A dawn raid response begins the moment unannounced government investigators appear at your reception desk, and what your team does in the next hour will shape everything that follows. Verify credentials, read the warrant or inspection decision word by word, call outside counsel, lock down data without deleting anything, assign a shadow to every investigator, and assert privilege claims in real time. Companies that have rehearsed these steps consistently fare better than those improvising under pressure.
What You’re Actually Facing
Before you can respond correctly, you need to know what kind of visit this is. In the United States, a criminal dawn raid requires a search warrant issued by a federal magistrate judge on a showing of probable cause. Federal Rule of Criminal Procedure 41 governs the process: the warrant must describe the specific places to be searched and the items to be seized, and executing officers must leave a copy of the warrant and a receipt for everything they take.1Legal Information Institute (LII). Federal Rules of Criminal Procedure Rule 41 – Search and Seizure The DOJ Antitrust Division, FBI, and other federal agencies use this route for criminal price-fixing, fraud, and obstruction cases.
Not every unannounced visit is criminal. Agencies like the SEC and FTC also use civil investigative demands and administrative subpoenas, which require a lower threshold. A criminal warrant authorizes agents to physically search premises and seize materials; a civil subpoena compels you to produce documents but doesn’t typically authorize a physical rummage through your offices. Determining which one you’re dealing with is your legal team’s first job.
If your company operates in Europe, the rules differ. The European Commission can order an inspection by formal decision without first obtaining a judicial warrant, and its inspectors can enter premises, examine and copy business records, seal offices for the duration of the inspection, and ask employees for on-the-spot explanations of documents.2EUR-Lex. Council Regulation (EC) No 1/2003 Refusing to submit, or producing incomplete records, exposes the company to fines of up to 1% of total worldwide annual turnover. In the UK, the Competition and Markets Authority holds comparable powers under the Competition Act 1998. Multinational investigations increasingly involve coordinated simultaneous raids across multiple countries, so your response plan cannot depend on a single location’s legal team being available.
The First Fifteen Minutes
When investigators arrive, front-line staff should do four things and nothing else: ask for identification from every official, direct investigators to a pre-designated waiting area, make no substantive statements about the business, and trigger the notification chain. The chain bypasses normal hierarchy. A receptionist who spots investigators in the lobby needs a direct line to in-house counsel and the IT lead, not three levels of management.
Simultaneously, the IT lead locks down remote access and suspends any automated data deletion processes. Nobody touches a keyboard to delete anything. Nobody starts shredding. These are the actions that turn a survivable regulatory event into a criminal obstruction case.
External counsel’s first task is to read every word of the search warrant or inspection decision. That review confirms which legal entities are being searched, what subject matter the investigation covers, what types of documents investigators are authorized to take, and the relevant time period. Any ambiguity gets clarified with the lead investigator before the search moves forward. Experienced counsel can often narrow the practical scope significantly just by pointing out what the warrant does not cover.
Managing the Search While It’s Underway
Shadow Every Investigator
Assign a company representative to physically accompany every investigator throughout the search. Shadows take detailed contemporaneous notes of everything: which rooms were entered, which drawers and file cabinets were opened, which computer files were accessed, what questions were asked, and what documents were flagged for seizure. This log is your primary evidence if you later need to challenge the search as exceeding its authorized scope. Shadows should be calm, professional, and silent unless asserting a privilege claim. Their job is to observe and record, not to argue with investigators.
Assert Privilege in Real Time
When investigators encounter a document that may be protected by attorney-client privilege or the work product doctrine, your representative must assert the claim before the document is reviewed. The document gets set aside, logged with an identification number and the basis for the claim, and held for later resolution. A privilege log template prepared in advance speeds this up enormously. If investigators refuse to honor a claim, note the refusal in the shadow’s log and escalate through counsel.
The DOJ uses “filter teams,” sometimes called “taint teams,” consisting of agents and attorneys not involved in the underlying investigation. Their job is to screen seized materials for privileged content before anything reaches the prosecution team.3United States Department of Justice. Justice Manual 9-13000 – Obtaining Evidence Knowing this process exists gives you leverage to insist that disputed documents be sealed and handled through the filter protocol rather than reviewed on the spot.
Monitor the Digital Imaging
When investigators image corporate servers or hard drives, insist on having your own forensic expert present. Your expert verifies that only data within the authorized scope is being copied and that the imaging doesn’t corrupt the original data. Request that investigators generate a cryptographic hash value for every forensic image created. A hash value, typically using the SHA-256 algorithm, lets both sides later confirm that the seized data hasn’t been altered since collection. If the government ever introduces digital evidence at trial, the hash value is how you verify its integrity.
Remote workers add complexity. A warrant for your headquarters doesn’t automatically extend to a remote worker’s home office. Federal Rule 41 limits warrant authority to a specific district, with exceptions for electronic storage media that can be searched remotely under certain circumstances.1Legal Information Institute (LII). Federal Rules of Criminal Procedure Rule 41 – Search and Seizure Your response plan should address data stored on devices at locations not covered by the warrant.
Employee Interactions
Employees are not obligated to answer substantive questions from investigators during a search. The Fifth Amendment protects individuals from being compelled to make statements that could incriminate them.4LII / Legal Information Institute. Fifth Amendment Voluntary statements made during a raid can and will be used against both the individual and the company. If investigators want to interview an employee, that employee should be advised to speak only in the presence of counsel. Employees who have been trained know they can politely decline and that doing so is not obstruction.
