United States v. Andrew Katakis

FOR PUBLICATION

UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT

UNITED STATES OF AMERICA, No. 14-10283
Plaintiff-Appellant,
D.C. No.
v. 2:11-cr-00511-WBS-2

ANDREW B. KATAKIS,
Defendant-Appellee. OPINION

Appeal from the United States District Court
for the Eastern District of California
William B. Shubb, Senior District Judge, Presiding

Argued and Submitted
May 15, 2015—San Francisco, California

Filed August 31, 2015

Before: Marsha S. Berzon and N. Randy Smith, Circuit
Judges and Raner C. Collins,* Chief District Judge.

Opinion by Judge N.R. Smith

*
The Honorable Raner C. Collins, Chief District Judge for the U.S.
District Court for the District of Arizona, sitting by designation.
2 UNITED STATES V. KATAKIS

SUMMARY**

Criminal Law

The panel affirmed the district court’s order granting
Andrew Katakis a judgment of acquittal after a jury convicted
him of obstruction of justice, in violation of 18 U.S.C.
§ 1519, in a case in which Katakis, after learning that federal
authorities had subpoenaed his bank records in connection
with an investigation into a scheme to rig bids at foreclosure
auctions, installed onto his home computer a program
designed to wipe hard drives clean of all information.

The panel affirmed because the evidence was insufficient
to show that Katakis actually deleted electronic records or
files, and because proving that Katakis moved emails from an
email client’s inbox to the deleted items folder does not
demonstrate Katakis actually concealed those emails within
the meaning of § 1519.

COUNSEL

Adam D. Chandler (argued), Attorney; William J. Baer,
Assistant Attorney General; Brent Snyder, Deputy Assistant
Attorney General; Anna Tryon Pletcher, Tai S. Milder, May
Lee Heye, Kelsey C. Linnett, Kristen C. Limarzi, and James
Joseph Fredricks, Attorneys, United States Department of
Justice, Antitrust Division, Washington, D.C., for Plaintiff-
Appellant.

**
This summary constitutes no part of the opinion of the court. It has
been prepared by court staff for the convenience of the reader.
 UNITED STATES V. KATAKIS 3

Elliot R. Peters (argued), Steven A. Hirsch, Jennifer A.
Huber, and Elizabeth K. McCloskey, Keker & Van Nest LLP,
San Francisco, California, for Defendant-Appellee.

OPINION

N.R. SMITH, Circuit Judge:

The Government appeals the district court’s order
granting Katakis’s Fed. R. Crim. P. 29 motion. The district
court vacated Katakis’s conviction and entered a judgment of
acquittal, holding that the evidence was insufficient to
support the jury’s verdict. The Government’s theory of
liability collapsed during trial, and the Government now
raises several alternative theories to try and rescue the
conviction. The evidence was insufficient to show that
Katakis actually deleted electronic records or files. Further,
proving Katakis moved emails from an email client’s inbox
to the deleted items folder does not demonstrate Katakis
actually concealed those emails within the meaning of
§ 1519. We affirm.

BACKGROUND

This case arises from an investigation by federal
authorities into a scheme to rig bids at foreclosure auctions in
2008 and 2009. By 2010, the investigation focused on
Andrew Katakis as one of the primary real estate investors
helming the conspiracy. On September 1, 2010, Katakis
received a letter from his bank informing him that
federal investigators had subpoenaed his bank records.
On September 3, 2010, Katakis purchased, downloaded,
and installed a program called DriveScrubber 3
4 UNITED STATES V. KATAKIS

(“DriveScrubber”) onto his home computer, a Dell
(“Katakis’s Dell”). DriveScrubber is a program designed to
wipe hard drives clean of all information. DriveScrubber
may be used to overwrite all of the information in a hard
drive’s unallocated or “free” space. Free space is the portion
of the hard drive that is not allocated for the use of the
computer’s programs or operating system; items that are
deleted by a user may “fall” into the free space. There, the
deleted item is not actually removed from the computer right
away; the space it occupies on the hard drive has simply been
made available to be overwritten. Instead of waiting for
another file to overwrite the deleted file by chance,
DriveScrubber actively overwrites all data in the unallocated
space of a hard drive, permanently erasing any files that had
fallen into the free space. Once a file is overwritten by
DriveScrubber, it is impossible to retrieve it.

