[00:00:00] Speaker 04:
Second argument set for today, United States versus Aloba, case number 22-50291.

[00:00:10] Speaker 00:
Good morning, Your Honors.

[00:00:11] Speaker 00:
Can you see and hear me all right?

[00:00:14] Speaker 00:
Yes.

[00:00:15] Speaker 00:
Great.

[00:00:16] Speaker 00:
Thank you.

[00:00:18] Speaker 00:
I'm David Anicarico for the appellant, Oriomi Aloba.

[00:00:21] Speaker 00:
If I may, I'd like to reserve three minutes for rebuttal.

[00:00:27] Speaker 00:
Mr. Aloma.

[00:00:28] Speaker 00:
is entitled to a new sentencing hearing because his guidelines offense level was overstated.

[00:00:35] Speaker 00:
Turning first to the issue of the salaried employees and the erroneous enhancement for $45,000 in fictional loss to the Los Angeles Superior Court or LASD.

[00:00:46] Speaker 04:
Can I ask about that?

[00:00:48] Speaker 04:
Because

[00:00:50] Speaker 04:
I was intrigued by your argument.

[00:00:54] Speaker 04:
Your argument seems to be, look, these were salaried employees.

[00:00:56] Speaker 04:
They were going to be doing this job anyway.

[00:00:58] Speaker 04:
So you can't count that as loss.

[00:01:01] Speaker 04:
And yet, in other criminal statutes,

[00:01:04] Speaker 04:
there's case law to say the opposite, that how you respond, how the victim chooses to respond, whether they choose to use in-house work or outside work, either one can be considered loss.

[00:01:21] Speaker 04:
Do you have any cases that support your position that this wouldn't be an actual loss?

[00:01:32] Speaker 00:
Yes, Your Honor.

[00:01:33] Speaker 00:
In this court's Harper case, the court said, quote, loss is the amount of money the victim has actually ended up losing, not what it could have lost.

[00:01:43] Speaker 00:
And that's because loss under the guidelines is a distinct question from damage under the statute that Your Honor is referring to in the Middleton case.

[00:01:53] Speaker 00:
Loss is about harm to the pocketbook, the wallet.

[00:01:58] Speaker 00:
It's a specific kind of harm.

[00:02:00] Speaker 04:
Well, but why isn't that still loss to the pocketbook if they had to effectively expand resources?

[00:02:07] Speaker 04:
I mean, you would agree if they had to hire outside resources to respond to this phishing scam, that that would be loss, right?

[00:02:18] Speaker 00:
If they had hired outside contractors, Your Honor, and paid money,

[00:02:23] Speaker 00:
which they then lost, absolutely that would be lost.

[00:02:26] Speaker 00:
The difference here is that the salaried employees weren't paid anything extra.

[00:02:33] Speaker 00:
They only were diverted to perform different tasks.

[00:02:36] Speaker 00:
And there's no indication that diverting them to other tasks caused any financial loss to LASC.

[00:02:44] Speaker 00:
Their being working on other work didn't cause the court to lose any money.

[00:02:50] Speaker 00:
And again, Harper tells us that loss

[00:02:53] Speaker 00:
is the amount of money the victim actually ended up losing, not what it could have lost.

[00:02:58] Speaker 00:
Could have lost would be if they had used contractors.

[00:03:00] Speaker 00:
Here they didn't.

[00:03:02] Speaker 00:
And I think a very important point on that is that it's not like the government would have it as if he's escaping punishment because they used, their own employees were able to handle this matter instead of contractors.

[00:03:15] Speaker 00:
He's serving years in prison.

[00:03:17] Speaker 00:
He's just not subject to this one specific enhancement for loss.

[00:03:22] Speaker 00:
There are other ways that Mr. Aloba's actions were accounted for at sentencing, including the fact that this was a government agency that didn't have to expend extra resources by hiring contractors.

[00:03:34] Speaker 00:
They had their own personnel.

[00:03:35] Speaker 00:
He's not getting off scot-free because he's got the enhancements for misrepresenting himself as a government agency, the enhancement for the government being a victim.

[00:03:46] Speaker 00:
He also had an enhancement here for obtaining the personal information of others.

[00:03:50] Speaker 03:
But the definition of loss for purposes of this enhancement is the same as for the Mandatory Victims Restitution Act.

[00:03:59] Speaker 03:
Is that right?

[00:04:01] Speaker 00:
I don't know if it's the exact same definition offhand, Your Honor.

[00:04:05] Speaker 00:
I did want to make the point about restitution that, you know, restitution is about being made financially whole again.

[00:04:13] Speaker 00:
And the Los Angeles Superior Court here actually received a windfall.

[00:04:18] Speaker 00:
They spent no money.

