Adkins v. Facebook, Inc.

Opinion

NORTHERN DISTRICT OF CALIFORNIA

No. C 18–05982 WHA Plaintiff,

v. FINAL SETTLEMENT APPROVAL AND ORDER GRANTING IN PART FACEBOOK, INC., AND DENYING IN PART MOTION FOR ATTORNEY’S FEES Defendant.

Both sides seek final approval of a class action settlement and class counsel seek a large sum in fees and costs. A coding error allowed hackers to break into the Facebook platform and pilfer the personal information of millions of users in the United States. This came to light in 2018, leading to a flurry of complaints. A prior order explained the coding vulnerability responsible for the data breach (Dkt. 153). In brief, if three particular features on the Facebook platform aligned access to accounts. The compromising of access tokens made millions of users accounts vulnerable to entry (Dkt. 193). A consolidated complaint sought relief in the form of a credit monitoring service for the victims, in addition to compensatory, statutory, and punitive damages, and declaratory relief based on ten claims. To this end, counsel moved to certify a class of users whose information had been compromised. An order declined to certify a damages class but allowed an injunctive relief class. Users were left to pursue damages claims on their own but no one ever filed one (Dkt. 338 at 4). All but two of plaintiffs’ claims were dismissed and by the time the case settled, only one named class representative remained out of the 11 plaintiffs involved in the case after consolidation. The terms of the settlement included commitments by Facebook to prevent future vulnerabilities related specifically to access tokens and consent to be independently monitored. More specifically, Facebook’s security commitments include (Dkt. 315-5 at 27-29):

1. Tools to run integrity checks on updates

2. Tools for the detection of suspicious patterns in the generation and use of access tokens 3. Procedures to contain security incidents related to improper issuance of access tokens

4. Automatic alerts for suspicious activity in user growth metrics and reporting on that activity 5. Five years of annual SOC2 Type II security assessments of certain products related to security and vulnerability management and an agreement to report the results to the Court and class counsel

6. Processes that give applications related to access tokens only the capabilities to perform intended functions, including internal guidance to software engineers for selecting capabilities of applications using access tokens and automatic removal of access token capabilities for applications that do not use those capabilities over a 90-day period

7. Certification by Facebook that it eliminated the type of authentication proofs which made user credentials vulnerable

8. Commitment to employing at least one senior security 9. Logging issuance and receipt of access tokens to facilitate detection and investigation of compromised access tokens Class counsel also move for attorney’s fees in the amount of $10,700,000 (based on a 1.253 multiplier), $1,210,900.75 in costs, a reserve of $15,000 for a data security vendor to monitor compliance with the settlement terms (by way of the SOC2 Type II assessments), and a $5,000 service award for plaintiff Stephen Adkins (Br. at 2–3). ANAYLSIS After the coding error in the Facebook platform exposed users to possible loss of personal information, at least ten civil actions were immediately filed in this district and consolidated. A previous order certified a class seeking injunctive relief but rejected certification of a damages class. A class settlement followed whereby Facebook agreed to maintain certain security fixes almost all of which Facebook would likely have maintained anyway. This order will approve the settlement as fair and adequate in light of the substantial risks of litigation. All damages claims have been preserved but none have been asserted anywhere by any of the millions potentially affected. This order will also grant reasonable attorney’s fees and expenses for class counsel but not for other lawyers. 1. PROPOSED CLASS SETTLEMENT FINAL APPROVAL Under FRCP 23(e), the Court must approve any settlement agreement that will bind absent class members. In reviewing a proposed settlement agreement, the district court must perform two tasks: (1) direct notice in a reasonable manner to all class members who would be bound by the proposal; and (2) approve the settlement only after a hearing and on finding that the terms of the agreement are fair, reasonable, and adequate. In determining if a settlement is fair, reasonable, and adequate, district courts take into account (1) the strength of the plaintiffs’ case; (2) the risk, expense, complexity, and likely duration of further litigation; (3) the risk of maintaining class action status throughout the trial; (4) the amount offered in settlement; (5) the extent of discovery completed and the stage of the proceedings; (6) the experience and view of counsel; (7) the presence of a governmental participant; and (8) the reaction of the class members to the proposed settlement. In re Online DVD-Rental Antitrust Litig., 779 F.3d 934, 944 (9th Cir. 2015). A prior order approved the form, content, and planned distribution of the class notice. The claims administrator has fulfilled the notice plan. This order further finds that notice to class members was adequate. For the following reasons and for the reasons stated in the November 2020 order (Dkt. 314), the proposed class settlement is fair, reasonable, and adequate under FRCP 23(e). In considering the strength of plaintiff’s case, this order notes that what Facebook did wrong was not an intentional betrayal of its users for profit. At most Facebook was negligent in allowing a confluence of rare circumstances to open up access tokens to strangers and, arguably, being too slow to catch this vulnerability. The heart of this case was a software coding mistake. Given the many millions of lines of codes, Facebook cannot entirely rid its complex system of all risk of software coding errors. So, the relief obtained herein will not eliminate all future breaches or leaks. Though Facebook reports in supplemental briefing that no further breaches related to access tokens have occurred since putting the settlement measures into place, other intrusions of one sort or another will eventually recur. Class counsel characterize their success achieved by settlement as “momentous.” In the Court’s view the success of the settlement seems modest as best and cosmetic at worst. This will be discussed further in connection with the motion for attorney’s fees. The benefit obtained, however, meets the threshold of adequacy in light of the above explained context, as well as the expense to the parties’ and the drain on resources that would result from continued litigation. These proceedings have been ongoing for more than two years and extensive discovery has been taken, including 20 depositions. There has been a motion to dismiss which was granted in part and denied in part, but no dispositive motions. This makes settlement appropriate given the limited relief that could be awarded even if the case were litigated all the way through trial. One individual responded to the notice of class settlement. The objector claims her Facebook submitted a declaration stating the class notice administrator, Angeion Group, LLC, searched data provided by Facebook and could not verify that the objector was a class member (Dkt. 327-2 at 2). Angeion was unable to contact the objector with the email and phone number provided in the objection (Dkt. 327-2 at 2). The objection raises no points that warrant denial of settlement because the objector remains free under the settlement to independently pursue any claim for damages. 2. ATTORNEY’S FEES AND COSTS In the class settlement agreement, Facebook agreed to pay attorney’s fees and costs awarded by the Court to “Class Counsel” (Dkt. 315-5 at § 7.4):

