good morning runners and may please the court in a minute i'd like to address how the substantial risk of harm from those appose data breach and the efforts plaintiffs made to mitigate those risks establish article three standing but i want to start as numerous other found but i would like to start by addressing how this case is different namely that while plaintiff claims that they were injured by his negligence they also have a run of the mill consumer protection claim they paid zappa's for services expecting not just to get the delivery of some shoes but they also expected competent security that zappa's would protect their personal identification information and that's because those made that explicit promise to the point so to that promises that that information will be protected and absent that promise zappos the services are worth less and that simply because not only does that post pay money for are ostensibly paid money but also because consumers value that additional security effort and you don't think that's an implicit guarantee in any electronic transaction with a vendor it seems like it would be a little odd wouldn't it for us to say the reason that they could expect security is because they had something saying it was secure your honor may be an implicit maybe an implicit agreement but for purposes of standing the fact that it's a explicit promise puts it right into the wheel house of a standard consumer protection i'm just not sure that that makes sense though because  i would have thought that any online transaction you have the right to expect that they're not going to distribute your information so the fact that they said they weren't i don't know if it really changes your injury in the way it's an interesting argument for to start with because i  guess i'm not sure that that's your strongest of your arguments maybe it gives you standing that they got rid of your of your information was stolen but that's your other arguments and not this one this one turns on whether i made the statement it seems like i would have hoped most would implicitly be making that statement it doesn't make that much difference when they make it explicit or implicit while you're on i think that gets into a little bit of the nitty gritty of a consumer protection claim but if a if a defendant doesn't have a duty to make an affirmative statement and hadn't had that statement they were going to keep your information secure on their website i don't your honor i think it would be the same as is in the michael's case judge buffalo decided their their consumers made over the counter purchases and provided their credit card and the goods they received hadn't necessarily been reduced in value just because the over the counter point of sale system had been hacked here however we have an online service that explicitly promises two things shoes and that your personal identification information should be protected it's clearly material representation otherwise they wouldn't have made it and so the question then i guess becomes can an online retailer promise to provide security make explicit promises that every consumer seeds and then not fulfill that promise and then have the result be that there isn't an injury and that can't be the case that it's a subset of you know different than chavez versus blue sky which this court decided in two thousand and nine where  the defendant promised soda that was sourced from particular place where they still got the soda but the misrepresentation that it was that it wasn't sourced at a particular place and so that was a sufficient to give rise to standing it's also similar to this this decision in the maya case where consumers alleged that had they not that the defendant's actions resulted in them purchasing homes that were worth less than they had represented or were they wouldn't made the purchase at all and that that is an injury put it differently a peculiar injury is is an old school article three injury because you're out of money and had and so i guess the answer is yes had not made these explicit representations then there might not be a consumer protection claim maybe there would just be a negligent misrepresentation claim as the district court found counsel though there's a recent case from the eighth circuit in receiver value which is not a good case for you guys so explain to me why we should one go your way in light of that case and second is there a way we can distinguish that case or not directly in conflict with it if we're going to go your way we don't i think the super value case again is just one of those over the counter situations you have somebody making purchases i would suggest a different circuit cases is well on that before we run away from super value understand the temptation to do so i have to imagine though when you go to a grocery store and use a credit card to purchase something there's something in either the bylaws of the company or on the company's website saying we value our customers and we value their privacy i mean there's got to be something out there somewhere that you can latch onto so i  give you another way to distinguish that case while you're on i think the difference is that those aren't representations made directly to the consumers most people who go to the grocery store don't check the website to see whether there's going to be security or not and again it gets to the question of duty a defendant doesn't have a duty to make an affirmative representation regarding data security but when they do and when it does i'm sorry cut you off the eighth circuit didn't as i remember the case the eighth circuit did not rule for the reasons you're saying they said no standing well that's an injury question that's not a that's not a cause of action question i agree you're on the go how do we deal with the eighth circuit standing rule and in that case well your honor i think that the way you actual data isn't stolen then the fact you make a representation doesn't affect the goods where the eight circuit in august reversed that decision and the circuit held that where there is an explicit promise that there that there will be data security handy but we can locate it how did that case talk about the standing issue absolutely your honor it turned on standing and in that's actually the first case where a circuit court has decided that the benefit of the bargain can be the basis for standing and scottrade is on all fours there which is the was the defense argument before the eighth circuit had reversed their consumers go to an online site scottrade they're required to provide their personal information just like here just like you're the privacy policy represented that they would protect information and just like you're the website had additional representations that they would protect the personal identification information and the eighth circuit only addressed the benefit of the bargain issue because they found that that was sufficient to provide standing now in all candor there's a slight difference there it was a contract claim namely that the plans allege there was a contract with scottrade which they would provide trading services and security whereas here it's a consumer protection claim but that's a that's a difference that action without a difference ultimately we possibly allege that consumers attach value to a promise to protect security and that the defendant promise to protect their security we plead the studies that indicate that consumers are willing to pay a levy to sixteen dollars more for websites and it certainly stands to reason that if zappa's had fulfilled their promise they would have incurred higher overhead costs which naturally have an effect on the overhead price so it shouldn't be a challenge to demonstrate a price premium they promised security they didn't promise they didn't provide it the value of the goods receiver les that my own ruling on standing in michael's where i said there was standing and i don't understand why you're making more difficult arguments for yourself your own right for what seems more difficult as i don't necessarily want to handicap myself i do think the ruling by this court that there is a damages based on the benefit of the bargain would help move the case forward because then there would be injury common to the entire class and we wouldn't have to say in additional issues but i don't want to handicap myself i'm not suggesting that the other arguments are any weaker and and judge michael i think you're exactly right that the seven circuits decisions and your honour's own decisions in michaels are absolutely apis it in this case  here just as in those cases hackers specifically identified the most they wouldn't have stolen that information if they hadn't intended on using them we plausibly allege that the information that was stolen can be used namely either fishing in farming by using their email addresses and we also allege that a number of people actually have suffered identity theft are new plaintiffs o'brien and wadsworth allege that shortly after the data breach their claims are out now though right they voluntarily dismissed those claims that's correct your honor but again as judge bucko noticed in noted in the in the michaels decision were other class members have suffered actually identity theft that goes to the question of whether the name plaintiffs are also at eminent risk at the end of the day the only argument that the district court and the defendant proffer on this point is that a lot of years of past but of course the f t c recognize that it can take many years  for these kind of identity theft issues to occur and let's keep in mind there are twenty four million people who are affected just doing a little bit of simple math if you had a thousand hackers working every single day for three hundred sixty five days a year and they were able to steal ten identities it would take six and a half years to work their way through the entire list so the mere fact that some time has passed and only some class members or not all class members have suffered identity theft i think didn't know that don't we determine that as of the time the case was filed and then how do you even know at this point who has or who has not suffered injury in the intervening time well given that we haven't had full class discovery we don't know that answer yet but we do know that a couple plaintiffs did or a couple of our new plan of suffered and even the district court recognized that there there'd be theft injuries were who steals a laptop almost certainly because they wanted the laptop creates a minute or substantial risk of injury more so than this case where data thieves intentionally steal that information and that of course is the reasoning in the seven circuits decisions identification information theory i would also like to just make a couple points and i should mention for like to reserve a couple minutes for rebuttal i'd like to bring up one of our other arguments which is the  because of the risk of future injury caused by defend its negligence that that was sufficient and that that cup created standing a few years later the district were reversed course reasoning that because so much time had passed and those plaintiffs who attempted to mitigate the risk hadn't had any triggers or other instances of identity theft that somehow was no longer compensable but it's a bit ironic to say that it's appropriate for people to take efforts to protect their identity have those efforts be successful and then say a few years down the road you can don't want to take advantage of the fact that you protected your identity well that's a bit of an ironic conclusion and for that reason i think that the mitigation is also a independent reason why you are playing it so standing on a reserve you may please the court i think your honor is absolutely correct that the super value case provides super guidance here it is consistent with this court's prior ruling in crofton or and it makes the exact same distinction that are just or judge did below which is if you have a plaintiff alleges actual identity theft even if as we argued there is really no relationship here here is why we don't think it matters there's no they've alleged identity theft that identified in the an identity theft they get to proceed threat and if someone says i had something that i that i had an identity theft i have an i don't know where it no one had that