AMD sued over Spectre flaw

[Jito463]

https://www.theregister.co.uk/2018/01/17/amd_investors_sue_over_chip_flaw_silence/

 

A lawsuit was filed in California against AMD, claiming they artificially inflated stock prices by not announcing the Spectre vulnerability.

Quote

AMD stands accused of "artificially inflating" its stock price by not making public a CPU design flaw the tech world now knows as Spectre, according to a class-action lawsuit brought on behalf of investors.

 

Yesterday's filing by shareholder Doyun Kim in the northern district of California court stated: "As a result of defendants' wrongful acts and omissions, and the precipitous decline in the market value of the company's common shares, plaintiff and other class members have suffered significant losses and damages."

 

The listed defendants are AMD CEO Lisa Su and CFO Devinder Kumar.

I'm not sure the suit will stand, given that the product was already launched well before the vulnerability was discovered.  It's not like they rushed it to market after learning about Spectre, that was all discovered well after the product was released to market.  Especially given that the lawsuit alleges the artificial inflation goes back to FY 2016.

Quote

This latest legal challenge covers the period between 21 February, 2017, the day AMD filed its 2016 end-of-year financial statement, and 11 January this year, when the company made an official response to the reports of the flaws.

Another nail in the coffin of this lawsuit, is that the stock prices have actually gone up since the announcement about Spectre.

Quote

There's also the little annoying fact that AMD's share price went up after details of Meltdown and Spectre emerged in early January, and at $12.12 today, the stock price is more than its June 1 value of $10.93. It peaked at $14.76 in July.

 

Kim bought 21,000 shares in AMD at $12.24 on January 8, 2018, presumably thinking it was a safe bet. He now appears to be upset they declined in value by 0.99 per cent to $12.02 on January 12, the day after the chip design clarified its position on Meltdown and Spectre.

*EDIT*

I apparently overlooked this, there was a link to the original filing in the above story.

 

https://regmedia.co.uk/2018/01/17/amd_cpu_design_lawsuit.pdf

 

*EDIT2*

I just noticed one more bit of information (and this is why I shouldn't post late at night, when I should be sleeping).

 

Apparently, the guy bringing the lawsuit bought his shares on the 8th.  Of January.  Of this year.  In other words, he apparently bought shares after the Meltdown bug was announced, while AMD was saying there was little chance of vulnerability from Spectre.  After AMD announced they were vulnerable to Spectre, the shares dropped by 0.99% (or $0.12), meaning he lost money on a gamble (around $1,200) and now wants to cry foul.

Quote

Kim bought 21,000 shares in AMD at $12.24 on January 8, 2018, presumably thinking it was a safe bet. He now appears to be upset they declined in value by 0.99 per cent to $12.02 on January 12, the day after the chip design clarified its position on Meltdown and Spectre.

 

[Damascus]

Wtf is this.

 

I'm a little disapointed in humanity rn.

[mr moose]

stupid lawsuits from greedy lawyers.  The more money they spend defending stupid lawsuits the more they have to charge for CPU's and the less they have for developing better stuff.

[Jurrunio]

I'd rather tune to channel Intel and see how their lawsuits go

[SpaceGhostC2C]

7 minutes ago, Jito463 said:

I'm not sure the suit will stand, given that the product was already launched well before the vulnerability was discovered.  It's not like they rushed it to market after learning about Spectre, that was all discovered well after the product was released to market.  Especially given that the lawsuit alleges the artificial inflation goes back to FY 2016.

The lawsuit has nothing to do with product releases, so product release dates are irrelevant. The focus is on the timing of the disclosure of the vulnerability, and the potential evolution of stock prices between the date at which the vulnerability was known to AMD and the date in which it was revealed. More precisely, it refers to whether AMD informed about the vulnerability and its potential impact on the company's future profits in its financial statement (since by accounting rules any important information with potential impact on the firm's value must be reported, such as pending lawsuits and other examples i will remember tomorrow ).

 

I don't know whether they have a case or not, though. I just wanted to clarify it because the OP doesn't explain well what the accusation is.

[Jito463]

I updated the original post with a link to a PDF copy of the filing.

[captain_to_fire]

What are they specifically trying to accomplish by suing AMD exactly? 

