San Francisco Division OMAR ABDULAZIZ, Case No. 19-cv-06694-LB
Plaintiff, ORDER GRANTING MOTION TO v. DISMISS FOURTH AMENDED COMPLAINT Re: ECF No. 119 Defendant. Employees of Twitter — at the direction of the Saudi government — allegedly accessed the plaintiff’s private Twitter account in 2015 and obtained his personal information. In 2018, Saudi agents planted malware on his phone, hacked it, obtained personal information, and targeted his family. The plaintiff is a Saudi dissident with a large social-media following who received political asylum in Canada in 2014. He sued Twitter for negligent supervision and retention of its employees (among other claims). The court twice dismissed the claims for lack of Article III standing (because Twitter’s alleged misconduct did not cause the harm), as barred by the statute of limitations, and as not plausibly pled (again because Twitter’s conduct did not plausibly cause the harm). The last dismissal order gave leave to amend to allege more facts about causation for Article III standing and the negligence claim.1 In the operative Fourth Amended Complaint, the plaintiff again claims negligence and negligent supervision and retention of employees and adds new allegations about the connection of the 2015 Twitter access to the Saudi government’s targeting of the plaintiff’s family in 2018.2 The allegations do not change the court’s earlier conclusion that the plaintiff did not plausibly plead a causal connection between Twitter’s conduct and the alleged harm. He thus does not have Article III standing or plausibly plead negligence. The court grants Twitter’s motion to dismiss and dismisses the claims with prejudice. The court issued two orders dismissing the case. Those orders summarize the complaint’s allegations.3 The main allegations in the current complaint have not changed. In short, the plaintiff alleges that (now former) employees of Twitter accessed Twitter accounts (including the plaintiff’s account in June and July 2015) without authorization. As a result, they obtained the plaintiff’s confidential information (including passwords). In 2018, Saudi operatives hacked the plainitff’s phone, spied on him, raided his family’s home, and imprisoned family members and friends. The plaintiff claimed he never received Twitter’s December 2015 notice — sent by email and through an in-app message — that his account had been compromised and instead learned about the compromise of his phone from the University of Toronto’s Citizens Lab in August 2018.4 The amended complaint adds new allegations relevant to notice about the 2015 unauthorized access of the Twitter account and the alleged connection to the 2018 hack of the phone. First, the plaintiff and another prominent Saudi dissident did not receive Twitter’s December 2015 notice — either by the in-app notification or by email — and searched their emails 1 First Am. Compl. – ECF No. 38; Third Am. Compl. – ECF No. 98; Orders – ECF Nos. 76, 107. Citations refer to material in the Electronic Case File (ECF); pinpoint citations are to the ECF- generated page numbers at the top of documents. 2 Fourth Am. Compl. (4th AC) – ECF No. 113 at 40–42 (¶¶ 170–81). He also claimed unauthorized access of a computer in violation of Cal. Penal Code § 502(c) but — in response to Twitter’s motion to dismiss — conceded the dismissal of the claim. Id. at 42–44 (¶¶ 182–92); Opp’n – ECF No. 122 at 9 n.1. 3 Orders – ECF Nos. 76 & 107. This order incorporates the summaries by this reference. (including their spam folders) to confirm this. Twitter’s notice also did not tell users that Saudi authorities were behind the unauthorized access.5 Second, the former employees had no legitimate business reason to access the compromised Twitter accounts, and monitoring software would have revealed their unauthorized use.6 Third, in May 2015 (one week after meeting with Saudi officials), one of the Twitter employees accessed the other Saudi dissident’s Twitter account and his direct messages with the plaintiff and learned from the messages that the plaintiff had insider information that was potentially damaging to the Saudi government. This caused Saudi authorities — who had no previous knowledge of the plaintiff’s role in generating political opposition to the Saudi government — to single out the plaintiff and his family in 2018. Also, one week after the Twitter employee accessed the other dissident’s direct messages, “the hacker used [the other dissident’s] direct messaging capability to send a [direct message] to Plaintiff saying, ‘You’re next, motherfucker.’”7 Twitter moved to dismiss the operative complaint, and the court held a hearing on July 15, 2021. All parties consented to magistrate-judge jurisdiction under 28 U.S.C. § 636.8 The amount in controversy exceeds $75,000, and the parties are diverse: the plaintiff resides in Canada, and Twitter is incorporated in Delaware and has its headquarters in San Francisco.9 The parties do not dispute the court’s diversity jurisdiction. 28 U.S.C. § 1332(a)(1). The court previously dismissed the complaint for failure to plead the causation needed for Article III standing and negligence. It gave the plaintiff leave to amend to add allegations about causation. The new allegations do not alter the conclusion that the plaintiff did not plead causation.
