El Omari v. Dechert LLP

• Court: Court of Appeals for the Second Circuit
• Decided: June 9, 2025
• Docket: 24-1970
• Status: Unpublished

Opinion

24-1970-cv El Omari v. Dechert LLP, et al.

UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT

SUMMARY ORDER

RULINGS BY SUMMARY ORDER DO NOT HAVE PRECEDENTIAL EFFECT. CITATION TO A SUMMARY ORDER FILED ON OR AFTER JANUARY 1, 2007, IS PERMITTED AND IS GOVERNED BY FEDERAL RULE OF APPELLATE PROCEDURE 32.1 AND THIS COURT’S LOCAL RULE 32.1.1. WHEN CITING A SUMMARY ORDER IN A DOCUMENT FILED WITH THIS COURT, A PARTY MUST CITE EITHER THE FEDERAL APPENDIX OR AN ELECTRONIC DATABASE (WITH THE NOTATION “SUMMARY ORDER”). A PARTY CITING TO A SUMMARY ORDER MUST SERVE A COPY OF IT ON ANY PARTY NOT REPRESENTED BY COUNSEL.

At a stated term of the United States Court of Appeals for the Second Circuit, held at the Thurgood Marshall United States Courthouse, 40 Foley Square, in the City of New York, on the 9th day of June, two thousand twenty-five.

PRESENT: SARAH A. L. MERRIAM, MARIA ARAÚJO KAHN, Circuit Judges, RACHEL P. KOVNER, District Judge. *

__________________________________________

OUSSAMA EL OMARI,

Plaintiff-Appellant,

v. 24-1970-cv

DECHERT LLP; NICHOLAS PAUL DEL ROSSO; VITAL MANAGEMENT SERVICES, INC.,

Defendants-Appellees. __________________________________________

* Judge Rachel P. Kovner of the United States District Court for the Eastern District of New York, sitting by designation. FOR PLAINTIFF-APPELLANT: SCOTT M. MOORE, Moore International Law PLLC, New York, NY.

FOR DEFENDANT-APPELLEE JOHN C. QUINN, Hecker Fink LLP, New York, DECHERT LLP: NY (Sean Hecker, Hecker Fink LLP, New York, NY; Carmen Iguina González, Katherine Epstein, James Piltch, Hecker Fink LLP, Washington, D.C., on the brief)

FOR DEFENDANTS-APPELLEES SAMUEL ROSENTHAL, Nelson Mullins Riley & NICHOLAS PAUL DEL ROSSO; Scarborough LLP, Washington, D.C. VITAL MANAGEMENT SERVICES, INC.:

Appeal from a judgment of the United States District Court for the Southern District

of New York (Kaplan, J.).

UPON DUE CONSIDERATION, the judgment of the District Court entered on

June 25, 2024, is AFFIRMED.

Plaintiff-appellant Oussama El Omari (“El Omari”) appeals from the District

Court’s dismissal of his complaint. El Omari brought this action against Dechert LLP

(“Dechert”) and two of its contractors, Nicholas Paul Del Rosso and Vital Management

Services (the “VMS Defendants”), claiming that they directed a non-party to illegally

access and copy his email accounts. He brought the following claims: (1) accessing a

protected computer in violation of the Computer Fraud and Abuse Act (“CFAA”), 18

U.S.C. § 1030(a)(2)(C); (2) conspiracy to commit the same; and (3) common law

conversion under North Carolina state law.

Dechert and the VMS Defendants filed motions to dismiss the complaint as time-

barred and for failure to state a claim; the VMS Defendants also argued that the claims

2 against them should be dismissed for lack of personal jurisdiction. The Magistrate Judge

issued a Report and Recommendation (“R&R”) recommending that the District Court grant

both motions to dismiss. El Omari timely objected to the R&R. The District Judge, in a

one-page order, granted the motions to dismiss, stating that it had “reviewed the R&R” and

El Omari’s objections, and that it “perceive[d] nothing contrary to law nor any clear error.”

App’x at 86.

