Orbis Global Equity Fund Limited v. NortonLifelock Incorporated

• Court: District Court, D. Arizona
• Decided: February 7, 2023
• Docket: 2:21-cv-01995
• Status: Unknown

Opinion

Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 1 of 39

1 WO 2 3 4 5 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA 8 9 Orbis Global Equity Fund Limited, et al., No. CV-21-01995-PHX-JJT 10 Plaintiffs, ORDER 11 v. 12 NortonLifelock Incorporated, et al., 13 Defendants. 14 15 At issue is the Omnibus Motion to Dismiss Plaintiffs’ Amended Complaint 16 (Doc. 22, “Mot.”) filed by Defendants NortonLifelock Inc. (formerly known as Symantec 17 Corporation and hereinafter referred to as “Symantec” or “the Company”) and Gregory S. 18 Clark, Nicholas R. Noviello, and Mark S. Garfield (collectively, the “Individual 19 Defendants”), to which Plaintiffs, a group of investment funds managed by Orbis 20 Investment Management Limited (collectively, “Orbis”), filed a Response in opposition 21 (Doc. 25, “Resp.”), and Defendants filed a Reply in support (Doc. 27). Also at issue is 22 Defendants’ Request for Incorporation by Reference and Judicial Notice in Support of 23 Defendants’ Omnibus Motion to Dismiss (Doc. 23, “RJN”), to which Plaintiffs filed a 24 Response in opposition (Doc. 26, “RJN Opp.”), and Defendants filed a Reply in support 25 (Doc. 28). The Court has reviewed the parties’ briefing and finds these matters appropriate 26 for disposition without oral argument. See LRCiv 7.2(f). For the reasons set forth below, 27 the Court grants in part and denies in part both Defendants’ Omnibus Motion to Dismiss 28 and Defendants’ Request for Incorporation by Reference and Judicial Notice. Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 2 of 39

1 I. BACKGROUND 2 At all relevant times, Symantec was a multinational technology company providing 3 cybersecurity products and services. (¶ 43.)1 Plaintiffs are a group of investment funds 4 managed by a privately owned asset manager, Orbis Investment Management Limited. 5 (¶ 30.) Plaintiffs allege that they purchased tens of millions of shares of Symantec common 6 stock between May 11, 2017, and August 2, 2018 (“the Relevant Period”). (¶¶ 30, 534-38.) 7 Plaintiffs allege that they collectively incurred over $360 million in recoverable securities- 8 fraud damages on their purchases of Symantec common stock as a result of fraudulent 9 conduct on the part of Symantec and three of its former officers: Defendant Clark, 10 Symantec’s Chief Executive Officer from August 2016 to May 2019; Defendant Noviello, 11 its Chief Financial Officer from December 2016 to May 2019; and Defendant Garfield, its 12 Chief Accounting Officer from February 2014 to August 2017. (¶¶ 30–52.) 13 The Court discusses Plaintiffs’ allegations in detail in the analysis that follows. 14 Here, a summary will suffice. Broadly, the alleged fraud centers on Defendants’ purported 15 misrepresentations about Symantec’s financial performance and accounting practices 16 during the Relevant Period. Plaintiffs allege that Symantec was a leader in the 17 cybersecurity-software sector in the 1990s and early 2000s, but its performance steadily 18 declined thereafter. (¶ 4.) In August 2016, Symantec acquired Blue Coat Systems, Inc., a 19 privately held network security firm. (¶ 4.) Prior to the acquisition, Defendants Clark and 20 Noviello served as Blue Coat’s CEO and CFO, respectively. (¶ 5.) After the acquisition, 21 they assumed identical posts at Symantec, while the rest of Blue Coat’s top management 22 took over as Symantec’s senior management. (¶ 5.) Publicly, Defendants represented that 23 Symantec had turned a corner and its financial performance was “strong,” highlighting 24 measures such as reported revenue and non-GAAP operating margin.2 (E.g., ¶ 6.) Plaintiffs 25 1 The Court cites to Plaintiffs’ first Amended Complaint (Doc. 20, “FAC”) by reference to the paragraphs within the FAC as Plaintiffs have numbered them. All citations to “¶” 26 hereinafter refer to the numbered paragraphs within the FAC. 27 2 “GAAP” refers to generally accepted accounting principles, which “encompass[] the conventions, rules, and procedures that define accepted accounting practice at a particular 28 point in time.” Shalala v. Guernsey Mem’l Hosp., 514 U.S. 87, 101 (1995).

-2- Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 3 of 39

1 allege that Symantec’s apparent financial turnaround was a façade. (¶ 9.) Motivated by 2 lucrative compensation under a scheme pegged to certain financial performance metrics, 3 Symantec’s management team allegedly employed a “host of accounting manipulations” 4 that mispresented the Company’s financial results. (See, e.g., ¶¶ 5, 8–19.) Plaintiffs allege 5 that after Symantec disclosed in May and August 2018 that it had commenced an internal 6 investigation into accounting improprieties, the Company’s stock fell by double-digit 7 percentages, causing a $7 billion decline in market capitalization. (¶¶ 20–24.) 8 In the wake of Symantec’s disclosures, multiple lawsuits were filed against 9 Defendants on behalf of the Company’s investors, including a securities-class action in the 10 Northern District of California in Case Number CV-18-02902-WHA (the “Class Action”). 11 The district court appointed a lead plaintiff to represent the class and the case was captioned 12 SEB Investment Management v. Symantec Corporation. The Class Action complaint raised 13 claims under Sections 10(b), 20(a), and 20A of the Securities Exchange Act of 1934 (“the 14 Act”).3 In June 2019, the district court granted motions to dismiss filed by Defendants and 15 dismissed the Class Action complaint with leave to amend. Symantec, 2019 WL 2491935, 16 at *11 (N.D. Cal. June 14, 2019). Also in June 2019, the district court granted a motion to 17 relate a stockholder derivative action, captioned Lee v. Clark et. al. and with the Case 18 Number CV-19-02522-WHA (the “Derivative Action”). See 2019 WL 4859099, at *2 19 (N.D. Cal. Oct. 2, 2019). In July 2019, the district court denied in part a motion to seal 20 portions of the Derivative Action complaint. See id. Following the unsealing of portions of 21 that complaint, the Class Action plaintiffs moved for leave to amend their complaint, which 22 the district court granted in October 2019. See id. at *1. The Class Action plaintiffs and 23 Defendants reached a $70 million settlement, which the district court approved in February 24 2022. See 2022 WL 409702, at *1 (N.D. Cal. Feb. 10, 2022). 25 After timely opting out of the Class Action in August 2020, Plaintiffs filed the 26 instant action in this Court on November 22, 2021. (Doc. 1.) Plaintiffs filed the operative 27 first Amended Complaint on February 3, 2022. (Doc. 20.) Plaintiffs raise a claim under 28 3 Hereinafter, all statutory references to enumerated “Sections” are to the Act, unless otherwise stated.

-3- Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 4 of 39

1 Section 10(b) and Securities & Exchange Commission (“SEC”) Rule 10b-5 thereunder 2 against all Defendants (Count I); a Section 20(a) claim against all Individual Defendants 3 (Count II); a Section 20A claim against Defendants Clark and Noviello (Count III); a 4 Section 18(a) claim against all Defendants (Count IV); and a common law fraud claim 5 against all Defendants (Count V). (¶¶ 539–81.) Defendants move to dismiss Plaintiffs’ first 6 Amended Complaint in its entirety. (MTD at 2.) Defendants argue that certain of Plaintiffs’ 7 claims are time barred and that, in any event, Plaintiffs fail to state a claim for which relief 8 may be granted under federal securities law or Arizona common law. (Id. at 5–11, 13–40.) 9 II. LEGAL STANDARD 10 Federal Rule of Civil Procedure 12(b)(6) is designed to “test[] the legal sufficiency 11 of a claim.” Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). A dismissal under Rule 12 12(b)(6) for failure to state a claim can be based on either: (1) the lack of a cognizable legal 13 theory; or (2) the absence of sufficient factual allegations to support a cognizable legal 14 theory. Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990). When 15 analyzing a complaint for failure to state a claim, the well-pled factual allegations are taken 16 as true and construed in the light most favorable to the nonmoving party. Cousins v. 17 Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). A plaintiff must allege “enough facts to state 18 a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 19 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows 20 the court to draw the reasonable inference that the defendant is liable for the misconduct 21 alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 556). 22 “The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more 23 than a sheer possibility that a defendant has acted unlawfully.” Id. 24 “While a complaint attacked by a Rule 12(b)(6) motion does not need detailed 25 factual allegations, a plaintiff’s obligation to provide the grounds of his entitlement to relief 26 requires more than labels and conclusions, and a formulaic recitation of the elements of a 27 cause of action will not do.” Twombly, 550 U.S. at 555 (cleaned up). Legal conclusions 28 couched as factual allegations are not entitled to the assumption of truth and therefore are

-4- Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 5 of 39

1 insufficient to defeat a motion to dismiss for failure to state a claim. Iqbal, 556 U.S. at 2 679-80. However, “a well-pleaded complaint may proceed even if it strikes a savvy judge 3 that actual proof of those facts is improbable, and that ‘recovery is very remote and 4 unlikely.’” Twombly, 550 U.S. at 556 (quoting Scheuer v. Rhodes, 416 U.S. 232, 236 5 (1974)). 6 Where, as here, a plaintiff alleges fraud or misrepresentation, Federal Rule of Civil 7 Procedure 9(b) imposes heightened pleading requirements. While malice, intent, 8 knowledge, and other conditions of mind usually may be alleged generally, the 9 circumstances constituting fraud must be pled with particularity. Fed. R. Civ. P. 9(b). 10 Specifically, “[a]verments of fraud must be accompanied by ‘the who, what, when, where, 11 and how’ of the misconduct charged.” Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1106 12 (9th Cir. 2003) (quoting Cooper v. Pickett, 137 F.3d 616, 627 (9th Cir. 1997)). Further, 13 a plaintiff must set forth more than the neutral facts necessary to identify the transaction. The plaintiff must set forth what is false or misleading about a 14 statement, and why it is false. In other words, the plaintiff must set forth an explanation as to why the statement or omission complained of was false or 15 misleading. 16 In re GlenFed, Inc. Sec. Litig., 42 F.3d 1541, 1548 (9th Cir. 1994). 17 The Private Securities Litigation Reform Act of 1995, Pub. L. 104–67, 109 Stat. 737 18 (“PSLRA”), likewise imposes more exacting pleading standards in private securities-fraud 19 lawsuits such as this one. With regard to alleged untrue statements or omissions of material 20 fact, the PSLRA provides that “the complaint shall specify each statement alleged to have 21 been misleading, the reason or reasons why the statement is misleading, and, if an allegation 22 regarding the statement or omission is made on information and belief, the complaint shall 23 state with particularity all facts on which that belief is formed.” 15 U.S.C. § 78u-4(b)(1). 24 Moreover, under the PSLRA, where recovery depends “on proof that the defendant 25 acted with a particular state of mind, the complaint shall, with respect to each act or omission 26 alleged to violate this chapter, state with particularity facts giving rise to a strong inference 27 that the defendant acted with the required state of mind.” 15 U.S.C. § 78u-4(b)(2)(A). The 28 Supreme Court has stated that the “strong inference” standard for pleading “facts evidencing

