United States v. Twitter, Inc.

• Court: District Court, N.D. California
• Decided: November 16, 2023
• Docket: 3:22-cv-03070
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 UNITED STATES OF AMERICA, Case No. 22-cv-03070-TSH

8 Plaintiff, ORDER RE MOTION FOR 9 v. PROTECTIVE ORDER AND RELIEF FROM CONSENT ORDER 10 TWITTER, INC., Re: Dkt. No. 17 11 Defendant.

12 13 X Corp., successor in interest to Defendant Twitter, Inc., moves the Court for an order 14 terminating or modifying the May 26, 2022 Stipulated Order for Civil Penalty, Monetary 15 Judgment, and Injunctive Relief (ECF No. 11) (the “Stipulated Order”) pursuant to Federal Rule 16 of Civil Procedure 60(b)(5)-(6) and staying the Federal Trade Commission’s (“FTC’s”) Notice of 17 Deposition of Elon Musk pursuant to Federal Rule of Civil Procedure 26. In the alternative, X 18 Corp. requests that the Court enter an order directing the FTC to provide discovery to X Corp. and 19 staying enforcement of the Stipulated Order until that discovery is produced. The Court held a 20 hearing on November 16, 2023 and now issues this order.1 21 I. BACKGROUND 22 A. The Stipulated Order 23 The United States filed a complaint in this case on May 25, 2022 against Twitter. ECF No. 24 1. The government alleged that from at least May 2013 until at least September 2019, Twitter 25 misrepresented to users of its online communication service the extent to which it maintained and 26 protected the security and privacy of their nonpublic contact information. Specifically, while 27 1 Twitter represented to users that it collected their telephone numbers and email addresses to secure 2 their accounts, the government alleged that Twitter failed to disclose that it also used user contact 3 information to aid advertisers in reaching their preferred audiences. The government claimed that 4 Twitter’s misrepresentations violated the Federal Trade Commission Act and a 2011 FTC Order 5 (ECF No. 1, Ex. A). ECF No. 1 ¶ 2. The same day the parties filed a joint motion asking the 6 Court to enter the Stipulated Order, saying that “[t]he parties have resolved all issues in this 7 matter,” ECF No. 5 at 2. The following day the Court entered the Stipulated Order. ECF No. 11. 8 Let’s read it carefully. First, the Court made seven findings:

9 1. This Court has jurisdiction over the subject matter and all of the parties. 10 2. Venue is proper as to all parties in this District. 11 3. The Complaint states a claim upon which relief may be granted 12 against Defendant under Sections 5(a) and (l), 13(b), and 16(a)(1) of the FTC Act, 15 U.S.C. §§ 45(a), 45(l), 53(b), and 56(a)(1), including 13 for violations of Part I of the Commission’s Decision and Order in In re Twitter, Inc., C-4316, 151 FTC LEXIS 162 (F.T.C. Mar. 2, 2011). 14 4. Defendant’s activities are “in or affecting commerce,” as defined 15 in Section 4 of the FTC Act, 15 U.S.C. § 44.

16 5. Defendant waives any claim that it may have under the Equal Access to Justice Act, 28 U.S.C. § 2412, concerning the prosecution 17 of this action through the date of this Stipulated Order, and agrees to bear its own costs and attorney’s fees. 18 6. Defendant neither admits nor denies any of the allegations in the 19 Complaint, except as specifically stated in the Decision and Order set forth in Attachment A. Only for purposes of this action, Defendant 20 admits the facts necessary to establish jurisdiction.

21 7. Defendant and Plaintiff waive all rights to appeal or otherwise challenge or contest the validity of this Stipulated Order. 22 Second, the Court issued a monetary judgment: 23 A. Judgment in the amount of ONE HUNDRED FIFTY MILLION 24 dollars ($150,000,000.00) is entered in favor of Plaintiff against Defendant as a civil penalty pursuant to Section 5(l) of the FTC Act, 25 15 U.S.C. § 45(l).

