Oral argument — Del Rio v. CrowdStrike

The case on our docket this morning is 25-50518, Del Rio v. CrowdStrike Incorporated. Mr. Parkhill. Good morning. May it please the court, Anthony Parkhill on behalf of Plaintiffs Appellants. This is a case regarding the preemptive scope of the Airline Deregulation Act of 1978. The statutory text that's relevant to the issue of this case is short. The statute preempts state law claims. There's no issue in this case about what's called the mechanism question, whether a common law claim can constitute a state law regulation for the purpose of this provision. It can, and that's conceded by the parties. So the question is whether a claim is related to a price, route, or service of an air carrier. The U.S. Supreme Court, the Morales case, held that related to borrowing from its ERISA lineup cases means a connection with or reference to. With respect to reference to, I think the meaning of reference to was best elucidated by the Day Against Sky West decision from the 10th Circuit, where they again follow the lead of the U.S. Supreme Court in looking to the ERISA line of cases and find that relation to within the meaning of the Supreme Court's reference to within the meaning of the Supreme Court's meaning of related to should have the same meaning as it has in the ERISA context, which is either something that acts exclusively and immediately upon the regulated area, in this case rates, routes, or services of an air carrier, or something where the existence of rates, routes, or services of the air carrier are essential to the operation of the regulation. When you're looking at a common common law rule, which is all that's at stake in this case, there is no reference to. So the analysis in this case is focused on a connection with rates, routes, or services of an air carrier, and in evaluating that connection with, we look to a substantial forbidden effect, which is to say a regulatory effect that violated the deregulation Congress enacted in 1978. An provision of labor from one party to another and must derive from the contractual agreement between the airline and the user of the service. The ADA encompasses only aspects of air transportation pertinent and necessarily included with the contract of carriage between the passenger and the airline. So that's from the Hodges decision. An en banc panel of this court further limited the scope of services in the Smith decision to find that services only relate to the economic aspects of... But this case is about routes, right? I mean about time delays of flights, right? So I don't believe that anyone has argued that this case is about, is a routes case. I think most of the analysis... I meant, I guess I misspoke, delayed flights, right? So the injuries in this case largely stem from travel disruption, delayed flights. There's no question about it, but the right... When we're looking at a common law cause of action, we're trying to determine what the regulatory effect, because the regulatory effect of a negligence cause of action can be significant. In Judge Higginbottom's dissent in the Hodges decision, he says that the regulatory bite of tort cases can be immediate. And I think that that caution is well-founded. But the right analysis for looking at this question in the context of negligence is the analysis that the U.S. Circuit Court of Appeals for the First Circuit took in the Bowers against Egypt Air case and the Tobin case. And in those cases, what the court did to evaluate whether the common law claims had a significant regulatory effect is to look at exactly what sort of duties ex ante enforcement of this cause of action could impose on air carriers. So in Bowers against Egypt Air, it was a case, a parental kidnapping case, where if the common law claims were allowed, it would incentivize airlines to enact wholly different procedures regarding ticket and boarding to look for red flags of parental kidnapping. Well, enforcement of that, those common law claims would constitute a regulation of an airline. And I think that is the correct conclusion. The analysis makes sense. In the Tobin case, which was a case about misdelivered marijuana, the First Circuit applied the same approach and found in that case it was an air carrier or it was a motor carrier regulated under an identical provision that's intended to be read identically. And the issue in the Tobin case, I'm sorry, I misspoke. Tobin was FedEx and FedEx was an air carrier within the meaning of that case. Within Tobin, the issue was whether the cause of action in that case about address verification, certain customer service procedures about traces and things like that, because the individual who had received the misdelivered marijuana was concerned that the rightful recipient could come looking for it. And so all of these things that the lawsuit was about, address verification, trace procedures, all of these things went to the core of the shipper's business. And for that reason... So, I mean, to try to get to the, I guess, the point is that this is about delayed route. So why doesn't that get to the core of the airline's business? Because it's duties, not injuries that drives the analysis. That's the approach taken by the First Circuit. It's consistent with the economic deregulation purpose of the statute because it within negligence, it's duties that have a direct impact on the ex-ante behavior. Does not the duty here have to do with delay, with making sure the planes fly on time? No. The defendant in this case sold an undifferentiated software product. It was just IT infrastructure used by more than half the Fortune 500 companies. It was in no way tailored to the business of aviation. And it's similar to other basic business inputs that airlines must purchase. Well, what's the relationship of the software to the flights? Because if the injury alleged as well, the flights were delayed. So there's got to be a relationship between them. So the developer in this case pushed a software update that caused one of the largest global IT outages in history. And it took down the computer systems, all of the computer systems of major air carriers within