UNITED STATES DISTRICT COURT WESTERN DISTRICT OF NEW YORK

EPHRAIM ATWAL, M.D., Plaintiff, v. DECISION AND ORDER 20-CV-449S NORTONLIFELOCK, INC., Defendant.

I. Introduction This is a removed diversity action alleging breach of contract and seeking declaratory judgment. Plaintiff (a New York doctor) claims coverage under Defendant’s (a Delaware corporation with its principal place of business in Arizona) Policy offering protection for losses due to identity theft. Defendant moved to dismiss (Docket No. 6), which this Court, on February 3, 2022, granted in part and denied in part, ordering Plaintiff to amend the Complaint, Atwal v. NortonLifeLock, Inc., No. 20CV449,

(W.D.N.Y. 2022) (Docket No. 13). Familiarity with this Decision and Order is presumed. Plaintiff then amended his Complaint (Docket No. 19; see Docket No. 14) filed upon the stipulation of the parties (Docket No. 17; see Docket No. 18 (Order adopting stipulation)). There, he reasserts a breach of contract and seeks declaratory judgment under Defendant’s Policy. Presently before this Court is Defendant’s Motion to Dismiss the Amended Complaint (Docket No. 20). For the reasons stated herein, Defendant’s Motion (Docket No. 20) is granted in part, denied in part. II. Background A. Plaintiff’s Cryptocurrency Account As alleged in the Amended Complaint (and stated in the February 3rd Decision, Atwal, supra,

, at *1) from June 26, 2017, Plaintiff maintained a “private

EOS cryptocurrency account” (Docket No. 19, Am. Compl. ¶ 16). This account was accessible through private key credentials (id. ¶ 17). On or about August or September 2018, an unknown third-party misappropriated Plaintiff’s key credentials and then stole all his EOS cryptocurrency funds from this private account (id. ¶¶ 18-19; see id. ¶ 21 (unauthorized access and use of his credentials)). Plaintiff had 2.09 million EOS funds in his account, valued at approximately $12 million (id. ¶ 20). B. Defendant’s LifeLock Identify Theft Program Under Defendant’s LifeLock Ultimate Plus Policy (hereinafter the “Policy”) issued to Plaintiff, Defendant agreed to pay up to $1 million coverage for remediation, stolen funds reimbursement, personal expenses, and coverage for lawyers and experts for a

“Stolen Identity Event” (id. ¶ 25, Ex. B, Policy at 3). A “Stolen Identity Event” is defined as a theft of personal information without the insured’s express authorization to establish or use a deposit, credit, or other Account (id. ¶ 29, Ex. B, Policy § VI., Definitions U., “Stolen Identity Event,” at 10). That personal information includes “personal identification, social security number, or other method of identifying you, or one or more uses of such stolen information without your express authorization to establish or use a deposit, credit or other Account, secure a loan, . . . enter into a contract or commit a crime” (id. (emphasis added)). A covered victim of a Stolen Identity Event also may obtain remediation coverage from Defendant including reimbursement of stolen funds (id.), remediation coverages (id. ¶ 26, Ex. B, Policy § I.C., at 4-5), and coverage of “direct financial loss arising from a Stolen Funds Loss incurred as a direct result of a Stolen Identity Event” (id. ¶ 27, Ex. B, Policy § I.B., at 4). “Stolen Funds Loss” in turn is defined in this policy as “the principal amount, incurred by [the insured] and caused by an Unauthorized Funds Transfer” (id.

¶ 28, Ex. B, Policy § VI., Definitions T., “Stolen Funds Loss,” at 10). “Unauthorized Funds Transfer” is defined there as “a Funds Transfer from your Account initiated by a person other than [the insured] without the actual authority to initiate the transfer and from which you and your immediate family members receive no benefit” (id., Ex. B, Policy § VI., Definitions X., “Unauthorized Funds Transfer,” at 10). An “Account” in this Policy “is defined as ‘a U.S. regulated and domiciled checking, savings, money market, brokerage, or credit card Account of yours held directly or indirectly by a Financial Institution and established primarily for personal, family or household purposes. ‘Account’ also includes a Retirement Account held in your name, or the name of your authorized representative.”

