Omar Abdulaziz v. Twitter, Inc.

NOT FOR PUBLICATION FILED UNITED STATES COURT OF APPEALS NOV 6 2024 MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS FOR THE NINTH CIRCUIT OMAR ABDULAZIZ, No. 21-16195 Plaintiff-Appellant, D.C. No. 3:19-cv-06694-LB v. MEMORANDUM* TWITTER, INC., Defendant-Appellee, and MCKINSEY & COMPANY, Defendant. Appeal from the United States District Court for the Northern District of California Laurel D. Beeler, Magistrate Judge, Presiding Argued and Submitted December 4, 2023 San Francisco, California Before: COLLINS, FORREST, and SUNG, Circuit Judges. Dissent by Judge COLLINS. Plaintiff-Appellant Omar Abdulaziz appeals the district court’s dismissal of his state-law negligence-based claims asserted against Defendant-Appellee Twitter, * This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. Inc.1 We have jurisdiction under 28 U.S.C. § 1291, and we affirm but on different grounds than those relied on by the district court. 1. Standing. The district court held that Abdulaziz lacked Article III standing. “We review de novo an order granting a motion to dismiss for lack of standing,” accepting all factual allegations in the complaint as true and drawing all reasonable inferences in the non-movant’s favor. Iten v. County of Los Angeles, 81 F.4th 979, 983 (9th Cir. 2023). To establish Article III standing,2 a plaintiff must demonstrate (1) an injury in fact, (2) fairly traceable to the challenged conduct of the defendant (causation), and (3) likely to be redressed by a favorable judicial decision. Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). We conclude that Abdulaziz has pled sufficient facts to satisfy these requirements. An injury in fact is “an invasion of a legally protected interest” that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992) (internal quotation marks and citation omitted). Theft of personal identifying information is 1 We grant Twitter’s motion to take judicial notice of court filings in other proceedings related to this case [Dkt. 46]. See United States v. Aguilar, 782 F.3d 1101, 1103 n.1 (9th Cir. 2015) (“[W]e may take notice of proceedings in other courts, both within and without the federal judicial system, if those proceedings have a direct relation to matters at issue.” (quoting United States ex rel. Robinson Rancheria Citizens Council v. Borneo, Inc., 971 F.2d 244, 248 (9th Cir.1992))). 2 The parties disagree about whether California law applies to the standing analysis. On this issue, the Supreme Court is clear: in federal court, federal standing law applies. Hollingsworth v. Perry, 570 U.S. 693, 715 (2013). 2 sufficient to establish injury in fact. See In re Zappos.com, Inc., 888 F.3d 1020, 1027 (9th Cir. 2018); see also Krottner v. Starbucks Corp., 628 F.3d 1139, 1140, 1143 (9th Cir. 2010). Here, Abdulaziz, a Saudi dissident, alleged that two operatives of the Kingdom of Saudi Arabia (KSA) who worked for Twitter accessed his Twitter accounts without authorization and provided his personal information to the KSA. He further asserts that the KSA used that information to embed surveillance malware on his smartphone by sending his phone a spear-phishing text message. The Twitter data breach by hostile foreign intelligence operatives and the alleged consequences of that breach are more than sufficient to demonstrate cognizable injury. See In re Zappos.com, 888 F.3d at 1027 (holding that a data breach placing customers “at higher risk of ‘phishing’ and ‘pharming’” was sufficient to establish injury). Abdulaziz has also shown that his injury is traceable to Twitter. “[T]he traceability requirement is less demanding than proximate causation, and thus the ‘causation chain does not fail solely because there are several links’ or because a single third party’s actions intervened.” O’Handley v. Weber, 62 F.4th 1145, 1161 (9th Cir. 2023) (quoting Maya v. Centex Corp., 658 F.3d 1060, 1070 (9th Cir. 2011)). Abdulaziz alleges that KSA operatives misused their employment position at Twitter and accessed his personal contact information without authorization using company software, which would have sent a security alert to Twitter. He contends 3 that had Twitter not been negligent in maintaining its security system and hiring and managing its employees, KSA operatives could not have accessed his personal information