United States v. Oriyomi Aloba

• Court: Court of Appeals for the Ninth Circuit
• Decided: March 26, 2025
• Docket: 22-50291
• Status: Unpublished

Opinion

NOT FOR PUBLICATION FILED UNITED STATES COURT OF APPEALS MAR 26 2025 MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA, No. 22-50291

Plaintiff-Appellee, D.C. No. 2:18-cr-00083-RGK-1 v.

ORIYOMI SADDIQ ALOBA, MEMORANDUM*

Defendant-Appellant.

Appeal from the United States District Court for the Central District of California R. Gary Klausner, District Judge, Presiding

Argued and Submitted September 10, 2024 Pasadena, California

Before: R. NELSON, MILLER, and DESAI, Circuit Judges. Partial Dissent by Judge R. NELSON. Partial Dissent by Judge DESAI.

Following a jury trial, Oriyomi Saddiq Aloba was convicted on 27 counts

related to an email “phishing” attack on the Los Angeles Superior Court (LASC),

including conspiracy to commit wire fraud and attempted wire fraud, in violation

of 18 U.S.C. § 1349; wire fraud, in violation of 18 U.S.C. § 1343; unauthorized

* This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. impairment of a protected computer, in violation of 18 U.S.C. § 1030(a)(5)(A),

(c)(4)(B)(i), (c)(4)(A)(i)(I); unauthorized access to a protected computer to obtain

information, in violation of 18 U.S.C. § 1030(a)(2)(C), (c)(2)(B)(i), (ii); aggravated

identity theft, in violation of 18 U.S.C. § 1028A; and aiding and abetting, in

violation of 18 U.S.C. § 2(a). He was sentenced to 145 months of imprisonment

and three years of supervised release and ordered to pay restitution in the amount

of $47,479.26. We affirmed Aloba’s conviction but remanded for resentencing so

that the district court could address his objections to the calculation of the advisory

Sentencing Guidelines range and consider the 18 U.S.C. § 3553(a) factors. United

States v. Aloba, No. 19-50343, 2022 WL 808208, at *1 (9th Cir. Mar. 16, 2022).

On remand, Aloba was resentenced to 87 months of imprisonment and three years

of supervised release and ordered to pay the same restitution amount of

$47,479.26—including $45,484.31 to the LASC. He appeals again. We have

jurisdiction under 28 U.S.C. § 1291 and 18 U.S.C. § 3742(a). We vacate Aloba’s

sentence and remand for resentencing.

Because Aloba did not object at resentencing, we review the district court’s

alleged failure to adequately explain his sentence for plain error. See United States

v. Sandoval-Orellana, 714 F.3d 1174, 1180 (9th Cir. 2013). We review the district

court’s interpretation of the Sentencing Guidelines de novo, its factual findings for

2 clear error, and its application of the Sentencing Guidelines to the facts of the case

for abuse of discretion. United States v. Pham, 545 F.3d 712, 716 (9th Cir. 2008).

1. The district court did not commit plain error in its explanation of Aloba’s

sentence. In general, a district court should consider the section 3553(a) factors and

provide an adequate explanation for the chosen sentence to allow for “meaningful

appellate review.” United States v. Carty, 520 F.3d 984, 992 (9th Cir. 2008) (en

banc). Aloba argues that the district court did not consider eight arguments that he

made for a lower sentence. But the court made findings that addressed at least

some of those arguments. As for the rest, adequate explanation can be inferred

from the record, and the court “need not tick off each of the § 3553(a) factors to

show that it has considered them.” Id.; see also Rita v. United States, 551 U.S. 338,

356 (2007) (“[W]hen a judge decides simply to apply the Guidelines to a particular

case, doing so will not necessarily require lengthy explanation.”). We therefore

conclude that the district court’s explanation of Aloba’s sentence was sufficient

and not plain error.