[00:04:20] Speaker 00:
to remedy the harm and then appellant must pay them $45,000 in restitution.

[00:04:25] Speaker 00:
So we have an overlapping problem there.

[00:04:27] Speaker 03:
Well, I mean, I guess it seems kind of seems a little bit peculiar that on your theory, somebody who victimizes a for-profit business, I mean, that's sort of like in Sablon, they'd be able to say, well,

[00:04:40] Speaker 03:
You know, our employees who were responding to the cyber attack couldn't be engaged in money-making ventures and therefore that's our financial loss.

[00:04:50] Speaker 03:
But if you victimize a government agency or a nonprofit agency, they can't say that.

[00:04:55] Speaker 03:
And so it seems kind of peculiar that for-profit businesses get restitution, but nonprofits and the government don't.

[00:05:04] Speaker 00:
That's because they need to be made whole for what they lost, Your Honor.

[00:05:08] Speaker 00:
The for-profit bank in one case, that's Sablan and slip.net in the Middleton case, they actually lost money.

[00:05:18] Speaker 00:
And so they need to be made whole again.

[00:05:20] Speaker 04:
Well, why did they lose money?

[00:05:22] Speaker 04:
Because I thought it was the same analogy where they just had in-house employees, they chose to respond to it.

[00:05:29] Speaker 04:
Was there other money that they lost there?

[00:05:31] Speaker 00:
Because those people are engaged in a money making business.

[00:05:34] Speaker 00:
So when they're diverted to other tasks, their employer loses money, which wasn't the case at the Superior Court.

[00:05:42] Speaker 00:
And I'd like to just reiterate that it's not as if, you know, crimes against for-profit entities are meaningful and crimes against nonprofit entities or entities that have their own employees who can handle

[00:05:56] Speaker 00:
this kind of issue that he gets off scot-free.

[00:05:59] Speaker 00:
The fact that this was a government agency got him two separate additional enhancements here.

[00:06:06] Speaker 04:
Can I ask about the, maybe you're going to go into it, the second argument about the number of victims?

[00:06:15] Speaker 04:
Yes, Your Honor.

[00:06:15] Speaker 04:
So, when I read your brief, and I thought you had a pretty decent argument here, that it's use or, let's put it this way, under the definitions that are in the sentencing guidelines, not the sentencing guidelines themselves, but the commentary,

[00:06:37] Speaker 04:
You seem to have a pretty strong argument, at least as to the definition of a victim in the commentary.

[00:06:46] Speaker 04:
Are we bound by the definition?

[00:06:48] Speaker 04:
Because I think here in this case, it might matter.

[00:06:52] Speaker 04:
Because to me, if my information is stolen, I would consider myself to be a victim.

[00:06:58] Speaker 04:
The guidelines, the commentary wouldn't define me as a victim unless I actually had some financial loss.

[00:07:05] Speaker 04:
Are we bound by what the commentary says or can we use a plain language reading of the sentencing guideline and the definition of victim?

[00:07:17] Speaker 00:
Appellant's primary argument here is, and the one that I think carries the day, is that the court doesn't defer to the commentary unless the wording of the guideline itself is genuinely ambiguous.

[00:07:32] Speaker 00:
That's the standard from the Kaiser Supreme Court case.

[00:07:36] Speaker 04:
Has Loper changed that or made that a different standard?

[00:07:40] Speaker 00:
That's the Chevron Deference case.

[00:07:44] Speaker 00:
I don't know that any case has applied that

[00:07:46] Speaker 00:
to the guidelines, but the standard has become even less deferential.

[00:07:54] Speaker 04:
That seems to hurt your argument here, because it seems to me your best hook is the definitions and the commentary.

[00:08:00] Speaker 04:
And if we can't defer to those, and we think there's an inconsistency between how victim is normally understood and what the commentary definitions are.

[00:08:10] Speaker 00:
Maybe I haven't explained my point well.

[00:08:14] Speaker 00:
I don't want the court to defer to the commentary.

[00:08:17] Speaker 00:
I want the court to follow the ordinary meaning of victim in the plain text of the guideline.

[00:08:24] Speaker 00:
And a victim in the context of a financial fraud crime is someone who suffered financial loss.

[00:08:31] Speaker 00:
So then, as the government would have it, we need to defer to application note 4E, which attempts to expand the meaning to include anyone whose means of identification was used.

[00:08:44] Speaker 00:
But that conflicts with the plain meaning of the word victim in a financial fraud guideline.

[00:08:50] Speaker 00:
Now, Your Honor is correct that victims of identity theft are victims.

[00:08:54] Speaker 00:
They're not victims under 2B1.1, which is about financial loss.

[00:09:00] Speaker 00:
They're victims under the separate guideline 2B1.6, which applies specifically to identity theft crimes.

