EFiled: Feb 22 2021 07:35PM EST

Transaction ID 66344807
Case No. 2021-0156-
IN THE COURT OF CHANCERY FOR THE STATE OF DELAWARE

ELLEN F. GREENBERG, TRUSTEE OF

THE ELLEN F. GREENBERG TRUST,
Derivatively on Behalf of TWITTER, INC.,
C.A. No. ______________
Plaintiff,

v.

JACK DORSEY,

Defendant,

-and-

TWITTER, INC.,

Nominal Defendant.

VERIFIED STOCKHOLDER DERIVATIVE COMPLAINT

Plaintiff Ellen F. Greenberg, Trustee of the Ellen F. Greenberg Trust

(“Plaintiff”), by and through the undersigned attorneys, brings this action

derivatively on behalf of nominal defendant Twitter, Inc. (“Twitter” or the

“Company”), against Jack Dorsey (“Dorsey”), a member of Twitter’s Board of

Directors (“Board”) and Twitter’s Chief Executive Officer (“CEO”) for breaches of

fiduciary duties.

Except for allegations specifically pertaining to Plaintiff and Plaintiff’s own

acts, the allegations in the Complaint are based upon information and belief, which

1
includes but is not limited to: (i) Twitter’s public filings with the United States

Securities and Exchange Commission (the “SEC”); (ii) court filings in lawsuits

involving Twitter; (iii) press releases, corporate governance, and other documents

available on the Company’s website; (iv) media reports; (v) tweets; and (v) other

public sources.

NATURE OF THE ACTION

1. On July 28, 2020, Twitter announced that the Federal Trade

Commission (“FTC”) had shared with the Company a draft complaint (“July 2020

FTC Complaint”) alleging violations of a 2011 Consent Order entered into between

Twitter and the FTC (“2011 FTC Order”) as well as violations of the Federal Trade

Commission Act, 15 U.S.C. 41 et seq. (“FTC Act”)—and that Twitter expected to

pay between $150 and $250 million to resolve the FTC’s allegations.

2. These apparent violations of the 2011 FTC Order and the FTC Act

were entirely avoidable. As detailed herein, Dorsey’s self-interested commitment to

affording advertisers’ maximal access to Twitter users’ private data and his disregard

for regulatory compliance and Twitter’s own privacy policy and privacy settings

directly led to this harm to the Company. Dorsey’s self-interest stemmed from his

significant financial interest in the other company that he leads as CEO, Square Inc.

(“Square”), which benefitted wildly from this disregard for privacy.

2
 3. Accordingly, this action seeks to hold Defendant Dorsey accountable

for the hundreds of millions of dollars Twitter is expected to pay to resolve the claims

raised by the FTC, as well as other injuries to the Company arising from his failure

to appropriately protect user privacy and as a consequence of other wrongful conduct

as set forth herein.

4. Twitter was founded in 2006 by Dorsey and Williams, with Dorsey

serving as Twitter’s CEO from 2007 until 2008. In 2008, Dorsey was fired for his

failings as a manager and his lack of focus on his job in favor of other interests.

Allegedly, Williams told Dorsey, “[y]ou can either be a dressmaker or the CEO of

Twitter. But you can’t be both.” Williams replaced Dorsey as CEO.

5. After being fired from Twitter, Dorsey started Square, a company that

primarily offers “mobile payment solutions.” Dorsey controls more than 50% of

Square’s voting power and has a much larger economic interest in Square than he

has in Twitter.

6. In 2009, a hacker capitalized on Twitter’s failure to implement security

protocols for employee access to administrative accounts. After an investigation,

the FTC entered into the 2011 FTC Order with Twitter in March 2011. Among other

things, the 2011 FTC Order required Twitter to improve its cybersecurity practices

and comply with users’ preferences over the handling of their private data.

3
 7. Also, in March 2011, Dorsey orchestrated a “boardroom coup” that

replaced CEO Williams with Dorsey loyalist Dick Costolo (“Costolo”), and left

Dorsey as the undisputed leader of Twitter’s Board.

8. While Twitter grew its revenues substantially under Costolo, by 2015,

the Company was losing users to competing platforms. Accordingly, in June 2015,

Costolo resigned, and Twitter announced that Dorsey would be taking on the

interim-CEO role on a part-time basis, while keeping his CEO role at Square.

9. Thereafter, Dorsey’s leadership as CEO heralded increased access for

advertisers to Twitter users’ private information, by means of invasive and improper

tracking and harvesting of behavioral data. By increasing advertisers’ access to user

data and weakening privacy safeguards, Dorsey appears to have disregarded

Twitter’s obligations under the 2011 FTC Order and to its users. As Dorsey

permitted expansive access to Twitter’s user information, the members of Twitter’s

Board looked the other way and failed to take any action to ensure the Company’s

compliance with the 2011 FTC Order.

10. The laissez-faire attitude of Dorsey and the Board to user privacy has

resulted in Twitter’s failure as a gatekeeper of private user data. Meanwhile,

Twitter’s lax privacy protections benefitted Square by providing it with additional

user data, thereby allowing it to grow its base of users and increase its revenues.

Advertisers’ ability to target Twitter’s user base using behavioral and private user

4
data, enhanced Square’s ability to convert Twitter’s 330 million monthly average

users (users who don’t pay Twitter directly), into millions of Square and Cash App

users. (Square launched Cash App as a peer-to-peer payment mobile payment

solution to allow individual users to send money quickly, including users without a

traditional bank account). Many Square and Cash App users wind up paying Square

a percentage fee for certain popular transactions. Thus, Twitter’s lax privacy

protections afforded Dorsey the opportunity to convert many non-paying users of

Twitter, into revenue producers for his other company, Square.

11. Between January 2015 and January 2020, Square’s revenue growth

outpaced Twitter’s growth by a factor of more than ten. Square, and thus Dorsey

indirectly, benefitted substantially at Twitter’s expense, in breach of Dorsey’s duty

of loyalty.

12. As a result of the lack of concern for user privacy under Dorsey’s

leadership, Twitter has been besieged with privacy leaks and hacks of its

infrastructure. Recently, Twitter experienced two serious privacy failures: (i) a

hacker accessed a poorly secured employee administrative account to take control

over multiple high-profile user accounts in an incident echoing the 2009 incident

that led to the 2011 FTC Order; and (ii) Twitter collected user telephone numbers

for purposes of two-factor authentication, and then proceeded to sell those numbers

to advertisers in flagrant violation of user agreements and the 2011 FTC Order.

5
These breaches are alleged to have resulted in the FTC’s circulation of the July 2020

FTC Complaint and Twitter’s expected $150 to $250 million penalty.

13. On or about August 13, 2020, Plaintiff, through her counsel, sent a

letter, attached hereto as Exhibit A, to Twitter’s Board demanding, among other

things, that the Board: (i) take action against Twitter’s senior officers and directors

to seek recovery of damages caused by the Company’s disregard of its privacy

obligations; and (ii) require Dorsey to resign as CEO from either Twitter or Square

(the “Demand Letter”).

14. The Board has ignored Plaintiff’s demands for more than six months,

thus constructively denying such demands.

THE PARTIES

A. Plaintiff
15. Plaintiff Ellen F. Greenberg, Trustee of the Ellen F. Greenberg Trust is

a current Twitter stockholder and has continuously been a stockholder at all relevant

times.

B. Nominal Defendant

16. Nominal Defendant Twitter is a Delaware corporation with its principal

executive offices located at 1355 Market Street, Suite 900, San Francisco,

California. Twitter’s common shares trade on the New York Stock Exchange under

the symbol “TWTR.”

6
 C. Individual Defendant

17. Defendant Jack Dorsey is one of Twitter’s founders and has served as

Twitter’s CEO since September 2015 and as a member of Twitter’s Board since May

2007. Defendant Dorsey served as Twitter’s interim CEO from July 2015 to

September 2015 and, previously, as Twitter’s President and CEO from May 2007 to

October 2008. Defendant Dorsey served as the Chairperson of Twitter’s Board from

October 2008 to September 2015. Since February 2009, Defendant Dorsey has

served as CEO and a director of Square, the mobile-payments company he Co-

Founded and previously served on the Board of the Walt Disney Company from

December 2013 until March 2018.

D. Relevant Non-Parties

18. Patrick Pichette (“Pichette”) has served as a member of Twitter’s Board

since December 2017. Pichette is the Chair of Twitter’s Audit Committee and a

member of Twitter’s Compensation Committee. Since April 2018, Pichette has

served as a general partner at Inovia Capital, a Canadian venture capital firm.

Pichette served as Chief Financial Officer (“CFO”) of Google, LLC (“Google”)

between 2008 and 2015.

19. Jesse Cohn (“Cohn”) has served as a member of Twitter’s Board since

March 2020. He also serves as an Equity Partner and Senior Portfolio Manager, the

head of U.S. Equity Activism, and a member of the Management Committee of

7
Elliott Management Corporation (together with its subsidiaries and affiliates,

“Elliott”).

20. Egon Durban (“Durban”) has served as a member of Twitter’s Board

since March 2020. Durban is co-CEO of Silver Lake, a global private investment

firm. Mr. Durban joined Silver Lake in 1999 as a founding principal. He holds

multiple directorships including, inter alia, Dell Technologies, Learfield IMG

College, Motorola Solutions, Twitter, UFC, Unity Technologies, Verily, VMware,

and Waymo.

21. Martha Lane Fox (“Fox”) has served as a member of Twitter’s Board

since April 2016. Defendant Fox is a member of Twitter’s Audit Committee and

Nominating and Corporate Governance Committee.

22. Dr. Fei-Fei Li (“Li”) has served as a member of Twitter’s Board since

May 2020. From January 2017 to September 2018, Dr. Li was Vice President at

Google and served as Chief Scientist of AI/ML at Google Cloud.

23. Omid R. Kordestani (“Kordestani”) has served as a member of

Twitter’s Board since October 2015. He previously served as Twitter’s Executive

Chairman from October 2015 to May 2020. Kordestani received over $16 million

in compensation during his tenure as Executive Chairman. Prior to joining Twitter’s

Board, Kordestani served as Senior Vice President and Chief Business Officer at

8
Google. Previously, from May 1999 to April 2009, Mr. Kordestani served as Senior

Vice President of Global Sales and Business Development at Google.

24. Ngozi Okonjo-Iweala (“Okonjo-Iweala”) has served as a member of

Twitter’s Board since July 2018. Okonjo-Iweala is a member of Twitter’s Audit

Committee.

25. David Rosenblatt (“Rosenblatt”) has served as a member of Twitter’s

Board since December 2010. Rosenblatt is the Chair of Twitter’s Compensation

Committee and is the Chair of Twitter’s Nominating and Corporate Governance

Committee. In 2019, Rosenblatt was paid $306,081 in fees and stock awards for his

service as a director. From October 2008 to May 2009, Rosenblatt served as

President of Global Display Advertising at Google. Rosenblatt joined Google in

March 2008 in connection with Google’s acquisition of DoubleClick, Inc., a

provider of digital marketing technology and services.

