United States Court of Appeals FOR THE DISTRICT OF COLUMBIA CIRCUIT

Argued December 4, 2023 Decided October 22, 2024

No. 22-3042

UNITED STATES OF AMERICA, APPELLEE

v.

COUY GRIFFIN, APPELLANT

Appeal from the United States District Court for the District of Columbia (No. 1:21-cr-00092-1)

Lisa B. Wright, Assistant Federal Public Defender, argued the cause for appellant. With her on the briefs was A. J. Kramer, Federal Public Defender. Tony Axam Jr., Assistant Federal Public Defender, entered an appearance.

Daniel J. Lenerz, Assistant U.S. Attorney, argued the cause for appellee. With him on the brief were Chrisellen R. Kolb and Nicholas P. Coleman, Assistant U.S. Attorneys. James Pearce, Attorney, U.S. Department of Justice, entered an appearance.

Before: PILLARD and KATSAS, Circuit Judges, and ROGERS, Senior Circuit Judge. 2 Opinion for the Court filed by Circuit Judge PILLARD.

Dissenting opinion filed by Circuit Judge KATSAS.

PILLARD, Circuit Judge: This appeal turns on interpretation of a federal law enacted to better protect the President and other national leaders from assassination, kidnapping, and assault. The law creates a narrow domain of federal trespass authority to prevent unauthorized members of the public from getting too close to a person under Secret Service protection. It does so by empowering the Secret Service to prevent unauthorized people from knowingly encroaching on “posted, cordoned off, or otherwise restricted” safety zones where the President or Vice President (current or past), a leading candidate for such office, or any of a handful of other Secret Service protectees “is or will be temporarily visiting.” 18 U.S.C. § 1752(c)(1)(B).

The defendant says a person “knowingly enters” the restricted safety zone only if he knows that the basis of the restriction is to safeguard a Secret Service protectee. Id. § 1752(a)(1). We hold that knowingly breaching the restricted area suffices, even without knowing the basis of the restriction—here, the presence of Vice President Pence at the Capitol on January 6—which merely confirms that such trespasses are within Congress’s legislative authority. Traditional tools of statutory interpretation establish that Congress intended to criminalize trespasses endangering Secret Service protectees regardless of the trespasser’s awareness of the basis for Congress’s authority to regulate them. And a contrary interpretation would impair the Secret Service’s ability to protect its charges. It would require Secret Service agents preventing members of the public from encroaching on a temporary security zone to confirm that each intruder knows that a person under Secret Service protection is 3 or is expected to be there. Neither the text nor the context of the statute supports that reading.

Couy Griffin knowingly intruded into the area of the United States Capitol grounds that had been restricted in order to protect Vice President Pence on January 6, 2021, during the counting of the electoral college votes for President. Griffin came to the Capitol that day along with thousands of other people to try to stop the certification of the electors’ ballots. He breached the boundary established to prevent public access and remained for approximately two hours in the restricted area while the Capitol Police struggled, facing serious injury and even death, to control the mob that overwhelmed them and broke into the Capitol Building.

Following a bench trial, the district court convicted Griffin of violating 18 U.S.C. § 1752(a)(1), which prohibits “knowingly enter[ing] or remain[ing] in any restricted building or grounds without lawful authority to do so.” “Restricted building or grounds” refers to a limited number of “posted, cordoned off, or otherwise restricted area[s],” including the White House or Vice President’s residence, areas where a Secret Service protectee “is or will be temporarily visiting,” and areas being used for a “special event of national significance.” Id. § 1752(c)(1). The Capitol grounds fell under that provision on January 6 because a Secret Service protectee, Vice President Michael Pence, was expected to be and was present. Id. § 1752(c)(1)(B).

Griffin raises two arguments on appeal. He first asserts that because waves of rioters ahead of him trampled much of the fencing and signage delineating the relevant area’s perimeter, it was no longer “posted, cordoned off, or otherwise restricted” when he entered and remained there. But Griffin’s main claim is that a conviction for “knowingly” entering or 4 remaining in a “restricted building or grounds” under section 1752(a)(1) requires proof that the defendant not only knew that the area was restricted, but that he knew the reason for the restriction when he entered or remained. The government acknowledged its obligation to prove that Griffin knew the grounds were restricted; Griffin challenges the sufficiency of the proof on that point. The government disagreed that the statute also requires proof that Griffin knew precisely why the area was restricted, and the district court held that the government did not “have to prove [he] knew that a specific dignitary was there.” J.A. 534.

We hold that the grounds immediately surrounding the U.S. Capitol qualified as a “restricted building or grounds” under section 1752, and that they were adequately “posted, cordoned off, or otherwise restricted” when Griffin clambered over a stone wall and jumped inside. And we hold that a conviction for knowingly entering and remaining on such grounds in violation of section 1752(a)(1) required only that Griffin knew that he had entered or remained in a “posted, cordoned off, or otherwise restricted” area where he was not authorized to be. The government was not required to prove that Griffin was aware that the Vice President’s presence was the reason the grounds remained restricted. We therefore affirm the judgment of conviction.

I.

A.

Section 1752 enables the Secret Service to protect the people and events they guard in settings the statute refers to as “restricted building[s] or grounds.” 18 U.S.C. § 1752(a). The statute has three subsections. Subsection (a) prohibits a range of conduct connected to those sites, including the trespass offense at issue in this appeal, as well as engaging in “any act 5 of physical violence” therein, and obstructing the means of ingress and egress to those sites with the intent to impede or disrupt government business. Id. §§ 1752(a)(1)-(5). Subsection (b) provides for criminal penalties, including imprisonment or a fine, or both, for those who violate subsection (a). Id. § 1752(b). The offense is punishable as a misdemeanor, id. § 1752(b)(2), unless a deadly or dangerous weapon is used or significant bodily injury results, in which case it may be punished as a felony, id. § 1752(b)(1).

Subsection (c) defines the term “restricted buildings or grounds” as “any posted, cordoned off, or otherwise restricted area”:

(A) of the White House or its grounds, or the Vice President’s official residence or its grounds;

(B) of a building or grounds where the President or other person protected by the Secret Service is or will be temporarily visiting; or

(C) of a building or grounds so restricted in conjunction with an event designated as a special event of national significance.

Id. §§ 1752(c)(1)(A)-(C).

Section 1752 did not always have this three-part structure. It was enacted in 1971 as a more streamlined statute focused on protecting the President in the wake of a series of political assassinations in the 1960s—particularly those of President John F. Kennedy in Dallas and then-presidential candidate Robert F. Kennedy in Los Angeles. In recognition of the rising levels of violent political rhetoric and the “constant excoriation of America’s institutions and leaders” that made holding the office of the presidency increasingly dangerous, Congress set 6 out to provide stronger and more standardized security for the President. S. Rep. No. 91-1252, at 4 (1970). Congress recognized the complex challenges of protecting national leaders away from their usual offices or residences, where they are “most vulnerable”—whether from an “isolated and deranged individual” or from “organized premeditated attempts” on their lives. Id. at 6.

At the time, no statute conferred federally enforceable authority on the Secret Service to restrict entry to places temporarily visited or used by the President. Instead, the Service relied on “the assistance of local authorities to arrest persons” under a patchwork of state and local criminal statutes—an arrangement that rendered it “increasingly difficult to maintain the necessary level of security” when local authorities were not present and closely coordinating or when the proper jurisdiction for arresting and prosecuting violations was unclear. Id. at 7. To remedy that impediment to presidential security, Congress enacted section 1752, creating a federal offense encompassing trespasses that the Secret Service had previously relied on state and local officials to enforce under state and local trespass laws. Id. at 7. In this way, Congress provided “a uniform minimum of Federal jurisdiction for Presidential security when the President is on temporary visits,” id. at 6, by empowering the Secret Service to prevent “physical presence [and] physical violence within the security perimeter” created by temporarily restricted areas surrounding the President, id. at 9.

Over the decades, Congress has repeatedly revisited section 1752, expanding its coverage to align with the broader scope of the Secret Service’s protective duties. At first, the statute protected only places designated as the President’s temporary residence or office or any other building or grounds where the President was or would be temporarily visiting. See 7 18 U.S.C. § 1752(a)(1) (1971). In 1982, Congress amended the statute to extend “the same ‘zone of protection’ authority” applicable to the President to all Secret Service protectees (which includes the Vice President). See Pub. L. No. 97-308, 96 Stat. 1451, 1451-52 (1982). In 2006, Congress again amended the statute to apply beyond sites temporarily visited by protectees to also shield any “event designated as a special event of national significance.” See Pub. L. No. 109-177, 120 Stat. 192, 252 (2006). Finally, in 2012, Congress added federal protection against intrusion into the White House or Vice President’s residence or their grounds. See Pub. L. No. 112- 98, 126 Stat. 263, 263-64 (2012). In so doing, Congress acknowledged that the Secret Service had previously relied on District of Columbia trespass law to protect those sites. H.R. Rep. 112-9, at 2 (2011). 1

B.

In January 2021, Griffin was serving as an elected Commissioner on the Otero County Commission in southern New Mexico and as the leader of a political committee called “Cowboys for Trump.” He decided to travel to Washington, D.C. to attend the Stop the Steal rally on the National Mall on January 6, 2021—the day that Congress was set to certify the Electoral College vote that confirmed the outcome of the 2020 presidential election. He arrived by January 5 and recorded a video of himself in front of the U.S. Capitol’s western side, declaring that he was “praying for” former Vice President Pence and “trust[ed] that he would do the right

1 In referencing the importance of section 1752 to the Secret Service’s ability to shield the President, Vice President, and other protectees, we recognize that the Secret Service works together with other protective forces—as it did in this case—and take no position on whether section 1752 requires the Secret Service itself to designate or secure the “restricted buildings or grounds.” 8 thing . . . tomorrow.” GX 63 at 1:00-1:13. Fencing surrounding the grassy areas in front of the Capitol was visible behind Griffin in the video. Id.

In anticipation of the rally and certification, the Secret Service worked in coordination with the U.S. Capitol Police to prepare for Vice President Pence’s visit to the Capitol. The Secret Service informed the Capitol Police of Vice President Pence’s anticipated schedule of arrivals and departures to and from each location he intended to visit at the Capitol, and the Capitol Police prepared for the certification, including Vice President Pence’s presence at the Capitol. Pursuant to its longstanding relationship with the Secret Service, the Capitol Police implemented “an agreed-upon standard boundary” to secure a perimeter on the grounds immediately surrounding the Capitol. J.A. 450. To do so, the Capitol Police erected barriers using temporary crowd-control fencing that they referred to as metal “bike racks” and plastic “snow fencing” to supplement permanent walls. They also placed temporary fencing both immediately behind the permanent walls and midway up the west lawn to protect the inaugural stage that was being prepared for Inauguration Day. The racks and fencing were posted with signs reading “Area Closed by Order of the United States Capitol Police Board” and were patrolled by law enforcement officers.

On January 6, Griffin attended the Stop the Steal rally on the Ellipse adjacent to the White House and followed the crowd as it proceeded toward the U.S. Capitol. Griffin was not at the front of the crowd. Shortly after 2 p.m., as the first wave of rioters to have breached the security perimeter shattered the Capitol Building’s windows and climbed inside, Griffin was taking photos and exchanging social media information with other rally attendees near the Capitol Reflecting Pool adjacent to the west lawn of the Capitol. At 2:31 p.m.—around the same 9 time that Capitol Police officers were conducting emergency evacuations of the House and Senate chambers in response to the breach of the Capitol Building—Griffin used the seat of a parked bicycle to boost himself over a five-foot-tall stone wall separating a sidewalk from the Capitol’s west front lawn. He landed on a trampled length of plastic snow fencing that the U.S. Capitol Police had erected to cordon off the area.

Once inside the grounds, Griffin proceeded up the lawn to the base of the inaugural stage, scaling two other walls along the way with the help of a metal bike rack and a plywood ramp manned by other rioters helping the crowd advance toward the Capitol. After he ascended the bike rack, he narrated to a camera “we’re in now” and joked to a masked rioter that he, too, needed a face mask to obscure his identity. GX 37-1 at 1:10-28. As Griffin made his way toward the front of the crowd, the crowd packed increasingly closely together in pressing toward the Capitol, with rioters scaling the bannisters of the Capitol steps, banging on the Capitol terraces with flagpoles, pounding on the doors of the inaugural stage, and urging the crowd forward with shouts of “this is our House” and “break the doors down.”

Griffin proceeded to the foot of the inaugural platform, near an emergency stairwell door, where he announced that he would “wait until they get this door broken down” to go up on the inaugural stage. GX 40-1 at 0:25-30. Griffin managed to make his way onto the inaugural stage. As he climbed the stairs, he proclaimed—in response to the smell of pepper spray officers used to try to clear the area—that he “love[s] the smell of napalm in the air.” GX 43-1 at 0:30-40; see also J.A. 536. Having ascended the stage, he borrowed a bullhorn in an attempt to lead the rioters below in prayer. Around that time, a crowd of rioters armed with plastic riot shields and flagpoles massed in a tunnel approximately a hundred feet away from 10 Griffin, pressing against and engaging in hand-to-hand combat with Metropolitan Police Department officers in an attempt to gain access to the Capitol. Griffin stayed up on the inaugural stage and the nearby terrace until at least 4:48 p.m.

