Adkins v. Facebook, Inc.

Opinion

1 2 3 4 5 6 7 8 9 UNITED STATES DISTRICT COURT 10 NORTHERN DISTRICT OF CALIFORNIA 11

13 STEPHEN ADKINS, No. C 18–05982 WHA 14 Plaintiff,

15 v. FINAL SETTLEMENT APPROVAL AND ORDER GRANTING IN PART 16 FACEBOOK, INC., AND DENYING IN PART MOTION FOR ATTORNEY’S FEES 17 Defendant.

18 19 20 INTRODUCTION 21 Both sides seek final approval of a class action settlement and class counsel seek a large 22 sum in fees and costs. 23 STATEMENT 24 A coding error allowed hackers to break into the Facebook platform and pilfer the personal 25 information of millions of users in the United States. This came to light in 2018, leading to a 26 flurry of complaints. A prior order explained the coding vulnerability responsible for the data 27 breach (Dkt. 153). In brief, if three particular features on the Facebook platform aligned 1 access to accounts. The compromising of access tokens made millions of users accounts 2 vulnerable to entry (Dkt. 193). 3 A consolidated complaint sought relief in the form of a credit monitoring service for the 4 victims, in addition to compensatory, statutory, and punitive damages, and declaratory relief 5 based on ten claims. To this end, counsel moved to certify a class of users whose information 6 had been compromised. An order declined to certify a damages class but allowed an injunctive 7 relief class. Users were left to pursue damages claims on their own but no one ever filed one 8 (Dkt. 338 at 4). All but two of plaintiffs’ claims were dismissed and by the time the case settled, 9 only one named class representative remained out of the 11 plaintiffs involved in the case after 10 consolidation. The terms of the settlement included commitments by Facebook to prevent future 11 vulnerabilities related specifically to access tokens and consent to be independently monitored. 12 More specifically, Facebook’s security commitments include (Dkt. 315-5 at 27-29):

13 1. Tools to run integrity checks on updates

14 2. Tools for the detection of suspicious patterns in the generation and use of access tokens 15 3. Procedures to contain security incidents related to improper 16 issuance of access tokens

17 4. Automatic alerts for suspicious activity in user growth metrics and reporting on that activity 18 5. Five years of annual SOC2 Type II security assessments of 19 certain products related to security and vulnerability management and an agreement to report the results to the 20 Court and class counsel

21 6. Processes that give applications related to access tokens only the capabilities to perform intended functions, 22 including internal guidance to software engineers for selecting capabilities of applications using access tokens 23 and automatic removal of access token capabilities for applications that do not use those capabilities over a 90-day 24 period

25 7. Certification by Facebook that it eliminated the type of authentication proofs which made user credentials 26 vulnerable

