FOR PUBLICATION



### UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT

I N R E A L P HAB E T , I N C

. S E CU R I T I E S L I T I G AT I ON ,

S TA T E O F RH O D E I S LA ND , Office of the Rhode Island Treasurer on behalf of the Em ployees’ Retirem ent System of Rhode Island; Lead Plaintiff, Individually and On Behalf of All Others Sim ilarly Situated,

Plaintiff-Appellant
,

v

.

A L P H AB E T , I N C .; L AW

R E N C E E. P A GE ; S U

NDAR P I C H

AI ; R UT H M. P O R A T ; G O O GL E L LC; KE I T H P. ENR I GH T ; J O H

N KE N T WAL K

E R , J R ., Defendants-Appellees. No. 20-15638

D.C. No. 4:18-cv-06245- JSW

OPINION

Appeal from

the United States District Court for the Northern District of California Jeffrey S. Wh ite, District Judge, Presiding

Argued and Subm itted February 4, 2021 San Francisco, California

Filed June 16, 2021I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 2

Before: Sidney R. Thom as, Chief Judge, and Sandra S. Ikuta and Jacqueline H. Nguyen, Circuit Judges.

Opinion by Judge Ikuta

SUMMARY *

Securities Fraud

The panel affirm ed in part and reversed in part the district court’s dism issal of a securities frau d a ction for failure to state a claim
, vacated the d istrict co urt ’ s judgm ent, and

rem anded for further proceedings.

The S tate of R

hode Island filed a private securities fraud action under §§ 10(b) and 20(a) of the Securities Ex ch ange Act of 1 934 and SEC Rule 10b-5 against G oogle LLC, its holding com

pany Alphabet, Inc., and individual d efendants. The consolidated am ended com p laint alleged that defendants

om itted to disclose security problem s with the Google+ social network. The com

plaint referred to the cybersecurity p ro b lem s as the “Three-Year Bug” and the “Privacy B ug .” The district court gr anted d efendants’ m otion to dism iss on the grounds that Rhode Island failed to adequately allege a

m aterially m isleading m isrepresentation or om ission and that Rhode Island failed to adequately allege scienter.

The panel held that the com plaint adequately alleged that two statem ents m ade by Alphabet in its quarterly reports filed

* This summ ary constitutes no part of the opinion of the court. It h as been prepared by court staff for the convenience of the reader.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 3

with the S EC on Form 10-Q om itted m aterial facts necessary to m ake the statem ents not m isleading. Applying an ob j ective m ateriality standard to the 1 0-Qs, the panel held that Rhode I s l an d’s com plaint plausibly alleged the

m ateriality of the costs and consequences associated with the Privacy Bug, and its public d isclosure, and h o w Alphabet’s decision to o m it inform ation about the Privacy Bug in its 10- Qs significantly altered the total m ix of inform ation available for decisionm aking by a reasonable investor.

The panel n ext addressed whether the com plaint adequ a tely alleged scienter for the m aterially m isleading

om issions from the 10-Q statem ents. T h e panel held that the

com plaint was r e qu ir ed to plausibly allege, with the particularity required by the Private Securities Li tigation Reform A ct, that the m aker of the statem ents knew about the security vulnerabilities and intentionally or recklessly did not disclose them

. Th e panel concluded that the com plaint’s specific allegations, taken as a whole, raised a strong inference that defe n d an t Lawrence Page, and therefore Alphabet, knew about the Three-Year Bug, the P rivacy Bug, and a P rivacy Bug Mem o, and that Alphabet intentionally did not disclose this inform ation in its 10-Q statem ents.

Th e panel further held that Rhode Island adequat e l y alleged falsity, m ateriality, and scienter fo r the 10-Q statem ents. The panel therefore reversed the district court’s holdings to the contrary. T he panel also reversed the district court’s dism issal o f th e com plaint’s § 20(a) control-person claim s based on the 10-Q statements.

As to te n additional statem ents identified in the

com plaint, the panel concluded that the com pla i n t d id not plausibly allege that these rem aining statem ents wereI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 4

m isleading m aterial m isrepresentations. The panel therefore affirm ed the district court’s dism issal of claim s b ased on these statem ents.

Rhode Island argued o n appeal that the district court erred in dism issing its “schem e liability claim ” under R u le 1 0 b -5 ( a) and (c) when it dism issed the com plaint in its entirety without addressing thos e claim s. The panel held that because Alphabet’s m otion to d ism iss did not target Rhode Island’s Rule 10b-5(a) and (c) c l a i ms , R hode Island did not waive those claim s by failing to address them in o p position t o the

m otion to dism iss. Reversing, the panel held that the district court erred in sua sponte dism issing the Rule 10b-5(a) and (c) claim s when Alphabet had not targeted them in its m otion to dism iss.

C OUNSEL

Jason A. Forge (argued), Michael Al b e rt , J. Marco Janoski Gray, and Ti n g H. L iu, Robbins Geller Rudm an & Dowd LLP, San Diego, California, for Plaintiff-Appellant.

Ignacio E. Sa l c eda (argued), Benjam in M. Crosson, Cheryl W

. Foung, Stephen B. Strain, and E m ily Peterson, Wi l s o n Sonsini G oodrich & Rosati, Palo Alto, California; G ideon A

. Schor, W ilson Sonsini Goodrich & Rosati, New Y o rk, New York; for Defendants-Appellees.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 5

OPINION

IKUTA, Circuit Judge:

In March 2018, am id th e furor caused by news that Cam b ridg e Analytica im

properly h arvested user data from Facebook’s social network, Google d iscovered that a security glitch in its Google+ social network had left the private data of som e hundreds of thousands of users (according to Google’s estim ate) expo s e d to third-party developers for three years and that G oogle+ was pl agued by m ultiple other security vulnerabilities. W arned by its legal and policy staff that d i s c losure of these issues would result in imm ediate regulatory and governm ental scrutiny, G oogle and its holding

c om pany, Alphabet, chose to conceal this discovery, ma d e generic statem ents about how cybersecurity risks could affect their business, and sta ted that there had been no m aterial changes to Alphabet’s risk fac t ors since 2017. This appeal raises the question whether, f or purpos e s o f a private securities fraud action, the com plaint adequately alleged that Google, A lph ab et, an d in d iv id u al defendants m ade m aterially

m isleading statem ents by om itting to disclose these security problem s and that the defendants did so w ith sufficient scienter, m eaning with an intent to deceive, m anipulate, o r defraud.

I

A

At the m otion to dism iss stage, w e start with the facts plausibly alleged in the com plaint, docum ents incorp orated into the com

plaint by reference, and m atters of which a court

m ay take judicial notice. See Ashcroft v. Iqbal
, 556 U.S. 662,I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 6

678–79 (2009); Tellabs, Inc. v. Makor Issues & Rts., L td.
, 551 U.S. 3 08, 322 (2007). The story begins i n the 1990s when Lawrence Page and Sergey Brin, then s tu d en t s at Stanford University, developed Google, a web-based s e ar ch engine. Over the next two decades, Google rapidly expanded b eyond its search engine services into a range of other internet-related servi c es and products, including advertising technology, cloud com

puting, and hardware.

Since its initial publi c offering prospectus in 2004 and throughout Google’s continued ris e , Google and its

ex ecutives publicly reco g n ized th e im p o rtan ce o f u ser p riv acy and user trust to G oogl e’ s b usiness. Google executives expressed their understanding that Google’s “success is largely dependent on m ainta i n i ng consum ers’ trust” so that “users will continue to entrust Google with their private data, which G oogle c an then m o netize.” As one m edia outlet put it, “Google has a str o n g i n c e ntive to position itself as a trustworthy gu ardia n o f personal inform ation because, like Facebook, its financial success hinges on its success to learn about the interests, habits and location[s] of its users in order to s e l l targeted ads.” Google and its executives repeatedly

em phasized that m aintaining users’ trust is essential and that

a significant security failure “would be devastating.” Google’s public em

phasis on user trust and user privacy

rem ained central to its busin e s s wh en, in 2 0 11, G oogle launched Google+ “in an attem pt to m ake a so c i a l m edia network to rival that of Facebook and Twitter, and to join all

users of Google se rv ices ( i.e. , Search, Gm ail, YouTube, Maps) into a single online identity.”

