Schober v. Thompson

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLORADO Civil Action No. 21-cv-01382-NYW ANDREW SCHOBER, Plaintiff, v. BENEDICT THOMPSON, OLIVER READ, EDWARD J. THOMPSON, CLAIRE L. THOMPSON, PAUL READ, and HAZEL DAVINA WELLS, Defendants. MEMORANDUM OPINION AND ORDER Magistrate Judge Nina Y. Wang This action is before the court on (1) Defendants Oliver Read’s Motion to Dismiss [Doc. 8, filed June 28, 2021]; (2) Defendant Hazel Davina Wells’ Motion to Dismiss [Doc. 9, filed June 28, 2021]; and (3) Defendants Benedict Thompson, Edward J. Thompson, and Claire L. Thompson’s Motion to Dismiss [Doc. 11, filed July 1, 2021] (collectively, “Motions to Dismiss” or “Motions”). This court presides fully over this matter pursuant to 28 U.S.C. § 636 (c), the unanimous consent of the Parties, see [Doc. 14], and the Order of Reference dated July 12, 2021 [Doc. 18]. The court has considered the Motions and associated briefing, and the applicable case law. For the following reasons, the Motions to Dismiss are GRANTED IN PART AND DENIED IN PART. FACTUAL BACKGROUND The following facts are drawn from the Complaint [Doc. 1] and are taken as true for the purposes of the instant Motions. This case involves the January 2018 theft by Defendants Benedict Thompson (“Defendant Benedict”)1 and Oliver Read (“Defendant Oliver”)2 of cryptocurrency— Bitcoin “worth approximately $1 million,” [Doc. 1 at ¶ 1]—which belonged to Plaintiff Andrew Schober (“Plaintiff” or “Mr. Schober”). See [id.]. Plaintiff alleges that Defendants designed a Malware for the primary purpose of diverting another person’s cryptocurrency wallet to Defendants’ cryptocurrency wallet.3 [Id. at ¶¶ 17–19, 20]. Plaintiff’s computer became infected with the Malware when he downloaded a software, “Electrum Atom,” from online forum Reddit after one or both of Defendants posted a link to the software at the website. [Id. at ¶ 25]. The Malware—which was hidden within the Electrum Atom software, [id.]4—“clandestinely install[ed] itself” on Plaintiff’s hard drive and began to monitor Plaintiff’s computer activity “by secretly requesting” that the computer run a particular algorithm each time Plaintiff used the “copypaste (or ‘clipboard’) function on his computer.” [Id. at ¶ 17]; see also [id. at ¶ 27]. To obtain access to a user’s cryptocurrency, the Malware used a “‘Man-in-the-Middle’ attack vector,” a type 1 Ordinarily, this court would not refer to a Party by his first name. However, some of the Defendants in this matter share the same last name, and accordingly, this court refers to these Defendants who were minors at the time of the alleged acts by first name to distinguish between the Defendants. 2 For ease of reference, the court will refer to Defendant Benedict and Defendant Oliver together in this section as “Defendants.” 3 Plaintiff defines “cryptocurrency wallets” as follows: “Cryptocurrency wallets are required to send and receive transactions on cryptocurrency blockchains. A cryptocurrency wallet is controlled by any entity with control of the private key(s) corresponding to the wallet’s public key(s). Anyone who controls a wallet’s private key(s) controls the cryptocurrency associated with the wallet.” [Doc. 1 at ¶ 20]. 4 Plaintiff alleges that the online posts by at least one of Defendants claimed that Electrum Atom “was a new version of Electrum,” another “popular and widely used software client application that hosts cryptocurrency wallets.” [Id. at ¶ 26]. of “cyberattack where the attacker secretly intercepts and/or alters the communications between two parties who believe they are directly communicating with one another.” [Id. at ¶ 21]. Thus, “[w]hen the Malware recognized that Mr. Schober copied a cryptocurrency wallet address, the Malware immediately executed code that replaced the address he copied with a new address controlled by one or more of the Defendants.” [Id. at ¶ 28]. Mr. Schober was unable to delete the Malware from his computer once it was installed because “the Malware embeds itself in the Java library on a victim’s computer, regardless of the location where the downloaded file is initially saved, and conceals its existence” by using a particular encryption technique. [Id. at ¶ 32]. Mr. Schober installed the Malware onto his computer in or about January 2018, and his cryptocurrency was stolen