USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 1 of 22
PUBLISHED
UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT
No. 24-4478
UNITED STATES OF AMERICA,
Plaintiff – Appellee,
v.
EBUKA RAPHAEL UMETI, a/k/a Ebuka Rapheal Umeti,
Defendant – Appellant.
Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Leonie M. Brinkema, District Judge. (1:22-cr-00123-LMB-1)
Argued: December 12, 2025 Decided: February 19, 2026
Before NIEMEYER, GREGORY, and AGEE, Circuit Judges.
Affirmed in part, reversed in part, and remanded by published opinion. Judge Agee wrote the opinion in which Judge Niemeyer and Judge Gregory joined.
ARGUED: Jenny R. Thoma, OFFICE OF THE FEDERAL PUBLIC DEFENDER, Clarksburg, West Virginia, for Appellant. Laura Devon Withers, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellee. ON BRIEF: Erik S. Siebert, United States Attorney, Daniel J. Honold, Assistant United States Attorney, OFFICE OF THE UNITED STATES ATTORNEY, Alexandria, Virginia, for Appellee. USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 2 of 22
AGEE, Circuit Judge:
Ebuka Raphael Umeti was charged with, inter alia, conspiracy to commit wire
fraud, conspiracy to cause intentional damage to a protected computer, wire fraud and
aiding and abetting, and intentional damage to a computer with a loss of at least $5,000.
During the venire proceedings, a potential juror stated that he worked in cybersecurity and
was familiar with Umeti’s case. He was eventually struck for cause. Subsequently, the jury
convicted Umeti on all counts.
On appeal, Umeti argues that the potential juror’s statements improperly affected
juror impartiality. He further argues that the Government failed to adduce sufficient
evidence (1) tying him to the scheme and (2) that the businesses incurred $5,000 of
qualifying losses.
For the reasons that follow, we affirm in part, reverse in part, and remand for
resentencing.
I.
Umeti and his co-conspirators, Franklin Okwonna and Mohammed Butaish
(collectively, “Defendants”), conspired to commit wire fraud by deceiving businesses into
executing wire transfers to bank accounts controlled by the Defendants. Umeti and
Okwonna, both of whom resided in Nigeria, discussed template phishing emails, some of
which included malware. The pair connected with Saudi Arabia-based Butaish online, at
which point they conferred about purchasing undetectable malware.
2 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 3 of 22
In August 2022, a grand jury returned an eleven-count indictment charging the
Defendants with various crimes related to their scheme. Those charges, as relevant here,
included conspiracy to commit wire fraud in violation of 18 U.S.C. § 1349, with an
enhancement for falsely registering a domain name under 18 U.S.C. § 3559(g)(1) (Count
1); conspiracy to cause intentional damage to a protected computer, in violation of 18
U.S.C. § 371, with an enhancement for causing loss of at least $5,000 in a one-year period
under 18 U.S.C. § 1030(c)(4)(B) (Count 2); three counts of wire fraud and aiding and
abetting, in violation of 18 U.S.C. § 1343 (Counts 3–5); and intentional damage to a
protected computer, in violation of 18 U.S.C. § 1030(a)(5)(A), with an enhancement for
causing loss of at least $5,000 in a one-year period under 18 U.S.C. § 1030(c)(4)(B) (Count
11).
Okwonna accepted a plea deal, and Umeti went to trial. 1 Before voir dire, the district
court instructed the potential jurors on the importance of impartiality. See J.A. 52
(instructing prospective jurors to “listen carefully to all of the evidence and to make
decisions based solely upon the evidence presented during the trial and not on extraneous
or improper bases”). Then, during voir dire, the court asked whether any potential juror
thought “that he or she might know something about the case.” J.A. 55. In response, Greg
Kodish and the district court engaged in the following colloquy:
Kodish: I work in cybersecurity. I think we might have done some of the remediation regarding some of these. The Court: Well, I’m going to ask a general question about cyber work, but do you know anything about this particular case?
1 As of the date of this opinion, Butaish’s charges remain pending. 3 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 4 of 22
Kodish: I’ve heard of the defendants and some of their— The Court: I’m sorry? Kodish: I’ve heard of the defendants and some of their previous involvement in this industry. The Court: All right. Thank you, Mr. Kodish.
