A search at an IT company: a step-by-step algorithm

Vitalii Petryk

Attorney at law · Lexon (LF LEXON)

A search at an IT company is not only stressful, it is a risk of business interruption: seizure of servers and equipment can paralyse operations for weeks. Below attorney Vitalii Petryk explains step by step what to do, what your rights are and how to avoid excessive seizure.

A search is possible only on the basis of an investigating judge ruling

A search is carried out on the basis of a ruling of an investigating judge (Articles 234 and 235 CPC). Before it begins the investigator must produce the ruling and provide a copy (Article 236 CPC). Read the ruling carefully: the address covered, what and whom they are looking for, the list of items and documents, the period of validity. Anything beyond those limits is questionable in terms of lawfulness.

First steps when a search begins

1. Stay calm and do not physically obstruct.
2. Record the start time, the composition of the investigative team, names and ID numbers.
3. Demand the investigating judge ruling and a copy, and check its limits.
4. Call your lawyer and management immediately.
5. Where possible, start your own video recording.
6. Appoint one responsible person to accompany the investigators.
7. Do not delete or alter any data.

The right to a lawyer: what matters

You are entitled to legal assistance. But an important nuance: a search is not paused merely because the lawyer is still on the way. The lawyer contact details must therefore be ready in advance. Until the defence lawyer arrives, give no explanations on the merits; once the lawyer arrives, the investigators are obliged to admit them.

What may and may not be seized

Items and documents specified in the ruling may be seized, as well as items withdrawn from circulation. Going beyond the ruling is not allowed. Everything seized must be described in the report, with an opportunity to verify the list.

Servers and equipment: copying instead of seizure

This is the key safeguard for business. As a general rule the investigator must copy the required information rather than seize the electronic information systems and computer equipment themselves (Article 168 CPC). Seizure of equipment is permitted only in exceptional cases, for example where obtaining the information without seizure is impossible or where the equipment is the object or instrument of the offence. Insist on copying and record in writing if equipment is taken without proper grounds.

Which breaches to record

• Absence of a ruling or a mismatch between its content and what is happening.
• Going beyond the scope of the ruling.
• Seizure of equipment without grounds instead of copying information.
• Absence of proper recording of the search.
• Refusal to admit the lawyer.

All of this later works towards having the evidence obtained declared inadmissible (Articles 87 and 89 CPC).

What not to do

Do not physically obstruct, as this carries separate liability. Do not delete data, as this may be treated as concealment. Do not give hasty explanations without a lawyer. Do not sign documents without reading them.