‘Consumer champions’ coming after you? Show them who’s really champ by standing up to them! 

Law firms. Traditionally such a necessary and benevolent force for good throughout the world. Regulating business, following rules, enforcing rules, getting justice… That’s how many and maybe even I once viewed much of the law profession last century. But this century…

It reminds me of Animalism. Or, to be more precise, originally the seventh commandment of Animalism: ‘All animals are equal’.

We all know how it was amended, becoming ‘All animals are equal, but some animals are more equal than others’. And that phrase in particular brings to mind many law firms today. Some are fair, benign and indispensable and play by the rule-book. Others are more equal than others: unfair, malignant, superfluous and scornful of the rule-book: operating seemingly outside the law – above the law – when they’re the ones that should be upholding it! Yep ladies and gents, I’m talking about the unscrupulous law firms that manipulate laws and moral norms to extract a pretty penny from large (and sometimes not so large) companies – which have done nothing wrong!

I’ve already written plenty about patent trolls (and how we have a policy of never giving in to them). Today I’ll be telling you about a similar phenomenon we recently came up against…

So what’s all this about?

Picture the mise-en-scène:

Take a manufacturer of a consumer good. A law firm decides to uncover an alleged small flaw in that consumer good (and one can be found in any consumer good; these guys are like wizards in making them appear anywhere), and once they find the best ‘defect’ they seek out a supposedly affected and aggrieved consumer, who then files a claim against the manufacturer, but not just on his or her own behalf, also on that of a large group in a class action lawsuit claiming violation of consumer rights. A website is created and an advertising campaign is launched (no joke) calling on consumers to join their concerted effort against the ‘excesses, unfairness and incompetence’ of the alleged guilty party.

At first blush the intentions of one of these campaigns and the corresponding slogans look convincing and honorable. It can indeed seem that it’s just the small people being gallantly looked after. And from a legal standpoint it does look like all is well-intentioned, good and proper. But all you have to do is probe a little deeper, and a different– vastly different –picture then comes into view: one resembling deceit and underhandedness (to put it politely), or sham/scam (to be less polite but no less accurate)!

This particular business model first took root in the good ole U.S. of A. a long time ago, somewhere in the last century. Today, consumer class actions in America have become serious business. There are dedicated websites that keep track of all such litigation and that send emails out listing new such class actions and agreements and how to easily sign up to them with a few keystrokes on the keyboard. Ten bucks here, another ten there… a tidy sum of extra income can be earned.

Now, to large multinational companies with multimillion dollar turnovers these class actions hardly even register, like a flea-bite to an elephant. However, for not-so-big companies, like for example small software vendors, class actions add up to huge sums having to be taken out of the pot for development of new technologies; often it’s simpler to just declare bankruptcy and start the business over.

Now, I don’t know how many tens of thousands of lawyers earn their living feeding at this trough (Animal Farm-related pun not intended) or what the annual turnover is ($6-8 billion has been estimated), but what I do know is that it’s very widespread. And I also know for sure – they openly admit it themselves – that the main reason these lawyers go for class actions is just because the like them (fast forward to 2:11).

And it’s small wonder why they like them. Costs are minimal (they don’t even need to buy up patents!), and the courts’ default stance is to be on the side of the consumer ‘victims’ – protecting them from the ‘excesses of capitalism’. It’s also small wonder that the other victims in this sorry state of affairs – the companies that are targeted by this extortion – prefer to negotiate than fight through the courts: many don’t have the wherewithal to go to court (it’s never cheap), and for some it’s a lot simpler and economically more viable to just pay the ransom instead of having their legal department get bogged down for eons. As a result this industry flourishes as more and more lawyers pour into it after getting a whiff of the easy bucks.

Still not convinced these wholesome attorneys aren’t just wanting to line their pockets and in fact only just want to protect the rights of consumers?

Then let me give you an example…

One of our competitors (the information is public domain already, but all the same I think it’s only right not to mention any names) recently settled a class action lawsuit and paid $700,000 to the lawyers of the suer, $1.25 million to third organizations, and $9 plus three months’ free use of its product to each participating consumer! So there you have it folks: straight-up, honest looking after the poor consumer, plain and simple for all to see :).

Precisely a year ago we found out we were to be targeted by a set of these white-collar ‘consumer champions’. But they needn’t have wasted their time…

For we have a firm policy for how to deal with such unscrupulous behavior: no negotiations. Instead, we fight – to the end. It’s not the easy way out that’s for sure, or the cheapest one, but it’s worth it – especially if they go off with their tales between their legs and never come back.