On appeal, El Omari argues that the District Judge erred (1) procedurally, by failing

to review de novo the portions of the R&R to which he objected and (2) substantively, by

granting the motions to dismiss and failing to grant leave to amend his complaint. We

assume the parties’ familiarity with the underlying facts, procedural history, and arguments

on appeal, to which we refer only as necessary to explain our decision to affirm.

STANDARD OF REVIEW

“We review de novo a district court’s decision to grant motions under Rule 12(b)(2)

and 12(b)(6).” Charles Schwab Corp. v. Bank of Am. Corp., 883 F.3d 68, 81 (2d Cir. 2018).

“Although the statute of limitations is ordinarily an affirmative defense that must be raised

in the answer, a statute of limitations defense may be decided on a Rule 12(b)(6) motion if

the defense appears on the face of the complaint.” Ellul v. Congregation of Christian Bros.,

774 F.3d 791, 798 n.12 (2d Cir. 2014).

DISCUSSION

We agree with El Omari that the District Judge should have reviewed de novo the

portions of the R&R to which El Omari properly objected. See 28 U.S.C. § 636(b)(1); Fed.

R. Civ. P. 72(b)(3) (requiring de novo review of “any part of the magistrate judge’s

3 disposition that has been properly objected to”). The District Judge erroneously applied

clear error review and failed to address El Omari’s objections. See App’x at 86 (“[T]he

Court perceives nothing contrary to law nor any clear error.”). El Omari lodged proper

objections to at least some of the conclusions in the R&R—including on the issues of

personal jurisdiction and the statute of limitations. See App’x at 69–74. Those objections,

at least, were sufficient to trigger de novo review. Nevertheless, we conclude that the

District Judge’s error was harmless in this case because, on de novo review, we affirm the

District Court’s dismissal of El Omari’s claims.

I. Personal Jurisdiction Over Del Rosso and Vital Management Services

El Omari’s claims against Del Rosso and Vital Management Services were properly

dismissed for lack of personal jurisdiction. “To defeat a motion to dismiss for lack of

personal jurisdiction, a plaintiff must make a prima facie showing that jurisdiction exists.

Such a showing entails making legally sufficient allegations of jurisdiction, including an

averment of facts that, if credited, would suffice to establish jurisdiction over the

defendant.” Charles Schwab Corp., 883 F.3d at 81 (internal quotation marks omitted)

(alteration adopted). A plaintiff must demonstrate both that personal jurisdiction complies

with the forum state’s long-arm statute as well as that the exercise of jurisdiction comports

with constitutional due process. See id. at 82.

The provision of New York’s long-arm statute invoked by El Omari, N.Y. C.P.L.R.

§ 302(a)(1), provides that a court may exercise jurisdiction over a non-domiciliary “who

in person or through an agent . . . transacts any business within the state or contracts

anywhere to supply goods or services in the state” “[a]s to a cause of action arising from”

4 that transaction. In his complaint, El Omari asserts that jurisdiction exists because Del

Rosso directed the hack of El Omari’s email account; because Del Rosso did so at the

behest of an attorney at Dechert LLP located in London for eventual use in litigation against

El Omari in New York; and because, “[u]pon information and belief, Del Rosso made

numerous trips to New York for personal meetings as part of his wrongful activities.”

App’x at 15.

These allegations are inadequate. First, the asserted agency relationship is

insufficient. Section 302(a)(1) requires that a defendant himself have transacted business

or contracted to supply goods or services in New York and that the claim arise out of that

transaction. Though jurisdiction may lie when the defendant projects itself into New York

through an agent, El Omari cites no authority at all suggesting the reverse—that a

defendant’s putative status as an agent of a (London-based) entity with ties to New York

permits a court to exercise jurisdiction over the defendant under Section 302(a)(1). The

allegation that Del Rosso “reported” certain information to his London principal for the

purpose of its being used in New York is also too insubstantial and attenuated an allegation

to establish that Del Rosso “purposefully availed [himself] of the privileges and benefits

of performing any services in” New York. Bank Brussels Lambert v. Fiddler Gonzalez &

Rodriguez, 171 F.3d 779, 789 (2d Cir. 1999).

That leaves the allegation that “[u]pon information and belief, Del Rosso made

numerous trips to New York for personal meetings as part of his wrongful activities.”

