UNITED STATES of America, Plaintiff-Appellant, v. Andrew B. KATAKIS, Defendant-Appellee, 800 F.3d 1017

OPINION N.R. SMITH, Circuit Judge: The Government appeals the district court’s order granting Katakis’s Fed. R.Crim.P. 29 motion. The district court vacated Katakis’s conviction and entered a judgment of acquittal, holding that the evidence was insufficient to support the jury’s verdict. The Government’s theory of liability collapsed during trial, and the Government now raises several alternative theories to try and rescue the conviction. The evidence was insufficient to show that Katakis actually deleted electronic records or files.

Further, proving Katakis moved emails from an email client’s inbox to the deleted items folder does not demonstrate Katakis actually concealed those emails within the meaning of § 1519. We affirm. BACKGROUND This case arises from an investigation by federal authorities into a scheme to rig bids at foreclosure auctions in 2008 and 2009. By 2010, the investigation focused on Andrew Katakis as one of the primary real estate investors helming the conspiracy. On September 1, 2010, Katakis received a letter from his bank informing him that federal investigators had subpoenaed his bank records.

On September 3, 2010, Katakis purchased, downloaded, and installed a program called DriveScrubber 3 (“DriveScrubber”) onto his home computer, á Dell (“Katakis’s Dell”). DriveScrubber is a program designed to wipe hard drives clean of all information. DriveSerubber may be used to overwrite all of the information in a hard drive’s unallocated or “free” space. Free space is the portion of the hard drive that is not allocated for the use of the computer’s programs or operating system; items that are deleted by a user may “fall” into the free space.

There, the deleted item is not actually removed from the computer right away; the space it occupies on the hard drive has simply been made available to be overwritten. Instead of waiting for another file to overwrite the deleted file by chance, DriveScrubber actively overwrites all data in the unallocated space of a hard drive, permanently erasing any files that had fallen into the free space. Once a file is overwritten by DriveScrubber, it is impossible to retrieve it.

Katakis’s business partner and alleged co-conspirator, Steve Swanger, kept two computers at their office: an- ASUS (“Swanger’s ASUS”), and a Dell (“Swanger’s Dell”). Swanger’s Dell was used primarily for emailing with Katakis, and Swanger’s ASUS was used for general internet searching. On Saturday, September 4, 2010, Katakis summoned Swanger to their business office.

Katakis told Swanger that he wanted to install a “scrubber program” on their computers and that there was “nothing wrong with us cleaning our computers.” Swanger observed Katakis use Swanger’s ASUS and perform a search for emails involving members of the bid-rigging conspiracy. At 4:40 pm, Katakis installed DriveScrubber on the Swanger ASUS. This copy of DriveScrubber was different from the one installed on Katakis’s Dell. Swanger did not observe any deletions on the ASUS; he only observed Katakis “clicking and moving things around.” Katakis then moved to Swanger’s Dell and installed DriveScrubber at 4:47 pm.

The Swanger Dell had 4,000 emails on it, as Swanger was not in the habit of regularly deleting his emails. Swanger kept hard copies of some important emails, because he feared Katakis might try and wipe clean the hard drives some day. Swanger observed Katakis checking boxes on various emails and unchecking those emails that Katakis believed that Swanger needed. Katakis gave up sorting the emails after about five minutes and pressed the delete key. After seeing that it would take a long time for the emails to be deleted, Katakis went home.

When he returned to the office on Monday, Swanger noticed that almost all of the emails on his Dell had been deleted from his email in-box. At 5:37 pm on September 4, 2010, the same copy of DriveScrubber that was installed on Katakis’s Dell was installed on the office’s mail server (“GD Mail Server”). The server managed all email sent or received in the office through the Microsoft Outlook program. The GD Mail Server was operated by a program called Exchange. Katakis had the authority to install programs on the GD Mail Server and knew that DriveScrubber had been installed on it.

The Government seized the four computers in the course of its investigation into the bid-rigging scheme. When examining Swanger’s Dell, the Government discovered ten incriminating emails that implicated Katakis in the conspiracy. Katakis was either a sender or recipient of all ten emails. Swanger was also either the sender or recipient of all ten emails. The emails were discovered in the deleted items folder in Swanger’s email client. Metadata attached to the emails showed that the emails had passed through the GD Mail Server and that Katakis had received and opened all of them.

