Abdulaziz v. Twitter, Inc.

Background

Omar Abdulaziz alleged that Saudi authorities recruited two Twitter employees, Ali Alzabarah and Ahmad Abouammo, to access Twitter accounts without authorization. He alleged that Alzabarah accessed his confidential information, including passwords, internet protocol addresses, and direct messages, in June and July 2015. Twitter notified potentially affected account owners on December 11, 2015, that state-sponsored actors might have targeted their accounts, but Abdulaziz alleged that he did not receive the notices and learned about the unauthorized access in October 2018.

Abdulaziz also alleged that Saudi agents later planted Pegasus malware on his phone in June 2018. According to the complaint, the malware allowed the agents to obtain his messages, emails, photographs, location data, and other information and to monitor the phone. He alleged that the phone hacking was connected to the earlier Twitter data access and that Saudi authorities then harmed or imprisoned members of his family, friends, and associates.

The operative Third Amended Complaint asserted claims against Twitter for negligent supervision and retention of employees and negligence. Twitter moved to dismiss, arguing that Abdulaziz lacked Article III standing because he did not adequately allege causation, that the claims were untimely, and that he had not plausibly pleaded negligence. Twitter also argued that its terms of service barred the claims.

Analysis

The court applied the rules governing motions to dismiss. For Article III standing, a plaintiff must show an injury that is fairly traceable to the defendant’s conduct and likely to be redressed by a favorable decision. The court held that Abdulaziz did not plausibly allege that Twitter’s employees’ access to his data caused the later harms to him, his family, and his friends.

The court emphasized that Abdulaziz alleged persecution before the Twitter data compromise, that the phone hacking occurred about three years after the Twitter access, and that the complaint offered a conclusion rather than facts connecting the two events. Because the complaint did not adequately allege causation, the court held that Abdulaziz did not establish Article III standing.

The court separately held that the negligence claims were barred by California’s two-year statute of limitations. The lawsuit was filed on October 18, 2019, almost four years after Twitter’s December 11, 2015 notice about the possible compromise. The court held that the notice was sufficient to trigger the period under California’s discovery rule, which generally starts the limitations period when a plaintiff discovers or has reason to discover the cause of action.

The court also held that Abdulaziz did not plausibly plead negligence. Under California law, negligence requires a duty of care, breach, causation, and damages. For negligent supervision, an employer must have known or reasonably should have known that an employee created a particular risk or hazard, and that harm must then occur. The court concluded that Abdulaziz did not adequately plead either causation or facts showing that Twitter knew or should have known that its employees created the relevant risk.

The court did not reach Twitter’s argument concerning the terms of service. It noted that the provision limited liability for damages resulting from unauthorized access to a user’s transmissions or content, but Twitter had not adequately addressed how that provision applied to claims involving its own employees’ alleged conduct.

Disposition

The court granted Twitter’s motion to dismiss the Third Amended Complaint with leave to amend. Any amended complaint had to be filed within 21 days and include an attachment showing the changes from the prior complaint. The order disposed of ECF No. 99.