Enigma Software Group USA, LLC v. Malwarebytes Inc. ( 2021 )

1 2 3 4 5 6 UNITED STATES DISTRICT COURT 7 NORTHERN DISTRICT OF CALIFORNIA 8 SAN JOSE DIVISION 9 ENIGMA SOFTWARE GROUP USA LLC, 10 Case No. 5:17-cv-02915-EJD Plaintiff, 11 ORDER GRANTING DEFENDANT’S v. MOTION TO DISMISS SECOND 12 AMENDED COMPLAINT MALWAREBYTES INC., 13 Re: Dkt. No. 147 Defendant. 14 15 Plaintiff Enigma Software Group USA, LLC (“Enigma”) alleges that Malwarebytes Inc. 16 (“Malwarebytes”) wrongfully categorized Enigma’s cybersecurity and anti-malware software as 17 “malicious,” a “threat,” and as a Potentially Unwanted Program (“PUP”). In its Second Amended 18 Complaint (“SAC”), Enigma asserts claims for (1) violations of the Lanham Act, (2) violations of 19 New York General Business Law § 349, (3) tortious interference with contractual relations, and 20 (4) tortious interference with business relations. Dkt. No. 140. 21 Malwarebytes moves to dismiss the SAC, asserting that because Enigma’s allegations are 22 insufficient as a matter of law, all of Enigma’s claims should be dismissed. For the reasons set 23 forth below, Malwarebytes’ motion is GRANTED.1 24 25 26 1 The Court took this motion under submission without oral argument pursuant to Civil Local Rule 27 7-1(b). Case No.: 5:17-cv-02915-EJD 1 I. BACKGROUND2 2 A. Factual Background 3 i. The Parties 4 Enigma is a Florida limited liability company that designs and develops cybersecurity 5 software to combat malware, ransomware, viruses, Trojans, hackers, and other problematic 6 computer system attacks. SAC ¶¶ 2, 48. Enigma’s flagship anti-malware product, SpyHunter 4, 7 was an adaptive malware detection and removal tool that provided rigorous protection against the 8 latest malware threats. Id. ¶ 48. SpyHunter 4 was available on the market until mid-2018, when 9 an Enigma affiliate introduced a new malware software program, SpyHunter 5. Id. Additionally, 10 Enigma offers a PC privacy and software optimizer program known as RegHunter 2. With 11 RegHunter 2, Enigma’s aim is to enhance users’ personal privacy by providing certain privacy 12 tools such as a powerful file shredding function that ensures secure deletion and prevents 13 unwanted recovery of deleted files. Id. ¶ 49. The program also offers a privacy scan which 14 provides for removal of web browsing history, temporary files, and other web browsing remnants. 15 Id. 16 As part of its software offerings, Enigma allowed users to download a free scanning 17 version of SpyHunter 4 which would detect whether a computer had malware, spyware, 18 ransomware, Trojans, rootkits, viruses or other malicious or threatening software. Id. ¶ 50. 19 SpyHunter 4 also allegedly detected PUPs based on defined objective and industry-based criteria. 20 Id. In addition to the free scanning version, Enigma also gave users the option to buy the full 21 version of SpyHunter 4 and provided users with a “Buy Now” link to do so. Id. The full version 22 of SpyHunter 4 included the scanner, tools to remove and remediate malware, and other security 23 protection features. Id. Enigma also previously provided users with a free version of RegHunter 2 24 which, among other features, scanned for and detected privacy and optimization issues and 25 26 2 The Background is a summary of the allegations in the SAC that are relevant to the issues raised 27 in the motion to dismiss. Case No.: 5:17-cv-02915-EJD 1 “effected certain repairs.” Id. ¶ 51. As it did with SpyHunter 4, Enigma gave users the option of 2 paying for and accessing a full version of RegHunter 2 which included additional privacy tools 3 and registry repair functions. Id. 4 Malwarebytes is a software company that sells, markets, and directly competes with 5 Enigma in the anti-malware and Internet security market. Id. ¶ 7. Its flagship anti-malware 6 offerings (collectively known as “MBAM”) directly competed with Enigma’s SpyHunter 4 7 product for the entirety of SpyHunter 4’s market life. Id. Moreover, Malwarebytes promotes, 8 markets, and sells its MBAM products as consumer and business solutions that detect and remove 9 malware, PUPs, and other potentially threatening programs on users’ computers. Id. The MBAM 10 products detect PUPs, automatically identify and list those purported PUPs as “threats,” and 11 automatically quarantine those programs, blocking their operation and rendering them inaccessible 12 for users. Id. 13 ii. Malwarebytes’ Identification of Enigma’s Products 14 From its inception in 2008 until October 4, 2016, Malwarebytes’ products did not identify 15 any of Enigma’s products as “malicious,” “threats,” PUPs, or any other label denoting an 16 unwanted or problematic program. SAC ¶ 10. Malwarebytes also did not quarantine or block 17 businesses or consumers from using any of Enigma’s products, including SpyHunter 4 and 18 RegHunter 2. Id. 19 On October 5, 2016, however, Malwarebytes revised the “criteria” it used to identify 20 PUPs. Id. ¶ 12. The new criteria identified SpyHunter 4 and RegHunter 2 as PUPs and “threats.” 