Document ID: s3://data.kl3m.ai/documents/govinfo/USCOURTS/USCOURTS-ca9-14-10283/USCOURTS-ca9-14-10283-0/pdf.json

Parties Involved:
Andrew B. Katakis
Appellee
United States of America
Appellant

Document Text:

FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA,

Plaintiff-Appellant,

v.

ANDREW B. KATAKIS,

Defendant-Appellee.

No. 14-10283

D.C. No.

2:11-cr-00511-WBS-2

OPINION

Appeal from the United States District Court

for the Eastern District of California

William B. Shubb, Senior District Judge, Presiding

Argued and Submitted

May 15, 2015—San Francisco, California

Filed August 31, 2015

Before: Marsha S. Berzon and N. Randy Smith, Circuit

Judges and Raner C. Collins,* Chief District Judge.

Opinion by Judge N.R. Smith

* The Honorable Raner C. Collins, Chief District Judge for the U.S.

District Court for the District of Arizona, sitting by designation.

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 1 of 25
2 UNITED STATES V. KATAKIS

SUMMARY**

Criminal Law

The panel affirmed the district court’s order granting

Andrew Katakis a judgment of acquittal after a jury convicted

him of obstruction of justice, in violation of 18 U.S.C.

§ 1519, in a case in which Katakis, after learning that federal

authorities had subpoenaed his bank records in connection

with an investigation into a scheme to rig bids at foreclosure

auctions, installed onto his home computer a program

designed to wipe hard drives clean of all information.

The panel affirmed because the evidence was insufficient

to show that Katakis actually deleted electronic records or

files, and because proving that Katakis moved emails from an

email client’s inbox to the deleted items folder does not

demonstrate Katakis actually concealed those emails within

the meaning of § 1519.

COUNSEL

Adam D. Chandler (argued), Attorney; William J. Baer,

Assistant Attorney General; Brent Snyder, Deputy Assistant

Attorney General; Anna Tryon Pletcher, Tai S. Milder, May

Lee Heye, Kelsey C. Linnett, Kristen C. Limarzi, and James

Joseph Fredricks, Attorneys, United States Department of

Justice, Antitrust Division, Washington, D.C., for PlaintiffAppellant.

** This summary constitutes no part of the opinion of the court. It has

been prepared by court staff for the convenience of the reader.

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 2 of 25
UNITED STATES V. KATAKIS 3

Elliot R. Peters (argued), Steven A. Hirsch, Jennifer A.

Huber, and Elizabeth K. McCloskey, Keker & Van Nest LLP,

San Francisco, California, for Defendant-Appellee.

OPINION

N.R. SMITH, Circuit Judge:

The Government appeals the district court’s order

granting Katakis’s Fed. R. Crim. P. 29 motion. The district

court vacated Katakis’s conviction and entered a judgment of

acquittal, holding that the evidence was insufficient to

support the jury’s verdict. The Government’s theory of

liability collapsed during trial, and the Government now

raises several alternative theories to try and rescue the

conviction. The evidence was insufficient to show that

Katakis actually deleted electronic records or files. Further,

proving Katakis moved emails from an email client’s inbox

to the deleted items folder does not demonstrate Katakis

actually concealed those emails within the meaning of

§ 1519. We affirm.

BACKGROUND

This case arises from an investigation by federal

authorities into a scheme to rig bids at foreclosure auctions in

2008 and 2009. By 2010, the investigation focused on

Andrew Katakis as one of the primary real estate investors

helming the conspiracy. On September 1, 2010, Katakis

received a letter from his bank informing him that

federal investigators had subpoenaed his bank records. 

On September 3, 2010, Katakis purchased, downloaded,

and installed a program called DriveScrubber 3

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 3 of 25
4 UNITED STATES V. KATAKIS

(“DriveScrubber”) onto his home computer, a Dell

(“Katakis’s Dell”). DriveScrubber is a program designed to

wipe hard drives clean of all information. DriveScrubber

may be used to overwrite all of the information in a hard

drive’s unallocated or “free” space. Free space is the portion

of the hard drive that is not allocated for the use of the

computer’s programs or operating system; items that are

deleted by a user may “fall” into the free space. There, the

deleted item is not actually removed from the computer right

away; the space it occupies on the hard drive has simply been

made available to be overwritten. Instead of waiting for

another file to overwrite the deleted file by chance,

DriveScrubber actively overwrites all data in the unallocated

space of a hard drive, permanently erasing any files that had

fallen into the free space. Once a file is overwritten by

DriveScrubber, it is impossible to retrieve it.

Katakis’s business partner and alleged co-conspirator,

Steve Swanger, kept two computers at their office: an ASUS

(“Swanger’s ASUS”), and a Dell (“Swanger’s Dell”). 

Swanger’s Dell was used primarily for emailing with Katakis,

and Swanger’s ASUS was used for general internet searching. 