So, like I say, exactly one year ago we were hit with one of these sham(eful) lawsuits, from a certain Barbara Machowicz (and her representative, the law firm Edelson). It was brought against our free Kaspersky Security Scan (KSS). They alleged “[that they were] fraudulently induced to buy [KL’s] security software through … KSS, which is purportedly designed to ‘detect unwanted malware, software vulnerabilities, and other non-malware security problems’ “ and “that KSS is essentially ‘scareware’ engineered to detect fake security threats”.

And btw, this Edelson (surely just by a coincidence) was the law firm that brought the case against our competitor mentioned above. Fancy that?! Taking another closer look (the devil’s always in the details in these matters), we found out that they’d decided to simply do a repeat of their lawsuit against our competitor: basically, the claims against KSS were mostly copied word-for-word from it. I can just see the MS Word template used for the statement of claim, with blanks left for just the name of the defendant :).

Just how we were defamed in the statement of claim with their groundless accusations… I won’t go into here; that wouldn’t be quite proper. All I’ll say is that we didn’t ignore the statement or regard it lightly. After having received it we took it seriously (despite the wholly unserious allegations) and started to analyze what’s afoot. And sure enough, soon enough, all became clear.

KSS scans a computer for malicious and suspicious programs, system and application vulnerabilities, the correctness of settings, and other particulars that could affect the security of the computer. Ms. Machowicz had KSS scan her comp, and though it didn’t find any viruses, it did find a slew of vulnerabilities, including dangerous Windows and Internet Explorer settings, USB and CD auto-runs, cookies being saved, and caching of data received via https. As a result, KSS rightly issued Ms. Machowicz its verdict: ‘Your computer could be at risk. Problems found!’

Yes folks, it was with this that Edelson accused us of frightening users! Sure, like an unpatched browser isn’t a threat, antivirus software can only protect a comp from viruses, and if viruses aren’t discovered on a comp then protection isn’t necessary. Urrrr, ok.

I assume that most of you reading this don’t need to be told how antivirus protects against a lot more than just viruses, and that today’s definition of a ‘threat to a computer’ goes far beyond malware. Problem is, courts aren’t like you; one has to demonstrate everything to them including the absurdly basic and bleeding obvious.

Accordingly, we’d prepared detailed explanations of each of the 112 ‘non-virus’ vulnerabilities that KSS considers a threat. We had ready examples of malware penetrating a system via these vulnerabilities. We’d even set up a stand for a live demonstration so that the court could see attack scenarios via these found vulnerabilities and how KIS protects against them. Here are a few select examples we’d prepared for the court:

An example of an ‘other issue’ KSS indicates is an ‘Invalid EXE files association’. This is reported when KSS detects anomalies in registry values, since these are usually caused by the operation of malware. EXE extension files are the executable files of most applications. An invalid EXE file association leads to the possibility of an attacker running a malicious program that can gain control of the system and user data when the user tries to run any application. Failure to correct the problem does not allow the running of applications or opening of files with data that the user needs to work.

Another exemplary ‘other issue’ is ‘Registry Editor is blocked’. This problem is also usually due to malware running (here’s an example from Microsoft). The Registry Editor is an application for managing system settings. Its being blocked complicates the cancellation of the autorun malware, which can allow an attacker to gain control of the system and user data.

Another ‘issue’: ‘Protocol prefixes are modified’. This signals that there’s a problem that’s preventing websites from opening. This is used for advertising or for redirecting to phishing sites. Normally the open link takes the form ‘http://[unwanted site]/parameters&parameter=[entered web address]’. In this case, any link or address entered by the user will lead to other, non-requested websites, which can be harmful. Through such a site an attacker can, you guessed it, gain control of the system and compromise user data. Here’s a description of malware that causes or exploits the issue.

But before we could even start giving our explanations, all of a sudden a most unexpected, interesting, yet very satisfying thing happened: the plaintiff… disappeared!

Yep, like Keyser Söze, poof – gone! Vanished.

And all communication with her lawyers stopped. What actually happened I don’t know, but the main thing, the lawsuit was dropped!

Sure, we spent serious coinage, and we won’t get that back ever, but at least it wasn’t spent for nothing. Maybe the opposing side finally understood how serious vulnerabilities are and how important antivirus programs that fight malware can be to the stability of a computer – and mental wellbeing of the user!

So there you have it. That’s what happened to the latest set of attorneys who went after us; they got what was coming to them – a good kick up the donkey, and the strongest signal never to come near us again: no easy money here! And now all antivirus developers have access to a working case on how to successfully fight legal attacks like this one. So if you’re a developer and these types have already started going after you, send me a message. We’ll be glad to assist!

Meantime, we’re popping the Moët – celebrating our latest court victory!

How @kaspersky beat a class action against its free antivirus scannerTweet