Katakis’s business partner and alleged co-conspirator,
Steve Swanger, kept two computers at their office: an ASUS
(“Swanger’s ASUS”), and a Dell (“Swanger’s Dell”).
Swanger’s Dell was used primarily for emailing with Katakis,
and Swanger’s ASUS was used for general internet searching.
On Saturday, September 4, 2010, Katakis summoned
Swanger to their business office. Katakis told Swanger that
he wanted to install a “scrubber program” on their computers
and that there was “nothing wrong with us cleaning our
computers.” Swanger observed Katakis use Swanger’s
ASUS and perform a search for emails involving members
of the bid-rigging conspiracy. At 4:40 pm, Katakis installed
DriveScrubber on the Swanger ASUS. This copy of
DriveScrubber was different from the one installed on
 UNITED STATES V. KATAKIS 5

Katakis’s Dell.1 Swanger did not observe any deletions on
the ASUS; he only observed Katakis “clicking and moving
things around.”

Katakis then moved to Swanger’s Dell and installed
DriveScrubber at 4:47 pm. The Swanger Dell had 4,000
emails on it, as Swanger was not in the habit of regularly
deleting his emails. Swanger kept hard copies of some
important emails, because he feared Katakis might try and
wipe clean the hard drives some day. Swanger observed
Katakis checking boxes on various emails and unchecking
those emails that Katakis believed that Swanger needed.
Katakis gave up sorting the emails after about five minutes
and pressed the delete key. After seeing that it would take a
long time for the emails to be deleted, Katakis went home.
When he returned to the office on Monday, Swanger noticed
that almost all of the emails on his Dell had been deleted
from his email inbox.

At 5:37 pm on September 4, 2010, the same copy of
DriveScrubber that was installed on Katakis’s Dell was
installed on the office’s mail server (“GD Mail Server”). The
server managed all email sent or received in the office
through the Microsoft Outlook program. The GD Mail
Server was operated by a program called Exchange. Katakis
had the authority to install programs on the GD Mail Server
and knew that DriveScrubber had been installed on it.

1
Although the program installed on Katakis’s Dell and Swanger’s
ASUS was the same, the evidence indicated that two different copies were
used. The version of DriveScrubber installed on Swanger’s ASUS and
Swanger’s Dell was purchased using Swanger’s credit card.
6 UNITED STATES V. KATAKIS

The Government seized the four computers in the course
of its investigation into the bid-rigging scheme. When
examining Swanger’s Dell, the Government discovered ten
incriminating emails that implicated Katakis in the
conspiracy. Katakis was either a sender or recipient of all ten
emails. Swanger was also either the sender or recipient of all
ten emails. The emails were discovered in the deleted items
folder in Swanger’s email client. Metadata attached to the
emails showed that the emails had passed through the GD
Mail Server and that Katakis had received and opened all of
them. Special Agent Scott Medlin conducted a forensic
analysis of the other three computers. Because Katakis’s
Dell, Swanger’s ASUS, and the GD Mail Server were all part
of the email network shared with Swanger’s Dell, Medlin
expected to find traces of the ten emails on these computers.
Medlin was unable to locate any trace of the ten incriminating
emails, but did not think that enough time had passed for all
traces of the emails to be removed by the gradual automatic
overwriting process, leading him to believe that Katakis had
destroyed them using DriveScrubber.

Based on the discrepancy between the presence of the ten
incriminating emails on Swanger’s Dell but not on the other
computers, the Government sought and obtained an
indictment charging Katakis with obstruction of justice, in
violation of 18 U.S.C. § 1519.2 The indictment alleged that
Katakis “deleted and caused others to delete electronic
records and documents. KATAKIS also installed and used
and caused others to use a software program that overwrote

2
Katakis was also charged with bid-rigging, in violation of 15 U.S.C.
§ 1, and conspiracy to commit mail fraud, in violation of 18 U.S.C.
§ 1349. The jury found Katakis guilty of bid-rigging. That conviction is
not before us.
 UNITED STATES V. KATAKIS 7

deleted electronic records and documents so that they could
not be viewed or recovered.” Notably, the indictment failed
to charge attempt, thus committing the Government to prove
actual deletion.

The Government proceeded to trial on the theory that
Katakis ran the DriveScrubber program on his Dell,
Swanger’s ASUS, and the GD Mail Server, to erase all traces
of the ten incriminating emails. The Government’s key
witness was Medlin, who testified as an expert. Medlin
testified that Katakis “double-deleted” emails; that is, he
deleted them once from the mail client and then again when
he emptied the deleted items folder. After they were double
deleted, the emails fell into the free space, where Medlin
opined that they were irretrievably overwritten by
DriveScrubber.