Special Agent Scott Medlin conducted a forensic analysis of the other three computers. Because Katakis’s Dell, Swanger’s ASUS, and the GD Mail Server were all part of the email network shared with Swanger’s Dell, Medlin expected to find traces of the ten emails on these computers. Medlin was unable to locate any trace of the ten incriminating emails, but did not think that enough time had passed for all traces of the emails to be removed by the gradual automatic overwriting process, leading him to believe that Katakis had destroyed them using DriveScrubber.

Based on the discrepancy between the presence of the ten incriminating emails on Swanger’s Dell but not on the other computers, the Government sought and obtained an indictment charging Katakis with obstruction of justice, in violation of 18 U.S.C. § 1519. The indictment alleged that Katakis “deleted and caused others to delete electronic records and documents.

KATAKIS also installed and used and caused others to use a software program that overwrote deleted electronic records and documents so that they could not be viewed or recovered.” Notably, the indictment failed to charge attempt, thus committing the Government to prove actual deletion. The Government proceeded to trial on the theory that Katakis ran the DriveScrubber program on his Dell, Swanger’s ASUS, and the GD Mail Server, to erase all traces of the ten incriminating emails. The Government’s key witness was Medlin, who testified as an expert.

Medlin testified that Katakis “double-deleted” emails; that is, he deleted them once from the mail client and then again when he emptied the deleted items folder. After they were double deleted, the emails fell into the free space, where Medlin opined that they were irretrievably overwritten by DriveScrubber. Katakis called Don Vilfer as a rebuttal expert. Vilfer testified that Medliris theory of what happened to double-deleted emails was incorrect, based on how the Exchange program on the GD Mail Server worked.

According to Vilfer, a double-deleted email would not fall into the free space, as Medlin testified, but would remain within the portion of the hard drive allocated for the Exchange database. The crux of Vilfer’s testimony was that, given how the Exchange program operated, it would be impossible for DriveScrubber to overwrite any double-deleted emails, including the ten incriminating emails that were at the heart of the Government’s case. Vilfer further noted that the Exchange program itself removed double-deleted emails after a certain period of time, usually fourteen days.

Vilfer testified that he was able to recover thousands of double-deleted emails, but he could not find the ten incriminating emails. Vilfer agreed with Medlin that it was suspicious that there were no traces of the ten incriminating emails on any computer other than Swanger’s Dell. However, he explained that absence by opining that the ten incriminating emails (including meta-data) had been fabricated. The defense sought to draw an inference that Swanger fabricated the ten incriminating emails and the metadata indicating Katakis had seen them in order to implicate Katakis.

In rebuttal, Medlin admitted that Vilfer’s testimony was correct: it was impossible for DriveScrubber to have deleted the ten incriminating emails. Medlin testified that his opinion was unchanged, because DriveScrubber could have deleted transmission logs associated with the ten incriminating emails. Vilfer testified in response that deleting the transmission logs would not have deleted the emails themselves. By the time of its closing argument, the Government’s primary theory of the case had collapsed. In closing, the Government offered two theories of liability to the jury.

First, the Government argued a purely circumstantial case. The ten incriminating emails were present on Swanger’s Dell, and both experts testified that they would have expected to find them on the other computers. The only logical inference, the Government reasoned, was that Katakis had somehow deleted them. Second, the Government relied on Swanger’s testimony for an alternative theory of liability. Under this theory, DriveScrubber was only relevant to prove intent.

If the jury believed Swanger’s testimony that Katakis hit the delete key and sent emails on Swanger’s Dell to the deleted items folder, this was legally sufficient to convict Katakis of obstruction of justice. The Government alluded to an additional theory of liability in its rebuttal, arguing that Katakis used DriveScrubber to delete remnants of the emails (the transmission logs). The jury convicted Katakis of obstruction of justice. Katakis filed a motion for judgment of acquittal, alleging, among other things, that the evidence was insufficient to convict him.

