Summary. A subpoena or civil investigative demand arrives without warning and starts several clocks at once. This guide walks the response from the first hour through production and beyond: what to do immediately, including the litigation hold that must issue before anyone reads the demand carefully; how to determine what kind of process you have and what it says about the investigation; scope negotiation, which is expected and productive; collection and production mechanics; privilege review and logging; individual employees who may need separate counsel; parallel proceedings; the cooperation decision; obstruction risk; and what to have done beforehand.

At 4:40 on a Thursday afternoon, two agents hand the receptionist of a 300-employee company an envelope addressed to the custodian of records. Inside is a grand jury subpoena calling for eleven categories of documents, returnable in three weeks.

Within the next ninety minutes, three things will happen at that company, and two of them will be mistakes.

Someone will forward the subpoena to a distribution list of eight executives, creating a discoverable record of the initial reactions. Someone will call the employee whose name appears in category six to ask what it is about, which is a conversation that will be reconstructed under oath. And nobody will suspend the email auto-deletion policy that removes messages older than 90 days, which is running tonight as it does every night.

The third failure is the serious one. Everything else can be managed. Documents that are gone are gone, and their absence will be characterized by someone whose job is to characterize it unfavorably.

The first hour of a government investigation is spent on preservation. Everything else — what it is about, whether the company is a target, whether to cooperate — can be figured out afterward.

The first hour

1. Do not distribute the document widely. Route it to the general counsel or to outside counsel and to a small, defined group. Every email about the subpoena is a document about the subpoena.

2. Issue a litigation hold immediately — before the demand is fully analyzed. The hold should be broader than the demand, because the investigation will be. It must:

  • Identify the subject matter in plain language.
  • Instruct recipients to preserve all documents and communications, in any form, including text messages, chat platforms, personal email used for business, personal devices, notes, and voicemail.
  • Suspend auto-deletion, retention policies, ephemeral messaging, and routine media recycling.
  • Prohibit deletion, alteration, or backdating of anything.
  • Require acknowledgment.
  • Name a contact for questions.

3. Suspend automated destruction at the system level. Do not rely on individual compliance. Email retention rules, chat message expiry, backup rotation, device wipe on separation, and cloud storage lifecycle policies must be turned off centrally, and the IT actions must be documented with timestamps.

4. Preserve the envelope and note the manner of service, the date, and who accepted it. Service defects matter, and the date starts the clock.

5. Engage counsel with experience in the specific agency's practice, and — where the conduct at issue could implicate individuals — begin thinking about whether separate counsel will be needed.

6. Notify insurers. D&O policies commonly cover investigation costs, sometimes from the point of a subpoena and sometimes only from a formal order or a Wells notice. Read the definition of "claim" and give notice in the required form.

7. Say nothing to the agents beyond confirming receipt. Employees are entitled to decline an interview and to have counsel present. That message must be delivered accurately and without any suggestion that anyone should not cooperate — the line between informing employees of their rights and obstructing an investigation is one counsel should draw, in writing.

Identify what you have received

The type of process tells you a great deal about the posture.

Grand jury subpoena (Fed. R. Crim. P. 17) — a criminal investigation. Issued by a prosecutor in the grand jury's name, either duces tecum for documents or ad testificandum for testimony. Grand jury secrecy under Rule 6(e) binds the government, not the recipient — you may generally disclose that you received it, subject to any court order.

Administrative subpoena — issued by an agency under statutory authority without judicial approval. The SEC issues them under a formal order of investigation; the DOJ has authority under specific statutes; HHS-OIG, DOL, and dozens of other agencies have their own.

Civil investigative demand (CID) — a statutory instrument used in civil investigations. The False Claims Act CID, 31 U.S.C. § 3733, can demand documents, interrogatory answers, and oral testimony, and its issuance frequently signals a sealed qui tam complaint. The FTC CID, 15 U.S.C. § 57b-1, and the antitrust CID, 15 U.S.C. § 1312, work similarly. The CFPB issues CIDs under 12 U.S.C. § 5562, which must state the nature of the conduct under investigation and the applicable provisions.

Search warrant — a different emergency entirely, and outside this guide's scope: do not obstruct, ask for and photograph the warrant, note the scope, do not consent to anything beyond it, request a copy of the inventory, assert privilege as to attorney files, and call counsel immediately.

Section 104(e) letter, a Nasdaq or FINRA inquiry, a state attorney general demand, an OSHA or EEOC request, or an IRS summons each have their own procedures and deadlines.