the same month and immediately sent to a Bitcoin wallet address (the “Malware Address”) that was controlled by either or both of Defendants. [Id. at ¶¶ 36–39]. Mr. Schober learned about Defendants’ involvement in the theft and their control of the Malware Address through an investigation that was conducted sometime thereafter. [Id. at ¶ 39]; see also [id. at ¶¶ 40–46]. At the time of the theft, Defendants Benedict and Oliver were minors under the age of 18 and living with their parents, who are also named Defendants in this action. [Id. at ¶¶ 47, 53]. In or about October 2018 and December 2019, Plaintiff emailed a letter to Defendant Oliver’s parents, respectively, demanding they return the stolen cryptocurrency. [Id. at ¶¶ 51, 57]. Neither set of parents responded to Plaintiff’s requests. [Id. at ¶¶ 52, 58]. PROCEDURAL BACKGROUND Plaintiff initiated this action by filing the Complaint in this court on May 21, 2021, asserting four claims against Defendants: conversion (Claim I); trespass to chattels (Claim II); civil conspiracy (Claim III); and violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030 (Claim IV). [Doc. 1 at ¶¶ 74–104]. On June 28, 2021, Defendant Oliver and his mother, Defendant Hazel Wells, proceeding pro se, each filed a Motion to Dismiss. [Doc. 8; Doc. 9]. On July 1, proceeding through counsel, Defendant Benedict and his parents, Defendants Edward J. Thompson and Claire L. Thompson (collectively, “Thompson Defendants”), filed a Motion to Dismiss. [Doc. 11]. On July 8, 2021, Defendant Oliver’s father, Defendant Paul Read,5 filed a joinder in the Thompson Defendants’ Motion. [Doc. 16]. On July 29, Plaintiff filed an Omnibus Opposition to Defendants’ Motions to Dismiss (“Response”). [Doc. 23]. The Thompson Defendants filed their Reply on August 8, 2021. [Doc. 26]. The Read Defendants did not file a Reply. The Motions are thus ripe for determination. LEGAL STANDARD Under Rule 12(b)(6), a court may dismiss a complaint for “failure to state a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). In deciding a motion under Rule 12(b)(6), the court must “accept as true all well-pleaded factual allegations … and view these allegations in the light most favorable to the plaintiff.” Casanova v. Ulibarri, 595 F.3d 1120, 1124 (10th Cir. 2010) (quoting Smith v. United States, 561 F.3d 1090, 1098 (10th Cir. 2009)). A plaintiff may not rely on mere labels or conclusions, and a “formulaic recitation of the elements of a cause of action will not do.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 555 (2007). Rather, “a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); see also Robbins v. Okla., 519 F.3d 1242, 1247 (10th Cir. 2008) (explaining that plausibility refers “to the scope of the allegations in a complaint,” and that the allegations must be sufficient to nudge a plaintiff’s claim(s) “across the 5 The court will refer to Defendant Oliver, Defendant Paul Read, and Defendant Hazel Davina Wells together as the “Read Defendants.” line from conceivable to plausible.”). The court must ultimately “determine whether the complaint sufficiently alleges facts supporting all the elements necessary to establish an entitlement to relief under the legal theory proposed.” Forest Guardians v. Forsgren, 478 F.3d 1149, 1160 (10th Cir. 2007). Here, all Defendants seek dismissal of Plaintiff’s claims on the same basis: they are barred by the statute of limitations. See [Doc. 8; Doc. 9; Doc. 11]. 6 The statute of limitations is generally an affirmative defense. See Jiying Wei v. Univ. of Wyoming Coll. of Health Sch. Pharmacy, 759 F. App'x 735 , 739 (10th Cir. 2019) (observing that the statute of limitations is an affirmative defense). The United States Court of Appeals for the Tenth Circuit (“Tenth Circuit”) has held that “it is appropriate to resolve a statute of limitations defense on a Rule 12(b)(6) motion when the dates given in the complaint make clear that the right sued upon has been extinguished.” Sierra Club v. Okla. Gas & Elec. Co., 816 F.3d 666, 671 (10th Cir. 2016) (internal quotation marks omitted). When a plaintiff raises equitable tolling in response to a motion to dismiss that is based on a statute-of-limitations defense, such motion should only be granted “only if it appears beyond a doubt that Plaintiffs can prove no set of facts that toll the