21

Ages ago, when dinosaurs roamed the earth and I was in college, I went to a recruiting event for a company that collected and sold statistical data. They explained that they got the information by installing programs on people's computer 'in exchange for' providing free products like screen savers. When someone pointed out that sounded like spyware they assured us it was entirely legal since their terms and conditions document disclosed that downloading their free product would result in installing their data collection software.

I'd still consider that malware, regardless of whether it was legal, which made me wonder what the legal implications of such would be. What would happen if I wrote a virus scan and I listed this program as malware and recommended its deletion? This could lead to the program being deleted from many computers and thus a reduction of the program's data collection, which could translate to a loss of profits. Can the makers of this program sue me for loss of profits? Would I risk getting into some legal debate as to whether their 'legal' product constituted malware?

3
  • 4
    Well, to be safe(r) from prosecution you could just be very honest in your description of the "malware" actions: Explain clearly that it's a data collection program, which run with the authorisation of the user, and provides whatever freeby as an excuse/compensation. The user can then make an informed choice, and the software publisher cannot sue you for misleading information ...
    – Hoki
    Jan 15 at 11:25
  • 1
    Instead of saying "this is malware", why don't you just say what the software accesses and that you don't recommend this under best security practices? Jan 15 at 16:07
  • 1
    This is one of the reasons why there is more than one word used to describe classes of software. Off the record, I would say that this clearly ISN'T malware, as there is no intent to carry out any malicious act on the client, so calling it either Spyware, or "Potentially Unwanted" is much more accurate, and the latter is of course a reasonable label to apply to anything from a pure virus, to MS Office.
    – MikeB
    Jan 16 at 13:42

1 Answer 1

25

There is a risk of getting sued, similar to Enigma Software v. Malwarebytes, where Malwarebytes characterized plaintiffs product with the words malicious, threats potentially unwanted programs. Enigma files a claim under Section 43(a) of the Lanham Act for false advertising, and tortious interference of business. Malwarebyte's argument was that their statements were non-actionable statements of opinion. The 9th Circuit panel found that when a computer security firm claims something is "malicious", that is to be interpreted as an objective statement of fact, not opinion. This conclusion did not include the claim that the product was "potentially unwanted", which is too non-specific to be actionable, but the claim to being malware or a threat is sufficiently specific that it is a verifiable claim.

However, you personally might not be suable (you can provide more professional context as you like), because you are not a well-known computer security company. The determination that the statement is "false, misleading, and deceptive information" under the Lanham Act depends on the reputation of the maker of the statement. If you were just to say in a conversation between fellow truck drivers "I think that operating system is malware", the statement would not be reasonably interpreted as a false statement of fact. But when you hold yourself out as an expert at identifying malware and label something as malware but it plainly isn't malware, then you are in the neighborhood of getting sued.

4
  • 1
    In any event, there's a regrettable tendency for companies to make dubious statements, and to try to put the onus on the arguably-wronged party to request correction via a public forum or publicly-visible edits. Jan 15 at 8:17
  • 2
    I would assume that if OP writes and sells a virus scanner then they would be liable to get sued regardless of how popular their virus scanner is. The point is that OP claims their software identifies malware, is designed for that purpose and is trying to earn money on this capability.
    – quarague
    Jan 15 at 9:01
  • "label something as malware but it plainly isn't malware" How do the courts determine that something "plainly isn't malware" when an industry expert (like Malwarebytes) already determined that it was malware? Is there a legal definition of malware that a judge can use to make their own determination? Or would they get the opinion of other experts?
    – T Hummus
    Jan 15 at 22:25
  • 4
    @THummus: Most likely, the plaintiff would be required to produce an expert witness who would testify that the software is non-malicious. The defendant would probably also produce their own expert witness, and the court would then determine whose testimony is more plausible.
    – Kevin
    Jan 15 at 23:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .