Hampton v. Root9B Technologies , 897 F.3d 1291 ( 2018 )

FILED
United States Court of Appeals
Tenth Circuit
July 30, 2018
PUBLISH
Elisabeth A. Shumaker
UNITED STATES COURT OF APPEALS Clerk of Court
TENTH CIRCUIT
DAVID HAMPTON,
Plaintiff - Appellant,
and
TY MESSERLI, individually and on
behalf of all others similarly situated,
Plaintiff,
v. No. 16-1417
ROOT9B TECHNOLOGIES, INC.;
JOSEPH J. GRANO, JR.; KENNETH
T. SMITH,
Defendants - Appellees.
Appeal from the United States District Court
for the District of Colorado
(D.C. No. 1:15–CV-02152-MSK-MEH)
Nicholas I. Porritt, of Levi & Korsinsky LLP, Washington, D.C. (Alexander A.
Krot, III, of Levi & Korsinsky LLP, Washington, D.C., and Kip B. Shuman and
Rusty E. Glenn, of The Shuman Law Firm, Denver, Colorado, with him on the
briefs), for Plaintiff-Appellant.
Nina F. Locker, of Wilson Sonsini Goodrich & Rosati Professional Corporation,
Palo Alto, California (Steven Guggenheim, Joni L. Ostler, Evan L. Seite, of
Wilson Sonsini Goodrich & Rosati Professional Corporation, Palo Alto,
California, and Holly Stein Sollod, Christina F. Gomez, Cici Cheng, of Holland &
Hart LLP, Denver, Colorado, with her on the briefs) for Defendants-Appellees.
Before HARTZ, KELLY, and HOLMES, Circuit Judges.
HOLMES, Circuit Judge.
This appeal arises from the district court’s dismissal of Plaintiff-Appellant
David Hampton’s securities-fraud class action against Defendants-Appellees
root9B Technologies, Inc. (“root9B”), a provider of cybersecurity products and
services, Joseph J. Grano, Jr., root9B’s Chief Executive Officer and Chairman,
and Kenneth T. Smith, root9B’s former Chief Financial Officer (collectively,
“Defendants”). Mr. Hampton brought this action pursuant to §§ 10(b) and 20(a)
of the Securities Exchange Act of 1934, 15 U.S.C. §§ 78j(b) & 78t(a), and
Securities and Exchange Commission (“SEC”) Rule 10b-5, 17 C.F.R. § 240.10b-
5, claiming that root9B made false or misleading statements in connection with
the purchase or sale of securities.
Mr. Hampton identified two statements that he alleges were false or
misleading and material: (1) a letter from Mr. Grano to investors—language from
which was repeated in a number of SEC filings—attesting that root9B was
differentiated from competitors by its “proprietary hardware and software,”
Aplt.’s App. at 15 (Am. Class Compl., dated Jan. 4, 2016); and (2) a press release
and associated report published by root9B in which the company claimed to have
detected a planned cyber attack against a number of international financial
2
institutions, id. at 30. He further alleges that the individual defendants—i.e., Mr.
Grano and Mr. Smith—are jointly and severally liable under § 20(a).
The district court dismissed Mr. Hampton’s claims, finding that he had
failed to sufficiently plead that the identified statements were false or misleading.
Mr. Hampton appeals, and exercising jurisdiction pursuant to 28 U.S.C. § 1291,
we affirm.
I
root9B provides “cybersecurity, regulatory risk mitigation, and energy and
controls solutions” through three business lines: Cyber Solutions, Business
Advisory Solutions, and Energy Solutions. Aplees.’ Resp. Br. at 1. In November
2013, Premier Alliance Group, Inc. (“Premier Alliance”), a publicly-traded
company, acquired root9B LLC in exchange for cash and restricted shares of
Premier Alliance common stock. On October 17, 2014, Mr. Grano, the Chief
Executive Officer and Chairman of Premier Alliance, published a letter to
shareholders announcing plans to rebrand Premier Alliance as root9B
Technologies, Inc. The rebranding took place on December 1, 2014. Mr. Grano
explained that the rebranding reflected a business strategy focused on growing the
cybersecurity business.
A
Mr. Hampton alleges that root9B issued, during and after the rebranding,
the two misleading statements underlying this dispute.
3
First, in the aforementioned October 17 letter to investors, Mr. Grano
identified, as a competitive strength of root9B, its “proprietary hardware and
software designed to combat the new methodologies being utilized by state-
sponsored and sophisticated individual hackers.” Aplt.’s App. at 23–24; id. at
241 (Form 8-K, dated Oct. 17, 2014 (“Grano letter”)). That statement was
repeated in SEC filings on November 14, 2014, March 31, 2015, and May 15,
2015. Following Mr. Grano’s letter, root9B raised $11.5 million over three stock
and option offerings in February and March of 2015. Defendants filed a post-
effective amendment to the registration statement on May 1, 2015, pursuant to
which Mr. Grano and other root9B “insiders” were able to sell shares to the
public. Id. at 68–70.
Second, root9B announced, via a press release on May 12, 2015, that it had
uncovered and defeated plans by a state-sponsored team of Russian hackers,
known as Sofacy or APT28, to target several international financial institutions
(“Sofacy statements”). Id. at 30–37, 249–50 (root9B Uncovers Planned Sofacy
Cyber Attack Targeting Several International and Domestic Financial
Institutions, PR N EWSWIRE , dated May 12, 2015). root9B claimed that this was
“the first and only known Sofacy attack to be discovered, identified, and
reported” before the attack began. Id. at 32 (emphasis omitted). root9B
contemporaneously published a report entitled “APT28 Targets Financial
Markets: Root9B Releases Zero Day Hashes” (“APT28 Report”) explaining its
4
basis for attributing the planned attack to Sofacy. Id. at 31, 251–59 (APT28
Targets Financial Markets: Root9B Releases Zero Day Hashes, R OOT 9B. COM ,
dated May 10, 2015). Mr. Grano gave a televised interview on Fox Business on
May 14, 2015, during which he discussed the Sofacy statements and said that he
was aware of the evidence upon which root9B attributed the attack to Sofacy.
Following the announcement, the price of root9B’s stock rose 42% between May
11, 2015 and May 19, 2015, to an “all-time trading high of $2.51.” Id. at 37.
B
Mr. Hampton alleges that two subsequent articles that challenged root9B’s
statements caused the company’s inflated share price to fall.
First, on May 20, 2015, “cybersecurity expert” and former reporter Brian
Krebs published an article entitled “Security Firm Redefines APT: African
Phishing Threat” (“Krebs article”) on his security news blog, challenging
root9B’s attribution of the attack to Sofacy. Id. at 44, 120–22 (Brian Krebs,
Security Firm Redefines APT: African Phishing Threat, K REBS ON S ECURITY ,
dated May 20, 2015). Mr. Krebs claimed that root9B had “scant evidence” to
support its attribution of the attack to Sofacy. Id. at 45, 122. According to Mr.
Krebs, root9B based the attribution in large part upon the use of a domain known
to be used by Sofacy. However, based in part on his claim that this server was
associated with a number of bad actors in the world of cyberattacks, Mr. Krebs
concluded that the attack was more likely a “run-of-the-mill bank phishing
5
scam[]” perpetrated by “Nigerian scammers.” Id. at 45, 122. The article claimed
that this conclusion was corroborated by the “chief scientist” of “one of the
security firms that first published the initial findings on the Sofacy/APT28 group
back in October 2014.” Id. at 46, 122. Mr. Hampton claims that, as a result of
the Krebs article, root9B’s share price fell by 8%, from $2.51 on May 19, 2015 to
$2.32 on May 21, 2015.
Second, on June 15, 2015, an anonymous author known as Pump Stopper
published an article entitled “ROOT9: -82.5% Downside [o]n Management Fraud
Allegations, Cyber Failure [a]nd Bankruptcy - Strong Sell” (“Pump Stopper
article”) on the website SeekingAlpha.com. Aplt.’s App. at 46, 95–119 (Pump
Stopper, Root9: -82.5% Downside On Management Fraud Allegations, Cyber
Failure And Bankruptcy - Strong Sell, S EEKING A LPHA , dated June 15, 2015). In
the article, the author claimed that the financial results reported for the Cyber
Solutions sector of root9B’s business reflected “a one-time[,] low margin
hardware installation,” and the resale and installation of a product called Digital
Shield. 1 Id. at 47. The author allegedly based his or her claims on an interview
1
The Pump Stopper article included, in pertinent part:
Since [root9B’s] “cyber” product is so obviously a bad
joke . . . I felt compelled to double check with the company in
case I missed something, how can there be nothing of value at
[root9B?] . . . I called [CFO Smith] to get more perspective on
. . . the company’s product claims.
6
with Mr. Smith, root9B’s CFO. Mr. Hampton claims that, as a result of the Pump
Stopper article, root9B’s share price fell by 9% on June 15, 2015 on heavy
trading, from $1.87 to $1.70. The share price fell an additional 40%, to $1.02, by
June 23, 2015.
II
Securities-fraud claims were first filed in the United States District Court
for the Central District of California by Ty Messerli, on behalf of others similarly
situated. Those claims were transferred to the District of Colorado on September
29, 2015. A magistrate judge granted Mr. Hampton’s motion for appointment as
lead plaintiff, which was unopposed. See Hampton v. Root9B Techs., Inc., Dist.
Ct. No. 15-cv-02152-MSK-MEH, Doc. 18, at 1–2 (Order, dated Oct. 14, 2015).
Mr. Hampton filed an amended class-action complaint on January 4, 2016,
I was told a large portion of “cyber” was actually a
one-time low margin hardware installation, projects [root9B] will
be apparently moving away from going forward . . . . Best I can
tell, another component of revenue is largely what appears to me
[to be] an old training and certification service for a product
[root9B] acts as a reseller for. During our conversation, [Smith]
didn’t even seem to know what the product was called! . . .
[I]t appears to me [that root9B’s] cyber claims are also
based on a product called Digital Shield, a product [root9B]
resells, and installs for other companies and municipalities with
a price point of $3,600 - [root9B] is going to have to do an
impossible amount of reselling this old “training module” to
justify the current market capitalization of $134 million!
Aplt.’s App. at 47 (emphases omitted).
7
alleging violations of Securities Exchange Act §§ 10(b) and 20(a), and SEC Rule
10b-5, and also purporting to represent a class of “all persons who acquired
root9B securities between October 17, 2014 and June 15, 2015, inclusive.”
Aplt.’s App. at 13, 15. Defendants moved to dismiss the amended complaint on
February 18, 2016. Mr. Hampton filed a brief in opposition to the motion to
dismiss.
The district court, adopting in part and rejecting in part the magistrate
judge’s recommendation, entered an opinion and final judgment on September 21,
2016 that granted Defendants’ motion to dismiss all claims. Aplt.’s App. at 404
(Op. & Order Granting Mot. to Dismiss, dated Sept. 21, 2016), 417 (Final J.,
dated Sept. 21, 2016). The district court held that Mr. Hampton had failed to
state a claim under § 10(b) or § 20(a) because his “allegations [were] insufficient
to allege that either [the proprietary-hardware statements or the Sofacy statements
were] false.” Id. at 410.
The court acknowledged that Mr. Hampton’s assertion of falsity with
regard to the proprietary-hardware statements relied on the Pump Stopper article
and Defendants’ deletion of the statements from subsequent SEC filings. The
court found it “entirely unclear” how Mr. Hampton sought to equate the
proprietary-hardware statements with the Pump Stopper article’s description of “a
onetime low margin hardware installation.” Id. at 411. The court noted that,
while it was possible that the two phrases referred to the same hardware, Mr.
8
Hampton’s “obligation under [Rule] 12(b)(6) require[d] him to plead something
more than . . . mere possibility.” Id. at 412. It further reasoned that even if the
two phrases referred to the same hardware, (1) there was no “inherent[]
inconsisten[cy]” between the characterizations “proprietary” and “low margin,”
and (2) there was no inherent inconsistency between the characterizations
“proprietary” and “re-sale.” Id. at 411–12. The court was further unconvinced by
the deletion of the “proprietary hardware” language from the SEC filings because
Defendants had in fact deleted “an entire block of text promot[ing] several ways
in which [root9B] believed its business was different from its competition.” Id. at
412–13. root9B’s later SEC filings also disclosed that “‘revenue . . . from
hardware resales . . . was not repeated in’ subsequent quarters,” and that re-sales
would be “discontinued,” which “explained[ed] why [root9B] ceased touting its
hardware as ‘proprietary’ in late-2015.” Id. at 413.
