NOT FOR PUBLICATION FILED UNITED STATES COURT OF APPEALS NOV 6 2024 MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS FOR THE NINTH CIRCUIT
OMAR ABDULAZIZ, No. 21-16195
Plaintiff-Appellant, D.C. No. 3:19-cv-06694-LB
v. MEMORANDUM* TWITTER, INC.,
Defendant-Appellee,
and
MCKINSEY & COMPANY,
Defendant.
Appeal from the United States District Court for the Northern District of California Laurel D. Beeler, Magistrate Judge, Presiding
Argued and Submitted December 4, 2023 San Francisco, California
Before: COLLINS, FORREST, and SUNG, Circuit Judges. Dissent by Judge COLLINS.
Plaintiff-Appellant Omar Abdulaziz appeals the district court’s dismissal of
his state-law negligence-based claims asserted against Defendant-Appellee Twitter,
* This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. Inc.1 We have jurisdiction under 28 U.S.C. § 1291, and we affirm but on different
grounds than those relied on by the district court.
1. Standing. The district court held that Abdulaziz lacked Article III
standing. “We review de novo an order granting a motion to dismiss for lack of
standing,” accepting all factual allegations in the complaint as true and drawing all
reasonable inferences in the non-movant’s favor. Iten v. County of Los Angeles, 81
F.4th 979, 983 (9th Cir. 2023). To establish Article III standing,2 a plaintiff must
demonstrate (1) an injury in fact, (2) fairly traceable to the challenged conduct of the
defendant (causation), and (3) likely to be redressed by a favorable judicial decision.
Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). We conclude that Abdulaziz has
pled sufficient facts to satisfy these requirements.
An injury in fact is “an invasion of a legally protected interest” that is
“concrete and particularized” and “actual or imminent, not conjectural or
hypothetical.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992) (internal
quotation marks and citation omitted). Theft of personal identifying information is
1 We grant Twitter’s motion to take judicial notice of court filings in other proceedings related to this case [Dkt. 46]. See United States v. Aguilar, 782 F.3d 1101, 1103 n.1 (9th Cir. 2015) (“[W]e may take notice of proceedings in other courts, both within and without the federal judicial system, if those proceedings have a direct relation to matters at issue.” (quoting United States ex rel. Robinson Rancheria Citizens Council v. Borneo, Inc., 971 F.2d 244, 248 (9th Cir.1992))). 2 The parties disagree about whether California law applies to the standing analysis. On this issue, the Supreme Court is clear: in federal court, federal standing law applies. Hollingsworth v. Perry, 570 U.S. 693, 715 (2013).
2 sufficient to establish injury in fact. See In re Zappos.com, Inc., 888 F.3d 1020, 1027
(9th Cir. 2018); see also Krottner v. Starbucks Corp., 628 F.3d 1139, 1140, 1143
(9th Cir. 2010).
Here, Abdulaziz, a Saudi dissident, alleged that two operatives of the
Kingdom of Saudi Arabia (KSA) who worked for Twitter accessed his Twitter
accounts without authorization and provided his personal information to the KSA.
He further asserts that the KSA used that information to embed surveillance malware
on his smartphone by sending his phone a spear-phishing text message. The Twitter
data breach by hostile foreign intelligence operatives and the alleged consequences
of that breach are more than sufficient to demonstrate cognizable injury. See In re
Zappos.com, 888 F.3d at 1027 (holding that a data breach placing customers “at
higher risk of ‘phishing’ and ‘pharming’” was sufficient to establish injury).
Abdulaziz has also shown that his injury is traceable to Twitter. “[T]he
traceability requirement is less demanding than proximate causation, and thus the
‘causation chain does not fail solely because there are several links’ or because a
single third party’s actions intervened.” O’Handley v. Weber, 62 F.4th 1145, 1161
(9th Cir. 2023) (quoting Maya v. Centex Corp., 658 F.3d 1060, 1070 (9th Cir. 2011)).