In October 2015, Google restructured itself f rom Google, Inc. into Google LLC and created A lphabet, Inc. as its parent

com pany, whic h i s “essentially a holding com pany” whoseI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 7

“ lifeblood is G oogle.” Page, who had been the CEO of Google, became the CEO o f A lphabet. Sundar Pichai, a longtim e Google senior executive, replaced Page as the C EO of Google. Page and Pichai both sat o n Alphabet’s Board o f Directors and served on the board’s three-perso n Executive Comm ittee. P ichai directly reported to Page and m aintained regular contact with him ; P ichai w as a lso d irectly accountable to Page. Pichai also p artic i pated in Alphabet’s public earnings calls. Page received weekly reports of Google’s operating results and c ontinued to m ake “key operating decisions” at Google.

Google’s corporate restructuring did n ot change the central im

portance o f privacy and s e cur ity. Google and Alphabet consistently indicated that Go ogle’s forem ost

c o mp etitive advantage against other com panies was its sophistication in secur i ty. Thus, according to Alphabet’s Chief Financial Officer in February 2018, security is “clearly what we’ve built Google on.”

While highlighting expertise in security and data privacy, Google and Alphabet also acknowledged the substantial im pact that a cybersecurity failure would have on their business. According to Alphabet’s 2017 Annual Repo rt on Form 10-K filed with the Securities and Exchange Comm ission (SEC), “[c]oncerns ab o ut our practices with regard to the collection, use, d is closure, or security o f personal inform ation or other privacy related m atters, even if unfounded, could d am age our reputation and adversely affect

our o perating results.” Alp h ab et warned that “[i]f our security m easures are breached resulting in the im proper use and disclosure of user data” then A lphabet’s “produ c t s and services m ay be perceived as not being secure, us ers and custom ers m ay curtail or stop u sing our products andI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 8

services, and we m ay incur significant legal and financ ial exposure.” As Pichai explained in January 2018, “users use Google because they trust u s and it is som ething easy to lose if y o u ar e not good stewards of it. S o w e work hard to earn the trust every day.”

B

“By the spring of 2018, the trustworthiness of technology and those who control it were under unprecedented scrutiny.” According to the com

plaint, a trigger for this scrutiny was the publication of reports that a research firm
, Cam br i d ge Analytica, “im

properly harvested data from Facebook users’ profiles” to be used for political advertising. The imm ediate effects of this reporting were “devastating to Facebook and its i nv estors,” including a 13% decline in Facebook’s sto c k price, which am ounted to a loss of approxim ately $75 billion of m arket capitalization.

This scandal quickly led to congressional hearings into Facebook’s leak of use r in form ation to a third-party data collector. Facebook was not the only target of scrutiny, as the Senate Judiciary Comm ittee, chaired by Senato r Grassley, requested that Google and Twitter testify at these he ar i n g s about their data privacy and security practices. In a letter to Pi c ha i
, Se n a t o r Gr as s l e y o ut l in e d th e c o mmi tt ee’s “significant concerns regarding the d ata security practices o f large social m edia platform s and their interactions with third party developers and other comm ercial[] users of such data.” According to Senator Grassley, P ich ai d eclined to testify after “asse rting that the problem s surrounding Facebook and Cam b ridge Analytica did not involve Google.”I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 9

At around the sam e tim e, in May 2 0 1 8
, the E uropean Union im plem ented the General Data Protection Regulation (GDPR), a new fram ework for regulating data privacy protections in all m em

ber states. Am ong other th i ng s , the GDPR required p rom

pt disclosure of personal data breaches, not later than 72 hours after learning of the breach. On its website, G oogle reaffirm ed its co mmi tm ent to com plying with the GDPR across all its services an d r eaffirm ed Google’s aim“always to keep data private and safe.”

C

While external scrutiny of data privacy and security grew in March and April 2018, inte rn al Google investigators h ad discovered a software glitc h i n the Google+ social network tha t ha d existed since 2015 (referred to in the com plaint as the “Three-Year Bug”). Be cause o f a bug in an application programm ing inte rface for Google+, third-party d evelopers could collect certain users’ profile data even i f th ose users had relied on Google’s privacy settings to designate such data

as nonpublic. The exposed privat e profile data included

em ail addresses, birth dates, gender, p rofile photos, places lived, occupations, and relationship status.

Not only did Google’s security p rotocols fail to detect the problem for three years, but Google also had a lim ited set o f activity logs that could review only the two m ost recent

wee k s of user d ata access. D ue to this record-keeping lim itation, Googl e “ h a d no way of determ ining how m any third-parties had m isused its users’ personal private data.” And G oogle “could o nly estim ate that it exposed to thirdparties the personal private data of hundreds of thousands o f users” based on “less than 2% of the Thre e-Year Bug’s lifespan.” Despite th e efforts of “over 100 of Google’s bestI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 10

and b rightest,” Google “could not confirm the dam age from [the bug] or d eterm ine the num ber o f othe r bugs.” At the

sam e tim e, this investigation i nt o the Three-Year Bug detected other shortcom ings in Google’s secur i ty system s, including “previously unknown, or unappreciated
, security vulnerabilities that m ade additional data exposures virtually inevitable.” The com

plaint refers collectively to the ThreeYear Bug and these additional vulnerabilities as the “Privacy Bug.”

Around April 2018, G oogle’s legal an d policy staff prepared a m em o detailing the Three-Year Bug and the additional vulnerabilities (referred to in the com p laint as the “Privacy Bug Mem o ”). According to the com plaint, the Privacy Bug Mem o warned that the disclosure of these security issues “would likely trigger ‘imme d i a te regulatory interest’ and r esult in defendants ‘com ing into the spotlight alongside or even instead of Facebook despite having stayed under the radar through o ut the Cam bridge Analytica scandal.’” The m em o warned that “disclosur e ‘alm ost guarantees Sundar [Pichai] will testify before Congress.’”

According to the com

plaint, Pichai and other se n i o r Google executives received and read the m em o in early April 2018. The com

plaint alleges that key officers and directors, including Page and Pichai, chose a strategy o f nondisclosure. Pichai approved a plan to conceal the existence of the ThreeYear Bug and other security vulnerabilities described in the Privacy Bug Mem o “to avoid any ad ditional regulatory scrutiny, including h aving to testify before Congress.” Further, despite Google+ having 395 m illion m onthly active
users, m ore than either Twitter or S napchat, Pichai and Page approved a plan to shut down the Google+ c on sum er platform

.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 11

D

Despite the in fo rm ation in the Privacy Bug Mem o, Alphabet and G oogle continued to give the pub lic the sam e

assurances about security an d privacy as before. In particular, on April 23, 2018, A lphabet fil ed its quarterly report on Form 10-Q f

or the period ending March 31, 2018. The 10-Q incorporated the risk disclosure s fr om Alphabet’s 2017 10-K and m ade no disclosure about the P rivacy B ug. It stated:

Our operations and financial results are subject to various risks and un c e rtainties, including those described in Part I, I t e m 1A, “Risk Factors” in our Annual Report on Form 10-K for the ye ar ended Decem ber 31, 2017, which could adversely affect our bu s iness, financial condition, results o f o perations, cash flows, and the trading price of o ur comm on and capital stock. There have b e e n no material changes to our risk factors since our Annual Report on Form 10

-K for the year ended December 31, 2017

. (em phasis added). Nor d id Alphab e t mak e any d isclosure during an earnings call on the sam e day. Months later, in July 2018, Alphabe t fi l ed its Form 10-Q for the period ending Jun e 3 0
, 2018. This filing included a risk d isclosure substantially identical to the one in the April 2018 fi l i n g ; it likewise incorporated the 2017 Form 10-K risk f actors and affirm ed that no m aterial changes occurred. N or didI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 12

Alphabet m ake any disclosure of the problem s during its July 2018 earnings call. 1

The com plaint identifies statem ents m ade by Alphab e t , G o o g le, and their em

ployees b etween April and O cto b er 2 0 1 8 that continued to reference user security and da t a privacy while m aking the s ame o m ission regarding any Google+ problem s. According to the com plaint, Alphabet thought that this “decision to b uy tim e” would reduce the detrim ental effects of eventual disclosure b y avoiding disclosure at a tim e when Facebook was facing regulatory scrutiny, public criticism
, and loss o f c o nsum er confidence as a result of the Cam b ridge Analytica scandal.