The district court agreed, and, after carefully evaluating each of the Government’s theories of liability and finding them all insufficient to sustain a conviction for obstruction of justice, vacated Katakis’s conviction and entered a judgment of acquittal. The Government appeals. DISCUSSION We review de novo the district court’s order granting a judgment of acquittal pursuant to Fed.R.Crim.P. 29. United States v. Sanchez, 639 F.3d 1201, 1203 (9th Cir.2011). Our review “is governed by Jackson v.

Virginia, which requires a court of appeals to determine whether ‘after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.’ ” United States v. Nevils, 598 F.3d 1158, 1163-64 (9th Cir. 2010) (en banc) (citation omitted) (quoting Jackson v. Virginia, 443 U.S. 307, 319, 99 S.Ct. 2781, 61 L.Ed.2d 560 (1979)).

Nevils prescribes the structure of our inquiry: “[f]irst, a reviewing court must consider the evidence presented at trial in the light most favorable to the prosecution.” Id. at 1164. “Second, ... the reviewing court must determine whether this evidence, so viewed, is adequate to allow ‘any rational trier of fact to find the essential elements of the crime beyond a reasonable doubt.’ ” Id. (alterations omitted) (quoting Jackson, 443 U.S. at 319, 99 S.Ct. 2781). “[T]he government does not need to rebut all reasonable

interpretations of the evidence that would establish the defendant’s innocence, or ‘rule out every hypothesis except that of guilt beyond a reasonable doubt.’ ” Id. (quoting Jackson, 443 U.S. at 326, 99 S.Ct. 2781). That said, “evidence is insufficient to support a verdict where mere speculation, rather than reasonable inference, supports the government’s case, or where there is a ‘total failure of proof of a requisite element.’” Id. at 1167 (citations and alterations omitted) (quoting Briceno v. Scribner, 555 F.3d 1069, 1079 (9th Cir. 2009)).

Katakis was convicted of obstruction of justice, in violation of 18 U.S.C. § 1519. That statute provides: Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States ... or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both. 18 U.S.C. § 1519..

Section “1519 was intended to prohibit, in particular, corporate document-shredding to hide evidence of financial wrongdoing.” Yates v. United States, — U.S.-, 135 S.Ct. 1074, 1081, 191 L.Ed.2d 64 (2015). In order to prove a violation of § 1519, the Government must show that the defendant (1) knowingly committed one of the enumerated acts in the statute, such as destroying or concealing; (2) towards “any record, document, or 'tangible object”; (3) with the intent to obstruct an actual or contemplated investigation by the United States of a matter within its jurisdiction.

We have only one question regarding the sufficiency of the evidence before us: whether the Government carried its burden to show actual destruction or concealment. There is no dispute that there was sufficient evidence for a rational juror to conclude that the Government satisfied the third element, that Katakis intended that his actions would obstruct the investigation into the bid-rigging scheme. A rational juror also could have concluded that Katakis knew or believed that his actions could destroy or conceal the ten incriminating emails.

However, the Government failed to charge Katakis with attempted obstruction in the indictment. Therefore, in order to secure a conviction, the Government was required to prove that Katakis actually destroyed or concealed “electronic records and documents.” In light of Medlin’s retraction, there was no evidence upon which a reasonable juror could conclude that Katakis used DriveScrubber to irretrievably overwrite (that is, destroy or conceal) the ten incriminating emails from the free space of any of the computers. The theory that the Government presented in its case-in-chief cannot support Katakis’s conviction.

Nevertheless, the Government contends that the district court erred, because there are three other theories of liability that the jury could have credited that satisfy the elements of the statute:

(1) Katakis used DriveScrubber to delete the transmission logs belonging to the ten incriminating emails;

(2) Katakis double deleted emails on his Dell, Swanger’s ASUS, and the GD Mail Server; or

(3) Katakis single-deleted emails on Swanger’s Dell, moving those emails from the inbox to the deleted items folder. For the reasons set out below, we agree with the district court that the evidence was insufficient to convict Katakis of obstruction of justice on any of these theories. A. DriveScrubber Theory The first theory that the Government advances relies on testimony given by Medlin during rebuttal to the effect that, although Katakis could not have deleted the ten incriminating emails themselves, he could have deleted transmissions logs generated by the emails.