21 Id. As a result, if a consumer had SpyHunter 4 or RegHunter 2 on his or her computer and then 22 downloaded or scanned that computer with MBAM products, the MBAM products would 23 automatically quarantine the Enigma products and identify them to the consumer as “threats” and 24 PUPs, denying users access to the products’ protection features. Id. ¶ 117. Once the products 25 were quarantined, the consumer would not be able to automatically launch or use SpyHunter 4 or 26 RegHunter 2, even if the consumer attempted to restore those programs. Id. ¶ 121. The user 27 Case No.: 5:17-cv-02915-EJD 1 would have to access the “Quarantine” window and manually click the “Restore” button. Id. 2 Further, Enigma claims that subsequent attempts by the user to “re-launch” the Enigma product 3 would result in it being automatically quarantined, once again, by Malwarebytes’ MBAM 4 products. Id. Enigma alleges that if the user restarted the computer, she would still not be able to 5 launch the Enigma program upon reboot because Malwarebytes continued to block the operation 6 of necessary Enigma files. Id. Alternatively, if a user had MBAM products on her computer and 7 then attempted to download or install SpyHunter 4 or RegHunter 2, the MBAM products would 8 block the installation of the programs regardless of whether the consumer tried to “restore” them 9 from quarantine. Id. ¶ 123. 10 Malwarebytes also acquired an anti-adware product called “AdwCleaner,” in October 11 2016. Id. ¶ 15. According to Enigma, AdwCleaner “identif[ies] for removal PUPs, adware, 12 toolbars, and other unwanted software for its users.” Id. At the time Malwarebytes acquired 13 AdwCleaner, the product did not identify SpyHunter 4 or RegHunter 2 as PUPs and “threats.” Id. 14 Enigma alleges this changed following Malwarebytes’ acquisition, as AdwCleaner began 15 identifying, detecting, and pre-selecting for removal SpyHunter 4 and RegHunter 2 as PUPs and 16 “threats.” Id. ¶ 16. AdwCleaner would then quarantine and block these products in a similar way 17 as Malwarebytes’ MBAM products. Id. 18 After Malwarebytes began identifying and blocking Enigma’s products as “threats” and 19 PUPs, Enigma attempted to mitigate the issue by providing its users with an option to download 20 an alternative SpyHunter 4 installer that disabled Malwarebytes’ MBAM products and allowed the 21 user to use SpyHunter 4 instead. Id. ¶ 165. In December 2016, Enigma issued a press release to 22 announce this “Countermeasure” informing its customers that it had developed the alternative 23 installer to allow those customers who wished to use SpyHunter instead of MBAM to do so. Id. ¶ 24 166. Thereafter, MBAM products began blocking all *.enigmasoftware.com domains and 25 designating them “Malicious Website[s].” Id. ¶ 167. 26 Enigma also became aware of a Malwarebytes’ “Trusted Advisor” identified as “Aura” 27 Case No.: 5:17-cv-02915-EJD 1 who wrote on Malwarebytes’ message board forum that Malwarebytes was “now flagging 2 SpyHunter products following a more aggressive stance against PUP” and that “SpyHunter fits in 3 many of the [PUP] criterias [sic].” Id. ¶ 141. After another forum user mentioned that they would 4 be cancelling their subscription to SpyHunter, Aura replied: “[m]ake sure that your subscription 5 gets cancelled for real when you do, since there’s been a lot of report[s] in the past (and even 6 today) of users still being charged by [Enigma] for SpyHunter[.]” Id. 7 In June 2018, EnigmaSoft, an Enigma affiliate, released SpyHunter 5, an adaptive malware 8 detection and removal software designed to target a wide range of threats and potential problems 9 to protect users’ cybersecurity. Id. ¶ 171. According to Enigma, two months after SpyHunter 5’s 10 introduction, MBAM products began to detect, quarantine, and block SpyHunter 5 as an identified 11 PUP and “threat.” Id. ¶ 172. Enigmasoft contacted Malwarebytes requesting an explanation for 12 why SpyHunter 5 had been designated as a PUP and “threat” and for Malwarebytes to reconsider 13 its designation. Id. ¶ 173. Malwarebytes never provided Enigmasoft with a formal explanation 14 nor did it respond by changing the designations of any Enigma products. Id. 15 B. Procedural History 16 Enigma first brought this action in the Southern District of New York alleging that 17 Malwarebytes’ actions (1) violated the Lanham Act § 43(a), (2) violated New York General 18 Business Law § 349, (3) constituted tortious interference with Enigma’s contractual relations, and 19 (4) constituted tortious interference with Enigma’s business relations. After Enigma amended its 20 complaint, Malwarebytes moved to transfer the case under 28 U.S.C. § 1404, and in the 21 alternative, to dismiss Enigma’s complaint pursuant to Federal Rules of Civil Procedure 12(b)(2) 22 and 12(b)(6). In May 2017, the court held that transfer of venue to the Northern District of 23 California was warranted for the convenience of the parties and witnesses, and in the interest of 24 justice. See Enigma Software Grp. USA, LLC v. Malwarebytes Inc., 260 F. Supp. 3d 401, 413 25 (S.D.N.Y. 2017). Although the court granted Malwarebytes’ motion to transfer venue, it declined 26 to rule on Malwarebytes’ motion to dismiss for lack of personal jurisdiction and for failure to state 27 Case No.: 5:17-cv-02915-EJD 1 a claim. Therefore, Malwarebytes renewed its motion to dismiss all of Enigma’s claims once the 2 case was before this Court. 3 The Court entered an order granting Malwarebytes’ motion finding that Malwarebytes was 4 entitled to immunity under 47 U.S.C. § 230(c)(2)(B) of the Communications Decency Act of 1996 5 with respect to all of Enigma’s claims. See Order Granting Defendant’s Motion to Dismiss 6 (“Order”), Dkt. No. 105. Enigma appealed the Court’s Order, and the Ninth Circuit considered the 7 extent of the Communications Decency Act’s immunity provision. The Ninth Circuit panel 8 reversed and remanded the Court’s Order, holding that § 230 does not immunize blocking a 9 competitor for anticompetitive reasons. See Enigma Software Group USA, LLC v. Malwarebytes, 10 Inc., 946 F.3d 1040, 1053-54 (9th Cir. 2019), cert. denied, 141 S. Ct. 13, 2020. Following the 11 Ninth Circuit’s denial of Malwarebytes’ petition for panel and en banc rehearing, Malwarebytes 12 filed a petition to the United States Supreme Court for a writ of certiorari. The Supreme Court 13 denied Malwarebytes’ petition and the case was then remanded to this Court for further 14 proceedings. 