Enigma Software Group USA, LLC v. Malwarebytes, Inc.

FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

ENIGMA SOFTWARE GROUP No. 21-16466

USA, LLC,

Plaintiff-Appellant, D.C. No.

5:17-cv-02915-

v. EJD

MALWAREBYTES, INC.,

Defendant-Appellee. OPINION

Appeal from the United States District Court

for the Northern District of California

Edward J. Davila, District Judge, Presiding

Argued and Submitted November 8, 2022

Portland, Oregon

Filed June 2, 2023

Before: Richard R. Clifton and Patrick J. Bumatay, Circuit

Judges, and M. Miller Baker,* International Trade Judge.

Opinion by Judge Clifton;

Concurrence by Judge Baker;

Dissent by Judge Bumatay

*

The Honorable M. Miller Baker, Judge for the United States Court of

International Trade, sitting by designation.

2 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

SUMMARY**

Lanham Act

The panel affirmed in part and reversed in part the

district court’s judgment dismissing a lawsuit brought by

Enigma Software Group USA LLC, a computer security

software provider, against its competitor Malwarebytes, Inc.

for designating its products as “malicious,” “threats,” and

“potentially unwanted programs”; and remanded for further

proceedings.

Enigma’s operative complaint alleged a false advertising

claim under Section 43(a) of the Lanham Act, 15 U.S.C.

§ 1125(a)(1)(B), and tort claims under New York

law. Dismissing the motion under Fed. R. Civ. P. 12(b)(6),

the district court concluded that all of Enigma’s claims were

insufficient as a matter of law.

The district court primarily based the dismissal on its

conclusion that Malwarebytes’s designations of Enigma’s

products were “non-actionable statements of opinion.” The

panel disagreed with that assessment. In the context of this

case, the panel concluded that when a company in the

computer security business describes a competitor’s

software as “malicious” and a “threat” to a customer’s

computer, that is more a statement of objective fact than a

non-actionable opinion. It is potentially actionable under the

Lanham Act provided Enigma plausibly alleges the other

elements of a false advertising claim.

**

This summary constitutes no part of the opinion of the court. It has

been prepared by court staff for the convenience of the reader.

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 3

The district court held that the tort claims under New

York law failed because Malwarebytes was not properly

subject to personal jurisdiction in New York. That meant

Enigma’s claim for relief under New York General Business

Law (NYGBL) § 349 failed because that statute did not

apply to the alleged misconduct. The panel disagreed and

concluded that Malwarebytes is subject to personal

jurisdiction in New York. As this action was initially filed

in New York, the law of that state properly applies.

The common law claims for tortious interference with

contractual relations and tortious interference with business

relations were also dismissed by the district court. Those

torts are recognized as actionable under California law, as

they are under New York law, but the district court

concluded that Enigma failed to allege essential elements for

those claims under California law. The contractual relations

claim failed because Enigma did not identify a specific

contractual obligation with which Malwarebytes interfered.

The business relations claim was dismissed because that

claim required an allegation of independently wrongful

conduct, and that requirement was not satisfied following the

dismissal of the Lanham Act and NYGBL § 349

claims. Because the panel held that the Lanham Act and

NYGBL § 349 claims should not have been dismissed, the

panel concluded that the tortious interference with business

relations claim should similarly not have been

dismissed. The panel agreed with the district court regarding

dismissal of the claim for tortious interference with

contractual relations, however, and affirmed the dismissal of

that claim.

Concurring, Court of International Trade Judge Baker

wrote separately to touch on choice of law. He wrote that

ordinarily the application of a transferor jurisdiction’s law

4 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

carries with it the choice-of-law rules of that jurisdiction, but

here the parties did not address the choice of law beyond the

dispute over whether personal jurisdiction existed in the

Southern District of New York. The opinion assumes—as

the parties did in their briefing by not addressing choice of

law—that under New York choice-of-law rules, New York

substantive law applies to Enigma’s state-law claims, save

for the claims based on Malwarebytes’ transactions with

customers outside of New York.

Judge Bumatay dissented. He wrote that the Lanham

Act protects against false or misleading representations of

fact, but flagging a competitor’s products as “potentially

unwanted,” a “threat,” or “malicious” is no expression of

fact—these are subjective statements, not readily verifiable,

which means they are opinions. He wrote that by treating

these terms as actionable statements of fact under the

Lanham Act, the court sends a chilling message to

cybersecurity companies—civil liability may now attach if a

court later disagrees with your classification of a program as

“malware.” He wrote that Enigma’s failure to allege a

misstatement of fact is also dispositive on its state-law

claims.

COUNSEL

Terry Budd (argued), Budd Law PLLC, Wexford,

Pennsylvania; Christopher M. Verdini and Anna Shabalov,

K&L Gates LLP, Pittsburgh, Pennsylvania; Edward P.

Sangster, K&L Gates LLP, San Francisco, California; for

Plaintiff-Appellant.

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 5

Moez M. Kaba (argued), Michael H. Todisco, and Warren

S. Crandall, Hueston Hennigan LLP, Los Angeles,

California; John C. Hueston, Hueston Hennigan LLP,

Newport Beach, California; for Defendant-Appellee.

OPINION

CLIFTON, Circuit Judge:

Plaintiff-Appellant Enigma Software Group USA LLC

(“Enigma”), a computer security software provider, sued a

competitor, Defendant-Appellee Malwarebytes, Inc.

(“Malwarebytes”), for designating its products as

“malicious,” “threats,” and “potentially unwanted

programs” (“PUPs”). Enigma’s operative complaint alleged

a false advertising claim under Section 43(a) of the Lanham

Act, 15 U.S.C. § 1125(a)(1)(B), and tort claims under New

York law.

Malwarebytes moved to dismiss under Federal Rule of

Civil Procedure 12(b)(6). The district court granted the

motion, concluding that all of Enigma’s claims were

insufficient as a matter of law. It primarily based the

dismissal on its conclusion that Malwarebytes’s

designations of Enigma’s products were “non-actionable

statements of opinion.” As we explain in more detail below,

we disagree with that assessment. In the context of this case,

we conclude that when a company in the computer security

business describes a competitor’s software as “malicious”

and a “threat” to a customer’s computer, that is more a

statement of objective fact than a non-actionable opinion. It

is potentially actionable under the Lanham Act provided

6 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

Enigma plausibly alleges the other elements of a false

advertising claim.

The district court also held that the tort claims under New

York law failed because Malwarebytes was not properly

subject to personal jurisdiction in New York. That meant

Enigma’s claim for relief under New York General Business

Law (“NYGBL”) § 349 failed because that statute did not

apply to the alleged misconduct. We disagree and conclude

that Malwarebytes is subject to personal jurisdiction in New

York. As this action was initially filed in New York, the law

of that state properly applies.

The common law claims for tortious interference with

contractual relations and tortious interference with business

relations were also dismissed by the district court. Those

torts are recognized as actionable under California law, as

they are under New York law, but the district court

concluded that Enigma failed to allege essential elements for

those claims under California law.

The contractual relations claim failed because Enigma

did not identify a specific contractual obligation with which

Malwarebytes interfered. The business relations claim was

dismissed because that claim required an allegation of

independently wrongful conduct, and that requirement was

not satisfied following the dismissal of the Lanham Act and

NYGBL § 349 claims. Because we hold that the Lanham Act

and NYGBL § 349 claims should not have been dismissed,

we conclude that the tortious interference with business

relations claim should similarly not have been dismissed.

We agree with the district court regarding dismissal of the

claim for tortious interference with contractual relations,

however, and affirm the dismissal of that claim.

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 7

In sum, we affirm in part, reverse in part, and remand for

further proceedings.

I. Background and Procedural History

Enigma is a Florida company that markets and sells

computer security software nationwide. Its products,

according to its Second Amended Complaint (“SAC”), “(i)

detect and remove malicious software (i.e., malware)” such

as “viruses, spyware, adware, ransomware, and Trojans; (ii)

enhance users’ Internet privacy; (iii) offer users the choice

to block ‘Potentially Unwanted Programs’ (‘PUPs’); and/or

(iv) eliminate security threats and risks from problematic

software programs.” SAC ¶ 2.

Malwarebytes is a Delaware corporation, headquartered

in California. It is a direct competitor of Enigma in the anti-

malware and computer security market. Founded in 2008, its

flagship anti-malware products are aimed, according to the

complaint, at “detect[ing] and remov[ing] malware, PUPs,

and other potentially threatening programs on users’

computers.” SAC ¶ 7.

Enigma commenced this lawsuit against Malwarebytes

in the U.S. District Court for the Southern District of New

York asserting Lanham Act false advertising and

supplemental tort claims under New York law. See Enigma

Software Grp. USA, LLC v. Malwarebytes Inc., 260 F. Supp.