Katakis called Don Vilfer as a rebuttal expert. Vilfer
testified that Medlin’s theory of what happened to double-
deleted emails was incorrect, based on how the Exchange
program on the GD Mail Server worked. According to
Vilfer, a double-deleted email would not fall into the free
space, as Medlin testified, but would remain within the
portion of the hard drive allocated for the Exchange database.
The crux of Vilfer’s testimony was that, given how the
Exchange program operated, it would be impossible for
DriveScrubber to overwrite any double-deleted emails,
including the ten incriminating emails that were at the heart
of the Government’s case. Vilfer further noted that the
Exchange program itself removed double-deleted emails after
a certain period of time, usually fourteen days. Vilfer
testified that he was able to recover thousands of double-
deleted emails, but he could not find the ten incriminating
emails. Vilfer agreed with Medlin that it was suspicious that
8 UNITED STATES V. KATAKIS

there were no traces of the ten incriminating emails on any
computer other than Swanger’s Dell. However, he explained
that absence by opining that the ten incriminating emails
(including metadata) had been fabricated. The defense
sought to draw an inference that Swanger fabricated the ten
incriminating emails and the metadata indicating Katakis had
seen them in order to implicate Katakis.

In rebuttal, Medlin admitted that Vilfer’s testimony was
correct: it was impossible for DriveScrubber to have deleted
the ten incriminating emails. Medlin testified that his opinion
was unchanged, because DriveScrubber could have deleted
transmission logs associated with the ten incriminating
emails. Vilfer testified in response that deleting the
transmission logs would not have deleted the emails
themselves.

By the time of its closing argument, the Government’s
primary theory of the case had collapsed. In closing, the
Government offered two theories of liability to the jury.
First, the Government argued a purely circumstantial case.
The ten incriminating emails were present on Swanger’s Dell,
and both experts testified that they would have expected to
find them on the other computers. The only logical inference,
the Government reasoned, was that Katakis had somehow
deleted them. Second, the Government relied on Swanger’s
testimony for an alternative theory of liability. Under this
theory, DriveScrubber was only relevant to prove intent. If
the jury believed Swanger’s testimony that Katakis hit the
delete key and sent emails on Swanger’s Dell to the deleted
items folder, this was legally sufficient to convict Katakis of
obstruction of justice. The Government alluded to an
additional theory of liability in its rebuttal, arguing that
 UNITED STATES V. KATAKIS 9

Katakis used DriveScrubber to delete remnants of the emails
(the transmission logs).

The jury convicted Katakis of obstruction of justice.
Katakis filed a motion for judgment of acquittal, alleging,
among other things, that the evidence was insufficient to
convict him. The district court agreed, and, after carefully
evaluating each of the Government’s theories of liability and
finding them all insufficient to sustain a conviction for
obstruction of justice, vacated Katakis’s conviction and
entered a judgment of acquittal. The Government appeals.

DISCUSSION

We review de novo the district court’s order granting a
judgment of acquittal pursuant to Fed. R. Crim. P. 29. United
States v. Sanchez, 639 F.3d 1201, 1203 (9th Cir. 2011). Our
review “is governed by Jackson v. Virginia, which requires a
court of appeals to determine whether ‘after viewing the
evidence in the light most favorable to the prosecution, any
rational trier of fact could have found the essential elements
of the crime beyond a reasonable doubt.’” United States v.
Nevils, 598 F.3d 1158, 1163–64 (9th Cir. 2010) (en banc)
(citation omitted) (quoting Jackson v. Virginia, 443 U.S. 307,
319 (1979)). Nevils prescribes the structure of our inquiry:
“[f]irst, a reviewing court must consider the evidence
presented at trial in the light most favorable to the
prosecution.” Id. at 1164. “Second, . . . the reviewing court
must determine whether this evidence, so viewed, is adequate
to allow ‘any rational trier of fact to find the essential
elements of the crime beyond a reasonable doubt.’” Id.
(alterations omitted) (quoting Jackson, 443 U.S. at 319).
“[T]he government does not need to rebut all reasonable
interpretations of the evidence that would establish the
10 UNITED STATES V. KATAKIS

defendant’s innocence, or ‘rule out every hypothesis except
that of guilt beyond a reasonable doubt.’” Id. (quoting
Jackson, 443 U.S. at 326). That said, “evidence is
insufficient to support a verdict where mere speculation,
rather than reasonable inference, supports the government’s
case, or where there is a ‘total failure of proof of a requisite
element.’” Id. at 1167 (citations and alterations omitted)
(quoting Briceno v. Scribner, 555 F.3d 1069, 1079 (9th Cir.
2009)).

Katakis was convicted of obstruction of justice, in
violation of 18 U.S.C. § 1519. That statute provides:

Whoever knowingly alters, destroys,
mutilates, conceals, covers up, falsifies, or
makes a false entry in any record, document,
or tangible object with the intent to impede,
obstruct, or influence the investigation or
proper administration of any matter within the
jurisdiction of any department or agency of
the United States . . . or contemplation of any
such matter or case, shall be fined under this
title, imprisoned not more than 20 years, or
both.