in chrono right i thought it was just the laptop was stolen well there was a laptop with social security numbers on it the nature of the data was much more significant than was at issue here there's this is case is so different than lots of things we've seen and so say your distinction is about the social security number so your distinction is cotner involves social security numbers in this few times and i would remind the court that what maya says is that cautions lawyers against engaging in quote an ingenious academic exercise in the conceivable quote to explain some theory of injury and that's at six fifty thirty and ten sixty eight and hear of plaintiffs who claim to avoid an arbitration clause they told the district we read nothing we saw nothing so you can't make us arbitrate and now here oh well we read this express promise that you'll keep our data safe and secure for all times i mean that's that's on a stop your honor there so not a valid thing going back to your distinction about social security numbers for value was very much based on this report about what causes identity  theft can we take judicial notice of that report in its accuracy i'm not quite sure how can you defend that approach and is that what you think we need to do here to say that social security numbers are different from passwords and credit card information and other things that they all taken i don't know about the specific report but certainly you can't steal an identity based on a portion of a credit card number if you're going to so how do we know it's only a portion of the credit card i think that allegation is they still credit card numbers the allegation through every iteration of the complaint been first all this is what happened the allegation through every iteration of the complaint was that it was just the credit card tail without anything just the last four digits and then after extensive litigation the two new plaintiffs showed up as by the way we think our phone number was stolen i mean it's really it's apparently i mean so we're we're reviewing the third amended complaint as the operative one now is that right that is the operative complaint but your honor can't ignore the prior allegations all along through the course of the case with no explanation as to where this this new allegation came from after three years of discovery and you know quite well usually we don't assume the complaint is based on discovery under the posture here is a little odd right there there is a case and i wish i could remember the case name but there's a case in state court that says that when you plead multiple versions of the complaint consistently and then you plead and you complaint you don't wash out the you know quoting from macbeth you don't wash out the damn spot of your prior allegations there is nothing to suggest that full credit card number stolen here and if i could i think this if i can answer the question asking us to assume an allegation of a claim is not true i'm asking you to assume is that multiple allegations throughout the course of the complaint is the kind of thing the plaintiffs need to stick with and then when you know that the case is on the brink of dismissal they can't just make something up that has no so do you have a case in our court that says that there are i believe  carriers and maybe the seventh circuit you know i apologize for not having one in this circuit but i think i can get a little bit into judge buffalo's questions about the michael's case which he had and this is significant  many of the identity theft cases you see in the news michaels p f chang's neiman marcus target these are cases where fraud actually precedes the notice in every single one of these cases the information was stolen and the thieves used it right away and the credit card networks were receiving reports of fraud they identified fraud at a common point of purchase so hey it's really odd we have one hundred fraud claims and what are the odds that one hundred people on the same day all shopped at michaels they then notify the retailer the retailer goes into it the passwords got notice out to the public and stop the situation before it could actually result in fraud so this theory that oh well the criminals may wait twenty years to use it criminals are not known for their lack of impulsive behavior data has a half life data has a shelf life credit card numbers change people move the fact that we're now almost you know we have six years past this event do you agree that we have valuate standing as of the time of the complaint well i as of the time of the first complaint when the case was initiated well i i think the court allowed them to get into discovery and i think if your honor looks at us well that's a pretty simple question it's yes or no i think lou hahn answers the question for the court and the answer is and the answer is as the case progresses ask the case progresses plaintiff's face a higher and higher burden on standing so it is that's at the each procedural stage you have to meet the summary judgment standard at the summary judgment stage we're still at the pleading stage in this case but it is appropriate for the court to consider how much time has passed a says that well again i rely on luan for the time since the case was filed less unfortunate the way appeals work so i agree with you that what we want from motion to dismiss a summary judgment ok now here's a summary judgment a different emotion dismissed i'm with you one hundred percent i think that's a way to distinguish some of these cases also but we're still the motions so getting back to treatment question you agree with the motion to dismiss states correct we are here on all right so that's the question again so don't we evaluate standing as of the time that the case was initiated ok pushing you and i mean if you have authority otherwise i'd love to know i it's far as i can tell the answer is yes but if you have authority otherwise i'd love to hear it the law doesn't say otherwise or in my view i don't i understand your i then let's look at the allegation at the explain why you're honorable and why in this case even though it may be yes you still prevail bank your honor i apologize for making that harder