J.A. 56.
Defense counsel subsequently approached the bench and expressed concern that
Kodish’s comments tainted the jury pool, contending that Kodish stated “to the whole jury
pool that he had firsthand knowledge that the defendants, including Mr. Umeti, were
involved in fraud[.]” J.A. 63. The district court disagreed, explaining that it “did not hear
it that clearly at all,” but the court noted the objection for the record. Id.
Throughout voir dire, the district court continued to emphasize the importance of
juror impartiality. See, e.g., J.A. 70 (noting the importance that each potential juror “think[]
carefully about whether he or she can be completely impartial in acting as a juror”). At the
close of voir dire, Kodish was struck for cause.
When the jury was empaneled, the Government presented its case and adduced
evidence that Defendants stole millions of dollars from various businesses throughout the
country. Of particular import to this appeal, the Defendants targeted Company H by duping
one of its employees in 2020. 2 They sent malware-laden emails to that employee purporting
to be well-known businesses, including Company H’s vendors. Once the files attached to
these emails were opened, malware automatically downloaded onto the recipient’s
2 Both parties anonymized the companies victimized by the Defendants’ scheme in their briefing. We do the same throughout this opinion. 4 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 5 of 22
computer. The same type of scheme was carried out against one of Company L’s
employees. Further tying the Defendants to both companies, federal agents discovered
malicious files on Company H’s computers that matched malware discovered on Company
L’s computers. That malware permitted the Defendants to evade antivirus software and
gave them access to information on the recipient’s computer so as to steal funds from that
entity.
The Government sought to prove Umeti’s involvement in the scheme by linking his
personal online presence with the fraudsters’ online presence. It did so by constructing a
chain of evidence tying Umeti’s personal online presence to the fraudsters’ online presence
through similar social media handles 3 and email addresses, shared internet protocol (“IP”)
addresses, and connections between Umeti’s personal emails and the fraud-connected
accounts. The Government also sought to connect Umeti’s personal Gmail and Instagram
accounts to the fraudsters’ GitHub, Yahoo, Hack Forums, Discord, and Namecheap
accounts. 4
A “handle” is the name under which someone posts on social media. See Antonyuk 3
v. James, 120 F.4th 941, 1002 (2d Cir. 2024). 4 These social media platforms serve somewhat distinct purposes. GitHub is “an account for an online software development platform. The users . . . store[] and track[] and collaborate[] on various software projects[.]” J.A. 391. Hack Forums is an online forum to “discuss ideas about how to hack and share ideas of how to purchase and buy different types of malware encryptors.” J.A. 387–88. Discord “is an instant messaging and . . . social platform where Discord users can send text messages, make . . . voice calls, video calls and send files.” J.A. 432. Finally, “Namecheap is a domain registrar” that permits users “to create [and register] a domain name[.]” J.A. 407. A “[d]omain is a text address similar to a numerical address to a residence. [It] is an address to a website[.]” J.A. 407–08. 5 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 6 of 22
The Government further introduced evidence that, as a result of the Defendants’
scheme, Company H suffered financial damages. Company H’s representative testified
that, over a period of “about three months,” Company H conducted “a big cleanup job” as
a result of the hacking. J.A. 286–87. It purchased “two new laptops” and contacted
customers to determine the extent of the fraud. J.A. 286. The corporate representative also
testified that she “believe[d] there was about [$]1.7 million that went to different banks”
because of the Defendants’ scam. J.A. 287.
Umeti moved for judgment of acquittal at the close of the Government’s case,
arguing that it failed to establish his involvement in the fraud. The district court denied that
motion, explaining that the Government’s circumstantial evidence was “more than
enough” for the jury to conclude that Umeti was involved in the fraud. 5 J.A. 601.
After Umeti presented his defense, the district court instructed the jury, reiterating
that the verdict must be based “on the evidence received during the trial,” J.A. 861, and
emphasizing the importance of each juror’s “impartial consideration of the evidence,” J.A.
895. Following deliberations, the jury convicted Umeti on all counts and the sentencing
enhancements presented.
