NOT FOR PUBLICATION FILED UNITED STATES COURT OF APPEALS MAY 15 2020 MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS FOR THE NINTH CIRCUIT
DIANA HAUCK, et al., No. 19-16124
Plaintiffs-Appellants, D.C. Nos. 5:18-cv-00447-LHK 5:18-cv-00744-LHK v. 5:18-cv-00883-LHK
ADVANCED MICRO DEVICES, INC., MEMORANDUM* Defendant-Appellee.
Appeal from the United States District Court for the Northern District of California Lucy H. Koh, District Judge, Presiding
Submitted May 13, 2020** San Francisco, California
Before: FRIEDLAND and BENNETT, Circuit Judges, and RAKOFF,*** District Judge.
Plaintiffs-Appellants, each of whom had purchased a computer processor
manufactured by Defendant-Appellee Advanced Micro Devices, Inc. (“AMD”) or
* This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. ** The panel unanimously concludes this case is suitable for decision without oral argument. See Fed. R. App. P. 34(a)(2). *** The Honorable Jed S. Rakoff, United States District Judge for the Southern District of New York, sitting by designation. a device containing such a processor, filed this putative class action alleging
various state law claims arising out of alleged defects in those AMD processors.1
Like all major computer processor manufacturers, AMD employs branch
prediction, speculative execution, and caches in its processors’ microarchitecture.
Plaintiffs’ operative second amended complaint alleges that AMD processors are
defective because their reliance on these features renders the processors vulnerable
to cybersecurity attacks in which attackers (1) artificially induce mis-speculation to
influence what metadata a processor stores, and then (2) launch side-channel
attacks to deduce users’ underlying sensitive information from that metadata.
Plaintiffs allege that this vulnerability was publicized to consumers in January
2018, and Plaintiffs acknowledge that the type of attack the processors were
vulnerable to was commonly referred to as a Spectre attack. Plaintiffs do not
allege that any such attack has successfully compromised their data or any other
consumer’s data. Instead, their claims are premised on allegations that they would
not have purchased their devices or would have paid less for them if they had
1 Plaintiffs-Appellants are citizens of four different states and assert state law claims corresponding to their respective domiciles. We refer to Plaintiff-Appellant Diana Hauck as the “Louisiana Plaintiff,” Plaintiffs-Appellants Shon Elliott, Michael Garcia, and Joann Martinelli as the “California Plaintiffs,” Plaintiff- Appellant Benjamin Pollack as the “Florida Plaintiff,” and Plaintiff-Appellant Jonathan Caskey-Medina as the “Massachusetts Plaintiff.” Each plaintiff group asserts claims on behalf of the named plaintiffs from the corresponding state, a nationwide class, and a state class.
2 known about the defect, and on allegations that the defect prompted them to install
third-party patches that then caused their processors’ performance to worsen.
The district court granted AMD’s motion to dismiss the claims in Plaintiffs’
second amended complaint that the parties had identified as bellwether claims,
entered a partial final judgment pursuant to Federal Rule of Civil Procedure 54(b),
and certified this matter for immediate appeal. Plaintiffs timely appealed.
Reviewing de novo, see Davidson v. Kimberly-Clark Corp., 889 F.3d 956, 963 (9th
Cir. 2018), we affirm.
1. Plaintiffs have adequately alleged Article III standing as to their claims
for damages. Plaintiffs’ allegations that their devices degraded in performance
after they installed third-party patches to attempt to mitigate their processors’
vulnerability to the alleged defect are sufficient to establish an injury in fact that is
“concrete and particularized” and “actual or imminent, not conjectural or
hypothetical.” Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528
U.S. 167, 180 (2000). That injury is “fairly traceable” to the design of AMD
processors. Id. Although it is possible, as AMD suggests, that the age of
Plaintiffs’ computers or other issues with the third-party patches were partially
responsible for the performance losses, Plaintiffs allege an adequate causal
connection between their learning about the vulnerabilities resulting from the
microarchitecture of AMD’s processors and their alleged injury to establish
3 standing at this juncture. See Mendia v. Garcia, 768 F.3d 1009, 1014-15 (9th Cir.
2014). Finally, Plaintiffs’ claimed injury, if proven, would be redressable through
damages. See Jewel v. Nat’l Sec. Agency, 673 F.3d 902, 908, 912 (9th Cir. 2011).