15 Following remand, Enigma filed its SAC asserting the same four claims as its earlier 16 complaint. Malwarebytes has moved to dismiss all claims with prejudice. See Defendant 17 Malwarebytes’ Motion to Dismiss Second Amended Complaint (“Mot.”), Dkt. No. 147. Enigma 18 has filed an opposition (“Opp’n”) to the motion to dismiss and Malwarebytes has also filed its 19 reply (“Reply”). See Dkt. Nos. 153, 155. 20 II. LEGAL STANDARD 21 Federal Rule of Civil Procedure 8(a) requires a plaintiff to plead each claim with sufficient 22 specificity to “give the defendant fair notice of what the . . . claim is and the grounds upon which 23 it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (internal quotations omitted). The 24 factual allegations in the complaint “must be enough to raise a right to relief above the speculative 25 level” such that the claim “is plausible on its face.” Id. at 556-57. A complaint that falls short of 26 the Rule 8(a) standard may be dismissed if it fails to state a claim upon which relief can be 27 Case No.: 5:17-cv-02915-EJD 1 granted. Fed. R. Civ. P. 12(b)(6). “Dismissal under Rule 12(b)(6) is appropriate only where the 2 complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” 3 Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). 4 III. DISCUSSION 5 A. Request for Judicial Notice 6 The Court first addresses Malwarebytes’ request for judicial notice. Although a district 7 court generally may not consider any material beyond the pleadings in ruling on a Rule 12(b)(6) 8 motion, the Court may take judicial notice of documents referenced in the complaint, as well as 9 matters in the public record, without converting a motion to dismiss into one for summary 10 judgment. See Lee v. City of Los Angeles, 250 F.3d 668, 688-89 (9th Cir. 2001), overruled on 11 other grounds by Galbraith v. Cty. of Santa Clara, 307 F.3d 1119, 1125-26 (9th Cir. 2002). In 12 addition, the Court may take judicial notice of matters that are either “generally known within the 13 trial court’s territorial jurisdiction” or “can be accurately and readily determined from sources 14 whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). Public records for 15 instance, including judgments and other court documents, are proper subjects of judicial notice. 16 See, e.g., United States v. Black, 482 F.3d 1035, 1041 (9th Cir. 2007). 17 Malwarebytes requests for the Court to take judicial notice of two sets of exhibits. Dkt. 18 No. 147-12, (“RJN”). Malwarebytes firsts asks the Court to take judicial notice of Exhibits A 19 through J attached to the declaration of Moez M. Kaba (“Kaba Decl.”). Exhibits A and B are 20 copies of previous complaints filed by Enigma. See Kaba Decl. ¶¶ 2-3, Exs. A-B. Exhibit C is a 21 consumer class action complaint filed against Enigma. Id. ¶ 4, Ex. C. Enigma opposes 22 Malwarebytes’ request for the Court to take judicial notice of Exhibits A-C believing they are not 23 relevant to its claims. The Court GRANTS Malwarebytes’ request, as these are filings in related 24 federal court proceedings and relevant to what Malwarebytes knew about Enigma. See Black, 482 25 F.3d at 1041. 26 Second, Malwarebytes requests judicial notice of a collection of press releases and cease 27 Case No.: 5:17-cv-02915-EJD 1 and desist letters issued by Enigma and obtained from its website, www.enigmasiftware.com. 2 Kaba Decl. ¶¶ 5-6, Exs. D-E. Specifically, Malwarebytes requests that the Court take judicial 3 notice of Enigma publicly stating it has sent “several Cease and Desist letters” to other security 4 software providers based on their classification of Enigma’s SpyHunter program “as a security 5 threat.” Kaba Decl. ¶ 5, Ex. D. Although Enigma disputes the purpose of the press releases, 6 courts in the Ninth Circuit have previously taken judicial notice of press releases. See, e.g., In re 7 Netflix, Inc. Sec. Litig., No. C 04–2978 WHA, 2005 WL 3096209, at *1 (N.D. Cal. Nov. 18, 8 2005); In re Ligand Pharms., Inc. Sec. Litig., No. 04CV1620DMS(LSP), 2005 WL 2461151, at *2 9 n. 1 (S.D. Cal. Sept. 27, 2005); In re Homestore.com. Inc. Sec. Litig., 347 F. Supp. 2d 814, 816–17 10 (C.D. Cal. 2004) (stating that the court can take judicial notice of press releases). Moreover, the 11 Court finds that the press releases and cease and desist letters are relevant to Enigma’s allegations 12 that Malwarebytes had “no objective or good faith” basis to believe Enigma software was a 13 potential threat. See, e.g., SAC ¶¶ 179-80, 196 (asserting that Malwarebytes’ classification of 14 Enigma software was “pretextual”); see also Veronica Foods Co. v. Ecklin, No. 16-CV-07223- 15 JCS, 2017 WL 2806706, at *4 (N.D. Cal. June 29, 2017) (judicially noticing documents which 16 were relevant because they undermined plaintiff’s allegations of misappropriation of trade secrets 17 by demonstrating that the plaintiff had publicly disclosed those supposed secrets). The Court 18 therefore GRANTS Malwarebytes’ request and takes judicial notice of Exhibits D and E. 19 For the same reasons, the Court will also take judicial notice of publicly available letters 20 between Enigma and an individual who referred to Enigma’s software as “ransomware,” “rouge,” 21 and “malicious.” See Kaba Decl. ¶¶ 7-9, Exs. F, G, H.3 The letters directly relate to Enigma’s 22 allegations that Malwarebytes designations and complaints about Enigma’s programs were 23 “pretextual.” See SAC ¶ 196. Therefore, Malwarebytes’ request for judicial notice of Exhibits F, 24 G, and H is GRANTED. 