United States v. Ebuka Umeti

USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 1 of 22 PUBLISHED UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT No. 24-4478 UNITED STATES OF AMERICA, Plaintiff – Appellee, v. EBUKA RAPHAEL UMETI, a/k/a Ebuka Rapheal Umeti, Defendant – Appellant. Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Leonie M. Brinkema, District Judge. (1:22-cr-00123-LMB-1) Argued: December 12, 2025 Decided: February 19, 2026 Before NIEMEYER, GREGORY, and AGEE, Circuit Judges. Affirmed in part, reversed in part, and remanded by published opinion. Judge Agee wrote the opinion in which Judge Niemeyer and Judge Gregory joined. ARGUED: Jenny R. Thoma, OFFICE OF THE FEDERAL PUBLIC DEFENDER, Clarksburg, West Virginia, for Appellant. Laura Devon Withers, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellee. ON BRIEF: Erik S. Siebert, United States Attorney, Daniel J. Honold, Assistant United States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellee. USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 2 of 22 AGEE, Circuit Judge: Ebuka Raphael Umeti was charged with, inter alia, conspiracy to commit wire fraud, conspiracy to cause intentional damage to a protected computer, wire fraud and aiding and abetting, and intentional damage to a computer with a loss of at least $5,000. During the venire proceedings, a potential juror stated that he worked in cybersecurity and was familiar with Umeti’s case. He was eventually struck for cause. Subsequently, the jury convicted Umeti on all counts. On appeal, Umeti argues that the potential juror’s statements improperly affected juror impartiality. He further argues that the Government failed to adduce sufficient evidence (1) tying him to the scheme and (2) that the businesses incurred $5,000 of qualifying losses. For the reasons that follow, we affirm in part, reverse in part, and remand for resentencing. I. Umeti and his co-conspirators, Franklin Okwonna and Mohammed Butaish (collectively, “Defendants”), conspired to commit wire fraud by deceiving businesses into executing wire transfers to bank accounts controlled by the Defendants. Umeti and Okwonna, both of whom resided in Nigeria, discussed template phishing emails, some of which included malware. The pair connected with Saudi Arabia-based Butaish online, at which point they conferred about purchasing undetectable malware. 2 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 3 of 22 In August 2022, a grand jury returned an eleven-count indictment charging the Defendants with various crimes related to their scheme. Those charges, as relevant here, included conspiracy to commit wire fraud in violation of 18 U.S.C. § 1349, with an enhancement for falsely registering a domain name under 18 U.S.C. § 3559(g)(1) (Count 1); conspiracy to cause intentional damage to a protected computer, in violation of 18 U.S.C. § 371, with an enhancement for causing loss of at least $5,000 in a one-year period under 18 U.S.C. § 1030(c)(4)(B) (Count 2); three counts of wire fraud and aiding and abetting, in violation of 18 U.S.C. § 1343 (Counts 3–5); and intentional damage to a protected computer, in violation of 18 U.S.C. § 1030(a)(5)(A), with an enhancement for causing loss of at least $5,000 in a one-year period under 18 U.S.C. § 1030(c)(4)(B) (Count 11). Okwonna accepted a plea deal, and Umeti went to trial. 1 Before voir dire, the district court instructed the potential jurors on the importance of impartiality. See J.A. 52 (instructing prospective jurors to “listen carefully to all of the evidence and to make decisions based solely upon the evidence presented during the trial and not on extraneous or improper bases”). Then, during voir dire, the court asked whether any potential juror thought “that he or she might know something about the case.” J.A. 55. In response, Greg Kodish and the district court engaged in the following colloquy: Kodish: I work in cybersecurity. I think we might have done some of the remediation regarding some of these. The Court: Well, I’m going to ask a general question about cyber work, but do you know anything about this particular case? 1 As of the date of this opinion, Butaish’s charges remain pending. 