18 U.S.C. § 1519. Section “1519 was intended to prohibit, in
particular, corporate document-shredding to hide evidence of
financial wrongdoing.” Yates v. United States, 135 S. Ct.
1074, 1081 (2015). In order to prove a violation of § 1519,
the Government must show that the defendant (1) knowingly
committed one of the enumerated acts in the statute, such as
destroying or concealing; (2) towards “any record, document,
or tangible object”; (3) with the intent to obstruct an actual or
 UNITED STATES V. KATAKIS 11

contemplated investigation by the United States of a matter
within its jurisdiction.

We have only one question regarding the sufficiency of
the evidence before us: whether the Government carried its
burden to show actual destruction or concealment. There is
no dispute that there was sufficient evidence for a rational
juror to conclude that the Government satisfied the third
element, that Katakis intended that his actions would obstruct
the investigation into the bid-rigging scheme. A rational
juror also could have concluded that Katakis knew or
believed that his actions could destroy or conceal the ten
incriminating emails. However, the Government failed to
charge Katakis with attempted obstruction in the indictment.
Therefore, in order to secure a conviction, the Government
was required to prove that Katakis actually destroyed or
concealed “electronic records and documents.”

In light of Medlin’s retraction, there was no evidence
upon which a reasonable juror could conclude that Katakis
used DriveScrubber to irretrievably overwrite (that is, destroy
or conceal) the ten incriminating emails from the free space
of any of the computers. The theory that the Government
presented in its case-in-chief cannot support Katakis’s
conviction. Nevertheless, the Government contends that the
district court erred, because there are three other theories of
liability that the jury could have credited that satisfy the
elements of the statute: (1) Katakis used DriveScrubber to
delete the transmission logs belonging to the ten
incriminating emails; (2) Katakis double deleted emails on
his Dell, Swanger’s ASUS, and the GD Mail Server; or
(3) Katakis single-deleted emails on Swanger’s Dell, moving
those emails from the inbox to the deleted items folder. For
the reasons set out below, we agree with the district court that
12 UNITED STATES V. KATAKIS

the evidence was insufficient to convict Katakis of
obstruction of justice on any of these theories.

A. DriveScrubber Theory

The first theory that the Government advances relies on
testimony given by Medlin during rebuttal to the effect that,
although Katakis could not have deleted the ten incriminating
emails themselves, he could have deleted transmissions logs
generated by the emails.3 Forced to retract his testimony that
the ten incriminating emails could have been deleted by
DriveScrubber, Medlin testified that he did not retract his
opinion that Katakis used DriveScrubber to destroy electronic
records, because he likely used DriveScribber to overwrite
transmission logs generated by the emails.

Medlin testified that transmission logs are generated daily
by the Exchange system. These logs resided outside the
Exchange database (so they were separate from the emails
themselves), and would “remain” in the program for a period
of time before falling off into the free space to be made
available for the DriveScrubber program to overwrite.
Medlin could not testify as to how long it took for the
transmission logs to fall into free space; he noted that there
was a default time programmed into the Exchange database
(although he did not recall what the default was), but that
time could be changed by the system administrator. On

3
The Government likely waived this theory by failing to present it to the
district court as part of its opposition to Katakis’s Rule 29 motion. See
United States v. Piazza, 647 F.3d 559, 565 (5th Cir. 2011) (holding that
government waived an argument it failed to present in its response to
defendant’s motion for new trial). However, Katakis has not asserted
waiver on appeal. Therefore, Katakis has “waive[d] waiver.” Tokatly v.
Ashcroft, 371 F.3d 613, 618 (9th Cir. 2004).
 UNITED STATES V. KATAKIS 13

cross-examination, Medlin admitted that he did not perform
an investigation into whether a default time was even set on
the Exchange database. Medlin also testified that he did not
perform any investigation as to whether any user had entered
a command causing the Exchange database to “clean up” the
transmission logs and let them enter free space.

Although the Government is entitled to every reasonable
inference from the evidence, a conviction may not be based
on mere speculation. Nevils, 598 F.3d at 1167. “[A]
reasonable inference is one that is supported by a chain of
logic, rather than mere speculation dressed up in the guise of
evidence.” United States v. Del Toro-Barboza, 673 F.3d
1136, 1144 (9th Cir. 2012) (quotation marks and alteration
omitted) (quoting Juan H. v. Allen, 408 F.3d 1262, 1277 (9th
Cir. 2005)). The logical chain supporting the Government’s
theory is as follows: (1) Katakis downloaded and installed
DriveScrubber, which, along with Swanger’s testimony,
demonstrates his intent to destroy incriminating emails and
other electronic records; (2) DriveScrubber could only
destroy the emails if they were in the free space; (3) the
transmission logs enter the free space through one of two
ways, either at the default time or through user action;
(4) both agents testified that they expected to find email
remnants, including transmission logs, on the computers; and
(5) no email remnants were found. From this chain of logic,
the Government contends a reasonable juror could have
concluded that Katakis destroyed the logs using
DriveScrubber.