The district court similarly rejected Mr. Hampton’s claim with regard to the
Sofacy statements. After concluding that Mr. Hampton’s allegation of falsity
rested entirely on the Krebs article, the court found that the Krebs article merely
offered an alternative explanation, but did not offer proof that root9B’s attribution
was false. The court arrived at this conclusion even after determining that
root9B’s Sofacy-based claim was a statement of fact, rather than a statement of
opinion, which had the effect of holding Mr. Hampton to a less-demanding
pleading standard.
9
Because the district court found that Mr. Hampton had not sufficiently
alleged that either set of statements was, in fact, false, the court did not reach the
other elements of Mr. Hampton’s claim under § 10(b). The court did, however,
express “profound doubts” that Mr. Hampton had sufficiently pleaded either
scienter or loss causation. Aplt.’s App. at 415 n.6.
Mr. Hampton timely appealed from the district court’s judgment.
III
“Because this is an appeal from a motion to dismiss, we accept all
well-pleaded facts, as distinguished from conclusory allegations, as true.” Adams
v. Kinder-Morgan, Inc., 340 F.3d 1083, 1088 (10th Cir. 2003). And we conduct a
“de novo review of the dismissal.” Anderson v. Spirit Aerosystems Holdings,
Inc., 827 F.3d 1229, 1237 (10th Cir. 2016). Furthermore, “notwithstanding the
usual rule that a court should consider no evidence beyond the pleadings on a
[Federal] Rule [of Civil Procedure] 12(b)(6) motion to dismiss, ‘the district court
may consider documents referred to in the complaint if the documents are central
to the plaintiff’s claim and the parties do not dispute the documents’
authenticity.’” 2 Alvarado v. KOB-TV, L.L.C., 493 F.3d 1210, 1215 (10th Cir.
2
Consistent with this proposition, Mr. Hampton does not dispute that
the district court properly considered in resolving Defendants’ motion to dismiss
the SEC filings discussed herein, the Krebs Article, the Pump Stopper Article, the
Sofacy Statement, and the APT28 Report. In conducting our de novo review, we
consider these materials as well.
10
2007) (quoting Jacobsen v. Deseret Book Co., 287 F.3d 936, 941 (10th Cir.
2002)).
A
Section 10(b) and Rule 10b-5 create an implied private cause of action
arising from fraud in the purchase or sale of securities. See Halliburton Co. v.
Erica P. John Fund, Inc., --- U.S. ----, 134 S. Ct. 2398, 2407 (2014). The
regulation prohibits “any untrue statement of a material fact or [omission of] a
material fact necessary in order to make the statements made, in the light of the
circumstances under which they were made, not misleading[,] . . . in connection
with the purchase or sale of any security.” 17 C.F.R. § 240.10b-5.
To state a claim under § 10(b) and Rule 10b-5, a plaintiff must plausibly
allege that:
[A] defendant made statements that[:] (1) contained false or
misleading statements of material fact, (2) related to the purchase
or sale of a security, (3) were made with intent to defraud
investors or conscious disregard of a risk that shareholders would
be misled (scienter) , (4) led to reliance by the plaintiff, and (5)
caused the plaintiff’s loss (loss causation).
Nakkhumpun v. Taylor, 782 F.3d 1142, 1146–47 (10th Cir. 2015); accord In re
Zagg, Inc. Sec. Litig., 797 F.3d 1194, 1200 (10th Cir. 2015); City of Philadelphia
v. Fleming Cos., 264 F.3d 1245, 1257–58 (10th Cir. 2001).