On Saturday, September 4, 2010, Katakis summoned

Swanger to their business office. Katakis told Swanger that

he wanted to install a “scrubber program” on their computers

and that there was “nothing wrong with us cleaning our

computers.” Swanger observed Katakis use Swanger’s

ASUS and perform a search for emails involving members

of the bid-rigging conspiracy. At 4:40 pm, Katakis installed

DriveScrubber on the Swanger ASUS. This copy of

DriveScrubber was different from the one installed on

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 4 of 25
UNITED STATES V. KATAKIS 5

Katakis’s Dell.1 Swanger did not observe any deletions on

the ASUS; he only observed Katakis “clicking and moving

things around.”

Katakis then moved to Swanger’s Dell and installed

DriveScrubber at 4:47 pm. The Swanger Dell had 4,000

emails on it, as Swanger was not in the habit of regularly

deleting his emails. Swanger kept hard copies of some

important emails, because he feared Katakis might try and

wipe clean the hard drives some day. Swanger observed

Katakis checking boxes on various emails and unchecking

those emails that Katakis believed that Swanger needed. 

Katakis gave up sorting the emails after about five minutes

and pressed the delete key. After seeing that it would take a

long time for the emails to be deleted, Katakis went home. 

When he returned to the office on Monday, Swanger noticed

that almost all of the emails on his Dell had been deleted

from his email inbox.

At 5:37 pm on September 4, 2010, the same copy of

DriveScrubber that was installed on Katakis’s Dell was

installed on the office’s mail server (“GD Mail Server”). The

server managed all email sent or received in the office

through the Microsoft Outlook program. The GD Mail

Server was operated by a program called Exchange. Katakis

had the authority to install programs on the GD Mail Server

and knew that DriveScrubber had been installed on it.

1 Although the program installed on Katakis’s Dell and Swanger’s

ASUS was the same, the evidence indicated that two different copies were

used. The version of DriveScrubber installed on Swanger’s ASUS and

Swanger’s Dell was purchased using Swanger’s credit card.

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 5 of 25
6 UNITED STATES V. KATAKIS

The Government seized the four computers in the course

of its investigation into the bid-rigging scheme. When

examining Swanger’s Dell, the Government discovered ten

incriminating emails that implicated Katakis in the

conspiracy. Katakis was either a sender or recipient of all ten

emails. Swanger was also either the sender or recipient of all

ten emails. The emails were discovered in the deleted items

folder in Swanger’s email client. Metadata attached to the

emails showed that the emails had passed through the GD

Mail Server and that Katakis had received and opened all of

them. Special Agent Scott Medlin conducted a forensic

analysis of the other three computers. Because Katakis’s

Dell, Swanger’s ASUS, and the GD Mail Server were all part

of the email network shared with Swanger’s Dell, Medlin

expected to find traces of the ten emails on these computers. 

Medlin was unable to locate any trace of the ten incriminating

emails, but did not think that enough time had passed for all

traces of the emails to be removed by the gradual automatic

overwriting process, leading him to believe that Katakis had

destroyed them using DriveScrubber.

Based on the discrepancy between the presence of the ten

incriminating emails on Swanger’s Dell but not on the other

computers, the Government sought and obtained an

indictment charging Katakis with obstruction of justice, in

violation of 18 U.S.C. § 1519.2 The indictment alleged that

Katakis “deleted and caused others to delete electronic

records and documents. KATAKIS also installed and used

and caused others to use a software program that overwrote

2 Katakis was also charged with bid-rigging, in violation of 15 U.S.C.

§ 1, and conspiracy to commit mail fraud, in violation of 18 U.S.C.

§ 1349. The jury found Katakis guilty of bid-rigging. That conviction is

not before us.

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 6 of 25
UNITED STATES V. KATAKIS 7

deleted electronic records and documents so that they could

not be viewed or recovered.” Notably, the indictment failed

to charge attempt, thus committing the Government to prove

actual deletion.

The Government proceeded to trial on the theory that

Katakis ran the DriveScrubber program on his Dell,

Swanger’s ASUS, and the GD Mail Server, to erase all traces

of the ten incriminating emails. The Government’s key

witness was Medlin, who testified as an expert. Medlin

testified that Katakis “double-deleted” emails; that is, he

deleted them once from the mail client and then again when

he emptied the deleted items folder. After they were double

deleted, the emails fell into the free space, where Medlin

opined that they were irretrievably overwritten by

DriveScrubber.

Katakis called Don Vilfer as a rebuttal expert. Vilfer

testified that Medlin’s theory of what happened to doubledeleted emails was incorrect, based on how the Exchange

program on the GD Mail Server worked. According to

Vilfer, a double-deleted email would not fall into the free

space, as Medlin testified, but would remain within the

portion of the hard drive allocated for the Exchange database. 

