United States v. Oriyomi Aloba

UNITED STATES COURT OF APPEALS FILED FOR THE NINTH CIRCUIT APR 30 2025 MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS UNITED STATES OF AMERICA, No. 22-50291 Plaintiff-Appellee, D.C. No. 2:18-cr-00083-RGK-1 v. ORIYOMI SADDIQ ALOBA, ORDER Defendant-Appellant. Before: R. NELSON, MILLER, and DESAI, Circuit Judges. The memorandum disposition filed on March 26, 2025, is hereby amended. The amended memorandum disposition will be filed concurrently with this order. Appellee’s petition for panel rehearing is DENIED. Judge R. Nelson would grant the petition. Appellant’s unopposed motion to expedite the panel rehearing decision is GRANTED. The mandate shall issue forthwith.  NOT FOR PUBLICATION FILED UNITED STATES COURT OF APPEALS APR 30 2025 MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS FOR THE NINTH CIRCUIT UNITED STATES OF AMERICA, No. 22-50291 Plaintiff-Appellee, D.C. No. 2:18-cr-00083-RGK-1 v. ORIYOMI SADDIQ ALOBA, AMENDED MEMORANDUM* Defendant-Appellant. Appeal from the United States District Court for the Central District of California R. Gary Klausner, District Judge, Presiding Argued and Submitted September 10, 2024 Pasadena, California Before: R. NELSON, MILLER, and DESAI, Circuit Judges. Partial Dissent by Judge R. NELSON. Partial Dissent by Judge DESAI. Following a jury trial, Oriyomi Saddiq Aloba was convicted on 27 counts related to an email “phishing” attack on the Los Angeles Superior Court (LASC), including conspiracy to commit wire fraud and attempted wire fraud, in violation of 18 U.S.C. § 1349; wire fraud, in violation of 18 U.S.C. § 1343; unauthorized * This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. impairment of a protected computer, in violation of 18 U.S.C. § 1030(a)(5)(A), (c)(4)(B)(i), (c)(4)(A)(i)(I); unauthorized access to a protected computer to obtain information, in violation of 18 U.S.C. § 1030(a)(2)(C), (c)(2)(B)(i), (ii); aggravated identity theft, in violation of 18 U.S.C. § 1028A; and aiding and abetting, in violation of 18 U.S.C. § 2(a). He was sentenced to 145 months of imprisonment and three years of supervised release and ordered to pay restitution in the amount of $47,479.26. We affirmed Aloba’s conviction but remanded for resentencing so that the district court could address his objections to the calculation of the advisory Sentencing Guidelines range and consider the 18 U.S.C. § 3553(a) factors. United States v. Aloba, No. 19-50343, 2022 WL 808208, at *1 (9th Cir. Mar. 16, 2022). On remand, Aloba was resentenced to 87 months of imprisonment and three years of supervised release and ordered to pay the same restitution amount of $47,479.26—including $45,484.31 to the LASC. He appeals again. We have jurisdiction under 28 U.S.C. § 1291 and 18 U.S.C. § 3742(a). We vacate Aloba’s sentence and remand for resentencing. Because Aloba did not object at resentencing, we review the district court’s alleged failure to adequately explain his sentence for plain error. See United States v. Sandoval-Orellana, 714 F.3d 1174, 1180 (9th Cir. 2013). We review the district court’s interpretation of the Sentencing Guidelines de novo, its factual findings for 2 clear error, and its application of the Sentencing Guidelines to the facts of the case for abuse of discretion. United States v. Pham, 545 F.3d 712, 716 (9th Cir. 2008). 1. The district court did not commit plain error in its explanation of Aloba’s sentence. In general, a district court should consider the section 3553(a) factors and provide an adequate explanation for the chosen sentence to allow for “meaningful appellate review.” United States v. Carty, 520 F.3d 984, 992 (9th Cir. 2008) (en banc). Aloba argues that the district court did not consider eight arguments that he made for a lower sentence. But the court made findings that addressed at least some of those arguments. As for the rest, adequate explanation can be inferred from the record, and the court “need not tick off each of the § 3553(a) factors to show that it has considered them.” Id.; see also Rita v. United States, 551 U.S. 338, 356 (2007) (“[W]hen a judge decides simply to apply the Guidelines to a particular case, doing so will not necessarily require lengthy explanation.”). We therefore conclude that the district court’s explanation of Aloba’s sentence was sufficient and not plain error. 