-5- Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 6 of 39

1 scienter, i.e., the defendant’s intention to deceive, manipulate, or defraud,” is not satisfied 2 simply through “alleged facts from which, if true, a reasonable person could infer that the 3 defendant acted with the required intent.” Tellabs, Inc. v. Makor Issues & Rights, Ltd., 551 4 U.S. 308, 313–14 (2007) (internal quotations omitted). 5 Rather, to determine whether a complaint’s scienter allegations can survive threshold inspection for sufficiency, a court . . . must engage in a comparative 6 evaluation; it must consider, not only inferences urged by the plaintiff . . . , but 7 also competing inferences rationally drawn from the facts alleged. An inference of fraudulent intent may be plausible, yet less cogent than other, 8 nonculpable explanations for the defendant’s conduct. To qualify as “strong” 9 within the intendment of [the PSLRA] . . . , an inference of scienter must be more than merely plausible or reasonable—it must be cogent and at least as 10 compelling as any opposing inference of nonfraudulent intent. 11 Id. at 314. The Ninth Circuit has recognized that the “bar set by Tellabs is not easy to satisfy.” 12 Webb v. Solarcity Corp., 884 F.3d 844, 855 (9th Cir. 2018) (citing 551 U.S. at 324). 13 Finally, a defendant asserting an affirmative statute-of-limitations defense as 14 grounds for dismissal bears the burden of showing it is “beyond doubt” that the plaintiff 15 can prove no set of facts that would establish the timeliness of his or her claims. Hernandez 16 v. City of El Monte, 138 F.3d 393, 402 (9th Cir. 1998) (citation and quotation marks 17 omitted). Dismissal at the pleading stage is appropriate only if “the running of the statute 18 is apparent on the face of the complaint.” Cervantes v. Countrywide Home Loans, Inc., 656 19 F.3d 1034, 1045 (9th Cir. 2011) (citation and quotation marks omitted). 20 III. ANALYSIS 21 A. Time Bars 22 Defendants argue that certain of Plaintiffs’ claims are time barred. (MTD at 5–11.) 23 As a threshold matter, the Court must determine the time bars applicable to each claim. 24 Here, the parties agree that a two-year statute of limitations applies to claims under Sections 25 10(b), 20(a), and 20A. (MTD at 5–6; Resp. at 12–14.) They further agree that a three-year 26 statute of limitations applies to fraud claims brought under Arizona common law. (Id.) 27 They disagree as to the time bars applicable to claims under Section 18. (Id.) 28

-6- Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 7 of 39

1 As enacted, Section 18 provides for a one-year statute of limitations. 15 U.S.C. 2 § 78r(c). It also provides for a three-year statute of repose, id., a related but distinct legal 3 mechanism that extinguishes a claim after a certain period of time. See CTS Corp. v. 4 Waldburger, 573 U.S. 1, 9 (2014). In 2002, Congress passed the Sarbanes-Oxley Act, Pub. 5 L. 107-204, 116 Stat. 745 (“Sarbanes-Oxley”). Among other things, Sarbanes-Oxley 6 provides for a two-year statute of limitations and a five-year statute of repose for any 7 “private right of action that involves a claim of fraud, deceit, manipulation, or contrivance 8 in contravention of a regulatory requirement concerning the securities laws.” 28 U.S.C. 9 § 1658(b). The parties here dispute whether Sarbanes-Oxley’s extended periods of 10 limitation apply to claims under Section 18. (MTD at 5–6, 10; Resp. at 13–14.) 11 Courts are likewise divided on this question, which the Ninth Circuit does not 12 appear to have addressed. Several district courts, including two within the Ninth Circuit, 13 have held that Sarbanes-Oxley’s extended periods of limitation do not apply to Section 18 14 claims. See Reese v. Malone, No. C-08-1008M-MJP, 2009 WL 506820, at *8–9 (W.D. 15 Wash. Feb. 27, 2009); Kelley v. Rambus, Inc., No. C-07-1238 JF (HRL), 2008 WL 16 5170598, at *9 (N.D. Cal. Dec. 9, 2008); In re Fed. Nat’l Mortg. Ass’n Sec., Deriv., and 17 ERISA Litig,, 503 F. Supp. 2d 25, 34–36 (D.D.C. 2007); In re Enron Corp. Sec. Litig., 465 18 F. Supp. 2d 687, 711–13 (S.D. Tex. 2006). Notably, each of these cases have relied on 19 reasoning supplied by the district court in the Southern District of New York in In re Alstom 20 SA Securities Litigation. 406 F. Supp. 2d 402, 419–21 (S.D.N.Y. 2005). That court’s 21 reasoning has since been rejected expressly by the Second Circuit. See Dekalb Cty. Pension 22 Fund v. Transocean Ltd., 817 F.3d 393, 405–08 (2d Cir. 2016). 23 In Alstom, the district court reasoned that the plain language of Sarbanes-Oxley’s 24 extended periods of limitation refers only to causes of action that require the plaintiff to 25 plead fraudulent intent, which Section 18 does not. 406 F. Supp. 2d at 420. The Second 26 Circuit disagreed. Dekalb, 817 F.3d at 405–08. The Second Circuit held that even though 27 Section 18 does not require the plaintiff to plead any particular state of mind, a Section 18 28 claim still falls within the ambit of “a private right of action involving fraud, deceit, [or]

-7- Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 8 of 39

1 manipulation.” Id. The Second Circuit first looked to the definition of fraud and noted that 2 “[o]n its face, Section 18(a) unquestionably involves a claim of misrepresentation made . . 3 . to induce another person to act.” Id. at 406. Second, the court noted that although Section 4 18 does not require the plaintiff to plead any particular state of mind, “in order for a plaintiff 5 to recover under Section 18(a), [the] misrepresentation . . . must have been made recklessly 6 without belief in its truth, at the very least.” Id. at 405–06 (citation and quotation marks 7 omitted). Third, the Second Circuit noted that Section 18 allows a defendant to present 8 evidence of good faith as an affirmative defense, meaning that “as a practical matter, 9 Section 18(a) actions will generally involve proof of a defendant’s state of mind.” Id. at 10 405–06. Thus, “[a] plaintiff asserting a Section 18(a) claim is, in essence, asserting a fraud 11 claim—a fraud claim with respect to which the defendant, and not the plaintiff, 12 uncharacteristically bears the burden of proof regarding the defendant’s state of mind, but 13 a fraud claim no less.” Id. at 407; see also Blaz v. Belfer, 368 F.3d 501, 503 (5th Cir. 2004) 14 (recognizing that Sarbanes-Oxley extended the statute of repose for Section 18 claims). 15 In Alstom, the district court also reasoned that “nothing in either the statutory 16 framework of 28 U.S.C. § 1658 or the legislative history of Sarbanes–Oxley show a clear 17 intent to overrule express limitations periods stated in the securities laws.” 406 F. Supp. 2d 18 at 415–16, 420. The district court cited, among other sources, a Senate Judiciary Committee 19 Report in which certain committee members “expressed their understanding of the statute 20 of limitations as not being ‘intended to conflict with existing limitations periods for any 21 express private rights of action under the federal securities laws.’” Id. (quoting S. Rep. No. 22 107-146, at 29). The Second Circuit criticized reliance on this passage, which “appears to 23 have been drafted by those senators who lost the battle to prevent § 1658(b)’s passage.” 24 Dekalb, 817 F.3d at 404. In any event, the Second Circuit found the statute’s language 25 unambiguous and held that reliance on legislative history therefore was inappropriate. Id. 26 In short, while two district courts in the Ninth Circuit have held Sarbanes-Oxley’s 27 extended periods of limitation inapplicable to Section 18 claims, both decisions relied on 28 reasoning that has since been rejected in an appellate opinion binding upon the district

-8- Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 9 of 39

1 court that provided it. See Reese, 2009 WL 506820 at *9; Kelley, 2008 WL 5170598, at *9. 2 These decisions therefore would provide the Court only a thin reed upon which to rely. The 3 Court instead relies upon the Second Circuit’s persuasive reasoning in Dekalb, joining 4 several other district courts that have since considered the question. See, e.g., Lord Abbett 5 Invest. Trust-Lord Abbett Short Duration Income Fund v. Valeant Pharms. Int’l, Inc., No. 6 CV-17-6365, 2018 WL 3637514, at *8 (D.N.J. July 31, 2018); Twin Master Fund, Ltd. v. 7 Akorn, Inc., No. C-19-3648, 2020 WL 564222, at *4 (N.D. Ill. Feb. 5, 2020). 8 Thus, a two-year statute of limitations applies to each of Plaintiffs’ federal securities 9 law claims and a three-year statute of limitations applies to their common law fraud claim. 10 The five-year statute of repose applicable to Plaintiffs’ federal securities law claims 11 accrued on August 2, 2018, when Plaintiffs allege they last purchased Symantec shares. 12 See Lindner Dividend Fund, Inc. v. Ernst & Young, 880 F. Supp. 49, 53 (D. Mass. 1995) 13 (“A cause of action accrues within the meaning of section 18(c) when the purchase of 14 securities for which damages sought has taken place.”). Thus, it has not yet run. 15 1. Federal Securities Law Claims 16 The statute of limitations for a federal securities claim begins to run “(1) when the 17 plaintiff did in fact discover, or (2) when a reasonably diligent plaintiff would have 18 discovered, ‘the facts constituting the violation’—whichever comes first.” Merck & Co. v. 19 Reynolds, 559 U.S. 633, 637 (2010) (quoting 28 U.S.C. § 1658(b)(1)). “[T]he facts 20 constituting the violation include the fact of scienter.” Id. (citation and quotation marks 21 omitted). In fashioning a consistent standard with which to apply Merck and using the 22 Supreme Court’s opinion as a guide, the Second Circuit held that 23 the reasonably diligent plaintiff has not “discovered” one of the facts constituting a securities fraud violation until he can plead that fact with 24 sufficient detail and particularity to survive a 12(b)(6) motion to dismiss. 25 Under this standard, the amount of particularity and detail a plaintiff must 26 know before having “discovered” the fact will depend on the nature of the 27 fact. For example, a sufficient allegation of scienter requires the pleader to “state with particularity facts giving rise to a strong inference that the 28 defendant acted with the required state of mind” such that “it is at least as

-9- Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 10 of 39

1 likely as not that the defendant acted with the relevant knowledge or intent.” 2 Merck, 130 S. Ct. at 1796 (internal quotation marks omitted). Until the plaintiff has uncovered—or a reasonably diligent plaintiff would have 3 uncovered—enough information about the defendant’s knowledge or intent to satisfy this pleading standard, he has not “discovered” the fact of scienter, 4 and the statute of limitations cannot begin to run. 5 6 City of Pontiac Gen. Emps.’ Ret. Sys. v. MBIA, Inc., 637 F.3d 169, 174–75 (2d Cir. 2011); 7 see also Pension Fund Trust Fund for Operating Engs. v. Mortg. Asset. Securitization 8 Transactions, Inc., 730 F.3d 263, 272 (3d Cir. 2013) (following MBIA standard). 9 Although the Ninth Circuit has not expressly adopted the MBIA standard, district 10 courts within the Ninth Circuit frequently apply it. See, e.g., Lowthorp v. Mesa Air Group 11 Inc., No. CV-20-00648-PHX-MTL, 2021 WL 3089118, at *6 (D. Ariz. July 22, 2021); 12 Rieckborn v. Jefferies LLC, 81 F. Supp. 3d 902, 915 (N.D. Cal. 2015); Stichting 13 Pensioenfonds ABP v. Countrywide Fin. Corp., 802 F. Supp. 2d 1125, 1135 (C.D. Cal. 14 2011). Defendants make several arguments why the Court should not follow suit, but fail 15 to persuade the Court. For example, Defendants note that MBIA did not involve opt-out 16 claims. (MTD at 9.) But MBIA makes no distinction between class and individual 17 complaints and other courts have applied it to opt-out claims. See, e.g., Stichting, 802 18 F. Supp. 2d at 1135. The Court will apply the MBIA standard here. 19 a. Claims Under Sections 10(b), 20(a), and 20A 20 Defendants argue that Plaintiffs’ claims under Sections 10(b), 20(a), and 20A 21 against Defendants Noviello and Garfield are barred under the two-year statute of 22 limitations. (MTD at 8–10.)4 As an initial matter, the Court notes that Defendants’ 23 arguments are at cross purposes with their arguments that Plaintiffs entirely fail to state a 24 claim. If that were true, then it is difficult to see how Defendants could succeed on their 25 time-bar arguments under MBIA. In any event, the Court concludes below that Plaintiffs 26 state claims under Sections 10(b), 20(a), and 20A. The Court also concludes that certain of 27 the misrepresentations alleged by Plaintiffs are not actionable. As to Defendants Noviello 28 4 Defendants do not contend that Plaintiffs’ claims under Sections 10(b), 20(a), or 20A are time-barred as against Defendants Symantec and Clark.