The crux of Vilfer’s testimony was that, given how the

Exchange program operated, it would be impossible for

DriveScrubber to overwrite any double-deleted emails,

including the ten incriminating emails that were at the heart

of the Government’s case. Vilfer further noted that the

Exchange program itself removed double-deleted emails after

a certain period of time, usually fourteen days. Vilfer

testified that he was able to recover thousands of doubledeleted emails, but he could not find the ten incriminating

emails. Vilfer agreed with Medlin that it was suspicious that

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 7 of 25
8 UNITED STATES V. KATAKIS

there were no traces of the ten incriminating emails on any

computer other than Swanger’s Dell. However, he explained

that absence by opining that the ten incriminating emails

(including metadata) had been fabricated. The defense

sought to draw an inference that Swanger fabricated the ten

incriminating emails and the metadata indicating Katakis had

seen them in order to implicate Katakis.

In rebuttal, Medlin admitted that Vilfer’s testimony was

correct: it was impossible for DriveScrubber to have deleted

the ten incriminating emails. Medlin testified that his opinion

was unchanged, because DriveScrubber could have deleted

transmission logs associated with the ten incriminating

emails. Vilfer testified in response that deleting the

transmission logs would not have deleted the emails

themselves.

By the time of its closing argument, the Government’s

primary theory of the case had collapsed. In closing, the

Government offered two theories of liability to the jury. 

First, the Government argued a purely circumstantial case. 

The ten incriminating emails were present on Swanger’s Dell,

and both experts testified that they would have expected to

find them on the other computers. The only logical inference,

the Government reasoned, was that Katakis had somehow

deleted them. Second, the Government relied on Swanger’s

testimony for an alternative theory of liability. Under this

theory, DriveScrubber was only relevant to prove intent. If

the jury believed Swanger’s testimony that Katakis hit the

delete key and sent emails on Swanger’s Dell to the deleted

items folder, this was legally sufficient to convict Katakis of

obstruction of justice. The Government alluded to an

additional theory of liability in its rebuttal, arguing that

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 8 of 25
UNITED STATES V. KATAKIS 9

Katakis used DriveScrubber to delete remnants of the emails

(the transmission logs).

The jury convicted Katakis of obstruction of justice. 

Katakis filed a motion for judgment of acquittal, alleging,

among other things, that the evidence was insufficient to

convict him. The district court agreed, and, after carefully

evaluating each of the Government’s theories of liability and

finding them all insufficient to sustain a conviction for

obstruction of justice, vacated Katakis’s conviction and

entered a judgment of acquittal. The Government appeals.

DISCUSSION

We review de novo the district court’s order granting a

judgment of acquittal pursuant to Fed. R. Crim. P. 29. United

States v. Sanchez, 639 F.3d 1201, 1203 (9th Cir. 2011). Our

review “is governed by Jackson v. Virginia, which requires a

court of appeals to determine whether ‘after viewing the

evidence in the light most favorable to the prosecution, any

rational trier of fact could have found the essential elements

of the crime beyond a reasonable doubt.’” United States v.

Nevils, 598 F.3d 1158, 1163–64 (9th Cir. 2010) (en banc)

(citation omitted) (quoting Jackson v. Virginia, 443 U.S. 307,

319 (1979)). Nevils prescribes the structure of our inquiry:

“[f]irst, a reviewing court must consider the evidence

presented at trial in the light most favorable to the

prosecution.” Id. at 1164. “Second, . . . the reviewing court

must determine whether this evidence, so viewed, is adequate

to allow ‘any rational trier of fact to find the essential

elements of the crime beyond a reasonable doubt.’” Id.

(alterations omitted) (quoting Jackson, 443 U.S. at 319). 

“[T]he government does not need to rebut all reasonable

interpretations of the evidence that would establish the

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 9 of 25
10 UNITED STATES V. KATAKIS

defendant’s innocence, or ‘rule out every hypothesis except

that of guilt beyond a reasonable doubt.’” Id. (quoting

Jackson, 443 U.S. at 326). That said, “evidence is

insufficient to support a verdict where mere speculation,

rather than reasonable inference, supports the government’s

case, or where there is a ‘total failure of proof of a requisite

element.’” Id. at 1167 (citations and alterations omitted)

(quoting Briceno v. Scribner, 555 F.3d 1069, 1079 (9th Cir.

2009)).

Katakis was convicted of obstruction of justice, in

violation of 18 U.S.C. § 1519. That statute provides:

Whoever knowingly alters, destroys,

mutilates, conceals, covers up, falsifies, or

makes a false entry in any record, document,

or tangible object with the intent to impede,

obstruct, or influence the investigation or

proper administration of anymatter within the

jurisdiction of any department or agency of

the United States . . . or contemplation of any

such matter or case, shall be fined under this

title, imprisoned not more than 20 years, or

both.