3d 401 (S.D.N.Y. 2017). Malwarebytes moved to dismiss for

lack of personal jurisdiction and failure to state a claim or,

in the alternative, to transfer the case to the Northern District

of California under 28 U.S.C. § 1404. Id. at 404. The district

court granted the motion to transfer and declined to reach the

motion to dismiss. Id.

8 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

In the California federal court, Malwarebytes renewed its

motion to dismiss, arguing that Enigma failed to state a claim

and, in the alternative, that Malwarebytes was immune from

suit as all of Enigma’s claims were barred by Section 230 of

the Communications Decency Act of 1996, 47 U.S.C.

§ 230(c)(2). See Enigma Software Grp. USA LLC v.

Malwarebytes Inc., No. 5:17-CV-02915-EJD, 2017 WL

5153698, at *1 (N.D. Cal. Nov. 7, 2017). The district court

granted the motion, holding that Malwarebytes was immune

from suit under Section 230. It did not examine whether

Enigma failed to state a claim. Id. at *4.

Enigma appealed the district court’s ruling. This court

reversed and remanded, holding that Section 230 did not

apply to “blocking and filtering decisions that [we]re driven

by anticompetitive animus.” Enigma Software Grp. USA,

LLC v. Malwarebytes, Inc., 946 F.3d 1040, 1050 (9th Cir.

2019).

On remand, Enigma filed its SAC asserting four causes

of action: (1) false advertising in violation of the Lanham

Act, 15 U.S.C. § 1125(a)(1)(B); (2) a violation of NYGBL

§ 349, prohibiting deceptive and unlawful business

practices; (3) tortious interference with contractual relations;

and (4) tortious interference with business relations.

Enigma alleged that from 2008 to October 2016,

Malwarebytes’s products did not identify any of Enigma’s

products as “malicious,” “threats,” “PUPs,” or any other

type of malware, nor did it quarantine or block consumers

from using any of them. SAC ¶ 11. But starting in October

2016, the complaint alleged, Malwarebytes started to do so.

Enigma alleged it was in retaliation for Enigma suing an

affiliate of Malwarebytes called Bleeping Computer, which

held itself out to the public as an independent website

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 9

reviewing software products. SAC ¶ 11. According to

Enigma, Bleeping Computer was not independent and

conveyed “false, misleading, and deceptive information” on

its website about Enigma and its products, as well as

“instruct[ing] users not to install, or to uninstall,” Enigma

products and “instead purchase Malwarebytes’ competing

products.” SAC ¶ 23. Enigma alleged that Bleeping

Computer disseminated this false information in exchange

for sales commissions from Malwarebytes. SAC ¶ 11.

Enigma further alleged that Malwarebytes retaliated

against it because the former subpoenaed the latter in the

Bleeping Computer lawsuit seeking evidence of a

“profiteering scheme” between Malwarebytes and Bleeping

Computer “employing anticompetitive, unfair trade

practices” to Enigma’s detriment.

Malwarebytes moved to dismiss for failure to state a

claim, and the district court again dismissed the case, as

described above. Regarding the Lanham Act claim, the

district court reasoned that Enigma alleged that

Malwarebytes’s designations of the former’s products were

“just [nonactionable] subjective opinions” rather than

“verifiably false.” As to Enigma’s state law claims, the

district court concluded that California law applied because

New York lacked personal jurisdiction over Malwarebytes.

For that reason alone, the district court held, the NYGBL

§ 349 claim failed. But even if New York law applied, the

claim failed for the same reasons that the Lanham Act claim

failed. The district court concluded that Enigma’s tortious

interference claims failed under California law. The district

court reasoned that the contractual interference claim failed

to identify “a specific contractual obligation with which

Malwarebytes interfered” and failed to “plead that

Malwarebytes engaged in any independently wrongful act

10 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

which interfered with a specific contractual obligation under

its at-will agreements with users.” The interference with

business relations claim failed because Enigma did not

“allege any other independently wrongful conduct,”—

meaning conduct “proscribed by some [statutory or common

law] standard,”—beyond the failed Lanham Act and

NYGBL § 349 claims.

In dismissing the case, the district court also denied leave

to amend, reasoning that “there are no further facts Enigma

can allege to cure the complaint.” Enigma timely appealed.

II. Discussion

We review de novo a district court’s dismissal for failure

to state a claim, crediting all factual allegations as true and

construing the pleadings in the light most favorable to the

non-moving party. Tingley v. Ferguson, 47 F.4th 1055, 1066

(9th Cir. 2022).

A. Lanham Act

Enigma argues that the district court erred in dismissing

its Lanham Act claim. Enigma alleged that Malwarebytes

designated its products and domains as “malicious,”

“threats,” and “PUPs” and that such statements were

“factually false” and misrepresented the very purpose of its

software. The district court held that these statements were

non-actionable statements of opinion. As to the statements

that Enigma’s products are “malicious” and “threats,” we

disagree.1

1

Enigma also argues that our previous opinion in Enigma Software Grp.

USA, LLC v. Malwarebytes, Inc., 946 F.3d 1040 (9th Cir. 2019), compels

reversing the district court’s dismissal of the Lanham Act claim. There,

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 11

To state a claim for false advertising under Section 43(a)

of the Lanham Act, Enigma had to allege that (1)

Malwarebytes made a false statement of fact in a commercial

advertisement; (2) the statement deceived or had the

tendency to deceive a substantial segment of its audience;

(3) the deception was material, in that it was likely to

influence the purchasing decision; (4) the false statement

entered interstate commerce; and (5) Enigma has been or is

likely to be injured as a result of the false statement.

Southland Sod Farms v. Stover Seed Co., 108 F.3d 1134,

1139 (9th Cir. 1997). Because the district court concluded

that Malwarebytes’s challenged designations were non-

actionable statements of opinion rather than fact, the court

did not consider whether the company plausibly alleged the

other applicable requirements.2

To show falsity under the Lanham Act, a plaintiff must

allege that “the statement was literally false, either on its face

or by necessary implication, or that the statement was

literally true but likely to mislead or confuse consumers.”

Id.; see also Ariix, LLC v. NutriSearch Corp., 985 F.3d 1107,

1121 (9th Cir. 2021) (quoting Coastal Abstract Serv., Inc. v.

First Am. Title Ins. Co., 173 F.3d 725, 731 (9th Cir. 1999))

we held that Enigma’s Lanham Act claim did not fall under Section 230

of the Communications Decency Act’s intellectual property exception.

Id. at 1052–53. We did not decide, however, whether Enigma stated a

claim under the Lanham Act.

2

In addition to the defending the district court’s determination that the

challenged designations were nonactionable opinions rather than

statements of fact, Malwarebytes defends dismissal of the Lanham Act

claim on the alternative grounds that those designations were not

commercial speech, and that they did not deceive a substantial segment

of the relevant audience. We remand those issues to the district court to

consider in the first instance.

12 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

(“An actionable statement is a specific and measurable

claim, capable of being proved false or of being reasonably

interpreted as a statement of objective fact.”).

Taken as true at the stage of a motion to dismiss,

Enigma’s allegations are sufficient to state a Lanham Act

claim. Malwarebytes’s designations employ terminology

that is substantively meaningful and verifiable in the

cybersecurity context. Unlike non-actionable statements of

puffery, which are “extremely unlikely to induce consumer

reliance,” Malwarebytes’s designations of Enigma’s

products “make[] a claim as to the specific or absolute

characteristics of a product” and are accordingly actionable

statements of fact under the Lanham Act. Newcal Indus., Inc.

v. Ikon Off. Sol., 513 F.3d 1038, 1053 (9th Cir. 2008)

(internal quotation marks and citation omitted). As Enigma

points out, its products either contain malicious files and

threaten the security of users’ computers, or they do not.

These statements are not the type of general, subjective

claims typically deemed non-actionable opinions.

We must look to “the totality of the circumstances” when

assessing whether a statement implies a factual assertion.

Underwager v. Channel 9 Australia, 69 F.3d 361, 366 (9th

Cir. 1995). Although “malicious” and “threatening” are

“adjectives [that] admit of numerous interpretations,”

Partington v. Bugliosi, 56 F.3d 1147, 1158 (9th Cir. 1995),

“[t]he context . . . is paramount” because “the reasonable

interpretation of a word can change depending on the context

in which it appears.” Knievel v. ESPN, 393 F.3d 1068, 1075

(9th Cir. 2005). Malwarebytes’s anti-malware program

specifically labeled Enigma’s software as “malicious” and a

“threat,” which a reasonable person would plausibly

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 13

interpret as the identification of malware.3 SAC ¶¶ 143–64.

Because whether software qualifies as malware is largely a

question of objective fact, at least when that designation is

given by a cybersecurity company in the business of

identifying malware for its customers, Enigma plausibly

alleged that Malwarebytes’s statements are factual

assertions.