the United States, including American Airlines, Delta Airlines, and United Airlines. It also took down systems that were in the healthcare space that were running critical life systems, computer systems that sort of run our global financial system, which also use the same software product that's at issue in this case. And the only thing about this case that pertains to aviation in any specific way is the injuries that the plaintiff suffered from the defendant's negligence. All of the allegations of negligence in this case pertain to the negligent software development practices used by Kratzreich. So when we look at the other cases where software developers or vendors, where claims against them were found to be preempted under the ADA, when we look at the PICA against Delta Airlines case, that case involved a voice in chat vendor who was directly providing customer service on behalf of the airline to the airline passengers. And then that vendor suffered a cybersecurity breach, a data breach, and information was leaked. Well, that vendor of the airline in that case was directly providing an airline service, but a vendor doesn't need to be directly providing the service of an airline in order to have a connection with that would have a substantial forbidden effect. But in this case, there's just almost virtually no connection between Kratzreich's negligent conduct. The only link is injury. And the defendants- But that negligent conduct had caused the injury in order for it to be actionable as a tort, right? But that's actually a really useful way to think about it. And that's the reason that duty and breach are what matters, which is that when we're thinking about whether something's related to, we have duty and breach on the one hand, which inform our ex-ante incentives and how we behave in the world. Then we have a world of attenuation that we call causation. And on the other side of causation, we have injuries. Well, the proximate- You may be talking about this in Louisiana law terms, in common law terms, you'd call it proximate cause, right? The injury has to be foreseeable within the duty, within the scope of the duty. If it's not foreseeable, there's no cause. That's right. But that makes the injuries naturally attenuated from the duties. I don't understand that. Why naturally attenuated? Because causation is itself, it requires some connection, but that connection and that extra step is a point of attenuation because something can be a foreseeable injury without being something that directly regulates in the way that duties do. So duties can be imposed- I mean, are we falling away from the language of the statute, right? It just says related to. Which means a connection with or reference to, and the analysis used by the First Circuit in looking at common law causes of action, which focuses on duty, is the approach that fits with the Supreme Court's approach in the Morales case. It fits with this court's unbunked decisions in Smith and Hodges, where what we're looking at is the economic reality of how the enforcement of state common law claim is going to impact ex-ante behavior in the world. And injuries related to the disruption of travel- So you're saying if we allow this lawsuit against the software company, it will have no effect whatsoever on how airlines operate or the cost of services or anything? Absolutely. Our lawsuit is not premised on any allegation of negligence on the part of an airline. Well, is it required to find preemption that you sue, that you have an allegation that the airline was negligent? It's not, although it's telling that it almost always is the case that airlines and vendors whose claims are also preempted are almost always sued together because they're sued on the basis that there was some sort of joint negligence between the two, where the vendor was carrying out one of the services of the air carrier. And for that reason, the claims against the vendor were also preempted, like in PICA or in Ray American Airlines, which was another private case finding preemption. In the greater stepping back about the whole CrowdStrike mess, some people thought CrowdStrike was a defective product and refused to use it. And there was a choice by different industries to go ahead and pick it. I mean, you say it's attenuated from the airlines, but they made a decision to use this software, right? But we're not suggesting there's no allegation. This isn't the result of artful pleading. It's the allegation of the facts in the case, resulting in the pleading being what it is. There's no allegation in this case that any airline was negligent or negligently supervised CrowdStrike or that any airline did anything wrong. And so the only connection to aviation, although I have two minutes left here, so I'll get to one more. The only conceivable connection to an airline service is to a newly created airline service that's not included in the Hodges case that CrowdStrike wants the court to find today, which is the service of cybersecurity. And CrowdStrike has argued in its brief that cybersecurity is an airline service that's necessarily pertinent to every contract between a passenger and an airline. And I think there are a couple of problems with that. One is that cybersecurity category is very broad, and it describes a lot of activities that really could constitute part of the bargain between an airline customer and an airline. For example, looking at the American Airlines privacy case, operating a website and that website where passengers go to buy tickets, having sufficient cybersecurity to protect personal information. Tell me again why the airlines were using CrowdStrike. So this was an endpoint threat detection system that operated at an infrastructural level on their systems. What is that? I don't understand. So nothing about the software was customized to the needs of their business. Well, they were using it for some reason. Why were they using it? It's like a fancy antivirus, I guess is the right answer. So it was operating on all of their Microsoft Windows systems, as was Microsoft Windows. They were using Office 365 extensively at Delta. There were a lot