ACRISON, INC. v. RAINONE

• Court: District Court, D. New Jersey
• Decided: November 3, 2022
• Docket: 2:22-cv-01176
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW JERSEY

ACRISON, INC., Plaintiff, v. ANTHONY M. RAINONE, BRACH Civ. No. 22-1176 (KM) (ESK) EICHLER LLC, XCELLENCE, INC. directly and as successor-in-interest OPINION to RVM ENTERPRISES, INC. doing business as XACT DATA DISCOVERY, JOHN P. MARTIN, JOHN DOES 1-10, ABC COMPANIES 1-10, Defendants.

KEVIN MCNULTY, U.S.D.J.: Plaintiff Acrison, Inc. (“Acrison”), a New Jersey corporation, brought this action on March 3, 2022 against (1) Defendant Anthony M. Rainone, an attorney, and Defendant John P. Martin, a paralegal, both of whom work for Defendant Brach Eichler, LLC, a law firm (collectively, “Brach Eichler”); and (2) Defendant Xcellence Inc., d/b/a Xact Data Discovery (“XDD”), which acquired RVM Enterprises, Inc. on or about July 8, 2020. (DE 1, ¶¶ 1–5.)1 Brach Eichler and XDD now move to dismiss Acrison’s complaint.2 For the following reasons, the motion to dismiss is GRANTED to the extent it seeks

1 Certain citations to the record are abbreviated as follows: DE = docket entry Compl. = Complaint (DE 1) Mot. = Brach Eichler’s Brief in Support of the Motion to Dismiss (DE 9) Opp. = Acrison’s Brief in Opposition to the Motion to Dismiss (DE 13) 2 XDD joins in and fully incorporates the factual recitations and legal arguments advanced by Brach Eichler and did not file a separate brief. (DE 11, 21.) dismissal of the federal claims. Because the basis for diversity or supplemental jurisdiction is lacking, I dismiss the remaining state-law claims as well. I. BACKGROUND Acrison was formerly owned by two brothers, Ronald Ricciardi (“Ron”) and Ralph Ricciardi (“Ralph”). (Compl. ¶¶ 18–20.) Ron, who was the founder, President, and a director of Acrison, along with his spouse, owned 100% of Acrison’s Class A, voting shares and 50% of Acrison’s Class B, non-voting shares. (Id. at 19.) Ralph, who was the Vice President, Treasurer, and also a director of Acrison, owned 45% of Acrison’s Class B, non-voting shares. (Id. at 20.) Ralph’s spouse owned the remaining 5% of Acrison’s Class B, non-voting shares. (Id.) On December 20, 2021, Ralph and his spouse transferred all of their non-voting shares to Acrison. (Id.) The brothers and their spouses are not parties to this action. To understand the allegations, however, it is necessary to review a prior legal dispute in New Jersey state court between Ron and Ralph regarding Acrison. A. The State Court Action On September 5, 2019, Ralph and his spouse, Patricia Ricciardi, represented by Brach Eichler, commenced a shareholder oppression action against Ron, Geraldine Ricciardi (Ron’s spouse), Thomas Ricciardi (Ron’s son), and Joseph Casini (Acrison’s former CFO) in the Bergen County Superior Court, Chancery Division, New Jersey (Docket No. BER-C-238-19) (the “state court action”). (Compl. ¶ 21.) Acrison was also named as a nominal defendant. (Compl. ¶ 23.) Ralph and Patricia brought the state court action as minority and oppressed shareholders of Acrison, alleging “years of fraud, waste, misuse, and misappropriation of corporate assets and opportunities” by the defendants. (Compl. Docket No. BER-C-238-19, ¶ 1.)3 According to the state court

3 I consider the complaint and other filings in the state court action not for the truth of the facts asserted therein, but to determine the nature and scope of the proceeding, and the ruling of the state court in the underlying action. See Southern Cross Overseas Agencies, Inc. v. Wah Kwong Shipping Group, Ltd., 181 F.3d 410, 426 complaint, Rocco Ricciardi, who is Ron and Ralph’s late father, founded Acrison in 1963. (Id. ¶¶ 19–22.) When Rocco died in 1997, his shares in Acrison should have been distributed equally to Ralph and Ron pursuant to his will; however, that did not happen. (Id. ¶ 67.) Additionally, Ron and his attorney allegedly “attempted to unilaterally change shareholder percentages and voting structure of the shares of Acrison to make Ron the majority shareholder with 51% of the shares and with voting control.” (Id. ¶ 90.) Ralph and Patricia also alleged misconduct, oppression, and mismanagement of Acrison by the defendants. Ron allegedly maintained an unauthorized “cash slush fund” (id. ¶¶ 98–99), switched banks and refused to allow audits of Acrison’s inventory or records (id. ¶¶ 100–07), misappropriated corporate money for his benefit, manipulated corporate books and records to “hide his scheme” (id. ¶¶ 108–18), and usurped corporate opportunities for his own financial benefit (id. ¶¶ 119–46). In early 2019, Ralph and Patricia confronted Ron about his actions. (Id. ¶ 147.) Ron denied the allegations and enlisted his son, Thomas, to fabricate a record to rebut the allegations. (Id. ¶¶ 148–52.) In response, Ralph and Patricia demanded an inspection of Acrison’s books and records, which Ron refused. (Id. ¶¶ 154–55.) Ron also attempted to intimidate a witness. (Id. ¶¶ 160–65.) Based on the above allegations, Ralph and Patricia asserted claims of breach of duty of loyalty, breach of fiduciary duty, conspiracy to commit breach of fiduciary duty and duty of loyalty, aiding and abetting breach of fiduciary duty of care and loyalty, and oppressed shareholder claims. B. Acrison’s Counterclaim On October 21, 2019, Acrison filed its answer to the state court complaint and asserted its counterclaims. (Answer & Counterclaim, Docket No.

