Rhode Island v. Alphabet, Inc., No. 20-15638 (9th Cir. 2021)
Annotate this Case
After Cambridge Analytica improperly harvested user data from Facebook's social network, Google discovered that a security glitch in its Google+ social network had left the private data of some hundreds of thousands of users exposed to third-party developers. Google and its holding company, Alphabet, chose to conceal this discovery, made generic statements about how cybersecurity risks could affect their business, and stated that there had been no material changes to Alphabet's risk factors since 2017.
Rhode Island, in a consolidated amended complaint, filed suit against Alphabet, Google, and others, alleging violations of Section 10(b) of the Securities Exchange Act of 1934 and SEC Rule 10b-5 for securities fraud, as well as violations of Section 20(a) of the Exchange Act. The district court granted Alphabet's motion to dismiss on the grounds that Rhode Island failed to adequately allege a materially misleading misrepresentation or omission and that Rhode Island failed to adequately allege scienter.
The Ninth Circuit concluded that the complaint adequately alleged that Google, Alphabet, and individual defendants made materially misleading statements by omitting to disclose these security problems and that defendants did so with sufficient scienter, meaning with an intent to deceive, manipulate, or defraud. Applying an objective materiality standard, the panel concluded that Rhode Island's complaint plausibly alleges the materiality of the costs and consequences associated with the Privacy Bug, and its public disclosure, and how Alphabet's decision to omit information about the Privacy Bug in its 10-Qs significantly altered the total mix of information available for decisionmaking by a reasonable investor. Furthermore, the complaint adequately alleges scienter for the materially misleading omissions from the 10-Q statements. The panel also concluded that Rhode Island adequately alleged falsity, materiality, and scienter for the April 2018 and July 2018 10-Q statements. Accordingly, the panel reversed the district court's holdings to the contrary and reversed the dismissal of the section 20(a) control-person claims based on the 10-Q statements.
Because the complaint does not plausibly allege that the remaining statements at issue are misleading material misrepresentations or omissions, the panel affirmed the district court's dismissal of the Section 10(b) and Rule 10b-5(b) statement liability claims based on these statements. The panel also affirmed the district court's dismissal of the Section 20(a) controlling-person claims for these statements. Finally, because the district court erred in sua sponte dismissing Rhode Island's claims under Rule 10b-5(a) and (c) when Alphabet had not targeted those claims in its motion to dismiss, the panel reversed the dismissal of the claims under Section 10(b) and Rule 10b-5(a) and (c) against all defendants and remanded to the district court. The panel also reversed the dismissal of Rhode Island's claims under Section 20(a) to the extent those claims depend on claims alleging violations of Rule 10b-5(a) and (c).
Court Description: Securities Fraud. The panel affirmed in part and reversed in part the district court’s dismissal of a securities fraud action for failure to state a claim, vacated the district court’s judgment, and remanded for further proceedings. The State of Rhode Island filed a private securities fraud action under §§ 10(b) and 20(a) of the Securities Exchange Act of 1934 and SEC Rule 10b-5 against Google LLC, its holding company Alphabet, Inc., and individual defendants. The consolidated amended complaint alleged that defendants omitted to disclose security problems with the Google+ social network. The complaint referred to the cybersecurity problems as the “Three-Year Bug” and the “Privacy Bug.” The district court granted defendants’ motion to dismiss on the grounds that Rhode Island failed to adequately allege a materially misleading misrepresentation or omission and that Rhode Island failed to adequately allege scienter. The panel held that the complaint adequately alleged that two statements made by Alphabet in its quarterly reports filed IN RE ALPHABET, INC. SECURITIES LITIGATION 3 with the SEC on Form 10-Q omitted material facts necessary to make the statements not misleading. Applying an objective materiality standard to the 10-Qs, the panel held that Rhode Island’s complaint plausibly alleged the materiality of the costs and consequences associated with the Privacy Bug, and its public disclosure, and how Alphabet’s decision to omit information about the Privacy Bug in its 10- Qs significantly altered the total mix of information available for decisionmaking by a reasonable investor. The panel next addressed whether the complaint adequately alleged scienter for the materially misleading omissions from the 10-Q statements. The panel held that the complaint was required to plausibly allege, with the particularity required by the Private Securities Litigation Reform Act, that the maker of the statements knew about the security vulnerabilities and intentionally or recklessly did not disclose them. The panel concluded that the complaint’s specific allegations, taken as a whole, raised a strong inference that defendant Lawrence Page, and therefore Alphabet, knew about the Three-Year Bug, the Privacy Bug, and a Privacy Bug Memo, and that Alphabet intentionally did not disclose this information in its 10-Q statements. The panel further held that Rhode Island adequately alleged falsity, materiality, and scienter for the 10-Q statements. The panel therefore reversed the district court’s holdings to the contrary. The panel also reversed the district court’s dismissal of the complaint’s § 20(a) control-person claims based on the 10-Q statements. As to ten additional statements identified in the complaint, the panel concluded that the complaint did not plausibly allege that these remaining statements were 4 IN RE ALPHABET, INC. SECURITIES LITIGATION misleading material misrepresentations. The panel therefore affirmed the district court’s dismissal of claims based on these statements. Rhode Island argued on appeal that the district court erred in dismissing its “scheme liability claim” under Rule 10b-5(a) and (c) when it dismissed the complaint in its entirety without addressing those claims. The panel held that because Alphabet’s motion to dismiss did not target Rhode Island’s Rule 10b-5(a) and (c) claims, Rhode Island did not waive those claims by failing to address them in opposition to the motion to dismiss. Reversing, the panel held that the district court erred in sua sponte dismissing the Rule 10b-5(a) and (c) claims when Alphabet had not targeted them in its motion to dismiss.
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.