- 10 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 11 of 39

1 and Garfield, Plaintiffs state a claim only as to Defendants’ alleged misstatements 2 concerning Symantec’s non-GAAP reporting. Thus, the Court must consider when a 3 reasonably diligent plaintiff would have had sufficient information about the facts 4 necessary to survive a motion to dismiss as to these misrepresentations. 5 Defendants argue that Plaintiffs had such information by August 2, 2018, at which 6 time Defendants disclosed certain improprieties in Symantec’s accounting. (MTD at 6–8.) 7 But this argument is undercut by the Symantec court’s ruling in October 2019 that the Class 8 Action plaintiffs failed to state a claim against Defendants Noviello and Garfield— 9 including as to misrepresentations of Symantec’s non-GAAP reporting—and dismissed 10 them from the case. See 2019 WL 4859099, at *5–6. This ruling was based on the failure 11 to plead scienter. Id. Moreover, Plaintiffs here contend that much of the evidence on which 12 their allegations of scienter as to Defendants Noviello and Garfield rely was not available 13 to them until March 18, 2021, when the Class Action plaintiffs filed previously confidential 14 exhibits with their summary judgment papers. (See Resp. at 13.) Based on Plaintiffs’ 15 allegations, this evidence appears to include, inter alia, documents relating to a July 2017 16 presentation by Defendant Garfield concerning a “significant deficiency” in Symantec’s 17 non-GAAP reporting; a September 2017 email from Defendant Garfield’s replacement, 18 Matthew Brown, to Defendant Noviello concerning issues with non-GAAP reporting; and 19 notes regarding Defendant Garfield’s exit interview in August 2017 in which he allegedly 20 suggested that the Company’s expanding definition of “Transition costs” was “ridiculous” 21 and “potentially illegal.” (¶¶ 278–79, 472.) Defendants do not contend that Plaintiffs had 22 access to this evidence prior to March 18, 2021. Nor do they show that Plaintiffs possessed, 23 or reasonably should have possessed, other facts sufficient to survive dismissal on scienter 24 grounds. At this stage, Defendants have failed to carry their burden to show that Plaintiffs’ 25 claims under Sections 10(b), 20(a), and 20A are untimely. 26 b. Section 18 Claim 27 Defendants argue that Plaintiffs’ Section 18 claim is time barred as against all 28 Defendants. (MTD at 10–11.) Plaintiffs counter that their claim is timely under American

- 11 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 12 of 39

1 Pipe & Construction Company v. Utah, 414 U.S. 538, 554 (1974), which holds that 2 “commencement of a class action suspends the applicable statute of limitations as to all 3 asserted members of the class,” including those who file separate suits. Crown, Cork & 4 Seal Co. v. Parker, 462 U.S. 345, 352–54 (1983). Defendants respond that American Pipe 5 cannot save Plaintiffs’ Section 18 claim because it was not raised in the Class Action. 6 (MTD at 10.) They concede that the claim rests on substantially similar factual allegations 7 as the Section 10(b) claim in the Class Action, but nonetheless argue that American Pipe 8 does not apply because of the distinctions between the legal elements of Section 10(b) and 9 Section 18 claims. (Id. at 6–8, 12–13.) 10 Plaintiffs maintain that American Pipe applies in these circumstances. (Resp. at 14.) 11 In support, they cite to Tosti v. City of Los Angeles, in which the Ninth Circuit held that an 12 individual opt-out action need not “be identical in every respect to the class suit for the 13 statute to be tolled.” 754 F.2d 1485, 1489 (9th Cir. 1985). (See Resp. at 14.) But Tosti does 14 not answer the question presented here. Even if the opt-out claims need not be identical, 15 they must be similar enough that the earlier-filed class action claims provided the defendant 16 sufficient notice “of the need to preserve evidence and witnesses” relevant to the opt-out 17 claims to avoid the “potential for unfair surprise.” Crown, Cork & Seal, 462 U.S. at 352– 18 54; see also id. at 355 (Powell, J., concurring) (“[W]hen a plaintiff invokes American Pipe 19 in support of a separate lawsuit, the district court should take care to ensure that the suit 20 raises claims that ‘concern the same evidence, memories, and witnesses as the subject 21 matter of the original class suit,’ so that ‘the defendant will not be prejudiced.’” (quoting 22 American Pipe, 414 U.S. at 562 (Blackmun, J., concurring)). 23 The Ninth Circuit does not appear to have addressed whether Section 10(b) claims 24 and Section 18 claims are sufficiently similar for purposes of American Pipe. Although 25 district courts are divided on this question, most appear to conclude they are not. See, e.g., 26 Gotham Diversified Neutral Master Fund, LP v. Chicago Bridge & Iron Co., No. CV-18- 27 9927 (LGS), 2019 WL 3996519, at *3 (S.D.N.Y. Aug. 23, 2019); In re Bear Stearns Cos. 28 Inc. Sec., Deriv., & ERISA Litig., 995 F. Supp. 2d 291, 308 (S.D.N.Y. 2014), aff’d sub

- 12 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 13 of 39

1 nom. SRM Glob. Master Fund Ltd. P’ship v. Bear Stearns Cos. LLC, 829 F.3d 173 (2d Cir. 2 2016); Children’s Hosp. & Med. Ctr. Found. of Omaha v. Countryside Fin. Corp., No. 3 CV-11-02056-MRP-MAN, 2011 WL 13220509, at *3–4 (C.D. Cal. Aug. 22, 2011); 4 Special Situations Fund III, LP v. Am. Dental Partners, 775 F. Supp. 2d 227, 246 (D. Mass. 5 2011); but see MYL Litig. Recov. I LLC v. Mylan N.V., No. 19-CV-1799 (JPO), 2020 WL 6 1503673, at *7–8 (S.D.N.Y. Mar. 30, 2020) (Section 18 claims tolled by class action raising 7 Section 10(b) claims based on “same facts”); Broadway Gate Master Fund., Ltd. v. Ocwen 8 Fin. Corp., No. 16-80056-CIV-WPD, 2016 WL 9413421, at *10 (S.D. Fla. June 29, 2016) 9 (same as to Sections 10(b) and 18 claims resting on “virtually identical” factual basis). 10 The Court is persuaded by the view—apparently of the majority—that Section 10(b) 11 claims raised in class actions do not toll the statute of limitations for later-filed Section 18 12 claims. As other courts have observed, the two claims require “markedly different” proof. 13 Children’s Hosp., 2011 WL 13220509, at *3. Unlike Section 10(b), Section 18 requires the 14 plaintiff to plead actual reliance on the defendant’s misrepresentations; the plaintiff cannot 15 rely on the “constructive reliance, or fraud-on-the-market, theory available under Section 16 10(b).” Howard v. Everex Sys., 228 F.3d 1057, 1063 (9th Cir. 2000). The actual reliance 17 requirement has led courts to deny class certification of Section 18 claims altogether. See 18 Children’s Hosp., 2011 WL 13220509, at *3 (citation omitted). The filing of a Section 19 10(b) class action therefore does not necessarily “put a defendant on notice that it will be 20 called upon to defend a Section 18 claim.” Id.; cf. In re LIBOR-Based Fin. Instruments 21 Antitrust Litig., No. MDL-11-2262, 2015 WL 6243526, at *148 (S.D.N.Y. Oct. 20, 2015) 22 (“Defendants cannot plausibly claim prejudice when a class member sues individually on 23 a new legal theory that the class representatives could still sue on in the predicate class 24 action.”). Unlike Section 10(b), Section 18 does not require scienter, but it does permit a 25 defendant to plead and prove good faith as an affirmative defense. 15 U.S.C. § 78r(a). It is 26 conceivable that such a defense could involve different evidence than the defense of a 27 Section 10(b) claim. In short, the claims are “sufficiently distinct” and American Pipe 28 tolling does not apply. See Am. Dental, 775 F. Supp. 2d at 246.

- 13 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 14 of 39

1 The next question is when the two-year statute of limitations began to run—that is, 2 when a reasonably diligent plaintiff would have had sufficient information about the facts 3 necessary to survive a motion to dismiss. See MBIA, 637 F.3d at 174–75. Here, Plaintiffs 4 cannot claim reliance on the scienter evidence submitted in the class action because Section 5 18 does not require scienter. See McGann v. Ernst & Young, 102 F.3d 390, 395 (9th Cir. 6 1996). With respect to actual reliance, much of the relevant evidence presumably would 7 have been in Plaintiffs’ hands from the beginning. Naturally, Plaintiffs’ actual reliance 8 allegations point to their strategies and purchases during the Relevant Period—i.e., prior to 9 and including August 2018. (See ¶¶ 531–38.) Nor can Plaintiffs point to the Symantec 10 court’s rulings for support. In its June 2019 order, the Symantec court ruled that the Class 11 Action plaintiffs had met their pleading burden with respect to certain materially false 12 statements and found only scienter lacking as to those statements. 2019 WL 2491935, at 13 *6, 7. In its October 2, 2019 order, the Symantec court found that the Class Action plaintiffs 14 had met their pleading burden as to all elements of their Section 10(b) claim. 2019 WL 15 4859099, at *2–6. Thus, the statute of limitations cannot possibly have begun to run any 16 later than October 2, 2019. Plaintiffs’ Section 18 claim was not filed until November 22, 17 2021. It is therefore untimely. As “the running of the statute is apparent on the face of the 18 complaint,” Cervantes, 656 F.3d at 1045, the Court will dismiss the Section 18 claim. 19 2. Common Law Fraud Claim 20 Defendants argue that Plaintiffs’ fraud claim under Arizona common law is time 21 barred as to all Defendants. (MTD at 11.) A.R.S. Section 12-543(3) provides for a three- 22 year limitations period that begins to run upon “discovery by the aggrieved party of the 23 facts constituting the fraud.” Arizona courts have held that the statute begins to run “when 24 the defrauded party discovers or with reasonable diligence could have discovered the 25 fraud.” Mister Donut of Am., Inc. v. Harris, 723 P.2d 670, 672 (Ariz. 1986) (citing, inter 26 alia, Coronado Dev. Corp. v. Superior Ct., 678 P.2d 535, 537 (Ariz. Ct. App. 1984)). 27 Plaintiffs suggest that in determining when the statute began to run on their state- 28 law claim, the Court should apply the same standard applicable to their federal law

