Court Opinion

ID: 6319552
Source: CourtListenerOpinion
Date Created: 2022-03-02 21:00:48.286394+00
Date Added: 2024-06-11T09:01:39.139682
License: Public Domain

NOT FOR PUBLICATION                        FILED
                    UNITED STATES COURT OF APPEALS                        MAR 2 2022
                                                                      MOLLY C. DWYER, CLERK
                                                                       U.S. COURT OF APPEALS
                              FOR THE NINTH CIRCUIT

LOCAL 353, I.B.E.W. PENSION FUND,               No.    21-15785
Lead Plaintiff,
                                                D.C. Nos.    3:19-cv-06968-CRB
                Plaintiff-Appellant,                         3:19-cv-07361-CRB

and
                                                MEMORANDUM*
CHARLES REIDINGER; MANDY HO,

                Plaintiffs,

 v.

ZENDESK, INC.; et al.,

                Defendants-Appellees,

and

ADRIAN MCDERMOTT; et al.,

                Defendants.

                   Appeal from the United States District Court
                     for the Northern District of California
                   Charles R. Breyer, District Judge, Presiding

                      Argued and Submitted February 7, 2022
                            San Francisco, California

      *
             This disposition is not appropriate for publication and is not precedent
except as provided by Ninth Circuit Rule 36-3.
Before: WARDLAW, IKUTA, and BADE, Circuit Judges.

      Plaintiffs Local 353, IBEW Pension Fund, Charles Reidinger and Mandy Ho

(“Plaintiffs”) appeal a district court order dismissing their Second Amended

Complaint (“SAC”) for failure to state a claim under 17 C.F.R. § 240.10b-5 (“Rule

10b-5”), 15 U.S.C. § 78j(b) (“Section 10(b)”), or 15 U.S.C. § 78t(a) (“Section

20(a)”). We have jurisdiction under 28 U.S.C. § 1291, and we affirm.

      1.     The district court did not err in dismissing Plaintiffs’ claim under Rule

10b-5 and Section 10(b) for failure to state a claim. To state a claim under Rule

10b-5 and Section 10(b), a plaintiff must plead “six essential elements” including

(1) falsity (a material misrepresentation or omission), and (2) scienter. Retail

Wholesale & Dep’t Store Union Loc. 338 Ret. Fund v. Hewlett-Packard Co., 845

F.3d 1268, 1274 (9th Cir. 2017). To survive a motion to dismiss, the SAC must

not only satisfy Federal Rule of Civil Procedure 8, but meet additional pleading

requirements set out in Federal Rule of Civil Procedure 9 and the Private Securities

Litigation Reform Act (“PSLRA”), 15 U.S.C. § 78u-4(b)(1), 78u-4(b)(2)(A).

      2.     The district court did not err in concluding that while the SAC did

“specify” five publicly filed statements, 15 U.S.C. § 78u-4(b)(1), it did not include

facts supporting a reasonable inference that any of those statements were false or

misleading, see Retail Wholesale, 845 F.3d at 1274.

                                          2
       Plaintiffs argue that two of the five statements in Zendesk’s 2018 Form 10-K

(filed February 14, 2019)—that Zendesk “maintain[s] a comprehensive security

program,” and that it “completed the EU approval process for [its] global Binding

Corporate Rules” in 2017—were misleading because they created the impression

that Zendesk implemented the data security best practices described in those

statements no later than 2016, when in fact, the company did not implement those

practices until later.

       We disagree. Neither statement makes any reference to Zendesk’s data

security practices in 2016. Statement one is in the present tense; it describes

features of Zendesk’s 2019 data security program and certifies that the current

program is “comprehensive.” Statement two simply states that the EU approved

Zendesk’s global Binding Corporate Rules in 2017. Both statements are truthful.