Facebook shall pay the attorneys’ fees, costs, and expenses awarded by the Court to Class Counsel. The agreement further defined “Class Counsel” as (Dkt. 315-5 at § 1.6):

“Class Counsel” and “Lead Settlement Class Counsel” mean John Yanchunis of Morgan & Morgan Complex Litigation Group, Ariana Tadler of Tadler Law LLP, and Andrew Friedman of Cohen Milstein Sellers & Toll PLLC. This definition tracked the definition in the class certification order that had appointed these very lawyers, describing them as “class counsel” (Dkt. 260 at 16). This order will, accordingly, award all reasonable attorney’s fees, costs, and expenses to class counsel but will not do so for lawyers other than class counsel. Although most of the work appears to have been done by class counsel, the application includes time and expenses for 17 law firms and over 100 timekeepers, including law firms that represented one or more early plaintiffs (all but one of whom eventually withdrew or were dismissed). None of these other firms were ever designated as class counsel. Applicants, however, answer that the work of class counsel was farmed out to many of these other firms, and therefore seek to include them, albeit after the fact. At the recent hearing, Attorney de Bartolomeo stated (Tr. ):

[Counsel] may not have done as clear a job as we would have liked appointed, I see it's ECF Number 72 which [counsel] submitted to the Court at the appointment time, advising that there was going to be committee structure and other firms would be working under the guidance and direction of the co-leads.