26. Bret Taylor (“Taylor”) has served as a member of Twitter’s Board since

July 2016. Taylor is a member of Twitter’s Compensation Committee. Prior to June

2007, Taylor served as Group Product Manager at Google, where he co-created

Google Maps and the Google Maps API.

27. Robert Zoellick (“Zoellick”) has served as a member of Twitter’s

Board since July 2018. Zoellick is a member of Twitter’s Audit Committee and

Nominating and Corporate Governance Committee.

9
 SUBSTANTIVE ALLEGATIONS

I. BACKGROUND OF TWITTER

A. General Background

28. Created in 2006, Twitter is a self-described “global platform for public

self-expression and conversation in real time” where users can “tweet” thoughts that

other users can reply to, “like,” or “retweet” (i.e., post to their own timeline).1

Twitter is available in more than 40 languages around the world. Users can access

the service via twitter.com, on an array of mobile devices via Twitter-owned and

operated mobile applications (e.g., Twitter for iPhone and Twitter for Android), and

through text messages.

29. Twitter has grown to become a global social media platform with over

330 million total Monthly Active Users (“MAUs”) and over 186 million daily active

users, including over 36 million (20%) in the United States.2

30. Twitter is a conversational platform centered around short-form text,

image, and video content. Its users can access real-time information regarding a

1
Registration Statement on Form S-1 filed with the SEC on Oct. 03, 2013.
2
J. Clement, Twitter: Number of Monthly Active Users 2010-2019, STATISTA
(Aug. 14, 2019), https://www.statista.com/statistics/282087/number-of-monthly-
active-twitter-users/ (noting that in early 2019, Twitter averaged over 330 million
total monthly active users); Twitter, Inc., Twitter Q2 2020 Shareholder Letter (July
23, 2020) (stating that Twitter averaged over 186 million daily active users, of which
36 million (nearly 20%) were in the United States).
10
wide array of topics or news events. They can also share information and content,

interact with content, or express their reactions to other Twitter users.

31. These types of interactions allow Twitter to compile data about its

users, including their interests and their behavior, which is then licensed or utilized

by Twitter and its advertising customers to launch targeted advertisements.

32. Twitter is, at its core, an advertising medium, leveraging its audience

and employing analytics to purportedly improve and measure users’ engagement

with advertising. As of the Third Quarter (“Q3”) 2020, Twitter generated

approximately 86% of its revenue from advertising, an increase of 13.7% over Q3

2019. 3

33. Advertising revenue goes up when Twitter can maximize its number of

MAUs and demonstrates each user’s level of engagement with advertising content.

Accordingly, Twitter tries to maximize MAUs and user engagement.

34. Despite advertising revenue being central to Twitter’s business, Twitter

has persistently struggled with how to count its users and how to measures user

engagement. This was explained by an investment analyst from Oppenheimer

Holdings Inc., who lamented Twitter’s “slowing user growth, poor product

3
Quarterly Report (Form 10-Q) for September 30, 2020 (Nov. 6, 2020).
11
implementation/execution, decreasing user engagement, inferior advertising

technology, platform safety issues, and strong competition.”4

35. Indeed, Twitter previously had a policy to count fake users when

reporting user metrics to advertisers. Now, it only discloses that the “the actual

number of false or spam accounts could be higher than we have estimated.” 5

B. Dorsey’s History with Twitter [pre-2008]

36. Dorsey cofounded Twitter in 2006 and, on March 21, 2006, Dorsey was

named the Company’s CEO.6 As the founder and an avid early user of Twitter,

Dorsey often used the medium to describe his leadership philosophy:

4
Riley McDermid, Why Twitter shareholders should brace themselves for a
disappointing deal, even as high-profile suitors circle, Silicon Valley Bus. J.
(Sept. 27, 2016), https://www.bizjournals.com/sanjose/news/2016/09/27/twitter-
shareholders-bad-deal-google-disney-crm.html.
5
Current Report (Form 8-K) (Feb. 6, 2020).
6
Biography, https://www.biography.com/business-figure/jack-dorsey (last
visited Jan. 20, 2021).
12
 37. Dorsey also logged his daily activities as CEO:

38. In 2008, Twitter fired Dorsey, reportedly for being too unruly: he

worked too few hours, leaving the office early for yoga or to attend courses in

fashion design. 7 Williams, Dorsey’s successor as CEO and co-founder of Twitter,

sat down with Dorsey and said, “You can either be a dressmaker or the CEO of

Twitter. But you can't be both.” 8

C. Twitter’s Global Reach and Influence

39. With over 330 million total MAUs, advertisers understandably employ

Twitter to target and influence large swaths of users, with global companies from

7
Newsroom, Jack Dorsey: the bad boy of Silicon Valley who got Twitter off the
ground, Morning Future (Sept. 14, 2018),
https://www.morningfuture.com/en/article/2018/09/14/jack-dorsey-twitter-startup-
silicon-valley/411/.
8
Alyson Shontell, There were a lot of problems the last time Jack Dorsey was
CEO of Twitter, Bus. Insider (June 11, 2015),
https://www.businessinsider.com/jack-dorsey-twitter-ceo-last-time-2015-6.
13
Nestle to Disney each generating over 1 billion advertising impressions in the first

quarter (“Q1”) of 2020 alone. 9

40. Twitter’s influence goes beyond purchasing decisions. The platform

has been an increasingly important part of public and political discourse and affects

a range of real-world outcomes. A 2013 study found that 153 of the 193 countries

represented at the United Nations had established government Twitter accounts.

41. World leaders and their foreign ministers maintained some 1,089

Twitter handles, with their tweets able to reach a combined audience of over 620

million followers as of 2020. 10

42. Twitter is mentioned 74 times in the Mueller Report on Russia’s

interference in the 2016 election. 11

43. During June 2020 protests in Washington D.C., a hashtag #dcblackout

had begun circulating throughout Twitter, referencing a fake story that said no social

media would be accessible in the city due to the civil unrest. The hashtag had almost

one million mentions in the first few hours in circulation and, as the hashtag spread,

9
Statista, https://www.statista.com/statistics/1094351/us-twitter-advertisers-
ranked-by-impressions/ (last visited Jan. 20, 2021).
10
Twiplomacy, Twiplomacy Study 2020 (July 20, 2020),
https://twiplomacy.com/blog/twiplomacy-study-2020/.
11
Scott Galloway, TWTR: Enough Already, Medium (Dec. 9, 2019),
https://medium.com/@profgalloway/twtr-enough-already-a6a6755645c8.
14
the claims behind it became wilder—that phones and other means of communication

were being blocked and police were replacing rubber bullets with real ones. Rumors

of the “black out” later proved to be false. 12

44. Twitter’s platform has been maliciously deployed to enact wide ranging

and evolving harm. In one instance, in Veracruz, Mexico, two “Twitter Terrorists”

allegedly spread false reports of gunmen attacking schools and kidnapping

children—eliciting panic as parents scrambled to get to their children, and causing

dozens of car accidents and jamming emergency phone lines.13 A recent study by

the American Public Health Association revealed that bots and foreign government

trolls had been engaged widely to spread anti-vaccination messaging on Twitter,

with hard-to-measure public health impacts, including reportedly increased vaccine

hesitancy and delay.14 A recent private study discovered newly evolved forms of

malware using Tweets to deploy harmful instructions to infected computers—the

12
Dara Kerr & Shara Tibken, Amid George Floyd Protests, weaponized
misinformation floods social media, Cnet (Jun. 16, 2020),
https://www.cnet.com/news/amid-george-floyd-protests-social-media-is-
weaponizing-misinformation/.
13
Emily Banks, “Twitter Terrorists” Could Get 30 Years In Prison, Mashable
(Sept. 4, 2011), https://mashable.com/2011/09/04/twitter-terrorists/.
14
David A. Broniatowski et al., Weaponized Health Communication: Twitter
Bots and Russian Trolls Amplify the Vaccine Debate, 108 Am. J. of Public
Health 1378 (Oct. 1, 2018).
15
malware listens for commands from a Twitter account run by the malware operator

employing “steganography” to hide commands within Twitter meme images—

considered by researchers to be a potential proof-of-concept for future attacks.15

45. Dorsey acknowledges the seriousness of the issues Twitter faces, noting

that, “We have seen abuse, we have seen harassment, we have seen manipulation,

automation, human coordination, misinformation,” and recognizing that Twitter had

created a “pretty terrible situation.”16 “Right now the system makes it super easy to

harass and abuse others,” Dorsey further stated. 17

II. SECURITY AND PRIVACY AT TWITTER

46. Security or privacy breaches at Twitter endanger the safety and

security of individual users and increase risks of harms ranging from data theft to

national security intrusions.

15
Zack Whittaker, New malware pulls its instructions from code hidden in
memes posted in Twitter, Tech Crunch (Dec. 17, 2018),
https://techcrunch.com/2018/12/17/malware-commands-code-twitter-hidden-
memes/.
16
Aria Bendix, Jack Dorsey Says Twitter Makes It ‘Super Easy’ to Harass and
Abuse Others, Entrepreneur (Apr. 17, 2019),
https://www.entrepreneur.com/article/332408.
17
Id.
16
 47. In 2017, Twitter’s General Counsel acknowledged that, “[s]haring

private information on the platform could pose serious safety and security risks.” 18

A. In 2009, Hackers Exposed Twitter’s Utter Failure to Implement

Basic Security and Privacy Measures

48. As discussed extensively herein, Twitter collects certain information

from its users that it makes public, and also collects non-public user information.

Using privacy settings, Twitter allows its users to choose which of their information

may be shared with whom, and Twitter has a privacy policy which obligates Twitter

to protect user privacy.

49. From approximately July 2006 until July 2009, nearly every Twitter

employee had credentials that would allow them the ability to “exercise

administrative control” over the entire Twitter network, including the ability to

access individual accounts and all of the public and private information included

therein. In order for Twitter’s employees to access this system, an employee would

merely enter their username and a password (which was not required to be complex)

into Twitter’s public website. The account would not lock-down, even after multiple

wrong password guesses.

18
Social Media Influence in the 2016 U.S. Elections: Hearing Before the S.
Select Comm. On Intelligence, 115th Congress (2017) (Questions for the Record),
https://www.intelligence.senate.gov/sites/default/files/documents/Twitter%20Resp
onse%20to%20Committee%20QFRs.pdf.
17
 50. On or about January 4, 2009, an 18 year-old hacker gained access to

Twitter’s administrative control panel, “by pointing an automated password-

guesser” at an employee’s account, which guessed the employee’s weak password,

“happiness.”19 The hacker was then able to share login information for certain,

prominent, public figures, including Barack Obama and Fox News.

51. Four months later, on or about April 27, 2009, another intruder gained

access to an employee’s Twitter administrative password and was able to (and did)

use that control to access user accounts.

