Abdulaziz v. Twitter, Inc. et al

Filing 107

ORDER. In the attached order, the court grants 99 the defendant's motion to dismiss the third-amended complaint with leave to amend (given the plaintiff's representations at the hearing that he can plead facts to cure the defects regarding causation). Any amended complaint must be filed within 21 days of this order and must include as an attachment a blackline of the amended complaint.(lblc2S, COURT STAFF) (Filed on 2/18/2021)

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 1 of 13

1
2
3
4
5
6
7
8

UNITED STATES DISTRICT COURT

9

NORTHERN DISTRICT OF CALIFORNIA

10

San Francisco Division

United States District Court
Northern District of California

11

OMAR ABDULAZIZ,

12

Plaintiff,

Case No. 19-cv-06694-LB
ORDER GRANTING MOTION TO
DISMISS

13

v.

14

TWITTER, INC.,

Re: ECF No. 99

Defendant.

15
16

INTRODUCTION

17
18

The plaintiff Omar Abdulaziz is a political dissident who moved to Canada in 2009 and was

19

granted political asylum there in 2014 based on the Kingdom of Saudi Arabia’s persecution of him.1

20

In this lawsuit, he alleges that in 2014, Saudi authorities recruited two employees of the social-

21

media company Twitter to access his confidential Twitter data and thereafter used malware in 2018

22

to hack his phone (and obtain texts, emails, and other information) and then targeted his family.
In an earlier complaint, the plaintiff sued Twitter for violating the Stored Communications Act,

23
24

California’s Unfair Competition Law, and state law. The state claims included Twitter’s negligent

25

hiring, supervision, and retention of employees.2 The court dismissed the claims for lack of Article

26
27
28

Third Am. Compl. (TAC) – ECF No. 98 at 2 (¶ 1). Citations refer to material in the Electronic Case
File (ECF); pinpoint citations are to the ECF-generated page numbers at the top of documents.
1

2

First Am. Compl. (FAC) – ECF No. 38 at 22–30 (¶¶ 114–78).

ORDER – No. 19-cv-06694-LB

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 2 of 13

1

III standing and, alternatively, for the plaintiff’s failure to plausibly plead that Twitter ratified its

2

employees’ conduct or otherwise had vicarious liability. This disposed of all claims except the

3

negligent-hiring claims, which the court held were barred by the statute of limitations.3
In his amended complaint, the plaintiff sued Twitter for negligent supervision and retention of

4
5

its employees and negligence. Twitter moved to dismiss the claims for failure to establish causation

6

for Article III standing or negligence, as barred by statute of limitations and its terms of service, and

7

because the plaintiff did not plausibly allege its negligence. The court grants the motion on all

8

grounds except for the terms of service, which the court does not reach on this briefing.

9
STATEMENT

10

United States District Court
Northern District of California

11

1. The Plaintiff’s Political Activism
In 2009, the plaintiff moved from Saudi Arabia to Canada to attend a Canadian university and

12
13

was granted asylum in 2014 based on his fear of persecution in Saudi Arabia.4 As a student, the

14

plaintiff discussed Saudi Arabian politics on Twitter and other social-media platforms, criticizing

15

the governing regime, the royal family, and human-rights violations.5 The plaintiff was a close ally

16

of Jamal Khashoggi, who was assassinated in October 2018 — by order of the Crown Prince

17

Mohammad Bin Salman (according to the CIA) — in the Saudi consulate in Istanbul.6 The plaintiff

18

and Mr. Khashoggi had been collaborating on a “range of political activities with the objective of

19

educating the public in Saudi Arabia.”7 The plaintiff has a large social-media following: over a half-

20

million followers on Twitter and over 163,000 subscribers to his YouTube channel.8

21
22
3

Order – ECF No. 76 at 2.

4

TAC – ECF No. 98 at 3 (¶ 8).

24

5

Id.

25

6

Id. at 4 (¶ 10).

7

Id.

