                FOR PUBLICATION

  UNITED STATES COURT OF APPEALS
       FOR THE NINTH CIRCUIT


UNITED STATES OF AMERICA ,                No. 10-10224
                Plaintiff-Appellee,
                                             D.C. No.
                 v.                       2:08-cr-00538-
                                              FCD-1
MARC MCMAIN KEYSER,
           Defendant-Appellant.             OPINION


      Appeal from the United States District Court
         for the Eastern District of California
   Frank C. Damrell, Senior District Judge, Presiding

                Argued and Submitted
       May 17, 2012—San Francisco, California

                Filed December 6, 2012

     Before: Stephen Reinhardt, Richard R. Clifton,
         and N. Randy Smith, Circuit Judges.

               Opinion by Judge Clifton
2                  UNITED STATES V . KEYSER

                           SUMMARY*


                           Criminal Law

    The panel affirmed convictions for mailing threatening
communications under 18 U.S.C. § 876(c) and for
communicating hoaxes regarding the presence of a biological
weapon under 18 U.S.C. § 1038(a), but vacated the sentence
and remanded for resentencing in a case in which the
defendant mailed to a congressman, a Starbucks, and a
McDonald’s sugar packets labeled “Anthrax.”

    The panel held that the mailings to Starbucks and
McDonald’s constituted true threats unprotected by the First
Amendment’s protection, and that the defendant’s hoax
speech was not protected under the First Amendment because
false and misleading information indicating an act of
terrorism tends to incite a tangible negative response by law
enforcement, emergency workers, and citizens.

    The panel rejected the defendant’s argument that because
his statements were addressed to a generic “manager,” not to
specific natural persons, he cannot be convicted under
§ 876(c).

    The panel held that the district court did not err in
refusing the defendant’s proposed instruction on his theory of
the case (i.e., that he did not intend for people to believe that
he was actually sending out anthrax) or in defining


  *
    This summary constitutes no part of the opinion of the court. It has
been prepared by court staff for the convenience of the reader.
                UNITED STATES V . KEYSER                    3

“reasonable person.” The panel wrote that the instructions’
use of “under circumstances” was adequate to inform the jury
that it was to evaluate the defendant’s statements in context.

    The panel rejected the defendant’s contention that the
prosecutor engaged in impermissible vouching. The panel
did not decide whether a statement by the prosecutor misled
the jury as to how to interpret “reasonable person” because
the defendant did not show it is more probable than not that
the verdict would have been materially different if the
prosecutor had not made the statement.

    The panel held that in applying to each of the Starbucks
and McDonald’s counts an enhancement under U.S.S.G.
§ 2A6.1(b)(4) for substantial governmental expenditures, the
district court abused it discretion when it considered as
relevant conduct mailings for which the defendant was not
convicted, which would not be grouped with the Starbucks
and McDonald’s mailings under U.S.S.G. § 3D1.2 had they
resulted in convictions.


                        COUNSEL

John Balazs, Sacramento, California, for Appellant.

Jean M. Hobler, Assistant United States Attorney,
Sacramento, California, for Appellee.
4                UNITED STATES V . KEYSER

                         OPINION

CLIFTON, Circuit Judge:

    In an effort to drum up publicity for a self-published book
on the dangers of anthrax, Marc Keyser feigned multiple acts
of biological terrorism. After mailing hundreds of packets of
powder labeled “Anthrax”—which were actually full of
sugar—Keyser was convicted on two counts of mailing
threatening communications under 18 U.S.C. § 876(c)
(“threat” counts) and three counts of communicating false or
misleading information regarding the presence of a biological
weapon under 18 U.S.C. § 1038(a) (“hoax” counts). He was
sentenced to 51 months in prison. He now appeals his
conviction and sentence.

    Keyser contends that all of his convictions should be
overturned because his communications were protected
expression under the First Amendment. We disagree,
concluding that his statements fall into categories of speech
that do not enjoy constitutional protection. He also argues
that he cannot be convicted under the threat statute, because
his statements were addressed to a generic “manager,” not to
specific natural persons. The title of “manager,” however,
sufficiently indicates that the mailings were addressed to
natural persons, which is all the statute requires. See United
States v. Havelock, 664 F.3d 1284, 1293 (9th Cir. 2012) (en
banc). In addition, Keyser raises multiple challenges to the
jury instructions and alleges prosecutorial misconduct during
closing arguments, but these claims are unpersuasive. We
affirm his convictions.
                UNITED STATES V . KEYSER                   5

    We do, however, agree with Keyser that the district court
improperly calculated his sentencing range under the advisory
Sentencing Guidelines when it applied an enhancement for
substantial governmental expenditures on the basis of conduct
that included mailings for which he was not convicted. The
Guidelines describe the appropriate realm of relevant
conduct, and the district court’s consideration of conduct
beyond that scope when it decided to apply the four-level
enhancement was procedural error. We therefore vacate the
sentence and remand for resentencing.