statute.” Whitington v. Sokol, 491 F. Supp. 2d 1012, 1014 (D. Colo. 2007) (quotations marks and citations omitted). ANALYSIS In support of their statute of limitations defenses, Defendants argue that Plaintiff’s claims began to accrue in January 2018 because the Complaint shows that Plaintiff “was immediately aware of the theft and that he was aware that it was caused by the installation of malware upon his 6 The Motions to Dismiss are nearly identical to each other. For ease of reference, the court will primarily cite to the first Motion filed, [Doc. 8], and will cite to the other Motions as necessary. Citations to [Doc. 8] should be read as including citations to the same page numbers located in [Doc. 9] and [Doc. 11]. computer.” [Doc. 8 at 1]. Therefore, Defendants reason that Plaintiff waited too long to seek relief by filing his Complaint more than three years later, on May 21, 2021. [Id. at 2]. The court will address each of Plaintiff’s claims in turn. I. Plaintiff’s Common Law Claims (Claims I and II) “Whether a [Colorado] statute of limitations bars a particular claim is a question of fact, but the issue may be decided as a matter of law if undisputed facts demonstrate that the plaintiff had the requisite information as of a particular date.” Conry v. Barker, No. 14-cv-02672-CMAKLM, 2015 WL 5636405 , at *11 (D. Colo. Aug. 11, 2015), report and recommendation adopted, 2015 WL 5608133 (D. Colo. Sept. 24, 2015) (quoting Burns v. Mac, No. 13-cv-2109-WJM-KLM, 2014 WL 1242032 , at *11 (D. Colo. Mar. 26, 2014) and Trigg v. State Farm Mut. Auto. Ins. Co., 129 P.3d 1099, 1101 (Colo. App. 2005)). While the statute of limitations itself is a state law matter, federal law rather than state law determines when a cause of action accrues. See Indus. Constructors Corp. v. U.S. Bureau of Reclamation, 15 F.3d 963 , 968 (10th Cir. 1994) (citations omitted). There is some ambiguity as to the applicable statute of limitations, as some observers have noted that the Colorado Court of Appeals has reached differing conclusions on the applicable statute of limitations for conversion actions. See Statutes of Limitations: Colorado, Practical Law State Q&A 6-520-4145. Here, Defendants argue, and Plaintiff does not dispute, that Plaintiff’s conversion and trespass to chattels claims are subject to a three-year statute of limitations. [Doc. 8 at 4 (citing to Colo. Rev. Stat. § 13-80-101 (1)(h) (stating a three-year statute of limitations applies for “all actions of replevin or for taking, detaining, or converting goods or chattels”)); Doc. 23 at 4 (“The defendants are correct that the limitations period for Mr. Schober’s common law conversion and trespass to chattel claims is three years.”)]. Thus, this court applies (without deciding) a three-year statute of limitations to its analysis. See Curtis v. Counce, 32 P.3d 585, 588 (Colo. App. 2001). But see Focke v. Allen, No. 20-CV-03014-MEH, 2021 WL 3828714 , at *5 (D. Colo. Aug. 27, 2021) (applying a two-year statute of limitations to a conversion claim); Oaster v. Robertson, 173 F. Supp. 3d 1150, 1168 (D. Colo. 2016); McGee v. Hardina, 140 P.3d 165, 167 (Colo. App. 2005) (holding that conversion, as an action in tort, was subject to a twoyear statute of limitations). Under federal law, the statute of limitations begins running once “the plaintiff knows or has reason to know of the existence and cause of the injury which is the basis of his action.” Indus., 15 F.3d at 969. Similarly, under Colorado law, a claim begins to accrue on the day when both the injury and its cause became known or should have been knowable to Plaintiff by the exercise of reasonable diligence. Colo. Rev. Stat. § 13-80-108 (7). “In other words, it is the point when a plaintiff knows (or should have known) all material facts essential to show the elements of the cause of action. The focus of the inquiry is on the discovery of facts, not the realization of potential causes of action.” Focke, 2021 WL 3828714 , at *5 (citing Crosby v. Am. Family Mut. Ins. Co., 251 P.3d 1279 , 1285–87 (Colo. App. 2010)). The requirement that a plaintiff use due diligence in discovering a relevant circumstance or event imposes an objective standard and does not reward denial or self-induced ignorance. Sulca v. Allstate Ins. Co., 77 P.3d 897 (Colo. App. 2003). It is Defendants’ burden to prove when the claims