E

Six m o nths after this decision to b uy tim e, the Wall Street Journal exposed Google’s discovery of Google+’s security

v u l n e r ab i l i t i e s a n d i t s d e c i s i o n t o c o n c e a l th o s e vulnerabilities. In October 2018, the Wall Street Journal published a lengthy story on the events surrounding the Privacy Bug Mem o. S

ee Douglas MacMillan & Robert M c M i l l a n , G o o g l e E x p o s e d U

s e r D a t a , Fe a r e d Repercussions of

D isclosing to Public
, W all Street J. (Oct. 8, 2018). The story reported that “Google exposed th e p rivate data o f hundreds of thousands of u sers of the G oogle+ social netwo rk and then opted not to disclose the issue this past spring, in part because of fears tha t d oi n g so would draw regulatory scrutin y an d cause reputational dam age.” It

1 T h e com

p lain t a l l e g e s that Page signed the 10-Qs and signed certifications, under SEC rules p rom ulgated after the Sarbanes-Oxley Act, that vouched for t

he accuracy o f the 10-Qs and the adequacy of controls for identifying cybersecurity risks.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 13

walked the rea d e r thr ough the discovery of the privacy bug, explained how Google m ade “concerted efforts to avoid public scrutiny of h ow it handles use r i n form ation, particularly at a tim e when regulators and consum er privacy groups are leading a charge to hold tech giants a ccountable for the v a s t p o wer they wield over the p ersonal data o f billions of people,” and reported that Pichai had been briefed on the plan not to notify users.

The d ay the news b roke, Google p ub l i shed a blog post acknowledging the “significant challenges” regarding data security identified in the Wall Street Journal article. It finally adm itted to exposing the private d ata of hundr e ds o f thousand s of users and announced it was shutting down the Google+ social network for consum ers.

Condemn ation from lawm akers so o n f o llo w ed

. Two days after the Wall Street Journal article, D em ocratic senators

wr ote to dem and an investigation by the Federal T rade Comm ission. This letter noted that, due to the lim itations o f Google’s intern a l l o g s, “we m ay n ever know the full extent of the d am age caused by the failure to provide adequate controls and protection to users.” T h e letter like wi s e noted that the “awareness and approval by Google m anagem ent to not d isclose represents a culture of concealm ent and o pacity set from the top of the com pany.” Republ i can senators also wrote a letter to Pichai that questioned Google’s decision “to withh old inform ation about a relevant vulnerability for fear of public scrutiny” at the sam e tim e that Facebook was being questioned regarding the Cam bridge Analytica scandal. In a second letter to Pichai, Senator Grassley c o m plained that Google had assured him in April 2018 that it m ai ntained robust protection f

or user data, despite Pichai’s awarenes s that G oogle+ “had an alm ost identical f eature t o Facebook,I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 14

which allowed third party developers to access inform ation from users.”

Markets reacted to the news. Alphabet’s publicly traded

s h are price fell after the Wall Street Journal articl e. Accordin g to the com

plaint, A lphabet’s share price fell $11.91 on O ctober 8, $10.75 on October 9, and $53.01 on October 10. Financial news reports called Google’s decision not to disclose the security breach a “cover-up” and p redicted forthcom ing regulatory scrutiny.

Just weeks later, in Decem b er 2 018, G oogle disclosed the discovery of another Google+ bug that had exposed user data from 5 2. 5 m illion accounts. Google also announced it was accelerating the shutdown of the consum er Google+ platform to occur four m onths earlier than planned.

F

Three days after the Wall Street Journ a l article, R hode I s l an d filed a securities fraud action, as did other plaintiffs. 2 After the cases were c on solidated, Rhode Island was designated the lead plaintiff. It filed a consolidated am ended

com plaint in April 2019, which now serves as the o perative

com plaint. The com

plaint nam es Al p habet, Google, P age, Pichai, and two other Google senior executives as defendants (we refer to the defendants collect iv e l y as Alphabet, where

2 Rhode Island refers t o the State of Rhode Island, O ffice of the Rhode Island Treasurer o n behalf of t he Em p loy ees’ Retirem ent System of Rhode Island.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 15

appropriate, and otherwise b y nam e). 3 The com plaint alleges prim ary violations of Section 10(b) of the Securities Exchange Act of 1934, 15 U.S.C. § 7 8j(b), and S EC Rule 10b-5, 17 C

. F .R. § 240.10b-5, for securities fraud, as well as violations of Section 20(a) of the Exchange Act
, 15 U.S.C. § 78t(a), which im

poses joint and several liability on persons in co ntrol o f “any person liable under any provision” o f securities law.

Alphabet m oved to dis mi s s the com plaint for failure to state a claim. Th e d istrict court granted the m otion after determ ining that the com plaint failed to al l e ge any m aterial

m isrepresentation o r om ission and failed to allege scienter sufficiently. Further, the court held that because the Section 10(b) claim failed, the Section 20( a ) c laim for controlling-person liability “necessarily fails.”

Although the district court granted leave to am end, R hode Island notified the district court that it did n ot intend to

am end, and the district court entered judgm ent. Rhode Island now appeals from

that final judgm ent.

II

W e have jurisdiction under 28 U .S.C. § 1291. W e review the district court’s dism issal of Rhode Island’s com plaint for fai l ur e t o s t ate a claim de novo. In re NVIDIA Corp. Sec.

3 The other two individual defendants are K e i th P. Enright, who served as Google’s Legal Director of P rivacy from 2016 until Septem ber 2018 when he becam e Google’s Chief Pri vacy Officer, and John Kent W alker, Jr., who served as Google’s V ice President and General Counsel from 2016 through August 2018 before becom ing Senior Vice President for Global Affairs.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 16

Litig.
, 768 F.3d 1046, 1051 (9th C ir. 2014). “To surviv e a

m otion to dism iss, a com

plaint m ust contain sufficient factual

m atter, accepted as true, t o ‘state a claim to relief that is plausible on its face.’” Iqbal
, 556 U.S. at 678 (quoting Bell Atl. Corp. v. Twombly
, 550 U.S. 5 44, 570 (2007)). “Wh en there are well-pleaded factual allegations, a c o urt should

a ssum e their veracity and then determ ine whether th e y plausibly give rise to an entitlem ent to relief.” Id. at 679. A s the Suprem e Court has explained, “ [d]eterm ining whether a

com plaint states a plausible claim for relief” is “a context-sp ecific task that requires the reviewing court to draw

on its judicial experience and co mmo n sense.” Id. In the process, w e m ay “disregard ‘[t]hreadbare r ecitals of the elem ents of a cause of action, supported by m ere conclusory statem ents.’” Telesaurus VPC, L LC v. Power
, 623 F.3d 998, 1003 (9th Cir. 2010) (quoting Iqbal , 556 U.S. at 678).

A com plaint is p lau sible o n its face “when the plaintiff pleads f actual conten t th a t allows the court to draw the reasonable inference th a t the defendant is liable for the

m isconduct alleged.” Iqbal
, 556 U.S. at 678. The

m isconduct alleged here includes claim s under two statutory sections: prim ary liability under Section 10(b) of the Exchange Act and contr olling-person liability under Section 20(a) of the Exchange Act.