2. The district court did not err in concluding that, to the extent Plaintiffs’
second amended complaint alleged that AMD processors were defective for the
reason that their caches are vulnerable to side-channel attacks generally and not
only Spectre-like attacks in particular, or because of other some other subset of
their features, Plaintiffs failed to allege the nature of the defect with sufficient
specificity to state any of their claims sounding in fraud under the heightened
pleading standard of Federal Rule of Civil Procedure 9(b).
3. The district court did not err in dismissing for failure to state a claim the
California Plaintiffs’ claims for violation of the unfair business practices prong of
the Unfair Competition Law (“UCL”) and for fraud by omission under California
law. The fraud by omission claim was properly dismissed for failure to plausibly
allege the existence of any of the relevant bases for a fraud claim set forth in
LiMandri v. Judkins, 60 Cal. Rptr. 2d 539 (Ct. App. 1997). The California
Plaintiffs do not allege that AMD is their fiduciary. See id. at 543. Nor are their
allegations sufficient to establish either AMD’s knowledge or active concealment
of the defect. See id. Although the California Plaintiffs allege that AMD was
aware of some of the vulnerabilities created by its design choices, they do not
4 plausibly allege that AMD knew of the specific vulnerability identified in their
second amended complaint until that vulnerability was disclosed to AMD in June
2017, which was after the California Plaintiffs had made their purchases. Nor do
the California Plaintiffs plausibly allege that AMD “suppresse[d]” material facts
regarding that specific defect. See id. (quoting Heliotis v. Schuman, 226 Cal. Rptr.
509, 512 (Ct. App. 1986)).
To the extent the California Plaintiffs’ unfair business practices UCL claim
is not also grounded in fraud, it was nevertheless properly dismissed, because the
California Plaintiffs have not stated a plausible claim that AMD engaged in an
unfair business practice under either the “tether[ing]” or the “balancing” tests. See
Lozano v. AT&T Wireless Servs., Inc., 504 F.3d 718
Free access — add to your briefcase to read the full text and ask questions with AI
NOT FOR PUBLICATION FILED UNITED STATES COURT OF APPEALS MAY 15 2020 MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS FOR THE NINTH CIRCUIT
DIANA HAUCK, et al., No. 19-16124
Plaintiffs-Appellants, D.C. Nos. 5:18-cv-00447-LHK 5:18-cv-00744-LHK v. 5:18-cv-00883-LHK
ADVANCED MICRO DEVICES, INC., MEMORANDUM* Defendant-Appellee.
Appeal from the United States District Court for the Northern District of California Lucy H. Koh, District Judge, Presiding
Submitted May 13, 2020** San Francisco, California
Before: FRIEDLAND and BENNETT, Circuit Judges, and RAKOFF,*** District Judge.
Plaintiffs-Appellants, each of whom had purchased a computer processor
manufactured by Defendant-Appellee Advanced Micro Devices, Inc. (“AMD”) or
* This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. ** The panel unanimously concludes this case is suitable for decision without oral argument. See Fed. R. App. P. 34(a)(2). *** The Honorable Jed S. Rakoff, United States District Judge for the Southern District of New York, sitting by designation. a device containing such a processor, filed this putative class action alleging
various state law claims arising out of alleged defects in those AMD processors.1
Like all major computer processor manufacturers, AMD employs branch
prediction, speculative execution, and caches in its processors’ microarchitecture.
Plaintiffs’ operative second amended complaint alleges that AMD processors are
defective because their reliance on these features renders the processors vulnerable
to cybersecurity attacks in which attackers (1) artificially induce mis-speculation to
influence what metadata a processor stores, and then (2) launch side-channel
attacks to deduce users’ underlying sensitive information from that metadata.