accrued. Focke, 2021 WL 3828714 , at *5 (citing Crosby, 251 P.3d at 1283 ). Plaintiff filed the Complaint on May 21, 2021. [Doc. 1]. Defendants argue that, in January 2018, “Plaintiff knew or had reason to know that his bitcoin had disappeared from his cryptocurrency wallet,” that “it is not reasonable to assume that Plaintiff did not know that [his] bitcoin was stolen from him immediately,” and Plaintiff was “on notice immediately that the cause of the theft was the invasion of some sort of his computer.” [Doc. 8 at 5–6]. Therefore, Defendants contend, Plaintiff’s claims began to accrue in January 2018—more than three years before Plaintiff filed the Complaint—because “Plaintiff’s knowledge of his injury and its general cause … was sufficient to start the clock on his causes of action.” [Id. at 6]. In his Response, Plaintiff argues that the Complaint does not contain any information to suggest that, “more than three years before he filed his [C]omplaint,” [Doc. 23 at 6]—prior to May 21, 2018—Plaintiff “knew or should have known both (i) his injury, i.e., that his cryptocurrency was missing as the result of wrongdoing, rather than because of some other reason; and (ii) its cause, i.e., that Benedict Thompson and Oliver Read had stolen it.” [Doc. 23 at 4]; see also [id. at 5–6]. Plaintiff also contends that Defendants “fail[] to discern the difference between missing and stolen [Bitcoin], and that Mr. Schober took action to learn what had happened to his missing cryptocurrency by” investigating the theft. [Id. at 5 (emphasis in original)]. Relatedly, Plaintiff argues that because the Malware was designed to conceal its existence, it is not reasonable to infer that Plaintiff was “‘on notice immediately’ of what had happened to his cryptocurrency.” [Id.]. In the Thompson Defendants’ Reply, they argue that “it is not objectively reasonable to ascribe losing thousands and thousands of dollars to the money simply being ‘missing’” and “[a] reasonable person would immediately investigate whether substantially all of their net worth was ‘missing’ because it was taken by wrongdoing.” [Doc. 26 at 4]. They also argue that it was unnecessary for Plaintiff to know “the defendant’s identity in order to be cognizant of his injury and the cause of his injury.” [Id. at 5]. Based on the record before it, the court finds that Defendants have not met their burden of establishing that the Complaint makes clear that Plaintiff’s right to assert a claim based on conversion and/or trespass to chattels has been extinguished. Sierra Club v. Okla. Gas & Elec. Co., 816 F.3d 666, 671 (10th Cir. 2016). Plaintiff does implicitly concede that no later than October 2018, he knew that his cryptocurrency had been solen and he at least believed that Defendant Oliver was responsible. [Doc. 1 at ¶ 57]. See Indus., 15 F.3d at 969 (stating a cause of action begins to accrue when “the plaintiff knows or has reason to know of the existence and cause of the injury which is the basis of his action”). But he also alleges that he “spent in excess of $10,000 investigating who accessed his computer and damaged information on it.” [Doc. 1 at ¶ 104]. Plaintiff also alleges he learned about Defendants Benedict’s and Oliver’s involvement in the theft through “Blockchain tracing analyses and investigations” that were performed after the Bitcoin was already stolen.7 [Id. at ¶ 39]; see also [id. at ¶¶ 40–46]. Thus, based on the allegations in the Complaint, and reviewing them in the light most favorable to Plaintiff, all that Plaintiff knew in January 2018 was that his cryptocurrency had gone missing. It was not until Plaintiff investigated that he later discovered, at an unidentified time, the cause of his missing cryptocurrency and the identities of the individuals involved. And then, in or about October 2018 and December 2019, Plaintiff emailed a letter to Defendant Oliver’s parents and Defendant Benedict’s parents, respectively, “demanding that they return” the stolen Bitcoin. [Id. at ¶¶ 51, 57]. Defendants cite Sanders v. Mountain America Fed. Credit Union, 689 F.3d 1138, 1141 (10th Cir. 2012) in support of their proposition that “it is not reasonable to assume that Plaintiff 7 The Thompson Defendants’ Reply also appears to support this conclusion, given their indications therein that, in January 2018, Plaintiff was aware