3 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 4 of 22 Kodish: I’ve heard of the defendants and some of their— The Court: I’m sorry? Kodish: I’ve heard of the defendants and some of their previous involvement in this industry. The Court: All right. Thank you, Mr. Kodish. J.A. 56. Defense counsel subsequently approached the bench and expressed concern that Kodish’s comments tainted the jury pool, contending that Kodish stated “to the whole jury pool that he had firsthand knowledge that the defendants, including Mr. Umeti, were involved in fraud[.]” J.A. 63. The district court disagreed, explaining that it “did not hear it that clearly at all,” but the court noted the objection for the record. Id. Throughout voir dire, the district court continued to emphasize the importance of juror impartiality. See, e.g., J.A. 70 (noting the importance that each potential juror “think[] carefully about whether he or she can be completely impartial in acting as a juror”). At the close of voir dire, Kodish was struck for cause. When the jury was empaneled, the Government presented its case and adduced evidence that Defendants stole millions of dollars from various businesses throughout the country. Of particular import to this appeal, the Defendants targeted Company H by duping one of its employees in 2020. 2 They sent malware-laden emails to that employee purporting to be well-known businesses, including Company H’s vendors. Once the files attached to these emails were opened, malware automatically downloaded onto the recipient’s 2 Both parties anonymized the companies victimized by the Defendants’ scheme in their briefing. We do the same throughout this opinion. 4 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 5 of 22 computer. The same type of scheme was carried out against one of Company L’s employees. Further tying the Defendants to both companies, federal agents discovered malicious files on Company H’s computers that matched malware discovered on Company L’s computers. That malware permitted the Defendants to evade antivirus software and gave them access to information on the recipient’s computer so as to steal funds from that entity. The Government sought to prove Umeti’s involvement in the scheme by linking his personal online presence with the fraudsters’ online presence. It did so by constructing a chain of evidence tying Umeti’s personal online presence to the fraudsters’ online presence through similar social media handles 3 and email addresses, shared internet protocol (“IP”) addresses, and connections between Umeti’s personal emails and the fraud-connected accounts. The Government also sought to connect Umeti’s personal Gmail and Instagram accounts to the fraudsters’ GitHub, Yahoo, Hack Forums, Discord, and Namecheap accounts. 4 A “handle” is the name under which someone posts on social media. See Antonyuk 3 v. James, 120 F.4th 941, 1002 (2d Cir. 2024). 4 These social media platforms serve somewhat distinct purposes. GitHub is “an account for an online software development platform. The users . . . store[] and track[] and collaborate[] on various software projects[.]” J.A. 391. Hack Forums is an online forum to “discuss ideas about how to hack and share ideas of how to purchase and buy different types of malware encryptors.” J.A. 387–88. Discord “is an instant messaging and . . . social platform where Discord users can send text messages, make . . . voice calls, video calls and send files.” J.A. 432. Finally, “Namecheap is a domain registrar” that permits users “to create [and register] a domain name[.]” J.A. 407. A “[d]omain is a text address similar to a numerical address to a residence. [It] is an address to a website[.]” J.A. 407–08. 5 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 6 of 22 The Government further introduced evidence that, as a result of the Defendants’ scheme, Company H suffered financial damages. Company H’s representative testified that, over a period of “about three months,” Company H conducted “a big cleanup job” as a result of the hacking. J.A. 286–87. It purchased “two new laptops” and contacted customers to determine the extent of the fraud. J.A. 286. The corporate representative also testified that she “believe[d] there was about [$]1.7 million that went to different banks” because of the Defendants’ scam. J.A. 287. Umeti moved for judgment of acquittal at the close of the Government’s case, arguing that it failed to establish his involvement in the fraud. The district court denied that motion, explaining that the Government’s circumstantial evidence was “more than enough” for the jury to conclude that Umeti was involved in the fraud. 