2. The district court abused its discretion by applying a two-level enhancement for 10 or more victims under U.S.S.G. § 2B1.1(b)(2)(A)(i). The parties debate the meaning of “victim”—a word that is not defined in the Guidelines—as well as the relevance of the Guidelines commentary in interpreting the word. But even the government concedes that “[t]he term ‘victims’ 3 is most naturally read to include anyone who is harmed by a defendant’s crimes,” a reading with which we agree. See Victim, Black’s Law Dictionary (12th ed. 2024) (defining “victim” as “[a] person harmed by a crime, tort, or other wrong”); Victim, Oxford English Dictionary (Rev. 2024) (defining “victim” as “[a] person who has been intentionally harmed, injured, or killed as the result of . . . [a] crime”); see also 18 U.S.C. § 3771(e)(2)(A) (cited by the government for its definition of “crime victim” as “a person directly and proximately harmed as a result of the commission of a Federal offense”). The government suggests that all of “those who had their identities misappropriated” are victims, but that proposition is difficult to square with the government’s own position that a victim must be one who has suffered harm. (Does the mere possession of login credentials cause harm? Maybe, but the conclusion is not obvious.) Even if we thought the word “victim” could be read that broadly, it is at least ambiguous, and nothing in the structure or history of the Guidelines resolves that ambiguity in favor of the government. Rather than construct our own definition—one not advanced by either party—we follow the government’s suggestion and turn to the Guidelines commentary. See United States v. Trumbull, 114 F.4th 1114, 1117–18 (9th Cir. 2024) (deferring to the commentary’s reasonable interpretation when there is genuine ambiguity). Application Notes 1 and 4(E) in the commentary specify that a “victim” who 4 suffered harm in a case involving means of identification includes “any person who sustained any part of the actual loss determined” as well as “any individual whose means of identification was used unlawfully or without authority.” U.S.S.G. § 2B1.1 cmt. n.1 & n.4(E); see United States v. Gonzalez Becerra, 784 F.3d 514, 518–20 (determining that the commentary’s articulation of “a rule applicable to a certain subset of [section 2B1.1] crimes . . . and an additional type of victim” was consistent with the use of “victim” in the Guidelines). Applying that understanding of “victim,” we are unable to confirm the district court’s assertion that “there [we]re many, many more than ten victims, maybe 500 Los Angeles Superior Court employees.” The court did not explain how it arrived at that figure. In particular, it did not explain how any of those employees suffered any harm (even harm to their privacy or reputation), sustained any actual loss, or had their means of identification used unlawfully. Perhaps the district court could have made such findings, but it did not do so, and it is not clear to us whether the record would support them. The district court therefore abused its discretion by applying the victims enhancement. 3. The district court did not abuse its discretion in determining the loss and restitution amount. The Guidelines provide for sentencing enhancements if the “loss” caused by the defendant exceeds certain thresholds, U.S.S.G. § 2B1.1(b)(1), and the Mandatory Victims Restitution Act requires that the defendant pay 5 restitution to the victim of the offense if the victim suffered a “pecuniary loss,” 18 U.S.C. § 3663A. In applying the Guidelines and calculating restitution, the district court included $45,484.31 in wages paid by the LASC to its employees during the estimated time they responded to Aloba’s attack. That amount, together with a credit-card transaction that Aloba does not contest, corresponds to a six-level sentencing enhancement under section 2B1.1(b)(1)(D). The district court reasonably determined that the LASC suffered a pecuniary loss because it was deprived of valuable employee time that would have been spent on other projects in exchange for the salaries that the employees were paid. After Aloba’s attack, six senior IT employees and 40 desktop support staff spent approximately four weeks investigating the attack and resetting the compromised accounts, thus impeding what one witness confirmed as “their ability to do the work that they were supposed to be doing.” Aloba’s attack directly and proximately caused that productivity loss. See United States v. Peterson, 538 F.3d 1064, 1077–78 (9th Cir. 2008). Indeed, Aloba himself acknowledges that the attack may have “lowered productivity at the court’s IT department.” Had the LASC hired an outside contractor to respond to Aloba’s offense, there would be no doubt that its payments to the contractor would constitute pecuniary harm. The LASC’s choice to use its own employees does not change the analysis because those employees sacrificed productive work time that would have been spent on 6 completing other projects for which they were hired and paid. The LASC need not have spent or lost money directly so long as its productivity loss can be measured in monetary terms. In United States v. Sablan, we allowed the standard hourly rate charged to paying customers for employee time spent repairing damaged computers and restoring compromised computer files to be used as a reasonable estimate of loss under the Guidelines. 