[Jito463]

12 minutes ago, SpaceGhostC2C said:

The lawsuit has nothing to do with product releases, so product release dates are irrelevant. The focus is on the timing of the disclosure of the vulnerability, and the potential evolution of stock prices between the date at which the vulnerability was known to AMD and the date in which it was revealed. More precisely, it refers to whether AMD informed about the vulnerability and its potential impact on the company's future profits in its financial statement (since by accounting rules any important information with potential impact on the firm's value must be reported, such as pending lawsuits and other examples i will remember tomorrow ).

 

I don't know whether they have a case or not, though. I just wanted to clarify it because the OP doesn't explain well what the accusation is.

In a way, it does though.  The lawsuit refers to anyone "who purchased or otherwise acquired common shares of AMD between February 21, 2017 and January 11, 2018".  This seems - at least to me - to be referencing the launch of Ryzen.  However, the vulnerability wasn't disclosed to AMD until around June, so the dates seem odd, to say the least.

 

*EDIT*
Never mind, I see now that February 21st was the day of the FY 2016 filing for shareholders.  My bad.

Edited January 18, 2018 by Jito463
Clarification

[leadeater]

So the stock price went up and investors are angry? Is it just me or this makes no sense?

[Jito463]

1 minute ago, hey_yo_ said:

What are they specifically trying to accomplish by suing AMD exactly? 

That's the question no one seems to have an answer for, yet.

[Delicieuxz]

Just now, leadeater said:

So the stock price went up and investors are angry? Is it just me or this makes no sense?

Maybe Intel is sponsoring the lawsuit.

[ItsMitch]

Artificially inflated the stock rofl, have fun in court q

[dragoon20005]

[LAwLz]

1 hour ago, Jito463 said:

I'm not sure the suit will stand, given that the product was already launched well before the vulnerability was discovered.  It's not like they rushed it to market after learning about Spectre, that was all discovered well after the product was released to market.  Especially given that the lawsuit alleges the artificial inflation goes back to FY 2016.

Actually, AMD released a few more products such as Ryzen 3 and I believe Ryzen Pro after they were informed about the vulnerabilities.

But the lawsuit doesn't seem to be about launching productions while knowing they are vulnerable so that is kind of irrelevant.

 

52 minutes ago, hey_yo_ said:

What are they specifically trying to accomplish by suing AMD exactly? 

Same as with any lawsuit, to get lots and lots of money.

 

It's stupid and harmful to the entire industry.

Like I said in the Intel lawsuit thread, if these (talking about Intel, AMD or any other lawsuit which might happen because of Spectre) actually goes through and wins then expect lawsuits like these to become very common. It will happen basically every product launch.

[mr moose]

1 hour ago, LAwLz said:

Actually, AMD released a few more products such as Ryzen 3 and I believe Ryzen Pro after they were informed about the vulnerabilities.

But the lawsuit doesn't seem to be about launching productions while knowing they are vulnerable so that is kind of irrelevant.

 

 

It's stupid and harmful to the entire industry.

Like I said in the Intel lawsuit thread, if these (talking about Intel, AMD or any other lawsuit which might happen because of Spectre) actually goes through and wins then expect lawsuits like these to become very common. It will happen basically every product launch.

And then the only solution for Intel/AMD et al will be to release a full disclosure product statement that describes the fact security flaws cannot be guaranteed not to exist. 

 

Either that or in order for Intel/AMD to lose the case the court is going to have to decree that it is somehow possible for a CPU like product to be 100% flawless (perfect) by design.     We are in big trouble if that eventuates because it won;t just be hardware manufacturers but every software company on the planet that has had a security breach will be either a target or lining up a target themselves.

 

Personally I find the argument about product release/sales to be moot, all companies are told to keep operating as normal during such times. To stop selling something or to not release new products is at best unnecessarily reducing revenue and at worst a form of admission of guilt.   Even while legal action is pending the advice from lawyers is to keep trading as normal until the court orders you to stop.    There is nothing illegal about either AMD or Intel continuing the sale or release of new processors after they were informed of the bug.

[Trixanity]

3 hours ago, LAwLz said:

Actually, AMD released a few more products such as Ryzen 3 and I believe Ryzen Pro after they were informed about the vulnerabilities.

But the lawsuit doesn't seem to be about launching productions while knowing they are vulnerable so that is kind of irrelevant.

 

Same as with any lawsuit, to get lots and lots of money.

Funny thing is that it would have hurt shareholders if they withheld products from the market. Their stock would drop if they canceled Ryzen 3 and Pro.