23

26

Id. at 34 (¶ 154) (Twitter); FAC – ECF No. 38 at 5 (¶ 16) (Twitter and YouTube). The court can
consider statements in the plaintiff’s earlier complaint as a party admission. Phillips et al., Fed Civ. P.
Before Trial § 9:223 (2020) (citing Andrews v. Metro N. Commuter R.R. Co., 882 F.2d 705, 707 (2nd
Cir. 1989)). Here, the plaintiff’s social-media status is relevant to the analysis of the claims.
8

27
28

ORDER – No. 19-cv-06694-LB

2

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 3 of 13

1

2. Saudi Arabia Obtained Information About the Plaintiff

2

In addition to its access to publicly available information about the plaintiff, Saudi Arabia

3

obtained information about him through two means: (1) his private Twitter information accessed

4

unlawfully by Twitter employees and (2) planting malware on his phone and then hacking the phone.

5

2.1 Twitter Employees Gain Access to the Plaintiff’s Twitter Information

6

Saudi Arabia allegedly recruited two Twitter employees — Ali Alzabarah (a Saudi citizen and

7

a U.S. resident since 2005 and a site-reliability engineer for Twitter from August 2013 to

8

December 2015) and Ahmad Abouammo (an American citizen and a Media Partnerships Manager

9

for Twitter for the Middle East and North Africa region from November 2013 to May 2015) — to
access certain Twitter accounts without Twitter’s authorization.9 Abouammo began the

11

United States District Court
Northern District of California

10

unauthorized access in December 2014, and Alzabarah began in May 2015.10 The plaintiff alleges

12

that Alzabarah accessed his confidential information, including his passwords, IP addresses, and

13

direct messages, in June and July 2015.11 Federal prosecutors investigated the unauthorized access

14

and ultimately charged both former employees criminally in November 2019 with acting as agents

15

of a foreign government in violation of 18 U.S.C. § 951.12

16

The TAC alleges that the FBI met with Twitter in late 2015, said that Alzabarah was the mole

17

and that the FBI investigation was sensitive and ongoing, and “expressly asked Twitter not to tell

18

Alzabarah what was going on as it could hurt the case[.]”13 Twitter allegedly refused to comply

19

with this request and instead, confronted Alzabarah with accusations that he improperly accessed

20

user accounts.14 He admitted that he had done so. Twitter did not detain Alzabarah (despite

21

allegedly having the legal authority to do so under California Penal Code § 837) so that the FBI

22
23
24

9

Id. at 8–10 (¶¶ 31–45); 13–14 (¶¶ 59–62).

10

Id. at 10 (¶ 46); 13 (¶ 61).

25

11

Id. at 14–15 (¶ 67–69).

26

12

27

13

TAC – ECF No. 98 at 20 (¶ 97).

28

14

Id. at 20–21 (¶ 98).

United States v. Abouammo, No. 3:19-mj-71824-MAG (N.D. Cal.); id., No. 19-cr-00621-EMC
(N.D. Cal.) (the indicted case).

ORDER – No. 19-cv-06694-LB

3

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 4 of 13

1

could arrest him and instead escorted him out of the building and suspended him.15 Alzabarah then

2

decamped to Saudi Arabia on December 3, 2015.16 The Justice Department officials were “livid”

3

because Twitter had “blown up their case by tipping off a man they were hoping to

4

arrest.”17Abouammo left his job at Twitter earlier that year.18
Shortly after Alzabarah fled, Saudi authorities interrogated the plaintiff’s father and brother in

5
6

Saudi Arabia, cancelled the brother’s financial assistance, and summoned three of the plaintiff’s

7

friends and roommates in Canada to the Saudi Cultural Bureau between March and July 2016.19
On December 11, 2015, by email and through an in-app message, Twitter notified the owners

8
9

of the accounts that had been compromised, including the plaintiff, that their Twitter accounts may
have been targeted by state-sponsored actors to obtain IP addresses, emails, and phone data.20 It

11

United States District Court
Northern District of California

10

did this in two ways: through email (here, the email address that the plaintiff gave to Twitter) and

12

through an in-app safety alert.21 The plaintiff alleges that he did not receive the notices and instead

13

learned about the unauthorized access when he read about it in the New York Times on October

14

20, 2018.22 If he had known that his account had been compromised, then he would have been

15

more careful about clicking on hyperlinks in text messages and would not have clinked on the link

16

that put malware on his phone and allowed Saudi operatives to hack his phone.23
In support of his contention that Twitter is responsible for the unauthorized act of its

17
18

employees (even though those actions violated company policy), the plaintiff alleges the conduct

19
20
15

Id.

