Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 1 of 23
`
`
`
`
`
`
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`ALI AL-AHMED,
`
`Plaintiff,
`
`v.
`
`TWITTER, INC., et al.,
`
`Case No. 21-cv-08017-EMC
`
`
`ORDER GRANTING DEFENDANT
`TWITTER’S MOTION TO DISMISS
`
`Docket No. 62
`
`
`
`
`
`Defendants.
`
`
`
`
`
`I.
`
`INTRODUCTION
`
`Plaintiff Al-Ahmed is a critic of the Kingdom of Saudi Arabia (“KSA”) who has been
`
`granted asylum in the United States. Between 2013 and 2015, two of Twitter’s (now former)
`
`employees accessed user information without authorization and provided it to KSA government
`
`officials. The employees were indicted in 2019. On October 13, 2021, Al-Ahmed sued the former
`
`employees and Twitter. Specifically, Al-Ahmed sued Twitter for violating the Electronics
`
`Communications Privacy Act (“EPCA”); the Computer Fraud and Abuse Act (“CFAA”); the
`
`Stored Communications Act (“SCA”); California’s Unfair Competition Law (“UCL”); breach of
`
`contract; intrusion upon seclusion; unjust enrichment; promissory estoppel; negligence; negligent
`
`hiring, supervision, and retention; civil conspiracy; and replevin. See Docket No. 1 (“original
`
`complaint”). In Al-Ahmed’s First Amended Complaint, he adds claims for breach of the duty of
`
`loyalty, aiding and abetting breach of fiduciary duty, an additional UCL claim, and interference
`
`with prospective economic advantage. See Docket No. 55 (“FAC”). Notably, Al-Ahmed does not
`
`add a claim under the Lanham Act, for which he was granted leave to amend after this Court
`
`dismissed the original complaint. Al-Ahmed alleges that his Twitter account was hacked, which
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 2 of 23
`
`
`
`led to the KSA targeting him and those around him. Furthermore, he alleges that Twitter’s
`
`suspension of his account in 2018 punishes him—the victim—and demonstrates that Twitter was
`
`complicit in their former employees’ conduct, or at least that Twitter ratified their conduct.
`
`The Court dismissed Al-Ahmed’s first complaint with leave to amend. See Al-Ahmed v.
`
`Twitter, Inc., No. 21-CV-08017-EMC, 2022 WL 1605673, at *5 (N.D. Cal. May 20, 2022). He
`
`filed an amended complaint. See FAC. Pending now is Twitter’s motion to dismiss Al-Ahmed’s
`
`FAC. See Docket No. 62 (“Mot.”). Twitter argues that (1) Al-Ahmed lacks Article III standing,
`
`(2) his claims are barred by the statute of limitations, (3) he does not plausibly plead that Twitter is
`
`vicariously liable for its rogue employees’ acts on behalf of the KSA, (4) the Community Decency
`
`Act (“CDA”) immunity bars many of his claims, (5) Twitter’s Terms of Service (“TOS”) bars
`
`many of his claims, and (6) individual actions fail for numerous claim-specific reasons. The Court
`
`only addresses Article III standing, the statute of limitations, and CDA immunity because each of
`
`Al-Ahmed’s claims fail for one of these three reasons.
`
`II.
`
`BACKGROUND
`
`A.
`
`Factual Background
`
`Al-Ahmed alleges as follows in his FAC:
`
`Al-Ahmed is one of the leading critics of the KSA who resides and has been granted
`
`asylum in the United States. FAC ¶ 17. Between August 2013 and December 2015, Twitter
`
`employees accessed user data without authorization and provided the data to KSA government
`
`officials. Id. ¶¶ 22–23. Twitter failed to detect these breaches for more than a year. Id. ¶ 26. Al-
`
`Ahmed’s Arabic Twitter account, which has over 36,000 followers worldwide, was one of the
`
`accounts breached during this time. Id. ¶ 21. Al-Ahmed contends that Twitter’s conduct resulted
`
`in the compromising of his private information, including his “email addresses, contacts, phone
`
`numbers, birth dates, and internet protocol (“IP”) addresses;” and his “Tweets, private messages,
`
`direct message, online chats, friend requests, file transfers, file uploads, and file downloads.” Id.
