NOT FOR PUBLICATION FILED

UNITED STATES COURT OF APPEALS MAY 15 2020

MOLLY C. DWYER, CLERK

U.S. COURT OF APPEALS

FOR THE NINTH CIRCUIT

DIANA HAUCK, et al., No. 19-16124

Plaintiffs-Appellants, D.C. Nos. 5:18-cv-00447-LHK 5:18-cv-00744-LHK v. 5:18-cv-00883-LHK

ADVANCED MICRO DEVICES, INC.,

MEMORANDUM*

Defendant-Appellee.

Appeal from the United States District Court for the Northern District of California Lucy H. Koh, District Judge, Presiding

Submitted May 13, 2020** San Francisco, California

Before: FRIEDLAND and BENNETT, Circuit Judges, and RAKOFF,*** District Judge.

Plaintiffs-Appellants, each of whom had purchased a computer processor

manufactured by Defendant-Appellee Advanced Micro Devices, Inc. (“AMD”) or

* This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. ** The panel unanimously concludes this case is suitable for decision without oral argument. See Fed. R. App. P. 34(a)(2). *** The Honorable Jed S. Rakoff, United States District Judge for the Southern District of New York, sitting by designation. a device containing such a processor, filed this putative class action alleging

various state law claims arising out of alleged defects in those AMD processors.1

Like all major computer processor manufacturers, AMD employs branch

prediction, speculative execution, and caches in its processors’ microarchitecture.

Plaintiffs’ operative second amended complaint alleges that AMD processors are

defective because their reliance on these features renders the processors vulnerable

to cybersecurity attacks in which attackers (1) artificially induce mis-speculation to

influence what metadata a processor stores, and then (2) launch side-channel

attacks to deduce users’ underlying sensitive information from that metadata.

Plaintiffs allege that this vulnerability was publicized to consumers in January

2018, and Plaintiffs acknowledge that the type of attack the processors were

vulnerable to was commonly referred to as a Spectre attack. Plaintiffs do not

allege that any such attack has successfully compromised their data or any other

consumer’s data. Instead, their claims are premised on allegations that they would

not have purchased their devices or would have paid less for them if they had

1 Plaintiffs-Appellants are citizens of four different states and assert state law claims corresponding to their respective domiciles. We refer to Plaintiff-Appellant Diana Hauck as the “Louisiana Plaintiff,” Plaintiffs-Appellants Shon Elliott, Michael Garcia, and Joann Martinelli as the “California Plaintiffs,” Plaintiff- Appellant Benjamin Pollack as the “Florida Plaintiff,” and Plaintiff-Appellant Jonathan Caskey-Medina as the “Massachusetts Plaintiff.” Each plaintiff group asserts claims on behalf of the named plaintiffs from the corresponding state, a nationwide class, and a state class.

2 known about the defect, and on allegations that the defect prompted them to install

third-party patches that then caused their processors’ performance to worsen.

The district court granted AMD’s motion to dismiss the claims in Plaintiffs’

second amended complaint that the parties had identified as bellwether claims,

entered a partial final judgment pursuant to Federal Rule of Civil Procedure 54(b),

and certified this matter for immediate appeal. Plaintiffs timely appealed.

Reviewing de novo, see Davidson v. Kimberly-Clark Corp., 889 F.3d 956, 963 (9th

Cir. 2018), we affirm.

1. Plaintiffs have adequately alleged Article III standing as to their claims

for damages. Plaintiffs’ allegations that their devices degraded in performance

after they installed third-party patches to attempt to mitigate their processors’

vulnerability to the alleged defect are sufficient to establish an injury in fact that is

“concrete and particularized” and “actual or imminent, not conjectural or

hypothetical.” Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528

U.S. 167, 180 (2000). That injury is “fairly traceable” to the design of AMD

processors. Id. Although it is possible, as AMD suggests, that the age of

Plaintiffs’ computers or other issues with the third-party patches were partially

responsible for the performance losses, Plaintiffs allege an adequate causal

connection between their learning about the vulnerabilities resulting from the

microarchitecture of AMD’s processors and their alleged injury to establish

3 standing at this juncture. See Mendia v. Garcia, 768 F.3d 1009, 1014-15 (9th Cir.

2014). Finally, Plaintiffs’ claimed injury, if proven, would be redressable through

damages. See Jewel v. Nat’l Sec. Agency, 673 F.3d 902, 908, 912 (9th Cir. 2011).

2. The district court did not err in concluding that, to the extent Plaintiffs’

second amended complaint alleged that AMD processors were defective for the

reason that their caches are vulnerable to side-channel attacks generally and not

only Spectre-like attacks in particular, or because of other some other subset of

their features, Plaintiffs failed to allege the nature of the defect with sufficient

specificity to state any of their claims sounding in fraud under the heightened

pleading standard of Federal Rule of Civil Procedure 9(b).

