As a recent opinion from a federal District Court Judge who
sites in the U.S. District Court for the Eastern District of California
explains, in a “Superseding Indictment, the government charged defendant Andrew
Katakis with violation of the Sherman Antitrust Act, 15 U.S. Code § 1;
conspiracy to commit mail fraud, 18 U.S. Code § 1349; and obstruction of justice, 18 U.S. Code § 1519.” U.S. v. Katakis, 2014 WL 1884213
(2014). You can, if you are interested,
read more about the charges and the trial in the press release you can find
here.
After “a twenty-three-day . . . trial,” the jury convicted Katakis
on the Sherman Antitrust and obstruction of justice charges “but was unable to
reach a verdict on the conspiracy to commit mail fraud charge.” U.S. v.
Katakis, supra. Katakis then filed a
motion for a judgment of acquittal on the obstruction of justice charge
pursuant to Federal Rule of Criminal Procedure 29. U.S. v.
Katakis, supra. As Rule 29(c)
explains, once the jury returns a guilty verdict, the defendant has roughly fourteen
days in which to file a motion for a judgment of acquittal; if the jury
returned a guilty verdict, the judge can “set [it] aside . . . and enter an
acquittal.” Federal Rule of Criminal
Procedure 29(c).
The judge began his analysis of Katakis’ Rule 29 motion by explaining
that the superseding indictment charged and the
evidence at trial established that the
government began an investigation in 2009 of anti-competitive conspiracies
between Katakis and other purchasers at public foreclosure auctions in San
Joaquin County, California. As part of that investigation, the government
subpoenaed bank records for Katakis and his company from Oak Valley Community
Bank on August 27, 2010. In response to the subpoena, the bank sent Katakis a
letter on September 1, 2010 informing him of the subpoena and providing him
with a copy of it. The Superseding Indictment charged that Katakis
violated § 1519 `[i]n or about September 2010’ when he `deleted and
caused others to delete electronic records and documents’ and `installed and
used and caused others to install and use a software program that overwrote
deleted electronic records and documents so that they could not be viewed or
recovered.’ . . .
U.S. v. Katakis, supra.
He also noted that the prosecution “primarily, if not
exclusively,” pursued the
obstruction of justice charge by
seeking to establish that Katakis purchased and ran a program called
DriveScrubber 3 (`DriveScrubber’) on at least four computers and the company
mail server shortly after he received a copy of the subpoena.
According to the initial testimony from
the government's expert, the program successfully deleted emails on Katakis'
Dell computer, Steve Swanger's Asus computer, and the company mail server. To
rebut this evidence, Katakis offered expert testimony that discredited the
testimony from the government's expert. Katakis timely moved for a judgment of
acquittal pursuant to Rule 29(b) and, during argument, the government
indicated it would pursue the obstruction of justice charge based on [his] alleged
manual deletion of emails independent of running DriveScrubber.
U.S. v. Katakis, supra.
According to the document you can find here, Steve Swanger
was a “cooperating witness” in the investigation/prosecution. U.S. v.
Katakis, et. al., Corrected Notice of Motion and Memorandum of Points and
Authorities 2 (May 5, 2014). The
reference to Rule 29(b) in the above-quoted paragraph refers to the fact that,
as was his right, Katakis filed a motion for a judgment of acquittal before the
jury returned a verdict; and, as the rule allows, the judge reserved ruling on
the motion until after the jury had returned its verdict. U.S. v.
Katakis, supra. In this opinion, the
judge is issuing his ruling on the motion.
U.S. v. Katakis, supra.
He began his ruling by noting that under Rule 29, a must
enter a judgment of acquittal
`of any offense for which the evidence
is insufficient to sustain a conviction.’ [Rule 29(a).] `A motion for Judgment
of Acquittal is reviewed on a sufficiency-of-the-evidence standard.’ U.S.
v. Graf, 610 F.3d 1148 (U.S. Court of Appeals for the 9th Circuit 2010)
(quoting U.S. v. Stoddard, 150 F.3d 1140 (U.S. Court ofAppeals for the 9th Circuit 1998)). `Under that standard, evidence supports a
conviction, if, viewed in the light most favorable to the government, it would
allow any rational trier of fact to find the essential elements of the crime
beyond a reasonable doubt.’ Id.
U.S. v. Graf, supra (quoting
U.S. v. Stoddard, supra).
For the jury to have found Katakis guilty of
obstruction of justice, it had to find that the government proved each of the
following elements beyond a reasonable doubt:
[1] that defendant Katakis knowingly
altered, destroyed, or concealed electronic records or documents; [2] that
defendant Katakis acted with the intent to impede, obstruct, or influence an
investigation that he either knew of or contemplated; and [3] that the
investigation was about a matter by or within the jurisdiction of the United
States Department of Justice or Federal Bureau of Investigation.
U.S. v. Katakis, supra.
