United States v. Katakis

• Decision Date: 31 August 2015
• Docket Number: No. 14–10283.,14–10283.
• Citation: 800 F.3d 1017
• Parties: UNITED STATES of America, Plaintiff–Appellant, v. Andrew B. KATAKIS, Defendant–Appellee.
• Court: U.S. Court of Appeals — Ninth Circuit

800 F.3d 1017

UNITED STATES of America, Plaintiff–Appellant

v.Andrew B. KATAKIS, Defendant–Appellee.

No. 14–10283.

United States Court of Appeals, Ninth Circuit.

Argued and Submitted May 15, 2015.

Filed Aug. 31, 2015.

Adam D. Chandler (argued), Attorney; William J. Baer, Assistant Attorney General; Brent Snyder, Deputy Assistant Attorney General; Anna Tryon Pletcher, Tai S. Milder, May Lee Heye, Kelsey C. Linnett, Kristen C. Limarzi, and James Joseph Fredricks, Attorneys, United States Department of Justice, Antitrust Division, Washington, D.C., for Plaintiff–Appellant.

Elliot R. Peters (argued), Steven A. Hirsch, Jennifer A. Huber, and Elizabeth K. McCloskey, Keker & Van Nest LLP, San Francisco, CA, for Defendant–Appellee.

Appeal from the United States District Court for the Eastern District of California, William B. Shubb, Senior District Judge, Presiding. D.C. No. 2:11–cr–00511–WBS–2.

Before: MARSHA S. BERZON and N. RANDY SMITH, Circuit Judges and RANER C. COLLINS,^* Chief District Judge.

OPINION

N.R. SMITH, Circuit Judge:

The Government appeals the district court's order granting Katakis's Fed.R.Crim.P. 29 motion. The district court vacated Katakis's conviction and entered a judgment of acquittal, holding that the evidence was insufficient to support the jury's verdict. The Government's theory of liability collapsed during trial, and the Government now raises several alternative theories to try and rescue the conviction. The evidence was insufficient to show that Katakis actually deleted electronic records or files. Further, proving Katakis moved emails from an email client's inbox to the deleted items folder does not demonstrate Katakis actually concealed those emails within the meaning of § 1519. We affirm.

BACKGROUND

This case arises from an investigation by federal authorities into a scheme to rig bids at foreclosure auctions in 2008 and 2009. By 2010, the investigation focused on Andrew Katakis as one of the primary real estate investors helming the conspiracy. On September 1, 2010, Katakis received a letter from his bank informing him that federal investigators had subpoenaed his bank records. On September 3, 2010, Katakis purchased, downloaded, and installed a program called DriveScrubber 3 (“DriveScrubber”) onto his home computer, a Dell (“Katakis's Dell”). DriveScrubber is a program designed to wipe hard drives clean of all information. DriveScrubber may be used to overwrite all of the information in a hard drive's unallocated or “free” space. Free space is the portion of the hard drive that is not allocated for the use of the computer's programs or operating system; items that are deleted by a user may “fall” into the free space. There, the deleted item is not actually removed from the computer right away; the space it occupies on the hard drive has simply been made available to be overwritten. Instead of waiting for another file to overwrite the deleted file by chance, DriveScrubber actively overwrites all data in the unallocated space of a hard drive, permanently erasing any files that had fallen into the free space. Once a file is overwritten by DriveScrubber, it is impossible to retrieve it.

Katakis's business partner and alleged co-conspirator, Steve Swanger, kept two computers at their office: an ASUS (“Swanger's ASUS”), and a Dell (“Swanger's Dell”). Swanger's Dell was used primarily for emailing with Katakis, and Swanger's ASUS was used for general internet searching. On Saturday, September 4, 2010, Katakis summoned Swanger to their business office. Katakis told Swanger that he wanted to install a “scrubber program” on their computers and that there was “nothing wrong with us cleaning our computers.” Swanger observed Katakis use Swanger's ASUS and perform a search for emails involving members of the bid-rigging conspiracy. At 4:40 pm, Katakis installed DriveScrubber on the Swanger ASUS. This copy of DriveScrubber was different from the one installed on Katakis's Dell.¹ Swanger did not observe any deletions on the ASUS; he only observed Katakis “clicking and moving things around.”