I. Background

    In the aftermath of the September 11th terrorist attacks,
Marc Keyser began researching terrorism, including the use
of anthrax. He wrote a book on anthrax, ultimately entitled
“Anthrax: Shock and Awe Terror,” to spread the message that
an anthrax attack could wreak havoc on the country. After
unsuccessfully attempting to obtain a publisher, Keyser self-
published his book on CDs and tried to market it.

    In an attempt to secure publicity for the book, Keyser
mailed a package to the Sacramento News & Review in 2007.
The package contained a letter, a CD containing Keyser’s
book, and a small spray can with a label stating
“ANTHRAX” and displaying a biohazard symbol. The
package prompted employees to call 911 and to evacuate the
building, and numerous emergency agencies responded.

    FBI agents subsequently visited Keyser at his home,
informed him that his mailing had upset people and led to a
hazardous materials unit response, and warned him that he
could be criminally prosecuted. An agent advised him not to
do it again, and Keyser said that he would not.
6               UNITED STATES V . KEYSER

    A. 2008 Mailings

    The next year, Keyser sent out approximately 120
packages to various news outlets, elected officials, and
businesses. The materials sent to news outlets and elected
officials were placed in business envelopes. They contained
a CD printed with a picture of Colin Powell, the book title,
and Keyser’s name. The CD contained over half of the
contents of Keyser’s book. He attached a white sugar packet
to the front of the CD with the sugar markings covered by a
label stating “Anthrax” in large letters, “Sample” in smaller
letters, and an orange and black biohazard symbol.

    The materials sent to businesses were placed in purple
greeting card envelopes. They contained a card with the
same Colin Powell picture and “Anthrax” sugar packet on the
front and a short blurb about the book inside. The card
directed recipients to visit a website to learn more about the
book.

    Recipients of the packages responded in various ways, but
only three specific mailings are relevant for this appeal: one
to Congressman George Radinovich, one to a Starbucks, and
one to a McDonald’s.

       1. Radinovich Mailing

    Keyser sent a business envelope with a CD and an
“Anthrax”/“Sample”-labeled sugar packet to Congressman
Radinovich’s Modesto, California, office. The envelope was
opened by staff members who were aware of previous
anthrax threats to members of Congress and who had been
briefed regarding suspicious packages. Upon seeing the
“Anthrax” sugar packet and the words “Anthrax: Shock and
                 UNITED STATES V . KEYSER                      7

Awe” on the CD, they called the police. Per a detective’s
instructions, they left the envelope in a conference room and
vacated the office. Police, fire trucks, ambulances, and a
hazardous materials truck all responded to the scene. One
staffer testified that when she saw the package, she felt
“[i]nstant concern” because “[t]hose types of things scare
you,” and that her colleague who had opened the package was
“scared to death” and “petrified.”

        2. McDonald’s Mailing

     Keyser sent a purple envelope to a Sacramento
McDonald’s restaurant, addressed to “McDonald’s” on the
first line and “Manager” on the second line. The restaurant’s
general manager opened the envelope to find one of Keyser’s
cards. He considered the contents to be “a very frightening
letter.” He was “scared, but . . . at a loss [and] dropped it and
stepped back. Emotionally [he] was kind of shocked and
appalled . . . and called 911.” Following the 911 operator’s
instructions to quarantine the area, he left his office and
barricaded the door. Police and a hazardous materials team
responded.

        3. Starbucks Mailing

     Keyser also sent a purple envelope addressed to
“Starbucks” on the top line and “Manager” on the second line
to a Sacramento Starbucks. The envelope was postmarked on
October 28, 2008, but was not opened until the store manager
returned from vacation. The store manager identified the
packet as sugar and was not concerned about her safety, but
8                UNITED STATES V . KEYSER

reported the card after discussing it with a customer in the
shop who was a security guard for then-Governor
Schwarzenegger. A hazardous materials responder and an
FBI agent came to the store to pick up the package.

