No. 24-5966

Appeal from the United States District Court for the District of Hawaii Leslie E. Kobayashi, District Judge, Presiding

Argued and Submitted October 7, 2025 Honolulu, Hawaii

Filed February 17, 2026

Before: M. Margaret McKeown, Michelle T. Friedland, and Jennifer Sung, Circuit Judges.

Opinion by Judge McKeown

Page 2SUMMARY *

In a case in which a jury convicted Bryan Melvin Brandenburg of offenses arising from Brandenburg’s bomb threats directed towards a Salt Lake City courthouse and other governmental and educational institutions, the panel affirmed the district court's imposition of a sentencing enhancement under U.S.S.G. § 2A6.1(b)(4)(A) for substantial disruption of governmental functions.

The panel held (1) a non-public-facing security response to a threat may qualify as a substantial disruption of governmental functions under § 2A6.1(b)(4)(A); and (2) the district court, which correctly focused on the scope and time of the disruption caused by Brandenburg's threat, did not abuse its discretion in applying § 2A6.1(b)(4)(A).

The panel addressed Brandenburg’s appeal of his conviction and his other sentencing challenges in a concurrently filed memorandum disposition.

Page 3W. KeAupuni Akina (argued) and Darren Ching, Assistant United States Attorneys; Kenneth M. Sorenson, Acting United States Attorney; Office of the United States Attorney, United States Department of Justice, Honolulu, Hawaii; for Plaintiff-Appellee.

Harlan Y. Kimura (argued), Harlan Y. Kimura AAL ALC, Honolulu, Hawaii, for Defendant-Appellant.

OPINION

McKEOWN, Circuit Judge:

This appeal arises from Bryan Brandenburg's bomb threats directed towards a Salt Lake City courthouse and a number of other governmental and educational institutions. Following his conviction by a jury, the district court imposed sentencing enhancements for substantial disruption of governmental functions and obstruction of justice and determined that he did not qualify for an adjustment for acceptance of responsibility. This opinion focuses on the enhancement related to “substantial disruption of . . . governmental . . . functions” under U.S. Sentencing Guideline (“U.S.S.G.”) 2A6.1(b)(4)(A). We address Brandenburg's appeal of his conviction and his other sentencing challenges in a separate memorandum disposition filed concurrently with this opinion, and we affirm.

Brandenburg's threats kickstarted a series of security measures to secure the courthouse, including creation of aPage 4 threat working group, enhanced screenings, surveillancevideo reviews, and continuous patrols. However, he claims that the disruption did not relate to governmental functions because security is not a governmental function, the disruption was not public facing, and the courthouse continued operations. This crabbed view of the Guideline ignores the plain meaning of “disruption” and miscomprehends the role of courthouse security, which is an integral function of courthouse operations. Indeed, security functions performed behind the scenes, away from public view, are just as important as the prominent security apparatus the public sees upon entering a courthouse.

As then-Judge Kennedy wrote when he was a member of this court, “[t]he serenity of the court of appeals is not so debilitating that we fail to appreciate the real dangers posed by threats of violence directed at other courthouses and government facilities.” McMorris v. Alioto , 567 F.2d 897, 900 (9th Cir. 1978). Recent threats to judges and courthouses have only amplified this sentiment. See, e.g. , Chief Justice John G. Roberts, Jr., Year End Report on the Federal Judiciary 5–7 (Dec. 31, 2024); Mary Ellen Barbera & Joseph Baxter, Assessing Safety and Security Challenges in State Courts , 104 Judicature, no. 3, 2020–21, at 56. We hold that a non-public-facing security response to a threat may qualify as a “substantial disruption of . . . governmental . . . functions' under Sentencing Guideline 2A6.1(b)(4)(A).

In 2022, Bryan Brandenburg participated remotely in divorce proceedings at the Third Judicial District Courthouse in downtown Salt Lake City, Utah. After a bench trial, Brandenburg's email inquiries to court staff Page 5regarding a timeline for issuance of a decision grew increasingly indecorous. Eventually, his insults degenerated into threats. On May 3 and 4, Brandenburg-once a prominent Salt Lake businessman-emailed court staff threats to 'bomb' or 'level' a variety of local targets, including “the city,” “the sacred temple,” “the State Capital [sic],” “the mayor’s office,” and “the 3rd District Courthouse.' He also threatened to bomb Ivy League schools, Rockefeller Center, and “the Federal Courthouse in San Diego to teach them a lesson.”