(id., Ex. B, Policy § VI., Definitions B., “Account,” at 9 (emphasis added)). “Financial Institution” is defined in the Policy as a “bank, savings, association, credit union, credit institution or company issuing credit or any other person or entity that directly or indirectly holds an Account belonging to you” (id., Ex. B, Policy § VI., Definitions G., at 9). C. Proceedings Plaintiff initially alleged a breach of Defendant’s Policy by the unauthorized use of his key credentials to the EOS account (id.). He did not explicitly allege that the EOS account, or the cryptocurrency it contained, was an “Account” under the terms of Defendant’s Policy—that is, currency from a government regulated, domestic financial institution—or that the cryptocurrency was a regulated commodity or security. Defendant removed that case on diversity jurisdiction to this Court (Docket No. 1) and then moved to dismiss (Docket No. 6). This Court granted in part (dismissing the breach of the duty of good faith and unjust enrichment claims and part of the claims alleging breach of contract for losses to

Plaintiff’s account) and denied in part that motion (Docket No. 13), Atwal, supra,

(W.D.N.Y. Feb. 3, 2022). There, this Court found that Plaintiff had not alleged how he acquired his EOS cryptocurrency that was stolen from his account that he claims coverage under Defendant’s LifeLock Identity Theft Program. This was essential to establish coverage under Defendant’s program since it expressly covered only “Accounts” from “U.S. regulated and domiciled” financial institutions. Id. at *7, 5, 2. “Absent allegation of government regulation generally applicable to fiat money, cryptocurrency like Plaintiff’s EOS here is dependent upon the agreed upon definition of the parties,” where Defendant defined “Account” narrowly, id. at *5. This Court held that “Plaintiff needed to allege that the cryptocurrency account fell

under the terms of Defendant’s Policy,” id. at *8. The initial Complaint did not allege how Plaintiff acquired the cryptocurrency, but “had Plaintiff’s acquisition of EOS cryptocurrency as a regulated security been alleged in the Complaint, the losses Dr. Atwal incurred from its theft would be covered under Defendant’s Policy as from an ‘Account’ from a U.S. regulated and domiciled brokerage,” id. at *7. That Decision also ordered Plaintiff to serve and file an Amended Complaint within twenty-one days of entry of that Decision, or by February 24, 2022, id. at *13. Plaintiff timely moved for Leave to Amend the Complaint (Docket No. 14). There, he adds allegations of the source for his EOS cryptocurrency, claiming that he acquired the cryptocurrency from Block.one in a public offering (id., Ex. A, proposed Am. Compl. ¶¶ 9, 14). He further contends that the U.S. Securities and Exchange Commission (“SEC”) determined that Block.one offered and sold securities under federal securities law (id. ¶10-12, 15, citing SEC Order, dated Sept. 20, 2019, In re Block.one, Admin. Proceeding

File No. 3-1568, id., Ex. A). Plaintiff maintained the EOS cryptocurrency in his private account which had his private credentials misappropriated and the EOS funds taken (id. ¶¶ 16-17, 18-20). The Amended Complaint now only alleges claims for declaratory judgment and breach of contract, arguing in both that the theft of his EOS cryptocurrency was covered by Defendant’s program. He also sought extension of the service and filing deadline for an Amended Complaint until the decision of his Motion for Leave to Amend (Docket No. 14); that extension was granted (Docket No. 16, Text Order, Feb. 23, 2022). The parties stipulated to granting leave to amend the Complaint (Docket No. 17) which this Court adopted (Docket No. 18). Plaintiff then served and filed the Amended

Complaint (Docket No. 19), alleging what was proposed in the Motion for Leave to Amend. Defendant then moved to dismiss the Amended Complaint (Docket No. 201). Responses to this Motion were due by May 3, 2022, and any reply by May 10, 2022 (Docket No. 21). After filing responding and reply papers (Docket Nos. 22, 23), this Motion was deemed submitted and oral argument was not necessary.

1In support of its Motion to Dismiss the Amended Complaint, Defendant submits the Declaration of Defendant’s Attorney with exhibits (the original state Summons and Complaint, Notice of Removal with its related papers; this Court’s February 3, 2022, Decision; and the Amended Complaint); Defendant’s Memorandum of Law (Docket No. 20). In reply, Defendant submitted its Reply Memorandum, Docket No. 23.

In opposition, Plaintiff submits his Memorandum of Law, Docket No. 22. III. Discussion A. Applicable Standards 1. Motion to Dismiss The standards for a Motion to Dismiss under Rule 12(b)(6) are familiar and remain as stated in the February 3rd Decision, Atwal,

, at *3.

