Abdulaziz v. Twitter, Inc.

• Court: District Court, N.D. California
• Decided: February 18, 2021
• Docket: 3:19-cv-06694
• Status: Unknown

Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 NORTHERN DISTRICT OF CALIFORNIA 10 San Francisco Division 11 OMAR ABDULAZIZ, Case No. 19-cv-06694-LB

12 Plaintiff, ORDER GRANTING MOTION TO 13 v. DISMISS

14 TWITTER, INC., Re: ECF No. 99 15 Defendant. 16 17 INTRODUCTION 18 The plaintiff Omar Abdulaziz is a political dissident who moved to Canada in 2009 and was 19 granted political asylum there in 2014 based on the Kingdom of Saudi Arabia’s persecution of him.1 20 In this lawsuit, he alleges that in 2014, Saudi authorities recruited two employees of the social- 21 media company Twitter to access his confidential Twitter data and thereafter used malware in 2018 22 to hack his phone (and obtain texts, emails, and other information) and then targeted his family. 23 In an earlier complaint, the plaintiff sued Twitter for violating the Stored Communications Act, 24 California’s Unfair Competition Law, and state law. The state claims included Twitter’s negligent 25 hiring, supervision, and retention of employees.2 The court dismissed the claims for lack of Article 26 27 1 Third Am. Compl. (TAC) – ECF No. 98 at 2 (¶ 1). Citations refer to material in the Electronic Case File (ECF); pinpoint citations are to the ECF-generated page numbers at the top of documents. 1 III standing and, alternatively, for the plaintiff’s failure to plausibly plead that Twitter ratified its 2 employees’ conduct or otherwise had vicarious liability. This disposed of all claims except the 3 negligent-hiring claims, which the court held were barred by the statute of limitations.3 4 In his amended complaint, the plaintiff sued Twitter for negligent supervision and retention of 5 its employees and negligence. Twitter moved to dismiss the claims for failure to establish causation 6 for Article III standing or negligence, as barred by statute of limitations and its terms of service, and 7 because the plaintiff did not plausibly allege its negligence. The court grants the motion on all 8 grounds except for the terms of service, which the court does not reach on this briefing. 9 10 STATEMENT 11 1. The Plaintiff’s Political Activism 12 In 2009, the plaintiff moved from Saudi Arabia to Canada to attend a Canadian university and 13 was granted asylum in 2014 based on his fear of persecution in Saudi Arabia.4 As a student, the 14 plaintiff discussed Saudi Arabian politics on Twitter and other social-media platforms, criticizing 15 the governing regime, the royal family, and human-rights violations.5 The plaintiff was a close ally 16 of Jamal Khashoggi, who was assassinated in October 2018 — by order of the Crown Prince 17 Mohammad Bin Salman (according to the CIA) — in the Saudi consulate in Istanbul.6 The plaintiff 18 and Mr. Khashoggi had been collaborating on a “range of political activities with the objective of 19 educating the public in Saudi Arabia.”7 The plaintiff has a large social-media following: over a half- 20 million followers on Twitter and over 163,000 subscribers to his YouTube channel.8 21 22 23 3 Order – ECF No. 76 at 2. 4 TAC – ECF No. 98 at 3 (¶ 8). 24 5 Id. 25 6 Id. at 4 (¶ 10). 26 7 Id. 8 Id. at 34 (¶ 154) (Twitter); FAC – ECF No. 38 at 5 (¶ 16) (Twitter and YouTube). The court can 27 consider statements in the plaintiff’s earlier complaint as a party admission. Phillips et al., Fed Civ. P. Before Trial § 9:223 (2020) (citing Andrews v. Metro N. Commuter R.R. Co., 882 F.2d 705, 707 (2nd 1 2. Saudi Arabia Obtained Information About the Plaintiff 2 In addition to its access to publicly available information about the plaintiff, Saudi Arabia 3 obtained information about him through two means: (1) his private Twitter information accessed 4 unlawfully by Twitter employees and (2) planting malware on his phone and then hacking the phone. 