- 14 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 15 of 39

1 claims—that is, the statute did not begin to run until a reasonably diligent plaintiff “would 2 have discovered the facts constituting the violation, including scienter.” Merck, 559 U.S. 3 at 653. (See Resp. at 14–15.) In support, they cite to this Court’s decision in Maverick 4 Fund, L.D.C. v. First Solar, Incorporated. No. CV-15-1156-PHX-DGC, 2018 WL 5 6181241, at *15 (D. Ariz. Nov. 27, 2018). In Maverick, the court noted that “[t]he discovery 6 of facts that put a plaintiff on inquiry notice may be useful in determining when a 7 reasonably diligent plaintiff should have been prompted to begin investigating, but it does 8 not automatically begin the running of the limitations period.” Id. (citing Strategic 9 Diversity, Inc. v. Alchemix Corp., 666 F.3d 1197, 1205 (9th Cir. 2011), in turn citing Merck, 10 559 U.S. at 648). But Maverick considered the timeliness of an Arizona Securities Act 11 claim, not a common law fraud claim. See id. Plaintiffs cite to no case in which a court 12 applying Arizona law has applied the Merck standard to a common law fraud claim. 13 Defendants provide one reason that cautions against doing so: Merck applied the 14 PSLRA’s “heightened pleading requirements for the scienter element of § 10(b) fraud 15 cases,” 559 U.S. at 649, which do not govern Arizona common law. Further, whereas 16 Merck explicitly rejected an “inquiry notice” standard, id. at 650–52, Arizona courts appear 17 to have embraced such a standard. The Arizona Court of Appeals has recognized that the 18 statute of limitations for common law fraud claims begins to run once a plaintiff has 19 “‘knowledge of facts sufficient to make a reasonably prudent person suspicious of fraud, 20 thus putting him on inquiry.’” Coronado, 678 P.2d at 537 (quoting Nat’l Auto. & Cas. Ins. 21 Co. v. Payne, 261 Cal. App. 2d 403 (1968)); accord Richards v. Powercraft Homes, Inc., 22 678 P.2d 449, 451 (Ariz. Ct. App. 1983), aff’d in part, vacated in part on other grounds, 23 678 P.2d 427 (1984); see also Cullison v. Okoneski, No. CV-11-01179-PHX-NVW, 2012 24 WL 1156426, at *5 (D. Ariz. Apr. 6, 2012) (“[Under Arizona law, a] fraud claim accrues 25 when a plaintiff ‘should have known such facts that would have prompted a reasonable 26 person to investigate and discover the fraud.’” (quoting Richards, 678 P.2d at 451)). 27 Thus, even assuming that Plaintiffs are correct that they did not have sufficient facts 28 indicative of scienter to survive a motion to dismiss their federal claims until July 2019 as

- 15 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 16 of 39

1 to Defendants Clark and Symantec, and March 2021 as to Defendants Noviello and Clark 2 (Resp. at 14–15), that is not dispositive of the timeliness of their state-law claims. 3 Plaintiffs’ allegations demonstrate that by September 24, 2018, they knew, inter alia, that 4 Defendants had “engaged in accounting improprieties”; the Symantec Board of Directors’ 5 Audit Committee had conducted an internal investigation and found problems with the 6 Company’s accounting practices; the Company would be revising its financial results to 7 account for $12 million in revenue that should have been deferred to a later period; and the 8 SEC had commenced a formal investigation into Symantec’s accounting. (See, e.g., ¶¶ 326, 9 353–360.) Even if Plaintiffs could not meet the PSLRA’s exacting standards for pleading 10 scienter, by September 24, 2018, they had sufficient facts “that would have prompted a 11 reasonable person to investigate and discover the fraud.” Richards, 678 P.2d at 451; accord 12 Coronado, 678 P.2d at 537. As Plaintiff’s common law fraud claim was not filed until 13 November 22, 2021, it is untimely. Because the “the running of the statute is apparent on 14 the face of the complaint,” Cervantes, 656 F.3d at 1045, the Court will dismiss the claim. 15 B. Whether Plaintiffs State Claims Under Sections 10(b), 20(a), and 20A 16 1. Section 10(b) Claim 17 To state a claim under Section 10(b), the plaintiff must show “(1) a material 18 misrepresentation or omission by the defendant; (2) scienter; (3) a connection between the 19 misrepresentation or omission and the purchase or sale of a security; (4) reliance upon the 20 misrepresentation or omission; (5) economic loss; and (6) loss causation.” Webb, 884 F.2d 21 at 850 (quoting Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27, 37–38 (2011)). Rule 22 9(b) and the PSLRA apply. In re Daou Sys., Inc., 411 F.3d 1006, 1015 (9th Cir. 2005). 23 To plead falsity, Plaintiffs must allege that Defendants made representations that 24 “directly contradict what [they] knew at that time,” Khoja v. Orexigen Therapeutics, Inc., 25 899 F.3d 988, 1009 (9th Cir. 2018), or “would give a reasonable investor the impression 26 of a state of affairs that differs in a material way from the one that actually exists.” Retail 27 Wholesale & Dep’t Store Union Local 338 Ret. Fund v. Hewlett-Packard Co., 845 F.3d 28 1268, 1275 (9th Cir. 2017) (citation and quotation marks omitted). As for materiality, the

- 16 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 17 of 39

1 inquiry is “fact-specific, and requires delicate assessments of the inferences a reasonable 2 shareholder would draw from a given set of facts and the significance of those inferences 3 to him.” In re Alphabet Sec. Litig., 1 F.4th 687, 700 (9th Cir. 2021) (citations and quotation 4 marks omitted). “[R]esolving materiality as a matter of law is generally appropriate only if 5 the adequacy of the disclosure . . . is so obvious that reasonable minds [could] not differ.” 6 Id. To plead scienter, Plaintiffs must allege that Defendants made material 7 misrepresentations either “intentionally or with deliberate recklessness.” Daou, 411 F.3d 8 at 1015. Finally, “loss causation refers to the causal relationship between a material 9 misrepresentation and the economic loss suffered by an investor.” Loos v. Immersion 10 Corp., 762 F.3d 880, 887 (9th Cir. 2014). Plaintiffs “must demonstrate than an economic 11 loss was caused by the defendant’s misrepresentations, rather than some intervening 12 event.” Llyod v. CVB Fin. Corp., 811 F.3d 1200, 1209 (9th Cir. 2016). This “is typically 13 satisfied by allegations that the defendant revealed the truth through ‘corrective 14 disclosures’ which ‘caused the company’s stock price to drop and investors to lose 15 money.’” Id. (quoting Halliburton Co. v. Erica P. John Fund, Inc., 573 U.S. 258 (2014)). 16 Broadly, Plaintiffs allege that Defendants misled Symantec’s investors during the 17 Relevant Period in four main ways. First, Defendants improperly recognized revenue in 18 violation of GAAP. (¶¶ 93–166.) Second, Defendants reported misleading non-GAAP 19 measures and falsely claimed such measures facilitated comparisons to Symantec’s peers 20 and to its prior performance. (¶¶ 176–256.) Third, Defendants falsely certified that 21 Symantec’s internal controls over financial reporting and disclosures were effective, 22 despite the existence of what Plaintiffs allege to be “rampant accounting manipulations.” 23 (¶¶ 276–85.) Finally, Defendants made false and misleading statements attributing 24 Symantec’s increasing deferred revenues to new business development, when in fact they 25 were driven by longer contracts which did not actually increase revenue. (¶¶ 308–24.) 26 Defendants argue that Plaintiffs fail to adequately plead falsity, materiality, scienter, 27 and/or loss causation as to these alleged misrepresentations. (MTD at 14–38.) In light of 28 the Ninth Circuit’s observation that falsity and scienter “are generally strongly inferred

- 17 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 18 of 39

1 from the same set of facts,” Daou, 411 F.3d at 1015, and the requirement that Plaintiffs 2 offer a plausible theory as to how the alleged misrepresentations proximately caused their 3 economic loss, Loos, 762 F.3d at 887, the Court analyzes the sufficiency of Plaintiffs’ 4 allegations as to each category of misrepresentation in turn. 5 a. Improper Revenue Recognition 6 Plaintiffs allege that Defendants recognized period-end revenue in violation of 7 GAAP. (¶¶ 93–166.) “If properly pled, overstating of revenues may state a claim of 8 securities fraud, as under GAAP, revenue must be earned before it can be recognized.” 9 Daou, 511 F.3d at 1016. Plaintiffs “must allege enough information so that a court can 10 discern whether the alleged GAAP violations were minor or technical in nature, or whether 11 they constituted widespread and significant inflation of revenue.” Id. at 1017. In other 12 words, they must plead “how the adjustments affected the company’s financial statements 13 and whether they were material in light of the company’s overall financial position.” Id. at 14 1018. Here, Plaintiffs allege that Defendants improperly recognized a deal with Oracle in 15 Q4 2018 (“the Oracle Transaction”), double booked six multi-million dollar deals in Q4 16 2017 and Q1 2018, and engaged in other “rampant improper revenue recognition 17 practices.” (¶¶ 93–166.)5 The Court considers these allegations in turn. 18 i. Oracle Transaction 19 Plaintiffs allege that Symantec improperly recognized $12 million in revenue from 20 the Oracle Transaction in the Form 8-K filed on May 10, 2018. (¶¶ 94–100, 452–53.) On 21 September 24, 2018, the Audit Committee acknowledged that this $12 million “should be 22 deferred” to FY 2019 and that financial results would be revised “to take into account this 23 deferral and any other financial adjustments required as a result of this revision.” (¶ 100.) 24 Symantec allegedly used this revenue in reporting $6 million in GAAP operating income 25 for Q4 2018 and $49 million in GAAP operating income for FY 2018. (¶¶ 99, 452–53.) 26 Had Symantec not improperly recorded this revenue, Plaintiffs allege, the Company would 27 5 The Court refers to reporting periods by the abbreviations “Q” for quarters and “FY” for 28 fiscal years. Symantec’s fiscal year ends in March. (See ¶ 6 n.1; Mot. at 3 n.1.) For example, FY 2017 ended on March 31, 2017.

- 18 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 19 of 39

1 have recorded a loss of $6 million for Q4 2018—a 200% decline—and operating income 2 of only $37 million for FY 2018—a 24.5% decline. (¶¶ 101–04.) 3 Defendants argue that Plaintiffs fail to show that this revenue deferral was material. 4 (MTD at 24–26.) At bottom, however, Defendants’ arguments raise factual disputes that 5 are premature at this stage in the litigation. For example, Defendants challenge as baseless 6 Plaintiffs’ allegation that “a deferral of $12 million in revenue corresponds one-for-one 7 with a reduction of operating income by $12 million.” (MTD at 25 (citing ¶ 101).) But 8 Plaintiffs’ allegations are not implausible, and, at this stage, the Court must accept them as 9 true. Defendants also point out that Symantec reported the same operating income— 10 $6 million for Q4 2018 and $49 million for FY 2018—in both the Form 8-K filed before 11 the Audit Committee made its announcement and the Form 10-K filed afterward. (Compare 12 RJN Ex. 10 (Form 8-K filed May 10, 2018) with Ex. 1 (Form 10-K filed Oct. 26, 2018).6) 13 This likewise raises potential factual questions. Defendants further dispute that operating 14 income is the relevant metric (MTD at 24), but Symantec itself described operating income 15 as a “Key Financial Metric.” (See, e.g., RJN Ex. 1.) Plaintiffs further allege the “highest 16 levels of the organization were instrumental” in the revenue deferral and that it helped 17 executives reach financial targets that unlocked higher bonuses. (¶¶ 105–06.) In short, the 18 Court cannot say, as a matter of law, that Plaintiffs’ allegations fail to show that the $12 19 million revenue deferral was material. 20 Next, Defendants argue that Plaintiffs fail to plead scienter. (MTD at 26.) As to 21 6 Defendants request that the Court consider certain documents submitted in support of 22 Defendants’ Omnibus Motion to Dismiss under the incorporation-by-reference and judicial notice doctrines. (RJN at 1.) Plaintiffs oppose Defendants’ request, but only reference 23 certain of the submitted documents in their Response. (See RJN Opp. at 4–10.) The Court grants Defendants’ request only as to those documents referenced in this Order. The Court 24 considers these documents to the extent they are “incorporated into the complaint by reference,” Tellabs, 551 U.S. at 322, and/or present information that is “not subject to 25 reasonable dispute because it: (1) is generally known within the trial court’s territorial jurisdiction; or (2) can be accurately and readily determined from sources whose accuracy 26 cannot reasonably be questioned.” Fed. R. Evid. 201(b). As to the former, the Court does not “assume the truth of an incorporated document if such assumptions only serve to 27 dispute facts stated in [Plaintiffs’ otherwise] well-pleaded complaint,” Khoja, 899 F.3d at 998. Here, the Court considers Exhibits 1 and 10 to Defendants’ Request for Incorporation 28 by Reference and Judicial Notice to the extent they document Symantec’s reported financial metrics. The Court does not consider them for any other purpose.

