Abdulaziz v. Twitter, Inc.

Opinion

San Francisco Division OMAR ABDULAZIZ, Case No. 19-cv-06694-LB

Plaintiff, ORDER GRANTING MOTION TO v. DISMISS

TWITTER, INC., Re: ECF No. 99 Defendant. The plaintiff Omar Abdulaziz is a political dissident who moved to Canada in 2009 and was granted political asylum there in 2014 based on the Kingdom of Saudi Arabia’s persecution of him.1 In this lawsuit, he alleges that in 2014, Saudi authorities recruited two employees of the social- media company Twitter to access his confidential Twitter data and thereafter used malware in 2018 to hack his phone (and obtain texts, emails, and other information) and then targeted his family. In an earlier complaint, the plaintiff sued Twitter for violating the Stored Communications Act, California’s Unfair Competition Law, and state law. The state claims included Twitter’s negligent hiring, supervision, and retention of employees.2 The court dismissed the claims for lack of Article 1 Third Am. Compl. (TAC) – ECF No. 98 at 2 (¶ 1). Citations refer to material in the Electronic Case File (ECF); pinpoint citations are to the ECF-generated page numbers at the top of documents. III standing and, alternatively, for the plaintiff’s failure to plausibly plead that Twitter ratified its employees’ conduct or otherwise had vicarious liability. This disposed of all claims except the negligent-hiring claims, which the court held were barred by the statute of limitations.3 In his amended complaint, the plaintiff sued Twitter for negligent supervision and retention of its employees and negligence. Twitter moved to dismiss the claims for failure to establish causation for Article III standing or negligence, as barred by statute of limitations and its terms of service, and because the plaintiff did not plausibly allege its negligence. The court grants the motion on all grounds except for the terms of service, which the court does not reach on this briefing. 1. The Plaintiff’s Political Activism In 2009, the plaintiff moved from Saudi Arabia to Canada to attend a Canadian university and was granted asylum in 2014 based on his fear of persecution in Saudi Arabia.4 As a student, the plaintiff discussed Saudi Arabian politics on Twitter and other social-media platforms, criticizing the governing regime, the royal family, and human-rights violations.5 The plaintiff was a close ally of Jamal Khashoggi, who was assassinated in October 2018 — by order of the Crown Prince Mohammad Bin Salman (according to the CIA) — in the Saudi consulate in Istanbul.6 The plaintiff and Mr. Khashoggi had been collaborating on a “range of political activities with the objective of educating the public in Saudi Arabia.”7 The plaintiff has a large social-media following: over a half- million followers on Twitter and over 163,000 subscribers to his YouTube channel.8 3 Order – ECF No. 76 at 2. 4 TAC – ECF No. 98 at 3 (¶ 8). 5 Id. 6 Id. at 4 (¶ 10). 7 Id. 8 Id. at 34 (¶ 154) (Twitter); FAC – ECF No. 38 at 5 (¶ 16) (Twitter and YouTube). The court can consider statements in the plaintiff’s earlier complaint as a party admission. Phillips et al., Fed Civ. P. Before Trial § 9:223 (2020) (citing Andrews v. Metro N. Commuter R.R. Co., 882 F.2d 705, 707 (2nd 2. Saudi Arabia Obtained Information About the Plaintiff In addition to its access to publicly available information about the plaintiff, Saudi Arabia obtained information about him through two means: (1) his private Twitter information accessed unlawfully by Twitter employees and (2) planting malware on his phone and then hacking the phone. 