The Private Securities Litigation Reform Act of 1995 (“PSLRA”), 15
U.S.C. § 78u-4(b), adjusts the general pleading standard applicable under Federal
11
Rule of Civil Procedure 12(b)(6), which requires a plaintiff to plead “sufficient
factual matter, accepted as true, to ‘state a claim to relief that is plausible on its
face.’” S.E.C. v. Shields, 744 F.3d 633, 640 (10th Cir. 2014) (quoting Ashcroft v.
Iqbal, 556 U.S. 662, 678 (2009)); accord Pirraglia v. Novell, Inc., 339 F.3d 1182,
1187 (10th Cir. 2003). Specifically, under the PSLRA, a plaintiff must meet a
heightened pleading standard with regards to the first and third elements of a
securities-fraud claim: that is, respectively, as to whether the statements at issue
were false or misleading, and whether the defendant acted with the requisite
scienter. § 78u-4(b)(1)–(2); see Adams, 340 F.3d at 1095–96.
Relevant to this appeal, the PSLRA requires a plaintiff to identify “each
statement alleged to have been misleading, the . . . reasons why the statement is
misleading, and, if an allegation regarding the statement or omission is made on
information and belief, [that] the complaint shall state with particularity all facts
on which the belief is formed.” § 78u-4(b)(1). To satisfy this statutory burden, a
plaintiff must “explain why the statement was misleading, and allege with
particularity his basis for believing that the statement was false.” Nakkhumpun,
782 F.3d at 1147.
In reviewing the sufficiency of a plaintiff’s pleadings, we “evaluat[e] the
facts alleged in a complaint to determine whether, taken as a whole, they support
a reasonable belief that the defendant’s statements identified by the plaintiff were
false or misleading.” Adams, 340 F.3d at 1099. In doing so, we evaluate:
12
(1) the level of detail provided by the facts stated in a complaint;
(2) the number of facts provided; (3) the coherence and
plausibility of the facts when considered together; (4) whether
the source of the plaintiff’s knowledge about a stated fact is
disclosed; (5) the reliability of the sources from which the facts
were obtained; and (6) any other indicia of how strongly the facts
support the conclusion that a reasonable person would believe
that the defendant’s statements were misleading.
Id.
“To meet the [pleading] standard, plaintiffs are not required to disclose the
documentary or personal sources from which they learned the facts alleged . . . .
[T]he PSLRA did heighten the standard of pleading securities fraud, [however,]
and where a plaintiff does not identify the sources of the facts stated in the
complaint, the facts alleged . . . will usually have to be particularly detailed,
numerous, plausible, or objectively verifiable by the defendant before they will
support a reasonable belief that the defendant’s statements were false or
misleading.” Id. at 1103.
There is a meaningful distinction between statements of opinion and
statements of fact; the former require a plaintiff to meet a higher pleading
standard. “[P]ure statements of opinion,” Omnicare, Inc. v. Laborers Dist.
Council Constr. Indus. Pension Fund, --- U.S. ----, 135 S. Ct. 1318, 1327 (2015),
and “statements of optimism that are not capable of objective verification” are not
material misstatements unless they inaccurately represent “the speakers’ beliefs
concerning then-present factual conditions,” Grossman v. Novell, Inc., 120 F.3d
13
1112, 1119, 1123 (10th Cir. 1997). “[S]tatements of opinion or belief must rest
on ‘a factual basis that justifies them as accurate, the absence of which renders
them misleading.’” Id. at 1123 (quoting Va. Bankshares, Inc. v. Sandberg, 501
U.S. 1083, 1093 (1991)).
Having reviewed the applicable law, we address, in turn, Mr. Hampton’s
arguments that the district court erred in dismissing his claims based on root9B’s
proprietary-hardware and Sofacy statements. We conclude—as to both sets of
statements—that Mr. Hampton fails to sufficiently plead the first prong—i.e., that
root9B made materially false statements. Accordingly, we reject Mr. Hampton’s
contentions of error and uphold the district court’s dismissal of his amended
complaint.
B
We first address the alleged falsity of the proprietary-hardware statements.
As discussed above, Mr. Hampton alleges that root9B’s statements were false
based on (1) the Pump Stopper article (which in turn relied on an alleged
interview with CFO Smith), and (2) the subsequent omission of the relevant
statements from root9B’s SEC filings. The district court dismissed Mr.