As explained at trial by a member of the Secret Service detail accompanying Vice President Pence, his wife, and their daughter, the “unknown individuals who were breaking through a security barrier of a site where [the Secret Service] had protectees” posed a security risk by “potentially taking away options for our routes out” of the Capitol. J.A. 422. Due to breaches of security, “the Capitol went into lockdown, which means everything has to stop, and the doors lock, and people aren’t allowed in,” and “any official actions that are taking place” are halted. J.A. 426. The mass security breaches on January 6 by thousands of people, including Griffin, halted the certification of the electoral votes while the Secret Service sought to safeguard the Vice President and his family in a building under attack. The Vice President, his wife, and their daughter remained at an underground loading dock at the Capitol under Secret Service protection for four or five hours, not returning to the Senate Chamber until approximately 7 p.m. J.A. 425-27.

The next day, Griffin resurfaced in Roanoke, Virginia, where he recorded another video. He asserted that he heard when he was “about three-quarters of the way down [to the Capitol]” on January 6 that “Mike Pence had sold us all out.” GX 64 at 3:20-35. Griffin went on to explain that the inaugural stage was “set up for Joe Biden” and “roped off” on the Capitol grounds. Id. at 3:35-4:15. As he put it, “You’re gonna have those patriots who get in there and went over the—when the D.C. police tells ‘em you can’t step over this because this is— we’re getting it ready for Joe Biden. What do you think was gonna happen?” Id. 11 The following week, Griffin addressed his colleagues on the Otero County Commission. He told them:

On the inaugural side, all those Trump people got down there, had not got anything necessarily from the President that was new, and then heard that Mike Pence had certified a fraudulent election. The element in the crowd was pretty elevated, I would say. But when they got down to the inaugural side, there was some fencing up, and they were saying that you couldn’t go any further because this was being reserved for Joe Biden and his inauguration. You tell a million Trump supporters that, they’re going down there. Pretty soon that crowd just pushed through. I wasn’t anywhere in the front of it. I was in the back.

GX 78 at 2:27-3:12. Griffin said that he planned to return to Washington, D.C. for Inauguration Day with multiple firearms. See id. at 11:10-11:50. Days later, he was arrested in Washington, D.C.

C.

Federal prosecutors charged Griffin with two misdemeanors: entering and remaining in a restricted building or grounds, in violation of 18 U.S.C. § 1752(a)(1), and disorderly and disruptive conduct in a restricted building or grounds, in violation of 18 U.S.C. § 1752(a)(2). He opted for a bench trial before the district court.

Shortly before trial, the parties briefed whether the government would be required to prove that Griffin knew Vice President Pence was visiting the Capitol at the time Griffin was on the Capitol grounds. Griffin argued that, because section 1752(a)(1)’s “knowingly” modifies the object of the prohibited conduct—the “restricted building or grounds” in which a 12 defendant enters or remains—a defendant must be shown to know the characteristics of the area that qualify it as a “restricted building or grounds” pursuant to section 1752(c)(1), which include the presence of a Secret Service protectee. See Griffin’s Resp. to Gov’t’s Trial Br. at 3 (J.A. 129).

At the conclusion of the bench trial, the district court rejected Griffin’s argument, concluding that section 1752’s condition that a defendant act “knowingly” did not require knowledge of the presence of a Secret Service protectee. The court noted that “it doesn’t make a lot of sense” to require proof that the defendant “knew that a specific dignitary was there,” and found it unimaginable that “a provision that is looking to protect Secret Service protectees would require the Secret Service to somehow be telling people and proving that [defendants] knew which protectee was in the restricted area at what time.” J.A. 534. It sufficed, the district court held, that the area was restricted because of Vice President Pence’s presence when Griffin entered and stayed, J.A. 530-532, and that, “by the time [Griffin] was on the stage, he certainly knew he shouldn’t be there. And yet, he remained.” J.A. 537. The court accordingly convicted Griffin of violating 18 U.S.C. § 1752(a)(1).

As to the section 1752(a)(2) charge of disruptive or disorderly conduct in or near a restricted building or grounds, the court found “more than a reasonable doubt as to whether he intended for his conduct to disrupt the certification of the election.” J.A. 539. Despite “some close questions about whether his mere presence impeded or disrupted government business,” the court held the government failed to prove that Griffin “engaged in disorderly or disruptive conduct.” J.A. 539. And it failed to establish that Griffin “acted knowingly and with intent” to impede or disrupt congressional business, 13 because Griffin “thought the electoral certification had already occurred prior to his entering the restricted area.” J.A. 537-38.

The district court sentenced Griffin to fourteen days of incarceration, with credit for time served, and one year of supervised release. He timely filed this appeal.

II.

To violate section 1752(a)(1), a defendant must “knowingly” and “without lawful authority” enter or remain in a “restricted building or grounds.” Griffin contends the district court should have acquitted him for two reasons. First, he argues that the government failed to prove beyond a reasonable doubt that the area immediately surrounding the U.S. Capitol was sufficiently demarcated as restricted when he entered and remained there. Second, Griffin argues that the government failed to prove beyond a reasonable doubt that Griffin knew not just that the area was restricted, but also the reason for that restriction—here, that Vice President Pence, a Secret Service protectee, was or would be visiting.

Griffin challenges both the district court’s interpretation of section 1752’s elements and the sufficiency of the evidence to support his conviction. We review de novo the district court’s interpretation of the statute. See United States v. Verrusio, 762 F.3d 1, 13 (D.C. Cir. 2014); see also United States v. Johnson, 979 F.3d 632, 636 (9th Cir. 2020) (“In a bench trial, a district court’s legal error regarding the elements of the offense is reviewed in the same way we review an erroneous jury instruction regarding the elements of the offense.”). In reviewing the sufficiency of the evidence, we defer to the factfinder’s verdict, considering the evidence “in the light most favorable to the government.” United States v. Robertson, 103 F.4th 1, 10-11 (D.C. Cir. 2023) (quoting United States v. Shi, 991 F.3d 198, 205 (D.C. Cir. 2021)); see also United States v. 14 Brock, 94 F.4th 39, 46 (D.C. Cir. 2024) (explaining that “this standard is the same for both jury and non-jury cases”). We consider the evidence taken as a whole, and with reasonable inferences drawn in the light most favorable to the verdict. United States v. Broda, 848 F.3d 1044, 1053 (D.C. Cir. 2017). We will affirm a guilty verdict if “any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.” Musacchio v. United States, 577 U.S. 237, 243 (2016) (quoting Jackson v. Virginia, 443 U.S. 307, 319 (1979)).

A.

We begin with Griffin’s argument that the government failed to prove the requisite conduct, or actus reus, under section 1752(a)(1). The U.S. Capitol grounds are ordinarily open to the public. J.A. 337. To qualify as a “restricted building or grounds” protected by section 1752, those grounds must have been “posted, cordoned off, or otherwise restricted” at the time Griffin entered or remained there. 18 U.S.C. § 1752(c)(1).

Apart from his argument addressed below regarding his knowledge of the grounds restriction, Griffin argues that, by the time he entered, the grounds were in fact no longer restricted within the meaning of the statute. They were neither posted nor cordoned off, he claims, because earlier waves of the rioters had torn down the temporary fencing and trampled signs announcing the closure. Griffin Br. 21-22, 46-47; see J.A. 345. And, reading “otherwise restricted” narrowly to require demarcation “comparable to a physical ‘posting’ or ‘cordoning off,’” Griffin Br. 40, Griffin insists only a clear, observable demarcation would suffice. He argues his conviction cannot stand because the barriers and signs had been trampled or pushed aside. Id. 15 The statutory text imposes no such requirement. “Otherwise” means “in another way” or “in a different manner,” and “restricted” means deemed “accessible only to certain authorized people.” Otherwise (adv.), Oxford English Dictionary (2d ed. 1989); Restricted (adj.), Oxford English Dictionary. Section 1752 thus applies to areas made nonpublic by posting signs, cordoning off the area, or in some other way effecting the restriction, regardless of whether the method consistently and physically stakes out the area’s boundaries. For example, to “otherwise restrict[]” an area, officers or agents charged with excluding the public could position themselves around the area occupied by a protected person or move in coordination with the protectee, as they typically do when the President or Vice President is on foot moving through otherwise publicly accessible areas. Or they might use a sound system or official briefing warning people to maintain a specified distance as means to control the perimeter, 18 U.S.C. § 1752(c)(1), even without static visual demarcation of an area’s boundaries. J.A. 444.

The drafting history confirms as much. When Congress first promulgated section 1752, it “anticipated that the Secret Service [would] make every effort . . . to make such restricted areas known to the public,” S. Rep. 91-1252, at 9, but it declined to list exhaustively the ways in which the public would be excluded. By separately requiring proof of a defendant’s subjective awareness that the area was “posted, cordoned off, or otherwise restricted,” Congress ensured that unwitting trespassers would not be punished. Id. That approach accommodated the reality that “flexibility must be maintained” to ensure adequate security. Id. at 2.

Griffin’s proposed physical demarcation requirement would undermine the function of section 1752(a)(1). Under his reading, a defendant would be entitled to acquittal so long as 16 he waited until a sufficiently strong gust of wind, a soaking downpour—or even a less scrupulous prior intruder—disposed of law enforcement tape, fencing, or signage before he entered a sensitive area in full awareness he was not lawfully authorized to do so. We decline to read the statute to allow a mob to de-restrict an officially restricted area encompassing persons under Secret Service protection.

With the meaning of those terms thus settled, we hold that the evidence at trial was sufficient for a reasonable factfinder to conclude that the U.S. Capitol grounds qualified on January 6 as a “restricted building or grounds” and were “posted, cordoned off, or otherwise restricted” when Griffin entered and remained there. In anticipation of then-Vice President Pence’s presence at the Capitol to certify the electoral votes on January 6, law enforcement officers had erected barriers around the perimeter of the closed area with layers of snow fencing and bike racks supplementing pre-existing permanent walls to encircle the Capitol grounds. Signs indicating the area was closed were affixed along the barriers. By the time Griffin entered the restricted area, many of those physical manifestations of its closure had been largely trampled, but that fact did not alter the status of the area as closed to the public. The Secret Service’s protectees, then-Vice President Pence and his wife and daughter, remained within the Capitol complex, sheltering in the eye of the riot’s storm. Far from reopening the grounds, law enforcement officers remained onsite battling to secure them.

B.

We turn next to Griffin’s arguments that he lacked the requisite knowledge to be convicted. Griffin argues that the government failed to prove the knowledge element in two ways. First, he contends that there is insufficient evidence to 17 support the district court’s finding that Griffin knowingly entered or remained within a “posted, cordoned off, or otherwise restricted” area. Second, Griffin argues that the district court misread the statute in not requiring the government to prove that he knew why the Capitol grounds were restricted—namely, that former Vice President Pence was or would be visiting the Capitol—and that the trial evidence failed to establish his knowledge of the Vice President’s whereabouts.

We can quickly dispose of Griffin’s first argument. Griffin insists that a reasonable factfinder could only have found that, when Griffin entered the Capitol grounds, he believed that the area was no longer restricted. See Griffin Br. 60 (describing Griffin’s view of the trampled fencing as “akin to seeing rolled up fencing after a 4th of July concert”).

The evidence does not support that claim. Viewed in the light most favorable to the government, the trial evidence showed that Griffin knew he had entered or remained without authorization in a “posted, cordoned off, or otherwise restricted” area. The district court found “ample evidence that Mr. Griffin knowingly entered or remained within the restricted area.” J.A. 536. The government proved that Griffin saw the rings of fencing and signage encircling the Capitol grounds on January 5, when he recorded a video with the grounds as his backdrop. J.A. 536 (district court’s oral ruling); see also GX 63. And it showed that, the next day, when Griffin scaled the stone wall that partially delineated the grounds, he landed on trampled snow fencing and signs, GX 33-1, which the district court observed would suggest to a reasonable person “that perhaps you should not be entering the area.” J.A. 536. The evidence that Griffin knew he was trespassing only mounted as he continued to progress across the grounds. Arriving at the base of the inaugural stage, he announced, 18 “we’re in now,” and joked that he should hide his identity with a face mask. GX 37-1 at 1:10-28. When Griffin quipped that he loved the “smell of napalm in the air,” he showed he knew that law enforcement officers were using teargas as they battled to expel the mob—a clear sign that the area remained restricted. GX 43-1 at 0:30-40; see also J.A. 536.

Griffin’s public statements in the days after January 6 confirm that Griffin knew when he entered and stayed on the Capitol grounds that the area was “restricted” within the meaning of section 1752(c)(1). See J.A. 536-37. On January 7, Griffin recalled that the inaugural stage that he climbed was “roped off,” and that “D.C. police” had told the rioters “you can’t step over this.” GX 64 at 3:20-4:15. And, on January 14, Griffin reiterated that “there was some fencing up” that alerted the rioters they “couldn’t go any further,” but the crowd— including Griffin—“just pushed through.” GX 78 at 2:27-3:12.