Our dissenting colleague disagrees. The dissent

contends, at 36, that “[c]ontrary to Enigma’s claims, a

program isn’t simply ‘potentially unwanted’ or not. A

software program isn’t verifiably a ‘threat’ or not. And a

website isn’t measurably ‘malicious’ or not. In the

cybersecurity context, these terms refer to a spectrum of

digital features with no verifiable line to cross to determine

when they apply.”

We agree that “potentially unwanted” is too unspecific to

provide a basis for a Lanham Act claim, as we noted above

at 13, n.3. But the premise of the dissent regarding the terms

“threat” and “malicious” rests on an understanding of the

meaning of those words in this context that we do not share.

Malware, in its ordinary meaning, refers to software

“written with the intent of being disruptive or damaging to

(the user of) a computer or other electronic device; viruses,

worms, spyware, etc., collectively.” Oxford English

Dictionary Online (2022); see also Malware, Black’s Law

Dictionary (11th ed. 2019) (defining malware as “software,

used to monitor or gain access to another’s computer system

3

Unlike the terms “malicious” and “threat,” which a cybersecurity

application would use to describe malware, “potentially unwanted

program” is too vague to be considered a factual assertion.

14 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

without authorization for the purpose of impairing or

disabling the system.”).

We think such a definition lends itself to verification.

Enigma’s complaint indicates that malware can come in

many forms, including “viruses, spyware, adware,

ransomware, and Trojans.” SAC ¶ 2. But at bottom, as

demonstrated by the dictionary definitions quoted above, the

term necessarily implies that someone created software with

the intent to gain unauthorized access to a computer for some

nefarious purpose. The dissent offers no compelling reason

why that cannot be determined objectively. Just like the

certification at issue in Ariix, whether a given software

qualifies as malware can be reduced to “a binary

determination” based on “falsifiable criteria.” 985 F.3d at

1122. The dissent’s characterization of malware as “a

spectrum of digital features with no verifiable line” is

therefore incorrect.4

4

The dissent contends that we have manufactured a claim against

Malwarebytes stating, “Enigma has never alleged that Malwarebytes

violated the Lanham Act based on the use of the term ‘malware.’”

Dissent at 42–43. Not so. Enigma alleged that Malwarebytes’s software

tells users that conducting a recommended “Threat Scan” “scans all the

places malware is known to hide.” SAC ¶ 132 (emphasis added). If

Malwarebytes’s software detected something as a “threat” or “PUP,” the

default configuration was to “treat detections as malware.” SAC ¶¶ 133–

34. The result is that Enigma customers using Malwarebytes’s software

to conduct a “Threat Scan” were left with the impression that Enigma’s

products were malware. See, e.g., SAC ¶ 147 (stating that one customer

contacted Enigma to inquire why “Malware bites [sic] says [Enigma’s

software] is an infection” and “another customer reported the ‘malware

bytes’ program keeps detecting malware every time I try to download

your software.’”); SAC ¶ 149 (“Please advise why your SpyHunter and

RegHunter applications are being detected as malware.”) (emphasis in

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 15

More importantly, judges are not experts in the

cybersecurity field. We should not presume that we are.

Enigma has alleged that those terms have implied meaning

in that field which was understood by a significant portion

of its users, SAC ¶¶ 143–64, such that Malwarebytes’s

allegedly false use of those terms can be proved or disproved

as a matter of objective fact. Those allegations are not

implausible, and the dissent does not claim that they are. To

prevail, Enigma must ultimately prove that Malwarebytes’s

designation of its software was false. But at the motion to

dismiss stage, the allegations are sufficient.

At root, the dissent’s disagreement with our conclusion

rests on its purported effort to protect expressions of

“opinion” based on its misperception of the First

Amendment. It makes that clear from its first paragraph.

Dissent at 27. The dissent acknowledges that the protection

afforded to commercial speech is limited and that “there can

be no constitutional objection to the suppression of

commercial messages that do not accurately inform the

public.” Dissent at 32 (quoting Cent. Hudson Gas & Elec.

Corp. v. Pub. Serv. Comm’n of New York, 447 U.S. 557, 562–

63 (1980)). But it does not heed that distinction. As we said

in Ariix,

Today, consumers face waves of

advertisements amid a sea of product choices.

To navigate the seemingly unending stream

of advertisements, consumers often depend

on independent reviews for candid and

accurate assessments. But when someone

original). In short, the dissent’s contention is premised on a misreading

of the record.

16 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

falsely claims to be independent, rigs the

ratings in exchange for compensation, and

then profits from that perceived objectivity,

that speaker has drowned the public trust for

economic gain. Society has little interest in

protecting such conduct under the mantle of

the First Amendment.

Ariix, 985 F.3d at 1118–19.

In that case, we held that a five-star rating system

comparing nutritional supplement products from the view of

the speaker was an opinion not actionable under the Lanham

Act. Id. at 1121. If Malwarebytes had said that its product

was better than Enigma’s product, that statement would be

covered by Ariix and not subject to a Lanham Act claim. That

is not the statement challenged by Enigma in this action,

though. Malwarebytes stated that Enigma’s products were a

“threat” and “malicious.” We conclude that those statements

could be found to be statements of objective fact, subject to

being found false. Like the “Medal of Achievement”

certification in Ariix, those statements may properly be the

subjects of a claim, outside the protection of the First

Amendment, as we held in that decision. Id. at 1121–22.

The facts of this case do not closely match Ariix, but the

principle is the same. Enigma has alleged that Malwarebytes

disparaged Enigma’s products for commercial advantage by

making misleading statements of fact. If those allegations

are true, and at this stage we must presume that they are,

trying to wrap them in a First Amendment flag does not

make them any less offensive or any less actionable.

“Society has little interest in protecting such conduct under

the mantle of the First Amendment.” Id. at 1119.

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 17

B. Personal Jurisdiction

Enigma also argues the district court erred in holding that

Malwarebytes was not subject to personal jurisdiction in

New York and that California law applied to the dispute. We

review personal jurisdiction rulings de novo. Ayla, LLC v.

Alya Skin Pty. Ltd., 11 F.4th 972, 978 (9th Cir. 2021).

As noted above, the Southern District of New York

transferred this case to the Northern District of California.5

Generally, diversity cases transferred under 28 U.S.C.

§ 1404(a) require that the transferee district court apply the

state law, including the choice-of-law rules, of the original

transferor court. See Van Dusen v. Barrack, 376 U.S. 612,

639 (1964) (holding, in a diversity case transferred at the

request of the defendant, that “[a] change of venue under

§ 1404(a) generally should be, with respect to state law, but

a change of courtrooms”); Ferens v. John Deere Co., 494

U.S. 516, 529 (1990) (in another diversity case, extending

the rule of Van Dusen to cases transferred at the request of

the plaintiff); Muldoon v. Tropitone Furniture Co., 1 F.3d

964, 965–66 (9th Cir. 1993) (under Van Dusen and Ferens,

“the transferee court must follow the choice-of-law rules of

the transferor court”).

To apply the state law of the transferor jurisdiction in a

§ 1404(a) transfer case, the transferor court must have had

personal jurisdiction over the defendant. Because the court

in New York declined to rule on Malwarebytes’s challenge

to personal jurisdiction before transferring this case, “the

5

The district court exercised federal question jurisdiction over Enigma’s

Lanham Act claim, see 28 U.S.C. § 1331, and—because the parties are

citizens of different states—diversity jurisdiction over its state-law

claims, id. § 1332.

18 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

transferee court must determine whether . . . jurisdiction

would have been proper in the transferor court in order to

decide which forum state’s law will apply under Erie” and

Van Dusen. Davis v. Costa–Gavras, 580 F. Supp. 1082,

1086 (S.D.N.Y. 1984) (citing Roofing & Sheet Metal Servs.,

Inc. v. La Quinta Motor Inns, Inc., 689 F.2d 982, 992–93

(11th Cir. 1982); Ellis v. Great Southwestern Corp., 646

F.2d 1099, 1107 (5th Cir. Unit A June 1981); Martin v.

Stokes, 623 F.2d 469, 474 (6th Cir. 1980)); see also Nelson

v. Int’l Paint Co., 716 F.2d 640, 643 (9th Cir. 1983) (where

transferor court lacked personal jurisdiction, state law of

transferee court applies).

Accordingly, we must determine whether the court in

New York had personal jurisdiction over Malwarebytes. If

New York had such jurisdiction, as discussed above we must

apply the law of New York to the state law claims; if the

New York court lacked personal jurisdiction, we would

apply the law of California.

“An exercise of personal jurisdiction in federal court

must comport with both the applicable state’s long-arm

statute and the federal Due Process Clause.” Burri L. PA v.