5 J.A. 601. After Umeti presented his defense, the district court instructed the jury, reiterating that the verdict must be based “on the evidence received during the trial,” J.A. 861, and emphasizing the importance of each juror’s “impartial consideration of the evidence,” J.A. 895. Following deliberations, the jury convicted Umeti on all counts and the sentencing enhancements presented. Thereafter, Umeti renewed his motion for a judgment of acquittal or, in the alternative, a new trial. In support of that motion, he contended Kodish’s statements during the venire process constituted a prejudicial, external influence on the jury. He also argued 5 The district court also rejected Umeti’s argument that the Government offered insufficient evidence of damage to the computer. J.A. 601. Umeti does not challenge that determination on appeal. 6 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 7 of 22 that the Government adduced insufficient evidence of (1) Umeti’s involvement in the fraud and (2) the $5,000 loss necessary for the sentencing enhancement under 18 U.S.C. § 1030(c)(4)(B)(i). The district court orally denied Umeti’s motion. On the issue of Kodish’s statements, it reasoned that because he made only “general[]” statements before jury selection and was ultimately struck for cause, he had no opportunity to provide any improper information to the jurors. S.J.A. 1055–56. The court also noted that both before and after voir dire, the prospective jurors were instructed to remain unbiased and impartial. As to the sufficiency of the Government’s evidence of Umeti’s involvement in the crimes of conviction, the court acknowledged that this case primarily involved circumstantial evidence. However, it opined that the evidence, such as “the various names that [Umeti] used, . . . social media pictures of him, [] unexplained sources of wealth, . . . [and] the interconnection of all these pieces of information[,] . . . created a very clear picture of culpability.” S.J.A. 1057–58. Finally, the district court rejected Umeti’s argument that the Government failed to establish the requisite loss for Count 11’s sentencing enhancement. In so doing, the court referenced the Government’s evidence of the fraud’s impact on victims—“invoices [] being misdirected, [and] millions of dollars of losses.” J.A. 1058. Thereafter, the district court held a sentencing hearing. Umeti was sentenced to 120 months’ imprisonment: 12 months on Count One; 12 months consecutive on Count Two; 24 months consecutive each on Counts Three, Four, and Five; and 24 months consecutive on Count 11. 7 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 8 of 22 Umeti timely appealed, and this Court has jurisdiction under 28 U.S.C. § 1291. II. This Court reviews a district court’s denial of a motion for judgment of acquittal de novo and denial of a motion for a new trial for abuse of discretion. United States v. Davis, 75 F.4th 428, 437 (4th Cir. 2023) (motion for judgment of acquittal); United States v. Bartko, 728 F.3d 327, 334 (4th Cir. 2013) (motion for a new trial). We review the district court’s decision not “to conduct a Remmer[6] hearing under a ‘somewhat narrowed modified abuse of discretion standard,’ which ‘grants us more latitude to review the trial court’s conclusion’ in the context of all the evidence presented.” United States v. Johnson, 954 F.3d 174, 179 (4th Cir. 2020) (quoting United States v. Basham, 561 F.3d 302, 319 (4th Cir. 2009)). III. Umeti first contends that Kodish’s statements during venire proceedings were prejudicial, external influences that improperly affected juror impartiality. However, Kodish’s statements were innocuous and failed to draw into question the integrity of the trial proceedings. Accordingly, we discern no abuse of discretion in the district court’s denial of Umeti’s motion for a new trial on this basis. 6 Remmer v. United States, 347 U.S. 227 (1954). 8 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 9 of 22 A. The Sixth Amendment guarantees criminal defendants the right to trial by an impartial jury. U.S. Const. amend. VI. Part and parcel of that right is the jury’s freedom from “influence outside the jury’s deliberative process, a so-called external influence, [that] affects the jury’s decision-making.” Johnson, 954 F.3d at 179 (cleaned up). To that end, in Remmer v. United States, 347 U.S. 227 (1954), the Supreme Court held that a rebuttable presumption of prejudice arises when there has been a direct or indirect “private communication, contact, or tampering . . . with a juror during a trial about the matter pending before the jury.” Id. at 229. A defendant claiming entitlement to a Remmer presumption must first “make [a] threshold showing.” Johnson, 954 F.3d at 179. He must “introduce[] competent evidence of extrajudicial juror contacts,” and if such contacts are shown, the Court “must analyze whether the contacts were more than innocuous interventions that simply could not justify a presumption of prejudicial effect.” United States v. Cheek, 94 F.3d 136, 141 (4th Cir. 1996) (cleaned up). To determine whether a contact with a juror is innocuous or instead triggers the Remmer presumption, we look to whether there was “(1) any private communication; (2) any private contact; (3) any tampering; (4) directly or indirectly with a juror during trial; (5) about the matter before the jury.” Id. Once the party attacking the verdict has cleared that initial hurdle, the burden shifts to the Government to rebut the presumption of prejudice. United States v. Elbaz, 52 F.4th 593, 607 (4th Cir. 2022). In view of these factors, Umeti cannot carry his burden of showing that Kodish’s statements were more than “innocuous interventions.” Cheek, 94 F.3d at 141 (cleaned up). 9 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 10 of 22 The district court asked the prospective jurors whether they “might know something about the case.” J.A. 55. In response, Kodish volunteered to the court: “I work in cybersecurity. I think we might have done some of the remediation regarding some of these.” J.A. 56. He continued that he had “heard of the defendants and some of their previous involvement in th[e] industry.” Id. These statements occurred in open court before the entire jury pool. Their substance—which is nothing more than Kodish stating a general awareness of Umeti through his work in cybersecurity—falls far short of tampering or attempting to influence potential jurors. Cf. United States v. Blauvelt, 638 F.3d 281, 295 (4th Cir. 2011) (declining to apply a Remmer presumption where “no one suggest[ed] there was any tampering or any attempt by [the external contact] to exert any influence”). Moreover, nothing in Kodish’s statements show any disposition toward Umeti’s guilt or innocence. Kodish disclosed his familiarity with Umeti in direct response to the district court’s probe into whether any prospective jurors “know anything about the case.” J.A. 54. That is simply not the kind of prejudicial contact the Supreme Court contemplated in creating the Remmer presumption. See Remmer, 347 U.S. at 229 (noting that “private communication, contact, or tampering directly or indirectly, with a juror during a trial about the matter pending before the jury is . . . deemed presumptively prejudicial, if not made in pursuance of known rules of the court and the instructions and directions of the court made during the trial, with full knowledge 10 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 11 of 22 of the parties” (emphasis added)). As a result, it is clear that the district court did not abuse its discretion in declining to grant a new trial on this basis. 7 For the foregoing reasons, we affirm the district court’s denial of Umeti’s Remmer- based motion for a new trial. B. Umeti next contends that the district court erred by denying his motion for judgment of acquittal based on the Government’s insufficient evidence on two points: (1) his involvement in the fraud, and (2) qualifying losses under § 1030(c)(4)(B)(i). Before addressing these arguments we first highlight the deferential standard in reviewing a sufficiency challenge. In assessing whether judgment of acquittal based on insufficient evidence is appropriate, “we ask ‘whether, after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.’” United States v. Millender, 970 F.3d 523, 528 (4th Cir. 2020) (quoting Jackson v. Virginia, 443 U.S. 307, 319 (1979)). With that in mind, we turn to Umeti’s sufficiency-of-the-evidence challenges. 7 Umeti also asks the Court to address whether statements made by a prospective juror during voir dire can ever constitute “extrajudicial contact[s]” that trigger the Remmer presumption. Cheek, 94 F.3d at 141. However, given our conclusion that Kodish’s statements were not prejudicial, we need not reach that issue. Umeti further argues that the district court improperly attributed another juror’s statements to Kodish, and thus misapprehended the Remmer issue. Having reviewed the record, we see no support for that argument. 