A search at the office: what to do in the first thirty minutes

A search begins without warning, by definition. So the only thing that genuinely works is a sequence of steps the staff already know, and a single phone number they call straight away.

What is produced at the door

The investigator produces a decision ordering the search. For a search of a home, a court order is required. For non-residential premises belonging to an organisation no court order is needed: the investigator's decision is enough.

The first thing to do is read the document and copy out the details: who issued it, in which criminal case, on what grounds, what exactly is being looked for, which address is stated. The address matters: a search is carried out at a specific address, and extending it to neighbouring premises is unlawful.

A copy of the decision must be handed over. If it is not, that is recorded in the observations attached to the record of the search.

Who may be present

The search is carried out in the presence of a representative of the organisation. Attesting witnesses are mandatory unless video recording is used.

An advocate has the right to be present. The investigator is not obliged to wait for them to arrive, but the request for defence counsel to take part must be recorded, and any refusal must be reflected in the record. In practice, a call to the advocate and a note of the time of that call change the tone of what follows.

Staff may remain on the premises, but the investigator may restrict their movement and their communication with one another. That is lawful.

What you may and may not do

You must not obstruct. Locking doors, hiding documents, carrying hardware out: that creates a separate offence and destroys any defence.

You must not delete data. Files deleted during a search are recovered and recorded. It is the worst possible decision.

You may and should record what happens. Note the time it started, who was present, what was examined, what was seized. Video recording is not prohibited by law, but the investigator may restrict it by reference to the confidentiality of the investigation; in that case record everything in writing.

You may state observations. Anything that looks like a breach goes into the record of the search, in the observations section. Oral objections do not exist.

You may insist that a specialist takes part in the seizure of electronic storage media: that is expressly provided for by law.

Electronic storage media

There is a separate rule: a specialist takes part in the seizure of electronic storage media. At the request of the owner or the holder of the information, the specialist copies the information onto other media, provided this does not impede the investigation.

The practical conclusion: the request to copy must be made in writing and made immediately. A company whose servers have been seized with no copies left behind grinds to a halt for weeks.

Staff members' personal phones are seized if they are named in the decision or if there are grounds to believe they contain relevant information. An employee is not obliged to disclose passwords: Article 51 of the Constitution.

The record of the search

Read it in full before signing. Check: the list of items seized with their individual identifying features, the quantities, the packaging and sealing, the start and finish times, everyone who took part.

A line reading "documents seized, one box" is a defect that later makes it impossible to establish what was actually taken. Insist on an inventory, or record an observation that there is none.

A copy of the record is handed to the representative of the organisation.

After the search

Within twenty-four hours, establish exactly what was seized and assess the impact on operations: which documents are needed for current obligations, which data has been lost.

Prepare an application for the return of property unconnected with the case and for copies of the documents seized. The investigator is obliged to make copies on request, provided this does not impede the investigation.

In parallel, assess the nature of what is happening: a search connected with a counterparty, a search in a case where the company is the injured party, or a search in a case where the interest is in the management. The strategy depends on the answer, and it is rarely obvious on day one.

What to prepare in advance

A one-page instruction: who to call, who meets the investigators, who records what happens, what to tell staff. A designated responsible person and a deputy. A document storage arrangement in which staff members' personal belongings are not mixed up with the company's. Backup copies of data held away from the office.

This is not paranoia. It is the same as a fire drill: useless right up to the day it becomes the only thing that works.

This material is for information only and is not a substitute for advice on a specific case.

If investigators have arrived with a search warrant, or you want to prepare your company in advance, write to us. The first consultation is free of charge where an engagement agreement is signed.

Dmitry Malyutov — advocate, chairman of the Kovalev, Malyutov, Tsypkalo & Partners Moscow Bar Association