    Federal agents returned to Keyser’s home. Keyser
admitted the mailings and explained that he was trying to sell
his book. He recalled his previous meeting with FBI agents
and his agreement not to send out such mailings again but
distinguished the 2008 mailings from his 2007 mailing by
pointing out that the latest mailings included the word
“Sample” under “Anthrax.”

    B. Procedural Background

     Keyser was indicted on ten counts of hoax in violation of
18 U.S.C. § 1038(a) and three counts of mailing threatening
communications in violation of 18 U.S.C. § 876(c). After a
trial, a jury convicted Keyser on three counts of hoax under
§ 1038(a) for the mailings to Congressman Radinovich,
McDonald’s, and Starbucks, and two counts of threatening
mailings under § 876(c) for the mailings to McDonald’s and
Starbucks. The jury acquitted him on all other counts.

    Prior to Keyser’s sentencing, the district court calculated
the advisory Sentencing Guidelines range. The § 1038(a) and
§ 876(c) counts resulting from the McDonald’s mailing were
grouped together because they involved the same victim, and,
similarly, the Starbucks counts were grouped together. The
probation officer assigned a base offense level of 12 for each
of the three counts or group of counts.
                 UNITED STATES V . KEYSER                     9

    The district court adopted the findings of the probation
officer in the Presentence Report and increased the offense
level by four for each of the three mailings in accordance
with U.S.S.G. § 2A6.1(b)(4), which provides for a four-level
increase when an offense resulted in a substantial expenditure
of funds or disruption in service available for a real
emergency. The Congressman Radinovich offense was
increased by six levels because it involved a government
official. The resulting adjusted offense levels were as
follows: Congressman Radinovich hoax, 22; McDonald’s
threat and hoax, 16; Starbucks threat and hoax, 16. Because
the McDonald’s and Starbucks groups were within 8 levels of
the Congressman Radinovich offense, Keyser’s Combined
Offense Level was calculated by taking his highest offense
level (22) and adjusting it upward by two units in accordance
with the procedure for multiple counts outlined in U.S.S.G.
§ 3D1.4. Keyser had a final Combined Adjusted Offense
Level of 24 and a Criminal History Category of I, which
resulted in a Guidelines range of 51–63 months. The district
court sentenced him to 51 months in prison and ordered him
to pay $6,677.70 in restitution. Keyser filed a timely notice of
appeal.

II. Discussion

   A. First Amendment Challenge

    Keyser argues that he cannot be convicted for his mailed
statements because they are protected by the First
Amendment. “[A]s a general matter, the First Amendment
means that government has no power to restrict expression
because of its message, its ideas, its subject matter, or its
content.” Ashcroft v. Am. Civil Liberties Union, 535 U.S. 564,
573 (2002) (internal quotation marks omitted). The Supreme
10              UNITED STATES V . KEYSER

Court has repeatedly recognized, however, that certain
categories of speech do not enjoy the benefit of full First
Amendment protection. See United States v. Alvarez, 132 S.
Ct. 2537, 2544 (2012) (plurality opinion); United States v.
Stevens, 130 S. Ct. 1577, 1584 (2010). Famously, the First
Amendment does not protect someone who falsely cries
“fire” in a crowded theater. See Schenck v. United States,
249 U.S. 47, 52 (1919).

    Keyser was convicted of mailing threatening
communications under 18 U.S.C. § 876(c) for his Starbucks
and McDonald’s mailings and for communicating hoaxes
regarding a biological weapon under 18 U.S.C. § 1038(a) for
his Starbucks, McDonald’s, and Congressman Radinovich
mailings. We first look at whether Keyser’s convictions
under the threat statute violate the First Amendment, then
turn to his convictions under the hoax statute.

       1. Threats: 18 U.S.C. § 876(c)

    Federal law makes it a crime to “knowingly . . . deposit[]
or cause[] to be delivered . . . any communication with or
without a name or designating mark subscribed thereto,
addressed to any other person and containing any threat to
kidnap any person or any threat to injure the person of the
addressee or of another.” 18 U.S.C. § 876(c). This statute
“must be interpreted with the commands of the First
Amendment clearly in mind.” Watts v. United States,
394 U.S. 705, 707 (1969) (per curiam).