11 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 12 of 22 i. As to Umeti’s challenge to his involvement in the fraud, the parties dispute whether he preserved this argument in his motion for a new trial. In his motion for judgment of acquittal or a new trial, Umeti expressly sought a new trial based on the Remmer issue. Under a separate subheading, he stated: “An additional ground to enter judgment of acquittal or set aside the guilty verdict against [] Umeti is that [the] [G]overnment failed to prove that he was the one who committed the alleged fraud.” J.A. 925. In Umeti’s view, his use of “set aside the guilty verdicts” implies that he also moved for a new trial on the basis of insufficient evidence. One notable distinction between a motion for a new trial and a motion for judgment of acquittal is the standard of review: we review the former for abuse of discretion and the latter de novo. Davis, 75 F.4th at 437; Bartko, 728 F.3d at 334. For purposes of this appeal, however, this is a distinction without a difference. Neither party disputes that Umeti moved for judgment of acquittal on the grounds that the Government failed to adequately connect him to the fraud. We review the district court’s denial of that motion under the less deferential de novo standard of review. As explained below, this Court concludes that, even under that less deferential standard, the Government’s evidence passes muster. So even assuming Umeti preserved the same issue in his motion for a new trial, the district court’s denial of that motion necessarily survives review for an abuse of discretion as well. Umeti’s argument that the Government failed to adduce sufficient evidence of his connection to the fraud is unpersuasive. At trial, the Government’s theory was that Umeti, along with his co-conspirators, defrauded businesses through various schemes. To tie 12 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 13 of 22 Umeti to these schemes, the Government needed to connect his personal accounts to fraud- related accounts. It did so by introducing evidence of a chain of social media accounts connecting Umeti to the fraud. As Umeti sees it, this is where the Government failed. We disagree. As outlined below, at each link in that chain, the Government adequately supported Umeti’s connection to the fraud. At the outset, Umeti does not dispute that his personal Instagram account was listed under “Raphael Raphael,” had the handle of “eternal1502,” and was registered under the “eternal1502” Gmail. He also concedes that he used a Gmail account with a handle of “ebuka1502.” The Government explained that the use of “1502” in these handles represented Umeti’s birthday: February 15. The Government argued that Umeti’s personal accounts were connected to a fraud- connected GitHub account used to further the conspiracy. In support of that contention, the Government adduced evidence that (1) Umeti’s personal accounts and the GitHub account shared a handle, “eternal1502,” and (2) the person who controlled that GitHub account went by the username “Raph,” consistent with Umeti’s middle name, “Raphael,” which he used for his personal social media accounts. Given the overlap between the handles and Umeti’s name, the Government adequately connected his personal accounts to the fraud- connected “eternal1502” GitHub account. The Government then offered evidence tying the “eternal1502” GitHub account to the broader conspiracy. It explained that the GitHub account was registered to a Yahoo email account, “jm.collins100.” Connecting Umeti to the “jm.collins100” handle was critical, as it linked him to myriad fraud-related social media and email accounts with 13 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 14 of 22 similar handles. For instance, the “jm.collins100” Yahoo account was used to register a Hack Forums account with the handle “eternal101,” which the conspirators used to locate information about malware encryptors. Relatedly, a “jm.collins002” iCloud account was linked to a Dingtone account that was used to register two fraud-related phone numbers. There was also IP address overlap between that fraud-connected Dingtone account and Umeti’s personal “ebuka1502” Gmail. Based on this overlap, FBI Special Agent Gerald Kim testified that the same person likely controlled both accounts. 8 The Government also showed that: (1) the IP address was owned by “9mobile Nigeria,” J.A. 701; (2) Umeti’s personal “eternal1502” Gmail contained a bank payment to 9mobile; and (3) the bank payment indicated that there was an Android phone associated with Umeti’s “ebuka1502” Gmail, his “eternal1502” Gmail, and 9mobile. Taken together, this evidence is sufficient to permit a rational factfinder to conclude that Umeti controlled the fraud-related Dingtone account. Further, based on Umeti’s connection to the “jm.collins” handles, the Government posited that he was connected to numerous other handles involved in the fraud. The “jm.collins002” Gmail sent an “invoice_s321” Yahoo account a “test” email, while the “jm.collins100” Gmail sent that same Yahoo account an email and attached a file that was 8 Umeti objected to Agent Kim’s testimony, arguing that it was speculative, lacked foundation, and was improper expert testimony from a lay witness. J.A. 379, 389. The district court overruled those objections. J.A. 379, 390–96. Umeti does not challenge that decision on appeal. So regardless of whether Agent Kim’s testimony was permissible, we may consider it at this juncture. See United States v. Huskey, 90 F.4th 651, 662 (4th Cir. 2024) (“[W]e consider all the evidence considered by the jury, both admissible and inadmissible[,] when assessing a sufficiency challenge.” (cleaned up)). 