Questions to answer in the first days:

  • Which agency, and which office?
  • What statute authorizes the process?
  • Is there a parallel civil or criminal track?
  • Is the company a target, a subject, or a witness? Ask. Prosecutors frequently answer, and the answer changes the strategy entirely. A target is a person as to whom the prosecutor has substantial evidence linking them to the commission of a crime; a subject is a person whose conduct is within the scope of the investigation; a witness is neither.
  • Are individuals separately subpoenaed?
  • Is there a whistleblower? A CID under the False Claims Act, or an SEC subpoena following a specific and narrow document request, usually means yes.

Negotiate the scope

This is the step companies skip, and it is almost always available.

Contact the issuing attorney promptly, introduce counsel, confirm the return date, and ask to discuss scope. Agencies expect this. Their demands are drafted broadly to avoid missing anything, not because they want everything.

What is negotiable:

  • Custodians — the number of people whose files are searched, and whether a phased approach starting with the most likely custodians is acceptable.
  • Date range — demands often reach back further than the relevant conduct.
  • Search terms — proposing terms with hit reports demonstrating burden is the standard mechanism.
  • Categories — narrowing definitions, dropping categories that plainly do not exist, and clarifying ambiguous ones.
  • Form of production — native versus image, metadata fields, load file specifications.
  • Timing — rolling productions, prioritized categories, and extensions, which are freely given where the recipient is engaging in good faith.
  • Structured data — producing a report or a database extract rather than raw systems.

How to negotiate effectively:

  • Come with information, not objections. Hit counts, custodian counts, gigabyte volumes, and a cost estimate move a conversation that adjectives do not.
  • Propose a phased approach: produce the core categories now, and revisit the rest after the government has reviewed them. Investigators frequently lose interest in the back half of a demand once they have the front half.
  • Confirm every agreement in writing, promptly, in a short letter. Oral understandings about scope evaporate when the line attorney changes.
  • Be candid about what does not exist. Saying "we have no documents responsive to category seven because we did not begin that line of business until 2021" resolves it permanently.

Formal challenges exist and are rarely the right first move:

  • Motion to quash or modify for unreasonable or oppressive process, Fed. R. Crim. P. 17(c)(2), or under the agency's statute. The standard for a grand jury subpoena is deferential — United States v. R. Enterprises, Inc., 498 U.S. 292 (1991), holds that a subpoena is presumed reasonable and the challenger bears the burden of showing no reasonable possibility that the material will produce information relevant to the grand jury's investigation.
  • Petition to set aside or modify a CID, which most statutes permit within a short window — commonly 20 days — and which is generally a prerequisite to later challenging enforcement.
  • Enforcement proceedings, where the agency must show the investigation has a legitimate purpose, the inquiry is relevant, the agency does not already have the information, and administrative steps were followed — the United States v. Powell, 379 U.S. 48 (1964), framework.

Litigating scope is expensive, slow, and signals resistance. Negotiation achieves more in almost every case.

Collect and produce

Identify custodians and sources systematically: the individuals named or implicated; their supervisors and direct reports; assistants; the functional owners of relevant processes; departed employees whose data survives; and shared repositories, structured systems, and third parties holding company data.

Do not forget:

  • Text messages and personal devices used for business, which are now a standard focus and a standard source of adverse inference arguments.
  • Ephemeral and encrypted messaging applications, which agencies have specifically targeted in evaluating cooperation credit.
  • Personal email accounts used for business.
  • Cloud storage and collaboration platforms.
  • Structured data — ERP, CRM, ticketing, and access logs.
  • Legacy systems and backup tapes, which may require restoration.
  • Paper, which still exists and is still overlooked.

Collect forensically where the data may be contested — through a vendor, with documented chain of custody, preserving metadata. Self-collection by custodians is acceptable for low-risk material and is indefensible where the custodian is implicated.

Process and review with a defined protocol: deduplication, threading, search term application, and a first-pass review for responsiveness and privilege. Document the methodology; the government will ask about it, and a defensible process is what makes a later dispute about completeness manageable.

Privilege review.

  • Segregate attorney-client privileged and work product material, and log it.
  • Privilege logs for government productions typically follow civil practice: date, author, recipients, all copy recipients, type, general subject matter, and the basis for the claim. Categorical logs can sometimes be negotiated for large volumes.
  • Beware the crime-fraud exception, and beware that in-house counsel's business advice is not privileged. Communications where counsel is one recipient among many, or where the legal advice is incidental, are frequently found non-privileged.
  • Do not over-designate. An inflated log invites a challenge, wastes the review budget, and damages credibility. A log that claims privilege over a shipping schedule undermines the claim over the memorandum next to it.
  • Consider a clawback agreement and, in civil matters, a Federal Rule of Evidence 502(d) order where a court is involved.