Thereafter, Umeti renewed his motion for a judgment of acquittal or, in the
alternative, a new trial. In support of that motion, he contended Kodish’s statements during
the venire process constituted a prejudicial, external influence on the jury. He also argued
5 The district court also rejected Umeti’s argument that the Government offered insufficient evidence of damage to the computer. J.A. 601. Umeti does not challenge that determination on appeal. 6 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 7 of 22
that the Government adduced insufficient evidence of (1) Umeti’s involvement in the fraud
and (2) the $5,000 loss necessary for the sentencing enhancement under 18 U.S.C. §
1030(c)(4)(B)(i).
The district court orally denied Umeti’s motion. On the issue of Kodish’s
statements, it reasoned that because he made only “general[]” statements before jury
selection and was ultimately struck for cause, he had no opportunity to provide any
improper information to the jurors. S.J.A. 1055–56. The court also noted that both before
and after voir dire, the prospective jurors were instructed to remain unbiased and impartial.
As to the sufficiency of the Government’s evidence of Umeti’s involvement in the
crimes of conviction, the court acknowledged that this case primarily involved
circumstantial evidence. However, it opined that the evidence, such as “the various names
that [Umeti] used, . . . social media pictures of him, [] unexplained sources of wealth, . . .
[and] the interconnection of all these pieces of information[,] . . . created a very clear picture
of culpability.” S.J.A. 1057–58.
Finally, the district court rejected Umeti’s argument that the Government failed to
establish the requisite loss for Count 11’s sentencing enhancement. In so doing, the court
referenced the Government’s evidence of the fraud’s impact on victims—“invoices [] being
misdirected, [and] millions of dollars of losses.” J.A. 1058.
Thereafter, the district court held a sentencing hearing. Umeti was sentenced to 120
months’ imprisonment: 12 months on Count One; 12 months consecutive on Count Two;
24 months consecutive each on Counts Three, Four, and Five; and 24 months consecutive
on Count 11.
7 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 8 of 22
Umeti timely appealed, and this Court has jurisdiction under 28 U.S.C. § 1291.
II.
This Court reviews a district court’s denial of a motion for judgment of acquittal de
novo and denial of a motion for a new trial for abuse of discretion. United States v. Davis,
75 F.4th 428, 437 (4th Cir. 2023) (motion for judgment of acquittal); United States v.
Bartko, 728 F.3d 327, 334 (4th Cir. 2013) (motion for a new trial). We review the district
court’s decision not “to conduct a Remmer[6] hearing under a ‘somewhat narrowed
modified abuse of discretion standard,’ which ‘grants us more latitude to review the trial
court’s conclusion’ in the context of all the evidence presented.” United States v. Johnson,
954 F.3d 174, 179 (4th Cir. 2020) (quoting United States v. Basham, 561 F.3d 302, 319
(4th Cir. 2009)).
III.
Umeti first contends that Kodish’s statements during venire proceedings were
prejudicial, external influences that improperly affected juror impartiality. However,
Kodish’s statements were innocuous and failed to draw into question the integrity of the
trial proceedings. Accordingly, we discern no abuse of discretion in the district court’s
denial of Umeti’s motion for a new trial on this basis.
6 Remmer v. United States, 347 U.S. 227 (1954). 8 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 9 of 22
A.
The Sixth Amendment guarantees criminal defendants the right to trial by an
impartial jury. U.S. Const. amend. VI. Part and parcel of that right is the jury’s freedom
from “influence outside the jury’s deliberative process, a so-called external influence, [that]
affects the jury’s decision-making.” Johnson, 954 F.3d at 179 (cleaned up). To that end, in
Remmer v. United States, 347 U.S. 227 (1954), the Supreme Court held that a rebuttable
presumption of prejudice arises when there has been a direct or indirect “private
communication, contact, or tampering . . . with a juror during a trial about the matter
pending before the jury.” Id. at 229.
A defendant claiming entitlement to a Remmer presumption must first “make [a]
threshold showing.” Johnson, 954 F.3d at 179. He must “introduce[] competent evidence
of extrajudicial juror contacts,” and if such contacts are shown, the Court “must analyze
whether the contacts were more than innocuous interventions that simply could not justify
a presumption of prejudicial effect.” United States v. Cheek, 94 F.3d 136, 141 (4th Cir.