So I would just point that out. So if the Court wants to consider that, [counsel] did advise that there would be additional lawyers. (Dkt. 348, Tr. at 35). Therefore, applicants say, Facebook should pay the committee members for their work. This is not quite what the record shows. Under Rule 23, there is a difference between “class counsel” versus “interim counsel.” Class counsel refers to counsel appointed at the time of class certification by the district court to represent the certified class through discovery, pretrial, trial, and appeal and must, where there are more than one applicant, be the counsel “best able to represent the interests of the class.” By contrast, “interim counsel” refers to counsel “to act on behalf of a putative class before determining whether to certify the action as a class action.” Interim counsel are the exception and not the rule. (Class counsel are not only the rule but mandatory.) Interim counsel are usually helpful early on when a number of related actions are moving toward consolidation. Interim counsel can act as a coordinator for the jumble of cases. But once the cases are consolidated and class counsel expressly appointed, interim counsel disappear and there is no need for coordination. During an early case management conference on January 12, 2019, counsel said they would move to be interim counsel to help coordinate the various cases. The Court replied: But we do need a motion for interim counsel from the plaintiffs’ side on this coordinated thing, and I want you all to come up with something . . . I'll give you my lecture on the plaintiffs’ side. I like streamlined. One lawyer, one firm is the best. Now, maybe you don't want to give me that. Okay, I can maybe live with two, but what we can't have is a top-heavy structure that is going to rack up big fees, and I don't like that. That's just a waste of money. So you need to think of a good system, even for the interim counsel part, to avoid the problem of a top-heavy plaintiff counsel structure. Please take that to heart. I don't know enough about this case to tell you how that applies here, but . . . some just say, oh, The other is, whoever is the lead counsel for interim counsel purposes is not necessarily who will wind up being the lead for the class on Rule 23. Some . . . could be, but I would be open to someone else taking that role as well. So you need to make that motion pronto. You can do that soon in order for us to be able to work out some of these problems that are probably going to come up in the next four weeks. In response, Attorney McNamara of Cohen Milstein stated, “That is helpful guidance, and we will abide by it” (Dkt. 71, at 114-15). Three days later, on January 15, 2019, counsel filed their motion to appoint John Yanchunis of Morgan & Morgan, Ariana Tadler of Milberg Tadler Phillips Grossman LLP, and Andrew Friedman of Cohen Milstein Sellers & Toll, PLLC as “interim counsel” (Dkt. 72). At the end of the attachments to that motion, counsel included a table depicting a committee structure for delegating work across 17 law firms and a protocol for time and expense reporting (Dkt 72, Exhs. 5, 6). The protocol included the statement “before you expend any time in this litigation for which you may seek compensation, you must obtain written approval in advance from Co-Lead Counsel” (Dkt. 72, Exh. 6) (emphasis in original). The full section read (Dkt. 72, Exh. 6):

As fiduciaries to the proposed Class, we are obligated to litigate this case effectively and efficiently, without unnecessary effort and duplication. Proposed Co-Lead Interim Counsel (“CoLead Counsel”) have, therefore, prepared this protocol to ensure those goals. We will strictly adhere to these directives. Accordingly, before you expend any time in this litigation for which you may seek compensation, you must obtain written approval in advance from Co-Lead Counsel. Moreover, the written approval must clearly authorize all of the time for which you seek to be compensated. If you have any doubts about whether your time has been so authorized, please reach out to us for clarification.

Simply reporting the time does not mean a firm will be paid for that time or that such time will be included in any fee application. We will not be able to include in any fee petition any time that is not expended and timely reported in accordance with this protocol. Further, CoLead Counsel will evaluate the propriety of all reported time to ensure that the tasks were efficiently handled and the time is reasonable. On February 14, the Court approved the proposed interim counsel (Dkt. 79). That order acknowledged that (Dkt. 79 at 4):

[C]ounsel have committed to expending resources to represent the putative class. Counsel have already retained experts and have tentatively created and assigned committees with the existing firms involved in this action (each to be led and supervised by one of the proposed counsel), to meet the deadlines set by the case management order. To date, proposed counsel have managed this litigation with the unanimous support of all counsel in the consolidated cases. Counsel have also prepared protocols to govern timekeeping, monthly submission of time records, and other administrative tasks. The order again “remind[ed] interim counsel that, as usual, duplicative or excessive requests for attorney’s fees will be looked upon with disfavor” (Dkt. 79 at 4). The committee structure made sense at the interim stage under Rule 23(g)(3) so as to allow more lawyers to have a shot at becoming class counsel and to give various contenders a role prior to selection of class counsel at the certification stage. All of the above occurred before any motion for class certification. Many months later at the class certification stage, interim counsel moved to certify a damages class and argued for the adequacy of the existing interim counsel for the continued representation of the class (Dkt. 197-4). The motion for class certification simply stated, “Proposed class counsel, approved by this Court as interim counsel, are experienced class action attorneys and are committed to prosecuting this case,” recited class counsel’s work on the case up to that point, and concluded that “[p]laintiff and proposed Class Counsel meet the adequacy requirement” (Dkt. 197-4 at 14). No mention was made of any committee structure. The Court’s order certifying a class and appointing class counsel, unlike the interim order, did not approve or refer to any committee structure (Dkt. 260). That order stated (Dkt. 260 at 16):

