United States v. Katakis

21 F. Supp. 3d 1081, 2014 WL 1884213, 113 A.F.T.R.2d (RIA) 1998, 2014 U.S. Dist. LEXIS 64689

• Court: District Court, E.D. California
• Decided: May 9, 2014
• Docket: No. 2:11-511 WBS
• Status: Published

Opinion

ORDER RE: MOTION FOR JUDGMENT OF ACQUITTAL ON COUNT THREE

WILLIAM B. SHUBB, District Judge.

In the Superseding Indictment, the government charged defendant Andrew Ka-takis with violation of the Sherman Antitrust Act, 15 U.S.C. § 1; conspiracy to commit mail fraud, 18 U.S.C. § 1349; and obstruction of justice, 18 U.S.C. § 1519. After a twenty-three-day jury trial, the jury found Katakis guilty of the Sherman Antitrust and obstruction of justice charges but was unable to reach a verdict on the conspiracy to commit mail fraud charge. (Docket No. 277.) Pursuant to Federal Rule of Criminal Procedure 29, Katakis seeks a judgment of acquittal on the Third Count for obstruction of justice.

The Superseding Indictment charged and the evidence at trial established that the government began an investigation in 2009 of anti-competitive conspiracies between Katakis and other purchasers at public foreclosure auctions in San Joaquin County, California. As part of that investigation, the government subpoenaed bank records for Katakis and his company from Oak Valley Community Bank on August 27, 2010. In response to the subpoena, the bank sent Katakis a letter on September 1, 2010 informing him of the subpoena and providing him with a copy of it. The Superseding Indictment charged that Ka-takis violated § 1519 “[i]n or about September 2010” when he “deleted and caused others to delete electronic records and documents” and “installed and used and caused others to install and use a software program that overwrote deleted electronic records and documents so that they could not be viewed or recovered.” (Docket No. 136 at 8:27-9:5.)

In its case-in-chief, the government primarily, if not exclusively, pursued the obstruction of justice charge by seeking to establish that Katakis purchased and ran a program called DriveScrubber 3 (“DriveS-crubber”) on at least four computers and the company mail server shortly after he received a copy of the subpoena. According to the initial testimony from the government’s expert, the program successfully deleted emails on Katakis’s Dell computer, Steve Swanger’s Asus computer, and the company mail server. To rebut this evidence, Katakis offered expert testimony that discredited the testimony from the government’s expert. Katakis timely moved for a judgment of acquittal pursuant to Rule 29(b) and, during argument, the government indicated it would pursue the obstruction of justice charge based on Katakis’s alleged manual deletion of emails independent of running DriveScrubber.

As provided for in Rule 29(b), the court reserved ruling on the motion until after the jury returned a verdict. See Fed. R.Crim.P. 29(b) (“The court may reserve decision on the motion, proceed with the trial (where the motion is made before the close of all the evidence), submit the case to the jury, and decide the motion either before the jury returns a verdict or after it returns a verdict of guilty or is discharged without having returned a verdict.”)- Because the jury returned a verdict of guilty against Katakis on the obstruction of justice charge, the court will now address his motion for acquittal.

Pursuant to Rule 29(a), “the court on the defendant’s motion must enter a judgment of acquittal of any offense for which the evidence is insufficient to sustain a conviction.” “A motion for Judgment of Acquittal is reviewed on a sufficiency-of-the-evidence standard.” United States v. Graf, 610 F.3d 1148, 1166 (9th Cir.2010) (quoting United States v. Stoddard, 150 F.3d 1140, 1144 (9th Cir.1998)). “Under that standard, evidence supports a conviction, if, viewed in the light most favorable to the government, it would allow any rational trier of fact to find the essential elements of the crime beyond a reasonable doubt.” Id. (quoting Stoddard, 150 F.3d at 1144).

For the jury to have found Katakis guilty of obstruction of justice, it had to find that the government proved each of the following elements beyond a reasonable doubt:

that defendant Katakis knowingly altered, destroyed, or concealed electronic records or documents; [2] that defendant Katakis acted with the intent to impede, obstruct, or influence an investigation that he either knew of or contemplated; and [3] that the investigation was about a matter by or within the jurisdiction of the United States Department of Justice or Federal Bureau of Investigation.

(Jury Instruction No. 20 (Docket No. 268)); see also 18 U.S.C. § 1519 (“Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.”).¹ The Superseding Indictment charged that Katakis violated § 1519 and did not charge him with attempt. Under the first element, the government thus had to show that Katakis destroyed or concealed electronic documents or records, not merely that he attempted or even intended to do so.