[00:09:10] Speaker 00:
And there you have a two-year mandatory term for that crime,

[00:09:15] Speaker 00:
So under that separate guideline, it actually specifically provides that you don't also slap the defendant with not only the mandatory two-year term, but also under a different guideline, a specific offense characteristic for use of someone's identity.

[00:09:32] Speaker 00:
He's not supposed to be doubly punished.

[00:09:34] Speaker 00:
And that's an additional reason why we don't consider victims under 2B1.1 and the plain meaning of it to include someone whose identification was used.

[00:09:45] Speaker 00:
When you're talking about financial fraud, victimhood is someone who lost money.

[00:09:53] Speaker 03:
But if we don't agree with you on that, I mean, if we think that a victim does include anyone whose means of identification was used, then do you think that there are more than 10 victims here?

[00:10:10] Speaker 00:
No, Your Honor.

[00:10:11] Speaker 00:
There are only six.

[00:10:14] Speaker 00:
And that's because there are six specific people who the government charged in the indictment as victims of identity theft.

[00:10:22] Speaker 00:
Only six, not 10 or more.

[00:10:24] Speaker 04:
Well, but that's not, I mean, the sentencing guidelines aren't limited.

[00:10:28] Speaker 04:
That seems to be a different argument.

[00:10:30] Speaker 04:
You're arguing that they didn't put that in the indictment, but I've never understood the sentencing guidelines to be limited to those that were put in the indictment.

[00:10:40] Speaker 00:
No, Your Honor, it's not so limited.

[00:10:41] Speaker 00:
And that's only one part of the argument here.

[00:10:44] Speaker 04:
Well, then respond to Judge Miller's question, because his question was, if we don't agree with you on your interpretation of victim as to this financial loss, do you agree that there were more than 10 victims?

[00:10:57] Speaker 03:
And I guess to be more specific, the district court said there were more than 500 employees.

[00:11:01] Speaker 03:
So why is that wrong?

[00:11:05] Speaker 00:
Yes, Your Honor.

[00:11:06] Speaker 00:
So the point that I started to make, but I need to explain further, is that there are six people who are in charge in the indictment.

[00:11:14] Speaker 00:
So the government, from the beginning, has only ever relied on there being six people who were victims of the crime of identity theft.

[00:11:22] Speaker 00:
And then at sentencing, the government argued that appellants' possession of dozens of email addresses of court employees made all of them victims, too.

[00:11:32] Speaker 04:
Well, for purposes of the enhancement.

[00:11:35] Speaker 00:
Right.

[00:11:35] Speaker 00:
And that's what we're addressing here.

[00:11:40] Speaker 00:
But possession of email addresses does not qualify for even the application notes commentary view of victimhood, which is someone whose identity was used.

[00:11:51] Speaker 00:
And possession is certainly not the same as use of identity.

[00:11:55] Speaker 04:
Is that all he had was email addresses?

[00:11:57] Speaker 04:
How many credit card numbers did he have of employees?

[00:12:01] Speaker 00:
I don't know that any of them were of employees.

[00:12:03] Speaker 00:
He was found to have a list of credit card numbers.

[00:12:06] Speaker 04:
So he was using the emails.

[00:12:09] Speaker 04:
He was really using well, no, I thought there was at least one he had to have a credit.

[00:12:12] Speaker 04:
I thought one, maybe I'm misunderstanding.

[00:12:14] Speaker 04:
I thought there was one, two that he tried to charge their credit cards.

[00:12:18] Speaker 04:
One was rejected and one was charged for $1,900 for actual loss.

[00:12:22] Speaker 00:
Yes, there was one actual victim of financial loss here due to identity theft.

[00:12:29] Speaker 04:
And then he had... But he had those credit cards.

[00:12:31] Speaker 04:
That's my question.

[00:12:32] Speaker 04:
How many... Oh, go ahead.

[00:12:35] Speaker 00:
They're not Los Angeles Superior Court employees' credit card numbers.

[00:12:38] Speaker 00:
Oh, I see.

[00:12:38] Speaker 00:
This was his goal, but his only actual attempt, his only success with getting someone's credit card number and using it was the one that your honor mentioned.

[00:12:46] Speaker 04:
But how many credit card numbers did he have?

[00:12:48] Speaker 04:
You're sort of suggesting, hey, he only had this list of emails.

[00:12:52] Speaker 04:
He had a list of credit card numbers.

[00:12:54] Speaker 04:
How many were they?

[00:12:56] Speaker 00:
My understanding is that they were hundreds and that they are not

[00:12:59] Speaker 00:
from this phishing scam.

[00:13:00] Speaker 00:
They were additional conduct that he committed that he uncharged conduct here.

[00:13:07] Speaker 00:
But the district court certainly erred by finding that all of the hundreds of members of the Superior Court were victims.

