24-1970-cv El Omari v. Dechert LLP, et al.

UNITED STATES COURT OF APPEALS FOR THE SECOND CIRCUIT SUMMARY ORDER RULINGS BY SUMMARY ORDER DO NOT HAVE PRECEDENTIAL EFFECT. CITATION TO A SUMMARY ORDER FILED ON OR AFTER JANUARY 1, 2007, IS PERMITTED AND IS GOVERNED BY FEDERAL RULE OF APPELLATE PROCEDURE 32.1 AND THIS COURT’S LOCAL RULE 32.1.1. WHEN CITING A SUMMARY ORDER IN A DOCUMENT FILED WITH THIS COURT, A PARTY MUST CITE EITHER THE FEDERAL APPENDIX OR AN ELECTRONIC DATABASE (WITH THE NOTATION “SUMMARY ORDER”). A PARTY CITING TO A SUMMARY ORDER MUST SERVE A COPY OF IT ON ANY PARTY NOT REPRESENTED BY COUNSEL.

At a stated term of the United States Court of Appeals for the Second Circuit, held at the Thurgood Marshall United States Courthouse, 40 Foley Square, in the City of New York, on the 9th day of June, two thousand twenty-five.

PRESENT: SARAH A. L. MERRIAM, MARIA ARAÚJO KAHN, Circuit Judges, RACHEL P. KOVNER, District Judge. * __________________________________________ OUSSAMA EL OMARI, Plaintiff-Appellant, v. 24-1970-cv DECHERT LLP; NICHOLAS PAUL DEL ROSSO; VITAL MANAGEMENT SERVICES, INC., Defendants-Appellees. __________________________________________ * Judge Rachel P. Kovner of the United States District Court for the Eastern District of New York, sitting by designation.

FOR PLAINTIFF-APPELLANT: SCOTT M. MOORE, Moore International Law PLLC, New York, NY.

FOR DEFENDANT-APPELLEE JOHN C. QUINN, Hecker Fink LLP, New York, DECHERT LLP: NY (Sean Hecker, Hecker Fink LLP, New York, NY; Carmen Iguina González, Katherine Epstein, James Piltch, Hecker Fink LLP, Washington, D.C., on the brief) FOR DEFENDANTS-APPELLEES SAMUEL ROSENTHAL, Nelson Mullins Riley & NICHOLAS PAUL DEL ROSSO; Scarborough LLP, Washington, D.C. VITAL MANAGEMENT SERVICES, INC.: Appeal from a judgment of the United States District Court for the Southern District of New York (Kaplan, J.).

UPON DUE CONSIDERATION, the judgment of the District Court entered on June 25, 2024, is AFFIRMED.

Plaintiff-appellant Oussama El Omari (“El Omari”) appeals from the District Court’s dismissal of his complaint. El Omari brought this action against Dechert LLP (“Dechert”) and two of its contractors, Nicholas Paul Del Rosso and Vital Management Services (the “VMS Defendants”), claiming that they directed a non-party to illegally access and copy his email accounts. He brought the following claims: (1) accessing a protected computer in violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030(a)(2)(C); (2) conspiracy to commit the same; and (3) common law conversion under North Carolina state law.

Dechert and the VMS Defendants filed motions to dismiss the complaint as time- barred and for failure to state a claim; the VMS Defendants also argued that the claims against them should be dismissed for lack of personal jurisdiction. The Magistrate Judge issued a Report and Recommendation (“R&R”) recommending that the District Court grant both motions to dismiss. El Omari timely objected to the R&R. The District Judge, in a one-page order, granted the motions to dismiss, stating that it had “reviewed the R&R” and El Omari’s objections, and that it “perceive[d] nothing contrary to law nor any clear error.”

App’x at 86.

On appeal, El Omari argues that the District Judge erred (1) procedurally, by failing to review de novo the portions of the R&R to which he objected and (2) substantively, by granting the motions to dismiss and failing to grant leave to amend his complaint. We assume the parties’ familiarity with the underlying facts, procedural history, and arguments on appeal, to which we refer only as necessary to explain our decision to affirm.