The government’s theory in support of the obstruction of justice charge focused on ten Microsoft Outlook emails primarily between Katakis and Swanger sent between September 9, 2008 and July 20, 2009. (Tr. 2407:15-17, 2409:9-11, 2414:11-18; Gov’t’s Exs. 112, 141, 142, 145, 150, 157, 166, 168, 172, 175.) The government established that it was unable to find any of the ten emails on Katakis’s Dell computer, Swanger’s Asus computer, or the mail server. (Tr.- 2417:23-2418:4.) All ten emails were found, however, in the deleted items bin on Swanger’s Dell computer. (Tr. 2418:5-10.) The government now argues that the jury’s verdict can be upheld based on one of three theories: (1) Katakis deleted the ten emails on his Dell computer, Swanger’s Asus computer, and the mail server and then overwrote them using Dri-veScrubber; (2) Katakis manually deleted the ten emails on his Dell computer, Swan-ger’s Asus computer, and the mail server; or (3) Katakis manually moved the ten emails to the deleted items folder in Swan-ger’s Dell computer. The court has no doubt that the government initially intended to pursue the obstruction of justice charge based solely on the first theory, but resorted to the second and third theories after the first theory failed. In its closing argument, the government told the jury: “All you have to do is find that Andrew Katakis hit the delete button. That’s it. It’s that simple.” (Tr. 3240:5-7.)

1. DriveScrubber

The government offered sufficient evidence for a jury to find that Katakis purchased DriveScrubber on September 3, 2010 and that he installed and ran it on his Dell computer on September 3, on Swan-ger’s Asus and Dell computers and the mail server on September 4, and on another computer on September 15. (See Tr. 2449:22-2456:1.) The undisputed evidence at trial was that DriveScrubber overwrites and therefore permanently deletes files on the free space of a computer.

To prove that Katakis used DriveScrub-ber to overwrite the emails, the government offered the testimony of FBI Special Agent/Computer Forensic Examiner Scott Medlin. Agent Medlin opined that the ten emails were no longer on Katakis’s Dell computer, Swanger’s Asus computer, or the mail server because they had been double-deleted and then overwritten by DriveScrubber. Agent Medlin explained that this could occur if a user, deletes an email in Outlook, then double-deletes the email by deleting the email from the Outlook deleted items bin. According to Agent Medlin’s testimony during the government’s case-in-ehief, when an Outlook email is double-deleted, the email is sent to the free space of the computer. (Tr. 2404:11-23.) Because none of the ten emails could be found on Katakis’s Dell computer, Swanger’s Asus computer, or the mail server, and Katakis had installed DriveScrubber on those devices, Agent Medlin concluded that Katakis must have double-deleted the emails and then used DriveScrubber to overwrite them in the free space. (Tr. 2418:21-22, 2419:30-24, 2420:20-25.)

Katakis, however, offered expert testimony from Donald Vilfer that discredited Agent Medlin’s testimony and the government’s theory. Vilfer testified that, because the computers and mail server at issue were part of a Microsoft Exchange Database, emails were sent directly to the Exchange Database upon double-deletion. (See Tr. 2992:21-2993:2, 2993:14-2994:18.) Vilfer explained that DriveScrubber could not have deleted any of the double-deleted emails from the free space because, as they were stored in the Exchange Database, they never entered the free space. (Tr. 3002:15-3003:11,' 3006:6-10.) He further explained that DriveScrubber could not affect a double-deleted email stored in the Exchange Database unless the entire operating system for a computer or mail server was “scrubbed” so that nothing remained.² (Tr. 3001:20-3002:14.)

In light of Vilfer’s testimony, the government recalled Agent Medlin in its rebuttal case. Departing from his earlier testimony, Agent Medlin confirmed the accuracy of Vilfer’s testimony: that double-deleted Outlook emails on the computers and mail server could not have been affected by DriveScrubber because they were stored in the Exchange Database and never entered the free space on the computers or mail server. (See Tr. 3084:6-23.)

A rational jury could not have found that Katakis destroyed or concealed any of the emails in question using DriveScrubber because the undisputed evidence from both experts at trial was that DriveScrubber' could only overwrite emails in the free space of the computers or mail server and the emails never entered the free space.