of undifferentiated information technology products that are being used on these machines. And I would analogize to a case about microprocessors or defective microprocessors or about a problem with the electrical grid. It's an input that has no, it's not used directly to provide rates, to provide services to airline customers. And there's nothing about the product that makes it in any way related to airlines. And the only thing we have in this case to look to is injury. The defendant points to the Ginsburg case for the proposition that injury can be enough. And that is not a proper reading of the Ginsburg case. The Ginsburg case, U.S. Supreme Court case regarding someone using common law claims to seek reinstatement in a frequent flyer program. Is this a different case in your mind, if an airline is sued for negligently choosing to use CrowdStrike? Absolutely. Thank you. Good morning, Your Honor. Samantha Heifetz on behalf of the appellees. So I think that the place for us to start, this court, the Supreme Court has told us that the place to start is with the complaint and with the allegations that the plaintiffs have made. Wallens tells us that, and this court has repeated it several times. And when we start with the complaint, we see that the case very clearly is not just, as opposing counsel suggests, one about damages and injuries. Although that, of course, is extremely significant. But this is a complaint that through and through, every count is premised in key ways on the relationship to and connection with airline services. And that includes duty. So when we talk about duty in this case, they're referring to their status over and over in the complaint to their status as airline passengers and alleging that CrowdStrike should have foreseen these huge effects on airline services. And so when we talk about why they think that CrowdStrike should be responsible in this massive class action for all of the costs attendant to flight delays and cancellations, all of the incidental costs of those flight delays and cancellations, they want to be paid for time off, lost for more, for meals that were purchased, for hotels, et cetera, et cetera. That's all premised on the notion that CrowdStrike was in a contractual relationship with the airlines, that it therefore had a duty to the airline passengers. What about products liability, for example, when there's no personal injury? Let's say that a component of jet airlines with some particular wiring that was used in other industries and it failed and it caused delays because of all these aircrafts. Over a period of time, would that be a situation where? So I think it's important, Your Honor, that in your question, I just want to highlight that you're taking personal injury out of the equation because time and time again in product liability cases where we see that there's a determination that there is not preemption, it is a case involving personal injury crashes and air safety. So air safety regulation is treated differently, just it's not coming up under expressed preemption. Those conversations are happening as a function of implied preemption. And that's not what we're looking at here. We're not having a conversation about whether DOT, FAA's air safety regulations create preemption or not. And we're not dealing with this court's decision in Hodges where there was recognition that when we deal with personal injury, we're outside of the landscape of services. We're talking about essentially the operation of aircraft, navigation concerns, and there's a dovetailing of those product liability analyses and discussions that's quite consistent with this court's discussion in Hodges. So if we're talking about a product liability case that doesn't involve any personal injury, then yes, we are back to express preemption. And the question for the court, as discussed in all of these cases, whether it relates to services, rates, routes. And so we are dealing here as there with a world in which airlines have many vendors. They don't do everything themselves. They do choose to outsource when the market forces suggest to them that that's economically beneficial. And when they have these relationships, they make these determinations as with cybersecurity, that it makes sense to rely on an outside vendor to do something rather than do it themselves. What they don't do or what they haven't up until this point, and if this court affirms, they will continue not to do, is open themselves up to a world of liability not contemplated by Congress. And this is, if my opposing counsel wants to talk about the forbidden effects test, the implications here are massive. So if we step back, there's a federal regulatory scheme that we're dealing with when it comes to delays and cancellations. Congress has made a determination that if your flight is canceled, substantially delayed, and you don't take the relief that the airline is giving you, you get a refund. Beyond that, beyond the mandates around refunds for baggage fees and for your flight, everything else is left to market forces. Very explicitly, the airlines are required to create customer service plans where they tell their customers what they will do for their customers in the event of delays and cancellations. We've all been through this. You get a voucher for your dinner. They tell you, you can stay at the Holiday Inn across the street and they'll cover the bill. There is a dashboard that DOT runs where the airlines list the relief that they will provide so customers can go and look. And if they want to make choices about which airline to take, they can do it on that basis. So those are concerted, careful choices thought through a function of deregulation. Now, there are some things that none of the airlines provide. None of them give cash compensation for the paid time off that you lost or pay you for your bother and give you money for the hours spent waiting for your new flights. So the relief that the plaintiffs are trying to get here- I can't get emotional damages for having to wait in a long TSA line? Unfortunately, you cannot. And indeed, there are many, many- I was going to be a millionaire. Well, many