App’x at 15. This statement is doubly deficient. First, El Omari alleges no facts that would

enable the Court to determine that his claims in this lawsuit “aris[e] from” any asserted

5 meetings in New York. See Best Van Lines, Inc. v. Walker, 490 F.3d 239, 249 (2d Cir.

2007) (“[A] claim arises from a particular transaction when there is some articulable nexus

between the business transacted and the cause of action sued upon, or when there is a

substantial relationship between the transaction and the claim asserted.” (quotation marks

and citation omitted) (alterations adopted)). El Omari does not allege what the meetings

were for, who they were with, or what occurred in the meetings. Instead, El Omari pleads

a legal conclusion—certain meetings in New York were connected to the scheme in the

manner relevant for personal jurisdiction—without the facts needed to support it. See

Jazini v. Nissan Motor Co., Ltd., 148 F.3d 181, 185 (2d Cir. 1998) (“[W]e are not bound

to accept as true a legal conclusion couched as a factual allegation.” (quotation marks and

citation omitted)).

Beyond this, El Omari’s allegation about relevant meetings is merely stated “upon

information and belief.” This Court has rejected as speculative jurisdictional allegations

predicated merely on the proponent’s belief. See Moussaoui v. Bank of Beirut & the Arab

Countries, No. 23-7332, 2024 WL 4615732, at *2 (2d Cir. Oct. 30, 2024) (summary order)

(citing Jazini, 148 F.3d at 185). Consistent with that principle, district courts in this Circuit

routinely decline to find personal jurisdiction based on allegations made only “on

information and belief.” See, e.g., Guo Jin v. EBI, Inc., No. 05-CV-04201 (NGG) (SMG),

2008 WL 896192 (E.D.N.Y. Mar. 31, 2008) (declining to credit allegation on “information

and belief that Defendants have maintained an office, a bank account, property and/or

agents in New York” (quotation marks omitted)); Fabius v. Gardère, No. 18-CV-06358

(WLK) (LB), 2021 WL 6797293, at *2 (E.D.N.Y. Sept. 22, 2021) (declining to credit

6 allegations on information and belief that the defendant communicated with the plaintiff

via telephone while the plaintiff was in New York, or that the defendant deposited money

into the plaintiff’s New York-based bank account).

On appeal, El Omari makes a new allegation not contained in his complaint, but it

does not change the analysis. He identifies testimony Del Rosso gave in a different

litigation occurring in the U.K. that on the “date [Del Rosso] first delivered a secure drive,”

he “was flying to New York.” Appellant’s Br. at 22. Like the previous allegation that Del

Rosso made trips to New York, this allegation conspicuously lacks any facts suggesting

either that the trip to New York or the “secure drive” referenced by Del Rosso had anything

to do with this case.

Because El Omari’s allegations regarding Del Rosso are deficient, his allegations

with respect to Vital Management Services fall short as well. El Omari pleads no facts

with respect to Vital—Del Rosso’s company—beyond the actions of Del Rosso described

above. The District Court thus properly dismissed El Omari’s claims against Del Rosso

and Vital Management Services for lack of personal jurisdiction.

II. The CFAA

El Omari failed to plausibly state a claim for violation of the CFAA against Dechert

LLP. Generally speaking, the CFAA bars unauthorized computer access. See 18 U.S.C.

§ 1030(a). The statute provides a private right of action to “[a]ny person who suffers

damage or loss by reason of a violation of” the CFAA, subject to certain qualifications,

“against the violator to obtain compensatory damages and injunctive relief or other

equitable relief.” 18 U.S.C. § 1030(g). We agree with the District Court that “[a] CFAA

7 claim should be dismissed where plaintiffs provided no facts to establish that the defendant

or any of its employees is affiliated with the hacks of plaintiff[’s] computers.” App’x at

53 (quoting El Omari v. Buchanan, No. 20-CV-02601 (VM), 2021 WL 5889341, at *13

(S.D.N.Y. Dec. 10, 2021)); see Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (“A claim has

facial plausibility when the plaintiff pleads factual content that allows the court to draw the

reasonable inference that the defendant is liable for the misconduct alleged.” (emphasis

added)).