Hampton’s claims because it found that the Pump Stopper article’s statements and
the omission of the “proprietary hardware and software” language from
subsequent filings did not disprove root9B’s earlier claims that it offered
proprietary hardware. See Aplt.’s App. at 411–13. We agree with the district
14
court’s conclusions for a number of reasons.
First, Mr. Hampton cannot show that the “low margin hardware
installation” and resale products that the Pump Stopper article identifies—which
Mr. Hampton claims refers to “a third-party’s hardware,” Aplt.’s Opening Br. at
25—are in fact the same products that the Grano letter and related SEC filings
refer to as “proprietary hardware and software.” Therefore, Mr. Hampton
necessarily falters in demonstrating that the “proprietary” label was false or
misleading because he cannot raise a plausible inference that the label does not fit
the products it references. Indeed, aside from citing to “[t]he stock market’s
reaction to the” alleged revelation of the Pump Stopper article, Mr. Hampton
points to no facts that push his allegation beyond a mere possibility. Aplt.’s
Opening Br. at 26.
Second, the exclusion of the “proprietary hardware and software” language
from subsequent SEC filings does not provide sufficient evidence that the
language was removed on account of the Pump Stopper article’s representations;
rather, a reasonable reading of the language that replaced the “propriety hardware
and software” language is that it simply provides greater details regarding the
products comprising that hardware or software.
Specifically, Mr. Hampton offers four filings featuring the “proprietary
hardware and software” language prior to the Pump Stopper article. The first of
these is the Form 8-K disclosure of Grano’s letter itself. The second and third
15
are, respectively, the Form 10-Q quarterly disclosure and the Form 10-K annual
disclosure covering the period in which Grano sent the letter to investors; these
filings would naturally include information like Grano’s rebranding update. The
final filing is the May 15, 2015 Form 10-Q. The relevant language in that filing
largely repeated the language from the annual disclosure:
In the latter half of 2014, the Company launched and announced
the repositioning of the Company’s business and adjustment to its
strategy to focus on cybersecurity and regulatory risk mitigation.
. . . The strategic change in focus was driven by several factors
[including] our expertise, capabilities and proprietary solutions
in the cyber security sector . . . . [O]ur cyber security segment is
differentiated in four ways[, including our] proprietary hardware
and software designed to combat the new methodologies being
utilized by state-sponsored and sophisticated individual hackers.
. . . During 2015, we are building an Adversarial Pursuit
Operations Center to expand our ability to deliver these services
as well as continuing to develop our proprietary products.
Aplt.’s App. at 41–42 (emphasis omitted).
Mr. Hampton then identifies two post-Pump-Stopper-article filings from
which the “proprietary hardware and software” language was omitted: a Form 10-
Q quarterly disclosure filed on August 14, 2015, and a Form 10-Q quarterly
disclosure filed in November 2015. Id. at 48–51. The “Outlook” section, in
which the above language appeared in the previous Form 10-Q, is rewritten nearly
identically in both subsequent filings:
The Company acquired root9B, its wholly owned cybersecurity
business at the end of 2013. In 2014, root9B began expanding
the number of subject matter experts it employs . . . and
developed and enhanced its offensive and defensive cyber
16
operations platforms and tools. These efforts have resulted in the
development of Orion[,] an Active Adversarial Pursuit (HUNT)
platform[;] Orkos which identifies compromised credentials and
supports predictive remediation[;] Cerberus which provides host
based security analytics and breach monitoring[;] and Event
Horizon which provides non attributable network access that
allows users to connect to a secure managed tunnel for web,
e-mail and file transfers. . . . We plan to discontinue the re-sale
of hardware and focus on the development, sale and licensing of
root9B’s tools at significantly higher margins. . . . We are still
in the early stages of commercialization . . . .
Id. at 51 (emphasis omitted). Far from abandoning claims about the existence of
root9B’s “proprietary hardware and software,” this new language is more
reasonably read as providing greater details about the “platforms and
tools”—which were under development by root9B’s team of “subject matter
experts”—that constitute the previously referenced proprietary hardware or
software. Id. The omission of the “propriety hardware and software” language
from these later filings, therefore, offers little, if any, support for Mr. Hampton’s
assertion that the earlier statements referred to the same products identified by the
Pump Stopper article.