people would be. And this is what Congress, Congress is trying to protect the airlines from exactly this. It's the reason that we are all, as I tell my children, you get what you get and you don't get upset. So when we deal with airline delays and cancellations, that is the world Congress has constructed. And we as consumers make choices when we choose which airline to fly. Did Congress intend to protect CrowdStrike? So yes, Your Honor, absolutely. And this court has recognized that. So in Linlea, you know, there was a vendor involved in Linlea or a subsidiary that was spun off. It wasn't the airline. And this court did not think that this warranted huge analysis. It dropped a footnote saying essentially, obviously, it doesn't have to be directly against the carrier. That's consistent with the language. The language says nothing about the identity of the defendant. The question is whether the claims relate to services, rates, routes. So there was no issue there. Plaintiff's own brief brings up a number of other cases where, likewise, vendors, there have been claims against vendors held preemptive. And none of those, they want to suggest they somehow come closer to airline services than cybersecurity. They do not. We're dealing, for example, in the In-Ray American Airlines privacy litigation that opposing counsel mentioned. That was a case where you had a web provider and research companies as defendants. They were referred to as the vendor defendants. The claims against them were dismissed as preempted. What did that look like? In that case, it was a data breach that had occurred. And the web provider had improperly given information from people's bookings to research companies. Claims against all of them were dismissed as preempted. And that's a much more challenging case, in my opinion, than ours. We are much more in the heartland, and that was preempted there in the case that they invoke. That was not a situation where it was part of the booking process. It was just information and then a data breach. Here, we are talking about cybersecurity. There can be no serious debate in the year 2026 about the importance of cybersecurity to airline function. It is laid plain in plaintiff's complaint. Over and over again, they talk about how important the cybersecurity products and services are to keeping planes flying as scheduled. And indeed, they do this because it's their foreseeability argument. They are saying that CrowdStrike should have known that there would be massive ground stoppages, outage, flight delays, if there was this kind of, as alleged, cybersecurity breakdown because it's so integral to airline services. And of course, the federal government has recognized this. Federal government, TSA, requires airlines to have cybersecurity. So this is not something that airlines can opt out of. Their only choices are this. Do it themselves. They don't have the in-house capabilities. They have to invest in building those up. Not efficient, perhaps. They can outsource it. They have chosen, as we saw with the CrowdStrike outage, major airlines in the United States have made a marketplace decision to bring in a vendor. That doesn't mean that they want to be on the hook for all of the kinds of damages that plaintiffs are seeking. And that is what the result would be here. If preemption is taken off the table and suits against vendors can proceed, we are talking about an explosion of liability where it has not been foreseen by the vendors or by the airlines. So it hasn't been built into contract prices. They don't have the indemnification provisions there. That's what we would see change. In the absence of preemption, CrowdStrike, but not CrowdStrike alone, needs to renegotiate with the airlines. The airlines are ultimately going to have to bear the cost of covering the damages from flight delays and cancellations. And so that will have massive implications for how they provide services, for how they go about the business of cybersecurity in order to be able to provide transportation and also huge implications for prices. And that's what the statute is about, whether the claims relate to prices, rates, services or routes. So plaintiffs can't escape the very core of their own complaint here. The district court got it quite right when it recognized that cybersecurity services, that CrowdStrike's product are core to the provision of airline services. It was premised on an understanding of how important cyber is to this whole aviation sector, which plaintiff's complaint, again, fully recognizes and the federal government recognizes. And then ultimately, if this court wants to undertake the analysis, we certainly have the kind of end run around deregulation that is of core concern to Congress in enacting the ADA. Because again, as noted, what they're looking for in this suit are exactly the kinds of relief that airlines have made a market-driven deregulation-based decision that they don't need to provide. And to the extent that suits against vendors can proceed in this way, there's nothing uncommon about flight delays and flight cancellations. The CrowdStrike outage may have been an unusual occurrence, but flight delays and cancellations are not. And airlines would then have to bear the higher costs of all of that. He raised, I'll just- Can you give me an example, I guess, from any court where a suit against a vendor, an airline vendor, is not preempted? I'm just trying to imagine how broad this preemption is that benefits the vendors because indirectly, as you say, impacts the airlines. Are there examples of vendor losses? There may be, I just don't know. So I don't know of a suit where the court held that it was not preempted. I can offer cases where there is. Preemption has been held. But I don't know of a case where there was a decision, there was no preemption. However, I would say that what we are not arguing, we are not suggesting that vendors are entitled to preemption in situations where the airlines are not. So the constraints on preemption that apply to the airline would apply likewise to the vendor. So in other words, if you've got physical injury, the case line under