25 26 3 The letters are available on a “publicly accessible website[],” which is a “[p]roper subject[] of judicial notice.” Minor v. Fedex Off. & Print Servs., Inc., 182 F. Supp. 3d 966, 974 (N.D. Cal. 27 2016). Case No.: 5:17-cv-02915-EJD 1 Next, Malwarebytes requests the Court take judicial notice or incorporate by reference 2 Exhibits I and J, which are publicly available webpages on Malwarebytes’ website. Kaba Decl. ¶¶ 3 10-11, Exs. I-J. Exhibit I is a webpage which purports to explain Malwarebytes’ characterization 4 of SpyHunter as a “PUP.Optional” program. Id. ¶ 10. Relatedly, Exhibit J displays a webpage 5 informing users what it means when Malwarebytes blocks a website. Id. ¶ 11. It is well- 6 established that “[c]ourts may take judicial notice of publications introduced to indicate what was 7 in the public realm at the time, not whether the contents of those articles were in fact true.” Von 8 Saher v. Norton Simon Museum of Art at Pasadena, 592 F.3d 954, 960 (9th Cir. 2010) (internal 9 quotations omitted); see also Packsys, S.A. de C.V. v. Exportadora de Sal, S.A. de C.V., 899 F.3d 10 1081, 1087 n.2 (9th Cir. 2018) (“We take notice of the fact of publication, but do not assume the 11 truth of the article’s contents.”). The Court therefore takes judicial notice of Malwarebytes 12 making the statements and publishing them on the webpages, does not assume the truth of those 13 statements. The request for judicial notice of Exhibits I and J is GRANTED; the Court need not 14 decide whether the blog post was incorporated by reference. See In re Google Assistant Priv. 15 Litig., 457 F. Supp. 3d 797, 813 (N.D. Cal. 2020). 16 Lastly, Malwarebytes requests that the Court take judicial notice of Exhibits 1 through 3 17 attached to the declaration of Nathan Scott (“Scott Decl.”). See Dkt. Nos. 98-10, -11, -12. 18 Exhibits 1 through 3 are screenshots of Enigma’s SpyHunter 4 product taken on November 14, 19 2016, showing the program’s scanning and purchasing functionalities shortly after Enigma filed its 20 complaint against Malwarebytes. These documents are judicially noticeable because they are 21 capable of accurate and ready determination using sources whose accuracy cannot reasonably be 22 questioned. See Fed. R. Evid. 201(b). Malwarebytes notes that Enigma cannot dispute the 23 accuracy of the screenshots because they depict its own program. Further, the alleged contents of 24 the screenshots are in Enigma’s SAC, thus demonstrating the importance of the depictions to the 25 case as it relates to Malwarebytes’ reasoning for labeling Enigma’s software as a PUP and 26 “threat.” See Datel Holdings Ltd. v. Microsoft Corp., 712 F. Supp. 2d 974, 985 (N.D. Cal. 2010). 27 Case No.: 5:17-cv-02915-EJD 1 Accordingly, the Court GRANTS Malwarebytes’ request for judicial notice of Exhibits 1 through 2 3. 3 B. Appropriate State Substantive Law 4 i. Legal Standard 5 Ordinarily, a federal court exercising diversity jurisdiction must apply the substantive law 6 of the state in which the court sits, except in matters governed by the U.S. Constitution or federal 7 statutes. Erie R. Co. v. Tompkins, 304 U.S. 64, 78 (1938). The Supreme Court has identified an 8 exception to that principle for cases transferred pursuant to 28 U.S.C. § 1404(a), requiring the 9 transferee district court to apply the state law of the original transferor court. Atl. Marine Constr. 10 Co. v. U.S. Dist. Ct. for W. Dist. of Texas, 571 U.S. 49, 59 (2013) (citing Van Dusen v. Barrack, 11 376 U.S. 612, 639 (1964)). This exception is inapplicable to cases transferred pursuant to 28 12 U.S.C. § 1406 because transfer was effectuated in part to cure a lack of personal jurisdiction. See 13 Muldoon v. Tropitone Furniture Co., 1 F.3d 964, 966–67 (9th Cir. 1993); Nelson v. Int’l Paint 14 Co., 716 F.2d 640, 643 (9th Cir. 1983) (“In [§ 1406(a)] cases, however, it is necessary to look to 15 the law of the transferee state, also to prevent forum shopping, and to deny plaintiffs choice-of-law 16 advantages to which they would not have been entitled to in the proper forum.”). 17 Here, the parties dispute the appropriate state substantive law that governs Enigma’s 18 claims. Malwarebytes contends that California law applies because the district court in New York 19 lacked personal jurisdiction. Mot. at 8-11. On the other hand, Enigma argues that New York 20 substantive law must apply because personal jurisdiction was proper in New York and the case 21 was transferred pursuant to § 1404(a). Opp’n. at 14-18. Because the district court in New York 22 did not rule on the propriety of jurisdiction, “the [Court] must determine whether . . . jurisdiction 23 would have been proper in the transferor court in order to decide which forum state’s law will 24 apply under Erie.” Davis v. Costa–Gavras, 580 F. Supp. 1082, 1086 (S.D.N.Y. 1984) (citing 25 Roofing & Sheet Metal Servs., Inc. v. La Quinta Motor Inns, Inc., 689 F.2d 982, 992–93 (11th Cir. 26 1982)); Ellis v. Great Sw. Corp., 646 F.2d 1099, 1107 (5th Cir. 1981); Martin v. Stokes, 623 F.2d 27 Case No.: 5:17-cv-02915-EJD 1 469, 474 (6th Cir.1980). Thus, the Court must apply the personal jurisdiction laws of New York 2 to determine whether the Southern District of New York had personal jurisdiction over 3 Malwarebytes. 