Wednesday, May 28, 2014

Obstruction of Justice, DriveScrubber and Emails

As a recent opinion from a federal District Court Judge who sites in the U.S. District Court for the Eastern District of California explains, in a “Superseding Indictment, the government charged defendant Andrew Katakis with violation of the Sherman Antitrust Act, 15 U.S. Code § 1; conspiracy to commit mail fraud18 U.S. Code § 1349; and obstruction of justice18 U.S. Code § 1519.”  U.S. v. Katakis, 2014 WL 1884213 (2014).  You can, if you are interested, read more about the charges and the trial in the press release you can find here.
After “a twenty-three-day . . . trial,” the jury convicted Katakis on the Sherman Antitrust and obstruction of justice charges “but was unable to reach a verdict on the conspiracy to commit mail fraud charge.”  U.S. v. Katakis, supra.  Katakis then filed a motion for a judgment of acquittal on the obstruction of justice charge pursuant to Federal Rule of Criminal Procedure 29.  U.S. v. Katakis, supra.  As Rule 29(c) explains, once the jury returns a guilty verdict, the defendant has roughly fourteen days in which to file a motion for a judgment of acquittal; if the jury returned a guilty verdict, the judge can “set [it] aside . . . and enter an acquittal.”  Federal Rule of Criminal Procedure 29(c). 
The judge began his analysis of Katakis’ Rule 29 motion by explaining that the superseding indictment charged and the
evidence at trial established that the government began an investigation in 2009 of anti-competitive conspiracies between Katakis and other purchasers at public foreclosure auctions in San Joaquin County, California. As part of that investigation, the government subpoenaed bank records for Katakis and his company from Oak Valley Community Bank on August 27, 2010. In response to the subpoena, the bank sent Katakis a letter on September 1, 2010 informing him of the subpoena and providing him with a copy of it. The Superseding Indictment charged that Katakis violated § 1519 `[i]n or about September 2010’ when he `deleted and caused others to delete electronic records and documents’ and `installed and used and caused others to install and use a software program that overwrote deleted electronic records and documents so that they could not be viewed or recovered.’ . . .
U.S. v. Katakis, supra. 
He also noted that the prosecution “primarily, if not exclusively,” pursued the
obstruction of justice charge by seeking to establish that Katakis purchased and ran a program called DriveScrubber 3 (`DriveScrubber’) on at least four computers and the company mail server shortly after he received a copy of the subpoena.

According to the initial testimony from the government's expert, the program successfully deleted emails on Katakis' Dell computer, Steve Swanger's Asus computer, and the company mail server. To rebut this evidence, Katakis offered expert testimony that discredited the testimony from the government's expert. Katakis timely moved for a judgment of acquittal pursuant to Rule 29(b) and, during argument, the government indicated it would pursue the obstruction of justice charge based on [his] alleged manual deletion of emails independent of running DriveScrubber.
U.S. v. Katakis, supra. 
According to the document you can find here, Steve Swanger was a “cooperating witness” in the investigation/prosecution.  U.S. v. Katakis, et. al., Corrected Notice of Motion and Memorandum of Points and Authorities 2 (May 5, 2014).  The reference to Rule 29(b) in the above-quoted paragraph refers to the fact that, as was his right, Katakis filed a motion for a judgment of acquittal before the jury returned a verdict; and, as the rule allows, the judge reserved ruling on the motion until after the jury had returned its verdict.  U.S. v. Katakis, supra.  In this opinion, the judge is issuing his ruling on the motion.  U.S. v. Katakis, supra. 
He began his ruling by noting that under Rule 29, a must enter a judgment of acquittal
`of any offense for which the evidence is insufficient to sustain a conviction.’ [Rule 29(a).] `A motion for Judgment of Acquittal is reviewed on a sufficiency-of-the-evidence standard.’ U.S. v. Graf, 610 F.3d 1148 (U.S. Court of Appeals for the 9th Circuit 2010) (quoting U.S. v. Stoddard, 150 F.3d 1140 (U.S. Court ofAppeals for the 9th Circuit 1998)). `Under that standard, evidence supports a conviction, if, viewed in the light most favorable to the government, it would allow any rational trier of fact to find the essential elements of the crime beyond a reasonable doubt.’  Id.  U.S. v. Graf, supra (quoting U.S. v. Stoddard, supra).