Section 1 0(b) of the Exchange Act prohibi t s u s ing o r

e mploying, “in connection w ith the purchase or sale o f any

s ec urity

. . . [,] any m anipulative o r deceptive device o r contrivance in contravention of such rules and regulations as the [SEC] m ay prescribe as n ecessary or appropriate in the public interest or for the p rotection of investors.” 15 U.S.C. § 78j(b). To im

plem ent Section 10(b), the SEC p r escribed Rule 10b-5, which m akes it unlawfulI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 17

(a) To em ploy any device, schem e, or artifice to defraud,

(b) To m ake any untrue statem ent of a

m aterial fact or to om it to state a m aterial fact necessary in order to m ake the statem ents

m ade, in the light of the circum stances under which they were m ade, not m isleading, or

(c) To engage in any act, practice, or course o f b u si ness which operates or would operate as

a f raud or de c e i t upon any person, in connection with the purchase or s a l e of any security.

17 C.F.R. § 240.10b-5.

The Suprem e Court ha s interpreted Section 10(b) and Rule 10b-5 as providing an i mplied p rivate cause of action. Stoneridge Inv. Partners, LLC v. Scientific-Atlanta
, 552 U.S. 148, 157 (2008). “In a typical § 10(b) private action” based

on m aterial m isrepresentations or om issions, a plaintiff m ust prove “(1) a mat erial m isrepresentation or om ission by the defendant; (2) scienter; (3) a connect i o n between the

m isrepresentation or o m ission and the purchase o r sale of a security; (4) reliance u

pon the m isrepresentation or om ission; (5) econom ic loss; and (6) loss causation.” Id.

Under Section 10(b) and Rule 10b-5(b), “the m aker of a statem ent is the person or entity with ultim ate authority over the statem e nt, including its content and whether and how to

comm un i c a t e it.” Janus Cap. Grp., Inc. v. First Derivative Tra d e r s , 564 U.S. 135, 142 (2011). Persons “who do not ‘m ake’ statem ents (as Janus defined ‘m ake’), but whoI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 18

dissem inate fa l se or m isleading statem ents to potential investors with the intent to d efraud, can be found to h ave violated the o ther parts of Rule 10b-5, subsections (a) and (c),

as well as related provisions of the securities laws” including Secti o n 1 0(b). Lorenzo v. SEC
, 139 S. Ct. 1094, 1099, 1100–03 (2019).

The first two elem ents of a typical Section 10(b) and Rule 1 0 b-5(b) claim are at issue here. The f irst elem ent is th a t a defendant om itted “to state a m aterial fact necessary in order to m ake the statem ents m ade

. . . not m isleading,” 17 C.F.R. § 240.10b-5(b). To m eet this requirem ent, the plaintiff m ust prove b oth that the om ission is m isleading and that it is

m aterial. Id.

W e apply the objective stan d ard of a “reasonable investor” to determ ine whether a statem ent is m isleading. See In re VeriFone S

e c

. L itig. , 11 F.3d 865, 869 (9th Cir. 1993). Section 10 ( b ) an d Rule 10b-5(b) “do not create an affirm ative duty to disclose any and all m aterial inform ation” and instead require disclosure “only when necessary ‘to m ake

. . . statem e n t s ma d e, in light of the circum stances under which they w ere m ade, not m isleading.’” Matrixx Initiatives, Inc. v. Siracusano
, 563 U .S. 27, 44 (2011) (quoting 17 C.F.R. § 240.10b-5(b)).

A m isleading om ission is m aterial if “there is ‘a substantial likelihood that [it] would have been v iewed by the reasonable investor as having significantly altered the “total

m ix” of inform ation m ade availab l e ’ for the purpose o f d e c i s i o n m a k i n g b y s t o c k h o l d e r s c o n c e r n i n g t h e i r investm ents.” Retail Wholesale & D ep’t Sto r e U nion Loc. 338 Ret. Fund v. Hewlett-Packard Co.
, 845 F.3d 1 268, 1274 (9th C ir. 2017) (quoting Basic Inc. v. Levinson
, 485 U.S. 224,I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 19

231–32 (1988) ). The inquiry into m ateriality is “factspecific,” Matrixx Initiatives
, 563 U.S. at 43 (quoting Basic
, 48 5 U. S. at 236), and “requires delicate assessm ents of the inferences a ‘reasonable shareholder’ would dr aw from a given s et o f facts and the significance of those inferences to him ,” Fecht v. Price C

o. , 70 F .3d 1078, 1080 (9th C ir. 1 995) (quoting T

SC Indus., Inc. v. Northway, Inc.
, 426 U.S. 438, 450 (1976)). “[T]hese assessm ents are peculiarly ones for the trier of fact.” Id. (quoting T SC Indus.
, 426 U.S. at 450). A s a result, resolving m ateriality as a m atter of law is generally appropriate “only if the adequacy of th e d isclosure or the

m ateriality of the statem ent is s o obvious that reasonable

m inds could n ot differ.” Id. at 1 081 (cleaned up); see Khoja

v. Orexigen T

herapeutics, Inc.
, 899 F.3d 988, 1014 (9th Cir. 2018) (sam e).

In evaluating whether an om ission rela ti ng to cybersecurity is m aterially m isleading, we m ay consider the SEC’ s interpretive guidance regarding the adequacy o f cy b ersecu rity -related di s c l o s u

r e s

. S e e C o m m issio n S tatement and Guidance on Public C o m p any C y b ersecu rity D isclo su

res, Securities Act Release No. 33-10459, Exchange Act Release No. 34-82746, 83 Fed. Reg. 8166-01, 8167 (Feb

. 2 6, 2 018) (“ Cybersecurity Disclosures ”). Regardless of the degree o f deference such interpretive guidance m ay m erit, see Kisor v. Wilkie
, 139 S. Ct. 2400, 2414–18 (2019), an SEC interpretive release can “shed further light” o n r e gulatory d isclosure requirem ents, NVIDIA
, 768 F .3d at 1055. Ag ency interpretations, like the SEC interpretive release he r e , c an provide “the judgm ents about the way the real world works” that “are p recisely the k ind that agencies are better equipped to m ake than are courts.” See Pension B enefit Guar. Corp. v. LTV C orp ., 496 U .S. 633, 6 51 (1990); see also Kisor
, 139 S. Ct. at 2413 (“[W ]hen new issues d em anding new policy callsI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 20

com e up within th at [ statu

to r y ] schem e, Congress presum ably wants the sam e agency, rather than any co urt, to take the laboring oar.”).

W e have held tha t “transparently aspirational” statem ents, H

ewlett-Packard
, 845 F.3d at 1278, as well as statem ents of “m ere corporate puffery, v agu e s tatem ents o f optim ism like ‘good,’ ‘well-regarded,’ or other feel g o o d

m onikers,” are generally no t a ctionable as a m atter o f law, because “professional investors, and m o st am ateur investors

as well, know how to devalue the o p tim ism of corporate executives,” Police Ret. Sys. of St. Louis v. Intuitive Surgical, Inc.
, 759 F.3d 1051, 1060 (9th Cir. 2014) ( quoting In re Cutera S e c. L itig. , 610 F.3d 1103, 1111 (9th Cir. 2010)). Such statem ents rise to the level of m aterially m isleading sta t em ents o nly if they provide “concrete d escription o f the past and p r esent” that affirm atively create a plausibly

m isleading im

pression of a “state o f affairs that differed in a

m aterial way from the one that ac tu a l l y existed.” See In re Quality Sys., Inc

. Sec. Litig. ( Quality Systems ), 8 65 F.3d 1130, 1144 (9th Cir. 2017) (cleaned up).