4 In assessing whether personal jurisdiction is proper, “the court must look first to the long- 5 arm statute of the forum state, in this instance, New York.” See Bensusan Rest. Corp. v. King, 126 6 F.3d 25, 27 (2d Cir. 1997) (citation omitted). “If the exercise of jurisdiction is appropriate under 7 that statute, the court then must decide whether such exercise comports with the requisites of due 8 process.” Id. In the present case, Enigma contends that jurisdiction over Malwarebytes is proper 9 pursuant to New York’s long-arm statute, which provides as follows: 10 (a) Acts which are the basis of jurisdiction. As to a cause of action arising from any of the acts enumerated in this section, a court 11 may exercise personal jurisdiction over any non-domiciliary, or his executor or administrator, who in person or through an agent: 12 (1) transacts any business within the state or contracts 13 anywhere to supply goods or services in the state; (2) commits a tortious act within the state, except as to a cause 14 of action for defamations of character arising from the act; or 15 (3) commits a tortious act without the state causing injury to person or property within the state, except as to a cause of 16 action for defamation of character arising from the act, if he 17 (i) regularly does or solicits business, or engages in any other persistent course of conduct, or 18 derives substantial revenue from goods used or consumed or services rendered, in the state, or 19 (ii) expects or should reasonably expect the act to have consequences in the state and derives 20 substantial revenue from interstate or international commerce; or 21 (4) owns, uses or possesses any real property situated within the state. 22 23 N.Y. C.P.L.R. § 302(a)(1)-(4).4 As the New York Court of Appeals has explained, § 302(a)(1) is a 24 25 4 In this case, Malwarebytes correctly points out, and Enigma does not dispute, that there is no 26 general jurisdiction over Malwarebytes under N.Y. C.P.L.R. § 301, because it is clear that Malwarebytes is not conducting “continuous and systematic” business in New York to warrant a 27 finding of their “presence” in New York. See McGowan v. Smith, 52 N.Y.2d 268, 272–73 (1981). Case No.: 5:17-cv-02915-EJD 1 “single act” statute pursuant to which “proof of one transaction in New York is sufficient to 2 invoke jurisdiction, even though the defendant never enters New York, so long as the defendant’s 3 activities [in New York] were purposeful and there is a substantial relationship between the 4 transaction and the claim asserted.” Kreutter v. McFadden Oil Corp., 71 N.Y.2d 460, 467 (1988) 5 (citations omitted). 6 In determining whether a defendant “transacts business” in New York as contemplated by 7 § 302(a)(1), the Court may consider a variety of factors, including: 8 (i) whether the defendant has an on-going contractual relationship 9 with a New York corporation; (ii) whether the contract was negotiated or executed in New York, and whether, after executing a contract with 10 a New York business, the defendant has visited New York for the purpose of meeting with parties to the contract regarding the 11 relationship; (iii) what the choice-of-law clause is in any such contract; and (iv) whether the contract requires [defendants] to send 12 notices and payments into the forum state or subjects them to supervision by the corporation in the forum state. 13 14 Agency Rent A Car Sys., Inc. v. Grand Rent A Car Corp., 98 F.3d 25, 29 (2d Cir. 1996) (internal 15 citations omitted). “Although all are relevant, no one factor is dispositive. Other factors may also 16 be considered, and the ultimate determination is based on the totality of the circumstances.” Id. 17 (citation omitted). 18 ii. Malwarebytes’ Contacts with New York 19 To establish that the Southern District of New York had personal jurisdiction over 20 Malwarebytes, Enigma claims Malwarebytes “regularly transacts business” in New York by 21 offering and selling its programs on its website to customers who include New York residents, 22 “has committed tortious acts in [the state],” has “misled and deceived consumers and businesses in 23 New York,” and has “disrupted and disabled use of [Enigma’s] program” in New York. SAC ¶¶ 24 37-42. Enigma also alleges that at least thirty-one Enigma customers who reside in New York 25 have reported to Enigma that Malwarebytes’ products have detected, quarantined, and/or blocked 26 Enigma’s programs as PUPs and “threats.” Id. ¶ 38. This, in turn, prompted some of those 27 Case No.: 5:17-cv-02915-EJD 1 customers to request refunds from Enigma. Id. Moreover, Enigma alleges that at least five 2 Malwarebytes employees currently work in New York, including a director of channel sales and 3 development, a senior sales engineer, and a senior researcher. Id. ¶ 37.5 4 Based on the foregoing contacts, the Court finds that Malwarebytes does not have 5 sufficient minimum contacts with New York to satisfy the state’s long-arm statute or 6 constitutional due process. First, Enigma’s allegations do not establish that Malwarebytes 7 purposefully directed its alleged activity towards New York. Under subsection 302(a)(1), the 8 Court “looks to: (1) whether a defendant has transacted business in such a way that it constitutes 9 purposeful activity; and (2) whether there is an articulable nexus, or a substantial relationship, 10 between the claim asserted and the actions that occurred in New York.” Megna v. Biocomp 11 Lab’ys Inc., 166 F. Supp. 3d 493, 497–98 (S.D.N.Y. 2016). Maintenance of an “interactive” 12 website that is available to, but does not “specifically target,” New York users does not establish 13 jurisdiction under § 302(a)(1). Seldon v. Direct Response Techs., Inc., No. 03 CIV.5381 (SAS), 14 2004 WL 691222, at *5 (S.D.N.Y. Mar. 31, 2004). 