(3d Cir. 1999) (“To resolve a 12(b)(6) motion, a court may properly look at public records, including judicial proceedings, in addition to the allegations in the complaint. . . . [O]n a motion to dismiss, we may take judicial notice of another court’s opinion— not for the truth of the facts recited therein, but for the existence of the opinion, which is not subject to reasonable dispute over its authenticity.”). BER-C-238-19.) Acrison alleged that Ralph was exclusively in control of Acrison’s inventory and that, while in that role, Ralph and his direct reports ordered materials that were used for personal reasons and not for Acrison. (Countercl. Docket No. BER-C-238-19, ¶ 21.) Ralph also paid a vendor to complete certain projects that could have been handled in-house at Acrison. (Id. ¶ 28.) Additionally, Ralph provided employees with loans without authorization. (Id. ¶ 29.) Finally, Ralph’s children received health insurance and other benefits through Acrison when they did not qualify for those benefits. (Id. ¶¶ 36–42.) Based on the foregoing, Acrison alleged counterclaims against Ralph and Patricia for breach of fiduciary duties, breach of duty of loyalty, tortious interference with contractual relations and prospective economic advantage, conversion of corporate assets, and joint and several liability/alter ego/corporate veil. C. Events Giving Rise to the Present Action Two weeks after filing the underlying shareholder oppression action, Brach Eichler, along with an Acrison employee, issued a “Change Order” to XDD for services described as follows: “[XDD] will image a workstation after 7 PM in Moonachie, NJ.” (Compl. ¶ 29.) Specifically, Brach Eichler requested that XDD image the hard drive of the work computer located at Acrison’s office and used by Casini. (Id. ¶¶ 22, 24, 105.) Casini did not authorize anyone to access this computer. (Id. ¶ 25.) Only Brach Eichler, the Acrison employee, and XDD knew of this extraction. (Id. ¶ 29.) The state court action proceeded in the normal course, and the parties exchanged demands for the production of documents. (Id. ¶ 34.) On or about March 17, 2020, Brach Eichler provided Acrison two sharefile links to documents, one of which Acrison could not access. (Id. ¶¶ 39–40.) Acrison advised Brach Eichler multiple times that it could not access the documents and asked that the documents be provided on a thumb drive; Brach Eichler declined Acrison’s requests. (Id. ¶¶ 41–45.) Then, in May 2020, Brach Eichler acknowledged during a meet-and- confer that a “pre-litigation” investigation occurred, but declined to provide additional details. (Id. ¶ 46.) The issue arose again in October 2020 when Brach Eichler attempted to use a document at a deposition that existed only on Ron’s computer. At that point, “Brach Eichler disclosed that thousands of pages of ESI were gathered as part of a ‘pre-litigation’ investigation and that the ESI had been produced in discovery.” (Id. ¶ 47.) By November 2020, “Acrison finally secured access to some of the ESI produced by Brach Eichler, but not all.” Brach Eichler did not, however, produce the original document metadata. (Id. ¶¶ 49–50.) Acrison made additional requests for the documents and metadata, which Brach Eichler refused to honor. (Id. ¶¶ 49–52.) In November 2020, Acrison raised the discovery issue with the state court and sought an order requiring Brach Eichler to, inter alia, “disclose how it obtained what appeared to be stolen information.” (Id. ¶ 57.) Ralph responded with a certification stating that he obtained the documents “in a pre-litigation investigation by accessing Acrison’s computers.” (Id. ¶ 59.) In December 2020, Brach Eichler advised that XDD performed a data extraction pre-litigation, between May 22 and 30, 2018. (Id. ¶¶ 62–63.) However, Acrison retained an expert who concluded that some of the documents had “created dates” after May 30, 2018, and not all documents and metadata had been produced. (Id. ¶¶ 69–73.) Acrison sought to depose a representative of XDD and requested the production of certain documents. In response, in January 2021, XDD produced an agreement with Brach Eichler authorizing XDD to “create a full forensic issue of a company computer belonging to Domain Admin,” to “bring the forensic image back to [XDD’s] lab to recover passwords and log-in information,” and to “Remote VPN access [into] Acrison, Inc. then map and image the paths and execute email export commands [and] perform the collection after hours.” (Id. ¶¶ 79–80.) Brach Eichler and XDD arranged to meet at Acrison on May 17, 2018 between 9:00 PM and 10:30 PM. (Id. ¶ 83.) XDD also produced a copy of the “change order” instructing XDD to image Acrison’s hard drive in September 2019. (Compl. ¶¶ 29, 86–87.) Acrison conducted the deposition of XDD’s representative on January 29, 2021. (Id. ¶¶ 91–92.) The representative testified that he met with Brach Eichler and another individual on May 17, 2018 at 9:00 PM at Acrison’s office. (Id. ¶ 93.) The XDD representative extracted the hard drive of the computer belonging to Acrison’s IT Director and “made an exact image of all the data on the computer’s hard drive.” (Id. ¶ 95.) He also recorded network information so that he could remotely access the computer, which he did at a later time. (Id. ¶¶ 96–97.) On February 17, 2021, Brach Eichler produced a drive that purportedly contained a copy of the original forensic data. (Id. ¶ 108.) D. Conclusion of the State Court Action On February 4, 2021, all parties moved for summary judgment in the state court action. Among other things, Acrison argued that all of Ralph and Patricia’s claims should be dismissed with prejudice as a sanction for the above-described discovery misconduct. (DE 9-5). Acrison asserted that Ralph and Patricia had violated the New Jersey Computer Related Offense Act (“CROA”) and the Computer Fraud and Abuse Act (“CFAA”). Acrison, however, did not seek leave to amend its answer to assert such violations as counterclaims. (Id. p. 22.) Acrison also relied on the alleged discovery-related misconduct to further support its counterclaims for breach of fiduciary duty and breach of duty of loyalty. (Acrison Opp. Br. Summ. J., 2/16/21, Docket No. BER-C-238-19, pp. 16–19.) On March 22, 2021, the state