What to Expect When you’re the Subject of an Investigation

A former FBI special agent and instructor provides a step-by-step search warrant scenario.

When the FBI shows up at your company with a search warrant in a bribery investigation, it’s best to be prepared. And it’s also best to understand what’s expected of you.When we ran a blog post about being prepared for a “dawn raid” we got a great response from John Hanson, who is a CFE and former Special Agent with the FBI, as well as an instructor, speaker and founder and executive director of Artifice, a forensic financial services firm. With his permission, we have condensed his comments into the following post on what companies can expect when the FBI visits their offices to execute a search warrant.In the execution of a search warrant, there are two primary concerns of Law Enforcement:

1. safety of both the Law Enforcement personnel and civilians;
2. preservation of the evidence.

Because of this, when executing a search warrant, even in alleged fraud (non-violent) matters, Law Enforcement will first take actions to control the scene of the search.An Agent/Officer would most likely approach the receptionist to “announce” his or her identity and purpose – the intent to execute a search warrant – to fulfill the “knock and announce” requirement as per Title 18, USC, Section 3109. This announcement would coincide with other Law Enforcement personnel immediately (even simultaneously) proceeding to secure the premises (for the reasons noted above).

Cooperation isn’t Optional

They will usually demand that everyone they encounter remove themselves from their work areas and will detain them and control their movements for a short period of time, before asking them to leave the premises. Law enforcement also has the authority to search the person and personal belongings of employees (or anyone else present on the premises), so employees should recognize that they themselves, along with their purses, briefcases and other personal belongings, will likely be searched.While not all employees will be asked to submit to formal interviews, they should expect that law enforcement will ask for their name(s) and other identifying information. Frequently, that information will be used to check for any outstanding warrants before the person(s) is released.

Don’t Expect a Lot of Detail

Once the scene is under law enforcement’s control, one of the lead law enforcement persons will look for and be happy to speak with company executives and/or counsel, but will not likely share a great deal of information. In many instances, the affidavit in support of the search warrant may be under seal, so that its particulars are not available to the company.The search warrant itself reveals little; it is merely the Court Order authorizing the search. The search warrant may or may not be shown to company personnel initially and usually will not be shown until the premises are at least secured (under their control). Law enforcement is required to leave a copy of the search warrant (and affidavit if not sealed), along with a “receipt” or list of the items seized, when they complete the search and release control of the premises.Law Enforcement frequently will not even allow executives or their counsel to remain present on the premises during the search. If something was seized that was outside the scope of the search warrant, the company and/or their counsel cannot prevent the initial seizure, only argue about it after the fact.Law Enforcement recognizes and appreciates attorney/client privilege and will have a procedure to deal with documents that might fall under this privilege; however, it is law enforcement that makes the determination about seizure, not the company or their counsel. Once again, if the company or counsel feels that something was seized that was privileged, they must make their arguments after the fact of the seizure or otherwise as provided for by the Law Enforcement agency’s procedures for addressing such matters on-site, if any.

Cooperation is Key

During the search, to the extent that a company may be asked to provide technical assistance, such as with IT systems, they should consider doing so. Similarly, to the extent that company personnel can provide information or assistance that would help law enforcement to more safely and efficiently conduct their search (i.e. providing keys for locked doors or closets, passwords, etc.), it positively reflects on the company’s willingness to cooperate (obviously in the context of their individual and company rights and in accordance with due process).Employees should be warned not to tamper with or destroy evidence. Not only do such actions compromise the credibility of the company and reflect very negatively on their willingness to cooperate, but in the context of a search warrant, the employees who take such actions may subject themselves to personal criminal exposure (i.e. Title 18, USC, Section 2232 and 2233).Keeping a record of the search itself is largely not possible in any detail, as company personnel and counsel are most often not permitted to be present during the search. It would be appropriate and advisable to designate a person to keep as much of a record of the search as possible, such as when it began and ended, how many law enforcement personnel were present, description of items observed as seized (i.e. being carried out for transport), etc., but it should not be expected that this record will be of great detail.A record of what was actually seized may be, with some significant effort, reconstructed by the company after-the-fact. Such a record will be provided by law enforcement in the form of a “receipt” upon completion of the search as required by law.Unfortunately for most companies, such receipts are not very detailed, particularly in fraud related investigations where an entire filing cabinet, for example, might be seized after several documents were located within it that were subject to seizure according to the search warrant.One final important element of responding to search warrant is a plan to have seized documents and items returned to the company in a timely manner. For example, if law enforcement seized computers, that seizure may prevent the company from being able to conduct their business.The law still holds that one is innocent until proven guilty and the company has the right to be able to continue doing business until (and if) proven guilty and that right removed. The company should begin asking for such items and records to be returned as soon as possible and take it up with the Court if they are not returned within a reasonable time.