5 2.1 Twitter Employees Gain Access to the Plaintiff’s Twitter Information 6 Saudi Arabia allegedly recruited two Twitter employees — Ali Alzabarah (a Saudi citizen and 7 a U.S. resident since 2005 and a site-reliability engineer for Twitter from August 2013 to 8 December 2015) and Ahmad Abouammo (an American citizen and a Media Partnerships Manager 9 for Twitter for the Middle East and North Africa region from November 2013 to May 2015) — to 10 access certain Twitter accounts without Twitter’s authorization.9 Abouammo began the 11 unauthorized access in December 2014, and Alzabarah began in May 2015.10 The plaintiff alleges 12 that Alzabarah accessed his confidential information, including his passwords, IP addresses, and 13 direct messages, in June and July 2015.11 Federal prosecutors investigated the unauthorized access 14 and ultimately charged both former employees criminally in November 2019 with acting as agents 15 of a foreign government in violation of 18 U.S.C. § 951.12 16 The TAC alleges that the FBI met with Twitter in late 2015, said that Alzabarah was the mole 17 and that the FBI investigation was sensitive and ongoing, and “expressly asked Twitter not to tell 18 Alzabarah what was going on as it could hurt the case[.]”13 Twitter allegedly refused to comply 19 with this request and instead, confronted Alzabarah with accusations that he improperly accessed 20 user accounts.14 He admitted that he had done so. Twitter did not detain Alzabarah (despite 21 allegedly having the legal authority to do so under California Penal Code § 837) so that the FBI 22 23 24 9 Id. at 8–10 (¶¶ 31–45); 13–14 (¶¶ 59–62). 10 Id. at 10 (¶ 46); 13 (¶ 61). 25 11 Id. at 14–15 (¶ 67–69). 26 12 United States v. Abouammo, No. 3:19-mj-71824-MAG (N.D. Cal.); id., No. 19-cr-00621-EMC (N.D. Cal.) (the indicted case). 27 13 TAC – ECF No. 98 at 20 (¶ 97). 1 could arrest him and instead escorted him out of the building and suspended him.15 Alzabarah then 2 decamped to Saudi Arabia on December 3, 2015.16 The Justice Department officials were “livid” 3 because Twitter had “blown up their case by tipping off a man they were hoping to 4 arrest.”17Abouammo left his job at Twitter earlier that year.18 5 Shortly after Alzabarah fled, Saudi authorities interrogated the plaintiff’s father and brother in 6 Saudi Arabia, cancelled the brother’s financial assistance, and summoned three of the plaintiff’s 7 friends and roommates in Canada to the Saudi Cultural Bureau between March and July 2016.19 8 On December 11, 2015, by email and through an in-app message, Twitter notified the owners 9 of the accounts that had been compromised, including the plaintiff, that their Twitter accounts may 10 have been targeted by state-sponsored actors to obtain IP addresses, emails, and phone data.20 It 11 did this in two ways: through email (here, the email address that the plaintiff gave to Twitter) and 12 through an in-app safety alert.21 The plaintiff alleges that he did not receive the notices and instead 13 learned about the unauthorized access when he read about it in the New York Times on October 14 20, 2018.22 If he had known that his account had been compromised, then he would have been 15 more careful about clicking on hyperlinks in text messages and would not have clinked on the link 16 that put malware on his phone and allowed Saudi operatives to hack his phone.23 17 In support of his contention that Twitter is responsible for the unauthorized act of its 18 employees (even though those actions violated company policy), the plaintiff alleges the conduct 19 20

21 15 Id. 22 16 Id. at 21 (¶ 99), 27 (¶ 122). 17 Id. 23 18 Abouammo, 3:19-mj-71824-MAG, Compl. – ECF No. 1 at 5 (¶ 17). 24 19 TAC – ECF No. 98 at 27 (¶ 122). 25 20 Notifications, Exs. 1 & 2 to Twitter Employee Decl. – ECF Nos. 41-6 & 41-7. The court considers the notices under the incorporation-by-reference doctrine. TAC – ECF No. 98 at 24 (¶¶ 111–112 26 referencing them); Knievel v. ESPN, 393 F.3d 1068, 1076–77 (9th Cir. 2005). 21 Notifications, Exs. 1 & 2 to Twitter Employee Decl. – ECF Nos. 41-6 & 41-7. 27 22 TAC – ECF No. 98 at 28 (¶ 127). 1 was a “red flag” that should have alerted Twitter to the illegal activity.24 The plaintiff also alleged 2 that the danger “was inherent in Twitter’s manner of operation:” 3 First, Twitter furnished Alzabarah and Abouammo with the access, hardware and software tools that enabled them to raid Plaintiff’s private information. This would not have been 4 possible were they not employed by Twitter. Second, Twitter implemented and benefited 5 from policies that allowed and encouraged its technical and professional staff to work offsite, from multiple locations. Although Twitter benefitted from the greater productivity 6 this allowed, it even further reduced Twitter’s ability to monitor sensitive employees’ conduct. Finally, Twitter implemented