2. The district court abused its discretion by applying a two-level

enhancement for 10 or more victims under U.S.S.G. § 2B1.1(b)(2)(A)(i). The

record shows that Aloba caused actual financial loss to one individual and two

entities—American Express and the LASC—and that he used the identification of

six other individuals to send emails or attempt to charge their credit cards. We

3 agree that all of those individuals and entities are victims, but there are only nine of

them. See United States v. Herrera, 974 F.3d 1040, 1050 (9th Cir. 2020) (holding

that government entities can be victims under the Guidelines).

The parties debate the meaning of “victim”—a word that is not defined in

the Guidelines—as well as the relevance of the Guidelines commentary in

interpreting the word. But even the government concedes that “[t]he term ‘victims’

is most naturally read to include anyone who is harmed by a defendant’s crimes,” a

reading with which we agree. See Victim, Black’s Law Dictionary (12th ed. 2024)

(defining “victim” as “[a] person harmed by a crime, tort, or other wrong”); Victim,

Oxford English Dictionary (Rev. 2024) (defining “victim” as “[a] person who has

been intentionally harmed, injured, or killed as the result of . . . [a] crime”); see

also 18 U.S.C. § 3771(e)(2)(A) (cited by the government for its definition of

“crime victim” as “a person directly and proximately harmed as a result of the

commission of a Federal offense”).

The government suggests that all of “those who had their identities

misappropriated” are victims, but that proposition is difficult to square with the

government’s own position that a victim must be one who has suffered harm.

(Does the mere possession of login credentials cause harm? Maybe, but the

conclusion is not obvious.) Even if we thought the word “victim” could be read

that broadly, it is at least ambiguous, and nothing in the structure or history of the

4 Guidelines resolves that ambiguity in favor of the government. Rather than

construct our own definition—one not advanced by either party—we follow the

government’s suggestion and turn to the Guidelines commentary. See United States

v. Trumbull, 114 F.4th 1114, 1117–18 (9th Cir. 2024) (deferring to the

commentary’s reasonable interpretation when there is genuine ambiguity).

Application Notes 1 and 4(E) in the commentary specify that a “victim” who

suffered harm in a case involving means of identification includes “any person

who sustained any part of the actual loss determined” as well as “any individual

whose means of identification was used unlawfully or without authority.” U.S.S.G.

§ 2B1.1 cmt. n.1 & n.4(E); see United States v. Gonzalez Becerra, 784 F.3d 514,

518–20 (determining that the commentary’s articulation of “a rule applicable to a

certain subset of [section 2B1.1] crimes . . . and an additional type of victim” was

consistent with the use of “victim” in the Guidelines).

Applying that understanding of “victim,” we are unable to identify 10 or

more victims. Although the district court asserted that “there [we]re many, many

more than ten victims, maybe 500 Los Angeles Superior Court employees,” the

court did not explain how it arrived at that figure. In particular, it did not explain

how any of those employees suffered any harm (even harm to their privacy or

reputation), sustained any actual loss, or had their means of identification used

unlawfully. Perhaps the district court could have made such findings, but it did not

5 do so, and it is not clear to us whether the record would support them. The district

court therefore abused its discretion by applying the victims enhancement.

3. The district court did not abuse its discretion in determining the loss and

restitution amount. The Guidelines provide for sentencing enhancements if the

“loss” caused by the defendant exceeds certain thresholds, U.S.S.G. § 2B1.1(b)(1),

and the Mandatory Victims Restitution Act requires that the defendant pay

restitution to the victim of the offense if the victim suffered a “pecuniary loss,” 18

U.S.C. § 3663A. In applying the Guidelines and calculating restitution, the district

court included $45,484.31 in wages paid by the LASC to its employees during the

estimated time they responded to Aloba’s attack. That amount, together with a

credit-card transaction that Aloba does not contest, corresponds to a six-level

sentencing enhancement under section 2B1.1(b)(1)(D).

The district court reasonably determined that the LASC suffered a pecuniary

loss because it was deprived of valuable employee time that would have been spent

on other projects in exchange for the salaries that the employees were paid. After

Aloba’s attack, six senior IT employees and 40 desktop support staff spent

approximately four weeks investigating the attack and resetting the compromised

accounts, thus impeding what one witness confirmed as “their ability to do the

work that they were supposed to be doing.” Aloba’s attack directly and

proximately caused that productivity loss. See United States v. Peterson, 538 F.3d

6 1064, 1077–78 (9th Cir. 2008). Indeed, Aloba himself acknowledges that the attack

may have “lowered productivity at the court’s IT department.” Had the LASC

hired an outside contractor to respond to Aloba’s offense, there would be no doubt

that its payments to the contractor would constitute pecuniary harm. The LASC’s

choice to use its own employees does not change the analysis because those

employees sacrificed productive work time that would have been spent on

completing other projects for which they were hired and paid. The LASC need not

have spent or lost money directly so long as its productivity loss can be measured

in monetary terms.

In United States v. Sablan, we allowed the standard hourly rate charged to

paying customers for employee time spent repairing damaged computers and

restoring compromised computer files to be used as a reasonable estimate of loss

under the Guidelines. 92 F.3d 865, 869–70 (9th Cir. 1996). Sablan’s reasoning

applies equally here. Aloba observes that Sablan involved a for-profit business

rather than a government entity, but we have never treated businesses and

government entities differently under the Guidelines simply because the latter do

not generate profits from charging customers. Rather, we have said that “[i]t

cannot be disputed that government entities sometimes suffer losses from the types

of fraudulent conduct that § 2B1.1 addresses.” Herrera, 974 F.3d at 1047. Here,

the record shows that the LASC suffered a productivity loss measurable in

7 employee compensation—including overtime compensation to at least one senior

IT employee.

To the extent that Aloba argues that employee time spent assisting law

enforcement should not be included in the loss and restitution amount, that

argument fails because the record suggests that any such time was de minimis.

4. On remand, the district court should determine whether to apply

Amendment 821 to the Sentencing Guidelines, which became effective after

Aloba’s resentencing and which provides a two-level reduction for certain

defendants, like Aloba, with no criminal history points. See United States v. Wales,

977 F.2d 1323, 1327–28 (9th Cir. 1992).

VACATED and REMANDED.

8 FILED United States v. Aloba, No. 22-50291 MAR 26 2025 MOLLY C. DWYER, CLERK R. Nelson, J., dissenting in part: U.S. COURT OF APPEALS

Oriyomi Aloba stole email login credentials from 127 employees. Those

employees are “victims” of identify theft. Because the majority concludes

otherwise, I dissent in part.1

The Sentencing Guidelines enhance a defendant’s recommended sentencing

range if his crime “involved 10 or more victims.” U.S.S.G. § 2B1.1(b)(2)(A)(i).

Because the Guidelines do not define “victim,” we apply the “ordinary tools of

statutory interpretation” and enforce the term’s ordinary meaning. United States v.

Kirilyuk, 29 F.4th 1128, 1137 (9th Cir. 2022). That’s true even though the Sentencing

Commission has defined “victim” in its interpretive commentary. Kisor v. Wilkie,

588 U.S. 558, 573 (2019); United States v. Trumbull, 114 F.4th 1114, 1117–18 (9th

Cir. 2024). “Before even considering” the commentary, we exhaust our traditional

interpretive tools. Kisor, 588 U.S. at 590. And we look to the commentary only if

the Guidelines are “genuinely ambiguous” and the Commission’s interpretation is

“reasonable.”2 Id. at 573, 575–76.