Another thing is that it's not necessarily a new product in the sense it's just the same chip being released in a different segment after being sorted at the assembly line.

[SpaceGhostC2C]

8 hours ago, leadeater said:

So the stock price went up and investors are angry? Is it just me or this makes no sense?

Well, to be fair, whether it went up or down between two particular dates isn't relevant (the article does mention a "precipitous decline in the market value" as part of the accusation, but I think that just refers to the 1% drop in the period since the accusation bought stocks and the filing of the lawsuit). The issue is whether AMD knowingly misrepresented the value of the company in its financial statement by purposefully omitting relevant information from shareholders (hence why CEO and CFO are personally accused, so not clear AMD itself is being sued). To that end, it doesn't matter if the value is increasing or decreasing, but whether investors were mislead to expect higher increases / lower decreases (technically, all increases and declines are unpredictable by definition, but I digress ), and more generally assess the profit opportunities of AMD wrongly. For example, an investor being aware of the vulnerability could have anticipated lawsuits against AMD that will hinder its profits.

 

In other words, yes: it is an asshole lawyer suing the company for not informing him in due time that the company would become a target for asshole lawyers  

 

 

PS: I checked the filing linked by @Jito463 and the relevant bit is priceless:

 

Spoiler

4. Throughout the Class Period, Defendants made materially false and misleading
statements regarding the Company’s business, operational and compliance policies. Specifically,
Defendants made false and/or misleading statements and/or failed to disclose that: (i) a fundamental
security flaw in AMD’s processor chips renders them susceptible to hacking; and (ii) as a result,
AMD’s public statements were materially false and misleading at all relevant times.

 

5. On January 3, 2018, media outlets reported that Google Project Zero’s security team had
discovered serious security flaws affecting computer processors built by Intel Corporation (“Intel”),
AMD and other chipmakers. In a blog post, the Project Zero team stated that one of these security
flaws—dubbed the “Spectre” vulnerability—allows third parties to gather passwords and other sensitive
data from a system’s memory.

 

6. On January 3, 2018, in response to the Project Zero team’s announcement, a
spokesperson for AMD advised investors that while its own chips were vulnerable to one variant of
Spectre, there was “near zero risk” that AMD chips were vulnerable to the second Spectre variant.

7. Then, on January 11, 2018, post-market, AMD issued a press release entitled “An
Update on AMD Processor Security,” acknowledging that its chips were, in fact, susceptible to both
variants of the Spectre security flaw. The press release stated in relevant part:

Quote

 

The public disclosure on January 3rd that multiple research teams had discovered
security issues related to how modern microprocessors handle speculative
execution has brought to the forefront the constant vigilance needed to protect and
secure data. These threats seek to circumvent the microprocessor architecture
controls that preserve secure data.
At AMD, security is our top priority and we are continually working to ensure the
safety of our users as new risks arise. As a part of that vigilance, I wanted to
update the community on our actions to address the situation.

• Google Project Zero (GPZ) Variant 1 (Bounds Check Bypass or Spectre) is applicable to AMD processors. We believe this threat can be contained with an operating system (OS) patch and we have been working with OS providers to address this issue. Microsoft is distributing patches for the majority of AMD systems now. We are working closely with them to correct an issue that paused the distribution of patches for some older AMD processors (AMD Opteron, Athlon and AMD Turion X2 Ultra families) earlier this week. We expect this issue to be corrected shortly and Microsoft should resume updates for these older processors by next week. For the latest details, please see Microsoft’s website. Linux vendors are also rolling out patches across AMD products now.
• GPZ Variant 2 (Branch Target Injection or Spectre) is applicable to AMD processors. While we believe that AMD’s processor architectures make it difficult to exploit Variant 2, we continue to work closely with the industry on this threat. We have defined additional steps through a combination of processor microcode updates and OS patches that we will make available to AMD customers and partners to further mitigate the threat. AMD will make optional microcode updates available to our customers and partners for Ryzen and EPYC processors starting this week. We expect to make updates available for our previous generation products over the coming weeks. These software updates will be provided by system providers and OS vendors; please check with your supplier for the latest information on the available option for your configuration and requirements. Linux vendors have begun to roll out OS patches for AMD systems, and we are working closely with Microsoft on the timing for distributing their patches. We are also engaging closely with the Linux community on development of “return trampoline” (Retpoline) software mitigations.

 

(Emphasis added.)