27 8. Commitment to employing at least one senior security 9. Logging issuance and receipt of access tokens to facilitate 1 detection and investigation of compromised access tokens 2 Class counsel also move for attorney’s fees in the amount of $10,700,000 (based on a 3 1.253 multiplier), $1,210,900.75 in costs, a reserve of $15,000 for a data security vendor to 4 monitor compliance with the settlement terms (by way of the SOC2 Type II assessments), and 5 a $5,000 service award for plaintiff Stephen Adkins (Br. at 2–3). 6 ANAYLSIS 7 After the coding error in the Facebook platform exposed users to possible loss of personal 8 information, at least ten civil actions were immediately filed in this district and consolidated. A 9 previous order certified a class seeking injunctive relief but rejected certification of a damages 10 class. A class settlement followed whereby Facebook agreed to maintain certain security fixes 11 almost all of which Facebook would likely have maintained anyway. This order will approve the 12 settlement as fair and adequate in light of the substantial risks of litigation. All damages claims 13 have been preserved but none have been asserted anywhere by any of the millions potentially 14 affected. This order will also grant reasonable attorney’s fees and expenses for class counsel but 15 not for other lawyers. 16 1. PROPOSED CLASS SETTLEMENT FINAL APPROVAL 17 Under FRCP 23(e), the Court must approve any settlement agreement that will bind absent 18 class members. In reviewing a proposed settlement agreement, the district court must perform 19 two tasks: (1) direct notice in a reasonable manner to all class members who would be bound by 20 the proposal; and (2) approve the settlement only after a hearing and on finding that the terms of 21 the agreement are fair, reasonable, and adequate. In determining if a settlement is fair, 22 reasonable, and adequate, district courts take into account (1) the strength of the plaintiffs’ case; 23 (2) the risk, expense, complexity, and likely duration of further litigation; (3) the risk of 24 maintaining class action status throughout the trial; (4) the amount offered in settlement; (5) the 25 extent of discovery completed and the stage of the proceedings; (6) the experience and view of 26 counsel; (7) the presence of a governmental participant; and (8) the reaction of the class 27 1 members to the proposed settlement. In re Online DVD-Rental Antitrust Litig., 779 F.3d 934, 2 944 (9th Cir. 2015). 3 A prior order approved the form, content, and planned distribution of the class notice. The 4 claims administrator has fulfilled the notice plan. This order further finds that notice to class 5 members was adequate. For the following reasons and for the reasons stated in the November 6 2020 order (Dkt. 314), the proposed class settlement is fair, reasonable, and adequate under 7 FRCP 23(e). 8 In considering the strength of plaintiff’s case, this order notes that what Facebook did 9 wrong was not an intentional betrayal of its users for profit. At most Facebook was negligent in 10 allowing a confluence of rare circumstances to open up access tokens to strangers and, arguably, 11 being too slow to catch this vulnerability. The heart of this case was a software coding mistake. 12 Given the many millions of lines of codes, Facebook cannot entirely rid its complex system of all 13 risk of software coding errors. So, the relief obtained herein will not eliminate all future 14 breaches or leaks. Though Facebook reports in supplemental briefing that no further breaches 15 related to access tokens have occurred since putting the settlement measures into place, other 16 intrusions of one sort or another will eventually recur. 17 Class counsel characterize their success achieved by settlement as “momentous.” In the 18 Court’s view the success of the settlement seems modest as best and cosmetic at worst. This will 19 be discussed further in connection with the motion for attorney’s fees. 20 The benefit obtained, however, meets the threshold of adequacy in light of the above 21 explained context, as well as the expense to the parties’ and the drain on resources that would 22 result from continued litigation. 23 These proceedings have been ongoing for more than two years and extensive discovery has 24 been taken, including 20 depositions. There has been a motion to dismiss which was granted in 25 part and denied in part, but no dispositive motions. This makes settlement appropriate given the 26 limited relief that could be awarded even if the case were litigated all the way through trial. 27 One individual responded to the notice of class settlement. The objector claims her 1 Facebook submitted a declaration stating the class notice administrator, Angeion Group, LLC, 2 searched data provided by Facebook and could not verify that the objector was a class member 3 (Dkt. 327-2 at 2). Angeion was unable to contact the objector with the email and phone number 4 provided in the objection (Dkt. 327-2 at 2). The objection raises no points that warrant denial of 5 settlement because the objector remains free under the settlement to independently pursue any 6 claim for damages. 7 2. ATTORNEY’S FEES AND COSTS 8 In the class settlement agreement, Facebook agreed to pay attorney’s fees and costs 9 awarded by the Court to “Class Counsel” (Dkt. 315-5 at § 7.4):

10 Facebook shall pay the attorneys’ fees, costs, and expenses awarded by the Court to Class Counsel. 11 12 The agreement further defined “Class Counsel” as (Dkt. 315-5 at § 1.6):