14 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 15 of 22 eventually sent to a victim of the Defendants’ scheme. The “invoice_s321” account was registered under a Proton Mail account, “helsinki_ar.” That account, in turn, was used to register a fraud-connected Namecheap account, “cassbanks101.” Cementing the connection between these accounts, the “jm.collins100” Gmail account sent $10 to “helsinki_ar” in connection with the Namecheap account. There is one other link in the chain: Umeti’s connections to the “jm.collins,” “eternal,” and “helsinki_ar” handles led officers to his Discord accounts, “eternal101” and “hels101.” In Discord chats, “eternal101” told other users that he used the “jm.collins002,” “jm.collins001,” and “helsinki_ar” Proton Mail accounts and the “jm.collins100” Yahoo account. J.A. 484–85. Given the connection between Umeti and “jm.collins” handles, this adequately ties Umeti to the fraud-connected Discord account. The Government’s evidence adequately supports Umeti’s convictions based on his involvement in the fraud. As to the conspiracy charges, Umeti does not dispute the existence of the conspiracy. Opening Br. 27 (noting that it was not “in dispute” “that the frauds happened and how they happened”). And “once it has been shown that a conspiracy exists, the evidence need only establish a slight connection between the defendant and the conspiracy to support conviction.” United States v. Burgos, 94 F.3d 849, 861 (4th Cir. 2019) (en banc) (cleaned up) (emphasis added); see id. at 858 (“[A] conspiracy may be proved wholly by circumstantial evidence.”). To establish that connection, Agent Kim testified that, at each link, the evidence led him to conclude that Umeti controlled the fraud- related accounts. J.A. 392–436. Viewing the facts in the light most favorable to the Government, a rational trier of fact could conclude, based on the aforementioned evidence 15 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 16 of 22 and Agent Kim’s accompanying testimony, that Umeti was directly and extensively connected to the fraud. See Millender, 970 F.3d at 528. Resisting this conclusion, Umeti argues that certain pieces of evidence relied upon by the Government, such as the overlapping IP addresses and use of Umeti’s nickname, did not establish that he was connected to the fraud. Still, the jury heard the evidence and concluded that, viewed in its entirety, it connected Umeti to the fraud. We do the same, considering the evidence “in cumulative context” rather than “in a piecemeal fashion.” Burgos, 94 F.3d at 863. As set out above, we find that a reasonable factfinder could conclude that Umeti was connected to the fraud. Accordingly, the district court did not err in denying Umeti’s motion for judgment of acquittal based on insufficient evidence connecting him to the fraud. And even assuming Umeti preserved this argument in his motion for a new trial, for the same reasons, the district court did not abuse its discretion in denying that motion. ii. Umeti next challenges the district court’s denial of his motion for judgment of acquittal based on insufficient evidence showing $5,000 in loss, as required to sustain Count 11’s sentencing enhancement under 18 U.S.C. § 1030(c)(4)(B)(i). That enhancement raised the statutory maximum from one year of imprisonment to ten years’ imprisonment. Consistent with the enhancement’s higher statutory maximum, Umeti was sentenced to 24 months’ imprisonment. Thus, as relief, Umeti seeks vacatur of his sentence as to Count 11 and remand for resentencing. 