`
`¶¶ 24, 79. He also alleges confidential information provided by his followers and journalistic
`
`sources was compromised. Id. ¶ 4. Al-Ahmed alleges his private information was used by the
`
`KSA to silence him by stripping him of his Saudi nationality, keeping him under surveillance, and
`
`2
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 3 of 23
`
`
`
`attempting to kidnap and kill him on multiple occasions. Id. ¶ 18. Al-Ahmed alleges his
`
`followers on Twitter and those who otherwise contacted him using Twitter, have disappeared,
`
`been arrested, or have been executed. Id. ¶ 27. Examples of such third-party harms include the
`
`jailing of Saudi dissident Abdullah al-Hamid, whom the KSA jailed in 2013, and the murder of
`
`journalist Jamal Khashoggi in 2018, which Al-Ahmed alleges was not uncoincidental to the
`
`KSA’s espionage against Twitter. Id. ¶¶ 27, 57. According to the FAC, “the KSA managed to
`
`fully silence Al-Ahmed when [Twitter] . . . suspend[ed his] Arabic Twitter account, without
`
`explanation, warning, or justification. Id. ¶ 28.
`
`On November 19, 2019, the two Twitter employees allegedly responsible for hacking Al-
`
`Ahmed’s account were indicted for acting as agents of the KSA. Id. ¶ 7. Defendant Ahmad
`
`Abouammo (“Abouammo”) was the Media Partnerships Manager responsible for the Middle East
`
`and North Africa region at Twitter. Id. ¶ 5. Defendant Ali Hamad A. Alzabarah (“Alzabarah”)
`
`was a Site Reliability Engineer whose responsibility was maintaining Twitter’s hardware and
`
`software to ensure uninterrupted service. Id. ¶ 6.
`
`1.
`
`Twitter’s Notice
`
`On or about December 11, 2015, Twitter sent the following notice to the users whose data
`
`was accessed by Abouammo and Alzabarah:
`
`Dear @{{screen_name}}, As a precaution, we are alerting you that
`your Twitter account is one of a small group of accounts that
`may have been targeted by state-sponsored actors. We believe
`that these actors (possibly associated with a government) may
`have been trying to obtain information such as email addresses,
`IP addresses, and/or phone numbers.
`
`At this time, we have no evidence they obtained your account
`information, but we’re actively investigating this matter. We wish
`we had more we could share, but we don’t have any additional
`information we can provide at this time.
`
`It’s possible your account may not have been an intended target of
`the suspected activity, but we wanted to alert you as soon as
`possible. We recognize that this may be of particular concern if you
`choose to Tweet using a pseudonym. For tips on protecting your
`identity online, you may want to visit the Tor Project or EFF’s
`Protecting Yourself on Social Networks.
`
`
`Id. ¶ 45.
`
`3
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 4 of 23
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`According to Al-Ahmed, this notice was insufficient to inform him of the scope and nature
`
`of the problem because it did not indicate that Abouammo and Alzabarah committed these data
`
`breaches at the direction of Twitter, and while located on Twitter’s premises, employed by
`
`Twitter, and using Twitter’s resources. Id. ¶ 46. Therefore, Al Ahmed alleges he did not, and
`
`could not have reason to know of Twitter’s involvement until the public indictment of the
`
`employees in 2019. Id. ¶ 47. Further, Al-Ahmed alleges for the first time in his FAC that he did
`
`not in fact receive the notice. Id. ¶ 48.
`
`2.
`
`Twitter’s Alleged Actions in Aid of the KSA
`
`Al-Ahmed alleges that Twitter provided Abouammo and Alzabarah with access to
`
`Twitter’s resources with the full knowledge that they were improperly accessing user data, that
`
`Twitter helped them provide the information to the KSA, and Twitter helped them cover their
`
`tracks by purging its internal database of incriminating evidence. Id. ¶ 25.
