DAVID HAMPTON, Plaintiff - Appellant, and TY MESSERLI, individually and on behalf of all others similarly situated, Plaintiff, v. ROOT9B TECHNOLOGIES, INC.; JOSEPH J. GRANO, JR.; KENNETH T. SMITH, Defendants - Appellees.
No. 16-1417
UNITED STATES COURT OF APPEALS TENTH CIRCUIT
July 30, 2018
PUBLISH. Elisabeth A. Shumaker Clerk of Court.
Appeal from the United States District Court for the District of Colorado (D.C. No. 1:15–CV-02152-MSK-MEH)
Nicholas I. Porritt, of Levi & Korsinsky LLP, Washington, D.C. (Alexander A. Krot, III, of Levi & Korsinsky LLP, Washington, D.C., and Kip B. Shuman and Rusty E. Glenn, of The Shuman Law Firm, Denver, Colorado, with him on the briefs), for Plaintiff-Appellant.
Nina F. Locker, of Wilson Sonsini Goodrich & Rosati Professional Corporation, Palo Alto, California (Steven Guggenheim, Joni L. Ostler, Evan L. Seite, of Wilson Sonsini Goodrich & Rosati Professional Corporation, Palo Alto, California, and Holly Stein Sollod, Christina F. Gomez, Cici Cheng, of Holland & Hart LLP, Denver, Colorado, with her on the briefs) for Defendants-Appellees.
Before HARTZ, KELLY, and HOLMES, Circuit Judges.
This appeal arises from the district court‘s dismissal of Plaintiff-Appellant David Hampton‘s securities-fraud class action against Defendants-Appellees root9B Technologies, Inc. (“root9B“), a provider of cybersecurity products and services, Joseph J. Grano, Jr., root9B‘s Chief Executive Officer and Chairman, and Kenneth T. Smith, root9B‘s former Chief Financial Officer (collectively, “Defendants“). Mr. Hampton brought this action pursuant to §§ 10(b) and 20(a) of the Securities Exchange Act of 1934,
Mr. Hampton identified two statements that he alleges were false or misleading and material: (1) a letter from Mr. Grano to investors—language from which was repeated in a number of SEC filings—attesting that root9B was differentiated from competitors by its “proprietary hardware and software,” Aplt.‘s App. at 15 (Am. Class Compl., dated Jan. 4, 2016); and (2) a press release and associated report published by root9B in which the company claimed to have detected a planned cyber attack against a number of international financial institutions, id. at 30. He further alleges that the individual defendants—i.e., Mr. Grano and Mr. Smith—are jointly and severally liable under
The district court dismissed Mr. Hampton‘s claims, finding that he had failed to sufficiently plead that the identified statements were false or misleading. Mr. Hampton appeals, and exercising jurisdiction pursuant to
I
root9B provides “cybersecurity, regulatory risk mitigation, and energy and controls solutions” through three business lines: Cyber Solutions, Business Advisory Solutions, and Energy Solutions. Aplees.’ Resp. Br. at 1. In November 2013, Premier Alliance Group, Inc. (“Premier Alliance“), a publicly-traded company, acquired root9B LLC in exchange for cash and restricted shares of Premier Alliance common stock. On October 17, 2014, Mr. Grano, the Chief Executive Officer and Chairman
A
Mr. Hampton alleges that root9B issued, during and after the rebranding, the two misleading statements underlying this dispute.
First, in the aforementioned October 17 letter to investors, Mr. Grano identified, as a competitive strength of root9B, its “proprietary hardware and software designed to combat the new methodologies being utilized by state-sponsored and sophisticated individual hackers.” Aplt.‘s App. at 23–24; id. at 241 (Form 8-K, dated Oct. 17, 2014 (“Grano letter“)). That statement was repeated in SEC filings on November 14, 2014, March 31, 2015, and May 15, 2015. Following Mr. Grano‘s letter, root9B raised $11.5 million over three stock and option offerings in February and March of 2015. Defendants filed a post-effective amendment to the registration statement on May 1, 2015, pursuant to which Mr. Grano and other root9B “insiders” were able to sell shares to the public. Id. at 68-70.