- 19 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 20 of 39

1 Defendant Clark, the Court disagrees. Plaintiffs allege that it was Defendant Clark’s 2 decision to send a text message to Oracle’s President of Product Development, Thomas 3 Kurian, that necessitated deferring the revenue in the first place. (¶¶ 94–97.) On March 29, 4 2018, Symantec’s Vice President of Finance, Matthew Brown, instructed Defendants Clark 5 and Noviello that if Symantec made any promises to Oracle regarding certain future 6 functionality, Symantec would have to defer revenue from the deal to FY 2019. (¶¶ 94-95.) 7 The next day, Defendant Clark allegedly sent a text message to Mr. Kurian “informing him 8 that Symantec ‘can’t send a [letter of intent] or a zero dollar [statement of work] . . . we 9 will get it done but we can’t contract.” (¶ 97.) Defendants suggest that the plain language 10 of the message shows that Defendant Clark declined to promise future functionality. (MTD 11 at 26.) The Court is not persuaded. Whether a factfinder might be persuaded after 12 considering the evidence is for later in the litigation. 13 However, Plaintiffs fail to adequately plead scienter as to Defendant Noviello. 14 Plaintiffs allegations suggest that he knew of Oracle’s request for an assurance of future 15 functionality and understood the effect such an assurance would have on Symantec’s 16 accounting (see ¶¶ 94–99), but they do not support a strong inference that he knew, or was 17 deliberately reckless in not knowing, that Defendant Clark made such an assurance. Even 18 if the allegations were sufficient to support an inference that Defendant Noviello knew or 19 should have known of Defendant Clark’s actions, it is not “at least as compelling as any 20 opposing inference.” Tellabs, 551 U.S. at 324. 21 Finally, Defendants argue that Plaintiffs fail to plead loss causation. (MTD at 22 26-27.) The Court disagrees. Plaintiffs allege that on May 10, 2018, Symantec disclosed 23 that the Audit Committee opened an internal investigation and, as a result, the Company’s 24 “financial results and guidance may be subject to change.” (¶ 327.) The next day, 25 Symantec’s stock price fell over 33%. (¶ 340.) Plaintiffs allege that on August 2, 2018, 26 Symantec disclosed that the investigation related to financial results for Q4 2018. (¶ 348.) 27 The next day, Symantec’s stock fell nearly 8%. (¶ 352.) Plaintiffs allege that on 28 September 24, 2018, the Audit Committee acknowledged that $12 million from the Oracle

- 20 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 21 of 39

1 Transaction should have been deferred and financial results would be revised. (¶¶ 353, 2 356.) While “the announcement of an investigation, standing alone and without any 3 subsequent disclosure of actual wrongdoing,” is insufficient, Loos, 762 F.3d at 890 n.3, 4 “the announcement of an investigation can form the basis for a viable loss causation theory 5 if the complaint also alleges a subsequent corrective disclosure by the defendant.’” Lloyd, 6 811 F.3d at 1210–11 (citations and quotation marks omitted). It is immaterial, at this stage, 7 that the August 2018 disclosure did not “precisely mirror” the misrepresentation. See 8 Grigsby v. Bofl Holding, Inc., 979 F.3d 1198, 1207–08 (9th Cir. 2020); Mineworkers’ 9 Pension Scheme v. First Solar, Inc., 881 F.3d 750, 753 (9th Cir. 2018) (“[L]oss causation 10 . . . may be shown even where the alleged fraud is not necessarily revealed prior to the 11 economic loss.” (citation and quotation marks omitted)). The August 2018 disclosure 12 indicated that the investigation related to Q4 2018 results, and thus plausibly “relat[ed] 13 back” to recognition of the Oracle Transaction revenue in the Form 8-K for Q4 2018. See 14 Grigsby, 979 F.3d at 1207–08. 15 ii. Double-Booked Revenue 16 Plaintiffs allege that in Q4 2017 and Q1 2018, Symantec improperly “double- 17 booked” revenue from six year-end transactions that “can be estimated to amount to a total 18 of at least $63 million dollars.” (¶ 149.) Plaintiffs allege that Defendant Clark was 19 “personally and directly involved” in approving these transactions. (¶ 149.) Plaintiffs’ 20 claim relies on allegations by former Symantec employees, primarily an Account Manager 21 who worked at Symantec from December 2013 to October 2017 and managed the Verizon 22 Account. (Id. ¶¶ 108, 149–60, 165–66.) 23 When a plaintiff relies on confidential witness allegations (“CW allegations”), the 24 PSLRA imposes additional hurdles. A plaintiff need not name his or her sources “so long 25 as the sources are described with sufficient particularity to support the probability that a 26 person in the position occupied by the source would possess the information alleged and 27 the complaint contains adequate corroborating details.” Daou, 411 F.3d at 1015 (citations 28 and quotation marks omitted). Even then, to contribute to materiality, the allegations must

- 21 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 22 of 39

1 show that Defendants’ improper practices “constituted widespread and significant inflation 2 of revenue.” Id. at 1017. With respect to scienter, the Ninth Circuit has formulated a two- 3 part test. “First, the confidential witnesses whose statements are introduced to establish 4 scienter must be described with sufficient particularity to establish their reliability and 5 personal knowledge. Second, those statements which are reported by confidential 6 witnesses with sufficient reliability and personal knowledge must themselves be indicative 7 of scienter.” Zucco Partners, LLC v. Digimarc Corp., 552 F.3d 981, 995 (9th Cir. 2009). 8 Courts consider “the level of detail provided by the confidential sources, the corroborative 9 nature of the other facts alleged . . . , the coherence and plausibility of the allegations, the 10 number of sources, the reliability of the sources, and similar indicia.” Id. 11 Plaintiffs allege that the Verizon Account Manager “was responsible for driving all 12 net new purchases as well as maintaining and overseeing renewals of existing solutions.” 13 (¶ 152.) She describes a culture of improper revenue booking driven by top executives and 14 that she “left Symantec because she knew the issues would come out.” (¶¶ 108–09, 150.)7 15 She describes a $13 million deal with Verizon in which the Head of Global Sales, Steve 16 Tchejeyan, verbally agreed to give Verizon a $1 million discount. (¶ 152–53.) The deal 17 closed on the last day of FY 2017, a Friday. (¶ 155.) When the Verizon Account Manager 18 returned the following Monday and “checked the Oracle application in which everything 19 was booked, the Verizon deal was no longer booked with a Q4 end date . . . and, instead, 20 it had a Q1 end date.” (¶ 155) She believes the booking was manually changed “because 21 each line item in the system said ‘Manual Adjustment,’” which was a “huge accounting 22 red flag.” (¶ 155.) She states that Defendant Clark personally approved her request to be 23 credited for the deal for Q4 2017 compensation purposes. (¶ 157.) She recounts discussing 24 this issue with her manager, Regional Vice President Rich Ruggiero, who “reported to her 25 that the booking of a Q4 deal in Q1 happened to five other Symantec Account Managers” 26 27 7 Plaintiffs explain that they use the pronoun “she” and possessive “her” to refer to all 28 former employees “[f]or ease of comprehension and readability,” and not with the intention of identifying any former employee by gender. (¶ 108 n.16.)

- 22 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 23 of 39

1 involving “‘big,’ ‘double digit’ million- dollar deals.” (¶ 156.) For these reasons, she 2 believes Symantec booked these six deals in both Q4 2017 and Q1 2018. (¶ 158.) 3 Defendants argue that these CW allegations are implausible under the theory that 4 such impropriety would have been caught in subsequent reviews of Symantec’s 5 accounting. (MTD at 27.) This argument relies, in part, on references to extrinsic evidence 6 which the Court will not consider. Even on their face, however, Plaintiffs’ CW allegations 7 fail to carry the weight Plaintiffs place upon them. As Defendants note, the Verizon 8 Account Manager is not alleged to possess any accounting expertise. (Id.) That would not 9 be fatal to Plaintiffs’ claim if it were nonetheless plausible that she had personal knowledge 10 of how Symantec accounted for the deal in its reported financial statements. But Plaintiffs 11 do not allege facts to suggest as much. The Verizon Account Manager’s belief that 12 Defendants recognized revenue from the deal twice is based on inference, not first-hand 13 knowledge. (See ¶ 158.) Plaintiffs allege that other employees corroborated her allegations. 14 (¶ 160.) Another former Account Manager recalled a 2018 conversation in which the 15 Verizon Account Manager disclosed the double-booking of the Verizon deal. (¶ 160). This 16 account fails to fill in any significant new information. A former Director of Enterprise 17 Ecommerce Payment and Risk “stated that she learned that the Company had double- 18 booked revenue from Verizon and other large deal [sic] in 4Q17 and 1Q18 while 19 performing an internal audit,” and that she received “pushback” when she tried to collect 20 on the Verizon deal. (¶ 160.) Plaintiffs do not allege facts plausibly suggesting she had 21 personal knowledge of Symantec’s accounting and her allegations about the internal audit 22 are vague. In short, none of the CW allegations provide “specific descriptions of the precise 23 means through which [the alleged fraud] occurred, provided by persons said to have 24 personal knowledge of them.” In re Cabletron Sys., Inc., 311 F.3d 11, 30 (9th Cir. 2002). 25 Plaintiffs’ claim that Symantec double booked five other deals worth tens of 26 millions of dollars is even more tenuous. It relies on the Verizon Account Manager’s 27 statement reporting what her supervisor told her about deals involving other account 28 managers—double if not triple hearsay. While admissibility is not the test at this stage,

- 23 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 24 of 39

1 plausibility and reliability are. See Zucco, 552 F.3d at 997 n.4. The allegations are also 2 vague. It is difficult to determine whether or not the alleged double-booking led to 3 “widespread and significant inflation of revenue” in Symantec’s reported financial 4 statements. See Daou, 411 F.3d at 1020. Nor do the allegations raise a strong inference the 5 individual Defendants knew about, or were reckless in disregarding, the same. For 6 example, while the Verizon Account Manager’s allegations show that Defendant Clark 7 approved her compensation for the Verizon deal as if booked in Q4 2017, they do not show 8 he intentionally or recklessly approved the reporting of revenue from the deal in 9 Symantec’s Q4 2017 financial statements. Plaintiffs’ CW allegations do not contribute to 10 their claim that Defendants materially misrepresented Symantec’s GAAP revenue. 11 Plaintiffs also fail to plead loss causation. As noted, the May 2018 announcement 12 of the Audit Committee’s investigation could serve as the basis for loss causation if 13 Plaintiffs alleged a subsequent disclosure that revealed the wrongdoing. See Lloyd, 811 14 F.3d at 1210–11. Here, unlike with the Oracle Transaction, Plaintiffs point to no disclosure 15 that relates back to the double booking of revenue, such as an acknowledgment of, or 16 revision of Symantec’s financial statements to reflect, the same. The August 2018 17 disclosure does not suffice; Plaintiffs allege that revenue was doubled booked in Q4 2017 18 and Q1 2018 (see ¶ 158), but in August 2018, the Company stated it “did not anticipate a 19 material adverse impact on its historical financial statements for Q3 fiscal year 2018 and 20 prior.” (¶ 348.) Plaintiffs point to no aspect of the September 2018 disclosure relating to 21 improper revenue recognition other than the specific deferral of revenue from the Oracle 22 Transaction. (¶¶ 353–60.) Nor can Plaintiffs simply allege they purchased stock at fraud- 23 inflated prices. See Dura Pharmaceuticals, Inc. v. Broudo, 544 U.S. 336, 342–46 (2005). 24 iii. Additional Improper Revenue Recognition Practices 25 Plaintiffs allege that Defendants engaged in additional revenue recognition practices 26 that violated GAAP. (¶¶ 107–08, 110, 125–26.) Here, Plaintiffs substantially rely on CW 27 allegations excerpted verbatim from the Class Action complaint. (¶¶ 117–48.) Defendants 28

