement.” Enigma II, 69 F.4th at 671 (citing Southland Sod Farms v. Stover 12 Seed Co., 108 F.3d 1134, 1139 (9th Cir. 1997)). The Ninth Circuit held in Enigma II that Enigma 13 had sufficiently pleaded falsity with respect to the terms “malicious” and “threats.” See id. at 672. 14 Malwarebytes now argues that Enigma’s Lanham Act claim2 fails because the designations of 15 “malicious” and “threats” are neither (1) statements made “in a commercial advertisement” nor (2) 16 materially deceptive as a matter of law. See Mot. 7–17.3 17 1. Commercial Advertisement 18 “The Lanham Act prohibits any person from misrepresenting her or another person’s 19 goods or services in ‘commercial advertising or promotion.’” Ariix, LLC v. NutriSearch Corp., 20 985 F.3d 1107, 1114–15 (9th Cir. 2021) (quoting 15 U.S.C. § 1125(a)(1)(B)). The Ninth Circuit 21 has adopted the below definition of commercial advertising or promotion under the Lanham Act:
22 (1) commercial speech, (2) by a defendant who is in commercial competition with plaintiff, (3) for the purpose of influencing 23 consumers to buy defendant's goods or services, and (4) that is 24
25 2 Malwarebytes structures its Motion to jointly address the Lanham Act and NYGBL claims, see Mot. 7–17, and Enigma responds in kind, see Opp’n 7–16, but the Court will evaluate the claims 26 separately.
27 3 Malwarebytes also made these arguments on appeal, but the Ninth Circuit remanded both issues to this Court to consider in the first instance. Enigma II, 69 F.4th at 671 n.2. sufficiently disseminated to the relevant purchasing public. 1 2 Id. at 1115 (citing Coastal Abstract Serv., Inc. v. First Am. Title Inc. Co., 173 F.3d 725, 735 (9th 3 Cir. 1999)).4 Malwarebytes argues that the challenged designations are not commercial 4 advertising because they (1) are part of Malwarebytes’s actual software products, rather than mere 5 advertising, see Mot. 8–10, and (2) do not promote Malwarebytes’s products, as the statements are 6 made about Enigma’s products and viewed by existing Malwarebytes users, see id. at 8–12. 7 Enigma counters that it adequately establishes that the designations are commercial advertising 8 because the SAC alleges that Malwarebytes makes its statements in free products that function as 9 advertising for paid products; that Malwarebytes’s speech directly references and falsely labels 10 specific Enigma products; and that Malwarebytes’s speech is economically motivated by its desire 11 to increase sales, profits, and market position at Enigma’s expense. See Opp’n 2, 7–12. The 12 Court evaluates these arguments in the context of the four elements of commercial advertising. 13 a. Commercial Speech 14 The Ninth Circuit has noted that although “[c]ommercial speech is ‘usually defined as 15 speech that does no more than propose a commercial transaction,’” Ariix, 985 F.3d at 1115 16 (quoting United States v. United Foods, Inc., 533 U.S. 405, 409 (2001)), courts view this 17 definition as a “starting point” for engaging in a “fact-driven” analysis, id. (citations omitted). 18 “Where the facts present a close question, ‘strong support’ that the speech should be characterized 19 as commercial speech is found where [1] the speech is an advertisement,5 [2] the speech refers to a 20 particular product, and [3] the speaker has an economic motivation.” Hunt v. City of Los Angeles, 21 638 F.3d 703, 715 (9th Cir. 2011) (citing Bolger v. Youngs Drug Prods. Corp., 463 U.S. 60, 66–67 22 (1983)). “These so-called Bolger factors are important guideposts, but they are not dispositive.” 23
