Roemer v. Hurd

• Court: District Court, M.D. Tennessee
• Decided: March 16, 2023
• Docket: 3:22-cv-00676
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT MIDDLE DISTRICT OF TENNESSEE NASHVILLE DIVISION NEIL B. ROEMER, ) ) Plaintiff, ) ) v. ) ) Case No. 3:22-cv-00676 STACY HURD, TIM DUTTON, individually ) Judge Aleta A. Trauger and d/b/a THE TIM DUTTON GROUP, ) PARKS VILLAGE NASHVILLE, LLC d/b/a ) PARKS REALTY, LORI SHELTON, ) UPTOWN TITLE & ESCROW, LLC, and ) JOHN DOE, ) ) Defendants. ) MEMORANDUM & ORDER Parks Village Nashville, LLC (“Parks Village”) has filed a Motion to Dismiss. (Doc. No. 9.) Tim Dutton, Stacey Hurd, and the Dutton Group also have filed a Motion to Dismiss. (Doc. No. 17.) Neil B. Roemer has filed a Response in which he addresses both motions (Doc. No. 21), and the defendants have filed Replies (Doc. Nos. 22, 23). For the reasons set out herein, the motions will be granted. I.BACKGROUND1 Neil Roemer is a Los Angeles-based real estate investor. (Doc. No. 1 ¶¶ 1, 11.) Stacy Hurd and Tim Dutton are Tennessee-based real estate agents “engaged” by Parks Village. (Id. ¶¶ 2–3.) Dutton and Hurd have worked together as the “Tim Dutton Group.” (Id. ¶ 4.) Roemer and Hurd had an established business relationship through which Hurd assisted Roemer with the acquisition of properties in Tennessee. (Id. ¶ 11.) 1 The facts herein are taken from the Complaint (Doc. No. 1) and are accepted as true for the purposes of the pending motions. On February 24, 2022, Roemer, in consultation with Hurd, decided to purchase a property on Nashville’s West End Circle for the asking price of $343,817.28. (Id. ¶¶ 10, 13.) Lori Shelton, a Tennessee-based title agent for Uptown Title & Escrow, LLC (“Uptown Title”), would facilitate the transaction. (Id. ¶¶ 5, 14.B.) On March 3, 2022, Roemer wired the full purchase price pursuant to what he believed were instructions from Shelton. Roemer, though,

had been misled. The instructions he received were not from Shelton, but from an apparent hacker—this case’s “John Doe”—impersonating Shelton by e-mail. Pursuant to the hacker’s instructions, Roemer sent the funds to an account at New York-based Signature Bank,2 from which they were immediately withdrawn, presumably by Doe or someone working in concert with him. (Id. ¶¶ 16–17.) Roemer does not appear to know exactly what happened to allow the hacker to insert himself so smoothly into a real estate transaction between seemingly sophisticated parties. Based on what Roemer does know, however, he has some theories. Roemer believes that the hacker, whom Roemer refers to as John Doe, “hack[ed] into one or more of the accounts of . . . Hurd,

Dutton, and/or Shelton,” which makes sense; the hacker had to know the details of the transaction somehow. Roemer also believes that, before Doe impersonated Shelton to him, Doe impersonated him to Shelton. (Id. ¶ 14.D.i.) Roemer suggests that the hacker “gained access to [Roemer’s] personal identity, including [Roemer’s] email account through the negligence of Hurd when she transmitted Roemer’s private information, including his email and contact information to Shelton.” (Id. ¶ 19.) Roemer also “alleges, in the alternative, that . . . the hacker . . . gained access to [Roemer’s] personal identity, including [his] email account, through

2 The court notes that, according to news reports, while these motions were pending, “Signature Bank, a New York financial institution . . . that had recently made a play to win cryptocurrency deposits, closed its doors abruptly . . . after regulators said that keeping the bank open could threaten the stability of the entire financial system.” Mathew Goldstein & Emily Fitter, Risky Bet on Crypto and a Run on Deposits Tank Signature Bank, N.Y. Times, Mar. 12, 2023. the negligence of Shelton when she corresponded to Hurd’s initial communication and referral of the purchase contract.” (Id. ¶ 20.) It is not clear to the court why the amount of hacking described above would have been necessary to Doe’s scheme, but it is possible that he was simply covering his bases by seeking to gain access to the transaction and its participants from as many angles as possible. It is also not

clear to the court what exactly Roemer is suggesting may have actually happened—other than that Doe impersonated Shelton to Roemer and Roemer to Shelton. Roemer alleges that various events occurred and communications were made, and he asserts that, after those events, the hacker successfully impersonated Shelton and intercepted the funds. However, the Complaint is noticeably vague regarding how the defendants’ actions supposedly led to the hacker’s success. Roemer suggests that there were red flags that should have alerted the other participants in the deal to the fact that accounts had been compromised, in time to prevent the fraudulently directed wire transfer. Some of those red flags included the email addresses used in communications ostensibly between Roemer and Shelton, although Roemer does not explain this

aspect of his theory very clearly. It appears, however, that the hacker, at times, used one or more email addresses featuring slight spelling variations on the parties’ actual addresses. (Id. ¶¶ 14.D.i.a–c.) The hacker also used certain language while impersonating Roemer to Shelton that, Roemer alleges, should have alerted Shelton that the emailer was not really Roemer. Specifically, the hacker began his email with “Greetings” and closed it with “Kind regards,” which Roemer apparently not only would not have done, but, supposedly, so clearly would not have done that the very appearance of those phrases should have blown the hacker’s cover. (Id. ¶ 15.D.i.d.) Roemer also suggests that the email should have put the defendants on alert because he “communicated and transacted business with . . . Hurd by his personal smartphone device.” (Id. ¶ 25.) On September 1, 2022, Roemer filed a Complaint against Hurd, Dutton, the Tim Dutton Group, Parks Village, Shelton, Uptown Title, and Doe. (Doc. No. 1.) The Complaint states five counts. Count I asserts claims for negligence and gross negligence against Hurd, Shelton,

Dutton, and their respective business entities based on the theory that those defendants “were on notice, or should have been on notice, that communications with [Roemer] had been hacked,” but “failed to confirm that [Roemer] had the correct information needed for the wiring of funds.” (Id. ¶ 25.) Count II asserts claims against all defendants for violation of the Tennessee Personal and Commercial Computer Act of 2003, Tenn. Code Ann. §§ 39-14-601 to -605. (Id. ¶¶ 30–36.) The Complaint asserts that the non-hacker defendants are liable under that statute because they “operat[ed] and maintain[ed] their computers in such a way as to allow their networks to be hacked by Doe, resulting in damages to” Roemer. (Id. ¶ 35.) Count III relies on the same general theory of liability to assert claims against all defendants pursuant to the Tennessee Anti-Phishing

Act of 2006, Tenn. Code Ann. §§ 47-18-5201 to -5205. (Id. ¶¶ 37–43.) Count IV asserts the same allegations in the context of yet another statute, the Tennessee Identity Theft Deterrence Act of 1999, Tenn. Code Ann. §§ 47-18-2101 to -2111. (Id. ¶¶ 44–49.) Finally, Count V asserts claims against all defendants pursuant to the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030. (Id. ¶¶ 50–54.) On October 3, 2022, Parks Village filed a Motion to Dismiss, arguing that (1) any claims against Parks Village are insufficiently pleaded and, (2) insofar as Roemer’s factual allegations against Park Village have been sufficiently pleaded, they are not sufficient to support liability. (Doc. No. 9.) The same day, Shelton and Uptown Title filed a Motion to Dismiss directed only at Counts II through V—that is, the claims other than the claim for negligence. (Doc. No. 11.) On October 12, 2022, Hurd, Dutton, and the Tim Dutton Group—whom the court will refer to collectively as the “Hurd/Dutton Defendants”—filed a separate Motion to Dismiss, arguing that the Complaint “contains no set of facts to establish liability” with regard to those defendants. (Doc. No. 17 at 1.)

On November 15, 2022, Roemer and the movants—that is, every defendant except Doe—filed a Proposed Agreed Order on Defendants’ Pending Motions to Dismiss and/or For Partial Dismissal and Dismissal of Counts Two Through Five of Plaintiff’s Complaint Without Prejudice. (Doc. No. 26.) The parties informed the court that they had agreed for the court to dismiss Counts II through V, as pleaded against each defendant other than Doe, without prejudice, while leaving those claims pending against Doe. (Id. at 1–2.) The court entered the Order as proposed, which wholly resolved the motion by Shelton and Uptown Title and resolved the other motions other than with regard to Count I. (Doc. No. 27.) All that remains, therefore, are the requests by the Hurd/Dutton Defendants and Parks Village to dismiss Count I, for

negligence. II. LEGAL STANDARD In deciding a motion to dismiss for failure to state a claim under Rule 12(b)(6), the court will “construe the complaint in the light most favorable to the plaintiff, accept its allegations as true, and draw all reasonable inferences in favor of the plaintiff.” Directv, Inc. v. Treesh, 487 F.3d 471, 476 (6th Cir. 2007); Inge v. Rock Fin. Corp., 281 F.3d 613, 619 (6th Cir. 2002). The Federal Rules of Civil Procedure require only that a plaintiff provide “a short and plain statement of the claim that will give the defendant fair notice of what the plaintiff’s claim is and the grounds upon which it rests.” Conley v. Gibson, 355 U.S. 41, 47 (1957). The court must determine only whether “the claimant is entitled to offer evidence to support the claims,” not whether the plaintiff can ultimately prove the facts alleged. Swierkiewicz v. Sorema N.A., 534 U.S. 506, 511 (2002) (quoting Scheuer v. Rhodes, 416 U.S. 232, 236 (1974)). The complaint’s allegations, however, “must be enough to raise a right to relief above the speculative level.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). To establish the

“facial plausibility” required to “unlock the doors of discovery,” the plaintiff cannot rely on “legal conclusions” or “[t]hreadbare recitals of the elements of a cause of action,” but, instead, the plaintiff must plead “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678-79 (2009). “[O]nly a complaint that states a plausible claim for relief survives a motion to dismiss.” Id. at 679; Twombly, 550 U.S. at 556. III. ANALYSIS As a preliminary matter, the court notes that any liability on behalf of Parks Village or the Dutton Group would be based on the fact that Hurd and Dutton were employed by those

entities. (See Doc. No. 1 ¶ 19.) Dutton’s involvement in the underlying events, moreover, was relatively minimal. He is alleged to have sent Shelton one email informing her that Roemer needed to wire the funds, but that email contained no other meaningful information other than what appears to be a link to a file system that housed the actual transaction documents. (See Doc. No. 1-1.) The liability of each defendant with a still-pending motion therefore hinges on the same question: whether the Complaint plausibly states a claim for negligence based on the actions of Hurd or, with regard to Dutton’s relatively minor role in the transaction, Dutton. The elements of a general negligence claim in Tennessee are (1) a duty of care owed by the defendant to the plaintiff; (2) breach of the applicable standard of care; (3) injury to the plaintiff; and (4) that the defendant’s conduct is both a “cause in fact” and “proximate cause” of the injury. Giggers v. Memphis Hous. Auth., 277 S.W.3d 359, 364 (Tenn. 2009) (citing McCall v. Wilder, 913 S.W.2d 150, 153 (Tenn.1995); Naifeh v. Valley Forge Life Ins. Co., 204 S.W.3d 758, 771 (Tenn. 2006)). The defendants do not dispute that Hurd owed at least some duty of care to Roemer or that, to the extent that Dutton actually did any work for Roemer, he would have

owed a duty of care as well. Indeed, even if no such duty existed under general principles of the common law, it would exist pursuant to Tennessee’s statutes governing licensure of real estate agents, which require an agent to, among other things, “[d]iligently exercise reasonable skill and care in providing services to all parties to [a] transaction” and “[m]aintain for each party to a transaction the confidentiality of any information obtained” by the agent, to the extent that “the party would reasonably expect” that information “to be held in confidence.” Tenn. Code Ann. § 62-13-403(1), (3). The defendants argue, however, that, even assuming that Hurd’s duties as a real estate agent included an obligation to protect against hacking, the facts, as pleaded, do not support any

plausible inference that she violated that duty, because she, among other things, had no ground for suspecting that hacking had occurred prior to Roemer’s mistaken wire transfer. The supposedly suspicious email that Doe sent under the guise of Roemer was addressed solely to Shelton, not Hurd. (See Doc. No. 1-2.) The Complaint asserts that Hurd nevertheless should have known that something was amiss because the real Roemer communicated with her solely by phone, but the facts, as pleaded, suggest that Roemer and Hurd did communicate exclusively by phone throughout this transaction, with the exception of one email from Dutton, seemingly generated through a third-party document management system. (See Doc. No. 1-1.) There are simply no facts in the Complaint sufficient to suggest that Hurd had notice of any need to pause the transaction until the security of the parties’ communications was ensured. In Roemer’s briefing, he attempts to identify other allegations in the Complaint that could give rise to liability, but they all fall short. Roemer alleges that Hurd “breached [her] duty [of care] when [she] advised Shelton and [Roemer] that the money should be wired,” but he

identifies no plausible basis for why that instruction could possibly have been negligent, if Hurd was not on notice regarding any hacking. (Doc. No. 21 at 8.) Roemer also points to his allegation that Doe “gained access to [Roemer’s] personal identity, including [Roemer’s] email account through the negligence of Hurd when she transmitted Roemer’s private information, including his email and contact information to Shelton.” (Doc. No. 1 ¶ 19.) The Complaint is not clear with regard to why Hurd’s transmission of that information would have been negligent, but, in Roemer’s briefing, he clarifies that his position is that sending such information through an “unsecured email” violated Hurd’s duty of care. (Doc. No. 21 at 8.) The court notes that, contrary to Roemer’s briefing, the Complaint contains no