3. The district court did not err in dismissing for failure to state a claim the

California Plaintiffs’ claims for violation of the unfair business practices prong of

the Unfair Competition Law (“UCL”) and for fraud by omission under California

law. The fraud by omission claim was properly dismissed for failure to plausibly

allege the existence of any of the relevant bases for a fraud claim set forth in

LiMandri v. Judkins, 60 Cal. Rptr. 2d 539 (Ct. App. 1997). The California

Plaintiffs do not allege that AMD is their fiduciary. See id. at 543. Nor are their

allegations sufficient to establish either AMD’s knowledge or active concealment

of the defect. See id. Although the California Plaintiffs allege that AMD was

aware of some of the vulnerabilities created by its design choices, they do not

4 plausibly allege that AMD knew of the specific vulnerability identified in their

second amended complaint until that vulnerability was disclosed to AMD in June

2017, which was after the California Plaintiffs had made their purchases. Nor do

the California Plaintiffs plausibly allege that AMD “suppresse[d]” material facts

regarding that specific defect. See id. (quoting Heliotis v. Schuman, 226 Cal. Rptr.

509, 512 (Ct. App. 1986)).

To the extent the California Plaintiffs’ unfair business practices UCL claim

is not also grounded in fraud, it was nevertheless properly dismissed, because the

California Plaintiffs have not stated a plausible claim that AMD engaged in an

unfair business practice under either the “tether[ing]” or the “balancing” tests. See

Lozano v. AT&T Wireless Servs., Inc., 504 F.3d 718, 735-36 (9th Cir. 2007); Cal.

Bus. & Prof. Code § 17200 et seq. Plaintiffs have not plausibly alleged either the

existence of false advertising or an actual violation of a privacy right, nor have

they plausibly alleged that the harm represented by the theoretical risk of a

cybersecurity flaw that has not yet been successfully exploited outweighs the other

benefits of AMD’s processor design.

4. The Florida Plaintiff’s omission claim under the Florida Deceptive and

Unfair Trade Practices Act (“FDUTPA”), Fla. Stat. § 501.201 et seq., and the

Massachusetts and Florida Plaintiffs’ affirmative misrepresentation claims under

the Massachusetts Consumer Protection Act (“MCPA”), Mass. Gen. Laws ch. 93A,

5 § 1 et seq., and FDUTPA were also properly dismissed. Plaintiffs do not plausibly

allege that AMD’s statements or omissions “offend[ed] established public policy”

or were “immoral, unethical, oppressive, unscrupulous or substantially injurious to

consumers.” PNR, Inc. v. Beacon Prop. Mgmt., Inc., 842 So. 2d 773, 777 (Fla.

2003) (quoting Samuels v. King Motor Co. of Fort Lauderdale, 782 So. 2d 489,

499 (Fla. Dist. Ct. App. 2001)); see also Aspinall v. Philip Morris Cos., 813

N.E.2d 476, 486-87 (Mass. 2004) (“[A] practice is ‘deceptive’ . . . ‘if it could

reasonably be found to have caused a person to act differently from the way he [or

she] otherwise would have acted.’” (last alteration in original) (quoting Purity

Supreme, Inc. v. Attorney Gen., 407 N.E.2d 297, 307 (Mass. 1980))). Nor were

any of the alleged statements or omissions “likely to mislead” consumers “acting

reasonably in the circumstances” to their detriment, given that such consumers

would not plausibly believe that AMD’s clock-speed representations were

premised on any implicit security assurances, or that their devices would be

completely impervious to novel cybersecurity threats. PNR, 842 So. 2d at 777

(quoting Millennium Commc’ns & Fulfillment, Inc. v. Office of Attorney Gen., 761

So. 2d 1256, 1263 (Fla. Dist. Ct. App. 2000)); see also Aspinall, 813 N.E.2d at

486-87.

5. The Massachusetts Plaintiff’s omission claim under the MCPA was

properly dismissed. Given the wide publicity the alleged defect received prior to

6 the Massachusetts Plaintiff’s purchase of his AMD processor and the absence of

plausible allegations that consumers would have believed their devices were not

susceptible to any cybersecurity threats, the second amended complaint does not

plausibly allege that AMD’s failure to disclose the defect “could reasonably be

found to have caused [the Massachusetts Plaintiff] to act differently from the way

he . . . otherwise would have acted.” Aspinall, 813 N.E.2d at 486 (quoting Purity

Supreme, 407 N.E.2d at 307).

6. The California Plaintiffs’ warranty claims were properly dismissed. Even

if AMD’s clock-speed representations are treated as an express warranty, Plaintiffs

fail to identify any specific or unequivocal written statement that guarantees that

such clock speeds could be attained without any possible security compromises.

See Cal. Com. Code § 2313; Maneely v. Gen. Motors Corp., 108 F.3d 1176, 1181

(9th Cir. 1997). Nor have Plaintiffs plausibly alleged that their devices lack “even

the most basic degree of fitness for ordinary use” as required to state a claim for

breach of an implied warranty of merchantability. Mocek v. Alfa Leisure, Inc., 7

Cal. Rptr. 3d 546, 549 (Ct. App. 2003); see also Cal. Com. Code §§ 2314-15.

7. The Louisiana Plaintiff’s redhibition claim was also properly dismissed.

Plaintiffs have not plausibly alleged either that AMD’s processors were

“absolutely useless” or that they were so inconvenient or imperfect that a

reasonable person would not have purchased them. Justiss Oil Co. v. Oil Country

7 Tubular Corp., 216 So. 3d 346, 361 (La. Ct. App. 2017) (quoting Blair v. Bad Boy

Inc., 137 So. 3d 1223, 1227 (La. Ct. App. 2014)); see also La. Civ. Code Ann. arts.

2520, 2524.

AFFIRMED.

8