Abdulaziz alleges that KSA operatives misused their employment position at
Twitter and accessed his personal contact information without authorization using
company software, which would have sent a security alert to Twitter. He contends
3 that had Twitter not been negligent in maintaining its security system and hiring and
managing its employees, KSA operatives could not have accessed his personal
information associated with his public and pseudonymous Twitter accounts.
Abdulaziz further asserts that because Twitter did not reveal the details of its
employees’ data breach, he did not have reason to get a new phone and phone
number or to be concerned about hyperlinks embedded in text messages.
Accepting Abdulaziz’s allegations as true, it is “possible to draw a causal line”
between Twitter’s actions, or lack thereof, and the consequent injury that he
suffered.3 O’Handley, 62 F.4th at 1161–62.
Finally, redressability largely overlaps with traceability but is “distinct in that”
it “analyzes the connection between the alleged injury and requested relief.” Mecinas
3 The Supreme Court’s recent decision in FDA v. Alliance for Hippocratic Medicine, 602 U.S. 367 (2024), does not undermine this analysis. Although the Court emphasized that “plaintiffs attempting to show causation generally cannot rely on speculation about the unfettered choices made by independent actors not before the courts” . . . [and] “must show that the third parties will likely react in predictable ways that in turn will likely injure the plaintiffs,” Twitter’s causal connection to the injury does not “rely on speculation.” Id. at 383 (internal quotation marks and citations omitted). The plaintiffs in Alliance for Hippocratic Medicine had “more difficulty establishing causation,” id. at 382, because they alleged injuries from “the government’s ‘unlawful regulation (or lack of regulation) of someone else,’” id. (quoting Lujan, 504 U. S. at 562), and “future injuries to unregulated [third parties],” id. at 385 n.2. Unlike those plaintiffs, Abdulaziz is alleging injuries on his own behalf that have already occurred and that can be directly linked to Twitter’s allegedly inadequate security system, leaving Abdulaziz with no protection against predictable harm. See id. at 388–90 (holding that “as a matter of fact” federal law protects plaintiff-doctors from injury, which “breaks any chain of causation”).
4 v. Hobbs, 30 F.4th 890, 899 (9th Cir. 2022) (citation omitted). Here, where
Abdulaziz has alleged a causal connection between his injury and Twitter’s actions,
he has also shown redressability as it relates to his damages claims.4 See State Farm
Mut. Auto. Ins. Co. v. Campbell, 538 U.S. 408, 416 (2003).
For these reasons, we conclude that Abdulaziz has sufficiently alleged Article
III standing.
2. Statute of Limitations. As a threshold matter, Twitter argues that
Abdulaziz “forfeited any challenge to the district court’s ruling on the statute of
limitations” because he did not raise this issue in his opening brief. We reject that
argument. See Warmenhoven v. NetApp, Inc., 13 F.4th 717, 728–29 (9th Cir. 2021)
(“Petitioner does not waive a challenge to any ground for [the district court’s ruling]
in its opening brief on appeal that was not relied on in the district court’s order.”
(citation omitted) (alteration in original)). Alternatively, Twitter argues that if
Abdulaziz did not forfeit this issue, the district court’s dismissal order should be
affirmed because Abdulaziz’s claims are time-barred. Abdulaziz does not challenge
Twitter’s statute-of-limitations argument on the merits and instead argues in reply
4 To the extent Abdulaziz is requesting injunctive relief, he has not established standing because he did not plausibly allege any future harm or ongoing effects from Twitter’s actions. See Fleming v. Charles Schwab Corp., 878 F.3d 1146, 1151 n.1 (9th Cir. 2017) (explaining that “[p]ast exposure to illegal conduct does not in itself show a present case or controversy regarding injunctive relief” unless the challenged conduct “continuing” and has “present adverse effects” (quoting City of Los Angeles v. Lyons, 461 U.S. 95, 102 (1983))).