2. Manual Deletion from Katakis’s Dell Computer, Swanger’s Asus Computer, and the Mail Server

There was no testimony at trial about Katakis manually deleting the emails on his Dell computer, Swanger’s Asus computer, or the mail server. Although Swan-ger testified that he saw Katakis searching for documents prior to running DriveS-crubber on his Asus computer, when asked whether he “observe[d] Andrew Katakis deleting any documents,” Swanger testified: “I wasn’t sure if he was — what he was doing. I saw him on [the Asus computer], clicking and moving things around, but I-I didn’t — I didn’t pay attention closely, on that computer, what it was he was doing.” (Tr. 2144:24-2145:3.) Swan-ger also “wasn’t quite sure what was deleted and what wasn’t [on the Asus], because [he] didn’t have a clear memory of what was there.” (Tr. 2146:19-24; see also Tr. 2138:6-11 (Swanger testifying that he used the Dell computer “[p]rimarily for emails” and the Asus computer for “[finternet searches, and, when I’d comp properties, MLS, that kind of stuff’).)

The government was thus left to rely on the inference that, because the ten emails in question were not found on Katakis’s Dell computer, Swanger’s Asus computer, or the mail server, Katakis must have double-deleted them. (See Tr. 3240:12-16 (“Those e-mails were deleted, and there is only one reasonable explanation. Andrew Katakis had the motive and the means to erase the evidence against him, to keep his hands clean, just like he tried to do with his involvement with the rounds.”); Tr. 3240:8-9 (relying on Katakis’s use of Dri-veScrubber to show “what was going through [his] mind”); see also 3236:15-3237:11.)

In deciding Katakis’s Rule 29 motion, the court must accept this inference in favor of the government and assume the jury could have found that Katakis double-deleted the emails on his computer, Swan-ger’s Asus computer, and the mail server. See United States v. Nevils, 598 F.3d 1158, 1164 (9th Cir.2010) (“[W]hen ‘faced with a record of historical facts that supports conflicting inferences’ a reviewing court ‘must presume — even if it does not affirmatively appear in the record — that the trier of fact resolved any such conflicts in favor of the prosecution, and must defer to that resolution.’” (quoting Jackson v. Virginia, 443 U.S. 307, 326, 99 S.Ct. 2781, 61 L.Ed.2d 560 (1979))). The court will also assume for purposes of deciding this motion that double-deleting an email is sufficient to destroy or conceal the email.

Nonetheless, even when the court makes these assumptions in favor of the government, there is still insufficient evidence for a jury to have found that Katakis violated § 1519. To sustain a conviction, the government had to prove that Katakis destroyed or concealed evidence with the intent to obstruct an investigation that he knew of or contemplated. (See Jury Instruction No. 20); 18 U.S.C. § 1519. To establish the requisite intent under § 1519, the government thus had to show that when Katakis double-deleted the emails he knew of or contemplated the investigation at that time.

In order to make that showing, the government charged in the Superseding In-dictraent that Katakis obstructed justice “in or about September 2010.” The government charged that time period based on its theory that Katakis learned about the investigation when he received a copy of the bank subpoena on September 1, 2010. As the court instructed the jury, “The government need not prove beyond a reasonable doubt the exact date of each alleged offense. It is sufficient if the government proves beyond a reasonable doubt that each offense was committed on a date or dates reasonably near the date or dates charged.” (Jury Instruction No. 12)

While there was sufficient evidence for the jury to find that Katakis knew about the investigation in September 2010,³ there was no evidence from which the jury could have inferred that Katakis double-deleted the emails on a date “reasonably near” September 2010. In fact, there was not even circumstantial evidence from which the jury could have inferred an approximate date when Katakis double-deleted the emails.

Establishing when Katakis double-deleted the emails was crucial for the government to prove that he did so with the requisite intent. Deleting emails and emptying them from a deleted items bin in the ordinary course of business is a common and legal practice and intent under § 1519 therefore cannot be inferred exclusively from the fact that an incriminating email was deleted or double-deleted at some unknown time. See United States v. Delgado, 357 F.3d 1061, 1068 (9th Cir.2004) (“[Wjhen there is an innocent explanation for a defendant’s conduct as well as one that suggests that the defendant was engaged in wrongdoing, the Government must produce evidence that would allow a rational jury to conclude beyond a reasonable doubt that the latter explanation is the correct one.”). Absent evidence that an individual contemplated or knew about an investigation, that individual cannot be required to depart from his common practice in an effort to preserve all evidence that the government may want to use against him in a hypothetical investigation that the individual is not even contemplating. Cf. United States v. Yielding, 657 F.3d 688, 711 (8th Cir.2011) (“[T]he statute does not impose liability for ‘knowingly ... destroying] ... any ... document ... in ... contemplation of any [federal] matter,’ without an intent to impede, obstruct, or influence a matter. If it did, then the statute would forbid innocent conduct such as routine destruction of documents that a person consciously and in good faith determines are irrelevant to a foreseeable federal matter.” (alterations and omissions in original)).