To survive a motion to dismiss, the factual allegations in the Complaint “must be enough to raise a right to relief above the speculative level,” Bell Atlantic Corp. v. Twombly,

,

,

(2007); see also Ashcroft v. Iqbal,

,

,

(2009). A Rule 12(b)(6) motion is addressed to the face of the pleading. The pleading is deemed to include any document attached to it as an exhibit, Fed. R. Civ. P. 10(c), such as Defendant’s Policy (Docket No. 19, Am. Compl., Ex. B), Goldman v. Belden,

(2d Cir. 1985). In considering such a motion, the Court must accept as true all the well pleaded facts alleged in the Complaint. Bloor v. Carro, Spanbock, Londin, Rodman

& Fass,

(2d Cir. 1985). However, conclusory allegations that merely state the general legal conclusions necessary to prevail on the merits and are unsupported by factual averments will not be accepted as true. New York State Teamsters Council Health and Hosp. Fund v. Centrus Pharmacy Solutions,

(N.D.N.Y. 2002). 2. Choice of Law The choice of law remains New York substantive law, id. at *3-4, 6 (breach of contract elements under New York law); see also id. at *5 (declaratory judgment standard under

(a)) (see also Docket No. 19, Am. Compl. ¶ 7). 3. Effect of Amending the Complaint The effect of amending the Complaint is to supersede the original pleading, see 6 Charles A. Wright, Arthur R. Miller & Mary Kay Kane, Federal Practice and Procedure § 1476, at 636-38 (Civil ed. 2010). Defendant seeks dismissal of the Amended

Complaint. The parties stipulated to granting leave to amend the Complaint (Docket No. 17). Under Federal Rule of Civil Procedure 15(a), amendment of pleadings after the time to do so as of right requires either consent of all parties or by leave of the Court. Absent consent, motions for leave to amend the complaint are to be freely given when justice requires, and the grant of such leave is within the sound discretion of the Court. Foman v. Davis,

,

,

(1962); Zenith Radio Corp. v. Hazeltine Research, Inc.,

,

,

(1971). “In the absence of any apparent or declared reason–such as undue delay, bad faith or dilatory motive on the part of the movant, repeated failure to cure deficiencies by amendments

previously allowed, undue prejudice to the opposing party by virtue of allowance of the amendment, futility of amendment, etc.–the leave sought should, as the rules require, be ‘freely given.’”

(quoting Fed. R. Civ. P. 15(a)). 4. New York Breach of Contract and Declaratory Judgment Standards The Amended Complaint alleges breach of contract and seeks declaratory judgment that Defendant is entitled to coverage under Defendant’s Policy (Docket No. 19, Am. Compl. ¶¶ 41-46, 37-39). As this Court observed previously, to state a breach of contract under New York common law (applicable pursuant to Defendant’s policy, Docket No. 1, Ex. A, Compl. Ex A, Policy VIII. E., at 12), Plaintiff must prove by preponderance of evidence the existence of a contract with Defendant, performance of his obligations under the contract, breach of the contract by Defendant, and damages to Plaintiff caused by Defendant’s breach, e.g., Diesel Props S.r.l. v. Greystone Business Credit II LLC,

(2d Cir. 2011) (citing cases) (Docket No. 37, Def. Memo. at 8); Atwal,

supra,

, at *6. As for declaratory judgment, this Court reaffirms, see Atwal, supra,

, at *5, that under applicable federal procedures, see

(a) (removal), this Court “upon the filing of an appropriate pleading, may declare the rights and other legal relations of any interested party seeking such declaration, whether or not further relief is or could be sought. Any such declaration shall have the force and effect of a final judgment or decree,”

(a). B. Scope of Defendant’s Policy Whether Plaintiff has an “Account” covered by Defendant’s Policy depends upon whether Plaintiff’s private EOS cryptocurrency account falls under the Policy’s definition

of a domestic regulated “Account” (Docket No. 19, Am. Compl., Ex. B, Policy § VI., Definitions B., at 9). The February 3rd Decision focused upon the cryptocurrency funds in the account, whether it was property Defendant intended to secure under its Policy, see Atwal, supra,