15 Enigma does not allege any facts showing that Malwarebytes’ website specifically targeted 16 New York residents. Rather, Enigma relies on the alleged existence of some users of 17 Malwarebytes’ MBAM software in New York. But the Supreme Court held that specific 18 jurisdiction must be based on “contacts that the ‘defendant himself’ creates with the forum State.” 19 Walden v. Fiore, 571 U.S. 277, 284 (2014) (citation omitted). The Supreme Court explained that 20 it has “consistently rejected attempts to satisfy the defendant-focused ‘minimum contacts’ inquiry 21 by demonstrating contacts between the plaintiff (or third parties) and the forum State.” Id. 22 (citations omitted). The Second Circuit has reiterated that courts must focus on “the relationship 23 24 5 Enigma also argued that Malwarebytes has additional contacts with New York residents that, while not discussed in the SAC, are “reasonable inferences therefrom” that help establish personal 25 jurisdiction. See Opp’n at 16. The Court, however, will not consider these conclusory allegations in its analysis. See Byun v. Amuro, No. 10 CIV. 5417 DAB, 2011 WL 10895122, at *3 (S.D.N.Y. 26 Sept. 6, 2011) (on a 12(b)(2) motion, “conclusory allegations lacking factual specificity do not satisfy plaintiff's burden” and “the Court will not draw argumentative inferences in the plaintiff’s 27 favor” (quoting Robinson v. Overseas Mil. Sales Corp., 21 F.3d 502, 507 (2d Cir. 1994))). Case No.: 5:17-cv-02915-EJD 1 among the defendant, the forum, and the litigation,” rather than a plaintiff’s or third party’s 2 contacts with the forum. Waldman v. Palestine Liberation Org., 835 F.3d 317, 335-37 (2d Cir. 3 2016). The Court must look to “defendants’ suit-related conduct,” or “conduct that could have 4 subjected them to liability,” to evaluate whether the defendant itself created ties with the forum. 5 Id. The conduct at issue here is not “sufficiently connected” to New York because Malwarebytes’ 6 potential liability does not arise from its actions in the forum state. Id. 7 Malwarebytes’ “suit-related conduct” occurred in California, where it developed and 8 executed its criteria for PUPs. See Decl. of Mark Harris (“Harris Decl.”), Dkt. No. 39 ¶ 13. 9 Further, Malwarebytes maintains its website from which its software is distributed in California 10 and its programs are accessible throughout the United States. Id. ¶¶ 6, 13. Therefore, Enigma’s 11 reliance on its claim that thirty-one users of both parties’ programs reside in New York is 12 insufficient to establish jurisdiction. See Walden, 571 U.S. at 286 (“Due process requires that a 13 defendant be haled into court in a forum State based on his own affiliation with the State, not 14 based on the ‘random, fortuitous, or attenuated’ contacts he makes by interacting with other 15 persons affiliated with the State.”). 16 Next, Enigma argues that the Southern District of New York has personal jurisdiction over 17 Malwarebytes pursuant to N.Y. C.P.L.R. § 302(a)(2). Under § 302(a)(2), a court may exercise 18 personal jurisdiction over a non-domiciliary if the non-domiciliary “commits a tortious act within 19 the state, except as to a cause of action for defamation of character arising from the act.” N.Y. 20 C.P.L.R. § 302(a)(2). The defendant, however, must actually be present in New York to be 21 subject to personal jurisdiction under N.Y. C.P.L.R. § 302(a)(2). See, e.g., 7 W. 57th St. Realty 22 Co., LLC v. Citigroup, Inc., No. 13 CIV. 981 PGG, 2015 WL 1514539, at *7 (S.D.N.Y. Mar. 31, 23 2015) (“‘[T]he New York Court of Appeals has interpreted [this] subsection to reach only tortious 24 acts performed by a defendant who was physically present in New York when he committed the 25 act.’”); Elsevier, Inc. v. Grossman, 77 F. Supp. 3d 331, 345 (S.D.N.Y. 2015) (“A ‘defendant’s 26 physical presence in New York is a prerequisite to jurisdiction under § 302(a)(2).’”). Because 27 Case No.: 5:17-cv-02915-EJD 1 Malwarebytes is not physically present in New York, § 302(a)(2) is not a basis for personal 2 jurisdiction. 3 Lastly, the Court turns to N.Y. C.P.L.R. § 302(a)(3). Here, Enigma argues a New York 4 court’s exercise of personal jurisdiction over Malwarebytes would be appropriate. Enigma again 5 relies on alleged cancellation, non-renewal, and/or refund requests it has received from customers 6 residing in New York who were unable to use Enigma’s programs because Malwarebytes 7 designated its programs as PUPs and “threats.” Opp’n at 15-16 (citing SAC ¶¶ 38, 159, 162). 8 Even if Enigma’s allegations properly established injury within New York, subjecting 9 Malwarebytes to personal jurisdiction based on the injury to a third-party in New York would 10 violate due process. Walden, 571 U.S. at 290 (“The proper question is not where the plaintiff 11 experienced a particular injury or effect but whether the defendant’s conduct connects him to the 12 forum in a meaningful way”); see also Waggaman v. Arauzo, 117 A.D.3d 724, 725 (2014) (provision 13 of medical services to a New York resident’s mother was “attenuated connection” to forum under 14 Walden). In addition to this alleged injury, Enigma needed to establish that New York was the “focal 15 point of the torts alleged” and that Malwarebytes “expressly aimed” its conduct toward the state to 16 confer jurisdiction. See Waldman, 835 F.3d at 337-340. As the Court indicated above, 17 Malwarebytes asserts that it does not develop the relevant PUPs criteria in New York. Further, 18 Malwarebytes is not incorporated, headquartered, or operated out of the state of New York and 19 neither its advertisements nor its websites specifically target the state of New York. Mot. at 9; 20 Harris Decl. ¶¶ 4, 5, 6, 11. Accordingly, Enigma has not demonstrated a sufficient basis for the 21 Court’s exercise of personal jurisdiction in this action under New York’s long-arm statute because 22 it does not comport with due process protections established under the Constitution. 