Accordingly, a rational factfinder could conclude—as, indeed, the district court did, see J.A. 536-37—that Griffin was aware that the U.S. Capitol grounds were “posted, cordoned off, or otherwise restricted” and his presence was unauthorized when he remained there during the afternoon of January 6, 2021.

C.

To prevail, then, Griffin must persuade us that the district court misinterpreted section 1752(a)(1)’s knowledge requirement. Section 1752(a)(1) prohibits “knowingly enter[ing] or remain[ing] in any restricted building or grounds without lawful authority to do so.” 18 U.S.C. § 1752(a)(1). And, as relevant here, section 1752(c)(1) defines the term “restricted buildings or grounds” to mean “any posted, cordoned off, or otherwise restricted area . . . of a building or grounds where the President or other person protected by the 19 Secret Service is or will be temporarily visiting.” Id. § 1752(c)(1)(B).

As we explained, the district court reasonably found that the Capitol grounds were “posted, cordoned off, or otherwise restricted” when he entered, and that Griffin knew that they were. But Griffin argues that the statute demands something more: In his view, the statute also requires proof that he knew why the Capitol grounds were so restricted when he entered or remained there—i.e., that Griffin knew that a Secret Service protectee was or would be temporarily visiting the Capitol grounds. We decline to adopt such a rule, which would contravene the statute’s text as read in accord with binding precedent of the Supreme Court and this court, and would undermine the statute’s context and purpose. Every indicator points in the same direction: A person trespassing on grounds he knows are restricted, where he knows he lacks permission to be, may be convicted of a federal misdemeanor trespass under section 1752(a)(1) even if he does not know that a Secret Service protectee is within.

1.

“Whether a criminal statute requires the Government to prove that the defendant acted knowingly is a question of congressional intent.” Rehaif v. United States, 588 U.S. 225, 228 (2019) (citing Staples v. United States, 511 U.S. 600, 605 (1994)). Griffin contends that Congress’s intent is clear—and “dictated by text.” Griffin 28(j) Ltr. at 2 (Feb. 19, 2024). He argues that section 1752(a) uses “restricted building or grounds” as a defined term, so its appearances across the text of subsection (a)(1) must be treated as shorthand for every detail of the term’s definition. In Griffin’s view, because “knowingly” modifies “restricted building or grounds,” the government must prove that he had knowledge not just that 20 access was restricted, but the precise reason why it was restricted. Griffin Br. 48-57. Otherwise, Griffin urges, the government would have failed to prove that the defendant knew he entered a “restricted building or grounds” as the statute requires.

In support of this argument, Griffin cites McFadden v. United States, 576 U.S. 186 (2015), in which the Supreme Court held that violation of the Controlled Substances Act’s prohibition of “knowingly . . . distribut[ing] . . . a controlled substance” required the defendant to know that he distributed something that qualified as a “controlled substance” as elsewhere defined by the Act. 576 U.S. at 191-92. “[J]ust as it is not enough to know that a substance is generically ‘controlled’ (antibiotics are ‘controlled’),” Griffin urges, “it is not enough to know that a building or grounds is generically ‘restricted’ (any place bearing an ‘area closed’ sign is ‘restricted’).” Griffin Br. 54.

Griffin’s reading of the extent of the statute’s knowledge requirement fails because it is contrary to both Supreme Court precedent and contextual evidence of Congress’s purpose. Grammatical rules and presumptions regarding statutory knowledge requirements and “jurisdictional only” elements all weigh against extending the “knowingly” requirement in section 1752(a)(1) to the specific reason that the area is “posted, cordoned off, or otherwise restricted.”

Griffin is correct that a handful of Supreme Court cases, including McFadden, hold that, at least for relatively short statutory phrases, “[a]s a matter of ordinary English grammar, it seems natural to read the statute’s word ‘knowingly’ as applying to all the subsequently listed elements of the crime.” Flores-Figueroa v. United States, 556 U.S. 646, 650 (2009). The Court in Flores-Figueroa, for example, interpreted the 21 phrase “knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person,” 18 U.S.C. § 1028A(a)(1), to require that the defendant knew the identification he used belonged to “another person.” Id.

That precedent does not resolve this case. To begin with, the Court has adopted that understanding of ordinary usage inconsistently even as applied to relatively short and straightforward statutory phrases. For instance, in Liparota v. United States, 471 U.S. 419 (1985), the Court analyzed whether, in a statutory phrase concerning someone who “knowingly uses, transfers, acquires, alters, or possesses coupons or authorization cards in any manner not authorized by [the statute],” the “knowingly” requirement extends to the fact that the use was unauthorized. Id. at 420-21. The Court concluded that “the words themselves provide little guidance,” as “[e]ither interpretation would accord with ordinary usage.” Id. at 424. Instead, to determine that “knowingly” extended to the unauthorized nature of the use, the Court relied on the judicial presumptions that elements criminalizing otherwise innocent conduct are subject to a mens rea requirement and that ambiguous statutes should be interpreted leniently. Id. at 424- 27.

More to the point, “where the modifier ‘knowingly’ introduces a long statutory phrase,” the ordinary meaning Griffin asserts loses its clarity, “such that questions may reasonably arise about how far into the statute the modifier extends.” Rehaif, 588 U.S. at 230. And when a statutory phrase is long enough, the ordinary usage presumption flips, so that the “most natural grammatical reading . . . suggests that the term ‘knowingly’ modifies only the surrounding verbs” and does not travel down to modify elements “set forth in independent clauses separated by interruptive 22 punctuation.” United States v. X-Citement Video, Inc., 513 U.S. 64, 68 (1994).

The Court in X-Citement Video accordingly had to reach beyond rules of grammar to interpret a statute penalizing “[a]ny person who—(1) knowingly transports or ships [using any means or facility of] interstate or foreign commerce by any means including by computer or mails, any visual depiction, if—(A) the producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct.” Id. It recognized that, in the most natural reading of that long text string, “the word ‘knowingly’ would not modify the elements of the minority of the performers, or the sexually explicit nature of the material.” Id. The Court ultimately rejected that “most natural grammatical reading” because of “anomalies which [would] result,” and to ensure that “some form of scienter” would apply to avoid criminalizing conduct that was not only “otherwise innocent” but protected by the First Amendment. Id. at 68-69, 72-73.

Here, the statutory phrase—“knowingly enters or remains in any . . . posted, cordoned off, or otherwise restricted area . . . of a building or grounds where the President or other person protected by the Secret Service is or will be temporarily visiting,” where “other person protected by the Secret Service” is further defined as “any person whom the United States Secret Service is authorized to protect under section 3056 of this title or by Presidential memorandum, when such person has not declined such protection,” 18 U.S.C. §§ 1752(a), (c)—is sufficiently long to raise “questions . . . about how far into the statute the modifier extends.” Rehaif, 588 U.S. at 230. The statutory definition of “restricted building or grounds” requires not just following section 1752(a)’s reference to subsection (c)(1), and then to either (A), (B), or (C), but also, if (B) applies, flipping to section 3056 to find the list of protectees under the 23 Secret Service’s care. Some protectees defined by the section are straightforward—e.g., the “President [and] the Vice President.” 18 U.S.C. § 3056(a)(1). But others are contingent on further facts, such as the Secret Service’s protection of children of former Presidents only until their sixteenth birthday, or its protection of “distinguished foreign visitors . . . when the President directs that such protection be provided.” Id. § 3056(a)(6).

The “most natural grammatical reading” of that matryoshka doll of nested statutory references is that “the word ‘knowingly’ would not modify” all elements in each reference. X-Citement Video, 513 U.S. at 68. No grammatical rule requires that “knowingly” be read to apply, for example, to elements that are not only “set forth in independent clauses separated by interruptive punctuation,” but span multiple, separate statutory provisions. Id. (holding that the “most natural grammatical reading” would not extend “knowingly” to subsections listing further specifications of the offense, and describing em-dashes introducing those requirements as “interruptive punctuation”). And here, unlike in X-Citement Video, the grammatically natural reading neither produces “anomalies” nor fails to require a culpable state of mind—and certainly not in a way that raises a risk of punishing constitutionally protected conduct. Id. To the contrary, it is Griffin’s construction that would produce absurd results. It would require a defendant to know that the protectee “has not declined” Secret Service protection. See 18 U.S.C. § 1752(c)(2). If the protectee is a visiting official from abroad, it would require a defendant charged under section 1752(a) to know that the President saw fit to grant that visitor Secret Service protection pursuant to section 3056(a)(7). And if the basis for a restriction is a “special event of national significance,” see 18 U.S.C. § 1752(c)(1)(C), a defendant would have to know that it has been so designated. If we read 24 the knowledge requirement to jump the em-dash into subsection (c)(1)(B) as Griffin urges, we would by all indications have to do the same for those qualifiers. See, e.g., Clark v. Martinez, 543 U.S. 371, 378 (2005) (“The operative language . . . applies without differentiation to all three categories . . . that are its subject. To give these same words a different meaning for each category would be to invent a statute rather than interpret one.”). This is no far-fetched reductio ad absurdum, post at 10-12; it is a direct consequence of Griffin’s own syntactic logic and suggests that Griffin’s interpretation— which is not required by any interpretive rule and defies common sense—cannot be correct.

Although the plain text makes clear that “knowingly” does not apply all the way down the definitional line, the text alone “provide[s] little guidance” regarding how far “knowingly” extends. Liparota, 471 U.S. at 424. To answer that question, we turn to longstanding judicial presumptions, Supreme Court precedent, and the statute’s context and purpose. Because those interpretive tools reveal the answer—“knowingly” does not extend to the reason for the restriction listed in subsection (c)(1)(B)—we have no occasion to apply the rule of lenity, which “applies only when, after consulting traditional canons of statutory construction, we are left with an ambiguous statute.” Shular v. United States, 589 U.S. 154, 165 (2020) (quoting United States v. Shabani, 513 U.S. 10, 17 (1994)); see also Ocasio v. United States, 578 U.S. 282, 295 (2016) (explaining that the rule of lenity “applies only when a criminal statute contains a ‘grievous ambiguity or uncertainty,’ and ‘only if, after seizing everything from which aid can be derived,’ the Court ‘can make no more than a guess as to what Congress intended.’”) (quoting Muscarello v. United States, 524 U.S. 125, 138-39 (1998)). 25 2.

As noted above, “[w]hether a criminal statute requires the Government to prove that the defendant acted knowingly is a question of congressional intent.” Rehaif, 588 U.S. at 228 (citing Staples, 511 U.S. at 605). “In determining Congress’ intent, we start from a longstanding presumption . . . that Congress intends to require a defendant to possess a culpable mental state regarding ‘each of the statutory elements that criminalize otherwise innocent conduct.’” Id. (quoting X- Citement Video, 513 U.S. at 72). But that presumption is both limited and rebuttable.

Two interpretive rules confirm that section 1752(a)(1) requires only that a defendant “knowingly enter[] or remain[] in” an area that is “posted, cordoned off, or otherwise restricted.” For one thing, the presumption “flips” for the jurisdictional elements of a federal offense, so courts presume that a criminal statute’s knowledge requirement is typically inapplicable to such jurisdictional elements. Torres v. Lynch, 578 U.S. 452, 468 (2016). And, more generally, contextual clues may rebut the presumption in favor of scienter. Applying those rules here confirms that section 1752(a)(1) does not require that the defendant further know which of the subsection (c)(1) requirements is the reason for the restriction.

a.

Federal criminal prohibitions, unlike their state counterparts, contain jurisdictional elements that “connect[] the law to one of Congress’s enumerated powers, thus establishing legislative authority.” Torres, 578 U.S. at 467-68. Those jurisdictional elements must be proven beyond a reasonable doubt, as with any element of a criminal offense. See id. But they are also distinctive as subjects of statutory interpretation: When Congress has not explicitly applied a 26 mental state requirement to a jurisdictional element, we “assume that Congress wanted such an element to stand outside the otherwise applicable mens rea requirement.” Id. at 468. In other words, we presume that “the existence of the fact that confers federal jurisdiction need not be one in the mind of the actor at the time he perpetrates the act made criminal by the federal statute.” United States v. Feola, 420 U.S. 671, 676 n.9 (1975). That rule applies even when textual cues might cut the other way. In Rehaif, for example, the Supreme Court eschewed what it described as the most grammatical reading of a criminal statute in order to exempt a jurisdictional element from a knowledge requirement that it held applied to textually preceding and succeeding statutory terms. Rehaif, 588 U.S. at 230.

