One of the first things I tell a potential client in a criminal case is not to delete anything from his computer. I explain that DOJ will turn deleting an email or two into an obstruction of justice charge. The client will nod and say he understands.
Then he probably goes home and deletes a bunch of emails.
I can’t blame him. It’s a natural temptation to delete incriminating evidence—electronic or not–when you find out that the government is investigating you. In a recent case, however, the Ninth Circuit affirmed a post-verdict judgment of acquittal for a defendant who may have tried to do just that.
The Ninth Circuit’s opinion delved into a surprising amount of detail to describe why a reasonable jury could not have found that Andrew Katakis’ conduct warranted an obstruction conviction. This is a very fact-specific case, but there are a few pointers for every white-collar lawyer here.
Here’s what happened.
Using the Scrubber
Facing an indictment for bid-rigging and conspiracy to defraud, Mr. Katakis contacted Steve Swanger, a coworker, and a cooperating witness in this case. Mr. Katakis asked Mr. Swanger to bring his computers, a Dell and an ASUS, to the meeting. Mr. Katakis told Mr. Swanger that he wanted to install a “scrubber program” on their computers and that there was “nothing wrong with us cleaning our computers.”
He then installed a scrubber program on the ASUS and on Mr. Katakis’ own computer and reviewed Mr. Swanger’s email inbox on the Dell.
When the government seized the computers, it found ten incriminating emails in the deleted items folder on Mr. Swanger’s Dell computer. But they did not find these emails on the other devices. They also found a program called “Drive Scrubber” that they assumed Mr. Katakis installed in an effort to delete the emails in question.
As a result, they charged Mr. Katakis with obstruction of justice under 18 U.S.C. § 1519, which provides:
Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct or influence the investigation or proper administration of any matter within the jurisdiction of . . . the United States . . . shall be fined under this title, imprisoned not more than 20 years, or both.
The Ninth Circuit emphasized that there are three factors that the government must prove to obtain a conviction under this section:
(1) [that the defendant] knowingly committed one of the enumerated acts in the statute, such as destroying or concealing; (2) towards “any record, document, or tangible object”; (3) with the intent to obstruct an actual or contemplated investigation by the United States of a matter within its jurisdiction.
Perry Mason Moment
The government relied heavily on the testimony of forensic computer expert Special Agent Scott Medlin. At trial, Agent Medlin described how he searched for the ten emails on the computers other than the Dell but could not find them and that the Drive Scrubber program was installed on all of the computers except the Dell.
He did not, however, describe how or whether the Drive Scrubber program could have been used to delete the missing emails. He concluded that because the computers containing Drive Scrubber did not have the emails and the one without the program did have the emails, Drive Scrubber must have been used to delete the emails.
Reasonable, perhaps, but still a leap in logic. We don’t usually let experts offer pure conjecture. Unless it comes to hair analysis.
The defense countered with a forensics expert of its own who testified that the government’s theory made no sense. According to this expert, Drive Scrubber was incapable of deleting emails as Agent Medlin had testified. In addition, the fact that the emails were only on Mr. Swanger’s Dell computer suggested that Mr. Katakis was innocent:
However, [the defense expert] explained that absence by opining that the ten incriminating emails (including metadata) had been fabricated. The defense sought to draw an inference that Swanger fabricated the ten incriminating emails and the metadata indicating Katakis had seen them in order to implicate Katakis.
Hey, when in doubt, blame the cooperating witness. Juries never like them anyway.
Agent Medlin was recalled to the stand and recanted his prior testimony, admitting that the program could not have possibly deleted the emails.
That’s a Perry Mason kind of moment. I hope I get one moment like that in my career.
Despite the fact that the Drive Scrubber theory was demolished, the government kept trying, telling the jury at closing:
The fact that DriveScrubber was installed . . . is important because it shows what was going through Andrew Katakis’ mind. He bought this program with the intent to buy a program that would permanently erase. Those emails were deleted, and there is only one reasonable explanation. Andrew Katakis had the motive and the means to erase the evidence against him, to keep his hands clean, just like he tried to do with his involvement with the rounds. But again, he got caught.