The overall posture is controlled cooperation. You comply with the warrant, you don’t physically obstruct the search, you don’t hide or destroy anything, and you provide access to what the warrant covers. But you assert every legal right you have, document everything, and make sure investigators don’t drift beyond their authority.
What Obstruction Costs
Getting this wrong is severe enough to warrant its own warning. Destroying, altering, or concealing records to impede a federal investigation carries a maximum sentence of 20 years in prison under 18 U.S.C. § 1519, enacted as part of the Sarbanes-Oxley Act.5Office of the Law Revision Counsel. 18 US Code 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy A separate statute, 18 U.S.C. § 1505, makes it a crime to obstruct proceedings before any federal department or agency, carrying up to five years in prison.6Office of the Law Revision Counsel. 18 US Code 1505 – Obstruction of Proceedings Before Departments, Agencies, and Committees Both apply to individuals.
For the company, non-cooperation hits the balance sheet. The DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy ties cooperation directly to fine reductions. A company that fully cooperates and remediates can receive a reduction of 50% to 75% off the low end of the sentencing guidelines fine range. A company that obstructs loses that credit entirely. The policy specifically requires that a company must have “appropriately retained business records and prohibited the improper destruction or deletion of business records” to qualify for any cooperation credit.7Department of Justice. Corporate Enforcement and Voluntary Self-Disclosure Policy Deleting a single Slack thread during a raid could disqualify your company from millions of dollars in fine reductions.
The DOJ and FTC have explicitly stated that messages on collaboration platforms like Slack, Microsoft Teams, and Signal are covered by preservation obligations, even when the tools allow messages to auto-delete.8United States Department of Justice. Justice Department and the FTC Update Guidance that Reinforces Parties Preservation Obligations for Collaboration Tools and Ephemeral Messaging Failure to preserve these communications can result in obstruction charges. If auto-delete features are enabled on business communication channels, your legal team should evaluate now whether those settings create unacceptable risk.
After the Investigators Leave
Reconcile and Debrief Immediately
Your first job after the search ends is reconciling the investigators’ inventory of seized items against the shadow logs. Flag any discrepancy. If investigators took something not listed on their receipt, or if the shadow logs show access to areas outside the warrant’s scope, those facts become the foundation for a potential challenge.
Next, conduct a privileged debriefing of every employee who interacted with investigators, including front-line staff and shadows. Legal counsel should manage these conversations so the notes are protected by attorney-client privilege. Collect every detail: what questions investigators asked, which documents they reviewed, what they seemed most interested in, anything that felt out of scope. Memory fades fast. The debriefing should happen the same day.
Issue a Legal Hold
The legal team must immediately issue a formal litigation hold notice to all employees whose work touches the subject matter of the investigation. This overrides routine document retention schedules that might otherwise result in automated deletion. Failing to issue this hold, or issuing it too late, exposes the company to spoliation sanctions that can be as damaging as the underlying investigation. The preservation obligation extends to ephemeral messaging and collaboration platforms; auto-delete features must be suspended for anything related to the investigation’s subject matter.8United States Department of Justice. Justice Department and the FTC Update Guidance that Reinforces Parties Preservation Obligations for Collaboration Tools and Ephemeral Messaging
Launch a Privileged Internal Investigation
With the immediate evidence secured, the company should launch a privileged internal investigation to understand what prompted the raid. The warrant’s scope tells you a lot about what regulators suspect, and the documents they focused on during the search tell you even more. This internal review identifies compliance gaps, assesses exposure, and informs the strategy for engaging with regulators going forward, including whether voluntary self-disclosure or cooperation might be worth pursuing.
Preparation Is What Separates Good Responses From Disasters
The companies that handle raids well prepared before they had any reason to expect one. The core of that preparation is a written response manual, sometimes called a dawn raid playbook, kept in a physical binder at reception and in the hands of every member of the response team. It needs to be rehearsed, ideally through tabletop exercises at least annually.
Designate a standing response team: in-house counsel, an IT lead, a facilities or security contact, and pre-retained external counsel who specializes in regulatory enforcement. Every member’s contact details must be accessible from personal devices, not just the corporate intranet that investigators might restrict during the search. Pre-arrange fee structures and rapid deployment commitments with outside counsel so billing negotiations don’t eat into your first critical hour.
Identify a command center room for the response team to use during a raid. Choose a space unlikely to contain documents relevant to any investigation; a conference room without file cabinets works. Stock it with printed copies of the response manual, independent phone lines, and access to a secure, out-of-band communication channel like an encrypted messaging service set up exclusively for raid response. That separate channel keeps internal coordination off the corporate network that investigators may be monitoring or imaging.
Your IT department needs a current, comprehensive map of every location where corporate data lives: on-premises servers, employee laptops, cloud platforms, collaboration tools, and backup systems. The IT map should distinguish between centrally controlled data and data residing on personal or remote devices. When investigators arrive, the IT team’s job is to secure those systems against unauthorized access or accidental deletion, not to hide anything. The goal is controlled access so you can track exactly what investigators are reviewing and ensure they stay within the scope of their authority.
Finally, train the front line. Receptionists, security guards, and office managers are the people who will meet the investigators first, and their instincts under pressure determine whether the opening minutes go smoothly or spiral. Practicing the four steps (verify ID, direct to waiting area, make no substantive statements, trigger the notification chain) matters more than memorizing them. People under stress revert to what they have physically rehearsed.