In response, the Third Judicial District Courthouse's security team initiated extensive security measures, including creation of an interdepartmental threat working group; coordination with the sheriff’s department to conduct background research on Brandenburg and ensure appropriate responses by the state capitol and mayor's office; enhanced screenings of all entrants, including staff, to the courthouse; review of surveillance tapes from the day of the threat and prior days; and continuous patrols of the courthouse's interior, exterior, and surrounding buildings and areas. Because the emailed threats used the first-person plural “we,” courthouse security assumed that more than one person was involved in the threat. All officers not actively protecting a jury, staff member, or courtroom were assigned to patrol within and around the courthouse. The result was that approximately fifteen deputies, about half of the officers on duty at the courthouse, were removed from their normal duties and dedicated to constant searches for suspicious devices and persons. The high-alert status lasted from May 4 until May 6. As the courthouse’s security director recalled, “for [the courthouse’s] security staff, it wasn’t business as usual . . . there was [sic] no breaks, there was no nothing.”

Page 6The impact of Brandenburg’s threats radiated beyond the Third Judicial District Courthouse. On May 6, he emailed four local journalists accusing medical-devices company Hall Labs and the University of Utah’s Center for Medical Innovation of having placed 'illegal medical devices in [him] without [his] knowledge or permission.” The email concluded: 'We're bombing both campuses today for crimes against humanity.' At least three of the four journalists deemed the threats sufficiently serious to warrant contacting local police departments. Authorities mobilized in response. A Provo Police Department officer deployed to Hall Labs, performed an exterior sweep, and offered to search the premises with bomb-sniffing canines. At the University of Utah, authorities evacuated the Health Sciences Library, the adjoining College of Nursing, and sections of the nearby hospital before conducting a visual and canine search of the entire library building. All but one of the University’s patrol officers were diverted to assist, and a Situation Triage and Assessment Team was assembled with campus, local, and federal authorities. The bomb threat coincided with commencement ceremonies and the funeral of Senator Orrin Hatch, which drew various high-profile politicians and religious leaders to campus.

Brandenburg was indicted for one count of transmitting a threat in interstate commerce in violation of 18 U.S.C. § 875(c) and six counts of making threats or false statements about explosives in violation of 18 U.S.C. § 844(e). Counts 1 through 6 of the indictment arise from the threats sent to the Third Judicial District Courthouse staff, while Count 7 arises from the email sent to journalists threatening Hall Labs and the University of Utah. A jury found Brandenburg guilty of all seven counts.

Page 7At sentencing, the government argued for an enhancement for Counts 1 through 6 under Sentencing Guideline 2A6.1(b)(4)(A), which courts must apply when an offense resulted in “substantial disruption of public, governmental, or business functions or services.” Pushing back, Brandenburg argued that although “security may have been disrupted . . . security is not necessarily [a] governmental function[].” Or, “in other words, the court was still operating . . . as intended” and “therefore the sentenc[ing] enhancement should not apply.” The district court disagreed and applied the enhancement, reasoning that the court security staff’s devotion of “time and energy” to addressing the threat resulted in sufficient “interfere[nce]” with governmental functions.

The district court sentenced Brandenburg to concurrent sentences of sixty months for transmitting a threat in interstate commerce and seventy months for each of the six counts for making threats or false statements about explosives. Brandenburg appealed both his conviction and sentence. We have jurisdiction under 18 U.S.C. § 3742 and 28 U.S.C. § 1291, and we affirm.

Guideline 2A6.1(b)(4) provides for a four-level enhancement:

[i]f the offense resulted in (A) substantial disruption of public, governmental, or business functions or services; or (B) a substantial expenditure of funds to clean up,

Page 8decontaminate, or otherwise respond to the offense[.]

The commentary to Guideline 2A6.1 does not define what constitutes a “substantial disruption of public, governmental, or business functions or services,” and caselaw regarding the Guideline's parameters is scant: We have addressed the meaning of “substantial disruption” under Guideline 2A6.1 in only one previous case. See United States v. Mohamed , 459 F.3d 979 (9th Cir. 2006). However, we can also draw on virtually identical language in recently deleted Guideline 5K2.7’s upward departure for “a significant disruption of a governmental function.”

In Mohamed , we held that a substantial disruption occurred after the defendant telephoned in a threat to bomb several shopping malls near a federal building in Los Angeles. 459 F.3d at 981, 988. In response, '[l]aw enforcement agencies . . . devoted substantial resources to investigating and preventing the purported attack,” with at least seven different agencies contributing support. Id. at 982. Additionally, 'the hoax disrupted business in the targeted areas,” with sales at affected establishments decreasing by up to eighty-five percent. Id. Such effects on law enforcement and businesses provided “ample evidence” to support Guideline 2A6.1(b)(4)(A)'s application. Id. at 988. Mohamed , however, does not directly address what constitutes “substantial disruption of governmental functions.” U.S.S.G. § 2A6.1(b)(4)(A) (citation modified).