court issued an oral decision on the parties’ summary judgment motions. (DE 9-6.) When discussing the discovery dispute, the court noted that none of the defendants asserted in their answers or counterclaims any violation of the CROA or CFAA. (DE 9-6, p. 26.) The court also recognized that those claims require that the person or entity be damaged and that the actions be unauthorized. (Id.) The court found that the defendants did not show “any damage or specific prejudice” arising from Ralph’s actions, and that a substantial question existed as to whether Ralph’s actions were authorized. (Id.) The court ultimately denied Acrison’s motion for summary judgment, finding genuine issues of material fact as to whether Ralph misappropriated Acrison’s assets. (Id. p. 40.) On March 25, 2021, just a few days after the court’s summary judgment decision, the parties signed a term sheet agreement to settle the dispute. (Compl. ¶ 110; Docket No. BER-C-238-19.) The parties then executed a settlement agreement in December 2021. Per the settlement agreement, Brach Eichler was to deliver to Acrison “all documents, records, recordings, and electronically stored information (“ESI”) copied and extracted by [XDD] or anyone else in connection with the pre-litigation and litigation activities in the [state court action]. . . . No documents involving Brach Eichler and [XDD] regarding Acrison’s ESI should be destroyed, altered or modified.” (Compl. ¶ 113.) Brach Eichler notified Acrison that it had instead instructed “Citrin” to “destroy and purge” all documents, ESI, or copies in its possession that were related to the state court action. (Id. ¶ 121.) Additionally, XDD deleted Acrison’s ESI from its network. (Id. ¶ 122.) On February 4, 2022, the parties filed a stipulation dismissing the state court action with prejudice. (DE 9-7.) E. This Action On March 3, 2022, Acrison filed its complaint in this action, alleging that Brach Eichler and XDD violated the CFAA (Count I), engaged in a conspiracy to violate the CFAA (Count II), violated the CROA (Count III), and committed trespass to personal property (Count IV) and conversion (Count V). Acrison bases its claims on the facts underlying the discovery dispute that occurred in the now-settled state court action. See Section I.C., supra. II. LEGAL STANDARD Federal Rule of Civil Procedure 12(b)(6) provides for the dismissal of a complaint, in whole or in part, if it fails to state a claim upon which relief can be granted. The defendant, as the moving party, bears the burden of showing that no claim has been stated. Animal Science Prods., Inc. v. China Minmetals Corp., 654 F.3d 462, 469 n. 9 (3d Cir. 2011). For the purposes of a motion to dismiss, the facts alleged in the complaint are accepted as true and all reasonable inferences are drawn in favor of the plaintiff. N.J. Carpenters & Trs. Thereof v. Tishman Const. Corp. of N.J., 760 F.3d 297, 302 (3d Cir. 2014). Federal Rule of Procedure 8(a) does not require that a complaint contain detailed factual allegations. Nevertheless, “a plaintiff’s obligation to provide the ‘grounds’ of his ‘entitlement to relief’ requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). Thus, the complaint’s factual allegations must be sufficient to raise a plaintiff’s right to relief above a speculative level, so that a claim is “plausible on its face.” Id. at 570; see also West Run Student Housing Assocs., LLC v. Huntington Nat. Bank, 712 F.3d 165, 169 (3d Cir. 2013). That facial-plausibility standard is met “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 556). While “[t]he plausibility standard is not akin to a ‘probability requirement’ . . . it asks for more than a sheer possibility.” Iqbal, 556 U.S. at 678. III. DISCUSSION A. Entire Controversy Doctrine I will first address defendants’ argument that New Jersey’s entire controversy doctrine required Acrison to raise its current claims as counterclaims in the state court action and, because it did not do so, those claims are precluded. Res judicata, though an affirmative defense, may be considered on a Rule 12(b)(6) motion where, as here, the necessary facts are apparent on the face of the complaint and other documents properly considered on a motion to dismiss. Whether a state court judgment should have a preclusive effect in a subsequent federal action depends on the law of the state that adjudicated the original action. See Greenleaf v. Garlock, Inc., 174 F.3d 352, 357 (3d Cir. 1999) (“To determine the preclusive effect of [the plaintiff’s] prior state action we must look to the law of the adjudicating state.”). See also Allen v. McCurry, 449 U.S. 90, 96 (1980) (“Congress has specifically required all federal courts to give preclusive effect to state-court judgments whenever the courts of the State from which the judgments emerged would do so.”). Here, that state is New Jersey. Claim preclusion in the traditional sense tends to be subsumed by New Jersey’s “entire controversy” doctrine. The entire controversy doctrine is currently codified in Rule 4:30A of the New Jersey Rules of Court, which provides that “[n]on-joinder of claims required to be joined by the entire controversy doctrine shall result in the preclusion of the omitted claims to the extent required by the entire controversy doctrine.” N.J. Ct. R. 4:30A. The entire controversy doctrine has been described as “New Jersey’s specific, and idiosyncratic, application of traditional res judicata principles.” Rycoline Prods., Inc. v. C & W Unlimited, 109 F.3d 883, 886 (3d Cir. 1997). The doctrine precludes, not just claims actually decided by a prior judgment, but all claims that a party could and should have joined in a prior case based on the same transaction or occurrence. The doctrine “seeks to assure that all aspects of a legal dispute occur in a single lawsuit.” Olds v. Donnelly, 636 A.2d 633, 637 (N.J. 1997). Its purposes are “(1) to encourage the comprehensive and conclusive determination of a legal controversy; (2) to achieve party fairness, including both parties before the court as well as prospective parties; and (3) to promote judicial economy and efficiency by avoiding fragmented, multiple and duplicative litigation.” Mystic Isle Dev. Corp. v. Perskie & Nehmad, 662 A.2d 