Section 1752(c)(1) supplies the jurisdictional elements for Griffin’s statute of conviction. As described above, Section 1752(c)(1) defines “restricted buildings or grounds” to include “any posted, cordoned off, or otherwise restricted area” of the White House, the Vice President’s official residence, or their grounds; a building or grounds where the President or other Secret Service protectee is or will be temporarily visiting; or a building or grounds restricted in conjunction with a special event of national significance. 18 U.S.C. § 1752(c)(1)(A)-(C). Those elements are jurisdictional; they “ensure that the Federal Government has the constitutional authority to regulate the defendant’s conduct.” Rehaif, 588 U.S. at 230.

The subsection (c)(1)(A)-(C) requirements narrow the criminal offense’s applicability to a small subset of trespassing offenses that implicate both the personal security of the most high-profile federal officials and their foreign counterparts when they visit the United States, and also, necessarily, the national security of the United States. See Wood v. Moss, 572 U.S. 744, 748 (2014) (citing Watts v. United States, 394 U.S. 27 705, 707 (1969)) (recognizing that “safeguarding the President” is “of overwhelming importance in our constitutional system”). Those requirements thus tie the criminal prohibition to Congress’s power to “provide for the common Defense and general Welfare of the United States.” U.S. Const. art. I, § 8, cl. 1; see H. R. Rep. No. 112-9, at 4 (2011) (identifying this basis of Congress’s constitutional authority in the 2012 amendment to the section).

The jurisdictional status of the subsection (c)(1) requirements is confirmed by their essential role in distinguishing a violation of section 1752(a)(1) from the familiar, state-law crime of trespass. Without them, section 1752(a)(1) would impermissibly federalize garden-variety trespass—entering or remaining in a restricted area without lawful authority—which is “historically a concern of state law.” Taggart v. Weinacker’s, Inc., 397 U.S. 223, 227 (1970) (Burger, J., concurring); cf. United States v. Lopez, 514 U.S. 549, 567-68 (1995) (emphasizing federalism’s requirement that Congress distinguish between “what is truly national and what is truly local,” and only legislate regarding the former). With or without the satisfaction of a (c)(1)(A), (B), or (C) requirement, the underlying conduct is the same knowing trespass. It is the satisfaction of one of the required connections to federal national security interests that elevates the conduct to a matter upon which Congress has authority to legislate.

Those subsection (c)(1) requirements are therefore jurisdictional in nature. And, under binding Supreme Court precedent, if they are “jurisdictional only” they “need not be one in the mind of the actor at the time he perpetrates the act made criminal by the federal statute.” Feola, 420 U.S. at 676 n.9. 28 Griffin contends that the subsection (c)(1) requirements are not jurisdictional at all, let alone “jurisdictional only,” because they play a substantive role in defining the prohibited conduct. The presence of a Secret Service protectee is “the very reason Congress cares to punish such conduct as wrongful at all,” Reply Br. 21, Griffin insists, so it cannot be jurisdictional. That argument misunderstands the Court’s admittedly “mislead[ing]” jurisdictional elements terminology. Feola, 420 U.S. at 676 n.9.

It is often the case that jurisdictional elements “have nothing to do with the wrongfulness of the defendant’s conduct.” Rehaif, 588 U.S. at 230. The classic example is “a standard interstate commerce element, of the kind appearing in a great many federal laws.” Torres, 578 U.S. at 471. That element “is almost always a simple jurisdictional hook” used to “connect[] the congressional exercise of legislative authority with . . . the Commerce Clause[] that grants Congress that authority.” Id. at 457, 471.

But things are not always so straightforward. Sometimes, an element of a federal crime both “makes evident Congress’s regulatory power” and also “play[s] a role in defining the behavior Congress thought harmful.” Id. at 471. The Supreme Court has recognized that such dual-role elements present “tough questions” concerning whether they are treated as both jurisdictional and substantive or as jurisdictional only. Id. at 470-71. And it has squarely held that the mere fact that a statutory element has something to do with the wrongfulness of the defendant’s conduct does not necessarily mean that the element is not “jurisdictional only.” Feola, 420 U.S. at 676 n.9. As the Court has explained, “[t]he significance of labeling a statutory requirement as ‘jurisdictional’ is not that the requirement is viewed as outside the scope of the evil Congress intended to forestall.” Id. Rather, as illustrated by Feola, dual- 29 role elements are nonetheless treated as “jurisdictional only” when they (a) implement Congress’s purpose to federalize pre- existing state law rather than defining a new substantive crime, and (b) do not transform innocent conduct into criminal conduct. Id.

In Feola, the Supreme Court considered the scope of the knowledge requirement in 18 U.S.C. § 111, which makes it a crime to assault a federal officer engaged in the performance of his official duties. Feola tried to sell counterfeit drugs to undercover federal officers and, when the deal went south, assaulted one of them. Feola, 420 U.S. at 674. Feola did not know that his victim was a federal officer—or an officer at all—so he was “undoubted[ly] surprise[d]” when he was charged with, and later convicted of, assaulting a federal officer. Id. at 675. But his surprise did not undermine his conviction. Deeming the “federal officer” requirement jurisdictional, the Court held that section 111 “cannot be construed as embodying an unexpressed requirement that an assailant be aware that his victim is a federal officer.” Id. at 684. “All the statute requires is an intent to assault, not an intent to assault a federal officer.” Id.

In holding that the victim’s federal officer status was “jurisdictional only,” the Court acknowledged that a jurisdictional requirement could also be “an element of the offense Congress intended to describe and to punish.” Id. at 676 n.9. Indeed, “a requirement is sufficient to confer jurisdiction on the federal courts for what otherwise are state crimes precisely because it implicates factors that are an appropriate subject for federal concern.” Id. (emphasis added). The Court explained that “a mere general policy of deterring assaults would probably prove to be an undesirable or insufficient basis for federal jurisdiction; but where Congress seeks to protect the integrity of federal functions and the safety 30 of federal officers, the interest is sufficient to warrant federal involvement.” Id. So, “[t]he significance of labeling a statutory requirement as ‘jurisdictional’ is not that the requirement is viewed as outside the scope of the evil Congress intended to forestall, but merely that the existence of the fact that confers federal jurisdiction need not be one in the mind of the actor at the time he perpetrates the act made criminal by the federal statute.” Id.

The Court thus concluded that the federal-nexus requirement was “jurisdictional only” because, in enacting section 111, Congress aimed to create a federal forum for the prosecution of already-criminalized conduct, rather than to create new substantive criminal law. Id. at 683-84. The law “in large part . . . duplicat[ed] state proscriptions” with the goal of ensuring that “those who killed or assaulted federal officers were brought to justice” under the uniform standards of federal court, rather than state courts where “state officials would not always or necessarily share congressional feelings of urgency as to the necessity of prompt and vigorous prosecutions of those who violate the safety of the federal officer.” Id. Therefore, because the “concept of criminal intent does not extend so far as to require that the actor understand not only the nature of his act but also its consequence for the choice of a judicial forum,” the Court declined to require knowledge of federal officers’ status. Id. at 685. Rather, despite the fact that Congress’s interest in establishing a federal forum was born of its specific concern for “protect[ing] the integrity of federal functions and the safety of federal officers,” id. at 676 n.9, the Court held that the federal officers’ status was “no more germane to the nature of [the assault] than the color of the victim’s hair,” id. at 693.

The Court also emphasized that its “interpretation poses no risk of unfairness to defendants.” Id. at 685. Even though 31 Feola may have been “surprised to find that his intended victim [was] a federal officer in civilian apparel, he nonetheless [knew] from the very outset that his planned course of conduct [was] wrongful.” Id. The Court distinguished the case from “one where legitimate conduct becomes unlawful solely because of the identity of the individual or agency affected.” Id.; cf. Ruan v. United States, 597 U.S. 450, 460-61 (2022) (applying the knowledge requirement in a statute criminalizing dispensing of a controlled substance to the element of lack of authorization because that “is often the critical thing distinguishing wrongful from proper conduct”). In that kind of case, the Court suggested, the identity of the victim may not be treated as jurisdictional. Feola, 420 U.S. at 685. But where the defendant’s planned course of conduct is wrongful from the outset, “the offender takes his victim as he finds him.” Id.

The rule from Feola is thus clear: When an element of a criminal offense serves as the basis for Congress’s authority to legislate; the offense merely provides federal jurisdiction over what was previously a state law offense; and knowledge of the element is not “essential to the existence of any crime,” United States v. Hicks, 15 F.4th 814, 818 (7th Cir. 2021) (emphasis added), the element is treated as “jurisdictional only” and courts presume that knowledge of that element is not required.

Feola thus resolves the “tough question” presented by the statutory text alone in favor of treating the element regarding a Secret Service protectee’s presence as “jurisdictional only.” As in Feola, section 1752(a)(1) does not create a substantively new criminal offense. Rather, Congress designed it to ensure that Secret Service officers did not have to “rely upon the assistance of local authorities to arrest persons” who entered restricted areas around a protectee. See S. Rep. No. 91-1252, at 7 (1970). 32 When it first enacted section 1752 in 1971, Congress recognized that “almost everything proscribed in [section 1752] is presently outlawed in some form or other at the State or local level.” Id. Similarly, in amending the statute in 2012 to include prohibitions on entering the grounds of the White House and Vice President’s residence, Congress stressed that the Secret Service had previously relied on D.C. trespass law to exclude and prosecute White House and Naval Observatory intruders. H.R. Rep. No. 112-9, at 2 (2011). Before section 1752’s enactment, Secret Service officers found it “difficult to tell exactly which jurisdiction bears the responsibility for detention and prosecution,” and the patchwork of relevant state laws that applied depending on the protectee’s location made “Secret Service agents unsure of the legal extent of their authority and [made] uniform enforcement impossible.” S. Rep. No. 91-1252, at 7 (1970). Just as in Feola, the fact that section 1752(a)(1) merely federalizes preexisting state or local prohibitions makes the basis for restricting the prohibited area “jurisdictional only.” That remains true even though the enacting Congress was of course motivated by a desire to safeguard federal Secret Service protectees, just as the Congress that enacted section 111 in Feola was motivated to shield federal officers.

Also as in Feola, the prohibited conduct (here, trespass) is wrongful regardless of whether it is restricted by federal, state, or local law, and it is therefore sufficient that the defendant knowingly trespassed on a restricted area. Just as Feola did not need to know that the target of his assault was a federal officer, so Griffin need not have known that the restriction was predicated on the presence of the Vice President. As in Feola, our interpretation of section 1752 “poses no risk of unfairness to defendants” because a trespasser knows “from the very outset that his planned course of conduct is wrongful.” 420 U.S. at 685. That is true even if he “may be surprised to find” 33 that the restricted area on which he is trespassing is protected by federal rather than state law. Id.

Contrary to the dissent’s view that mens rea requirements presumptively apply to each element distinguishing “greater and lesser evils,” post at 15-16, the Supreme Court has recently reaffirmed that “the purpose of scienter” is to “help[] to separate wrongful from innocent acts,” Rehaif, 588 U.S. at 231- 32, and described the mens rea presumption as one that normally applies to “statutory elements that criminalize otherwise innocent conduct,” id. at 229 (quoting X-Citement Video, 513 U.S. at 72). Applying Griffin’s contrary rule would also be in tension with decisions of many other courts that regularly apply Feola to hold that jurisdictional elements that do not criminalize otherwise innocent conduct are “jurisdictional only.” Consider just a few examples.

In United States v. Evans, 74 F.4th 597 (4th Cir. 2023), the Fourth Circuit addressed the scope of the knowledge requirement in 18 U.S.C. § 1855, which makes it a crime to “willfully and without authority, set[] on fire any timber, underbrush, or grass or other inflammable material . . . upon any lands owned or leased by . . . the United States.” Id. at 601, 605. The court held that the government need not prove that the defendant knew that the land on which he set fire was federally owned; it was sufficient that he knowingly set a fire on the property of another. Id. The court explained that the “proscribed arson [wa]s the culpable conduct”; the statutory requirement that the fire be set ablaze on federally owned lands merely brought that “culpable conduct within the United States’ jurisdiction” by tying the offense to Congress’s constitutional power to regulate federal land. Evans, 74 F.4th at 605, 606. And the jurisdictional nature of the federal- ownership element was “confirm[ed]” by the fact that it “is not an element that ‘separate[s] wrongful conduct from innocent 34 acts.’” Id. (quoting Ruan, 597 U.S. at 458). So, too, here, subsection (c)(1)(B) ties the trespassing offense to Congress’s authority to regulate in the national security arena, and trespassing on an area that one knows is restricted is wrongful, regardless of why the area is restricted. See also United States v. Quarrell, 310 F.3d 664, 671-74 (10th Cir. 2002) (holding that a defendant convicted of knowingly and without authorization excavating archaeological resources from public or Indian lands was not required to know the specified ownership of the land because “[o]ne would anticipate that excavating for archaeological resources on another person’s land, whether private or public, would not be viewed as an innocent act”).