1996) (cleaned up). To determine whether a contact with a juror is innocuous or instead
triggers the Remmer presumption, we look to whether there was “(1) any private
communication; (2) any private contact; (3) any tampering; (4) directly or indirectly with
a juror during trial; (5) about the matter before the jury.” Id. Once the party attacking the
verdict has cleared that initial hurdle, the burden shifts to the Government to rebut the
presumption of prejudice. United States v. Elbaz, 52 F.4th 593, 607 (4th Cir. 2022).
In view of these factors, Umeti cannot carry his burden of showing that Kodish’s
statements were more than “innocuous interventions.” Cheek, 94 F.3d at 141 (cleaned up).
9 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 10 of 22
The district court asked the prospective jurors whether they “might know something about
the case.” J.A. 55. In response, Kodish volunteered to the court: “I work in cybersecurity.
I think we might have done some of the remediation regarding some of these.” J.A. 56. He
continued that he had “heard of the defendants and some of their previous involvement in
th[e] industry.” Id.
These statements occurred in open court before the entire jury pool. Their
substance—which is nothing more than Kodish stating a general awareness of Umeti
through his work in cybersecurity—falls far short of tampering or attempting to influence
potential jurors. Cf. United States v. Blauvelt, 638 F.3d 281, 295 (4th Cir. 2011) (declining
to apply a Remmer presumption where “no one suggest[ed] there was any tampering or any
attempt by [the external contact] to exert any influence”). Moreover, nothing in Kodish’s
statements show any disposition toward Umeti’s guilt or innocence. Kodish disclosed his
familiarity with Umeti in direct response to the district court’s probe into whether any
prospective jurors “know anything about the case.” J.A. 54. That is simply not the kind of
prejudicial contact the Supreme Court contemplated in creating the Remmer presumption.
See Remmer, 347 U.S. at 229 (noting that “private communication, contact, or tampering
directly or indirectly, with a juror during a trial about the matter pending before the jury is
. . . deemed presumptively prejudicial, if not made in pursuance of known rules of the court
and the instructions and directions of the court made during the trial, with full knowledge
10 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 11 of 22
of the parties” (emphasis added)). As a result, it is clear that the district court did not abuse
its discretion in declining to grant a new trial on this basis. 7
For the foregoing reasons, we affirm the district court’s denial of Umeti’s Remmer-
based motion for a new trial.
B.
Umeti next contends that the district court erred by denying his motion for judgment
of acquittal based on the Government’s insufficient evidence on two points: (1) his
involvement in the fraud, and (2) qualifying losses under § 1030(c)(4)(B)(i).
Before addressing these arguments we first highlight the deferential standard in
reviewing a sufficiency challenge. In assessing whether judgment of acquittal based on
insufficient evidence is appropriate, “we ask ‘whether, after viewing the evidence in the
light most favorable to the prosecution, any rational trier of fact could have found the
essential elements of the crime beyond a reasonable doubt.’” United States v. Millender,
970 F.3d 523, 528 (4th Cir. 2020) (quoting Jackson v. Virginia, 443 U.S. 307, 319 (1979)).
With that in mind, we turn to Umeti’s sufficiency-of-the-evidence challenges.
7 Umeti also asks the Court to address whether statements made by a prospective juror during voir dire can ever constitute “extrajudicial contact[s]” that trigger the Remmer presumption. Cheek, 94 F.3d at 141. However, given our conclusion that Kodish’s statements were not prejudicial, we need not reach that issue. Umeti further argues that the district court improperly attributed another juror’s statements to Kodish, and thus misapprehended the Remmer issue. Having reviewed the record, we see no support for that argument. 11 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 12 of 22
As to Umeti’s challenge to his involvement in the fraud, the parties dispute whether
he preserved this argument in his motion for a new trial. In his motion for judgment of
acquittal or a new trial, Umeti expressly sought a new trial based on the Remmer issue.
Under a separate subheading, he stated: “An additional ground to enter judgment of
acquittal or set aside the guilty verdict against [] Umeti is that [the] [G]overnment failed to
prove that he was the one who committed the alleged fraud.” J.A. 925. In Umeti’s view,
his use of “set aside the guilty verdicts” implies that he also moved for a new trial on the
basis of insufficient evidence.