Plaintiffs allege that this vulnerability was publicized to consumers in January
2018, and Plaintiffs acknowledge that the type of attack the processors were
vulnerable to was commonly referred to as a Spectre attack. Plaintiffs do not
allege that any such attack has successfully compromised their data or any other
consumer’s data. Instead, their claims are premised on allegations that they would
not have purchased their devices or would have paid less for them if they had
1 Plaintiffs-Appellants are citizens of four different states and assert state law claims corresponding to their respective domiciles. We refer to Plaintiff-Appellant Diana Hauck as the “Louisiana Plaintiff,” Plaintiffs-Appellants Shon Elliott, Michael Garcia, and Joann Martinelli as the “California Plaintiffs,” Plaintiff- Appellant Benjamin Pollack as the “Florida Plaintiff,” and Plaintiff-Appellant Jonathan Caskey-Medina as the “Massachusetts Plaintiff.” Each plaintiff group asserts claims on behalf of the named plaintiffs from the corresponding state, a nationwide class, and a state class.
2 known about the defect, and on allegations that the defect prompted them to install
third-party patches that then caused their processors’ performance to worsen.
The district court granted AMD’s motion to dismiss the claims in Plaintiffs’
second amended complaint that the parties had identified as bellwether claims,
entered a partial final judgment pursuant to Federal Rule of Civil Procedure 54(b),
and certified this matter for immediate appeal. Plaintiffs timely appealed.
Reviewing de novo, see Davidson v. Kimberly-Clark Corp., 889 F.3d 956, 963 (9th
Cir. 2018), we affirm.
1. Plaintiffs have adequately alleged Article III standing as to their claims
for damages. Plaintiffs’ allegations that their devices degraded in performance
after they installed third-party patches to attempt to mitigate their processors’
vulnerability to the alleged defect are sufficient to establish an injury in fact that is
“concrete and particularized” and “actual or imminent, not conjectural or
hypothetical.” Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528
U.S. 167, 180 (2000). That injury is “fairly traceable” to the design of AMD
processors. Id. Although it is possible, as AMD suggests, that the age of
Plaintiffs’ computers or other issues with the third-party patches were partially
responsible for the performance losses, Plaintiffs allege an adequate causal
connection between their learning about the vulnerabilities resulting from the
microarchitecture of AMD’s processors and their alleged injury to establish
3 standing at this juncture. See Mendia v. Garcia, 768 F.3d 1009, 1014-15 (9th Cir.
2014). Finally, Plaintiffs’ claimed injury, if proven, would be redressable through
damages. See Jewel v. Nat’l Sec. Agency, 673 F.3d 902, 908, 912 (9th Cir. 2011).
2. The district court did not err in concluding that, to the extent Plaintiffs’
second amended complaint alleged that AMD processors were defective for the
reason that their caches are vulnerable to side-channel attacks generally and not
only Spectre-like attacks in particular, or because of other some other subset of
their features, Plaintiffs failed to allege the nature of the defect with sufficient
specificity to state any of their claims sounding in fraud under the heightened
pleading standard of Federal Rule of Civil Procedure 9(b).
3. The district court did not err in dismissing for failure to state a claim the
California Plaintiffs’ claims for violation of the unfair business practices prong of
the Unfair Competition Law (“UCL”) and for fraud by omission under California
law. The fraud by omission claim was properly dismissed for failure to plausibly
allege the existence of any of the relevant bases for a fraud claim set forth in
LiMandri v. Judkins, 60 Cal. Rptr. 2d 539 (Ct. App. 1997). The California
Plaintiffs do not allege that AMD is their fiduciary. See id. at 543. Nor are their
allegations sufficient to establish either AMD’s knowledge or active concealment
of the defect. See id. Although the California Plaintiffs allege that AMD was
aware of some of the vulnerabilities created by its design choices, they do not
4 plausibly allege that AMD knew of the specific vulnerability identified in their
second amended complaint until that vulnerability was disclosed to AMD in June
2017, which was after the California Plaintiffs had made their purchases. Nor do
the California Plaintiffs plausibly allege that AMD “suppresse[d]” material facts
regarding that specific defect. See id. (quoting Heliotis v. Schuman, 226 Cal. Rptr.
509, 512 (Ct. App. 1986)).
To the extent the California Plaintiffs’ unfair business practices UCL claim
is not also grounded in fraud, it was nevertheless properly dismissed, because the
California Plaintiffs have not stated a plausible claim that AMD engaged in an
unfair business practice under either the “tether[ing]” or the “balancing” tests. See
Lozano v. AT&T Wireless Servs., Inc., 504 F.3d 718, 735-36 (9th Cir. 2007); Cal.