523, 529 (N.J. 1995). There are three requirements for the application of the entire controversy doctrine: (1) the judgment in the prior action must be valid, final, and on the merits; (2) the parties in the later action must be identical to or in privity with those in the prior action; and (3) the claim in the later action must grow out of the same transaction or occurrence as the claim in the earlier one. McNeil v. Legislative Apportionment Comm’n of State, 828 A.2d 840, 859 (N.J. 2003) (citation omitted). Final Judgement on the Merits The first factor requires a final judgment on the merits, which I find is satisfied. A dismissal with prejudice constitutes an adjudication on the merits “as fully and completely as if the order had been entered after trial.” Petrossian v. Cole, 613 F. App’x 109, 111–12 (3d Cir. 2015) (quoting Gambocz v. Yelencsics, 468 F.2d 837, 840 (3d Cir. 1972)); see also Jackson v. Dow Chem. Co., 518 F. App’x 99, 102 (3d Cir. 2013) (“[Plaintiff’s] voluntary dismissal with prejudice of his remaining ADA claims also operated as a final judgment on the merits for purposes of claim preclusion.”). Here, all parties voluntarily stipulated to dismissal of the state court action, and expressly provided that the dismissal was with prejudice. (DE 9-7.) Accordingly, I find that the stipulation of dismissal in the state court action was a final judgment on the merits and that this element of the entire controversy doctrine is satisfied. Privity of the Parties Neither Brach Eichler nor XDD was a party to the state court action. Therefore, for the entire controversy doctrine to apply, they must be in privity with a party to the state court action. I find that they are. In comparison to federal preclusion principles, New Jersey has adopted a broader definition of “privity.” See Opdycke v. Stout, 233 F. App’x 125, 129 n. 6 (3d Cir. 2007). “In New Jersey, privity is merely a word used to say that the relationship between the one who is a party on the record and another is close enough to include that other within the res judicata.” Hamburg Music Corp. v. Winter, No. 04-2738, 2005 WL 2170010, at *3 (3d Cir. Sept. 8, 2005) (citation and quotation omitted). Less circularly, a relationship is defined as being “close enough” to satisfy privity “when the party is a virtual representative of the non- party, or when the non-party actually controls the litigation.” Collins v. E.I. DuPont de Nemours & Co., 34 F.3d 172, 176 (3d Cir. 1994). Thus, “one person is in privity with another and is bound by and entitled to the benefits of a judgment as though he was a party when there is such an identification of interest between the two as to represent the same legal right.” Zirger v. Gen. Accident Ins. Co., 676 A.2d 1065, 1071 (N.J. 1996) (citation omitted). Brach Eichler represented Ralph in the state court action, creating a legal relationship, and XDD was hired to conduct the alleged hacking at the direction of Brach Eichler and Ralph. (DE 9-4; Compl. ¶ 29). In both instances, the privity was formal and contractual, as well as practical. Acrison alleges that the wrongfulness of the actions of Brach Eichler and XDD arose from Ralph’s lack of rightful access to the computers. Acrison alleges that “Ralph and defendants here lacked authorized access to Acrison’s computers and servers” and, because “Ralph . . . had no authorized access to the subject servers and computers and/or exceeded his authorized access to those serves and computers,” Brach Eichler and XDD “cannot find safe harbor from liability.” (Id. ¶¶ 31, 150.) Moreover, “co-conspirators are by definition in privity.” Goel v. Heller, 667 F. Supp. 144, 152 (D.N.J. 1987) (citing Gambocz, 468 F.2d at 842). Acrison alleges a direct violation of the CFAA, along with a conspiracy between Ralph, XDD, and Brach Eichler to engage in a violation of the CFAA. (Compl. ¶¶ 161– 65.) There is room for doubt, particularly as to whether XDD and Brach Eichler truly partook of Ralph’s legal interest in the underlying litigation, but that argument is better addressed under the third factor, infra. Acrison’s own theory of the case, particularly at the pleading stage, is sufficient to set forth a claim of privity. Transactionally Related The real problem arises with respect to the third factor: whether the claims in the present action arose from the same transaction or occurrence as the state court action. I conclude that they do not. The independent claims against Brach Eichler and XXD are ancillary to the actual merits of the state court action, which relate to corporate control and malfeasance in corporate governance. This third factor requires that the facts of the later action are sufficiently related to the facts giving rise to the underlying action, such that the two actions “arise from related facts or the same transaction or series of transactions.” Fields v. Thompson Printing Co., 363 F.3d 259, 265 (3d Cir. 2004) (citation omitted). “It is the core set of facts that provides the link between distinct claims against the same or different parties and triggers the requirement that they be determined in one proceeding.” DiTrolio v. Antiles, 662 A.2d 494, 502 (N.J. 1995). The court must consider the factual context “giving rise to the controversy itself, rather than a commonality of claims, issues or parties.” Mystic Isle Dev. Corp., 662 A.2d at 529. “In the absence of such a factual nexus, a party is not required to join all of its claims against another party in a single action.” McNally v. Providence Washington Ins. Co., 698 A.2d 543, 548 (N.J. Super. App. Div. 1997). For example, in Fields v. Thompson Printing Co., Fields’s employer, Thompson Printing Co., terminated him following allegations by three employees that Fields sexually harassed them and created a hostile work environment. 