STANDARD OF REVIEW “We review de novo a district court’s decision to grant motions under Rule 12(b)(2) and 12(b)(6).” Charles Schwab Corp. v. Bank of Am. Corp., 883 F.3d 68, 81 (2d Cir. 2018).

“Although the statute of limitations is ordinarily an affirmative defense that must be raised in the answer, a statute of limitations defense may be decided on a Rule 12(b)(6) motion if the defense appears on the face of the complaint.” Ellul v. Congregation of Christian Bros., 774 F.3d 791, 798 n.12 (2d Cir. 2014).

DISCUSSION We agree with El Omari that the District Judge should have reviewed de novo the portions of the R&R to which El Omari properly objected. See 28 U.S.C. § 636(b)(1); Fed. R. Civ. P. 72(b)(3) (requiring de novo review of “any part of the magistrate judge’s disposition that has been properly objected to”). The District Judge erroneously applied clear error review and failed to address El Omari’s objections. See App’x at 86 (“[T]he Court perceives nothing contrary to law nor any clear error.”). El Omari lodged proper objections to at least some of the conclusions in the R&R—including on the issues of personal jurisdiction and the statute of limitations. See App’x at 69–74. Those objections, at least, were sufficient to trigger de novo review. Nevertheless, we conclude that the District Judge’s error was harmless in this case because, on de novo review, we affirm the District Court’s dismissal of El Omari’s claims.

I. Personal Jurisdiction Over Del Rosso and Vital Management Services El Omari’s claims against Del Rosso and Vital Management Services were properly dismissed for lack of personal jurisdiction. “To defeat a motion to dismiss for lack of personal jurisdiction, a plaintiff must make a prima facie showing that jurisdiction exists.

Such a showing entails making legally sufficient allegations of jurisdiction, including an averment of facts that, if credited, would suffice to establish jurisdiction over the defendant.” Charles Schwab Corp., 883 F.3d at 81 (internal quotation marks omitted) (alteration adopted). A plaintiff must demonstrate both that personal jurisdiction complies with the forum state’s long-arm statute as well as that the exercise of jurisdiction comports with constitutional due process. See id. at 82.

The provision of New York’s long-arm statute invoked by El Omari, N.Y. C.P.L.R. § 302(a)(1), provides that a court may exercise jurisdiction over a non-domiciliary “who in person or through an agent . . . transacts any business within the state or contracts anywhere to supply goods or services in the state” “[a]s to a cause of action arising from” that transaction. In his complaint, El Omari asserts that jurisdiction exists because Del Rosso directed the hack of El Omari’s email account; because Del Rosso did so at the behest of an attorney at Dechert LLP located in London for eventual use in litigation against El Omari in New York; and because, “[u]pon information and belief, Del Rosso made numerous trips to New York for personal meetings as part of his wrongful activities.”

App’x at 15.

These allegations are inadequate. First, the asserted agency relationship is insufficient. Section 302(a)(1) requires that a defendant himself have transacted business or contracted to supply goods or services in New York and that the claim arise out of that transaction. Though jurisdiction may lie when the defendant projects itself into New York through an agent, El Omari cites no authority at all suggesting the reverse—that a defendant’s putative status as an agent of a (London-based) entity with ties to New York permits a court to exercise jurisdiction over the defendant under Section 302(a)(1). The allegation that Del Rosso “reported” certain information to his London principal for the purpose of its being used in New York is also too insubstantial and attenuated an allegation to establish that Del Rosso “purposefully availed [himself] of the privileges and benefits of performing any services in” New York. Bank Brussels Lambert v. Fiddler Gonzalez & Rodriguez, 171 F.3d 779, 789 (2d Cir. 1999).

That leaves the allegation that “[u]pon information and belief, Del Rosso made numerous trips to New York for personal meetings as part of his wrongful activities.”