Here, as charged in the Superseding Indictment, Katakis’s double-deletion of the emails before September 1 and the eventual overwriting of them within the Exchange Database cannot sustain a guilty verdict. (See Tr. 2989:3-2992:18 (Vilfer explaining how the Exchange Database works and that it overwrote double-deleted emails after fourteen days); 3090:23-3091:15 (Agent Medlin affirming that emails in the Exchange Database are overwritten “in normal course ... all the time, every single day”).) Accordingly, a rational jury could not have found that Katakis violated § 1519 by double-deleting the emails on his Dell computer, Swanger’s Asus computer, or the mail server because there was no evidence from which the jury could infer that he did so with the requisite intent to obstruct investigation that he knew of or contemplated.

3. Unsuccessful Manual Deletion from Swanger’s Dell Computer

The only evidence at trial about Katakis actually deleting emails came from Swanger. Swanger testified that, when Katakis installed DriveScrubber on Swan-ger’s Dell computer on Saturday, he saw Katakis deleting emails on that computer and, when Swanger returned to work on Monday, almost all of the emails were gone from his Dell computer. (Tr. 2145:17-2146:24.) At trial, however, Agent Medlin and Vilfer testified that the ten emails in question were recovered from the deleted items bin on Swanger’s Dell computer. (Tr. 2418:5-10, 3046:18-19, 3057:2-4.) In what is unquestionably an eleventh-hour argument, the government contends that placing the emails in the deleted items bin on Swanger’s Dell computer constituted destruction or concealment under § 1519.

The undisputed evidence at trial was that deleting an Outlook email places the email in the deleted items bin and the email remains in that folder unless and until a user takes further action. (Tr. 2403:15-23.) The user can move the email back into his inbox, into a different Outlook folder, or double-delete the email by deleting it from the deleted items bin. (Tr. 2404:2-10.) There was sufficient evidence at trial for the jury to find that Katakis deleted the ten emails on Swan-ger’s Dell computer and thereby moved them from the inbox to the deleted items bin. There was no evidence or suggestion at trial that Katakis or anyone else double-deleted any of the ten emails on Swanger’s Dell computer.

To sustain a conviction under § 1519, the government must have produced sufficient evidence from which the jury could find that placing the emails in the deleted items bin destroyed or concealed them. At trial, however, the undisputed evidence was that the ten emails on Swanger’s Dell computer were recovered and thus there was no evidence from which the jury could infer that they were destroyed. The government cannot simply rely on the label of “deleting” when it is undisputed that “deleting” an email within Outlook simply moves it to another folder where it remains easily accessible.,

Nor was there any evidence from which a reasonable jury could infer that placing an email in the deleted items bin conceals it from the government. To the contrary, Agent Medlin, the government’s own expert, testified how easy it is to retrieve an Outlook email from a deleted items bin:

Q. Now, a few questions about deleting e-mails. When someone opens an e-mail in their computer, they open it, they read it, and they hit the delete key, what happens to that e-mail?

A. That e-mail will go to the deleted items folder. Depending on the program you’re using, it may not be called “deleted items,” may be recycle bin or trash folder. But it will be moved to that folder to sit there until you address it.

Q. Microsoft Outlook is a common program. If you hit delete on Microsoft Outlook, which folder does it go into?

A. Microsoft Outlook, it’s called deleted items.

Q. When the e-mail is in the deleted items folder, can it be retrieved?

A. Yes, ma'am.

Q. How?

A. One simply opens the deleted items folder and can retrieve the e-mail, or read it, or move it to another folder.

Q. That’s something the user can do?

A. Yes.

(Tr. 2403:15-2404:10.) There was no testimony from which the jury could infer that an email in a deleted items bin is any more concealed from the government than an email that remains in the inbox or any other folder within Outlook.