363 F.3d at 263. The three employees filed a lawsuit in New Jersey state court against Fields and Thompson Printing Co. based on those allegations, which ultimately settled. Id. During the pendency of the state court action, Fields filed a federal action against Thompson Printing Co. alleging that his employer breached his employment contract and violated ERISA by failing to pay his benefits following his termination. Id. at 263–64. In response, Thompson Printing Co. asserted that Fields’s claims were barred by the entire controversy doctrine and should have been raised in state court because he would not have been fired but for his actions underlying the state court matter. Id. at 264. The Third Circuit found that the causal relationship between the two sets of claims was insufficient to satisfy the entire controversy doctrine. Id. at 265–66. The separate actions lacked a “commonality of facts”—the state court action concerned the employees’ complaints of hostile working conditions, whereas the federal action considered the language of Fields’s employment contract and Thompson Printing Co.’s obligations pursuant to ERISA. Id. at 266. Because “two different sets of facts” were relevant to the “two different types of claims,” the Third Circuit found “no reason to believe that the New Jersey courts would bar” Fields’s federal court action. Id. Similarly, here, the facts of the state court action are distinct from the facts necessary for Acrison to prove its claims in the present action. The state court action concerned whether Ralph, Ron, and other persons who worked at Acrison breached their duties to the company and committed fraud, waste, misuse, and/or misappropriation of corporate assets and opportunities over many years. See Section I.A., supra. In contrast, the present action turns on whether Brach Eichler and XDD accessed Acrison’s computers in violation of state or federal law. As in Fields, the cases raise two different types of claims and rely on two different sets of facts. Therefore, because the third factor of the entire controversy doctrine is not satisfied, I conclude that it does not preclude Acrison’s claims. B. Computer Fraud and Abuse Act Statute of Limitations Finding that the entire controversy doctrine does not apply, I will now address whether Acrison has stated a claim for violation of the federal CFAA. Acrison alleges Brach Eichler and XDD violated 18 U.S.C. § 1030(a)(2)(c), a criminal provision which applies to whoever “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer.” A violation of § 1030(a)(2) also gives rise to civil liability; a person suffering “damage” or “loss” from such a violation is granted a cause of action to sue for money damages or equitable relief. 18 U.S.C. § 1030(g); Van Buren v. United States, 141 S. Ct. 1648, 1652 (2021). A civil action for violation of the CFAA may be brought only if one of the factors in § 1030(c)(4)(A)(i)(I) to (V) is satisfied.4 Here, Acrison

4 The factors are: alleges “loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value” under § 1030 (c)(4)(A)(i)(I), arising from: “investigation expenses, expert costs, discovery master fees and legal fees in uncovering the misconduct.” (Compl. ¶ 149.) Defendants respond that Acrison cannot recover for such loss because its claim is barred by the relevant two-year statute of limitations. The CFAA requires that a civil action be brought “within 2 years of the date of the act complained of or the date of the discovery of the damage.” 18 U.S.C. § 1030(g). Thus, if a plaintiff does not allege later-discovered “damage,” as defined by § 1030(e)(8), then by default the plaintiff is limited to bringing the action within two years of the violation itself. Radcliff v. Radcliff, No. 20-cv-3669, 2020 WL 7090687, at *5 (D.N.J. Dec. 4, 2020); Gap Properties, LLC v. Cairo, No. 19-cv- 20117, 2021 WL 5757410, at *4 n.5 (D.N.J. Dec. 3, 2021); Sewell v. Bernardin, 795 F.3d 337, 340 (2d Cir. 2015). Defendants assert that Acrison has not alleged any “damage” (whether contemporaneous or later-discovered) as that term is defined in the CFAA. The CFAA defines “damage” as “any impairment to the integrity or availability of data, a program, a system, or information.” 18 U.S.C. § 1030(e)(8). The term “loss” likewise “relates to costs caused by harm to computer data, programs,

(I) loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value; (II) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals; (III) physical injury to any person; (IV) a threat to public health or safety; [or] (V) damage affecting a computer used by or for an entity of the United States Government in furtherance of the administration of justice, national defense, or national security. 18 U.S.C. § 1030(c)(4)(A)(i)(I) to (V). systems, or information services.”5 Van Buren, 141 S. Ct. at 1659–60. Moreover, the terms “damage” and “loss” “focus on technological harms—such as the corruption of files—of the type unauthorized users cause to computer systems and data.” Id. at 1660. Acrison argues in its brief that it has suffered the following damage: Brach Eichler and XDD accessed Acrison’s computers, imaged the computers’ hard drives, and captured passwords. (Opp. p. 13 (citing Compl. ¶¶ 14, 65, 79, 81, 101, 153).) Additionally, the data that defendants copied from Acrison’s computers was deleted from the networks of XDD and a third party. (Compl. ¶¶ 114–26.) Acrison’s complaint, however, alleges that it only suffered “loss” as defined by 18 U.S.C. § 1030(e)(11); it does not allege that Acrison also suffered “damage” as defined by 18 U.S.C. § 1030(e)(8). (See Compl. ¶ 160.) At any rate, even if damage had been alleged as a legal theory, the allegations of the complaint would not support it. Courts have found damage where a defendant has inflicted some type of impairment to the computer at issue, such as corrupted files, see Van Buren, 141 S. Ct. at 1660; deleted data, see Volpe v. Abacus Software Sys. Corp., No. 20-cv-10108, 2021 WL 2451968, at *7 (D.N.J. June 16, 2021); prevented access, see United States v. Soybel, 13 F.4th 584, 595 (7th Cir. 2021); or installed software, see Radcliff, 2020 WL 7090687, at *6. Brach Eichler and XDD are alleged only to have accessed, copied, or downloaded information from Acrison’s computers. That, without more, is insufficient to show “damage” under the CFAA. See Fidlar Techs. v. LPS Real Est. Data Sols., Inc., 810 F.3d 1075, 1084 (7th Cir. 2016) (holding that downloading data without altering data or disrupting service is insufficient to constitute “damage”); Rodgers Grp., LLC v. Lewis, No. 22-cv-482, 2022 WL 4095785, at *7 (D.N.J. Sept. 7, 2022). To the extent Brach Eichler and XDD are