Free access — add to your briefcase to read the full text and ask questions with AI
San Francisco Division OMAR ABDULAZIZ, Case No. 19-cv-06694-LB
Plaintiff, ORDER GRANTING MOTION TO v. DISMISS FOURTH AMENDED COMPLAINT Re: ECF No. 119 Defendant. Employees of Twitter — at the direction of the Saudi government — allegedly accessed the plaintiff’s private Twitter account in 2015 and obtained his personal information. In 2018, Saudi agents planted malware on his phone, hacked it, obtained personal information, and targeted his family. The plaintiff is a Saudi dissident with a large social-media following who received political asylum in Canada in 2014. He sued Twitter for negligent supervision and retention of its employees (among other claims). The court twice dismissed the claims for lack of Article III standing (because Twitter’s alleged misconduct did not cause the harm), as barred by the statute of limitations, and as not plausibly pled (again because Twitter’s conduct did not plausibly cause the harm). The last dismissal order gave leave to amend to allege more facts about causation for Article III standing and the negligence claim.1 In the operative Fourth Amended Complaint, the plaintiff again claims negligence and negligent supervision and retention of employees and adds new allegations about the connection of the 2015 Twitter access to the Saudi government’s targeting of the plaintiff’s family in 2018.2 The allegations do not change the court’s earlier conclusion that the plaintiff did not plausibly plead a causal connection between Twitter’s conduct and the alleged harm. He thus does not have Article III standing or plausibly plead negligence. The court grants Twitter’s motion to dismiss and dismisses the claims with prejudice. The court issued two orders dismissing the case. Those orders summarize the complaint’s allegations.3 The main allegations in the current complaint have not changed. In short, the plaintiff alleges that (now former) employees of Twitter accessed Twitter accounts (including the plaintiff’s account in June and July 2015) without authorization. As a result, they obtained the plaintiff’s confidential information (including passwords). In 2018, Saudi operatives hacked the plainitff’s phone, spied on him, raided his family’s home, and imprisoned family members and friends. The plaintiff claimed he never received Twitter’s December 2015 notice — sent by email and through an in-app message — that his account had been compromised and instead learned about the compromise of his phone from the University of Toronto’s Citizens Lab in August 2018.4 The amended complaint adds new allegations relevant to notice about the 2015 unauthorized access of the Twitter account and the alleged connection to the 2018 hack of the phone. First, the plaintiff and another prominent Saudi dissident did not receive Twitter’s December 2015 notice — either by the in-app notification or by email — and searched their emails 1 First Am. Compl. – ECF No. 38; Third Am. Compl. – ECF No. 98; Orders – ECF Nos. 76, 107. Citations refer to material in the Electronic Case File (ECF); pinpoint citations are to the ECF- generated page numbers at the top of documents. 2 Fourth Am. Compl. (4th AC) – ECF No. 113 at 40–42 (¶¶ 170–81). He also claimed unauthorized access of a computer in violation of Cal. Penal Code § 502(c) but — in response to Twitter’s motion to dismiss — conceded the dismissal of the claim. Id. at 42–44 (¶¶ 182–92); Opp’n – ECF No. 122 at 9 n.1. 3 Orders – ECF Nos. 76 & 107. This order incorporates the summaries by this reference. (including their spam folders) to confirm this. Twitter’s notice also did not tell users that Saudi authorities were behind the unauthorized access.5 Second, the former employees had no legitimate business reason to access the compromised Twitter accounts, and monitoring software would have revealed their unauthorized use.6 Third, in May 2015 (one week after meeting with Saudi officials), one of the Twitter employees accessed the other Saudi dissident’s Twitter account and his direct messages with the plaintiff and learned from the messages that the plaintiff had insider information that was potentially damaging to the Saudi government. This caused Saudi authorities — who had no previous knowledge of the plaintiff’s role in generating political opposition to the Saudi government — to single out the plaintiff and his family in 2018. Also, one week after the Twitter employee accessed the other dissident’s direct messages, “the hacker used [the other dissident’s] direct messaging capability to send a [direct message] to Plaintiff saying, ‘You’re next, motherfucker.’”7 Twitter moved to dismiss the operative complaint, and the court held a hearing on July 15, 2021. All parties consented to magistrate-judge jurisdiction under 28 U.S.C. § 636.8 The amount in controversy exceeds $75,000, and the parties are diverse: the plaintiff resides in Canada, and Twitter is incorporated in Delaware and has its headquarters in San Francisco.9 The parties do not dispute the court’s diversity jurisdiction. 28 U.S.C. § 1332(a)(1). The court previously dismissed the complaint for failure to plead the causation needed for Article III standing and negligence. It gave the plaintiff leave to amend to add allegations about causation. The new allegations do not alter the conclusion that the plaintiff did not plead causation.