18 U.S.C. § 1519. Section “1519 was intended to prohibit, in

particular, corporate document-shredding to hide evidence of

financial wrongdoing.” Yates v. United States, 135 S. Ct.

1074, 1081 (2015). In order to prove a violation of § 1519,

the Government must show that the defendant (1) knowingly

committed one of the enumerated acts in the statute, such as

destroying or concealing; (2) towards “any record, document,

or tangible object”; (3) with the intent to obstruct an actual or

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 10 of 25
UNITED STATES V. KATAKIS 11

contemplated investigation by the United States of a matter

within its jurisdiction.

We have only one question regarding the sufficiency of

the evidence before us: whether the Government carried its

burden to show actual destruction or concealment. There is

no dispute that there was sufficient evidence for a rational

juror to conclude that the Government satisfied the third

element, that Katakis intended that his actions would obstruct

the investigation into the bid-rigging scheme. A rational

juror also could have concluded that Katakis knew or

believed that his actions could destroy or conceal the ten

incriminating emails. However, the Government failed to

charge Katakis with attempted obstruction in the indictment. 

Therefore, in order to secure a conviction, the Government

was required to prove that Katakis actually destroyed or

concealed “electronic records and documents.”

In light of Medlin’s retraction, there was no evidence

upon which a reasonable juror could conclude that Katakis

used DriveScrubber to irretrievablyoverwrite (that is, destroy

or conceal) the ten incriminating emails from the free space

of any of the computers. The theory that the Government

presented in its case-in-chief cannot support Katakis’s

conviction. Nevertheless, the Government contends that the

district court erred, because there are three other theories of

liability that the jury could have credited that satisfy the

elements of the statute: (1) Katakis used DriveScrubber to

delete the transmission logs belonging to the ten

incriminating emails; (2) Katakis double deleted emails on

his Dell, Swanger’s ASUS, and the GD Mail Server; or

(3) Katakis single-deleted emails on Swanger’s Dell, moving

those emails from the inbox to the deleted items folder. For

the reasons set out below, we agree with the district court that

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 11 of 25
12 UNITED STATES V. KATAKIS

the evidence was insufficient to convict Katakis of

obstruction of justice on any of these theories.

A. DriveScrubber Theory

The first theory that the Government advances relies on

testimony given by Medlin during rebuttal to the effect that,

although Katakis could not have deleted the ten incriminating

emails themselves, he could have deleted transmissions logs

generated by the emails.3 Forced to retract his testimony that

the ten incriminating emails could have been deleted by

DriveScrubber, Medlin testified that he did not retract his

opinion that Katakis used DriveScrubber to destroyelectronic

records, because he likely used DriveScribber to overwrite

transmission logs generated by the emails.

Medlin testified that transmission logs are generated daily

by the Exchange system. These logs resided outside the

Exchange database (so they were separate from the emails

themselves), and would “remain” in the program for a period

of time before falling off into the free space to be made

available for the DriveScrubber program to overwrite. 

Medlin could not testify as to how long it took for the

transmission logs to fall into free space; he noted that there

was a default time programmed into the Exchange database

(although he did not recall what the default was), but that

time could be changed by the system administrator. On

3 The Government likely waived this theory by failing to present it to the

district court as part of its opposition to Katakis’s Rule 29 motion. See

United States v. Piazza, 647 F.3d 559, 565 (5th Cir. 2011) (holding that

government waived an argument it failed to present in its response to

defendant’s motion for new trial). However, Katakis has not asserted

waiver on appeal. Therefore, Katakis has “waive[d] waiver.” Tokatly v.

Ashcroft, 371 F.3d 613, 618 (9th Cir. 2004).

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 12 of 25
UNITED STATES V. KATAKIS 13

cross-examination, Medlin admitted that he did not perform

an investigation into whether a default time was even set on

the Exchange database. Medlin also testified that he did not

perform any investigation as to whether any user had entered

a command causing the Exchange database to “clean up” the

transmission logs and let them enter free space.

Although the Government is entitled to every reasonable

inference from the evidence, a conviction may not be based

on mere speculation. Nevils, 598 F.3d at 1167. “[A]

reasonable inference is one that is supported by a chain of

logic, rather than mere speculation dressed up in the guise of

evidence.” United States v. Del Toro-Barboza, 673 F.3d

1136, 1144 (9th Cir. 2012) (quotation marks and alteration

omitted) (quoting Juan H. v. Allen, 408 F.3d 1262, 1277 (9th

Cir. 2005)). The logical chain supporting the Government’s

theory is as follows: (1) Katakis downloaded and installed

DriveScrubber, which, along with Swanger’s testimony,

demonstrates his intent to destroy incriminating emails and

other electronic records; (2) DriveScrubber could only

destroy the emails if they were in the free space; (3) the

transmission logs enter the free space through one of two

ways, either at the default time or through user action;

(4) both agents testified that they expected to find email

remnants, including transmission logs, on the computers; and

(5) no email remnants were found. From this chain of logic,

the Government contends a reasonable juror could have

concluded that Katakis destroyed the logs using

DriveScrubber.