    Threats generally are not entitled to First Amendment
protection. See id. (“What is a threat must be distinguished
from what is constitutionally protected speech.”); Lovell v.
Poway Unified Sch. Dist., 90 F.3d 367, 371 (9th Cir. 1996)
                     UNITED STATES V . KEYSER                               11

(“In general, threats are not protected by the First
Amendment.”). “Whether a particular statement may
properly be considered to be a threat is governed by an
objective standard—whether a reasonable person would
foresee that the statement would be interpreted by those to
whom the maker communicates the statement as a serious
expression of intent to harm or assault.” United States v.
Orozco-Santillan, 903 F.2d 1262, 1265 (9th Cir. 1990),
overruled in part on other grounds by Planned Parenthood of
the Columbia/Willamette, Inc. v. American Coalition of Life
Activists, 290 F.3d 1058, 1066–70 (9th Cir. 2002) (en banc).
In order to be subject to criminal liability for a threat, the
speaker must subjectively intend to threaten. See United
States v. Bagdasarian, 652 F.3d 1113, 1117–18 (9th Cir.
2011). It is not necessary that the speaker intend to follow
through on the threat, commit an assault, or inflict actual
physical harm, however. See Planned Parenthood, 290 F.3d
at 1075.

    On independent review, in accordance with the approach
outlined in Planned Parenthood, 290 F.3d at 1070,1 we
conclude that Keyser’s mailings to Starbucks and
McDonald’s constituted true threats and fall outside of the
First Amendment’s protection.


  1
    Planned Parenthood directs us first to determine whether the district
court correctly defined a threat and properly instructed the jury regarding
the statute’s requirements for liability. If so, we defer to the jury’s
findings on historical facts, credibility determinations, and elements of
statutory liability. If statutory liability is supported by sufficient evidence,
we then engage in an independent review of any constitutional
facts— here, whether the statements were true threats. 290 F.3d at 1070.
The district court’s instructions were proper and the record contains
sufficient evidence to support the jury’s conviction on those instructions,
so we focus on the independent review of the constitutional fact.
12              UNITED STATES V . KEYSER

     The mailings satisfy the objective standard by which we
define a threat. See Orozco-Santillan, 903 F.2d at 1265. A
reasonable sender would foresee that recipients would
understand the mailings to be threats to injure them. Given
the broad media coverage of actual anthrax being sent
through the mail in 2001, a reasonable person would
understand that a recipient would perceive a packet of powder
with the word “Anthrax” and a biohazard symbol printed on
it as a threat. A reasonable person would also understand that
the word “sample” would not alleviate that concern—if read
and processed at all, the word would likely indicate a small
amount of the actual substance, rather than a prop or
representation.

    We also conclude, after reviewing the record as a whole,
that Keyser had the requisite subjective intent to threaten
when he mailed the packages to McDonald’s and Starbucks.
At trial, Keyser testified that he was not trying to scare the
people who received his packages and letters, and that he did
not want people to believe the packets actually contained
anthrax. However, he did agree at trial that he knew that
some people “might at least briefly be concerned that maybe
this is real anthrax.” He also stated that he intended the
packets to be “provocative” and wanted people to have “a
reaction” and be “concerned about the danger we’re in.” He
testified that he was not trying to cause a panic, but agreed
that attracting attention to the book “was definitely worth it
even if people were frightened.”

    One of the agents who interviewed Keyser after his arrest
testified that Keyser said, “Well, I did want it to cause
concern. I wanted to cause a buzz.” Keyser also told him that
“[h]e wanted people to believe they had received a sample of
Anthrax; that they wanted him [sic] to have the visceral
                 UNITED STATES V . KEYSER                   13

reaction to seeing it so it would drive his message home.”
The same agent reported that Keyser expressed that he
expected the FBI to contact him after he sent out his 2008
mailings.

    The record also establishes that Keyser was aware that the
2001 anthrax attacks had caused deaths, and that the press
and members of Congress had been targeted in those attacks.
Keyser sent mailings to persons within those same groups.
He was also aware that his 2007 mailing upset recipients and
led to a hazardous materials team response.