24 4 With respect to the second element of competition, the Supreme Court has clarified that the 25 Lanham Act does not require direct competition between the parties. See Lexmark Intern., Inc. v. Static Control Components, Inc., 572 U.S. 118, 136 (2014). 26 5 The difficulty of the commercial speech inquiry is perhaps evidenced by the self-referential 27 nested definitions—i.e., a commercial advertisement requires commercial speech, which is in turn indicated if the speech is an advertisement. 1 Ariix, 985 F.3d at 1116 (citing Bolger, 463 U.S. at 67 n.14; see also Dex Media West, Inc. v. City 2 of Seattle, 696 F.3d 952, 958 (9th Cir. 2012)). 3 Malwarebytes argues that there is no close question presented here because the challenged 4 designations were made within Malwarebytes’s own products and thus at the threshold do not 5 qualify as a commercial advertisement. See Mot. 8–10. However, as Enigma notes, there is no 6 categorical rule that in-product statements are immune from Lanham Act claims. See Opp’n 11– 7 12. Further, the cases cited by Malwarebytes for its proposed rule are unavailing: one decision, 8 Vidillion, Inc. v. Pixalate, Inc., No. CV 18-7270, 2019 WL 13071961, at *1 (C.D. Cal. Mar. 15, 9 2019), does not provide sufficient information for the Court to determine whether the present case 10 is factually analogous, and the others—including the case on which Vidillion relies—involve 11 factual analyses of the commercial advertisement question, rather than a threshold test. See Rice v. 12 Fox Broad. Co., 330 F.3d 1170, 1181 (9th Cir. 2003) (finding statement made by host of broadcast 13 show about contents of show were not commercial advertising under Coastal Abstract because 14 they were not made in promotion or marketing of show, but that nearly identical statements on 15 jacket of videotape version of show “readily satisf[ied]” criteria for commercial advertisement); 16 New.Net, Inc. v. Lavasoft, 356 F. Supp. 2d 1090, 1111 (C.D. Cal. 2004) (applying Bolger factors 17 and finding that challenged speech was not commercial because it occurred after conclusion of 18 user’s transaction with defendant and because it focused not on “any particular software program . 19 . . but primarily on the larger issue of the surreptitious downloading of computer programs”). 20 By contrast, the allegations here state that the challenged designations were made in a 21 marketing context for a potential transaction. Cf. Hilton v. Hallmark Cards, 599 F.3d 894, 905 n.7 22 (9th Cir. 2010) (in anti-SLAPP analysis, finding Hallmark card was not advertising itself, and that 23 mere fact of being sold for a profit did not make the card commercial speech). The Court thus 24 finds that Enigma’s allegations present a close question of whether Malwarebytes’s designations 25 of Enigma’s anti-malware programs constitute commercial speech, and accordingly turns to the 26 three Bolger factors. Cf. IMDb.com Inc. v. Becerra, 962 F.3d 1111, 1122 (9th Cir. 2020) (finding 27 analysis of Bolger factors unnecessary where speech at issue—freely available public profiles of 1 entertainment industry professionals in an online database including content uploaded by members 2 of the public—did not pose a close question of commercial speech). 3 The Court finds the first Bolger factor—whether the statements are an advertisement—to 4 fall slightly in favor of the conclusion that the challenged designations are commercial speech. 5 Although the words at issue—“malicious” and “threat”—are not themselves advertisements, 6 Enigma has alleged facts permitting an inference in its favor that Malwarebytes makes the speech 7 in an advertising context. For example, Enigma alleges that the designations appear during a free 8 trial period designed to showcase Malwarebytes’s product capabilities, so that the users experience 9 “a marketing mechanism for Malwarebytes to entice users to ultimately purchase the 10 Malwarebytes products.” SAC ¶ 66. Enigma also alleges that Malwarebytes displays the 11 challenged speech directly alongside buttons with phrases such as “Upgrade Now.” See SAC ¶¶ 12 118–19 (depicting scan results with “threats” near “Upgrade Now” button).6 Given these 13 allegations, the Court finds that Malwarebytes’s labeling of Enigma’s competing anti-malware 14 software as a “threat” or “malicious,” especially when combined with the button linking the user 15 to a payment space, is an advertisement for purportedly superior MBAM products. See Enigma 16 Software Grp. USA, LLC v. Bleeping Computer LLC, 194 F. Supp. 3d 263, 294 (S.D.N.Y. 2016) 17 (finding blog posts promoting defendant’s products as superior to Enigma’s and setting forth 18 purchase links were advertisements). 