, at *4-5. The Amended Complaint addresses the nature of the funds in the account and claims coverage under Defendant’s Policy (see Docket No. 19). C. First and Second Causes of Action—Declaratory Judgment and Breach of Contract Plaintiff again seeks declaratory judgment that Defendant breached its contract. This Court will consider together Plaintiff’s First and Second Causes of Action. 1. Parties’ Contentions Defendant argues that Plaintiff fails to state a claim for either Cause of Action because Plaintiff’s private account was not an “Account” under Defendant’s Policy (Docket No. 20, Def. Memo. at 1, 4-6). Although Plaintiff identified the EOS

cryptocurrency as purchased from Block.one and claimed it was a security, Defendant replies that this cryptocurrency was not controlled or overseen by a governmental agency and cybercurrencies were not legal tender. Defendant’s Policy covers only legal tender. (Id. at 6). Plaintiff first argues that Defendant abandoned any futility argument by not opposing his Motion for leave to amend (Docket No. 22, Pl. Memo. at 2, 14-15). Plaintiff argues that this Court’s February 3 Decision, including the holding that the First and Second Causes of Action stated claims, was law of the case (id. at 6-9). Plaintiff also resists this Motion as an improperly labeled Motion for Reconsideration (id. at 9-10). Next, he contends that the Amended Complaint alleges coverage for “Stolen Funds Loss” under

the Policy (id. at 10-14). Defendant replies that the law of the case does not apply here and that it did not move for reconsideration (Docket No. 23, Def. Reply Memo. at 2-3, 3-4). Defendant asserts that Plaintiff still has not plead a claim (id. at 1-2, 4-7). Finally, Defendant denies that its stipulation for leave to amend was a waiver of its Motion to Dismiss (id. at 7-8). 2. Analysis a. Plaintiff’s Preliminary Objections First, this Court needs to address two points on the Amended Complaint from Plaintiff’s arguments (cf. Docket No. 22, Pl. Memo. at 14-15, 9-10). Defendant’s Motion to Dismiss does not argue futility in amendment. Defendant addresses whether the Amended Complaint states a claim, not whether it was futile to amend the prior pleading. While the concepts of futility to amend and failure to state a claim overlap, Defendant did not waive arguing the latter by agreeing to Plaintiff’s amendment.

Next, the effect of amending the Complaint is to replace the original pleading, Fed. R. Civ. P. 15. While Plaintiff realleges claims that survived following the first Motion to Dismiss, Defendant’s Motion is not seeking reconsideration. b. Breach of Policy—Account Covered by Policy For his First and Second Causes of Action (for declaratory relief and for breach of contract, respectively), Plaintiff needs to allege the existence of a contract with Defendant and that Defendant breached it. The Policy’s definition of “Account” (including the “Financial Institution” and “Stolen Identity Event” definitions for the use of the information to establish or use a deposit, credit, or other Account, Docket No. 19, Am. Compl., Ex. B, Policy § VI., Definitions G.,

U., at 10) is limited to “U.S. regulated and domiciled” accounts (id., § VI., Definitions B., at 9). Defendant argues the Policy still does not cover this cryptocurrency for two reasons. First, the account that held the cryptocurrency was private and not in a governmentally regulated institution (Docket No. 20, Def. Memo. at 4-5). Second, the EOS cryptocurrency is not “legal tender” that Defendant believes renders it beyond its coverage (id. at 6). Defendant’s Policy does not cover private accounts (id. at 5). The Amended Complaint (and as alleged in the original, Docket No. 1, Ex. A, Compl. ¶ 7) expressly asserts that he maintained a “private EOS cryptocurrency account” (Docket No. 19, Am. Compl. ¶ 16; cf. Docket No. 1, Ex. A, Compl. ¶ 7). As concluded in deciding Defendant’s first Motion to Dismiss, Plaintiff still needs to “allege that the cryptocurrency account fell under the terms of the Defendant’s Policy,” Atwal, supra,

, at *8

(emphasis added). Plaintiff, however, focuses on his EOS cryptocurrency, arguing that it is deemed a security (Docket No. 22, Pl. Memo. at 11-12). He alleges in the Amended Complaint the nature of his EOS cryptocurrency, identifying the source of the EOS cryptocurrency as Block.one, an entity found by the SEC to be issuing unregistered securities (Docket No. 19, Am. Compl. ¶¶ 9-15, Ex. A). Plaintiff has established in his amended pleading that his EOS cryptocurrency was a security (Docket No. 19, Am. Compl. ¶¶ 8-15, 9 n.1, 11 n.3, 12 n.4, Ex. A), addressing the concern noted in the February 3rd Decision and Order that the nature of the cryptocurrency was never alleged initially, id. at *7. Thus, Defendant’s alternative argument is rejected.

