Enigma Software Group USA, LLC v. Malwarebytes Inc.

Background

Enigma alleged that Malwarebytes, a competing cybersecurity software company, began labeling Enigma’s SpyHunter and RegHunter products “malicious,” “threats,” and “potentially unwanted programs,” or “PUPs.” Enigma alleged that Malwarebytes’s software quarantined and blocked those products and that Malwarebytes used the labels in a marketing context to encourage users to buy Malwarebytes products instead.

The operative Second Amended Complaint asserted four claims: false advertising under the Lanham Act; deceptive and unlawful business practices under New York General Business Law § 349; tortious interference with contractual relations; and tortious interference with business relations. After earlier rulings and an appeal, the claims remaining for this order were the Lanham Act claim, the New York General Business Law claim, and the business-relations interference claim. The contractual-interference claim had previously been dismissed, and the appeals court had affirmed that dismissal.

Motion and Judicial Notice

Malwarebytes filed a renewed motion under Federal Rule of Civil Procedure 12(b)(6), which permits dismissal when a complaint does not state a legally sufficient claim. Malwarebytes also asked the court to take judicial notice of a publicly available webpage describing a Malwarebytes website-protection feature.

The court took notice of the webpage’s existence and public availability, but not of disputed facts contained in it. The court explained that disputed facts in a publicly available document cannot be accepted as true on a motion to dismiss, and that it could not use the webpage to contradict well-pleaded allegations in the complaint.

Lanham Act Claim

The Lanham Act false-advertising claim required Enigma to plausibly allege, among other things, that Malwarebytes made a false statement of fact in commercial advertising, that the statement deceived or had a tendency to deceive a substantial segment of its audience, that the deception was material, and that Enigma was injured.

The appeals court had already held that the “malicious” and “threat” labels could be actionable statements of fact, while the “PUP” label was too vague to be actionable. In the renewed motion, Malwarebytes argued that the labels were not commercial advertising and were not materially deceptive.

The district court rejected both arguments at the pleading stage. It found that Enigma’s allegations presented a close, fact-dependent question about whether the labels were commercial speech. The court gave slight weight to the allegation that the labels appeared during a free trial designed to showcase Malwarebytes’s product and alongside “Upgrade Now” buttons. It also relied on allegations that the labels targeted specific competing products and were intended to persuade consumers to buy Malwarebytes products.

The court further found that Enigma plausibly alleged sufficient distribution to the relevant purchasing public. Enigma alleged that users who had, or tried to install, both companies’ products would see the labels and quarantine actions. The court also found material deception adequately alleged because Enigma reported hundreds of user complaints describing Enigma’s products as malware and alleged that customers canceled orders and requested refunds. Whether Malwarebytes’s disclosures adequately explained its labels was, in the court’s view, premature to decide on a motion to dismiss.

The court therefore denied Malwarebytes’s motion to dismiss the Lanham Act claim.

New York General Business Law § 349 Claim

A claim under New York General Business Law § 349 requires allegations of consumer-oriented conduct, material deception, and resulting injury. Malwarebytes argued that this claim failed for the same reasons as the Lanham Act claim.

The court rejected those arguments for the same reasons discussed in its Lanham Act analysis and denied the motion to dismiss the § 349 claim.

Tortious Interference with Business Relations

The appeals court had held that Enigma sufficiently alleged the elements of a claim for tortious interference with business relations and had reversed the dismissal of that claim. Malwarebytes asked the district court to apply California law, find that Enigma had not met the applicable elements, or conclude that Enigma had not adequately alleged conduct specific to New York.

The district court declined to make findings that conflicted with the appeals court’s ruling and denied the motion to dismiss this claim.

Disposition

The court denied Malwarebytes’s renewed motion to dismiss. Enigma’s Lanham Act, New York General Business Law § 349, and tortious-interference-with-business-relations claims remain at issue. Malwarebytes was ordered to file an answer to those three claims within 14 days after the order’s entry.