`
`Al-Ahmed also alleges that Twitter’s Privacy Policy suggests that a user can adjust their
`
`account settings so their Tweets can only be viewed by the user’s Twitter followers. Id. ¶¶ 31–32.
`
`This created an illusion of security and safety relied upon by Al-Ahmed and others. Id. Al-
`
`Ahmed alleges that Twitter failed to safeguard user data, evidenced by its disclosure to the
`
`Securities and Exchange Commission in 2020 that it received a draft complaint from the Federal
`
`Trade Commission alleging “violations…[r]elate[d] to the Company’s use of phone number
`
`and/or email address data provided for safety and security purposes [ostensibly for targeted
`
`advertising] during periods between 2013 and 2019.” Id. ¶ 38. Thus, he argues Twitter
`
`negligently failed to implement policies, practices, and safeguards that would have prevented the
`
`acts of its former employees. Id.
`
`3.
`
`Twitter’s Relationship with the KSA
`
`In 2011, Saudi Prince Alwaleed Bin Talal purchased $300 million worth of stock in
`
`Twitter. Id. ¶ 3. In 2015, Bin Talal made an additional investment, and now owns 5.2% of the
`
`company, more than Twitter’s founder and former CEO, Jack Dorsey (“Dorsey”). Id. Bin Talal
`
`later signed over many of his assets to Crown Prince of Saudi Arabia Mohammed Bin Salman. Id.
`
`Al-Ahmed further alleges that Bader al-Asaker, the head of Bin Salman’s affairs, was the “Saudi
`
`4
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 5 of 23
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`mastermind” behind the Twitter spy scandal. Id. ¶ 39. He claims that Asaker is “Foreign Official-
`
`1” in the United States Attorneys Offices’ indictment against Abouammo and Alzabarah. Id. ¶ 41.
`
`Al-Ahmed alleges that Asaker provided Abouammo and Alzabarah with “gifts, cash payments,
`
`and promises of future employment in exchange for nonpublic information about Twitter uses,
`
`which constituted valuable property...” Id. Furthermore, Dorsey met with both Asaker and Bin
`
`Salman at Twitter’s headquarters on June 25, 2016, and at least one additional time in Riyadh
`
`thereafter. Id. ¶ 43. Dorsey and Asaker follow each other on Twitter. Id. ¶ 44.
`
`4.
`
`Twitter’s Suspension of Al-Ahmed’s Account
`
`In 2018, Al-Ahmed’s Twitter account was suspended, preventing him from accessing his
`
`followers. Id. ¶¶ 28, 30. The basis of his suspension was an allegedly abusive direct message
`
`(“DM”) Al-Ahmed sent using his Arabic language Twitter account. Id. ¶ 50. Al-Ahmed alleges
`
`that as a result, he lost significant revenue and earning potential related to his work as a journalist,
`
`as much of his work was contingent on his online presence. Id. ¶ 59. Al-Ahmed further alleges
`
`that his appeal of the suspension failed despite Alzabarah and Abouammo’s indictment. Id. ¶ 29.
`
`According to Al-Ahmed, preventing access to his account, punishes the victim and “ratifie[s] the
`
`actions of its supposedly errant employees and show[s] [Twitter’s] continuing allegiance to the
`
`KSA.” Id.