Produce with a cover letter identifying the categories addressed, the custodians and sources searched, the date range, the search methodology, what is being withheld and why, and what remains outstanding with a completion date. Bates number everything and maintain a production log.

Certify carefully. Where a certification of completeness is required, do not sign it until it is true. A knowingly false certification is a separate federal crime, and it converts a document case into an obstruction case.

Individuals, testimony, and the Fifth Amendment

Corporations have no Fifth Amendment privilege, Braswell v. United States, 487 U.S. 99 (1988), and a corporate custodian may not resist producing corporate records on the ground that the act of production would incriminate them personally — though the government may not use the individual act of production against the custodian personally.

Individuals do have the privilege, and it protects the act of production of personal records where the act itself is testimonial — conceding existence, possession, and authenticity, United States v. Hubbell, 530 U.S. 27 (2000).

Separate counsel. Where an employee's individual exposure diverges from the company's, they need their own lawyer. Signals: the employee is separately subpoenaed; the employee is named as a subject or target; the conduct at issue was arguably outside the scope of employment; or the company may need to take a position adverse to the employee.

Company-paid separate counsel is common and usually appropriate, subject to advancement and indemnification obligations under the charter, bylaws, and applicable corporate statute — and subject to the reality that a company's payment of counsel fees does not make that counsel the company's lawyer.

Upjohn warnings are mandatory in every interview counsel conducts with an employee: counsel represents the company, not the employee; the conversation is privileged, but the privilege belongs to the company, which may waive it and disclose the substance to the government; and the employee should keep the conversation confidential. Deliver the warning, document that it was delivered, and note the employee's acknowledgment.

Testimony. For grand jury or CID testimony, prepare the witness on the process and on the substance: tell the truth, answer only the question asked, do not speculate, say you do not recall if you do not, and ask for clarification. Counsel may not accompany a witness into the grand jury room, though the witness may leave to consult. Proffer agreements ("queen for a day") allow a discussion with limited use immunity, and their derivative-use limitations should be understood before anyone accepts one.

Joint defense and common interest agreements among the company and separately represented individuals can preserve privilege across the group — in writing, with a clear scope, and with an understanding that they complicate a later decision to cooperate against a participant.

The internal investigation and the cooperation decision

Investigate in parallel. The company cannot make good decisions about scope, cooperation, or disclosure without knowing what happened. Structure the investigation under counsel for privilege, define its scope in writing, and conduct it quickly enough to stay ahead of the government — which is the entire point.

Deconfliction. Where the government has an active criminal investigation, it may ask the company to defer interviews of specific witnesses so as not to disturb its own sequencing. Cooperating with a deconfliction request is a standard element of cooperation credit; ignoring one is not.

The cooperation decision is the central strategic judgment, and it is not binary. The considerations:

  • What actually happened. A company that has established the facts can make an informed decision. One that has not is guessing.
  • Individual accountability. Under the Justice Department's principles, cooperation credit requires timely disclosure of all relevant, non-privileged facts about the individuals involved. A company that will not identify individuals does not receive credit.
  • Timing. Credit correlates strongly with speed. Voluntary self-disclosure before the government learns of the conduct is worth substantially more than cooperation after a subpoena.
  • Privilege. The Department's stated policy is that a company need not waive attorney-client privilege or work product protection to receive cooperation credit — it must disclose facts, not privileged communications. In practice the line requires careful management, and a waiver as to one subject can be held to waive as to the entire subject matter.
  • Remediation. Discipline of responsible individuals, compensation consequences where available, and demonstrable improvements to compliance controls, tested.
  • Collateral consequences. Debarment, exclusion from federal healthcare programs, license consequences, and follow-on civil litigation frequently exceed the penalty itself.
  • The parallel civil case. Anything produced or said becomes available to private plaintiffs. Positions taken with the government will be used in the civil case, and vice versa.
  • Insurance. Whether investigation costs and any resolution are covered.

Resolution structures range from a declination, to a non-prosecution agreement, to a deferred prosecution agreement with a term and reporting obligations, to a plea, to civil settlement with an administrative agreement — and, on the civil side, to a consent order or a settlement with an agreed compliance program.