For the jury to have found Katakis guilty of obstruction of justice, it had to find that the government proved each of the following elements beyond a reasonable doubt:

[1] that defendant Katakis knowingly altered, destroyed, or concealed electronic records or documents; [2] that defendant Katakis acted with the intent to impede, obstruct, or influence an investigation that he either knew of or contemplated; and [3] that the investigation was about a matter by or within the jurisdiction of the United States Department of Justice or Federal Bureau of Investigation.
U.S. v. Katakis, supra. 
The judge began his analysis of Katakis’ motion by noting that, “[u]nder the first element” set out above, “the government . . . had to show that Katakis destroyed or concealed electronic documents or records, not merely that he attempted or even intended to do so.”  U.S. v. Katakis, supra.  He noted that the prosecution’s theory in
support of the obstruction of justice charge focused on ten Microsoft Outlook emails primarily between Katakis and Swanger sent between September 9, 2008 and July 20, 2009. . . . The government established that it was unable to find any of the ten emails on Katakis' Dell computer, Swanger's Asus computer, or the mail server. . . . All ten emails were found, however, in the deleted items bin on Swanger's Dell computer. . . .

The government now argues that the jury's verdict can be upheld based on one of three theories: (1) Katakis deleted the ten emails on his Dell computer, Swanger's Asus computer, and the mail server and then overwrote them using DriveScrubber; (2) Katakis manually deleted the ten emails on his Dell computer, Swanger's Asus computer, and the mail server; or (3) Katakis manually moved the ten emails to the deleted items folder in Swanger's Dell computer. The court has no doubt that the government . . . resorted to the second and third theories after the first theory failed. In its closing argument, the government told the jury:  `All you have to do is find that Andrew Katakis hit the delete button. That's it. It's that simple.’ . . .  
U.S. v. Katakis, supra. 
The judge analyzed each theory, in the order set out above.  U.S. v. Katakis, supra.  As to the DriveScrubber theory, he explained that the prosecution introduced
sufficient evidence for a jury to find Katakis purchased DriveScrubber on September 3, 2010 and . . . installed and ran it on his Dell computer on September 3, on Swanger's Asus and Dell computers and the mail server on September 4, and on another computer on September 15. . . . The undisputed evidence at trial was that DriveScrubber overwrites and therefore permanently deletes files on the free space of a computer.

To prove Katakis used DriveScrubber to overwrite the emails, the government offered the testimony of FBI Special Agent/Computer Forensic Examiner Scott Medlin. Medlin opined that the ten emails were no longer on Katakis’ Dell computer, Swanger's Asus computer, or the mail server because they had been double-deleted and then overwritten by DriveScrubber. Medlin explained that this could occur if a user deletes an email in Outlook, then double-deletes the email by deleting the email from the Outlook deleted items bin. According to Medlin's testimony . . . , when an Outlook email is double-deleted, the email is sent to the free space of the computer. . . . Because none of the ten emails could be found on Katakis' Dell computer, Swanger's Asus computer, or the mail server, and Katakis had installed DriveScrubber on those devices, Medlin concluded Katakis must have double-deleted the emails and then used DriveScrubber to overwrite them in the free space. . . .
U.S. v. Katakis, supra. 
The judge also explained, though, that in presenting the defense’s case, Katakis
offered expert testimony from Donald Vilfer that discredited Medlin's testimony and the government's theory. Vilfer testified that, because the computers and mail server at issue were part of a Microsoft Exchange Database, emails were sent directly to the Exchange Database upon double-deletion. . . . Vilfer explained that DriveScrubber could not have deleted any of the double-deleted emails from the free space because, as they were stored in the Exchange Database, they never entered the free space. . . .He further explained that DriveScrubber could not affect a doubledeleted email stored in the Exchange Database unless the entire operating system for a computer or mail server was `scrubbed’ so that nothing remained. . . .
U.S. v. Katakis, supra.  In a footnote, the judge points out that the prosecution “neither suggested nor presented evidence indicating that Katakis scrubbed, or destroyed, the operating systems of the computers or mail server.”  U.S. v. Katakis, supra. 
He then noted that, given Vilfer’s testimony, the prosecution recalled Medlin
in its rebuttal case. Departing from his earlier testimony, Medlin confirmed the accuracy of Vilfer's testimony: that double-deleted Outlook emails on the computers and mail server could not have been affected by DriveScrubber because they were stored in the Exchange Database and never entered the free space on the computers or mail server.
U.S. v. Katakis, supra.  The judge therefore found that a
rational jury could not have found that Katakis destroyed or concealed any of the emails in question using DriveScrubber because the undisputed evidence from both experts at trial was that DriveScrubber could only overwrite emails in the free space of the computers or mail server and the emails never entered the free space.
U.S. v. Katakis, supra. 
He then took up the prosecution’s second theory – that Katakis manually deleted the emails.  U.S. v. Katakis, supra.  He noted that there was “no testimony” at trial about
Katakis manually deleting the emails on his Dell computer, Swanger's Asus computer, or the mail server. Although Swanger testified that he saw Katakis searching for documents prior to running DriveScrubber on his Asus computer, when asked whether he `observe[d] Andrew Katakis deleting any documents,’ Swanger testified: `I wasn't sure if he was-what he was doing. I saw him on [the Asus computer], clicking and moving things around, but I–I didn't-I didn't pay attention closely, on that computer, what it was he was doing.’ . . . Swanger also `wasn't quite sure what was deleted and what wasn't [on the Asus], because [he] didn't have a clear memory of what was there.’ . . . 