associated with his public and pseudonymous Twitter accounts. Abdulaziz further asserts that because Twitter did not reveal the details of its employees’ data breach, he did not have reason to get a new phone and phone number or to be concerned about hyperlinks embedded in text messages. Accepting Abdulaziz’s allegations as true, it is “possible to draw a causal line” between Twitter’s actions, or lack thereof, and the consequent injury that he suffered.3 O’Handley, 62 F.4th at 1161–62. Finally, redressability largely overlaps with traceability but is “distinct in that” it “analyzes the connection between the alleged injury and requested relief.” Mecinas 3 The Supreme Court’s recent decision in FDA v. Alliance for Hippocratic Medicine, 602 U.S. 367 (2024), does not undermine this analysis. Although the Court emphasized that “plaintiffs attempting to show causation generally cannot rely on speculation about the unfettered choices made by independent actors not before the courts” . . . [and] “must show that the third parties will likely react in predictable ways that in turn will likely injure the plaintiffs,” Twitter’s causal connection to the injury does not “rely on speculation.” Id. at 383 (internal quotation marks and citations omitted). The plaintiffs in Alliance for Hippocratic Medicine had “more difficulty establishing causation,” id. at 382, because they alleged injuries from “the government’s ‘unlawful regulation (or lack of regulation) of someone else,’” id. (quoting Lujan, 504 U. S. at 562), and “future injuries to unregulated [third parties],” id. at 385 n.2. Unlike those plaintiffs, Abdulaziz is alleging injuries on his own behalf that have already occurred and that can be directly linked to Twitter’s allegedly inadequate security system, leaving Abdulaziz with no protection against predictable harm. See id. at 388–90 (holding that “as a matter of fact” federal law protects plaintiff-doctors from injury, which “breaks any chain of causation”). 4 v. Hobbs, 30 F.4th 890, 899 (9th Cir. 2022) (citation omitted). Here, where Abdulaziz has alleged a causal connection between his injury and Twitter’s actions, he has also shown redressability as it relates to his damages claims.4 See State Farm Mut. Auto. Ins. Co. v. Campbell, 538 U.S. 408, 416 (2003). For these reasons, we conclude that Abdulaziz has sufficiently alleged Article III standing. 2. Statute of Limitations. As a threshold matter, Twitter argues that Abdulaziz “forfeited any challenge to the district court’s ruling on the statute of limitations” because he did not raise this issue in his opening brief. We reject that argument. See Warmenhoven v. NetApp, Inc., 13 F.4th 717, 728–29 (9th Cir. 2021) (“Petitioner does not waive a challenge to any ground for [the district court’s ruling] in its opening brief on appeal that was not relied on in the district court’s order.” (citation omitted) (alteration in original)). Alternatively, Twitter argues that if Abdulaziz did not forfeit this issue, the district court’s dismissal order should be affirmed because Abdulaziz’s claims are time-barred. Abdulaziz does not challenge Twitter’s statute-of-limitations argument on the merits and instead argues in reply 4 To the extent Abdulaziz is requesting injunctive relief, he has not established standing because he did not plausibly allege any future harm or ongoing effects from Twitter’s actions. See Fleming v. Charles Schwab Corp., 878 F.3d 1146, 1151 n.1 (9th Cir. 2017) (explaining that “[p]ast exposure to illegal conduct does not in itself show a present case or controversy regarding injunctive relief” unless the challenged conduct “continuing” and has “present adverse effects” (quoting City of Los Angeles v. Lyons, 461 U.S. 95, 102 (1983))). 5 that this issue “is not before this Court” because “the District Court did not dismiss the [operative] complaint on statute of limitations grounds.”5 Abdulaziz’s procedural argument is misplaced. Regardless of whether the district court based its decision on the statute of limitations, Twitter preserved this argument by raising it in its motion to dismiss the operative complaint and “we may affirm the district court’s dismissal on any ground that is supported by the record, whether or not the district court relied on the same ground.” Silk v. Bond, 65 F.4th 445, 456 (9th Cir. 2023) (quoting Hartmann v. Cal. Dep’t of Corr. & Rehab., 707 F.3d 1114, 1121 (9th Cir. 2013)). “We review de novo the question of when a cause of action accrues and whether a claim is barred by the statute of limitations,” Oja v. U.S. Army Corps of Eng’rs, 440 F.3d 1122, 1127 (9th Cir. 2006), and we hold that Abdulaziz’s claims are untimely. Abdulaziz’s state-law negligence claims are governed by California’s two- year statute of limitations. Cal. Civ. Proc. Code § 335.1 (2003); Nev. Power Co. v. Monsanto Co., 955 F.2d 1304, 1306 (9th Cir. 1992). Abdulaziz had no way of knowing about Twitter’s alleged negligence until Twitter provided notice of the 5 Abdulaziz suggests that Twitter needed to cross-appeal in order to preserve the statute of limitations for appeal. This is incorrect. A cross-appeal is required only when an appellee seeks relief from the district court’s judgment. See Ellis v. Salt River Project Agric. Improvement & Power Dist., 24 F.4th 1262, 1268 (9th Cir. 2022) (appellee “should not cross-appeal if all it wishes to do is present alternative grounds for affirming the judgment”). 6 unauthorized access of his accounts. Thus, the “discovery rule” applies. Fox v. Ethicon Endo-Surgery, Inc., 35 Cal. 4th 797, 807 (2005) (“An important exception to the general rule of accrual is the ‘discovery rule,’ which postpones accrual of a cause of action until the plaintiff discovers, or has reason to discover, the cause of action.” (citation omitted)). On December 11, 2015, Twitter sent “safety” notices to its account holders whose accounts appeared to have been accessed without authorization. The notice advised: “As a precaution, we are alerting you that your Twitter account is one of a small group of accounts that may have been targeted by state-sponsored actors.” The notice did not identify the state actors involved. Twitter presented evidence, of which the district court took judicial notice, showing that Abdulaziz received this notice two ways, both via the email address that he provided to Twitter and through an in- application message. Abdulaziz denies that he and his allies on Twitter received this notice. But Abdulaziz need not have received actual notice to trigger the discovery rule— constructive notice suffices. See Cmtys. for a Better Env’t v. Bay Area Air Quality Mgmt. Dist., 1 Cal. App. 5th 715, 722 (2016) (“[I]n actions where the [discovery] rule applies, the limitations period does not accrue until the aggrieved party has notice, either actual or constructive, of the facts constituting the injury.” (internal quotation marks and citation omitted)). Aside from his summary denial that he 7 neither received the December 2015 notices from Twitter, nor saw the contemporaneous media coverage about these notices, Abdulaziz does not offer any cogent justification for failing “at least to suspect a factual basis” for his cause of action during this time period. Fox, 35 Cal. 4th at 807 (emphasis added) (citation omitted); see also Marchisheck v. San Mateo County, 199 F.3d 1068, 1078 (9th Cir. 1999). Furthermore, Abdulaziz conceded that he received a threatening direct message through his Twitter account no later than December 3, 2015, and a separate notice from Twitter in February 2016 stating that his data may have been viewed “by another user.” Despite the various circumstances giving Abdulaziz “reason to discover” his negligence-based claims against Twitter at least by early 2016, he did not file this action until October 2019, well beyond the applicable two-year statute of limitations. Cal. Code Civ. Proc. § 335.1. We therefore affirm the dismissal of this action based on the statute of limitations, and we do not reach Abdulaziz’s remaining arguments. AFFIRMED. 8  FILED Abdulaziz v. Twitter, Inc., No. 21-16195 NOV 6 2024 MOLLY C. DWYER, CLERK COLLINS, Circuit Judge, dissenting: U.S. COURT OF APPEALS In this diversity suit brought against Defendant-Appellee Twitter, Inc. (“Twitter”), Plaintiff-Appellant Omar Abdulaziz alleges that, due to Twitter’s negligence, two Twitter employees who were assertedly intelligence operatives of the Kingdom of Saudi Arabia (“KSA”) were able to access Abdulaziz’s private information and turn it over to the KSA, which then used it to harass Abdulaziz and his family. The district court dismissed the operative complaint with prejudice, concluding that Abdulaziz had failed to allege sufficient facts to establish that Twitter caused his injuries, for purposes of either Article III standing or the merits of his negligence-based claims. I agree with the majority that Abdulaziz sufficiently alleged causation of injury to establish Article III standing and that the district court erred in holding otherwise. The majority nonetheless proceeds to affirm the district court’s dismissal of Abdulaziz’s negligence claims on the merits. The majority does so, not on the ground that Abdulaziz failed to allege causation for purposes of negligence (an issue that the majority does not reach), but rather on the ground that the negligence claims are barred by the statute of limitations. In my view, the allegations of Abdulaziz’s operative complaint are sufficient to establish causation for purposes of negligence as well as to show that his claims are timely. Because I would accordingly reverse the district court’s judgment, I respectfully dissent. I Abdulaziz’s negligence claims are timely under California’s applicable two- year statute of limitations. See CAL. CODE CIV. PROC. § 335.1. A As a threshold matter, I reject Twitter’s contention that Abdulaziz forfeited the statute-of-limitations issue by failing to discuss the merits of that issue in his opening brief. “An appeal from a final judgment draws in question all earlier, non-final orders and rulings which produced the judgment.” Litchfield v. Spielberg, 736 F.2d 1352, 1355 (9th Cir. 1984) (emphasis added). Accordingly, to set aside the judgment against him in its entirety on appeal, Abdulaziz’s opening brief needed to establish that each independently sufficient ground, or set of grounds, on which that judgment rested was erroneous. Here, the order dismissing the final, operative version of the complaint rested only on Abdulaziz’s failure to adequately allege causation for purposes of Article III standing and the merits. Although the district court’s prior dismissal orders had been based alternatively on the statute of limitations, those prior orders granted leave to amend, leading to the filing of new complaints.1 “It is well-established in our circuit that an ‘amended complaint 1 Twitter suggests that the district court’s penultimate order intended to allow 2 supersedes the original, the latter being treated thereafter as non-existent.’” Ramirez v. County of San Bernardino, 806 F.3d 1002, 1008 (9th Cir. 2015) (citation omitted). Consequently, to the extent that the district court believed that the final complaint failed to cure previously identified defects, it was incumbent upon the court to state, in its final dismissal order, which deficiencies still remained. That is especially true given that Abdulaziz’s operative amended complaint contained additional allegations that arguably bore on the statute-of- limitations issue.2 Here, the court’s final order did not rely on the statute of limitations, and so that issue cannot be said, in whole or in part, to have “produced the judgment.” Litchfield, 736 F.2d at 1355. Abdulaziz therefore had no obligation to address the statute of limitations in his opening brief on appeal. See Warmenhoven v. NetApp, Inc., 13 F.4th 717, 729 (9th Cir. 2021). At oral argument, Twitter asserted that, even if Abdulaziz had no obligation repleading only as to causation, and not as to the statute of limitations, but that is not a reasonable reading of that order. It would make no sense to pointlessly grant leave to replead claims that the district court had already definitively determined fail on other grounds. 2 In its penultimate dismissal order, the district court held that notices that Twitter claimed it sent to impacted users, including Abdulaziz, via email and an in-app notification in December 2015 sufficed to trigger the statute of limitations. In his operative amended complaint, Abdulaziz added new allegations further detailing his claim that he never received those notices. In its final motion to dismiss, Twitter argued that the popular press widely reported the security breach in December 2015 as well, and Abdulaziz disputed that contention in his opposition to Twitter’s motion. The district court’s final order did not purport to resolve these points or the statute-of-limitations issue more generally. 3 to address the statute of limitations in his opening brief, his failure to respond after Twitter raised the issue in its answering brief amounted to a forfeiture of the issue under Sabra v. Maricopa County Community College District, 44 F.4th 867, 881– 83 (9th Cir. 2022). But Sabra is a very narrow decision that is plainly inapplicable here. In that case, we held that the appellants “abandoned” one particular claim, in favor of pressing only their remaining claims, when their reply brief “failed to address or even mention” the particular ground for affirming dismissal of that claim that was raised in the answering brief. Id. at 881 (emphasis added). Here, by contrast, nothing in Abdulaziz’s reply brief suggests a comparable selective abandonment of a particular claim. Far from failing to “even mention” Twitter’s invocation of the statute of limitations, Abdulaziz argued in his reply brief that the issue was not properly before this court and should not be reached in resolving this appeal. Moreover, in contrast to the situation in Sabra, which involved selective abandonment of a particular claim in the reply brief, here it would be wholly unreasonable to conclude (as Twitter contends) that Abdulaziz abandoned the merits of his entire appeal simply because, beyond stating that the statute-of- limitations issue should not be reached, he did not also discuss the merits of that issue in his reply brief. Reply briefs, after all, are optional, and a failure of a reply brief to address the merits of an alternative case-dispositive ground for affirmance raised only in the answering brief cannot fairly be said to result in forfeiture of an 4 entire appeal, any more than the failure to file a reply brief at all could be said to do so. B As to the merits of the statute-of-limitations issue, I disagree with the majority’s conclusion that Abdulaziz’s claims can be said to be time-barred under the standards applicable to a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6). Under California law, a cause of action accrues when “the plaintiff discovers, or has reason to discover, the cause of action.” Fox v. Ethicon Endo- Surgery, Inc., 110 P.3d 914, 920 (Cal. 2005). A plaintiff “has reason to discover the cause of action when he has reason at least to suspect a factual basis for its elements.” Norgart v. Upjohn Co., 981 P.2d 79, 88 (Cal. 1999). In turn, “[h]e has reason to suspect when he has ‘notice or information of circumstances to put a reasonable person on inquiry.’” Id. (simplified). Under this standard, Abdulaziz did not have reason to discover the cause of action until October 2018, when he learned from a New York Times article that a suspected agent of the KSA employed by Twitter had used employee access privileges to obtain his personal information. At no prior point did he have notice or information that would have put a reasonable person on inquiry that his asserted injuries at the hands of the KSA were traceable to Twitter’s conduct. Fox, 110 P.3d 5 at 924 (“[I]f a plaintiff’s reasonable and diligent investigation discloses only one kind of wrongdoing when the injury was actually caused by tortious conduct of a wholly different sort, the discovery rule postpones accrual of the statute of limitations on the newly discovered claim.”). Because the statute of limitations as to any claim against Twitter thus began to run only in October 2018, Abdulaziz’s action for negligence-based claims, filed one year later in October 2019, was timely. Neither the majority here nor the district court below offers persuasive arguments to the contrary. The majority points in part to a threatening direct message Abdulaziz received on Twitter no later than December 2015, as well as to an unrelated February 2016 notice from Twitter stating that Abdulaziz’s data may have been viewed by another user due to a software bug. But these facts are not enough to put a reasonable person on inquiry notice of this cause of action, which rests on entirely different alleged conduct by Twitter that assertedly led to the otherwise seemingly unrelated harassment by the KSA. The majority also cites the December 2015 notices from Twitter and the contemporaneous media coverage of the disclosed security breach as providing constructive notice that would put a reasonable person on inquiry. Abdulaziz, however, alleged that he did not receive the December 2015 