The government also offered during closing a brand new theory involving Mr. Katakis’ supposed deletion of email log files of the computer.
The jury convicted him of obstruction.
The Rule 29 Motion
When the jury came back with a conviction on the obstruction of justice charge, the defense made its Rule 29 motion for judgment of acquittal. These motions are hardly ever granted. You make them as a matter of course, to preserve the argument for appeal.
This time was a little different. The defense won.
Because Mr. Katakis was not charged with attempted obstruction of justice, the government was required to show that he actually concealed electronic records or documents. It couldn’t.
As the Ninth Circuit explained:
There is no dispute that there was sufficient evidence for a rational juror to conclude that the Government satisfied the third element, that Katakis intended that his actions would obstruct the investigation into the bid-rigging scheme. A rational juror also could have concluded that Katakis knew or believed that his actions could destroy or conceal the ten incriminating emails. However, the Government failed to charge Katakis with attempted obstruction in the indictment. Therefore, in order to secure a conviction, the Government was required to prove that Katakis actually destroyed or concealed “electronic records and documents.”
The Ninth Circuit noted that: “Make no mistake, the Government’s original plan failed.” The court went on to debunk each of the government’s myriad Plan Bs. The “Drive Scrubber theory” was clearly refuted at trial. The “log files” theory was an “eleventh hour argument” that failed because the log files did exist on the Dell and were therefore not deleted.
The government even tried a new argument in its briefs that Mr. Katakis’ “single deletion” on the Dell meant that it had proven the required concealment. The government argued that when Mr. Katakis moved an email from his inbox to his deleted items folder, he demonstrated the appropriate intent to obstruct justice. (Usually, deletion of emails requires “double deletion” – deleting the email so it is placed in the deleted items folder and then a second deletion to remove it from the computer entirely.)
This argument went nowhere. This is my favorite part of the opinion.
According to the court of appeals, simply placing an email in the deleted items folder isn’t evidence of any concealment under § 1519, because only a dummy would think that the emails couldn’t be found later.
The Government makes much of the fact that a jury could find that Katakis placed the emails into the deleted items folder, which the Government analogizes to a real world, physical trash can. But a deleted items folder in an email client is not like a trash can. Ordinarily, a trash can is eventually emptied into a larger receptacle, the trash is mingled with other garbage, and the garbage is then either destroyed or placed in a location in which it is extremely difficult to find any particular item. On Katakis’ computer, in contrast, an email placed in the deleted items folder remained in that folder unless a user took further action. As Katakis persuasively argues, all that he accomplished by single deleting the emails was moving them from one folder to another. In essence, Katakis placed the ten incriminating emails into an email folder that is by default not displayed to the user. But the first place that any competent investigator would look for emails that are not in the inbox is in the deleted items folder. This degree of concealment is not sufficient to satisfy § 1519.
The Court concluded:
The evidence of Mr. Katakis’ intent was truly overwhelming, but the Government’s attempts to prove that he actually performed the acts of which he was accused, were incredibly weak.
A Few Final Thoughts
There’s no question that this is a fact-specific case. The Ninth Circuit was careful to note that the scope of this ruling was limited. But it is still a major win for the defense. Mr. Katakis was lucky that he was not charged with attempted obstruction of justice, and that the government did such a sloppy job proving the technical aspects of the case.
A few parting thoughts from this case:
- Keep warning your clients from the start that they should not delete evidence and remind them that the government has sophisticated methods to discover any deletions.
- In particular, remind your clients to stay away from “scrubber” programs. They don’t work and my 8-year old can probably figure out that one was installed. Also, the government can find your client’s internet search history. Searches for “how to delete files” or “how to wipe your computer” will not look good in front of the jury.
- Find a good forensic expert of your own to challenge the government’s expert and offer affirmative testimony for your defense. This isn’t an area to skimp on costs, since a clean-cut, credible, articulate FBI agent talking about deletions and computer scrubbers will bury your client.
- Keep making those Rule 29 motions. Sometimes, lightning strikes and you may just win.