Hodges, if you're dealing with some of the kinds of product liability cases that don't arise under express preemption but are about implied preemption, those are situations where there has been a determination. Those are not about rates, routes, services. And so in those scenarios, those have been built into the pricing structure. There are indemnification provisions if you're a vendor in a relationship where there could be liability. But that's not this case because we are in the heartland of the kind of cases that go directly to airline services. No one is suggesting here, certainly not opposing counsel, that the airlines are liable for these kinds of relief that they're looking for in this case. They would not be able to bring this suit against an airline. They seem to appreciate that. The district court recognized that. It is unquestionably true. And so where you have this type of relationship, a vendor providing a service and the claim against the airline would be preempted, it's so clearly connected to those airline services, rates or routes, and it doesn't implicate any of the other case law that creates exemptions or exceptions for the airlines, then yes, there needs to be, and there has been found, preemption as applied to the vendors, again, to protect the underlying deregulatory aims vis-a-vis the airlines themselves. Thank you. If there are no further questions or answers, thank you so much. Thank you. Anthony Parkhill on behalf of Plaintiff's Appellants. With respect to this issue about these other cases concerning vendors, in every one of these other cases, Gordon against Amadeus in the Southern District of New York, where the conducted issue there was the provision of an IT service for the distribution and sale of airfares, so that the vendors were in the business of transmitting data about plane tickets. In American Airlines, where the case was about a website vendor who created a website that American Airlines used to, among other things, sell tickets to passengers, and in the process of selling tickets to passengers, collected personal information about individuals, and then there was a disclosure of that information in lawsuit results. All of these vendor cases involve conduct that pertains to airline services. The reason that CrowdStrike cannot point to any conduct or duties in this case that pertain to an airline service is because there are none. If preemption here could exist, it would have to be on the basis of a substantial forbidden effect, and there is none, and there's no evidence on the record to support CrowdStrike. What if it was Microsoft instead of CrowdStrike? Did all the airlines use Microsoft software that was not unique to the airlines? It wouldn't change the analysis at all. I think it's precisely this case. You could sue Microsoft. Absolutely. Could you sue the airlines for negligently using CrowdStrike? For negligently choosing to use CrowdStrike? I mean, I guess this kind of becomes just the Badra case that was decided in Georgia, and the issue there is that the plaintiffs had allegations seeking, allegations that were based on fraudulent representations about refunds and reimbursements against Delta Airlines. So this is a case arising out of the same CrowdStrike outage, and they sued for refunds and reimbursements. They sued for deceptive advertising, common law claims like these, and they were all preempted. And the reason that those claims when brought against an airline are preempted is because refunds and reimbursements and representations and marketing about refunds and reimbursements relate to fares. It's sort of an uncontroversial application of the Morales case and not a hard case. Could you sue the airlines for lost wages and for emotional distress and things that are not covered by the DOT regulations and the FAA? Could you sue them for those? So I guess in the context of these regulations, when we're interpreting the ADA, we really need to put them all on one side. Because they can't tell us how we should regulate the language that Congress used in 1978. So when we're focusing on the language Congress used in 1978, we look at whether something relates to a rate route or service of an air carrier. And in the instance of... I'm sorry, Your Honor, can you repeat your hypothetical? Um, can you sue the airline for your lost wages? So I understand what you're telling me about the Delta case is like, yeah, you couldn't get the stuff that you would otherwise get under federal regulations. You can't sue there because it's all related to stuff that you have a federal obligation to provide. So I'm giving you a hypothetical. It's not really hypothetical. It's your case with your claim. And I'm just saying, if you hadn't sued CrowdStrike or in addition to suing CrowdStrike, could you sue Delta and Southwest and whatever for negligently using CrowdStrike and the damages you want are lost wages, emotional distress, damages, et cetera? The answer is absolutely yes, so long as it's within the express terms of the contract of carriage with the air carrier. So as long as what is? As long as it's permitted by the express terms of the contract of carriage of the air carrier. And that would not be related to an airline service? Something that's expressly in the carriage contract? So this is the Wollens case from the U.S. Supreme Court. The U.S. Supreme Court held that the ADA does not preempt the voluntary undertakings of an air carrier. OK, so you're just suing it for breach of contract on their carriage service. That's right. But that's I guess now you're dodging my hypothetical because I'm asking you about negligence. I'm asking you, can you bring your negligence claims against the airline? And I've heard you say no. Yes, that's correct. But you think you can do it against the third party vendor? In a case where the third party vendor's conduct and the duties sought to impose do not relate to a railroader service of an air carrier? That's right. Plaintiff's appellants ask that the court reverse the decision of the district court. Thank you, counsel. That will conclude our argument. That will conclude our arguments of cases are under submission.