       Plaintiffs contend, however, that based on these statements a reasonable

investor could have concluded that any data security improvements Zendesk

described would have been put in place in response to the two public hacks

Zendesk had experienced in the past, one in 2013 and one in 2016. However,

Plaintiffs plead no facts supporting a reasonable inference that either of those

hacks was a prominent enough milestone in company history that the average

investor would be led to believe every data security improvement directly followed

them. Further, the 2013 hack occurred before Zendesk began using Amazon Web

                                          3
Services (“AWS”) and the 2016 hack involved only Defendant Svane’s personal

Twitter account.

      Next, Plaintiffs argue that the remaining three statements—all of which are

risk disclosures that appeared in Zendesk’s 2018 Form 10-K (filed February 14,

2019)—were misleading because they created the impression that it was unlikely

Zendesk had suffered an undetected data breach in the past, when in reality it was

somewhat likely. Again, we disagree. None of the three statements makes

assertions as to the likelihood of such contingencies occurring. Therefore, these

statements would not give an ordinary investor reason to believe that Zendesk was

asserting that the risk that an undetected breach had occurred was particularly high

or low, or that it had changed over time.

      3.     The district court did not err in finding that Plaintiffs failed to state

“with particularity” facts supporting a “strong inference,” 15 U.S.C. § 78u-

4(b)(2)(A), that Zendesk acted with the required scienter—intent to “deceive,

manipulate or defraud” or “deliberate recklessness” toward that possibility—under

either the core operations doctrine or the corporate scienter doctrine. Schueneman

v. Arena Pharms. Inc., 840 F.3d 698, 705 (9th Cir. 2016) (internal quotation marks

omitted).

      Plaintiffs fail to adequately allege scienter under the core operations doctrine

because they do not make “detailed and specific allegations” supporting a strong

                                            4
inference that Defendants Gomez or Svane were intimately involved in the

minutiae of Zendesk’s AWS data-security policy, Zucco Partners, LLC v.

Digimarc Corp., 552 F.3d 981, 1000 (9th Cir. 2009) (internal quotation marks

omitted), or allegations supporting a strong inference that the facts at issue (minor

changes in the company’s data security policy over a three-year period) were “of

such prominence that it would be absurd to suggest that management was without

knowledge of the matter,” S. Ferry LP, No. 2 v. Killinger, 542 F.3d 776, 786 (9th

Cir. 2008) (emphasis added) (internal quotation marks omitted). They do allege

that, generally speaking, data security is a core element of Zendesk’s business, that

both Gomez and Svane signed Zendesk’s form 10-K which made assertions about

data security, and that in the wake of the 2019 discovery of the 2016 hack, Svane

stated that Zendesk was in a “very different state of security” in 2016 than it was in

2019. However, those allegations fall far short of the bar set by our cases.

Compare No. 84 Emp.-Teamster Joint Council Pension Tr. Fund v. America

West, 320 F.3d 920, 937–939 (9th Cir. 2003), with Zucco, 552 F.3d at 1001.

      Similarly, even assuming corporate scienter is a viable theory in our circuit,

Plaintiffs fail to adequately allege scienter under that doctrine because the

statements that Plaintiffs cite to were not “so dramatically false” that at least some

corporate official must have known of their falsity upon publication. Compare In

re NVIDIA Corp. Sec. Litig., 768 F.3d 1046, 1063–64 (9th Cir. 2014) (serious

                                           5
defects in two important products was not enough to trigger corporate scienter),

with Makor Issues & Rts., Ltd. v. Tellabs Inc., 513 F.3d 702, 709–10 (7th Cir.

2008) (production issues, collapsing sales, and other serious issues for company’s

flagship products were enough to trigger corporate scienter).

      4.     Finally, the district court did not err in dismissing Plaintiffs’ Section

20(a) claim because liability under Section 20(a) requires an underlying violation

of securities law, and the district court correctly dismissed Plaintiffs’ claim under

Rule 10b-5/Section 10(b). See In re Rigel Pharms., Inc. Sec. Litig., 697 F.3d 869,

886 (9th Cir. 2012) (“Because Plaintiff here has failed to adequately plead a

violation of the federal securities laws, it follows that Plaintiff also has failed to

adequately plead violations of section 20(a) . . .”).

      AFFIRMED.

                                            6