However, the Government’s chain of logic misses an

important link: there is no evidence whatsoever that the

transmission logs were made available, in any manner, for

DriveScrubber to overwrite. The Government invited the

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 13 of 25
14 UNITED STATES V. KATAKIS

jury to speculate as to whether the transmission logs entered

the free space; the Government’s own expert could not testify

that they ever did. The transmission logs theory was

developed entirely in rebuttal in an attempt to save the

Government’s case. Make no mistake, the Government’s

original plan failed. Indeed, the full theory presented here did

not crystallize as an argument until this appeal. The

Government did not argue in its closing that deletion of the

transmission logs could, under § 1519, constitute the

destruction of electronic records; instead, the Government

asserted in its rebuttal that the absence of the logs was

evidence DriveScrubber was run to delete the emails. In light

of the way that this case was tried, it is not surprising that the

Government’s transmission log theory was half-baked. 

Medlin admitted he never even investigated the possibility

that the transmission logs were removed to the free space

where they could have been deleted by DriveScrubber. In the

absence of that evidence, the jury was left to speculate not

only regarding how the transmission logs entered the free

space but if they ever did so. There was nothing preventing

the Government from havingMedlin investigate this question

and provide evidence, even circumstantial evidence, from

which the jury could make the desired inference. However,

that evidence was entirely lacking in this case.4

4 The Government’s failure to develop this theory may have led to

another deficiency. Section 1519 requires that the defendant act

knowingly. A defendant “is said to act knowingly if he is aware ‘that that

result is practically certain to follow from his conduct, whatever his desire

may be as to that result.’” United States v. Bailey, 444 U.S. 394, 404

(1980) (quoting United States v. U.S. Gypsum Co., 438 U.S. 422, 445

(1978)). “[T]he term ‘knowingly’ merely requires proof of knowledge of

the facts that constitute the offense.” Bryan v. United States, 524 U.S.

184, 193 (1998). The Government failed to provide any evidence that

Katakis knew that transmission logs, a category of electronic record

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 14 of 25
UNITED STATES V. KATAKIS 15

In the absence of that critical link in the logical chain of

inference, the evidence was not sufficient to convict Katakis

on this theory.

B. Double Deletion Theory

The Government’s second theory contends that a rational

juror could have found that Katakis double deleted emails on

all of the computers except Swanger’s Dell, and that, if he did

so with the requisite intent, he violated the statute. We shall

assume, without deciding, that double deletion would

constitute the requisite concealment or destruction element of

§ 1519. However, even with that assumption, no reasonable

juror could have found on this record that the Government

carried its burden to show that double deletion actually

occurred.

In this context, “double deletion” means that the

Government sought to first prove that Katakis pressed the

delete key after selecting emails in the inbox of the email

client, moving them to the deleted items folder or a recycling

bin. The Government’s theory asserted that Katakis then

deleted the emails a second time, with the intent that they

would fall into the free space of the hard drive so they could

be permanently overwritten by DriveScrubber. This theory

relies on two pieces of evidence, one direct and one

circumstantial. First, the Government points to direct

evidence that Swanger observed Katakis deleting emails. 

wholly separate and distinct from the emails, even existed. There is no

evidence that Katakis knowingly destroyed these records. It is not clear

to us that Katakis could have been aware that the destruction of the

transmission logs was “practically certain” to result from running

DriveScrubber.

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 15 of 25
16 UNITED STATES V. KATAKIS

Given that fact, and the evidence that Katakis installed

DriveScrubber, the Government contends that a rational juror

could have inferred that he had double deleted the emails to

make them available for DriveScrubber to overwrite. Second,

the Government argues that a rational juror could have

inferred double deletion from the fact that the ten

incriminating emails were not found on any computer other

than Swanger’s Dell.

There are again significant factual flaws in the

Government’s argument. First, Swanger never offered any

testimony that he observed Katakis do anything on Katakis’s

Dell or the GD Mail Server. With regard to Swanger’s

ASUS, Swanger declined to testify that he actually observed

Katakis deleting anything, much less double-deleting the

emails. Swanger testified only that he saw Katakis “clicking

and moving things around.” Swanger never testified that he

noticed that any files or emails were missing on his ASUS,

whereas he testified that many emails were missing from his

Dell.

