Facebook and Cambridge Analytica Hearing

Mr. Shanmugam (00:00):

… representation about how the speaker formed the opinion. So too here, depending on the content of the statement, a forward-looking risk disclosure can be misleading, based on an embedded premise about the current state of-

(00:12)
… representation about how the speaker formed the opinion-

(00:14)
The justice's statement …

(00:15)
The road may be flooded if it rains.

(00:16)
So too here, depending on the content of a-

(00:19)
… simply because it rained …

(00:20)
A forward-looking risk disclosure can be misleading-

(00:22)
… a typical risk disclosure cannot be misleading-

(00:23)
… based on an embedded premise-

(00:24)
… triggering [inaudible 00:00:26]

(00:24)
… a reasonable person would draw that inference from a statement of this variety. Where a statement says, if something occurs, harm may follow from that, I don't think it's a necessary premise of that statement that the event has never occurred. And yet, that is the implication of Respondents' and the government's position, subject only to the caveat that if the omitted information is immaterial, which is, of course, a separate element, it would not qualify.

(02:57)
Now I do want to say one other thing in response to your question, which is that the context matters. This Court has made clear, most recently in Omnicare, that when you apply the reasonable investor standard, you assume that the reasonable investor is aware of the context, the regulatory framework, and so forth.

(03:13)
As we explain in our brief, these Item 105 disclosures serve a very specific purpose. They warn about the types of risks that a particular company will face in the future so that investors are on notice of the types of issues that the company might face.

Justice Thomas (03:29):

Why would you include in your 105 a past statement?

Mr. Shanmugam (03:33):

So I think Item 105 disclosures can include references to past events, and, of course, where those references are incorrect, you can have a claim for the statement being false or misleading.

(03:45)
But, to the extent that my friends on the other side and particularly the government points to the fact that there are certain examples given of breaches that have taken place in the past, we don't think that any negative inference can be drawn from that about the particular type of episode that occurred here.

(04:04)
We think that those disclosures connote breadth. They convey that there are many types of ways in which parties can access data improperly. And, again, the whole point of this disclosure is to put investors on notice that this may happen in the future.

(04:21)
And I would add one other contextual point if I could make it very quickly, which is that it's important to keep in mind that at the very beginning of the 10-K, at Joint Appendix 410, Meta warns that statements that include words like "may" are intended to identify forward-looking statements.

Justice Kagan (04:38):

So if I could give you a hypothetical, and it's a modified version of one of the hypotheticals that is in the briefs.

(04:45)
If I say to you a fire occurs at our production plant, our ability to meet our production and sales targets could be impaired, all right, and, in fact, there had been a significant fire at the production plant, completely destroying it, how does that come out on your view?

Mr. Shanmugam (05:06):

So I think, if there were no longer a production plant by virtue of the fire, that you would be contravening an implied premise of the statement, which is that the production-

Justice Kagan (05:17):

So that's what I understood your brief to say, so I'm not surprised by that. So what if instead there was a fire and it destroyed 50% of the production capacity of the plant?

Mr. Shanmugam (05:28):

So I would say no misrepresentation in that instance, and let me explain why. I think that the difference is that there is no implied representation that there have not been fires at the plant in the past. I think the only implied representation is that there is a plant. Now you can change the language-

Justice Kagan (05:49):

Well, I think that that's not really the way we communicate. I mean, if you think of the typical investor and you say in the first version of the hypothetical, yes, the typical investor would think it's kind of misleading for you to make this statement that's framed entirely in a hypothetical if, in fact, there's no more plant and no more production capacity, so too the reasonable investor is going to say, well, if there's been such substantial damage to a plant that production capacity is operating at 50% or 30% or 10%, you know, that too is going to be of interest to the investor for the exact same reason.

(06:31)
And I guess what that suggests to me is that this inquiry is more contextual than your position allows for.

Mr. Shanmugam (06:40):

Well, I think, as I indicated at the outset, that our position is the one that is sensitive to context. The wording of the statement really matters because, after all, as the Court indicated in the opinion in Omnicare, when you're engaged in this analysis, you are looking closely, if necessary, at both the language of the statement and the context.

(07:01)
And I recognize that your hypothetical gets very close to the actual edge case because you could posit an example where the factory has been so greatly damaged that it is as if the factory doesn't exist.

Justice Kagan (07:12):

Well, it was meant to be a hard hypothetical. I grant you that. But I think you could come up with a lot of those, where there's not an embedded statement of the kind that you're saying is necessary. It's like, you know, we said there's a plant and there's not a plant. It's not a black-and-white thing in that, but it is clearly misleading.

(07:32)
And when we think about these questions, we're not looking only to lies, right, or to complete false statements. We're also looking to misleading statements or misleading omissions as the case may be. And this seems the hypothetical is meant to suggest that there are a range of ways in which these forward-looking statements can be misleading as to things that have occurred in the past.

Mr. Shanmugam (08:01):

And I actually completely agree with that, and I think that our approach takes account of that context. It does require scrutiny of the statement.

(08:10)
I would submit that the other side's approach does not. And let me at least describe what I understand the other side's approach to be, and Mr. Russell and Mr. Barber can explain if I'm incorrect about this.

(08:22)
I understand their position to be that whenever you have an if/then statement of this variety, which is a pretty paradigmatic form of statement in a risk disclosure, that the if carries with it an implied representation that the specified triggering event has not previously occurred, subject only to the caveat that it has to be material.

(08:44)
Now let me explain why I think that can't be right with a tangible example. If you take a look at Meta's 10-K and the risk disclosures in that 10-K, which are voluminous, on page 441, the risk disclosure states that: Unfavorable media coverage could negatively affect our business. And that is the equivalent of an if/then statement: If we suffer unfavorable media coverage, that could negatively affect our business.

(09:07)
I don't think anyone would infer from that that Meta has never previously suffered unfavorable media coverage. And, if you read the entirety of the risk disclosures, it's sort of replete with examples like that.

Justice Jackson (09:19):

But, Mr. Shanmugam, I guess what concerns me a little bit is I don't know if your position is appreciating the fact that past occurrences, past triggering events, can still lead to future harm and that what is misleading is the suggestion, when you make your statement completely futuristic, that no such future harm is going to occur.

(09:48)
So let me give you an example that I hope will clarify this. So suppose a realtor is speaking to a potential buyer about a house, and I think there was some house examples in your briefing and he says: If crime goes up in this area, homeowners insurance could become more expensive.

(10:09)
The triggering event would be crime, and the harm would be more expensive homeowners insurance. Both of those things in the futuristic statement are happening in the future.

(10:20)
Wouldn't it be misleading to make this statement if a string of burglaries had actually happened that month? The homeowner has no way of knowing that. The realtor knows that. And, at the time the statement is made, the homeowners insurance has actually already shot up two times higher than before.

(10:41)
What I'm suggesting is it's misleading because the homeowner is making a determination of the risk of buying this property and paying a certain amount of homeowners insurance. And, when you say your statement totally futuristically, as though the burglaries never happened, they're miscalculating. They're being misled into making that calculation.

Mr. Shanmugam (11:03):

Justice Jackson, I would make three points in response to that. The first is that I don't think that that statement would be misleading because I think you have to parse carefully the language of the statement. And I think, if somebody says, if crime goes up, some consequence could occur, I think the natural implication of that is if crime goes up from where it is now. But that having been said, I want to acknowledge, I think-

Justice Jackson (11:28):

But, I mean, isn't the whole point, the whole point of these risk disclosure statements, as I think you admitted, is that the person who is hearing them is trying to determine whether there's going to be a future harm to their business investment, right? I mean, isn't that what they're doing?

Mr. Shanmugam (11:44):

I would slightly disagree with that. I think the point of these risk disclosures, as the SEC itself has made clear, is to warn prospectively about the types of risks that a company would face. And a perverse consequence of the other side's approach here is that a company could effectively penalize-

Justice Jackson (12:03):

But why? Why? But can I just ask you why? Why are you warning about the types of risks? Isn't it because the investor is trying to determine that if any of those risks happen, it's going to be a problem for the investment?

Mr. Shanmugam (12:14):

Yes, but a company is not ordinarily making any warranty about the probability of the risk occurring. And the way in which these statements are framed really bears that out.

(12:23)
Now I do want to acknowledge something that I think is underlying your hypothetical and was also underlying Justice Kagan's hypothetical.

(12:28)
In many of these cases, the omitted information is something that an investor might like to know. I think we would acknowledge that in these hypotheticals, the omitted information may be material.

(12:41)
But the problem with the other side's approach is that it really conflates materiality with falsity, and while both of those elements start from a reasonable investor, they measure very different things.

(12:52)
Materiality focuses on the omitted information, whether it is something that in this Court's words would be important to an investor's decision about whether or not to invest. I think the falsity or misleadingness inquiry focuses on the statement itself: What does the statement connote is-

Brett M. Kavanaugh (13:11):

What other disclosure requirements are out there about past events that are relevant to assessing this?

Mr. Shanmugam (13:19):

Well, there are many, many. And I do think that this Court can write an opinion that sort of draws a square around Item 105 disclosures because, while those are intended to be forward-looking, to warn about types of risks, you have Item 101, which requires a description of the business, you have Item 106, which is a very specific and recent item included in Regulation S-K to warn about cybersecurity events, and you also have Item 303, which this Court is well familiar with from the Macquarie case last spring, which is the Management Discussion & Analysis section, which requires broad disclosures about known trends and uncertainties. And I would further add-

Brett M. Kavanaugh (14:01):

So, on the 50% hypothetical, if the 50% of the plant capacity's been destroyed in the past, is there a disclosure requirement that could encompass that that's separate from the one before us?

Mr. Shanmugam (14:14):

I think it could be relevant to, for instance, the description of the business if the company talks about its facilities there. And a company also has a requirement to update, under Form 8-K, when there have been material changes to the company's business.

(14:30)
There are a panoply of these requirements, but we rely on them really simply to make the point that if the SEC ever judges that there needs to be explicit disclosures about a particular type of past or present event, the SEC has the power to promulgate all necessary and appropriate disclosure requirements.

John G. Roberts, Jr. (14:50):

That's what I-

Justice Alito (14:50):

Mr. Shanmugam-

John G. Roberts, Jr. (14:52):

… I'm having a little trouble with the question I think you're actually addressing in terms of the relationship between 105 and the rest of it. I mean, is your position basically that: Don't worry about half-truths under 105 because the basic problem is already going to be disclosed under other provisions?