Second, root9B announced, via a press release on May 12, 2015, that it had uncovered and defeated plans by a state-sponsored team of Russian hackers, known as Sofacy or APT28, to target several international financial institutions (“Sofacy statements“). Id. at 30–37, 249–50 (root9B Uncovers Planned Sofacy Cyber Attack Targeting Several International and Domestic Financial Institutions, PR NEWSWIRE, dated May 12, 2015). root9B claimed that this was “the first and only known Sofacy attack to be discovered, identified, and reported” before the attack began. Id. at 32 (emphasis omitted). root9B contemporaneously published a report entitled “APT28 Targets Financial Markets: root9B Releases Zero Day Hashes” (“APT28 Report“) explaining its basis for attributing the planned attack to Sofacy. Id. at 31, 251–59 (APT28 Targets Financial Markets: root9B Releases Zero Day Hashes, ROOT9B.COM, dated May 10, 2015). Mr. Grano gave a televised interview on Fox Business on May 14, 2015, during which he discussed the Sofacy statements and said that he was aware of the evidence upon which root9B attributed the attack to Sofacy. Following the announcement, the price of root9B‘s stock rose 42% between May 11, 2015 and May 19, 2015, to an “all-time trading high of $2.51.” Id. at 37.
B
Mr. Hampton alleges that two subsequent articles that challenged root9B‘s statements caused the company‘s inflated share price to fall.
First, on May 20, 2015, “cybersecurity expert” and former reporter Brian Krebs published an article entitled “Security Firm Redefines APT: African Phishing Threat” (“Krebs article“) on his security news blog, challenging root9B‘s attribution of the attack to Sofacy. Id. at 44, 120–22 (Brian Krebs, Security Firm Redefines APT: African Phishing Threat, KREBS ON SECURITY, dated May 20, 2015). Mr. Krebs claimed that root9B had “scant evidence” to support its attribution of the attack to Sofacy. Id. at 45, 122. According to Mr. Krebs, root9B based the attribution in large part upon the use of a domain known to be used by Sofacy. However, based in part on his claim that this server was associated with a number of bad actors in the world of cyberattacks, Mr. Krebs concluded that the attack was more likely a “run-of-the-mill bank phishing scam[]” perpetrated by “Nigerian scammers.” Id.
Second, on June 15, 2015, an anonymous author known as Pump Stopper published an article entitled “ROOT9: -82.5% Downside [o]n Management Fraud Allegations, Cyber Failure [a]nd Bankruptcy - Strong Sell” (“Pump Stopper article“) on the website SeekingAlpha.com. Aplt.‘s App. at 46, 95–119 (Pump Stopper, Root9: -82.5% Downside On Management Fraud Allegations, Cyber Failure And Bankruptcy - Strong Sell, SEEKING ALPHA, dated June 15, 2015). In the article, the author claimed that the financial results reported for the Cyber Solutions sector of root9B‘s business reflected “a one-time[,] low margin hardware installation,” and the resale and installation of a product called Digital Shield.1 Id. at 47. The author allegedly based his or her claims on an interview with Mr. Smith, root9B‘s CFO. Mr. Hampton claims that, as a result of the Pump Stopper article, root9B‘s share price fell by 9% on June 15, 2015 on heavy trading, from $1.87 to $1.70. The share price fell an additional 40%, to $1.02, by June 23, 2015.
II
Securities-fraud claims were first filed in the United States District Court for the Central District of California by Ty Messerli, on behalf of others similarly situated. Those claims were transferred to the District of Colorado on September 29, 2015. A magistrate judge granted Mr. Hampton‘s motion for appointment as lead plaintiff, which was unopposed. See Hampton v. Root9B Techs., Inc., Dist. Ct. No. 15-cv-02152-MSK-MEH, Doc. 18, at 1–2 (Order, dated Oct. 14, 2015).