52. The FTC subsequently undertook an investigation of these events.

B. The 2011 FTC Order

53. On June 24, 2010, an eleven-month FTC investigation culminated in a

Complaint against Twitter. 20 The FTC charged Twitter with deceiving consumers

and putting their privacy at risk by failing to safeguard their personal information.21

19
Kim Zetter, Weak Password Brings ‘Happiness’ to Twitter Hacker, Wired
(Jan. 6, 2009), https://www.wired.com/2009/01/professed-twitt/.
20
Kim Hart, Twitter settles FTC charges, Politico (Jun. 24, 2020),
https://www.politico.com/story/2010/06/twitter-settles-ftc-charges-038974.
21
Press Release, FTC, Twitter Settles Charges that it Failed to Protect
Consumers’ Personal Information; Company Will Establish Independently Audited

18
The agency released the news of Twitter’s agreement to settle the action,

simultaneously with the public filing of the 2010 Complaint.22 The 2010 Complaint

included extensive discussion of the January 4, 2009 and April 2009 hacking

incidents, and alleged that “Twitter engaged in a number of practices that . . . failed

to provide reasonable and appropriate security to: prevent unauthorized access to

nonpublic user information and honor the privacy choices exercised by its users in

designating certain tweets as nonpublic.”

54. The March 2011 FTC Order created an affirmative obligation for

Twitter to enforce its own privacy policy and abide by user privacy settings.23 It

required Twitter not to “misrepresent in any manner, expressly or by implication,

the extent to which respondent maintains and protects the security, privacy,

confidentiality, or integrity of any nonpublic consumer information, including

… misrepresentations related to its security measures to: (a) prevent unauthorized

Information Security Program (June 24, 2010), https://www.ftc.gov/news-

events/press-releases/2010/06/twitter-settles-charges-it-failed-protect-consumers-
personal; Complaint, In re Twitter, Inc., No. 0923093 (F.T.C. 2010),
https://www.ftc.gov/sites/default/files/documents/cases/2010/06/100624twittercmp
t.pdf (“2010 Complaint”).
22
Id.
23
Press Release, FTC, FTC Accepts Final Settlement with Twitter for Failure to
Safeguard Personal Information (Mar. 11, 2011), https://www.ftc.gov/news-
events/press-releases/2011/03/ftc-accepts-final-settlement-twitter-failure-
safeguard-personal.
19
access to nonpublic consumer information; or (b) honor the privacy choices

exercised by users.”

55. The 2011 FTC Order further ordered Twitter to establish and maintain

a comprehensive information security program designed to protect the security,

privacy, confidentiality, and integrity of non-public consumer information. The

Order obliged Twitter to implement and document “administrative, technical, and

physical safeguards appropriate to respondent’s size and complexity.”

56. In the years following the 2011 FTC Order, Twitter suffered multiple

large-scale hacks, each with significant privacy implications, including a 2012

incident in which thousands of usernames and passwords were breached,24 and 2013

incidents in which a substantial number of Twitter passwords were stolen.25 These

incidents should have further reinforced to Dorsey and the Board the need to take

significant additional steps to remain in compliance with the 2011 FTC Order.

24
Cass Jones, Twitter says 250,000 accounts have been hacked in security
breach, The Guardian (Feb. 1, 2013),
https://www.theguardian.com/technology/2013/feb/02/twitter-hacked-accounts-
reset-security.
25
Jose Pagliery, 2 Million Facebook, Gmail, and Twitter passwords stolen in
massive attack, CNN (Dec. 4, 2013),
https://money.cnn.com/2013/12/04/technology/security/passwords-stolen/.
20
 C. FTC Issued Guidelines that Emerged in Part from Twitter’s “Lax
Practices”

57. In 2015, in the wake of the FTC’s investigation and the 2011 FTC

Order, the Agency promulgated guidance to the industry, utilizing Twitter’s

experience as a cautionary tale.26 The FTC’s guidance outlined common sense

privacy and security remedies, that the Agency noted would have prevented specific

incidents at Twitter.

58. For instance, the FTC guidelines point out that Twitter granted

“administrative access to just about everybody in-house” resulting in increased “risk

that a compromise of any of its employees’ credentials could result in a serious

breach.” The FTC guidelines point out that Twitter could reduce that risk, simply by

“ensuring that employees’ access to the system’s administrative controls was

tailored to their job needs.” 27

59. The FTC guidelines further pillory Twitter’s “lax practices [that] left

Twitter’s system vulnerable to hackers who used password-guessing tools, or tried

passwords stolen from other services.” The Agency notes that, “Twitter could have

limited those risks by implementing a more secure password system – for example,

26
FTC, Start With Security A Guide for Business, Lessons Learned From FTC
Cases (June 2015), https://www.ftc.gov/system/files/documents/plain-
language/pdf0205-startwithsecurity.pdf.
27
Id.
21
by requiring employees to choose complex passwords and training them not to use

the same or similar passwords for both business and personal accounts.” A number

of similar examples of Twitter’s “lax practices” accompanied the FTC’s guidance,

with other simple solutions recommended such as “store credentials securely” or

offer “two-factor authentication.” 28

60. In addition to the FTC, legislatures around the world have taken broad

steps to strengthen data security and consumer privacy protections. In 2016, the

European Union (“EU”) adopted the General Data Protection Regulation (“GDPR”),

granting individuals control over their personal data, and requiring “data

controllers,” like Twitter, to disclose any data collection and enforce adherence to

individually selected privacy controls, among other protections. 29

61. In 2018, California adopted the California Consumer Privacy Act

(“CCPA”), which has similarities to the GDPR, including the right to opt out of the

selling of their personal information to third parties.30

28
Id.
29
Ben Wolford, What is GDPR, the EU’s new data protection law?
https://gdpr.eu/what-is-gdpr/ (last visited Jan. 20, 2021).
30
Francesca Lucarini, The differences between the California Consumer
Privacy Act and the GDPR, Advisera (Apr. 13, 2020),
https://advisera.com/eugdpracademy/blog/2020/04/13/gdpr-vs-ccpa-what-are-the-
main-differences/.
22
 D. Twitter’s Professed Commitment to Privacy
62. Twitter and its senior leadership have made promises to its users,

advertisers, as well as state and federal governments, including through testimony

under oath, that “privacy … is of paramount importance to Twitter.”31

63. In 2018, Twitter’s Data Protection Officer testified, “[T]he privacy of

the people who use our service is of paramount importance to Twitter. We believe

privacy is a fundamental right, not a privilege. Privacy is part of Twitter’s DNA.”32

64. Twitter’s 2018 testimony further emphasized the Company’s

commitment to ensuring that its users “should know, and have meaningful control

over, what data is being collected about them, how it is used, and when it is

shared.” 33

65. Twitter’s Code of Business Conduct commits the Company to taking

steps to “protect the privacy and security of [user’s personal and confidential]

information.” Twitter’s Code of Business Conduct further purports to enforce

31
Examining Safeguards for Consumer Data Privacy: Hearing before the S.
Comm. on Commerce, Science, and Transportation, 115th Cong. (Sept. 26, 2018)
(testimony of Damien Kieran, Data Protection Officer, Twitter Inc.),
https://www.commerce.senate.gov/services/files/C684F1AD-4BE7-4805-B447-
57D3B2A1A790.
32
Id.
33
Id.
23
limited “access to and use of users’ personal information” and requires Twitter to

“take measures to protect user data from unauthorized access.” 34

66. Twitter’s Privacy Policy further promises its users transparency

regarding how the Company preserves and protects user data: the policy states that

users “should always know what data we collect from [users] and how we use it, and

that [users] should have meaningful control over both.” 35

67. In a 2019 SEC filing, Twitter emphasized that the goal of its “product

development is … protecting the privacy and safety of the people who use

Twitter.” 36

68. If Twitter loses the trust of its users, the Company will lose value.

Indeed, Twitter’s Quarterly Report on Form 10-Q (“Form 10-Q”) for the period

ended September 30, 2020, filed with the SEC on October 30, 2020 (“Q3 2020 Form

10-Q”) acknowledges that decline in users’ “trust and confidence” in the platform

could have “a material adverse impact on our business, operating results, and

financial condition.” And, the Company has already begun to explore possible

34
Twitter, Twitter Code of Business Conduct & Ethics
https://legal.twitter.com/en/code-of-business-conduct.html (last visited Jan. 20,
2021).
35
Twitter, Twitter Privacy Policy, https://twitter.com/en/privacy (last visited
Jan. 20, 2021).
36
Twitter, Annual Report (Form 10-K) FY Dec. 31, 2019 (Feb. 19, 2020).
24
negative ramifications to the Company’s bottom line for failing to address privacy

and platform safety concerns.

69. Twitter’s Q3 2020 Form 10-Q states “a number of factors [that] have

affected and could potentially negatively affect” advertising engagement and

thereby, revenue growth, “including if:

• There is a decrease in the perceived quality, usefulness, trustworthiness

or relevance of the content generated by people on Twitter or content
partners;

• There are concerns related to communication, privacy, data protection,

safety, security, spam, manipulation or other hostile or inappropriate
usage or other factors…;

• There are concerns related to the security breach in July 2020 whereby
attackers gained control of certain highly-visible accounts;

• Changes in our products or services that are mandated by, or that we elect
to make to address, laws (such as the General Data Protection Regulation
(GDPR)) or legislation, inquiries from legislative bodies, regulatory
authorities or litigation (including settlements or consent decrees)
adversely affect our products or services.”

70. Twitter’s Q3 2020 Form 10-Q acknowledges that its failures in privacy

protection may cause Twitter to go out of business entirely.

71. The Q3 2020 Form 10-Q acknowledges that the most recent July 2020

breach “may … impact the market perception of the effectiveness of our security

measures, and people may lose trust and confidence in us, decrease the use of our

products and services or stop using our products and services in their entirety.”

25
 72. Accordingly, protecting user privacy and platform safety is a mission

critical duty of the Board.

III. DORSEY TAKES OVER AND PRIORITIZES TWITTER’S SALE OF

PRIVATE USER DATA OVER THE COMPANY’S PRIVACY
OBLIGATIONS

A. Dorsey Engineers the Ouster of Co-Founder Williams and Installs

Costolo as CEO
73. While described as a product visionary, Dorsey has been involved in

leadership turmoil at Twitter throughout the years.

74. Entering 2011, Twitter had been led by Twitter co-founder and CEO

Williams, with Dorsey serving as a Board member. Williams had been described as

a “thoughtful Twitter critic” having acknowledged that the advertising business that

supports digital media is a “broken system.” 37

75. In March 2011, however, Dorsey orchestrated a “boardroom coup,”

purging Williams’ loyalists in what some described as payback for Dorsey’s 2008

37
Kurt Wagner, Ev Williams is finally moving on from Twitter, Vox (Feb. 22,
2019), https://www.vox.com/2019/2/22/18236814/ev-williams-twitter-board-steps-
down.
26
ouster. 38 This “coup” culminated with Costolo emerging as Dorsey’s pick to lead

the Company.

76. Costolo had presided over Twitter for five years, as an “adult C.E.O. to

tame Twitter’s madness.”39 Under Costolo’s tenure, Twitter achieved undisputed

growth: the Company had grown from 300 employees to around 4,100; it had

increased revenues from nearly zero to around $2 billion a year; and Twitter had also

completely rebuilt its website to eliminate fatal server crashes.