Skurla, 35 F.4th 1207, 1212 (9th Cir. 2022). New York’s

long-arm statute states that a court may exercise specific

personal jurisdiction over a non-resident if it “transacts any

business within the state,” N.Y. C.P.L.R. § 302(a)(1), and if

the “cause of action ‘aris[es] from’ such a business

transaction.” Best Van Lines, Inc. v. Walker, 490 F.3d 239,

246 (2d Cir. 2007) (alteration in original) (quoting Deutsche

Bank Sec., Inc. v. Montana Bd. of Invs., 850 N.E.2d 1140,

1142 (N.Y. 2006)).

“A defendant transacts business within the meaning of

§ 302(a)(1) when it purposefully ‘avails itself of the

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 19

privilege of conducting activities [in New York], thus

invoking the benefits and protections of its laws.’” Brown v.

Web.com Grp., Inc., 57 F. Supp. 3d 345, 356 (S.D.N.Y.

2014) (alteration in original) (quoting Fischbarg v. Doucet,

880 N.E.2d 22, 26 (N.Y. 2007)). “[P]roof of one transaction

in New York is sufficient to invoke jurisdiction, even though

the defendant never enters New York, so long as the

defendant’s activities [there] were purposeful and there is a

substantial relationship between the transaction and the

claim asserted.” Eades v. Kennedy, PC L. Offices, 799 F.3d

161, 168 (2d Cir. 2015) (quoting Chloé v. Queen Bee of

Beverly Hills, LLC, 616 F.3d 158, 163 (2d Cir. 2010)).

Whether there is personal jurisdiction based on the

operation of a website depends on where the website falls on

the “spectrum of interactivity.” Weiss v. Barc, Inc., No. 12

CV 7571(TPG), 2013 WL 2355509, at *4 (S.D.N.Y. May

29, 2013). “Passive websites . . . are limited to making

information available to users” and do not establish personal

jurisdiction. Id. “Interactive websites knowingly transmit

goods or services to users and if made available to New York

residents, the activities can be sufficient for establishing

personal jurisdiction over a defendant.” Id. The website

operated by Malwarebytes easily qualifies as interactive

under Weiss.

As for whether the claim “arises from” a business

transaction, the New York Court of Appeals has held that the

“arising from” prong of Section 302(a)(1) does not require

but-for causation between a defendant’s New York business

activity and a plaintiff’s injury. Licci v. Lebanese Canadian

Bank, 984 N.E.2d 893, 900 (N.Y. 2012). Instead, it requires

“a relatedness between the transaction and the legal claim

such that the latter is not completely unmoored from the

former . . . . In effect, the ‘arise-from’ prong limits the

20 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

broader ‘transaction-of-business’ prong to confer

jurisdiction only over those claims in some way arguably

connected to the transaction.” Id. at 900–01.

Applying these standards, Malwarebytes is subject to

personal jurisdiction in New York. First, Malwarebytes

“transacts business” in New York through its website, which

allows New York–based users to buy and download

products.6 Malwarebytes does not have to be physically

present in New York to transact business there within the

meaning of the first clause of Section 302(a)(1). See Chloé,

616 F.3d at 169 (collecting cases). Second, Enigma’s claims

in this lawsuit arise at least in part out of Malwarebytes’s

transaction of business in New York. Courts in New York

have held that the sale of copyright- and trademark-

infringing works into New York through the internet is

sufficient to establish personal jurisdiction under the “arising

under” prong.7

New York’s exercise of personal jurisdiction is also

consistent with the Due Process Clause. See Knight v.

Standard Chartered Bank, 531 F. Supp. 3d 755, 763

6

Cf. Citigroup Inc. v. City Holding Co., 97 F. Supp. 2d 549, 565–66

(S.D.N.Y. 2000) (finding that a website permitting New Yorkers to apply

for loans and communicate with defendant’s employees was

“unqualifiedly commercial in nature,” rising to the level of transacting

business required by § 302(a)(1)); NFL v. Miller, No. 99 Civ. 11846

JSM, 2000 WL 335566, at *1 (S.D.N.Y. Mar. 30, 2000) (“[O]ne who

uses a web site to make sales to customers in a distant state can thereby

become subject to the jurisdiction of that state’s courts.”).

7

See, e.g., Mattel, Inc. v. www.fisher-price.online, No. 21-CV-9608

(LJL), 2022 WL 2801022, at *4 (S.D.N.Y. July 18, 2022) (defendant’s

sale of counterfeit products in New York had “a substantial relationship

with Plaintiff’s claim that Defendant counterfeited and infringed upon

[its trademarks] in violation of the Lanham Act”).

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 21

(S.D.N.Y. 2021) (“[B]ecause the Due Process Clause

permits the exercise of jurisdiction in a broader range of

circumstances [than] N.Y. C.P.L.R. § 302, . . . a foreign

defendant meeting the standards of § 302 will satisfy the due

process standard.”) (internal quotation marks and citation

omitted). Therefore, if an exercise of personal jurisdiction

satisfies New York’s long-arm statute, it also satisfies the

Due Process Clause. See D.H. Blair & Co. v. Gottdiener, 462

F.3d 95, 105 (2d Cir. 2006) (“[T]he constitutional

requirements of personal jurisdiction are satisfied because

application of [§ 302(a)] meets due process requirements.”).

We therefore reverse the district court’s holding that

New York lacked personal jurisdiction over Malwarebytes

and that California law applies to Enigma’s state law claims.

New York has personal jurisdiction over Malwarebytes with

respect to its sales to New York–based customers, and

therefore New York law applies to Enigma’s state-law

claims based on those transactions. We do not decide

whether New York law applies to Malwarebytes’s

transactions with other customers outside the state of New

York. That choice of law question is not before us in the

current appeal.

C. State-law Claims

1. NYGBL § 349

The district court dismissed Enigma’s NYGBL § 349

claim for two reasons. The first was that New York law did

not apply. The second was that “an opinion that is not

actionable under the Lanham Act is also not actionable under

the NYGBL § 349.” Because we hold that New York law

applies and that Enigma’s Lanham Act claim is actionable,

we reverse the dismissal of the NYGBL claim and remand

to the district court to reinstate.

22 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

2. Tortious interference claims

Enigma also argues that the district court erred in

dismissing its claims for tortious interference with

contractual and business relations. The district court

construed the tortious interference claims under California

law, but as discussed above, New York law applies to these

claims. Reading the complaint in the light most favorable to

the plaintiff, as we must, Enigma has sufficiently pled its

cause of action for tortious interference with business

relations but has failed to do so for tortious interference with

contractual relations.

a. Tortious interference with business relations

To state a claim for tortious interference with business

relations, New York requires a plaintiff to establish that:

(1) it had a business relationship with a third

party; (2) the defendant knew of that

relationship and intentionally interfered with

it; (3) the defendant acted solely out of

malice, or used dishonest, unfair, or improper

means; and (4) the defendant’s interference

caused injury to the relationship.

Kirch v. Liberty Media Corp., 449 F.3d 388, 400 (2d Cir.

2006) (quoting Carvel Corp. v. Noonan, 350 F.3d 6, 17 (2d

Cir. 2003)). Enigma’s complaint plausibly demonstrated

each of these factors.

Enigma stated in its complaint that it had contracts with

customers who purchased subscription-based licenses to use

its SpyHunter 4 and RegHunter 2 software. SAC ¶ 235.

Enigma also stated that it and Malwarebytes had some

customers in common who, seeking added levels of security,

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 23

simultaneously used both companies’ products. SAC ¶ 236.

Enigma further alleged Malwarebytes took a series of steps

to interfere with its prospective relationships with

customers. For instance, Enigma stated that Malwarebytes

(1) falsely labelled Enigma’s products as “threats” and

“PUPs,” (2) automatically blocked customers from installing

Enigma’s software, and (3) automatically quarantined and

preselected Enigma software for deletion. SAC ¶¶ 237–39.

The result of this conduct, Enigma alleges, is that

Malwarebytes induced Enigma’s customers to choose either

not to install, or to delete, Enigma’s programs from their

computers without any legitimate justification. SAC ¶ 240.

Further, Enigma alleged the prospective relationships

with the requisite specificity to establish a claim for tortious

interference with business relations. New York requires that

a “plaintiff . . . identify a specific customer that the plaintiff

would have obtained ‘but for’ the defendant’s wrongful

conduct,” Zetes v. Stephens, 969 N.Y.S.2d 298, 304 (4th

Dep’t 2013), as relief should not be afforded for merely

speculative damage, see, e.g., Parekh v. Cain, 948 N.Y.S.2d

72, 76 (2d Dep’t 2012) (dismissing a claim for tortious

interference with business relations because the plaintiff did

not identify a third party with which the plaintiff had

business relations). For this, Enigma asserted that certain

customers downloaded its software before paying for a full

subscription. SAC ¶¶ 244–46. Because Enigma points to

identifiable customers whose business it lost, its complaint

plausibly alleges that it had business relationships with third

parties.

The district court’s dismissal of this claim for Enigma’s

inability to identify an independent wrongful act was

erroneous for two reasons. First, Enigma’s reinstated claims

under the Lanham Act and NYGBL § 349 could serve as

24 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

independent wrongful acts if such a showing were necessary.