The government’s reliance on United States v. Kernell, 667 F.3d 746 (6th Cir.2012), to argue that an unsuccessful deletion can be sufficient under '§ 1519 is also misplaced. In Kemell, the defendant successfully accessed Sarah Palin’s email account and tried to conceal this action by taking “numerous actions to remove information from the computer relating to his access to the Palin email account.” 667 F.3d at 748-49. The defendant, however, did not challenge the sufficiency of the evidence supporting the jury’s finding that he knowingly deleted or altered information on his computer with the requisite intent. The defendant challenged only whether his statement on a blog was sufficient evidence from which the jury could have found that he contemplated an investigation at the time he deleted or altered the information on his computer. Moreover, the defendant in Kemell successfully removed certain information from his computer; he simply did not remove all of the evidence against him.⁴ Here, there was no evidence from which the jury could infer that Katakis successfully removed any part of the emails from Swanger’s Dell computer.

A rational jury therefore could not find that Katakis violated § 1519 by deleting the emails on Swanger’s Dell computer because there was no evidence from which the jury could infer that Katakis destroyed or concealed the emails.

4. Conclusion

Although the jury heard extensive and complicated evidence regarding the obstruction of justice charge and the government resorted to every theory possible, none of the evidence was sufficient for the jury to find beyond a reasonable doubt that Katakis knowingly destroyed or concealed the emails with the intent to obstruct an FBI investigation that he knew of or contemplated. (See Jury Instruction No. 20.) By the close of trial, the undisputed expert testimony was that DriveS-crubber could not have overwritten any of the emails at issue and that Katakis did not successfully destroy or conceal the emails on Swanger’s Dell computer. With respect to the remaining computers and mail server, there was no evidence establishing that Katakis double-deleted the emails in question in or about the time period alleged in the Superseding Indictment. The evidence advancing each theory underlying the obstruction of justice charge was therefore materially insufficient for the government to carry its burden.

As the Ninth Circuit has explained, the court must grant a Rule 29 motion if “the evidence construed in favor of the government [is] insufficient to establish every element of the crime” and “evidence is insufficient to support a verdict where mere speculation, rather than reasonable inference, supports the government’s case or where there is a ‘total failure of proof of [a] requisite’ element.” Nevils, 598 F.3d at 1167 (alteration in original) (internal citation omitted) (quoting Briceno v. Scribner, 555 F.3d 1069, 1079 (9th Cir.2009)). Accordingly, because a rational jury could not have returned a guilty verdict on the obstruction of justice charge, the court must grant Katakis’s motion for a judgment of acquittal on that charge.

IT IS THEREFORE ORDERED that Katakis’s motion for a judgment of acquittal on the Third Count of the Superseding Indictment charging a violation of 18 U.S.C. §' 1519 be, and the same hereby is, GRANTED. The verdict of guilty against Katakis on Count Three is hereby set aside, and the Clerk is instructed to enter a judgment of acquittal in favor of defendant Katakis on Count Three of the Superseding Indictment.

1 . The government did not argue and there was no evidence suggesting that Katakis altered electronic records or documents.

2 . The government neither suggested nor presented evidence indicating that Katakis scrubbed, or destroyed, the operating systems of the computers or mail server.

3 . There was evidence at trial that Katakis may have known about the investigation as early as a year before he received a copy of the bank subpoena. Wiley Chandler testified that he discussed the investigation with Katakis at the time when the ''round-robins'' ceased, which occurred approximately one year before September 2010. (See Tr. 1373:19-1375:17.) The government cannot — and did not — rely on Chandler's testimony to argue that any alleged destruction or concealment in 2009 was sufficient to sustain a conviction because that time period is not reasonably near the time period charged in the Superseding Indictment. See United States v. Hinton, 222 F.3d 664, 672-73 (9th Cir.2000) (discussing cases).

4 . In Kemell, the defendant

cleared the cache on his Internet Explorer browser, removing the record of websites he had visited during that period!;] ■ • • uninstalled the Firefox internet browser, which more thoroughly removed the record of his internet access using that browser!;] ran the disk defragmentation program on his computer, which reorganizes and cleans up the existing space on a hard drive, and has the effect of removing many of the remnants of information or files that had been deleted!; and] ... deleted a series of images that he had downloaded from the Palin email account.

Kemell, 667 F.3d at 749. The Sixth Circuit's decision neither indicated nor suggested that the government recovered any of this information. Instead, it noted that "despite the deletions, [the computer] contained numerous items related to accessing the Palin email account, including a draft of the 'Hello' post.” Id. at 749. ’