While the contents of Plaintiff’s account were securities, the account itself needed to be in a regulated, domestic financial institution to be covered under Defendant’s Policy. Plaintiff explicitly alleged that the account was “private” that would place the account outside the scope of the Policy. Plaintiff has not alleged that his account was with a domestic, regulated brokerage account to constitute an “Account” under the policy. The Amended Complaint does not claim the accounts were regulated by a public institution. The Stolen Identity Event under the policy remains defined as alternatives, either theft of personal information or the use of the stolen information to access the member’s “Account” (Docket No. 19, Am. Compl., Ex. B, § VI., Definitions U., at 10). Defendant next denies that this was a “Stolen Identity Event” under the Policy (Docket No. 20, Def. Memo. at 6-7). Plaintiff, however, is correct; Defendant seeks to relitigate a point resolved in the February 3rd Decision which held that Plaintiff alleged one form of stolen identity under the “Stolen Identity Event” from the use of Plaintiff’s key credential (his personal

information) to access his account, Atwal, supra,

, at *7. Plaintiff realleged this theft in the Amended Complaint (Docket No. 19, Am. Compl. ¶¶ 17-18; cf. Docket No. 1, Ex. A, Compl. 8-9). While Plaintiff alleges a Stolen Identity Event, remediation for that event is tied to a covered “Account.” Under Defendant’s Policy, remediation for a Stolen Fund Loss caused by an Unauthorized Funds Transfer from Plaintiff’s Account, id. at *2 (Docket No. 19, Am. Compl., Ex. B, Policy § I.C., at 4-5, § I.B., at 5, § VI., Definitions T., X., at 10), that is the transfer from governmentally regulated and domiciled Account. Plaintiff’s allegation of loss from his private account fails to allege remediation under the Policy and thus no breach of that Policy.

For remediation coverage under Defendant’s Policy, Plaintiff’s allegations here are analogous to Plaintiff seeking coverage from Defendant following his use of a wall safe in another person’s house (but not a bank or financial institution). The former contents of that safe are items of value, possibly recognized as securities or other currency. Plaintiff has a note recording the combination to the safe, with that combination based on Plaintiff’s Social Security number or another personal identifier. Someone steals the note with the combination to that safe and loots its contents. In this hypothetical, Defendant’s identity theft protection Policy would protect against the theft of the combination note as theft of Plaintiff’s personal information but would not provide for remediation of the lost contents of the wall safe. Since the safe was in a private establishment and not the regulated financial institutions stated in the Policy, the stolen items (regardless of what they were) are not covered for remediation. The costs for the lost note (whatever that might be) may be covered under the Policy.

Dr. Atwal here acquired cryptocurrency and placed it into a private account, a cyber version of the private wall safe. Defendant’s Policy by its terms does not cover remediation for items placed in that private account, regardless of what they were. Plaintiff has suffered a loss from a Stolen Identity Event that is covered by Defendant’s Policy. He states this claim but he has not alleged entitlement to remediation for the lost EOS cryptocurrency under that Policy. Therefore, Defendant’s Motion to Dismiss (Docket No. 19) the Amended Complaint is granted in part (dismissing remediation claims) and denied in part (upholding the theft of Plaintiff’s credentials).

IV. Conclusion Plaintiff seeks in his Amended Complaint the First and Second Causes of Action for a declaration of the breach of contract and damages for breach of contract under Defendant’s LifeLock Ultimate Plus Policy. He alleges the breach of contract occurred when Defendant failed to cover the theft of Plaintiff’s personal information (the key credentials for the cryptocurrency account). (Docket No. 19, Am. Compl.) This Amended Complaint, however, fails to allege a breach of contract due to access to the EOS cryptocurrency account in that there was no allegation that the account was from a domestic regulated brokerage firm. Thus, Defendant’s Motion to Dismiss (Docket No. 20) the First and Second Causes of Action is granted in part, denied in part, dismissing Plaintiff’s remediation claims but continuing his loss of key credentials claims. With portions of these Causes of Action remaining (to wit, the losses arising from the stolen key credentials), Defendant shall answer the Amended Complaint within

fourteen (14) days of entry of this Decision and Order. V. Orders IT HEREBY IS ORDERED, that Defendant NortonLifeLock, Inc.’s, Motion to Dismiss the Amended Complaint (Docket No. 20) is GRANTED IN PART, DENIED IN PART. FURTHER, that Defendant shall answer the Amended Complaint within fourteen (14) days after entry of this Decision and Order. SO ORDERED.

Dated: May 24, 2022 Buffalo, New York

s/William M. Skretny WILLIAM M. SKRETNY United States District Judge