16

Id. at 21 (¶ 99), 27 (¶ 122).

17

Id.

23

18

Abouammo, 3:19-mj-71824-MAG, Compl. – ECF No. 1 at 5 (¶ 17).

24

19

TAC – ECF No. 98 at 27 (¶ 122).

21
22

25
26

Notifications, Exs. 1 & 2 to Twitter Employee Decl. – ECF Nos. 41-6 & 41-7. The court considers
the notices under the incorporation-by-reference doctrine. TAC – ECF No. 98 at 24 (¶¶ 111–112
referencing them); Knievel v. ESPN, 393 F.3d 1068, 1076–77 (9th Cir. 2005).
20

21

Notifications, Exs. 1 & 2 to Twitter Employee Decl. – ECF Nos. 41-6 & 41-7.

27

22

TAC – ECF No. 98 at 28 (¶ 127).

28

23

Id. at 25 (¶ 114).

ORDER – No. 19-cv-06694-LB

4

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 5 of 13

1

was a “red flag” that should have alerted Twitter to the illegal activity.24 The plaintiff also alleged

2

that the danger “was inherent in Twitter’s manner of operation:”

3

First, Twitter furnished Alzabarah and Abouammo with the access, hardware and software
tools that enabled them to raid Plaintiff’s private information. This would not have been
possible were they not employed by Twitter. Second, Twitter implemented and benefited
from policies that allowed and encouraged its technical and professional staff to work
offsite, from multiple locations. Although Twitter benefitted from the greater productivity
this allowed, it even further reduced Twitter’s ability to monitor sensitive employees’
conduct. Finally, Twitter implemented and benefitted from policies allowing its
professional and technical staff flexibility as to when and where they performed their work,
further complicating any monitoring Twitter should have been doing. With hundreds of
millions of active users and a great many employees who had access to their data, the risk
that confidential data would be exposed was broadly incident to Twitter’s mode of
operation.25

4
5
6
7
8
9
10

United States District Court
Northern District of California

11

Despite the known risks, Twitter “failed to institute adequate safeguards to protect this data or

12

even alert Twitter senior management that private account data was being raided.”26 Also, Twitter

13

did not institute appropriate safeguards or notify the plaintiff or other victims that it wanted to

14

maintain its relationship with Saudi Arabia (shown in part by Saudi holdings in Twitter and a

15

meeting that Twitter CEO Jack Dorsey had with Crown Prince Mohammed Bin Salman six

16

months after Alzabarah fled to Saudi Arabia).27

17

2.2 Saudi Operatives Hack the Plaintiff’s Phone

18

In May 2018, two Saudi agents contacted the plaintiff, asked to meet with him, and met with

19

him in several meetings.28 The agents said that they worked for Crown Prince Bin Salman and

20

Saud Al-Qahtani (who was “entangled with the murder of” Jamal Khashoggi) and demanded that

21
22
23
24
24

Id. at 12 (¶ 53), 14 (¶ 64).

25

Id. at 15 (¶ 72).

26

Id.

27

27

Id. at 2 (¶ 3), 21 (¶ 100), 24 (¶¶ 108–09), 22 (¶ 106).

28

28

Id. at 29 (¶¶ 132–33).

25
26

ORDER – No. 19-cv-06694-LB

5

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 6 of 13

1

the plaintiff stop his political activities and return to Saudi Arabia.29 The plaintiff refused.30 A few

2

months later, Saudi operatives assassinated Mr. Khashoggi at the Saudi Consulate in Istanbul.31
On June 23, 2018, Saudi agents planted Pegasus malware on the plaintiff’s phone in a phishing

3
4

direct message masquerading as a message from the shipping company DHL to manage a

5

delivery.32 As a result, the agents exfiltrated the plaintiff’s SMS chats, emails, photographs,

6

location data, and other information and were able to spy on the plaintiff “real time” through

7

control of the phone’s camera and microphone and receipt of information that the plaintiff typed

8

into the phone or received from others.33
In late July and early August 2018, Saudi agents raided the plaintiff’s family’s home, arrested

9

and imprisoned his two brothers and dozens of his friends and associates, and continue to imprison

11

United States District Court
Northern District of California

10

and torture his brothers to pressure the plaintiff to stop his activism.34
In mid-August 2018, the Citizens Lab at the University of Toronto told the plaintiff about the

12
13

compromise of his phone through the Pegasus malware.35 In October 2018, two weeks after the

14

assassination of Mr. Khashoggi, a team of Saudi nationals traveled to Canada to assassinate the

15

plaintiff.36 In December 2018, in a separate lawsuit filed in Israel, the plaintiff sued N.S.O.