Mr. Hampton filed an amended class-action complaint on January 4, 2016, alleging violations of Securities Exchange Act
The district court, adopting in part and rejecting in part the magistrate judge‘s recommendation, entered an opinion and final judgment on September 21, 2016 that granted Defendants’ motion to dismiss all claims. Aplt.‘s App. at 404 (Op. & Order Granting Mot. to Dismiss, dated Sept. 21,
The court acknowledged that Mr. Hampton‘s assertion of falsity with regard to the proprietary-hardware statements relied on the Pump Stopper article and Defendants’ deletion of the statements from subsequent SEC filings. The court found it “entirely unclear” how Mr. Hampton sought to equate the proprietary-hardware statements with the Pump Stopper article‘s description of “a onetime low margin hardware installation.” Id. at 411. The court noted that, while it was possible that the two phrases referred to the same hardware, Mr. Hampton‘s “obligation under [Rule] 12(b)(6) require[d] him to plead something more than . . . mere possibility.” Id. at 412. It further reasoned that even if the two phrases referred to the same hardware, (1) there was no “inherent[] inconsisten[cy]” between the characterizations “proprietary” and “low margin,” and (2) there was no inherent inconsistency between the characterizations “proprietary” and “re-sale.” Id. at 411–12. The court was further unconvinced by the deletion of the “proprietary hardware” language from the SEC filings because Defendants had in fact deleted “an entire block of text promot[ing] several ways in which [root9B] believed its business was different from its competition.” Id. at 412-13. root9B‘s later SEC filings also disclosed that “‘revenue . . . from hardware resales . . . was not repeated in’ subsequent quarters,” and that re-sales would be “discontinued,” which “explained[ed] why [root9B] ceased touting its hardware as ‘proprietary’ in late-2015.” Id. at 413.
The district court similarly rejected Mr. Hampton‘s claim with regard to the Sofacy statements. After concluding that Mr. Hampton‘s allegation of falsity rested entirely on the Krebs article, the court found that the Krebs article merely offered an alternative explanation, but did not offer proof that root9B‘s attribution was false. The court arrived at this conclusion even after determining that root9B‘s Sofacy-based claim was a statement of fact, rather than a statement of opinion, which had the effect of holding Mr. Hampton to a less-demanding pleading standard.
Because the district court found that Mr. Hampton had not sufficiently alleged that either set of statements was, in fact, false, the court did not reach the other elements of Mr. Hampton‘s claim under
Mr. Hampton timely appealed from the district court‘s judgment.
III
“Because this is an appeal from a motion to dismiss, we accept all well-pleaded facts, as distinguished from conclusory allegations, as true.” Adams v. Kinder-Morgan, Inc., 340 F.3d 1083, 1088 (10th Cir. 2003). And we conduct a “de novo review of the dismissal.” Anderson v. Spirit Aerosystems Holdings, Inc., 827 F.3d 1229, 1237 (10th Cir. 2016). Furthermore, “notwithstanding the usual rule that a court should consider no evidence beyond the pleadings on a [Federal] Rule [of Civil Procedure] 12(b)(6) motion to dismiss, ‘the district court may consider documents referred to in the complaint if the documents are central to the plaintiff‘s claim and the parties do not dispute the documents’ authenticity.‘”2 Alvarado v. KOB-TV, L.L.C., 493 F.3d 1210, 1215 (10th Cir. 2007) (quoting Jacobsen v. Deseret Book Co., 287 F.3d 936, 941 (10th Cir. 2002)).
A
To state a claim under
[A] defendant made statements that[:] (1) contained false or misleading statements of material fact, (2) related to the purchase or sale of a security, (3) were made with intent to defraud investors or conscious disregard of a risk that shareholders would be misled (scienter), (4) led to reliance by the plaintiff, and (5) caused the plaintiff‘s loss (loss causation).
Nakkhumpun v. Taylor, 782 F.3d 1142, 1146–47 (10th Cir. 2015); accord In re Zagg, Inc. Sec. Litig., 797 F.3d 1194, 1200 (10th Cir. 2015); City of Philadelphia v. Fleming Cos., 264 F.3d 1245, 1257–58 (10th Cir. 2001).
The Private Securities Litigation Reform Act of 1995 (“PSLRA“),
Relevant to this appeal, the PSLRA requires a plaintiff to identify “each statement alleged to have been misleading, the . . . reasons why the statement is misleading, and, if an allegation regarding the statement or omission is made on information and belief, [that] the complaint shall state with particularity all facts on which the belief is formed.”