5 The term “loss” is defined as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11). alleged to have deleted or destroyed data, they did so only on their own computers or the computer of a third party. Damage to those computers is not at issue; the data stored on Acrison’s computers is not alleged to have been deleted, corrupted, or compromised in any manner.6 (See Compl. ¶¶ 114–126; Opp. p. 13.) Because Acrison fails to allege ongoing or later-discovered “damage,” it was required to bring its claim within two years of the date of the act complained of. 18 U.S.C. § 1030(g). The conduct of Brach Eichler and XDD occurred in May 2018 and September 2019, meaning the limitation periods expired in May 2020 and September 2021. (Compl. ¶¶ 63, 69, 93, 105.) Acrison did not file its complaint until March 3, 2022, which is well outside the two- year limitation periods. Equitable Tolling Acrison attempts to excuse its untimely filing by invoking the doctrine of equitable tolling by reason of fraudulent concealment. In the Third Circuit, a party seeking equitable tolling under the doctrine of fraudulent concealment bears the burden of showing three elements: “(1) that the defendant actively

6 The Senate Report on the 1996 amendments to the CFAA further illustrates how defendants’ access, alone, may constitute “loss” but not “damage”: [I]t is not always clear what constitutes “damage.” For example, intruders often alter existing log-on programs so that user passwords are copied to a file which the hackers can retrieve later. After retrieving the newly created password file, the intruder restores the altered log-on file to its original condition. Arguably, in such a situation, neither the computer nor its information is damaged. Nonetheless, this conduct allows the intruder to accumulate valid user passwords to the system, requires all system users to change their passwords, and requires the system administrator to devote resources to resecuring the system. Thus, although there is arguably no “damage,” the victim does suffer “loss.” If the loss to the victim meets the required monetary threshold, the conduct should be criminal, and the victim should be entitled to relief. S. Rep. No. 104-357, at 11 (1996). See also P.C. of Yonkers, Inc. v. Celebrations! Party & Seasonal Superstore, L.L.C., No. 04-cv-4554, 2007 WL 708978, at *5 (D.N.J. Mar. 5, 2007). misled the plaintiff; (2) which prevented the plaintiff from recognizing the validity of her claim within the limitations period; and (3) where the plaintiff’s ignorance is not attributable to her lack of reasonable due diligence in attempting to uncover the relevant facts.” Cetel v. Kirwan Fin. Grp., Inc., 460 F.3d 494, 509 (3d Cir. 2006); Winder v. Postmaster Gen. of U.S., 528 F. App’x 253, 256 (3d Cir. 2013). District courts “should be sparing in their use of this doctrine” and limit its application only to the “rare situation where [it] is demanded by sound legal principles as well as the interests of justice.” LaCava v. Kyler, 398 F.3d 271, 275 (3d Cir. 2005) (internal citations omitted). “[F]or a petitioner to obtain relief there must be a causal connection, or nexus, between the extraordinary circumstances [the petitioner] faced and the petitioner’s failure to file a timely federal petition.” Ross v. Varano, 712 F.3d 784, 803 (3d Cir. 2013). And even where the circumstances are extraordinary, “[i]f the person seeking equitable tolling has not exercised reasonable diligence in attempting to file after the extraordinary circumstances began, the link of causation between the extraordinary circumstances and the failure to file is broken, and the extraordinary circumstances therefore did not prevent timely filing.” Brown v. Shannon, 322 F.3d 768, 773 (3d Cir.2003) (citation omitted). I find that the equitable tolling doctrine is inapplicable to this matter. I first address the claims based on defendants’ accessing of the Acrison computers in May 2018. Acrison, by its own admission, knew about these acts by November or December 2020 at the latest. In November 2020, for example, Acrison sought an order requiring Brach Eichler to, inter alia, “disclose how it obtained what appeared to be stolen information.” (Id. ¶ 57.) Ralph then provided a certification which clearly, if grudgingly, acknowledged the having accessed the computers: “As a part of a pre-suit investigation, I obtained copies of electronically stored information (“ESI”) from Acrison’s servers and computers located on the property of Acrison.” (Compl. ¶ 59; DE 9-4.) In December 2020, Brach Eichler advised that XDD performed a data extraction pre-litigation, between May 22 and 30, 2018. (Id. ¶¶ 62–63.) So assume Acrison has adequately alleged an explanation for its failure to learn of defendants’ May 2018 activities prior to November or December 2020 (which was already beyond the limitations period of May 2020). And accept arguendo that these constituted extraordinary circumstances. Still, Acrison provides no explanation as to why it did not file its complaint until March 2022, over one year after it became aware of the acts giving rise to its claim. I find that Acrison did not exercise “reasonable diligence in attempting to file after the extraordinary circumstances began” with respect to the claims arising from the unauthorized access to its computers in May 2018. See Brown, 322 F.3d at 773. I next address the allegations of unauthorized access in September 2019. Acrison learned of defendants’ September 2019 actions by, at the latest, January 2021, when XDD produced documents in response to Acrison’s subpoena. (Compl. 