26 B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the United States, ONE HUNDRED FIFTY MILLION 27 dollars ($150,000,000.00), which, as Defendant stipulates, its days of entry of this Stipulated Order by electronic fund transfer in 1 accordance with instructions specified by a representative of Plaintiff.

2 C. In the event of any default in payment, the entire unpaid amount, together with interest, as computed pursuant to 28 U.S.C. § 1961 from 3 the date of default to the date of payment, shall immediately become due and payable. 4 D. Defendant relinquishes dominion and all legal and equitable right, 5 title, and interest to all funds paid pursuant to this Stipulated Order. Defendant shall make no claim to or demand for return of the funds, 6 directly or indirectly, through counsel or otherwise.

7 E. Defendant agrees that the facts alleged in the Complaint will be taken as true, without further proof, only in any subsequent civil 8 litigation by Plaintiff to enforce its rights to any payment or monetary judgment pursuant to this Stipulated Order. 9 F. Defendant acknowledges that its Taxpayer Identification Numbers 10 (Social Security Numbers or Employer Identification Numbers), which Defendant has previously submitted to Plaintiff, may be used 11 for collecting and reporting on any delinquent amount arising out of this Stipulated Order, in accordance with 31 U.S.C. § 7701. 12 Then the Court did the following, which X Corp. and the government seem to have very 13 different understandings of: 14 IT IS FURTHER ORDERED that Defendant, and its successors and 15 assigns, shall consent to: (i) reopening of the proceeding in FTC Docket No. C-4316; (ii) waiver of its rights under the show cause 16 procedures set forth in Section 3.72(b) of the Commission’s Rules of Practice, 16 C.F.R. § 3.72(b); and (iii) modifying the Decision and 17 Order in In re Twitter, Inc., C-4316, 151 FTC LEXIS 162 (F.T.C. Mar. 2, 2011), with the Decision and Order set forth in Attachment 18 A. 19 Next, the Court gave the Department of Justice (“DOJ”) the same rights that the FTC has 20 to request certain documents under the new Decision and Order (which the Court will refer to as 21 the “Administrative Order” so the reader will understand that it is reference to an FTC order, not a 22 court order):