`
`Al-Ahmed also alleges that his suspension is the result of Twitter and the KSA’s campaign
`
`against him. Id. ¶ 50. He asserts “agents of the KSA or other Twitter employees accessed his
`
`“private Twitter accounts to read and manipulate content, including, but not limited to, purported
`
`private/direct exchange messages that were then used as a pretext by Twitter” to suspend his
`
`Arabic-language account. Id. Al-Ahmed claims he does not recognize the statement attributed to
`
`him, the message was a “fabrication,” and is an incorrect translation. Id. ¶¶ 50–51. The English
`
`translation of the message provided by Twitter reads, “Damn your mother, you Ahmari, you
`
`mountain monkey, you Ethiopian, you slave, you pagan, you cow, you beast of burden! … I see
`
`your face and your teeth sticking out. Damn your father and Khomeini, you slave, you beast of
`
`burden, you animal!” Id. ¶ 50; see Docket No. 31, Ex. 5. According to Al-Ahmed, “Twitter’s
`
`translation of the word ‘slave’ would be more accurately translated to ‘lowlife,’ and is a common
`
`5
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 6 of 23
`
`
`
`slang term in Arabic. Likewise, ‘I see your face’ is not accurate—it actually says, ‘look at
`
`yourself’; also, ‘your teeth sticking out’ is entirely inaccurate.” FAC ¶ 51. Lastly, Al-Ahmed
`
`alleges Twitter’s choice to suspend him from his Arabic-language account, not his English-
`
`language account, proves that “Twitter’s true intent” was to “censor Plaintiff on behalf of
`
`Twitter’s Saudi Arabian investors.” Id. ¶ 53.
`
`B.
`
`Procedural Background
`
`Twitter previously filed a request for judicial notice (“RJN”) and incorporation, as well as
`
`a motion to dismiss Al-Ahmed’s original complaint. See Docket No. 30 (“Twitter’s First Motion
`
`to Dismiss”); Docket No. 31 (“RJN”).
`
`1.
`
`Request for Judicial Notice and Incorporation
`
`This Court granted Twitter’s RJN, taking notice and incorporating by reference the
`
`following:
`
`
`(a) Twitter’s December 11, 2015 email and in-app notices. Docket
`No. 29-5 (“Srinivasan Declaration”), Ex. A (“Twitter Employee
`Declaration”), Ex. 1–2.
`
`(b) Twitter’s records reflecting that the December 11, 2015 email
`notice and in-app notice were sent to Al-Ahmed. Twitter Employee
`Declaration, Ex. 3–4.
`
`(c) A screenshot of Al-Ahmed’s active Twitter account. Srinivasan
`Declaration, Ex. B.
`
`(d) A publicly available Twitter post made by Ali Al-Ahmed that
`lists his phone number. Srinivasan Declaration, Ex. C.
`
`(e) A publicly available press release listing Al-Ahmed’s phone
`number and e-mail address. Srinivasan Declaration, Ex. D.
`
`(f) Twitter’s current and prior terms of service. Srinivasan
`Declaration, Ex. E; Twitter Employee Declaration, Ex. 6A–6N.
`
`See Al-Ahmed, 2022 WL 1605673, at *5.
`
`Twitter also asked this Court to incorporate by reference the allegedly abusive Twitter
`
`message for which Al-Ahmed was suspended and a certified English translation of that message.
`
`See id.; Twitter Employee Declaration, Ex. 5. This Court DENIED Twitter’s motion because Al-
`
`Ahmed’s original complaint made “no reference to the message and Al-Ahmed’s claims were not
`
`dependent on the existence of this message.” See Al-Ahmed, 2022 WL 1605673, at *5. Id.
`
`6
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 7 of 23
`
`
`
`2.
`
`Motion to Dismiss
`
`This Court GRANTED Twitter’s motion to dismiss Al-Ahmed’s original complaint on the
`
`following grounds: (1) Al-Ahmed lacked Article III standing—excepting his claims based on
`
`invasion of privacy—because he failed to establish a causal nexus between Twitter’s actions and
`
`his injuries, and any such injury was not particularized to Al-Ahmed; (2) all of Al-Ahmed’s claims
`
`against Twitter related to the unauthorized intrusion of his Twitter account were barred by the
`
`statute of limitations; (3) Twitter’s CDA immunity extended to all of Al-Ahmed’s suspension-
`
`based claims; and (4) Al-Ahmed failed to articulate why Twitter’s failure to provide a justification
`
`for the suspension of his account constitutes a breach of contract. See Al-Ahmed, 2022 WL
`
`1605673, at *7-8, 14 & 20.