and benefitted from policies allowing its 7 professional and technical staff flexibility as to when and where they performed their work, 8 further complicating any monitoring Twitter should have been doing. With hundreds of millions of active users and a great many employees who had access to their data, the risk 9 that confidential data would be exposed was broadly incident to Twitter’s mode of operation.25 10 11 Despite the known risks, Twitter “failed to institute adequate safeguards to protect this data or 12 even alert Twitter senior management that private account data was being raided.”26 Also, Twitter 13 did not institute appropriate safeguards or notify the plaintiff or other victims that it wanted to 14 maintain its relationship with Saudi Arabia (shown in part by Saudi holdings in Twitter and a 15 meeting that Twitter CEO Jack Dorsey had with Crown Prince Mohammed Bin Salman six 16 months after Alzabarah fled to Saudi Arabia).27 17 2.2 Saudi Operatives Hack the Plaintiff’s Phone 18 In May 2018, two Saudi agents contacted the plaintiff, asked to meet with him, and met with 19 him in several meetings.28 The agents said that they worked for Crown Prince Bin Salman and 20 Saud Al-Qahtani (who was “entangled with the murder of” Jamal Khashoggi) and demanded that 21 22 23 24

25 24 Id. at 12 (¶ 53), 14 (¶ 64). 26 25 Id. at 15 (¶ 72). 26 Id. 27 27 Id. at 2 (¶ 3), 21 (¶ 100), 24 (¶¶ 108–09), 22 (¶ 106). 1 the plaintiff stop his political activities and return to Saudi Arabia.29 The plaintiff refused.30 A few 2 months later, Saudi operatives assassinated Mr. Khashoggi at the Saudi Consulate in Istanbul.31 3 On June 23, 2018, Saudi agents planted Pegasus malware on the plaintiff’s phone in a phishing 4 direct message masquerading as a message from the shipping company DHL to manage a 5 delivery.32 As a result, the agents exfiltrated the plaintiff’s SMS chats, emails, photographs, 6 location data, and other information and were able to spy on the plaintiff “real time” through 7 control of the phone’s camera and microphone and receipt of information that the plaintiff typed 8 into the phone or received from others.33 9 In late July and early August 2018, Saudi agents raided the plaintiff’s family’s home, arrested 10 and imprisoned his two brothers and dozens of his friends and associates, and continue to imprison 11 and torture his brothers to pressure the plaintiff to stop his activism.34 12 In mid-August 2018, the Citizens Lab at the University of Toronto told the plaintiff about the 13 compromise of his phone through the Pegasus malware.35 In October 2018, two weeks after the 14 assassination of Mr. Khashoggi, a team of Saudi nationals traveled to Canada to assassinate the 15 plaintiff.36 In December 2018, in a separate lawsuit filed in Israel, the plaintiff sued N.S.O. 16 Technologies, which manufactures the Pegasus software, on the ground that is liable for the 17 hacking of his phone and the resulting harm that he and his family and friends suffered.37 18 19 20

21 29 Id. 22 30 Id. 31 Id. at 29–30 (¶ 133). 23 32 Id. at 30 (¶ 135). 24 33 Id. (¶ 136). 25 34 Id. at 30–31 (¶¶ 137–38, 142). 35 Id. at 32 (¶ 143). 26 36 Id. at 32 (¶ 146). 27 37 Statement of Claim, Ex. A to Olm Decl. – ECF No. 41-2 at 1. The court takes judicial notice of the records. Lee v. City of Los Angeles, 250 F.3d 668, 689–90 (9th Cir. 2001); United States ex rel. 1 3. Procedural History 2 The plaintiff sued Twitter and McKinsey & Co. in October 2019 and then amended his 3 complaint.38 The court subsequently granted the defendants’ motion to dismiss.39 The plaintiff 4 dismissed McKinsey from the lawsuit.40 The plaintiff amended his complaint twice, and Twitter 5 moved to dismiss the operative Third Amended Complaint.41 The court held a hearing on February 6 11, 2021. 7 All parties consented to magistrate-judge jurisdiction.42 The plaintiff resides in Canada, and 8 Twitter is incorporated in Delaware and has its headquarters in San Francisco.43 The parties do not 9 dispute the court’s diversity jurisdiction. 28 U.S.C. § 1332(a)(1). 10 11 STANDARD OF REVIEW 12 A complaint must contain a short and plain statement of the ground for the court’s jurisdiction 13 (unless the court already has jurisdiction and the claim needs no new jurisdictional support). Fed. 14 R. Civ. P. 8(a)(1). The plaintiff has the burden of establishing jurisdiction. Kokkonen v. Guardian 15 Life Ins. Co. of Am., 511 U.S. 375, 377 (1994); Farmers Ins. Exch. v. Portage La Prairie Mut. Ins. 16 Co., 907 F.2d 911, 912 (9th Cir. 1990). 17 A complaint must contain a “short and plain statement of the claim showing that the pleader is 18 entitled to relief” to give the defendant “fair notice” of what the claims are and the grounds upon 19 which they rest. Fed. R. Civ. P. 8(a)(2); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). A 20 complaint does not need detailed factual allegations, but “a plaintiff’s obligation to provide the 21 ‘grounds’ of his ‘entitlement to relief’ requires more than labels and conclusions, and a formulaic 22 23