    Finally, we note that the jury appears not to have believed
Keyser’s self-interested testimony regarding his alleged lack
of intent. The jury convicted Keyser on the basis of
instructions that required a finding of subjective intent.
Though we do not defer to the jury’s finding of intent,
because, in this case, intent is not an element of statutory
liability, cf. Bagdasarian, 652 F.3d at 1118, we do defer to
the jury on credibility determinations, see Planned
Parenthood, 290 F.3d at 1070.

    Taken as a whole, this record convinces us that Keyser
possessed the intent to threaten. We therefore conclude, on
independent review, that Keyser’s statements mailed to
McDonald’s and Starbucks were true threats unprotected by
the First Amendment, and that his convictions under § 876(c)
did not violate the Constitution.

       2. False or misleading information: 18 U.S.C.
          § 1038(a)

   Federal law also makes it a crime to “engage[] in any
conduct with intent to convey false or misleading information
14                  UNITED STATES V . KEYSER

under circumstances where such information may reasonably
be believed and where such information indicates that an
activity has taken, is taking, or will take place that would
constitute a violation of” a number of listed statutes,
including Title 18, Chapter 10 of the United States Code,
which prohibits the possession or transfer of biological agents
or toxins for use as a weapon. 18 U.S.C. §§ 175(a), 1038(a).

    As with the threat speech, we engage in an independent
review. Having done so, we conclude that Keyser’s hoax
speech is not protected under the First Amendment.2

    The Supreme Court recently confirmed that “falsity alone
may not suffice to bring the speech outside the First
Amendment.” Alvarez, 132 S. Ct. at 2545 (plurality opinion).
Instead, cases that condone the criminalization of false speech
involve some sort of “legally cognizable harm associated with
[the] false statement.” Id. Indeed, the Court recognized that
“speech presenting some grave and imminent threat the
government has the power to prevent” was outside the First
Amendment’s protection. Id. at 2544. We conclude that such
harm was present here.

    False and misleading information indicating an act of
terrorism is not a simple lie. Instead, it tends to incite a
tangible negative response. Here, law enforcement and
emergency workers responded to the mailings as potential
acts of terror, arriving with hazardous materials units,


 2
   W e are satisfied that the record contains sufficient evidence such that
a jury could find all the elements of the crime satisfied. See Planned
Parenthood, 290 F.3d at 1070 (explaining that the court inquires into
sufficiency of the evidence before reaching independent review of a
constitutional fact).
                    UNITED STATES V . KEYSER                         15

evacuating buildings, sending the samples off to a laboratory
for tests, and devoting resources to investigating the source of
the mailings. Recipients testified to being “scared to death,”
“petrified,” “shocked and appalled,” “worried,” and feeling
“instant concern.” The staffers in Congressman Radinovich’s
office and the McDonald’s manager were deeply concerned
for their safety and the safety of those around them until they
were informed, hours later, that they were not exposed to
anthrax. Prompting law enforcement officials to devote
unnecessary resources and causing citizens to fear they are
victims of a potentially fatal terrorist attack is “the sort of
harm . . . Congress has a legitimate right to prevent by means
of restricting speech.” United States v. Alvarez, 617 F.3d
1198, 1215 (9th Cir. 2010).

    Justice Breyer’s concurring opinion in Alvarez confirms
our conclusion that Keyser’s hoax speech falls outside the
First Amendment’s protection. “Statutes prohibiting false
claims of terrorist attacks, or other lies about the commission
of crimes or catastrophes, require proof that substantial public
harm be directly foreseeable, or, if not, involve false
statements that are very likely to bring about that harm.”
Alvarez, 132 S. Ct. at 2554 (Breyer, J., concurring)
(specifically citing 18 U.S.C. § 1038(a) as an example).3


 3
   Our treatment of Keyser’s speech is consistent with the only case we
are aware to have addressed this issue directly, United States v. Brahm,
520 F. Supp. 2d 619 (D.N.J. 2007). The Brahm court analogized to the
Supreme Court’s decision in Schenck, 249 U.S. 47, and explained:

         Section 1038 was designed to prevent and punish
         phony bomb threats and other such hoaxes where no
         real threat existed, but law enforcement time and effort
         would be needlessly (and intentionally) sidetracked into
         looking for nonexistent weapons and fictitious
16                 UNITED STATES V . KEYSER

