“Business owners can legally sue rioters, but identifying culprits with recoverable assets is nearly impossible”