75.) As part of that document production, Acrison received a copy of the “change order” instructing XDD to image Acrison’s hard drive in September 2019. (Compl. ¶¶ 29, 86–87.) That order was not merely suggestive, but the proverbial smoking gun. The statute of limitations had not expired at the time Acrison received a copy of the “change order.” Indeed, the limitation period did not expire until September 2021, about eight months after Acrison learned of the acts giving rise to its claim. Acrison provides no explanation for its failure to file its CFAA claims within that eight-month period. See Brown, 322 F.3d at 773 (finding equitable tolling not justified where petitioner had one month left in limitations period in which he could have filed at least a basic pro se habeas petition). Acrison did not learn everything about defendants’ actions, but it learned enough to permit the filing of a complaint that would, at a minimum, have permitted further exploration in discovery. I find that Acrison did not exercise reasonable diligence, and I therefore conclude that equitable tolling under the doctrine of fraudulent concealment does not apply. Discovery rule Acrison also invokes the “discovery rule,” a doctrine under which a claim’s accrual date, and therefore the running of the statute of limitations, may be delayed. See Hedges v. United States, 404 F.3d 744, 750–51 (3d Cir. 2005) (distinguishing between equitable tolling and the discovery rule). Generally speaking, the discovery rule “tolls the limitations period until the plaintiff learns of his cause of action or with reasonable diligence could have done so,” and “is an exception to the usual principle that the statute of limitations begins to run immediately upon accrual regardless of whether or not the injured party has any idea what has happened to him.” Stephens v. Clash, 796 F. 3d 281, 284 (3d Cir. 2015). Simply stated, “the discovery rule means that the statute of limitations period begins to run as of the date of the discovery of the cause of action.” Am. Bd. of Internal Med. v. Rushford, 841 F. App’x 440, 443 (3d Cir. 2020). However, where Congress has “expressly incorporated a limited discovery rule” of its own, the more general judge-made “discovery rule” does not apply. Stephens, 796 F.3d at 287. Here, Congress has done just that by requiring that a CFAA action be brought “within 2 years of the date of the act complained of or the date of the discovery of the damage.” 18 U.S.C. § 1030(g) (emphasis added); see Tactical Pers. Leasing, Inc. v. Hajduk, No. 18-cv-203, 2018 WL 4740195, at *4 (W.D. Pa. Oct. 2, 2018) (rejecting application of the general “discovery rule” to claims arising under the CFAA because “the language of 18 U.S.C. § 1030 favors a strict reading of the injury-discovery limitation that applies only to discovery of damage.”); Kluber Skahan & Assocs., Inc. v. Cordogen, Clark & Assoc., No. 08-cv-1529, 2009 WL 466812, at *7 (N.D. Ill. Feb. 25, 2009) (same). Under the specific, statutory discovery rule of the CFAA, Acrison must sufficiently plead later-discovered “damage” in order to delay the onset of the limitations period. As discussed in Section III.B.1., supra, Acrison fails to plead “damage” as defined by 18 U.S.C. § 1030(e)(8) at all. Therefore, Acrison cannot rely on the CFAA’s discovery rule. Acrison’s CFAA claim is therefore barred by the statute of limitations and Count I of the complaint is dismissed. C. Conspiracy to Violate the Computer Fraud and Abuse Act Acrison also alleges that defendants engaged in a conspiracy to violate the CFAA. The parties dispute whether Acrison’s claim is one for general civil conspiracy or conspiracy under 18 U.S.C. § 1030(b) (via the civil remedy of § 1030(g)). Because I find that Acrison fails to satisfy the requirements under either theory, its claim for conspiracy to violate the CFAA is dismissed. Some courts have entertained civil claims for conspiracy to violate the CFAA on the theory that Section 1030(g)’s grant of a civil remedy for criminal CFAA violations extends to the CFAA’s criminal conspiracy provision, 18 U.S.C. § 1030(b). See, e.g., Advanced Fluid Sys., Inc. v. Huber, 28 F. Supp. 3d 306, 328 (M.D. Pa. 2014), aff’d, 958 F.3d 168 (3d Cir. 2020); Ryanair DAC v. Booking Holdings Inc., 20-cv-1191, 2022 WL 13946243, at *12 (D. Del. Oct. 24, 2022). Acrison must take the bitter with the sweet, however. The very section that would grant such a civil cause of action also contains the two-year statute of limitations. Because Acrison bases its conspiracy claim on the same conduct underlying the substantive § 1030(a) violation, see Section I.C., supra, the conspiracy claim is likewise time-barred, see Section III.B., supra. Acrison argues in the alternative that there is or should be a generalized tort of civil conspiracy that may have a CFAA violation as its object. Even assuming arguendo that the common law concept of civil conspiracy applies here, civil conspiracy is not really an independent tort, but rather a means of imposing joint or vicarious liability upon all participants in an underlying tort. The established rule is that a cause of action for civil conspiracy requires a separate underlying tort as a predicate for liability. Thus, one cannot sue a group of defendants for conspiring to engage in conduct that would not be actionable against an individual defendant. Instead, “actionable civil conspiracy must be based on an existing independent wrong or tort that would constitute a valid cause of action if committed by one actor.” In re Orthopedic Bone Screw Prods. Liab. Litig., 193 F.3d 781, 789 (3d Cir. 1999) (quoting Posner v. Essex Ins. Co., 178 F.3d 1209, 1218 (11th Cir. 1999) (quoting Williams Elec. Co. v. Honeywell, Inc., 772 F. Supp. 1225, 1239 (N.D. Fla. 1991)) (applying Florida law)).7 See also Boyanowski v. Cap. Area Intermediate Unit, 215 F.3d 396, 405–06 (3d Cir. 2000) (“The rule that civil conspiracy may not exist without an underlying tort is a common one.”); Curbison v. New Jersey, 242 F. App’x 806, 810 (3d Cir. 2007) (Under Pennsylvania law, “[a] civil conspiracy claim requires a separate underlying tort as a prerequisite for liability.”). “Thus, one cannot sue a group of defendants for conspiring to engage in conduct that would not be actionable against an individual defendant.” Pardue v. Gray, 136 F. App’x 529, 533 (3d Cir. 2005) (42 U.S.C. § 1983 conspiracy to violate civil rights; quoting Orthopedic Bone Screw, 193 F.3d at 789)). Here, Acrison alleges that Brach Eichler and XDD agreed to engage in the conduct described in Section I.C., supra. (Compl. ¶¶ 163–65.) However, Acrison cannot base its civil conspiracy claims on underlying claims that “would not be actionable against an individual defendant.” Id. Because Acrison’s CFAA claim is dismissed, I must dismiss any related civil conspiracy claim predicated on an underlying substantive violation of the CFAA.