Forced to retract his testimony that the ten incriminating emails could have been deleted by DriveScrubber, Medlin testified that he did not retract his opinion that Katakis used DriveScrubber to destroy electronic records, because he likely used DriveScrubber to overwrite transmission logs generated by the emails. Medlin testified that transmission logs are generated daily by the Exchange system.

These logs resided outside the Exchange database (so they were separate from the emails themselves), and would “remain” in the program for a period of time before falling off into the free space to be made available for the DriveScrubber program to overwrite. Medlin could not testify as to how long it took for the transmission logs to fall into free space; he noted that there was a default time programmed into the Exchange database (although he did not recall what the default was), but that time could be changed by the system administrator.

On cross-examination, Medlin admitted that he did not perform an investigation into whether a default time was even set on the Exchange database. Medlin also testified that he did not perform any investigation as to whether any user had entered a command causing the Exchange database to “clean up” the transmission logs and let them enter free space. Although the Government is entitled to every reasonable inference from the evidence, a conviction may not be based on mere speculation.

Nevils, 598 F.3d at 1167. “[A] reasonable inference is one that is supported by a chain of logic, rather than mere speculation dressed up in the guise of evidence.” United States v. Del Toro-Barboza, 673 F.3d 1136, 1144 (9th Cir. 2012) (quotation marks and alteration omitted) (quoting Juan H. v. Allen, 408 F.3d 1262, 1277 (9th Cir.2005)). The logical chain supporting the Government’s theory is as follows:

(1) Katakis downloaded and installed DriveScrubber, which, along with Swanger’s testimony, demonstrates his intent to destroy incriminating emails and other electronic records;

(2) DriveScrubber could only destroy the emails if they were in the free space; (3) the transmission logs enter the free space through one of two ways, either at the default time or through user action; (4) both agents testified that they expected to find email remnants, including transmission logs, on the computers; and (5) no email remnants were found. From this chain of logic, the Government contends a reasonable juror could have concluded that Katakis destroyed the logs using DriveScrubber.

However, the Government’s chain of logic misses an important link: there is no evidence whatsoever that the transmission logs were made available, in any manner, for DriveScrubber to overwrite. The Government invited the jury to speculate as to whether the transmission logs entered the free space; the Government’s own expert could not testify that they ever did. The transmission logs theory was developed entirely in rebuttal in an attempt to save the Government’s case. Make no mistake, the Government’s original plan failed.

Indeed, the full theory presented here did not crystallize as an argument until this appeal. The Government did not argue in its closing that deletion of the transmission logs could, under § 1519, constitute the destruction of electronic records; instead, the Government asserted in its rebuttal that the absence of the logs was evidence DriveScrubber was run to delete the emails. In light of the way that this case was tried, it is not surprising that the Government’s transmission log theory was half-baked.

Medlin admitted he never even investigated the possibility that the transmission logs were removed to the free space where they could have been deleted by DriveScrubber. In the absence of that evidence, the jury was left to speculate not only regarding how the transmission logs entered the free space but if they ever did so. There was nothing preventing the Government from having Medlin investigate this question and provide evidence, even circumstantial evidence, from which the jury could make the desired inference. However, that evidence was entirely lacking in this case.

In the absence of that critical link in the logical chain of inference, the evidence was not sufficient to convict Katakis on this theory. B. Double Deletion Theory The Government’s second theory contends that a rational juror could have found that Katakis double deleted emails on all of the computers except Swanger’s Dell, and that, if he did so with the requisite intent, he violated the statute. We shall assume, without deciding, that double deletion would constitute the requisite concealment or destruction element of § 1519.

However, even with that assumption, no reasonable juror could have found on this record that the Government carried its burden to show that double deletion actually occurred. ■In this context, “double deletion” means that the Government sought to first prove that Katakis pressed the delete key after selecting emails in the inbox of the email client, moving them to the deleted items folder or a recycling bin.