16

Technologies, which manufactures the Pegasus software, on the ground that is liable for the

17

hacking of his phone and the resulting harm that he and his family and friends suffered.37

18
19
20
29

Id.

30

Id.

31

Id. at 29–30 (¶ 133).

23

32

Id. at 30 (¶ 135).

24

33

Id. (¶ 136).

34

Id. at 30–31 (¶¶ 137–38, 142).

35

Id. at 32 (¶ 143).

26

36

Id. at 32 (¶ 146).

27

37

21
22

25

28

Statement of Claim, Ex. A to Olm Decl. – ECF No. 41-2 at 1. The court takes judicial notice of the
records. Lee v. City of Los Angeles, 250 F.3d 668, 689–90 (9th Cir. 2001); United States ex rel.
Robinson Rancheria Citizens Council v. Borneo, Inc., 971 F.2d 244, 248 (9th Cir. 1992).
ORDER – No. 19-cv-06694-LB

6

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 7 of 13

1

3. Procedural History

2

The plaintiff sued Twitter and McKinsey & Co. in October 2019 and then amended his

3

complaint.38 The court subsequently granted the defendants’ motion to dismiss.39 The plaintiff

4

dismissed McKinsey from the lawsuit.40 The plaintiff amended his complaint twice, and Twitter

5

moved to dismiss the operative Third Amended Complaint.41 The court held a hearing on February

6

11, 2021.

7

All parties consented to magistrate-judge jurisdiction.42 The plaintiff resides in Canada, and

8

Twitter is incorporated in Delaware and has its headquarters in San Francisco.43 The parties do not

9

dispute the court’s diversity jurisdiction. 28 U.S.C. § 1332(a)(1).

10
STANDARD OF REVIEW

United States District Court
Northern District of California

11
12

A complaint must contain a short and plain statement of the ground for the court’s jurisdiction

13

(unless the court already has jurisdiction and the claim needs no new jurisdictional support). Fed.

14

R. Civ. P. 8(a)(1). The plaintiff has the burden of establishing jurisdiction. Kokkonen v. Guardian

15

Life Ins. Co. of Am., 511 U.S. 375, 377 (1994); Farmers Ins. Exch. v. Portage La Prairie Mut. Ins.

16

Co., 907 F.2d 911, 912 (9th Cir. 1990).
A complaint must contain a “short and plain statement of the claim showing that the pleader is

17
18

entitled to relief” to give the defendant “fair notice” of what the claims are and the grounds upon

19

which they rest. Fed. R. Civ. P. 8(a)(2); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). A

20

complaint does not need detailed factual allegations, but “a plaintiff’s obligation to provide the

21

‘grounds’ of his ‘entitlement to relief’ requires more than labels and conclusions, and a formulaic

22
23
24

38

Compl. – ECF No. 1; FAC – ECF No. 38.

25

39

Order – ECF No. 76.

40

Notice of Voluntary Dismissal – ECF No. 85.

41

Second Am. Compl. (SAC) – ECF No. 80; TAC – ECF No. 98; Mot. – ECF No. 99.

27

42

Consents – ECF Nos. 10 & 20.

28

43

TAC – ECF No. 98 at 2 (¶¶ 2–3).

26

ORDER – No. 19-cv-06694-LB

7

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 8 of 13

1

recitation of the elements of a cause of action will not do. Factual allegations must be enough to

2

raise a claim for relief above the speculative level[.]” Twombly, 550 U.S. at 555 (cleaned up).