[00:13:17] Speaker 00:
That's plainly wrong because they're not victims under either of the definitions that we're using here, which is someone who suffered financial loss or someone whose means of identification was used.

[00:13:28] Speaker 00:
So for that reason alone, we have to remand to the Superior Court for a correct application of this guideline.

[00:13:36] Speaker 04:
But again... Do you want to reserve some time?

[00:13:41] Speaker 04:
You're down to about a minute and a half.

[00:13:43] Speaker 04:
Yes, thank you.

[00:13:44] Speaker 04:
Okay.

[00:13:44] Speaker 04:
Thank you.

[00:13:45] Speaker 04:
We'll hear from the government.

[00:13:54] Speaker 02:
Good morning.

[00:13:55] Speaker 02:
AUSA Kadar Bhatia for the United States.

[00:13:57] Speaker 02:
May it please the court.

[00:13:59] Speaker 02:
The district court here appropriately disposed of the defendant's varied arguments at sentencing and at resentencing.

[00:14:06] Speaker 02:
Notably, in the defendant's resentencing submission, he was represented by counsel.

[00:14:11] Speaker 02:
He identified five arguments in particular that he was raising again and he wanted the court to address.

[00:14:16] Speaker 02:
The court addressed each one of those arguments.

[00:14:19] Speaker 04:
Can we maybe hone in on these two arguments we've been discussing?

[00:14:23] Speaker 04:
I mean, there may be other questions, but for me, these are the key ones of whether there were more than 10 victims and how we analyze that.

[00:14:35] Speaker 04:
See, I don't think that he actually met the victim status.

[00:14:39] Speaker 04:
I don't think there were more than 10 if you look to the definitions

[00:14:43] Speaker 04:
in the commentary, used or financial loss.

[00:14:48] Speaker 04:
I guess I heard a slightly different argument than I understood it that financial loss is actually part of the actual definition of victim in the sentencing guideline itself.

[00:15:00] Speaker 04:
Can you respond to that?

[00:15:01] Speaker 02:
I can respond to that, Your Honor.

[00:15:02] Speaker 02:
So the guidelines themselves define victim in both the loss table and then there's the separate enhancement for 10 or more victims.

[00:15:13] Speaker 02:
In the initial reference to victim, for the general purposes of 2B1.1, it describes those who have suffered financial loss or physical harm.

[00:15:22] Speaker 02:
Specific to the number of victims enhancement, the definition is those who suffered financial harm, those who suffered physical harm,

[00:15:32] Speaker 02:
and those whose means of identification were used.

[00:15:36] Speaker 02:
The record here, the childhood.

[00:15:38] Speaker 04:
So means, and that is in the guidelines themselves or that's commentary?

[00:15:44] Speaker 04:
That's commentary.

[00:15:46] Speaker 04:
Both of those examples you gave me.

[00:15:48] Speaker 02:
Both of those examples.

[00:15:49] Speaker 02:
the guidelines themselves only describe it.

[00:15:51] Speaker 04:
What does the guidelines say?

[00:15:52] Speaker 04:
It just says victim.

[00:15:53] Speaker 02:
It just says victim.

[00:15:54] Speaker 04:
So, okay, so now I'm back to my question.

[00:15:56] Speaker 04:
Can we, I mean, if we're gonna, if we're only giving deference, Kaiser deference or Loper deference or whatever deference we're giving to the commentary,

[00:16:07] Speaker 04:
First of all, do we have a binding Ninth Circuit case that addresses the definition of victim under this statute, or under this guideline?

[00:16:16] Speaker 02:
I'll first address deference.

[00:16:17] Speaker 02:
Under deference, we think it's Kaiser deference.

[00:16:21] Speaker 02:
In Trumbull earlier this year, the Ninth Circuit reaffirmed that even after Loper, Kaiser was still a deference that applies in this setting.

[00:16:28] Speaker 02:
Ninth Circuit has said that?

[00:16:29] Speaker 02:
Ninth Circuit.

[00:16:30] Speaker 02:
That was from earlier this year.

[00:16:31] Speaker 02:
That was Trumbull.

[00:16:33] Speaker 02:
And as far as victims, I'm not aware of any cases, and I don't think that the defense cites to any that define victim on the plain text to mean really anything.

[00:16:46] Speaker 01:
The cases are all- Any authority to support your argument that the mere possession of email addresses or credit card numbers without the actual use constitutes a victim for purposes of the enhancement?

[00:17:00] Speaker 02:
Your Honor, I think Gurmuthi could support that conclusion.

[00:17:03] Speaker 02:
I think this court doesn't have to reach that decision.

[00:17:05] Speaker 02:
The trial testimony from Kenneth Bjork, who is the chief information officer for the Superior Court, was that there were 15.