1 I agree that the district court did not plainly err in explaining Aloba’s sentence or abuse its discretion in determining the loss and restitution amounts. 2 Some of our cases have applied the commentary’s definition of “victim.” E.g., United States v. Pham, 545 F.3d 712, 716–17, 722 (9th Cir. 2015); United States v. Armstead, 552 F.3d 769, 781 (9th Cir. 2008). Because none analyzed the 1 Dictionaries define “victim” as the “target” of a crime and any person

“harmed” by it. Victim, Oxford English Dictionary (Rev. 2024); Victim, New Oxford

American Dictionary (3d ed. 2010) (“a person harmed, injured, or killed as a result

of a crime”); Victim, Webster’s Third New International Dictionary (1961) (“a

person subjected to oppression, deprivation, or suffering”). In the context of fraud,

that includes anyone “deceived, fooled, or taken advantage of.” Victim, Oxford

English Dictionary (Rev. 2024); Victim, Webster’s Third New International

Dictionary (1961) (“someone tricked, duped, or subjected to hardship”).

These definitions reflect ordinary usage. When a hacker steals someone’s

social security number or login credentials, ordinary English speakers call that

person a “victim” of identity theft. See, e.g., United States v. Doe, 842 F.3d 1117,

1118 (9th Cir. 2016) (using “victim” this way); see also 18 U.S.C. § 1028A(a)(1)

(defining identity theft as unauthorized possession of identifiers).

These definitions also comport with other provisions of the criminal code.

The Mandatory Victim Restitution Act, for example, defines “victim” as someone

“directly and proximately harmed” by a crime. See 18 U.S.C. § 3663A(a)(2); see

also id. § 3771(e)(2)(A) (same); Victim, Black’s Law Dictionary (12 ed. 2024)

(similar).

commentary’s validity under Kisor, they are not binding on that question. Kirilyuk, 29 F.4th at 1134–35. 2 Based on this evidence of ordinary meaning, the 127 employees whose email

credentials were stolen are “victims.” They were “target[s]” of Aloba’s phishing

scam. See Victim, Oxford English Dictionary (Rev. 2024). They were “deceived,

fooled, [and] taken advantage of” when Aloba sent them deceptive emails and

requested their login credentials. See id. And they were harmed when Aloba

retained their credentials. “It should be obvious to any thoughtful observer of

modern economic life” that identity theft harms those whose identities are stolen.

United States v. Pham, 545 F.3d 712, 722 (9th Cir. 2015). Besides spending time

and energy recovering their identities, such individuals suffer “the gravest of

concerns” about their privacy, finances, and reputation. Id.

Aloba does not grapple with any of this. He asserts that, in the context of

fraud, “victim” refers only to those who suffer financial loss. We have already

rejected this argument, holding that “victim” is not limited to those who suffer

monetary harm. United States v. Gonzalez-Becerra, 784 F.3d 514, 518–19 (9th Cir.

2015); see also United States v. Thomsen, 830 F.3d 1049, 1074 (9th Cir. 2016). That

follows from the plain-meaning evidence discussed above. When dictionaries give

a fraud-specific definition of “victim,” they include anyone “tricked” or “duped” by

the fraud. Victim, Webster’s Third New International Dictionary (1961); Victim,

Oxford English Dictionary (Rev. 2024).

3 The majority gets closer to the correct definition. The majority recognizes

that individuals may qualify as victims without suffering pecuniary harm. But the

majority interprets “victim” to require some form of harm—whether pecuniary,

physical, dignitary, or to privacy.

Certainly, those harmed by crime are victims. But dictionaries, intuition, and

ordinary usage show that those targeted or tricked through fraud are also “victims,”

even if they do not suffer separate harm.

The majority gives no good reason for narrowing the definition of “victim.”

It retreats to the Guidelines commentary, which defines “victims” as those who

suffer physical or pecuniary harm or whose means of identification are “used.”

U.S.S.G. § 2B1.1 cmt. n. 1, n. 4(E). Based on that definition, the majority suggests

that the employees are victims only if they suffered demonstrable harm.

This approach is problematic. First, it’s inconsistent with our caselaw. We

have recognized that, “[as] commonly understood . . ., the term ‘victim’ includes

significantly more individuals than recognized in the [commentary].” Gonzalez-

Becerra, 784 F.3d at 519 n.5. We should enforce the Guidelines’ ordinary meaning,

not the Commission’s interpretive gloss on them.