77. Nevertheless, according to Vanity Fair, Costolo had a problem he could

not solve: “Twitter, which was once among the hottest companies in Silicon Valley,

had stopped being cool.” 40 In the year before Dorsey resumed leadership, the

number of active users on Twitter had grown by only eleven per cent, and the

Company’s penetration in the U.S. market had remained flat for the first three

38
Vindu Goel & Mike Isaac, Jack Dorsey Returns to Twitter as Chief, to
Shrugs & Quips, N.Y. Times (June 12, 2015),
https://www.nytimes.com/2015/06/13/technology/jack-dorsey-returns-to-twitter-
as-chief-to-shrugs-and-quips.html; Wagner, Ev Williams is finally moving on from
Twitter, supra note 37.
39
Nick Bilton, Twitter is Betting Everything on Jack Dorsey. Will it Work?,
Vanity Fair (June 1, 2016), https://www.vanityfair.com/news/2016/06/twitter-is-
betting-everything-on-jack-dorsey.
40
Id.
27
quarters of 2015. Facebook’s growth had eclipsed Twitter’s, and Instagram,

WhatsApp, and WeChat each had more individual users than Twitter. 41

B. Dorsey Elevates Himself to Lead Twitter As Part-Time CEO

78. On June 11, 2015, Twitter unexpectedly announced Costolo would

resign as CEO with Dorsey returning as the Company’s “interim” CEO.

79. The Board at this time included both Dorsey and Rosenblatt, a former

Google Ads executive. Rosenblatt has occupied a Board seat alongside Dorsey since

December 2010.42

80. Simultaneous with Costolo’s ouster, the Board established a Search

Committee to recruit a permanent CEO.43 On June 22, 2015, the Committee reported

41
Joshua Topolsky, The End of Twitter, The New Yorker (Jan. 29, 2016),
https://www.newyorker.com/tech/annals-of-technology/the-end-of-twitter.
42
Twitter, Investor Relations: Person details, David Rosenblatt
https://investor.twitterinc.com/corporate-governance/board-of-directors/person-
details/default.aspx?ItemId=c9760489-0a37-4d60-bdd2-5743f102bf14 (last visited
Jan. 21, 2021).
43
Goel & Isaac, Jack Dorsey Returns to Twitter as Chief, to Shrugs & Quips,
supra note 38.
28
that it would “only consider candidates for recommendation to the full Board who

are in a position to make a full-time commitment to Twitter.”44

81. Dorsey could not and would not meet the full-time requirement. At the

time that he re-positioned himself as Twitter’s CEO, Dorsey was serving as CEO of

Square, a mobile-payments company he had founded in 2009. 45

82. Square, which joined the NYSE on November 19, 2015,46 is a self-

described “cohesive commerce ecosystem” made up of two distinct businesses:

(i) Square Seller, which processes transactions and provides infrastructure for

businesses, and (ii) Cash App, which allows individuals to “send, spend, and save

money.”47 Square, unlike Twitter, profits directly from its user base, taking small

percentages of a wide range of transactions that utilize certain Square and Cash App

44
Press Release, Twitter, Twitter Board of Director Provides Update on CEO
Search (Jun. 22, 2015),
https://web.archive.org/web/20150905075937/https://investor.twitterinc.com/releas
edetail.cfm?ReleaseID=918844 (accessed via the Internet Archive Wayback
Machine as archived on Sept. 5, 2015 (link subsequently removed so content is no
longer available)).
45
Nick Statt, To Twitter CEO and back again: a timeline of Jack Dorsey’s
rise, The Verge (Oct. 5, 2015),
https://www.theverge.com/2015/10/5/9457277/jack-dorsey-twitter-ceo-timeline.
46
Ingird Lunden and Anthony Ha, Square Opens at $11.20, up 24% On Its IPO
Price of $9, Raising $243M, Tech Crunch (Nov. 19, 2015),
https://techcrunch.com/2015/11/19/square-nyse-pop/.
47
Square, About Us, Investor Relations,
https://squareup.com/us/en/about/investors (last visited Jan. 20, 2021).
29
features, such as purchases at businesses, international transfers, or the trading of

bitcoin.48

83. Despite the Search Committee’s commitment to hiring only a full-time

CEO, Dorsey would not give up his role as CEO of Square to lead Twitter. Once

pushed out for his failure to devote sufficient time to Twitter versus his personal

interests, Dorsey had manipulated his way back into Twitter as an officially part-

time CEO. This resulted in the unprecedented measure of naming Dorsey CEO of

Twitter, while he retained his role as CEO of Square.

84. While the Board allegedly went through the motions of asking Dorsey

to leave Square for Twitter, Dorsey insisted on simultaneously leading two

companies. “I’ll do whatever you need me to do to help the company,” Dorsey said,

“but I won’t leave Square.”49

85. Four months later, on October 5, 2015, Twitter announced that Dorsey

would remain the Company’s permanent CEO—on a part-time basis.50 The Board

48
Nathan Rieff, How Square Makes Money, Investopedia (Nov. 11, 2020),
https://www.investopedia.com/how-square-makes-money-4801197.
49
Bilton, Twitter Is Betting Everything on Jack Dorsey. Will It Work?, supra
note 39.
50
Hope King & Paul R. La Monica, Twitter Names Jack Dorsey as CEO, CNN
Bus. (Oct. 5, 2015), https://money.cnn.com/2015/10/05/technology/twitter-new-
ceo-jack-dorsey/?iid=EL.
30
took no steps to address any potential conflict of interest despite its CEO serving as

fiduciary to two companies both competing for investors on the NYSE.

86. With Dorsey’s elevation to permanent CEO complete, former CEO

Costolo resigned his Board seat. 51 Soon after, the Company added Kordestani,

another former Google ads executive, as the Board’s Executive Chairman. 52

87. Years later, Dorsey still splits his time between both of his companies.

Twitter in the morning, Square in the afternoon and evening. 53 Even with this

part-time allocation of his workday to Twitter, Dorsey has myriad other business and

personal interests to which he also devotes substantial time and further distract from

his leadership of the Company.

88. Dorsey’s management style somehow affords ample time for walking

around the office. “I spend 90% of my time with people who don't report to me,

51
Kurt Wagner, New CEO, New Chairman and Big Layoffs. So What’s Next
for Twitter?, Vox (Oct. 16, 2015),
https://www.vox.com/2015/10/16/11619660/new-ceo-new-chairman-big-layoffs-
what-comes-next-for-twitter.
52
Id.
53
Cory Stieg, Twitter CEO Jack Dorsey: People think ‘success means I work
20 hours a day’ like Elon Musk—‘which is BS’, CNBC (Aug. 26, 2020),
https://www.cnbc.com/2020/08/26/twitter-ceo-jack-dorsey-shares-habits-for-focus-
and-work-life-balance.html.
31
which also allows for serendipity, since I’m walking around the office all the time,”

Dorsey reportedly told Forbes. 54

89. According to some, Dorsey’s leadership of Twitter remains

dysfunctional. A former employee described the problem: “Jack is not decisive. You

just can’t have a company with no desire or ability to make decisions …. We used

to debate for a thousand hours and the boss man couldn’t make a decision.” 55

C. Dorsey Elevated His Interests as an Advertiser Over Twitter’s

Obligation to Maintain User Privacy
1. Dorsey is Economically Incentivized to Advance Square’s
Interests Over Twitter’s
90. In addition to Dorsey’s split-roles as CEO of both Twitter and Square,

he also has divergent economic interests.

91. As of March 31, 2016, Dorsey owned 69,504,082 Class B shares of

Square, representing 22.7% of Square’s aggregate equity voting power, valued at

more than $1 billion as of that date. 56 As of March 31, 2020, Dorsey owned

54
Scott S. Smith, How Jack Dorsey Changed the World, Twice, Investor’s
Bus. Daily (June 25, 2020), https://www.investors.com/news/management/leaders-
and-success/jack-dorsey-changed-the-world-twice-twitter-square/.
55
Maya Kosoff, “Just An Ass-Backward Tech Company”: How Twitter Lost
The Internet War, Vanity Fair (Feb. 19, 2018),
https://www.vanityfair.com/news/2018/02/how-twitter-lost-the-internet-war.
56
Square’s Class B shares are convertible at any time on a 1:1 basis for Square
Class A shares. Square’s Class B shares each represent 10 votes, while its Class A
shares each represent 1 vote.
32
59,297,392 Class B shares, representing 51% of Square’s aggregate equity voting

power, with a value of more than $3.1 billion as of that date.

92. In contrast, as of March 30, 2016, Dorsey only controlled 23,856,513

shares or 3.40% of Twitter’s stock, with an equity value of approximately $390

million. While by April 3, 2020, this stake had increased in value to approximately

$416 million, it pales in comparison to the amount of Dorsey’s wealth dependent on

Square’s success.

93. With an economic stake in Square valued at more than $3.1 billion

versus an economic stake in Twitter valued at $416 million, Dorsey had an incentive

to make decisions that advance Square’s interests over those of Twitter.

2. With Dorsey at the Helm, Twitter Focuses on Maximizing its

Sales of User Data – Including Private Data
94. Direct Response Advertising is a form advertising in which

advertisements trigger immediate actions from prospects. Because direct response

ads have unique correlated actions, advertising metrics study how many prospects

and leads come from each campaign. 57 A focus on direct response advertising

products requires that advertisers have enhanced access to user data, user activities,

57
Marketing Evolution, Resources, Direct Response,
https://www.marketingevolution.com/marketing-essentials/direct-response (last
visited Jan. 20, 2021).
33
and user’s devices—particularly because the direct response action taken by a

prospect takes place off the advertising platform, and on target devices or in the real

world.

95. By 2015, Twitter had begun to identify that new direct response

products could be a primary source of expected revenue growth for Twitter.58

96. With Dorsey at the helm and two former Google Ad Words executives

on the Board stoking enhanced focus on advertising revenues, Twitter further

emphasized sales of increasingly invasive advertising and began launching products

that monetized user’s private information and data.