Third, as the district court noted, even assuming arguendo that Mr.
Hampton was able to link the “proprietary hardware” language, which root9B’s
SEC filings spoke of, to the Pump Stopper article’s reference to “low margin
hardware installation,” his claim fails because there is nothing inherently
inconsistent between those two statements. See Aplt.’s App. at 412. Mr.
Hampton attacks this reasoning, arguing that the district court’s discussion
17
“disregards that the crux of Plaintiff’s allegations concerning the ‘proprietary
hardware’ statements was not the amount of margins [root9B] was receiving from
selling the ‘hardware,’ but whether the hardware root9B was selling was in fact
‘proprietary’ to root9B.” Aplt.’s Opening Br. at 32. However, the district court
specifically and persuasively addressed this issue by stating that Mr. Hampton’s
claim was meritless “[a]bsent evidence that reveal[ed] that the ‘proprietary
hardware’ in question was off-the-shelf equipment equally available to [root9B’s]
customers or competitors.” Aplt.’s App. at 412. And, on appeal, Mr. Hampton
still fails to show that it is anything more than merely possible that the
proprietary hardware at issue was in fact freely available to root9B’s potential
customers and competitors—as opposed to being controlled by root9B and subject
to its restrictions or limitations. 3
Accordingly, because Mr. Hampton fails to plead sufficient facts to show
that root9B’s proprietary-hardware statements were false or misleading, we
uphold the district court’s conclusion on this issue.
C
We next address Mr. Hampton’s Sofacy-based claim. Relying on the Krebs
article, Mr. Hampton asserts that root9B’s Sofacy press release, its APT28 report,
3
Mr. Hampton obliquely concedes that the term “proprietary” refers to
products “developed by root9B or exclusively licensed by it.” Aplt.’s Reply Br.
at 9. That concession undermines his argument with regard to root9B’s resale of
its proprietary products because he fails to allege that the products were not
resold pursuant to an exclusivity agreement.
18
and Mr. Grano’s Fox Business interview misattributed the source of the planned
cyberattack that root9B claimed to have uncovered.
Before reaching the merits of the claim, we turn to the question of whether
root9B’s attribution of the planned attack was a statement of fact, which is subject
to a comparatively lower pleading standard, or a statement of opinion. See
generally MHC Mut. Conversion Fund, L.P. v. Sandler O’Neill & Partners, L.P.,
761 F.3d 1109 (10th Cir. 2014) (Gorsuch, J.) (discussing the distinction between
statements of fact and statements of opinion). The district court found that the
attribution was “an assertion of fact, not a mere statement of opinion,” thus
reviewing, and ultimately rejecting, Mr. Hampton’s claim based on the less-
demanding pleading standard. Aplt.’s App. at 413. Although the parties dispute
whether the district court erred in concluding so, we need not decide the issue:
even assuming arguendo that root9B’s attribution of the attack to Sofacy was a
statement of fact, Mr. Hampton cannot prevail; that is, he cannot surmount even
the lower pleading hurdle.
Mr. Hampton challenges the accuracy of root9B’s attribution based entirely
on the Krebs article. See Aplt.’s App. at 44–46. That article states that “a closer
look at the details behind [the] report suggests the actors in question were
relatively unsophisticated Nigerian phishers who’d simply registered a bunch of
new fake bank Web sites.” Id. at 121. The article claims to reach this conclusion
based on “an analysis of the domains” used by the attackers, and finds “scant
19
evidence” to connect the “key email addresses and physical addresses . . . used in
common across all of the fake bank domains . . . to the Sofacy APT gang.” Id. at
122. According to the article, the “sole connection” supporting root9B’s
attribution is “a domain name server previously associated with Sofacy activity,”
but the article asserts that “Sofacy is hardly the only bad actor using that dodgy
name server.” Id. The Krebs article notes that most of the domains discussed in
the root9B report were apparently registered to a handful of email addresses,
including three “emails [that] have long been associated with phishing sites
erected by apparent Nigerian scammers.” Id. The article claims to find
corroboration from the vice president and chief scientist of “one of the security
firms that first published the initial findings on the Sofacy/APT28 group.” Id.