Second, the majority gets the analysis backwards. “Before even considering”

the commentary, we are to exhaust “all” traditional interpretive tools. Kisor, 588

U.S. at 590. Dictionaries, intuition, and ordinary usage confirm that employees

4 whose email credentials are stolen are “victims.” The majority errs by “wav[ing]

the ambiguity flag” before meaningfully engaging with these interpretive tools. See

id. at 575.

To be sure, the majority cites two dictionary definitions that emphasize

“harm.” See Victim, Black’s Law Dictionary (12 ed. 2024). But other definitions

treat those targeted by crime or tricked by fraud as “victims.” To fulfill its duty to

find the “single, best meaning” of the Guidelines, Loper Bright Enters. v. Raimondo,

603 U.S. 369, 400 (2024), the majority must do more than cherry-pick a few

favorable definitions and ignore competing evidence, Kisor, 588 U.S. at 573–75.

Finally, the commentary doesn’t support the majority. The majority defines

“victims” as those harmed by crime, whether physically or psychologically. Yet,

under the commentary, victims include those who suffer physical and pecuniary

harm and those whose means of identification are used. U.S.S.G. § 2B1.1 cmt. n. 1,

n. 4(E). Not even the commentary is limited to those who suffer demonstrable harm.

So even if we could look to the commentary, it wouldn’t support the majority’s

narrow definition of “victim.”

Elevating the commentary over the plain meaning matters. Jettisoning the

plain meaning decreases Aloba’s recommended sentencing range by 12–16 months.

We should have enforced the plain meaning. On this issue, I respectfully dissent.

5 FILED USA v. Aloba, No. 22-50291 MAR 26 2025 MOLLY C. DWYER, CLERK DESAI, Circuit Judge, dissenting in part: U.S. COURT OF APPEALS

I respectfully dissent from Section 3 of the memorandum disposition. LASC

failed to identify pecuniary harm from Aloba’s conduct justifying loss and restitution

in the amount of $45,484.31. Thus, I would hold that the district court abused its

discretion and would instruct the district court to recalculate the loss and restitution

amount on remand.

Courts must order restitution to victims for pecuniary loss, see 18 U.S.C. §

3663A, and the Guidelines include sentencing enhancements for “loss” the

defendant causes. U.S.S.G. § 2B1.1(b)(1). Loss is defined as “pecuniary harm,”

which “is harm that is monetary or that otherwise is readily measurable in money

but does not include emotional distress, harm to reputation, or other non-economic

harm.” United States v. May, 706 F.3d 1209, 1212 (9th Cir. 2013) (cleaned up);

U.S.S.G. § 2B1.1(b)(1)(C)(iii).

An entity could show pecuniary harm if it spent money to address the

defendant’s conduct. See, e.g., United States v. Brock-Davis, 504 F.3d 991, 1000–01

(9th Cir. 2007) (affirming restitution for cleanup and remediation costs caused by

the defendant). An entity could also show pecuniary harm if it lost money because

of the defendant’s conduct. See, e.g., United States v. Peterson, 538 F.3d 1064, 1077–

78 (9th Cir. 2008) (affirming restitution for the Department of Housing and Urban

1 Development’s losses on loans it insured due to the defendants’ false mortgage

letters); United States v. Sablan, 92 F.3d 865, 870 (9th Cir. 1996) (affirming

restitution for a bank’s monetary losses on “administrative overhead and profit [that]

would have been paid to the bank by its normal customers” had the bank employees

not been repairing files damaged by the defendant). Here, LASC does not show that

it suffered pecuniary harm in the amount of the loss calculation by spending or losing

money because of defendant’s conduct.

Yet the district court calculated a loss and restitution amount of $45,484.31

for the estimated time LASC IT employees and desktop support staff spent

responding to Aloba’s attack. But LASC was already paying its employees’ wages

for this work. The majority’s holding that it was nevertheless reasonable for the

district court to calculate pecuniary harm because LASC “was deprived of valuable

employee time that would have been spent on other projects,” Maj. at 6, is

unsupported by the law and the record.