that his cryptocurrency was missing, at which time Plaintiff was required to exercise reasonable diligence to determine the cause. See [Doc. 26 at 4 (“‘Reasonable diligence” on Mr. Schober’s part immediately after acquiring knowledge that his cryptocurrency was missing would show him that another individual was in possession of Plaintiff’s cryptocurrency … A reasonable person would immediately investigate whether substantially all of their net worth was ‘missing’ because it was taken by wrongdoing.” (emphasis added)]. did not know that bitcoin in the amount of ‘approximately $1 million’ and ‘95% of his net worth’ was stolen from him immediately.” [Doc. 8 at 6]. However, it is not obvious to the court how that case, arising under the federal Truth in Lending Act, supports such a proposition, and Defendants fail to explain the same. Insofar as Defendants are questioning Plaintiff’s diligence, such a challenge raises issues of material fact that are not appropriately resolved at the motion to dismiss stage. Defendants have not met their burden of establishing that Plaintiff’s claims began to accrue more than three years before Plaintiff filed the Complaint. See Focke, 2021 WL 3828714 , at *5 (finding a lawsuit was timely filed where one year and three months passed before the plaintiff obtained the information she needed to file suit); see also Glenn Arms Associates v. Century Mortg. & Inv. Corp., 680 P.2d 1315, 1317 (Colo. Ct. App. 1984) (“Predicates to a successful claim for conversion are the owner’s demand for the return of the property, and the controlling party’s refusal to return it.”).8 Accordingly, Defendants’ Motions to Dismiss as to Plaintiff’s claims for conversion (Claim I) and trespass to chattels (Claim II) are DENIED.9 II. Plaintiff’s CFAA Claim (Claim IV) Application of Statute of Limitations. Plaintiff asserts his fourth claim under the CFAA. “The CFAA criminalizes various specified forms of hacking and computer data theft if the affected computer is a ‘protected computer,’ meaning, among other things, a computer ‘which is used in or affecting interstate or foreign commerce or communication.’” Cloudpath Networks, Inc. v. 8 In addition, questions with respect to Plaintiff’s diligence may also play into whether or not equitable tolling is appropriate. Given this court’s ruling that Claims I and II are not barred by the statute of limitations, this court does not reach Plaintiff’s argument that the statute of limitations would be subject to equitable tolling. [Doc. 23 at 7–8]. 9 In so ruling, this court does not pass on whether, at a later stage in this proceeding, the statute of limitations might bar these two causes of action based on evidence evinced during discovery and/or trial. SecureW2 B.V., 157 F. Supp. 3d 961, 972 (D. Colo. 2016) (quoting 18 U.S.C. § 1030 (a), (e)(2)(B)). In addition, Section 1030(b) of the CFAA creates a separate offense for attempting or conspiring to violate the CFAA. To be timely, a civil action under the CFAA must be filed within two years “of the date of the act complained of or the date of the discovery of the damage.” 18 U.S.C. § 1030 (g). “Damage,” in turn, is defined under the CFAA as “any impairment to the integrity or availability of data, a program, a system, or information.” Id. § 1030(e)(8). Thus, the statute of limitations for the CFAA claim begins to run from the date that Plaintiff “discovered that someone had impaired the integrity of” his data, program, system, or information. See Sewell v. Bernardin, 795 F.3d 337, 340 (2d Cir. 2015); see also Gates Corp. v. CRP Indus., Inc., No. 16-cv-01145-KLM, 2019 WL 10894029 , at *16 (D. Colo. Nov. 13, 2019) (citing favorably to Sewell). The key inquiry in determining when the limitation period accrues is when the plaintiff discovers the unauthorized access or damage, regardless of whether the identity of the perpetrator is known. See Sewell, 795 F.3d at 342 . Defendants argue that Plaintiff’s CFAA claim is subject to a two-year statute of limitations, and therefore is barred. [Doc. 8 at 4 (citing to 18 U.S.C. § 1030 (g))]. Plaintiff does not dispute this limitations period. [Doc. 23 at 4]. Notably, however, Plaintiff’s Response addresses only whether his claims are subject to a three-year statute of limitations; and Plaintiff fails to explain, and the court’s review of the Complaint