[00:17:13] Speaker 01:
I'm interested to know if you have any authority.

[00:17:16] Speaker 01:
So I want to hear what you have to say about what case you think could be used to support this particular interpretation that you're urging.

[00:17:25] Speaker 02:
For mere possession, I think Gurmuthi supports that.

[00:17:29] Speaker 02:
I think the Merriam-Webster definition that we cited supports it.

[00:17:32] Speaker 04:
Well, and let's put a finer point on it.

[00:17:34] Speaker 04:
It seems to me there's a difference between possession of an email address and possession of a credit card number.

[00:17:41] Speaker 04:
I mean, would you say they're victims just because he has possession of their email address?

[00:17:46] Speaker 02:
Well, I think in the nature of this particular fraud scheme, where he harvested that information as part of the fraud scheme, he sent the phishing email.

[00:17:52] Speaker 01:
That is, in fact, the government's argument, correct?

[00:17:55] Speaker 01:
The way you get to the number is because you are looking at the possession of both the credit card numbers and email addresses.

[00:18:01] Speaker 02:
Not necessarily, Your Honor, no.

[00:18:02] Speaker 02:
So I think there's a different way.

[00:18:04] Speaker 02:
We cite this in our briefs.

[00:18:05] Speaker 02:
There's a different way to get there that is a more explicit use of those identities.

[00:18:09] Speaker 02:
So the testimony was that there were 15 to 20 superior court.

[00:18:13] Speaker 02:
I read that.

[00:18:14] Speaker 02:
You didn't raise that below.

[00:18:15] Speaker 02:
I didn't see.

[00:18:16] Speaker 02:
Did you?

[00:18:16] Speaker 02:
Your Honor, what we raised below was that there were many victims.

[00:18:19] Speaker 02:
We cited the fact that there were hundreds of victims.

[00:18:21] Speaker 02:
We cited the six that were in the indictment.

[00:18:22] Speaker 02:
I don't think we're precluded now.

[00:18:25] Speaker 02:
And this court's not precluded.

[00:18:26] Speaker 04:
Can you walk me through his testimony?

[00:18:30] Speaker 04:
I read it as a, you could assume that he had some knowledge, but I read it as a little bit off the cuff statement from him.

[00:18:37] Speaker 04:
How did he give any analysis for how he was saying there were 15 to 20 victims?

[00:18:41] Speaker 02:
Yes, your honor.

[00:18:41] Speaker 02:
So I think if, if the, uh, it was Kenneth York, who was the chief information officer, he was personally involved in the recovery and the cleanup effort here.

[00:18:49] Speaker 02:
He was one of the six employees who were counted in that lost number is having spent, you know, really all day, every day working on this in the early phase of the attack.

[00:18:58] Speaker 02:
And so he was really testifying from personal knowledge here.

[00:19:01] Speaker 02:
And I think it also flows from the nature of the fraud scheme.

[00:19:05] Speaker 02:
The defendant was sending, he initially was able to compromise one email.

[00:19:09] Speaker 02:
For a victim MP, he got that victim's email and login, their email and password.

[00:19:14] Speaker 02:
He then sent emails to other Los Angeles Superior Court employees that would harvest their emails and their passwords, and then he used those to send millions of emails.

[00:19:24] Speaker 02:
So I think it flows naturally from the fraud scheme where I think the end goal was undoubtedly to get credit card numbers and then to charge them as he did once and attempted to do, but he was trying to get the email accounts first to then use them to send the emails.

[00:19:37] Speaker 02:
So he's saying 15 to 20 represent the email accounts that he had.

[00:19:41] Speaker 02:
15 to 20 were the email accounts that were used to send yet more emails.

[00:19:47] Speaker 02:
That's part of the fraud.

[00:19:48] Speaker 04:
Ultimately, I think even the district court said there were only seven that were used.

[00:19:53] Speaker 04:
I don't believe that the district court had said that there were seven that were used.

[00:19:57] Speaker 04:
That's just the argument.

[00:19:58] Speaker 04:
I want to make this distinction between, and maybe it is a distinction without a difference, but to me, the credit card numbers

[00:20:06] Speaker 04:
that if he has a credit card number from this phishing scheme to me that in the common parlance would be a victim because if he has my credit card number

[00:20:17] Speaker 04:
I mean, presumably I would need to get some sort of reporting software or something like that to monitor my credit card.

[00:20:25] Speaker 04:
Or even if I had to cancel the credit card and get a new credit card, I would think that that would put me as a victim.

[00:20:31] Speaker 04:
How many credit card numbers did he have as opposed to email addresses from this phishing scheme?

[00:20:37] Speaker 04:
Because that's part of the problem is that it was like, oh, well, we found this list of 600.