The Government’s theory asserted that Katakis then deleted the emails a second time, with the intent that they would fall into the free space of the hard drive so they could be permanently overwritten by DriveScrubber. This theory relies on two pieces of evidence, one direct and one circumstantial. First, the Government points to direct evidence that Swanger observed Katakis deleting emails.

Given that fact, and the evidence that Katakis installed DriveScrubber, the Government contends that a rational juror could have inferred that he had double deleted the emails to make them available for DriveScrubber to overwrite. Second, the Government argues that a rational juror could have inferred double deletion from the fact that the ten incriminating emails were not found on any computer other than Swanger’s Dell. ' There are again significant factual flaws in the Government’s argument. First, Swanger never offered any testimony that he observed Katakis do anything on Katakis’s Dell or the GD Mail Server.

With regard to Swanger’s ASUS, Swanger declined to testify that he actually observed Katakis deleting anything, much less double-deleting the emails. Swanger testified only that he saw Katakis “clicking and moving things around.” Swanger never testified that he noticed that any files or emails were missing on his ASUS, whereas he testified that many emails were missing from his Dell. In the absence of direct evidence of double deletion, the Government relies on a chain of circumstantial inferences that a rational juror would have to credit to find that Katakis double deleted the emails.

The rational juror would first have to find that Katakis intended to destroy the ten incriminating emails; as to that point, there was sufficient evidence — the installation of DriveScrubber. But the evidence that he carried out this intent comes from a single fact: that the ten incriminating emails were not found on Katakis’s Dell, Swanger’s ASUS, or the GD Mail Server. Both experts testified that they expected to find the emails on those computers. In their absence, the Government argues that a rational juror would be entitled to conclude that Katakis double deleted the emails.

However, the Government never provided the jury with any mechanism that would explain how Katakis removed the emails from the three computers, given that, as both experts ultimately agreed, double deletion on the email client does not send an email to the free space, where DriveScrubber could have destroyed it. The Government’s theory is analogous to one that we rejected in United States v. Lo, 231 F.3d 471 (9th Cir.2000). In Lo, the defendant was charged with mail fraud, which required the government to prove that the defendant actually mailed a document in furtherance of the fraud scheme. Id. at 475.

The only evidence that the government could muster to show that the document was mailed was testimony from an employee that a document Lo submitted would have been mailed in the ordinary course of its business. Id. at 475-76. No one testified that they ever saw the document, no one testified that they had sent it, there was no record it had existed, and no one testified to receiving it. Id. at 476. We found that this evidence was insufficient, and the inferences that the jury was required to draw too “attenuated,” to support a conviction for mail fraud. Id. at 477.

In Lo, we were particularly concerned that the evidence of fraudulent intent, for which there was sufficient evidence, might lead a juror to overlook the factual gaps in the government’s proof. Id. We are faced with a similar concern here. In Lo, there was no evidence that the document in question even existed, id. at 476, while there were specific emails at issue in the record here. But as in Lo, the evidence of the crime itself was attenuated. There was no direct evidence in the record that Katakis deleted the emails on his Dell, Swanger’s ASUS, or the GD Mail Server, much less double-deleted them.

The evidence of Katakis’s intent was truly overwhelming, but the Government’s attempts to prove that he actually performed the acts of which he was accused, were incredibly weak. The Government’s primary theory, that Katakis double deleted the emails and then used DriveScrubber to overwrite them, completely collapsed. Had this theory been available to the jury, the jurors would have been entitled to conclude that Katakis double deleted the emails, because, according to Medlin’s initial testimony, this step is the necessary predicate for making the emails available for DriveScrubber to overwrite.

The Government conceded that it was impossible for DriveScrubber to overwrite the emails, but only the possibility that DriveScrubber overwrote the emails supported the inference of double deletion. Otherwise, both experts testified that they would have expected to find the emails. The Government now argues that the jury could have inferred double deletion from the fact that the ten incriminating emails could not be found on any of the three computers, raising an inference that they were somehow destroyed by a process that included double deletion.

