In 2006, hackers infiltrated Symantec’s network and stole the source code used in the 2006 versions of its antivirus etc. products. Symantec allegedly knew this, but neither performed a reasonable investigation into the breach nor informed consumers. Haskins bought Symantec’s Norton Antivirus software online in late 2007 or early 2008. She alleged that she was exposed to Symantec’s claims on its website that Norton Antivirus provided computer, data, and email security by, inter alia, blocking viruses and spyware, that she bought the product unaware that it was compromised and believing that it would protect her, and that had she known the truth she wouldn’t have bought the product. “In 2012, a hacking group publicly claimed to possess the 2006 stolen source code and posted certain code on the internet, and Symantec disclosed for the first time that its systems had been breached in 2006 and the source code stolen.”
The court first found that Rule 9(b) applied to the UCL and CLRA claims. Haskins identified specific statements on Symantec’s website and in its ads, e.g., the products are supposed to “secure and manage ... information against more risks” and “eliminate risks to information, technology and processes....” Symantec argued that this was insufficient because she failed to identify any specific ad she saw and relied on, and that these statements were mere puffery.
Haskins did identify specific statements in ads, and appended the relevant documents. Also, Tobacco II said that plaintiffs can sometimes state a UCL claim without showing that they viewed any particular ad where misrepresentations were part of an extensive, longterm ad campaign. If a plaintiff can prevail at trial without showing that she saw any specific ad, Rule 9(b) shouldn’t have a higher standard; that would turn Rule 9(b) from a procedural rule to a substantive one.
Even named class members can have standing without proof they saw a specific ad under Tobacco II, but that case offers a narrow exception to the general rule where the defendants engaged in decades-long saturation advertising. Here, Haskins based her allegations on ads 2006-2012, while purchasing in 2007/2008. To have standing, she’d have to allege that she was in a Tobacco II situation, and also that the long-term ad campaign to which she was exposed affected her purchase decision. This complaint didn’t, though the court would allow her to amend.
Symantec also argued that the claims were mostly nonactionable puffery. But that apparently conceded that some of the claims weren’t. Plus, even statements that might be puffery standing alone can in context contribute to deception and be actionable. But the court accepted Symantec’s argument that Haskins didn’t provide enough explanation of what was false. Though she attached the ads she was attacking and therefore Symantec was on notice, she still didn’t “set forth what is false or misleading about a statement, and why it is false” with sufficient particularity—she appended “nearly the entirety of Symantec’s 2006–12 advertisements for, and website descriptions of, the Products.” Even claims for fraud by omission need to identify the information Symantec communicated “that was rendered misleading by the failure to disclose the 2006 source code theft.” Her burden was to “at least make a prima facie explanation of how each of the complained-of statements constitute fraud.” Thus, the complaint was dismissed, but the court went on to address a few other issues in case she filed an amended complaint.
Haskins needed to show injury to have standing under the UCL; that can come from paying more than she would otherwise have been willing to pay because the product was not as advertised. Symantec argued that she didn’t have standing because she didn’t allege that she viewed any specific ad or representation, but this didn’t necessarily matter under Tobacco II. If she could win at trial on a long-term ad campaign theory, her economic injury is the purchase that wouldn’t have occurred but for the misrepresentation. Likewise, on a motion to dismiss, such harm would at least plausibly ground a claim of “unfair” business practices, as well as fraudulent ones. The same theory would give her CLRA standing.
Symantec argued that software wasn’t “goods” or “services” covered by the CLRA. The court disagreed, in a brief but pithy discussion. Goods are “tangible chattels bought or leased for use primarily for personal, family, or household purposes.” Symantec argued that (1) because Haskins downloaded the software, it wasn’t a tangible chattel, and (2) all software is outside the CLRA even if purchased on disk. The CLRA’s language is from 1970. “It seems unlikely that the Legislature knowingly exempted computer software from the CLRA’s scope two years before the invention of Pong.” More likely, the legislature meant to exempt credit and insurance from the scope of the law, “since those commodities are inherently intangible promises which have no direct and concrete impact on the physical universe.”
Of course, that reasoning wouldn’t justify expanding the statute beyond its terms. But “tangible” means “[h]aving or possessing physical form; corporeal.” Symantec’s software is often purchased in physical form, as other “goods” are; other intangibles aren’t. Plus, even downloaded, “it works a physical change on a physical hard drive. It possesses corporeal form in a way that credit or insurance inherently cannot.”
Symantec argued that the disk was irrelevant, “nothing but a physical mechanism for delivering a nonphysical right to use intangible software.” That was slicing the salami too thinly. A book is a “tangible chattel,” despite being “merely a delivery mechanism for the transmission of information.” By contrast, insurance contracts and credit cards aren’t delivery mechanisms, but physical representations of an intangible agreement. “Consumers do not purchase software discs or books to memorialize or prove the existence of an agreement; they purchase the objects to possess and use them. As a physical object purchased for a consumer’s use, a software disc is a tangible chattel.”Though it was a close call, the court deferred to the CLRA’s own instruction to construe the statute liberally. At least where there’s a physical version, construing the statute to cover only the in-store version wouldn’t be a liberal construction.