Mr. Shanmugam (15:14):

That isn't our submission, Mr. Chief Justice. We certainly acknowledge that there can be circumstances in which even Item 105 disclosures can be misleading. And we agree on many of the hypotheticals that Respondents and the government set out in their briefs, primarily because those are statements that contain implied representations of one sort or another.

(15:37)
I simply want to make the point that I think the great risk of accepting Respondents' and the government's approach and upholding the Ninth Circuit's decision, which, again, is an outlier in that it requires disclosure of previous occurrences of the triggering event without any assessment of how likely the risk is to occur, I think the great danger is that it would really convert these disclosures, which, again, identify types of risks that companies face, into disclosures of laundry lists of past occurrences, which companies would presumably-

Justice Sotomayor (16:09):

Counselor-

Mr. Shanmugam (16:09):

… to have to keep updating.

Justice Sotomayor (16:10):

… you keep accusing the Ninth Circuit of an absolute rule, but I'm hearing your absolute rule. Your absolute rule is or categorical rule, you say it in your brief at page 19: "Risk disclosures under 105 make no implied representation about a company's past experiences."

(16:29)
Later, you say: "Forward-looking risk disclosures do not make any implied assertion about previous events and the present risk of harm they create."

(16:40)
So you want a different categorical rule. You say it's contextual, but the only context you're looking at is whether there's a misrepresentation, not a misleading representation. I think that's the question that Justice Kagan was asking you.

(16:57)
If you take it out, you're shaking your head yes. You're saying it has to be an explicit or implicit misrepresentation. But there's no such thing as having a misleading misrepresentation with risk disclosures. Isn't that what you're arguing?

Mr. Shanmugam (17:16):

So, Justice Sotomayor, I think no litigant before this Court likes to be accused of having a categorical rule, but let me explain to you …

Justice Sotomayor (17:23):

No, but you're smiling because I think that's what you want.

Mr. Shanmugam (17:28):

No. I don't. I think we want a rule that goes like this. I think, when you have a bare if/then statement like the statements at issue here, which essentially boil down to the proposition, if there is an episode of data misuse, Facebook may suffer harm to its business or reputation, then, in that circumstance, there is no implied representation without more about whether or not data misuse has occurred in the past. It is no different from the adverse publicity example from the 10-K or any number of other examples.

Justice Sotomayor (18:01):

Could I stop you there?

Mr. Shanmugam (18:02):

Yes.

Justice Sotomayor (18:02):

All right. Let's go to these statements, okay? I'm going to start with the one that says: If third parties or developers fail to adopt adequate data security practices, something could happen in the future.

(18:20)
But that misleading statement is omitting the critical information that Meta had failed to implement adequate practices to prevent third parties from misusing its data. It had already happened. A third party had disclosed it, failed to disclose how many millions of user information?

Mr. Shanmugam (18:47):

It's alleged to be around 30 million-

Justice Sotomayor (18:51):

And failed-

Mr. Shanmugam (18:52):

… which was in the Guardian article.

Justice Sotomayor (18:54):

And failed to destroy those records, as it represented it had. So why isn't that a misleading statement?

Mr. Shanmugam (19:01):

So several points in response to that, Justice Sotomayor, and I think it's telling that when you look at Respondents' and the government's brief, they don't even really try to identify the statements that are at issue here. They just want to talk about why the omitted information matters.

(19:14)
Let's leave that aside. I'm happy to join issue on the statements here. The statement you're referring to, which is at the bottom of page 10 of our opening brief, is identified as Statement 24 in the complaint.

(19:26)
I don't think that the claim-

Justice Sotomayor (19:27):

I don't want to look at the statements. I've read the statement the way it was stated. Let's go back to my point. Why isn't it misleading that there were no mechanisms by the third party, as you state, if they have inadequate mechanisms, X is going to happen? We know there isn't any because Facebook didn't put any in.

Mr. Shanmugam (19:54):

So I actually don't think that that is the claim the plaintiffs have been pursuing. I think that their claim is that the app developer here did not develop sufficient safeguards.

Justice Sotomayor (20:04):

Why isn't that misleading?

Mr. Shanmugam (20:05):

I think the reason that that is not misleading is because there is no representation here about what has taken place in the past. That statement, no less than the other statements on which they rely, is forward-looking.

Justice Sotomayor (20:19):

Just as-

Mr. Shanmugam (20:20):

Now it differs in one respect in that it doesn't identify specifically harm to business or reputation, but the fundamental problem with plaintiffs' theory as to this statement is that the episode of data misuse that they're complaining about was in the public domain at the time. So their claim has to be-

Justice Sotomayor (20:37):

That has to go-

Mr. Shanmugam (20:37):

… something more than that-

Justice Sotomayor (20:38):

… to materiality. That's a different issue. That's not what we granted cert on.

Mr. Shanmugam (20:42):

Well, they can't possibly pursue a claim in a case where the alleged omitted information was in the public domain, whether you locate that in the materiality element or somewhere else. And that's precisely why their claim has to be that our statement had to contain something more than simply a disclosure about the data misuse that was already in the public domain.

(21:03)
And my question for the other side is: What is the something more that they think this statement should have contained that was not already in the public domain at that time?

Neil M. Gorsuch (21:11):

Mr. Shanmugam, I just want to see if I've got it, okay, where you're coming from at least, okay? A highly reticulated regulatory system, Item 105 is about risk factors and it's necessarily forward-looking. Companies typically do if/then statements. That's generally okay, you would say. Like opinions, got it, Omnicare. Unless there's some sort of affirmative representation about a fact in the world that's wrong. Is that the gist of your view?

Mr. Shanmugam (21:44):

It is. And to pick up on Justice Sotomayor's-

Neil M. Gorsuch (21:46):

And let me just continue before you pivot back to Justice Sotomayor, which I want you to do too, but to take Justice Kagan's hypothetical, which we're all concerned about, right, the 50%, would that be in your view possibly required by other provisions like Item 101, which requires information material to an understanding of the general development of the business?

Mr. Shanmugam (22:14):

Yes. It could be already required. And if it isn't the SEC could-

Neil M. Gorsuch (22:18):

And Item 303, which requires a disclosure of known trends or uncertainties that have had or that are reasonably likely to have a material impact?

Mr. Shanmugam (22:28):

Yes, it could be required by Item 303 as well.

Neil M. Gorsuch (22:32):

And 106 as well, which is specific to cybersecurity problems?

Mr. Shanmugam (22:36):

Yes, but doesn't, I think, by everyone's admission, sweep as broadly as to cover what took place here.

Neil M. Gorsuch (22:40):

But we don't have any of those provisions before us. This is a 105.

Mr. Shanmugam (22:44):

It is. And I do think that the Court could write an opinion that makes clear that the context here is a limiting factor on the rule, which is to say that precisely because Item 105 disclosures are forward-looking, a reasonable investor, familiar with that regulatory framework, would understand that, as Meta warned here, these statements make no representations about the past. And I do think, and the reason I wanted to pivot to Justice Sotomayor-

Neil M. Gorsuch (23:09):

Pivot away.

Mr. Shanmugam (23:10):

Was just to add the important caveat that you can change this statement pretty easily to render it misleading. If the statement had said Meta has never experienced an episode of data misuse involving its users, but if it did, it would do harm to Meta's business or reputation, of course, in that context, the statement would be false or misleading if there had been an episode in the past.

(23:34)
And I do want to say that the Court took this case to resolve a circuit conflict here, and there are basically sort of three options.

(23:42)
Our view is that a statement of this variety, as Justice Gorsuch just set out, is ordinarily forward-looking, the condition does not ordinarily contain an implied representation about what took place in the past.

(23:55)
The Ninth Circuit went all the way in the other direction and the Ninth Circuit said, if a triggering event has taken place in the past, the statement can be false or misleading regardless of whether or not the risk has materialized.

(24:06)
The circuits in the middle say that if the risk is certain or virtually certain to occur, a statement can be false or misleading in that circumstance. On these facts, we would not be liable even under that test, which was essentially the preexisting test in the Ninth Circuit before the court relaxed it.

John G. Roberts, Jr. (24:24):

Thank you, counsel. Justice Thomas?

Justice Thomas (24:27):

You said that the risk factors are necessarily forward-looking. Is that a regulatory or a statutory requirement?

Mr. Shanmugam (24:38):

So I think that the regulation makes quite clear that what you are warning about is factors that could render an investment in the company speculative or risky. That is in the language of Item 105 itself.

(24:55)
Now that having been said, there can be circumstances in which a company could include in an Item 105 disclosure something about the past or present state of affairs. And the government points to the fact that there was a time when an earlier version of Item 105 required at least some disclosures of that variety. That's all well and good. As I indicated in response to Justices Gorsuch and Sotomayor, a company could choose to do that and run the risk of being held liable.

(25:25)
My point is simply that if a company does not do that in the statement at issue, it cannot be liable for securities fraud based on some categorical implied representation that the specified event had never occurred in the past.

John G. Roberts, Jr. (25:40):

Justice Alito?

Justice Alito (25:41):

Well, isn't it the case that an evaluation of risks is always forward-looking? Isn't it inherently forward-looking? When you want to know about what risk you face, you want to know what your risk is in the future, right?

Mr. Shanmugam (25:57):

It is, and that is essentially what underlies

Mr. Shanmugam (26:00):

… lies our argument here. I would submit that where I think the Ninth Circuit went off the rails a little bit is that it seemed to conflate the risk of the ultimate harm with the risk of the conditional triggering event occurring.

Justice Alito (26:13):

I think the intuition is that a statement that simply blandly says that there's a possibility of a risk can, in context, be extremely misleading if there is a high probability of the risk materializing. I think that is the intuition. The fact that something has happened in the past very often sheds light on the risk of a recurrence. If you analyze the reason why the thing happened in the past, you may realize that this reason persists, and therefore it's predictable that the same thing may happen in the past. But the mere fact that something happened in the past doesn't necessarily tell you what the risk is, going forward. Do you disagree with any of that?

Mr. Shanmugam (27:02):

Justice Alito, I think that that is the intuition that supports the circuits that have adopted the so-called virtual certainty rule. The notion that if you warn that a risk is possible, but in fact the harm is certain or almost certain to materialize, that there comes a point at which it feels as if the statement is misleading. Now, here, precisely because we know that no harm occurred from the initial misuse of the data by Cambridge Analytica, this is an easy case, even under that standard.