16 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 17 of 22 Under § 1030(a)(5)(A), a person may not “knowingly cause[] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally cause[] damage without authorization, to a protected computer.” For such a violation, the penalty is “not more than 1 year.” 18 U.S.C. § 1030(c)(4)(G)(i). However, an enhanced statutory penalty applies when someone causes, inter alia, “loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value.” Id. § 1030(c)(4)(A)(i)(I). Where such loss accompanies a conviction under § 1030(a)(5)(A), the maximum statutory penalty is ten years’ imprisonment. Id. § 1030(c)(4)(B)(i). For purposes of the statute, loss is defined as: (1) “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense,” and (2) “any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” Id. § 1030(e)(11); see Yoder & Frey Auctioneers, Inc. v. EquipmentFacts, LLC, 774 F.3d 1065, 1073 (6th Cir. 2014) (recognizing that § 1030(e)(11) sets out two clauses that contain discrete definitions of “loss” and that loss can be satisfied by costs under either clause “or a combination of both”). The Government maintains that Umeti caused two types of loss: (1) costs incurred to investigate the offense and remediate computers and software, and (2) funds fraudulently diverted to the Defendants by Companies H and L. At oral argument, the Government 17 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 18 of 22 conceded that it only pressed arguments below related to the first clause of the “loss” definition, i.e., “any reasonable cost to the victim,” such as “the cost of responding to an offense.” 9 Oral Argument at 19:40–19:55, United States v. Umeti, No. 24-4478 (4th Cir. Dec. 12, 2025). We are therefore tasked with determining whether the Government’s evidence of “loss” falls within the ambit of the first clause and, if so, whether it adequately proved $5,000 of such loss at trial. After a careful review of the record, we conclude that a reasonable factfinder could not conclude that the Government met its burden on this point. First, the costs incurred in response to the offense are recoverable under the statute’s plain language. See A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630, 646 (4th Cir. 2009) (noting that the “broadly worded [§ 1030(e)(11)] plainly contemplates consequential damages of the type sought by iParadigms—costs incurred as part of the response to a [] violation”). So the Government was entitled to show qualifying losses through the response costs of Companies H and L. 10 The difficulty here is that it failed to do so in a manner that permitted the jury to conclude the companies suffered at least $5,000 of such a loss. The Government elicited the following testimony from Company H’s representative as to response costs: 9 As a result of the Government’s concession, we do not address whether the evidence adduced at trial satisfies the second clause of the “loss” definition. 10 Umeti disputes which victim company’s loss is relevant to this analysis. In the indictment, the Government alleged that Umeti, through his involvement in the conspiracy, caused damage to both Company H and Company L which, in the aggregate, led to at least $5,000 in losses. J.A. 41. The Government reiterated that theory at closing argument. See J.A. 818. Thus, this Court considers evidence of loss to both companies. 18 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 19 of 22 We [] had to do a big cleanup job, new software. I had to get two new laptops. Also, we had to get an employee from the corporate office, we had to contact every single customer and find out if they had received letters from anybody posing as our company, make sure that nobody was changing their banking information. Our CFO also drafted a letter, and we had to send that to every single customer. We had to make sure that we talked to the customer. It wasn’t just an email; we had to physically talk to the customer. J.A. 286–87. The corporate representative further explained that the remediation process took “about three months.” J.A. 287. At no point, however, did the representative assign a value to these costs. With respect to Company L, the record is similarly lacking—the parties did not cite, and we could not find, evidence regarding the amount of any loss. On this record, there is insufficient evidence to permit “any rational trier of fact” to conclude that the Government showed $5,000 in response cost loss “beyond a reasonable doubt.” Millender, 970 F.3d at 528 (cleaned up). Any conclusion as to a dollar amount for the response cost would be pure guesswork. In upholding similar convictions, our sister circuits have relied on evidence of the actual dollar amount associated with response costs. See, e.g., United States v. Batti, 631 F.3d 371, 374–78 (6th Cir. 2011) (affirming a conviction under § 1030(a)(2)(C), (c)(2)(B)(iii) where the Government elicited testimony that a victim “paid about $305,000 for the [] footage that Batti accessed” and that payment “best represented the value of the information Batti had obtained in his intrusions”); United States v. King, 861 F. App’x 490, 495–96 (2d Cir. 2021) (finding sufficient evidence to sustain King’s statutory penalty enhancement where the “jury heard evidence of (1) the types of expenses incurred . . . and (2) an estimate of the extent of those expenses, which was more than four times the $5,000 loss threshold”). 