warrior honors my name is jason forge i'm here on behalf of the state of rhode island and the office of the rhode island treasurer to say thank you i have never been more grateful to appear before this court because i've never had a more frustrating case than this one this case been pending for over two years in we have had to spend the majority of that time trying to correct what has been a relentless effort to revise our allegations and that's that's happened all the way through appeal before this court at this point i've run out of metaphors so i just want to be blunt we have never alleged nor argued that a single software bug that was completely eradicated without anything more would be enough to sustain this case that's not the case we've alleged that's not the case we want you to reinstate instead of we've all ledged far more than that we alleged a single software bug that it took the defendants almost three years to discover but that discovery led to this discovery of a much larger bigger problem and i want to stick to the complaint itself as much as i can because i don't want to slide into any characterizations or rhetoric because the complaint is really all that matters here because we all know that these allegations are accepted  where we discuss the discovery of this long bug which led to the discovery of the filing that defendants had such for security controls and record keeping that they cannot determine the scope of the data breach identify all of the affected users detect other data security bugs or protect the private personal data of the s of millions of google plus users furthermore in the same paragraph this discovery led to the discovery of other systemic vulnerabilities that further compromised the data security of google plus users this is not an isolated reference to your honor's if we turn to eighteen google's legal and policy staff prepared a memo concerning this security breach in this occurred to be for talking about the isolated one including the many shortcomings in google's security system and record keeping which revealed previously unknown or unappreciated security vulnerabilities that made additional data exposures virtually inevitable and then parents that a clean we explain that the three year bug and these additional involve abilities are referred to as the privacy bug and the memo discussing them in the privacy bug  memo so we've staked out a very clear vision of this case that the allegations the vulnerabilities the problem the defendants are facing it is far beyond one isolated software bug we go out of the same page and paragraph forty one dollars to allege and so therefore this is true this was such a significant breach in google's faith and its security was so shaken the privacy bug it led to shy and that's google c e o and page that's larry page also defendant to approve a plan to shut down google's google plus social networking site and service again there is no ambiguity thing that we are talking about a much bigger problem further in paris sixty three dollars which is it page forty three the w s j article google's blog post and the letters described in the preceding paragraphs contain enough information for investors to piece together that the three year bond was revealed systemic security deficiencies in google's google plus service that rendered additional bugs and data exposures virtually inevitable google admitted in it so we have a much bigger problem than one isolated bug that is clearly alleged and that clearly must be accepted at the motion to dismiss stage seven subsection a these are the defendant's own words regarding how significant of a risk any compromise to their privacy protections could be i'm quoting here from the defendant's own statements privacy concerns relating to our technology could damage our reputation and deter current and potential users or customers from our products and services subsection c concerns about our practices with regard to the collection and use disclosure of or security of personal information or other privacy related matters even if  paragraph twenty nine when asked about google's top three competitive advantages google's director of security responded well i'd say it's security st and foremost so we have a very big problem and in defendant's own words a very significant problem to their business model we also ledger honors that the timing of all of this could not have been worse for google which means could not have made these issues or significant for trustworthiness of technology and those who control it were under unprecedented scrutiny we then go on to explain that the congressional hearings into facebook's leak of years are information to a  rd party were underway and threatened to turn google's data collection privacy practices into the same hearing so we have a big problem defendants acknowledging that this is precisely the type of problem that is extremely significant for the business model and this is all occurring at the most important time in our history for this type of rob despite being fully briefed on the privacy bug so that's that's this big overarching problem is shah it approved a plan to hide the privacy bug from all users and everyone else outside of the companies one of the reasons which i approved this concealment plan was because he wanted to avoid any additional regulatory scrutiny including having to testify before congress we also have specific allegations regarding the direct knowledge of the other individual defendants other than the defendant page and then perhaps most importantly your honour's we allege that all of this is part of an overarching scheme to defraud a scheme that has a specific basis for liability and i'll give you just a couple examples of that there are several throughout but again returning to that st page of the complaint this is a sort of record twenty two dollars we're explaining this overarching problem we say at the end of the paragraph to the wall street journal lead the exposure of descendants sixteen triggering government governmental investigations congressional hearings and so on raised by defendants in a motion to dismiss there's no dispute about that in fact when we pointed that out in our opening brief as runners know the defendants responded by denying that there was even it a scheme alleged below in our reply brief we went into great detail explaining how the scheme with kicked off the entire complaint in the very st us developed nation and liability in the specific claim so to answer your question as i could they just record did not rule out that we pointed out specifically in our opposition brief that they had a very limited motion to dismiss it did not extend the scheme liability into venice have conceded in their withdrawing of that argument that there was in fact a