The Second Circuit in United States v. Escalera, 957 F.3d 122 (2d Cir. 2020), adopted the same approach to a statute that criminalizes “knowingly” engaging in conduct “with intent to retaliate” against a witness in an “official proceeding,” 18 U.S.C. § 1513(b)(1), and that separately defines “official proceeding” as certain federal proceedings, id. § 1515(a)(1). The court held that, for purposes of the conduct or actus reus, the government had to prove that the victim of the defendant’s retaliation had testified in an “official proceeding” as defined in the statute—“a proceeding before a judge or court of the United States.” Escalera, 957 F.3d at 128-34. But for the mental state or mens rea, the government needed only to prove the defendant knew the witness had testified in a “court.” Id. In so holding, the Second Circuit emphasized that “[i]t is not as if Congress deemed retaliatory assaults on witnesses in state proceedings to be innocent conduct which would be worthy of prohibition only if a federal proceeding were involved.” Id. at 133. Rather, the purpose of section 1513 is to “ensure that the Federal Government does all that is possible . . . to assist victims and witnesses of crime.” Id. (quoting Victim and 35 Witness Protection Act of 1982, Pub. L. No. 97-291 § 2(b), 96 Stat. 1248 (1982)).

Under the Feola line of cases, the requirements in section 1752(c)(1)(A)-(C) serve as jurisdictional hooks, and knowledge that any of those requirements is satisfied is unnecessary to render criminal the underlying conduct: knowing trespass on property where the defendant is aware he is not authorized to be. As in the above cases, the defendant must know he is engaged in culpable conduct—trespassing— but he need not know the precise basis for federal regulation of that conduct.

Griffin contends that, even if attaching “knowingly” to the subsection (c)(1) requirements is not necessary to avoid criminalizing otherwise innocent conduct, the satisfaction of those requirements increases the severity of the conduct and resulting penalty. He thus argues that the government should be required to prove he was aware of the presence of a Secret Service protectee because knowledge of that fact would increase his culpability. See Griffin 28(j) Ltr. at 2 (Jan. 6, 2024). But there is no doctrinal basis for presuming that a knowledge requirement attaches to every factor that might render a crime more serious. And, in any event, the penalties under section 1752(a)(1) are not categorially more severe than under state trespass laws.

Consider the statute at issue in Feola. Assaulting an officer is generally a more serious crime than assaulting a private citizen. Both are plainly wrongful, but assaulting a federal officer imperils the success of the federal objectives he is serving as well as his own personal safety. So, too, with the statute prohibiting false statements within the jurisdiction of the federal government at issue in United States v. Yermian, 468 U.S. 63 (1984). Because of its high stakes for the public 36 trust, lying to a federal agency on a security clearance application is generally culpable in a way that lying about similar matters to a private employer is not. Yet the Supreme Court held in each of those cases that facts establishing the federal nexus were jurisdictional and not subject to the statute’s knowledge requirements.

In United States v. Burwell, 690 F.3d 500 (D.C. Cir. 2012) (en banc), we rejected the same argument now raised by Griffin. In that case, the court held that 18 U.S.C. § 924(c)(1)(B)(ii), which imposes a “term of imprisonment of not less than 30 years” for a person who “possess[es] . . . a machinegun” “during . . . any crime of violence”—a substantive rather than jurisdictional provision—does not require “the government to prove that the defendant knew the weapon he was carrying was capable of firing automatically.” Id. at 502. That was so, we held, even though the fact that the firearm could fire automatically, and was therefore a machinegun, ratcheted up the defendant’s crime of conviction to a mandatory 30-year sentence. Id. at 516.

In a dissenting opinion, then-Judge Kavanaugh argued that the presumption in favor of scienter “applies both when necessary to avoid criminalizing apparently innocent conduct (when the defendant would be innocent if the facts were as the defendant believed) and when necessary to avoid convicting the defendant of a more serious offense for apparently less serious criminal conduct.” Burwell, 690 F.3d at 529 (Kavanaugh, J., dissenting). (His dissent did not address whether his analysis would be any different if the machinegun element were jurisdictional.) But the en banc majority rejected that proposed rule as unsupported by Supreme Court precedent. Id. at 516 (maj. op.). The fact that the type of firearm defendant Burwell used increased the offense’s severity did not mean the government had to prove that he knew it was a machinegun. 37 Id. We similarly held in United States v. Morgan, 45 F.4th 192, 205-09 (D.C. Cir. 2022), that a conviction under 18 U.S.C. § 2423(a), which prohibits “knowingly transport[ing] an individual who has not attained the age of 18 years” interstate to engage in sex offenses, did not require proof of the defendant’s knowledge of the victim’s minor age, even though a sex offense involving a minor typically carries harsher penalties than one involving an adult. That principle applies with all the more force here, where the element increasing sentence severity is jurisdictional only.

Nor is it apparent that defendants like Griffin will be exposed to sentences disproportionate to their culpability. Barring aggravating factors not applicable to Griffin, section 1752 imposes a maximum of one year’s imprisonment for violating subsection (a). See 18 U.S.C. § 1752(b). Similar penalties attach to state trespassing laws on which the Secret Service would otherwise have to rely for arrest and prosecution of those who breach a security perimeter around a protectee. For example, the District of Columbia imposes a six-month maximum for trespass, see D.C. Code § 22-3302(b), and trespassing in Virginia is punishable by up to one year of imprisonment, see Va. Code Ann. §§ 18.2-11, -119.

To the extent that the maximum period of incarceration under section 1752 is higher than state trespassing laws typically provide, the same was true in Feola, where the maximum penalties imposed by section 111 exceeded states’ penalties for simple assault. See Feola, 420 U.S. at 702-03 (Stewart, J., dissenting). The Court’s analysis in Feola was unaffected by that maximum-penalty disparity because “the offender takes his victim as he finds him.” Id. at 685. So too in Burwell, where the status of a firearm as a machinegun “skyrocket[ed]” the mandatory sentence from five to thirty years’ imprisonment, Burwell, 690 F.3d at 503, and Morgan, 38 where the juvenile status of the transported individual boosted the sentence imposed from a maximum of ten years’ imprisonment to a minimum of ten years and up to life. See Morgan, 45 F.4th at 205, 208-09.

The availability of up to a year’s incarceration does not support Griffin’s dramatically narrowed reading of section 1752(a)(1). Concerns about ensnaring relatively mild conduct, such as “stepping over temporary plastic fencing just outside the Capitol grounds on January 5, 2021, to save a few steps on a walk home from work,” post at 10, could equally be levelled at the ordinary trespass laws of myriad states and localities with similar terms of incarceration. But we can readily assume that people in Virginia ignore “no trespassing” signs with some frequency “to save a few steps” without doubting that the Virginia legislature intended to criminalize simple trespass.

Recent experience in this Circuit demonstrates that violators of section 1752(a) are typically sentenced to far less time than the statutory maximum. The Sentencing Guidelines recommend imposing a sentence of zero to six months for a defendant without prior criminal history convicted of violating section 1752(a)(1). Nearly every defendant charged in connection with the events of January 6 and sentenced solely for violation of section 1752(a) has been sentenced to fewer than six months’ incarceration—to the extent they were sentenced to jail time at all. See U.S. Attorney’s Office for the District of Columbia, Sentences Imposed in Cases Arising out of the Events of January 6, 2021 (updated October 7, 2024), available at https://www.justice.gov/usao-dc/capitol-breach- cases [https://perma.cc/6PYL-KAB7]. Griffin was sentenced to fourteen days’ imprisonment. Even those January 6-related defendants convicted of a section 1752 offense involving possession of “deadly or dangerous weapon[s] or firearm[s],” 18 U.S.C. § 1752(b)(1)(A), carrying a ten-year maximum 39 prison sentence, have all been sentenced to less than one year of imprisonment or to probation alone. See id.

In sum, the basis of the Secret Service’s authority to prevent access to designated areas for the safety of its protectees is a “jurisdictional only” element of a section 1752(a)(1) federal trespass offense. It need not be in the mind of the trespasser. The relative seriousness of trespass in an area protected by the Secret Service, and the potential for somewhat greater punishment than for typical trespass, does not alter the analysis where, as here, the prohibited conduct is wrongful whether or not federal criminal law applies.

b.

In addition to the jurisdictional character of the subsection (c)(1) requirements, a second rule guiding our interpretation of criminal statutes’ state-of-mind requirements similarly disfavors requiring proof of knowledge of a Secret Service protectee’s presence in the restricted area. Courts decline to extend even explicit state-of-mind requirements to statutory elements when “context” disfavors doing so. Morgan, 45 F.4th at 206-08; see also Rehaif, 588 U.S. at 229-30 (noting that there can be a “convincing reason to depart from the ordinary presumption in favor of scienter”); Hicks, 15 F.4th at 817-18 (holding that a defendant’s knowledge that the money he stole belonged to the government was jurisdictional only, in part because a contrary interpretation would undercut the statute’s purpose of protecting federal property used in an undercover operation). The context of section 1752—a law originally enacted to create Secret Service-controlled security zones around the President in response to nationwide alarm over a spate of high-profile political assassinations—demonstrates that Congress intended the statute to cover all knowing trespasses into those restricted areas. 40 First, section 1752’s drafting and legislative history make clear that Congress never intended “knowingly” to extend to the reason for the area’s restriction. The original version of section 1752(a)(1)(ii) made it unlawful “knowingly to enter or remain in … any posted, cordoned off, or otherwise restricted area of a building or grounds where the President is or will be temporarily visiting.” 18 U.S.C. § 1752(a)(1) (1971). In describing the wording of that provision, the Senate Judiciary Committee addressed the concern that the public would lack adequate notice of a restricted area’s boundary because there would be no “written public notice” in the Federal Register defining the temporarily restricted areas (as the statute requires for the President’s official residences and offices). S. Rep. No. 91-1252, at 9 (1970). In the Committee’s view, that concern was adequately allayed by the fact that the Secret Service “will make every effort, consistent with Presidential security, to make such restricted areas known to the public (i.e., by posting or cordoning off),” and that individuals would be subject to criminal prosecution only if they “‘knowingly and willfully’ violate[] the restricted area.” Id.

The Senate Committee’s expressed satisfaction with the requisite actual knowledge as to the boundary of the restricted area makes clear that prosecution under section 1752(a)(1)(ii) is inappropriate if an individual does not know that the area is “posted, cordoned off, or otherwise restricted.” The lack of any mention of an individual’s knowledge of the reason for the restriction—the President’s actual or expected presence— makes equally clear that Congress did not intend the “knowingly” requirement to extend to the reason for the restriction. Indeed, the Committee’s reference to the requirement of subjective knowledge of an area’s restriction, and to the Secret Service making “every effort” at providing public notice only to the extent “consistent with Presidential security,” reinforces that Congress did not intend to also 41 require the Secret Service to announce to the public the precise location of the President in order to be able to enforce access restrictions on areas surrounding him.

As discussed above, in 1982, Congress expanded section 1752(a)(1)(ii) to cover other Secret Service protectees in addition to the President. See Pub. L. No. 97-308, 96 Stat. 1451, 1451-52 (1982). As part of its 2012 amendments, Congress also implemented a “technical improvement[]” to streamline the increasingly cumbersome statutory language by moving into subsection (c) the identification of the three Secret Service-protected areas justifying federal restriction. H.R. Rep. No. 112-9, at 1-2; see also Pub. L. No. 112-98, 126 Stat. 263, 263-64 (2012). That change yielded the statute’s current form, which spells out criminal offense conduct in subsection (a) and defines the term “restricted buildings or grounds” in subsection (c)(1). But neither that act of legislative housekeeping, nor Congress’s addition of other Secret Service protectees to section 1752(a)(1)(ii) in 1982, changes the mens rea requirement of that section to encompass the reason that the building or grounds is “posted, cordoned off, or otherwise restricted.”

Second, applying a mens rea requirement to the reason for the restriction would undercut section 1752(a)(1)’s manifest protective purpose. To require proof that a defendant “know” that a Secret Service protectee is or would be in the restricted area would pointlessly hinder the Secret Service’s ability to defend national leaders from would-be assassins and encumber prosecution of persons whose knowing trespasses endanger persons under Secret Service protection. Section 1752 empowers the Secret Service to ensure a secure perimeter around the President, other national leaders, and their families wherever they may travel. The nature of the risk against which 42 section 1752 guards strongly disfavors Griffin’s interpretation of the statute.

Requiring proof that a defendant knew the reason for his exclusion would render the statute ineffective in circumstances in which Congress plainly intended it to apply. In enacting and amending section 1752, Congress’s particular concern was to empower the Secret Service to arrest and expel those who breach security perimeters—so-called “zones of protection”— around the nation’s leaders. See S. Rep. 91-1252, at 7 (1970); Zones of Protection: Hearing on H.R. 4468 Before the H. Comm. on the Judiciary, 97th Cong. 5, at 11 (1981). As the district court reasoned, it is “[un]imagin[able] that a provision that is looking to protect Secret Service protectees would require the Secret Service to somehow be telling people and proving that people knew which protectee was in the restricted area at what time.” J.A. 534.