97. In one example, Mobile App Promotion (“MAP”), certain promoted

advertisements prompted users to download or enhance engagement with the

promoter’s app. In order to operate MAP and similar products, Twitter began

tracking and measuring a number of new user activities. 59

98. In August 2015, Twitter announced the new Tailored Audience

Platform (“TAP”) to allow “advertisers to reach over 700 million people on and off

58
Declaration of Michael Nierenberg, In re Twitter, Inc., No. 4:16-cv-05314-
JST (SK) (N.D. Cal. Sept. 12, 2019”), ECF No. 340-1.
59
Eric Farkas, Increase your reach on and off Twitter with the Twitter
Audience Platform, Twitter (Aug. 20, 2015),
https://blog.twitter.com/en_us/a/2015/increase-your-reach-on-and-off-twitter-with-
the-twitter-audience-platform.html.
34
of Twitter.”60 This product offered advertisers the ability to “target[]… people based

on the type of mobile device they use, the operating system for their device, and/or

the mobile carrier.”61

99. Under Dorsey’s leadership, Twitter’s audience-targeting tools crept

ever deeper into user’s private data to offer advertisers insights into a user’s offline

activities. 62 For instance, Twitter began to offer advertisers targeted subgroups of

its users screened out by targeted “behaviors,” based on Twitter users’ online and

offline actions, buying patterns, or other household information, as illustrated by the

“Behaviors” tool offered to advertising partners:

60
Id.
61
Twitter, Device, carrier, and new mobile targeting,
https://business.twitter.com/en/help/campaign-setup/campaign-targeting/device-
carrier-and-new-mobile-user-targeting.html (last visited Jan. 21, 2021).
62
Twitter, Behavior targeting,
https://web.archive.org/web/20190805034049/https://business.twitter.com/en/help/
campaign-setup/campaign-targeting/behavior-targeting.html (accessed via Internet
Archive Wayback Machine as archived on August 5, 2019 (link subsequently
removed so content is no longer available)).
35
 100. In addition to new advertising products like MAP and TAP, the

Company also expanded its sales of various forms of user data to “data partners.”

For instance, in October 2015 (the same month Twitter announced Dorsey’s return

to the CEO role would be permanent), Twitter launched a suite of subscription-

access products and services called “Gnip.” Gnip offers “sophisticated data sets and

better data enrichments,” which allow developers and businesses to more effectively

target Twitter’s users.63 Indeed, Gnip touted “segmentation by usage, attitude and

emotion across millions of consumers, …enable[ing] marketers to take it all the way

to inform media placement and execute targeting in real–time.”64

101. In sum, as part of the process of courting more advertising revenue,

Twitter began to offer enhanced access to data that its users believed to be private to

advertisers.

3. Increased Focused on Monetization of User Information Led

to Repeated Breaches of the Company Privacy Policies

102. As Twitter rolled out its new MAP and TAP products and sought to

provide more data to its advertisers and data “partners,” it repeatedly released

63
Twitter Annual Report (Form 10-K) FY Dec. 31, 2015 (Feb. 29, 2016).
64
Rob Johnson, Announcing the Gnip Insights APIs, Twitter (Oct. 21, 2015),
https://blog.twitter.com/en_us/a/2015/gnip-insights-apis.html.
36
unauthorized private user data. These breaches have occurred despite Twitter’s user

facing policies promising increased user control over their private data. 65

103. Many of these breaches occurred following a June 28, 2018,

announcement by Dorsey that Twitter would be decentralizing the Company’s

internal organization, making an already amorphous leadership structure more

vulnerable to risks and non-compliance with the 2011 FTC Order. 66

104. Dorsey sent the Company announcement in the form of a Tweet

accompanied by a series of screen shots from his phone’s Notes app, noting that the

reorganization would result in “short-term risk, cost, and thrash.” 67

105. Based on Dorsey’s Tweets, the goals of the reorganization were “most

importantly” to set up Twitter for more “creativity and invention” while “through

the lense of increasing our durability, agility, invention, and entrepreneurial drive.”

While these changes facilitated bringing products to market faster, it did nothing to

protect users’ privacy.

65
Twitter, Twitter Private Policy,
https://twitter.com/en/privacy/previous/version_14 (last visited Jan. 20, 2021).
66
Jack Dorsey (@jack), Twitter (Jun. 28, 2018, 10:04 AM),
https://twitter.com/jack/status/1012381283396157440.
67
Id.
37
 106. The reorganization changed Twitter’s organizational structure from a

“General Manager” structure to an “end-to-end functional” structure. This change

resulted in Twitter’s leadership structure being divided into 10 departments:

(i) technology; (ii) engineering; (iii) product; (iv) revenue; (v) product; (vi) design

and research; (vii) customers, people and marketing, (viii) counsel; (ix) finance; and

(x) assists. Noticeably, Twitter did not include a department that focused on privacy

or data security.68

107. While the reorganization facilitated Twitter’s sale of even more user

data, it did not address the corresponding need for Twitter to enforce its privacy

policy, follow users’ privacy settings, and comply with the 2011 FTC Order.

108. Not surprisingly then, following the announcement of the

reorganization, there were a series of instances where Twitter provided private user

data to its advertisers and data partners without authorization.

109. For instance, in December 2018, Twitter announced that it had become

“aware of an issue” that allowed third parties to discover the country code of

people’s phone numbers if they had one associated with their Twitter account.69 In

this announcement, Twitter claimed to have already remedied this issue.

68
Id.
69
Twitter, An issue related to one of our support forums (Dec. 17, 2018),
https://help.twitter.com/en/support-form.
38
 110. Although Twitter announced it had discovered the country code leak

issue in December 2018, the Company had actually been specifically alerted to the

phone country code issue in 2016, but had taken no steps to investigate or remedy

the issue until 2018.70

111. Then, in May 2019, Twitter disclosed a “bug that in certain conditions

resulted in an account’s location data being shared with a Twitter partner—even if

the user had not opted in to sharing that data.” 71

112. On August 16, 2019, Twitter announced that the Company “may have

shared certain data (e.g., country code, if you engaged with the ad and when,

information about the ad, etc)” with advertising partners, even if the user didn’t give

Twitter permission to do so, if users had “clicked or viewed an advertisement for a

mobile application and subsequently interacted with the mobile application since

May 2018” that Company.72

70
Zach Whittaker, Twitter warned of phone country code leak two years ago—
but did nothing, security researchers says, Tech Crunch (Dec. 18, 2018),
https://techcrunch.com/2018/12/18/twitter-warned-country-code-form-leak-bug-
security-researcher/.
71
Sarah Perez, Twitter bug disclosed some users’ location data to an unnamed
partner, Tech Crunch (May 13, 2019), https://techcrunch.com/2019/05/13/twitter-
bug-disclosed-some-users-location-data-to-an-unnamed-partner/.
72
Twitter, An issue with your setting choices related to ads on Twitter,
https://help.twitter.com/en/ads-settings (last visited Jan. 20, 2021).
39
 113. On an October 24, 2019 investor call, Twitter’s CFO, Ned Segal,

responded to a question about the May 2019 unauthorized sharing of user location

data by stating that Twitter had “discovered that certain personalization and data

settings were not operating as expected. These issues were in our control, and we

will work to do better.” 73

114. Segal continued, admitting that Twitter had been sharing “device

settings even if people had asked us not to do so” in direct contravention of users’

election not to share such data in their privacy settings. Rather than offer any

concrete remedial action, Segal said, “[W]hen we think about these product-related

issues that we really feel were in our control, we look at them as a validation of

where we've been investing.”74

115. However, Segal further noted that efforts to “moderate” privacy issues

with MAP going forward would result in “4 or more points of reduced year-over-

year growth for total revenue in Q4, from 3 or more points of impact in Q3, reflecting

a full quarter impact in Q4 versus only a partial quarter impact in Q3.”75

73
Transcript of Twitter’s Third Quarter (“Q3”) 2019 Earnings Report Call
(Oct. 24, 2019),
https://s22.q4cdn.com/826641620/files/doc_financials/2019/q3/Q3_2019_Twitter_
Earnings_Transcript.pdf.
74
Id.
75
Id.
40
 116. As NYU Professor Scott Calloway noted in a December 6, 2019 letter

to the Company’s Board, failure to tend to the platform’s recurring problems “and

inconsistent application of [Twitter’s] terms of service have resulted in a firm that

not only underperforms, but is dangerous.” 76

117. Calloway further noted, “The poor citizenship of Twitter is bad. What’s

worse is Twitter’s malfeasance coupled with scant benefit to stakeholders.”77

118. Michael Gazeley, managing director of cybersecurity firm Network

Box, also noted Twitter’s repeated failures to protect its platform and its users,

asking “[h]ow can one of the world’s most used social media platforms have such

weak security?” 78

119. Twitter’s persistent cybersecurity vulnerabilities demonstrate the

continued potential for devastating consequences of the Company’s disregard for

privacy and security oversight, consequences which are now starting to unfold.

76
Galloway, TWTR: Enough Already, supra note 11.
77
Id.
78
Zen Soo, Experts say Twitter breach extremely troubling ‘How can one of
the world’s most used social media platforms have such weak security?’, Chicago
Tribune (Jul. 16, 2002), https://www.chicagotribune.com/business/ct-biz-twitter-
bitcoin-hack-cybersecurity-20200716-frecqlxiczf7nipn7yiwrv6uz4-story.html.
41
 4. Square and Square’s Cash App Benefit From Twitter’s
Indifference to Its User Privacy, and Pay Twitter for
Undisclosed Advertising and Marketing Services

120. Meanwhile, Square was profiting from Twitter’s decision to emphasis

the sale of user data over compliance with Twitter’s privacy policy, user privacy

settings, and the 2011 FTC Order.

121. As Square and Cash App grew from infancy, Dorsey was motivated to

give advertisers, like Square, nearly unlimited access to the Twitter’s larger base of

approximately 330 million MAUs and to make available all of Twitter’s user data

and analytics, including metrics like spending patterns.

122. In 2017, Twitter began receiving undisclosed “marketing and

advertising” payments from Square. During the year ended December 31, 2017,

Square reported paying Twitter “$280,000 in the aggregate for marketing and

advertising services,” of an undisclosed nature.79

123. Twitter neglected to declare these 2017 related party transactions with

Square to the SEC.80

79
Square, Definitive Proxy Statement, p.49 (Form 14A) (April 27, 2018).
80
See Twitter Annual Report, p. 104 (Form 10K) (February 23, 2018) (reporting
no Related Party Transaction with Square during Fiscal Year 2017); Twitter,
Definitive Proxy Statement, p.73 (Form 14A) (April 11, 2018) (reporting no Related
Party Transaction with Square for the period since January 1, 2017).
42
 124. Subsequently, Square disclosed that “[d]uring the fiscal year ended

December 31, 2018, [Square] paid Twitter, Inc. and its subsidiaries approximately

$382,000 in the aggregate for marketing and advertising services (the “Twitter

Services”).”81

125. Twitter failed to declare these 2018 related party transactions with

Square to the SEC.82

126. In 2020, Square reported that “during the fiscal year ending

December 31, 2019, [it] purchased approximately $1,000,000 of marketing and

advertising services from Twitter … including direct purchases and purchases

through agencies.”83

127. In addition, Square reported that in October 2019, “[Square] entered

into a cost sharing agreement with Twitter whereby [Square] will make payments to

Twitter for security services relating to the protection of Jack Dorsey (the ‘Security

Services,’ and together with the Marketing Services, the ‘Twitter Services’).