[00:20:41] Speaker 02:
But how many came from this phishing scheme?

[00:20:43] Speaker 02:
So most of the counts that were charged with the indictment related to the Los Angeles Superior Court attack, some of the counts related to other modes of identity theft that the defendant was doing.

[00:20:54] Speaker 02:
So what the defendant had on his computer and in his email account were the 777 credit card numbers that belonged to real people.

[00:21:02] Speaker 02:
So that's in the record at 109.

[00:21:05] Speaker 04:
I thought they got winnowed down where

[00:21:08] Speaker 04:
Actual actual working ones.

[00:21:10] Speaker 04:
I don't know.

[00:21:11] Speaker 04:
We're 500.

[00:21:12] Speaker 02:
I think it actually I think it started higher.

[00:21:13] Speaker 02:
I think it started at 900 and went down to 700.

[00:21:15] Speaker 04:
Here's what I want to know.

[00:21:16] Speaker 04:
Can we find more than 10 credit card numbers that are traceable to this scheme?

[00:21:29] Speaker 02:
I believe the court, the relevant conduct to this scheme, which is what the guidelines capture, includes that 777.

[00:21:35] Speaker 02:
The defendant was doing this scheme in order to harvest these accounts.

[00:21:39] Speaker 02:
The scheme wasn't just limited to the superior court.

[00:21:42] Speaker 02:
And those are the accounts that he had.

[00:21:44] Speaker 02:
in the email account that he used as part of this scheme and on his own personal computer.

[00:21:47] Speaker 02:
So I think all of that counts as the relevant conduct.

[00:21:50] Speaker 02:
But I don't think the court has to find all of those 777.

[00:21:52] Speaker 02:
I think the 15 to 20 email accounts that were used to send the phishing emails is the narrowest way for the court to find them.

[00:22:04] Speaker 04:
I guess I'm a victim because you've used – okay, that makes sense.

[00:22:09] Speaker 04:
You've used my email.

[00:22:10] Speaker 04:
It's different than having my email address.

[00:22:11] Speaker 02:
You've actually used my email.

[00:22:13] Speaker 02:
It's really a down-the-middle definition of use, right?

[00:22:16] Speaker 02:
Their information, their emails were used as part of the scheme.

[00:22:19] Speaker 03:
Turning to the financial loss question, suppose that the Superior Court has a cyber response department, and their only job is to respond to cyber attacks.

[00:22:32] Speaker 03:
When the bell goes off, they slide down the pole and get in their cyber truck and drive to the scene.

[00:22:38] Speaker 03:
When there isn't a cyber attack, they're just sitting around playing bridge.

[00:22:41] Speaker 03:
Would their salaries count as loss for the time that they spent responding to a cyber attack?

[00:22:51] Speaker 02:
I'll address this in two parts.

[00:22:54] Speaker 02:
First, if there's a legal argument that those salaries could never be covered, we think there's no support for that legal argument at all.

[00:23:05] Speaker 02:
If it's a factual argument,

[00:23:07] Speaker 02:
then it probably depends on the facts, Your Honor.

[00:23:08] Speaker 02:
And I think the district court here was entitled to make a finding about how much of the time was spent on that.

[00:23:14] Speaker 02:
So to go back to your example, if it's a legal question, can it ever be constitute loss?

[00:23:21] Speaker 02:
I don't see any support for the notion that it can never support loss.

[00:23:24] Speaker 03:
I would have thought that the loss is the opportunity cost of what resources were diverted to this.

[00:23:33] Speaker 03:
What would the resources have been used for otherwise?

[00:23:35] Speaker 03:
And that's what you've lost is the opportunity cost.

[00:23:39] Speaker 03:
And in my hypothetical, the opportunity cost is zero because they wouldn't have been doing anything.

[00:23:43] Speaker 03:
So why would there be any loss there?

[00:23:48] Speaker 02:
I think in this case, these weren't people devoted specifically to cyber intrusions.

[00:23:52] Speaker 02:
These were general IT support staff who were diverted from what they were doing to being diverted to doing this.

[00:23:58] Speaker 03:
So in that respect, this case is different from the hypothetical.

[00:24:01] Speaker 03:
But in the hypothetical, if they really wouldn't have been doing anything else, what is your argument for how there could be loss?

[00:24:10] Speaker 02:
I think it would probably have to do with the opportunity cost.

[00:24:12] Speaker 02:
So what else they would be doing if they were really doing nothing else?

[00:24:17] Speaker 02:
If they were only devoted to preventing this particular defendant's cyber attack, then I think

[00:24:24] Speaker 02:
It's possible.

[00:24:25] Speaker 03:
But I think this court's case is quite different.