     B. Addressees

    Keyser contends that his convictions under 18 U.S.C.
§ 876(c) cannot stand because his mailings to Starbucks and
McDonald’s were not addressed to specific persons, as he
argues is required by the statute. The relevant statutory
language criminalizes the mailing of a threat “addressed to
any other person.” 18 U.S.C. § 876(c). We review de novo
Keyser’s claim that there was insufficient evidence to sustain
the verdicts under § 876(c). See United States v. Sullivan,
522 F.3d 967, 974 (9th Cir. 2008). Evidence is sufficient if,
“viewing [it] in the light most favorable to the prosecution,
any rational jury could have found the essential elements of
the crime beyond a reasonable doubt.” Id. (internal quotation
marks omitted). Any statutory interpretation matters are
reviewed de novo as well. United States v. Buckholder,
590 F.3d 1071, 1074 (9th Cir. 2010).

      Earlier this year, an en banc panel of this court
interpreted the “addressed to any other person” clause of the
statute to require that the relevant mailing be addressed to a
natural person or persons rather than non-natural entities,
such as corporations. United States v. Havelock, 664 F.3d
1284, 1293 (9th Cir. 2012) (en banc).

    The addresses in question satisfy this statutory
requirement. The envelopes had the business name
(Starbucks or McDonald’s) on the first line of the address, the


         imminent threats. Such speech would be outside of the
         protection of the First Amendment, similar to shouting
         fire in a crowded theater or threatening the president.

Brahm, 520 F. Supp. 2d at 626 (internal citations omitted).
                 UNITED STATES V . KEYSER                   17

word “Manager” on the second line, and no further indication
of an addressee within the contents of the mailing. The use
of “Manager” in the address sufficiently transforms the
addressee from the corporation to a natural person—a
Starbucks or McDonald’s manager is a natural person. The
statutory language “any other person” does not indicate that
the “person” in question must be one particular natural
person, and Keyser does not cite any authority in support of
his argument that such specificity is required.

    There is nothing in the Havelock court’s reasoning that
indicates we should require a threat to be addressed to one
particular, previously-identifiable person, rather than, as the
statute states, “any other person.” In fact, the reasoning that
led the Havelock court to find that the “person” contemplated
by the statute does not include a corporation or other non-
natural entity supports our conclusion. When looking to use
the word consistently across the entire statute, the court
explained that a corporation cannot be kidnapped or
physically injured. Havelock, 664 F.3d at 1291. In addition,
“[o]ne of the purposes of § 876 is the preservation of the
recipient’s sense of personal safety. The recipient’s sense of
personal safety is simply not implicated when the recipient is
an entity.” Id. at 1292 (internal citation and quotations
omitted). A manager, or any other person who falls within a
larger group of people, can be kidnapped or injured, and also
has his or her own sense of personal safety. The textual
reasons for distinguishing between natural persons and non-
natural entities do not apply to this situation, and we see no
reason to confine the phrase “any other person” to anything
less than its own broad terms. Keyser’s mailings to the
Starbucks and McDonald’s managers were addressed to
natural persons, so there was sufficient evidence for a jury to
convict him under § 876(c).
18               UNITED STATES V . KEYSER

     C. Jury Instructions

    Keyser raises a number of issues regarding the
instructions given to the jury at trial. In reviewing jury
instructions, this court inquires into “whether the instructions
as a whole are misleading or inadequate to guide the jury’s
deliberations.” United States v. Dixon, 201 F.3d 1223, 1230
(9th Cir. 2000). Instructions are viewed in the context of the
overall charge, and the standard of review varies based on the
nature of the alleged error. Id.

        1. Theory of the case instruction

    Keyser argues that the district court erred in failing to
give his proposed theory of the case instruction. “The district
court’s failure to give a defendant’s requested instruction that
is supported by law and has some foundation in the evidence
warrants per se reversal, unless other instructions, in their
entirety, adequately cover that defense theory.” United States
v. Marguet-Pillado, 648 F.3d 1001, 1006 (9th Cir. 2011)
(internal quotation marks and citations omitted). In other
words, a defendant is entitled to have his theory fairly and
adequately covered by the instructions, but is not entitled to
an instruction in a particular form. See Dixon, 201 F.3d at
1231. We review de novo whether the district court’s
instructions adequately presented the defense’s theory of the
case. Id. at 1230. We review for abuse of discretion the
formulation of an instruction that fairly and adequately
covered the elements of the offense. Id.