One notable distinction between a motion for a new trial and a motion for judgment
of acquittal is the standard of review: we review the former for abuse of discretion and the
latter de novo. Davis, 75 F.4th at 437; Bartko, 728 F.3d at 334. For purposes of this appeal,
however, this is a distinction without a difference. Neither party disputes that Umeti moved
for judgment of acquittal on the grounds that the Government failed to adequately connect
him to the fraud. We review the district court’s denial of that motion under the less
deferential de novo standard of review. As explained below, this Court concludes that, even
under that less deferential standard, the Government’s evidence passes muster. So even
assuming Umeti preserved the same issue in his motion for a new trial, the district court’s
denial of that motion necessarily survives review for an abuse of discretion as well.
Umeti’s argument that the Government failed to adduce sufficient evidence of his
connection to the fraud is unpersuasive. At trial, the Government’s theory was that Umeti,
along with his co-conspirators, defrauded businesses through various schemes. To tie
12 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 13 of 22
Umeti to these schemes, the Government needed to connect his personal accounts to fraud-
related accounts. It did so by introducing evidence of a chain of social media accounts
connecting Umeti to the fraud. As Umeti sees it, this is where the Government failed. We
disagree. As outlined below, at each link in that chain, the Government adequately
supported Umeti’s connection to the fraud.
At the outset, Umeti does not dispute that his personal Instagram account was listed
under “Raphael Raphael,” had the handle of “eternal1502,” and was registered under the
“eternal1502” Gmail. He also concedes that he used a Gmail account with a handle of
“ebuka1502.” The Government explained that the use of “1502” in these handles
represented Umeti’s birthday: February 15.
The Government argued that Umeti’s personal accounts were connected to a fraud-
connected GitHub account used to further the conspiracy. In support of that contention, the
Government adduced evidence that (1) Umeti’s personal accounts and the GitHub account
shared a handle, “eternal1502,” and (2) the person who controlled that GitHub account
went by the username “Raph,” consistent with Umeti’s middle name, “Raphael,” which he
used for his personal social media accounts. Given the overlap between the handles and
Umeti’s name, the Government adequately connected his personal accounts to the fraud-
connected “eternal1502” GitHub account.
The Government then offered evidence tying the “eternal1502” GitHub account to
the broader conspiracy. It explained that the GitHub account was registered to a Yahoo
email account, “jm.collins100.” Connecting Umeti to the “jm.collins100” handle was
critical, as it linked him to myriad fraud-related social media and email accounts with
13 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 14 of 22
similar handles. For instance, the “jm.collins100” Yahoo account was used to register a
Hack Forums account with the handle “eternal101,” which the conspirators used to locate
information about malware encryptors.
Relatedly, a “jm.collins002” iCloud account was linked to a Dingtone account that
was used to register two fraud-related phone numbers. There was also IP address overlap
between that fraud-connected Dingtone account and Umeti’s personal “ebuka1502” Gmail.
Based on this overlap, FBI Special Agent Gerald Kim testified that the same person likely
controlled both accounts. 8 The Government also showed that: (1) the IP address was owned
by “9mobile Nigeria,” J.A. 701; (2) Umeti’s personal “eternal1502” Gmail contained a
bank payment to 9mobile; and (3) the bank payment indicated that there was an Android
phone associated with Umeti’s “ebuka1502” Gmail, his “eternal1502” Gmail, and 9mobile.
Taken together, this evidence is sufficient to permit a rational factfinder to conclude that
Umeti controlled the fraud-related Dingtone account.
Further, based on Umeti’s connection to the “jm.collins” handles, the Government
posited that he was connected to numerous other handles involved in the fraud. The
“jm.collins002” Gmail sent an “invoice_s321” Yahoo account a “test” email, while the
“jm.collins100” Gmail sent that same Yahoo account an email and attached a file that was
8 Umeti objected to Agent Kim’s testimony, arguing that it was speculative, lacked foundation, and was improper expert testimony from a lay witness. J.A. 379, 389. The district court overruled those objections. J.A. 379, 390–96. Umeti does not challenge that decision on appeal. So regardless of whether Agent Kim’s testimony was permissible, we may consider it at this juncture. See United States v. Huskey, 90 F.4th 651, 662 (4th Cir. 2024) (“[W]e consider all the evidence considered by the jury, both admissible and inadmissible[,] when assessing a sufficiency challenge.” (cleaned up)). 14 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 15 of 22
eventually sent to a victim of the Defendants’ scheme. The “invoice_s321” account was
registered under a Proton Mail account, “helsinki_ar.” That account, in turn, was used to
register a fraud-connected Namecheap account, “cassbanks101.” Cementing the
connection between these accounts, the “jm.collins100” Gmail account sent $10 to
“helsinki_ar” in connection with the Namecheap account.