13 “Class Counsel” and “Lead Settlement Class Counsel” mean John Yanchunis of Morgan & Morgan Complex Litigation Group, 14 Ariana Tadler of Tadler Law LLP, and Andrew Friedman of Cohen Milstein Sellers & Toll PLLC. 15 16 This definition tracked the definition in the class certification order that had appointed these very 17 lawyers, describing them as “class counsel” (Dkt. 260 at 16). 18 This order will, accordingly, award all reasonable attorney’s fees, costs, and expenses to 19 class counsel but will not do so for lawyers other than class counsel. 20 Although most of the work appears to have been done by class counsel, the application 21 includes time and expenses for 17 law firms and over 100 timekeepers, including law firms that 22 represented one or more early plaintiffs (all but one of whom eventually withdrew or were 23 dismissed). None of these other firms were ever designated as class counsel. 24 Applicants, however, answer that the work of class counsel was farmed out to many of 25 these other firms, and therefore seek to include them, albeit after the fact. At the recent hearing, 26 Attorney de Bartolomeo stated (Tr. ):

27 [Counsel] may not have done as clear a job as we would have liked appointed, I see it's ECF Number 72 which [counsel] submitted to 1 the Court at the appointment time, advising that there was going to be committee structure and other firms would be working under 2 the guidance and direction of the co-leads.

3 So I would just point that out. So if the Court wants to consider that, [counsel] did advise that there would be additional 4 lawyers. 5 (Dkt. 348, Tr. at 35). Therefore, applicants say, Facebook should pay the committee members 6 for their work. 7 This is not quite what the record shows. 8 Under Rule 23, there is a difference between “class counsel” versus “interim counsel.” 9 Class counsel refers to counsel appointed at the time of class certification by the district court to 10 represent the certified class through discovery, pretrial, trial, and appeal and must, where there 11 are more than one applicant, be the counsel “best able to represent the interests of the class.” By 12 contrast, “interim counsel” refers to counsel “to act on behalf of a putative class before 13 determining whether to certify the action as a class action.” Interim counsel are the exception 14 and not the rule. (Class counsel are not only the rule but mandatory.) Interim counsel are 15 usually helpful early on when a number of related actions are moving toward consolidation. 16 Interim counsel can act as a coordinator for the jumble of cases. But once the cases are 17 consolidated and class counsel expressly appointed, interim counsel disappear and there is no 18 need for coordination. 19 During an early case management conference on January 12, 2019, counsel said they 20 would move to be interim counsel to help coordinate the various cases. The Court replied: 21 But we do need a motion for interim counsel from the plaintiffs’ 22 side on this coordinated thing, and I want you all to come up with something . . . I'll give you my lecture on the plaintiffs’ side. I like 23 streamlined. One lawyer, one firm is the best. Now, maybe you don't want to give me that. Okay, I can maybe live with two, but 24 what we can't have is a top-heavy structure that is going to rack up big fees, and I don't like that. That's just a waste of money. 25 So you need to think of a good system, even for the interim 26 counsel part, to avoid the problem of a top-heavy plaintiff counsel structure. Please take that to heart. I don't know enough about this 27 case to tell you how that applies here, but . . . some just say, oh, 1 The other is, whoever is the lead counsel for interim 2 counsel purposes is not necessarily who will wind up being the lead for the class on Rule 23. Some . . . could be, but I would be 3 open to someone else taking that role as well. So you need to make that motion pronto. You can do that soon in order for us to 4 be able to work out some of these problems that are probably going to come up in the next four weeks. 5 6 In response, Attorney McNamara of Cohen Milstein stated, “That is helpful guidance, and we 7 will abide by it” (Dkt. 71, at 114-15). 8 Three days later, on January 15, 2019, counsel filed their motion to appoint John 9 Yanchunis of Morgan & Morgan, Ariana Tadler of Milberg Tadler Phillips Grossman LLP, and 10 Andrew Friedman of Cohen Milstein Sellers & Toll, PLLC as “interim counsel” (Dkt. 72). At 11 the end of the attachments to that motion, counsel included a table depicting a committee 12 structure for delegating work across 17 law firms and a protocol for time and expense reporting 13 (Dkt 72, Exhs. 5, 6). The protocol included the statement “before you expend any time in this 14 litigation for which you may seek compensation, you must obtain written approval in advance 15 from Co-Lead Counsel” (Dkt. 72, Exh. 6) (emphasis in original). The full section read (Dkt. 72, 16 Exh. 6):