[00:24:27] Speaker 03:
Then in the real case, the case here, if you want to say that it's different, doesn't there need to be some evidence of what they would have been doing?

[00:24:38] Speaker 03:
And in particular, of what the financial value to the victim of what they would have been doing was?

[00:24:45] Speaker 03:
Because otherwise, I don't see how there could be a finding that the court suffered financial loss unless

[00:24:52] Speaker 03:
they would have been doing something that had some financial value.

[00:24:55] Speaker 02:
Well, Your Honor, I think the record, and this is in Kenneth Bjork's testimony that's in the supplemental excerpt of record, it really goes through how much of a catastrophic attack this was.

[00:25:04] Speaker 02:
I think it's easy to imagine.

[00:25:06] Speaker 02:
There's a court system right above us right now.

[00:25:10] Speaker 02:
Everyone's emails were compromised.

[00:25:11] Speaker 02:
People didn't know what to expect.

[00:25:12] Speaker 02:
There were emails being sent from employees' emails to other employees, from other employees to the whole world.

[00:25:17] Speaker 02:
There were millions of emails sent.

[00:25:19] Speaker 02:
So it really did divert the six employees' resources.

[00:25:23] Speaker 02:
to remediate this fraud.

[00:25:25] Speaker 02:
They had to contact employees.

[00:25:27] Speaker 02:
They had to contact other people in the court.

[00:25:29] Speaker 02:
They had to reformat the computers.

[00:25:32] Speaker 02:
So the loss is really divided into the six pools.

[00:25:35] Speaker 02:
There's the two pools.

[00:25:37] Speaker 02:
One is for the six employees who spent really in the initial phase all day, every day working on this fraud, were working to remediate the fraud.

[00:25:43] Speaker 02:
The other bucket is for the IT staff who were specifically doing this.

[00:25:49] Speaker 02:
So they had to re-image the laptops.

[00:25:51] Speaker 02:
They had to find the laptops.

[00:25:52] Speaker 02:
They had to interface with the employees.

[00:25:53] Speaker 02:
And that was really a conservative estimate of how much time they spent and the lowest rate for any of them.

[00:25:59] Speaker 03:
Right.

[00:25:59] Speaker 03:
But I guess what I'm asking is, what's the evidence of the productive activity that they would otherwise have been engaged in?

[00:26:07] Speaker 03:
I mean, I think everybody agrees they spent a lot of time on it.

[00:26:10] Speaker 03:
But the loss is not that time, because they were getting paid for that time anyway.

[00:26:17] Speaker 03:
You know, we would have had this great new system, but they weren't able to develop the new system because they were busy responding to the cyber attacks.

[00:26:25] Speaker 03:
So what is the evidence of what they would have done otherwise?

[00:26:29] Speaker 02:
I don't think the case law requires that showing of what they would have done otherwise.

[00:26:33] Speaker 02:
I think based on the testimony, it's fair that they would have done the other IT work of the court, which is making improvements or doing day-to-day responsibilities.

[00:26:41] Speaker 02:
Instead of doing those, they were doing this.

[00:26:43] Speaker 02:
I think under Middleton and SABLA in both Ninth Circuit cases,

[00:26:47] Speaker 02:
The law doesn't require such an exacting analysis.

[00:26:49] Speaker 02:
It's a fair estimate of the laws.

[00:26:51] Speaker 04:
I'd like you to address why Middleton should apply here.

[00:26:53] Speaker 04:
I mean, is it because it covers the same?

[00:26:56] Speaker 04:
I mean, we're not bound by Middleton, are we, in context of this particular case?

[00:27:04] Speaker 04:
I mean, it provides a helpful analogy.

[00:27:07] Speaker 04:
Why should we adopt it?

[00:27:09] Speaker 02:
I think Middleton is helpful because it shows it doesn't matter if the court takes contractors or salaried employees, but it's devoting specific resources to this that aren't going to other things, and a fair estimate of the expenditures that it's facing are the salaries of those individuals.

[00:27:26] Speaker 02:
Here the testimony took an incredibly conservative estimate.

[00:27:29] Speaker 02:
It took the lowest rate for any of them.

[00:27:31] Speaker 02:
It assumed

[00:27:32] Speaker 02:
a little bit less time than they would have done.

[00:27:34] Speaker 02:
I think it was then a deduction of 25%.

[00:27:36] Speaker 02:
And so I think Middleton's a helpful guide to what's lost.

[00:27:41] Speaker 04:
Are there any cases that have required this sort of opportunity loss?

[00:27:45] Speaker 04:
Because it's a question that I had in the case as well.

[00:27:48] Speaker 04:
And I'm wondering, I mean, Middleton seemed persuasive to me at the end of the day.

[00:27:52] Speaker 04:
But are there cases that do require this opportunity cost to be shown?