There is one other link in the chain: Umeti’s connections to the “jm.collins,”
“eternal,” and “helsinki_ar” handles led officers to his Discord accounts, “eternal101” and
“hels101.” In Discord chats, “eternal101” told other users that he used the “jm.collins002,”
“jm.collins001,” and “helsinki_ar” Proton Mail accounts and the “jm.collins100” Yahoo
account. J.A. 484–85. Given the connection between Umeti and “jm.collins” handles, this
adequately ties Umeti to the fraud-connected Discord account.
The Government’s evidence adequately supports Umeti’s convictions based on his
involvement in the fraud. As to the conspiracy charges, Umeti does not dispute the
existence of the conspiracy. Opening Br. 27 (noting that it was not “in dispute” “that the
frauds happened and how they happened”). And “once it has been shown that a conspiracy
exists, the evidence need only establish a slight connection between the defendant and the
conspiracy to support conviction.” United States v. Burgos, 94 F.3d 849, 861 (4th Cir.
2019) (en banc) (cleaned up) (emphasis added); see id. at 858 (“[A] conspiracy may be
proved wholly by circumstantial evidence.”). To establish that connection, Agent Kim
testified that, at each link, the evidence led him to conclude that Umeti controlled the fraud-
related accounts. J.A. 392–436. Viewing the facts in the light most favorable to the
Government, a rational trier of fact could conclude, based on the aforementioned evidence
15 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 16 of 22
and Agent Kim’s accompanying testimony, that Umeti was directly and extensively
connected to the fraud. See Millender, 970 F.3d at 528.
Resisting this conclusion, Umeti argues that certain pieces of evidence relied upon
by the Government, such as the overlapping IP addresses and use of Umeti’s nickname,
did not establish that he was connected to the fraud. Still, the jury heard the evidence and
concluded that, viewed in its entirety, it connected Umeti to the fraud. We do the same,
considering the evidence “in cumulative context” rather than “in a piecemeal fashion.”
Burgos, 94 F.3d at 863. As set out above, we find that a reasonable factfinder could
conclude that Umeti was connected to the fraud.
Accordingly, the district court did not err in denying Umeti’s motion for judgment
of acquittal based on insufficient evidence connecting him to the fraud. And even assuming
Umeti preserved this argument in his motion for a new trial, for the same reasons, the
district court did not abuse its discretion in denying that motion.
Umeti next challenges the district court’s denial of his motion for judgment of
acquittal based on insufficient evidence showing $5,000 in loss, as required to sustain
Count 11’s sentencing enhancement under 18 U.S.C. § 1030(c)(4)(B)(i). That enhancement
raised the statutory maximum from one year of imprisonment to ten years’ imprisonment.
Consistent with the enhancement’s higher statutory maximum, Umeti was sentenced to 24
months’ imprisonment. Thus, as relief, Umeti seeks vacatur of his sentence as to Count 11
and remand for resentencing.
16 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 17 of 22
Under § 1030(a)(5)(A), a person may not “knowingly cause[] the transmission of a
program, information, code, or command, and as a result of such conduct, intentionally
cause[] damage without authorization, to a protected computer.” For such a violation, the
penalty is “not more than 1 year.” 18 U.S.C. § 1030(c)(4)(G)(i). However, an enhanced
statutory penalty applies when someone causes, inter alia, “loss to 1 or more persons
during any 1-year period (and, for purposes of an investigation, prosecution, or other
proceeding brought by the United States only, loss resulting from a related course of
conduct affecting 1 or more other protected computers) aggregating at least $5,000 in
value.” Id. § 1030(c)(4)(A)(i)(I). Where such loss accompanies a conviction under §
1030(a)(5)(A), the maximum statutory penalty is ten years’ imprisonment. Id. §
For purposes of the statute, loss is defined as: (1) “any reasonable cost to any victim,
including the cost of responding to an offense, conducting a damage assessment, and
restoring the data, program, system, or information to its condition prior to the offense,”
and (2) “any revenue lost, cost incurred, or other consequential damages incurred because
of interruption of service.” Id. § 1030(e)(11); see Yoder & Frey Auctioneers, Inc. v.