We first consider de novo the meaning of “disruption of governmental functions.” United States v. Patterson , 119 F.4th 609, 611 (9th Cir. 2024) ('We review de novo the district court’s legal interpretation of the [Sentencing] Guidelines.” (citation omitted)). In order to “determine[e]Page 9 the ‘plain meaning’ of a word, we may consult dictionary definitions, which we trust to capture the common contemporary understandings of the word.” United States v. Flores , 729 F.3d 910, 914 (9th Cir. 2013). 'Disruption' derives from “‘disrupt,’ which means ‘to cause disorder or turmoil in.’” United States v. Dudley , 463 F.3d 1221, 1226 (11th Cir. 2006) (quoting Random House Unabridged Dictionary 569 (2d ed. 1993)). A disruption is characterized by “a break or interruption in the normal course or continuation of some activity, process, etc.' Disruption , Merriam-Webster.com Dictionary, https://www.merriamwebster.com/dictionary/disruption [https://perma.cc/2Q3GFNDB] (last visited Feb. 2, 2026).

Our precedent examining recently deleted Guideline 5K2.7’s upward departure for “a significant disruption of a governmental function' echoes dictionaries' emphasis on confusion caused by the interruption of normal activities.¹ Although Guideline 5K2.7’s “significant disruption” is not the same as Guideline 2A6.1(b)(4)(A)’s “substantial disruption,” we view the terms as nearly synonymous in this context. Compare Substantial , Black's Law Dictionary (12th ed. 2024) (“Considerable in extent, amount, or value”), with Significant , Black's Law Dictionary (12th ed. 2024) (“Of special importance; momentous, as distinguished from insignificant”). In United States v. Singleton , we stated that Page 10law enforcement must be stretched beyond “normal function[s]' and 'responsibilities' for Guideline 5K2.7 to apply. 917 F.2d 411, 414 (9th Cir. 1990). Similarly, in United States v. Dayea , we held that evidence that a government agency’s “functioning was impaired in [some] way” would be needed for a “disruption” to have occurred. 32 F.3d 1377, 1381–82 (9th Cir. 1994). One example of a sufficient disruption under Guideline 5K2.7 was the 'overwhelm[ing]' of the Immigration and Naturalization Service’s application processing apparatus by thousands of false immigration petitions. United States v. Velez , 113 F.3d 1035, 1039 (9th Cir. 1997); accord United States v. Saani , 650 F.3d 761, 766 (D.C. Cir. 2011) ('Unlawful conduct necessitating an unusually burdensome or prolonged investigation of a government office may suffice as a 'significant disruption' under § 5K2.7 regardless whether the investigation proves fruitful.”).

A security response alone may constitute a disruption of government functions. In Mohamed, we reasoned that “the costs of law enforcement ' that resulted from the threat supported Guideline 2A6.1(b)(4)’s application. 459 F.3d at 988 (emphasis added). Elevated demands on security personnel can sow 'disorder or turmoil' that 'prevent[s] normal continuance of' their functioning within broader governmental functions. Dudley , 463 F.3d at 1226 (quoting Disrupt , Random House Unabridged Dictionary 569 (2d ed. 1993)); United States v. Anwar , 741 F.3d 1134, 1137 (10th Cir. 2013) (quoting Disrupt , Webster’s Third New International Dictionary 656 (1976)).

The specific record regarding the courthouse security team’s responses to Brandenburg’s conduct illustrates why that response qualifies as a 'disruption.' Because of Brandenburg’s threats, the Third Judicial District Page 11Courthouse’s security team’s responsibilities were stretched well beyond their “normal function” and “normal responsibilities' of maintaining the day-to-day safety of those inside the courthouse. Singleton , 917 F.2d at 414. In response to Brandenburg’s threat, the security staff shifted away from their normal duties to continuously search throughout the courthouse and surrounding areas, conduct enhanced screenings of all visitors and staff, review taped surveillance footage, and coordinate with the sheriff's department to understand the threat. See id. (emphasizing a change in scope of functions).

Brandenburg's threats arose in a climate of serious threats nationwide against courthouses and judges. In 2008, the San Diego federal courthouse-one of the targets of Brandenburg’s threats—was bombed. See United States v. Love , No. 10-cr-2418-MMM, 2013 WL 1660415, at *1 (S.D. Cal. Apr. 17, 2013). In 2020, District of New Jersey Judge Esther Salas's son was murdered by a plaintiff who had appeared before her, grimly echoing the killing fifteen years earlier of Northern District of Illinois Judge Joan Lefkow’s mother and husband by a disgruntled litigant. Esther Salas, Federal Judges Are at Risk , N.Y. Times, Dec. 9, 2020, at A25.

