Microsoft dodges some false advertising claims based on its security offerings

Tocmail
Inc. v. Microsoft Corp., 2020 WL 9210739, No. 20-60416-CIV-SMITH (S.D. Fla.
Nov. 6, 2020)

From
the deepest depths of backlog: Tocmail alleged that Microsoft’s deceptive
promotions of its cyber-security service, Safe Links, constituted false
advertising and contributory false advertising. Tocmail alleged that it sold
the only patented solution for cloud-based hacking, specifically the cloud
security flaw of IP-Cloaking. IP Cloaking allegedly allows hackers to pass
security scanners by sending benign links to the scanner and, then, once
approved by the scanner, proceed to send malicious content to the end user. Microsoft
offers a product, Safe Links, that Microsoft claims protects users against
cloud-based hacking. This allegedly harmed Tocmail’s reputation by convincing
over 100 million users of the Microsoft product that its product offers no
value to them.

Drawing
all inferences in Tocmail’s favor, the court found that it properly alleged reputational
and economic harm within the zone of interests protected by the Lanham Act.

Proximate
causation: Microsoft argued that the harms alleged were too speculative. “But
courts have found allegations based on the diversion of business from one party
to the other enough for purposes of pleading proximate causation.”

Specific
alleged falsehoods:

A
Microsoft product video stated, inter alia:

Sophisticated
attackers will plan to ensure links pass through the first round of security
filters by making the links benign, only to weaponize them once the message is
delivered. Meaning that the destination of that link is altered later to point
to a malicious site. Time is important when thwarting this type of attack. 20% of
all clicks happen within just five minutes of when an email is received, and
with Safe Links, we’re able to protect users right at the point of click by
checking the link for reputation and triggering detonation if necessary.

Tocmail
alleged that “it is literally false that Safe Links protects users by
‘thwarting this type of attack’ [that is, the described attacked of
sophisticated hackers].” The court disagreed, because on its face the statement
didn’t claim that Safe Links thwarts this type of attack, but rather that time
is important in thwarting this type of attack. Comment: Necessary implication
is made for these situations. There is no communicative reason for identifying
this type of attack if it’s not one that Safe Link thwarts “right at the point of
click.”

Next
statement:

[A]ttackers
sometimes try to hide malicious URLs within seemingly safe links that are
redirected to unsafe sites by a forwarding service after the message has been
received. The ATP Safe Links feature proactively protects your users if they
click such a link. That protection remains every time they click the link, so
malicious links are dynamically blocked while good links can be accessed.

But
Tocmail alleged that Safe Links does not do this. Microsoft argued that its
statement didn’t make “any promises, guarantees or other representations.” “Defendant’s
argument is belied by the express language of this statement, which promises
customers protections against attackers’ malicious links.” Falsity was
sufficiently alleged.

“You
Don’t Need Any Other Security Products. With ATP You’re Covered”: This was a
statement made by a Microsoft customer (possibly touted by Microsoft), and was
just opinion.

The
name “Safe Links”: “Safe” is sometimes puffery and sometimes not, depending on
context. In the context of a product name, it was “a very general claim that
characterizes classic puffery, as opposed to a specific assertion describing
absolute characteristics of Defendant’s product.”

“Safe
Links Ensures Hyperlinks in Documents are Harmless”: Also sufficiently alleged
to be literally false.

Contributory
false advertising: Tocmail alleged that that “[a]lmost all email cybersecurity
vendors participate in a coordinated, industry-wide deception that promotes
‘time-of-click’ redirection as the solution to links that appear benign to
cloud scanners yet send users to somewhere dangerous.” Microsoft allegedly
works with third parties to offer Safe Links alternatives paired with Microsoft
cloud services, and these “third parties cannot offer their services without
Microsoft providing access.” “Microsoft benefits from its cloud users being
assured that time-of-click redirection guarantees that they will never download
malware from a protected link.” Additionally, Tocmail alleged that “Microsoft
continues to supply its service to those it knows or has reason to know are
engaged in false advertising directly in regards to the service being
supplied.”

This
wasn’t enough to state a claim for contributory false advertising. “[T]he mere
sale of products in the course of an ordinary business relationship, without
more, cannot justify a finding that a defendant induced, encouraged, caused,
procured, or brought about false advertising.” A plaintiff must show that the
defendant “actively and materially furthered the unlawful conduct—either by
inducing it, causing it, or in some other way working to bring it about.” Tocmail
didn’t plead enough details to plausibly infer knowing or intentional
participation by Microsoft.

from Blogger https://ift.tt/38VvTnb

This entry was posted in Uncategorized and tagged , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s