Justice Alito (27:33):

What if, all right, let's take the hypothetical about the risk of a fire. And let's say that there was a fire, it was a damaging fire, and an analysis of the reason why the fire started was that all the wiring in the plant is obsolete and eventually has to be replaced, but it can't be replaced for the next six months. So, it shows there that there is a substantial risk of the recurrence of a fire. On the other hand, if there was a fire, and it was caused by the fact that the factory was hit by a piece of space junk that fell out of the sky, the fact that that happened doesn't really tell you much more about the probability that you're going to have another fire based on objects falling out of space. So, what do we do with that situation?

Mr. Shanmugam (28:26):

So, I would say two things about that situation. The first is that if you have a statement that simply says, "There may be a risk of a fire occurring at our facility", I don't think that that statement would be misleading simply because there's a modest increase in the probability of that happening because of some factor or another. I think the circuits that have adopted the certainty or virtual certainty standard have done so precisely because all you're saying is there's a possibility of this happening. If there is a certainty of it happening, then the statement starts to feel misleading.

(29:01)
But the other thing I would say, and again, I think this is very important, is that here we're talking about these sorts of if-then statements. If something occurs, then there may be harm to the company's business or reputation. What you're really warning about in that circumstance, I would submit, is the ultimate harm to business or reputation. So, if you're applying a standard like the virtual certainty standard, I think the argument that the other side is making is, if you had an episode of data misuse and you were aware of it at the time, that if it is highly likely that there is going to be harm to your business, then that statement is misleading.

Justice Alito (29:37):

Thank you.

Mr. Shanmugam (29:38):

And the problem is that that doesn't work out on these facts.

John G. Roberts, Jr. (29:41):

Justice Sotomayor? Justice Kagan?

Justice Kagan (29:45):

So, this is very much meant to follow up on Justice Alito's questions. My first note is that in this statement, Facebook actually does have various kinds of statements about what has happened in the past. It doesn't talk about Cambridge Analytica, but it does talk about other things. It says there have been hacking incidents in the past, hacking is a real problem, and we've experienced it. And if you had left that out, I think that you would have every right to stand up there and say, "Who could really think that our statement says that there aren't hacking incidents in the past?" So, you put in a bunch of stuff that nobody could accuse you of just omitting, because who could think that?

(30:34)
But now, say that there's an extraordinary release of confidential data, and let's make it even more extraordinary in this case, because if we make it this case, you'll tell me, "This was known already, and it really wasn't so bad." But just imagine that every user of Facebook had all their confidential data released in some way to a third party, who then put it on the open market. So, really quite an extraordinary mishap. And just as Justice Alito says, the reason why people want to know about that in assessing risks going forward is because it says something about the company's vulnerabilities. It might say something about operational problems at the company. It might say something about management issues at the company. "How does a company allow that to happen? I better go find out." So, why wouldn't that be required here? Whatever anything else requires, whatever other requirements there are, this requirement, which is supposed to give people an understanding of future risks, an investor needs to know that, doesn't she?

Mr. Shanmugam (31:49):

Yeah, so I would say two things in response to that, Justice Kagan. The first is that, again, with regard to the examples that were given, I think we would acknowledge that there could be a case in which you might draw a negative inference from something that a company said about what took place in the past. Again, it's a contextual analysis that depends on the nature of the statements. But here I think it's quite clear that the examples that were being given were precisely that: they were examples of the types of efforts improperly to obtain Facebook user data that had occurred in the past, and a reasonable investor, I would submit, would not have been misled by that to believe that no third party had ever gained access to user data or misused that data through other means.

(32:31)
But second, to respond to the second half of your question, of course there could be situations in which omitted information would really be of interest to a reasonable investor. That goes to materiality. And yet, it is a fundamental principle that this court has articulated in cases like Matrix and Macquarie that that is not enough, at least for 10b liability, where there cannot be pure omissions liability. There is pure omissions liability under other provisions of the securities laws, but not 10b, which is, of course, enforceable by private investors. And what is the problem that this court would be creating if it went as far as the Ninth Circuit? It would be the problem of creating a regime where a company would be penalized for disclosing about the very risk that eventually materializes.

Justice Kagan (33:14):

Thank you.

Neil M. Gorsuch (33:15):

Just do-

John G. Roberts, Jr. (33:15):

Yeah.

Neil M. Gorsuch (33:18):

Thank you, Chief. Mr. Shanmugam, so, you'd agree, though, an if-then statement can be misleading, and materially possibly so, if it understates the risk going forward, the probability of it?

Mr. Shanmugam (33:31):

I think only under the virtual certainty standard.

Neil M. Gorsuch (33:35):

Yeah.

Mr. Shanmugam (33:36):

But not-

Neil M. Gorsuch (33:36):

Do you object to that-

Mr. Shanmugam (33:38):

… under the standard we are advanced.

Neil M. Gorsuch (33:38):

I got that.

Mr. Shanmugam (33:39):

I think under that standard-

Neil M. Gorsuch (33:39):

Do we need to decide the difference between what you're advocating and the virtual certainty, what you're calling the virtual certainty standard? Is that necessary to decision here?

Mr. Shanmugam (33:47):

I think that this court could write an opinion that says simply that the Ninth Circuit's rule, as we understand it, and as the Ninth Circuit set out at pages 24A and 25A of the Petition Appendix, cannot be correct, that it cannot be sufficient to render a statement misleading simply that the specified triggering event has previously occurred in the past without an assessment of the risk of harm. The other side comes back and says, "It's implicit that if it's immaterial, that it would fall outside that rule." But our submission is that's not what the Ninth Circuit was really doing here. The Ninth Circuit was just saying, "If you have a previous occurrence, the falsity requirement is satisfied."

(34:29)
The court could leave for another day the delta between our proposed test and the virtual certainty test, because I think the virtual certainty test creates an exception in circumstances where, again, the risk of harm is certain or virtually certain to materialize. Defendants often prevail under that standard. We certainly think this court should ideally provide guidance and resolve the circuit conflict here definitively. But if the court wanted to say, "We're not going to decide between those two standards", it just doesn't matter on these facts.

Neil M. Gorsuch (34:59):

Thank you.

John G. Roberts, Jr. (35:01):

Justice Kavanaugh?

Brett M. Kavanaugh (35:02):

A couple questions on the risk factors. As I understand it, you don't have to identify the probability of the event occurring. Correct?

Mr. Shanmugam (35:12):

And companies typically don't. If a company said it is highly unlikely that an episode of data misuse is going to materialize, then all of these things would be put into play. Perhaps not surprisingly, companies don't make warranties of that [inaudible 00:35:27]-

Brett M. Kavanaugh (35:27):

Because if they did that, and as Justice Gorsuch said, they understated the risks, then they would be-

Mr. Shanmugam (35:32):

Correct. In Justice Alito's hypothetical, if you include a language that goes to how probable it is, then you're going to have a problem if you have information that goes to that probability.

Brett M. Kavanaugh (35:44):

Right. And second, the SEC, I think you're acknowledging, could adopt a regulation that says what it currently says about risk factors and, added, and by the way, if you're identifying possible future events that could create harm, you also need to identify if those events have occurred in the past.

Mr. Shanmugam (36:05):

And what's funny about this, Justice Kavanaugh-

Brett M. Kavanaugh (36:06):

Is that a yes?

Mr. Shanmugam (36:07):

Yes.

Brett M. Kavanaugh (36:08):

Okay. Okay.

Mr. Shanmugam (36:09):

And the SEC did not do that when it promulgated Item 106 just last year. It did not include episodes of data misuse in what had to be disclosed. And indeed, the SEC shied away from requiring elaborate disclosures about previous occurrences precisely because companies complained about the burden that that would impose.

Brett M. Kavanaugh (36:28):

Thank you.

John G. Roberts, Jr. (36:30):

Mrs. Barrett?

Amy Coney Barrett (36:30):

So, Mr. Shanmugam, you said that this is about context and about the regulatory context, but it seems to me, based on a lot of the hypotheticals that you've gotten and the ones written in the briefs, that it's about more than just the regulatory context, but also about the context of the business, the nature of the risk, et cetera, which makes it not easily susceptible to a categorical rule. Let's just say Justice Gorsuch was asking you to articulate where the line might be. It's hard for me to see why we would adopt the virtual certainty test when it's nobody's first choice, and it seems like the kind of bright line rule that maybe the SEC might want to adopt, that sort of thing, but it's hard for me to see why we would do that.

(37:08)
Assume that I think the Ninth Circuit's rule goes too far, and I think your rule goes too far. It seems to me very hard to articulate what the line is, and maybe I can put it this way. It seems like the hardest hypotheticals are the ones where the risks are either unusual or devastating, like a 50% loss of a factory because of a fire, or getting hit by space junk. Those are things that are unusual and hard, but nobody would think that a social media company wouldn't be at risk of data breaches or that data breaches hadn't happened in the past. Or if you're a food supply chain, E. coli outbreaks in spinach, that sort of thing.

(37:50)
If things are going to recur, and there are things you associate with the business, and they're described at a relatively high level of generality, seems to me that those kinds of statements, maybe those do seem like they're general statements just about the category of risk that a particular kind of business faces. But if they are more unusual, kind of either-or binary choices, make or break the business, well then those really seem like they're misleading. So, if I see it that way, how do I articulate a rule that handles anything more than the case in front of us? Maybe I shouldn't.

Mr. Shanmugam (38:22):

Sure. Justice Barrett, I think what I would say is that I would grant that I think there are circumstances in which a reasonable investor may have an intuition that something has taken place in the past. The example that I gave earlier, I think, falls into that category. Nobody would think that a company as big as Meta had never suffered unfavorable publicity. And I would submit that if we're talking about data misuse and the like, I think most people would assume that there have been episodes of that variety in the past.

(38:52)
I think what you may be reacting to here is the sense that sometimes there are events that seem so significant that it feels as if there ought to be an obligation to disclose them. And maybe the unusual events fall into that category, because those are perhaps likely to be events that are really, really significant. Our point is simply that that goes to materiality first and foremost. And again, I think part of the problem with the other side's approach is that it really conflates these elements that are meant to be different. The language of Rule 10b-5 itself makes clear that omission has to be both material on its own terms and necessary in order to avoid rendering the statement [inaudible 00:39:35].