However, the Government’s chain of logic misses an
important link: there is no evidence whatsoever that the
transmission logs were made available, in any manner, for
DriveScrubber to overwrite. The Government invited the
14 UNITED STATES V. KATAKIS

jury to speculate as to whether the transmission logs entered
the free space; the Government’s own expert could not testify
that they ever did. The transmission logs theory was
developed entirely in rebuttal in an attempt to save the
Government’s case. Make no mistake, the Government’s
original plan failed. Indeed, the full theory presented here did
not crystallize as an argument until this appeal. The
Government did not argue in its closing that deletion of the
transmission logs could, under § 1519, constitute the
destruction of electronic records; instead, the Government
asserted in its rebuttal that the absence of the logs was
evidence DriveScrubber was run to delete the emails. In light
of the way that this case was tried, it is not surprising that the
Government’s transmission log theory was half-baked.
Medlin admitted he never even investigated the possibility
that the transmission logs were removed to the free space
where they could have been deleted by DriveScrubber. In the
absence of that evidence, the jury was left to speculate not
only regarding how the transmission logs entered the free
space but if they ever did so. There was nothing preventing
the Government from having Medlin investigate this question
and provide evidence, even circumstantial evidence, from
which the jury could make the desired inference. However,
that evidence was entirely lacking in this case.4

4
The Government’s failure to develop this theory may have led to
another deficiency. Section 1519 requires that the defendant act
knowingly. A defendant “is said to act knowingly if he is aware ‘that that
result is practically certain to follow from his conduct, whatever his desire
may be as to that result.’” United States v. Bailey, 444 U.S. 394, 404
(1980) (quoting United States v. U.S. Gypsum Co., 438 U.S. 422, 445
(1978)). “[T]he term ‘knowingly’ merely requires proof of knowledge of
the facts that constitute the offense.” Bryan v. United States, 524 U.S.
184, 193 (1998). The Government failed to provide any evidence that
Katakis knew that transmission logs, a category of electronic record
 UNITED STATES V. KATAKIS 15

In the absence of that critical link in the logical chain of
inference, the evidence was not sufficient to convict Katakis
on this theory.

B. Double Deletion Theory

The Government’s second theory contends that a rational
juror could have found that Katakis double deleted emails on
all of the computers except Swanger’s Dell, and that, if he did
so with the requisite intent, he violated the statute. We shall
assume, without deciding, that double deletion would
constitute the requisite concealment or destruction element of
§ 1519. However, even with that assumption, no reasonable
juror could have found on this record that the Government
carried its burden to show that double deletion actually
occurred.

In this context, “double deletion” means that the
Government sought to first prove that Katakis pressed the
delete key after selecting emails in the inbox of the email
client, moving them to the deleted items folder or a recycling
bin. The Government’s theory asserted that Katakis then
deleted the emails a second time, with the intent that they
would fall into the free space of the hard drive so they could
be permanently overwritten by DriveScrubber. This theory
relies on two pieces of evidence, one direct and one
circumstantial. First, the Government points to direct
evidence that Swanger observed Katakis deleting emails.

wholly separate and distinct from the emails, even existed. There is no
evidence that Katakis knowingly destroyed these records. It is not clear
to us that Katakis could have been aware that the destruction of the
transmission logs was “practically certain” to result from running
DriveScrubber.
16 UNITED STATES V. KATAKIS

Given that fact, and the evidence that Katakis installed
DriveScrubber, the Government contends that a rational juror
could have inferred that he had double deleted the emails to
make them available for DriveScrubber to overwrite. Second,
the Government argues that a rational juror could have
inferred double deletion from the fact that the ten
incriminating emails were not found on any computer other
than Swanger’s Dell.

There are again significant factual flaws in the
Government’s argument. First, Swanger never offered any
testimony that he observed Katakis do anything on Katakis’s
Dell or the GD Mail Server. With regard to Swanger’s
ASUS, Swanger declined to testify that he actually observed
Katakis deleting anything, much less double-deleting the
emails. Swanger testified only that he saw Katakis “clicking
and moving things around.” Swanger never testified that he
noticed that any files or emails were missing on his ASUS,
whereas he testified that many emails were missing from his
Dell.