The s e c o n d elem ent o f a typical S ection 10(b) claim
, scienter, is not set forth in the sta tut e

. Rather, the Suprem e Court has determ ined that “[t]he wo r d s ‘m anipulative o r deceptive’ u sed in conjunction with ‘devi c e or contrivance’

s trongly suggest that § 10(b) was intended to proscri b e knowi ng o r intentional m isconduct.” Ernst & Ernst v. Hochfelder
, 425 U.S. 1 85, 197 (1976). We h av e since held
th at “a reckless om ission of m aterial facts” satisfies th e elem ent of scienter, Hollinger v. T itan Cap. Corp.
, 914 F.2d 1564, 1568–70 (9th Cir. 1990) (en banc) (quoting Sundstrand Cor p

. v. Sun Chem. Corp.
, 553 F .2d 1033, 1044 (7th Cir. 1977)), provided that such recklessness “reflects som e degreeI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 21

of i n t e n tional or conscious m isconduct,” In re Silicon Graphics Inc. Sec. Litig.
, 183 F.3d 970, 977 (9th Cir. 1999), abrogated in part on other grounds
, S. Ferr y LP, No

. 2 v. Killinger ( South Ferry ), 542 F.3d 7 76, 783– 84 (9th Cir. 2008). W e refer to this standard as “deliberate recklessness” and define it as “‘an extreme departure from the standards o f ordinary care,’ which ‘presents a danger of m isleading buyers

or sellers that is either known to the defendant or i s so obvious that the actor m

ust have been aware of it.’” Nguyen

v. Endologix, Inc.
, 962 F .3d 405, 414 (9th Cir. 2020) (quoting Schueneman v. Arena Pharm., I n c

. , 840 F.3d 698, 705 (9th Cir. 2016)).

In addition to these sub s t antive elem ents, a plaintiff bringing a securities fraud action must also m eet the heighte n e d pleading standards im p o sed by the P rivate Securities Li t igation Reform Act (PSLRA) for p leading,

am ong other things, “[m ]isleading statem ents and o m issions” and “[r]equired state of m ind.” 15 U.S.C. § 78u-4(b)(1)–(2). Under these standards, if the p laintiff alleges that the defendant “om itted to state a m aterial fact necessary in order to m ake the statem ents m ade, in the light o f the circum stances in which they were m ade, not m isleading,” then

the com p laint sh a l l specify each statem ent alleged to have been m isleading, the reason o r

reasons why the statem ent is m isleading, and, i f an allegation regarding the statem ent o r

om ission is m ade on inform ation and belief, the com plaint shall state with particularity all facts on which that belief is form ed.

15 U.S.C. § 78u-4(b)(1). Likewise, when a pla i n t i ff m ust prove “that the defendant acted with a particul ar state o fI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 22

m ind,” then “the com

plaint shall, with respect to each act or

om ission al l eged to violate this chapter, state with particularity facts giving rise to a stro ng i n fe rence that the defendant acted with the required state of m ind.” 15 U.S.C. § 78u-4(b)(2)(A); see also Fed. R. Civ. P. 9(b). For p leading scienter, we assess “all the allegations holistic ally” to determ ine whether the inference of scienter is “cogent and

com pelling.” Tellabs
, 5 51 U. S. at 324, 326. “[M]erely ‘reasonable’ o r ‘perm issible’” inferences are insufficient. Id.
at 324. As a result, courts m ust “take into account plausible

o p p o sin g inferences” and determ ine that “a reasonable p erso n would d ee m the inference of scienter cogent and at least as

com pelling as any opposing inference one c o u ld d raw from the facts alleged.” Id. at 323, 324.

Finally, in a d d i t ion to alleging violations under Section 10(b), Rhode Island also alleges violations of Sectio n 20(a) of the Exchange Act, 15 U.S.C. § 78t(a). Section 20(a) im poses liability on a person who is in control of the person who is directly responsible for a securities fraud violation:

Every person who, directly or indirectly, controls any person liable under any provision of this chapter or of any rule or regulation
th ereunder shall also be liable jointly an d severally with and to the sam e extent as such controlled person to any person to whom such

c on trolled person is liable

. . . , unless th e controlling person acted in good faith and did not d irectly or indirectly induce the act or acts constituting the violation or cause of action.

15 U.S.C. § 78t(a). S EC regulations define “control” to m ean “the possession, direct or indirect, o f the power to direct o rI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 23

cause the dir ec t i o n of the m anagem ent and policies o f a person, wh e th er through the ownership of voting securities, by contract, or otherwise.” 17 C.F.R. § 230.405. To establish

a cause of action under Se c t ion 20(a), “a plaintiff m ust first prove a prim ary v iolation of underlying federal securities laws, such as Section 10(b) or Rule 10b-5, and then show that
th e defendant exercised actual power over the primary violator.” NVIDIA
, 768 F.3d at 1 052. W e have held that the inquiry into actual power or control “is norm ally an ‘intensely factual question.’” Zucco Partners, LLC v. Digimarc Corp.
, 552 F.3d 981, 9 90 (9th C ir. 2009) (quoting Paracor Fin., Inc.

v

. Gen. Elec. Cap. Corp.
, 96 F.3d 1151, 1161 (9th Ci r. 1996)). Nevertheless, “if a p laintiff fails to adequately plead

a prim ary violation,” then Sectio n 20(a) claim s “m ay be dism issed summ arily.” Id.

III

The district court g ranted A lp h ab et’s m o tio n to dism iss on the grounds that Rhode Island failed to adequately allege a

m aterially m isleading m isrepresentation or om ission and that Rhode Island failed to adequa te ly allege scienter. W e th erefore focus on these two bases for the district court’s decision.

A

The com p laint identifies a d o zen allegedly m isleading statem ents, but we begin by considering two statem ents m ade b y Alphabet in its quarterly reports filed with the SEC o n Form 10-Q in April 2 018 and July 2018. W e conclude that the com plaint adequately alleges that these two sta te m ents

o m itted m aterial facts necessary to m ake the statem ents no t

m isleading.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 24

The April 2018 report for the period ending Marc h 31, 2018, stated that Alphabet’s “operations and financial results

are subject to v ario u s risks and uncertainties,” including those identified in Alphabet’s Annual Report on Form 1 0-K for the year ended D ecem

ber 31, 2017, and asserted that “ [t ]h e re have been no m aterial changes to o ur risk fa ct o rs since our Annual Report on Form 10-K for th e ye ar ended D ecem ber 31, 2017.” 4 T he 2017 10-K had warned, am ong other things, that even unfound e d concerns about Alphabet’s “practices with regard to the collection, use, dis c losure, or security o f personal inform ation or other privacy related m atters” could dam age the com

pany’s “reputation and adversely affect [its] operat in g r esults.” Alphabet’s April and July 2018 10-Qs

m ake n o m ention of the Three-Year B ug or other security vulnerabilities identified in the Privacy Bug Mem o.

Given that the April 1 0-Q filing was m ade aft e r the detection of Google’s cybersecurity issues, after internal deliberation based on the Privacy Bug Mem o, and during the growing scrutiny f

o llo w in g th e C am

b ridg e An alytica scan dal, the com plaint plausibly alleges th a t the om ission of any

m ention of the Three- Ye ar Bug or the other security vulnerabilities m ade the statem ents in each Form 10-Q

m aterially m isleading t o a reasonable investor and significantly altered the total m ix o f inform ation available to investors.

The com plaint plausibly alleges that A lphabet’s om ission

was m aterial. Am ong othe r a l legations in the com plaint, Alphabet’s risk disclosures in the 2017 10-K warned of th e harm s that could follow from the detection and disclosure o f

4 Alphabet’s July 2018 Form 10-Q, for t he quarter ending June 30, 2018, is substantively identical.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 25

security vulnerabilities, including pub l ic concerns about privacy and regulatory scrutiny. Public statem ents by G oogle and Alphabet executives sim ilarly dem onstra ted the im portance of user trust and public perceptions of security and privacy p ractices for the products and services central to Alphabet ’ s b usiness. The scale of the data-privacy and security-vulnerability problem s identified in the Privacy Bug Mem o further supports the allegations that these prob lem s

were m aterial. Indeed, the P rivacy Bug Mem o itself w arned of the significant consequences of th e p r o blem s d iscovered and of their disclosure. T h e m arket reaction, increased regulatory and governm ental scrutin y, both in the United States and abroad, and m edia coverage alleged by the

com plaint to h ave occurred after disclosure all support the

m ateriality of the m isleading om ission.