Bus. & Prof. Code § 17200 et seq. Plaintiffs have not plausibly alleged either the
existence of false advertising or an actual violation of a privacy right, nor have
they plausibly alleged that the harm represented by the theoretical risk of a
cybersecurity flaw that has not yet been successfully exploited outweighs the other
benefits of AMD’s processor design.
4. The Florida Plaintiff’s omission claim under the Florida Deceptive and
Unfair Trade Practices Act (“FDUTPA”), Fla. Stat. § 501.201 et seq., and the
Massachusetts and Florida Plaintiffs’ affirmative misrepresentation claims under
the Massachusetts Consumer Protection Act (“MCPA”), Mass. Gen. Laws ch. 93A,
5 § 1 et seq., and FDUTPA were also properly dismissed. Plaintiffs do not plausibly
allege that AMD’s statements or omissions “offend[ed] established public policy”
or were “immoral, unethical, oppressive, unscrupulous or substantially injurious to
consumers.” PNR, Inc. v. Beacon Prop. Mgmt., Inc., 842 So. 2d 773, 777 (Fla.
2003) (quoting Samuels v. King Motor Co. of Fort Lauderdale, 782 So. 2d 489,
499 (Fla. Dist. Ct. App. 2001)); see also Aspinall v. Philip Morris Cos., 813
N.E.2d 476, 486-87 (Mass. 2004) (“[A] practice is ‘deceptive’ . . . ‘if it could
reasonably be found to have caused a person to act differently from the way he [or
she] otherwise would have acted.’” (last alteration in original) (quoting Purity
Supreme, Inc. v. Attorney Gen., 407 N.E.2d 297, 307 (Mass. 1980))). Nor were
any of the alleged statements or omissions “likely to mislead” consumers “acting
reasonably in the circumstances” to their detriment, given that such consumers
would not plausibly believe that AMD’s clock-speed representations were
premised on any implicit security assurances, or that their devices would be
completely impervious to novel cybersecurity threats. PNR, 842 So. 2d at 777
(quoting Millennium Commc’ns & Fulfillment, Inc. v. Office of Attorney Gen., 761
So. 2d 1256, 1263 (Fla. Dist. Ct. App. 2000)); see also Aspinall, 813 N.E.2d at
486-87.
5. The Massachusetts Plaintiff’s omission claim under the MCPA was
properly dismissed. Given the wide publicity the alleged defect received prior to
6 the Massachusetts Plaintiff’s purchase of his AMD processor and the absence of
plausible allegations that consumers would have believed their devices were not
susceptible to any cybersecurity threats, the second amended complaint does not
plausibly allege that AMD’s failure to disclose the defect “could reasonably be
found to have caused [the Massachusetts Plaintiff] to act differently from the way
he . . . otherwise would have acted.” Aspinall, 813 N.E.2d at 486 (quoting Purity
Supreme, 407 N.E.2d at 307).
6. The California Plaintiffs’ warranty claims were properly dismissed. Even
if AMD’s clock-speed representations are treated as an express warranty, Plaintiffs
fail to identify any specific or unequivocal written statement that guarantees that
such clock speeds could be attained without any possible security compromises.
See Cal. Com. Code § 2313; Maneely v. Gen. Motors Corp., 108 F.3d 1176, 1181
(9th Cir. 1997). Nor have Plaintiffs plausibly alleged that their devices lack “even
the most basic degree of fitness for ordinary use” as required to state a claim for
breach of an implied warranty of merchantability. Mocek v. Alfa Leisure, Inc., 7
Cal. Rptr. 3d 546, 549 (Ct. App. 2003); see also Cal. Com. Code §§ 2314-15.
7. The Louisiana Plaintiff’s redhibition claim was also properly dismissed.
Plaintiffs have not plausibly alleged either that AMD’s processors were
“absolutely useless” or that they were so inconvenient or imperfect that a
reasonable person would not have purchased them. Justiss Oil Co. v. Oil Country
7 Tubular Corp., 216 So. 3d 346, 361 (La. Ct. App. 2017) (quoting Blair v. Bad Boy
Inc., 137 So. 3d 1223, 1227 (La. Ct. App. 2014)); see also La. Civ. Code Ann. arts.
2520, 2524.
AFFIRMED.