7 To further illustrate these background common law principles, In re Orthopedic Bone Screw Prods. cited state court cases such as Applied Equip. Corp. v. Litton Saudi Arabia Ltd., 869 P.2d 454, 457 (Cal. 1994) (“Standing alone, a conspiracy does no harm and engenders no tort liability. It must be activated by the commission of an actual tort.”); Stoldt v. City of Toronto, 678 P.2d 153, 161 (Kan. 1984) (“Conspiracy is not actionable without commission of some wrong giving rise to a cause of action independent of the conspiracy.”); Alleco, Inc. v. Harry & Jeanette Weinberg Found., Inc., 665 A.2d 1038, 1045 (Md. 1995) (“No action in tort lies for conspiracy to do something unless the acts actually done, if done by one person, would constitute a tort.”) (citation omitted); Alexander & Alexander of N.Y., Inc. v. Fritzen, 503 N.E.2d 102, 102–03 (N.Y. 1986) (“[A] mere conspiracy to commit a tort is never of itself a cause of action. Allegations of conspiracy are permitted only to connect the actions of separate defendants with an otherwise actionable tort.”) (citations omitted). Therefore, the motions to dismiss are granted as to Count II. D. Supplemental Jurisdiction Acrison’s claims under the CFAA, which are now dismissed, are the only federal claims in the complaint. All of the remaining claims are state-law claims: violation of the New Jersey Computer Related Offense Act (Count III), trespass to personal property (Count IV), and conversion (Count V). It follows that there is no longer a basis for federal-question jurisdiction, because there is no federal claim. See 28 U.S.C. § 1331. As diversity of citizenship has not been alleged,8 the only remaining candidate for subject matter jurisdiction is supplemental jurisdiction. See 28 U.S.C. § 1367. For the following reasons, I will not exercise my discretion to retain supplemental jurisdiction over the state law claims. “The district courts may decline to exercise supplemental jurisdiction over a claim under subsection (a) if . . . (3) the district court has dismissed all claims over which it has original jurisdiction . . . .” 28 U.S.C. § 1367(c). “[A] court does not err if it declines to exercise supplemental jurisdiction over state claims after it dismisses a federal claim on which its jurisdiction is based in the absence of extraordinary circumstances.” Robert W. Mauthe, M.D., P.C. v. Optum Inc., 925 F.3d 129, 135 (3d Cir. 2019). Indeed, where the federal claims that provided the basis for original jurisdiction are dismissed, the court should ordinarily “decline to decide the pendent state claims unless considerations of judicial economy, convenience, and fairness to the parties provide an affirmative justification for doing so.” Hedges v. Musco, 204 F.3d 109, 123 (3d Cir. 2000) (citation omitted); see Shaffer v. Bd. of Sch. Dirs. of Albert Gallatin Area Sch. Dist., 730 F.2d 910, 912 (3d Cir. 1984) (holding that “pendent [i.e.,

8 Diversity jurisdiction under 28 U.S.C. § 1332(a) requires that “every plaintiff must be of diverse state citizenship from every defendant.” In re Briscoe, 448 F.3d 201, 215 (3d Cir. 2006). Plaintiff Acrison and Defendants Brach Eichler and XDD all allegedly have their principal places of business in New Jersey. (Compl. ¶¶ 1, 3–4, 8– 12.) supplemental] jurisdiction should be declined where the federal claims are no longer viable, absent ‘extraordinary circumstances’”). No such extraordinary circumstances or considerations of efficiency and fairness are present here. The case is at the pleading stage, with no answer yet filed. The Magistrate Judge stayed discovery pending resolution of these motions to dismiss, so no discovery efforts would be wasted (and probably would not be wasted in any event, assuming the claims proceed in state court). (See DE 20, 24–25.) The state courts are available as an alternative, indeed preferred, forum for these state law claims, so there are no significant concerns of fairness. Accordingly, I decline to exercise jurisdiction over these state-law claims based on their being supplemental to a now-dismissed federal claim. IV. CONCLUSION For the reasons set forth above, the motion to dismiss is granted. A separate order will issue. Dated: November 3, 2022 /s/ Kevin McNulty ___________________________________ Hon. Kevin McNulty United States District Judge