Finally, the SEC’s guidance on when com panies should disclose “cybersecurity incidents” also supports the conclusion that A lphabet’s om ission was m aterial. See Cybersecurity Disclosures
, 8 3 Fed. R eg. at 8169. 5 In determ ining d i s c losure obligations and “[t]he m ateriality o f cybersecurity risks and incidents,” the SEC advises that

com panies should weigh, am ong other thing s, “harm to a

com pany’s reputation, financ i al perform ance, and custom er and vendor relationships, as well as the possibility o f litigatio n or regulatory investigations or actions, including regulatory actions by state and federal g overnm ental authorities and non-U.S. authorities.” Id. at 8168–69. H ere,

5 The SEC defines a “cybersecurity incident” as an “occurrence that actually or potentially results in adverse consequences to an inform ation

s y stem or the inform ation that the system processes, stores, or transm its and that m ay require a response action to m itigate the consequences.” Cybersecurity Disclosures , 83 Fed. Reg. at 8166 n.3 (cleaned up).I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 26

the com plaint p lausibly a ll eges that these risks of harm ripened into actual harm when the Privacy Bug was detected and created the new risk that this discovery would becom e public.

The com p laint also p lausibly alleges that Alphabet’s

om iss ion w as m isleading. Risk disclosures that “speak[] entirely of as-yet-unrealized risks and contingencies” and do not “alert[] th e r e a der that som e of these risks m ay already have com e to fruition” can m islead reasonable investors. See Berson v. Applied Signal Tech., Inc

. , 5 2 7 F.3d 982, 985–87 (9th Cir. 200 8)

. I n Berson
, we held that the com pany’s

s tatem ent of anticipated revenues from its large backlog o f work was m isleading b ecause it f ailed to disclo se that a significant portion o f the “backlogge d” work was “substantially delayed and at serious risk of being cancelled altogether.” Id. at 986. Sim ilarly, w e explained that a 10-Q statem ent that warned of “the risks of product liability claim s in the abstract” was m isleading because it fai l e d t o disclose that the risk had al r eady com e to fruition. Siracusano v. Matrixx Initiatives, Inc.
, 585 F.3d 1167, 1181 (9th Cir. 2 009) (ci t i n g Be rson , 527 F.3d at 986), aff’d
, 5 63 U.S. 2 7 (2011). Even m ore recently, we held that a com pany’s warning in its Form 10-Q that share pr i c e s “m ight” be affected by

announcem ents of study results that “m ay” b e inconsistent with interim study results was m isleading because the

c o mp any “allegedly knew already that the ‘new dat a ’ revealed exactly th a t

. ” Khoja
, 899 F.3d at 1 015–16; cf. Wochos v. Tesla, Inc.
, 985 F.3d 1180, 1195–96 (9th Cir. 2021) (rejecting the argum ent th a t a risk disclosure’s f o r w a r d

- l o o k i n g s t a t e m e n t s “ c o n s t i t u t e d m i s l e a d i n g

om issions about current or p ast challenges” becau s e the disclosure also acknowledged that the com pany had already experienced “the sort of ‘challenges’ that it would have toI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 27

overcom e in ord e r t o achieve its stated objective”). 6 A s in these cases, the com

pla i n t p lausibly alleges that Alphabet’s warning in each Form 10-Q of risks th at “could” or “m ay”

occur is m isleading to a reasonable investor when Al phabet knew that those risks had m aterialized.

Alphabet m akes several argum ents a gainst this conclusion. F irst, Alphabet argues that any om ission from the Form 1 0

- Qs was not m isleading because Google h ad already rem ediated the software glitch in Google+ before it

m ade the 10-Q statem ents. Because th e r isks caused by the software glitch had been rem ediated, Alphabet argues, R hode Island cannot rely on the cases h olding th a t a com pany’s warning of fu ture risks is m isleading if those risks have already m aterialized. This argum ent fails for several reasons. Given that Go o g l e ’s business m odel is based on trust, the

m aterial im

plications of a bug that i mproperly exposed user data for three years were not elim inated m erely by plugging the hole in Google+’s security. The existence of the software glitch for a three-y e ar period, which exposed the private inform ation o f hundreds of thousands of Google+ users, and the fact that Go ogle was unable to determ ine the scope and i m pact of the glitch, indicated that there were significant problem s with Google’s security controls. Google had long recognized that in an industry based on security and privacy, the public d isclosure o f s e rious failings in this area would have w ide-ran ging effects, including erosion of consum er confidence and increased regu l atory scrutiny. Further, the

6 In light of o ur precedent
, we decline to follow the Sixth Circuit’s unpubli s h e d d ecision in Bondali v. Yum! Brands, Inc.
, which held that a statem ent disclosi ng future h arm s g enerally would not m i slead a reasonable investor about the current state of a corporation’s operations. 620 F. App’x 483, 490–91 (6th Cir. 2015).I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 28

Privacy B u g Mem o was not lim ited t o discussing the discovery of the software glitch that had b e e n rem ediated because it highlighted additional security vulnerabilities that

were so significant that they allegedly led t o Go ogle’s decision to shut down the Google+ consum er platform

. Second, Alphabet contends that the 10-Q om issions were not m aterial because the software bug did not lead to the release of sensitive inform ation like fi n an c ial o r m edical inform ation or cause h arm to any user and be c ause Alphabet’s revenue increased from $ 12 billion to $30 billion between 2 017 and 2018. T h ese argum ents fail because a cybersecurity incident m ay be material even if it does not

com prom ise sensitive financial or m edical inform ation o r have an imm ediate financial im p act on the c o m

p any. The standard is whether there is a “substantial likelihood” that the inform ation at issue “would have been viewed b y the reasonable investor as having significantly altered the tota l

m ix of inform ation m ad e available for the purpose o f d e c i s i o n m a k i n g b y s t o c k h o l d e r s c o n c e r n i n g t h e i r investm ents.” Hewlett

- Packard
, 845 F.3d at 1274 (cleaned up). Because cybersecurity incidents m ay cause a range o f substantial c osts and harm s, 7 reasonable investors would likely find om issions regard i ng significant cybersecurity incidents m aterial to their d ecisionm aking. T h e likelihood is particula rly substantial here, given the nature of Alphabet’s b us i n ess. As the SEC has explained, the m ateriality of

7 See Cybersecurity Disclosures
, 83 Fed. Re g

. a t 81 67–69 & n.32 (noting that a cybersecurity i n ci d ent can cause a com pany to incur

rem ediation costs, increased cybersecurity protection costs, lost revenues, harm to custom er retention or attraction, litigation and legal risks, increased i nsurance prem i um s, reputational dam age, and dam age to stock price and shareholder value).I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 29

com prom ised inform ation m ay “depend on the nature of the

com pany’s b us i n e ss” and “the scope o f the com prom ised inform ation.” Id. at 8169 n.33. Here, for instance, the

com plaint alleges that the Wall Street Journal article resulted in a swift stock price decline, legislative scrutiny, and public reaction, all of which support the allegation that the Privacy Bug was m aterial even absent a release of sensitive inform ation or revenue decline.

Applying our objective m ateriality standard to the 10-Qs h er e, Rhode Island’s com plaint plausibly alleges the

m ateriality of the costs and consequences associated with the Privacy Bug, and its public d is c losure, and how Alphabet’s decision to o m it inform ation about the Privacy Bug in its 10- Qs significantly altered the total m ix of inform ation available for decisionm aking by a reasonable investor.