19 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 20 of 22 In short, to support a conclusion that Umeti’s fraud caused $5,000 in response costs, the Government needed to adduce evidence that Companies H and L actually spent $5,000 in response to the fraud. But nothing in the record directly shows—or even permits an inference—that Companies H and L incurred a determinable amount of costs. Because the record is devoid of the necessary evidence of those companies’ response costs, a reasonable factfinder could not conclude that the Government proved Umeti caused at least $5,000 in such loss to Companies H and L. That leaves the Government’s argument that the costs fraudulently diverted to the Defendants by Companies H and L are “losses” under the first clause of the statute. See 18 U.S.C. § 1030(e)(11) (permitting recovery under the first clause of “any reasonable cost to any victim”). The difficulty for the Government is that, in so arguing, it asks the Court to rewrite the statutory language. The statute’s second clause expressly permits recovery for “any revenue lost, cost incurred, or other consequential damages incurred” due to “interruption of service.” Id. But the Government concedes it made no argument as to this part of the statute. Instead, the Government attempts to shoehorn “diverted funds”—or, in other words, “revenue lost”—into the first clause, arguing that it also constitutes “any reasonable cost to any victim.” Id. The Government’s attempt falls flat. It is axiomatic that, “[i]n interpreting a statute, we should strive to give effect to every word that Congress has used to avoid surplusage.” Healthkeepers, Inc. v. Richmond Ambulance Auth., 642 F.3d 466, 472 (4th Cir. 2011) (cleaned up). This canon of statutory interpretation reflects courts’ “deep reluctance to 20 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 21 of 22 interpret a statutory provision so as to render superfluous other provisions in the same enactment.” Id. (cleaned up). In the second clause of § 1030(e)(11), Congress plainly stated its intent to restrict recovery of lost revenue or other consequential damages to situations where the loss is caused by an interruption of service. If this Court endorsed the Government’s view and also recognized “diverted funds” as a loss within the meaning of the first clause, we would read the second clause’s “interruption of service” restriction on analogous losses out of the statute entirely. Put another way, the Government’s stance would render the “because of interruption of service” language in § 1030(e)(11) superfluous. The Government therefore cannot rely on the diverted funds to satisfy the first clause of § 1030(e)(11), and it concedes it made no claim under the second clause of the statute. In sum, the Government failed to adduce evidence that Companies H and L suffered response costs that totaled at least $5,000. And as just explained, the Government cannot rely on diverted funds to satisfy the first clause of § 1030(e)(11). Thus, the district court erred in denying Umeti’s motion on this point. Accordingly, we reverse Umeti’s sentencing enhancement under § 1030(c)(4)(B)(i) as to Count 11. Based on that reversal, Umeti is no longer subject to that enhancement’s statutory maximum of ten years’ imprisonment for his conviction under § 1030(a)(5)(A). However, Umeti does not challenge his conviction under § 1030(a)(5)(A), which imposes a one-year statutory maximum. 18 U.S.C. § 1030(c)(4)(G)(i). We therefore remand for resentencing. 21 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 22 of 22 IV. In conclusion, the Court affirms the district court’s denial of Umeti’s motion for a new trial based on the district court’s failure to apply the Remmer presumption following Kodish’s statements. We further affirm the district court’s denial of Umeti’s motion for a judgment of acquittal based on the sufficiency of the Government’s evidence as to his involvement in the fraud and, assuming he preserved that argument in his motion for a new trial, we discern no abuse of discretion in that denial. However, we reverse Umeti’s conviction under 18 U.S.C. § 1030(c)(4)(B), as the Government failed to adduce sufficient evidence that Companies H and L suffered at least $5,000 in qualifying response losses. We therefore remand the case for resentencing consistent with this opinion. AFFIRMED IN PART, REVERSED IN PART, AND REMANDED FOR FURTHER PROCEEDINGS CONSISTENT WITH THIS OPINION. 22