notices from Twitter, 6 and we must take that allegation as true for purposes of this appeal.3 Abdulaziz also disputes that the December 2015 notice was widely publicized in the media, and there is no basis for concluding that, based on this limited publication, Abdulaziz was aware of facts that would put him on inquiry notice. See Unruh- Haxton v. Regents of University of Cal., 76 Cal. Rptr. 3d 146, 163 (Ct. App. 2008) (rejecting the view that “public awareness of a problem through media coverage alone creates constructive suspicion for purposes of discovery” and holding that “[t]he statute of limitations does not begin to run when some members of the public have a suspicion of wrongdoing, but only ‘once the plaintiff has a suspicion of wrongdoing’” (emphasis added) (simplified)). In all events, the December 2015 notice concerning third-party “targeting” of accounts does not provide inquiry notice of malevolent insider conduct by Twitter employees. In sum, because the well-pleaded facts adequately alleged that Abdulaziz did not have reason to discover this cause of action until October 2018, the complaint was not barred by California’s statute of limitations. 3 The highly redacted record produced by Twitter, together with an accompanying declaration from a Twitter employee explaining it, is manifestly not a matter that is subject to judicial notice. See FED. R. EVID. 201(b) (stating that a court “may judicially notice a fact that is not subject to reasonable dispute because it: (1) is generally known within the trial court’s territorial jurisdiction; or (2) can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned”). Moreover, the submitted record does not indisputably establish that Abdulaziz actually received the December 2015 notice, and we may not draw circumstantial inferences from that record that contradict Abdulaziz’s allegations. Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1003 (9th Cir. 2018). 7  II The complaint also pleaded sufficient facts to establish a plausible theory of causation of injury for purposes of the merits of Abdulaziz’s negligence claims— namely, that, because of Twitter’s negligence, foreign intelligence operatives were able to obtain Abdulaziz’s personal information and thereby implant surveillance malware on his smartphone. The district court held that Abdulaziz did not adequately plead proximate causation because the harm he allegedly suffered was too remote in time from Twitter’s alleged negligence. But under California law, temporal proximity is not absolutely necessary for proximate causation; it merely “afford[s] evidence for or against” proximate causation. Mitchell v. Gonzales, 819 P.2d 872, 877 (Cal. 1991) (citation omitted). Here, Abdulaziz overcame the lack of temporal proximity by pleading sufficient facts to plausibly claim that the KSA did not implant malware on his smartphone sooner because it first needed time to acquire the technical capabilities to do so. Nor do the intervening acts of foreign intelligence operatives sever the chain of causation so as to defeat proximate causation as a matter of law. “It is well settled in [California] . . . that an intervening act does not amount to a ‘superseding cause’ relieving the negligent defendant of liability if it was reasonably foreseeable.” Landeros v. Flood, 551 P.2d 389, 395 (Cal. 1976) (citation omitted). “Moreover, . . . that foreseeability may arise directly from the risk created by the 8 original act of negligence: ‘If the likelihood that a third person may act in a particular manner is . . . one of the hazards which makes the actor negligent, such an act whether innocent, negligent, intentionally tortious, or criminal does not prevent the actor from being liable for harm caused thereby.’” Id. (emphasis omitted) (citation omitted). It was reasonably foreseeable that Twitter’s alleged failure to implement reasonable security systems and internal controls would enable third parties to use corrupt or corruptible Twitter employees to surreptitiously access users’ personal information. Moreover, the risk of improper access by such malevolent third parties is precisely one of the foreseeable hazards that makes Twitter’s lax security measures negligent. * * * For the foregoing reasons, I would reverse the dismissal of Abdulaziz’s negligence claims. I respectfully dissent. 9