Ninth Circuit rulings separate subjective opinions from verifiably false statements under Lanham Act

In Enigma Software Group USA, LLC v Malwarebytes, Inc (21-16466; 9th Cir; 2 June 2023) – a case originally based on a false advertising claim under Section 43(a) of the Lanham (Trademark) Act – the US Court of Appeals for the Ninth Circuit has affirmed in part, reversed in part and remanded the district court’s dismissal of the claim. The higher court concluded that the defendant’s description of a competitor’s software product was plausibly alleged to be an element of false advertising, providing crucial guidance for brand owners in this space. 

Ninth Circuit remands district court ruling

Enigma is a security software company whose products detect and remove malicious software such as viruses, spyware, adware and ransomware. Malwarebytes is a direct competitor of Enigma and sells products designed to detect and remove malware and other potentially threatening programs on users’ computers.

Enigma initially brought this action in the US District Court for the Southern District of New York, but the case was moved to the Northern District of California following Malwarebytes’s motion to transfer.

The California court ruled that Enigma’s claims were barred by Section 230 of the Communications Decency Act, a ruling that the Ninth Circuit reversed, holding that the section did not apply to “blocking and filtering decisions that [we]re driven by anticompetitive animus”. The Ninth Circuit remanded the case.

On remand, Enigma asserted four causes of action:

• false advertising in violation of the Lanham Act;
• violation of Section 349 of the New York General Business Law (NYGBL), which prohibits deceptive and unlawful business practices;
• tortious interference with contractual relations; and
• tortious interference with business relations.

Subsequent Ninth Circuit and district court rulings

On Malwarebytes’s motion to dismiss for failure to state a claim, the district court found that (for the Lanham Act claim) Enigma’s allegation that Malwarebytes’s designations were “just [nonactionable] subjective opinions” rather than “verifiably false”. On appeal, Enigma argued that designations of its products as malicious, threats and potentially unwanted programs were factually false and misrepresented the software’s purpose.

To state a claim for false advertising under Section 43(a) of the Lanham Act, Enigma had to plausibly allege the following:

• Malwarebytes made a false statement of fact in a commercial advertisement;
• the statement deceived or had the tendency to deceive a substantial segment of its audience;
• the deception was material, in that it was likely to influence the purchasing decision;
• the false statement entered interstate commerce; and
• Enigma was or was likely to be injured as a result.

To show falsity, Enigma had to allege that the statement was literally false, either on its face or by necessary implication, or that the statement was literally true but likely to mislead or confuse consumers.

The Ninth Circuit found that Enigma’s allegations were sufficient to state a Lanham Act claim because Malwarebytes’s designations employed terminology that was substantively meaningful and verifiable in the cybersecurity context.

While terms such as ‘malicious’ and ‘threatening’ are adjectives subject to numerous interpretations, the court found that in the software competition realm, a reasonable person would plausibly interpret these designations as pertaining to malware. However, the term ‘potentially unwanted program’ was found too unspecific to provide a basis for a Lanham Act claim.

The district court dismissed Enigma’s New York state tort claim under Section 349 of the NYGBL because Malwarebytes was not properly subject to personal jurisdiction in New York. Enigma also brought actions for tortious interference with contractual relations and tortious interference with business relations, claims that are recognised as actionable under both California and New York law. However, the district court found that Enigma failed to allege essential elements for these claims under California law.

In evaluating the false claims issue, the Ninth Circuit recognised “the First Amendment overlay” in terms of “delineating what constitutes ‘fact’ versus ‘opinion’”. While statements of fact are actionable under the Lanham Act, “[s]tatements of opinion and puffery . . . are not”. As the court noted:

It makes no difference if the statements of opinion are made for the purpose of anticompetitive gain. After all, the suppression of ‘opinions’ – even in the commercial space – gets into murky constitutional waters. [When] boiled down, whether commercial speech is actionable depends on whether the statement implies something that can be proven false.

Lastly, the Ninth Circuit held that without a “core of objective evidence” to assess the accuracy of the use of the warnings, no reasonable factfinder could say that Malwarebytes made a false representation of fact in labelling Enigma’s products or website as a “threat”, “malicious” or “potentially unwanted”.

Consequently, the court ruled that the Lanham Act and Section 349 of the NYGBL claims should not have been dismissed and that, as a result, the tortious interference with business relations claim should similarly not have been dismissed. However, it did affirm the dismissal of the contractual relations claim as Enigma did not identify a specific contractual obligation with which Malwarebytes interfered.

Key judges provide further opinions

Court of International Trade Judge Baker wrote separately to concur and address the choice of law issue.

Baker noted that ordinarily, the application of law from a transferor jurisdiction carries with it the choice-of-law rules of that jurisdiction. However, since the parties did not address the choice of law issue, the Ninth Circuit applied New York substantive law to Enigma’s state-law claims, save for the claims based on Malwarebytes’ transactions with customers outside of New York.

Judge Bumatay of the Court of Appeals for the Ninth Circuit dissented, writing that a description of a competitor’s products as “potentially unwanted”, a “threat” or “malicious” is not an expression of fact, as these are subjective statements and not readily verifiable (ie, opinions).

According to Judge Bumatay, treating these terms as actionable statements of fact under the Lanham Act “sends a chilling message to cybersecurity companies—civil liability may now attach if a court later disagrees with your classification of a program as ‘malware’”.