United States v. Andrew Katakis
800 F.3d 1017
9th Cir.2015Background
- Federal investigation into bid-rigging led to subpoenas to Andrew Katakis; on Sept. 3–4, 2010 Katakis installed DriveScrubber on multiple computers (his Dell, Swanger’s ASUS and Dell, and the office Exchange mail server).
- DriveScrubber overwrites unallocated/free space on a hard drive, permanently erasing files that have been moved into free space after deletion.
- Ten incriminating emails referencing the conspiracy were found in the deleted items folder on Swanger’s Dell; no traces of those emails were found on Katakis’s Dell, Swanger’s ASUS, or the GD Mail Server.
- Government’s case-in-chief theorized Katakis double-deleted the emails and used DriveScrubber to irretrievably overwrite them; defense experts rebutted that Exchange’s handling of deletions made DriveScrubber incapable of erasing those emails and suggested possible fabrication.
- Jury convicted Katakis under 18 U.S.C. § 1519 (obstruction by altering/destroying/concealing records); district court granted Rule 29 judgment of acquittal for insufficiency of evidence. Government appealed.
Issues
| Issue | Plaintiff's Argument (Government) | Defendant's Argument (Katakis) | Held |
|---|---|---|---|
| Whether evidence proved actual destruction via DriveScrubber | DriveScrubber was run and could have overwritten incriminating items (including transmission logs); expert testimony and missing traces support deletion | Experts and record show DriveScrubber could not have overwritten the emails; no evidence logs entered free space | Insufficient — conviction cannot rest on DriveScrubber theory |
| Whether deletion of transmission logs satisfied §1519 | Deletion of transmission logs (not emails) could constitute destroying electronic records | No evidence logs were ever moved into free space or that Katakis knew they would be erased | Insufficient — speculative; no evidence logs were available for overwriting |
| Whether double-deletion (inbox → deleted items → free space) occurred | Circumstantial inference from intent and absence of emails across machines supports double-deletion | No direct proof of double-deletion; experts agreed double-deletion wouldn’t place emails into free space on Exchange; vital mechanism lacking | Insufficient — inference too attenuated/speculative |
| Whether single deletion (moving to deleted items folder) constitutes "concealment" under §1519 | Moving emails to deleted items is analogous to placing documents in a trash can and thus conceals them | Single deletion merely moves emails between folders; investigator would reasonably check deleted items; not actual concealment/destruction | Insufficient — single deletion alone not enough to satisfy §1519 (must do more than make item harder for a casual onlooker to see) |
Key Cases Cited
- Jackson v. Virginia, 443 U.S. 307 (standard for sufficiency of evidence under a Jackson review)
- United States v. Nevils, 598 F.3d 1158 (9th Cir. en banc) (framework for reviewing sufficiency under Jackson)
- United States v. Sanchez, 639 F.3d 1201 (9th Cir.) (Rule 29 de novo review reminder)
- Yates v. United States, 135 S. Ct. 1074 (2015) (context on §1519’s purpose to prevent document shredding)
- United States v. Lo, 231 F.3d 471 (9th Cir.) (rejects convictions based on attenuated inferences)
- United States v. Lessner, 498 F.3d 185 (3d Cir.) (placing documents in trash addressed as attempt vs. actual concealment/destruction)
- Bailey v. United States, 444 U.S. 394 (definition of acting knowingly)
- Bryan v. United States, 524 U.S. 184 (knowledge element requires awareness of facts constituting offense)