In the absence of direct evidence of double deletion, the

Government relies on a chain of circumstantial inferences

that a rational juror would have to credit to find that Katakis

double deleted the emails. The rational juror would first have

to find that Katakis intended to destroy the ten incriminating

emails; as to that point, there was sufficient evidence—the

installation of DriveScrubber. But the evidence that he

carried out this intent comes from a single fact: that the ten

incriminating emails were not found on Katakis’s Dell,

Swanger’s ASUS, or the GD Mail Server. Both experts

testified that they expected to find the emails on those

computers. In their absence, the Government argues that a

rational juror would be entitled to conclude that Katakis

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 16 of 25
UNITED STATES V. KATAKIS 17

double deleted the emails. However, the Government never

provided the jury with any mechanism that would explain

how Katakis removed the emails from the three computers,

given that, as both experts ultimately agreed, double deletion

on the email client does not send an email to the free space,

where DriveScrubber could have destroyed it.

The Government’s theory is analogous to one that we

rejected in United States v. Lo, 231 F.3d 471 (9th Cir. 2000). 

In Lo, the defendant was charged with mail fraud, which

required the government to prove that the defendant actually

mailed a document in furtherance of the fraud scheme. Id. at

475. The only evidence that the government could muster to

show that the document was mailed was testimony from an

employee that a document Lo submitted would have been

mailed in the ordinary course of its business. Id. at 475–76. 

No one testified that they ever saw the document, no one

testified that they had sent it, there was no record it had

existed, and no one testified to receiving it. Id. at 476. We

found that this evidence was insufficient, and the inferences

that the jury was required to draw too “attenuated,” to support

a conviction for mail fraud. Id. at 477. In Lo, we were

particularly concerned that the evidence of fraudulent intent,

for which there was sufficient evidence, might lead a juror to

overlook the factual gaps in the government’s proof. Id.

We are faced with a similar concern here. In Lo, there

was no evidence that the document in question even existed,

id. at 476, while there were specific emails at issue in the

record here. But as in Lo, the evidence of the crime itself was

attenuated. There was no direct evidence in the record that

Katakis deleted the emails on his Dell, Swanger’s ASUS, or

the GD Mail Server, much less double-deleted them. The

evidence of Katakis’s intent was truly overwhelming, but the

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 17 of 25
18 UNITED STATES V. KATAKIS

Government’s attempts to prove that he actually performed

the acts of which he was accused, were incredibly weak. The

Government’s primarytheory, that Katakis double deleted the

emails and then used DriveScrubber to overwrite them,

completely collapsed. Had this theory been available to the

jury, the jurors would have been entitled to conclude that

Katakis double deleted the emails, because, according to

Medlin’s initial testimony, this step is the necessary predicate

for making the emails available for DriveScrubber to

overwrite. The Government conceded that it was impossible

for DriveScrubber to overwrite the emails, but only the

possibility that DriveScrubber overwrote the emailssupported

the inference of double deletion. Otherwise, both experts

testified that they would have expected to find the emails.

The Government now argues that the jury could have

inferred double deletion from the fact that the ten

incriminating emails could not be found on any of the three

computers, raising an inference that they were somehow

destroyed by a process that included double deletion. Under

Lo, this fact might be enough, if the Government had

provided any explanation that the jury could credit to explain

why the emails were not present. The Government was

entirely unable to explain (a) at trial, (b) in closing, (c) before

the district court, or now (d) on appeal, where the ten

incriminating emails, their traces, or their remnants went. 

Indeed, the one theory that the Government provided, that

DriveScrubber was used to overwrite the emails, was

discredited and withdrawn. At closing, the Government

relied on Medlin’s eleventh-hour theory that email remnants,

not the emails themselves, had been overwritten by

DriveScrubber. After the collapse of the primary

DriveScrubber theory, the Government was left with no

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 18 of 25
UNITED STATES V. KATAKIS 19

theory at all to explain what happened to the emails and why

neither expert could find any trace of them.5

The absence of the emails eliminates the logical inference

of double-deletion. Both experts testified that they expected

to find the emails if they were double deleted, but they also

explained that it was impossible for DriveScrubber to delete

them. As a result, double deletion cannot explain the absence

of the emails. That absence, far from corroborating the

Government’s theory, demonstrates a gaping hole in its logic. 

Without a mechanism to make double deletion a necessary

inference to the cause of the emails’ absence, a rational juror

could not conclude, beyond a reasonable doubt, that double

deletion occurred. In essence, there was no evidence to

support the Government’s theory, only speculation that relied

heavily on evidence of Katakis’s intent while absolving the

Government of its obligation to prove the act. In short, there

was no evidence, direct or circumstantial, that the emails in

question were in fact double deleted.

5 The only other potential theory disclosed by the record was that the

email client or Exchange automatically overwrote the emails after they

were double deleted. The Government does not press this theory on

appeal and it did not raise it to the jury at trial. Nevertheless, we conclude

that this possibility also does not raise an inference of double deletion and

it does not explain the absence of any trace of the ten emails. There was

no evidence at all of what the time frame for such automatic deletion

would have been, or even whether the automatic deletion feature was

activated on the relevant computers. Further, both experts testified that

they would have expected to find, at the very least, traces of the ten emails

on the computers in question. There was no evidence in the record that

the automatic deletion process, as opposed to a program like

DriveScrubber, would have eliminated all traces of the emails. 