But, under Griffin’s reading, officers could not necessarily rely on section 1752 to stop and arrest anyone who breaches a restricted area; before doing so, they would need “at least some evidence supporting” the trespasser’s knowledge of the protectee’s presence. Hall v. Dist. of Columbia, 867 F.3d 138, 154 (D.C. Cir. 2017). In effect, Griffin would burden Secret Service agents protecting the perimeter around the President or other leader with the additional task of alerting members of the public who might breach the area that a Secret Service protectee is inside. Even an instruction from someone clearly identifiable as a Secret Service agent not to cross the perimeter would not suffice under Griffin’s reading of the statute to ensure a potential intruder “knows” a protectee is present.

Griffin minimizes the constraint his reading imposes by suggesting that officers could post “Secret Service ‘restricted building or grounds’ signage” around the areas they secure. 43 Griffin Br. 54-55. It is not clear, however, that a generic “Secret Service—Keep Out” sign could prove knowledge of the facts identified in subsection (c)(1)(B). The requirements of the statute as Griffin reads it would be unmet by proof that a defendant knowingly entered or remained without lawful authority in any building or grounds that he generally knew to have been placed under restriction by the Secret Service. His own logic is more demanding, calling for proof that the defendant knew the distinct facts supporting the restriction he violated: that the restricted area he entered was the White House or Vice President’s residence or their grounds (subsection (c)(1)(A)); or that a Secret Service protectee was or would be temporarily visiting the restricted area (subsection (c)(1)(B)); or that the area was restricted in conjunction with a “special event of national significance” (subsection (c)(1)(C)). His suggestion of a less cumbersome way to meet it tacitly acknowledges the implausibility of his highly detailed knowledge requirement. Griffin cannot have it both ways.

In any event, Griffin’s suggestion of generic Secret Service signage underscores the defect of his argument. To provide security for its protectees as they travel throughout the United States, the Secret Service often works with other federal law enforcement entities like the Capitol Police, and with state and local law enforcement agencies. Griffin’s interpretation would require the Secret Service to call on local partners to use specialized “Secret Service” notices, rather than the signage they routinely use, like the “Area Closed by Order of the United States Capitol Police Board” notices posted on January 6. Congress could not have intended that the security perimeters it authorized to protect the nation’s top political leadership would function only if the Secret Service provided signs specifying the particular reason for the Secret Service’s involvement and prevailed on its state and local partners to use them. 44 Griffin’s approach would surely hinder the Secret Service’s capacity to handle the full range of potential threats. Congress’s intent in enacting and amending the statute was to provide the Secret Service with consistent and effective federal-law tools so it would no longer have to rely on uneven protections of state law. But, by requiring proof that each intruder knew “the President or other person protected by the Secret Service is or will be temporarily visiting,” Griffin’s reading would make a section 1752(a)(1) violation significantly harder to prove than its state-law counterparts. That added proof burden might not hinder the Secret Service’s ability to detain and prosecute someone who breached a security perimeter with the avowed intent to confront a particular protectee. But, as the events of January 6 illustrate, Griffin’s reading would substantially undercut the Secret Service’s ability to fulfill its protective mission in volatile situations where potential intruders outnumber agents. More broadly, his reading would embolden people to breach Secret Service zones of protection with confidence that, so long as no agent tells them the reason the area is cordoned off (and they keep under wraps such knowledge they might have from other sources), section 1752(a)(1) will not reach them.

***

In sum, Congress’s clear purpose in enacting section 1752(a)(1) was to establish a uniform federal trespass misdemeanor to help the Secret Service protect national leadership from harm. We reject Griffin’s reading, which is so squarely at odds with that clear purpose. We have no basis to conclude that Congress intended to undermine its vital aim by requiring proof that an intruder knew, when he breached a federally restricted area, that a Secret Service protectee was or would be present. The statutory text does not compel that reading, facts that support Congress’s authority to legislate are 45 assumed to “stand outside the otherwise applicable mens rea requirement,” Torres, 578 U.S. at 468, and the conduct is independently culpable.

III.

To recap, we hold that the trial evidence sufficed to prove that the Capitol grounds were “posted, cordoned off, or otherwise restricted” under section 1752(c)(1), and that Griffin knew they were so restricted when he entered and remained there. We further hold that the government was not required to prove that Griffin knew when he entered and remained in the restricted area that Vice President Pence was still there.

For the foregoing reasons, the judgment of the district court is affirmed.

So ordered. KATSAS, Circuit Judge, dissenting: This appeal turns on the scope of an express knowledge requirement in a criminal statute that protects the President, the Vice President, and other high officials from trespassers. The statute prohibits knowingly entering a “restricted building or grounds,” 18 U.S.C. § 1752(a)(1), which is a defined term. First, the area must be “posted, cordoned off, or otherwise restricted.” Id. § 1752(c)(1). Second, as relevant here, it must be one where “the President or other person protected by the Secret Service is or will be temporarily visiting.” Id. § 1752(c)(1)(B). The question presented is whether a defendant, to be convicted under section 1752(a)(1), must know that the “restricted building or grounds” satisfies one or both elements of this statutory definition. My colleagues hold that a defendant must know that the area satisfies the first element of the definition but need not know that it satisfies the second. In my view, the defendant must know that the area satisfies both elements.

I

During the riot on January 6, 2021, Couy Griffin entered the grounds of the United States Capitol and made his way onto the inaugural stage. At that time, entry into the grounds was restricted because Congress was scheduled to count the votes of the presidential electors. When Griffin entered the restricted grounds, Vice President Michael Pence, a Secret Service protectee, was inside the Capitol to preside over the vote count.

Griffin was charged with knowingly entering a “restricted building or grounds,” in violation of section 1752(a)(1), and with knowingly engaging in disorderly conduct inside a “restricted building or grounds” with intent to disrupt government business, in violation of section 1752(a)(2). During a bench trial, the district court held that these offenses do not require proof that the defendant knew the “restricted building or grounds” satisfies the statutory definition of that term. The court found that Griffin had entered an area where 2 he “knew he shouldn’t be,” J.A. 537, but it made no finding whether Griffin knew that the Vice President was or would soon be present. The court further found that Griffin had neither engaged in any disorderly conduct nor intended to disrupt Congress. Based on these findings, the court convicted Griffin on the first count and acquitted him on the second. Griffin appealed the conviction.

II

Section 1752 of Title 18 creates five criminal offenses requiring acts inside a “restricted building or grounds.” 18 U.S.C. § 1752(a). The first offense covers anyone who “knowingly enters or remains in any restricted building or grounds without lawful authority to do so.” Id. § 1752(a)(1). Section 1752 expressly defines the term “restricted building or grounds.” As used in that provision:

[T]he term “restricted buildings or grounds” means any posted, cordoned off, or otherwise restricted area—

(A) of the White House or its grounds, or the Vice President’s official residence or its grounds;

(B) of a building or grounds where the President or other person protected by the Secret Service is or will be temporarily visiting; or

(C) of a building or grounds so restricted in conjunction with an event designated as a special event of national significance[.] 3 Id. § 1752(c)(1). 1

The parties dispute the extent of knowledge a defendant must have about the “restricted building or grounds” to be properly convicted under section 1752. They agree the defendant must know that the area satisfies the first element of the statutory definition—i.e., he must know that the area was “posted, cordoned off, or otherwise restricted.” 18 U.S.C. § 1752(c)(1); see Appellee Br. at 42–43. According to Griffin, the defendant also must know that the restricted area satisfies the second element of the definition. Here, in other words, Griffin had to know that the restricted area was one where the Vice President, who is protected by the Secret Service, was or would be “temporarily visiting.” 18 U.S.C. § 1752(c)(1)(B). 2

A

In my view, statutory text, history, and basic interpretive presumptions all point in the same direction: To be convicted

1 In section 1752, the substantive offenses involve misconduct in any “restricted building or grounds,” while the definition covers the term “restricted buildings or grounds,” with buildings in the plural. The slight difference appears to be a scrivener’s error, and no party suggests that it makes any difference here. 2 The question presented has often arisen in the prosecution of individuals who trespassed on Capitol grounds on January 6, 2021. According to the Department of Justice, prosecutors have obtained over 470 convictions under section 1752. In all of these cases, criminal liability may turn on whether the defendant had to know that Vice President Pence was present at the time of the trespass. The district judges in our circuit are deeply divided on that question; six have answered yes, while ten have answered no. See United States v. Vaglica, No. 23-cr-429, 2024 WL 4244279, at *2 (D.D.C. Sept. 4 of knowingly entering a “restricted building or grounds,” the defendant must know that the area in question satisfies the statutory definition of that term.

1

Start with text, grammar, and ordinary English usage. These considerations drive the interpretation of federal statutes—including criminal ones. See, e.g., Flores-Figueroa v. United States, 556 U.S. 646, 650–52 (2009); Jones v. United States, 529 U.S. 848, 855 (2000). And here, they strongly support Griffin.

a

“As a matter of ordinary English grammar, it seems natural to read” the word knowingly, if it introduces a criminal prohibition, “as applying to all the subsequently listed elements of the crime.” Flores-Figueroa, 556 U.S. at 650; see Rehaif v. United States, 588 U.S. 225, 230 (2019) (courts “ordinarily read a phrase in a criminal statute that introduces the elements of a crime with the word ‘knowingly’ as applying that word to each element” (quoting Flores-Figueroa, 556 U.S. at 652)); United States v. X-Citement Video, Inc., 513 U.S. 64, 79 (1994) (Stevens, J., concurring) (“the normal, commonsense reading of a subsection of a criminal statute introduced by the word ‘knowingly’ is to treat that adverb as modifying each of the elements of the offense identified in the remainder of the subsection”).

Examples prove this point. An obvious one involves knowingly followed by a series of verbs. A provision making

19, 2024) (collecting rulings); Hr’g Tr., United States v. Mauck, No. 23-cr-339 (Sept. 27, 2024). 5 it unlawful to “knowingly harass, bother, or intimidate” does not reach someone who unknowingly intimidates. See A. Scalia & B. Garner, Reading Law: The Interpretation of Legal Texts 147–48 (2012) (describing prepositive modifiers). Another example involves knowingly followed by a transitive verb, then a direct object, then a further limiting prepositional phrase. In that instance, the introductory adverb “tells the listener how the subject performed the entire action, including the object” as limited. Flores-Figueroa, 556 U.S. at 650; see also McFadden v. United States, 576 U.S. 186, 191 (2015) (“the word ‘knowingly’ applies not just to the statute’s verbs but also to the object of those verbs”); Flores-Figueroa, 556 U.S. at 657 (Scalia, J., concurring in part and concurring in the judgment) (once knowingly “is understood to modify the object of those verbs, there is no reason to believe it does not extend to the phrase which limits that object”). So, “if a bank official says, ‘Smith knowingly transferred the funds to his brother’s account,’ we would normally understand the bank official’s statement as telling us that Smith knew the account was his brother’s.” Flores-Figueroa, 556 U.S. at 650. For unless context dictates otherwise, it would make little sense to extend knowingly only to the verb (transferred), rather than carrying it through to the direct object (funds) and the limiting prepositional phrase (to the brother’s account). See id. at 650– 51. These principles vary and combine—often in obvious ways. Consider one other quotidian example: “He knowingly pulled over and parked in a no-parking zone.” An ordinary English speaker would understand that knowingly applies to both verbs (pulled over and parked) and to the particular circumstance in which those actions occurred (in a no parking zone). Nobody would think that the driver had knowingly 6 pulled over and parked, but may not have known whether he was doing so in a prohibited area.

The Supreme Court repeatedly has applied these principles in construing introductory knowledge requirements. For example, United States v. Liparota, 471 U.S. 419 (1985), involved a statute imposing criminal liability on anyone who “knowingly uses, transfers, acquires, alters, or possesses coupons or authorization cards in any manner not authorized by” the governing positive law. See id. at 420. The Court held that this provision reaches only individuals who know that their conduct is “not authorized” by law. See id. at 425–28. Flores- Figueroa construed a statute imposing criminal liability on anyone who “knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person.” See 556 U.S. at 647. The Court held that this provision reaches only individuals who know that their conduct involves a means of identifying “another person.” See id. Invoking “ordinary English,” the Court explained that it would make “little sense” to criminalize knowingly possessing “a something” unless the defendant also knows what that something is. See id. at 650.

The same principles support extending knowledge requirements into defined terms and across different statutory provisions. Rehaif involved a statute imposing criminal liability on anyone who “knowingly violates” certain separate offenses including 18 U.S.C. § 922(g), which prohibits any alien (1) “unlawfully in the United States” from (2) possessing any “firearm.” The Supreme Court held that the statute reaches only someone who knows he is violating all “material elements” of the predicate offense, and it found “no basis to interpret ‘knowingly’ as applying to the second § 922(g) element but not the first.” 588 U.S. at 230–31; see also United States v. Games-Perez, 667 F.3d 1136, 1143 (10th Cir. 2012) 7 (Gorsuch, J., concurring) (such an interpretation “defies linguistic sense—and not a little grammatical gravity”).