B

W e n ow consider whether the com plai nt adequately alleges scienter for the m aterially m isleading om issions from the 10-Q statem ents. B ecause R ule 1 0b-5 m akes it unlawful “[t]o m ake any untrue statem ent” or to om it m aterial facts necessary to m ake “the s tatem ents made ” not m isleading, 1 7 C.F.R. § 2 40.10b-5(b) (em phasis added), we m

ust first determ ine who was the m aker of the statem ent for purposes of Section 10 ( b ) and Rule 10b-5(b) and whether the

com plaint adequately alleged that the m aker om itted m aterial inform ation k

nowingly, int entionally, or with deliberate recklessness. In other words, the com plaint m ust plausibly allege, with the particularity required by the PSLRA, that the

m aker of the statem ent s kn ew about the security vulnerabilities and intentionally or recklessly did not disclose them

.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 30

Alphabet is at least one alleged maker of the 10-Q statem ents here, because A lphabet has “ultim ate authority

over the statem ent, including its content and whether and h ow to comm unicate it,” Janus , 564 U.S. at 142. 8

Because Alphabet is a corporation, it “‘can o n l y a ct through its em

ployees and agents’ and can likewise o nly have

s ci e nter through them .” In re ChinaCast Educ. Corp. S e c. Litig.
, 8 09 F.3d 471, 4 75 (9th Cir. 2015) (quoting Suez Equity Invs., L.P. v. Toronto-Dominion Bank
, 250 F.3d 87, 1 01 (2d Ci r. 20 0 1)). W e h ave explained that the “scienter of the senior controlling o fficers of a corporation m ay be attributed to the corporation itself to establish liability as a prim ary violator of § 10(b) and Rule 10b-5 when those senior officials

were acting within the scope of their apparent authority.” Id.
at 476 (quoting Adams v. Kinder-Morgan, Inc
., 340 F. 3d 1083, 1106–07 (10th Cir. 2003)).

The com plaint’s specific all e g a tions, taken as a whole, raise a strong infe r e n c e that Page, and therefore Alphabet, knew about the Three-Year Bug, the Privacy Bug, an d the Privacy Bug Mem o, and th a t A lphabet intentionally did not disclose this inform ation in its 10-Q statem ents.

The c o mplaint’s allegations, read as a whole, raise a strong inference that Alphabet was aware of the inform ation in the Privacy Bug Mem o. In this case, the com plaint alleges that Pic h a i and other Google senior executives read the Privacy Bug Mem o, an d s o necessarily knew of the ThreeYear B u g and other security vulnerabilities, b efore Alphabet

8 The com

plaint does not allege, and Rhode Island does not argue, that Page is a m aker of the 1 0-Q statem ents for purposes o f Section 10(b) and Rule 10b-5. W e therefore do not address this issue.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 31

m ade its April 2018 10-Q statem ent. T h e com plaint alleges with particularity that the m em o inform ed senior exec ut ive leadership at Google of the scope of the problem
, warned of the co n sequences of d isclosure, and presented G oogle leadership with a clear d ecision on whether to d isclose those problem s. S

ee South Ferry
, 5 42 F.3d at 785–86 (describing “actual access to the disputed informat io n ” as supporting a strong inference of scienter).

The com plaint also raises a strong inference that Pichai

co mm unicated this inform ation to Page, and therefore Page

was also awar e of the T hree-Year B ug and other security vulnerabilities before he signed the April 20 1 8 1 0-Q statem ent. Although the com pl a i n t does not directly allege that Page read the Privacy Bug Mem o, we m ay consider a senior execu t i ve’s role in a com pany to determ ine whether there is a cogent and c o mp e lling inference that the senior executive knew of the inform ation at issue. Id. at 785. This includes consideration o f th e executive’s access to the inform ation, and, whether, given the im portance o f th e inform ation, “it would b e ‘absurd’ to suggest that

m anagem ent was without knowledge of the matt er.” Id. at 786 (quoting Berson , 527 F.3d at 988).

Her e, num erous allegations in the com plaint raise the strong inference that Page was vitally concerned with Google’s operations. See id. at 78 5 –86. Specifically, the

com plaint alleges th a t Alphabet is essentially a holding

com pany for G oogle (i.e., G oogle was the “lifeblood” o f Alp hab e t)

. Page, the form er CEO of Google, received weekly reports of Google’s o perating results and m ade “key opera ti ng decisions” at Google. Pichai, as the replacem ent CEO of Google, reported directly to Page. Moreov e r , the

com plaint alleges that Pichai and P age together approved aI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 32

plan in sprin g 2 0 1 8 to shut down Google+ because of the security concerns revealed by the Privacy Bug Mem o

. Taken together, these specific allegations raise the strong inference that Pichai inform ed Page o f any inform ation r e garding Google’s operations that w as m aterial and that th e r e was shared decision-m aking on key issues. See id. (identifying a

com bination of allegations regarding corporate stru c ture, im portance of inform ation, and exposure to factual inform ation that “m ay be relevant and help to satisfy the PSLRA scienter requirem ent”). The com plaint also cogently alleges that the Three-Year B ug an d o ther security vulnerabilities that were disclosed in the Privacy Bug Mem o

were highly m aterial to Google’s operations, for the reasons explained above.

Therefore, considering these allegations together, there is

a strong inference that P age knew of these problem s and the consequences of disclosur e when Alphabet m ade its 10-Q statem e n t s in April and July 2018. The com peting inference—that Pi c hai concealed “the largest data-security vulnerability in the history of two Com panies wh ose existence depends on d at a s ecurity” from the CEO o f Alphabet at a tim e when social m edia n etworks we r e under imm ense regulatory and governm ental scrutiny—is not plausible. Acc o r d i n gly, we conclude there is a strong infer e n c e that Page h ad the requisite knowledge, which can be im puted to Alphabet. ChinaCast , 809 F.3d at 475.

For the sam e reasons, there is an equally strong inference that, arm ed with this knowledge, Alphabet intentionally did not disclos e the cybersecurity inform ation to the public in order to avoid or d elay the im p acts disclosure could have on regulatory scrutiny, public criticism
, and loss of consum e r confidence. The com

plaint also alleges that Pichai approvedI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 33

a cover-up to avoid regulatory scrutiny and testim ony before Congress. T he com

p lain t a l l eges that “key officers and directors,” including P age and Pi c hai, “had decided to conceal all of this inform ation f rom everyone outside the Com panies.” This decision to conceal was calculated to “buy tim e” by avoiding putting Google in the spo t light alongside the Facebook-Cam

bridge Analytica scandal and at the tim e o f heightened public and regulatory scrutiny. As it turned out, Alphabet successfully bought itself about six m onths of tim e between the April 2018 decision not to disclose an d the October 2018 publication of the Wall Street Journal art i cle. Agai n, th e com

peting inference that Alphabet knew of this inform ation but was m erely neglig e n t in not disclosing it is not plausible.

Finally, Alphabet argues that the com plaint does not raise

a strong in f

erence that Alphabet intentionally om itted

m aterial informat i o n from its 10-Q statem ent because the

com plaint does not allege that com pany officials m ade

su sp i cio u s sto ck sales o r in clu de allegations from confidential witnesses. Th i s argum ent fails. A lthough such allegations

m ay support an inference of scienter, they are not a sine q ua

non f or rai s i n g such an inference. S ee, e.g. , Siracusano
, 585 F .3d at 1180–83 (re j ecting need for stock sales and identifying sufficient scienter allegations without witnesses); No. 84 Employer-Teamster Joint Council Pens ion Tr. Fund

v. A m. W. Holding Corp. , 320 F.3d 920, 944 (9th Cir. 2 003) (“[T]he lack of stock sales by a defendant is not d ispositive

a s to scienter.”). Allegations of suspicious stock s a l e s o r inform ation from confidential wi tn esses are not needed where, as here, other allegations in the com plaint ra i se a strong inference o f scienter. Alphabet als o argues that because Google fixed the Three-Year Bug and no users were harm ed, Alphabet’s failure to disclose does not s u pport aI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 34

strong inference of scienter. This argum ent is little m ore than

a restatem ent o f Alphabet’s contention, which we have already rejected, that the Three-Year B ug and the Privacy Bug were not m aterial because they had been r e mediated. See supra Part III.A.

Rhode Island adequately alleged falsity, m ateriality, and scienter for the April 2018 and July 2 018 1 0

- Q statem ents. We therefore reverse the district court’s holdings to th e contrary. The defendants’ m o ti o n to dism iss did not ch allenge the rem aining elem ents of the Section 10(b) and Rule 10 b

- 5 ( b ) statem ent liability claim s for these or other statem ents, so we do not address the elem ents of connection to the sale of a security, reliance, econom ic loss, or l o ss causation.