[Square] did not make any payments under this agreement in 2019, but [Square] may

81
Square Definitive Proxy Statement, p.55 (Form 14A) (April 24, 2019).
82
See Twitter Annual Report, p. 115-116 (Form 10K) (February 21, 2019)
(reporting no Related Party Transaction with Square during Fiscal Year 2018);
Twitter, Definitive Proxy Statement, p.71 (Form 14A) (April 8, 2019) (reporting no
Related Party Transaction with Square for the period since January 1, 2018).
83
Square Definitive Proxy Statement, p.61 (Form 14A) (April 24, 2020).
43
make payments for such Security Services of over $120,000 in subsequent

periods.” 84

128. A study by ARK Investment Management shows that growth in the

number of Cash App users directly correlates to the number of followers that Cash

App generates on Twitter.85

129. Square has also taken advantage of Twitter’s direct response marketing

to maximize growth of the Cash App:86

84
Id.
85
Maximilian Friedrich, Square Cash App’s Viral Marketing Strategy Attracts
Users, Ark Invest (June 26, 2019), https://ark-invest.com/articles/analyst-
research/squares-cash-app-twitter/.
86
Jack Dorsey (@jack), Twitter (Mar. 18, 2020 11:34 AM),
https://twitter.com/jack/status/1240346204719837185?lang=en.
44
 130. The growth of Cash App’s user base directly correlates with increased

revenue for Square, as merchants pay a 2.75% transaction fee for each payment from

a Cash App user.87 Cash App also accrues fees for, inter alia, use of additional

services like expedited payments and transfers, the ability to make credit card

payments via Cash App, and bitcoin transactions. The more users engage these

services, the more revenue the company creates. As such, Square’s growth has been

dependent on recruiting more users and advertising its bespoke services. One way

Square has surged in growth has been through its advertising on Twitter and its

courting of Twitter’s 330 million MAUs, users who pay Twitter nothing to use its

87
Rieff, How Square Makes Money, supra note 48.
45
services, whereas Square monetizes each Cash App user by taking small percentages

of each and every relevant user transaction on the platform.

131. While Twitter’s revenues have failed to keep up the growth pace

expected for Silicon Valley companies, Square has exploded in popularity and

revenue. As of January 4, 2021, looking back five years over the course of Dorsey’s

co-tenure as CEO of both companies, Twitter has grown by 172.92%, while Square

grew 1,855.44%: 88

5. Rather Than Comply With User Privacy Settings, Twitter

Cancelled Users’ Ability to Protect Their Data

132. After Twitter reported that it took some steps to remedy these “bugs”

and to protect users’ choice to keep their data private, the growth of Twitter slowed

88
Google Finance, NYSE:TWTR,
https://www.google.com/finance/quote/TWTR:NYSE?comparison=NYSE%3ASQ
(last visited Jan. 4, 2021).
46
in the Q3 2019, because advertisers had been paying Twitter for private user data

that Twitter was forbidden to sell.89

133. As one industry watchdog noted, “Twitter fixed both bugs [but]

advertisers were unhappy. And Twitter announced a substantial hit to its revenue.

[The] fixes seem to have shown Twitter exactly how much privacy options were

costing it.”90

134. As Dorsey is the CEO of a Twitter advertiser that spent approximately

$1 million on Twitter in 2019 for marketing and advertising, he had a vested interest

in Twitter ensuring that advertisers continued to have access to the maximum

amount of user data.

135. Accordingly, on April 6, 2020, Twitter announced that it would

continue to share non-public user data with advertisers, whether users liked it or not,

and terminated the ability for non-EU users to protect their non-public user data. 91

89
Bennett Cyphers, Twitter Removes Privacy Option, and Shows Why We
Need Strong Privacy Laws, Electronic Frontier Foundation (Apr. 9, 2020),
https://www.eff.org/deeplinks/2020/04/twitter-removes-privacy-option-and-shows-
why-we-need-strong-privacy-laws.
90
Id.
91
Twitter, Additional information sharing with business partners,
https://help.twitter.com/en/safety-and-security/data-through-partnerships (last
visited Jan. 20, 2021).
47
 D. Twitter’s Indifference To User Privacy Has Resulted In Two
Additional Recent And Preventable Privacy Breaches

1. Twitter Reveals That User’s Two-Factor Authentication

Data, Including Phone Numbers and Email Addresses, Had
Been Given To Advertisers.
136. On October 8, 2019, Twitter confessed that “when [users] provided an

email address or phone number for safety or security purposes (for example, two-

factor authentication) this data may have inadvertently been used for advertising

purposes, specifically in our Tailored Audiences and Partner Audiences advertising

system.”92

137. The Washington Post outlined the source of the “breach”:

The trouble, however, stems from the fact that advertisers can upload
their own contact lists to match their customers with Twitter’s users.
In doing so, Twitter said, it ‘may have matched people on Twitter’ to
a marketer’s list ‘based on the email or phone number the Twitter
account holder provided for safety and security purposes.’ 93
138. Twitter went to state that it “cannot say with certainty how many people

were impacted” and failed to disclose the duration during which the private

92
Twitter, Personal information and ads on Twitter,
https://help.twitter.com/en/information-and-ads (last visited Jan. 20, 2021).
93
Tony Romm, Twitter says phone numbers users provided for security were
‘inadvertently’ used for ad purposes, Washington Post (Oct. 8, 2019),
https://www.washingtonpost.com/technology/2019/10/08/twitter-says-users-
phone-numbers-provided-security-inadvertently-used-ad-purposes/.
48
information had been available. 94 It has also failed to state that it had or was taking

any remedial action to correct this problem.

139. Far from being a one-off incident, in October 2016, Twitter’s “tailored

audience lists” feature explicitly offered advertisers the ability to upload lists of

phone numbers to compile a corresponding list of Twitter’s user handles. 95

140. Twitter had introduced the availability of two-factor authentication in

2013, touted as a tool to “better protect” users’ accounts. Twitter required users to

register a verified phone number and a confirmed email address. To access Twitter

once enrolled, the user would be asked to enter a six-digit code sent to the user’s

94
Twitter, Personal information and ads on Twitter, supra note 92.
95
Adido, 5 killer twitter tailored audience strategies (Oct. 21, 2016),
https://www.adido-digital.co.uk/blog/5-killer-twitter-tailored-audience-strategies/.
49
phone via SMS each time they signed in.96 Twitter had not disclosed that the phone

numbers users provided for two-factor authentication would also be used by Twitter

to target advertisements to those users. 97

141. Following the breach, information security expert Matthew D. Green,

Associate Professor of John Hopkins’ Department of Computer Science, responded

to the incident, observing “[Twitter] selling … advertising is a lot more important

than the trust and safety of [it’s] user base.” He continued: “Whose idea was it to

use a valuable advertising identifier as an input to a security system. This is like

using raw meat to secure your tent against bears.”98

142. In 2019, Facebook’s nearly identical misuse of users’ phone numbers

provided for two-factor authentication for advertising purposes resulted in a

five-billion-dollar judgment against the Company.99

96
Jim O’Leary, Getting started with login verification, Twitter (May 22, 2013),
https://blog.twitter.com/official/en_us/a/2013/getting-started-with-login-
verification.html.
97
See id.
98
Matthew Green (@matthew_d_green), Twitter (Oct. 8, 2019 2:05 pm)
https://twitter.com/matthew_d_green/status/1181677011615571973.
99
Press Release, FTC, FTC Imposes $5 Billion Penalty and Sweeping New
Privacy Restrictions on Facebook (July 24, 2019), https://www.ftc.gov/news-
events/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-
privacy-restrictions.
50
 2. July 2020 Hack Exposes Twitter’s Failure to Address Basic
Obligations of the 2011 FTC Order

a. The 2020 Hack

143. In July 2020, Twitter revealed a major hack involving a bitcoin scam

that targeted dozens of high-profile accounts, including former President Barack

Obama, Michael Bloomberg, Apple, and more. Twitter described the attack in

which the hackers successfully targeted employees who had access to its internal

systems.100

144. On July 15, 2020, a 17-year-old hacker utilized the exact weakness the

FTC had identified in its investigation of the January 2009 breach.101 The hacker

tricked Twitter’s employees into disclosing their credentials, resulting in a deep

breach of Twitter’s network and the hacker’s takeover of accounts assigned to high-

profile users in just a 24-hour period.102

145. The July 2020 Twitter hack happened in three phases: (i) social

engineering attacks to gain access to Twitter’s network; (ii) taking over accounts

100
Delphix, The Most-Ignored Data Security Practice: A Lesson From
Twitter’s Data Breach Nightmare, Security Boulevard (July 22, 2020),
https://securityboulevard.com/2020/07/the-most-ignored-data-security-practice-a-
lesson-from-twitters-data-breach-nightmare/.
101
Department of Financial Services, Twitter Investigation Report, New York
State (Oct. 14, 2020), https://www.dfs.ny.gov/Twitter_Report.
102
Id.
51
with desirable usernames and selling access to them; and (iii) taking over dozens of

high-profile Twitter accounts and trying to trick people into sending the hackers

bitcoin.103

146. In the July 2020 Twitter hack, 130 Twitter user accounts were

compromised.

147. Twitter believes that for up to 36 of the 130 targeted accounts, the

hackers also accessed Direct Message (“DM”) inboxes, including a verified account

of an elected official in the Netherlands. In the week following the Twitter hack,

Dutch politician Geert Wilders confirmed to multiple news sources that

unauthorized DMs were sent from his Twitter account. According to Twitter, no

other former or current elected officials’ accounts had their DM inbox accessed. 104

148. For seven of the Twitter accounts involved, the hackers also

downloaded account information through Twitter’s “Your Twitter Data” (“YTD”)

tool, which may have included the user’s private: profile information, tweets, DMs,

media (including images, videos, and GIFs attached to tweets and DMs), a list of the

account’s followers, a list of accounts the user follows, the user’s address book,

103
Id.
104
Id.
52
demographic information that Twitter has inferred about the user, information about

ads the user has seen or engaged with on Twitter, and more.105

149. Forty-five accounts were used to send tweets. The hackers sent tweets

from compromised accounts belonging to high-profile figures and companies such

as Elon Musk; former President Barack Obama; Bill Gates; Kanye West and Kim

Kardashian West; Joseph R. Biden, Jr.; Warren Buffet; Square’s Cash App;106 Uber,

Inc.; and Apple, Inc.107

105
Id.
106
Chris Mills Rodrigo, FBI investigating Twitter Hack, The Hill (July 16,
2020), https://thehill.com/policy/technology/507674-fbi-investigating-twitter-hack-
report.
107
Andrea Vittorio, Hack opens Twitter to potential fine from feds, The Detroit
News (Jul. 17, 2020)
https://www.detroitnews.com/story/business/2020/07/17/hack-opens-twitter-
potential-fine-feds/112296402/.
53
 150. The hackers utilized the handles to steal approximately $118,000 worth

of bitcoin. 108

151. It took Twitter’s response team many hours before they were able to

expel the hackers. Meanwhile, multiple public institutions could not access their

accounts to communicate, including to share public emergency information. For

example, the National Weather Service could not tweet a tornado advisory during

the incident.

152. Twitter’s failures in access management and authentication of

employee credentials had again failed to prevent unsophisticated hackers from

gaining access to Twitter’s entire infrastructure, including but not limited to, user’s

private data and Twitter’s powerful tools.

