It is 6am and the office mobile rings on the bedside table. It is security and they have a number of policemen with them. They have a search warrant and want access to your IT server. Security just want to check that this is OK with you… and there is a television crew there too.
A few minutes later the Head of Equities telephones, there are policemen at his country house wanting to take his mobile telephone and his laptop.
You switch on the TV to see scenes of police officers removing boxes of papers from your head office in New York in security tagged plastic bags.
Shortly afterwards you receive an email from your counterpart in Amsterdam who wants to know why his office is full of investigators.
Enhanced co-operation between international criminal investigative bodies and technological developments now means that search warrants must be executed simultaneously in several countries to avoid tipping off the suspects and limiting the opportunities for the destruction of evidence.
Increasingly common are searches conducted by domestic authorities at the behest of foreign regulatory or government bodies under mutual co-operation treaties. In other European financial centres, the authorities seem increasingly willing to use criminal sanctions in order to encourage behavioral change.
Financial services firms, in particular, are therefore likely to be targeted by multiple agencies in several jurisdictions.
Firms which hold a large amount of data on IT systems, including trading data or recorded telephone lines, will be targeted by investigators early on in an investigation to avoid the risk that evidence will be destroyed either inadvertently, by the application of overwriting policies, or by deliberate human intervention. In a firm with offices in many countries, it is likely that emails will have left an international trail.
Firms and their employees are not only likely to be targeted for sophisticated financial crime, but also for criminal activities made easier by the widespread use of the internet, such as downloading indecent images of children, internet harassment and the theft of sensitive information and personal data.
This requires investigators to access and preserve computer evidence in order to be able to mount a prosecution. Material obtained from IT systems is often the most incriminating form of evidence, and investigators have become increasingly adept at identifying likely sources.
We are frequently asked to provide multi-jurisdictional guidance for firms who fear they may be the subject of a search warrant executed by investigators with criminal powers.
In the UK, in most cases it will not be possible to prevent a search taking place but there is a great deal that can be done with foresight and proper planning to minimise the fallout from a raid.
With this preparation you can limit the damage to the brand and reputation of a firm (particularly in areas where trust is an important factor in the relationship with clients and suppliers), the disruption to IT systems from material being accessed or removed by investigators, the loss of employees or clients and, most importantly, to avoid prejudicing the position should the firm or its employees be charged with an offence.
With regard to international raids the police, the Serious Fraud Office (SFO) and the Financial Services Authority (FSA) will use their powers in support of an overseas police force, regulator or prosecuting authority. The important point to remember is that although public bodies, like the SFO and the FSA, have the ability to compel the provision of information from financial institutions without the need to obtain a warrant, the reason the public bodies (who have statutory powers of compulsion) choose to obtain search warrants is usually to maintain an element of surprise. This is important if they suspect that were an individual or a firm to be aware that they were under investigation, they would destroy evidence which might be deployed against them or tip off an accomplice. This is the most important factor to remember when planning for a search – the investigators have reason to believe that the evidence of wrongdoing they are seeking would not be made available to them voluntarily.
Anticipating and planning for a search
The firm and its legal advisers will need to co-ordinate the response across jurisdictions and time zones.
It is essential to establish the authority of the investigators and the context in which the investigation is taking place. If there is a search warrant, check what the investigators have been permitted to search for and remove. Find out who the investigators are. Identifying which agencies are involved (it may be that there are several) will give a strong indication of what type of conduct is likely to be alleged and what information is being sought.
It is common for experts in IT recovery to accompany police officers when electronic evidence is being sought and the firm’s IT department should be prepared for the possibility that investigators will require back-up tapes and images of computer data and have adequate systems in place to recover requested information within a short space of time. Contact the firm’s lawyers as soon as possible and ask them to be present during the search but anticipate that the investigators are unlikely to delay the search to allow for the arrival of external advisers. It is vital to have out of hours contact information
The firm’s press office should also be informed immediately and a press release prepared in the event that the search becomes public knowledge. Try to limit the number of people who become aware that the premises are being searched.
Even commercially sensitive material may be removed. Customers and suppliers may require reassurance as to the security of their information. Try to make copies of the documents that are seized especially if they are essential for the day-to-day business of the firm.
Do not volunteer to provide additional material outside the scope of the warrant even if it is believed that it will paint the firm in a more favorable light as it is unlikely that there will be sufficient information available at that stage to make a proper assessment.
You should avoid answering any questions at this stage.
David Esseks, Robert Knuts, Hendrik-JanBiemond and Sara George are members of the global investigations practice at Allen & Overy