2.1 Twitter Employees Gain Access to the Plaintiff’s Twitter Information Saudi Arabia allegedly recruited two Twitter employees — Ali Alzabarah (a Saudi citizen and a U.S. resident since 2005 and a site-reliability engineer for Twitter from August 2013 to December 2015) and Ahmad Abouammo (an American citizen and a Media Partnerships Manager for Twitter for the Middle East and North Africa region from November 2013 to May 2015) — to access certain Twitter accounts without Twitter’s authorization.9 Abouammo began the unauthorized access in December 2014, and Alzabarah began in May 2015.10 The plaintiff alleges that Alzabarah accessed his confidential information, including his passwords, IP addresses, and direct messages, in June and July 2015.11 Federal prosecutors investigated the unauthorized access and ultimately charged both former employees criminally in November 2019 with acting as agents of a foreign government in violation of 18 U.S.C. § 951.12 The TAC alleges that the FBI met with Twitter in late 2015, said that Alzabarah was the mole and that the FBI investigation was sensitive and ongoing, and “expressly asked Twitter not to tell Alzabarah what was going on as it could hurt the case[.]”13 Twitter allegedly refused to comply with this request and instead, confronted Alzabarah with accusations that he improperly accessed user accounts.14 He admitted that he had done so. Twitter did not detain Alzabarah (despite allegedly having the legal authority to do so under California Penal Code § 837) so that the FBI 9 Id. at 8–10 (¶¶ 31–45); 13–14 (¶¶ 59–62). 10 Id. at 10 (¶ 46); 13 (¶ 61). 11 Id. at 14–15 (¶ 67–69). 12 United States v. Abouammo, No. 3:19-mj-71824-MAG (N.D. Cal.); id., No. 19-cr-00621-EMC (N.D. Cal.) (the indicted case). 13 TAC – ECF No. 98 at 20 (¶ 97). could arrest him and instead escorted him out of the building and suspended him.15 Alzabarah then decamped to Saudi Arabia on December 3, 2015.16 The Justice Department officials were “livid” because Twitter had “blown up their case by tipping off a man they were hoping to arrest.”17Abouammo left his job at Twitter earlier that year.18 Shortly after Alzabarah fled, Saudi authorities interrogated the plaintiff’s father and brother in Saudi Arabia, cancelled the brother’s financial assistance, and summoned three of the plaintiff’s friends and roommates in Canada to the Saudi Cultural Bureau between March and July 2016.19 On December 11, 2015, by email and through an in-app message, Twitter notified the owners of the accounts that had been compromised, including the plaintiff, that their Twitter accounts may have been targeted by state-sponsored actors to obtain IP addresses, emails, and phone data.20 It did this in two ways: through email (here, the email address that the plaintiff gave to Twitter) and through an in-app safety alert.21 The plaintiff alleges that he did not receive the notices and instead learned about the unauthorized access when he read about it in the New York Times on October 20, 2018.22 If he had known that his account had been compromised, then he would have been more careful about clicking on hyperlinks in text messages and would not have clinked on the link that put malware on his phone and allowed Saudi operatives to hack his phone.23 In support of his contention that Twitter is responsible for the unauthorized act of its employees (even though those actions violated company policy), the plaintiff alleges the conduct

15 Id. 16 Id. at 21 (¶ 99), 27 (¶ 122). 17 Id. 18 Abouammo, 3:19-mj-71824-MAG, Compl. – ECF No. 1 at 5 (¶ 17). 19 TAC – ECF No. 98 at 27 (¶ 122). 20 Notifications, Exs. 1 & 2 to Twitter Employee Decl. – ECF Nos. 41-6 & 41-7. The court considers the notices under the incorporation-by-reference doctrine. TAC – ECF No. 98 at 24 (¶¶ 111–112 referencing them); Knievel v. ESPN, 393 F.3d 1068, 1076–77 (9th Cir. 2005). 21 Notifications, Exs. 1 & 2 to Twitter Employee Decl. – ECF Nos. 41-6 & 41-7. 22 TAC – ECF No. 98 at 28 (¶ 127). was a “red flag” that should have alerted Twitter to the illegal activity.24 The plaintiff also alleged that the danger “was inherent in Twitter’s manner of operation:” First, Twitter furnished Alzabarah and Abouammo with the access, hardware and software tools that enabled them to raid Plaintiff’s private information. This would not have been possible were they not employed by Twitter. Second, Twitter implemented and benefited from policies that allowed and encouraged its technical and professional staff to work offsite, from multiple locations. Although Twitter benefitted from the greater productivity this allowed, it even further reduced Twitter’s ability to monitor sensitive employees’ conduct. Finally, Twitter