Opinion ID: 2832197
Heading Depth: 2
Heading Rank: 1

Heading: DriveScrubber Theory

Text: The first theory that the Government advances relies on testimony given by Medlin during rebuttal to the effect that, although Katakis could not have deleted the ten incriminating emails themselves, he could have deleted transmissions logs generated by the emails.3 Forced to retract his testimony that the ten incriminating emails could have been deleted by DriveScrubber, Medlin testified that he did not retract his opinion that Katakis used DriveScrubber to destroy electronic records, because he likely used DriveScribber to overwrite transmission logs generated by the emails. Medlin testified that transmission logs are generated daily by the Exchange system. These logs resided outside the Exchange database (so they were separate from the emails themselves), and would “remain” in the program for a period of time before falling off into the free space to be made available for the DriveScrubber program to overwrite. Medlin could not testify as to how long it took for the transmission logs to fall into free space; he noted that there was a default time programmed into the Exchange database (although he did not recall what the default was), but that time could be changed by the system administrator. On 3 The Government likely waived this theory by failing to present it to the district court as part of its opposition to Katakis’s Rule 29 motion. See United States v. Piazza, 647 F.3d 559, 565 (5th Cir. 2011) (holding that government waived an argument it failed to present in its response to defendant’s motion for new trial). However, Katakis has not asserted waiver on appeal. Therefore, Katakis has “waive[d] waiver.” Tokatly v. Ashcroft, 371 F.3d 613, 618 (9th Cir. 2004). UNITED STATES V. KATAKIS 13 cross-examination, Medlin admitted that he did not perform an investigation into whether a default time was even set on the Exchange database. Medlin also testified that he did not perform any investigation as to whether any user had entered a command causing the Exchange database to “clean up” the transmission logs and let them enter free space. Although the Government is entitled to every reasonable inference from the evidence, a conviction may not be based on mere speculation. Nevils, 598 F.3d at 1167. “[A] reasonable inference is one that is supported by a chain of logic, rather than mere speculation dressed up in the guise of evidence.” United States v. Del Toro-Barboza, 673 F.3d 1136, 1144 (9th Cir. 2012) (quotation marks and alteration omitted) (quoting Juan H. v. Allen, 408 F.3d 1262, 1277 (9th Cir. 2005)). The logical chain supporting the Government’s theory is as follows: (1) Katakis downloaded and installed DriveScrubber, which, along with Swanger’s testimony, demonstrates his intent to destroy incriminating emails and other electronic records; (2) DriveScrubber could only destroy the emails if they were in the free space; (3) the transmission logs enter the free space through one of two ways, either at the default time or through user action; (4) both agents testified that they expected to find email remnants, including transmission logs, on the computers; and (5) no email remnants were found. From this chain of logic, the Government contends a reasonable juror could have concluded that Katakis destroyed the logs using DriveScrubber. However, the Government’s chain of logic misses an important link: there is no evidence whatsoever that the transmission logs were made available, in any manner, for DriveScrubber to overwrite. The Government invited the 14 UNITED STATES V. KATAKIS jury to speculate as to whether the transmission logs entered the free space; the Government’s own expert could not testify that they ever did. The transmission logs theory was developed entirely in rebuttal in an attempt to save the Government’s case. Make no mistake, the Government’s original plan failed. Indeed, the full theory presented here did not crystallize as an argument until this appeal. The Government did not argue in its closing that deletion of the transmission logs could, under § 1519, constitute the destruction of electronic records; instead, the Government asserted in its rebuttal that the absence of the logs was evidence DriveScrubber was run to delete the emails. In light of the way that this case was tried, it is not surprising that the Government’s transmission log theory was half-baked. Medlin admitted he never even investigated the possibility that the transmission logs were removed to the free space where they could have been deleted by DriveScrubber. In the absence of that evidence, the jury was left to speculate not only regarding how the transmission logs entered the free space but if they ever did so. There was nothing preventing the Government from having Medlin investigate this question and provide evidence, even circumstantial evidence, from which the jury could make the desired inference. However, that evidence was entirely lacking in this case.4 4 The Government’s failure to develop this theory may have led to another deficiency. Section 1519 requires that the defendant act knowingly. A defendant “is said to act knowingly if he is aware ‘that that result is practically certain to follow from his conduct, whatever his desire may be as to that result.’” United States v. Bailey, 444 U.S. 394, 404 (1980) (quoting United States v. U.S. Gypsum Co., 438 U.S. 422, 445 (1978)). “[T]he term ‘knowingly’ merely requires proof of knowledge of the facts that constitute the offense.” Bryan v. United States, 524 U.S. 184, 193 (1998). The Government failed to provide any evidence that Katakis knew that transmission logs, a category of electronic record UNITED STATES V. KATAKIS 15 In the absence of that critical link in the logical chain of inference, the evidence was not sufficient to convict Katakis on this theory.