More importantly—and unlike under California law, see

Ixchel Pharma, LLC v. Biogen, Inc., 470 P.3d 571, 576 (Cal.

2020) (“[I]ntentionally interfering with prospective

economic advantage requires pleading that the defendant

committed an independently wrongful act.”)—a claim for

tortious interference with business relations under New York

law does not require the plaintiff to show an “independent

wrongful act.” Instead, Enigma only needs to allege that

Malwarebytes acted “solely out of malice, or used dishonest,

unfair, or improper means,” Kirch, 449 F.3d at 400, which it

did in its complaint. See SAC ¶ 249 (Malwarebytes acted

“for the sole purpose of inflicting intentional harm upon

[Enigma]”). Accordingly, we hold that Enigma sufficiently

alleged the elements of a claim for tortious interference with

business relations.

b. Tortious interference with contractual

relations

To establish a claim of tortious interference with contract

under New York law, a plaintiff must plead the following

elements:

(1) the existence of a valid contract between

the plaintiff and a third party; (2) the

defendant’s knowledge of the contract; (3)

the defendant’s intentional procurement of

the third-party’s breach of the contract

without justification; (4) actual breach of the

contract; and (5) damages resulting

therefrom.

Kirch, 449 F.3d at 401 (internal quotation marks and citation

omitted).

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 25

The district court held that the contractual relations

interference claim failed because Enigma did not identify

any contractual breach that Malwarebytes induced.

Although the district court improperly analyzed this claim

under California law, the bottom-line result was still correct

under New York law.

To state a claim for tortious interference with contractual

relations under New York law, a plaintiff must allege that

the defendant induced an actual breach of contract. See NBT

Bancorp Inc. v. Fleet/Norstar Fin. Grp., Inc., 664 N.E.2d

492, 495–96 (N.Y. 1996) (holding that, although tortious

interference can take many forms, New York mandates that

actual breach be shown). Here, Enigma alleged that its

preexisting customers cancelled their subscriptions and

requested refunds because of Malwarebytes’s conduct. SAC

¶¶ 239–41. And although this amounts to disruption of the

contractual relationship between Enigma and its customers,

it falls short of alleging any contractual breach by those

customers. Because New York law requires such a breach,

Enigma has not adequately pled one of the required elements

for a claim of tortious interference with contractual relations.

III. Conclusion

We affirm the district court’s dismissal of Enigma’s

claim of tortious interference with contractual relations. We

reverse the district court’s dismissal of Enigma’s remaining

claims and remand for further proceedings consistent with

this opinion. Each party is to bear its own costs.

AFFIRMED in PART, REVERSED in PART, and

REMANDED for further proceedings.

26 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

BAKER, Judge, concurring:

I join the majority opinion in full and write separately to

briefly touch on choice of law. As the opinion

acknowledges, ordinarily the application of a transferor

jurisdiction’s law under Van Dusen and Ferens carries with

it the choice-of-law rules of that jurisdiction. See Muldoon

v. Tropitone Furniture Co., 1 F.3d 964, 965 (9th Cir. 1993)

(under Van Dusen and Ferens, “the transferee court must

follow the choice-of-law rules of the transferor court”).

Here, however, the parties have not addressed choice of

law beyond the dispute over whether personal jurisdiction

existed in the Southern District of New York. They appear

to agree that if such jurisdiction existed, then New York

substantive law would govern Enigma’s state-law claims

and, conversely, if such jurisdiction were lacking, then

California substantive law would apply. The opinion

therefore assumes—as the parties did in their briefing by not

addressing choice of law—that New York’s choice-of-law

rules require application of that state’s substantive law to

Enigma’s state-law claims, save for the claims based on

Malwarebytes’s transactions with customers located

elsewhere.

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 27

BUMATAY, Circuit Judge, dissenting:

When a cybersecurity company flags another company’s

products as “potentially unwanted programs,” “threats,” or

“malicious,” could it be liable for false advertising under the

Lanham Act? The answer is plainly “no.” The Lanham Act

protects against false or misleading representations of fact.

See 15 U.S.C. § 1125(a)(1)(B). But flagging a competitor’s

products as “potentially unwanted,” a “threat,” or

“malicious” is no expression of fact—these are subjective

statements, not readily verifiable. That means they are

opinions. The freedom to express opinions is at the core of

the First Amendment. And that guarantee doesn’t change

because the opinions are about cybersecurity, malware, or

internet domains.

Thus, even in the commercial context, we must be

careful not to expand Lanham Act liability to encompass

protected opinions. Unfortunately, that is exactly what our

court does here. We mistake subjective expressions of

opinion for provable statements of fact—falling for the claim

that some of these terms have an uncontested, objective

meaning in the cybersecurity field. Yet even a cursory

review shows that’s not true. By treating these terms as

actionable statements of fact under the Lanham Act, our

court sends a chilling message to cybersecurity companies—

civil liability may now attach if a court later disagrees with

your classification of a program as “malware.” But we have

neither the authority nor the competence to arrogate to

ourselves regulatory oversight over cybersecurity.

For these reasons, I respectfully dissent.

28 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

I.

Enigma Software Group USA, LLC and Malwarebytes,

Inc. develop competing anti-malware software products.

“Malware” is a portmanteau of “malicious” and “software.”

Oxford English Dictionary Online (2022). So, as the term

implies, anti-malware programs are designed to detect and

remove potentially unwanted, threatening, or malicious

programs from users’ computers. For eight years, from 2008

to 2016, the two companies’ products coexisted on users’

systems without issue. But in 2016, things changed. In

October of that year, Malwarebytes announced that it was

getting “tougher” on potentially unwanted programs. The

move was purportedly a response to software developers’

efforts to circumvent the company’s detection criteria.

Malwarebytes provided a statement announcing its new

criteria:

How do we identify potentially unwanted

software?

Analyzing and categorizing potentially

unwanted software is a complex problem.

Developers of potentially unwanted software

rapidly evolve their products. Some even

contain a few characteristics that resemble

legitimate software to mask the unwanted

functionality. It’s an on-going process, and

we work hard to identify common behaviors

that help provide you the highest level of

protection. In some cases, where the

behavior is questionable, we will list the

application even if it does not neatly fit into

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 29

the listed criteria. In other words, we use our

judgment.

While we highlight potentially unwanted

programs, you then make a choice in the

exclusions list and select what you want to

keep or remove.

Here are some of the criteria we use:

• obtrusive, misleading, or deceptive

advertising, branding, or search practices

• excessive or deceptive distribution, affiliate

or opt-out bundling practices

• aggressive or deceptive behavior especially

surrounding purchasing or licensing

• unwarranted, unnecessary, excessive,

illegitimate, or deceptive modifications of

system settings or configuration (including

browser settings and toolbars)

• difficulty uninstalling or removing the

software

• predominantly negative feedback or ratings

from the user community

• diminishes user experience

• other practices generally accepted as

riskware, scareware, adware, greyware, or

otherwise commonly unwanted software by

the user community

Malwarebytes informed its users that it must “regularly

update” its software to meet these criteria. The company

30 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

also warned that “sometimes [it] get[s] it wrong” and

provided an email address to ask for “reconsideration” of its

decisions. Noting the need to respond promptly to “new

forms of potentially unwanted software” that “frequently

emerge and proliferate,” Malwarebytes “reserve[d] the right

to adjust, expand and update [its] criteria without prior notice

or announcements.”

Under the new criteria, Malwarebytes’ software

designated two of Enigma’s anti-malware products—

“SpyHunter 4” and “RegHunter 2”—as “potentially

unwanted programs” and “threats.” As a result,

Malwarebytes’ program blocked, quarantined, or disabled

SpyHunter 4 and RegHunter 2’s operation on users’

computers. Enigma contends that Malwarebytes blocked its

programs because of “anticompetitive animus” and in

retaliation for Enigma suing a Malwarebytes affiliate.

According to Malwarebytes, its program flagged SpyHunter

4 and RegHunter 2 as “scareware”—which Malwarebytes

defines as programs that detect harmless system files and

browser cookies and present them with alarming graphics

“to convince users their systems have problems.”

Malwarebytes’ users had at least two options available if

they wished to continue using Enigma’s products. They

could exclude Enigma’s programs from scans by

“unchecking” and “ignor[ing]” the detection following

Malwarebytes’ instructions, or they could stop using

Malwarebytes’ program. But Enigma disputes whether both

programs can operate together. It argues that Malwarebytes’

default settings effectively prevent users from excluding

Enigma’s programs from scans, citing complaints from users

who struggled to change them.

