1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9 10 IN RE ZOOM SECURITIES LITIGATION Case No. 20-cv-02353-JD

11

ORDER RE MOTION TO DISMISS

12 Re: Dkt. No. 78 13 14

15 This is a securities fraud class action against Zoom Video Communications, Inc., and its 16 CEO, Eric Yuan, and CFO, Kelly Steckelberg. Court-appointed lead plaintiff Adam Butt filed a 17 consolidated complaint on behalf of “all who purchased or acquired Zoom securities from April 18 18, 2019 through April 6, 2020.” Dkt. No. 63 (Compl.) ¶ 2. Butt alleges that defendants violated 19 Sections 10(b) and 20(a) of the Securities Exchange Act of 1934, 15 U.S.C. §§ 78j(b) and 78t(a), 20 and SEC Rule 10b-5, 17 C.F.R. § 240.10b-5, “by making false and misleading statements and 21 omissions concerning the Company’s operations; the security capabilities, including the ability to 22 use AES 256-bit end-to-end encryption, available in its main product offering, Zoom Meetings; 23 and its collection and use of its users’ personal data.” Compl. ¶ 3. The consolidated complaint 24 challenges fifteen statements and omissions identified in plaintiff’s summary chart attached to the 25 complaint. Id., Ex. A. 26 Defendants ask to dismiss the complaint under the Private Securities Litigation Reform 27 Act of 1995 (PSLRA), 15 U.S.C. § 78u-4, and Federal Rule of Civil Procedure 12(b)(6), for 1 motion is granted and denied in part. Plaintiff’s Section 10(b)/Rule 10b-5 claim against Yuan and 2 Zoom for Statement No. 1 was adequately alleged and will go forward. All of the other statements 3 and claims are dismissed with leave to amend. 4 DISCUSSION 5 I. LEGAL STANDARDS 6 Under Section 10(b) of the Securities Exchange Act of 1934, it is unlawful for any person 7 “[t]o use or employ, in connection with the purchase or sale of any security registered on a 8 national securities exchange . . . any manipulative or deceptive device or contrivance in 9 contravention of such rules and regulations as the Commission may prescribe as necessary or 10 appropriate in the public interest or for the protection of investors.” 15 U.S.C. § 78j(b). One of 11 those rules prescribed by the U.S. Securities and Exchange Commission is Rule 10b-5, which 12 makes unlawful for any person to, inter alia, “make any untrue statement of a material fact or to 13 omit to state a material fact necessary in order to make the statements made, in the light of the 14 circumstances under which they were made, not misleading.” 17 C.F.R. § 240.10b-5(b). 15 “To plead a claim under [S]ection 10(b) and Rule 10b-5, [plaintiff] must allege: (1) a 16 material misrepresentation or omission; (2) scienter; (3) a connection between the 17 misrepresentation or omission and the purchase or sale of a security; (4) reliance; (5) economic 18 loss; and (6) loss causation.” Or. Pub. Emps. Ret. Fund v. Apollo Grp. Inc., 774 F.3d 598, 603 19 (9th Cir. 2014) (citing Stoneridge Inv. Partners, LLC v. Scientific-Atlanta, Inc., 552 U.S. 148, 157 20 (2008)). A complaint alleging claims under Section 10(b) and Rule 10b-5 must also “satisfy the 21 dual pleading requirements of Federal Rule of Civil Procedure 9(b) and the PSLRA.” Zucco 22 Partners, LLC v. Digimarc Corp., 552 F.3d 981, 990 (9th Cir. 2009). 23 Under FRCP 9(b), the circumstances constituting the alleged fraud must be stated with 24 particularity. “Rule 9(b) applies to all elements of a securities fraud action.” Or. Pub. Emps. Ret. 25 Fund, 774 F.3d at 605. The PSLRA further imposes specific pleading requirements on securities 26 fraud plaintiffs for falsity and scienter. Zucco Partners, 552 F.3d at 990-91. For falsity, the 27 complaint must “specify each statement alleged to have been misleading, the reason or reasons 1 on information and belief, . . . state with particularity all facts on which that belief is formed.” 15 2 U.S.C. § 78u-4(b)(1). For scienter, the complaint must “state with particularity facts giving rise to 3 a strong inference that the defendant acted with the required state of mind.” Id. § 78u-4(b)(2)(A). 4 “To adequately demonstrate that the ‘defendant acted with the required state of mind,’ a complaint 5 must ‘allege that the defendants made false or misleading statements either intentionally or with 6 deliberate recklessness.’” Zucco Partners, 552 F.3d at 991 (quotations and citation omitted). 7 Section 20(a) of the Act makes certain “controlling persons” also liable for violations of 8 Section 10(b) and its underlying regulations. Specifically, the statute provides that “[e]very 9 person who, directly or indirectly, controls any person liable under any provision of this chapter or 10 of any rule or regulation thereunder shall also be liable jointly and severally with and to the same 11 extent as such controlled person to any person to whom such controlled person is liable . . . , 12 unless the controlling person acted in good faith and did not directly or indirectly induce the act or 13 acts constituting the violation or cause of action.” 