Ultimately, there is no explanation in the record for why none of the ten

emails, or any trace of them, could not be found on any computer,

including the GD Mail Server.

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 19 of 25
20 UNITED STATES V. KATAKIS

We emphasize we are not requiring that the Government

disprove innocent explanations why the emails were not

present on any of the three computers. The Government is

correct that, following our decision in Nevils, authority

indicating that we may find the evidence insufficient to

convict where there is an innocent explanation for inculpatory

conduct, such as United States v. Delgado, 357 F.3d 1061,

1068 (9th Cir. 2004), is no longer viable. See Nevils,

598 F.3d at 1167 (overruling precedents that “strayed from

the test established in Jackson, and made ‘plausible’

exculpatory constructions” of the evidence). However, this

was not a case where a government theory competed with a

defense theory. Instead, the Government in this case

presented no theory at all to explain to the jury how the

emails were destroyed, a fact that was critical to the chain of

inferences required to find beyond a reasonable doubt that

Katakis double deleted the emails. In essence, the

Government again invited the jury to do what Nevils forbids:

engage in mere speculation on critical elements of proof. Id.

C. Single Deletion Theory

The Government’s final theory relies wholly on

Swanger’s testimony. Swanger testified that he observed

Katakis press the delete key after screening emails on

Swanger’s Dell. The Government argued in closing that all

the jury needed to find in order to convict Katakis was that he

pressed the delete key, thereby moving the emails from the

inbox on Swanger’s Dell to the deleted items folder.

The evidence was sufficient for the Government to prove

the fact underlying this legal theory; all the jury had to do was

credit Swanger’s testimony. “It is well established that the

uncorroborated testimony of a single witness may be

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 20 of 25
UNITED STATES V. KATAKIS 21

sufficient to sustain a conviction.” United States v. Dodge,

538 F.2d 770, 783 (8th Cir. 1976). Further, the ten

incriminating emails were discovered in the deleted items

folder of Swanger’s Dell, raising at least a colorable inference

that Katakis deleted them. The district court recognized that

the evidence was sufficient to prove the fact that Katakis

single deleted the emails. However, the district court held

that single deletion was not sufficient to give rise to liability

under §1519. We agree.

TheGovernment argues that moving the ten incriminating

emails from the inbox to the deleted items folder was

sufficient to “conceal” them within the meaning of § 1519. 

Once again, the Government is forced into this strained

position by the collapse of its original theory at trial. We

have been unable to locate any case law, and the Government

provides none, providing a definition for concealment under

§ 1519. “Conceal” is not a term of art, and it is unambiguous,

so we are obligated to give the term its plain meaning. See

Williams v. Paramo, 775 F.3d 1182, 1188 (9th Cir. 2015)

(“Because we assume that Congress means what it says in a

statute, the ‘plain meaning of a statute controls where that

meaning is unambiguous.’”) (quoting Khatib v. Cty. of

Orange, 639 F.3d 898, 902 (9th Cir. 2011) (en banc)). 

“Conceal” means “to prevent disclosure or recognition of;

avoid revelation of; refrain from revealing recognition of;

draw attention from; treat so as to be unnoticed; to place out

of sight; withdraw from being observed; shield from vision or

notice.” Webster’s Third New International Dictionary

(1993). The Government would have us adopt a definition of

“conceal” such that when a defendant removes something

from its “ordinary place of storage” making the thing “more

difficult to find,” he may be liable under § 1519. Indeed, the

Government would define concealment as “anything that

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 21 of 25
22 UNITED STATES V. KATAKIS

makes something harder for a casual onlooker to see, observe,

or notice.” The Government places special emphasis on the

fact that Katakis “dumped” the emails “in the digital

equivalent of a trash receptacle.”

The Government primarily relies on a Third Circuit case,

United States v. Lessner, 498 F.3d 185 (3d Cir. 2007), to

support its interpretation. In that case, federal agents arrived

at Lessner’s place of work as part of their investigation and

observed her placing an incriminating appointment book into

a trash can. Id. at 191. Lessner also removed a stack of files

from a locked filing cabinet and placed them on her desk. Id.

Lessner then contacted other individuals involved in her

scheme, and they destroyed the files. Id. On the basis of

these acts, the government charged Lessner with violating

18 U.S.C. § 1519. The Third Circuit held that placing the

incriminating appointment book in the trash can constituted

only “an attempt to ‘conceal’ and ‘cover up’ a ‘record.’”6Id.

at 196 n.5. Therefore, Lessner does not support the

Government’s position. Quite the opposite: removing the

incriminating appointment book from the place it would

normally be found and depositing it in a place that would

have made it somewhat harder for investigating agents to find

it was not sufficient to actually conceal the book.

