- Jul 27, 2015
The US Ninth Circuit Court of Appeals last week ruled that Enigma Software Group can pursue its long standing complaint against rival security firm Malwarebytes for classifying its software as "potentially unwanted programs" or PUPs.
Florida-based Enigma has been trying to hold Malwarebytes accountable for blocking its programs since 2017 when the firm initially sued Malwarebytes for tortious interference, violation of New York business law, and false advertising under the Lanham Act. This suit was filed in response to antivirus maker Malwarebytes labeling Enigma's anti-spyware tool a PUP – soft, supposedly legally safe industry jargon for malware or almost-malware. That labeling caused Malwarebytes' software to automatically quarantine and remove Enigma's Spyhunter from PCs. Enigma objected to the classification. A district court judge hearing the complaint in California dismissed the claim, citing the 2009 Zango v. Kaspersky decision, which affirmed that security firms have some latitude to classify software as harmful. The judge dismissed the case on Section 230(c)(2)(B) grounds, which exempts interactive service providers from liability for content moderation decisions. But Enigma appealed and the Ninth Circuit in 2019 reversed the district court's decision, creating in the process an anticompetitive animus exception to Section 230 of the Communications Decency Act that generally shields online service providers.
That appellate ruling meant that Malwarebytes may be liable for characterizing Enigma's software as PUPs if it's deemed to be a competitor – a decision that has the potential to discourage security companies from characterizing software as harmful.
Malwarebytes, supported by advocacy groups and other security outfits, asked the Supreme Court to review the case but was denied in 2020. In 2021, the California district court, having been told by the Ninth Circuit to reconsider Enigma's lawsuit, again dismissed the complaint. So far, Malwarebytes has been generally winning, and Enigma losing.
At the time, Malwarebytes' outside counsel, Moez Kaba of Hueston Hennigan, celebrated the judgment by noting the district court’s ruling "validates the right of cybersecurity firms to identify potentially unwanted programs and recognizes the rights of users to choose whether or not to enable those programs on their devices." But Malwarebytes' victory lap was premature. Enigma appealed again, and the Ninth Circuit last week revived the case [PDF], except for Enigma's claim of tortious interference with contractual relations. The case now heads back to the district court, subject to the appeals court's direction that New York law also needs to be considered alongside the false advertising claim.