Case o' The Week: Ninth Scrubs Gov't Theories, Conviction Washes Away - Katakis and Obstruction of Justice

  Altering is a no-no. 

Destroying, mutilating, and concealing is verboten. 

Falsifying will get you twenty, under 18 USC Section 1519.

But “scrubbing?” Maybe not enough for obstruction (at least, not here).

United States v. Katakis, 2015 WL 5090792 (9th Cir. May 15, 2015), decision available here.

Players: Decision by Judge N.R. Smith, joined by Judges Berzon and Chief D.J. Collins (D. Nev.).

Facts: Katakis was suspected of bid rigging. Id. at *1. He received a notice that his bank records had been subpoenaed. Id. Two days later, he purchased and downloaded “DriveScrubber 3.” Id. “Once a file is overwritten by DriveScrubber, it is impossible to retrieve it.” Id. That program was installed on two PCs (and an email server) associated with Katakis. Id. 

The government later seized those three computers, as well as a fourth. Id. at *2. On the fourth PC, the feds discovered ten incriminating emails between Katakis and a business partner. Id. Though expected to be on the three “DriveScrubber” computers, those incriminating emails were not in fact found. Id. 

Katakis was charged with obstruction under 18 USC § 1519. Id. At trial, the government’s forensic expert (Special Agent Scott Medlin) opined that DriveScrubber was used to delete “deleted” incriminating emails from the PC’s free space. Id.

A defense expert showed that was impossible: Medlin conceded he was wrong. “By the time of its closing argument, the Government’s primary theory of the case had collapsed.” Id. at *3. Although the jury convicted, but the district court granted the defense motion for judgment of acquittal. Id. at *4.

Issue(s): “We have only one question regarding the sufficiency of the evidence before us: whether the Government carried its burden to show actual destruction or concealment. There is no dispute that there was sufficient evidence for a rational juror to conclude that the Government satisfied the third element, that Katakis intended that his actions would obstruct the investigation into the bid-rigging scheme. A rational juror also could have concluded that Katakis knew or believed that his actions could destroy or conceal the ten incriminating emails. However, the Government failed to charge Katakis with attempted obstruction . . . . . Therefore, in order to secure a conviction, the Government was required to prove that Katakis actually destroyed or concealed ‘electronic records and documents.’” Id. at *5.

Held: “In light of Medlin’s retraction, there was no evidence upon which a reasonable juror could conclude that Katakis used DriveScrubber to irretrievably overwrite (that is, destroy or conceal) the ten incriminating emails from the free space of any of the computers. The theory that the Government presented in its case-in-chief cannot support Katakis’s conviction.” Id. at *5.

Of Note: The Court is, fair to say, unimpressed with this prosecution and its “half baked” theories. Id. at *6. Agent Medlin opined that DriveScrubber could have been used to delete email transmission logs from the three seized PCs. Id. at *5-*6. However, Medlin didn’t testify that the transmission logs actually entered free space, where DriveScrubber could have, well, scrubbed them. Id. at *6. In fact, the “full theory presented . . . did not crystallize as an argument until this appeal.” Id.  

If there ever was a case proving the need for defense experts, Katakis is it. In Katakis that expert was Don Vilfer of Capitol Digital– see bio here.

How to Use: Section 1519 authorizes up to twenty years for anyone who “alters, destroys . . . conceals . . .  any record . . . with the intent to . . . obstruct . . . the investigation.” See id. at *4. Is deleting an email in an email program "destroying" or "concealing" a record triggering Section 1519? 

Nope.  

In a very tech-savvy analysis, Judge Smith works through what happened when Katakis hit the “delete” button in his email program. Id. at *9. The incriminating emails weren’t, of course, deleted: they were just moved to the “deleted items” folder. Id. In this case, “removing an email from one folder and placing it another was not sufficient to actually conceal it.” Id. at *11. 

It is a great holding and worth a close read when a client’s “deleted items” email folder have an unfortunate email or two (moved there as the feds start sniffing around).

                                               

For Further Reading: The email server had its data wiped: what does that reveal about intent? 

Can the data be recovered? 

For an interesting discussion of the tech (in a higher-profile case), see The FBI Has Clinton’s Email Server. Now What? available here.

Image of DriveScrubber 3 from http://ecx.images-amazon.com/images/I/51vq%2B4M9C8L.jpg

Steven Kalar, Federal Public Defender, Northern District of California.  Website at www.ndcalfpd.org

.