App’x at 15. This statement is doubly deficient. First, El Omari alleges no facts that would enable the Court to determine that his claims in this lawsuit “aris[e] from” any asserted meetings in New York. See Best Van Lines, Inc. v. Walker, 490 F.3d 239, 249 (2d Cir. 2007) (“[A] claim arises from a particular transaction when there is some articulable nexus between the business transacted and the cause of action sued upon, or when there is a substantial relationship between the transaction and the claim asserted.” (quotation marks and citation omitted) (alterations adopted)). El Omari does not allege what the meetings were for, who they were with, or what occurred in the meetings. Instead, El Omari pleads a legal conclusion—certain meetings in New York were connected to the scheme in the manner relevant for personal jurisdiction—without the facts needed to support it. See Jazini v. Nissan Motor Co., Ltd., 148 F.3d 181, 185 (2d Cir. 1998) (“[W]e are not bound to accept as true a legal conclusion couched as a factual allegation.” (quotation marks and citation omitted)).

Beyond this, El Omari’s allegation about relevant meetings is merely stated “upon information and belief.” This Court has rejected as speculative jurisdictional allegations predicated merely on the proponent’s belief. See Moussaoui v. Bank of Beirut & the Arab Countries, No. 23-7332, 2024 WL 4615732, at *2 (2d Cir. Oct. 30, 2024) (summary order) (citing Jazini, 148 F.3d at 185). Consistent with that principle, district courts in this Circuit routinely decline to find personal jurisdiction based on allegations made only “on information and belief.” See, e.g., Guo Jin v. EBI, Inc., No. 05-CV-04201 (NGG) (SMG), 2008 WL 896192 (E.D.N.Y. Mar. 31, 2008) (declining to credit allegation on “information and belief that Defendants have maintained an office, a bank account, property and/or agents in New York” (quotation marks omitted)); Fabius v. Gardère, No. 18-CV-06358 (WLK) (LB), 2021 WL 6797293, at *2 (E.D.N.Y. Sept. 22, 2021) (declining to credit allegations on information and belief that the defendant communicated with the plaintiff via telephone while the plaintiff was in New York, or that the defendant deposited money into the plaintiff’s New York-based bank account).

On appeal, El Omari makes a new allegation not contained in his complaint, but it does not change the analysis. He identifies testimony Del Rosso gave in a different litigation occurring in the U.K. that on the “date [Del Rosso] first delivered a secure drive,” he “was flying to New York.” Appellant’s Br. at 22. Like the previous allegation that Del Rosso made trips to New York, this allegation conspicuously lacks any facts suggesting either that the trip to New York or the “secure drive” referenced by Del Rosso had anything to do with this case.

Because El Omari’s allegations regarding Del Rosso are deficient, his allegations with respect to Vital Management Services fall short as well. El Omari pleads no facts with respect to Vital—Del Rosso’s company—beyond the actions of Del Rosso described above. The District Court thus properly dismissed El Omari’s claims against Del Rosso and Vital Management Services for lack of personal jurisdiction.

II. The CFAA El Omari failed to plausibly state a claim for violation of the CFAA against Dechert LLP. Generally speaking, the CFAA bars unauthorized computer access. See 18 U.S.C. § 1030(a). The statute provides a private right of action to “[a]ny person who suffers damage or loss by reason of a violation of” the CFAA, subject to certain qualifications, “against the violator to obtain compensatory damages and injunctive relief or other equitable relief.” 18 U.S.C. § 1030(g). We agree with the District Court that “[a] CFAA claim should be dismissed where plaintiffs provided no facts to establish that the defendant or any of its employees is affiliated with the hacks of plaintiff[’s] computers.” App’x at (quoting El Omari v. Buchanan, No. 20-CV-02601 (VM), 2021 WL 5889341, at *13 (S.D.N.Y. Dec. 10, 2021)); see Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (“A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” (emphasis added)).