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 31

In December 2016, in response to Malwarebytes’ change

of criteria, Enigma issued a “Countermeasure,” which

allowed Enigma’s customers to download an installer that

disabled Malwarebytes’ products. Shortly after,

Malwarebytes responded by having its anti-malware

program block access to Enigma’s web domains—URLs

ending in “.enigmasoftware.com.” Malwarebytes’ program

flagged the domains with a pop-up—“Malicious Website

Blocked.” Enigma alleges that Malwarebytes’ domain

blocking was retaliation for the “Countermeasure.” After

some time, Malwarebytes stopped flagging Enigma’s

domains, which Enigma takes as a concession that

quarantining its websites was improper.

Enigma sued, alleging false advertising under the

Lanham Act and various torts under New York state law.

Enigma first brought suit in the Southern District of New

York, which transferred the case to the Northern District of

California. In the Northern District of California, the district

court granted Malwarebytes’ first motion to dismiss based

on immunity under § 230 of the Communications Decency

Act, 47 U.S.C. § 230. A divided panel of this court reversed

because we held that “immunity under [§ 230] does not

extend to anticompetitive conduct.” Enigma Software Grp.

USA, LLC v. Malwarebytes, Inc., 946 F.3d 1040, 1054 (9th

Cir. 2019). Dissenting, Judge Rawlinson noted that the

majority’s policy justifications for the carveout contravened

both text and precedent. Id. at 1054–55 (Rawlinson, J.,

dissenting).

On remand, the district court again granted

Malwarebytes’ motion to dismiss. This time, the district

court held that Malwarebytes’ flagging of Enigma’s

products conveyed “non-actionable statements of opinion.”

Enigma Software Grp. USA, LLC v. Malwarebytes Inc.,

32 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

2021 WL 3493764, at *11 (N.D. Cal. 2021). Enigma

appealed.

On de novo review, this should have been an easy affirm.

II.

A.

When it comes to the regulation of any speech, we

should always begin with the First Amendment. The First

Amendment protects against laws that abridge the freedom

of speech. U.S. Const. amend. I. And that’s true even in the

commercial context. Since Virginia Pharmacy Board v.

Virginia Citizens Consumer Council, Inc., 425 U.S. 748

(1976), the Supreme Court has recognized that First

Amendment protections apply to the regulation of purely

commercial speech. Id. at 761, 770. Such freedom advances

at least three purposes: it “serves the economic interest of

the speaker,” it “assists consumers,” and it “furthers societal

interest in the fullest possible dissemination of information.”

Central Hudson Gas & Elec. Corp. v. Pub. Serv. Comm’n of

New York, 447 U.S. 557, 561–62 (1980).

Of course, the Constitution “accords a lesser protection

to commercial speech than to other constitutionally

guaranteed expression,” and so “there can be no

constitutional objection to the suppression of commercial

messages that do not accurately inform the public.” Id. at

562–63. But unless the commercial communication is

“misleading,” the government’s power to circumscribe

commercial speech is limited. Id. at 564.

This is where the Lanham Act fits in. In 1946, Congress

created a cause of action for “unfair competition through

misleading advertising or labeling.” POM Wonderful LLC

v. Coca-Cola Co., 573 U.S. 102, 107 (2014). To protect

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 33

companies from competitors’ false attacks, § 43(a) of the

Lanham Act creates civil liability for:

Any person who, on or in connection with

any goods or services, . . . uses in commerce

any . . . false or misleading description of

fact, or false or misleading representation of

fact, which . . . in commercial advertising or

promotion, misrepresents the nature,

characteristics, qualities, or geographic

origin of his or her or another person’s goods,

services, or commercial activities[.]

15 U.S.C. § 1125(a)(1)(B). So, on one hand, to state a claim

under the Lanham Act, a plaintiff must show that the

defendant made “false or misleading representations of

fact.” Ariix, LLC v. NutriSearch Corp., 985 F.3d 1107, 1121

(9th Cir. 2021). On the other hand, given the freedom of

speech, “statements of opinion” are beyond the purview of

the Lanham Act. Id.

With the First Amendment overlay here, we must be

careful in delineating what constitutes “fact” versus

“opinion.” While statements of fact are actionable under the

Lanham Act, “[s]tatements of opinion and puffery . . . are

not.” Id. And it makes no difference if the statements of

opinion are made for the purpose of anticompetitive gain.

After all, the suppression of “opinions”—even in the

commercial space—gets into murky constitutional waters.

Even so, it’s not always easy to distinguish between the two.

See, e.g., Cochran v. NYP Holdings, Inc., 210 F.3d 1036,

1038 (9th Cir. 2000) (per curiam) (“[A] statement of opinion

is not automatically entitled to First Amendment protection

simply by virtue of its status as opinion; rather, a statement

34 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

of opinion may be actionable to the extent that it implies a

false assertion of fact.” (simplified)).

But our court has developed some good guideposts.

Commercial speech is actionable if it is “specific and

measurable,” “capable of being proved false or of being

reasonably interpreted as a statement of objective fact.”

Ariix, 985 F.3d at 1121. In other words, “a statement that is

quantifiable, that makes a claim as to the specific or absolute

characteristics of a product” may be actionable under the

Lanham Act. Newcal Indus., Inc. v. Ikon Off. Sol., 513 F.3d

1038, 1053 (9th Cir. 2008) (simplified). Given the serious

creep on First Amendment protections when we curtail

speech, when “it is highly debatable” whether a statement is

verifiable enough to be actionable, we must “err on the side

of nonactionability.” Partington v. Bugliosi, 56 F.3d 1147,

1158–59 (9th Cir. 1995) (simplified).

Ariix is a good example of how these principles work. In

that case, a nutrition-and-health research company published

a guide that compared and reviewed nutritional supplements

using a five-star rating system based on 18 criteria. 985 F.3d

at 1111. It also awarded a “Medal of Achievement” to

nutritional supplements manufacturers that meet two

measurable conditions: (1) compliance with FDA’s “good

manufacturing practices” and (2) certification of product

labels by an approved laboratory. Id. The research company

portrayed itself to the public as independent, presenting only

objective data and scientific analyses. But privately the

company allegedly had financial ties to one manufacturer of

nutritional products. Id. at 1112. The company was then

accused of improperly manipulating the rating system and

withholding the certification from a competing manufacturer

that met the two conditions. Id. at 1112–13.

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 35

We first considered whether the company’s five-star

ratings were actionable. 985 F.3d at 1121. We said no.

Even though the ratings were purportedly based on

“objective and scientific criteria,” we still held that they were

not factual. Id. That’s because “there is an inherently

subjective element in deciding which scientific and objective

criteria to consider.” Id. As an example, we compared the

ratings to college or law school rankings. While objective

criteria go into the rankings (like acceptance rates, test

scores, and class size), “selecting those criteria involves

subjective decision-making.” Id. Thus, we concluded that

the ratings were “simply statements of opinion about the

relative quality of various nutritional supplement products.”

Id.; cf. Underwager v. Channel 9 Australia, 69 F.3d 361, 367

(9th Cir. 1995) (concluding statements must rest “on a core

of objective evidence” to be provable as true or false under

defamation law).

But the “Medal of Achievement” certification was

different. The award (or more precisely, the lack of an

award) makes “specific and measurable statements” about a

nutritional supplements manufacturer. Ariix, 985 F.3d at

1121–22. The company’s certification is “a binary

determination” based on “falsifiable criteria” and the failure

to award the certification (when a manufacturer complies

with the two criteria) “falsely implies to consumers” that the

manufacturer did not meet manufacturing or labeling

standards. Id. at 1122. Because “[t]hese implications are

specific, measurable, and capable of being falsified,” we

held that they were actionable statements under the Lanham

Act. Id.

So boiled down, whether commercial speech is

actionable depends on whether the statement implies

something that can be proven false.

36 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

With this legal background, I turn to Enigma’s claims

against Malwarebytes.

B.

Here, we must determine whether Malwarebytes’

statements calling Enigma’s products “potentially

unwanted,” a “threat,” or “malicious” can be proven false.

Given that each warning has an “inherently subjective

element,” id. at 1121, the answer is no. Even if

Malwarebytes employed these terms to protect its products

from competition from Enigma, there are no dispositive,

objective criteria that would allow us to police whether the

three terms were falsely used against Enigma. In other

words, unlike the certification in Ariix, the three statements

aren’t “binary determinations.” Id. Contrary to Enigma’s

claims, a program isn’t simply “potentially unwanted” or

not. A software program isn’t verifiably a “threat” or not.

And a website isn’t measurably “malicious” or not. In the

cybersecurity context, these terms refer to a spectrum of

digital features with no verifiable line to cross to determine

when they apply. Cf. Underwager, 69 F.3d at 367 (“the term

‘lying’ applies to a spectrum of untruths including ‘white

lies,’ ‘partial truths,’ ‘misinterpretation,’ and ‘deception’”

and so is nonactionable). They thus depend on “subjective

decision-making,” Ariix, 985 F.3d at 1121, requiring the

exercise of judgment to determine when the warning is

warranted.

