Jurist says Twitter likely not liable for ‘rogue employee’s spying

SAN FRANCISCO -- Twitter properly notified a Saudi dissident about a rogue employee hacking his account on behalf of the Kingdom of Saudi Arabia to gather intelligence, company attorneys told a U.S. magistrate judge Thursday.

Benjamin Berkowitz, representing Twitter, said it's too late for Omar Abdulaziz to sue Twitter since it alerted him of the state-sponsored breach in 2015, nearly two years past the window to file suit.

U.S. Magistrate Judge Laurel Beeler sided with the defense that Abdulaziz likely cannot pursue most of his claims.

"I'm skeptical and that's an understatement," she said to plaintiffs' attorneys.

Abdulaziz alleged in a 2018 lawsuit that Twitter never sufficiently warned him that one of its employees infiltrated his account in 2015 and provided his personal information to Saudi operatives, leading to the imprisonment of his brothers by the regime. Abdulaziz v. Twitter, Inc., 19-cv-06694 (N.D. Cal., filed Oct. 18, 2019).

Representing Abdulaziz during the Thursday Zoom video hearing, Ben Gharagozli said the two-year window to sue never started because his client was never notified of the hack. While he did not dispute the notice's existence, which could have been filtered out from his client's email, he said Twitter did not take the necessary steps to properly notify affected users.

"For the statute of limitations to start ticking, the plaintiff had to actually know about this," the Marina del Rey-based attorney said. "Twitter could've tweeted about this, held press conferences or arranged for its app to force users to look at the notice."

Beeler replied that by sending the notice, regardless of whether it was received, Twitter was disavowing the crime, which she said the company likely referred to federal prosecutors. She characterized the issue as: "Did you ratify employee conduct such that it's appropriate under the law to hold you responsible?"

Twitter attorney Anjali Srinivasan of Keker, Van Nest & Peters LLP agreed with the judge. She said that receipt of the notice is irrelevant since it's solely about whether the company attempted to redress the hack.

Beeler also identified what could be a fatal flaw from plaintiffs in establishing a direct link between Twitter's alleged misconduct and the harm Abdulaziz suffered. She questioned why she should hold the company liable for "rogue employees' conduct."

In its motion to dismiss, Twitter emphasized the hack occurred in 2015 and the plaintiff's injuries, which were a result of Pegasus malware being installed on his phone allowing for extensive spying, were suffered much later in 2018.

Berkowitz, also of Keker, Van Nest & Peters LLP, argued Abdulaziz has not identified any particular information accessed from the hack that was used by Saudi operatives to target him and install the malware on his phone.

"The information on his phone number and email was publicly available," he said. "His public criticisms of [Saudi Arabia] were well documented."

Gharagozli responded that Pegasus only became available in 2017, which he said "explains pretty well why they waited so long."

Twitter should also be held responsible, Gharagozli continued, because it essentially allowed the rogue employee, Ali Alzabarah, to flee the country.

In 2018, Twitter confronted Alzabarah about his access of user data, to which he responded that he did so out of curiosity, and suspended him. He flew to Saudia Arabia the following day.

"They basically let this guy leave the country," Gharagozli said. "They probably should've coordinated with intelligence agencies."

Beeler said she's likely to give the plaintiff's attorneys another chance to fix defects in their complaint.

In the first time prosecutors publicly accused Saudia Arabia of using agents in the United States, the Justice Department in November unveiled charges against two former Twitter employees, including Alzabarah, with spying for the kingdom by illegally accessing company information on dissidents. U.S. v. Alzabarah, 19-cr-71824 (N.D. Cal., filed Nov. 5, 2019).