24 38 Compl. – ECF No. 1; FAC – ECF No. 38. 25 39 Order – ECF No. 76. 26 40 Notice of Voluntary Dismissal – ECF No. 85. 41 Second Am. Compl. (SAC) – ECF No. 80; TAC – ECF No. 98; Mot. – ECF No. 99. 27 42 Consents – ECF Nos. 10 & 20. 1 recitation of the elements of a cause of action will not do. Factual allegations must be enough to 2 raise a claim for relief above the speculative level[.]” Twombly, 550 U.S. at 555 (cleaned up). 3 To survive a motion to dismiss, a complaint must contain sufficient factual allegations, which 4 when accepted as true, “‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 5 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). “A claim has facial plausibility when 6 the plaintiff pleads factual content that allows the court to draw the reasonable inference that the 7 defendant is liable for the misconduct alleged.” Id. “The plausibility standard is not akin to a 8 ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted 9 unlawfully.” Id. (citing Twombly, 550 U.S. at 557). “Where a complaint pleads facts that are 10 merely consistent with a defendant’s liability, it stops short of the line between possibility and 11 plausibility of ‘entitlement to relief.’” Id. (cleaned up) (quoting Twombly, 550 U.S. at 557). 12 If a court dismisses a complaint, it should give leave to amend unless the “pleading could not 13 possibly be cured by the allegation of other facts.” United States v. United Healthcare Ins. Co., 848 14 F.3d 1161, 1182 (9th Cir. 2016) (cleaned up). 15 16 ANALYSIS 17 Twitter moved to dismiss the negligence claims for lack of Article III standing, as barred by 18 the statute of limitations, as not plausibly pled, and as barred by Twitter’s terms of service. The 19 court dismisses the claims because the plaintiff did not plead causation for Article III standing or 20 negligence. The claims also are barred by the statute of limitations, and the plaintiff did not 21 plausibly plead Twitter’s negligence. 22 23 1. Article III Standing 24 Federal-court jurisdiction extends only to “cases” and “controversies.” Raines v. Byrd, 521 25 U.S. 811, 818 (1997); Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016). To establish standing, 26 “[t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged 27 conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Id. 1 Article III requires “a causal connection between the injury and the conduct complained of — the 2 injury has to be ‘fairly . . . trace[able] to the challenged action of the defendant, and not . . . th[e] 3 result [of] the independent action of some third party not before the court.’” Lujan, 504 U.S. at 4 560‒61 (quoting Simon, 426 U.S. at 41‒42) (ellipses in original). 5 Twitter’s employees accessed the plaintiff’s Twitter data in June and July 2015. The immediate 6 harm (“shortly” after Alzabarah fled to Saudi Arabia in December 2015) was the questioning of the 7 plaintiff’s father and brother, the loss of his brother’s financial benefits (at some undisclosed time), 8 the imprisonment of many of the plaintiff’s friends in Saudi Arabia (again at an undisclosed time), 9 and the plaintiff’s resulting emotional distress.44 The hacking of the plaintiff’s phone was in late 10 July and early August 2018, resulting in the compromise of his data, the raid of his family home in 11 Saudi Arabia, the arrest and imprisonment of his brothers, and the persecution of his friends.45 12 These facts do not plausibly establish that Twitter’s alleged misconduct caused the harms. 