does not show, that “the date of the discovery of the damage” at issue was within two years of May 21, 2021—the date he filed the Complaint. See [Doc. 23 at 6 (“The Complaint contains no allegations indicating that Mr. Schober knew or should have known of his injury and its cause more than three years before he filed his complaint.” (emphasis added))]. Taking the allegations as pled in his Complaint as true, Plaintiff discovered that his computer had been accessed without authorized more than three years prior to the filing of his Complaint – indeed, Mr. Schober alleges that he had been deprived of the use of his cryptocurrency for more than three years, see e.g. [Doc. 1 at ¶ 82]; that he had been deprived of the use of his computer for more than two years, see [id. at ¶ 89]; and that no later than October 2018, he believed Defendant Oliver to be responsible for such injury, see [id. at ¶ 57]. Equitable Tolling. Plaintiff also generally argues that “even if the statute of limitations began to run as of the date of the theft itself,” the doctrine of equitable tolling should apply to his claims. [Doc. 23 at 7]. Equitable tolling is a general principal that courts may apply to toll the expiration of the statute of limitations when circumstances warrant. See, e.g., Stransky v. HealthONE of Denver, Inc., 868 F. Supp. 2d 1178, 1181 (D. Colo. 2012) (stating the doctrine of equitable tolling “permits courts to extend statutes of limitations on a case-by-case basis in order to prevent inequity.”) (citations omitted). Courts in their discretion may apply the doctrine to claims arising under federal statutes. Id. (citations omitted). Courts should apply the tolling doctrine when a defendants’ conduct “rises to the level of active deception, where a plaintiff has been lulled into inaction by a defendant, and ‘likewise, if a plaintiff is actively misled or has in some extraordinary way been prevented from asserting his or her rights.’” U.S. v. Clymore, 245 F.3d 1195, 1199 (10th Cir. 2001) (quoting Biester v. Midwest Health Servs., Inc, 77 F.3d 1264 , 1267 (10th Cir. 1996)). Application of the doctrine may also be appropriate if the plaintiff can show that “extraordinary circumstances” made it “impossible” to file a timely lawsuit. Id. Courts should apply the doctrine sparingly. Stransky, 868 F. Supp. 2d at 1181 (citing Irwin v. Dep’t of Veterans Affairs, 498 U.S. 89, 96 (1990); Graham-Humphreys v. Memphis Brooks Museum of Art, Inc., 209 F.3d 552, 560 (6th Cir. 2000)); see also Gognat v. Ellsworth, 224 P.3d 1039, 1049 (Colo. App. 2009), aff’d, 259 P.3d 497 (Colo. 2011) (explaining the doctrine of equitable tolling applies “to prevent a defendant from asserting a statute of limitations defense where the defendant’s wrongful conduct prevented the plaintiff from asserting a timely claim, or where extraordinary circumstances rendered the filing a claim within the statutory period impossible”). Though Plaintiff argues that equitable tolling applies because “the very nature of the conduct at issue involved Defendants’ concealing their identities from Plaintiff, necessarily preventing him from identifying them, suing them, and serving them with the Summons and Complaint,” [Doc. 23 at 7], Plaintiff asserts no facts that suggest he had not discovered the unauthorized access or damage to his computer or that any Defendant took any action that prevented him from discovering his injury by May 2019—two years before he filed the Complaint. Indeed, Plaintiff argues that the statute should be tolled “during the period in which Defendants successfully concealed their identity,” [Doc. 23 at 7], and acknowledges that he knew the identities of the Read Defendants “[i]n or about October 2018,” when he wrote Defendant Oliver’s parents to request the return of his cryptocurrency, [Doc. 1 at ¶ 57]. Plaintiff does not explain how Defendants’ actions to conceal their identities actually misled Plaintiff into thinking he did not have a cause of action under the CFAA within two years of the date he filed the Complaint. Thus, this court finds no basis to conclude that “extraordinary circumstances” rendered the filing of his CFAA claim within the two-year statutory period impossible to warrant the equitable tolling of that claim. See Radcliff v. Radcliff, No. CV 20-3669, 2020 WL 7090687 , at *7 (D.N.J. Dec. 4, 