92 F.3d 865, 869–70 (9th Cir. 1996). Sablan’s reasoning applies equally here. Aloba observes that Sablan involved a for-profit business rather than a government entity, but we have never treated businesses and government entities differently under the Guidelines simply because the latter do not generate profits from charging customers. Rather, we have said that “[i]t cannot be disputed that government entities sometimes suffer losses from the types of fraudulent conduct that § 2B1.1 addresses.” Herrera, 974 F.3d at 1047. Here, the record shows that the LASC suffered a productivity loss measurable in employee compensation—including overtime compensation to at least one senior IT employee. To the extent that Aloba argues that employee time spent assisting law enforcement should not be included in the loss and restitution amount, that argument fails because the record suggests that any such time was de minimis. 4. On remand, the district court should determine whether to apply 7 Amendment 821 to the Sentencing Guidelines, which became effective after Aloba’s resentencing and which provides a two-level reduction for certain defendants, like Aloba, with no criminal history points. See United States v. Wales, 977 F.2d 1323, 1327–28 (9th Cir. 1992). VACATED and REMANDED. 8  FILED United States v. Aloba, No. 22-50291 APR 30 2025 R. Nelson, J., dissenting in part: MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS Oriyomi Aloba stole email login credentials from 127 employees. Those employees are “victims” of identify theft. Because the majority concludes otherwise, I dissent in part.1 The Sentencing Guidelines enhance a defendant’s recommended sentencing range if his crime “involved 10 or more victims.” U.S.S.G. § 2B1.1(b)(2)(A)(i). Because the Guidelines do not define “victim,” we apply the “ordinary tools of statutory interpretation” and enforce the term’s ordinary meaning. United States v. Kirilyuk, 29 F.4th 1128, 1137 (9th Cir. 2022). That’s true even though the Sentencing Commission has defined “victim” in its interpretive commentary. Kisor v. Wilkie, 588 U.S. 558, 573 (2019); United States v. Trumbull, 114 F.4th 1114, 1117–18 (9th Cir. 2024). “Before even considering” the commentary, we exhaust our traditional interpretive tools. Kisor, 588 U.S. at 590. And we look to the commentary only if the Guidelines are “genuinely ambiguous” and the Commission’s interpretation is “reasonable.”2 Id. at 573, 575–76. 1 I agree that the district court did not plainly err in explaining Aloba’s sentence or abuse its discretion in determining the loss and restitution amounts. 2 Some of our cases have applied the commentary’s definition of “victim.” E.g., United States v. Pham, 545 F.3d 712, 716–17, 722 (9th Cir. 2015); United States v. Armstead, 552 F.3d 769, 781 (9th Cir. 2008). Because none analyzed the 1  Dictionaries define “victim” as the “target” of a crime and any person “harmed” by it. Victim, Oxford English Dictionary (Rev. 2024); Victim, New Oxford American Dictionary (3d ed. 2010) (“a person harmed, injured, or killed as a result of a crime”); Victim, Webster’s Third New International Dictionary (1961) (“a person subjected to oppression, deprivation, or suffering”). In the context of fraud, that includes anyone “deceived, fooled, or taken advantage of.” Victim, Oxford English Dictionary (Rev. 2024); Victim, Webster’s Third New International Dictionary (1961) (“someone tricked, duped, or subjected to hardship”). These definitions reflect ordinary usage. When a hacker steals someone’s social security number or login credentials, ordinary English speakers call that person a “victim” of identity theft. See, e.g., United States v. Doe, 842 F.3d 1117, 1118 (9th Cir. 2016) (using “victim” this way); see also 18 U.S.C. § 1028A(a)(1) (defining identity theft as unauthorized possession of identifiers). These definitions also comport with other provisions of the criminal code. The Mandatory Victim Restitution Act, for example, defines “victim” as someone “directly and proximately harmed” by a crime. See 18 U.S.C. § 3663A(a)(2); see also id. § 3771(e)(2)(A) (same); Victim, Black’s Law Dictionary (12 ed. 2024) (similar). commentary’s validity under Kisor, they are not binding on that question. Kirilyuk, 29 F.4th at 1134–35. 2  Based on this evidence of ordinary meaning, the 127 employees whose email credentials were stolen are “victims.” They were “target[s]” of Aloba’s phishing scam. See Victim, Oxford English Dictionary (Rev. 2024). They were “deceived, fooled, [and] taken advantage of” when Aloba sent them deceptive emails and requested their login credentials. See id. And they were harmed when Aloba retained their credentials. “It should be obvious to any thoughtful observer of modern economic life” that identity theft harms those whose identities are stolen. United States v. Pham, 545 F.3d 712, 722 (9th Cir. 2015). Besides spending time and energy recovering their identities, such individuals suffer “the gravest of concerns” about their privacy, finances, and reputation. Id. Aloba does not grapple with any of this. He asserts that, in the context of fraud, “victim” refers only to those who suffer financial loss. We have already rejected this argument, holding that “victim” is not limited to those who suffer monetary harm. United States v. Gonzalez-Becerra, 784 F.3d 514, 518–19 (9th Cir. 2015); see also United States v. Thomsen, 830 F.3d 1049, 1074 (9th Cir. 2016). That follows from the plain-meaning evidence discussed above. When dictionaries give a fraud-specific definition of “victim,” they include anyone “tricked” or “duped” by the fraud. Victim, Webster’s Third New International Dictionary (1961); Victim, Oxford English Dictionary (Rev. 2024). 