Amy Coney Barrett (39:34):

I think some of the hypotheticals that you're getting show that not everybody shares that intuition, that materiality is the only thing at stake, that it can also be misleading. Depending on how specific the risk is, people probably have different intuitions that fall along a spectrum. So, if I'm resisting, I feel like you're still advocating for your categorical-

Mr. Shanmugam (39:55):

All right, so let me offer the important caveat, which is where I started the argument, which is the caveat that we really drew from this court's opinion on Omnicare, which is that implied representations, I think, can take care of many of these circumstances. And we acknowledge in our reply brief that, for instance, a statement can have an implied representation about the current state of affairs. Take the final exam example. If I fail one of my finals this semester, I may have to retake a class. I think there, there's an implied representation. You're talking about your finals this semester, and if you failed one of them, that statement is then false or misleading. It is because there is an implied representation that we think is absent from a statement of this variety.

(40:40)
And I think the court can write an opinion that is mindful of the language of this statement, but recognizing that the reason there's a circuit conflict is that companies use this form of formulation quite frequently. And so, in some sense, the court is deciding it for a category of types of statements, but if the wording changes, the analysis is going to be different.

John G. Roberts, Jr. (41:02):

Justice Jackson?

Justice Jackson (41:03):

So, I have two questions that are kind of similar. I think that what is bugging me about your view is that you seem to suggest that the only implied misrepresentation or implied representation that matters is a statement that falsely suggests that something didn't happen in the past, when it actually did. You've said that many times. But I'm wondering whether there isn't also a statement about what needs to happen in the future from the investor's perspective, so that when you say, "If this kind of data breach happens, it could damage Facebook's business", the investor thinks, "Okay, so if I invest in this business now, I'm going to have to start looking out for signs of this kind of data breach happening in the future. I'm going to be focused on that aspect of the research, as I try to figure out this investment." You're sort of throwing him off the scent of the fact that what he really needs to do is figure out what harms are going to arise from the data breach that has already occurred.

(42:13)
This is similar to Justice Kagan's point about how an investor uses the information, they're looking for vulnerabilities in the company, et cetera. And so I'm just nervous about the suggestion that the only representation that's being made in a futuristic statement is one that relates to the past, as opposed to a possible statement about the future, in the way that I've described.

Mr. Shanmugam (42:43):

So, I'd make two points about that, Justice Jackson. The first is that I think it's important to look at Item 105. And one of the things that Item 105 requires is that the risk that you're disclosing be a material risk. In other words, it's got to be something that is reasonably likely to arise. And so I actually think if you had, for instance, the example of our factory being hit by a meteor, that's something that you would probably not have to disclose.

Justice Jackson (43:11):

No, no, but it's already occurred. In all the hypotheticals that I'm talking about, it's 100%, let's say, that there's going to be harm from this, because it's happened.

Mr. Shanmugam (43:21):

And in some sense my point is that precisely because it has to be material, I think a reasonable investor would think, "This is something that is a very real risk. It may have happened in the past, it could happen in the future." And I think that that is an important-

Justice Jackson (43:34):

No, I guess my question is why aren't you making a statement, with your purely futuristic formulation, that leads the reasonable investor to believe that no harm of this nature is going to happen right now? Right now. I have to wait. So, in my real estate example, the person is… When the real estate agent says, "If crime goes up, home insurance rates might go up." The investor says, "Okay, I'm going to start looking at crime reports, because if this were to happen in the future, then fine, this risk will materialize." What he doesn't know is that crime has already gone up, crime has already gone up, and that really tomorrow, the insurance rates are going to go up. And what I'm suggesting is that you've misled him into thinking that he has to wait for a future triggering event, as opposed to he has to do what he needs to mitigate the harm that will already happen, as a result of the past triggering event.

Mr. Shanmugam (44:39):

Yes, and I think we would draw a line between a circumstance in which the harm has currently materialized, in other words, the harm is ongoing, and therefore will exist in the future; and a circumstance in which there is simply a present risk of harm, whether from a past event or a future event. I think if there is merely a risk, there would be no liability, because that risk is precisely what you're warning of, and you're not making any warranty about whether the triggering event has occurred in the past.

(45:06)
And the last thing I would say is that I really do think it's a question for my friends on the other side what they think the statements here should have said, because it seems clear that they think it should have said something more than that there was the initial episode of misuse which was already in the public domain. And I think that the answer to that question will point up just how expansive and broad the implied representation, really, the warranty is-

Justice Jackson (45:33):

Thank you.

Mr. Shanmugam (45:34):

… that they think every statement includes.

John G. Roberts, Jr. (45:36):

Thank you, Counsel. Mr. Russell?

Kevin Russell (45:43):

Mr. Chief Justice, may it please the court, I'd like to start by making clear our position. First, as to the actual question presented, we agree that a risk disclosure is not misleading because it omits disclosure of an event that is immaterial, because it risks no business harm. The Ninth Circuit did not hold otherwise. Second, we agree that in addition to proving materiality, plaintiffs must also show that the risk statement implies that the omitted event did not occur. We don't claim that every risk statement includes that implication. Our position is simply that they can and frequently do, and it ultimately depends on the facts and context of each case.

(46:20)
Third, for that reason, the court should reject Facebook's categorical rule that Item 105 statements are always agnostic about whether the risk has transpired in the past. Facebook admits that if a student tells his parents that there's a risk he may fail an exam when he's already done so, that is misleading because it implies it's impossible that he won't, when that isn't true. The same is true of many risk factor statements, including the ones at issue in this case, stating that describing an improper disclosure of user data as a hypothetical risk implied that it was possible it wouldn't occur, and that wasn't possible, because it already had. This does not mean that issuers must disclose every material occurrence of a risk. They simply must say enough to remove the false impression that the omitted event has not yet materialized, something they generally can do, as Facebook did here with respect to hacking, by simply acknowledging that the risk has materialized in the past.

(47:16)
Finally, the Ninth Circuit did not adopt any contrary categorical rule. The court did not discuss whether these particular statements were agnostic about the past, because Facebook never argued that they were. It elected instead to argue only that the warrant of risks had not transpired, because it viewed the warrant of risks as speaking only to hacking events and business harm. Because Facebook does not challenge the Ninth Circuit's fact-bound rejection of those claims in this court, this court should provide any necessary guidance for future cases in the course of affirming the judgment. I welcome the court's questions.

Justice Thomas (47:48):

Mr. Russell, what else should Facebook have provided in the 105 statement to comply with 10b?

Kevin Russell (47:57):

So, I think they could have said what they said, and then said something like, " Such improper disclosure or misuse of user data has occurred in the past, including recently on a substantial scale." I think that would've removed any misimpression that an event like what happened in Cambridge Analytica hadn't occurred. And the reason that it is reasonable for somebody to think that this statement implies that it hadn't occurred is because an investor, reasonable investor, hearing a company describe factors that make the investment risky, would expect that if something like this had happened, 30 million users' private data released, eventually causing $100 billion reduction in the market capitalization of the company, that the company who was intent on telling the whole truth about the factors that make the investment risky would not speak about such things-

John G. Roberts, Jr. (48:47):

Mr. Russell?

Kevin Russell (48:47):

… in categorical terms.

Justice Thomas (48:48):

I'm sorry, Chief?

John G. Roberts, Jr. (48:49):

Yeah. Your basic submission is that a probabilistic statement about something carries the inference that something has not occurred?

Kevin Russell (49:01):

No, our position is that it can. It wasn't always.

John G. Roberts, Jr. (49:04):

Okay, it can.

Kevin Russell (49:04):

Yes.

John G. Roberts, Jr. (49:04):

But with respect to certainly some, but maybe most, a probabilistic statement will do the exact opposite. For example, if you're leaving my house, and I say, "You might slip on the steps." You wouldn't say, "That's never happened before."

Kevin Russell (49:23):

That's right.

John G. Roberts, Jr. (49:23):

Your inference would be that has happened, and that's why I'm giving you the warning. And it seems to me if you're saying it can go one way in some cases, it can go another way in the other cases, it's a real expansion of the disclosure obligation. In other words, it's not something that is narrow, because whether it's happened or not, you have to disclose it.

Kevin Russell (49:47):

No.

John G. Roberts, Jr. (49:48):

Exactly. How are we supposed to parse whether it's slipping on my steps, or what you say is the actionable in this case?

Kevin Russell (49:58):

I think you simply have to do what the court says you have to do in omission cases and Omnicare, which is you always have to ask how would a reasonable person understand the implications of this sentence? And if it is a case where somebody would understand that the warrant of risk is something that happens all the time, or you'd only be talking about it if it happened in the past, if it's an event like adverse publicity, that everybody knows has happened in the past, nobody's going to understand the statement would be implying that it hadn't happened.

Neil M. Gorsuch (50:24):

Mr. Russell… I'm sorry, Chief.

John G. Roberts, Jr. (50:25):

I was just going to follow up. So, basically if you have this and the suit is brought, you say, "The inference either has happened in the past or it hasn't happened in the past. And we're going to go to trial to decide that." It seems to me that's kind of a blank check.

Kevin Russell (50:43):

No, you treat it the way you do every omissions case. You can enter summary judgment or enter motion dismissive, no reasonable juror could find that this statement implied that the event hadn't happened in the past. In this case, there are at least four reasons why it would be reasonable for a jury to decide that this particular set of statements did. The first is the structure, which, it is the received wisdom of many courts, in many contexts, over many years, can and often does imply that speaking of something in a hypothetical term implies that it hasn't happened. But the context of this case reinforces that here, because here we are not talking about something like adverse publicity, which people would know happens all the time.

Neil M. Gorsuch (51:21):

Mr. Russell, on that, so I just want to make sure, there seems to be a point of agreement not only on the question actually presented, but that forward-looking risk factor statements don't generally imply anything. There has to be some implied representation about a past fact for you to get in the door. Is that right? Is that common ground?

Kevin Russell (51:44):

I don't know that I would agree on that generally. I think we do agree that it's context dependent, and sometimes it does, and sometimes it doesn't.

Neil M. Gorsuch (51:52):

But it depends upon an implied representation that there is no problem in the past?

Kevin Russell (51:56):

Yes.

Neil M. Gorsuch (51:57):

Okay. We agree on that, everybody seems to. You guys

Neil M. Gorsuch (52:00):

… guys agree on that, at least. What about the statement we have here? I want some help with that, because I wonder whether we're in the world of a meteorite or Justice Alito's falling debris, or whether we're in the Chief Justice's world of slip and fall on my front porch. The defendant represented that, "our industry is prone to cyber attacks." It says that, "Hacking has become more prevalent in our industry," and it says, "We cannot assure you that the measures we have will provide absolute security." Given those kinds of warnings, where's the implied representation that Meta has never had a significant data breach?