The judge began his analysis of Katakis’ motion by noting
that, “[u]nder the first element” set out above, “the government . . . had to
show that Katakis destroyed or concealed electronic documents or records, not
merely that he attempted or even intended to do so.” U.S. v.
Katakis, supra. He noted that the
prosecution’s theory in
support of the obstruction of justice
charge focused on ten Microsoft Outlook emails primarily between Katakis and
Swanger sent between September 9, 2008 and July 20, 2009. . . . The government
established that it was unable to find any of the ten emails on Katakis' Dell
computer, Swanger's Asus computer, or the mail server. . . . All ten emails
were found, however, in the deleted items bin on Swanger's Dell computer. . . .
The government now argues that the
jury's verdict can be upheld based on one of three theories: (1) Katakis deleted
the ten emails on his Dell computer, Swanger's Asus computer, and the mail
server and then overwrote them using DriveScrubber; (2) Katakis manually
deleted the ten emails on his Dell computer, Swanger's Asus computer, and the
mail server; or (3) Katakis manually moved the ten emails to the deleted items
folder in Swanger's Dell computer. The court has no doubt that the government .
. . resorted to the second and third theories after the first theory failed. In
its closing argument, the government told the jury: `All you have to do is find that Andrew
Katakis hit the delete button. That's it. It's that simple.’ . . .
U.S. v. Katakis, supra.
The judge analyzed each theory, in the order set out
above. U.S. v. Katakis, supra. As
to the DriveScrubber theory, he explained that the prosecution introduced
sufficient evidence for a jury to find Katakis
purchased DriveScrubber on September 3, 2010 and . . . installed and ran it on
his Dell computer on September 3, on Swanger's Asus and Dell computers and the
mail server on September 4, and on another computer on September 15. . . . The
undisputed evidence at trial was that DriveScrubber overwrites and therefore
permanently deletes files on the free space of a computer.
To prove Katakis used DriveScrubber to overwrite the
emails, the government offered the testimony of FBI Special Agent/Computer
Forensic Examiner Scott Medlin. Medlin opined that the ten emails were no
longer on Katakis’ Dell computer, Swanger's Asus computer, or the mail server
because they had been double-deleted and then overwritten by DriveScrubber.
Medlin explained that this could occur if a user deletes an email in Outlook,
then double-deletes the email by deleting the email from the Outlook deleted
items bin. According to Medlin's testimony . . . , when an Outlook email is
double-deleted, the email is sent to the free space of the computer. . . .
Because none of the ten emails could be found on Katakis' Dell computer,
Swanger's Asus computer, or the mail server, and Katakis had installed
DriveScrubber on those devices, Medlin concluded Katakis must have
double-deleted the emails and then used DriveScrubber to overwrite them in the
free space. . . .
U.S. v. Katakis, supra.
The judge also explained, though, that in presenting the defense’s case,
Katakis
offered expert testimony from Donald Vilfer that
discredited Medlin's testimony and the government's theory. Vilfer testified
that, because the computers and mail server at issue were part of a Microsoft
Exchange Database, emails were sent directly to the Exchange Database upon
double-deletion. . . . Vilfer explained that DriveScrubber could not have
deleted any of the double-deleted emails from the free space because, as they
were stored in the Exchange Database, they never entered the free space. . . .He
further explained that DriveScrubber could not affect a doubledeleted email
stored in the Exchange Database unless the entire operating system for a
computer or mail server was `scrubbed’ so that nothing remained. . . .
U.S. v. Katakis, supra. In a footnote, the judge points out that the
prosecution “neither suggested nor presented
evidence indicating that Katakis scrubbed, or destroyed, the operating systems
of the computers or mail server.” U.S. v. Katakis, supra.
He then noted that, given Vilfer’s testimony, the prosecution recalled
Medlin
in its rebuttal case. Departing from his earlier
testimony, Medlin confirmed the accuracy of Vilfer's testimony: that
double-deleted Outlook emails on the computers and mail server could not have
been affected by DriveScrubber because they were stored in the Exchange
Database and never entered the free space on the computers or mail server.
U.S. v. Katakis, supra. The judge therefore found that a
rational jury could not have found that
Katakis destroyed or concealed any of the emails in question using
DriveScrubber because the undisputed evidence from both experts at trial was
that DriveScrubber could only overwrite emails in the free space of the
computers or mail server and the emails never entered the free space.
U.S. v. Katakis, supra.
He then took up the prosecution’s second theory – that
Katakis manually deleted the emails. U.S. v. Katakis, supra. He noted that there was “no testimony” at
trial about
Katakis manually deleting the emails on
his Dell computer, Swanger's Asus computer, or the mail server. Although
Swanger testified that he saw Katakis searching for documents prior to running
DriveScrubber on his Asus computer, when asked whether he `observe[d] Andrew Katakis
deleting any documents,’ Swanger testified: `I wasn't sure if he was-what he
was doing. I saw him on [the Asus computer], clicking and moving things around,
but I–I didn't-I didn't pay attention closely, on that computer, what it was he
was doing.’ . . . Swanger also `wasn't quite sure what was deleted and what
wasn't [on the Asus], because [he] didn't have a clear memory of what was
there.’ . . .