108
Delphix, The Most-Ignored Data Security Practice: A Lesson From Twitter’s
Data Breach Nightmare, supra note 100.
54
 b. The 2020 Hack Mirrored the 2009 Hack That Led to
the 2011 FTC Order

153. As detailed supra, ten years earlier, in a January 4, 2009 incident,

hackers accessed unsecured administrative accounts to compromise Twitter users’

non-public personal information, reset their passwords, and send public tweets from

these accounts. For instance, one hacker accessed former President Barack Obama’s

Twitter account and offered his followers the chance to win $500 in gasoline if they

completed a survey. 109, 110

154. In the 2011 FTC Order, when describing Twitter’s core security

weakness, the FTC lamented that “all of its employees [had] the ability to exercise

administrative control of the Twitter system, including the ability to: reset a user’s

109
Press Release, FTC, Twitter Settles Charges That it Failed to Protect
Consumers’ Personal Information; Company Will Establish Independently Audited
Information Security Program (June 24, 2010).
110
Kim Zetter, Britney, Obama Twitter Feeds Hijacked Following Phishing
Attack, Wired (Jan. 1, 2009), https://www.wired.com/2009/01/twits-get-phish/.
55
account password, view a user’s nonpublic tweets and other nonpublic user

information, and send tweets on behalf of a user.”111

155. Given the July 2020 hacker used the same tactics identified during the

2010 FTC investigation, the Company plainly violated the 2011 FTC Order

requiring Twitter remedy the vulnerabilities that led to that attack. Twitter was a 22-

person company when the first hacking episode occurred in January 2009. 112 In the

past decade, it has grown to approximately 4,600 employees. 113 What may have

been an understandable weakness in 2009 in Twitter’s infancy, is unfathomable now.

156. The current scale of the Company will be a factor in any FTC evaluation

of Twitter’s non-compliance with the 2011 FTC Order, as the Order required Twitter

to implement and document “administrative, technical, and physical safeguards

appropriate to respondent’s size and complexity.”

111
2010 Complaint, supra note 21.
112
Kim Hart, Twitter Settles FTC Charges, Politico (June 24, 2010),
https://www.politico.com/story/2010/06/twitter-settles-ftc-charges-038974.
113
Twitter, Investor Fact Sheet (2019),
https://s22.q4cdn.com/826641620/files/doc_financials/2019/q3/Q3_19_InvestorFa
ctSheet.pdf.
56
IV. DORSEY’S DISDAIN FOR USER PRIVACY HAS CAUSED HARM
TO TWITTER

157. On July 28, 2020, the Company announced that it had received a draft

complaint from the FTC alleging violations of the 2011 FTC Order and the FTC Act.

158. So far, the Company has only acknowledged that the FTC is examining

Twitter’s unauthorized release of two-factor authentication data.114 However, the

proximity of the July 2020 hacking incident to Twitter’s receipt of the July 2020

FTC Complaint—and the similarity of the facts of the July 2020 hacking incident to

the 2009 incident—suggests that the July 2020 FTC Complaint also encompasses

the July 2020 hack, as well as Twitter’s other privacy and cybersecurity issues.

159. The Company’s SEC filing acknowledged that “[t]he Company

estimates that the range of probable loss in this matter is $150.0 million to $250.0

million and has recorded an accrual of $150.0 million.”115

160. Experts agree that Twitter’s recent practices likely violate the law and

expose the Company to enforcement action by the FTC as well as litigation

commenced by Twitter users emanating from the Company’s egregious violations

of the 2011 FTC Order. Discussing the leak of two-factor authentication data,

Ashkan Soltani, a former chief technologist at the FTC opined, “Given that

114
Quarterly Report (Form 10-Q) for June 30, 2020 (Aug. 3, 2020).
115
Id.
57
Facebook got dinged for this exact practice, I think [Twitter’s misuse of two-factor

authentication data] likely meets the threshold of material omission or even

deception under Section 5 on its own,” citing the portion of the FTC Act that

prohibits unfair or deceptive acts and practices. “That’s further compounded by the

fact that Twitter is also under order already by the FTC.”116

161. Twitter may be underestimating the scope of liability to the FTC, as the

FTC leveled a $5 billion penalty against Facebook for lesser violations. The amount

reserved, $150 million, utterly ignores the Company’s potential liabilities to other

government agencies, including those in the EU, to California consumers pursuant

to the CCPA, and others. A penalty similar to the $5 billion penalty levied against

Facebook, would consume most of Twitter’s liquidity—as of December 31, 2019,

Twitter declared that it “had 6.64 billion of cash, cash equivalents, and short-term

investments in marketable securities.” 117

162. On September 21, 2020, a Twitter user filed a class action entitled Gray

v. Twitter, Inc., No. 2:20-cv-1389 (W.D. Wash.) (the “Consumer Class Action”).

alleging that Twitter violated the class members’ privacy rights when the Company

116
Romm, Twitter says phone numbers users provided for security were
‘inadvertently’ used for ad purposes, supra note 93.
117
Twitter, Inc., Annual Report on Form 10-K (Feb. 19, 2020) at pg. 48,
https://investor.twitterinc.com/financial-information/sec-filings/default.aspx (last
accessed Jan. 26, 2021).
58
provided class members’ personal information to advertisers as described in

Twitter’s October 8, 2019 announcement. Presently, this action has a pending

motion to dismiss on the docket.

163. Then, on October 29, 2019, a securities class action was filed against

Twitter entitled In re Twitter, Inc. Securities Litigation, No.19-cv-07149 (N.D. Cal.)

(the “Securities Class Action”), alleging that Twitter failed to disclose a material

decline in demand for its advertising products when it stopped improperly harvesting

Twitter users’ data, which resulted in a material decline in Twitter’s revenue.

Presently, the plaintiffs therein have appealed the district court’s granting of

defendants’ motion to dismiss to the Ninth Circuit Court of Appeals.

164. As a result of Dorsey’s wrongful conduct, aided and abetted by all

members of Twitter’s Board, the Company is alleged to have violated the 2011 FTC

Order. Twitter has been, and will continue to be, significantly damaged by such

misconduct.

165. As a direct and proximate result of Dorsey’s actions as alleged herein,

Twitter has expended, and will continue to expend, significant sums of money. Such

expenditures include, but are not limited to:

a) Expenses incurred in investigating and defending Twitter and

certain officers against the July 2020 FTC Complaint;

59
 b) Expenses incurred in investigating and defending Twitter and

certain officers in the pending Securities Class Action, plus

potentially millions of dollars in settlement or to satisfy an

adverse judgment;

c) Expenses incurred in investigating and defending Twitter and

certain officers in the pending Consumer Class Action, plus

potentially millions of dollars in settlement or to satisfy an

adverse judgment and any possible new actions arising from the

Company’s privacy shortcomings;

d) Expenses incurred from the loss of the Company’s customers’

confidence in Twitter’s products and services; and

e) Expenses incurred in connection with such fines as the FTC and

other governmental agencies may impose.

V. ELLIOTT AND SILVER LAKE MAKE A DEAL WITH DORSEY

166. In early 2020, activist investment firm, Elliott began circling Twitter,

and in February 2020, amassed a four percent stake 118 in the company with plans to

push for changes and seek to gain board seats. Among Elliott’s reported goals was

118
Casey Newton, Jack Dorsey is in for the fight of his life, The Verge (Mar. 4,
2020),https://www.theverge.com/interface/2020/3/4/21163146/jack-dorsey-
activist-investor-paul-singer-elliott-management.
60
replacing Defendant Dorsey as CEO.119 Elliott has a reputation as one of the world’s

largest and “most feared” activist investors, targeting companies from eBay to

AT&T for aggressive improvement.120 According to a report in Vanity Fair,

company insiders were worried, “It was clear that Elliot smelled blood, and they

were getting ready to attack.” 121

167. A month later, in March 2020, Twitter made a deal with Elliott as well

as Silver Lake (the “PE Deal”), a global private equity firm focused on investments

in technology with approximately $75 billion in combined assets under

management. 122

168. Under Twitter’s deals with Elliott and Silver Lake, two new board

members were appointed to Twitter’s Board: Durban, co-CEO and managing

partner of Silver Lake; and Elliott partner Cohn. Twitter’s Board would also name

119
Scott Deveau & Ed Hammond, Singer’s Elliott Seeks to Replace Twitter
CEO Dorsey, Bloomberg (Feb. 28, 2020),
https://www.bloomberg.com/news/articles/2020-02-29/singer-s-elliott-is-said-to-
seek-to-replace-twitter-ceo-dorsey.
120
Newton, Jack Dorsey is in for the fight of his life, supra note 118.
121
Michelle Groskopf, Is the Force Still with Jack Dorsey?, VANITY FAIR
(May 2020), https://archive.vanityfair.com/article/2020/5/is-the-force-still-
withjack-dorsey (last accessed Jan. 26, 2021).
122
Silverlake, https://www.silverlake.com/?v=2 (last visited Jan. 21, 2021).
61
a third new independent director, “focusing on candidates that reflect the diversity

of the Twitter service and [who] also possess deep technology and AI expertise.” 123

169. As part of the PE Deal, Twitter received $1 billion from Silver Lake, in

exchange for Convertible Senior Notes in a private placement and further, agreed to

repurchase $2 billion of Twitter common stock. 124

170. Also, under the PE Deal, Twitter’s Board formed a five-person

committee (the “Management Structure Committee”) to evaluate the CEO

succession plan with the CEO; and make recommendations consistent with corporate

governance best practices with respect to the elimination of the Company’s

staggered Board.

171. The Management Structure Committee included Cohn and Durban, as

well as Directors Pichette, Fox, Rosenblatt, and Taylor.

123
Laura Feiner & Alex Sherman, Twitter CEO Dorsey keeps his job after
company strikes investment deal with Elliott Management, Silver Lake, CNBC
(Mar. 9, 2020), https://www.cnbc.com/2020/03/09/twitter-strikes-investment-deal-
with-elliott-management-silver-lake-after-attempt-to-oust-ceo-jack-dorsey.html;
Todd Spangler, Jack Dorsey Remains Twitter CEO After Company Makes Peace
With Activist Investor, Variety (Mar. 9, 2020),
https://variety.com/2020/digital/news/twitter-jack-dorsey-activist-investor-
1203527456/.
124
Id.
62
 172. The Management Structure Committee was directed to report on its

evaluation to the Board any considerations or recommended changes and would

conclude its work and share the results publicly before the end of the year.

173. Indeed, when Twitter entered the PE Deal with Elliott and Silver Lake,

Scott Galloway, a New York University professor, podcaster, and Twitter

shareholder, speculated that Elliott and Silver Lake may “press their advantage” by

replacing Dorsey with a new CEO or taking Twitter private. “Silver Lake does not

buy shares in tech firms, it takes them private,” Galloway tweeted. “This was first

step toward that end.” 125

174. On November 2, 2020, the Management Structure Committee made its

report, in which it recommended eliminating Twitter’s classified board structure

(through a 2021 proxy proposal) but determined that Dorsey should remain in his

role as part-time CEO of Twitter.