implemented and benefitted from policies allowing its professional and technical staff flexibility as to when and where they performed their work, further complicating any monitoring Twitter should have been doing. With hundreds of millions of active users and a great many employees who had access to their data, the risk that confidential data would be exposed was broadly incident to Twitter’s mode of operation.25 Despite the known risks, Twitter “failed to institute adequate safeguards to protect this data or even alert Twitter senior management that private account data was being raided.”26 Also, Twitter did not institute appropriate safeguards or notify the plaintiff or other victims that it wanted to maintain its relationship with Saudi Arabia (shown in part by Saudi holdings in Twitter and a meeting that Twitter CEO Jack Dorsey had with Crown Prince Mohammed Bin Salman six months after Alzabarah fled to Saudi Arabia).27 2.2 Saudi Operatives Hack the Plaintiff’s Phone In May 2018, two Saudi agents contacted the plaintiff, asked to meet with him, and met with him in several meetings.28 The agents said that they worked for Crown Prince Bin Salman and Saud Al-Qahtani (who was “entangled with the murder of” Jamal Khashoggi) and demanded that

24 Id. at 12 (¶ 53), 14 (¶ 64). 25 Id. at 15 (¶ 72). 26 Id. 27 Id. at 2 (¶ 3), 21 (¶ 100), 24 (¶¶ 108–09), 22 (¶ 106). the plaintiff stop his political activities and return to Saudi Arabia.29 The plaintiff refused.30 A few months later, Saudi operatives assassinated Mr. Khashoggi at the Saudi Consulate in Istanbul.31 On June 23, 2018, Saudi agents planted Pegasus malware on the plaintiff’s phone in a phishing direct message masquerading as a message from the shipping company DHL to manage a delivery.32 As a result, the agents exfiltrated the plaintiff’s SMS chats, emails, photographs, location data, and other information and were able to spy on the plaintiff “real time” through control of the phone’s camera and microphone and receipt of information that the plaintiff typed into the phone or received from others.33 In late July and early August 2018, Saudi agents raided the plaintiff’s family’s home, arrested and imprisoned his two brothers and dozens of his friends and associates, and continue to imprison and torture his brothers to pressure the plaintiff to stop his activism.34 In mid-August 2018, the Citizens Lab at the University of Toronto told the plaintiff about the compromise of his phone through the Pegasus malware.35 In October 2018, two weeks after the assassination of Mr. Khashoggi, a team of Saudi nationals traveled to Canada to assassinate the plaintiff.36 In December 2018, in a separate lawsuit filed in Israel, the plaintiff sued N.S.O. Technologies, which manufactures the Pegasus software, on the ground that is liable for the hacking of his phone and the resulting harm that he and his family and friends suffered.37

29 Id. 30 Id. 31 Id. at 29–30 (¶ 133). 32 Id. at 30 (¶ 135). 33 Id. (¶ 136). 34 Id. at 30–31 (¶¶ 137–38, 142). 35 Id. at 32 (¶ 143). 36 Id. at 32 (¶ 146). 37 Statement of Claim, Ex. A to Olm Decl. – ECF No. 41-2 at 1. The court takes judicial notice of the records. Lee v. City of Los Angeles, 250 F.3d 668, 689–90 (9th Cir. 2001); United States ex rel. 3. Procedural History The plaintiff sued Twitter and McKinsey & Co. in October 2019 and then amended his complaint.38 The court subsequently granted the defendants’ motion to dismiss.39 The plaintiff dismissed McKinsey from the lawsuit.40 The plaintiff amended his complaint twice, and Twitter moved to dismiss the operative Third Amended Complaint.41 The court held a hearing on February 11, 2021. All parties consented to magistrate-judge jurisdiction.42 The plaintiff resides in Canada, and Twitter is incorporated in Delaware and has its headquarters in San Francisco.43 The parties do not dispute the court’s diversity jurisdiction. 28 U.S.C. § 1332(a)(1). A complaint must contain a short and plain statement of the ground for the court’s jurisdiction (unless the court already has jurisdiction and the claim needs no new jurisdictional support). Fed. R. Civ. P. 8(a)(1). The plaintiff has the burden of establishing jurisdiction. Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994); Farmers Ins. Exch. v. Portage La Prairie Mut. Ins. Co., 907 F.2d 911, 912 (9th Cir. 1990). A complaint must contain a “short and plain statement of the claim showing that the pleader is entitled to relief” to give the defendant “fair notice” of what the claims are and the grounds upon which they rest. Fed. R. Civ. P. 8(a)(2); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). A complaint does not need detailed factual allegations, but “a plaintiff’s obligation to provide the ‘grounds’ of his ‘entitlement to relief’ requires more than labels and conclusions, and a formulaic

38 Compl. – ECF No. 1; FAC – ECF No. 38. 39 Order – ECF No. 76. 40 Notice of Voluntary Dismissal – ECF No. 85. 41 Second Am. Compl. (SAC) – ECF No. 80; TAC – ECF No. 98; Mot. – ECF No. 99. 42 Consents – ECF Nos. 10 & 20. recitation of the elements of a cause of action will not do. Factual allegations must be enough to raise a claim for relief above the speculative level[.]” Twombly, 550 U.S. at 555 (cleaned up). To survive a motion to dismiss, a complaint must contain sufficient factual allegations, which when accepted as true, “‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. (citing Twombly, 550 U.S. at 557). “Where a complaint pleads facts that are merely consistent with a defendant’s liability, it stops short of the line between possibility and plausibility of ‘entitlement to relief.’” Id. (cleaned up) (quoting Twombly, 550 U.S. at 557). If a court dismisses a complaint, it should give leave to amend unless the “pleading could not possibly be cured by the allegation of other facts.” United States v. United Healthcare Ins. Co., 848 F.3d 1161, 1182 (9th Cir. 2016) (cleaned up). Twitter moved to dismiss the negligence claims for lack of Article III standing, as barred by the statute of limitations, as not plausibly pled, and as barred by Twitter’s terms of service. The court dismisses the claims because the plaintiff did not plead causation for Article III standing or negligence. The claims also are barred by the statute of limitations, and the plaintiff did not plausibly plead Twitter’s negligence. 1. Article III Standing Federal-court jurisdiction extends only to “cases” and “controversies.” Raines v. Byrd, 521 U.S. 811, 818 (1997); Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016). To establish standing, “[t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Id. Article III requires “a causal connection between the injury and the conduct complained of — the injury has to be ‘fairly . . . trace[able] to the challenged action of the defendant, and not . . . th[e] result [of] the independent action of some third party not before the court.’” Lujan, 504 U.S. at 560‒61 (quoting Simon, 426 U.S. at 41‒42) (ellipses in original). Twitter’s employees accessed the plaintiff’s Twitter data in June and July 2015. The immediate harm (“shortly” after Alzabarah fled to Saudi Arabia in December 2015) was the questioning of the plaintiff’s father and brother, the loss of his brother’s financial benefits (at some undisclosed time), the imprisonment of many of the plaintiff’s friends in Saudi Arabia (again at an undisclosed time), and the plaintiff’s resulting emotional distress.44 The hacking of the plaintiff’s phone was in late July and early August 2018, resulting in the compromise of his data, the raid of his family home in Saudi Arabia, the arrest and imprisonment of his brothers, and the persecution of his friends.45 These facts do not plausibly establish that Twitter’s alleged misconduct caused the harms. First, the plaintiff does not explain how the compromise of the Twitter data caused the harm to his family and friends. Indeed, he is a political dissident with an active social-media presence who suffered persecution before the compromise of his Twitter data (shown by Canada’s granting him political asylum in February 2014). Second, the implanting of the Pegasus malware and the subsequent compromise of his data in July and August 2018 was three years after