Because we reverse the distri ct court’s dism issal o f Rhode Island’s claim s related to Alphabet’s 1 0-Q statem ents,

we also reverse its dism issal of the com plaint’s S ection 20(a) claim s based on th o s e statem ents, which allege that Pichai and Page were controlling persons of Alphabet under Section 20(a). The d istrict court dism issed these claim s solely on the ground that Rhode Island failed to state a claim for a prim ary violation o f Section 10(b) and Rule 10b-5. W e rem and to the district court to reconsider Pichai and P age’s liability under Section 20(a) in light of our holding today.

C

W e now consider the ten rem aining statem ents identified in the com

plaint.

First, the com

plain t id entifies statem ents m ade in two earnings calls in April and July 2018 b y El l en W est,I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 35

Alphabet’s Head of Invest o r Re l ations. According to the

com plaint, after noting that “[s]om e of the statem ents that we

m ake today m ay b e considered fo rwa r d looking” and that “[t]hese statem ents involve a num ber o f risks and uncertainties that could cause actual results to differ

m aterially,” W est stated: “For m ore inform ation, p lease refer to the risk factors discussed in our Form 10-K for 2 017 filed with the SEC.” 9 These statem ents alone did not plausibly give a reasonable investor the “im pression of a state of affairs
th a t differs in a m aterial way from the one that actually exists,” Hewlett-Packard
, 845 F.3d at 1275 (quoting B erson , 527 F.3d at 985), because, unlike the 2018 10-Q statem ents, We st’s statem ent did not include the express assurance that there h ad been “no m aterial chang e s ” to Alphabet’s risk factors since the 2017 10-K filing.

Second, the com

plaint identifies statem ents ma d e by Pichai, three seni o r G oogle executives, and an Alphabet proxy statem ent. These statem ents em phasize Google’s and Alphabet’s comm itm en t to user privacy, data security, and regulatory com

pliance and discuss Google and Alp h ab et’s ongoing efforts to secure user data an d wo rk on GDPR

com pliance. For instance, the com plaint alleges that, o n the April 2018 earnings call for Al phabet, Pichai assured the public and investors that Google “started working on GDPR

com pliance over 18 m o nths ago and ha[d] bee n very, very engaged on it” and that Google has a “very robust and strong privacy program .” Si mi larly, in an April 2018 letter to Senator Grassley, a s enior Google executive stated that “Google has a lon g stan d in g co m m itm ent to ensuring both that

our users share their data only with developers they can trust,

9 T he com plaint alleges that W est’s statem ents on the Ap ril 2018 and July 2018 earnings calls were substantively identical.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 36

and that they un derstand how developers will use that data” and that Google was “comm itted to protecting our users’ data and prohibit[s] developers from r e questing access to inform ation they do not need.” Google executives elsewhere touted Alphabet as “one of the leading com panies wh e n i t

com es to privacy and security of user d ata, ” e xp l ained that Al p habet was taking “great pains to m ake sure that p eo p le have great control and n o t ic e over their data,” and affirm ed that the “foundation o f [Google’s] business is the trust o f people that use our services.”

While these statem ents are relevant and were m ade while Google and Alphabet allegedly chose a strategy of concealm ent over disclo s ure, these statem ents do not rise to the level of “ c o n c r e te description of the past and present” that affirm atively create a misleading im pression of a “state of affairs that differed in a m aterial way from the on e th at actually existed.” Quality Systems
, 865 F.3d at 1144 (cleaned up). They instead am ount to vague and generalized corporate

comm itm ents, aspirations, o r puffery that cannot support statem ent liabi l ity under Section 10(b) and Rule 10b-5(b). See Hewlett-Pa c kard
, 845 F.3d at 1278; Intuitive Surgical
, 759 F.3d at 1060.

Finally, the com

plaint alleges that Page and Pic h ai decided not to testify before th e United States Senate Intelligence Comm ittee in S eptem ber 2018 alongside Facebook an d Twi tter, which left “an em pty chair for Google.” An em

pty chai r i s n ei ther a statem ent of m aterial fact nor the m isleading om ission of a m at e r i a l fact. See 17 C.F.R. § 240.10b-5(b); see also Hewlett-Packard
, 845 F.3d at 1278.I N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 37

Because the com

plaint d oes not plausibly allege that th ese

r e m a i n i n g s t a t e m e n t s a r e m i s l e a d i n g m a t e r i a l

m isrep resen

tations or om issions, we affirm the district co u rt’s dism issal of the Section 1 0(b) and Rule 10b-5(b) s tatem ent liability claim s based on these statem ents. W e also affirm the district court’s dism issal of the Section 2 0 ( a ) controllingperson claim s for these statem ents.

IV

Finally, R

hode Island argues on appeal that the district court erred in dism issing its claim s under Rule 10b-5(a) and (c) (referred to in the com

plaint as a “schem e liability claim ”) when it dism issed the com plaint i n its entirety without addressing those claim s. In its com plaint, Rhode Isl and alleged that th e defendants “dissem inated or approved the statem ents” alleged to be m aterially m isleading and “en gaged and participated in a continuous course of conduct to conceal the truth and/or adverse m aterial inform ation ab o ut Alphabet’s business and operations.”

Al p h ab et argues that Rhode Island waived these claim s because it failed to raise them to the distri c t c o urt in opposition to Alphabet’s m otion to dism iss. Alphabet also contends that the com

plaint’s claim s under Rule 10b-5(a) and (c) are duplicative of the claim s under R ule 10b-5(b) seeking to hold the defendants liable f or m isleading statem ents. Both argum ents fail.

First, b ecause Alphabet’s m otion to d ism iss did n ot target Rhode Island’s Rule 10b-5(a) and (c) claims
, Rh o d e Island did not w aive those claim s by failing to address them in opposition to the m otion to dism iss. A party’s failure to oppose an argum ent that was not m ade does not constitute aI N R E A L P HAB E T , I N C

. S E CUR I T I E S L I T I G

AT I O N 38

waiver. Second, Alphabet’s argum ent that Rule 10b-5(a) and (c) claim s cannot o v erlap with Rule 10b-5(b) statem ent liability claim s is forecl o sed by Lorenzo
, which rejected the petitioner’s argum ent that Rule 10b-5(a) and ( c) “concern ‘schem e liability claim s’ and are violated only when conduct other than m isstatem ents is invol ve d .” 139 S. Ct. at 1 101–02. 1 0 Rather, Lorenz o e xp lained that “considerable overlap” exists am ong the subsections of Rule 10b-5 and held that dissem inating f

alse statem ents “ran afoul of subsections (a) and (c).” Id. at 1102.

Because the district court erred in sua sponte dism issing Rhode Isl an d ’s claim s under R ule 10b-5(a) and (c) when Alphabet had not targeted those c la i ms in its m o tion to dism iss, we reverse dism issal of the claim s under Section 10(b) and Ru le 1 0b-5(a) and (c) against all defendants and rem and to the district court. See Golden Gate Hotel Ass’n v. City & C

ounty of S an Francisco
, 18 F.3d 1482, 1487 (9th Cir. 1994 ) ; se e also Reed v. Lieurance
, 863 F.3d 1196, 1207–08 (9th Ci r

. 2 017) (reversing sua sponte dism issal). W e also reverse the dism issal of Rhode Island’s claim s under Section 20(a) to the extent those claim s depend on claim s alleging violations of Rule 10b-5(a) and (c).

REVERSED IN PART, A FFIRMED IN PART, J U D G M E N T VA C A T E D , R E MAN D E D F O R F U RT H E R PROCEEDINGS. 1 1

10 In reaching this holding, Lorenzo abrogated our contrary h olding in WPP Luxembourg Gamma Three Sarl v. S pot Runner, Inc.
, 655 F.3d 1039, 1057–58 (9th Cir. 2011). See Lorenzo , 139 S. Ct. at 1100.

11 Each party will bear its own costs on appeal.