We agree, however, with the district court’s determination that Mr.
Hampton fails to show that the Sofacy attribution was false or misleading. To be
sure, the Krebs article provides factual allegations regarding the registration of
the domains identified as suspicious by root9B. But, despite Mr. Hampton’s
protestations, we conclude that the Krebs article merely provides an alternative
attribution—i.e., potentially Nigerian scammers—and therefore falls far short of
establishing that the Sofacy attribution was untrue or even misleading. For
example, the Krebs article fails to explicitly state that the Sofacy attribution was
actually untrue, and instead only indicates that it was more likely that the attack
was perpetrated by a different source (i.e., Nigerian scammers). Id. Indeed, the
20
article even hedges on its alternative finding by noting that root9B could have
been “holding back key details about their research,” see id. at 45, 122, which, if
true, could presumably impact the Krebs assessment.
Finally, it is significant that the Krebs article only addresses a portion of
the evidence upon which the Defendants made the attribution. root9B’s APT
report, for example, cites the fact that the Sofacy group had in the “past
attempt[ed] to launch attacks against many of the same targets” and that the
“design of the hack [bore a] striking similarity to the very exploits that have made
Sofacy so feared and respected.” Aplt.’s App. at 256–57. The Krebs article,
however, does not dispute those indicators in any way, nor explain why they
could not have supported root9B’s Sofacy attribution.
Lastly, we reject Mr. Hampton’s contention that the district court erred by
failing to treat his factual allegations related to the Sofacy matter as true.
Specifically, Mr. Hampton asserts that the district court, by focusing on the fact
that the true attackers may never be known, erred by failing to accept his
allegations that “the Krebs Report attribute[s] the attack to Nigerian hackers or, at
least, not to Sofacy.” Aplt.’s Opening Br. at 39. However, there is no logical
inconsistency between the district court’s belief that the true identity of the
hackers “remains an unsolved mystery,” Aplt.’s App. at 415, and its acceptance of
the fact that the Krebs article—based on its independent analysis—“suggest[ed
that] the actors in question were relatively unsophisticated Nigerian phishers,” id.
21
at 121 (emphasis added). By its terms, the Krebs article does not purport to have
irrefutable proof that the hackers were Nigerians or, more to the point, that
“Sofacy was not the party responsible for the pre-positioned attack.” Aplt.’s
Opening Br. at 39. Therefore, contrary to Mr. Hampton’s assertion, the district
court was not obliged to infer that the Krebs article “establishes”—as a factual
matter—that Sofacy was not involved. 4 Id.
As Mr. Hampton has failed to plead sufficient facts to establish that
root9B’s statements regarding the Sofacy attack were false or misleading, we
need not reach the remaining prongs of the established securities-fraud analysis,
and uphold the district court’s dismissal of this claim.
IV
Finally, we reject Mr. Hampton’s challenge to the district court’s dismissal
of his § 20(a) claims. Section 20(a) creates joint and several liability for control
persons of entities found to be liable for violations of securities laws. However,
because we conclude that Mr. Hampton’s § 10(b) claims fail, his § 20(a) claims
4
In any event, because we review de novo the complaint’s
averments—and thus independently draw appropriate inferences from
them—whether the district court stumbled in some respect in accepting the truth
of the Krebs averments would ultimately be of little (if any) moment in our
resolution of this appeal. Cf. Rivera v. City & Cty. of Denver, 365 F.3d 912, 920
(10th Cir. 2004) (“Because our review is de novo, we need not separately address
Plaintiff’s argument that the district court erred by viewing evidence in the light
most favorable to the City and by treating disputed issues of fact as undisputed.”);
accord George v. Newman, 726 F. App’x 699, 704 (10th Cir. 2018) (unpublished).
22
necessarily fail; a § 20(a) claim must be premised on a “primary violation of the
securities laws[,]” but no such violation has been established here. Adams, 340
F.3d at 1107. Accordingly, we uphold the district court’s determination on this
issue also.
V
For the foregoing reasons, we AFFIRM the district court’s judgment.
23