Katakis then moved to Swanger's Dell and installed DriveScrubber at 4:47 pm. The Swanger Dell had 4,000 emails on it, as Swanger was not in the habit of regularly deleting his emails. Swanger kept hard copies of some important emails, because he feared Katakis might try and wipe clean the hard drives some day. Swanger observed Katakis checking boxes on various emails and unchecking those emails that Katakis believed that Swanger needed. Katakis gave up sorting the emails after about five minutes and pressed the delete key. After seeing that it would take a long time for the emails to be deleted, Katakis went home. When he returned to the office on Monday, Swanger noticed that almost all of the emails on his Dell had been deleted from his email inbox.

At 5:37 pm on September 4, 2010, the same copy of DriveScrubber that was installed on Katakis's Dell was installed on the office's mail server (“GD Mail Server”). The server managed all email sent or received in the office through the Microsoft Outlook program. The GD Mail Server was operated by a program called Exchange. Katakis had the authority to install programs on the GD Mail Server and knew that DriveScrubber had been installed on it.

The Government seized the four computers in the course of its investigation into the bid-rigging scheme. When examining Swanger's Dell, the Government discovered ten incriminating emails that implicated Katakis in the conspiracy. Katakis was either a sender or recipient of all ten emails. Swanger was also either the sender or recipient of all ten emails. The emails were discovered in the deleted items folder in Swanger's email client. Metadata attached to the emails showed that the emails had passed through the GD Mail Server and that Katakis had received and opened all of them. Special Agent Scott Medlin conducted a forensic analysis of the other three computers. Because Katakis's Dell, Swanger's ASUS, and the GD Mail Server were all part of the email network shared with Swanger's Dell, Medlin expected to find traces of the ten emails on these computers. Medlin was unable to locate any trace of the ten incriminating emails, but did not think that enough time had passed for all traces of the emails to be removed by the gradual automatic overwriting process, leading him to believe that Katakis had destroyed them using DriveScrubber.

Based on the discrepancy between the presence of the ten incriminating emails on Swanger's Dell but not on the other computers, the Government sought and obtained an indictment charging Katakis with obstruction of justice, in violation of 18 U.S.C. § 1519.² The indictment alleged that Katakis “deleted and caused others to delete electronic records and documents. KATAKIS also installed and used and caused others to use a software program that overwrote deleted electronic records and documents so that they could not be viewed or recovered.” Notably, the indictment failed to charge attempt, thus committing the Government to prove actual deletion.

The Government proceeded to trial on the theory that Katakis ran the DriveScrubber program on his Dell, Swanger's ASUS, and the GD Mail Server, to erase all traces of the ten incriminating emails. The Government's key witness was Medlin, who testified as an expert. Medlin testified that Katakis “double-deleted” emails; that is, he deleted them once from the mail client and then again when he emptied the deleted items folder. After they were double deleted, the emails fell into the free space, where Medlin opined that they were irretrievably overwritten by DriveScrubber.

Katakis called Don Vilfer as a rebuttal expert. Vilfer testified that Medlin's theory of what happened to double-deleted emails was incorrect, based on how the Exchange program on the GD Mail Server worked. According to Vilfer, a double-deleted email would not fall into the free space, as Medlin testified, but would remain within the portion of the hard drive allocated for the Exchange database. The crux of Vilfer's testimony was that, given how the Exchange program operated, it would be impossible for DriveScrubber to overwrite any double-deleted emails, including the ten incriminating emails that were at the heart of the Government's case. Vilfer further noted that the Exchange program itself removed double-deleted emails after a certain period of time, usually fourteen days. Vilfer testified that he was able to recover thousands of double-deleted emails, but he could not find the ten incriminating emails. Vilfer agreed with Medlin that it was suspicious that there were no traces of the ten incriminating emails on any computer other than Swanger's Dell. However, he explained that absence by opining that the ten incriminating emails (including metadata) had been fabricated. The defense sought to draw an inference that Swanger fabricated the ten incriminating emails and the metadata indicating Katakis had seen them in order to implicate Katakis.

In rebuttal, Medlin admitted that Vilfer's testimony was correct: it was impossible for DriveScrubber to have deleted the ten incriminating emails. Medlin testified that his opinion was unchanged, because DriveScrubber could have deleted transmission logs associated with the ten incriminating emails. Vilfer testified in response that deleting the transmission logs would not have deleted the emails themselves.

By the time of its closing argument, the Government's primary theory of the case had collapsed. In closing, the Government offered two theories of liability to the jury. First, the Government argued a purely circumstantial case. The ten incriminating emails were present on Swanger's Dell, and both experts testified that they would have expected to find them on the other computers. The only logical inference, the Government reasoned, was that Katakis had somehow deleted them. Second, the Government relied on Swanger's testimony for an alternative theory of liability....