19 The second and third Bolger factors—whether the speech refers to a particular product and 20 whether the speaker has an economic motivation—also weigh in favor of commercial speech. 21 Enigma alleges that Malwarebytes applied the challenged designations to Enigma’s SpyHunter 4 22 and RegHunter products within Malwarebytes’s own MBAM products, including AdwCleaner. 23
24 6 Malwarebytes argues that “courts have squarely held that Enigma’s ‘free trial’ theory is ‘without merit.’” Mot. 12 (quoting Carafano v. Metrosplash.com, Inc., 207 F. Supp. 2d 1055, 1074 (C.D. 25 Cal. 2002)). Carafano held that challenged speech made by users of the defendant’s products about themselves was not made commercial merely by the fact that the defendant’s business was 26 dependent on enticing free trial members to become paying members. See 207 F. Supp. 2d at 1074–75 (distinguishing members’ speech on defendant’s website from case involving a 27 defendant’s use of photos in its catalog to promote its clothing). As the speech at issue here was uttered by Malwarebytes, rather than by its users, Carafano has no persuasive value here. 1 See, e.g., SAC ¶¶ 16–17, 114, 220. Enigma also alleges that Malwarebytes has an economic 2 motive to designate Enigma’s competing anti-malware products as “threats” and “malicious,” 3 namely, to persuade users to buy MBAM products rather than Enigma’s competing anti-malware 4 products, and thereby increase Malwarebytes’s sales, profits, and market position. See id. ¶¶ 111, 5 219. Further, the cases Malwarebytes cites in response to Enigma’s Bolger arguments are 6 inapposite because they concern, in essence, information published in a company’s database about 7 participants in a given industry, rather than statements about competitors. See Reply 2–3; 8 IMDb.com, 962 F.3d at 1122 (finding public profiles of entertainment professionals published by 9 operator of free database of information about movies, television shows, and video games were 10 not commercial speech); New.Net, 356 F. Supp. 2d at 1111 (finding free software intended to 11 inform users of secretly downloaded programs comparable to “a magazine whose focus is the 12 evaluation of consumer goods,” so that flagging of plaintiff’s surreptitious software related to sale 13 of domain names was not commercial speech); Exeltis USA Inc. v. First Databank, Inc., 520 F. 14 Supp. 3d 1225, 1229 (N.D. Cal. 2021) (finding database providing insurance payors with 15 information about pharmaceutical products was not commercial speech, and noting that database 16 did not concern defendant’s products and plaintiff had not identified direct or indirect economic 17 benefit to defendant of challenged product classifications). 18 The Court accordingly finds that at the present stage of the litigation, the Bolger factors 19 indicate that the challenged designations of “malicious” and “threats” are commercial speech, so 20 that Enigma’s allegations satisfy the first element of a “commercial advertisement or promotion.” 21 b. Commercial Competition Between Parties 22 The second element of “commercial advertising or promotion”—commercial competition 23 between parties—is easily met, as Enigma alleges that it directly competes with Malwarebytes in 24 the market for anti-malware and cybersecurity software. See SAC ¶ 1; see also Enigma I, 946 25 F.3d at 1045 (noting, in evaluating applicability of Section 230, that the action differed from other 26 cases “in that here the parties are competitors”). 