`
`This Court GRANTED Al-Ahmed leave to amend the Complaint to allege a Lanham Act
`
`claim that falls within the scope of the CDA’s intellectual property exception. Id. at 20. As noted,
`
`Al-Ahmed has failed to add a claim under the Lanham Act in his FAC.
`
`III.
`
`LEGAL STANDARD
`
`Federal Rule of Civil Procedure 8(a)(2) requires a complaint to include “a short and plain
`
`statement of the claim showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). A
`
`complaint that fails to meet this standard may be dismissed pursuant to Rule 12(b)(6). See Fed. R.
`
`Civ. P. 12(b)(6). To overcome a Fed. R. Civ. P. 12(b)(6) motion to dismiss after the Supreme
`
`Court’s decisions in Ashcroft v. Iqbal, 556 U.S. 662 (2009) and Bell Atlantic Corporation v.
`
`Twombly, 550 U.S. 544 (2007), a plaintiff’s “factual allegations [in the complaint] ‘must . . .
`
`suggest that the claim has at least a plausible chance of success.’” Levitt v. Yelp! Inc., 765 F.3d
`
`1123, 1135 (9th Cir. 2014). The court “accept[s] factual allegations in the complaint as true and
`
`construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St.
`
`Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). But “allegations in a
`
`complaint . . . may not simply recite the elements of a cause of action [and] must contain sufficient
`
`allegations of underlying facts to give fair notice and to enable the opposing party to defend itself
`
`effectively.” Levitt, 765 F.3d at 1135 (quoting Eclectic Props. E., LLC v. Marcus & Millichap
`
`Co., 751 F.3d 990, 996 (9th Cir. 2014)). “A claim has facial plausibility when the Plaintiff pleads
`
`7
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 8 of 23
`
`
`
`factual content that allows the court to draw the reasonable inference that the Defendant is liable
`
`for the misconduct alleged.” Iqbal, 556 U.S. at 678. “The plausibility standard is not akin to a
`
`‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted
`
`unlawfully.” Id. (quoting Twombly, 550 U.S. at 556).
`
`IV.
`
`ANALYSIS
`
`A.
`
`Article III Standing
`
`Under Rule 12(b)(1), a party may move to dismiss for lack of subject matter jurisdiction.
`
`“[L]ack of Article III standing requires dismissal for lack of subject matter jurisdiction under
`
`[Rule] 12(b)(1).” Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). The “irreducible
`
`constitutional minimum” of standing requires that a “plaintiff must have (1) suffered an injury in
`
`fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to
`
`be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 136 S. Ct.
`
`1540, 1547, 194 L.Ed.2d 635 (2016). These three elements are referred to as, respectively, injury
`
`in fact, causation, and redressability. Planned Parenthood of Greater Was. & N. Idaho v. U.S.
`
`Dep’t of Health & Human Servs., 946 F.3d 1100, 1108 (9th Cir. 2020). The alleged injury in fact
`
`must be “concrete, particularized, and actual or imminent.” TransUnion LLC v. Ramirez, 141 S.
`
`Ct. 2190, 2203 (2021). “For an injury to be ‘particularized,’ it must affect the plaintiff in a
`
`personal and individual way” and “[o]nly those plaintiffs who have been concretely harmed by a
`
`defendant's statutory violation may sue that private defendant over that violation in federal court.”
`
`Spokeo, 136 S. Ct. at 1548 (internal quotation marks omitted); Ramirez, 141 S. Ct. at 2205. “The
`
`plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing these
`
`elements[.]” Spokeo, 136 S. Ct. at 1547 (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)).
`
`Al-Ahmed’s claims arise from two separate events: (1) the former Twitter employees’
`
`unauthorized access into Twitter accounts at the behest of the KSA between 2013 and 2015, and
`
`(2) the May 2018 suspension of Al-Ahmed’s Arabic Twitter account. Mot. at 6. Twitter argues
`
`that Al-Ahmed lacks Article III standing relating to the KSA’s espionage, and therefore all claims
`
`against Twitter (except Replevin) must be dismissed. Id.