2020) (rejecting the plaintiff’s argument that “the fraudulent concealment doctrine saves her CFAA claim because [] Defendants ‘fraudulently concealed installation of the keylogger and recovered thousands of documents illegally from her computer’” because those actions did not “actually mis[lead] Plaintiff into thinking that she did not have a cause of action”); Sewell, 795 F.3d at 342 (“The plaintiff does have the option of initiating a lawsuit against a Jane or John Doe defendant, but she must still discover the hacker’s identity within two years of discovery or a reasonable opportunity to discover the violation to avoid dismissal.”). Accordingly, Defendants’ Motions to Dismiss as to Plaintiff’s CFAA claims are GRANTED.10 III. Plaintiff’s Civil Conspiracy Claim (Claim III) Plaintiff asserts his third claim for conspiracy under “common law and Colorado statutory law” and pursuant to the CFAA. See [Doc. 1 at ¶¶ 94–95]. In Colorado, civil conspiracy claims share a state of limitations with the underlying causes of action. See Sterenbuch v. Goss, 266 P.3d 428, 436 (Colo. App. 2011). As a result, insofar as Plaintiff’s common law conspiracy claim arises from his state causes of action—i.e., conversion and trespass of chattels—this court will accept, 10 In his Response, Plaintiff also argues that he should be allowed leave to replead under Federal Rule of Civil Procedure 15 because “[i]f the defendants’ motions to dismiss are granted, it would be on the assumption that Mr. Schober knew of his injury and its cause more than three years ago—which he did not.” [Doc. 23 at 8 (emphasis added)]. The court declines to grant leave to amend these CFAA claims for the following reasons. First, under D.C.COLO.LCivR 7.1(d) motions “shall not be included in a response” and must be filed as a separate document. Second, although courts should grant leave to amend freely under Rule 15, a court may deny leave to amend where amendment would be futile. Jefferson Cty. Sch. Dist. No. R-1 v. Moody’s Investor’s Servs., Inc., 175 F.3d 848, 859 (10th Cir. 1999). “A proposed amendment is futile if the complaint, as amended, would be subject to dismissal.” Id. The Thompson Defendants argue that Plaintiff’s proposed amendment would be futile because “[t]here is nothing Mr. Schober could add to his Complaint that would get rid of the fact that he was or should have been immediately aware that his cryptocurrency was stolen.” [Doc. 26 at 7–8]. As addressed throughout this Opinion, the Parties’ arguments focus on whether Plaintiff’s claims are subject only to a three-year statute of limitations. And while Defendants have failed to carry their burden in establishing that a threeyear limitations period bars Claims I and II, Plaintiff fails to address how leave to amend could cure his claims that under the CFAA (Claim IV) and civil conspiracy under the CFAA (Claim III) that are subject to a two-year statute of limitations – when he himself contends that he contacted the Read Defendants more than two years prior to the filing of the Complaint. See Oaster v. Robertson, 173 F. Supp. 3d 1150, 1180 (D. Colo. 2016) (“All of Plaintiff’s claims, save the fraud claim, are dismissed with prejudice because they fail as a matter of law.”); Gee v. Pacheco, 627 F.3d 1178, 1181 (10th Cir. 2010) (affirming dismissal with prejudice of claims as barred by the statute of limitations); Helmick v. Utah Valley State Coll., 394 Fed. App’x. 465, 467 (10th Cir. 2010) (dismissal based on the merits is with prejudice). for the purposes of the instant Motions, that a three-year statute of limitations applies. Given this court’s finding that Defendants have not established that Mr. Schober’s claims for conversion and trespass to chattels are barred by a three-year statute of limitations, the court also finds that dismissal of Plaintiffs civil conspiracy claim is not warranted at this time. CONCLUSION For the foregoing reasons, it is ORDERED that: (1) Defendants’ Motions to Dismiss [Doc. 8], [Doc. 9], [Doc. 11] are GRANTED IN PART AND DENIED IN PART; (2) Plaintiffs claim for violation of the CFAA (Claim IV) is DISMISSED with prejudice; and (3) Plaintiff's civil conspiracy claim (Claim III), insofar as that claim is brought under the CFAA, is DISMISSED with prejudice. DATED: January 14, 2022 BY THE COURT: a Y. Wang : United States Magistrate Judge