15 U.S.C. § 78t(a). 14 II. CLAIMS AGAINST DEFENDANT STECKELBERG 15 Defendant Kelly Steckelberg is barely mentioned at all in the complaint. This means that 16 plaintiff has not adequately alleged scienter for the Section 10(b) claim against Steckelberg. The 17 PSLRA requires that “the complaint shall, with respect to each act or omission alleged to violate 18 this chapter, state with particularity facts giving rise to a strong inference that the defendant acted 19 with the required state of mind.” 15 U.S.C. § 78u-4(b)(2)(A). Scienter must be alleged on a 20 statement-by-statement, defendant-by-defendant basis. 21 The complaint makes just one factual allegation against Steckelberg. Plaintiff says that 22 “Defendant Steckelberg has served as the Company’s CFO since November 2017. Since 23 becoming Zoom’s CFO, Steckelberg had the power to authorize or approve publicly disseminated 24 information about the Company, regularly spoke on Zoom’s quarterly earnings calls with Wall 25 Street analysts and investors, made live presentations at analyst-sponsored investor conferences 26 and signed or authorized filings for Zoom with the SEC.” Compl. ¶ 23. This is little more than a 27 generic job description that comes nowhere close to pleading scienter with the level of 1 claim against Steckelberg by not individually naming her even once in the “scienter” column. 2 Dkt. No. 63-1. Plaintiff’s opposition brief contains no discussion at all of Steckelberg’s individual 3 scienter. Dkt. No. 80 at 9-13. 4 Consequently, the Section 10(b) claim against Steckelberg is dismissed. The same goes 5 for the Section 20(a) claim, which also lacks any allegations establishing Steckelberg’s control 6 person liability. The Court declines to reach defendants’ other arguments for dismissal of the 7 claims against Steckelberg. 8 III. SECTION 10(b) CLAIM AGAINST YUAN AND ZOOM FOR STATEMENT NO. 1 9 For plaintiff’s 10(b) claim against defendants Yuan and Zoom, dismissal is denied for 10 Statement No. 1 in plaintiff’s summary chart. Dkt. No. 63-1 at 1-3. Plaintiff challenges this 11 statement, which appeared in Zoom’s April 18, 2019 Registration Statement and Prospectus: 12 “Security and disaster recovery. We offer robust security capabilities, including end-to-end 13 encryption, secure login, administrative controls and role-based access controls.” Id. at 1 14 (emphasis in original). Defendants do not contest that Yuan “made” this statement by signing the 15 Registration Statement, Dkt. No. 82 at 3 n.2, and they challenge only the elements of falsity, 16 scienter, and loss causation. Dkt. No. 78. 17 A. Falsity 18 Plaintiff has satisfied the falsity element for Statement No. 1 by alleging that defendants 19 represented that Zoom offered “end-to-end encryption” when in fact it did not. Plaintiff alleges 20 that “[w]hereas end-to-end encryption means that not even the company that runs the messaging 21 service can access the cryptographic keys necessary to decrypt the end users’ communication, here 22 Zoom secretly maintained access to the cryptographic keys that could allow Zoom to decrypt and 23 decipher the communications between the end users.” Compl. ¶ 9(a). Among other things, 24 plaintiff points to an article published on March 31, 2020, on The Intercept website titled, “ZOOM 25 MEETINGS AREN’T END-TO-END ENCRYPTED, DESPITE MISLEADING MARKETING: 26 The video conferencing service can access conversations on its platform.” Id. ¶ 56. 27 Defendants say that plaintiff’s falsity allegations are lacking because the term “end-to-end 1 which are alleged in the complaint, demonstrate otherwise. Plaintiff alleges that on April 1, 2020, 2 “Yuan published ‘A Message to Our Users’ on Zoom’s blog,” stating, “we recognize that we have 3 fallen short of the community’s -- and our own -- privacy and security expectations.” 4 Compl. ¶ 62. This blog post by Yuan further “referred and linked to a post of the same date by 5 Oded Gal, Zoom’s Chief Product Officer, titled, ‘The Facts Around Zoom and Encryption for 6 Meetings/Webinars.’” Id. ¶ 63. That linked post included these statements: “we want to start by 7 apologizing for the confusion we have caused by incorrectly suggesting that Zoom meetings were 8 capable of using end-to-end encryption. . . . While we never intended to deceive any of our 9 customers, we recognize that there is a discrepancy between the commonly accepted definition of 10 end-to-end encryption and how we were using it.” Id. 11 These statements make this case very different from Wochos v. Tesla, Inc., 985 F.3d 1180, 12 1194 (9th Cir. 2021), in which the circuit found that plaintiffs had failed to “plead sufficient facts 13 to establish that the actual term used had the distinctive, and false, meaning that plaintiffs claim.” 