scheme alleged below  and i appreciate you asking that question because that's the easiest way to resolve this appeal there's no question they did not attack they did not challenge two of the three misstatements the subsection be a liability goes way beyond the single isolated bug because it wasn't just one body it was one body that led to the discovery of a problem so great that they had to shut down a social networking platform that was bigger than twitter snap chat i have only in the last but i would love to answer any more questions john is before i reserve article again this is about disclosures and the fundamental point of a complaint is that alphabet should have disclosed the bug or something else and that's something else as a moving target here because well let me get into that what was the bug the bug was contrary to pious claim about how it's a massive problem it made certain information that was exposed the data of an issue was not social security numbers credit card numbers credit rating or information or any of that kind of sensitive information rather than data it was user profile information much of which is already public like occupation or a full name and nd there is no allegation that any of that data was actually accessed and misused there's no allegation that any user was harmed and as mr forge admits the bug was discovered by google and promptly before any of the disclosures that issue and so the question becomes fundamentally does google have an obligation to do a play by play of a remediated issue that did not cause wrong and if you look at the disclosure that google had in its s e c filings and you can see that acts of record twenty one dollars it's talks about any system failure compromised our security that results in the release of million credit ratings revealed to hackers who broke into the system or the heartland case which i've dealt with over one hundred million credit card numbers we're not talking about that kind of data we're often talking about sensitive data at a user and even if unfounded would mean that in spirit we would have to disclose all sorts of speculation and conspiracy theories which might be floating around that are unfounded but if people believe them then we'd have gaijin and sort of refuting each one sort of the game of whack a mole that's that's not what the securities laws require and in this instance there is again no doubt that this vulnerability was discovered and promptly remade and in addition and contrary to plato's theory about a company that doesn't care about its user user information this was discovered through the company's proactive effort created early in twenty eight feet bringing people from throughout the organization to do a detailed review of the companies they do practices and response was a couple holder on st the basis of the allegations about the class period are based on the wall street journal article oct eight and the company's blog a wall street journal article does not talk about any other blogs let alone some huge systemic problem what it does talk about is the company's concerted effort to review and address any issues that it might fin of their claim that during the last hearing there were other problems is that wall street journal article and the blogs there for example no other references there no witness says or others who have used them so during that las all this the company shut down the google plus product altogether that's not correct the company announced that it would wind down the consumer version of the product and noted that over ninety percent of user  engagement was less than five seconds the product did not have a significant user following among consumers however this same product this google poss product was available also to enterprises well and i think that what this shows is not just the absence of a false statement but also the independent basins which the court below noted of an here you have a company that puts together a very large working group a task force to examine its privacy polic so i think that those things need to be noted and also the notion that a company that's trying to improve its products and engages in that effort is somehow admitting that there's a systemic problem is wrong because otherwise any company that tries to do better the tries to improve is somehow had softened and harms way for a security issue because it didn't say that somehow it wasn't perfect but who never claimed it was perfect in sense that there were risks and that it would have to deal with the risk and if there was a real harm it could be harm in this instance before any of the challenge statements were made that had been discovered in the media and since i don't have a couple of minutes left i want to also highlight one absence of that is significant from the complaint and while the district court below to below noted that it wasn't just as if you don't have and have an instance here well but but if you look at the wall street journal or which talks about the memo it also talks about many other things including the decision about the bug and the decision concerning the if and the process that led to the  grandmother they're not alleging any misrepresentations is purely an admissions case and in order to establish an admissions case under this court's decision and prodi case they have to show a state of affairs that is materially of variance with the  facts and that is no or no there no one here composed of that and so again the fact that there are allegations that the cause any exams and thought about these issues and had a task force and an office a privacy and  to hide the privacy bugs from all users and everyone else outside of the companies one of the reasons give proved this concealment plan was because she wanted to avoid any additional regulatory scrutiny including having to of the district courts order your honour's you will see in footnote one there is absolutely no mention of the scheme liability allegation it simply was not raised by the defendants and therefore not addressed by the just records in the harm here that we're talking about  judge include a you hit the nail on the head it's not just social security numbers or credit card numbers the defendants themselves said it concern over data privacy is just as threatening to our business model as actual breaches it we know that that is true because that supplemental eggs are the record thirty three defense themselves admitted the reason why there was  low user engagement with this google plus platform for consumers was because of users were not engaging with our a p i is because of concerns around data privacy so it's not just one of these ladybug they wouldn't shut down one of the world's largest social media networks because of the example even mediated bug one month