In the absence of direct evidence of double deletion, the
Government relies on a chain of circumstantial inferences
that a rational juror would have to credit to find that Katakis
double deleted the emails. The rational juror would first have
to find that Katakis intended to destroy the ten incriminating
emails; as to that point, there was sufficient evidence—the
installation of DriveScrubber. But the evidence that he
carried out this intent comes from a single fact: that the ten
incriminating emails were not found on Katakis’s Dell,
Swanger’s ASUS, or the GD Mail Server. Both experts
testified that they expected to find the emails on those
computers. In their absence, the Government argues that a
rational juror would be entitled to conclude that Katakis
 UNITED STATES V. KATAKIS 17

double deleted the emails. However, the Government never
provided the jury with any mechanism that would explain
how Katakis removed the emails from the three computers,
given that, as both experts ultimately agreed, double deletion
on the email client does not send an email to the free space,
where DriveScrubber could have destroyed it.

The Government’s theory is analogous to one that we
rejected in United States v. Lo, 231 F.3d 471 (9th Cir. 2000).
In Lo, the defendant was charged with mail fraud, which
required the government to prove that the defendant actually
mailed a document in furtherance of the fraud scheme. Id. at
475. The only evidence that the government could muster to
show that the document was mailed was testimony from an
employee that a document Lo submitted would have been
mailed in the ordinary course of its business. Id. at 475–76.
No one testified that they ever saw the document, no one
testified that they had sent it, there was no record it had
existed, and no one testified to receiving it. Id. at 476. We
found that this evidence was insufficient, and the inferences
that the jury was required to draw too “attenuated,” to support
a conviction for mail fraud. Id. at 477. In Lo, we were
particularly concerned that the evidence of fraudulent intent,
for which there was sufficient evidence, might lead a juror to
overlook the factual gaps in the government’s proof. Id.

We are faced with a similar concern here. In Lo, there
was no evidence that the document in question even existed,
id. at 476, while there were specific emails at issue in the
record here. But as in Lo, the evidence of the crime itself was
attenuated. There was no direct evidence in the record that
Katakis deleted the emails on his Dell, Swanger’s ASUS, or
the GD Mail Server, much less double-deleted them. The
evidence of Katakis’s intent was truly overwhelming, but the
18 UNITED STATES V. KATAKIS

Government’s attempts to prove that he actually performed
the acts of which he was accused, were incredibly weak. The
Government’s primary theory, that Katakis double deleted the
emails and then used DriveScrubber to overwrite them,
completely collapsed. Had this theory been available to the
jury, the jurors would have been entitled to conclude that
Katakis double deleted the emails, because, according to
Medlin’s initial testimony, this step is the necessary predicate
for making the emails available for DriveScrubber to
overwrite. The Government conceded that it was impossible
for DriveScrubber to overwrite the emails, but only the
possibility that DriveScrubber overwrote the emails supported
the inference of double deletion. Otherwise, both experts
testified that they would have expected to find the emails.

The Government now argues that the jury could have
inferred double deletion from the fact that the ten
incriminating emails could not be found on any of the three
computers, raising an inference that they were somehow
destroyed by a process that included double deletion. Under
Lo, this fact might be enough, if the Government had
provided any explanation that the jury could credit to explain
why the emails were not present. The Government was
entirely unable to explain (a) at trial, (b) in closing, (c) before
the district court, or now (d) on appeal, where the ten
incriminating emails, their traces, or their remnants went.
Indeed, the one theory that the Government provided, that
DriveScrubber was used to overwrite the emails, was
discredited and withdrawn. At closing, the Government
relied on Medlin’s eleventh-hour theory that email remnants,
not the emails themselves, had been overwritten by
DriveScrubber. After the collapse of the primary
DriveScrubber theory, the Government was left with no
 UNITED STATES V. KATAKIS 19

theory at all to explain what happened to the emails and why
neither expert could find any trace of them.5

The absence of the emails eliminates the logical inference
of double-deletion. Both experts testified that they expected
to find the emails if they were double deleted, but they also
explained that it was impossible for DriveScrubber to delete
them. As a result, double deletion cannot explain the absence
of the emails. That absence, far from corroborating the
Government’s theory, demonstrates a gaping hole in its logic.
Without a mechanism to make double deletion a necessary
inference to the cause of the emails’ absence, a rational juror
could not conclude, beyond a reasonable doubt, that double
deletion occurred. In essence, there was no evidence to
support the Government’s theory, only speculation that relied
heavily on evidence of Katakis’s intent while absolving the
Government of its obligation to prove the act. In short, there
was no evidence, direct or circumstantial, that the emails in
question were in fact double deleted.