17 As fiduciaries to the proposed Class, we are obligated to litigate this case effectively and efficiently, without unnecessary effort and 18 duplication. Proposed Co-Lead Interim Counsel (“CoLead Counsel”) have, therefore, prepared this protocol to ensure those 19 goals. We will strictly adhere to these directives. Accordingly, before you expend any time in this litigation for which you may 20 seek compensation, you must obtain written approval in advance from Co-Lead Counsel. Moreover, the written approval must 21 clearly authorize all of the time for which you seek to be compensated. If you have any doubts about whether your time has 22 been so authorized, please reach out to us for clarification.

23 Simply reporting the time does not mean a firm will be paid for that time or that such time will be included in any fee 24 application. We will not be able to include in any fee petition any time that is not expended and timely reported in accordance with 25 this protocol. Further, CoLead Counsel will evaluate the propriety of all reported time to ensure that the tasks were efficiently 26 handled and the time is reasonable. 27 1 On February 14, the Court approved the proposed interim counsel (Dkt. 79). That order 2 acknowledged that (Dkt. 79 at 4): 3

4 [C]ounsel have committed to expending resources to represent the putative class. Counsel have already retained experts and have 5 tentatively created and assigned committees with the existing firms involved in this action (each to be led and supervised by one of the 6 proposed counsel), to meet the deadlines set by the case management order. To date, proposed counsel have managed this 7 litigation with the unanimous support of all counsel in the consolidated cases. Counsel have also prepared protocols to 8 govern timekeeping, monthly submission of time records, and other administrative tasks. 9 10 The order again “remind[ed] interim counsel that, as usual, duplicative or excessive requests 11 for attorney’s fees will be looked upon with disfavor” (Dkt. 79 at 4). 12 The committee structure made sense at the interim stage under Rule 23(g)(3) so as to allow 13 more lawyers to have a shot at becoming class counsel and to give various contenders a role 14 prior to selection of class counsel at the certification stage. All of the above occurred before any 15 motion for class certification. 16 Many months later at the class certification stage, interim counsel moved to certify a 17 damages class and argued for the adequacy of the existing interim counsel for the continued 18 representation of the class (Dkt. 197-4). The motion for class certification simply stated, 19 “Proposed class counsel, approved by this Court as interim counsel, are experienced class action 20 attorneys and are committed to prosecuting this case,” recited class counsel’s work on the case 21 up to that point, and concluded that “[p]laintiff and proposed Class Counsel meet the adequacy 22 requirement” (Dkt. 197-4 at 14). No mention was made of any committee structure. 23 The Court’s order certifying a class and appointing class counsel, unlike the interim order, 24 did not approve or refer to any committee structure (Dkt. 260). That order stated (Dkt. 260 at 25 16):

26 Plaintiff’s counsel Andrew Friedman of Cohen Milstein Sellers & Toll PLLC, John Yanchunis of Morgan & Morgan Complex 27 Litigation Group, and Ariana Tadler of Tadler Law LLP are hereby This definition is the very definition used in the settlement agreement — three firms and three 1 2 firms only. Attorney de Bartolomeo was incorrect, therefore, in suggesting that the applications 3 for class counsel informed the Court that a committee would assist class counsel. Although the 4 committee structure surfaced in the interim motion (and resulting order appointing interim 5 counsel), no references were made to a committee in the later motion for appointment of class 6 counsel (or in the resulting order appointing class counsel). Class counsel were specifically 7 called out as the three firm in the order. 8 It was therefore improper for class counsel to delegate class representation after 9 10 appointment. Any work farmed out to lawyers other than class counsel shall not be included in 11 the lodestar. 12 Turning to the work of class counsel, our review even for work by class counsel raises 13 questions concerning reasonableness of time spent and costs requested. For example: 14 • Class counsel seeks compensation for the cost of flying 20 15 attorneys to a two-hour all-hands meeting in Chicago. Apparently, none of the attorneys or firms were already located there. Though 16 there exists a real need to coordinate law firms before the appointment of class counsel, this meeting could have been 17 conducted telephonically. 18 • Class counsel seek reimbursement of $5,643.06 in hotel costs for a 19 single attorney to attend a Case Management Conference, among other unexplained high hotel charges. 20