3  The majority gets closer to the correct definition. The majority recognizes that individuals may qualify as victims without suffering pecuniary harm. But the majority interprets “victim” to require some form of harm—whether pecuniary, physical, dignitary, or to privacy. Certainly, those harmed by crime are victims. But dictionaries, intuition, and ordinary usage show that those targeted or tricked through fraud are also “victims,” even if they do not suffer separate harm. The majority gives no good reason for narrowing the definition of “victim.” It retreats to the Guidelines commentary, which defines “victims” as those who suffer physical or pecuniary harm or whose means of identification are “used.” U.S.S.G. § 2B1.1 cmt. n. 1, n. 4(E). Based on that definition, the majority suggests that the employees are victims only if they suffered demonstrable harm. This approach is problematic. First, it’s inconsistent with our caselaw. We have recognized that, “[as] commonly understood . . ., the term ‘victim’ includes significantly more individuals than recognized in the [commentary].” Gonzalez- Becerra, 784 F.3d at 519 n.5. We should enforce the Guidelines’ ordinary meaning, not the Commission’s interpretive gloss on them. Second, the majority gets the analysis backwards. “Before even considering” the commentary, we are to exhaust “all” traditional interpretive tools. Kisor, 588 U.S. at 590. Dictionaries, intuition, and ordinary usage confirm that employees 4 whose email credentials are stolen are “victims.” The majority errs by “wav[ing] the ambiguity flag” before meaningfully engaging with these interpretive tools. See id. at 575. To be sure, the majority cites two dictionary definitions that emphasize “harm.” See Victim, Black’s Law Dictionary (12 ed. 2024). But other definitions treat those targeted by crime or tricked by fraud as “victims.” To fulfill its duty to find the “single, best meaning” of the Guidelines, Loper Bright Enters. v. Raimondo, 603 U.S. 369, 400 (2024), the majority must do more than cherry-pick a few favorable definitions and ignore competing evidence, Kisor, 588 U.S. at 573–75. Finally, the commentary doesn’t support the majority. The majority defines “victims” as those harmed by crime, whether physically or psychologically. Yet, under the commentary, victims include those who suffer physical and pecuniary harm and those whose means of identification are used. U.S.S.G. § 2B1.1 cmt. n. 1, n. 4(E). Not even the commentary is limited to those who suffer demonstrable harm. So even if we could look to the commentary, it wouldn’t support the majority’s narrow definition of “victim.” Elevating the commentary over the plain meaning matters. Jettisoning the plain meaning decreases Aloba’s recommended sentencing range by 12–16 months. We should have enforced the plain meaning. On this issue, I respectfully dissent. 5  FILED USA v. Aloba, No. 22-50291 APR 30 2025 DESAI, Circuit Judge, dissenting in part: MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS I respectfully dissent from Section 3 of the memorandum disposition. LASC failed to identify pecuniary harm from Aloba’s conduct justifying loss and restitution in the amount of $45,484.31. Thus, I would hold that the district court abused its discretion and would instruct the district court to recalculate the loss and restitution amount on remand. Courts must order restitution to victims for pecuniary loss, see 18 U.S.C. § 3663A, and the Guidelines include sentencing enhancements for “loss” the defendant causes. U.S.S.G. § 2B1.1(b)(1). Loss is defined as “pecuniary harm,” which “is harm that is monetary or that otherwise is readily measurable in money but does not include emotional distress, harm to reputation, or other non-economic harm.” United States v. May, 706 F.3d 1209, 1212 (9th Cir. 2013) (cleaned up); U.S.S.G. § 2B1.1(b)(1)(C)(iii). An entity could show pecuniary harm if it spent money to address the defendant’s conduct. See, e.g., United States v. Brock-Davis, 504 F.3d 991, 1000–01 (9th Cir. 2007) (affirming restitution for cleanup and remediation costs caused by the defendant). An entity could also show pecuniary harm if it lost money because of the defendant’s conduct. See, e.g., United States v. Peterson, 538 F.3d 1064, 1077– 78 (9th Cir. 2008) (affirming restitution for the Department of Housing and Urban 1 Development’s losses on loans it insured due to the defendants’ false mortgage letters); United States v. Sablan, 92 F.3d 865, 870 (9th Cir. 1996) (affirming restitution for a bank’s monetary losses on “administrative overhead and profit [that] would have been paid to the bank by its normal customers” had the bank employees not been repairing files damaged by the defendant). Here, LASC does not show that it suffered pecuniary harm in the