5
The only other potential theory disclosed by the record was that the
email client or Exchange automatically overwrote the emails after they
were double deleted. The Government does not press this theory on
appeal and it did not raise it to the jury at trial. Nevertheless, we conclude
that this possibility also does not raise an inference of double deletion and
it does not explain the absence of any trace of the ten emails. There was
no evidence at all of what the time frame for such automatic deletion
would have been, or even whether the automatic deletion feature was
activated on the relevant computers. Further, both experts testified that
they would have expected to find, at the very least, traces of the ten emails
on the computers in question. There was no evidence in the record that
the automatic deletion process, as opposed to a program like
DriveScrubber, would have eliminated all traces of the emails.
Ultimately, there is no explanation in the record for why none of the ten
emails, or any trace of them, could not be found on any computer,
including the GD Mail Server.
20 UNITED STATES V. KATAKIS

We emphasize we are not requiring that the Government
disprove innocent explanations why the emails were not
present on any of the three computers. The Government is
correct that, following our decision in Nevils, authority
indicating that we may find the evidence insufficient to
convict where there is an innocent explanation for inculpatory
conduct, such as United States v. Delgado, 357 F.3d 1061,
1068 (9th Cir. 2004), is no longer viable. See Nevils,
598 F.3d at 1167 (overruling precedents that “strayed from
the test established in Jackson, and made ‘plausible’
exculpatory constructions” of the evidence). However, this
was not a case where a government theory competed with a
defense theory. Instead, the Government in this case
presented no theory at all to explain to the jury how the
emails were destroyed, a fact that was critical to the chain of
inferences required to find beyond a reasonable doubt that
Katakis double deleted the emails. In essence, the
Government again invited the jury to do what Nevils forbids:
engage in mere speculation on critical elements of proof. Id.

C. Single Deletion Theory

The Government’s final theory relies wholly on
Swanger’s testimony. Swanger testified that he observed
Katakis press the delete key after screening emails on
Swanger’s Dell. The Government argued in closing that all
the jury needed to find in order to convict Katakis was that he
pressed the delete key, thereby moving the emails from the
inbox on Swanger’s Dell to the deleted items folder.

The evidence was sufficient for the Government to prove
the fact underlying this legal theory; all the jury had to do was
credit Swanger’s testimony. “It is well established that the
uncorroborated testimony of a single witness may be
 UNITED STATES V. KATAKIS 21

sufficient to sustain a conviction.” United States v. Dodge,
538 F.2d 770, 783 (8th Cir. 1976). Further, the ten
incriminating emails were discovered in the deleted items
folder of Swanger’s Dell, raising at least a colorable inference
that Katakis deleted them. The district court recognized that
the evidence was sufficient to prove the fact that Katakis
single deleted the emails. However, the district court held
that single deletion was not sufficient to give rise to liability
under §1519. We agree.

The Government argues that moving the ten incriminating
emails from the inbox to the deleted items folder was
sufficient to “conceal” them within the meaning of § 1519.
Once again, the Government is forced into this strained
position by the collapse of its original theory at trial. We
have been unable to locate any case law, and the Government
provides none, providing a definition for concealment under
§ 1519. “Conceal” is not a term of art, and it is unambiguous,
so we are obligated to give the term its plain meaning. See
Williams v. Paramo, 775 F.3d 1182, 1188 (9th Cir. 2015)
(“Because we assume that Congress means what it says in a
statute, the ‘plain meaning of a statute controls where that
meaning is unambiguous.’”) (quoting Khatib v. Cty. of
Orange, 639 F.3d 898, 902 (9th Cir. 2011) (en banc)).
“Conceal” means “to prevent disclosure or recognition of;
avoid revelation of; refrain from revealing recognition of;
draw attention from; treat so as to be unnoticed; to place out
of sight; withdraw from being observed; shield from vision or
notice.” Webster’s Third New International Dictionary
(1993). The Government would have us adopt a definition of
“conceal” such that when a defendant removes something
from its “ordinary place of storage” making the thing “more
difficult to find,” he may be liable under § 1519. Indeed, the
Government would define concealment as “anything that
22 UNITED STATES V. KATAKIS

makes something harder for a casual onlooker to see, observe,
or notice.” The Government places special emphasis on the
fact that Katakis “dumped” the emails “in the digital
equivalent of a trash receptacle.”

The Government primarily relies on a Third Circuit case,
United States v. Lessner, 498 F.3d 185 (3d Cir. 2007), to
support its interpretation. In that case, federal agents arrived
at Lessner’s place of work as part of their investigation and
observed her placing an incriminating appointment book into
a trash can. Id. at 191. Lessner also removed a stack of files
from a locked filing cabinet and placed them on her desk. Id.
Lessner then contacted other individuals involved in her
scheme, and they destroyed the files. Id. On the basis of
these acts, the government charged Lessner with violating
18 U.S.C. § 1519. The Third Circuit held that placing the
incriminating appointment book in the trash can constituted
only “an attempt to ‘conceal’ and ‘cover up’ a ‘record.’”6 Id.
at 196 n.5. Therefore, Lessner does not support the
Government’s position. Quite the opposite: removing the
incriminating appointment book from the place it would
normally be found and depositing it in a place that would
have made it somewhat harder for investigating agents to find
it was not sufficient to actually conceal the book.