14 There, plaintiffs “pleaded no facts to support their premise that ‘production car’ would be 15 understood as referring exclusively to the fully automated production of identical vehicles.” Id. 16 (emphasis in original). That is not the situation here. Plaintiff has identified defendants’ express 17 acknowledgement that they had “incorrectly suggest[ed] that Zoom meetings were capable of 18 using end-to-end encryption,” and they had used the term “end-to-end encryption” differently 19 from “the commonly accepted definition.” Compl. ¶ 63. Plaintiff has adequately alleged that 20 defendants’ Statement No. 1 gave an “impression of a state of affairs that differs in a material way 21 from the one that actually exist[ed].” Berson v. Applied Signal Tech., Inc., 527 F.3d 982, 985 (9th 22 Cir. 2008) (quotations and citation omitted). 23 B. Scienter 24 Scienter is also satisfied by plaintiff’s allegations that Yuan -- who made the statement on 25 April 18, 2019, that Zoom offers “end-to-end encryption” -- issued a public statement on April 1, 26 2020, linking to a post that acknowledged and apologized for Zoom’s “incorrect” use of the term. 27 Defendants’ suggestion that the later statement does not qualify as “a statement similar to ‘I knew 1 No. 78 at 11, is not persuasive. The same kind of contemporaneous admission is not necessary 2 because this is not a case where plaintiffs are trying to say “that a later, sobering revelation makes 3 an earlier, cheerier statement a falsehood.” Yourish, 191 F.3d at 997 (cleaned up and citation 4 omitted). Rather, plaintiff has pleaded that Yuan holds an advanced degree in engineering; was a 5 “founding engineer” at “WebEx, a web conferencing and videoconferencing platform”; and he 6 personally “led the effort to engineer Zoom Meetings’ platform and is named on several patents 7 that specifically concern encryption techniques.” Compl. ¶¶ 22, 34(a). There simply is no factual 8 basis here to believe that Yuan’s understanding of the term “end-to-end encryption” may have 9 changed in a relevant way from the time he made the challenged representation in April 2019, to 10 the time Yuan acknowledged just a year later, on April 1, 2020, that Zoom’s usage was 11 inconsistent with “the commonly accepted definition.” 12 Plaintiff has consequently pleaded facts giving rise to a strong inference that when he made 13 the earlier statement, Yuan acted “either intentionally or with deliberate recklessness.” In re 14 Verifone Holdings, Inc. Sec. Litig., 704 F.3d 694, 701 (9th Cir. 2012); see also 15 U.S.C. § 78u- 15 4(b)(2). And because plaintiff has adequately pleaded Yuan’s scienter for Statement No. 1, 16 plaintiff’s scienter allegations for defendant Zoom are also sufficient. See Glazer Capital Mgmt., 17 LP v. Magistri, 549 F.3d 736, 743-45 (9th Cir. 2008). 18 C. Loss Causation 19 The final challenged element of loss causation is also satisfied. That element requires a 20 securities fraud plaintiff to “establish a causal connection between the defendant’s fraudulent 21 conduct and the plaintiff’s economic loss.” In re BofI Holdings, Inc. Sec. Litig., 977 F.3d 781, 786 22 (9th Cir. 2020). “One way to prove loss causation is to show that the defendant’s fraud was 23 revealed to the market through one or more ‘corrective disclosures’ and that the company’s stock 24 price declined as a result.” Id. “At the pleading stage, the plaintiff’s task is to allege with 25 particularity facts ‘plausibly suggesting’ that both showings can be made.” Id. at 791. 26 That is what plaintiff has done here. The complaint alleges that on March 31, 2020, the 27 article in The Intercept revealed the truth about Zoom’s “end-to-end encryption” capabilities, and 1 at $146.12 per share on March 31, 2020.” Compl. ¶¶ 103-04. On April 1, 2020, after Yuan 2 admitted that Zoom had “fallen short” of “privacy and security expectations” and linked to Gal’s 3 apology blog post admitting Zoom’s “incorrect[] suggest[ion]” that Zoom Meetings provided end- 4 to-end encryption, Zoom’s stock price fell further from the close of $146.12 on March 31, 2020, to 5 a close of $137.00 on April 1, 2020. Id. ¶¶ 105-06. 6 These allegations “give the defendant ‘notice of plaintiffs’ loss causation theory’ and 7 provide the court ‘some assurance that the theory has a basis in fact.’” BofI Holdings, 977 F.3d at 8 794 (quoting Berson, 527 F.3d at 989-90). Defendants argue that “industry publications from 9 December 2019 (and before) had already disclosed that ‘Zoom stores a copy of all users’ private 10 keys on their server,’” Dkt. No. 78 at 15, but this is a factual argument which the Court declines to 11 resolve at this stage. Pleading loss causation “should not prove burdensome,” BofI Holdings, 977 12 F.3d at 794, and at this stage, plaintiff has pleaded enough. 13 Plaintiff may proceed with his Section 10(b)/Rule 10b-5 claim against Yuan and Zoom for 14 Statement No. 1. 1 15