13 First, the plaintiff does not explain how the compromise of the Twitter data caused the harm to his 14 family and friends. Indeed, he is a political dissident with an active social-media presence who 15 suffered persecution before the compromise of his Twitter data (shown by Canada’s granting him 16 political asylum in February 2014). Second, the implanting of the Pegasus malware and the 17 subsequent compromise of his data in July and August 2018 was three years after the compromise 18 of his Twitter data. There is no temporal proximity. And the plaintiff’s allegation that it is related 19 to the Twitter breach is a conclusion, not a fact allegation. In sum, the plaintiff does not plausibly 20 plead causation and thus does not establish Article III standing. 21 The plaintiff’s arguments do not compel a contrary conclusion. 22 First, he contends that the Saudi government’s persecution of him before 2015 was limited to 23 withholding financial assistance and that the persecution intensified only after the Saudi 24 government accessed his Twitter data in 2015.46 But in his complaint, he contends that when he 25 26 44 Id. at 27–28 (¶ 122), 36–37 (¶¶ 163, 167–68). 27 45 Id. at 30–31 (¶¶ 137–38, 143) 1 applied for asylum in Canada, he did so because of his well-founded fear of persecution, meaning, 2 he would be “imprisoned, tortured, or killed.” 47 3 Second, he explains the three-year delay as part of a “gradual intensification” of persecution that 4 began in 2015 and that can be explained only by the Twitter breach: “despite no change in 5 Plaintiff’s behavior and nothing out of the ordinary happening apart from Twitter’s data breach, [the 6 Saudi government] suddenly escalated its persecution of Plaintiff in an unprecedented manner.”48 7 But by the plaintiff’s own account, he became a more vocal critic of the Saudi government 8 after he was granted asylum, gaining a substantial social-media platform.49 And during this time 9 period, Crown Prince Mohammad Bin Salmon obtained power in 2015, when his father became 10 king. As the complaint describes, the CIA attributes the 2018 assassination of the plaintiff’s ally 11 Jamal Khashoggi to Prince Bin Salman, and the plaintiff admits that he and Mr. Khashoggi 12 collaborated on a range of political activities.50 And, as discussed in his earlier complaint and in 13 the court’s order, by 2016 or 2017, McKinsey allegedly identified him to agents of Prince Bin 14 Salman as “one of the top three voices shaping public discussion about controversial austerity 15 measures.” (The other two were Khaled Al-Alkami, who was imprisoned after he was identified, 16 and “Ahmad,” who disappeared.)51 17 In sum, the plaintiff has not shown a causal link between the compromise of his Twitter 18 account and his persecution three years later. 19 20 21 47 TAC – ECF No. 98 at 27 (¶ 120); Statement of Claim – Ex. Ex. A to Olm Decl. – ECF No. 41-2 at 6 22 (¶ 16) (in claim against NSO, the maker of Pegasus, claims harassment by Saudi authorities because of his political activism, leading him to apply for asylum in Canada). 23 48 Opp’n – ECF No. 102 at 21. 24 49 TAC – ECF No. 98 at 34 (¶ 154) (Twitter); FAC – ECF No. 38 at 5 (¶ 16). 25 50 FAC – ECF No. 38 at 5 (¶ 17). 51 Id. at 5–6 (¶ 18); SAC – ECF No. 80 at 33–35 (¶¶ 130, 136–37, 141–42) (alleging that every critic in 26 the McKinsey report has been imprisoned except for the plaintiff, who is safe only because he is in Canada, and alleging that the McKinsey report resulted in the imprisonment and torture of his family, 27 friends, and associates); Order – ECF No. 76 at 7 (noting the plaintiff’s conclusory allegation that McKinsey bought Twitter data and the defendants’ contention that the McKinsey PowerPoint 1 2. Negligence Claims 2 Twitter moves to dismiss the claims on the ground that the statute of limitations bars them, and 3 the plaintiff did not plausibly plead the claims. The court dismisses the claims on both grounds. 4 First, the parties do not dispute that the statute of limitations is two years and that the plaintiff 5 filed this lawsuit on October 18, 2019, almost four years after Twitter notified him of the breach 6 on December 11, 2015. Cal. Civ. Proc. Code § 335.1; Kaldis v. Wells Fargo Bank, N.A., 263 F. 7 Supp. 3d 856, 867 (C.D. Cal. 2017); So v. Shin, 212 Cal. App. 4th 652, 662 (2013). The plaintiff 8 does not dispute that Twitter sent the notices, but he disputes that he received them, contends they 9 did not in any event warn him sufficiently of the breach, and asserts that he learned of the breach 10 only on October 20, 2018 (rendering his lawsuit timely).52 11 The December 2015 notice — that state actors potentially compromised the plaintiff’s Twitter 12 account — was sufficient notice to trigger the statute of limitations. At that point, under 13 California’s discovery rule, the plaintiff “discover[ed], or has reason to discover, the cause of 14 action.” Fox v. Ethicon Endo-Surgery, Inc., 35 Cal. 4th 797, 806 (Cal. 2005) (citation omitted). 