EquipmentFacts, LLC, 774 F.3d 1065, 1073 (6th Cir. 2014) (recognizing that § 1030(e)(11)
sets out two clauses that contain discrete definitions of “loss” and that loss can be satisfied
by costs under either clause “or a combination of both”).
The Government maintains that Umeti caused two types of loss: (1) costs incurred
to investigate the offense and remediate computers and software, and (2) funds fraudulently
diverted to the Defendants by Companies H and L. At oral argument, the Government
17 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 18 of 22
conceded that it only pressed arguments below related to the first clause of the “loss”
definition, i.e., “any reasonable cost to the victim,” such as “the cost of responding to an
offense.” 9 Oral Argument at 19:40–19:55, United States v. Umeti, No. 24-4478 (4th Cir.
Dec. 12, 2025). We are therefore tasked with determining whether the Government’s
evidence of “loss” falls within the ambit of the first clause and, if so, whether it adequately
proved $5,000 of such loss at trial. After a careful review of the record, we conclude that a
reasonable factfinder could not conclude that the Government met its burden on this point.
First, the costs incurred in response to the offense are recoverable under the statute’s
plain language. See A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630, 646 (4th
Cir. 2009) (noting that the “broadly worded [§ 1030(e)(11)] plainly contemplates
consequential damages of the type sought by iParadigms—costs incurred as part of the
response to a [] violation”). So the Government was entitled to show qualifying losses
through the response costs of Companies H and L. 10 The difficulty here is that it failed to
do so in a manner that permitted the jury to conclude the companies suffered at least $5,000
of such a loss.
The Government elicited the following testimony from Company H’s representative
as to response costs:
9 As a result of the Government’s concession, we do not address whether the evidence adduced at trial satisfies the second clause of the “loss” definition. 10 Umeti disputes which victim company’s loss is relevant to this analysis. In the indictment, the Government alleged that Umeti, through his involvement in the conspiracy, caused damage to both Company H and Company L which, in the aggregate, led to at least $5,000 in losses. J.A. 41. The Government reiterated that theory at closing argument. See J.A. 818. Thus, this Court considers evidence of loss to both companies. 18 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 19 of 22
We [] had to do a big cleanup job, new software. I had to get two new laptops. Also, we had to get an employee from the corporate office, we had to contact every single customer and find out if they had received letters from anybody posing as our company, make sure that nobody was changing their banking information. Our CFO also drafted a letter, and we had to send that to every single customer. We had to make sure that we talked to the customer. It wasn’t just an email; we had to physically talk to the customer.
J.A. 286–87. The corporate representative further explained that the remediation process
took “about three months.” J.A. 287. At no point, however, did the representative assign a
value to these costs. With respect to Company L, the record is similarly lacking—the
parties did not cite, and we could not find, evidence regarding the amount of any loss.
On this record, there is insufficient evidence to permit “any rational trier of fact” to
conclude that the Government showed $5,000 in response cost loss “beyond a reasonable
doubt.” Millender, 970 F.3d at 528 (cleaned up). Any conclusion as to a dollar amount for
the response cost would be pure guesswork. In upholding similar convictions, our sister
circuits have relied on evidence of the actual dollar amount associated with response costs.
See, e.g., United States v. Batti, 631 F.3d 371, 374–78 (6th Cir. 2011) (affirming a
conviction under § 1030(a)(2)(C), (c)(2)(B)(iii) where the Government elicited testimony
that a victim “paid about $305,000 for the [] footage that Batti accessed” and that payment
“best represented the value of the information Batti had obtained in his intrusions”); United
States v. King, 861 F. App’x 490, 495–96 (2d Cir. 2021) (finding sufficient evidence to
sustain King’s statutory penalty enhancement where the “jury heard evidence of (1) the
types of expenses incurred . . . and (2) an estimate of the extent of those expenses, which
was more than four times the $5,000 loss threshold”).