The
government was thus left to rely on the inference that, because the ten emails
in question were not found on Katakis' Dell computer, Swanger's Asus computer,
or the mail server, Katakis must have double-deleted them. . . .
U.S. v. Katakis, supra.
The judge explained that, under Rule 29, he was required to
“accept this inference . . . and assume
the jury could have found that Katakis double-deleted the emails on his
computer, Swanger's Asus computer, and the mail server” and that “double-deleting
an email is sufficient to destroy or conceal the email.” U.S. v.
Katakis, supra. He noted, however,
that even though he made those assumptions, the evidence was still not
sufficient to prove Katakis violated 18 U.S. Code § 1519. U.S. v.
Katakis, supra.
To prove that, the government had to prove, beyond a
reasonable doubt, that when “Katakis double-deleted the emails he knew of or
contemplated the investigation at that time.”
U.S. v. Katakis, supra. To establish that, the prosecution
argued that Katakis learned about the
criminal investigation when he received a copy of a bank subpoena “on September
1, 2010.” U.S. v. Katakis, supra. The
judge found, though, that while
there was sufficient evidence for the
jury to find that Katakis knew about the investigation in September 2010, there was no evidence from
which the jury could have inferred that Katakis double-deleted the emails on a
date “reasonably near” September 2010. In fact, there was not even
circumstantial evidence from which the jury could have inferred an approximate
date when Katakis double-deleted the emails.
U.S. v. Katakis, supra. He noted that the prosecution did not “even
[present] even circumstantial evidence from which the jury could have inferred
an approximate date when Katakis double-deleted the emails.” U.S. v.
Katakis, supra. He found, therefore,
that “a rational jury could not have found Katakis violated § 1519 by
double-deleting the emails on his Dell computer, Swanger's Asus computer, or
the mail server because there was no evidence from which the jury could infer
that he did so with the requisite intent to obstruct investigation that he knew
of or contemplated.” U.S. v. Katakis, supra.
The judge then took up the prosecution’s third theory, which
relied on Swanger’s testimony that when Katakis installed DriveScrubber on Swanger’s
Dell computer, “he saw Katakis deleting emails on that computer and, when
Swanger returned to work on Monday, almost all of the emails were gone from his
Dell computer.” U.S. v. Katakis, supra. The
judge noted that Medlin and Vilfer “testified that the ten emails in question
were recovered from the deleted items bin on Swanger's Dell computer.” U.S. v. Katakis, supra. And he explained that “the government
contends that placing the emails in the deleted items bin on Swanger's Dell
computer constituted destruction or concealment under § 1519.” U.S. v. Katakis, supra.
The judge pointed out, however, that the “undisputed
evidence” at trial was that
deleting an Outlook email places the
email in the deleted items bin and the email remains in that folder unless and
until a user takes further action. . . . The user can move the email back into
his inbox, into a different Outlook folder, or doubledelete the email by
deleting it from the deleted items bin. . . . There was sufficient evidence at
trial for the jury to find that Katakis deleted the ten emails on Swanger's
Dell computer and thereby moved them from the inbox to the deleted items
bin.
U.S. v. Katakis, supra.
He also noted that to support a conviction for violating 18 U.S. Code § 1519,
the prosecution must have introduced sufficient evidence from which
the jury could find that placing the
emails in the deleted items bin destroyed or concealed them. At trial, however,
the undisputed evidence was that the ten emails on Swanger's Dell computer were
recovered and thus there was no evidence from which the jury could infer that
they were destroyed. The government cannot simply rely on the label of `deleting’
when it is undisputed that `deleting’ an email within Outlook simply moves it
to another folder where it remains easily accessible.
U.S. v. Katakis, supra.
He also noted there was no evidence from which a reasonable
jury “could infer that placing an email in the deleted items bin conceals it
from the government” and that Medlin, “the government's own expert, testified
how easy it is to retrieve an Outlook email from a deleted items bin”. U.S. v. Katakis, supra. So he found that a “rational jury . . . could
not find that Katakis violated § 1519 by deleting the emails on Swanger's
Dell computer because there was no evidence from which the jury could infer
that Katakis destroyed or concealed the emails.” U.S. v. Katakis, supra.
The judge therefore granted Katakis’ motion for judgment of
acquittal under Rule 29 and ordered that the “verdict of guilty against Katakis
on Count Three is hereby set aside, and the Clerk is instructed to enter a
judgment of acquittal in favor of . . . Katakis on Count Three of the Superseding
Indictment.” U.S. v. Katakis, supra.
No comments:
Post a Comment