15 In any event, the plaintiff did not plausibly plead the claims. 16 The elements of a negligence claim are (1) the existence of a duty to exercise due care, (2) 17 breach of that duty, (3) causation, and (4) damages. Merrill v. Navegar, Inc., 28 P.3d 116, 139 18 (Cal. 2001). A duty to exercise due care is an “obligation to conform to a certain standard of 19 conduct for the protection of others against unreasonable risks.” McGarry v. Sax, 158 Cal. App. 20 4th 983, 994 (2008) (quotation omitted). Under California law, an employer is liable for negligent 21 supervision of any employee if it knew or should have known that “the employee created a 22 particular risk or hazard, and that particular harm materializes.” Bobol v. Feld Entm’t Inc., No. C 23 11–5539 PSG, 2012 WL 5828608, at *7 (N.D. Cal. Nov. 15, 2012) (quotation omitted). 24 First, Twitter contends that the plaintiff did not plausibly plead causation. “The causation 25 element of a negligence claim generally ‘has two aspects:’ (1) whether the defendant’s action or 26 inaction was a ‘cause in fact’ of the plaintiff's injury, also known as ‘but for’ causation; and (2) 27 1 whether, based on ‘the degree of connection between the conduct’ and considerations of public 2 policy, it would be ‘unjust to hold [the defendant] legally responsible,’ often referred to as 3 ‘proximate’” causation. Steinle v. United States, No. 16-cv-02859-JCS, 2020 WL 602024, at *8 4 (N.D. Cal. Jan. 6, 2020) (quoting State Dep’t of State Hosps. v. Superior Ct., 61 Cal. 4th 339, 5 352−53 (2015)). For the reasons that the plaintiff did not plead causation for standing, he also did 6 not plead causation for negligence. 7 Second, the plaintiff pleaded no facts that Twitter knew or should have known that its 8 employees created a particular risk or hazard. Bobol, 2012 WL 5828608, at *7. 9 10 3. Twitter’s Terms of Service 11 Twitter’s terms of service bar has a limitation-of-liability clause: a Twitter user cannot assert 12 Twitter’s liability for any damages resulting from “unauthorized access, use or alteration of [his] 13 transmissions or content” on any theory of liability, including “tort (including negligence).”53 The 14 plaintiff agreed to the terms of service but contends now that the limitation is an adhesion contract 15 that is procedurally and substantively unconscionable.54 16 On this briefing, the court does not reach the issue. Limitations of liability are upheld in 17 adhesion contracts (such as terms of service) if they are not procedurally or substantively 18 unconscionable. Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1028 (N.D. Cal. 2019). But terms 19 of service that might preclude a social-media company’s liability for an independent bad actor’s 20 hack of data do not necessarily preclude that company’s liability for employees who present a 21 particular risk or hazard, and that particular harm materializes. Bobol, 2012 WL 5828608, at *7. 22 So here, without the intervening acts of its employees, the terms of service may more easily 23 preclude Twitter’s liability for unknown state actors’ compromising Twitter users’ accounts. But 24 Twitter does not address how the cases affect the claims here, which at least in part are about its 25 former employees’ access to the plaintiff’s Twitter account. 26 27 53 Twitter’s TOS effective May 18, 2015–January 26, 2016, Ex. B to Olm Decl. – ECF No. 41-3; Twitter’s Current TOS, Ex. 10A to Suppl. RJN – ECF No. 60-11. 1 CONCLUSION 2 The court grants the defendant’s motion to dismiss the third-amended complaint with leave to 3 amend (given the plaintiffs representations at the hearing that he can plead facts to cure the defects 4 || regarding causation). Any amended complaint must be filed within 21 days of this order and must 5 include as an attachment a blackline of the amended complaint. 6 This disposes of ECF No. 99. 7 IT IS SO ORDERED. 8 Dated: February 18, 2021 LAE 9 LAUREL BEELER 10 United States Magistrate Judge 11 a 12

(«17

Z 18 19 20 21 22 23 24 25 26 27 28