the compromise of his Twitter data. There is no temporal proximity. And the plaintiff’s allegation that it is related to the Twitter breach is a conclusion, not a fact allegation. In sum, the plaintiff does not plausibly plead causation and thus does not establish Article III standing. The plaintiff’s arguments do not compel a contrary conclusion. First, he contends that the Saudi government’s persecution of him before 2015 was limited to withholding financial assistance and that the persecution intensified only after the Saudi government accessed his Twitter data in 2015.46 But in his complaint, he contends that when he 44 Id. at 27–28 (¶ 122), 36–37 (¶¶ 163, 167–68). 45 Id. at 30–31 (¶¶ 137–38, 143) applied for asylum in Canada, he did so because of his well-founded fear of persecution, meaning, he would be “imprisoned, tortured, or killed.” 47 Second, he explains the three-year delay as part of a “gradual intensification” of persecution that began in 2015 and that can be explained only by the Twitter breach: “despite no change in Plaintiff’s behavior and nothing out of the ordinary happening apart from Twitter’s data breach, [the Saudi government] suddenly escalated its persecution of Plaintiff in an unprecedented manner.”48 But by the plaintiff’s own account, he became a more vocal critic of the Saudi government after he was granted asylum, gaining a substantial social-media platform.49 And during this time period, Crown Prince Mohammad Bin Salmon obtained power in 2015, when his father became king. As the complaint describes, the CIA attributes the 2018 assassination of the plaintiff’s ally Jamal Khashoggi to Prince Bin Salman, and the plaintiff admits that he and Mr. Khashoggi collaborated on a range of political activities.50 And, as discussed in his earlier complaint and in the court’s order, by 2016 or 2017, McKinsey allegedly identified him to agents of Prince Bin Salman as “one of the top three voices shaping public discussion about controversial austerity measures.” (The other two were Khaled Al-Alkami, who was imprisoned after he was identified, and “Ahmad,” who disappeared.)51 In sum, the plaintiff has not shown a causal link between the compromise of his Twitter account and his persecution three years later. 47 TAC – ECF No. 98 at 27 (¶ 120); Statement of Claim – Ex. Ex. A to Olm Decl. – ECF No. 41-2 at 6 (¶ 16) (in claim against NSO, the maker of Pegasus, claims harassment by Saudi authorities because of his political activism, leading him to apply for asylum in Canada). 48 Opp’n – ECF No. 102 at 21. 49 TAC – ECF No. 98 at 34 (¶ 154) (Twitter); FAC – ECF No. 38 at 5 (¶ 16). 50 FAC – ECF No. 38 at 5 (¶ 17). 51 Id. at 5–6 (¶ 18); SAC – ECF No. 80 at 33–35 (¶¶ 130, 136–37, 141–42) (alleging that every critic in the McKinsey report has been imprisoned except for the plaintiff, who is safe only because he is in Canada, and alleging that the McKinsey report resulted in the imprisonment and torture of his family, friends, and associates); Order – ECF No. 76 at 7 (noting the plaintiff’s conclusory allegation that McKinsey bought Twitter data and the defendants’ contention that the McKinsey PowerPoint 2. Negligence Claims Twitter moves to dismiss the claims on the ground that the statute of limitations bars them, and the plaintiff did not plausibly plead the claims. The court dismisses the claims on both grounds. First, the parties do not dispute that the statute of limitations is two years and that the plaintiff filed this lawsuit on October 18, 2019, almost four years after Twitter notified him of the breach on December 11, 2015. Cal. Civ. Proc. Code § 335.1; Kaldis v. Wells Fargo Bank, N.A., 263 F. Supp. 3d 856, 867 (C.D. Cal. 2017); So v. Shin, 212 Cal. App. 4th 652, 662 (2013). The plaintiff does not dispute that Twitter sent the notices, but he disputes that he received them, contends they did not in any event warn him sufficiently of the breach, and asserts that he learned of the breach only on October 20, 2018 (rendering his lawsuit timely).52 The December 2015 notice — that state actors potentially compromised the plaintiff’s Twitter account — was