The majority relies on Sablan to support its holding but overlooks a key

distinction that unravels its reasoning. Maj. at 7. In Sablan, this court held it was

reasonable to calculate pecuniary harm based on a “bank’s standard hourly rate for

its employees’ time, computer time, and administrative overhead—the same rate that

the bank uses in charging paying customers.” 92 F.3d at 869–70. But the bank in

Sablan demonstrated that it suffered actual monetary loss because its employees had

2 to repair computer files instead of serving paying customers. See id. at 870 (“[H]ad

it not been necessary for the bank to devote its employees’ time and computer time

to making these repairs, the administrative overhead and profit would have been paid

to the bank by its normal customers.” (emphasis added)).

The majority insists that Sablan’s holding should extend here because this

court has “never treated businesses and government entities differently under the

Guidelines simply because the latter do not generate profits from charging

customers.” Maj. at 7. But the majority misses the mark. The key distinction is not

whether the entity is the government or a private business, or whether the entity

generates profits, but whether the entity has suffered pecuniary harm from the

defendant’s conduct.1 See 18 U.S.C. § 3663A; U.S.S.G. § 2B1.1(b)(1)(C)(iii).

Here, LASC did not spend money in the amount of $45,484.31 to address the

cybersecurity breach.2 And it also did not lose any money, like in Sablan. LASC

points only to evidence that IT employees performed their ordinary duties that they

were already paid to do: address cybersecurity issues and phishing attacks. Even the

1 Indeed, the majority’s public-private rationale is undermined by our precedent finding pecuniary harm when a government entity shows actual monetary loss. See Peterson, 538 F.3d at 1077–78. 2 The majority attempts to justify the district court’s loss and restitution calculation based on LASC’s payment of overtime to one IT employee. Maj. at 8. But the majority fails to explain how this could reasonably result in a loss and restitution amount of $45,484.31. Indeed, there is no evidence in the record that LASC suffered pecuniary harm amounting to $45,484.31 based on the payment of overtime to a single IT employee. 3 government concedes that “the LASC employees for whom restitution is sought

were personnel whose job functions entail LASC network security.” The majority

does not specify what “other projects” the LASC employees would have completed

but for the attack. Nor does the majority explain how the diversion of employee time

from these alleged hypothetical projects caused actual monetary loss or loss that is

readily measured in money. See U.S.S.G. § 2B1.1(b)(1)(C)(iii). The majority relies

on a vague quote from a witness that the attack impeded “their ability to do the work

that they were supposed to be doing.” Maj. at 6. This stray comment contradicts

LASC’s concession that its employees’ regular duties included addressing

cybersecurity issues; and, in any event, this lone statement is insufficient to establish

that LASC spent or lost $45,484.31. In short, LASC points to no evidence that its

employees’ time spent responding to the “phishing” attack caused it to suffer

pecuniary harm in the amount calculated by the district court. The district court’s

inclusion of $45,484.31 in employees’ wages was an abuse of discretion—one that

added a six-level sentencing enhancement to Aloba’s offense level. See U.S.S.G. §

2B1.1(b)(1).

Finally, by allowing restitution and a sentencing enhancement even when the

victim did not identify specific monetary loss from the defendant’s conduct, the

majority’s approach risks unintended consequences. Namely, the majority opens the

door for private and public entities alike to overstate and inflate requested restitution

4 without proving pecuniary harm. Entities may now seek restitution for wages and

employee salaries even if the employees continued performing their day-to-day tasks

and did not divert their attention from revenue-generating work or otherwise cause

their employer monetary loss. Section 3663A and the Guidelines do not justify

restitution and sentence enhancements for such speculative loss. I would hold that

the district court abused its discretion by including LASC employees’ wages in the

loss and restitution amount without any showing that LASC suffered pecuniary harm

totaling $45,484.31.

I respectfully dissent in part.