Ninth circuit affirms rights of anti-malware companies
In an important case for the anti-malware industry, the United States Court of Appeals for the Ninth Circuit affirmed a lower court ruling that anti-virus firm Kaspersky was protected by section 230 of the Communications Decency Act (CDA) in deciding to block software by Zango, which Kaspersky deemed adware or spyware. StopBadware is a member of the Anti-Spyware Coalition, which filed an amicus brief encouraging the court to find in Kaspersky's favor. (Side note: one of Zango's products was labeled by us as badware prior to this lawsuit.)
At issue were three key questions:
- Is Kaspersky an "interactive service provider," which is the entity that is protected by CDA section 230. The courts found that it is, as the term is defined by the legislation to include providers of software intended to filter or disallow objectionable content.
- Is adware or spyware "objectionable content," as intended by CDA section 230? The courts found that it is, as the legislation is explicit in allowing the filtering of "content that the provider or user considers obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable."
- Does Kaspersky have to prove "good faith" in order to use CDA section 230 as a defense? The courts ruled that no such proof is necessary, as the section that Kaspersky is using as its defense does not include a good faith clause. (In a concurring opinion, one of the judges noted the potential for this section to be abused if there is no good faith requirement, but affirms that in the Zango v. Kaspersky case, Kaspersky does not have to prove good faith.)
The concern about the good faith clause is an important one. In fact, the ASC amicus brief specifically asked the court to consider whether the good faith provision in one section of the legislation could be implicitly applied to another section. The court left this at least somewhat open with the concurring opinion's stated concerns. While the judge's concern was about anti-competitive behavior (e.g., Symantec blocks access to McAfee's website as "objectionable"), one could imagine a case where a piece of badware, installed without a user's permission, tries to hide behind CDA 230 because the software is blocking access to content the "provider" (i.e., the badware distributor) considers objectionable. Hopefully, if such a case occurred, the courts would find that the intent of the law was not to provide enforced blocking on users without their knowledge or permission.
Overall, we're very pleased by the circuit court's decision, as it is critical for anti-malware companies to be able to warn about or block potentially unwanted software without fear of liability.