Under Lo, this fact might be enough, if the Government had provided any explanation that the jury could credit to explain why the emails were not present. The Government was entirely unable to explain (

a) at trial, (

b) in closing, (

c) before the district court, or now (

d) on appeal, where the ten incriminating emails, their traces, or their remnants went. Indeed, the one theory that the Government provided, that DriveScrubber was used to overwrite the emails, was discredited and withdrawn. At closing, the Government relied on Medlin’s eleventh-hour theory that email remnants, not the emails themselves, had been overwritten by DriveScrubber. After the collapse of the primary DriveScrubber theory, the Government was left with no theory at all to explain what happened to the emails and why neither expert could find any trace of them.

The absence of the emails eliminates the logical inference of double-deletion. Both experts testified that they expected to find the emails if they were double deleted, but they also explained that it was impossible for DriveScrubber to delete them. As a result, double deletion cannot explain the absence of the emails. That absence, far from corroborating the Government’s theory, demonstrates a gaping hole in its logic.

Without a mechanism to make double deletion a necessary inference to the cause of the emails’ absence, a rational juror could not conclude, beyond a reasonable doubt, that double deletion occurred. In essence, there was no evidence to support the Government’s theory, only speculation that relied heavily on evidence of Katakis’s intent while absolving the Government of its obligation to prove the act. In short, there was no evidence, direct or circumstantial, that the.emails in question were in fact double deleted.

We emphasize we are not requiring that the Government disprove innocent explanations why the emails were not present on any of the three computers. The Government is correct that, following our decision in Nevils, authority indicating that we may find the evidence insufficient to convict where there is an innocent explanation for inculpatory conduct, such as United States v. Delgado, 357 F.3d 1061, 1068 (9th Cir.2004), is no longer viable. See Nevils, 598 F.3d at 1167 (overruling precedents that “strayed from the test established in Jackson, and made ‘plausible’ .exculpatory constructions” of the evidence).

However, this was not a case where a government theory competed with a defense theory. Instead, the Government in this case presented no theory at all to explain to the jury how the emails were destroyed, a fact that was critical to the chain of inferences required to find beyond a reasonable doubt that Katakis double deleted the emails. In essence, the Government again invited the jury to do what Nevils forbids: engage in mere speculation on critical elements of proof. Id. C. Single Deletion Theory The Government’s final theory relies wholly on Swanger’s testimony.

Swanger testified that he observed Katakis press the delete key after screening emails on Swanger’s Dell. The Government argued in closing that all the jury needed to find in order to convict Katakis was that he pressed the delete key, thereby moving the emails from the inbox on Swanger’s Dell to the deleted items folder. The evidence was sufficient for the Government to prove the fact underlying this legal theory; all the jury had to do was credit Swanger’s testimony. “It is well established that the uncorroborated testimony of a single witness may be sufficient to sustain a conviction.” United States v.

Dodge, 538 F.2d 770, 783 (8th Cir.1976). Further, the ten incriminating emails were discovered in the deleted items folder of Swanger’s Dell, raising at least a colorable inference that Katakis deleted them. The district court recognized that the evidence was sufficient to prove the fact that Katakis single deleted the emails. However, the district court held that single deletion was not sufficient to give rise to liability under § 1519. We agree. The Government argues that moving the ten incriminating emails from the inbox to the deleted items folder was sufficient to “conceal” them within the meaning of § 1519.

Once again, the Government is forced into this strained position by the collapse of its original theory at trial. We have been unable to locate any case law, and the Government provides none, providing a definition for concealment under § 1519. “Conceal” is not a term of art, and it is unambiguous, so we are obligated to give the term its plain meaning. See Williams v. Paramo, 775 F.3d 1182, 1188 (9th Cir.2015) (“Because we assume that Congress means what it says in a statute, the ‘plain meaning of a statute controls where that meaning is unambiguous.’ ”) (quoting Khatib v.

Cty. of Orange, 639 F.3d 898, 902 (9th Cir.2011) (en banc)). “Conceal” means “to prevent disclosure or recognition of; avoid revelation of; refrain from revealing recognition of; draw attention from; treat so as to be unnoticed; to place out of sight; withdraw from being observed; shield from vision or notice.” Webster’s Third New International Dictionary (1993). The Government would have us adopt a definition of “conceal” such that when a defendant removes something from its “ordinary place of storage” making the thing “more difficult to find,” he may be liable under § 1519.