El Omari fails to plausibly allege that Dechert is responsible for the hack of his

email account. El Omari’s complaint begins by setting forth circumstantial evidence that

his email account was hacked. He then asserts that the VMS Defendants paid an Indian

organization called CyberRoot to hack into El Omari’s emails, relying in part on financial

records showing that Vital transferred over $500,000 to CyberRoot in 2015 and 2016. He

suggests that these payments must have been to hack his email because CyberRoot has

engaged in phishing-based attacks similar to the one he suffered.

Whether or not these allegations would be enough to connect Del Rosso and Vital

Management Services to the hack of his email account, El Omari’s claim against Dechert

depends on the additional inferential leap that Vital acted at the direction of Dechert. To

make this leap, El Omari baldly asserts that Dechert “either had actual knowledge, or must

have strongly suspected the illegal hacking activities” because Vital paid CyberRoot

$500,000 and those costs would have been passed onto Dechert, and because “[t]he

subsequent sharing of the sensitive information gleaned from the stolen confidential emails

with [a lawyer] at Dechert NY must have triggered strong suspicions” on the part of that

8 lawyer “that El Omari’s sensitive litigation information was illegally obtained.” App’x at

25. But El Omari cites no facts suggesting that information from the hacked emails was

passed along to Dechert. And while El Omari cites facts suggesting that Vital paid over

$500,000 to CyberRoot over about seventeen months, the complaint is bereft of any support

for a claim that these payments were connected to the alleged hack of El Omari or that the

costs were passed along directly to Dechert. On the contrary, the complaint itself asserts

that the alleged hacker’s database “is believed to . . . show that Del Rosso gave [the hacker]

over 40 hacking target names,” not just El Omari’s. App’x at 23. El Omari’s allegations

therefore fall far short of plausibly alleging Dechert’s responsibility for the hacking

scheme.

III. Conversion Under North Carolina Law

El Omari’s state-law conversion claim is barred by the statute of limitations. In

North Carolina, conversion claims are subject to a three-year statute of limitations. See

N.C. Gen. Stat. § 1-52(4); Honeycutt v. Weaver, 812 S.E.2d 859, 867 (N.C. Ct. App. 2018).

Under North Carolina law, a claim for conversion “accrues, and the statute of limitations

begins to run, when the unauthorized assumption and exercise of ownership occurs—not

when the plaintiff discovers the conversion.” Stratton v. Royal Bank of Can., 712 S.E.2d

221, 227 (N.C. Ct. App. 2011). The complaint alleges: “On or about January 12, 2017, but

no later than February 19, 2017, . . . El Omari’s Microsoft Outlook email account,

ceo@oussamaelomari.com, was accessed without his authorization using his stolen login

credentials. . . . Confidential and privileged email communications between El Omari and

his undersigned attorney were copied from El Omari’s email account.” App’x at 21. This

9 makes clear that “the unauthorized assumption and exercise of ownership” of El Omari’s

digital information occurred in early 2017. Stratton, 712 S.E.2d at 227. That triggered the

running of the limitations period, which expired in 2020. El Omari’s conversion claim is

therefore untimely.

IV. Conclusion

Having reviewed the record de novo, we conclude that the Magistrate Judge

correctly determined that personal jurisdiction was lacking over Del Rosso and Vital

Management Services; that El Omari failed to plausibly allege Dechert’s involvement in

the CFAA claims; and that El Omari’s North Carolina conversion claim is barred by the

statute of limitations. The District Judge’s error in failing to conduct a de novo review of

El Omari’s properly raised objections is therefore harmless. See Maki v. New York, 597 F.

App’x 36, 37 (2d Cir. 2015) (summary order) (“[E]ven assuming the court applied the

incorrect standard of review, that error was harmless because our independent and de novo

review of the entire record reveals that the magistrate judge’s recommendations were

correct and [the plaintiff’s] objections were without merit.”). We therefore affirm the

District Court’s dismissal of El Omari’s complaint.

* * *

We have considered El Omari’s remaining arguments and find them to be without

merit. For the foregoing reasons, the judgment of the District Court is AFFIRMED.

FOR THE COURT: Catherine O’Hagan Wolfe, Clerk of Court