In reviewing the sufficiency of a plaintiff‘s pleadings, we “evaluat[e] the facts alleged in a complaint to determine whether, taken as a whole, they support a reasonable belief that the defendant‘s statements identified by the plaintiff were false or misleading.” Adams, 340 F.3d at 1099. In doing so, we evaluate:
(1) the level of detail provided by the facts stated in a complaint; (2) the number
of facts provided; (3) the coherence and plausibility of the facts when considered together; (4) whether the source of the plaintiff‘s knowledge about a stated fact is disclosed; (5) the reliability of the sources from which the facts were obtained; and (6) any other indicia of how strongly the facts support the conclusion that a reasonable person would believe that the defendant‘s statements were misleading.
Id.
“To meet the [pleading] standard, plaintiffs are not required to disclose the documentary or personal sources from which they learned the facts alleged . . . . [T]he PSLRA did heighten the standard of pleading securities fraud, [however,] and where a plaintiff does not identify the sources of the facts stated in the complaint, the facts alleged . . . will usually have to be particularly detailed, numerous, plausible, or objectively verifiable by the defendant before they will support a reasonable belief that the defendant‘s statements were false or misleading.” Id. at 1103.
There is a meaningful distinction between statements of opinion and statements of fact; the former require a plaintiff to meet a higher pleading standard. “[P]ure statements of opinion,” Omnicare, Inc. v. Laborers Dist. Council Constr. Indus. Pension Fund, 135 S. Ct. 1318, 1327 (2015), and “statements of optimism that are not capable of objective verification” are not material misstatements unless they inaccurately represent “the speakers’ beliefs concerning then-present factual conditions,” Grossman v. Novell, Inc., 120 F.3d 1112, 1119, 1123 (10th Cir. 1997). “[S]tatements of opinion or belief must rest on ‘a factual basis that justifies them as accurate, the absence of which renders them misleading.‘” Id. at 1123 (quoting Va. Bankshares, Inc. v. Sandberg, 501 U.S. 1083, 1093 (1991)).
Having reviewed the applicable law, we address, in turn, Mr. Hampton‘s arguments that the district court erred in dismissing his claims based on root9B‘s proprietary-hardware and Sofacy statements. We conclude—as to both sets of statements—that Mr. Hampton fails to sufficiently plead the first prong—i.e., that root9B made materially false statements. Accordingly, we reject Mr. Hampton‘s contentions of error and uphold the district court‘s dismissal of his amended complaint.
B
We first address the alleged falsity of the proprietary-hardware statements. As discussed above, Mr. Hampton alleges that root9B‘s statements were false based on (1) the Pump Stopper article (which in turn relied on an alleged interview with CFO Smith), and (2) the subsequent omission of the relevant statements from root9B‘s SEC filings. The district court dismissed Mr. Hampton‘s claims because it found that the Pump Stopper article‘s statements and the omission of the “proprietary hardware and software” language from subsequent filings did not disprove root9B‘s earlier claims that it offered proprietary hardware. See Aplt.‘s App. at 411–13. We agree with the district court‘s conclusions for a number of reasons.
First, Mr. Hampton cannot show that the “low margin hardware installation” and resale products that the Pump Stopper article identifies—which Mr. Hampton claims refers to “a third-party‘s hardware,” Aplt.‘s Opening Br. at 25—are in fact the same products that the Grano letter and related SEC filings refer to as “proprietary hardware and software.” Therefore, Mr. Hampton necessarily falters in demonstrating that the “proprietary” label was false or misleading because
Second, the exclusion of the “proprietary hardware and software” language from subsequent SEC filings does not provide sufficient evidence that the language was removed on account of the Pump Stopper article‘s representations; rather, a reasonable reading of the language that replaced the “propriety hardware and software” language is that it simply provides greater details regarding the products comprising that hardware or software.