IV. SECTION 10(b) CLAIM AGAINST YUAN AND ZOOM FOR STATEMENT

16 NOS. 2-15 17 For Statement Nos. 2-15, plaintiff vaguely identifies the speaker only as “Zoom” (Nos. 2- 18 12) or “defendants” (Nos. 13-15). Dkt. No. 63-1 at 3-14. Plaintiff concedes in his opposition 19 brief that Statement No. 1 is the only statement that Yuan actually made. Dkt. No. 80 at 3 n. 5 20 (arguing only that Yuan “signed the Registration Statement which made the claim that the 21 Company offered robust security capabilities including end-to-end encryption”). The complaint 22 contains no factual allegations adequately tying Yuan to any of Statement Nos. 2 through 15. 23

24 1 Defendants requested consideration of several documents as incorporated by reference in the complaint, or subject to judicial notice. Dkt. No. 79. Plaintiff did not object to the Court’s 25 consideration of Exs. 4, 8-10 and 15-18 as incorporated by reference. Dkt. No. 81 at 3. Defendants’ request is granted for those documents on that basis, but the Court does not take 26 judicial notice of any disputed facts. See Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 999, 1003 (9th Cir. 2018). Judicial notice is denied for Exs. 1-3, 5-7, 11-14, and 19-21, which were not 27 germane to the Court’s resolution of this motion in any event. 1 Because Yuan is not sufficiently alleged to have made Statement Nos. 2-15, plaintiff’s Section 2 10(b)/Rule 10b-5 claim seeking primary liability against Yuan is dismissed for those statements. 3 Defendant Zoom must also be dismissed for those statements. Plaintiff has not adequately 4 alleged scienter for any individual “responsible for actually making the statements.” Glazer, 549 5 F.3d at 745. Because there are no allegations suggesting that this is the exceptional case where “a 6 company’s public statements were so important and so dramatically false that they would create a 7 strong inference that at least some corporate officials knew of the falsity upon publication,” id. at 8 744 (emphasis in original), without allegations of individual scienter, there can be no finding of 9 corporate scienter. 10 V. SECTION 20(a) CLAIM AGAINST YUAN 11 All of this leaves the Section 20(a) claim against Yuan for Statement No. 1 only. See Or. 12 Pub. Emps. Ret. Fund, 774 F.3d at 610 (Section 20(a) claim viable only to extent plaintiff has 13 adequately pleaded a violation of Section 10(b) and Rule 10b-5). 14 To establish controlling person liability under Section 20(a), the plaintiff “must show that a 15 primary violation was committed and that the defendant directly or indirectly controlled the 16 violator.” Paracor Finance, Inc. v. Gen. Elec. Capital Corp., 96 F.3d 1151, 1161 (9th Cir. 1996) 17 (quotations omitted). For Statement No. 1, the Court has already found that plaintiff can pursue a 18 primary liability claim against Yuan as a maker of that statement. It is duplicative and nonsensical 19 to impose Section 20(a) secondary liability on Yuan for that statement on the theory that he 20 “directly or indirectly controlled” himself. The Section 20(a) claim is dismissed on that basis. 21 CONCLUSION 22 Plaintiff is granted leave to amend all claims dismissed by this order, and if he wishes to 23 do so, he may file an amended complaint that is consistent with this order by March 9, 2022. 24 // 25 // 26 // 27 // 1 No new claims or defendants may be added without prior approval of the Court. Plaintiff is 2 advised that further opportunities to amend are not likely to be granted. 3 IT IS SO ORDERED. 4 || Dated: February 16, 2022 5 6

JAME NATO

7 Unitedfftates District Judge 8 9 10 11 12

13

© 15 16

= 17

Z 18

19 20 21 22 23 24 25 26 27 28