The government was thus left to rely on the inference that, because the ten emails in question were not found on Katakis' Dell computer, Swanger's Asus computer, or the mail server, Katakis must have double-deleted them. . . .
U.S. v. Katakis, supra. 
The judge explained that, under Rule 29, he was required to “accept this inference . . .  and assume the jury could have found that Katakis double-deleted the emails on his computer, Swanger's Asus computer, and the mail server” and that “double-deleting an email is sufficient to destroy or conceal the email.”  U.S. v. Katakis, supra.  He noted, however, that even though he made those assumptions, the evidence was still not sufficient to prove Katakis violated 18 U.S. Code § 1519.  U.S. v. Katakis, supra. 
To prove that, the government had to prove, beyond a reasonable doubt, that when “Katakis double-deleted the emails he knew of or contemplated the investigation at that time.”  U.S. v. Katakis, supra.  To establish that, the prosecution argued  that Katakis learned about the criminal investigation when he received a copy of a bank subpoena “on September 1, 2010.”  U.S. v. Katakis, supra.  The judge found, though, that while
there was sufficient evidence for the jury to find that Katakis knew about the investigation in September 2010, there was no evidence from which the jury could have inferred that Katakis double-deleted the emails on a date “reasonably near” September 2010. In fact, there was not even circumstantial evidence from which the jury could have inferred an approximate date when Katakis double-deleted the emails.
U.S. v. Katakis, supra.  He noted that the prosecution did not “even [present] even circumstantial evidence from which the jury could have inferred an approximate date when Katakis double-deleted the emails.”  U.S. v. Katakis, supra.  He found, therefore, that “a rational jury could not have found Katakis violated § 1519 by double-deleting the emails on his Dell computer, Swanger's Asus computer, or the mail server because there was no evidence from which the jury could infer that he did so with the requisite intent to obstruct investigation that he knew of or contemplated.”  U.S. v. Katakis, supra. 
The judge then took up the prosecution’s third theory, which relied on Swanger’s testimony that when Katakis installed DriveScrubber on Swanger’s Dell computer, “he saw Katakis deleting emails on that computer and, when Swanger returned to work on Monday, almost all of the emails were gone from his Dell computer.”  U.S. v. Katakis, supra.  The judge noted that Medlin and Vilfer “testified that the ten emails in question were recovered from the deleted items bin on Swanger's Dell computer.” U.S. v. Katakis, supra.  And he explained that “the government contends that placing the emails in the deleted items bin on Swanger's Dell computer constituted destruction or concealment under § 1519.” U.S. v. Katakis, supra.
The judge pointed out, however, that the “undisputed evidence” at trial was that
deleting an Outlook email places the email in the deleted items bin and the email remains in that folder unless and until a user takes further action. . . . The user can move the email back into his inbox, into a different Outlook folder, or doubledelete the email by deleting it from the deleted items bin. . . . There was sufficient evidence at trial for the jury to find that Katakis deleted the ten emails on Swanger's Dell computer and thereby moved them from the inbox to the deleted items bin. 
U.S. v. Katakis, supra. He also noted that to support a conviction for violating 18 U.S. Code § 1519, the prosecution must have introduced sufficient evidence from which
the jury could find that placing the emails in the deleted items bin destroyed or concealed them. At trial, however, the undisputed evidence was that the ten emails on Swanger's Dell computer were recovered and thus there was no evidence from which the jury could infer that they were destroyed. The government cannot simply rely on the label of `deleting’ when it is undisputed that `deleting’ an email within Outlook simply moves it to another folder where it remains easily accessible.
U.S. v. Katakis, supra. 
He also noted there was no evidence from which a reasonable jury “could infer that placing an email in the deleted items bin conceals it from the government” and that Medlin, “the government's own expert, testified how easy it is to retrieve an Outlook email from a deleted items bin”. U.S. v. Katakis, supra.  So he found that a “rational jury . . . could not find that Katakis violated § 1519 by deleting the emails on Swanger's Dell computer because there was no evidence from which the jury could infer that Katakis destroyed or concealed the emails.” U.S. v. Katakis, supra. 
The judge therefore granted Katakis’ motion for judgment of acquittal under Rule 29 and ordered that the “verdict of guilty against Katakis on Count Three is hereby set aside, and the Clerk is instructed to enter a judgment of acquittal in favor of . . .  Katakis on Count Three of the Superseding Indictment.” U.S. v. Katakis, supra. 

No comments: