Facebook Immune from Liability Based on Third-Party Content

In an interesting examination of the role of social media platforms and terrorism, the U.S. District Court for the Eastern District of New York dismissed two related complaints against Facebook on Thursday, May 18. Each set of complainants had asserted similar claims: that “Facebook has supported terrorist organizations by allowing those groups and their members to use its social media platform to further their aims.” Last year on Lawfare, Benjamin Wittes and Zoe Bedell wrote about this case—in addition to a series of posts addressing the possibility of suing social media platforms as fostering terrorist organizations both in the abstract and practically, given a 2016 lawsuit against Twitter, Google, and Facebook filed for just that reason. Ultimately, the two concluded that though technology companies would claim immunity under Section 230 of the Communications Decency Act (47 U.S.C. § 230)—claims the two admit are strong—this defense “should probably not prevail under either the extensive extant § 230 case law or under the plain text of the statute itself.” District Judge Nicholas G. Garaufis of the Eastern District of New York ultimately disagreed. This post lays out the case’s factual and procedural background as well as court’s opinion dismissing the suit.

Factual and Procedural Background

As stated above, the court addressed two actions simultaneously: Cohen v. Facebook and Force v. Facebook.

Describing the Cohen Plaintiffs, the court quotes its complaint, stating they are “20,000 individuals residing in Israel who state that they ‘have been and continue to be targeted by’ attacks by Palestinian terrorist organizations.” These individuals claim to remain “‘threatened with imminent violent attacks that are planned, coordinated, directed, and/or incited by terrorist users of Facebook.’” The Force Plaintiffs, on the other hand, “are the estates of victims (and, in one case, the surviving victim) of past attacks by the Palestinian terrorist organization Hamas and the family members of those victims,” in which every victim is an American and most of whom were living in Israel at the time of the attack.

The Cohen Plaintiffs filed their complaint in New York state court in August 2016, and Facebook removed the action to federal court. (Because it was filed in King’s County—better known as Brooklyn—it was removed to the Eastern District.) The Force complaint was filed in federal District Court in the Southern District of New York, only to be transferred across the Brooklyn Bridge as sufficiently related to the Cohen cause of action.

Allegations

The complaints—“substantially similar”—allege that terrorist organizations “use Facebook’s social media platform and communications services to incite, enlist, organize, and dispatch would-be killers to ‘slaughter Jews,’” citing both specific acts of terrorism as well as general incitement and drumming up hatred. (Note: the Force complaint specifically denotes Hamas, whereas the Cohen complaint cites terrorist organizations writ large.) Furthermore, the Plaintiffs claim that Facebook “is aware of the use of its platform by . . . terrorist organizations and their members but has failed to take action to deactivate their accounts or prevent them from inciting violence.” Instead, as the opinion tells, the claimants assert that

Facebook’s approach to addressing this use of the platform has been piecemeal (intermittently deleting individual postings or banning users) and inconsistent (e.g., deleting offending posts from one individual without removing identical messages or banning users without taking steps to ensure that the same person does not subsequently rejoin the website under a different moniker).

The Cohen action includes “Israeli law claims of negligence, breach of statutory duty, and vicarious liability, as well as New York law claims for prima facie tort, intentional infliction of emotional distress, aiding and abetting a tort, and civil conspiracy . . . seek[ing] only declaratory and injunctive relief.” The Force complaint states similar claims for “negligence, breach of statutory duty, and vicarious liability under Israeli law.” But the Force complaint has an additional angle: it “also raises claims under the civil enforcement provisions of the federal Anti-Terrorism Act (“ATA”) and the Justice Against Sponsors of Terror Act for aiding and abetting acts of international terrorism, conspiracy in furtherance of acts of international terrorism, and providing material support to terrorist groups in violation of 18 U.S.C. §§ 2339A and 2339B.” The latter complaint also differs from the former in remedy sought: “$1 billion in compensatory damages, punitive damages to be determined at trial, and treble damages for violations of the federal anti-terrorism statutes.”

Legal Analysis

Judge Garaufis’s opinion is broken down into three parts: Subject Matter Jurisdiction and Standing; Personal Jurisdiction; and Failure to State a Claim. I explain each in turn.