amount of the loss calculation by spending or losing money because of defendant’s conduct. Yet the district court calculated a loss and restitution amount of $45,484.31 for the estimated time LASC IT employees and desktop support staff spent responding to Aloba’s attack. But LASC was already paying its employees’ wages for this work. The majority’s holding that it was nevertheless reasonable for the district court to calculate pecuniary harm because LASC “was deprived of valuable employee time that would have been spent on other projects,” Maj. at 6, is unsupported by the law and the record. The majority relies on Sablan to support its holding but overlooks a key distinction that unravels its reasoning. Maj. at 7. In Sablan, this court held it was reasonable to calculate pecuniary harm based on a “bank’s standard hourly rate for its employees’ time, computer time, and administrative overhead—the same rate that the bank uses in charging paying customers.” 92 F.3d at 869–70. But the bank in Sablan demonstrated that it suffered actual monetary loss because its employees had 2 to repair computer files instead of serving paying customers. See id. at 870 (“[H]ad it not been necessary for the bank to devote its employees’ time and computer time to making these repairs, the administrative overhead and profit would have been paid to the bank by its normal customers.” (emphasis added)). The majority insists that Sablan’s holding should extend here because this court has “never treated businesses and government entities differently under the Guidelines simply because the latter do not generate profits from charging customers.” Maj. at 7. But the majority misses the mark. The key distinction is not whether the entity is the government or a private business, or whether the entity generates profits, but whether the entity has suffered pecuniary harm from the defendant’s conduct.1 See 18 U.S.C. § 3663A; U.S.S.G. § 2B1.1(b)(1)(C)(iii). Here, LASC did not spend money in the amount of $45,484.31 to address the cybersecurity breach.2 And it also did not lose any money, like in Sablan. LASC points only to evidence that IT employees performed their ordinary duties that they were already paid to do: address cybersecurity issues and phishing attacks. Even the 1 Indeed, the majority’s public-private rationale is undermined by our precedent finding pecuniary harm when a government entity shows actual monetary loss. See Peterson, 538 F.3d at 1077–78. 2 The majority attempts to justify the district court’s loss and restitution calculation based on LASC’s payment of overtime to one IT employee. Maj. at 8. But the majority fails to explain how this could reasonably result in a loss and restitution amount of $45,484.31. Indeed, there is no evidence in the record that LASC suffered pecuniary harm amounting to $45,484.31 based on the payment of overtime to a single IT employee. 3 government concedes that “the LASC employees for whom restitution is sought were personnel whose job functions entail LASC network security.” The majority does not specify what “other projects” the LASC employees would have completed but for the attack. Nor does the majority explain how the diversion of employee time from these alleged hypothetical projects caused actual monetary loss or loss that is readily measured in money. See U.S.S.G. § 2B1.1(b)(1)(C)(iii). The majority relies on a vague quote from a witness that the attack impeded “their ability to do the work that they were supposed to be doing.” Maj. at 6. This stray comment contradicts LASC’s concession that its employees’ regular duties included addressing cybersecurity issues; and, in any event, this lone statement is insufficient to establish that LASC spent or lost $45,484.31. In short, LASC points to no evidence that its employees’ time spent responding to the “phishing” attack caused it to suffer pecuniary harm in the amount calculated by the district court. The district court’s inclusion of $45,484.31 in employees’ wages was an abuse of discretion—one that added a six-level sentencing enhancement to Aloba’s offense level. See U.S.S.G. § 2B1.1(b)(1). Finally, by allowing restitution and a sentencing enhancement even when the victim did not identify specific monetary loss from the defendant’s conduct, the majority’s approach risks unintended consequences. Namely, the majority opens the door for private and public entities alike to overstate and inflate requested restitution 4 without proving pecuniary harm. Entities may now seek restitution for wages and employee salaries even if the employees continued performing their day-to-day tasks and did not divert their attention from revenue-generating work or otherwise cause their employer monetary loss. Section 3663A and the Guidelines do not justify restitution and sentence enhancements for such speculative loss. I would hold that the district court abused its discretion by including LASC employees’ wages in the loss and restitution amount without any showing that LASC suffered pecuniary harm totaling $45,484.31. I respectfully dissent in part. 5