Specifically, Mr. Hampton offers four filings featuring the “proprietary hardware and software” language prior to the Pump Stopper article. The first of these is the Form 8-K disclosure of Grano‘s letter itself. The second and third are, respectively, the Form 10-Q quarterly disclosure and the Form 10-K annual disclosure covering the period in which Grano sent the letter to investors; these filings would naturally include information like Grano‘s rebranding update. The final filing is the May 15, 2015 Form 10-Q. The relevant language in that filing largely repeated the language from the annual disclosure:
In the latter half of 2014, the Company launched and announced the repositioning of the Company‘s business and adjustment to its strategy to focus on cybersecurity and regulatory risk mitigation. . . . The strategic change in focus was driven by several factors [including] our expertise, capabilities and proprietary solutions in the cyber security sector . . . . [O]ur cyber security segment is differentiated in four ways[, including our] proprietary hardware and software designed to combat the new methodologies being utilized by state-sponsored and sophisticated individual hackers. . . . During 2015, we are building an Adversarial Pursuit Operations Center to expand our ability to deliver these services as well as continuing to develop our proprietary products.
Aplt.‘s App. at 41–42 (emphasis omitted).
Mr. Hampton then identifies two post-Pump-Stopper-article filings from which the “proprietary hardware and software” language was omitted: a Form 10-Q quarterly disclosure filed on August 14, 2015, and a Form 10-Q quarterly disclosure filed in November 2015. Id. at 48–51. The “Outlook” section, in which the above language appeared in the previous Form 10-Q, is rewritten nearly identically in both subsequent filings:
The Company acquired root9B, its wholly owned cybersecurity business at the end of 2013. In 2014, root9B began expanding the number of subject matter experts it employs . . . and developed and enhanced its offensive and defensive cyber operations platforms and tools. These efforts have resulted in the development of Orion[,] an Active Adversarial Pursuit (HUNT) platform[;] Orkos which identifies compromised credentials and supports predictive remediation[;] Cerberus which provides host based security analytics and breach monitoring[;] and Event Horizon which provides non attributable network access that allows users to connect to a secure managed tunnel for web, e-mail and file transfers. . . . We plan to discontinue the re-sale of hardware and focus on the development, sale and licensing of root9B‘s tools at significantly higher margins. . . . We are still in the early stages of commercialization . . . .
Id. at 51 (emphasis omitted). Far from abandoning claims about the existence of
Third, as the district court noted, even assuming arguendo that Mr. Hampton was able to link the “proprietary hardware” language, which root9B‘s SEC filings spoke of, to the Pump Stopper article‘s reference to “low margin hardware installation,” his claim fails because there is nothing inherently inconsistent between those two statements. See Aplt.‘s App. at 412. Mr. Hampton attacks this reasoning, arguing that the district court‘s discussion “disregards that the crux of Plaintiff‘s allegations concerning the ‘proprietary hardware’ statements was not the amount of margins [root9B] was receiving from selling the ‘hardware,’ but whether the hardware root9B was selling was in fact ‘proprietary’ to root9B.” Aplt.‘s Opening Br. at 32. However, the district court specifically and persuasively addressed this issue by stating that Mr. Hampton‘s claim was meritless “[a]bsent evidence that reveal[ed] that the ‘proprietary hardware’ in question was off-the-shelf equipment equally available to [root9B‘s] customers or competitors.” Aplt.‘s App. at 412. And, on appeal, Mr. Hampton still fails to show that it is anything more than merely possible that the proprietary hardware at issue was in fact freely available to root9B‘s potential customers and competitors—as opposed to being controlled by root9B and subject to its restrictions or limitations.3
Accordingly, because Mr. Hampton fails to plead sufficient facts to show that root9B‘s proprietary-hardware statements were false or misleading, we uphold the district court‘s conclusion on this issue.
C
We next address Mr. Hampton‘s Sofacy-based claim. Relying on the Krebs article, Mr. Hampton asserts that root9B‘s Sofacy press release, its APT28 report, and Mr. Grano‘s Fox Business interview misattributed the source of the planned cyberattack that root9B claimed to have uncovered.