175. The Company has not disclosed whether Dorsey entered into any other

agreement(s) with Elliott, Silver Lake, or the members of the Management Structure

Committee, or the terms of any such agreement. Twitter made almost no public

disclosures concerning the negotiations leading to its deal with Elliot and Silver

125
Scott Galloway, (@profgalloway), Twitter, March 9, 2020 (12:52 PM)
https://twitter.com/profgalloway/status/1237103942498213895.
63
Lake, leaving shareholders largely in the dark about how and why such a substantial

deal came together both quickly and surreptitiously.

176. The PE deal raises the questions about why the Company suddenly

needs so much additional cash. Indeed, Twitter’s disclosures, including in its 2019

Form 10-K issued on February 19, 2020, portrayed that the Company had substantial

case on hand and no cash concerns: (reporting that Twitter “had 6.64 billion of cash,

cash equivalents, and short-term investments in marketable securities…sufficient to

meet [Twitter’s] working capital and capital expenditure requirements for at least

the next 12 months.”). 126

177. Twitter CFO Ned Segal described the cash infusion from the PE deal

as “$1 billion that [Twitter] didn’t have an immediate use for in terms of running the

business.” 127

178. It remains an unknown precisely what advantages Elliot and Silver

Lake pressed to gain board seats and seal the PE deal with such swiftness, but the

terms of the deal indicate that Twitter overpaid for the unneeded cash infusion from

Silver Lake, particularly in light of the board seat that Silver Lake received in the

126
Twitter, Inc., Annual Report on Form 10-K, supra note 117.
127
Remarks of Twitter CFO Ned Segal at December 1, 2020, Bank of America’s
2020 Leveraged Finance Virtual Conference, transcript available at:
https://seekingalpha.com/article/4392384-twitter-inc-twtr-presents-bofa-2020-
leveraged-finance-virtual-conference-transcript (last accessed Jan. 26, 2021).
64
deal. However, the threat of Elliot’s plot to oust Dorsey from the CEO role would

have motivated Dorsey to help shepherd the deal in order to retain his position of

power at the helm of Twitter.

VI. DORSEY’S BREACHES OF FIDUCIARY DUTIES

179. Defendant Dorsey, by virtue of his positions as a director and CEO of

Twitter owes to the Company and its stockholders the fiduciary duties of loyalty and

good faith, and the exercise of due care and diligence in the management and

administration of the affairs of Twitter, as well as in the use and preservation of its

property and assets. This includes a duty to avoid causing Twitter to operate in

violation of law, its internal policies, and its user agreements.

180. Dorsey’s conduct, complained of herein, involves knowing and

culpable violation of his obligations as a director and officer of Twitter, the absence

of good faith on his part, and a reckless disregard for his duties to Twitter and its

stockholders of which he was aware, or should have been aware, posed a risk of

serious injury to Twitter.

181. Dorsey breached his duties of loyalty and good faith by disregarding

Twitter’s obligations to protect user privacy under Twitter’s privacy policy, user

privacy settings, and the 2011 FTC Order, in order to maximize the availability of

private user data for exploitation by advertisers—actions that benefitted Dorsey

personally as CEO of Square.

65
 182. As a result of Dorsey’s illegal actions and course of conduct, the

Company, among other things, now is at risk of serious harm through FTC

enforcement actions, consumer litigation, securities class action litigation, and other

potential claims. Moreover, Twitter has expended, and will continue to expend, tens

of millions of dollars to defend against these actions.

VII. DERIVATIVE ALLEGATIONS

183. Plaintiff brings this action derivatively in the right and for the benefit

of Twitter to redress injuries suffered, and to be suffered, by Twitter as a direct result

of Dorsey’s breaches of fiduciary duties and unjust enrichment, as well as the aiding

and abetting thereof, by the remainder of the Board who have acquiesced in his

wrongful conduct as described herein. Twitter is named as a nominal defendant

solely in a derivative capacity and no claims are asserted against it.

184. Plaintiff will adequately and fairly represent the interests of Twitter in

enforcing and prosecuting its rights.

185. Plaintiff was a holder of Twitter common stock during much of the time

the wrongdoing of which she complains took place, and has held such stock

continuously thereafter.

186. Prosecution of this action, independent of the current Board, is in the

best interest of the Company.

PLAINTIFF’S LITIGATION DEMAND WAS WRONGFULLY REFUSED

66
 187. On August 13, 2020, Plaintiff, through her counsel, sent the Demand

Letter to Twitter’s Board, which was delivered on August 17, 2020, at 1:02 p.m.

188. In the Demand Letter, Plaintiff demanded that the Board (i) take action

against Twitter’s senior officers and directors to seek recovery of damages caused

by the Company’s disregard of its privacy obligations; (ii) require Dorsey to resign

as CEO from either Twitter or Square; (iii) appoint an independent auditor to assist

in preventing false/misleading tweets; (iv) eliminate staggered voting for directors,

and (v) retain an independent investment banker to advise the Board.

189. Despite Plaintiff receiving confirmation that the demand letter was

received by Twitter, Twitter has neither failed to confirm its consideration of the

demand letter, not indicated any review of the demand, nor indicated that any action,

nor consideration of future action, has been taken, or will be taken, with regard to

the demand.

190. Twitter’s Board’s was derelict in its duty to respond to the demand as

evidenced by its utter neglect to respond in any way. This raises a strong inference

that the Board has acted in bad faith with respect to the demand.

191. Twitter’s wrongful failure to respond to the Demand Letter constitutes

demand refusal, which refusal cannot be justified.

67
 192. Twitter’s failure to respond also demonstrates the Board’s disregard for

holding Dorsey and any other Twitter officers or directors accountable for their

disregard of the 2011 FTC Order.

COUNT I
Breach of Fiduciary Duties
(Against Defendant Dorsey)

193. Plaintiff incorporates by reference and realleges each of the foregoing

allegations as though fully set forth in this paragraph.

194. Defendant Dorsey owed and owes fiduciary duties to Twitter and its

shareholders. By reason of his fiduciary relationship to the Company, Defendant

Dorsey specifically owed and owes Twitter the highest obligation of good faith, fair

dealing, and due care in the administration and management of the affairs of the

Company, including the competent conduct of its internal privacy and data controls

and regulatory compliance functions as well as compliance with the 2011 FTC

Order.

195. Defendant Dorsey consciously, and in a sustained and systematic

manner, deliberately breached his duties of candor, good faith, and reasonable

inquiry to Twitter and its stockholders in at least the following ways:

• Being aware of, yet failing to address critical, systemic, and

repeated privacy, data integrity, and regulatory violations;

68
 • Promoting the use and sale of private user data in contravention

of users’ privacy settings and Twitter’s privacy policies;

• Allowing the use and sale of private user data in contravention

of users’ privacy settings in contravention of the 2011 FTC

Order;

• Limiting external and internal audits of privacy compliance;

• Being aware of, yet failing to address and taking no actions in

response to critical, systemic data integrity and cybersecurity

issues on the Twitter platform;

• Profiting upon the illicit sale of user data and access to users’

privacy information, including affording access to such data and

private information to Defendant’s competing company, Square;

• Failing to take action to remedy specific issues identified in the

2011 FTC Order with data and privacy integrity despite being

under order to do so.

196. As alleged herein, Defendant Dorsey failed to institute and maintain

adequate controls over Twitter’s privacy and data compliance efforts, and failed to

make a good faith effort to correct or prevent privacy and information security

management deficiencies. Accordingly, Defendant Dorsey breached his fiduciary

duties owed to the Company.

69
 197. As a direct and proximate result of Defendant Dorsey’s breaches of

fiduciary duties, the Company has sustained and will continue to sustain damages,

including, but not limited to, costs and expenses incurred in the FTC’s renewed

action against the Company and damages to users’ trust in the Company, resulting

in damages to reputation and losses in revenue.

COUNT II
Breach of Duty of Loyalty
(Against Defendant Dorsey)

198. Plaintiff incorporates by reference and realleges each of the foregoing

allegations as though fully set forth in this paragraph.

199. Defendant Dorsey owed and owes a duty of loyalty to Twitter and its

shareholders.

200. By reason of his favoring Square in its dealings with Twitter and

otherwise as described above, Defendant Dorsey has breached his duty of loyalty to

the Company and caused it substantial damages.

201. Moreover, despite being CEO of Twitter, with all of the responsibilities

attendant therewith, Defendant Dorsey has devoted more than half his working time

to Square and other personal business. Such conduct is not in Twitter’s best interests

and is in breach of Dorsey’s duty of loyalty owed to the Company.

70
 202. As a direct and proximate result of Defendant Dorsey’s breaches of the

duty of loyalty, the Company has sustained and will continue to sustain damages in

an amount that cannot presently be determined.

PRAYER FOR RELIEF

WHEREFORE, Plaintiff demands judgment as follows:

A. An order declaring that Plaintiff may maintain this action on behalf of

Twitter, and that Plaintiff is an adequate representative of the Company;

B. An order finding that the Defendant Dorsey breached his fiduciary

duties to Twitter;

C. An order finding that the Defendant Dorsey breached his duty of loyalty

to Twitter;

D. An order requiring that Defendant Dorsey devote himself full-time to

his position as CEO of Twitter or resign such position;

E. An order finding that the demands set forth in the Demand Letter were

wrongfully refused;

F. An order directing Twitter to take all necessary actions to reform and

improve its corporate governance and internal procedures to protect the Company

and its stockholders from a repeat of the damaging events described herein;

G. An order directing Twitter to retain an independent investment banker

to advise it as to: (1) the fairness of the Elliott/Silver Lake transaction; and (2)

71
Twitter’s strategic alternatives, including, among other things, whether the

Company should be taken private.

H. An order awarding the Company compensatory damages for the

wrongdoing alleged herein;

I. An order awarding Plaintiff the costs and disbursements of this action,

including attorneys’ and experts’ fees and expenses; and

J. An order awarding such other and further relief as this Court deems,

just, proper, and equitable.

Dated: February 22, 2021

/s/ P. Bradford deLeeuw

P. Bradford deLeeuw (#3569)
Of Counsel: DELEEUW LAW LLC
1301 Walnut Green Road
Nicole Lavallee Wilmington, DE 19807
Jeffrey Miles (302) 274-2180
BERMAN TABACCO brad@deleeuwlaw.com
44 Montgomery Street, Suite 650
San Francisco, CA 94104
Telephone: (415) 433-3200
Facsimile: (415) 433-6382
Email: nlavallee@bermantabacco.com
jmiles@bermantabacco.com

Nathaniel Orenstein
BERMAN TABACCO
One Liberty Square
Boston, MA 02109
Telephone: (617) 542-8300
Facsimile: (617) 542-1194
Email: norenstein@bermantabacco.com
72
Richard D. Greenfield
Marguerite R. Goodman
Ann M. Caldwell
GREENFIELD & GOODMAN LLC
1905 Spruce Street
Philadelphia, PA 19103
917-495-4446
Email: rule23gg@gmail.com

73