23 Because New York lacked personal jurisdiction over Malwarebytes, California law applies. 24 The Court will now turn to Enigma’s individual claims. 25 C. Enigma’s Claims 26 i. Lanham Act § 43(a) 27 Case No.: 5:17-cv-02915-EJD 1 Malwarebytes contends that Enigma has not alleged the requisite elements to state a claim 2 for violation of § 43(a) of the Lanham Act. Fundamentally, Malwarebytes argues that Enigma has 3 not alleged and cannot allege that Malwarebytes made actionable false statements. 4 To state a claim under § 43(a) of the Lanham Act, a plaintiff must allege that: (1) the 5 defendant made a false statement of fact in a commercial advertisement, (2) the statement actually 6 deceived or has the tendency to deceive a substantial segment of its audience, (3) the statement is 7 material, (4) the defendant caused the statement to “enter interstate commerce,” and (5) the 8 plaintiff has been or is likely to be injured as a result of the false statement. Southland Sod Farms 9 v. Stover Seed Co., 108 F.3d 1134, 1139 (9th Cir. 1997). Statements of opinion that are not 10 capable of being proven false do not give rise to civil liability. Coastal Abstract Serv., Inc. v. First 11 Am. Title Ins. Co., 173 F.3d 725, 731 (9th Cir. 1999) (holding that vague and subjective statement 12 that the plaintiff was “too small” to handle certain business did not give rise to liability under the 13 Lanham Act or a claim of defamation under California law). 14 As mentioned, the focus of Enigma’s § 43(a) claim is Malwarebytes’ allegedly false and 15 misleading labeling of Enigma’s software programs and domains as “malicious,” “threats,” and 16 PUPs. See SAC ¶¶ 214-23; see also Opp’n at 18-19. Enigma contends that these labels and 17 categorizations are objectively verifiable statements and actionable, whereas Malwarebytes argues 18 they are opinions and non-actionable. Malwarebytes adds that the challenged labels are based on 19 criteria that it has developed and refined but that Enigma itself alleges is “subjective” and “vague.” 20 Mot. at 12 (citing SAC ¶ 12) (“Malwarebytes’ new criteria rejected specific objective or scientific 21 standards in favor of subjective characteristics.”). In Asurvio LP v. Malwarebytes Inc., this Court 22 was asked to consider a similar scenario after Malwarebytes categorized Asurvio’s software 23 products as PUPs and stated that the products used “false positives,” were “bogus,” and a “scam.” 24 Asurvio LP v. Malwarebytes Inc., No. 5:18-CV-05409-EJD, 2020 WL 1478345, at *6 (N.D. Cal. 25 Mar. 26, 2020). The Court found that Asurvio’s Lanham Act claims failed as a matter of law 26 because Asurvio did not allege sufficient facts to show that Malwarebytes’ labels and warnings 27 Case No.: 5:17-cv-02915-EJD 1 about Asurvio’s products were verifiably false rather than subjective opinions. Id. 2 The present case is indistinguishable. Like in Asurvio LP, Enigma has not pleaded that 3 Malwarebytes’ alleged labels are verifiably false rather than just subjective opinions. Enigma’s 4 allegations that users view statements categorizing Enigma’s programs and domains as 5 “malicious,” “threats,” and PUPs as statements of fact rather than subjective opinions are not 6 supported by the facts presented. The allegations ignore that users of Malwarebytes are aware of 7 why it opines that a given software program may be a PUP based on Malwarebytes’ disclosed 8 criteria and can choose to quarantine or un-quarantine the detected program. See, e.g., SAC, Ex. 9 15 at 22; Kaba Decl. ¶¶ 10-11, Exs. I, J; see also ZL Techs., Inc. v. Gartner, Inc., 709 F. Supp. 2d 10 789, 797-98 (N.D. Cal. 2010) (finding that an information technology analyst’s assessment and 11 ranking of a software company in an industry report distributed to potential customers of the software 12 company is a “non-actionable opinion”). Furthermore, Enigma’s allegations that Malwarebytes 13 knew the labels used to describe Enigma’s programs were false are conclusory and need not be 14 accepted as true. See ZL Techs., Inc., 709 F. Supp. 2d at 796 (holding that “[e]ven on a motion to 15 dismiss, the Court need not accept as true” the plaintiff’s conclusory allegations that a statement is 16 actionable). Because Enigma has not alleged sufficient facts to establish the falsity of 17 Malwarebytes’ labels and related statements about Enigma’s software programs, the Lanham Act 18 claim is subject to dismissal and the Court need not address Malwarebytes’ remaining legal 19 challenges to this claim. 20 ii. New York General Business Law § 349 (Claim II) 21 The statements and labels discussed above are the predicate for Enigma’s claim under New 22 York General Business Law (“NYGBL”) § 349. Still, because the Court has found that New York 23 law does not apply in this case, Enigma’s NYGBL claims must be dismissed. Even if New York 24 law did apply, however, Enigma’s claim under NYGBL § 349 would fail because Enigma relies 25 on the same allegations underlying its Lanham Act claim. To state a claim under NYGBL § 349, 26 “a plaintiff must allege that a defendant has engaged in (1) consumer-oriented conduct that is (2) 27 Case No.: 5:17-cv-02915-EJD 1 materially misleading and that (3) plaintiff suffered injury as a result of the allegedly deceptive act 2 or practice.” Orlander v. Staples, Inc., 802 F.3d 289, 300 (2d Cir. 2015) (quoting Koch v. Acker, 3 Merrall & Condit Co., 18 N.Y.3d 940, 941 944 (2012). The standards for bringing a NYGBL § 4 349 claim “are substantially the same as those applied to claims brought under” § 43(a) of the 5 Lanham Act. Avon Prod., Inc. v. S.C. Johnson & Son, Inc., 984 F. Supp. 768, 800 (S.D.N.Y. 6 1997). Further, an opinion that is not actionable under the Lanham Act is also not actionable 7 under NYGBL § 349. ONY, Inc. v. Cornerstone Therapeutics, Inc., 720 F.3d 490, 498 (2d Cir. 8 2013). Therefore, Enigma’s NYGBL § 349 claim shall be dismissed. 