5 that this issue “is not before this Court” because “the District Court did not dismiss
the [operative] complaint on statute of limitations grounds.”5
Abdulaziz’s procedural argument is misplaced. Regardless of whether the
district court based its decision on the statute of limitations, Twitter preserved this
argument by raising it in its motion to dismiss the operative complaint and “we may
affirm the district court’s dismissal on any ground that is supported by the record,
whether or not the district court relied on the same ground.” Silk v. Bond, 65 F.4th
445, 456 (9th Cir. 2023) (quoting Hartmann v. Cal. Dep’t of Corr. & Rehab., 707
F.3d 1114, 1121 (9th Cir. 2013)). “We review de novo the question of when a cause
of action accrues and whether a claim is barred by the statute of limitations,” Oja v.
U.S. Army Corps of Eng’rs, 440 F.3d 1122, 1127 (9th Cir. 2006), and we hold that
Abdulaziz’s claims are untimely.
Abdulaziz’s state-law negligence claims are governed by California’s two-
year statute of limitations. Cal. Civ. Proc. Code § 335.1 (2003); Nev. Power Co. v.
Monsanto Co., 955 F.2d 1304, 1306 (9th Cir. 1992). Abdulaziz had no way of
knowing about Twitter’s alleged negligence until Twitter provided notice of the
5 Abdulaziz suggests that Twitter needed to cross-appeal in order to preserve the statute of limitations for appeal. This is incorrect. A cross-appeal is required only when an appellee seeks relief from the district court’s judgment. See Ellis v. Salt River Project Agric. Improvement & Power Dist., 24 F.4th 1262, 1268 (9th Cir. 2022) (appellee “should not cross-appeal if all it wishes to do is present alternative grounds for affirming the judgment”).
6 unauthorized access of his accounts. Thus, the “discovery rule” applies. Fox v.
Ethicon Endo-Surgery, Inc., 35 Cal. 4th 797, 807 (2005) (“An important exception
to the general rule of accrual is the ‘discovery rule,’ which postpones accrual of a
cause of action until the plaintiff discovers, or has reason to discover, the cause of
action.” (citation omitted)).
On December 11, 2015, Twitter sent “safety” notices to its account holders
whose accounts appeared to have been accessed without authorization. The notice
advised: “As a precaution, we are alerting you that your Twitter account is one of a
small group of accounts that may have been targeted by state-sponsored actors.” The
notice did not identify the state actors involved. Twitter presented evidence, of which
the district court took judicial notice, showing that Abdulaziz received this notice
two ways, both via the email address that he provided to Twitter and through an in-
application message.
Abdulaziz denies that he and his allies on Twitter received this notice. But
Abdulaziz need not have received actual notice to trigger the discovery rule—
constructive notice suffices. See Cmtys. for a Better Env’t v. Bay Area Air Quality
Mgmt. Dist., 1 Cal. App. 5th 715, 722 (2016) (“[I]n actions where the [discovery]
rule applies, the limitations period does not accrue until the aggrieved party has
notice, either actual or constructive, of the facts constituting the injury.” (internal
quotation marks and citation omitted)). Aside from his summary denial that he
7 neither received the December 2015 notices from Twitter, nor saw the
contemporaneous media coverage about these notices, Abdulaziz does not offer any
cogent justification for failing “at least to suspect a factual basis” for his cause of
action during this time period. Fox, 35 Cal. 4th at 807 (emphasis added) (citation
omitted); see also Marchisheck v. San Mateo County, 199 F.3d 1068, 1078 (9th Cir.
1999).
Furthermore, Abdulaziz conceded that he received a threatening direct
message through his Twitter account no later than December 3, 2015, and a separate
notice from Twitter in February 2016 stating that his data may have been viewed
“by another user.” Despite the various circumstances giving Abdulaziz “reason to
discover” his negligence-based claims against Twitter at least by early 2016, he did
not file this action until October 2019, well beyond the applicable two-year statute
of limitations. Cal. Code Civ. Proc. § 335.1. We therefore affirm the dismissal of
this action based on the statute of limitations, and we do not reach Abdulaziz’s
remaining arguments.
AFFIRMED.