[00:27:58] Speaker 02:
No, Your Honor.

[00:27:59] Speaker 02:
And I think actually the opposite.

[00:28:00] Speaker 02:
In Sablan, the court said that the loss could include not just the wages that were spent, but also the overhead and the lost profit for employees that were working on this.

[00:28:12] Speaker 02:
So the court didn't...

[00:28:13] Speaker 03:
Which wouldn't apply.

[00:28:15] Speaker 03:
Because in Sablin, it was a bank, I think.

[00:28:20] Speaker 03:
The bank was having these people do paying work for clients.

[00:28:27] Speaker 03:
So there, it was fairly easy to calculate, well, if they hadn't been doing this, they would have been billed out to clients at such and such an hourly rate.

[00:28:34] Speaker 03:
So that doesn't seem to help you here, where you aren't able to point to

[00:28:40] Speaker 03:
the productive thing that the people would have been doing.

[00:28:42] Speaker 02:
I think Sablan supports the notion that it doesn't have to be the pure, it doesn't have to be the narrowest definition of loss.

[00:28:51] Speaker 02:
It can be the fair estimate of what the victim lost as a result.

[00:28:54] Speaker 02:
In that case, Sablan, it was because they built up their time.

[00:28:57] Speaker 02:
But here, I think a fair estimate of that loss is the time that the court had to spend devoted purely to this attack when those individuals, those employees could have been doing the other important busy work of the court system.

[00:29:11] Speaker 04:
Okay.

[00:29:12] Speaker 04:
I think we have your argument.

[00:29:13] Speaker 04:
Thank you very much.

[00:29:14] Speaker 04:
We'll give time for rebuttal.

[00:29:17] Speaker 00:
Thank you, Your Honors.

[00:29:19] Speaker 00:
Turning to the issue of 10 or more victims, I just want to reiterate very briefly that our first argument is that the guideline itself says 10 or more victims.

[00:29:31] Speaker 00:
It doesn't define victims, and so you turn to the commentary

[00:29:37] Speaker 00:
if only if that victim word is genuinely ambiguous.

[00:29:42] Speaker 00:
And here there is no genuine ambiguity under Kaiser because Kaiser tells us to apply the ordinary rules of statutory construction.

[00:29:51] Speaker 00:
And one of those is that words must be read in their context.

[00:29:55] Speaker 00:
And here the context is financial fraud.

[00:29:58] Speaker 04:
But just to be clear, you're saying financial fraud only comes in through the context.

[00:30:02] Speaker 04:
It's not actually

[00:30:04] Speaker 04:
in the text that the victim has to have suffered financial fraud.

[00:30:08] Speaker 00:
That's right.

[00:30:09] Speaker 00:
When we're reading the plain text, we look to the context.

[00:30:14] Speaker 00:
This rule is a statutory construction that Keiser wants us to apply before deferring to commentary.

[00:30:18] Speaker 00:
But passing on to the next issue of the number of victims of identity theft, if we do apply the commentary,

[00:30:27] Speaker 00:
All the government can point to is this one stray piece of uncertain, off-the-cuff testimony that it never relied on at the sentencing.

[00:30:37] Speaker 00:
He said, it's a rough number, you know, it was... Has that been waived?

[00:30:40] Speaker 04:
Let me ask you, sorry, but has that been waived because they didn't rely on it at the sentencing?

[00:30:47] Speaker 04:
Can we still look to it as something in the record?

[00:30:50] Speaker 00:
It has been waived and secondarily,

[00:30:53] Speaker 00:
This isn't enough to carry the government's burden at this point because the government didn't rely on its sentencing.

[00:31:00] Speaker 00:
The court didn't find it.

[00:31:02] Speaker 00:
It's a stray remark.

[00:31:03] Speaker 00:
The court never found that this was reliable testimony.

[00:31:06] Speaker 00:
The court instead said it's all the hundreds of employees of the Superior Court, which is plainly incorrect.

[00:31:12] Speaker 00:
And itself requires remand for the court to make factual findings in the first place if the government is going to rely on this one admittedly uncertain piece of testimony.

[00:31:22] Speaker 00:
So this court can't find that the government has met its burden based on that.

[00:31:27] Speaker 00:
And then possession of these credit card numbers has not been linked to appellant's conduct in this case.

[00:31:36] Speaker 00:
These credit card numbers were not LA Superior Court employee numbers.

[00:31:39] Speaker 00:
And his possession of more email addresses than he used doesn't make them victims even under the commentary that I don't want the court to apply.

[00:31:49] Speaker 00:
Even under that note 4E that says it's a means of identity used, he didn't use them by virtue of possessing them.

[00:31:57] Speaker 04:
okay thank you counsel uh... we appreciate both counsel's argument in this case and the case is now submitted