Kevin Russell (52:46):

Because Meta itself insisted vehemently, below and in public, when this was finally disclosed in 2018, that this was not a hacking event. This was not a cybersecurity event. And the risk disclosures discuss separately the risk of misappropriation of user data by developers. And in that context, it doesn't say any of the things that you just read.

Neil M. Gorsuch (53:06):

Yeah, well, that's the next paragraph. And it does say that, "We provide limited information. However, if they fail to adopt or adhere to adequate data security practices or in the event of a breach of their networks," you're going to have a problem. So again, where's the implied representation that this hasn't happened in the past? And isn't this exactly the sort of thing that a reasonable investor does know can happen to large companies with-

Kevin Russell (53:35):

I respectfully disagree.

Neil M. Gorsuch (53:36):

I mean, the federal government. I mean, I think China probably has all of our FBI files. I mean, data breaches are part of our lives these days.

Kevin Russell (53:44):

But this wasn't a data breach, and this is really important. That was a principal argument that Facebook made below that these statements only warned about data breaches, and the Ninth Circuit rejected that reading. And the reason for that is because, unlike a hacking event, unlike what China does, here, Facebook allowed a third-party developer… It just gave them the data. And that doesn't happen, Justice Barrett, all the time. Actually, before the disclosures in this case, reasonable investors would've thought that it never happened, and particularly on this scale.

(54:14)
And Facebook had faced allegations of this in December of 2015 and it didn't respond by saying, "Yeah, that happened and we took care of it." It said, "We have to conduct an investigation, and if we do, we will take swift action." And by the time they issued this report in 2016, they hadn't said boo about this. And so in that context, I think it is very reasonable for investors to understand that by treating it as simply something that may happen in the future, they are confirming what their silence had already conveyed, which is that that we didn't substantiate the allegations in the 2015 article.

Amy Coney Barrett (54:51):

So you're saying that it is unusual, because you're saying it wasn't a data breach, it was Facebook/Meta just handing over the data. You're saying it falls more in the category of a factory half burning to the ground, something that we wouldn't necessarily expect because you would've trusted Meta not to hand it over. Is that what you're saying?

Kevin Russell (55:09):

That's right, and that's why users were so angry when they found out about this.

Justice Sotomayor (55:13):

And they found out with the data without any real controls; isn't that right? Isn't that the allegation?

Kevin Russell (55:17):

Right. This episode showed not only that they had given this away in this one instance, but that they didn't have the capability to keep their promises to users that users can control who has access to their private data.

Amy Coney Barrett (55:32):

Mr. Russell, can I just ask you one other question? Justice Gorsuch and the Chief too were trying to pin you down on exactly what you think about these if-then statements or these statements of risk, and you agreed that sometimes they might be purely forward-looking, right?

Kevin Russell (55:47):

Yes.

Amy Coney Barrett (55:48):

And you said, "But they can contain implied representations." And I think Mr. Shanmugam's position is that ordinarily they don't, and is yours that they ordinarily do?

Kevin Russell (56:00):

I think that may be a fair representation. That is the received wisdom from all these courts and all these cases in all these contexts. But at the end of the day, I'm not sure that it's helpful or necessary to say whether they ordinarily do or they ordinarily don't. At the end of the day, each case has to be considered on its facts.

Brett M. Kavanaugh (56:15):

Doesn't that raise what for me is a separation of powers or due process concern? The SEC knows how to write regulations that require disclosure of past events. As we've discussed, they have those kinds of regulations. And what happens here is this regulation does not explicitly require that. Then the question is, okay, why not let the SEC do that if they want to? Then we have this regulation, and you say, "Sometimes it does, sometimes it doesn't," in response to Justice Barrett and the Chief. And you said it can sometimes contain an implied representation. If you're the regulated party, you don't have fair notice, one could say, of what you're required to do. It's guesswork about when you're required to disclose. And you're going to therefore, another problem that they raise, and I just want you to respond to all this, that you're going to just over-disclose that and that's going to defeat the whole purpose of it.

(57:14)
So I guess the starting point is, why not let the SEC do this if they want to? Isn't there a notice problem when you do it this way? And doesn't that in turn lead to over-disclosures, which undermines the whole theory here?

Kevin Russell (57:27):

I think the premise of the question and a major premise of the other side's argument is that item 105 is directed at disclosing only things that might happen in the future, and that's just wrong. The text of the regulation says-

Brett M. Kavanaugh (57:40):

I'm sorry to interrupt. I just want to get this one point out and you can keep going. A lot of SEC regulations do specifically require disclosure of things in the past, correct?

Kevin Russell (57:48):

Correct. And they also require-

Brett M. Kavanaugh (57:50):

And this doesn't explicitly do that. Keep going, though. Sorry to interrupt.

Kevin Russell (57:53):

A lot of regulations require things to be disclosed about the past and the future. Most of them do both. And so I don't think you can draw any inference about what this regulation is intended to do just from that fact. But you can look at the regulatory language which requires disclosure of factors that make the investment risky, and the fact that there's been a recent misappropriation of 30 million users' private data that is a ticking time bomb that's going to cause $100 billion in damage to the company down the line is a factor that makes investment in the company risky.

Justice Alito (58:26):

That is an argument that seems to me different from the one that I thought was presented by the question. There can be a situation in which an event has happened in the past, a big data breach, and the company knows that this thing that happened in the past is going to have a continuing effect, that it does not have to be a recurrence. So the similar event, we're talking about the damage from the past event which continues to have an effect. That's different from the situation in which something happened in the past, it's a discrete event, it's over, but there's concern that there's a real risk that it's going to happen in the future.

Kevin Russell (59:08):

I think that's right. I think-

Justice Alito (59:09):

I thought we took the case to decide the second question, not this first question. And that may be the one that fits best with the facts of the case, but I see those two things as quite different.

Kevin Russell (59:22):

Well, but I was trying to make the more generic point that simply that item 105 is not limited to requiring disclosures about things that may happen in the future. And you can get that from the regulatory language. You get it from the fact that Facebook itself disclosed facts, including the prior occurrence of hacking, and it does so, and with respect to a bunch of other things. My point is simply that nobody who reads these things, I think, will think that a risk factor statement that expressly discusses past events that is intended to inform people about factors that make the investment risky, which can incur past events, who know that the prior versions of the regulation instructed people, that gave examples of past events, is going to think this is only talking about the future.

Justice Alito (01:00:06):

Let me give you these two situations. This is what most troubles me about your argument, although as I tried to bring out in questioning Mr. Shanmugam, I see problems with his as well. Let's go back to the fire example. Suppose the company does an internal, has an inspector come in, the inspector examines the factory and says, "Your wiring has got to be replaced, but it can't be done in less than six months and that there is an X percentage chance that there's going to be a fire in your factory in the next year." And they say in answering the 10K, "If there is a fire, there may be a significant disruption of our operations." Do they have to disclose that internal report and say, "We know that there is an X percent chance that a fire is going to occur?"

Kevin Russell (01:01:01):

So I think possibly yes, but this is actually the real virtual certainty rule. So this is where something is misleading, not because it's already happened in the past, but because you are not disclosing something that's virtually certain to happen in the future.

Justice Alito (01:01:14):

Well, it's not virtually certain. There's a certain percentage. Let's say it's a 15% chance.

Kevin Russell (01:01:19):

Well, I think if the statement is understood to imply that there hasn't been a fire in the past, that's our case, that is our claim here, and that would be misleading without regard-

Justice Alito (01:01:28):

Well, the statement is, " If there is a fire, there will be a substantial disruption of our operations."

Kevin Russell (01:01:35):

I think if there has been a fire-

Justice Alito (01:01:36):

It doesn't say, "If there has been." If there is a fire.

Kevin Russell (01:01:39):

I understand. I understand that. But a reasonable investor I think could read that as saying we wouldn't be talking about fires in hypothetical terms. If there had recently been one, that calls into question the safety of the entire facility.

Justice Alito (01:01:53):

If it calls into question the safety of the facility, if the X is high enough, if the probability of it happening is high enough. But if there was a fire in the past because of a meteorite, that doesn't say anything about the probability. It doesn't increase the infinitesimally low probability of it happening in the future.

Kevin Russell (01:02:16):

I think I agree with that. I think that event would probably be deemed immaterial to investors because it doesn't augur harm to the business going forward. That's the opposite of this case.

Justice Alito (01:02:23):

I'll tell you where this is going and I'll let you go. Unless there's a requirement to quantify in some way the nature of the risk, whether in numerical terms or in descriptive terms, there's a very high risk, there's a high risk, a moderate risk, whatever, then I don't see the basis. I see that to be inconsistent with the idea that the occurrence of an event in the future which highlights the potential for the materialization of the risk in the future has to be disclosed. I don't really see a difference between those two.

Kevin Russell (01:03:00):

Well, I don't think that a company is entitled to mislead people about something that occurred in the past that under basic would be a material event just because it has an assessment that it's not going to happen again. It's up to the investors to make that judgment themselves, to value the company based on their own assessment, once they are put on notice that this is actually something that happened in the past.

Justice Alito (01:03:22):

Thank you.

Justice Jackson (01:03:23):

So is that why you're sticking with that it has to be a statement that would cause a listener to infer a fact about the past is untrue? I'm with Justice Alito in trying to understand the probability of risk and whether a statement can also be misleading if it would lead to an inference that the risk of future harm is zero or very low when the speaker knows it to be much greater than that? Why isn't that another kind of misleadingness that we should be thinking about or that the SEC was thinking about?

Kevin Russell (01:03:57):

I don't dispute that that is another kind of harm and another way in which a statement could be misleading. I'm simply saying that this case is not about that. Our theory of liability is that this monumentally important event happened in the past, and Facebook misled people into thinking that it hadn't.

Justice Jackson (01:04:13):

Okay.

Justice Sotomayor (01:04:21):

I thought when Justice Alito put into his two hypotheticals or asked which of these two situations, something happened and it has continuing risk, or something happened, no risk, but something like it might happen in the future, this situation presents both, doesn't it?

Kevin Russell (01:04:41):

Sorry. I may have misunderstood the hypothetical there.

Justice Sotomayor (01:04:44):

That's all right. Go ahead.