3

To survive a motion to dismiss, a complaint must contain sufficient factual allegations, which

4

when accepted as true, “‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556

5

U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). “A claim has facial plausibility when

6

the plaintiff pleads factual content that allows the court to draw the reasonable inference that the

7

defendant is liable for the misconduct alleged.” Id. “The plausibility standard is not akin to a

8

‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted

9

unlawfully.” Id. (citing Twombly, 550 U.S. at 557). “Where a complaint pleads facts that are
merely consistent with a defendant’s liability, it stops short of the line between possibility and

11

United States District Court
Northern District of California

10

plausibility of ‘entitlement to relief.’” Id. (cleaned up) (quoting Twombly, 550 U.S. at 557).

12

If a court dismisses a complaint, it should give leave to amend unless the “pleading could not

13

possibly be cured by the allegation of other facts.” United States v. United Healthcare Ins. Co., 848

14

F.3d 1161, 1182 (9th Cir. 2016) (cleaned up).

15
ANALYSIS

16
17

Twitter moved to dismiss the negligence claims for lack of Article III standing, as barred by

18

the statute of limitations, as not plausibly pled, and as barred by Twitter’s terms of service. The

19

court dismisses the claims because the plaintiff did not plead causation for Article III standing or

20

negligence. The claims also are barred by the statute of limitations, and the plaintiff did not

21

plausibly plead Twitter’s negligence.

22
23

1. Article III Standing

24

Federal-court jurisdiction extends only to “cases” and “controversies.” Raines v. Byrd, 521

25

U.S. 811, 818 (1997); Spokeo, Inc. v. Robins, 136 S. Ct. 1540, 1547 (2016). To establish standing,

26

“[t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged

27

conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Id.

28

(citing Lujan v Defenders of Wildlife, 504 U.S. 555, 560 (1992)). As to the causation prong,
ORDER – No. 19-cv-06694-LB

8

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 9 of 13

1

Article III requires “a causal connection between the injury and the conduct complained of — the

2

injury has to be ‘fairly . . . trace[able] to the challenged action of the defendant, and not . . . th[e]

3

result [of] the independent action of some third party not before the court.’” Lujan, 504 U.S. at

4

560‒61 (quoting Simon, 426 U.S. at 41‒42) (ellipses in original).

5

Twitter’s employees accessed the plaintiff’s Twitter data in June and July 2015. The immediate

6

harm (“shortly” after Alzabarah fled to Saudi Arabia in December 2015) was the questioning of the

7

plaintiff’s father and brother, the loss of his brother’s financial benefits (at some undisclosed time),

8

the imprisonment of many of the plaintiff’s friends in Saudi Arabia (again at an undisclosed time),

9

and the plaintiff’s resulting emotional distress.44 The hacking of the plaintiff’s phone was in late
July and early August 2018, resulting in the compromise of his data, the raid of his family home in

11

United States District Court
Northern District of California

10

Saudi Arabia, the arrest and imprisonment of his brothers, and the persecution of his friends.45

12

These facts do not plausibly establish that Twitter’s alleged misconduct caused the harms.

13

First, the plaintiff does not explain how the compromise of the Twitter data caused the harm to his

14

family and friends. Indeed, he is a political dissident with an active social-media presence who

15

suffered persecution before the compromise of his Twitter data (shown by Canada’s granting him

16

political asylum in February 2014). Second, the implanting of the Pegasus malware and the

17

subsequent compromise of his data in July and August 2018 was three years after the compromise

18

of his Twitter data. There is no temporal proximity. And the plaintiff’s allegation that it is related

19

to the Twitter breach is a conclusion, not a fact allegation. In sum, the plaintiff does not plausibly

20

plead causation and thus does not establish Article III standing.

21

The plaintiff’s arguments do not compel a contrary conclusion.

22

First, he contends that the Saudi government’s persecution of him before 2015 was limited to

23

withholding financial assistance and that the persecution intensified only after the Saudi

24

government accessed his Twitter data in 2015.46 But in his complaint, he contends that when he

25
26
44

Id. at 27–28 (¶ 122), 36–37 (¶¶ 163, 167–68).

27

45

Id. at 30–31 (¶¶ 137–38, 143)

28

46

Opp’n – ECF No. 13 (citing TAC – ECF No. 98 at 27 (¶¶ 120–22)).