8 FILED Abdulaziz v. Twitter, Inc., No. 21-16195 NOV 6 2024 MOLLY C. DWYER, CLERK COLLINS, Circuit Judge, dissenting: U.S. COURT OF APPEALS
In this diversity suit brought against Defendant-Appellee Twitter, Inc.
(“Twitter”), Plaintiff-Appellant Omar Abdulaziz alleges that, due to Twitter’s
negligence, two Twitter employees who were assertedly intelligence operatives of
the Kingdom of Saudi Arabia (“KSA”) were able to access Abdulaziz’s private
information and turn it over to the KSA, which then used it to harass Abdulaziz
and his family. The district court dismissed the operative complaint with prejudice,
concluding that Abdulaziz had failed to allege sufficient facts to establish that
Twitter caused his injuries, for purposes of either Article III standing or the merits
of his negligence-based claims. I agree with the majority that Abdulaziz
sufficiently alleged causation of injury to establish Article III standing and that the
district court erred in holding otherwise. The majority nonetheless proceeds to
affirm the district court’s dismissal of Abdulaziz’s negligence claims on the merits.
The majority does so, not on the ground that Abdulaziz failed to allege causation
for purposes of negligence (an issue that the majority does not reach), but rather on
the ground that the negligence claims are barred by the statute of limitations. In
my view, the allegations of Abdulaziz’s operative complaint are sufficient to
establish causation for purposes of negligence as well as to show that his claims
are timely. Because I would accordingly reverse the district court’s judgment, I respectfully dissent.
I
Abdulaziz’s negligence claims are timely under California’s applicable two-
year statute of limitations. See CAL. CODE CIV. PROC. § 335.1.
A
As a threshold matter, I reject Twitter’s contention that Abdulaziz forfeited
the statute-of-limitations issue by failing to discuss the merits of that issue in his
opening brief.
“An appeal from a final judgment draws in question all earlier, non-final
orders and rulings which produced the judgment.” Litchfield v. Spielberg, 736 F.2d
1352, 1355 (9th Cir. 1984) (emphasis added). Accordingly, to set aside the
judgment against him in its entirety on appeal, Abdulaziz’s opening brief needed to
establish that each independently sufficient ground, or set of grounds, on which
that judgment rested was erroneous. Here, the order dismissing the final, operative
version of the complaint rested only on Abdulaziz’s failure to adequately allege
causation for purposes of Article III standing and the merits. Although the district
court’s prior dismissal orders had been based alternatively on the statute of
limitations, those prior orders granted leave to amend, leading to the filing of new
complaints.1 “It is well-established in our circuit that an ‘amended complaint
1 Twitter suggests that the district court’s penultimate order intended to allow
2 supersedes the original, the latter being treated thereafter as non-existent.’”
Ramirez v. County of San Bernardino, 806 F.3d 1002, 1008 (9th Cir. 2015)
(citation omitted). Consequently, to the extent that the district court believed that
the final complaint failed to cure previously identified defects, it was incumbent
upon the court to state, in its final dismissal order, which deficiencies still
remained. That is especially true given that Abdulaziz’s operative amended
complaint contained additional allegations that arguably bore on the statute-of-
limitations issue.2 Here, the court’s final order did not rely on the statute of
limitations, and so that issue cannot be said, in whole or in part, to have “produced
the judgment.” Litchfield, 736 F.2d at 1355. Abdulaziz therefore had no obligation
to address the statute of limitations in his opening brief on appeal. See
Warmenhoven v. NetApp, Inc., 13 F.4th 717, 729 (9th Cir. 2021).
At oral argument, Twitter asserted that, even if Abdulaziz had no obligation
repleading only as to causation, and not as to the statute of limitations, but that is not a reasonable reading of that order. It would make no sense to pointlessly grant leave to replead claims that the district court had already definitively determined fail on other grounds. 2 In its penultimate dismissal order, the district court held that notices that Twitter claimed it sent to impacted users, including Abdulaziz, via email and an in-app notification in December 2015 sufficed to trigger the statute of limitations. In his operative amended complaint, Abdulaziz added new allegations further detailing his claim that he never received those notices. In its final motion to dismiss, Twitter argued that the popular press widely reported the security breach in December 2015 as well, and Abdulaziz disputed that contention in his opposition to Twitter’s motion. The district court’s final order did not purport to resolve these points or the statute-of-limitations issue more generally.