Kevin Russell (01:04:46):

I do think that the reason it was so devastating to be misled about this occurrence is both, that people were going to be really mad when they found out about it, which is what happened when they did, and that [inaudible 01:05:01] other risks about Facebook's inability to control outside developers access to private user data. But the ultimate question here I think is simply whether there is a categorical rule that these statements are never or always contain that kind of implication. I think everybody agrees that that's not the case. It's always case-dependent. It's always fact-specific. And so then I think what's left for the court in this case is to ask, did the Ninth Circuit held something different? And-

Justice Sotomayor (01:05:33):

Thank you.

Kevin Russell (01:05:33):

… are you going to decide the facts of this particular case and whether these particular statements are misleading? I'm happy to talk about why they're not. We haven't focused on that question because we took it to court to take the case to decide the general legal question.

John G. Roberts, Jr. (01:05:46):

Thank you. Justice Thomas?

Justice Thomas (01:05:49):

This case, as Mr. Shanmugan indicated, is about falsity. And so at what point do we analyze that? The event took place, the misuse, in 2015?

Kevin Russell (01:06:08):

Yeah.

Justice Thomas (01:06:11):

And the statement was when?

Kevin Russell (01:06:13):

The statement was in the 2016 annual report.

Justice Thomas (01:06:15):

So do we just look at that period to determine whether or not the statement is false? Because you've made a big issue of the materiality part, and the harm that later on they find out in this full disclosure that you got a $100 billion loss, 30 million people's data has been disclosed, et cetera. So at what point do we analyze the falsity?

Kevin Russell (01:06:48):

I think at the point that they made the statement. And so we acknowledged that if the event had happened so long ago that it was immaterial, there would be no liability. But here-

Justice Thomas (01:06:56):

But we're not talking about materiality at this point.

Kevin Russell (01:07:00):

I think it would be false if they were to imply… There's an interrelationship between these two. Somebody reading a statement that is intended to put you on notice of risks to the business, what would make the investment risky, is not going to read the statement as implying anything about immaterial events. And so if the event-

Justice Thomas (01:07:18):

So how do you know in 2016 whether or not it was going to have the later effect of $100 billion in market cap drop long-list?

Kevin Russell (01:07:30):

So I think two things about that. One is I do think what actually happened is probative at the least of what was foreseeable at the time. And I think Facebook acknowledged in its warning statements that misuse of this kind could seriously damage the business. And it's only intuitive that it would because user data is the lifeblood of the company. And if somebody gives away your user data that you think is private, people are going to be really angry about that, as they were.

Justice Thomas (01:07:57):

I understand all of that. But when we're analyzing this for falsity, none of that comes into play.

Kevin Russell (01:08:04):

Only to the extent, I think, that you would not understand a statement to imply the non-occurrence of an immaterial event. And so once you understand that this is a material event, I agree that how material it is doesn't go to falsity, the question is did this happen or not?

Justice Thomas (01:08:18):

Yeah. And finally, what role does the fact that this is at the motion to dismiss stage play in our analysis?

Kevin Russell (01:08:28):

The question here I think is not what's the best reading of these particular statements. It is whether we have plausibly alleged that a reasonable jury can conclude that these statements falsely implied that the omitted event had not occurred. That's the question that Facebook is going to have plenty of opportunity later in the case to argue at summary judgment or to a jury what a reasonable person understood these statements to imply. But in Omnicare, this court correctly acknowledged that what statements imply is a question that is principally of fact, for the fact-finder, and it necessarily makes these kinds of cases a little bit messy. It doesn't provide the clarity that some issuers might like.

John G. Roberts, Jr. (01:09:11):

Justice Alito? Justice Sotomayor? Justice Gorsuch, any-

Brett M. Kavanaugh (01:09:18):

I just want to clarify, in response to Justice Sotomayor and Justice Alito, exactly what you think the question is before us. I thought the question was, in a situation where you disclose the risk of an event occurring in the future that could cause harm, is that statement false because you don't disclose that that same event had happened in the past, even though the harm from that event in the past is over?

Kevin Russell (01:09:50):

That is the question presented on that question, which is very different than what we've been talking about all morning. We agree that the answer is no. It is not misleading to omit the occurrence of an event that is immaterial because it risks no business harm. And in this case, that is not this case.

Brett M. Kavanaugh (01:10:09):

Okay, I'll read the transcript on that. Okay. And then the second thing, on Justice Thomas's point, just to put the real world into this for a second, getting past the motion to dismiss is just the game, right?

Kevin Russell (01:10:28):

I don't think so. A lot of these cases go to summary judgment. We've collected a number of cases in which-

Brett M. Kavanaugh (01:10:33):

It's a big part of the system-

Kevin Russell (01:10:34):

It is big and it is important.

Brett M. Kavanaugh (01:10:37):

I'm just stating this. It's not just, "Oh, it can all be resolved at summary judgment." There's a huge issue at stake just getting past the motion to dismiss in a lot of these cases. I think everyone-

Kevin Russell (01:10:50):

No, I acknowledge that, but I think at the end of the day, the question here is whether these statements are capable of implying that an event like this hasn't occurred in the past. And if the answer is they are, then I don't think any policy argument in the world will justify saying that they aren't. And if this court adopts a categorical rule saying statements of this kind are agnostic as a categorical rule about what happened in the past, then I think you are effectively saying that some statements that actually are misleading are not, that they're not actionable. And that, we respectfully suggest, is the office of a safe harbor, which Congress authorized the SEC, not the courts, to develop.

Brett M. Kavanaugh (01:11:30):

Okay. Thank you for your answers. Appreciate it.

John G. Roberts, Jr. (01:11:33):

Justice Barrett? Justice Jackson?

Justice Jackson (01:11:34):

Just to quickly clarify your response to Justice Kavanaugh, it's your view that this past event did present a risk of future business harm?

Kevin Russell (01:11:45):

Yes.

Justice Jackson (01:11:45):

Is that right?

Kevin Russell (01:11:45):

That is right.

Justice Jackson (01:11:46):

And so that's why you think their question presented doesn't accurately capture what was going on, because they suggest that it doesn't.

Kevin Russell (01:11:54):

Right. And the only reason that Facebook has ever given why the misappropriation of 30 million users' private data didn't risk business harm, didn't risk people being really mad when it finally came out, is their claim that the public learned the truth in 2015 and didn't care.

Justice Jackson (01:12:12):

Thank you.

John G. Roberts, Jr. (01:12:12):

Thank you, Counsel. Mr. Barber?

Mr. Barber (01:12:21):

Mr. Chief Justice, and may it please the court, petitioners ask this court to immunize from fraud liability risk factor statements that misleadingly depict a risk as hypothetical when it has already materialized. That argument is flawed as a matter of law and common sense. Indeed, petitioners now appear to recognize that a risk statement can implicitly misrepresent the past. That is exactly what Facebook's statements did here. There's been some discussion about the question presented and the extent to which it accurately captures what the court of appeals held. We agree with respondents that it does not, given the obvious importance of the Cambridge Analytica matter to Facebook's business, which depended so heavily on user data. The court of appeals had no occasion to hold that the nondisclosure of an unimportant event renders a risk statement misleading. That's why petitioners have raised the broader argument that a risk statement categorically implies nothing about the past. This court rejected a very similar argument in the Omnicare case and it should take the same course here. I welcome the court's questions.

Justice Thomas (01:13:26):

Mr. Shanmugan said that you should have the burden of saying exactly what else they should have said to meet the requirements of 105 and 10B.

Mr. Barber (01:13:41):

I don't think that's respondents' burden, but I do think that respondents gave a good answer to that question, which is Facebook should have said at least that they had experienced a significant episode of misappropriation of user data. That would've avoided the misleading impression left by the statements that they did make here.

Justice Thomas (01:13:59):

Was it considered significant in 2016 when they filed the statement, the 105 statement?

Mr. Barber (01:14:09):

Yes. I think it certainly was considered significant based on the actions that Facebook took, emailing Cambridge Analytica quite quickly after determining that its policies had been violated, directing them to delete the data. I think Facebook was, at least on the allegations of this complaint, highly aware of the great risk to its business that was posed by this episode.

John G. Roberts, Jr. (01:14:30):

And do you agree with Mr. Russell that a probabilistic statement sometimes implies that the event hadn't occurred and sometimes implied that the event had occurred?

Mr. Barber (01:14:47):

I do, and I think to the Chief Justice's question earlier, I agree with respondents that these kinds of matters are not susceptible to bright line rules. That goes for falsity, that goes for materiality. And it would be foreign to the common law of fraud and this court's securities law of jurisprudence to impose the kind of bright line, I don't want to call it categorical, but bright line rule that petitioners seem to be advancing. It depends on the particular statement, the particular kind of risk under discussion.

John G. Roberts, Jr. (01:15:16):

Well, in such a complicated scenario of that sort, sometimes it's yes, sometimes no. It depends on the particular context. That does seem something that your client, the Securities and Exchange Commission, might want to exercise its expertise with respect to it. Instead, as I think was suggested earlier, that this is a good case where the court can provide a lot of guidance on how you should apply these things. Are you concerned about that, that we may not do as good a job as the SEC?

Mr. Barber (01:15:49):

I think as long as you confine yourself to what respondents have suggested the court hold, which is a statement like this is misleading on this theory only insofar as it implicitly misrepresents that the relevant event has not already occurred, and then the past event that did occur has to be material. If the court so held, I think that would be fine. The SEC could always say more about this, provide more guidance, but that will be true in any kind of case involving a half-truth.

Justice Alito (01:16:17):

Well, under what circumstances does a statement that is framed like this, "If X event occurs, then our business will be hurt." Under what circumstances does the statement that is framed like that imply that the event is not going to happen?

Mr. Barber (01:16:38):

When the relevant risk is something that any reasonable person would expect to have occurred and would've expected the company to confront in the past, then you wouldn't have that kind of implication.

Justice Alito (01:16:49):

Well, it is a false implication. If the risk of the thing happening in the past is more than some quantity, it's more than X. It has to be more than X in order for a statement like that to be misleading.

Mr. Barber (01:17:08):

Are you positing that that's what the statement itself says?

Justice Alito (01:17:11):

I'm positing that the statement says exactly what I said it says. It says that if there is a fire in the plant, our operations will be disrupted. It's framed like that. Under what circumstances is that misleading?