Without a “core of objective evidence” to assess the

accuracy of the use of the warnings, Underwager, 69 F.3d at

367, no reasonable factfinder can say that Malwarebytes

made a false representation of fact in labeling Enigma’s

products or website as a “threat,” “malicious,” or

“potentially unwanted.” In fact, nowhere does Enigma offer

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 37

an objective, measurable definition of the warnings from

which we may draw an implication of testable falsehoods.

Instead, Enigma hints that they carry “specific factual

meanings” in the cybersecurity field and discovery is

required before we may fully understand this. As shown

below, this is not enough to state a claim under the Lanham

Act, and we should have affirmed the dismissal of Enigma’s

claims.

i. Potentially Unwanted Program

Take the phrase “potentially unwanted program.” That

designation inherently requires some guesswork—

estimating whether a program would be wanted—as made

clear by using the term “potentially.” And “unwanted” fits

within the type of nonactionable “personal assessments or

criticisms” that enjoy First Amendment protections. See

Partington, 56 F.3d at 1158 (observing that “fake,” “phony,”

“hefty mark-up,” and “unfair” are too subjective or

unprovable to be actionable). So the ordinary meaning of

the phrase conveys both uncertainty and subjectivity—not

falsifiability.

If there were any question about the subjective nature of

the phrase, Malwarebytes made it clear that it developed its

own criteria to determine what’s “potentially unwanted.”

Malwarebytes announced eight criteria for the designation,

including obtrusive or misleading advertising, negative

feedback, the difficulty in uninstalling or removing a

program, and whether the program can be considered

“riskware, scareware, adware, greyware, or otherwise

commonly unwanted by the community.” It also

acknowledged that some malware didn’t “neatly fit into the

listed criteria,” which only represented “some of the

criteria.” It explained that identifying malware was

38 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

ultimately a judgment call, and “sometimes we get it

wrong.” To address the changes in programming,

Malwarebytes expressly “reserve[d] the right to adjust,

expand and update [its] criteria without prior notice or

announcements.”

Malwarebytes was thus explicit that subjectivity inhered

in its “potentially unwanted program” determinations. As in

Ariix, when a company develops a rating or designation

containing “inherently subjective element[s],” like the eight

criteria here, the designation cannot be actionable. Even if

some of Malwarebytes’ criteria could be treated as objective

and technical, it would have no impact on the analysis.

That’s because “there is an inherently subjective element in

deciding which scientific and objective criteria to consider.”

Ariix, 985 F.3d at 1121. And the weight assigned to each

criterion would also reflect Malwarebytes’ subjective

assessment of what constitutes a “potentially unwanted

product.” Id.

In response, Enigma offers no objective, factual

definition of its own. Nor does Enigma provide any

evidence that the term has an agreed-upon and well-known

meaning in the cybersecurity world. Indeed, Enigma’s own

allegations prove the phrase’s subjective nature. For

instance, Enigma’s complaint alleges “Malwarebytes’ new

criteria rejected specific objective or scientific standards in

favor of subjective characteristics.” Similarly, Enigma

repeatedly criticized Malwarebytes’ criteria as “subjective,”

“vague,” and “self-serving”—grounds on which we have

previously held statements unactionable under the Lanham

Act. See Coastal Abstract, 173 F.3d at 731 (“vague and

subjective” statements are not liable under the Lanham Act).

So crediting the complaint’s allegations (as we must),

Enigma “may [have] plead[ed] [it]self out of court.”

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 39

Weisbuch v. County of Los Angeles, 119 F.3d 778, 783 n.1

(9th Cir. 1997).

ii. Threat

The analysis of the “threat” designation fares no better.

Start with its ordinary meaning. Like “potentially”

unwanted programs, “threat” generally refers to a “possible

source of harm or danger.” American Heritage Dictionary

of the English Language (5th ed. 2011) (emphasis added).

Given its tentative nature, it is not an absolute or specific

measurement. And, as with “unwanted,” a “source of harm

or danger” involves a subjective determination. See, e.g.,

Hernandez v. Scottsdale Hotel Grp. LLC, 2020 WL

6827745, at *3 (D. Ariz. Nov. 20, 2020) (holding the word

“threatening” in a defamation suit “is not provable or

falsifiable”). Indeed, Malwarebytes’ user guide emphasizes

that some programs or files categorized as “threats” are “not

malicious” and “[i]t is up to individual users to research and

make this determination.” Malwarebytes User Guide,

“Quarantine,” § 8.1 (2016).

Enigma, for its part, doesn’t contend that there is a single

criterion for identifying software as a “threat.” Instead, it

suggests that the term is “widely used” and “commonly

understood” in cybersecurity—pointing to several

definitions from federal statutes and governmental and

software industry authorities. But even accepting these

definitions, they also confirm the subjective nature of the

term “threats” and so undermine Enigma’s assertions.

First, Enigma offers the National Institute of Standards

and Technology (“NIST”) glossary for a definition of

“threat.” But NIST’s glossary has no fewer than 20

40 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

definitions for “threat.”1 Those definitions range from

“[a]ny circumstance or event with the potential to adversely

impact organizational operations . . . through an information

system via unauthorized access, destruction, disclosure,

modification of information, and/or denial of service” to “an

activity, deliberate or unintentional, with the potential for

causing harm to an automated information system or

activity.” Id. Thus, “threat” is defined in only the broadest

terms—“potential” for “harm” and “adverse[] impacts”—

with no attempt to narrow the field. And NIST prefaces its

glossary with the warning that “[t]erminology changes over

time” and its definitions may “contain potentially biased

terminology.” Id.

Next, Enigma asks us to adopt the International

Organization for Standardization’s (“ISO”) definition of

“threat.” It provides that a “threat” is “a potential cause of

an unwanted incident, which can result in harm to a system

or organization.” ISO/IEC 27000, Info. Sec. Mgmt.

Standard, at 10 (2018). The problems with this definition

are obvious. It requires a subjective assessment of what is

“unwanted,” and it requires some guessing because it applies

to anything that “potential[ly]” causes harm. As with

“potentially unwanted programs,” such a definition offers no

measurable or objective guidance.

Finally, Enigma looks to the definition of “cybersecurity

threat” from the Cybersecurity Act of 2015, 6 U.S.C. §§ 650,

1501. The Act defines “threat” as:

1

Comput. Sec. Res. Ctr. Glossary, U.S. Dep’t. of Com. Nat’l Inst. of

Standards and Tech. (NIST), available at: https://csrc.nist.gov/glossary/t

erm/threat [https://archive.is/5yDWa].

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 41

“[A]n action, not protected by the First

Amendment to the Constitution of the United

States, on or through an information system

that may result in an unauthorized effort to

adversely impact the security, availability,

confidentiality, or integrity of an information

system or information that is stored on,

processed by, or transiting an information

system.”

6 U.S.C. § 650(8)(A). Thus, this federal definition applies

to a broad range of “impact[s]” and requires a subjective

assessment of what is “adverse[].” Acknowledging the

ambiguity of its definition, the Act excludes “any action that

solely involves a violation of a consumer term of service or

a consumer licensing agreement.” § 650(8)(B).

Nothing in these definitions supplies an objective,

measurable basis to assess the term’s veracity. In fact,

Enigma’s identification of multiple meanings for “threats”

by itself shows that the term represents an opinion rather than

a fact. See Steam Press Holdings, Inc. v. Hawaii Teamsters,

Allied Workers Union, Loc. 996, 302 F.3d 998, 1008–09 (9th

Cir. 2002) (approving argument that a phrase “subject to

multiple interpretations” is not “susceptible of verification”).

As we’ve said, when a term or phrase lacks a “singular” and

“concrete” meaning, it cannot be “readily verifiable.” Id. at

1009. So Enigma’s own attempt to provide meaning to the

term only establishes its vague and unfalsifiable nature.

iii. Malicious

Nor does “malicious” have an objective and absolute

measurement. In its complaint, Enigma pleads that calling a

website “malicious” has a common meaning in the

42 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

“cybersecurity and privacy software markets”—“that the

website is harmful and can be disruptive to [users’]

computers.” Even if we accept this allegation as pleaded

fact, this definition of “malicious” reeks of subjectivity.

Because of the vagueness and inherent non-objectiveness of

“harmful” and “disruptive” in the definition of “malicious,”

the designation suffers from the same deficiencies as the

other two—there is no implied objective fact that can be

proven right or wrong. What can be “harmful” or

“disruptive” is necessarily in the eye of the beholder.

Imagine an energetic child in the classroom. Some might

view the child as “playful,” while others view him as

“disruptive.” Or spicy food. Some may find it enjoyable,

while others might find it “harmful” to their digestion.

Likewise, whether Enigma’s “Countermeasure” to

disable Malwarebytes’ software was “harmful” and

“disruptive” is a matter of opinion. To Malwarebytes, a

website that offered a program that deliberately targeted and

removed its anti-malware products could fit the bill. To

Enigma, its website was innocuous and only allowed its

customers the choice to continue to use its products without

interference from Malwarebytes. Rather than weighing in

on this difference of opinion, we should have allowed the

market to decide who is right.

