DIANA HAUCK V. ADVANCED MICRO DEVICES, INC., No. 19-16124 (9th Cir. 2020)

Annotate this Case

Download PDF

FILED NOT FOR PUBLICATION UNITED STATES COURT OF APPEALS MAY 15 2020 MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS FOR THE NINTH CIRCUIT DIANA HAUCK, et al., No. Plaintiffs-Appellants, 19-16124 D.C. Nos. v. ADVANCED MICRO DEVICES, INC., 5:18-cv-00447-LHK 5:18-cv-00744-LHK 5:18-cv-00883-LHK MEMORANDUM* Defendant-Appellee. Appeal from the United States District Court for the Northern District of California Lucy H. Koh, District Judge, Presiding Submitted May 13, 2020** San Francisco, California Before: FRIEDLAND and BENNETT, Circuit Judges, and RAKOFF,*** District Judge. Plaintiffs-Appellants, each of whom had purchased a computer processor manufactured by Defendant-Appellee Advanced Micro Devices, Inc. (“AMD”) or * This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. ** The panel unanimously concludes this case is suitable for decision without oral argument. See Fed. R. App. P. 34(a)(2). *** The Honorable Jed S. Rakoff, United States District Judge for the Southern District of New York, sitting by designation. a device containing such a processor, filed this putative class action alleging various state law claims arising out of alleged defects in those AMD processors.1 Like all major computer processor manufacturers, AMD employs branch prediction, speculative execution, and caches in its processors’ microarchitecture. Plaintiffs’ operative second amended complaint alleges that AMD processors are defective because their reliance on these features renders the processors vulnerable to cybersecurity attacks in which attackers (1) artificially induce mis-speculation to influence what metadata a processor stores, and then (2) launch side-channel attacks to deduce users’ underlying sensitive information from that metadata. Plaintiffs allege that this vulnerability was publicized to consumers in January 2018, and Plaintiffs acknowledge that the type of attack the processors were vulnerable to was commonly referred to as a Spectre attack. Plaintiffs do not allege that any such attack has successfully compromised their data or any other consumer’s data. Instead, their claims are premised on allegations that they would not have purchased their devices or would have paid less for them if they had 1 Plaintiffs-Appellants are citizens of four different states and assert state law claims corresponding to their respective domiciles. We refer to Plaintiff-Appellant Diana Hauck as the “Louisiana Plaintiff,” Plaintiffs-Appellants Shon Elliott, Michael Garcia, and Joann Martinelli as the “California Plaintiffs,” PlaintiffAppellant Benjamin Pollack as the “Florida Plaintiff,” and Plaintiff-Appellant Jonathan Caskey-Medina as the “Massachusetts Plaintiff.” Each plaintiff group asserts claims on behalf of the named plaintiffs from the corresponding state, a nationwide class, and a state class. 2 known about the defect, and on allegations that the defect prompted them to install third-party patches that then caused their processors’ performance to worsen. The district court granted AMD’s motion to dismiss the claims in Plaintiffs’ second amended complaint that the parties had identified as bellwether claims, entered a partial final judgment pursuant to Federal Rule of Civil Procedure 54(b), and certified this matter for immediate appeal. Plaintiffs timely appealed. Reviewing de novo, see Davidson v. Kimberly-Clark Corp., 889 F.3d 956, 963 (9th Cir. 2018), we affirm. 1. Plaintiffs have adequately alleged Article III standing as to their claims for damages. Plaintiffs’ allegations that their devices degraded in performance after they installed third-party patches to attempt to mitigate their processors’ vulnerability to the alleged defect are sufficient to establish an injury in fact that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180 (2000). That injury is “fairly traceable” to the design of AMD processors. Id. Although it is possible, as AMD suggests, that the age of Plaintiffs’ computers or other issues with the third-party patches were partially responsible for the performance losses, Plaintiffs allege an adequate causal connection between their learning about the vulnerabilities resulting from the microarchitecture of AMD’s processors and their alleged injury to establish 3 standing at this juncture. See Mendia v. Garcia, 768 F.3d 1009, 1014-15 (9th Cir. 2014). Finally, Plaintiffs’ claimed injury, if proven, would be redressable through damages. See Jewel v. Nat’l Sec. Agency, 673 F.3d 902, 908, 912 (9th Cir. 2011). 2. The district court did not err in concluding that, to the extent Plaintiffs’ second amended complaint alleged that AMD processors were defective for the reason that their caches are vulnerable to side-channel attacks generally and not only Spectre-like attacks in particular, or because of other some other subset of their features, Plaintiffs failed to allege the nature of the defect with sufficient specificity to state any of their claims sounding in fraud under the heightened pleading standard of Federal Rule of Civil Procedure 9(b). 