Indeed, the Government would define concealment as “anything that makes something harder for a casual onlooker to see, observe, or notice.” The Government places special emphasis on the fact that Katakis “dumped” the emails “in the digital equivalent of a trash receptacle.” The Government primarily relies on a Third Circuit case, United States v. Lessner, 498 F.3d 185 (3d Cir.2007), to support its

interpretation. In that case, federal agents arrived at Lessner’s place of work as part of their investigation and observed her placing an incriminating appointment book into a trash can. Id. at 191. Lessner also removed a stack of files from a locked filing cabinet and placed them on her desk. Id. Lessner then contacted other individuals involved in her scheme, and they destroyed the files. Id. On the basis of these acts, the government charged Lessner with violating 18 U.S.C. § 1519.

The Third Circuit held that placing the incriminating appointment book in the trash can constituted only “an attempt to ‘conceal’ and ‘cover up’ a ‘record.’ ” Id. at 196 n. 5. Therefore, Lessner does not support the Government’s position.

Quite the opposite: removing the incriminating appointment book from the place it would normally be found and depositing it in a place that would have made it somewhat harder for investigating agents to find it was not sufficient to actually conceal the book. v, The Government makes much of the fact that a jury could find that Katakis placed the emails into the deleted items folder, which the Government analogizes to a real world, physical trash can. But a deleted items folder in an email client is not like a trash can.

Ordinarily, a trash can is eventually emptied into a larger receptacle, the trash is mingled with other garbage, and the garbage is then either destroyed or placed in a location in which it is extremely difficult to find any particular item. On Katakis’s computer, in contrast, an email placed in the deleted items folder remained in that folder unless a user took further action. As Katakis persuasively argues, all that he accomplished by single deleting the emails was moving them from one folder to another.

In essence, Katakis placed the ten incriminating emails into an email folder that is by default not displayed to the user. But the first place that any competent investigator would look for emails that are not in the inbox is in the deleted items folder. This degree of concealment is not sufficient to satisfy § 1519. In making this determination, we are cognizant of the Government’s objection that focusing the inquiry too heavily on the potential actions of the investigator may create a “Catch-22.” It cannot be the case that, in order to prove concealment, the item being concealed must never be found.

However, there must be more than the de minimis standard the Government urges. The Government’s approach would all but eliminate the act requirement from the statute: so much as taking an incriminating document from the surface of a desk and placing it in a drawer, or putting another folder on top of it, would expose a defendant to a twenty-year prison sentence, so long as the defendant acted with even the faintest hope that investigators might overlook the document. That glimmer of intent .is all that the Government would require before subjecting a defendant to felony liability.

We cannot endorse the Government’s proposed “casual onlooker” test. Intent for an item not to be found is inherent in the act of concealment. If that intent is satisfied, there is almost no act with respect to a document that would not be criminal under the Government’s proposed test. In this case, we need not set out a comprehensive standard for what it means to “conceal” a record under § 1519. Suffice to say, contrary to the Government’s position, we cannot ignore entirely the effort that an investigator would have to expend to uncover a hidden document.

In this case, removing an email from one file folder and placing it in another was not sufficient to actually conceal it. Under the Government’s theory, a defendant would have concealed a document even by lifting it from the surface of his desk with the intent to place it somewhere else, because the defendant would have removed the document from where investigators (or not even an investigator, a casual onlooker) expected to find it. The Government must show actual obstruction.

It cannot show that here, where it seized all three computers and the email server in the course of its investigation and would have discovered all single deleted emails within due course. Indeed, the Government is in essence arguing that it need not undertake any investigation at all: if things are not as the Government expects to find them, a defendant may be exposed to a term of twenty years’ imprisonment. More is needed, there must be some likelihood that the item will not be found in the course of a cursory examination (without using forensic tools) of a defendant’s computer.

We emphasize the limited nature of this holding. Our conclusion that the evidence was insufficient to convict Katakis for single deleting emails rests upon the unique, factual circumstance that pressing the delete key in this context serves only to move an email from one file folder to another.