meaningful allegations regarding the extent or type of security employed by the parties in connection with their email accounts or document transmission systems. The Complaint does not explain how secure the accounts were, how secure they should have been, or what the defendants should have done differently, other than just not to be hacked. Roemer appears to have inferred security flaws from the fact that hacking occurred, and that may make sense, up to a point— clearly, the security surrounding this transaction failed in some way, and that failure may not have simply been a function of Doe’s hacking skills. The fact that something went wrong, however, is not alone sufficient to ascribe fault to specific individuals or specific actions. Moreover, even if Roemer had clearly pleaded that Hurd’s communications were less secure than they could have been, he offers no plausible explanation for why ordinary care would have required the use of such special security precautions simply to transmit “email and contact information,” which is the only specific information discussed in the cited paragraph. To state the obvious, every successfully sent e-mail includes at least someone’s email address. It is simply

not plausible—at least based on the scant facts alleged—that using “unsecured” email to send innocuous information such as an email address or phone numbers—as opposed to, for example, social security numbers, bank account numbers, or passwords—would have amounted to a departure from the standard of care applicable to a real estate agent, unless the agent at issue had reason to know that such additional steps were required. Indeed, the aforementioned licensure statute requires confidentiality only with regard to “any information that the party would reasonably expect to be held in confidence,” and that confidentiality obligation only exists if “the party has [not] authorized [the information] for disclosure.” Tenn. Code Ann. § 62-13-403(3). There is no indication in the Complaint that Roemer forbade Hurd from sharing his contact

information with Shelton. Indeed, by all accounts, sharing that information is what Roemer expected Hurd to do. Roemer also points out, in his briefing, that, on two occasions—first on February 25 and then on February 28— Hurd stated that she would “call” Roemer the next day, but she did not. (See Doc. No. 1 ¶¶ 14.B, 14.D.v.) The facts alleged, however, confirm that Hurd and Roemer remained in touch by text message throughout the transaction. While it might be rude to say that you will call someone but then, instead, just keep texting him, Roemer has not identified any plausible basis for concluding that doing so was actually negligent. In any event, Roemer has not identified any meaningful reason to believe that a phone call, rather than a conversation over text message, would have changed anything. Rather, Hurd’s failure to call simply seems to be something she did that (1) can be fairly criticized and (2) happened to precede the hacker’s deception of Roemer. A claim for negligence, however, cannot be based simply on the fact that the defendant did something that was, in some sense, bad and, later, some other bad thing happened to the plaintiff.

Finally, Roemer argues that the Hurd/Dutton Defendants “were negligent when they told Shelton to send wiring instructions to [Roemer], kickstarting the chain of events that ultimately harmed” him. (Doc. No. 21 at 10.) Again, though, the Hurd/Dutton Defendants were doing what Roemer wanted them to do. He wanted to close the sale. He wanted to receive the wire instructions. Obviously, somewhere during the process, something went very wrong, ultimately resulting in Doe’s being able to successfully impersonate Shelton. The communication that enabled Doe to take the funds, however, occurred between Doe (impersonating Shelton) and Roemer. Hurd and Dutton were neither parties to, nor impersonated in, that communication. (See Doc. No. 1-3.) Shelton, as the party who was actually impersonated, notably has not asked the

court to dismiss Count I against her or her employer, Uptown Title. Those parties sought only the dismissal of Roemer’s statutory claims, which he agreed to. The possibility that Shelton bears some responsibility for the underlying situation is therefore still very much a live issue in this case. The issue presented by these motions, however, involves the significantly more attenuated assertion that Hurd and Dutton bear responsibility for the misdirection of funds that were supposed to pass from Roemer to Shelton pursuant to instructions that Shelton was supposed to provide. Roemer has not alleged facts sufficient to support that leap. As frustrating as Doe’s actions undoubtedly were, the fact that a hacker infiltrated a transaction and made off with the funds does not authorize the injured party to sue every other person or entity who was part of the deal, in the hope that those parties’ actual culpability will reveal itself in time. If discovery uncovers information suggesting that Hurd or Dutton was even partially to blame for Roemer’s predicament, he can, like any plaintiff, seek to amend his Complaint. At this stage, however, Roemer has not plausibly alleged any basis for concluding that his loss was the result of a violation of Hurd’s or Dutton’s duty of care. Hurd, Dutton, and the defendants whose liability could only have arisen through Hurd or Dutton are therefore entitled to the dismissal of the claims against them. Count I will remain pending against Shelton and Uptown Title, and all counts will remain pending against Doe. IV. CONCLUSION For the foregoing reasons, Parks Village’s Motion to Dismiss (Doc. No. 9) and the Hurd/Dutton Defendants’ Motion to Dismiss (Doc. No. 17) are hereby GRANTED, and all remaining claims against Parks Village, Hurd, Dutton, and the Tim Dutton Group are hereby DISMISSED. It is so ORDERED.

United States District Judge

1]