Page 5
Ninth Circuit:
Suit Against Twitter for Hiring Alleged Spy Is Time-Barred
Majority Says Plaintiff on Notice of Breach of Personal Information by Message From Company He Denies Receiving, As Well As Media Coverage of Foreign State Actors Targeting Accounts, Drawing Dissent
By a MetNews Staff Writer
|
|
|
OMAR ABDULAZIZ appellant |
The Ninth U.S. Circuit Court of Appeals has held, in a 2-1 decision, that an action against Twitter—asserting that the social media giant acted negligently in employing and overseeing two operatives of the Kingdom of Saudi Arabia who accessed accounts belonging to a popular critic of the country’s government—is time-barred and was properly dismissed.
At issue is California’s “discovery rule” which provides that the clock for a cause of action will not begin to run until it is discovered, or reasonably could have been ascertained, by the plaintiff.
Finding that a highly-publicized message, sent in Dec. 2015 to various account holders, saying “we are alerting you that your Twitter account…may have been targeted by state-sponsored actors” put the plaintiff on notice of the cause of action, the court declared that the 2019 complaint was barred by the two-year statute of limitations provided for in California Civil Procedure Code §335.1. The plaintiff denies receiving the notice.
Appealing the dismissal was Omar Abdulaziz, who moved to Canada from Saudi Arabia in 2009 in order to study at a university in Montreal. He began voicing criticism of the regime in charge of his home country on Twitter, which had become a popular social media platform in Saudi Arabia.
According to the plaintiff, he was “a close ally” of Jamal Khashoggi, a journalist also critical of the regime who was famously shot to death in the Saudi embassy in Istanbul in October 2018.
Complaint Against Twitter
In October 2019, Abdulaziz filed a complaint against the technology company, asserting that Twitter employed two Saudi operatives—Ahmad Abouammo and Ali Alzabarah— and “allowed [the] two spies to operate without interference” in gaining “confidential user data for nearly 6,000 Twitter users.” In the operative complaint, he alleges:
“Plaintiff had placed his full trust and confidence into Twitter that his data and anonymity with respect to his pseudonymous account would be protected. Twitter breached that duty to him by allowing two employees to do what Twitter had promised Plaintiff would not happen: gain unauthorized access to his private user data and violate his privacy.”
He continued:
“The data illicitly viewed by the Twitter employees exposed Plaintiff’s name on [his] pseudonymous account, his IP address, his password, his direct messages, and his telephone number. Neither Abouammo or Alzabarah had any legitimate reason to be using the Profile Viewer software and doing so would have sent an alert to Twitter’s security systems….Had Twitter had adequate security, [the Kingdom of Saudi Arabia]…would have never learned that Plaintiff was operating this particular pseudonymous account.”
Abdulaziz asserts that Alzabarah returned to Saudi Arabia on Dec. 3, 2015 and the Saudi government then began efforts to “silence Plaintiff by threatening, and ultimately imprisoning and torturing his brother, his friends, and even just people who had exchanged messages with him on Twitter.”
He claims he did not have reason to discover the cause of action until Oct. 2018, when the New York Times published an article revealing that U.S. intelligence officials informed Twitter that the Saudis were grooming Alzabarah to spy on the accounts of Saudi dissidents.
Magistrate Judge Laurel Beeler, of the Northern District of California dismissed the complaint without leave to amend in July 2021 on the grounds that Abdulaziz lacked standing under Article III because “the plaintiff did not plausibly plead a causal connection between Twitter’s conduct and the alleged harm.”
In a memorandum decision, signed by Circuit Judges Danielle J. Forrest and Jennifer Sung, the court disagreed that Abdulaziz lacked standing but found that his claims are barred by the statute of limitations.
Circuit Judge Daniel P. Collins dissented.
Article III Standing
As to standing, the majority said that “[t]he Twitter data breach by hostile foreign intelligence operatives and the alleged consequences of that breach are more than sufficient to demonstrate cognizable injury” and “Abdulaziz has also shown that his injury is traceable to Twitter.” They reasoned:
“Abdulaziz alleges that KSA operatives misused their employment position at Twitter and accessed his personal contact information without authorization using company software, which would have sent a security alert to Twitter. He contends that had Twitter not been negligent in maintaining its security system and hiring and managing its employees, KSA operatives could not have accessed his personal information associated with his public and pseudonymous Twitter accounts.”
Under these circumstances, the judges concluded that “[a]ccepting Abdulaziz’s allegations as true, it is ‘possible to draw a causal line’ between Twitter’s actions, or lack thereof, and the consequent injury that he suffered.”
Time-Barred
Turning to when Abdulaziz could have discovered the cause of action against the company, Forrest and Sung remarked:
“On December 11, 2015, Twitter sent “safety” notices to its account holders whose accounts appeared to have been accessed without authorization….Twitter presented evidence, of which the district court took judicial notice, showing that Abdulaziz received this notice two ways, both via the email address that he provided to Twitter and through an in application message.”
They continued:
“Abdulaziz denies that he and his allies on Twitter received this notice. But Abdulaziz need not have received actual notice to trigger the discovery rule— constructive notice suffices….
“Aside from his summary denial that he neither received the December 2015 notices from Twitter, nor saw the contemporaneous media coverage about these notices, Abdulaziz does not offer any cogent justification for failing ‘at least to suspect a factual basis’ for his cause of action during this time period.”
The jurists added:
“Furthermore, Abdulaziz conceded that he received a threatening direct message through his Twitter account no later than December 3, 2015, and a separate notice from Twitter in February 2016 stating that his data may have been viewed ‘by another user.’ Despite the various circumstances giving Abdulaziz ‘reason to discover’ his negligence-based claims against Twitter at least by early 2016, he did not file this action until October 2019, well beyond the applicable two-year statute of limitations.”
Collins’ View
Collins wrote:
“In my view, the allegations of Abdulaziz’s operative complaint are sufficient to…show that his claims are timely. Because I would accordingly reverse the district court’s judgment, I respectfully dissent.”
He explained:
“Abdulaziz did not have reason to discover the cause of action until October 2018, when he learned from a New York Times article that a suspected agent of the [Kingdom of Saudi Arabia] employed by Twitter had used employee access privileges to obtain his personal information. At no prior point did he have notice or information that would have put a reasonable person on inquiry that his asserted injuries…were traceable to Twitter’s conduct.”
The jurist noted:
“The majority…cites the December 2015 notices from Twitter and the contemporaneous media coverage of the disclosed security breach as providing constructive notice that would put a reasonable person on inquiry. Abdulaziz, however, alleged that he did not receive the December 2015 notices from Twitter, and we must take that allegation as true for purposes of this appeal.”
He continued:
“The majority points in part to a threatening direct message Abdulaziz received on Twitter no later than December 2015, as well as to an unrelated February 2016 notice from Twitter stating that Abdulaziz’s data may have been viewed by another user due to a software bug. But these facts are not enough to put a reasonable person on inquiry notice of this cause of action, which rests on entirely different alleged conduct by Twitter that assertedly led to the otherwise seemingly unrelated harassment by the [Kingdom of Saudi Arabia].”
The case is Abdulaziz v. Twitter, 21-16195.
Copyright 2024, Metropolitan News Company