3 to address the statute of limitations in his opening brief, his failure to respond after
Twitter raised the issue in its answering brief amounted to a forfeiture of the issue
under Sabra v. Maricopa County Community College District, 44 F.4th 867, 881–
83 (9th Cir. 2022). But Sabra is a very narrow decision that is plainly inapplicable
here. In that case, we held that the appellants “abandoned” one particular claim, in
favor of pressing only their remaining claims, when their reply brief “failed to
address or even mention” the particular ground for affirming dismissal of that
claim that was raised in the answering brief. Id. at 881 (emphasis added). Here,
by contrast, nothing in Abdulaziz’s reply brief suggests a comparable selective
abandonment of a particular claim. Far from failing to “even mention” Twitter’s
invocation of the statute of limitations, Abdulaziz argued in his reply brief that the
issue was not properly before this court and should not be reached in resolving this
appeal. Moreover, in contrast to the situation in Sabra, which involved selective
abandonment of a particular claim in the reply brief, here it would be wholly
unreasonable to conclude (as Twitter contends) that Abdulaziz abandoned the
merits of his entire appeal simply because, beyond stating that the statute-of-
limitations issue should not be reached, he did not also discuss the merits of that
issue in his reply brief. Reply briefs, after all, are optional, and a failure of a reply
brief to address the merits of an alternative case-dispositive ground for affirmance
raised only in the answering brief cannot fairly be said to result in forfeiture of an
4 entire appeal, any more than the failure to file a reply brief at all could be said to
do so.
B
As to the merits of the statute-of-limitations issue, I disagree with the
majority’s conclusion that Abdulaziz’s claims can be said to be time-barred under
the standards applicable to a motion to dismiss under Federal Rule of Civil
Procedure 12(b)(6).
Under California law, a cause of action accrues when “the plaintiff
discovers, or has reason to discover, the cause of action.” Fox v. Ethicon Endo-
Surgery, Inc., 110 P.3d 914, 920 (Cal. 2005). A plaintiff “has reason to discover the
cause of action when he has reason at least to suspect a factual basis for its
elements.” Norgart v. Upjohn Co., 981 P.2d 79, 88 (Cal. 1999). In turn, “[h]e has
reason to suspect when he has ‘notice or information of circumstances to put a
reasonable person on inquiry.’” Id. (simplified).
Under this standard, Abdulaziz did not have reason to discover the cause of
action until October 2018, when he learned from a New York Times article that a
suspected agent of the KSA employed by Twitter had used employee access
privileges to obtain his personal information. At no prior point did he have notice
or information that would have put a reasonable person on inquiry that his asserted
injuries at the hands of the KSA were traceable to Twitter’s conduct. Fox, 110 P.3d
5 at 924 (“[I]f a plaintiff’s reasonable and diligent investigation discloses only one
kind of wrongdoing when the injury was actually caused by tortious conduct of a
wholly different sort, the discovery rule postpones accrual of the statute of
limitations on the newly discovered claim.”). Because the statute of limitations as
to any claim against Twitter thus began to run only in October 2018, Abdulaziz’s
action for negligence-based claims, filed one year later in October 2019, was
timely.
Neither the majority here nor the district court below offers persuasive
arguments to the contrary. The majority points in part to a threatening direct
message Abdulaziz received on Twitter no later than December 2015, as well as to
an unrelated February 2016 notice from Twitter stating that Abdulaziz’s data may
have been viewed by another user due to a software bug. But these facts are not
enough to put a reasonable person on inquiry notice of this cause of action, which
rests on entirely different alleged conduct by Twitter that assertedly led to the
otherwise seemingly unrelated harassment by the KSA.