5 4th AC – ECF No. 113 at 8 (¶¶ 30–31), 25 (¶ 112), 31 (¶ 131). 6 Id. at 13–14 (¶¶ 55–56). 7 Id. at 14–15 (¶¶ 63–68), 20–21 (¶¶ 95–97). A blackline of the complaint shows the new allegations, and the plaintiff’s opposition summarizes the allegations and their relevance in a chart. Blackline Compl. – ECF No. 114; Opp’n – ECF No. 122 at 10–12. 8 Consents – ECF Nos. 10 & 20. The legal standards for Article III standing and negligence are in the court’s earlier orders.10 Both require causation, meaning, Twitter’s conduct must cause the harm. For standing, a plaintiff must have an injury in fact “that is fairly traceable to the challenged conduct of the defendant.” Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016) (cleaned up). Article III requires “a causal connection between the injury and the conduct complained of — the injury has to be fairly traceable to the challenged action of the defendant, and not the result of the independent action of some third party not before the court.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992) (cleaned up). As the court held previously, the plaintiff is a political dissident who received asylum in 2014 based on the Saudi government’s persecution of him. The Saudi government’s planting the malware on his phone happened in 2018, three years after the compromise of his Twitter account. There is no temporal proximity.11 The new allegations — the Twitter employees, acting at the Saudi government’s behest, also accessed in 2015 his direct messages with another dissident and learned about his political activities — do not change the conclusion that there is no causal link between the compromise of his account and his alleged injuries. Negligence also requires causation: the defendant’s breach of the duty of care must cause the damages. Merrill v. Navegar, Inc., 28 P.3d 116, 123 (Cal. 2001). “The causation element of a negligence claim generally ‘has two aspects’: (1) whether the defendant’s action or inaction was a ‘cause in fact’ of the plaintiff’s injury, also known as ‘but for’ causation; and (2) whether, based on ‘the degree of connection between the conduct’ and considerations of public policy, it would be ‘unjust to hold [the defendant] legally responsible,’ often referred to as ‘proximate’ causation.” Steinle v. United States, No. 16-cv-02859-JCS, 2020 WL 60204, at *7 (N.D. Cal. Jan. 6, 2020) (quoting State Dep’t of State Hosps. v. Super. Ct., 61 Cal. 4th 339, 352−53 (2015)). For the reasons that the plaintiff did not plead causation for standing, he also did not plead causation for his negligence claims. 10 Orders – ECF Nos. 76 at 8–9, 10–11 & 107 at 7–9, 11–12. This order incorporates the full legal standards by this reference. 2 The court grants the defendant’s motion to dismiss the Fourth Amended Complaint. Because 3 the court previously gave leave to amend, and the plaintiff did not cure the deficiencies about 4 causation, the dismissal is with prejudice. 5 This disposes of ECF No. 119. 7 Dated: July 15, 2021 LAE 8 LAUREL BEELER 9 United States Magistrate Judge 10 11 a 12
© 15 16
it
18 19 20 21 22 23 24 25 26 27 28