`
`In his opposition, Al-Ahmed rehashes the same three arguments he made in opposition to
`
`8
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 9 of 23
`
`
`
`Twitter’s first motion to dismiss: (1) an injury exists solely by virtue of statutes creating legal
`
`rights; (2) Twitter’s invasion of his privacy is a harm in itself; and (3) he has nevertheless alleged
`
`a concrete and particularized injury apart from the invasion to his privacy. See Docket No. 63 at
`
`3–5 (“Opp’n”) (citing Havens Realty Corp. v. Coleman, 455 U.S. 363, 373 (1982) (internal
`
`quotations omitted)).
`
`1.
`
`First and Third Arguments
`
`The first argument fails because it was explicitly rejected by the Supreme Court in 2016.
`
`Spokeo II, 136 S. Ct. at 1543 (“Article III standing requires a concrete injury even in the context of
`
`a statutory violation.”). The third argument fails because Al-Ahmed does not identify a concrete
`
`and personal injury separate from the invasion of privacy itself. While Al-Ahmed has amended
`
`his complaint to include the allegation that “as a freelance journalist and author this has cost me
`
`hundreds of thousands of dollars in lost revenue from writing articles and books and through
`
`podcasts,” FAC ¶ 60, this fails to establish standing because it lacks any causal connection to the
`
`alleged KSA-sponsored espionage claims. Instead, it was Twitter’s suspension of his account in
`
`2018 that prevented him “from accessing the tens or thousands of KSA and other Arab-language
`
`followers and sources [that] curtailed [his] ability to report credibly and in real time on events
`
`unfolding in the KSA [and cost him his revenue.]” Id.; see also id. ¶¶ 58–61. “The hacking of his
`
`account is distinct from the termination of his account.” Al-Ahmed, 2022 WL 1605673, at *7.
`
`2.
`
`Invasion of Privacy
`
`The remaining question is whether an invasion of privacy is sufficiently concrete and
`
`particularized to confer Article III standing. In its previous order on Twitter’s motion to dismiss,
`
`this Court said it did. Al-Ahmed, 2022 WL 1605673, at *8. Al-Ahmed alleges Twitter invaded his
`
`privacy by intercepting his “personal information regarding…email addresses, contacts, phone
`
`numbers, birth dates, and internet protocol (“IP”) addresses;” and his “Tweets, private messages,
`
`direct message, online chats, friend requests, file transfers, file uploads, and file downloads.”
`
`FAC ¶¶ 24, 79. The Supreme Court suggested such an invasion of privacy is within the scope of
`
`Article III standing in Ramirez: “Various intangible harms can also be concrete. Chief among
`
`them are injuries with a close relationship to harms traditionally recognized as providing a basis
`
`9
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 10 of 23
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`for lawsuits in American courts. Those include, for example, reputational harms, disclosure of
`
`private information, and intrusion upon seclusion.” Ramirez, 141 S. Ct. at 2204.
`
`In the years between Spokeo and Ramirez, the Ninth Circuit has consistently found Article
`
`III standing in privacy-related claims. See Campbell v. Facebook, Inc., 951 F.3d 1106 (9th Cir.
`
`2020). Therefore, an invasion of privacy as a harm, particularly as analogous to that recognized in
`
`common law, is sufficient. See, e.g., Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir.
`
`2017) (“Privacy torts do not always require additional consequences to be actionable . . . the
`
`‘intrusion itself’ makes the defendant liable.” (citing Restatement (Second) of Torts § 652B cmt.
`
`b. (Am. Law Inst. 1977)); In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 599 (9th
`
`Cir. 2020) (“Plaintiffs have sufficiently alleged a clear invasion of the historically recognized right
`
`to privacy. Therefore, Plaintiffs have standing to pursue their privacy claims under the Wiretap
`
`Act, SCA, and CIPA[.]”).
`
`Still, Twitter argues that even if invasion of privacy is a sufficient injury in some cases, it
`
`is not sufficient here for two reasons. First, Twitter claims Al-Ahmed’s invasion of privacy
`
`allegation is insufficient because the “information he alleges was exposed was already public.”
`
`Mot. at 8 (“[plaintiff] cannot assert any privacy claim as to information that she has already
`
`released to the public” (citing Wasson v. Sonoma Cnty. Jr. Coll. Dist., 4 F. Supp. 2d 893, 908
`
`(N.D. Cal. 1997)). Second, Twitter argues that Al-Ahmed has not “pled sufficient facts to
`
`establish a concrete injury.” Id. (citing Shelton v. Hal Hays Constr., Inc., No.
`
`EDCV16360VAPKKX, 2016 WL 8904414, at *5 (C.D. Cal. July 29, 2016)). The private
`
`information Al-Ahmed alleges Twitter publicly exposed are his “personal information
`
`regarding…email addresses, contacts, phone numbers, birth dates, and internet protocol (“IP”)
`
`addresses;” and his “Tweets, private messages, direct message, online chats, friend requests, file
`
`transfers, file uploads, and file downloads.” FAC ¶¶ 24, 79. Twitter notes that Al-Ahmed’s
`
`“Twitter followers or contacts were publicly available on his Twitter profile[,]…his e-mail
`
`addresses and phone number have been publicly available on the Internet since as early as January
`
`2014[,]…and it is [] implausible that the KSA did not already have his birthdate.” Mot. at 8.
`
`Finally, Twitter asserts IP addresses are not private. Chevron Corp. v. Donziger, No. 12-MC-
`
`10
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 11 of 23
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`80237 CRB (NC), 2013 WL 4536808, at *10 (N.D. Cal. Aug. 22, 2013).
`
`While it is debatable whether some of the information at issue is sufficiently “private,” the
`
`Supreme Court was clear in Ramirez that the common-law analogue of a plaintiff’s asserted injury
`
`need not be an exact duplicate. See Leonard v. McMenamins, Inc., No. 2:22-CV-00094-BJR,
`
`2022 WL 4017674 (W.D. Wash. Sept. 2, 2022) (citing Bohnak v. Marsh & McLennan Cos., Inc.,
`
`580 F. Supp. 3d 21, 30 (S.D.N.Y. 2022) (“[I]n light of the TransUnion Court’s admonition that
`
`common-law analogs need not provide ‘an exact duplicate,’ as well as its explicit reference to
`
`[public disclosure of private information] as an example of traditionally judicially cognizable
`
`intangible harm, I find the fit sufficiently close.”). Thus, Al-Ahmed’s injury should not be
`
`negated simply because the privacy of his information is still in debate. More importantly, Twitter
`
`fails to explain how Al-Ahmed’s private messages, direct message, online chats, friend requests,
`
`file transfers, file uploads, and file downloads are not sufficiently private to confer standing. As
`
`construed in Al-Ahmed’s favor, the FAC sufficiently alleges private information not publicly
`
`available was hacked.
`
`As to Twitter’s claim that Al-Ahmed has not pled facts sufficient to establish an injury, the
`
`Court disagrees. The paragraphs in Al-Ahmed’s complaint which outline the information at issue
`
`may be sparse when viewed in isolation, but when viewed in the context of the entire complaint
`
`they plausibly allege invasion of privacy. Two Twitter employees targeted Al-Ahmed’s Twitter
`
`data while engaged in espionage for the KSA. See FAC. The FAC suggests that at the very least,
`
`Twitter, and Twitter employees (including Abouammo and Alzabarah), could access Al-Ahmed’s
`
`private messages and direct messages and provide them to the KSA, thereby putting Al-Ahmed
`
`personally at risk. See, e.g., id. ¶¶ 50, 62. Therefore, the Court maintains that “Al-Ahmed’s injury
`
`is sufficiently concrete and particularized.” Al-Ahmed, 2022 WL 1605673, at *8.
`
`Next, Twitter again argues that Al-Ahmed fails to establish that his alleged injury is “fairly
`
`traceable to Twitter.” Opp’n at 9.
`
`As before, to the extent that Al-Ahmed alleges that these breaches of privacy caused other
`
`harms such as the disappearance, arrest, or execution of his followers, his claims fail because he
`
`“does not explain how the compromise of [his] Twitter data caused the harm[.]” Abdulaziz v.
`
`11
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 12 of 23
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`Twitter, Inc., No. 19-CV-06694-LB, 2020 WL 6947929, at *6 (N.D. Cal. Aug. 12, 2020). Any
`
`harm to Al-Ahmed, if alleged to be a result of the harm or disappearance of his followers, cannot
`
`be established due to lack of causation, and alleging harm to “several” Twitter users who either
`
`followed him on Twitter or have messaged him, out of the 36,000 followers that he had, is
`
`insufficient. Also, the specific examples Al-Ahmed provides remain unavailing. First, Al-Ahmed
`
`points to a follower of his Twitter account who was also a Saudi dissident and journalist. FAC ¶
`
`27. The article cited by Al-Ahmed describes him as “one of the kingdom’s most prominent and
`
`persistent dissidents” who had “frequent prison terms.” Id. ¶¶ 27–28, n.8. Next, Al-Ahmed
`
`comments that the journalist Jamal Khashoggi was “not uncoincidentally slain following” the hack
`
`of Al-Ahmed’s Twitter. Id. ¶ 57. Al-Ahmed’s belief is based on the KSA accessing “messages
`
`between Plaintiff and individuals still living in, and in close proximity to, Saudi Arabia who were
`
`in close contact with Jamal Khashoggi.” Id. However, these claims are conclusory and based on
`
`mere speculation. See Twombly, 550 U.S. at 570. As such, Al-Ahmed fails to plead any facts that
`
`suggest the breach of privacy led to either individual’s imprisonment or death.
`
`On the other hand, even if consequential harm is not sufficiently pled, the alleged harm to
`
`Al-Ahmed based on the unauthorized access of his Twitter account is traceable to Twitter because
`
`Abouammo and Alzabarah were Twitter employees and obtained unauthorized access as a result
`
`of Twitter’s failings. Opp’n at 5–6. Twitter counters that the privacy injury is not traceable to
`
`Twitter based on vicarious liability because a plaintiff must demonstrate standing for each claim
`
`he seeks…and for each form of relief that is sought,” and Al-Ahmed cannot, and has not, “asserted
`
`a vicarious liability claim for each cause of action he pleads.” Mot. at 9 (citing Davis v. Fed.
`
`Election Comm’n, 554 U.S. 724, 734 (2008)). Specifically, Twitter claims Al-Ahmed “(1) fails to
`
`sufficiently plead that Twitter is vicariously liable for Abouammo and Alzabarah’s conduct; and
`
`(2) even assuming arguendo that vicarious liability is adequately pled for certain claims, standing
`
`is not dispensed in gross, and vicarious liability is inapplicable to several of his causes of action.”
`
`See Docket No. 64 at 3 (“Reply”).
`
`However, Twitter conflates Article III standing with the merits arguments. Al-Ahmed has
`
`alleged a theory by which Twitter is responsible for the hacking and the harm suffered thereby.
`
`12
`
`Northern District of California
`
`United States District Court
`
`

`

`Case 3:21-cv-08017-EMC Document 69 Filed 01/03/23 Page 13 of 23
`
`
`
`Whether Al-Ahmed may prevail on the merits on his vicarious liability claims as a matter of
`
`substantive law is a question separate from whether Al-Ahmed demonstrated traceability for
`
`standing purposes. As alleged, Abouammo and Alzabarah’s conduct is “fairly traceable” to
`
`Twitter.
`
`B.
`
`Statute of Limitations
`
`1.
`
`Delayed Discovery Rule
`
`Twitter argues that Al-Ahmed’s claims accrued when he r