El Omari fails to plausibly allege that Dechert is responsible for the hack of his email account. El Omari’s complaint begins by setting forth circumstantial evidence that his email account was hacked. He then asserts that the VMS Defendants paid an Indian organization called CyberRoot to hack into El Omari’s emails, relying in part on financial records showing that Vital transferred over $500,000 to CyberRoot in 2015 and 2016. He suggests that these payments must have been to hack his email because CyberRoot has engaged in phishing-based attacks similar to the one he suffered.

Whether or not these allegations would be enough to connect Del Rosso and Vital Management Services to the hack of his email account, El Omari’s claim against Dechert depends on the additional inferential leap that Vital acted at the direction of Dechert. To make this leap, El Omari baldly asserts that Dechert “either had actual knowledge, or must have strongly suspected the illegal hacking activities” because Vital paid CyberRoot $500,000 and those costs would have been passed onto Dechert, and because “[t]he subsequent sharing of the sensitive information gleaned from the stolen confidential emails with [a lawyer] at Dechert NY must have triggered strong suspicions” on the part of that lawyer “that El Omari’s sensitive litigation information was illegally obtained.” App’x at 25. But El Omari cites no facts suggesting that information from the hacked emails was passed along to Dechert. And while El Omari cites facts suggesting that Vital paid over $500,000 to CyberRoot over about seventeen months, the complaint is bereft of any support for a claim that these payments were connected to the alleged hack of El Omari or that the costs were passed along directly to Dechert. On the contrary, the complaint itself asserts that the alleged hacker’s database “is believed to . . . show that Del Rosso gave [the hacker] over 40 hacking target names,” not just El Omari’s. App’x at 23. El Omari’s allegations therefore fall far short of plausibly alleging Dechert’s responsibility for the hacking scheme.

III. Conversion Under North Carolina Law El Omari’s state-law conversion claim is barred by the statute of limitations. In North Carolina, conversion claims are subject to a three-year statute of limitations. See N.C. Gen. Stat. § 1-52(4); Honeycutt v. Weaver, 812 S.E.2d 859, 867 (N.C. Ct. App. 2018).

Under North Carolina law, a claim for conversion “accrues, and the statute of limitations begins to run, when the unauthorized assumption and exercise of ownership occurs—not when the plaintiff discovers the conversion.” Stratton v. Royal Bank of Can., 712 S.E.2d 221, 227 (N.C. Ct. App. 2011). The complaint alleges: “On or about January 12, 2017, but no later than February 19, 2017, . . . El Omari’s Microsoft Outlook email account, [email protected], was accessed without his authorization using his stolen login credentials. . . . Confidential and privileged email communications between El Omari and his undersigned attorney were copied from El Omari’s email account.” App’x at 21. This makes clear that “the unauthorized assumption and exercise of ownership” of El Omari’s digital information occurred in early 2017. Stratton, 712 S.E.2d at 227. That triggered the running of the limitations period, which expired in 2020. El Omari’s conversion claim is therefore untimely.

IV. Conclusion Having reviewed the record de novo, we conclude that the Magistrate Judge correctly determined that personal jurisdiction was lacking over Del Rosso and Vital Management Services; that El Omari failed to plausibly allege Dechert’s involvement in the CFAA claims; and that El Omari’s North Carolina conversion claim is barred by the statute of limitations. The District Judge’s error in failing to conduct a de novo review of El Omari’s properly raised objections is therefore harmless. See Maki v. New York, 597 F. App’x 36, 37 (2d Cir. 2015) (summary order) (“[E]ven assuming the court applied the incorrect standard of review, that error was harmless because our independent and de novo review of the entire record reveals that the magistrate judge’s recommendations were correct and [the plaintiff’s] objections were without merit.”). We therefore affirm the District Court’s dismissal of El Omari’s complaint.

* * * We have considered El Omari’s remaining arguments and find them to be without merit. For the foregoing reasons, the judgment of the District Court is AFFIRMED.

FOR THE COURT: Catherine O’Hagan Wolfe, Clerk of Court