Before reaching the merits of the claim, we turn to the question of whether root9B‘s attribution of the planned attack was a statement of fact, which is subject to a comparatively lower pleading standard, or a statement of opinion. See generally MHC Mut. Conversion Fund, L.P. v. Sandler O‘Neill & Partners, L.P., 761 F.3d 1109 (10th Cir. 2014) (Gorsuch, J.) (discussing the distinction between statements of fact and statements of opinion). The district court found that the attribution was “an assertion of fact, not a mere statement of opinion,” thus reviewing, and ultimately rejecting, Mr. Hampton‘s claim based on the less-demanding pleading standard. Aplt.‘s App. at 413. Although the parties dispute whether the district court erred in concluding so, we need not decide the issue: even assuming arguendo that root9B‘s attribution of the attack to Sofacy was a statement of fact, Mr. Hampton cannot prevail; that is, he cannot surmount even the lower pleading hurdle.
We agree, however, with the district court‘s determination that Mr. Hampton fails to show that the Sofacy attribution was false or misleading. To be sure, the Krebs article provides factual allegations regarding the registration of the domains identified as suspicious by root9B. But, despite Mr. Hampton‘s protestations, we conclude that the Krebs article merely provides an alternative attribution—i.e., potentially Nigerian scammers—and therefore falls far short of establishing that the Sofacy attribution was untrue or even misleading. For example, the Krebs article fails to explicitly state that the Sofacy attribution was actually untrue, and instead only indicates that it was more likely that the attack was perpetrated by a different source (i.e., Nigerian scammers). Id. Indeed, the article even hedges on its alternative finding by noting that root9B could have been “holding back key details about their research,” see id. at 45, 122, which, if true, could presumably impact the Krebs assessment.
Finally, it is significant that the Krebs article only addresses a portion of the evidence upon which the Defendants made the attribution. root9B‘s APT report, for example, cites the fact that the Sofacy group had in the “past attempt[ed] to launch attacks against many of the same targets” and that the “design of the hack [bore a] striking similarity to the very exploits that have made Sofacy so feared and respected.” Aplt.‘s App. at 256–57. The Krebs article, however, does not dispute those indicators in any way, nor explain why they could not have supported root9B‘s Sofacy attribution.
Lastly, we reject Mr. Hampton‘s contention that the district court erred by failing to treat his factual allegations related to the Sofacy matter as true. Specifically, Mr. Hampton asserts that the district court, by focusing on the fact that the true attackers may never be known, erred by failing to accept his allegations that “the Krebs Report attribute[s] the attack to Nigerian hackers or, at least, not to Sofacy.” Aplt.‘s Opening Br. at 39. However, there is no logical inconsistency between the district court‘s belief that the true identity of the hackers “remains an unsolved mystery,” Aplt.‘s App. at 415, and its acceptance of the fact that the Krebs article—based on its independent analysis—“suggest[ed that] the actors in question were relatively unsophisticated Nigerian phishers,” id. at 121 (emphasis added). By its terms, the Krebs article does not purport to have irrefutable
As Mr. Hampton has failed to plead sufficient facts to establish that root9B‘s statements regarding the Sofacy attack were false or misleading, we need not reach the remaining prongs of the established securities-fraud analysis, and uphold the district court‘s dismissal of this claim.
IV
Finally, we reject Mr. Hampton‘s challenge to the district court‘s dismissal of his
V
For the foregoing reasons, we AFFIRM the district court‘s judgment.
Notes
Aplt.‘s App. at 47 (emphases omitted).Since [root9B‘s] “cyber” product is so obviously a bad joke . . . I felt compelled to double check with the company in case I missed something, how can there be nothing of value at [root9B?] . . . I called [CFO Smith] to get more perspective on . . . the company‘s product claims. . . . I was told a large portion of “cyber” was actually a one-time low margin hardware installation, projects [root9B] will be apparently moving away from going forward . . . . Best I can tell, another component of revenue is largely what appears to me [to be] an old training and certification service for a product [root9B] acts as a reseller for. During our conversation, [Smith] didn‘t even seem to know what the product was called! . . . [I]t appears to me [that root9B‘s] cyber claims are also based on a product called Digital Shield, a product [root9B] resells, and installs for other companies and municipalities with a price point of $3,600 - [root9B] is going to have to do an impossible amount of reselling this old “training module” to justify the current market capitalization of $134 million!