than pulling teeth yes the allegation know what happened to me in these cases a company announces a breach and everyone scurries off to court before any really because there's such a push and pull in shocking among the various planets as to who is going to be in charge of the multi district litigation committee at the allegation here like what was the data that was at issue name shipping address portion of credit card number passwords scrambled not in a way that could be used and when you couple that as your description of the facts where is that in the operative complaint well they they rely on you know what zappos inform the public as to what happened and discovery never contradicted that and they never pleaded anything that contradicted that in terms of the limited scope of the dayton and if you look at these if you look at looking you point to the place in their complaint where they describe the data involved the way you just did well no i do see that they quote the notice that i sent in a way that is similar to what you just said yes that was and that was when i was looking for europe but that i thought that they did then also talk about a whole credit card numbers in the same complaint that if their case stands or falls on whether full credit card information was stolen this case is not going to have a short life expectancy in the district court you know and  you had an event that potentially affected twenty four million people and after three years of discovery huge publicity of this case they found two people who claimed well i had only the last four digits it reasonably you people all know that by now right yeah it was it was you know it was just the tail your honor but they allege otherwise in their third amended complaint correct they they have changed their story in the third amended complaint correct your honor so to standing at any rate deter is it determined on whether there were four numbers or the entire number well i would have difference for standing as opposed to summ judgment or even a twelve six claim i submit not your honor and i call the court's attention the second circuit's ruling in the weyland case which found that and that was out of the michaels incident your honor your honor your honor found in favor the defendant on the merits apparel a parallel case went all the way through to the second circuit and the second circuit ruled on standing finding that even though full numbers were stolen and even though there was actual fraud on those numbers because the plaintiffs fraud losses had before had been fully reimbursed there was no standing w not just a difference then in theory between the second circuit and the seventh circuit and actually in the ninth circuit in this prior ruling it may be your honor and i'm not suggesting that this court needs to go all the way to the second circuit approach you know we have argued that clapper is a significant change in the law and you think crocker is clearly irreconcilable with clapper i think you're i think if we were talking to him and being court i would say that that clapper over rules crouton or i don't think we need to get there because i think this court properly the gist of it properly applied or the district court looked across at him or looked at the nature of the data involved found there was no credible threat as to these plaintiffs looked at the history of litigation properly looked at the fact there was no loss looked at the repetitive zappa's response of the incident and may please the court again i just want to briefly address one thing that my learned colleague it argued which is that the plane is alleged they didn't read anything that's just a mischaracterization they did say that they didn't read the privacy policy which is attached by a small link at the bottom of the page and that did include some promise about data security but we also allege that on the actual payment page that every single plane customer has to go to that that page that plaintiff wadsworth had suffered identity theft on the credit the entire debit card that she used she used a debit card as apposed and that debit card was drained within a month or two after the within a month or two and so that combined with the fact that the super value doesn't call that identity theft they call it debit card fraud that's that's correct your honor but you want to say there's no such distinction there's no do i want to i think it's a distinction without a difference in this circumstance whether somebody has their identity stolen or their fraudulent credit card charges i think nobody would dispute that those are all injuries that would give rise to article three standing but i also don't think that our case turns on whether it was just the tail or the entire credit card in particular we've alleged plaza bully and certainly under the standard of that we should be applying a standard which is that you accept the material allegations are true and that's true and draw all reasonable inferences and plane is favored if it's only the last for what how do you get to any kind of risk to these people were going to that risk comes from the fact that their names emails and passwords were stolen and that's the reason why that is there anywhere that it's not a scrambled password the quote from the notice is a scrambled password right that well they call it a cryptographically scrambled password but we allege that they have it they didn't actually use proper encryption and that's a plausible allegation because there were so many people who actually suffered identity theft because of their passwords and that was shortly after the event it occurred and that's why i found some of the comments my learned colleague it made interesting because the notion that only cases where there's a raft of identity theft right out of the gate can be viable is surprising because we did allege that there were a number of people who suffered identity theft right away and because i explained earlier why it's reasonable that some issues can take a while i see that i'm out of time unless you all have any more questions i appreciate the court's attention thank you counsel very much thank you both for your argument this matter submitted and this panel