19 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 20 of 22
In short, to support a conclusion that Umeti’s fraud caused $5,000 in response costs,
the Government needed to adduce evidence that Companies H and L actually spent $5,000
in response to the fraud. But nothing in the record directly shows—or even permits an
inference—that Companies H and L incurred a determinable amount of costs. Because the
record is devoid of the necessary evidence of those companies’ response costs, a reasonable
factfinder could not conclude that the Government proved Umeti caused at least $5,000 in
such loss to Companies H and L.
That leaves the Government’s argument that the costs fraudulently diverted to the
Defendants by Companies H and L are “losses” under the first clause of the statute. See 18
U.S.C. § 1030(e)(11) (permitting recovery under the first clause of “any reasonable cost to
any victim”). The difficulty for the Government is that, in so arguing, it asks the Court to
rewrite the statutory language. The statute’s second clause expressly permits recovery for
“any revenue lost, cost incurred, or other consequential damages incurred” due to
“interruption of service.” Id. But the Government concedes it made no argument as to this
part of the statute. Instead, the Government attempts to shoehorn “diverted funds”—or, in
other words, “revenue lost”—into the first clause, arguing that it also constitutes “any
reasonable cost to any victim.” Id.
The Government’s attempt falls flat. It is axiomatic that, “[i]n interpreting a statute,
we should strive to give effect to every word that Congress has used to avoid surplusage.”
Healthkeepers, Inc. v. Richmond Ambulance Auth., 642 F.3d 466, 472 (4th Cir. 2011)
(cleaned up). This canon of statutory interpretation reflects courts’ “deep reluctance to
20 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 21 of 22
interpret a statutory provision so as to render superfluous other provisions in the same
enactment.” Id. (cleaned up).
In the second clause of § 1030(e)(11), Congress plainly stated its intent to restrict
recovery of lost revenue or other consequential damages to situations where the loss is
caused by an interruption of service. If this Court endorsed the Government’s view and
also recognized “diverted funds” as a loss within the meaning of the first clause, we would
read the second clause’s “interruption of service” restriction on analogous losses out of the
statute entirely. Put another way, the Government’s stance would render the “because of
interruption of service” language in § 1030(e)(11) superfluous. The Government therefore
cannot rely on the diverted funds to satisfy the first clause of § 1030(e)(11), and it concedes
it made no claim under the second clause of the statute.
In sum, the Government failed to adduce evidence that Companies H and L suffered
response costs that totaled at least $5,000. And as just explained, the Government cannot
rely on diverted funds to satisfy the first clause of § 1030(e)(11). Thus, the district court
erred in denying Umeti’s motion on this point.
Accordingly, we reverse Umeti’s sentencing enhancement under § 1030(c)(4)(B)(i)
as to Count 11. Based on that reversal, Umeti is no longer subject to that enhancement’s
statutory maximum of ten years’ imprisonment for his conviction under § 1030(a)(5)(A).
However, Umeti does not challenge his conviction under § 1030(a)(5)(A), which imposes
a one-year statutory maximum. 18 U.S.C. § 1030(c)(4)(G)(i). We therefore remand for
21 USCA4 Appeal: 24-4478 Doc: 93 Filed: 02/19/2026 Pg: 22 of 22
IV.
In conclusion, the Court affirms the district court’s denial of Umeti’s motion for a
new trial based on the district court’s failure to apply the Remmer presumption following
Kodish’s statements. We further affirm the district court’s denial of Umeti’s motion for a
judgment of acquittal based on the sufficiency of the Government’s evidence as to his
involvement in the fraud and, assuming he preserved that argument in his motion for a new
trial, we discern no abuse of discretion in that denial. However, we reverse Umeti’s
conviction under 18 U.S.C. § 1030(c)(4)(B), as the Government failed to adduce sufficient
evidence that Companies H and L suffered at least $5,000 in qualifying response losses.
We therefore remand the case for resentencing consistent with this opinion.
AFFIRMED IN PART, REVERSED IN PART, AND REMANDED FOR FURTHER PROCEEDINGS CONSISTENT WITH THIS OPINION.