21 These are but two examples. The special master shall scrutinize the entire lodestar of class 22 counsel to reduce it to a reasonable amount. 23 The benefit obtained for the class is of foremost importance in determining the 24 reasonableness of fees so “where the plaintiff has achieved only limited success, counting all 25 hours expended on the litigation — even those reasonably spent — may produce an excessive 26 amount, and the Supreme Court has instructed district courts to instead award only that amount 27 of fees that is reasonable in relation to the results obtained.” In re Bluetooth Headset Prod. 1 what Facebook would have done anyway. In the preliminary settlement approval and in their 2 supplemental briefing, both parties explained that Facebook voluntarily adopted most of the 3 security measures upon the recommendation of a working group created in 2018. Though 4 many of the security measures came about after the filing of complaints related to the breach, 5 class counsel do not state that these measures arose specifically from settlement discussions. 6 In fact, two of the settlement terms were practices Facebook had been using even before the 7 breach occurred (undergoing annual security assessments and board oversight of cybersecurity) 8 (Dkt. 334 at 5, Dkt. at 7). The only truly novel element of the settlement agreement is the 9 involvement of the Court, class counsel, and an independent monitor in ensuring that Facebook 10 maintains the security measures they would have implemented anyway. 11 Again, what Facebook did wrong was a coding mistake, not an attempt to sell users’ 12 private information. Most claims got dismissed. No damages class got certified. What 13 survived for trial was a negligence claim and a claim for declaratory and injunctive relief. The 14 settlement implicates limited aspects of Facebook’s overall data security responsibilities — 15 those related to access tokens — and provides neither monetary damages nor individualized 16 credit monitoring for class members. In light of the thinness of the surviving claims and 17 limited class certification obtained, the settlement itself is understandably thin as well but 18 acceptable in view of the probable merits, but the benefit achieved in this case for the class is 19 modest. Class counsel waxed poetic about the complexity, technicality, and novelty of the data 20 security issues presented in this case, but note well the settlement calls for only pocket change 21 to the monitor who will ensure that Facebook abides by the settlement terms. That amount is 22 merely $15,000 over five years. This is further evidence of a cosmetic settlement. 23 This order will allow recover for all of the reasonable time incurred by class counsel in 24 the case (without reduction for limited success) because Facebook agreed to pay it in the 25 settlement agreement. But no bonus or multiplier will be allowed in view of the limited 26 success in this case (even if the agreement could be stretched to cover a bonus or multiplier). 27 3. INCENTIVE AWARD 1 Incentive awards pose the risk that a class representative has gone along with a settlement, 2 not because it secures a good outcome for the class, but simply for the incentive award. Such 3 awards should therefore be subject to careful scrutiny. This order finds the $5,000 incentive 4 award for plaintiff Adkins unreasonably high. A reasonable amount is $500 in order to 5 compensate plaintiff Adkins for the use of his vacation time from work to travel to San Francisco 6 for proceedings and his role in discovery (including allowing his phone to be forensically 7 examined). 8 4. SPECIAL MASTER APPOINTMENT 9 The companion order appointing a special master gives further instruction on how billing 10 entries must be organized. A review of the excel document submitted in camera suggests that 11 the time keeping in this case was relatively thorough, but class counsel should resubmit their 12 billing records to align the instructions set out in the companion order if needed. 13 CONCLUSION 14 The final settlement is APPROVED and class counsel’s fees motion is GRANTED in part as 15 to entitlement of class counsel (and class counsel only), but DENIED as to amount. The special 16 master will recalculate fees and costs to a reasonable sum based on the foregoing considerations 17 and the companion order. 18

19 IT IS SO ORDERED. 20

21 Dated: 22

23 WILLIAM ALSUP UNITED STATES DISTRICT JUDGE 24 25 26 27