Mr. Barber (01:17:25):

I think that would be misleading if the company, the manufacturer, had recently suffered a significant fire that would be implicitly interpreted as in conflict with the representation that the issuer was making.

Justice Alito (01:17:40):

Okay. Well, I don't want to dwell on things that fall out of the sky, but what about the situation where the fire is caused by something that's utterly freakish? A meteorite fell out of the sky, or some crazy person who was hearing voices decided that that person was going to go throw

Speaker 1 (01:18:00):

… throw a Molotov cocktail in the window of this plant.

Mr. Barber (01:18:04):

I don't know if the source of the fire in particular matters. If the company is warning a risk of fire may affect our business negatively, and then a devastating fire had just affected the business and had these serious implications for the business's ability to compete going forward, I think that could well be misleading.

Speaker 1 (01:18:24):

Even in those situations it's caused by a meteorite or it's caused by the crazy Molotov cocktail thrower, you would say you've got to disclose that because a reasonable investor would want to know-

Mr. Barber (01:18:35):

A reasonable invest-

Speaker 1 (01:18:36):

… because the investor would think the place is haunted or it's cursed, because this happened in the past.

Justice Kagan (01:18:42):

Well, isn't what the reasonable investor would want to know in that situation… And I agree these are two different situations, but in that situation, what the reasonable investor would want to know is that there wasn't any plant. No matter what had caused the fact that there wasn't any plant, there wasn't any plant, so there wasn't going to be any output, so there wasn't going to be any business.

Speaker 1 (01:19:01):

Well, what I'm talking about, it doesn't wipe out the plant. It causes a certain amount of damage, and that's brought under control.

Justice Kagan (01:19:09):

No, so still, what the reasonable investor would want to know is that we enjoy this sometimes.

Speaker 1 (01:19:16):

Please, only sometimes.

Justice Kagan (01:19:20):

Is that 50% of the capacity had been wiped out, right?

Speaker 1 (01:19:23):

Right. Now there are other cases where what the reasonable investor would want to know is, oh my gosh, there appears to be insufficient inadequate management operational controls, such that the same thing could happen again. And so those are two different hypotheticals, but I imagine your view would be an either event if a reasonable investor might want to know that and the hypothetical statement might suggest the contrary of what is true.

Mr. Barber (01:19:59):

Right. My only point is that if you have a statement like our business is at risk of fire, and if that happens, our business would be negatively affected in all these ways, that can reasonably lead the implicit representation that the business had not just suffered a significant fire

Speaker 2 (01:20:15):

Mr. Barber, on that,-

Mr. Barber (01:20:17):

Yes.

Speaker 2 (01:20:19):

… it does seem to me we're talking about two totally different things, risks in the future and damages from the past. And if we're talking about damages from the past, how is that a risk factor that's clearly covered by 105, as opposed to something that should be disclosed perhaps in 101 or 303, first of all. And second of all, if you want to cram in risks from past events into 105, why would we do that, given the adoption of 106 which addresses these kinds of very problems and doesn't require that?

Mr. Barber (01:20:55):

So a few things on that. Justice Gorsuch, we agree with respondents that item 105 is not limited in its text to the disclosure of future events and future risks. Facebook's own practices, as you can see in the 10K at issue here, are consistent with that. The entire 10K is reproduced in volume two of the joint appendix, and literally every section of it, or I think almost every section includes discussion of some past event, some present condition. So item 105 is not limited to those kinds of future looking disclosures. Item 106 did emphasize for issuers, and this was promulgated well after the events in this case, and after the 10K was filed here, it emphasized that issuers do sometimes have to disclose past cybersecurity incidents. That doesn't mean that there's never any obligation to discuss past events under item 105 when necessary to avoid a misleading impression in the statements that are made.

Speaker 2 (01:21:50):

What do you say to the 101 and 303?

Mr. Barber (01:21:53):

I think the kind of disclosure that needed to happen here was much more at home in the risk factors section than in those sections. So 303 is about the management discussion and analysis-

Speaker 2 (01:22:04):

No trends and uncertainties that have had have had a material unfavorable impact. That would seem, to me, a heartland case for some destruction of some portion of your facility, whether due to fire or meteorites, or both, and 101 information material to an understanding of the general development of the business.

Mr. Barber (01:22:29):

Yes. I'm not saying that the information would be inappropriate in those sections. I just think it's very telling that if you look, for example, at Facebook's first 10K after the news really came out in March, 2018, they discussed the Cambridge analytic episode in multiple locations of that 10K. it was all in the risk factors section. I think it was predominantly in the risk factors section. So this is where investors do look for this kind of information. So I think that's an important fact. Another great example is in the actual 10K that was filed, and if you look at page 464 of the joint appendix, they specifically disclosed having discovered a bug in one of their algorithms in late 2015, which is exactly the time when they discovered the Cambridge Analytica matter.

Speaker 3 (01:23:10):

Thank you, counsel. Justice Thomas. Justice Sotomayor.

Justice Sotomayor (01:23:15):

Listening to Justice Gorsuch go through 101 and 103, and they seem even less precise than what Justice Kavanaugh was seeking for the SG to do. It seems like both are asking for the SEC to anticipate every potential risk for any type of company, and then spell out what they have to say. You can't do that. So point out to what in 105, what in the language of 105 suggest that it covers this?

Mr. Barber (01:23:55):

Sure. So item 105 speaks to material factors that render an investment in the offering or the registrant, risky or speculative. So I think it's perfectly natural to say that not only the potential future occurrence of incidents like cyber Cambridge Analytica would be such a material factor, but also-

Justice Sotomayor (01:24:18):

This wasn't a cyber attack, as respondents said.

Mr. Barber (01:24:20):

Correct.

Justice Sotomayor (01:24:21):

This was misused by a user who was given permission-

Mr. Barber (01:24:25):

Correct.

Justice Sotomayor (01:24:26):

… by Meta. Okay, go ahead.

Mr. Barber (01:24:27):

Correct. So I think this kind of event is comfortably encompassed by the language of item 105. We're not saying they had to get into the specifics of Cambridge Analytica, but they at least had to acknowledge that events of this nature had previously occurred in order to avoid leaving the kind of misleading impression that was left here. And I don't think, as Your Honor was suggesting, there's no basis in this court's case law for the idea that the SEC has to specifically lay out the particular kind of half truths that a disclosure may make to the investing public in order for those to be actionable under rule 10b5.

Justice Sotomayor (01:25:05):

Or exactly what won't previously.

Mr. Barber (01:25:10):

Right. The fact that the elements of this cause of action require what a reasonable investor would think, that is enough of a protection, so I don't think there's any kind of fair notice issue here.

Justice Sotomayor (01:25:20):

In terms of this question, you say it fits, and I agree with you under 105 because what they knew they had a 30 million user misuse. They knew that it had not been erased by the company. And when they saw Cambridge's assurances that they had destroyed the data, they were told nothing. So they knew there was a risk to their reputation at that point.

Mr. Barber (01:25:49):

Yes. The way we know that this belonged under item 105 is that the very risk statement that was rendered misleading by the omission of this information was made in the risk factor section of the 10K.

Justice Sotomayor (01:26:01):

Thank you.

Speaker 3 (01:26:02):

Justice Kate.

Justice Kagan (01:26:04):

I thought that Justice Alito, one of the questions he was interested in, and if not, I'll just say I'm interested in it, is how do we know when it is that you have to put in these past events. And you and Mr. Russell have said you don't have to put in anything that's not material

Mr. Barber (01:26:25):

Correct.

Justice Kagan (01:26:26):

But as to things that are material, you don't seem to be imposing any higher bar. In other words, that seems to be your only dividing line. Is it material or is it not? And I guess maybe this goes back to Justice Barrett's question too. Is there some higher standard that we might use in this area to prevent a mass of cases that are perhaps less viable, less meritorious than this one might be thought?

Mr. Barber (01:26:58):

Yes, but I think that bar is what we've been discussing, which is the need to show not just that the omitted fact is material, but that the omission rendered the affirmative statement that's made misleading because the statement implicitly misrepresents that the event never occurred. I think that's a requirement with real teeth. Because if you have a statement say that is phrased in very general terms, like our business may struggle with users trusting us in the year ahead, that may harm our business because we depend on ad revenue, that kind of general statement is much less likely to lead a reasonable investor to think anything in particular about the past occurrence of misappropriation of user data. The problem with the statements here is that they were reasonably specific and they were talking about a specific category of risk, which invites the reasonable investor to think no significant episode of that kind of risk has already materialized.

(01:27:54)
So I think it's a real limit on our position, and I think the court could well make that clear that you have to look at the generality of the statement. If the statement does acknowledge that events of this kind have occurred, even if you don't get into the specifics of the relevant event, it's going to avoid the kind of misleading impression that could otherwise be left. So it's not just materiality.

Justice Kagan (01:28:15):

Thank you

Speaker 3 (01:28:16):

Mr. Gorsuch.

Speaker 2 (01:28:17):

Sorry to prolong this, but to what extent does that incentivize companies to just be more general in their disclosures? You said if they raise it up a level of generality, it's less likely to be misleading, so they're going to have more useless disclosures potentially out of this. Is the SEC concerned about that? Our ad revenue might be harmed if our reputation's at risk from anything we do.

Mr. Barber (01:28:47):

I don't think that that's a major concern for us just because this has been the law. For example, in the 9th Circuit since at least 2008, the Burson case, we haven't seen this kind of danger arise. That's Facebook's home circuit, and they provided a lot of very helpful detailed risk factor statements in the relevant 10K at issue here.

Speaker 2 (01:29:05):

But now they may not.

Mr. Barber (01:29:07):

Well, that is the kind of issue that I think the SEC is well equipped to deal with. If that were to result from affirming the court of appeal of judgment, then the SEC could look at that. It's tinkered with item 105 before to change the standard for what needs to be disclosed, and it could well do so again. Yes.

Speaker 3 (01:29:26):

Justice Kavanaugh.

Brett M. Kavanaugh (01:29:27):

You said there's no fair notice issue here. I guess because I'm not really seeing that, because all the hypotheticals have illustrated a lot of uncertainty about when the company would be required to disclose and why not, but that blends back into the question I raised earlier in the chief race, which is why can't the SEC just write a rag? It's very simple. I think to add to 105, something like when the company discloses the risk of a future event that could cause harm, also disclose any past occurrences of that event. Could the SEC do that?