Section 1519 was drafted to prevent corporate document shredding. The digital context threatens to expand § 1519 and its potentially harsh punishment well beyond its intended reach. We are hesitant to expand the reach of § 1519, in part because the Government barely developed the facts necessary to support the single-deletion theory at trial and we are left without many of the facts that might prove actual concealment.

As with the other theories raised on appeal, the single-deletion theory was an afterthought, a comment the Government made at closing and now urges was sufficient to warrant a potential twenty-year sentence. Accordingly, we cannot endorse the Government’s reading of the statute. Actual concealment must do more than merely inconvenience a reasonable investigator — there must be some likelihood that the item will not be found. That low bar is not met in this case. CONCLUSION Accordingly, we affirm the district court’s order granting Katakis a judgment of acquittal.

Because we hold that the evidence was insufficient to convict Katakis, we do not reach his contentions that the Government’s proof created a fatal variance with the indictment and that the Government committed prosecutorial miscon-. duct. AFFIRMED. . Although the program installed on Katakis's Dell and Swanger's ASUS was the same, the evidence indicated that two different copies were used. The version of DriveScrubber installed on Swanger's ASUS and Swanger’s Dell was purchased using Swanger's credit card. .

Katakis was also charged with bid-rigging, in violation of 15 U.S.C. § 1, and conspiracy to commit mail fraud, in violation of 18 U.S.C. § 1349. The jury found Katakis guilty of bid-rigging. That conviction is not before us. . The Government likely waived this theory by failing to present it to the district court as part of its opposition to Katakis’s Rule 29 motion. See United States v. Piazza, 647 F.3d 559, 565 (5th Cir.2011) (holding that government waived an argument it failed to present in its response to defendant’s motion for new trial). However, Katakis has not asserted waiver on appeal.

Therefore, Katakis has "waive[d] waiver.” Tokatly v. Ashcroft, 371 F.3d 613, 618 (9th Cir.2004). . The Government’s failure to develop this theory may have led to another deficiency.

Section 1519 requires that the defendant act knowingly. A defendant "is said to act knowingly if he is aware ‘that that result is practically certain to follow from his conduct, whatever his desire may be as to that result.' " United States v. Bailey, 444 U.S. 394, 404, 100 S.Ct. 624, 62 L.Ed.2d 575 (1980) (quoting United States v. U.S. Gypsum Co., 438 U.S. 422, 445, 98 S.Ct. 2864, 57 L.Ed.2d 854 (1978)). "[T]he term 'knowingly' merely requires proof of knowledge of the facts that constitute the offense.” Bryan v. United States, 524 U.S. 184, 193, 118 S.Ct. 1939, 141 L.Ed.2d 197 (1998).

The Government failed to provide any evidence that Katakis knew that transmission logs, a category of electronic record wholly separate and distinct from the emails, even existed. There is no evidence that Katakis knowingly destroyed these records. It is not clear to us that Katakis could have been aware that the destruction of the transmission logs was "practically certain” to result from running DriveScrubber. . The only other potential theory disclosed by the record was that the email client or Exchange automatically overwrote the emails after they were double deleted.

The Government does not press this theory on appeal and it did not raise it to the jury at trial. Nevertheless, we conclude that this possibility also does not raise an inference of double deletion and it does not explain the absence of any trace of the ten emails. There was no evidence at all of what the time frame for such automatic deletion would have been, or even whether the automatic deletion feature was activated on the relevant computers. Further, both experts testified that they would have expected to find, at the very least, traces of the ten emails on the computers in question.

There was no evidence in the record that the automatic deletion process, as opposed to a program like DriveScrubber, would have eliminated all traces of the emails. Ultimately, there is no explanation in the record for why none of the ten emails, or any trace of them, could not be found on any computer, including the GD Mail Server. . The Third Circuit noted that "Lessner's act of disposal — which seems clearly to be a form of 'destruction' — falls within the proscriptions of the statute.'' Lessner, 498 F.3d at 196 n. 5.

Given the language quoted above, we take the Third Circuit’s language to mean that, had the appointment book been taken out with the trash, then it would have eventually been destroyed. It is nonsensical that the Third Circuit could have meant that the incriminating appointment book could have been actually destroyed simply by placing it a trash can.