ORDER – No. 19-cv-06694-LB

9

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 10 of 13

1

applied for asylum in Canada, he did so because of his well-founded fear of persecution, meaning,

2

he would be “imprisoned, tortured, or killed.” 47
Second, he explains the three-year delay as part of a “gradual intensification” of persecution that

3
4

began in 2015 and that can be explained only by the Twitter breach: “despite no change in

5

Plaintiff’s behavior and nothing out of the ordinary happening apart from Twitter’s data breach, [the

6

Saudi government] suddenly escalated its persecution of Plaintiff in an unprecedented manner.”48

7

But by the plaintiff’s own account, he became a more vocal critic of the Saudi government
after he was granted asylum, gaining a substantial social-media platform.49 And during this time

9

period, Crown Prince Mohammad Bin Salmon obtained power in 2015, when his father became

10

king. As the complaint describes, the CIA attributes the 2018 assassination of the plaintiff’s ally

11

United States District Court
Northern District of California

8

Jamal Khashoggi to Prince Bin Salman, and the plaintiff admits that he and Mr. Khashoggi

12

collaborated on a range of political activities.50 And, as discussed in his earlier complaint and in

13

the court’s order, by 2016 or 2017, McKinsey allegedly identified him to agents of Prince Bin

14

Salman as “one of the top three voices shaping public discussion about controversial austerity

15

measures.” (The other two were Khaled Al-Alkami, who was imprisoned after he was identified,

16

and “Ahmad,” who disappeared.)51
In sum, the plaintiff has not shown a causal link between the compromise of his Twitter

17
18

account and his persecution three years later.

19
20
21
22

TAC – ECF No. 98 at 27 (¶ 120); Statement of Claim – Ex. Ex. A to Olm Decl. – ECF No. 41-2 at 6
(¶ 16) (in claim against NSO, the maker of Pegasus, claims harassment by Saudi authorities because of
his political activism, leading him to apply for asylum in Canada).

23

48

Opp’n – ECF No. 102 at 21.

24

49

TAC – ECF No. 98 at 34 (¶ 154) (Twitter); FAC – ECF No. 38 at 5 (¶ 16).

50

FAC – ECF No. 38 at 5 (¶ 17).

47

25

Id. at 5–6 (¶ 18); SAC – ECF No. 80 at 33–35 (¶¶ 130, 136–37, 141–42) (alleging that every critic in
the McKinsey report has been imprisoned except for the plaintiff, who is safe only because he is in
Canada, and alleging that the McKinsey report resulted in the imprisonment and torture of his family,
friends, and associates); Order – ECF No. 76 at 7 (noting the plaintiff’s conclusory allegation that
McKinsey bought Twitter data and the defendants’ contention that the McKinsey PowerPoint
presentation at issue was obviously based on publicly available Twitter feeds).
51

26
27
28

ORDER – No. 19-cv-06694-LB

10

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 11 of 13

1

2. Negligence Claims
Twitter moves to dismiss the claims on the ground that the statute of limitations bars them, and

2
3

the plaintiff did not plausibly plead the claims. The court dismisses the claims on both grounds.
First, the parties do not dispute that the statute of limitations is two years and that the plaintiff

4
5

filed this lawsuit on October 18, 2019, almost four years after Twitter notified him of the breach

6

on December 11, 2015. Cal. Civ. Proc. Code § 335.1; Kaldis v. Wells Fargo Bank, N.A., 263 F.

7

Supp. 3d 856, 867 (C.D. Cal. 2017); So v. Shin, 212 Cal. App. 4th 652, 662 (2013). The plaintiff

8

does not dispute that Twitter sent the notices, but he disputes that he received them, contends they

9

did not in any event warn him sufficiently of the breach, and asserts that he learned of the breach

10

only on October 20, 2018 (rendering his lawsuit timely).52
The December 2015 notice — that state actors potentially compromised the plaintiff’s Twitter

United States District Court
Northern District of California

11
12

account — was sufficient notice to trigger the statute of limitations. At that point, under

13

California’s discovery rule, the plaintiff “discover[ed], or has reason to discover, the cause of

14

action.” Fox v. Ethicon Endo-Surgery, Inc., 35 Cal. 4th 797, 806 (Cal. 2005) (citation omitted).

15

In any event, the plaintiff did not plausibly plead the claims.