27 1 c. Purpose of Influencing Consumers in Defendant’s Favor 2 As discussed above in the Court’s analysis of the Bolger factors, the Court finds that 3 Enigma has sufficiently alleged that Malwarebytes made the challenged designations in an 4 advertising context to showcase its own MBAM products. See supra, at Part IV(A)(1)(a). The 5 Court accordingly concludes that Enigma has satisfied the third element of “commercial 6 advertising or promotion” by alleging that Malwarebytes made the speech at issue with the 7 purpose of influencing consumers in its favor. 8 d. Sufficiently Disseminated to the Relevant Purchasing Public 9 Malwarebytes argues that the challenged designations were not sufficiently disseminated 10 to the relevant purchasing public because only existing Malwarebytes customers saw the 11 designations. See Mot. 11 n.5. Enigma responds that the SAC’s allegations, which must be taken 12 as true at this stage, demonstrate that the majority of Malwarebytes users are free users and not 13 paying customers, and that Malwarebytes’s sales model relies on its free programs to function as 14 advertisements to induce users to upgrade to paid MBAM products. See Opp’n 11 (citing SAC ¶¶ 15 64–66, 220). Enigma further argues that the SAC alleges that Malwarebytes displays the 16 challenged designations to all consumers who seek to simultaneously deploy both Malwarebytes 17 and Enigma products. See id. at 11 n.2 (citing SAC ¶¶ 222–23). 18 The Court finds that the SAC’s allegations permit an inference that Malwarebytes 19 disseminated the challenged designations to the relevant purchasing public. First, Enigma alleges 20 that Malwarebytes’s free version includes features such as protection from malicious websites for 21 14 days—after which the only function of the free version is to clean up an already-infected 22 computer—and that Malwarebytes uses its free trial directly as a marketing mechanism for its paid 23 MBAM products. See SAC ¶¶ 65–66. Second, Enigma alleges that users who had already 24 downloaded and installed its products and subsequently ran an MBAM scan would find Enigma’s 25 products quarantined and labeled a “threat,” and that Malwarebytes users who sought to download 26 and install Enigma products would also see the “threat” label and quarantine action. See SAC ¶¶ 27 118–23. The Court infers from these allegations that the relevant public includes consumers who 1 seek to use products from both Malwarebytes and Enigma, and that Malwarebytes disseminated its 2 statements to those users. Accordingly, the challenged statements were sufficiently disseminated 3 to the relevant purchasing public. See Coastal Abstract, 173 F.3d at 735 (“Where the potential 4 purchasers in the market are relatively limited in number, even a single promotional presentation 5 to an individual purchaser may be enough to trigger the protections of the [Lanham] Act.”) (citing 6 Seven-Up Co. v. Coca-Cola Co., 86 F.3d 1379, 1386 (5th Cir. 1996)); cf. Walker & Zanger, Inc. v. 7 Paragon Indus., Inc., 549 F. Supp. 2d 1168, 1182 (N.D. Cal. 2007) (finding at summary judgment 8 that defendant’s admission of directing speech to at least one nonparty was insufficient 9 dissemination where potential purchasers were not relatively limited in number) (citing Coastal 10 Abstract, 173 F.3d at 735). 11 Accordingly, the Court finds that Enigma has sufficiently alleged that the challenged 12 designations of “threat” and “malicious” are commercial advertisements. 13 2. Materially Deceptive 14 A Lanham Act claim also requires a plaintiff to plausibly allege that the challenged 15 statement “deceived or had the tendency to deceive a substantial segment of its audience” and that 16 “the deception was material, in that it was likely to influence the purchasing decision.” Enigma II, 17 69 F.4th at 671 (citing Southland Sod Farms, 108 F.3d at 1139). Malwarebytes argues that the 18 challenged designations were not materially deceptive because Malwarebytes disclosed to 19 consumers its definitions for “threat” and “malicious,” as well as the specific criteria used to reach 20 those designations, so