- 24 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 25 of 39

1 argue that this is improper. (MTD at 12–13.) They urge the Court to disregard these 2 “recycled” allegations, although they have not moved for them to be stricken. (Id.) 3 Rule 11 requires attorneys to conduct a “reasonable factual investigation” into the 4 basis for their clients’ claims prior to filing a complaint. Christian v. Mattel, Inc., 286 F.3d 5 1118, 1127 (9th Cir. 2002). This responsibility is “nondelegable.” Pavelic & LeFlore v. 6 Marcel Entm’t Group, 493 U.S. 120, 126 (1989). On this basis, district courts have 7 disregarded allegations that “rely exclusively on the analysis and investigation of different 8 attorneys in different actions.” See, e.g., Attia v. Google, LLC, No. CV-17-6037-BLF, 2018 9 WL 2971049, at *14–15 (N.D. Cal. June 13, 2018) (dismissing claims where “sole basis” 10 upon which plaintiffs pleaded an essential element of claims was derived from other 11 lawsuits); In re Apollo Group, Inc. Sec. Litig., No. CV-10-1735-PHX-JAT, 2011 WL 12 5101787, at *10 n.5 (D. Ariz. Oct. 27, 2011) (rejecting request to amend complaint to 13 include “unproven and contested” allegations from separate qui tam action). 14 At the same time, the responsibility to conduct a reasonable prefiling investigation 15 does not preclude an attorney from relying on others, see Garr v. U.S. Healthcare, Inc., 16 22 F.3d 1274, 1278–79 (3d Cir. 1994), so long as the attorney “acquire[s] knowledge of 17 facts sufficient to enable him to certify that the paper is well-grounded in fact.” Unioil, Inc. 18 v. E.F. Hutton & Co., Inc., 809 F.2d 548, 558 (9th Cir. 1986). Accordingly, district courts 19 have declined to disregard allegations merely because they are incorporated from 20 complaints in separate actions. See, e.g., Homeward Residential, Inc. v. Sand Canyon 21 Corp., 298 F.R.D. 116, 126 (S.D.N.Y. 2014) (“Rule 11 seems to allow incorporation of 22 allegations from other complaints if they are combined with material the plaintiff has 23 investigated personally that lend credence to the borrowed allegations.”); 380544 Canada, 24 Inc. v. Aspen Tech., Inc., 544 F. Supp. 2d 199, 225 (S.D.N.Y. 2008) (concluding that “the 25 fact that the informants’ accounts are derived from an earlier pleading in a different case 26 simply does not render the instant pleading inadequate”). 27 Here, the Court declines to disregard the excerpted allegations for several reasons. 28 First, unlike in Attia, Plaintiffs do not rely exclusively on the excerpted allegations as the

- 25 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 26 of 39

1 basis for their claims. See 2018 WL 2971049, at *14–15. The excerpted CW allegations 2 are supported by allegations by other former employees. (See, e.g., ¶¶ 108–15.) Moreover, 3 Plaintiffs’ counsel aver they “interviewed many of the former Symantec employees cited 4 in the Class Complaint, to independently verify the allegations attributed to those 5 employees.” (Doc. 29, Supp. Decl. of David R. Kaplan ¶ 4.) Second, Plaintiffs here are 6 using the CW allegations for an identical purpose as in the Class Action, which mitigates 7 concerns about the allegations being misconstrued to accomplish different purposes in 8 different contexts. See, e.g., Schwab Cap. Trust v. Colgene Corp., No. CV-20-3754, 2021 9 WL 1085474, at *10 n.14 (D.N.J. Mar. 22, 2021). Finally, opt-out actions present unique 10 circumstances that may warrant consideration of CW allegations previously credited. See 11 id. at *10; see also, e.g., MicroCapital Fund LP v. Conn’s Inc., No. 18-CV-1020, 2019 WL 12 3451153, at *14 n.28 (S.D. Tex. July 24, 2019) (declining to strike CW allegations upheld 13 in class action supported by corroborating allegations); 380544 Canada, 544 F. Supp. 2d 14 at 224–25 (declining to disregard CW allegations block-quoted from class action but 15 alleged with sufficient particularity to show reliability). 16 Plaintiffs’ allegations must still pass the pleading hurdles imposed by the PSLRA. 17 As an initial matter, certain allegations concern business practices that do not amount to 18 securities fraud, including that Defendants pressured sales employees to “pull in as many 19 orders as they could before the new quarter.” (E.g., ¶¶ 114, 143–45.)8 Even as to those 20 allegations concerning improper recognition of revenue, the allegations are lacking. While 21 the Court agrees with the Symantec court’s conclusion that the allegations provide 22 sufficient facts regarding the reliability and personal knowledge of the witnesses, see 2019 23 WL 2019 WL 2491935, at *4, the information they possess goes only so far. Plaintiffs 24 allege few facts plausibly suggesting that these former employees have personal knowledge 25 of how Symantec accounted for the allegedly improper deals in the challenged financial 26 8 The same is not necessarily true of pressuring finance employees to book deals prematurely. (E.g., ¶¶ 137–40.) As Plaintiffs note, the distinction matters because “sales 27 personnel . . . could work harder to generate more revenue,” but “finance personnel . . . could only work with the transactions they were given.” Luna v. Marvell Tech. Group, No. 28 C-15-5447-WHA, 2017 WL 2171273, at *4 (N.D. Cal. May 17, 2017). (See Resp. at 20.)

- 26 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 27 of 39

1 statements. For example, Plaintiffs point to their allegations that Defendants pressured a 2 former Manager of Bill and Collect-Finance and her boss to pull in revenue and approve 3 “half baked deals,” but the only deal she identifies occurred around January 2016—a period 4 for which Plaintiffs do not allege Defendants made misrepresentations. (See ¶¶ 137–40.) 5 The Court further agrees with the Symantec court’s conclusion that the excerpted 6 CW allegations are insufficient to show “widespread and significant inflation of revenue.” 7 2019 WL 4859099, at *3. Plaintiffs’ allegations refer to deals worth “tens of millions of 8 dollars” (e.g., ¶ 126), but they fail to estimate exactly how much, if at all, the improper 9 deals inflated revenue reported during the Relevant Period. (See ¶¶ 377–61.) From the 10 Court’s review, the aggregate of the deals specifically identified by Plaintiffs appears to be 11 no more than approximately $15 million. (See, e.g., ¶¶ 110, 111, 113, 125–29, 135, 146.)9 12 Although the Ninth Circuit stated that “prematurely recognizing millions of dollars in 13 revenue is not minor,” it made that statement in the context of allegations that a company 14 overinflated its revenue in one quarter by 48%. See Daou, 411 F.3d at 1019. By contrast, a 15 $15 million overstatement of revenue would appear to be approximately 0.25% of the 16 approximately $6 billion in revenue Symantec reported in the financial statements 17 Plaintiffs here challenge. (See RJN Exs. 1, 8.) Plaintiffs do not show how this amount was 18 material in light of the Company’s overall financial position, as they have done, for 19 example, with respect to the Oracle Transaction. (Compare ¶¶ 94–106, with ¶¶ 107–48.) 20 Further, for the same reasons Plaintiffs fail to plead loss causation as to the alleged 21 double-booking of revenue, they fail to plead loss causation as to the other alleged improper 22 revenue recognition practices. Plaintiffs point to no disclosure that relates back to 23 Defendants’ allegedly improper recognition of revenue except for the deferral of revenue 24 from the Oracle Transaction, a distinct issue. (See ¶¶ 327–66.) 25 26 9 Revenue from certain other referenced deals appears to have been recognized, if at all, in 27 financial statements that Plaintiffs have not challenged. (See ¶ 133 (deal “worth almost eight figures” forced through around April or May 2018, i.e. Q1 2019), ¶ 138 ($6 million 28 deal brought in two quarters early around January 2016, i.e. Q4 2016).)

- 27 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 28 of 39

1 b. Non-GAAP Measures 2 Plaintiffs allege that Defendants’ non-GAAP reporting was false and misleading. 3 (¶¶ 176–256.) They allege that Defendants falsely stated that Symantec’s non-GAAP 4 measures “facilitate comparisons of our performance to prior periods and to our peers.” 5 (E.g., ¶ 178.) In fact, they were manipulating non-GAAP measures by excluding recurring 6 operating expenses as “transition and transformation” (“T&T”) costs10—which 7 Symantec’s peers did not do and which contradicted Defendants’ statements that their T&T 8 expenses were not incurred in the ordinary course of business. (¶¶179–228; see, e.g., 9 ¶ 387(b).) The result of the alleged manipulations was a corresponding increase in non- 10 GAAP operating income, creating a misleading picture of Symantec’s profitability. (E.g., 11 ¶ 16.) Plaintiffs further allege that Defendants deceptively switched bonus payments from 12 cash to stock to boost non-GAAP operating income. (¶¶ 249–56.) Defendants argue that 13 Plaintiffs fail to plead falsity, materiality, scienter, or loss causation. (MTD at 14–23.) 14 i. T&T Classifications 15 Symantec’s reported transition costs increased substantially from FY 2017 to 16 FY 2018. (¶¶ 187, 189.) Plaintiffs allege that this increase “was due in part to Defendants 17 regularly classifying expenses incurred in the ordinary course to operate the Company’s 18 ongoing business as T&T costs,” which “violated both the SEC’s guidance and the 19 Company’s public statements about its non-GAAP measures.” (E.g., ¶ 190.) Symantec’s 20 former Vice President and Chief Security Officer alleged that costs associated with 21 enterprise-resource-planning projects, cloud-infrastructure projects and security issues 22 were “pushed into th[e T&T] bucket” in amounts “in at least the high tens of million.” 23 (¶¶ 214, 216.) She stated that the process of classifying costs as transformative “was used 24 as a mechanism to be able to get large pieces of work done that otherwise wouldn’t fit into 25 operational budgets.” (¶ 217.) Defendant Garfield allegedly suggested that management 26 10 Although Plaintiffs allege that Symantec changed its definition of T&T costs over time, 27 Symantec generally defined these costs as those related to “restructuring, separation, transition, and other activity” amounting to a “discrete event based on a unique set of 28 business objectives or circumstances,” in which the Company did not engage “in the ordinary course of business.” (See, e.g., ¶ 191.)