Plaintiff’s counsel Andrew Friedman of Cohen Milstein Sellers & Toll PLLC, John Yanchunis of Morgan & Morgan Complex Litigation Group, and Ariana Tadler of Tadler Law LLP are hereby This definition is the very definition used in the settlement agreement — three firms and three firms only. Attorney de Bartolomeo was incorrect, therefore, in suggesting that the applications for class counsel informed the Court that a committee would assist class counsel. Although the committee structure surfaced in the interim motion (and resulting order appointing interim counsel), no references were made to a committee in the later motion for appointment of class counsel (or in the resulting order appointing class counsel). Class counsel were specifically called out as the three firm in the order. It was therefore improper for class counsel to delegate class representation after appointment. Any work farmed out to lawyers other than class counsel shall not be included in the lodestar. Turning to the work of class counsel, our review even for work by class counsel raises questions concerning reasonableness of time spent and costs requested. For example: • Class counsel seeks compensation for the cost of flying 20 attorneys to a two-hour all-hands meeting in Chicago. Apparently, none of the attorneys or firms were already located there. Though there exists a real need to coordinate law firms before the appointment of class counsel, this meeting could have been conducted telephonically. • Class counsel seek reimbursement of $5,643.06 in hotel costs for a single attorney to attend a Case Management Conference, among other unexplained high hotel charges.

These are but two examples. The special master shall scrutinize the entire lodestar of class counsel to reduce it to a reasonable amount. The benefit obtained for the class is of foremost importance in determining the reasonableness of fees so “where the plaintiff has achieved only limited success, counting all hours expended on the litigation — even those reasonably spent — may produce an excessive amount, and the Supreme Court has instructed district courts to instead award only that amount of fees that is reasonable in relation to the results obtained.” In re Bluetooth Headset Prod. what Facebook would have done anyway. In the preliminary settlement approval and in their supplemental briefing, both parties explained that Facebook voluntarily adopted most of the security measures upon the recommendation of a working group created in 2018. Though many of the security measures came about after the filing of complaints related to the breach, class counsel do not state that these measures arose specifically from settlement discussions. In fact, two of the settlement terms were practices Facebook had been using even before the breach occurred (undergoing annual security assessments and board oversight of cybersecurity) (Dkt. 334 at 5, Dkt. at 7). The only truly novel element of the settlement agreement is the involvement of the Court, class counsel, and an independent monitor in ensuring that Facebook maintains the security measures they would have implemented anyway. Again, what Facebook did wrong was a coding mistake, not an attempt to sell users’ private information. Most claims got dismissed. No damages class got certified. What survived for trial was a negligence claim and a claim for declaratory and injunctive relief. The settlement implicates limited aspects of Facebook’s overall data security responsibilities — those related to access tokens — and provides neither monetary damages nor individualized credit monitoring for class members. In light of the thinness of the surviving claims and limited class certification obtained, the settlement itself is understandably thin as well but acceptable in view of the probable merits, but the benefit achieved in this case for the class is modest. Class counsel waxed poetic about the complexity, technicality, and novelty of the data security issues presented in this case, but note well the settlement calls for only pocket change to the monitor who will ensure that Facebook abides by the settlement terms. That amount is merely $15,000 over five years. This is further evidence of a cosmetic settlement. This order will allow recover for all of the reasonable time incurred by class counsel in the case (without reduction for limited success) because Facebook agreed to pay it in the settlement agreement. But no bonus or multiplier will be allowed in view of the limited success in this case (even if the agreement could be stretched to cover a bonus or multiplier). 3. INCENTIVE AWARD Incentive awards pose the risk that a class representative has gone along with a settlement, not because it secures a good outcome for the class, but simply for the incentive award. Such awards should therefore be subject to careful scrutiny. This order finds the $5,000 incentive award for plaintiff Adkins unreasonably high. A reasonable amount is $500 in order to compensate plaintiff Adkins for the use of his vacation time from work to travel to San Francisco for proceedings and his role in discovery (including allowing his phone to be forensically examined). 4. SPECIAL MASTER APPOINTMENT The companion order appointing a special master gives further instruction on how billing entries must be organized. A review of the excel document submitted in camera suggests that the time keeping in this case was relatively thorough, but class counsel should resubmit their billing records to align the instructions set out in the companion order if needed. CONCLUSION The final settlement is APPROVED and class counsel’s fees motion is GRANTED in part as to entitlement of class counsel (and class counsel only), but DENIED as to amount. The special master will recalculate fees and costs to a reasonable sum based on the foregoing considerations and the companion order.

IT IS SO ORDERED.

Dated:

UNITED STATES DISTRICT JUDGE