Likewise, McFadden addressed the knowledge requirement in the Controlled Substances Act. That statute makes it unlawful to “knowingly … manufacture, distribute, or dispense, or possess with intent to manufacture, distribute, or dispense, a controlled substance.” 21 U.S.C. § 841(a)(1). And it separately defines the term “controlled substance” as “a drug or other substance, or immediate precursor, included in schedule I, II, III, IV, or V” of the Act. Id. § 802(6). The Supreme Court explained that the substantive prohibition, by its “ordinary meaning,” reaches only individuals who know that the substance at issue is “listed on the federal drug schedules.” See 576 U.S. at 192. In other words, the introductory mens rea extends to the elements of the defined term, even when they appear in different statutory provisions.

Finally, United States v. Lucero, 989 F.3d 1088 (9th Cir. 2021), involved criminal liability under the Clean Water Act. One section of that Act imposes criminal liability for “knowingly” violating a second section, which prohibits the “discharge of any pollutant” without a permit. See id. at 1093. A third section defines “discharge of pollutants” as adding any “pollutant” to “navigable waters” from any “point source.” See id. Three other subsections of that section separately define each of those three terms. See id. at 1093–94. Faced with these terms strung together “like Russian nesting dolls,” id. at 1093, the Ninth Circuit held that the criminal provision requires knowledge of all “substantive elements” set forth in the definition and sub-definitions—thus excluding only a purely 8 “jurisdictional element” that the polluted water must also be “waters of the United States.” See id. at 1095–97.

b

These textual and grammatical principles are dispositive here. As noted above, the governing statute punishes anyone who “knowingly enters or remains in any restricted building or grounds.” 18 U.S.C. § 1752(a)(1). The introductory adverb knowingly applies not only to the two verbs but also to the phrase that immediately follows—“any restricted building or grounds,” which functions either as the direct object of “enters” or as part of a prepositional phrase modifying “remains.” In other words, a defendant must know not only that he is entering somewhere off-limits; he must know that he is entering a “restricted building or grounds” as statutorily defined. See, e.g., McFadden, 576 U.S. at 188–89; Flores-Figueroa, 556 U.S. at 650. And that requires both knowing that the relevant area is “posted, cordoned off, or otherwise restricted,” 18 U.S.C. § 1752(c)(1), and, for January 6 Capitol trespassers, also knowing that the Vice President was or would be “temporarily visiting” at the time of the trespass, id. § 1752(c)(1)(B).

My colleagues try to split the difference. They agree the defendant must know that the relevant area satisfies the first part of the statutory definition—i.e., that the area was “posted, cordoned off, or otherwise restricted” at the time of the trespass. Ante at 4. But there is no textual or contextual basis for projecting the knowledge requirement only halfway through the definition. As shown above, it is routine to project an introductory adverb like knowingly past the following verbs and direct object to prepositional phrases that limit one or the other. Faced with a request to do otherwise, the Court in Flores-Figueroa asked rhetorically: “But how are we to square 9 this reading with the statute’s language?” 556 U.S. at 651–52. Likewise, it is common to project knowingly from operative text into statutory definitions, as happened in Rehaif, McFadden, and Lucero.

My colleagues object that a mens rea need not travel through a “long statutory phrase,” especially one “set forth in independent clauses separated by interruptive punctuation.” Ante at 21–22 (citing X-Citement Video, 513 U.S. at 68). Perhaps not, but section 1752 presents none of those features. All agree that knowingly must extend beyond the operative verbs (“enters or remains”) to the immediately following qualifier (“restricted building or grounds”), which is a defined term. And all agree that knowingly must then extend a short distance from the prohibition in section 1752(a)(1) to at least the first half of the definition in section 1752(c)(1)—a leap much smaller than the one recognized in McFadden, from a prohibition in section 841 of Title 21 to a definition in section 802. See 576 U.S. at 192. And once extended into section 1752(c), why would knowingly stop halfway through the definition, immediately after the phrase “any posted, cordoned off, or otherwise restricted area—”? That phrase neither stands on its own nor adds much to the prohibition on entering or remaining in “any restricted building or grounds.” Moreover, the second half of the definition, which elaborates on where individuals must not trespass, does not feature independent clauses. Just the opposite: The three descriptions all begin with the preposition “of” and would be sentence fragments if severed from the first half of the definition. Finally, the em- dash separating the two elements of the definition does not serve as interruptive punctuation. In the abstract, an em-dash might mark an interruption, a connection, or simply a stylistic choice to replace a comma or a colon. See B. Garner, Garner’s Modern English Usage 899–900 (5th ed. 2022); Mitchell v. Chapman, 343 F.3d 811, 830 (6th Cir. 2003) (em-dash 10 “introduces related provisions”). Here, inserted after a largely redundant noun phrase and before several limiting prepositional phrases, the em-dash clearly serves to connect.

Moreover, the ensuing prepositional phrases impose significant limits. So, excluding them from the knowledge requirement substantially broadens the underlying prohibition. For example, it ensnares a hotel guest who walks past an “area closed for private event” sign in search of an open bar if, unbeknownst to the thirsty interloper, the First Lady is expected to attend. See 18 U.S.C. § 3056(a) (Secret Service protectees). Likewise, it ensnares an individual who stepped over temporary plastic fencing just outside the Capitol grounds on January 5, 2021, to save a few steps on a walk home from work, even if he was unaware of the impending arrival of the Vice President. And if that person did so while lawfully carrying a firearm, he would face imprisonment of up to ten years. See id. § 1752(b)(1)(A). Such improbable breadth suggests that something has gone awry. See, e.g., Fischer v. United States, 144 S. Ct. 2176, 2189 (2024); Bond v. United States, 572 U.S. 844, 860 (2014).

My colleagues further object with a reductio ad absurdum. If section 1752(a)(1) incorporates any element of the defined term “restricted building or grounds,” then why not incorporate every element “all the way down” the entire “definitional line”? Ante at 24. After all, the definition of “restricted building or grounds” contains three alternative elements after its internal em-dash. See 18 U.S.C. § 1752(c)(1). The alternative at issue here contains the term “other person protected by the Secret Service,” which is separately defined. Id. § 1752(c)(1)(B), (c)(2). And the separate definition incorporates yet another statute listing eligible protectees. See id. § 1752(c)(2) (citing 18 U.S.C. § 3056(a)). Plucking out elements from this “matryoshka doll of nested statutory references,” ante at 23, 11 one might ask questions such as: For areas meeting the definition of “restricted building or grounds” based on an “event designated as a special event of national significance,” id. § 1752(c)(1)(C), must the defendant know about the designation? Because the defined term “other person protected by the Secret Service” excludes certain individuals who have declined such protection, id. § 1752(c)(2), must the defendant know that the individual has not declined the protection? And for individuals whose protection depends on obscure details such as the age of children of a former President, see id. § 3056(a)(4), must the defendant know those details?

In my view, the reductio is unpersuasive. Of course, the extension of an introductory mens rea requirement is a question of degree. Adverbs do not necessarily modify everything that follows. So when knowingly “introduces a long statutory phrase,” questions “may reasonably arise about how far into the statute the modifier extends.” Rehaif, 588 U.S. at 230. Likewise for nested statutory references, reaching the first one does not necessarily require reaching all of them. But here, there is nothing extravagant about extending the knowledge requirement to the simple verb-object phrase that immediately follows (“enters or remains in any restricted building or grounds”) and then to the straightforward incorporated definition (requiring, as relevant here, an area “posted, cordoned off, or otherwise restricted” in connection with a current or impending visit by someone “protected by the Secret Service”). As shown above, the Supreme Court has routinely done at least that much, and the Ninth Circuit has done more.

Moreover, the reductio highlights elements for which knowledge may be difficult or impossible to prove—the existence of a presidential designation not announced in advance, an individual’s acceptance or declination of protection, and the age of individuals protected only while they 12 are children. For those elements, closer questions might arise. Perhaps the near-impossibility of proving knowledge of some element is a contextual clue suggesting that no mens rea requirement applies to it. See Scalia & Garner, supra, at 307. But those questions, involving definitional elements not at issue here, should not obscure what is at issue: knowledge about restrictions imposed in connection with a current or impending visit by the Vice President, who may not decline Secret Service protection and whose status as a protectee is not contingent on anything. See 18 U.S.C. § 3056(a)(1). The reach of the knowledge requirement is necessarily a line-drawing exercise—which my colleagues must recognize in extending the knowledge requirement from section 1752(a)(1) to the first half of the statutory definition in section 1752(c). Precisely for that reason, the reductio falls flat. The only question here is whether the knowledge requirement comes to a full stop at the em-dash halfway through the definition. As explained above, it does not—regardless of how much farther the knowledge requirement might or might not extend into nested statutory sections besides section 1752(c)(1)(B).

2

Statutory history reinforces these points. As originally enacted, section 1752 made it unlawful for any person “willfully and knowingly to enter or remain in” either of two areas, one of which was “any posted, cordoned off, or otherwise restricted area of a building or grounds where the President is or will be temporarily visiting.” Omnibus Crime Control Act of 1970, Pub. L. No. 91-644, § 18, 84 Stat. 1880, 1891–92 (1971). Under the grammatical principles and caselaw discussed above, the introductory mens rea requirements (“willfully and knowingly”) plainly extended to the relevant verbs (“enter or remain”), object (“area”), and immediately ensuing qualifier (“where the President is or will 13 be temporarily visiting”). And the argument for that extension would have avoided all of the textual complications invoked here by my colleagues: The relevant text was strung together without interruption, so there was no question about extending an introductory mens rea requirement from a substantive prohibition to an incorporated definition, compare ante at 23– 24, with Lucero, 989 F.3d at 1095–97, or, within that definition, about extending the mens rea to text after an intervening em- dash, compare United States v. Palomares, 52 F.4th 640, 643 (5th Cir. 2022) (opinion of Jolly, J.), with id. at 653–54 (Willett, J., dissenting) and Pulsifer v. United States, 601 U.S. 124, 171 n.4 (2024) (Gorsuch, J., dissenting).

Section 1752 has become broader and more complex over time, but none of the changes helps the government. Congress has extended the statute to Secret Service protectees other than the President, see Pub. L. No. 97-308, 96 Stat 1451, 1451 (1982), and to events designated as nationally significant, see Pub. L. No. 109-177, § 602, 120 Stat. 192, 252 (2006). But as explained above, those amendments (other than the extension of section 1752 to the Vice President) are neither directly at issue here nor helpful in understanding the provisions that are. Moreover, Congress did not move the key requirement at issue—that a Secret Service protectee “is or will be temporarily visiting” the restricted area—from operative text into a separate definition until 2012, when the statute assumed roughly its current form. See Pub. L. No. 112-98, § 2, 126 Stat. 263, 263– 64. In the 2012 amendments, use of a separate definition avoided the need to repeat the operative text in each of four separate paragraphs setting forth four separate offenses. See id. And use of an em-dash in the definition avoided the need to repeat the phrase “any posted, cordoned off, or otherwise restricted area” to describe each of the three categories of protected areas. See id. As my colleagues explain, these changes served merely to “streamline” a statute that had 14 become “increasingly cumbersome” as its coverage expanded. Ante at 41. Such “legislative housekeeping,” id., did not work a sea change by severing the mens rea from offense elements to which it had previously applied.

Two other changes warrant a brief mention. In 2006, Congress increased the maximum authorized penalty for violations of section 1752 from six months of imprisonment to one year, and it authorized ten years of imprisonment for violations while the defendant is carrying a “deadly or dangerous weapon or firearm.” Pub. L. No. 109-177, § 602, 120 Stat. at 252; see 18 U.S.C. § 1752(b). This change underscored the substantive difference between section 1752(a)(1) and simple trespass, thus weakening the government’s position even more. See United States v. Groseclose, 710 F. Supp. 3d 1, 9 (D.D.C. 2024). Finally, in 2012, Congress eliminated the separate mens rea requirement of acting willfully. See Pub. L. No. 112-98, § 2, 126 Stat. at 263. But that says nothing about the scope of the knowledge requirement, which has remained unchanged since 1971.

In sum, the knowledge requirement in the original version of section 1752 applied to the requirement of a current or impending visit by a protected individual, and none of the later amendments undercuts that conclusion.

3

If any doubt on this point remained, two interpretive principles would resolve it against the government—the presumption of mens rea and the rule of lenity.

The Supreme Court has long recognized a presumption that criminal statutes “include broadly applicable scienter requirements.” X-Citement Video, 513 U.S. at 70; see, e.g., Ruan v. United States, 597 U.S. 450, 457–59 (2022); Staples v. 15 United States, 511 U.S. 600, 605–06 (1994); United States v. U.S. Gypsum Co., 438 U.S. 422, 436 (1978). The presumption reflects a view that crime usually requires the “concurrence of an evil-meaning mind with an evil-doing hand,” which originated in English common law and “took deep and early root in American soil.” Morissette v. United States, 342 U.S. 246, 251–52 (1952). The presumption “is no provincial or transient notion”; rather, it “is as universal and persistent in mature systems of law as belief in freedom of the human will and a consequent ability and duty of the normal individual to choose between good and evil.” Id. at 250.