- 28 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 29 of 39

1 “was putting all different kinds of things under transition” and “into GAAP-only that 2 shouldn’t be there” as part of a “ridiculous” and “potentially illegal” “effort to expand the 3 definition of Transition cost.” (¶ 239.) After Symantec engaged an outside accounting firm, 4 Ernst & Young (“E&Y”), to study its practices related to non-GAAP measures, E&Y found 5 significant problems, including that “the costs included in [T&T] have the appearance of 6 recurring operating expenses.” (¶¶ 242–44.) The Company disclosed in September 2018 7 that it had “relatively weak and informal processes with respect to some aspects of the 8 review, approval and tracking of transition and transformation expenses.” (¶ 283.) 9 Plaintiffs identify initiatives within three Symantec projects they allege were falsely 10 labeled as T&T costs, to the tune of approximately $50 million. (¶¶ 194–209.) Defendants 11 dispute that any of these initiatives were improperly classified (MTD at 14–15.) but their 12 contentions raise factual questions that are premature at this stage. Defendants cite a 13 Southern District of New York case noting that non-GAAP measures “have no uniform 14 definition.” See Ironworkers Local 580-Joint Funds v. Linn Energy, LCC, 29 F. Supp. 3d 15 400, 426 (S.D.N.Y. 2014). There, the court found the defendants had “at all times . . . told 16 the whole truth and nothing but about how they were calculating [non-GAAP measures].” 17 Id. Here, Plaintiffs make facially plausible allegations to the contrary. While Defendants 18 were not obligated to report non-GAAP measures, once they chose to do so “they [were] 19 bound to do so in a manner that wouldn’t mislead investors.” Khoja, 899 F.3d at 1009. 20 Nor have Defendants shown that the adequacy of their T&T disclosures is so 21 obvious that no reasonable minds could differ as to whether they were materially 22 misleading. See Alphabet, 1 F.4th at 700. Plaintiffs allege that all of Symantec’s $365 23 million-plus T&T costs during the Relevant Period were improperly excluded—a 24 significant percentage of Symantec’s non-GAAP measures. (¶¶ 12, 186–92.) Defendants 25 note that Plaintiffs only specifically identify $50 million in allegedly misclassified costs, 26 which represents approximately 1.7% of total non-GAAP operating income. (MTD at 17. 27 See RJN, Exs. 8, 14.) But Plaintiffs allege $50 million as the “absolute minimum” 28 misclassified amount. (¶ 210.) Defendants cite In re Apple Computer, Incorporated

- 29 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 30 of 39

1 Securities Litigation for the proposition that a “6.5% revenue miss is immaterial” (MTD 2 at 17), but that case did not involve allegedly misleading financial statements. See 127 F. 3 App’x 296, 304 (9th Cir. 2005). Rather, it involved misleading financial projections, which 4 the Ninth Circuit recognized are “by their very nature . . . imprecise.” Id. 5 Plaintiffs also adequately plead scienter on the part of Defendants Clark and 6 Noviello. Plaintiffs’ allegations plausibly suggest their involvement in the misclassification 7 of T&T costs. For example, Plaintiffs allege that Defendant Clark received an email in 8 February 2017 suggesting that the Head of Symantec’s website security business could 9 meet operating income targets by excluding T&T costs. (¶ 468 n.32.) Similarly, Plaintiffs 10 allege that Defendants Clark and Noviello were asked by Symantec’s General Counsel to 11 “help” in getting certain expenses classified as T&T. (¶¶ 204, 470.) Plaintiffs allege that 12 Defendants Clark and Noviello “then emailed each other with a plan to ‘discuss live,’ i.e., 13 to avoid creating a paper trail.” (¶ 204.) Plaintiffs further allege that the Board—of which 14 Defendant Clark was a member—approved adjustments to non-GAAP income. (E.g., 15 ¶¶ 231, 237.) As Defendants note, it is not clear whether the Board approved specific T&T 16 costs or merely approved overall expense ranges. (Reply at 17.) Even assuming the latter, 17 Plaintiffs’ allegations strongly suggest that Defendants Clark and Noviello knew, or were 18 reckless in disregarding, that Symantec’s T&T reporting was misleading. (See, e.g., 19 ¶¶ 238–48, 464–81.) Both also had incentives to approve the T&T misclassifications. (See 20 ¶¶ 482–93.) Defendant Garfield allegedly suggested Defendant Clark was a “participant” 21 in “driving the non-GAAP number up” so he could “triple” his income. (¶¶ 472–73.) 22 With respect to Defendant Garfield, Plaintiffs’ efforts to establish scienter are 23 constrained by the fact that he resigned from Symantec only a few months into the Relevant 24 Period. (See ¶ 52.) But Plaintiffs’ allegations are sufficient for this stage. For example, 25 Defendants allege that in July 2017, Defendant Clark was informed that Defendant Garfield 26 was leaving the Company due to accounting problems and that “he called for an 27 ‘Accounting Re-Org’ which flagged that T&T costs were ‘frequently submitted in error.’” 28 (¶ 471.) The notes from his August 2017 exit interview allegedly flag Defendants’ “‘effort

- 30 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 31 of 39

1 to expand definition of Transition costs’ that was ‘ridiculous,’ what the Audit Committee 2 ‘need[s] to worry about most’ and even ‘potentially illegal.’” (¶ 472.) 3 Plaintiffs also adequately plead loss causation. Subsequent to Symantec’s 4 announcement of the Audit Committee’s investigation in May 2018, Symantec disclosed 5 that the investigation related to the “reporting of certain non-GAAP measures” (¶ 341); 6 that its Q4 2018 financials were still “open from an accounting perspective” (¶ 348); and 7 that “the Company initiated a review by an outside accounting firm of, and took other steps 8 to enhance, the Company’s policies and procedures regarding non-GAAP measures.” 9 (¶ 357.) These subsequent disclosures sufficiently related back to the alleged 10 misrepresentations of non-GAAP measures, including T&T classifications. 11 ii. Peer Comparisons 12 Plaintiffs allege that Defendants not only reported misleading non-GAAP 13 adjustments, but also misled investors in explaining why they made such adjustments. 14 (¶¶ 176–85.) For example, in the Forms 8-K filed in May and August 2017, Symantec 15 stated that its non-GAAP reporting 16 provides meaningful supplemental information regarding the Company’s 17 operating performance . . . . We believe that these non-GAAP financial measures also facilitate comparisons of our performance to prior periods and 18 to our peers and that investors benefit from an understanding of the non- GAAP financial measures. 19 20 (¶ 178.) Plaintiffs allege that these statements were misleading because most of Symantec’s 21 peers did not adjust their non-GAAP measures for “transition costs” and because Symantec 22 was misclassifying T&T expenses that other peers were not. (¶ 179–81.) 23 Defendants argue that Plaintiffs’ claim fails on the falsity element. (MTD at 17–19.) 24 They note that the introductory language “we believe” makes clear these were statements 25 of opinion. (Id.) Opinions are actionable where the plaintiff alleges that (1) the speaker did 26 not actually hold the belief professed and the belief is objectively untrue; (2) the speaker 27 supplied a supporting fact that is untrue; or (3) the speaker omits facts going to the basis of 28 his or her opinion whose omission renders the statements misleading. City of Dearborn

- 31 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 32 of 39

1 Heights Act 345 Police & Fire Ret. Sys. v. Align Tech., Inc., 856 F.3d 605, 615–16 (9th 2 Cir. 2017) (citing Omnicare, Inc. v. Laborers Dist. Counsel Const. Indus. Pension Fund, 3 575 U.S. 175, 196 (2015)). As Defendants note, Plaintiffs do not point to any allegation 4 that Defendants did not subjectively believe that Symantec’s non-GAAP measures 5 facilitated comparisons to its peers, nor to any untrue fact embedded within the opinions. 6 (Reply at 16.) Thus, it appears that Plaintiffs are proceeding under an omissions theory. 7 (See Resp. at 23.) Accordingly, to survive dismissal at this stage, Plaintiffs must allege that 8 Defendants “omit[ed] material facts about [their] inquiry into or knowledge concerning 9 [the] statement of opinion . . . [which] conflict with what a reasonable investor would take 10 from the statement itself.” Dearborn, 856 F.3d at 615 (quoting Omnicare, 575 U.S. at 189). 11 Here, Plaintiffs allege that Defendants had no basis upon which to opine that 12 Symantec’s non-GAAP measures facilitated comparisons to its peers. (¶¶ 179, 185.) 13 Plaintiffs allege that Mr. Brown sent Defendant Noviello an email in September 2017 14 “explicitly stating that ‘We don’t have any clear/current benchmarking analysis against 15 peer companies’ with regard to non-GAAP measures.” (¶ 179.) Plaintiffs allege that E&Y’s 16 analysis showed that only two out of Symantec’s 38 peers adjusted their non-GAAP 17 measures for “transition costs”—and one of them stopped doing so prior to the Relevant 18 Period. (¶ 181.) E&Y concluded that Symantec was an “‘outlier in terms of the number of 19 [non-GAAP measures] in comparison to our peers’ and that its ‘[r]isk in terms of 20 comparison to peer’s [non-GAAP measures] reporting’ for its T&T costs was ‘High.’” 21 (¶ 181.) Symantec subsequently removed the peer comparison language from its filings but 22 did not explain why. (¶ 182.) Plaintiffs further allege that Defendants manipulated the 23 Company’s non-GAAP measures. (¶¶ 183–84.) In short, Plaintiffs have identified specific 24 facts going to the basis for Defendants’ opinion regarding peer comparisons—“facts about 25 the inquiry [Defendants] did or did not conduct or the knowledge [they] did or did not 26 have.” Dearborn, 856 F.3d at 615. Whether a reasonable investor would have been misled 27 by the omission of these facts presents a factual question; at this stage, the Court cannot 28 say that Plaintiffs’ allegations are legally insufficient or their theory implausible.

- 32 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 33 of 39

1 Defendants do not specifically challenge Plaintiffs’ peer comparisons claim on 2 scienter grounds. (See MTD at 17–19.) To the extent Defendants argue that Plaintiffs’ 3 claim fails because Plaintiffs do not plead scienter as to the underlying alleged T&T 4 misclassifications, the Court rejects that argument for the reasons stated above. The Court 5 likewise finds that Plaintiffs adequately plead loss causation. (See, e.g., ¶¶ 353, 357.) 6 iii. Switch to Stock-Based Compensation 7 Plaintiffs allege that Defendants deceptively switched bonus payouts from cash to 8 restricted stock units (“RSUs”) to artificially increase Symantec’s non-GAAP operating 9 income. (¶¶ 249–56.) Defendants argue that this claim fails because Plaintiffs do not allege 10 an adequate theory as to how Defendants’ statements relating to stock-based compensation 11 were materially misleading. (MTD at 23–24 & n.13.) The Court agrees. 12 Plaintiffs point to the SEC’s Compliance & Disclosure Interpretations, which 13 recognize that non-GAAP measures can be misleading if presented inconsistently between 14 periods. (¶ 254.) Plaintiffs state that 15 [t]he guidance specifically notes that ‘a non-GAAP measure that adjusts a 16 particular charge or gain in the current period and for which other, similar charges or gains were not also adjusted in prior periods could violate Rule 17 100(b) of Regulation G unless that change between periods is disclosed and the reasons for it explained. 18 19 (¶ 254.) But as Defendants observe, Symantec consistently adjusted non-GAAP operating 20 income to exclude stock-based compensation throughout the Relevant Period. (See, e.g., 21 RJN Ex. 5 (Form 8-K filed Nov. 1, 2017); Ex. 15 (Form 8-K filed Aug. 2, 2017); Ex. 20 22 (Form 8-K filed Jan 31, 2018).) The increase in stock-based compensation would have 23 been observable to investors. Plaintiffs do not dispute this, but nonetheless argue that 24 investors were improperly “kept in the dark” about the reason for this increase—namely, 25 to save on non-GAAP operating expenses. (¶ 251.) Plaintiffs cite no authority as to why 26 Defendants were obligated to disclose the reason for the increase when, as Plaintiffs 27 implicitly concede, the increase itself was disclosed. 28