that a reasonable consumer would understand that the challenged 21 designations did not identify Enigma’s software as malware. See Mot. 14–17; see also MWB 22 Webpage. Malwarebytes further argues that it disclosed both that Enigma’s products are not 23 malware, but rather PUPs, and that the “threat” designation applied to Enigma’s products 24 specifically because of the PUP classification. See id. at 16–17. Malwarebytes concludes that 25 because the Ninth Circuit held that the “PUP” classification was not an actionable statement of 26 fact under the Lanham Act, the challenged designations were not materially deceptive because 27 they were a disclosed result of the PUP classification and specifically were not statements that 1 Enigma’s products were malware. See id. Enigma counters that the SAC alleges that Enigma’s 2 users sent it hundreds of complaints after viewing Malwarebytes’s statements, and the complaints 3 reflected a belief that Enigma’s products were cybersecurity threats and malware, see Opp’n 13 4 (citing SAC ¶¶ 143–64); that the PUP criteria is no longer relevant following the Ninth Circuit’s 5 decision in Enigma II, see id. at 14; and that Malwarebytes’s purported disclosures are entirely 6 disconnected from the presentation of the challenged designations to users, see id. at 14–16. 7 The Court agrees with Enigma that it has sufficiently alleged that the designations of 8 “threat” and “malicious” were materially deceptive to a substantial segment of the relevant 9 purchasing population. Enigma alleges that it received hundreds of complaints from users of its 10 products who had viewed Malwarebytes’s designations, and that the complaints included 11 statements indicating that the users understood the designations to identify Enigma’s products as 12 malware. See, e.g., SAC ¶ 147 (“the malware bytes’ program keeps detecting malware every time 13 I try to download your software”); id. ¶ 149 (“Please advise why your SpyHunter and RegHunter 14 applications are being detected as malware.”). Enigma further alleges that customers canceled 15 orders for Enigma’s software and requested refunds, see id. ¶ 153, and the Court can accordingly 16 infer that the statements influenced users’ purchasing decisions. See Cisco Sys., Inc. v. Beccela’s 17 Etc., LLC, 403 F. Supp. 3d 813, 829–30 (N.D. Cal. 2019) (finding material deception sufficiently 18 pleaded for Lanham Act claim where party alleged that misrepresentations deterred consumers 19 from purchasing products and that party lost sales that would have been made but for false 20 representations). The Court also finds that any conclusion as to the efficacy of Malwarebytes’s 21 disclosures, such as in the MWB Webpage, would be premature at this stage of the proceedings 22 and run afoul of the Court’s duty to find all inferences in Enigma’s favor. Cf. Benetech, Inc. v. 23 Omni Fin. Grp., Inc., 116 A.D. 3d 1190, 1192 (N.Y. App. Div. 2014) (finding, in NYGBL false 24 advertising matter, that “documentary evidence utterly refute[d] . . . plaintiff’s factual allegations” 25 and showed contested fees were conspicuously disclosed in materials tendered by plaintiff). 26 Accordingly, the Court finds that Enigma has sufficiently alleged that the challenged 27 designations of “threat” and “malicious” were materially deceptive. 1 3. Conclusion Re: Lanham Act Claim 2 For the reasons discussed above, the Court rejects the two bases on which Malwarebytes 3 moves to dismiss Enigma’s Lanham Act claim, i.e., that the challenged statements were neither a 4 commercial advertisement nor materially deceptive. See supra, at Parts IV(A)(1)–(2). The Court 5 will therefore deny Malwarebytes’s motion to dismiss the Lanham Act claim. 