 

8. On that same day, during an interview with Yahoo Finance, AMD’s Chief Executive
Officer (“CEO”) Lisa Su confirmed news that its products were susceptible to Spectre vulnerabilities,
stating: “to clarify, for Meltdown, AMD is not susceptible… we don’t have a susceptibility to that
variant. But with Spectre, AMD is susceptible.” (Emphasis added.)

 

9. On this news, AMD’s share price fell $0.12 or 0.99%, to close at $12.02 on January 12,
2018.

 

10. As a result of Defendants’ wrongful acts and omissions, and the precipitous decline in
the market value of the Company’s common shares, Plaintiff and other Class members have suffered
significant losses and damages.

Basically: the guy argues that he was mislead when AMD first said "there is “near zero risk” that AMD chips are vulnerable to the second Spectre variant", since later AMD revealed that "GPZ Variant 2 (Branch Target Injection or Spectre) is applicable to AMD processors. While we believe that AMD’s processor architectures make it difficult to exploit Variant 2, we continue to work closely with the industry on this threat", and a 0.99% drop in AMD stock followed.

The guy is suing over "near zero risk" vs. "difficult to exploit" as choice of words. Seems damn thin to me...

[Jito463]

2 hours ago, SpaceGhostC2C said:

9. On this news, AMD’s share price fell $0.12 or 0.99%, to close at $12.02 on January 12,
2018.

 

10. As a result of Defendants’ wrongful acts and omissions, and the precipitous decline in
the market value of the Company’s common shares, Plaintiff and other Class members have suffered significant losses and damages

This is where I feel the guy is going to have the biggest difficulty making his case.  A >1% decline in shares is practically a rounding error.  To call that "precipitous" is almost amusing in its ridiculousness.

[dalekphalm]

3 hours ago, SpaceGhostC2C said:

(the article does mention a "precipitous decline in the market value" as part of the accusation, but I think that just refers to the 1% drop in the period since the accusation bought stocks and the filing of the lawsuit@Jito463)

 

 

Stock regularly fluctuates more than 1% on the stock market on a daily basis, so I would not personally call a 1% drop "precipitous".

 

And I can't see how the 2nd definition would apply, given that they specifically said "precipitous decline" - AMD has no direct control over stock prices, nor does any company.

[leadeater]

3 hours ago, SpaceGhostC2C said:

Well, to be fair, whether it went up or down between two particular dates isn't relevant (the article does mention a "precipitous decline in the market value" as part of the accusation, but I think that just refers to the 1% drop in the period since the accusation bought stocks and the filing of the lawsuit).

Yea because the person who is pissed off and filed the lawsuit, on behalf of everyone lol, brought shares based on unofficial news stories that AMD was not effected then lost 0.99%. That person was an idiot.

[dalekphalm]

2 minutes ago, leadeater said:

Yea because the person who is pissed off and filed the lawsuit, on behalf of everyone lol, brought shares based on unofficial news stories that AMD was not effected then lost 0.99%. That person was an idiot.

Agreed. Obviously I won't draw any full conclusions until this goes into court (if it doesn't get thrown out anyway). But to me, this seems like a stretch. I don't think AMD did anything particularly wrong, nor do I think they should or could have done anything much differently.

 

I think this guy's lawyer is gonna get rich, but he's probably just gonna end up losing money.

[Fred Castellum]

1 hour ago, dalekphalm said:

Stock regularly fluctuates more than 1% on the stock market on a daily basis, so I would not personally call a 1% drop "precipitous".

 

And I can't see how the 2nd definition would apply, given that they specifically said "precipitous decline" - AMD has no direct control over stock prices, nor does any company.

It's almost comical, 1% down is very common stock price fluctuation. I'm actually trading AMD stock right now and it's been in oversold territory as a company for a while. 

You've got big financial institutions that just made entry positions into AMD not too long ago as well, Goldman Sachs being one of them. 

[Silentprototipe]

[mr moose]

9 hours ago, Trixanity said:

Funny thing is that it would have hurt shareholders if they withheld products from the market. Their stock would drop if they canceled Ryzen 3 and Pro.

Another thing is that it's not necessarily a new product in the sense it's just the same chip being released in a different segment after being sorted at the assembly line.

Whether it is a new product or not is moot though anyway.

[Jito463]

Made another addendum to the OP.  It seems that the guy bringing the lawsuit didn't buy AMD stock until January 8th.  Now he's upset that shares went down instead of up.