When a court orders a search of your team's personal email and devices, you'll need a documented protocol that satisfies legal requirements while preserving attorney-client privilege. Here's a template that addresses compliance requirements established in cases like Washington v. Mass. Dept. of Corrections.
Purpose of the Protocol
This protocol governs counsel-supervised searches of personal email accounts and devices (phones, tablets, laptops) when employees have used them for work-related communications subject to legal hold or discovery obligations.
Use it when:
- A legal hold is triggered and employees conducted business on personal systems
- Discovery requests include personal device communications
- A court orders production of materials from personal accounts
- An internal investigation requires review of employee-owned technology
The protocol ensures attorney oversight, limits scope appropriately, and creates an audit trail demonstrating good-faith compliance.
Prerequisites
Before deploying this protocol, confirm:
Legal Authority: You have a court order, a discovery request, or documented legal hold obligations that justify the search. Generic "we might need this someday" doesn't meet the threshold.
Scope Definition: Identify specific custodians, date ranges, and search terms. The Washington order limited searches to six named individuals, seven search terms, and a nine-month window (November 1, 2019, through August 1, 2020). Your scope should be similarly bounded.
Counsel Availability: Ensure qualified legal counsel (internal or external) can directly supervise the search process. This can't be delegated to IT or records staff alone.
Employee Notice: Custodians must understand their participation is required and that refusal constitutes potential spoliation.
The Protocol Template
PERSONAL DEVICE SEARCH PROTOCOL
1. Custodian Identification
- List each employee by name and role
- Document why you believe work communications exist on personal systems
- Note any prior acknowledgment from the employee about personal device use
2. Search Parameters
- Date Range: [Start date] through [End date]
- Search Terms: [List each term]
- Communication Types: Email, text messages, messaging applications (specify: WhatsApp, Signal, Slack, etc.), cloud storage
- Exclusions: Personal financial records, medical information, communications with the employee's own legal counsel
3. Supervision Requirements
- Lead Attorney: [Name, bar number]
- The attorney or attorney-supervised staff will conduct the search
- The custodian may not self-select responsive materials
- The custodian may be present during the search but cannot determine responsiveness
4. Search Method Choose one:
- Custodian-Assisted Keyword Search: Attorney operates the device while custodian provides access credentials. Attorney applies search terms and reviews results in real-time.
- Forensic Collection with Review: Third-party vendor creates forensic image, attorney reviews collected data in a secure environment, custodian never handles the review process.
- Cloud Export with Counsel Review: Custodian exports data from cloud services (Gmail, iCloud) using native export tools, delivers export file to counsel, counsel reviews.
5. Privilege Screen Before producing to opposing counsel or investigators:
- Attorney reviews all potentially responsive items
- Attorney logs privileged communications
- Attorney redacts or withholds privileged material with log entry
6. Attestation Requirement Each custodian who completes a search signs:
"I, [Name], attest that I provided complete access to my personal [email account/device] for the period [dates]. I conducted a diligent search using the terms [list terms]. I did not delete, modify, or withhold any communications responsive to these terms. I understand that this attestation is made under penalty of perjury."
Signature: _________________ Date: _________
7. Documentation For each custodian, record:
- Date and time of search
- Systems searched (Gmail account, iPhone 12, personal laptop)
- Number of items reviewed
- Number of items collected as responsive
- Supervising attorney name
- Any technical issues or access problems
Customizing the Protocol
Adjust Scope Precision: If your matter involves a narrow dispute (contract negotiation, specific project), tighten the search terms and date range. Broad terms like "company name" will produce massive over-collection from personal devices.
Add Technical Specifications: If you're working with forensic vendors, insert collection standards (hash verification, chain of custody, write-blocking for physical devices).
Scale for Volume: For more than 10 custodians, add a tracking spreadsheet with completion status, attestation receipt date, and production volume per custodian.
Insert Messaging App Details: If your organization uses Slack, Microsoft Teams, or other platforms and employees installed them on personal devices, specify how to export that data (Slack's export API, Teams chat export).
Public vs. Private Sector Considerations: Government entities may need to add public records law compliance steps. Private companies should reference employment agreements and BYOD policies if they exist.
Validation Steps
After executing the protocol:
1. Completeness Check
- Did every identified custodian either complete a search or sign an attestation stating no responsive materials exist?
- Do you have signed attestations on file?
2. Supervision Verification
- Can you demonstrate attorney involvement in each search? (Calendar entries, billing records, vendor invoices showing attorney review time)
- Did any custodian conduct an unsupervised "self-collection"? If yes, that's a problem you need to remedy.
3. Scope Compliance
- Review a sample of collected items. Do they fall within the date range and match the search terms?
- Check for obvious gaps (an email thread that stops mid-conversation, suggesting deletion).
4. Privilege Protection
- Run a secondary keyword search for privilege indicators ("privileged," "attorney-client," law firm names).
- Confirm you logged withheld items.
5. Production Record
- Document what you produced, when, and to whom.
- Retain the original collected set in case of later disputes about completeness.
If you find that an employee deleted work-related communications from a personal device after the legal hold notice, document it immediately and consult counsel about spoliation disclosure obligations. The worst outcome isn't finding a problem; it's finding a problem and not reporting it.
This protocol won't prevent employees from using personal devices for work (that requires a separate policy and enforcement), but it will demonstrate that when you're required to search those devices, you did so with appropriate legal oversight and documented rigor.