23 IT IS FURTHER ORDERED that Defendant shall provide to the Department of Justice copies of all of the reports, assessments, 24 notifications, certifications, and other documents required or requested under the Decision and Order set forth in Attachment A as 25 follows: Parts VI.A, VI.E, VIII.A, IX, X.A, XI.A, and XI.B. Such documents shall be furnished via email to 26 Consumer.Compliance@usdoj.gov, with the subject line “United States v. Twitter, Inc., DJ 102-4022.” In the event that electronic mail 27 is unavailable, the documents may be sent to the Director of the Service) to: Director, Consumer Protection Branch, Department of 1 Justice, 450 Fifth St. NW Ste. 6400-South, Washington, DC 20001, with the subject line “United States v. Twitter, Inc., DJ 102-4022.” 2 Defendant agrees that the Department of Justice shall have the same rights as the Commission (as given in the Decision and Order set forth 3 in Attachment A) to request such documents under the specified parts, subject to any applicable law or regulation. Within fourteen (14) days 4 of receipt of a written request from a representative of the Department of Justice’s Consumer Protection Branch related to the reports, 5 assessments, notifications, certifications, and other documents produced pursuant to the parts of the Decision and Order identified in 6 this paragraph, Defendant agrees to submit additional compliance reports or other requested information, which must be sworn under 7 penalty of perjury. For purposes of this paragraph, “Defendant” shall have the same definition and scope as the definition of “Respondent” 8 in Paragraph E on page 3 of the Decision and Order set forth in Attachment A. 9 Finally, the Court ordered that “this Court shall retain jurisdiction in this matter for 10 purposes of construction, modification, and enforcement of this Stipulated Order.” 11 B. The Administrative Order 12 The Administrative Order (ECF No. 42-2) created a compliance structure for Twitter. Part 13 V mandates that Twitter establish and maintain a “comprehensive privacy and information 14 security program” (the “Program”) in order to “protect[] the privacy, security, confidentiality, and 15 integrity” of certain user information. The Administrative Order details the required content of the 16 Program, including, for example, the development and evaluation of risk-appropriate safeguards, 17 employee training, and monitoring and reporting of certain security incidents to the FTC. Part 18 V.E–I. The Administrative Order required Twitter to implement the Program by November 22, 19 2022. ECF No. 18 (Koffmann Decl.) ¶ 6. 20 Assessment of Twitter’s Program by “qualified, objective, independent third-party 21 professionals” is required by Part VI of the Administrative Order. Part VI sets forth detailed 22 requirements for those assessments, which must cover five specific elements: (1) whether Twitter 23 “has implemented and maintained the Program,” (2) “the effectiveness of [Twitter’s] 24 implementation and maintenance” of the Program, (3) identification of “any gaps or weaknesses 25 in, or instances of material noncompliance with, the Program[,]” (4) the status of any previously 26 identified gaps or weaknesses, and (5) identification of the evidence the assessor relied upon and 27 an explanation of why that evidence was appropriate and sufficient for its analysis. Part VI.D. 1 The assessor must sign its work and certify that it “conducted an independent review of the 2 Program and did not rely primarily on assertions or attestations by [Twitter’s] management.” Id. 3 In July 2022, Twitter executed a Statement of Work with Ernst & Young (“EY”) to perform this 4 assessment. ECF No. 19-2. 5 X Corp. states that in the five months between the issuance of the Administrative Order on 6 May 26, 2022 and Elon Musk’s acquisition of Twitter on October 27, 2022, the FTC sent Twitter 7 a total of three demand letters (one of which was sent on October 27, 2022). ECF No. 18 8 (Koffmann Decl.) ¶¶ 4-6. 9 C. Elon Musk Acquires Twitter 10 X Corp.2 reports that following Musk’s acquisition of Twitter, the FTC has sent X Corp. 11 17 demand letters that incorporate more than 200 individual demands. ECF No. 18 (Koffmann 12 Decl.) ¶ 7. In addition, the FTC has deposed five former Twitter employees, as well as David 13 Roque, a partner at EY. Id. ¶ 8. The FTC has also sought to depose Musk. ECF Nos. 18-11 & 14 18-12. X Corp. characterizes this as a sharp increase in investigative activity, likely aimed at 15 Musk personally, rather than legitimate investigative efforts. 16 The government says this increase in investigative activity should not be surprising 17 because Musk directed at least five rounds of terminations, layoffs or other reductions in X 18 Corp.’s workforce, which affected the security, governance, risk and compliance team. ECF No. 19 41 at 5-6. The government argues that the FTC was concerned about X Corp.’s ability to comply 20 with the Administrative Order given these significant changes to the company. As for deposing 21 Musk, the government argues that the major changes to the company appear to have been initiated 22 by Musk himself. Id. at 7-8 23 The parties focus on Roque’s deposition, highlighting different portions of his testimony. 24 X Corp. generally argues that Roque’s testimony shows that the FTC improperly bullied and 25 badgered EY, in a way that is inconsistent with EY’s role as an independent assessor. X Corp. 26 quotes Roque testifying that the FTC’s conduct made him “fe[el] as if the FTC was trying to 27 1 influence the outcome of the engagement before it had started . . .” ECF No. 18-14 at 120:20–22. 2 He testified:

3 [EY’s] obligation under our contract is to go in and do the independent assessor report and then report the facts based on the 4 results. In some of the discussions that we were having with the FTC, expectations were being conveyed about what those results should be 5 before we had even begun any procedures, and I was concerned that there was this adversarial situation occurring where you had two 6 competing parties that, stepping back, both had a desire for a certain outcome to occur that may not have always been aligned. 7 Id. at 122:4-14. “[T]he way the conversations with the FTC were transpiring” concerned Roque 8 that the FTC could pose “an adverse threat [to EY],” meaning that the FTC could be “somebody 9 outside of the arrangement [EY] had with Twitter trying to influence the outcome of [EY’s] 10 results.” Id. at 120:23–121:2. 11 When the FTC attorney deposing Roque asked him to confirm that “no one from the FTC 12 directed you to reach a particular conclusion about Twitter’s program,” he explained that “[t]here 13 w[ere] suggestions of what they would expect the outcome to be.” Id. at 122:20–24. Roque 14 testified that the “outcome” he perceived the FTC expected was that EY “would conclude that 15 there were deficiencies in Twitter’s privacy and information security program.” Id. at 120:20–22, 16 200:19–201:3. 17 Roque also testified that at a meeting in January 2023, the FTC gave EY “a list of 18 specific[] . . . types of procedures they were expecting us to execute” and “provid[ed] areas that 19 they were expecting us to look at” in connection with its “independent” assessment under the 20 Administrative Order. Id. at 201:11–15. “It was almost as if [they] were giving us components of 21 our audit program to execute.” Id. at 203:17–21. Roque explained that this level of “third party” 22 involvement in an independent testing engagement was “unusual,” especially since EY conceived 23 of its auditing role as limited to “look[ing] at the processes and controls” that make up the required 24 elements of the Program and how they operate, “[n]ot going into some of the one-offs, very 25 specific details [FTC staff] were asking us about.” Id. at 203:13–204:25. 26 The government quotes different portions of Roque’s deposition, focusing on why EY 27 chose to resign as the independent assessor and emphasizing the government’s theme that Twitter 1 was undergoing significant turmoil. Roque testified that EY chose to resign because of concerns 2 “with the timing of the engagement . . .[,] the resource availability of the client to support and 3 execute the engagement, [and] the ongoing changes amid the executive management team to be 4 able to represent compliance with the order.” Id. at 24:21-25:11. Because the “order has a very 5 specific timeline for the end of the assessment period,” EY and X Corp. had agreed that EY would 6 “be onsite starting in January of 2023.” Id. at 25:15-25, 26:8-13. However, when EY reached out 7 in December 2022, they were informed that X Corp. “did not have the resources to facilitate [EY] 8 beginning [its] procedures.” Id. at 26:17-27:6. At least weekly thereafter, EY followed up on its 9 request, but X Corp. continued pleading insufficient resources. Id. at 27:18-25. Finally, in 10 February 2023, X Corp. proposed that EY begin field work procedures on March 15, 2023. Id. at 11 27:7-11. EY was concerned, however, that this truncated period was insufficient to “actually . . . 12 complete or assess all of the controls that [it was] going to be required to look at” under the 13 Administrative Order. Id. at 25:15-25. 14 Moreover, Roque explained that the “significant amount of turnover and departure of 15 employees from the company” meant that there was “a very limited set of individuals that had 16 been identified to facilitate [EY’s] audit.” Id. at 28:3-15. Further, “[t]he large number of 17 departures that occurred at [X Corp.] in November and through early December just left holes 18 operationally,” including in terms of who could serve as the designated “owners” responsible for 19 the various controls that made up the company’s privacy and information security program. Id. at 20 33:9-34:24. These holes remained apparent to EY from information that X Corp. provided in 21 December 2022 and January 2023. Id. at 34:25-35:9. 22 Finally, Roque testified there was “constant turnover” in “the executives that were . . . 23 familiar with the [privacy and information security] programs that had been implemented.” Id. at 24 38:15-23. As part of its assessment, EY “need[ed] to obtain a representation letter” from an X 25 Corp. manager or executive who could “convey they have accurately represented and truthfully 26 shared the operation of the program.” Id. at 38:24-39:12. But by February 2023, EY was 27 “wondering if [X Corp.] would be able to have somebody in a role that could make those types of 1 II. ANALYSIS 2 A. Rule 60(b) Motion 3 1. Legal Standard 4 Rule 60(b)(5)-(6) states that “the court may relieve a party or its legal representative from a 5 final judgment, order, or proceeding for the following reasons . . . the judgment has been satisfied, 6 released, or discharged; it is based on an earlier judgment that has been reversed or vacated; or 7 applying it prospectively is no longer equitable; or any other reason that justifies relief.” 