Responses, be they public-facing or solely behind-thescenes, to threats can trigger disruptions of governmental functions. Brandenburg’s contrary argument that Guideline 2A6.1 differentiates between public- and private-facing governmental functions is unpersuasive. The plain language of the Guideline contravenes Brandenburg’s view: The disjunctive “or” distinguishes among “public, governmental, or business functions or services.” U.S.S.G. § 2A6.1(b)(4)(A) (emphasis added). To read the Guideline as limited to 'public' functions and services would be to Page 12eliminate the “or.” Indeed, Brandenburg acknowledged that the “or” is disjunctive.

We are hard-pressed to understand why an out-of-theordinary, non-routine security response at a courthouse could not qualify as disrupting governmental functions. A comparison can be drawn with Guideline 2J1.3(b)(2), which commands a three-level enhancement '[i]f the perjury, subornation of perjury, or witness bribery resulted in substantial interference with the administration of justice .” (emphasis added). Guideline 2J1.3(b)(2)’s language permits consideration of only a narrower category of justiceadministration-related functions as compared to Guideline 2A6.1(b)(4)(A)’s broad ambit, which encompasses all 'public, governmental, or business functions or services.' While both guidelines require courts to “assess[] the scope and time of the disruption at issue,' Anwar , 741 F.3d at 1139, courts should consider a crime’s effects across the full breadth of governmental functions and services under Guideline 2A6.1(b)(4)(A).

We are not aware of any support for Brandenburg's assertion that 'governmental functions' under Guideline 2A6.1(b)(4)(A) are limited to functions performed by public-facing or non-security-related government personnel. Court security staff, including those who do not perform public-facing tasks, can, and do, perform vital government functions and enable other government workers to perform their duties. For example, in this case, the effectiveness of the Third Judicial District Courthouse security team’s response permitted the court's judges and other staff to continue their administration of justice despite Brandenburg's credible threats. It might have seemed as though operations were business-as-usual to the public, but, in fact, it was the extraordinary measures undertaken by Page 13security personnel that allowed courthouse operations to continue as normally as possible.

Court proceedings, including Brandenburg's contested divorce, are often explosive. Threats voiced by litigants and other aggrieved parties towards judges and the court system must be taken seriously. We agree with the district court that members of security staff constitute essential parts of the organizational machinery that allow the government to function, and that demands beyond security staff’s normal scope of duties can, as a matter of law, constitute a disruption of governmental functions under Guideline 2A6.1(b)(4)(A).

The question of whether the disruption was “substantial” requires us to evaluate “the district court’s application of the Guidelines to the facts,' which we review for abuse of discretion. United States v. Petrushkin , 142 F.4th 1241, 1245 (9th Cir. 2025). Although this standard is deferential and '[h]ow much disruption of governmental activity is ‘substantial’ is a matter of degree,” judges must still rely on “evidence and not speculation” to establish Guideline 2A6.1’s applicability. United States v. Bourquin , 966 F.3d 428, 433 (6th Cir. 2020) (citation omitted).

We agree with the Tenth and Eleventh Circuits that “substantial disruption of . . . functions or services” in Guideline 2A6.1(b)(4)(A) “suggests a significant interruption of normal activities when measured by scope and time.' Anwar , 741 F.3d at 1137 (citing Dudley , 463 F.3d at 1226). The inquiry “focuses on the outcome of the threat, not the defendant's intent.' Id. Hence, a district court should consider “objectively quantifiable effects, such as the extent to which the false threat interrupted or impeded normal activity and the amount of time the interruption Page 14lasted.” Id. at 1139. Factors relevant to whether a 'substantial disruption' occurred may include how many law enforcement officers and agencies responded, how long the response lasted, what normal duties the responding officers were diverted from, how much money was spent on the response, 2 and how other 'public, governmental, or business functions or services' were affected. U.S.S.G. § 2A6.1(b)(4)(A); Mohamed , 459 F.3d at 982, 988 (mentioning facts relevant to each of these factors except diversion from normal duties); Anwar , 741 F.3d at 1139–41 (considering each of these factors except cost); Dudley , 463 F.3d at 1226 (same).

The district court's inquiry correctly focused on the “scope and time” of the disruption caused by Brandenburg’s threat. Anwar , 741 F.3d at 1139. The courthouse security team’s sustained efforts over three days disrupted its normal routine and shifted all available officers from normal functions to nonstop patrols, time-consuming inspections of each visitor and staff member, exhaustive review of surveillance footage, vigilant coordination with outside agencies, and other elevated security protocols.³ Accordingly, the district court did not abuse its discretion in applying Guideline 2A6.1(b)(4)(A).

AFFIRMED.