• Subject Matter Jurisdiction and Standing

Judge Garaufis begins his legal analysis with the court’s subject matter jurisdiction and the complainants’ standing. Put simply, the court writes, “[t]he Cohen Plaintiffs fail to carry their burden of showing that their claims are grounded in some non-speculative future harm.” Though the Cohen complaint offered “extensive descriptions” of previous attacks, “the Cohen Plaintiffs do not seek redress for past actions but instead seek prospective, injunctive relief based on their allegation that Facebook’s actions increase their risk of harm from future terrorist attacks.” However, the court finds that to get from their descriptions of past attacks to Facebook’s actions as enabling harms is a bridge too far; relying on “multiple conjectural leaps, most significantly its central assumption that the Cohen Plaintiffs will be among the victims of an as-yet unknown terrorist attack by independent actors not before the court,” the complaint cannot meet the standard set forth by the Supreme Court that the Plaintiffs are at “substantial” or “certainly impending” risk of imminent harm. Instead, the court finds the logical connection could “[a]t most” show Facebook increasing the risk to Israel at large rather than the Plaintiffs specifically. Additionally, the court is unpersuaded by any argument that fear of future attack is a sufficient harm, under the standard set forth by the Supreme Court in Clapper v. Amnesty International. Therefore, the court dismissed the Cohen claim altogether for lack of standing.

• Personal Jurisdiction

Next, the court addresses questions of personal jurisdiction and rejects Facebook’s claim that the EDNY cannot assert personal jurisdiction over the company because of Facebook’s more than minimal contact with the district. Citing Licci v. Lebanese Canadian Bank, SAL, Judge Garaufis concludes that the court has personal jurisdiction over Facebook. Because the company received proper service of process, there was statutory basis for personal jurisdiction, and the court exercised jurisdiction “consistent with ‘constitutional due process principles.’” Facebook disputed the final two requirements.

To find a statutory basis for jurisdiction, the court looked to Weiss v. National Westminster Bank and Strauss et al. v. Credit Lyonnais, S.A.; both of these cases found a statutory basis in the service itself. Under 18 U.S.C. § 2334, “[p]rocess [for a federal antiterrorism cause pursuant to 18 U.S.C. § 2333] may be served in any district where the defendant resides, is found, or has an agent.” By permitting service of process nationwide, the Weiss and Strauss courts reasoned, the statute simultaneously creates a statutory basis for personal jurisdiction nationwide. Judge Garaufis was similarly persuaded by this reasoning, not to mention the precedential value of both cases.

As for due process considerations, the court deployed a “minimum contacts” analysis; however, it did so for the entire country rather than for the district because “satisfaction of due process as to federal statutes with nationwide service provisions depends only on a party's contact with the United States as a whole,” including specifically under the ATA. (Including Strauss, Weiss, and two other similar cases.) Facebook’s minimum contacts with the United States are beyond dispute.

Finally, the court exercised its discretion in choosing not to separate the Israeli law-based claims. According to Second Circuit precedent, so long as federal and non-federal claims “‘derive from a common nucleus of operative fact’, the district court may assert personal jurisdiction over the parties to the related . . . claims even if personal jurisdiction is not otherwise available.” Therefore, the district court has discretion to bifurcate the claims based on “considerations of juridical economy, convenience, and fairness to litigants.” Given the common nexus, the court forged ahead with the entirety of the Force complaint intact.

• Failure to State a Claim

As predicted by Ben and Zoe, the focus of the legal analysis is on Section 230 of the Communications Decency Act (CDA), which shields internet services and technology companies from liability based on a third party’s content in subsection (c)(1): “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” (Ben and Zoe went through an exhaustive history of the Act and its subsequent interpretations here.) Notably, the suit involves two distinct arguments surrounding § 230: “First, the parties dispute whether the asserted claims fall within the substantive coverage of Section 230(c)(1). Second, the Force Plaintiffs argue that Facebook is improperly attempting to apply Section 230(c)(1) extraterritorially.”

To discern the answer, the opinion first recounts the Second Circuit’s tripartite test for where § 230 applies: “if the defendant (1) is a provider or user of an interactive computer service, (2) the claim is based on information provided by another information content provider and (3) the claim would treat [the defendant] as the publisher or speaker of that information.” The Force Plaintiffs only object to the final necessary condition.

The Second Circuit, in the same case that it offers the three-pronged test, offers further explanation of this final prong:

"At its core, § 230 bars 'lawsuits seeking to hold a service provider liable for its exercise of a publisher’s traditional editorial functions—such as deciding whether to publish, withdraw, postpone or alter content'". . . . [W]hat matters is whether the cause of action inherently requires the court to treat the defendant as the "publisher or speaker" of content provided by another. To put it another way, courts must ask whether the duty that the plaintiff alleges the defendant violated derives from the defendant’s status or conduct as a "publisher or speaker."