The majority also cites the December 2015 notices from Twitter and the
contemporaneous media coverage of the disclosed security breach as providing
constructive notice that would put a reasonable person on inquiry. Abdulaziz,
however, alleged that he did not receive the December 2015 notices from Twitter,
6 and we must take that allegation as true for purposes of this appeal.3 Abdulaziz
also disputes that the December 2015 notice was widely publicized in the media,
and there is no basis for concluding that, based on this limited publication,
Abdulaziz was aware of facts that would put him on inquiry notice. See Unruh-
Haxton v. Regents of University of Cal., 76 Cal. Rptr. 3d 146, 163 (Ct. App. 2008)
(rejecting the view that “public awareness of a problem through media coverage
alone creates constructive suspicion for purposes of discovery” and holding that
“[t]he statute of limitations does not begin to run when some members of the
public have a suspicion of wrongdoing, but only ‘once the plaintiff has a suspicion
of wrongdoing’” (emphasis added) (simplified)). In all events, the December 2015
notice concerning third-party “targeting” of accounts does not provide inquiry
notice of malevolent insider conduct by Twitter employees.
In sum, because the well-pleaded facts adequately alleged that Abdulaziz did
not have reason to discover this cause of action until October 2018, the complaint
was not barred by California’s statute of limitations.
3 The highly redacted record produced by Twitter, together with an accompanying declaration from a Twitter employee explaining it, is manifestly not a matter that is subject to judicial notice. See FED. R. EVID. 201(b) (stating that a court “may judicially notice a fact that is not subject to reasonable dispute because it: (1) is generally known within the trial court’s territorial jurisdiction; or (2) can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned”). Moreover, the submitted record does not indisputably establish that Abdulaziz actually received the December 2015 notice, and we may not draw circumstantial inferences from that record that contradict Abdulaziz’s allegations. Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1003 (9th Cir. 2018).
7 II
The complaint also pleaded sufficient facts to establish a plausible theory of
causation of injury for purposes of the merits of Abdulaziz’s negligence claims—
namely, that, because of Twitter’s negligence, foreign intelligence operatives were
able to obtain Abdulaziz’s personal information and thereby implant surveillance
malware on his smartphone. The district court held that Abdulaziz did not
adequately plead proximate causation because the harm he allegedly suffered was
too remote in time from Twitter’s alleged negligence. But under California law,
temporal proximity is not absolutely necessary for proximate causation; it merely
“afford[s] evidence for or against” proximate causation. Mitchell v. Gonzales, 819
P.2d 872, 877 (Cal. 1991) (citation omitted). Here, Abdulaziz overcame the lack of
temporal proximity by pleading sufficient facts to plausibly claim that the KSA did
not implant malware on his smartphone sooner because it first needed time to
acquire the technical capabilities to do so.
Nor do the intervening acts of foreign intelligence operatives sever the chain
of causation so as to defeat proximate causation as a matter of law. “It is well
settled in [California] . . . that an intervening act does not amount to a ‘superseding
cause’ relieving the negligent defendant of liability if it was reasonably
foreseeable.” Landeros v. Flood, 551 P.2d 389, 395 (Cal. 1976) (citation omitted).
“Moreover, . . . that foreseeability may arise directly from the risk created by the
8 original act of negligence: ‘If the likelihood that a third person may act in a
particular manner is . . . one of the hazards which makes the actor negligent, such
an act whether innocent, negligent, intentionally tortious, or criminal does not
prevent the actor from being liable for harm caused thereby.’” Id. (emphasis
omitted) (citation omitted). It was reasonably foreseeable that Twitter’s alleged
failure to implement reasonable security systems and internal controls would
enable third parties to use corrupt or corruptible Twitter employees to
surreptitiously access users’ personal information. Moreover, the risk of improper
access by such malevolent third parties is precisely one of the foreseeable hazards
that makes Twitter’s lax security measures negligent.
* * *
For the foregoing reasons, I would reverse the dismissal of Abdulaziz’s
negligence claims. I respectfully dissent.