The presumption applies in two distinct contexts. First, courts will read mens rea requirements into criminal statutes that “are silent on the required mental state.” Elonis v. United States, 575 U.S. 723, 736 (2015); see, e.g., Staples, 511 U.S. at 605. In doing so, “we read into the statute only that mens rea which is necessary to separate wrongful conduct from otherwise innocent conduct.” Elonis, 575 U.S. at 736 (cleaned up); see United States v. Burwell, 690 F.3d 500, 505 (D.C. Cir. 2012) (en banc). Second, if text and grammar are not dispositive, courts will construe express mens rea requirements broadly as opposed to narrowly. When a statute is not silent as to the mens rea but instead includes a general scienter provision, “‘the presumption applies with equal or greater force’ to the scope of that provision.” Ruan, 597 U.S. at 458 (quoting Rehaif, 588 U.S. at 229). Moreover, the Supreme Court has “rejected the government’s argument that the absence of innocence should circumscribe the reach of an explicit mens rea requirement.” Burwell, 690 F.3d at 516 (citing Flores-Figueroa, 556 U.S. at 650–52). So while express mens rea terms “often” separate wrongful and innocent 16 conduct, Ruan, 597 U.S. at 458, they can also separate greater and lesser evils.

Needless to say, a trespass that threatens the life or safety of the President or the Vice President is substantially more culpable than a simple trespass consisting of nothing more than knowingly entering an area “posted, cordoned off, or otherwise restricted,” 18 U.S.C. § 1752(c)(1). The latter is a local misdemeanor offense, D.C. Code § 22-3302, which, if it were to occur in the states, Congress would not and could not regulate at all, see, e.g., United States v. Morrison, 529 U.S. 598 (2000); United States v. Lopez, 514 U.S. 549 (1995). The former is an urgent matter, which my colleagues aptly describe as implicating “the national security of the United States.” Ante at 26. And so too are trespasses that threaten the lives of other Secret Service protectees, who are leading national officials, their immediate families, and their foreign counterparts. See 18 U.S.C. § 3056(a).

Finally, consider the rule of lenity. In cases addressing the scope of mens rea requirements in criminal statutes, the presumption and the rule of lenity work as companion principles, both supporting narrow constructions over broad ones. See, e.g., U.S. Gypsum Co., 438 U.S. at 437; Liparota, 471 U.S. at 427–28. On the cutting edge, jurists may disagree about which doctrine should predominate. Compare Wooden v. United States, 595 U.S. 360, 378–79 (2022) (Kavanaugh, J., concurring) (stressing presumption of mens rea), with id. at 388–92 (Gorsuch, J., concurring in the judgment) (stressing lenity). But where the defendant’s proposed construction is as 17 textually plausible as it is here, one or both doctrines should remove any lingering doubt.

B

My colleagues reason that the definition of “restricted building or grounds” is merely jurisdictional and that a broad reading of section 1752(a) would best advance its underlying purpose. Neither argument seems to me persuasive.

1

Start with the proper treatment of assertedly jurisdictional elements of federal criminal statutes.

a

The Supreme Court has distinguished between substantive and jurisdictional elements. Substantive elements “describe the evil Congress seeks to prevent.” Torres v. Lynch, 578 U.S. 452, 467 (2016). On the other hand, jurisdictional elements connect the statute “to one of Congress’s enumerated powers,” such as its powers to regulate interstate commerce and federal property. Id. Because jurisdictional elements “have nothing to do with the wrongfulness of the defendant’s conduct,” they “are not subject to the presumption in favor of scienter.” Rehaif, 588 U.S. at 230. To the contrary, “when Congress has said nothing about the mental state pertaining to a jurisdictional element, the default rule flips: Courts assume that Congress wanted such an element to stand outside the otherwise applicable mens rea requirement.” Torres, 578 U.S. at 468.

Statutory elements sometimes serve both jurisdictional and substantive ends, for “an element that makes evident Congress’s regulatory power also might play a role in defining the behavior Congress thought harmful.” Torres, 578 U.S. at 18 470–71. In considering such an element, the right question is “whether it is jurisdictional only,” not whether it is jurisdictional in part. United States v. Feola, 420 U.S. 671, 676 n.9 (1975); see also United States v. Evans, 74 F.4th 597, 605– 06 (4th Cir. 2023) (“a jurisdictional element only”). In other words, so long as a statutory element has something to do “with the wrongfulness of the defendant’s conduct,” Rehaif, 588 U.S. at 230, courts should not abandon the presumption of mens rea let alone impose the opposite presumption. Of course, “tough questions may lurk on the margins” if it is unclear whether a jurisdictional element “also” serves substantive ends. Torres, 578 U.S. at 470–71. But this is not such a case.

The statutory definition of “restricted building or grounds” is not “jurisdictional only.” The first element of the definition—that the area in question must be “posted, cordoned off, or otherwise restricted”—is entirely substantive; it defines the area into which entry is prohibited, and it does not make evident the constitutional basis for federal legislation. The second element of the governing definition—that a Secret Service protectee “is or will be visiting”—serves both jurisdictional and substantive ends. It is partly jurisdictional, because Congress could not enact a national prohibition on simple trespass. And it is partly substantive, because it reflects an obvious judgment that trespasses endangering the life or safety of the President, the Vice President, or other Secret Service protectees are substantially more culpable than is trespassing simpliciter. Given that obviously substantive purpose, there is no basis for excepting this provision from the statutory mens rea requirement.

b

My colleagues rest their contrary conclusion mainly on Feola, which involved a statute prohibiting assaults on federal 19 officers performing official duties. See 420 U.S. at 673. The Court held that this statute, which includes no express mens rea element, does not require knowledge of the victim’s status as a federal officer. In concluding that the identity of the victim was “jurisdictional only,” id. at 676 n.9, the Court relied heavily on a letter from the Attorney General to the Chairman of the Senate Judiciary Committee, id. at 680–84. Based on that letter, the Court concluded that Congress’s primary objective was to create a “federal forum” for prosecuting assaults on federal officers, id. at 682, in order to avoid any risk that state officials might not prosecute such crimes with sufficient “urgency,” id. at 684. The Court specifically concluded that Congress had neither intended to “fill a gap in existing substantive state law” nor to create a substantive “federal aggravated assault statute.” Id. at 683. And if Congress had so intended, the Court strongly suggested, the statute would presumptively “require[] knowledge of the victim’s office.” Id. Finally, in extending its holding to conspiracies predicated on the assault statute, the Court reiterated its view that the “identity of the proposed victim” was “no more germane to the nature” of the assault “than the color of the victim’s hair.” Id. at 692–93.

Feola does not support my colleagues’ position. For one thing, it involved the question whether to impose a court-made mens rea requirement, not any question about the scope of a statutory one. For another, section 1752(c) reflects concerns that are obviously substantive as well as jurisdictional. As my colleagues explain, the statute targets only a “small subset of trespassing offenses that implicate both the personal security of the most high-profile federal officials and their foreign counterparts.” Ante at 26. And section 1752 was enacted in the wake of the assassinations of President John Kennedy in 1963 and presidential candidate Robert Kennedy in 1968. Although a letter from the Attorney General pushed the Court 20 towards concluding that the statute in Feola was “jurisdictional only,” a Senate Report accompanying section 1752 cuts strongly in the other direction here. Not surprisingly, it confirmed the urgent substantive imperative to afford special protection to one singularly important official: Congress sought to “protect the physical safety of the President of the United States and the orderly functioning of his Office,” given that “[t]wice in th[e] decade, and nine times in our history, the Office of the President ha[d] been the subject of an assassination attempt.” S. Rep. No. 91-1252, at 3 (1970); see also id. at 5 (“[t]he risk of assassination falls most heavily on the highest office in our land”); id. at 6 (“we must be sure that the President is fully protected at all times against the isolated deranged individual”).

My colleagues do not dispute that section 1752(c) serves substantive as well as jurisdictional ends. Instead, they read a footnote in Feola as establishing that “dual-role elements” presumptively lack any mens-rea requirement. Ante at 28–30; see 420 U.S. at 676 n.9. In all candor, the footnote is hardly a model of clarity. But its principal thrust is that a jurisdictional element, “precisely because it implicates factors that are an appropriate subject for federal concern,” can have substantive significance as well, see id., in contrast to purely jurisdictional elements such as a reference to interstate commerce, see Torres, 578 U.S. at 468; Rehaif, 588 U.S. at 230. And that is why the relevant question, as articulated in the footnote and applied in the rest of the opinion, “is not whether the requirement is jurisdictional” in part, but instead “whether it is jurisdictional only.” Feola, 420 U.S. at 676 n.9. My colleagues further reason that Feola must cover partly substantive elements because assaulting a federal officer “is generally a more serious crime than assaulting a private citizen.” Ante at 35. But the Court reasoned that Congress’s concerns were merely forum-based, see 420 U.S. at 682–84, 21 with “the identity” of federal officers as substantively “irrelevant” as the color of their hair, see id. at 693. Finally, my colleagues invoke Feola’s statement that dispensing with the mens rea posed “no risk of unfairness” because assaults are wrongful regardless. Ante at 32; see 420 U.S. at 685. But as explained above, the Supreme Court has since rejected the contention “that the absence of innocence should circumscribe the reach of an explicit mens rea requirement.” See Burwell, 690 F.3d at 516 (citing Flores-Figueroa, 556 U.S. at 650–52).

My colleagues invoke other precedents besides Feola, but none helps their case. United States v. Yermian, 468 U.S. 63 (1984), turned on the “clear” textual separation between a jurisdictional element and a statutory mens rea requirement, which appeared after and “in a phrase separate from” the jurisdictional element. See id. at 68–69. United States v. Morgan, 45 F.4th 192 (D.C. Cir. 2022), turned on a special presumption against knowledge requirements regarding the age of victims in “sex crimes involving minors,” which does not involve jurisdictional elements at all. Id. at 206. Burwell involved the mens rea requirement for a firearms offense requiring the weapon at issue to be capable of firing automatically, 690 F.3d at 502, which was also not a jurisdictional element. And the out-of-circuit precedents involved provisions held to be “jurisdictional element[s] only,” Evans, 74 F.4th at 606—i.e., elements with no substantive significance for the offense at issue. See id. (arson on federal lands, assessed relative to background state arson law); United States v. Hicks, 15 F.4th 814, 817–18 (7th Cir. 2021) (stealing federal property, assessed relative to background state theft statutes); United States v. Escalera, 957 F.3d 122, 132–33 (2d Cir. 2020) (witness-protection statute for federal proceedings, assessed relative to background state witness-protection statutes). These decisions do not control a statute that, as 22 enacted, afforded singular and special protection to the President.

One final point. Long after Feola, the Supreme Court flagged that jurisdictional elements which “also” serve substantive ends may pose “tough questions.” Torres, 578 U.S. at 470–71. If that is a fair characterization of the interpretive issues surrounding dual-purpose elements, then the rule of lenity would resolve this case in Griffin’s favor.

2

Finally, my colleagues seek to avoid any interpretation of section 1752 that would “pointlessly hinder the Secret Service’s ability to defend national leaders.” Ante at 41. Repeatedly, they stress the utmost seriousness of protecting the President and other high officials from would-be trespassers. Id. at 39–44. This line of argument underscores the substantive nature of the requirement that the defendant trespass in an area where a Secret Service protectee is or will be present.

The argument also falters on its own terms. Trespassers unaware that someone like the President or Vice President is present are much less likely to pose a threat to those officials than are individuals who knowingly trespass into an area restricted to protect them. My colleagues suggest that the January 6 riot reveals a significant practical problem with Griffin’s position, given the difficulty of proving that any particular trespasser knows a protectee is present. Ante at 43– 44. That concern strikes me as overstated, particularly given the number of Capitol trespassers boasting about their desire to influence (whether peacefully or otherwise) the Vice President’s performance of his official duties. Moreover, the seriousness of an offense is reason to insist on, not depart from, a mens rea requirement. See, e.g., Staples, 511 U.S. at 616–19. And “concerns about practical enforceability are insufficient to 23 outweigh the clarity of the text.” Flores-Figueroa, 556 U.S. at 656. We should not jettison these principles here.

III

Given its erroneous legal ruling, the district court did not make a finding whether Griffin knew that the Vice President was still present at the Capitol when Griffin trespassed. Some evidence suggests Griffin did not know, such as his later, mistaken statement that the Vice President had already certified the election before Griffin arrived at the Capitol. Because an essential element of the section 1752(a)(1) charge thus remains unresolved, I would vacate Griffin’s conviction and remand for further findings or proceedings.

IV

On the question of mens rea, section 1752 required the government to prove more than just Griffin’s knowledge that the Capitol grounds were posted, cordoned off, or otherwise restricted. The government also had to prove that Griffin knew, when he entered or remained in those restricted grounds, that the Vice President was still present. Because my colleagues conclude otherwise, I respectfully dissent. 3

3 I agree with my colleagues that the Capitol grounds remained “posted, cordoned off, or otherwise restricted” even after rioters tore down barriers and that there was sufficient evidence supporting the district court’s finding that Griffin knew the grounds satisfied this element of the definition when he trespassed.