8 “‘[T]he power of a court of equity to modify a decree of injunctive relief is long- 9 established, broad, and flexible.’” Rufo v. Inmates of Suffolk County Jail, 502 U.S. 367, 381 n.6 10 (1992) (quoting New York State Ass’n for Retarded Children, Inc. v. Carey, 706 F.2d 956, 967 (2d 11 Cir. 1983)). “A district court may modify or terminate a consent decree, subject to abuse-of- 12 discretion review, if changed circumstances have caused compliance with the decree to become 13 substantially more onerous, have rendered the decree impracticable, or have caused its continued 14 enforcement to be inimical to the public interest.” Coffey v. Braddy, 834 F.3d 1184, 1193 (11th 15 Cir. 2016) (cleaned up). “[A]ny showing of a significant change in factual conditions or law 16 would justify a modification of a decree,” Patterson v. Newspaper & Mail Deliverers’ Union of 17 New York & Vicinity, 13 F.3d 33, 37 (2d Cir. 1993) (applying a “flexible standard”). 18 “In Rufo v. Inmates of Suffolk County Jail, the Supreme Court articulated the applicable 19 two-prong standard for modifying a consent decree under Rule 60(b)(5).” United States v. Asarco, 20 430 F.3d 972, 979 (9th Cir. 2005). “The moving party must satisfy the initial burden of showing a 21 significant change either in factual conditions or in the law warranting modification of the 22 decree. The district court must then determine whether the proposed modification is suitably 23 tailored to resolve the problems created by the changed factual or legal conditions.” Id. (cleaned 24 up). “In particular, [i]f the movant cites significantly changed factual conditions . . . it must 25 additionally show that the changed conditions make compliance with the consent decree more 26 onerous, unworkable, or detrimental to the public interest.” Id. (cleaned up). 27 2. Analysis 1 the FTC’s abusive investigation conduct. X Corp. argues that the FTC radically shifted its 2 investigative strategy after Musk acquired Twitter, imposing new and burdensome demands and 3 treating the Stipulated Order as license for invasive scrutiny of any move X Corp. makes, no 4 matter how remote from data privacy and security concerns. X Corp. argues that the agency’s 5 ongoing overreach raises serious concerns about due process and prosecutorial misconduct, as 6 well as the fairness of, and public confidence in, agency investigations and proceedings. X Corp. 7 in particular points to the FTC’s alleged interference with EY’s ability to be an independent 8 assessor as striking at the heart of the compliance mechanism that was put in place. X Corp. says 9 that the FTC’s newly adopted enforcement regime constitutes a “changed circumstance” rendering 10 continued enforcement of the Stipulated Order “no longer equitable.” 11 But there is a problem with this motion. The obligations that X Corp. seeks to be relieved 12 of come from the FTC’s Administrative Order, not this Court’s Stipulated Order. Remember what 13 the Stipulated Order did: It made some findings; it imposed a monetary judgment; it ordered 14 Twitter to consent to the reopening of the FTC proceeding and to the modification of the prior 15 FTC order with the new one attached as Attachment A to the Stipulated Order; it gave DOJ the 16 same rights the FTC has to obtain certain documents under the Administrative Order; and it 17 retained jurisdiction “for purposes of construction, modification, and enforcement of this 18 Stipulated Order.” ECF No. 11, Ex. A. 19 For the most part, the Stipulated Order does not require X Corp. to comply with the 20 Administrative Order.3 The Administrative Order stands on its own as an FTC order. The Court 21 says “for the most part” because section III of the Stipulated Order obligates X Corp. to provide 22 certain documents to DOJ that are contemplated by the Administrative Order, and DOJ would not 23 otherwise have that right. But even if the Court were to wipe away section III, such that literally 24 nothing in the Stipulated Order required X Corp. to comply with the Administrative Order, X 25 3 At the hearing, X Corp. shifted focus and argued that what it really wants is to be relieved of the 26 Court’s ability to enforce the Administrative Order via contempt sanctions. This was a significant shift from the focus of the written briefing. In any event, the Court is of the view that it has the 27 power to enforce only the literal terms of the Stipulated Order. Aside from the obligation to 1 Corp. would still be bound by the Administrative Order and subject to the FTC’s enforcement of 2 it. Indeed, even if the Court completely vaporized the entirety of the Stipulated Order, X Corp. 3 would still be bound by the Administrative Order. 4 As noted previously, section II of the Stipulated Order provides that:

5 IT IS FURTHER ORDERED that Defendant, and its successors and assigns, shall consent to: (i) reopening of the proceeding in FTC 6 Docket No. C-4316; (ii) waiver of its rights under the show cause procedures set forth in Section 3.72(b) of the Commission’s Rules of 7 Practice, 16 C.F.R. § 3.72(b); and (iii) modifying the Decision and Order in In re Twitter, Inc., C-4316, 151 FTC LEXIS 162 (F.T.C. 8 Mar. 2, 2011), with the Decision and Order set forth in Attachment A. 9 The Court reads this provision literally to mean that it ordered Twitter to consent to the 10 reopening of the FTC proceeding, to waive its rights under the FTC’s show cause procedures, and 11 to consent to the modification of the previous FTC order with the new Administrative Order. This 12 sped up the issuance of the Administrative Order, but it does not mean that the Administrative 13 Order became a Court order. And though this Court’s Stipulated Order sped up the issuance of the 14 Administrative Order, it did not breathe life into it. The Administrative Order has life and legal 15 force because it is an FTC order. 16 Rule 60(b) allows the Court to modify its own orders, not another tribunal’s orders. There 17 is no modification the Court can make to the Stipulated Order that will relieve X Corp. of the 18 obligation to comply with the Administrative Order. (And please remember that this case is not a 19 petition to review an FTC order, which cannot be filed in a district court anyway. 15 U.S.C. § 20 45(c).) The Court lacks the power to grant X Corp. the requested relief, i.e., relief from its 21 prospective obligations under the Administrative Order. Accordingly, X Corp.’s motion to 22 terminate or modify the Stipulated Order is DENIED. 23 B. Alternative Request for Discovery or to Stay Musk’s Deposition 24 There is authority for the proposition that the Court may order discovery in aid of a Rule 25 60(b) motion. See, e.g., Midwest Franchise Corp. v. Metromedia Restaurant Group, Inc., 177 26 F.R.D. 438, 442 (ND. Iowa 1997); Sathianathan v. Smith Barney, Inc., 2007 WL 2417370, *3 27 (N.D. Cal. Aug. 24, 2007) (“some preliminary discovery before a ruling on a Rule 60 Motion is 1 appropriate so long as a party acts in good faith and makes out a reasonable case that discovery 2 || might lead to relevant information”) (cleaned up). 3 Here, however, no discovery is necessary or appropriate. The flaw in X Corp.’s motion is 4 || purely legal: X Corp. is seeking to be relieved from its prospective obligations under the 5 Administrative Order, and there is no order the Court can issue under Rule 60(b), or under any 6 || other Rule, that would accomplish that. Accordingly, discovery would not serve any purpose for 7 this judicial proceeding. 8 The Court also does not understand how it could order the FTC not to depose Musk. The 9 || Stipulated Order does not mean that the Court is supervising the FTC’s enforcement of the 10 || Administrative Order. 11 X Corp.’s alternative request for discovery or to stay Musk’s deposition is therefore a@ 12 || DENIED.

I. CONCLUSION

14 X Corp.’s motion is DENIED in its entirety. 15 IT IS SO ORDERED. 16

= 17 Dated: November 16, 2023 ° Zz 18 TAA. |} 4 — THOMAS S. HIXSON 19 United States Magistrate Judge 20 21 22 23 24 25 26 27 28