9 iii. Tortious Interference with Contractual Relations (Claim III) 10 To state a claim for tortious interference with contractual relations, a plaintiff must allege: 11 “(1) a valid contract between plaintiff and a third party; (2) defendant’s knowledge of this 12 contract; (3) defendant’s intentional acts designed to induce a breach or disruption of the 13 contractual relationship; (4) actual breach or disruption of the contractual relationship; and (5) 14 resulting damage.” Quelimane Co. v. Stewart Title Guar. Co., 19 Cal. 4th 26, 55 (1998). 15 Enigma’s tortious interference with contractual relations claim fails for two reasons. 16 Enigma first fails to identify a specific contractual obligation with which Malwarebytes 17 interfered. Enigma also fails to adequately plead that Malwarebytes engaged in any independently 18 wrongful act which interfered with a specific contractual obligation under its at-will agreements 19 with users. See Cuba v. Pylant, 814 F.3d 701, 717 (5th Cir. 2016) (requiring “some evidence that 20 the defendant knowingly induced one of the contracting parties to breach its obligations under a 21 contract”); see also Ixchel Pharma, LLC v. Biogen, Inc., 9 Cal. 5th 1130, 1148 (2020) (“We 22 therefore hold that to state a claim for interference with an at-will contract by a third party, the 23 plaintiff must allege that the defendant engaged in an independently wrongful act.”). Instead, 24 Enigma recognizes that Malwarebytes identifies Enigma’s software programs as PUPs yet 25 provides instructions which allow the user to choose whether to continue using those products. 26 See SAC ¶ 120, Ex. 15 at 22-23, 30-31, 46 (providing instructions for how to ignore detected 27 Case No.: 5:17-cv-02915-EJD 1 threats); Kaba Decl. ¶ 11, Ex. J (providing link to instructions to “[e]xclude detections in 2 Malwarebytes on Windows devices”). Thus, Enigma’s tortious interference with contractual 3 relations claim is dismissed. 4 iv. Tortious Interference with Business Relations (Claim IV) 5 Enigma’s final claim asserts that by labeling Enigma’s software programs and domains as 6 “malicious,” “threats,” and PUPs, Malware tortiously interfered with Enigma’s “prospective 7 business relationships between [Enigma’s] users and Enigma” because it induces users not to 8 complete the installation or purchase of licenses for its software. SAC ¶ 246. 9 To state a claim for tortious interference with business relations under California law, a 10 plaintiff must show “(1) an economic relationship between the [claimant] and some third party, 11 with the probability of future economic benefit to the [claimant], (2) that the opposing party knew 12 of the relationship, (3) an intentional, wrongful act designed to disrupt the relationship, (4) actual 13 disruption of the relationship, and (5) that the act caused economic harm to the claimant.” Korea 14 Supply Co. v. Lockheed Martin Corp., 29 Cal. 4th 1134, 1153 (2003). Further, to satisfy the third 15 element of an intentional interference claim—i.e., intentional, wrongful conduct designed to 16 disrupt a business relationship—a claimant “must plead that the alleged interference was 17 independently wrongful by some measure beyond the fact of the interference itself.” See Manwin 18 Licensing Int’l S.A.R.L. v. ICM Registry, LLC, No. CV119514PSGJCGX, 2013 WL 12123772, at 19 *8 (C.D. Cal. Feb. 25, 2013). The claimant can do so by pleading that the conduct was 20 “proscribed by some constitutional, statutory, regulatory, common law, or other determinable legal 21 standard.” Id. at *9. 22 Here, Malwarebytes argues that since Enigma’s Lanham Act and NYGBL § 349 claims 23 fail, Enigma’s tortious interference claim must also fail because Enigma does not allege any other 24 independently wrongful conduct. Mot. at 20-21. The Court agrees, and, therefore, grants 25 Malwarebytes’ motion to dismiss the claim for tortious interference with business relations on this 26 ground. 27 Case No.: 5:17-cv-02915-EJD 1 IV. CONCLUSION 2 For the reasons set forth above, Malwarebytes’ motion to dismiss is GRANTED. Under 3 || Federal Rule of Civil Procedure 15(a), leave to amend “should be freely granted when Justice so 4 || requires.” When dismissing a complaint for failure to state a claim, a court should grant leave to 5 amend “unless it determines that the pleading could not possibly be cured by the allegation of 6 other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000). The Court finds that leave to 7 amend would be futile in this case for several reasons. First, Enigma has already had the 8 || opportunity to amend its claims in the SAC. Second, the Court’s analysis is based in large part on 9 Malwarebytes’ labels, which are non-actionable statements of opinion. Accordingly, there are no 10 || further facts Enigma can allege to cure the complaint. For these reasons, Enigma’s claims are 11 || DISMISSED without leave to amend. a 12 IT IS SO ORDERED. 13 || Dated: August 9, 2021 EDWARD J. DAVILA 15 United States District Judge 16 it 4 18 19 20 21 22 23 24 25 26 27 Case No.: 5:17-cv-02915-EJD 28 || ORDER GRANTING DEFENDANT?’S MOTION TO DISMISS SECOND AMENDED COMPLAINT