6 B. NYGBL § 349 7 NYGBL § 349 declares unlawful “[d]eceptive acts or practices in the conduct of any 8 business, trade or commerce or in the furnishing of any service” in New York. N.Y. Gen. Bus. § 9 349(a). To state a claim under NYGBL § 349, “a plaintiff must allege that a defendant has 10 engaged in (1) consumer-oriented conduct that is (2) materially misleading and that (3) plaintiff 11 suffered injury as a result of the allegedly deceptive act or practice.” Orlander v. Staples, Inc., 12 802 F.3d 289, 300 (2d Cir. 2015) (quoting Koch v. Acker, Merrall & Condit Co., 967 N.E.2d 675, 13 675 (N.Y. 2012)). 14 Malwarebytes argues that Enigma’s NYGBL claim fails along with the Lanham Act claim 15 because Enigma does not adequately allege that (1) the challenged designations are commercial 16 advertisements covered by the statute and (2) the designations were materially deceptive. See 17 Mot. 7–17. The Court rejects these arguments for the same reasons described above with respect 18 to the claims under the Lanham Act. See Avon Prods., Inc. v. S.C. Johnson & Son, Inc., 984 F. 19 Supp. 768, 800 (S.D.N.Y. 1997) (“The standards for bringing a claim under § 43(a) of the Lanham 20 Act are substantially the same as those applied to claims brought under the New York common 21 law for unfair competition and §§ 349 and 350 of the New York General Business Law.”) 22 (citations omitted). The NYGBL-specific cases cited by Malwarebytes do not dictate a different 23 result, as they—like those identified by the Court in its Lanham Act analysis—are broadly 24 inapposite to the present facts as alleged by Enigma. See, e.g., N.Y. Pub. Int. Rsch. Grp., Inc. v. 25 Ins. Info. Inst., 554 N.Y.S.2d 590, 591 (N.Y. App. Div. 1990) (dismissing NYGBL claim where 26 consumer advocacy plaintiffs brought action based on statements made by insurance industry 27 mouthpiece in editorial campaign against civil suits where defendant made no effort to sell 1 products—let alone products in competition with any sold by plaintiffs). 2 Accordingly, the Court will deny Malwarebytes’s motion to dismiss the NYGBL claim. 3 C. Tortious Interference with Business Relations 4 As noted above, Enigma originally brought two common law claims for tortious 5 interference. The Ninth Circuit held that New York law applied to both claims; affirmed the 6 Court’s dismissal of Enigma’s claim for tortious interference with contractual relations; and 7 reversed and remanded the dismissal of the claim for tortious interference with business relations. 8 See Enigma II, 69 F.4th at 676–78. With respect to the latter claim, the circuit court expressly 9 “h[e]ld that Enigma sufficiently alleged the elements of a claim for tortious interference with 10 business relations.” Id. at 677. 11 Malwarebytes nonetheless argues that this Court should dismiss Enigma’s claim for 12 tortious interference with business relations for various reasons, including that the Court should 13 find that California law applies to the claim under New York’s choice of law rules and that 14 Enigma has not met the elements under California law, and that Enigma does not sufficiently 15 allege New York-specific conduct to state a claim under either state’s law. See Mot. 17–20. The 16 Court declines Malwarebytes’s invitation to make such findings in direct contradiction to the 17 Ninth Circuit’s holding in Enigma II, and will deny the motion to dismiss the tortious interference 18 claim with business relations that the circuit court has held to be sufficiently pleaded. 19 V. CONCLUSION 20 For the foregoing reasons, the Court hereby ORDERS as follows: 21 1. Malwarebytes’s motion to dismiss is DENIED, and thus Enigma’s claims for (1) 22 violation of the Lanham Act, (2) violation of NYGBL § 349, and (3) tortious 23 interference with business relations remain at issue in this action. 24 \\ 25 \\ 26 27 1 2. Malwarebytes shall file an answer to the three remaining claims within 14 days of 2 the entry of this order. 3 4 IT IS SO ORDERED. 5 Dated: June 6, 2024 6 7 EDWARD J. DAVILA 8 United States District Judge 9 10 11 12
© 15 16
= 17
Z 18 19 20 21 22 23 24 25 26 27 28 || Case No.: 17-cv-02915-EJD ORDER DENYING DEFT.’S RENEWED MOT. DISMISS SECOND AM. COMPL.