6 The Third Circuit noted that “Lessner’s act of disposal—which seems

clearly to be a form of ‘destruction’—falls within the proscriptions of the

statute.” Lessner, 498 F.3d at 196 n.5. Given the language quoted above,

we take the Third Circuit’s language to mean that, had the appointment

book been taken out with the trash, then it would have eventually been

destroyed. It is nonsensical that the Third Circuit could have meant that

the incriminating appointment book could have been actually destroyed

simply by placing it a trash can.

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 22 of 25
UNITED STATES V. KATAKIS 23

The Government makes much of the fact that a jury could

find that Katakis placed the emails into the deleted items

folder, which the Government analogizes to a real world,

physical trash can. But a deleted items folder in an email

client is not like a trash can. Ordinarily, a trash can is

eventually emptied into a larger receptacle, the trash is

mingled with other garbage, and the garbage is then either

destroyed or placed in a location in which it is extremely

difficult to find any particular item. On Katakis’s computer,

in contrast, an email placed in the deleted items folder

remained in that folder unless a user took further action. As

Katakis persuasively argues, all that he accomplished by

single deleting the emails was moving them from one folder

to another. In essence, Katakis placed the ten incriminating

emails into an email folder that is by default not displayed to

the user. But the first place that any competent investigator

would look for emails that are not in the inbox is in the

deleted items folder. This degree of concealment is not

sufficient to satisfy § 1519.

In making this determination, we are cognizant of the

Government’s objection that focusing the inquiry too heavily

on the potential actions of the investigator may create a

“Catch-22.” It cannot be the case that, in order to prove

concealment, the item being concealed must never be found. 

However, there must be more than the de minimis standard

the Government urges. The Government’s approach would

all but eliminate the act requirement from the statute: so

much as taking an incriminating document from the surface

of a desk and placing it in a drawer, or putting another folder

on top of it, would expose a defendant to a twenty-year prison

sentence, so long as the defendant acted with even the faintest

hope that investigators might overlook the document. That

glimmer of intent is all that the Government would require

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 23 of 25
24 UNITED STATES V. KATAKIS

before subjecting a defendant to felony liability. We cannot

endorse the Government’s proposed “casual onlooker” test. 

Intent for an item not to be found is inherent in the act of

concealment. If that intent is satisfied, there is almost no act

with respect to a document that would not be criminal under

the Government’s proposed test.

In this case, we need not set out a comprehensive standard

for what it means to “conceal” a record under § 1519. Suffice

to say, contrary to the Government’s position, we cannot

ignore entirely the effort that an investigator would have to

expend to uncover a hidden document. In this case, removing

an email from one file folder and placing it in another was not

sufficient to actually conceal it. Under the Government’s

theory, a defendant would have concealed a document even

by lifting it from the surface of his desk with the intent to

place it somewhere else, because the defendant would have

removed the document from where investigators (or not even

an investigator, a casual onlooker) expected to find it. The

Government must show actual obstruction. It cannot show

that here, where it seized all three computers and the email

server in the course of its investigation and would have

discovered all single deleted emails within due course. 

Indeed, the Government is in essence arguing that it need not

undertake any investigation at all: if things are not as the

Government expects to find them, a defendant may be

exposed to a term of twenty years’ imprisonment. More is

needed, there must be some likelihood that the item will not

be found in the course of a cursory examination (without

using forensic tools) of a defendant’s computer.

We emphasize the limited nature of this holding. Our

conclusion that the evidence was insufficient to convict

Katakis for single deleting emails rests upon the unique

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 24 of 25
UNITED STATES V. KATAKIS 25

factual circumstance that pressing the delete key in this

context serves only to move an email from one file folder to

another. Section 1519 was drafted to prevent corporate

document shredding. The digital context threatens to expand

§ 1519 and its potentially harsh punishment well beyond its

intended reach. We are hesitant to expand the reach of

§ 1519, in part because the Government barely developed the

facts necessary to support the single-deletion theory at trial

and we are left without many of the facts that might prove

actual concealment. As with the other theories raised on

appeal, the single-deletion theory was an afterthought, a

comment the Government made at closing and now urges was

sufficient to warrant a potential twenty-year sentence. 

Accordingly, we cannot endorse the Government’s reading of

the statute. Actual concealment must do more than merely

inconvenience a reasonable investigator—theremust be some

likelihood that the item will not be found. That low bar is not

met in this case.

CONCLUSION

Accordingly, we affirm the district court’s order granting

Katakis a judgment of acquittal. Because we hold that the

evidence was insufficient to convict Katakis, we do not reach

his contentions that the Government’s proof created a fatal

variance with the indictment and that the Government

committed prosecutorial misconduct.

AFFIRMED.

 Case: 14-10283, 08/31/2015, ID: 9665339, DktEntry: 34-1, Page 25 of 25