sufficient notice to trigger the statute of limitations. At that point, under California’s discovery rule, the plaintiff “discover[ed], or has reason to discover, the cause of action.” Fox v. Ethicon Endo-Surgery, Inc., 35 Cal. 4th 797, 806 (Cal. 2005) (citation omitted). In any event, the plaintiff did not plausibly plead the claims. The elements of a negligence claim are (1) the existence of a duty to exercise due care, (2) breach of that duty, (3) causation, and (4) damages. Merrill v. Navegar, Inc., 28 P.3d 116, 139 (Cal. 2001). A duty to exercise due care is an “obligation to conform to a certain standard of conduct for the protection of others against unreasonable risks.” McGarry v. Sax, 158 Cal. App. 4th 983, 994 (2008) (quotation omitted). Under California law, an employer is liable for negligent supervision of any employee if it knew or should have known that “the employee created a particular risk or hazard, and that particular harm materializes.” Bobol v. Feld Entm’t Inc., No. C 11–5539 PSG, 2012 WL 5828608, at *7 (N.D. Cal. Nov. 15, 2012) (quotation omitted). First, Twitter contends that the plaintiff did not plausibly plead causation. “The causation element of a negligence claim generally ‘has two aspects:’ (1) whether the defendant’s action or inaction was a ‘cause in fact’ of the plaintiff's injury, also known as ‘but for’ causation; and (2) whether, based on ‘the degree of connection between the conduct’ and considerations of public policy, it would be ‘unjust to hold [the defendant] legally responsible,’ often referred to as ‘proximate’” causation. Steinle v. United States, No. 16-cv-02859-JCS, 2020 WL 602024, at *8 (N.D. Cal. Jan. 6, 2020) (quoting State Dep’t of State Hosps. v. Superior Ct., 61 Cal. 4th 339, 352−53 (2015)). For the reasons that the plaintiff did not plead causation for standing, he also did not plead causation for negligence. Second, the plaintiff pleaded no facts that Twitter knew or should have known that its employees created a particular risk or hazard. Bobol, 2012 WL 5828608, at *7. 3. Twitter’s Terms of Service Twitter’s terms of service bar has a limitation-of-liability clause: a Twitter user cannot assert Twitter’s liability for any damages resulting from “unauthorized access, use or alteration of [his] transmissions or content” on any theory of liability, including “tort (including negligence).”53 The plaintiff agreed to the terms of service but contends now that the limitation is an adhesion contract that is procedurally and substantively unconscionable.54 On this briefing, the court does not reach the issue. Limitations of liability are upheld in adhesion contracts (such as terms of service) if they are not procedurally or substantively unconscionable. Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1028 (N.D. Cal. 2019). But terms of service that might preclude a social-media company’s liability for an independent bad actor’s hack of data do not necessarily preclude that company’s liability for employees who present a particular risk or hazard, and that particular harm materializes. Bobol, 2012 WL 5828608, at *7. So here, without the intervening acts of its employees, the terms of service may more easily preclude Twitter’s liability for unknown state actors’ compromising Twitter users’ accounts. But Twitter does not address how the cases affect the claims here, which at least in part are about its former employees’ access to the plaintiff’s Twitter account. 53 Twitter’s TOS effective May 18, 2015–January 26, 2016, Ex. B to Olm Decl. – ECF No. 41-3; Twitter’s Current TOS, Ex. 10A to Suppl. RJN – ECF No. 60-11. 2 The court grants the defendant’s motion to dismiss the third-amended complaint with leave to 3 amend (given the plaintiffs representations at the hearing that he can plead facts to cure the defects 4 regarding causation). Any amended complaint must be filed within 21 days of this order and must 5 include as an attachment a blackline of the amended complaint. 6 This disposes of ECF No. 99. 8 Dated: February 18, 2021 LAE 9 LAUREL BEELER 10 United States Magistrate Judge 11 a 12

(«17

Z 18 19 20 21 22 23 24 25 26 27 28