Mr. Barber (01:30:08):

The SEC could always be clearer in this regard, and maybe it could someday, but I don't think the SEC feels that it hasn't already [inaudible 01:30:16]

Brett M. Kavanaugh (01:30:15):

Why does the judiciary have to walk the plank on this and answer that question when the SEC could do it with all the uncertainty and all the hypotheticals that have arisen, which in turn, at least as I see it, just speaking for myself, raises a lot of questions for companies about what they have to disclose and what they don't. And they're, of course, going forward, looking backward, they're going to be stuck with liability. Going forward, they're just going to disclose everything, and which defeats the whole, at least as I understand, the whole purpose.

Mr. Barber (01:30:45):

Right.

Brett M. Kavanaugh (01:30:45):

So attack any one of those premises or that you want.

Mr. Barber (01:30:48):

So Justice Kavanaugh, a few things on that. I think one of the signs of a weak policy argument is that you could make it in either direction equally. You could equally argue that issuers will be disincentivized, kind of what Justice Gorsuch was getting at, they'd be disincentivized to make risk disclosures because of fear of liability. The likeliest scenario here is that risk disclosures would remain about the same length. Issuers would just be a little bit more careful about disclosing past materializations of the risk. I think the SEC did write the regulations that it needed to write here, writing item 105, writing rule 10b5, writing rule 12b20, saying that not only do you have to disclose the things that are directly required to be disclosed by regulation SK, but you also have to disclose whatever else is necessary to avoid those statements being misleading. That is enough. This court… This is a bread and butter half truth case. In half truth cases, this court and other courts don't constantly ask, has the SEC or has the regulator directly said that this kind of falsity is required or is prohibited? And to that point as well-

Brett M. Kavanaugh (01:31:55):

Well, I guess the problem there, and last question, sorry, but there's not one reasonable person… Reasonable people have different views about whether the lack of disclosure of the past event occurring makes the current statement misleading. You're going to get wildly different answers as you've heard from the questions from the nine of us. So that's the concern.

Mr. Barber (01:32:19):

I appreciate that. I think I would go back to the Omnicare case again and just say in that case, the court said whenever you have a provision that prohibits half-truths, not just outright lies, you're going to have some uncertainty, and it's not going to be completely cut and dried. That was a case involving a provision that's strict liability, section 11 of the Securities Act. Here, we have a provision that requires [inaudible 01:32:39]. The PSLRA requires strong pleading, strong inference of [inaudible 01:32:45]. So that's another protection against limitless liability of the kind petitioners fear.

Brett M. Kavanaugh (01:32:49):

Okay. Thank you very much.

Mr. Barber (01:32:51):

Thank you

Speaker 3 (01:32:51):

Mrs. Barrett.

Amy Coney Barrett (01:32:53):

Mr. Barber. Think I heard you tell Justice Gorsuch that your position has been the settled law. Did I hear you correctly?

Mr. Barber (01:33:00):

Yes. In the 9th Circuit, it has for many years

Amy Coney Barrett (01:33:04):

Outside of the 9th Circuit? What I'm getting at is I'm wondering how your position differs from the virtual certainty test that several other circuits apply. Is it different?

Mr. Barber (01:33:13):

Well, so I think that the problem with that, Justice Barrett is that the other circuits don't apply the virtual certainty rule in the way that petitioners say they do. What the other circuits say, what most circuits say is a risk statement can be false or misleading if either, A, the risk has already materialized, which is our case, or B, the risk hasn't materialized, but it's a virtually certain to do so. And that's fine. I don't think anybody has a quarrel with that, at least for purposes of this case. What petitioners are saying is that the virtual certainty rule says even in that category, A, this kind of case, the statement is only misleading if the undisclosed past event is virtually certain to harm the business. That's wrong. I don't think any circuit applies that rule. There's one case from the 10th Circuit that if you look at the end of the relevant section of the court's opinion, it's the Indiana public retirement case, the court does seem to apply it that way, and we think that's wrong.

(01:34:11)
But even above that, in that opinion, the court describes the rule correctly, the way I just described it. The problem with the virtual certainty rule as petitioners imagine it, is that it would distort the materiality standard because it's never been thought that the omission of a particular fact is only actionable if it's virtually certain to harm the business. The standard under this court's cases is, would a reasonable person view the information as significantly altering the total mix of information bearing on the investment decision?

Amy Coney Barrett (01:34:40):

Does the government's position differ from the virtual certainty rule as it already exists? As it exists, you're saying that Mr. Shanmugam has mischaracterized what the virtual certainty rule requires. But as the law actually exists as you described it, does the SEC's position differ from that? Would we be shifting the law? If we go your way, do those circuits now have it wrong?

Mr. Barber (01:35:05):

I don't think we have a firm position on that for purposes of this case because, again, we're not in that second category of cases where we're just dealing with a potential future event and the likelihood of it, given the fact that, as has been discussed, item 105 doesn't require specific quantification of the risk, you don't need to say like 70% or whatever, then probably in most cases, to show that that is false based on the understatement of the risk, you would probably have to show something like virtual certainty to actually make that actionable.

Amy Coney Barrett (01:35:36):

Okay, thank you

Speaker 3 (01:35:37):

Justice Jackson.

Justice Jackson (01:35:38):

So I think what's a little tough for your position is that I don't know that this is a bread and butter half-truth case, as you've said, because I would think that a bread-and-butter half-truth case exists against the backdrop of a duty to disclose the information. And what petitioner says is there is no standalone obligation to talk about past events, and it's not rendered misleading if we have this purely futuristic statement. So it seems to me to be different than the standard Half-truth. And the way I'm thinking that it might still trigger liability is that it becomes potentially misleading in a continuing harm scenario, the kind that Justice Alito keeps pointing to, that you didn't have to say originally that this past thing happened, but if the past thing happens and before the harm completely materializes, before the harm completely happens, you have to make a disclosure statement, that maybe there's something misleading about making your statement purely futuristically in that situation because it leads investors to underestimate the risk or the potential for the future harm.

Mr. Barber (01:37:00):

So Justice Jackson, a couple of things on that. I disagree that you only have a half-truth if you're under some kind of regulatory disclosure requirement. Half-truth claims are not limited to that particular context. The reason why we're in that situation here is that if a company isn't subject to a disclosure requirement like item 105, then they don't have much incentive to go around the markets telling people how risky their investments might be in the company. So I think that's important, but I also do disagree at a second level that item 105 just doesn't ever require disclosure of past events, because what it requires disclosure of is material factors that render an investment in the company, risky or speculative, and that can readily encompass past events, present conditions, and potential future events.

Justice Jackson (01:37:47):

Thank You.

Speaker 3 (01:37:49):

Thank you, counsel.

Mr. Barber (01:37:50):

Thank you.

Speaker 3 (01:37:51):

Mr. Shanmugam, rebuttal.

Mr. Shanmugam (01:37:54):

Thank you, Mr. Chief Justice. Four points. First, let me start with respondents and the government's test. Mr. Russell said that under their test, risk disclosures can and frequently do imply something about the past. But as Justice Kagan asked, the devil is in the details. How do you determine when risk disclosures fall on that side of the line? From respondents and the government's brief, it seemed like their answer was the materiality requirement. If omitted information is important to a reasonable investor, then the risk disclosure contains an implication about that. But there are a couple of problems with that. The first is the one that we discussed in my opening argument, which is that that conflates and collapses the elements of falsity and materiality. And second, materiality really doesn't provide a great deal of protection because it is a relatively low bar. And so I think as it stands, that rule would be a categorical rule by any other name.

(01:38:48)
Now, Mr. Russell also suggested, in points of his argument, that it's really all about the intuition as to whether or not the event is of the sort that has occurred in the past. And so bad publicity would presumably fall on the side of the line of something a reasonable investor would understand has occurred in the past, and Justice Alito's meteor strike or Molotov cocktail would not, I would submit that we would prevail under such a standard because a reasonable investor would think that Facebook had suffered episodes of data misuse in the past, but I think the problem with an intuition-based test is it's not really an administrable standard, and it's not an objective one. And I would submit that it's a very difficult one for a defendant to prevail on a motion to dismiss. Most of the cases in the circuit conflict have come up on and been resolved on a motion to dismiss. And remember that we're not just dealing with the ordinary Twombly Iqbal standard here.

(01:39:41)
We're dealing with the heightened pleading standard of the PSLRA, under which both the statements themselves and the reasons why the statements are misleading must be pleaded specifically. Second, the wording of the statements here. Mr. Russell said that what we should have said was Such improper data misuse has occurred in the past, including recently on a substantial scale. The problem with that formulation is that all of that was in the public domain. This court can judge that for itself. The articles that were in the public domain before the 10K are at joint appendix 616 to six 30. It was public that millions of users data were in play as a result of what took place here. And to the extent that Mr. Russell relies on the $100 billion alleged drop in the stock price, that took place after the continued misuse became public. But it is clear that that continued misuse is no longer in the case. It was waived below. And that was for good reason because the district court said the no responsible person at Meta was aware of that continued misuse at the time of the 10K in early 2017.

(01:40:49)
What should this court do here? Well, I think that this court should write an opinion that simply says that statements like this one and others like it contain no implied representation, that the previous triggering event had never occurred. And this court should rely on the context of item 105, where I would note parenthetically, the SEC requires disclosures to be concise, not voluminous, and the court can make clear, as it did in Omnicare, that the answer naturally depends on the wording or the context in which the statement was made. So if you have a defendant that says something about the probability of the event occurring or said something like, "If this event were ever to incur," thereby implying that it had not occurred in the past, the outcome could be different.

(01:41:35)
Finally, just a word about the implications of this case. The effect of accepting either respondents or the government's position would be to hold a company liable for securities fraud, precisely because it warned of the specific risk at issue, presumably on the theory that a company failed to catalog all of the prior episodes of the event occurring. That would create a regime that is effectively a regime of omissions liability because what you would be saying is that if a company warns about a genus of risk, it is on the hook for any previous episode that has not been disclosed. That would place an onerous obligation on companies not only to disclose initially, but continually to update its risk disclosures in its quarterly reports, and it would penalize companies for doing the right thing and what item 105 requires, which is to identify risks that may affect the company's business. The 9th Circuit's formulation of the standard here cannot stand. And for that reason, we would submit its judgment should be reversed. Thank you.

Speaker 3 (01:42:37):

Thank you, counsel. The case is submitted.

Speaker 4 (01:42:42):

The Honorable Court is now adjourned until Tuesday the 12th of November at 10 o'clock.