- 33 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 34 of 39

1 Plaintiffs also fail to plead loss causation as to the allegedly misleading change to 2 stock-based bonus payouts. They point to no disclosure relating back to the change. 3 c. Deferred Revenue 4 Plaintiffs allege that Defendants misled investors about Symantec’s increasing 5 deferred revenue during the Relevant Period by falsely representing that the increase was 6 due to new business generation and failing to disclose that it was, in fact, due to increasing 7 contract duration. (¶¶ 312–24.) Defendants argue that Plaintiffs fail to point to any 8 actionable statement and fail to allege scienter. (MTD at 30–34.) The Court disagrees. 9 Plaintiffs allege that between August 2017 and February 2018, Defendants made 10 multiple statements that created the false and/or misleading impression that Symantec’s 11 increasing deferred revenue was driven by new business generation. The Court agrees that 12 two of these statements (¶¶ 404, 430) amount to the kind of “vague, generalized and 13 unspecific assertions of corporate optimism” that are not actionable. Weiss v. Amkor Tech., 14 Inc., 527 F. Supp. 2d 938, 955–56 (D. Ariz. 2007) (quotation marks and citation omitted). 15 However, other statements were assertions that “strong business activity,” “cloud 16 subscription sales,” or “a higher mix of ratable business” were driving deferred revenue. 17 (E.g., ¶¶ 426, 427, 428.) Plaintiffs have plausibly alleged that when they made these 18 statements, Defendants Clark and Noviello knew, or recklessly disregarded, what a 19 Symantec Board member later concluded: that there was a significant increase in contract 20 duration; there was “no significant evidence to support a shift towards ratable solutions 21 over the course of FY18”; and the “shift in ratable as a % of [total observable volume] 22 appears entirely driven by contract duration.” (¶ 318; see ¶¶ 494–99.) 23 Defendants had no duty to disclose why Symantec’s deferred revenue was 24 increasing during this time, but once they chose to tout the increase and attribute a reason 25 for it, “they [were] bound to do so in a manner that wouldn’t mislead investors.” Khoja, 26 899 F.3d at 1009. At this stage, the Court is not persuaded that Defendants’ decision to not 27 initially disclose the effect of increasing contract duration reflected a prudent judgment to 28 await further analysis rather than an effort to mislead investors. (See MTD at 34.) Plaintiffs

- 34 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 35 of 39

1 allege that former Symantec employees, including Defendant Garfield, believed that 2 lengthening contract duration “potentially could be misleading to an investor.” (¶ 316.) 3 Plaintiffs allege that internal emails from June/July 2017 state that the analysis “looks 4 pretty straightforward.” (¶ 496.) Plaintiffs allege that prior to the Q2 2018 conference call 5 in November 2017, explicit language concerning this issue was struck from Defendant 6 Clark’s CEO script. (¶ 498.) Evidence may shed light on what Defendants knew and when 7 they knew it. At this stage, Plaintiffs’ falsity and scienter allegations are sufficient. 8 Plaintiffs also adequately plead loss causation. Plaintiffs allege that during an 9 earnings call in May 2018, Defendants revealed “for the first time that Symantec’s contract 10 duration for its ratable business had been steadily and significantly increasing to the point 11 that it was materially impacting the presentation of the Company’s financials.” (¶ 329; see 12 also ¶ 311.) They allegedly “highlighted that ‘increased contract duration’ was one of the 13 ‘primar[y]’ reasons for the Company’s low revenue guidance.” (¶ 329.) The next day, the 14 Company’s stock price fell by over 33%. (¶ 340.) Defendants note that they had previously 15 indicated to investors in January 2018 that contract duration was increasing (see RJN Ex. 16 24), which Defendants argue defeats loss causation because the earlier disclosure was not 17 followed by a stock-price decline. (Mot. at 34–35.) However, Plaintiffs allege that the 18 January 2018 disclosure was itself misleading. (¶¶ 448–49.) It plausibly follows that the 19 more fulsome disclosure in May 2018 caused Plaintiffs’ economic loss. 20 d. Internal Controls 21 Finally, Plaintiffs allege that Defendants Clark and Noviello falsely certified that 22 Symantec maintained “effective” internal control over financial reporting (“ICFR”) and 23 disclosure controls and procedures (“DPC”), despite the many issues in Symantec’s 24 accounting practices. (¶¶ 268–85; see, e.g., ¶ 388.) Defendants first argue that this claim 25 fails because Plaintiffs fail to state claims concerning improper revenue recognition and 26 non-GAAP reporting practices. (MTD at 35.) As discussed above, the Court does not agree. 27 The parties further dispute whether Defendants were obligated to report both 28 “significant deficiencies” and “material weaknesses” in Symantec’s ICFR and DPR, or

- 35 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 36 of 39

1 only the latter. (MTD at 35; Resp. at 27.) As Plaintiffs note, they have alleged both. In any 2 event, the alleged problems in both categories plausibly contradict Defendants’ 3 certification that Symantec maintained “effective” ICFR and DCP. (¶¶ 268, 275, 390, 403, 4 425, 447.) Moreover, Plaintiffs suggest that Defendants’ certifications explicitly reference 5 “significant deficiencies” (Resp. at 27), underscoring that the parties’ disputes raise factual 6 questions. In short, Plaintiffs sufficiently allege that Symantec did not maintain effective 7 ICFR and DPR; that Defendants’ certifications to the contrary were materially false or 8 misleading; and that Defendants Clark and Noviello knew, or recklessly disregarded, that 9 the statements they were certifying were materially false or misleading. (See ¶¶ 268–85.) 10 Plaintiffs also adequately allege loss causation. Plaintiffs allege that Symantec 11 disclosed in September 2018 that its internal investigation determined that the Company’s 12 internal controls were “‘relatively weak and informal processes’ with respect to certain 13 aspects of the review, approval and tracking” of T&T expenses. (¶ 353–54.) The Company 14 disclosed additional issues with accounting practices, into which the SEC had commenced 15 an investigation. (¶¶ 355–60.) Although Plaintiffs do not allege that Symantec’s stock price 16 declined on this disclosure, it is plausible that investors interpreted the earlier disclosures 17 about the Audit Committee’s investigation as a disclosure of the ineffective controls and 18 “thus treated the actual disclosure of the fraud as something they already knew.” Di Donato 19 v. Insys Therapeutics Inc., No. CV-16-00302-PHX-NVW, 2017 WL 3268797, at *17 (D. 20 Ariz. Aug. 1, 2017) (citing Lloyd, 811 F.3d at 1210). 21 2. Claims Under Sections 20(a) and 20A 22 Lastly, Defendants argue that Plaintiffs fail to state claims under Sections 20(a) or 23 20A. (MTD at 40.) Section 20(a) creates liability for “[e]very person who, directly or 24 indirectly, controls any person liable” for violations of the securities laws. 15 U.S.C. § 25 78t(a). Section 20A creates liability for “[a]ny person who violates any provision of [the 26 Act] or the rules or regulations thereunder by purchasing or selling a security while in 27 possession of material, nonpublic information.” 15 U.S.C. § 78t–1. Section 20A limits an 28 insider’s liability to persons who purchased or sold securities “contemporaneously with the

- 36 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 37 of 39

1 purchase or sale of securities that is the subject of such violation.” Id. To the extent 2 Defendants’ arguments challenging the Sections 20(a) and 20A claims rest on their 3 arguments challenging the Section 10(b) claim, the Court’s above analysis applies equally. 4 Defendants also argue that Plaintiffs’ claim fails the contemporaneity requirement, 5 except as to Defendant Clark. (MTD at 40.) “[A]lthough the Ninth Circuit has eschewed 6 any exact delineation as to how close in time trading must be to be ‘contemporaneous,’ the 7 Ninth Circuit has explained that the rule ‘ensures that only private parties who have traded 8 with someone who had an unfair advantage will be able to maintain insider trading 9 claims.’” SEB Invest. Mgmt. AB v. Align Tech., Inc., 485 F. Supp. 3d 1113, 1135–36 (N.D. 10 Cal. 2020) (quoting Neubronner v. Milken, 6 F.3d 666, 670 (9th Cir. 1993)). Indeed, district 11 courts are divided on whether the plaintiff and defendant must have traded stock on the 12 same day. See In re Under Armour Sec. Litig., --- F. Supp. 3d ----, 2022 WL 4545286, at 13 *5 (D. Md. 2022) (noting that this interpretation is “hotly contested” and citing cases). 14 Given the policy underlying the rule, it logically follows that “trades occurring 15 before the alleged insider trading could never satisfy the contemporaneity requirement 16 because it would be impossible that Plaintiff traded with [the alleged insider] for those 17 sales.” SEB Invest., 485 F. Supp. 3d at 1136. It further follows from the Ninth Circuit’s 18 focus on an insider’s “unfair advantage,” Neubronner, 6 F.3d at 670, that “shares purchased 19 below the defendant’s sale price cannot satisfy the contemporaneity requirement, because 20 it is impossible that those trades occurred with [the] defendant at an unfair advantage.” SEB 21 Invest., 485 F. Supp. 3d at 1136; see also In re MicroStrategy, Inc. Sec. Litig., 115 F. Supp. 22 2d 620, 663 (E.D. Va. 2000) (“The fact that plaintiff bought shares at a lower price than 23 that at which defendant sold suggests that plaintiff could not have traded with defendant.”). 24 Plaintiffs’ argument and cited authority to rebut the former proposition is unpersuasive; 25 they provide no argument or authority to rebut the latter. (See Resp. at 39–40.) 26 Plaintiffs must therefore show that they purchased Symantec shares after, but still 27 contemporaneously with, Defendants’ sales of Symantec shares, and that they purchased 28 these shares at higher prices than the prices at which Defendants sold them. Plaintiffs have

- 37 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 38 of 39

1 satisfied this burden only as to Defendant Clark, who allegedly sold 13,567 shares of 2 Symantec stock on the same day Plaintiffs purchased 341,314 shares. (¶ 561.) Although 3 Plaintiffs allege that they purchased shares on September 7, 2017 at prices higher than 4 those at which Defendant Noviello sold shares on August 31, 2017, the passage of a full 5 week of trading diminishes the likelihood they traded with him. See MicroStrategy, 115 F. 6 Supp. 2d at 663 (“[A]s the temporal separation between the trades increases, the 7 increasingly dynamic nature of the securities markets, when viewed in light of the trading 8 activity of the securities involved and other circumstances in a particular case, 9 correspondingly makes it less likely that a purchaser traded with the insider . . . .” (footnotes 10 omitted). Thus, Plaintiffs fail to state a Section 20A claim as to Defendant Noviello. 11 IT IS THEREFORE ORDERED granting in part and denying in part Defendants’ 12 Omnibus Motion to Dismiss Plaintiffs’ Amended Complaint (Doc. 22). 13 As stated above, the Court concludes that Plaintiffs’ claims against all Defendants 14 under Section 18(a) of the Securities Exchange Act (Count IV) and against all Defendants 15 under Arizona common law (Count V) are time barred. These claims are dismissed. 16 As stated above, the Court further concludes that Plaintiffs’ allegations are sufficient 17 to state claims for relief against all Defendants under Section 10(b) (Count I); against 18 Defendants Clark, Noviello, and Garfield under Section 20(a) (Count II); and against 19 Defendant Clark only under Section 20A (Count III). These claims will proceed. 20 To the extent stated above, however, the Court also finds that certain of Plaintiffs’ 21 allegations are insufficient, in and of themselves, to state claims for relief under Sections 22 10(b), 20(a), and 20A. Because the Court cannot conclude that it would be futile for 23 Plaintiffs to attempt to cure the deficiencies identified above with respect to their 24 allegations under Sections 10(b), 20(a), and 20A, the Court grants Plaintiffs leave to amend 25 the operative Amended Complaint (Doc. 20) for this limited purpose, if they wish to do so. 26 Any Second Amended Complaint shall be filed within 28 days of the date of this Order. 27 IT IS FURTHER ORDERED granting in part and denying in part Defendants’ 28 Request for Incorporation by Reference and Judicial Notice in Support of Defendants’

- 38 - Case 2:21-cv-01995-JJT Document 31 Filed 02/07/23 Page 39 of 39

1 Omnibus Motion to Dismiss (Doc. 23). The Court has considered the documents submitted 2 for incorporation and notice to the extent stated above. 3 Dated this 7th day of February, 2023. 4 5 Honorable John J. Tuchi United States District Judge 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

- 39 -