6
The Third Circuit noted that “Lessner’s act of disposal—which seems
clearly to be a form of ‘destruction’—falls within the proscriptions of the
statute.” Lessner, 498 F.3d at 196 n.5. Given the language quoted above,
we take the Third Circuit’s language to mean that, had the appointment
book been taken out with the trash, then it would have eventually been
destroyed. It is nonsensical that the Third Circuit could have meant that
the incriminating appointment book could have been actually destroyed
simply by placing it a trash can.
 UNITED STATES V. KATAKIS 23

The Government makes much of the fact that a jury could
find that Katakis placed the emails into the deleted items
folder, which the Government analogizes to a real world,
physical trash can. But a deleted items folder in an email
client is not like a trash can. Ordinarily, a trash can is
eventually emptied into a larger receptacle, the trash is
mingled with other garbage, and the garbage is then either
destroyed or placed in a location in which it is extremely
difficult to find any particular item. On Katakis’s computer,
in contrast, an email placed in the deleted items folder
remained in that folder unless a user took further action. As
Katakis persuasively argues, all that he accomplished by
single deleting the emails was moving them from one folder
to another. In essence, Katakis placed the ten incriminating
emails into an email folder that is by default not displayed to
the user. But the first place that any competent investigator
would look for emails that are not in the inbox is in the
deleted items folder. This degree of concealment is not
sufficient to satisfy § 1519.

In making this determination, we are cognizant of the
Government’s objection that focusing the inquiry too heavily
on the potential actions of the investigator may create a
“Catch-22.” It cannot be the case that, in order to prove
concealment, the item being concealed must never be found.
However, there must be more than the de minimis standard
the Government urges. The Government’s approach would
all but eliminate the act requirement from the statute: so
much as taking an incriminating document from the surface
of a desk and placing it in a drawer, or putting another folder
on top of it, would expose a defendant to a twenty-year prison
sentence, so long as the defendant acted with even the faintest
hope that investigators might overlook the document. That
glimmer of intent is all that the Government would require
24 UNITED STATES V. KATAKIS

before subjecting a defendant to felony liability. We cannot
endorse the Government’s proposed “casual onlooker” test.
Intent for an item not to be found is inherent in the act of
concealment. If that intent is satisfied, there is almost no act
with respect to a document that would not be criminal under
the Government’s proposed test.

In this case, we need not set out a comprehensive standard
for what it means to “conceal” a record under § 1519. Suffice
to say, contrary to the Government’s position, we cannot
ignore entirely the effort that an investigator would have to
expend to uncover a hidden document. In this case, removing
an email from one file folder and placing it in another was not
sufficient to actually conceal it. Under the Government’s
theory, a defendant would have concealed a document even
by lifting it from the surface of his desk with the intent to
place it somewhere else, because the defendant would have
removed the document from where investigators (or not even
an investigator, a casual onlooker) expected to find it. The
Government must show actual obstruction. It cannot show
that here, where it seized all three computers and the email
server in the course of its investigation and would have
discovered all single deleted emails within due course.
Indeed, the Government is in essence arguing that it need not
undertake any investigation at all: if things are not as the
Government expects to find them, a defendant may be
exposed to a term of twenty years’ imprisonment. More is
needed, there must be some likelihood that the item will not
be found in the course of a cursory examination (without
using forensic tools) of a defendant’s computer.

We emphasize the limited nature of this holding. Our
conclusion that the evidence was insufficient to convict
Katakis for single deleting emails rests upon the unique
 UNITED STATES V. KATAKIS 25

factual circumstance that pressing the delete key in this
context serves only to move an email from one file folder to
another. Section 1519 was drafted to prevent corporate
document shredding. The digital context threatens to expand
§ 1519 and its potentially harsh punishment well beyond its
intended reach. We are hesitant to expand the reach of
§ 1519, in part because the Government barely developed the
facts necessary to support the single-deletion theory at trial
and we are left without many of the facts that might prove
actual concealment. As with the other theories raised on
appeal, the single-deletion theory was an afterthought, a
comment the Government made at closing and now urges was
sufficient to warrant a potential twenty-year sentence.
Accordingly, we cannot endorse the Government’s reading of
the statute. Actual concealment must do more than merely
inconvenience a reasonable investigator—there must be some
likelihood that the item will not be found. That low bar is not
met in this case.

CONCLUSION

Accordingly, we affirm the district court’s order granting
Katakis a judgment of acquittal. Because we hold that the
evidence was insufficient to convict Katakis, we do not reach
his contentions that the Government’s proof created a fatal
variance with the indictment and that the Government
committed prosecutorial misconduct.

AFFIRMED.