3. The district court did not err in dismissing for failure to state a claim the California Plaintiffs’ claims for violation of the unfair business practices prong of the Unfair Competition Law (“UCL”) and for fraud by omission under California law. The fraud by omission claim was properly dismissed for failure to plausibly allege the existence of any of the relevant bases for a fraud claim set forth in LiMandri v. Judkins, 60 Cal. Rptr. 2d 539 (Ct. App. 1997). The California Plaintiffs do not allege that AMD is their fiduciary. See id. at 543. Nor are their allegations sufficient to establish either AMD’s knowledge or active concealment of the defect. See id. Although the California Plaintiffs allege that AMD was aware of some of the vulnerabilities created by its design choices, they do not 4 plausibly allege that AMD knew of the specific vulnerability identified in their second amended complaint until that vulnerability was disclosed to AMD in June 2017, which was after the California Plaintiffs had made their purchases. Nor do the California Plaintiffs plausibly allege that AMD “suppresse[d]” material facts regarding that specific defect. See id. (quoting Heliotis v. Schuman, 226 Cal. Rptr. 509, 512 (Ct. App. 1986)). To the extent the California Plaintiffs’ unfair business practices UCL claim is not also grounded in fraud, it was nevertheless properly dismissed, because the California Plaintiffs have not stated a plausible claim that AMD engaged in an unfair business practice under either the “tether[ing]” or the “balancing” tests. See Lozano v. AT&T Wireless Servs., Inc., 504 F.3d 718, 735-36 (9th Cir. 2007); Cal. Bus. & Prof. Code § 17200 et seq. Plaintiffs have not plausibly alleged either the existence of false advertising or an actual violation of a privacy right, nor have they plausibly alleged that the harm represented by the theoretical risk of a cybersecurity flaw that has not yet been successfully exploited outweighs the other benefits of AMD’s processor design. 4. The Florida Plaintiff’s omission claim under the Florida Deceptive and Unfair Trade Practices Act (“FDUTPA”), Fla. Stat. § 501.201 et seq., and the Massachusetts and Florida Plaintiffs’ affirmative misrepresentation claims under the Massachusetts Consumer Protection Act (“MCPA”), Mass. Gen. Laws ch. 93A, 5 § 1 et seq., and FDUTPA were also properly dismissed. Plaintiffs do not plausibly allege that AMD’s statements or omissions “offend[ed] established public policy” or were “immoral, unethical, oppressive, unscrupulous or substantially injurious to consumers.” PNR, Inc. v. Beacon Prop. Mgmt., Inc., 842 So. 2d 773, 777 (Fla. 2003) (quoting Samuels v. King Motor Co. of Fort Lauderdale, 782 So. 2d 489, 499 (Fla. Dist. Ct. App. 2001)); see also Aspinall v. Philip Morris Cos., 813 N.E.2d 476, 486-87 (Mass. 2004) (“[A] practice is ‘deceptive’ . . . ‘if it could reasonably be found to have caused a person to act differently from the way he [or she] otherwise would have acted.’” (last alteration in original) (quoting Purity Supreme, Inc. v. Attorney Gen., 407 N.E.2d 297, 307 (Mass. 1980))). Nor were any of the alleged statements or omissions “likely to mislead” consumers “acting reasonably in the circumstances” to their detriment, given that such consumers would not plausibly believe that AMD’s clock-speed representations were premised on any implicit security assurances, or that their devices would be completely impervious to novel cybersecurity threats. PNR, 842 So. 2d at 777 (quoting Millennium Commc’ns & Fulfillment, Inc. v. Office of Attorney Gen., 761 So. 2d 1256, 1263 (Fla. Dist. Ct. App. 2000)); see also Aspinall, 813 N.E.2d at 486-87. 5. The Massachusetts Plaintiff’s omission claim under the MCPA was properly dismissed. Given the wide publicity the alleged defect received prior to 6 the Massachusetts Plaintiff’s purchase of his AMD processor and the absence of plausible allegations that consumers would have believed their devices were not susceptible to any cybersecurity threats, the second amended complaint does not plausibly allege that AMD’s failure to disclose the defect “could reasonably be found to have caused [the Massachusetts Plaintiff] to act differently from the way he . . . otherwise would have acted.” Aspinall, 813 N.E.2d at 486 (quoting Purity Supreme, 407 N.E.2d at 307). 6. The California Plaintiffs’ warranty claims were properly dismissed. Even if AMD’s clock-speed representations are treated as an express warranty, Plaintiffs fail to identify any specific or unequivocal written statement that guarantees that such clock speeds could be attained without any possible security compromises. See Cal. Com. Code § 2313; Maneely v. Gen. Motors Corp., 108 F.3d 1176, 1181 (9th Cir. 1997). Nor have Plaintiffs plausibly alleged that their devices lack “even the most basic degree of fitness for ordinary use” as required to state a claim for breach of an implied warranty of merchantability. Mocek v. Alfa Leisure, Inc., 7 Cal. Rptr. 3d 546, 549 (Ct. App. 2003); see also Cal. Com. Code §§ 2314-15. 7. The Louisiana Plaintiff’s redhibition claim was also properly dismissed. Plaintiffs have not plausibly alleged either that AMD’s processors were “absolutely useless” or that they were so inconvenient or imperfect that a reasonable person would not have purchased them. Justiss Oil Co. v. Oil Country 7 Tubular Corp., 216 So. 3d 346, 361 (La. Ct. App. 2017) (quoting Blair v. Bad Boy Inc., 137 So. 3d 1223, 1227 (La. Ct. App. 2014)); see also La. Civ. Code Ann. arts. 2520, 2524. AFFIRMED. 8

Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.