C.

Ignoring the problems with the inherent subjectivity of

these terms, the majority presses on with the expansion of

Lanham Act liability here because, it claims, the term

“malware” lends itself to verification. Maj. Op. 14. There

are several problems with this.

First, Enigma has never alleged that Malwarebytes

violated the Lanham Act based on the use of the term

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 43

“malware.” To prove the Lanham Act claim, Enigma’s

complaint alleges that Malwarebytes used “false and

misleading statements” in commerce based on “statements

that SpyHunter 4 and RegHunter 2 are ‘threats’ and/or

‘potentially unwanted programs’ and that [Enigma’s]

website and domains are ‘malicious’ and disruptive.” The

term “malware” is not included among the statements

allegedly violative of § 1125(a)(1)(B). Indeed, there’s no

basis to equate the terms “threats,” “potential unwanted,”

and “malicious” with “malware.” Malwarebytes’ user guide

defines “potentially unwanted programs” as a “class[] of

non-malware,” and explains that some programs “may [be]

categorized as threats” even though they “are not malicious.”

Malwarebytes User Guide, “Quarantine,” § 8.1 (2016). And

Malwarebytes only referred to Enigma’s website domains as

“malicious,” not its software. A malicious website may host

malware, but calling a website malware is like calling a street

address a criminal. So the majority is manufacturing its own

claim against Malwarebytes—one that isn’t even supported

by the record.

To justify the sua sponte amendment of Enigma’s

complaint, the majority looks to Malwarebytes’ user guide,

which explains that a default setting for its scan

configuration “[t]reat[s] detections” of potentially unwanted

programs “as malware.” Maj. Op. 14 n.4. But this allegation

is irrelevant because the majority agrees that calling

something “potentially unwanted” is “too unspecific” to be

actionable under the Lanham Act. The majority also relies

on the user guide’s reference to a “Threat Scan,” which

“captures all programs treated as ‘malware’ in all the places

malware is known to hide.” Id. But user guide statements

that Malwarebytes’ program treats something as “malware”

or scans where malware is known to be isn’t the same thing

44 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

as calling Enigma’s products “malware” in commerce. The

majority then somehow finds it actionable that Enigma’s

own customers called Enigma’s programs “malware.” Id.

(citing allegations that Enigma’s customers thought

Enigma’s products were “malware”). But what Enigma’s

customers say about Enigma is not a basis to find Lanham

Act liability against Malwarebytes.

Second, while acknowledging that “judges are not

experts in the cybersecurity field,” the majority invents its

own verifiable definition of “malware” for the field—

“software [created] with the intent to gain unauthorized

access to a computer for some nefarious purpose.” Id. The

majority then concludes that “malware can come in many in

forms including ‘viruses, spyware, adware, ransomware, and

Trojans.’” Id. at 14. And finally, the majority says that these

terms can be objectively determined. Id. at 14.

Even if Enigma’s complaint had alleged that

Malwarebytes designated Enigma’s products as “malware”

and if this definition were plausible, the majority’s

terminology admits subjectivity. One needn’t be an expert

in cybersecurity to see why. Take “adware.” Adware

monitors users’ online activities and habits, typically

without their knowledge, and uses the collected data to

display targeted advertisements or sell to third parties.

Adware usually comes bundled with free software (e.g.,

games, browser extensions, media players), allowing

developers to generate revenue and continue developing

useful and free software. Adware can expose sensitive data

and slow or disrupt one’s computer, though it also helps

serve users with more relevant ads. And typically, the user

has inadvertently authorized and consented to the adware’s

operation via a terms and conditions agreement. In such

cases, has the adware been created and employed for “some

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 45

nefarious purpose?” This is plainly a subjective question

that will elicit different responses from different people.

The majority also insists that “[j]ust like the certification

at issue in Ariix,” the “malware” designation “can be

reduced to ‘a binary determination’ based on ‘falsifiable

criteria.’” Maj. Op. 14. It would seem the majority

conflates the ability to phrase something as a binary

determination, with the objectivity of that

determination. One could also say, “whether green is the

best color is objective and verifiable, because either it is the

best, or it’s not the best.” But clearly that’s a subjective

question—appending “it is or it isn’t” doesn’t make the

determination objective and verifiable. See ZL Techs, Inc. v.

Gartner, Inc., 709 F. Supp. 2d 789, 798 (N. D. Cal. May 3,

2010). And calling Enigma’s products a “threat” or

“malicious” is far from Ariix saying a manufacturer didn’t

comply with FDA standards or obtain the appropriate

laboratory certification—both falsifiable criteria. Ariix, 985

F.3d at 1122.

***

In sum, Enigma cannot base its false advertising claim

on nonactionable opinions, like the phrases here. We thus

should have affirmed the dismissal of the Lanham Act claim.

III.

Not only is Enigma’s failure to allege a misstatement of

fact dispositive on the Lanham Act claim, but it’s also

dispositive on its state-law claims. We thus should have also

affirmed the dismissal of Enigma’s claims for (1) violation

of New York General Business Law § 349, (2) tortious

interference with business relations, and (3) tortious

interference with contractual relations. In reviving the § 349

46 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

and business relations claims, the majority concludes that

New York has personal jurisdiction over Malwarebytes.

While I have serious reservations about the majority’s

jurisdictional analysis, we didn’t need to reach that question

because Enigma’s claims would fail under either New York

or California law.

First, General Business Law § 349, New York’s law

against deceptive business acts and practices, generally

follows the Lanham Act. “[W]hat is non-actionable opinion

under the Lanham Act is also non-actionable . . . under

General Business Law § 349.” ONY, Inc. v. Cornerstone

Therapeutics, Inc., 720 F.3d 490, 498 (2d Cir. 2013). Since

I would conclude that Malwarebytes’ flagging of Enigma’s

products was non-actionable opinion, Enigma’s § 349 claim

must be dismissed as well.

Second, Enigma’s claim for tortious interference with

business relations is not viable under either California or

New York law. In California, “interference with prospective

economic advantage requires a plaintiff to allege an act that

is wrongful independent of the interference itself.” CRST

Van Expedited, Inc. v. Werner Enters., Inc., 479 F.3d 1099,

1108 (9th Cir. 2007). “[A]n act is independently wrongful

if it is unlawful, that is, if it is proscribed by some

constitutional, statutory, regulatory, common law, or other

determinable legal standard.” Korea Supply Co. v. Lockheed

Martin Corp., 63 P.3d 937, 954 (Cal. 2003). New York has

adopted a similar general rule requiring an “independently

unlawful act” for tortious interference with a business

relationship. Carvel Corp. v. Noonan, 818 N.E.2d 1100,

1103 (N.Y. 2004). There is an “exception” in New York,

however, when a defendant engages in “egregious

wrongdoing” in the absence of an independent act, like

ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC. 47

acting for the “sole purpose of inflicting intentional harm on

plaintiffs.” Id. at 1102–03 (simplified).

Here, because Enigma’s Lanham Act claim fails, it

hasn’t shown that Malwarebytes engaged in independent

wrongdoing for a business interference tort. And while

Enigma alleges that Malwarebytes acted with anti-

competitive animus, that is not enough to invoke New

York’s exception to the general rule because the exception

does not apply to “normal economic self-interest.” Id. at

1103. As Enigma alleged, Malwarebytes also sought to

increase sales and “secur[e] a stronger, more dominant”

market position for itself. Thus, Enigma concedes that

Malwarebytes did not act “solely” to target Enigma, which

the exception requires. See id. at 1103. So Enigma’s

business tort claim fails.

Third, I agree with the majority that Enigma failed to

plead tortious interference with a contract—although I

would hold it failed to do so under both New York and

California law. Enigma’s claim fails under California law

because it doesn’t allege an “independently wrongful act,”

as discussed above. See Ixchel Pharma, LLC v. Biogen, Inc.,

470 P.3d 571, 580 (Cal. 2020) (“We therefore hold that to

state a claim for interference with an at-will contract by a

third party, the plaintiff must allege that the defendant

engaged in an independently wrongful act.”). And the claim

must be dismissed under New York law because Enigma

hasn’t alleged a breach of a specific contract. See NBT

Bancorp Inc. v. Fleet/Norstar Fin. Grp., Inc., 664 N.E.2d

492, 495–96 (N.Y. 1996) (Absent wrongful means, there is

no tort “[w]here there has been no breach of an existing

contract[.]”).

48 ENIGMA SOFTWARE GRP. USA, LLC V. MALWAREBYTES, INC.

So, in sum, the lack of an actionable Lanham Act claim

deprives Enigma of its other claims.

IV.

For all these reasons, we should have affirmed the

district court’s order. I respectfully dissent.