This interpretation, in addition to analogous case law in both sister district courts and other courts, compels the court to determine “that Section 230(c)(1) is implicated not only by claims that explicitly point to third party content but also by claims which . . . implicitly require recourse to that content to establish liability or implicate a defendant’s role, broadly defined, in publishing or excluding third party communications.” This interpretation has also led other courts to conclude that, in Judge Garaufis’s words, “decisions as to whether existing content should be removed” as well as the “structure and operation” of a website are editorial functions that fall under § 230(c)(1)’s protection. In one case, that has been “extended to a social media platform's decisions as to who may obtain an account.” (See Fields v. Twitter, No. 16-CV-213, 2016 WL 6822065, at *6) (N.D. Cal. Nov. 18, 2016)).

The Force complaint attempts to artfully plead so as to avoid § 230’s bar, arguing that Facebook should be held liable for permitting users with connection to Hamas to join the social media platform and for failing to excise these hateful accounts, but to no avail. Judge Garaufis parries these claims by stating they constitute a distinction without a difference: “Facebook’s choices as to who may use its platform are inherently bound up in its decisions as to what may be said on its platform, and so liability imposed based on its failure to remove users would equally ‘derive[] from [Facebook’s] status or conduct as a ‘publisher or speaker.’’” What’s more, because the complaint alleges that Facebook’s platform is an integral part of the necessary causal inference—Facebook contributed to the Plaintiffs’ harms by allowing Hamas to post content that recruited more terrorists and incited more malevolent acts—it would be impossible to simultaneously harm the Plaintiffs while not retaining the role of an editor or publisher. Therefore, the court concludes that §230(c)(1)’s immunity applies domestically. But does it apply extraterritorially? The short answer is no; the long answer is far more nuanced.

First, the court goes straight to the presumption against territoriality, stating that, as recently confirmed by the Supreme Court’s RJR Nabisco, Inc. v. European Cmty. and Kiobel v. Royal Dutch Petroleum, “statutes should only be given domestic effect absent a definitive demonstration of Congress’s intent for them to apply abroad.” (Jack Goldsmith just highlighted a fascinating note in the Harvard Law Review about Justice Alito’s “touch and concern” concurrence in Kiobel, for those interested in the issue of extraterritoriality more broadly.) But RJR created a “two-step framework”: “whether the statute gives a clear, affirmative indication that it applies extraterritorially, the presumption is rebutted." Otherwise, under RJR, the court must “determine whether the case involves a domestic application of the statute, and we do this by looking to the statute’s ‘focus.’”

Because the statute lacks explicit indicia of extraterritorial application, the court swiftly moves onto the statute’s “focus.” The plain text of § 230(c)(1), which “offers only one directive— that qualifying defendants may not be treated as the ‘publisher or speaker of any’ third party content—which it does not cabin based on either the location of the content provider or the user or provider of the interactive computer service” “‘suggests a legislative focus on’ providing immunity.” (The Fourth Circuit agreed.) The opinion buttressed its reasoning on the two surrounding substantive provisions, both of which “were adopted specifically for the purpose of clarifying—and curtailing—the scope of internet-providing defendants’ exposure to liability predicated on third party content.”

Here’s the important part, however: whether the statute applies extraterritorially is not actually relevant. Rather we must ask if the grant of immunity applies to the case. That answer, the court concludes, is that it does. §230(c)(1) puts forward myriad “territorial relationships and events,” primarily divided into two categories: those associated with the underlying claim (in this case, abroad) and those associated with the suit (where the defendant is acting as a publisher). But the court reasons that, “[g]iven the statutory focus on limiting liability, the location of the relevant ‘territorial events’ or ‘relationships’ cannot be the place in which the claims arise but instead must be where redress is sought and immunity is needed.” Therefore, §230(c)(1) nevertheless applies, which necessarily means that the Force Plaintiffs failed to state a claim and cannot survive a 12(b)(6) motion to dismiss.

* * * *

For all the reasons Ben and Zoe laid out in their earlier posts, this case presented a potential opportunity to dramatically strengthen civil remedies for material support for terrorism allegations, putting the pressure on technology companies to take a much more active role in policing their content. As Ben and Zoe correctly noted, this complaint was “significantly more sophisticated than the earlier suits,” offering a much stronger case to survive motions to dismiss on challenges of proximate cause. But as the courts in this case and the other analogous cases cited above continue to apply the §230(c)(1) grant of immunity, it grows increasingly unlikely that any case against a service provider can actually break through the §230 wall.