    Keyser’s proposed instruction set out the theory that
Keyser did not intend for people to believe that he was
actually sending out anthrax. The proposed instruction
provided, in relevant part:
                 UNITED STATES V . KEYSER                    19

       As to the 2008 mailings, the defense theory of
       the case is that Mr. Keyser relied on a
       suggestion by a government official, FBI
       Agent Timothy Lester, that if he intended to
       include a prop with his mailing, he should
       include the word “prop” or “sample.” The
       defense theory is that by using the word
       “sample” and a sugar packet, Mr. Keyser
       intended for people to understand that the
       mailing contained a prop, and that the mailing
       did not actually contain anthrax. If you find
       that Mr. Keyser believed that by changing the
       nature of the mailing in these ways, he
       intended to convey to people that the mailing
       did not actually contain anthrax, you must
       find him not guilty.

     “A trial judge may refuse an instruction if its language
gives undue emphasis to defendant’s version of the facts
rather than being a statement of appropriate principles of [the]
law for the jury to apply to the facts, or if it would tend to
influence the jury towards accepting the defendant’s version
of the facts.” United States v. Davis, 597 F.2d 1237, 1240
(9th Cir. 1979) (internal quotation marks and citation
omitted); see also United States v. Goland, 959 F.2d 1449,
1453 (9th Cir. 1992) (quoting Davis). That is the case here.
The proposed instruction signaled that Keyser’s theory of the
case was a lack of intent, but it focused on Keyser’s version
of the facts rather than the legal principle.

   The district court’s instructions made clear that the jury
must find intent in order to convict Keyser. On the hoax
counts, the court instructed the jury that they must find
“Keyser engaged in conduct with the intent to convey false or
20               UNITED STATES V . KEYSER

misleading information.” On the threat counts, the court
instructed the jury that they must find “Keyser intended to
communicate a threat to injure the person of the addressee or
another.”

    As in Davis and Goland, the instructions made it clear
that the jury had to find intent in order to convict, Keyser had
the opportunity to testify, of which he took advantage, and
defense counsel contested intent during closing arguments.
See Davis, 597 F.2d at 1240 n.7; Goland, 959 F.2d at 1454.
The district court did not err in refusing Keyser’s proposed
instruction on his theory of the case.

       2. Reasonable person standard

    Keyser argues that the district court erred in defining the
“reasonable person” standard to the jury. Keyser does not
dispute that the definition was legally correct but instead
contends that it was confusing, circular, and inadequate to
guide the jury. Alleged errors in the district court’s
formulation of an instruction are reviewed for abuse of
discretion. United States v. Reese, 2 F.3d 870, 883 (9th Cir.
1993).

    The district court twice defined a “reasonable person.”
With respect to the hoax counts, the court instructed: “A
‘reasonable person’ is an objectively reasonable person. The
persons to whom the information was conveyed may or may
not be objectively reasonable persons. It is for you to decide
who is a reasonable person.” With respect to the threat
counts, the court instructed: “A ‘reasonable person’ is an
objectively reasonable person. It is for you to decide who is
a reasonable person.”
                UNITED STATES V . KEYSER                  21

    These jury instructions adequately indicated that the
reasonable person standard is an objective one, not based on
the actual people involved in this case. Though more
elaboration might not have been improper, the instructions
did not mislead the jury, nor were they inadequate to guide
the jury. See Dixon, 201 F.3d at 1230. The district court did
not abuse its discretion in instructing as to the “reasonable
person” standard.

       3. “Context”

    Keyser also argues that the jury instructions did not
adequately inform the jury that they were to evaluate
Keyser’s statements in context, as required by Fogel v.
Collins, 531 F.3d 824, 831 (9th Cir. 2008). Keyser’s
proposed reasonableness and hoax instructions included use
of the specific word “context.”

     The court’s instructions did not include the actual word
“context,” but they did instruct the jury to look beyond the
literal words of the mailing. The threat instructions defined
a threat as “a communication made under circumstances in
which a reasonable person would foresee” that a recipient
would find it a threat (emphasis added). Similarly, the hoax
instruction said that the jury must find “Keyser conveyed
information under circumstances in which a reasonable
person could believe it” (emphasis added). Though the court
in Fogel examined the communication “in light of the full
context available,” nowhere did it state that the word
“context” must be used in jury instructions regarding threats
or hoaxes. 531 F.3d at 831. There is no requirement that the
court use the particular word “context.” Here, “under
circumstances” directed the jury to consider exactly what
22               UNITED STATES V . KEYSER

Keyser requested—evidence in addition to the literal words
of the mailing.