16

The elements of a negligence claim are (1) the existence of a duty to exercise due care, (2)

17

breach of that duty, (3) causation, and (4) damages. Merrill v. Navegar, Inc., 28 P.3d 116, 139

18

(Cal. 2001). A duty to exercise due care is an “obligation to conform to a certain standard of

19

conduct for the protection of others against unreasonable risks.” McGarry v. Sax, 158 Cal. App.

20

4th 983, 994 (2008) (quotation omitted). Under California law, an employer is liable for negligent

21

supervision of any employee if it knew or should have known that “the employee created a

22

particular risk or hazard, and that particular harm materializes.” Bobol v. Feld Entm’t Inc., No. C

23

11–5539 PSG, 2012 WL 5828608, at *7 (N.D. Cal. Nov. 15, 2012) (quotation omitted).

24

First, Twitter contends that the plaintiff did not plausibly plead causation. “The causation

25

element of a negligence claim generally ‘has two aspects:’ (1) whether the defendant’s action or

26

inaction was a ‘cause in fact’ of the plaintiff's injury, also known as ‘but for’ causation; and (2)

27
28

52

Opp’n – ECF No. 102 at 21–24.

ORDER – No. 19-cv-06694-LB

11

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 12 of 13

1

whether, based on ‘the degree of connection between the conduct’ and considerations of public

2

policy, it would be ‘unjust to hold [the defendant] legally responsible,’ often referred to as

3

‘proximate’” causation. Steinle v. United States, No. 16-cv-02859-JCS, 2020 WL 602024, at *8

4

(N.D. Cal. Jan. 6, 2020) (quoting State Dep’t of State Hosps. v. Superior Ct., 61 Cal. 4th 339,

5

352−53 (2015)). For the reasons that the plaintiff did not plead causation for standing, he also did

6

not plead causation for negligence.
Second, the plaintiff pleaded no facts that Twitter knew or should have known that its

7
8

employees created a particular risk or hazard. Bobol, 2012 WL 5828608, at *7.

9
10

3. Twitter’s Terms of Service

United States District Court
Northern District of California

11

Twitter’s terms of service bar has a limitation-of-liability clause: a Twitter user cannot assert

12

Twitter’s liability for any damages resulting from “unauthorized access, use or alteration of [his]

13

transmissions or content” on any theory of liability, including “tort (including negligence).”53 The

14

plaintiff agreed to the terms of service but contends now that the limitation is an adhesion contract

15

that is procedurally and substantively unconscionable.54
On this briefing, the court does not reach the issue. Limitations of liability are upheld in

16
17

adhesion contracts (such as terms of service) if they are not procedurally or substantively

18

unconscionable. Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1028 (N.D. Cal. 2019). But terms

19

of service that might preclude a social-media company’s liability for an independent bad actor’s

20

hack of data do not necessarily preclude that company’s liability for employees who present a

21

particular risk or hazard, and that particular harm materializes. Bobol, 2012 WL 5828608, at *7.

22

So here, without the intervening acts of its employees, the terms of service may more easily

23

preclude Twitter’s liability for unknown state actors’ compromising Twitter users’ accounts. But

24

Twitter does not address how the cases affect the claims here, which at least in part are about its

25

former employees’ access to the plaintiff’s Twitter account.

26
27
28

Twitter’s TOS effective May 18, 2015–January 26, 2016, Ex. B to Olm Decl. – ECF No. 41-3;
Twitter’s Current TOS, Ex. 10A to Suppl. RJN – ECF No. 60-11.
53

54

TAC – ECF No. 98 at 32–33 (¶¶ 148–50); Opp’n – ECF No. 102 at 33–40.

ORDER – No. 19-cv-06694-LB

12

Case 3:19-cv-06694-LB Document 107 Filed 02/18/21 Page 13 of 13

CONCLUSION

1
2

The court grants the defendant’s motion to dismiss the third-amended complaint with leave to

3

amend (given the plaintiff’s representations at the hearing that he can plead facts to cure the defects

4

regarding causation). Any amended complaint must be filed within 21 days of this order and must

5

include as an attachment a blackline of the amended complaint.

6

This disposes of ECF No. 99.

7

IT IS SO ORDERED.

8

Dated: February 18, 2021
______________________________________
LAUREL BEELER
United States Magistrate Judge

9
10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
ORDER – No. 19-cv-06694-LB

13