     D. Closing Argument

     Keyser also alleges that a statement the prosecutor made
during closing argument constituted impermissible vouching
and misled the jury on how to interpret the reasonable person
standard. We review for abuse of discretion. See United
States v. Nobari, 574 F.3d 1065, 1073 (9th Cir. 2009). To
demonstrate an abuse of discretion, the alleged prosecutorial
misconduct must be considered in the context of the entire
trial, and the defendant must show that it is “more probable
than not that the misconduct materially affected the verdict.”
United States v. Sarkisian, 197 F.3d 966, 988 (9th Cir. 1999)
(citations omitted).

     The prosecutor argued the following:

        Would reasonable people believe they were
        receiving Anthrax? That was the [defense
        counsel’s] first [question]. The answer to that
        is yes. It doesn’t – the law does not require
        that everybody who received it fear that they
        were receiving anthrax, simply that a
        reasonable person under the circumstances
        would believe it. You know that’s the case
        because reasonable people testified in this
        case and they did believe it.

(Emphasis added.) Keyser first argues that the italicized
statement above was impermissible vouching by the
government. A prosecutor may not place “the prestige of the
government behind a witness through personal assurances of
                 UNITED STATES V . KEYSER                    23

the witness’s veracity.” United States v. Necoechea, 986 F.2d
1273, 1276 (9th Cir. 1993). Such statements are improper
even if they are implicit. See United States v. McKoy,
771 F.2d 1207, 1211 (9th Cir. 1985). Referring to the
testifying witnesses as “reasonable” is not an assurance of the
veracity of those witnesses, however, so the statement does
not qualify as prosecutorial vouching.

    Keyser also argues that the statement misled the jury as to
how to interpret the “reasonable person” standard by
implying that the jurors were supposed to be deciding
whether or not the testifying witnesses were reasonable,
rather than applying an objective, witness-independent
standard.

    We need not decide whether the statement was misleading
because Keyser has not shown that it is more probable than
not that the verdict would have been materially different if
the prosecutor had not made the statement in question. See
Sarkisian, 197 F.3d at 988. The given jury instructions were
sufficient to cure any potential defect. Though not as
elaborate as Keyser might have liked, the instructions did
clearly tell the jury that they were to apply an objective
standard and that it was for them to decide who was and who
was not a reasonable person. In addition, the hoax instruction
explicitly stated that the recipients of Keyser’s letters may or
may not be objectively reasonable people.

   We therefore affirm Keyser’s convictions on all counts.

   E. Sentencing

    The district court did, however, procedurally err when
calculating the applicable Sentencing Guidelines range. See
24              UNITED STATES V . KEYSER

United States v. Carty, 520 F.3d 984, 993 (9th Cir. 2008) (en
banc). The district court applied a four-level enhancement to
each of the Starbucks and McDonald’s groups of counts
pursuant to Section 2A6.1(b)(4) of the Guidelines, finding
that the offenses of conviction resulted in substantial
government expenditures. In so determining, the district
court considered the government’s expenditures in response
to other mailings for which Keyser was not convicted.

    This consideration was contrary to the direction contained
in the Guidelines. The Guidelines specify that the district
court may consider other acts as part of the “course of
conduct or common scheme or plan” related to a conviction
offense only if those other acts must be grouped with the
conviction offense under U.S.S.G. § 3D1.2(d). See U.S.S.G.
§ 1B1.3(a)(2). Hoaxes and threatening communications,
however, are specifically excluded from grouping under
U.S.S.G. § 3D1.2(d) because they are described in U.S.S.G.
§ 2A6.1. Grouping is inappropriate because the counts
involved different victims and different acts. See U.S.S.G.
§ 3D1.2(a). The district court abused its discretion when it
considered other mailings as relevant conduct when those
mailings would not be grouped with the Starbucks and
McDonald’s mailings under U.S.S.G. § 3D1.2(d) had they
resulted in convictions.

   Improper calculation of the Guidelines range is
procedural error. Therefore, we vacate the sentence and
remand for resentencing. See United States v. Cantrell,
433 F.3d 1269, 1279 (9th Cir. 2006).

   AFFIRMED in part, VACATED and REMANDED in
part.