Obstruction: what not to do

The investigation frequently becomes less serious than the response to it.

The statutes:

  • 18 U.S.C. § 1519 — knowingly altering, destroying, mutilating, concealing, covering up, falsifying, or making a false entry in any record or document with intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of a federal department or agency, or in relation to or contemplation of any such matter. Twenty years. Note that no proceeding need be pending.
  • 18 U.S.C. § 1512(b) and (c) — witness tampering and corrupt obstruction of an official proceeding. Yates v. United States, 574 U.S. 528 (2015), construed § 1519's "tangible object" narrowly, and Fischer v. United States, 603 U.S. 480 (2024), construed § 1512(c)(2) to require impairment of the availability or integrity of records, documents, or objects used in an official proceeding.
  • 18 U.S.C. § 1001 — false statements to a federal officer, including statements made in an interview that the speaker did not realize was consequential. Five years.
  • 18 U.S.C. § 1503 — influencing or impeding due administration of justice.

Practical rules:

  • Never delete, alter, or backdate anything. Metadata makes it visible, and the attempt is worse than whatever it concealed.
  • Never tell an employee what to say, suggest what they should not remember, or discourage them from speaking with the government. Informing employees of their rights is proper; anything beyond that is dangerous.
  • Never guess in an interview or in a certification. "I don't know" and "I'd have to check" are complete answers.
  • Never let the auto-deletion policy keep running. This is the most common and most damaging failure, and it is invariably characterized as intentional.
  • Never create a document reconstructing events to look better. It will be produced, and its creation date will be visible.

Preparing before it arrives

Companies that handle these matters well have made five decisions in advance.

A defensible document retention policy — written, reasonable, uniformly applied, with a defined suspension mechanism. A policy that deletes email after 90 days is defensible; deleting selectively after a subpoena is not, and the existence of the policy is what makes routine deletion innocent.

A litigation hold capability — a template, a distribution mechanism, an IT runbook for suspending automated deletion, and a person responsible for executing it within hours.

A data map — what systems exist, what they hold, who the custodians are, how long data is retained, and how it is collected. Building this during a three-week return period is why productions are late.

A written response protocol — who is called first, who accepts service, what the receptionist says, what employees are told about their rights, who notifies insurers, and who speaks to the government. Distributed to the people who will actually receive the process.

A messaging application policy. Agencies now examine whether companies permit ephemeral messaging and whether they preserved it. Decide which platforms are approved, configure retention on them, and prohibit business use of the others.

A worked example

Calder Diagnostics, a clinical laboratory, receives a False Claims Act CID demanding documents and interrogatory answers regarding medical necessity and billing for a panel of tests over four years.

Day 1. Counsel engaged. Hold issued to 61 custodians. IT suspends the 180-day email purge, the chat platform's 30-day expiry, and device wipe on separation, with a documented change record. The CID and the manner of service are preserved. D&O and healthcare regulatory carriers noticed.

Day 3. Counsel calls the Assistant United States Attorney. Confirms a four-week extension, learns the investigation focuses on two of the seven test codes, and learns — by asking — that the matter arises from a sealed qui tam complaint. The company is not told the relator's identity, but the narrow scope of category three tells counsel a great deal about who it is.

Week 2. Scope agreement confirmed in writing: 14 custodians rather than 61; a three-year date range; agreed search terms with hit reports; structured billing data produced as a report rather than a database image; and a rolling production schedule with the billing data first.

Weeks 2-8. Internal investigation proceeds in parallel under privilege. Counsel interviews 19 employees with Upjohn warnings documented. Two employees — the former billing manager and a medical director — receive separate counsel at company expense.

Findings. The panel was ordered by a standing protocol that a former medical director implemented and that was not reviewed against payer coverage policies. There was no falsification and no kickback. The billing was consistent with the orders; the orders were not consistently supported by documented medical necessity.

Week 10. Production complete, with a cover letter describing custodians, sources, date range, methodology, withheld material, and a privilege log.

Week 14. The company makes a presentation: the factual findings, the root cause, the individuals involved and their roles, the remediation (protocol retired, coverage policy review process implemented, documentation requirements added to the LIS, training completed, and the responsible individual no longer employed), and a proposed resolution including repayment of the identified overpayment.

Outcome. Civil settlement with single damages plus a modest multiplier, a corporate integrity agreement waived in favor of the company's own compliance enhancements, and no exclusion action. The relator receives a statutory share.

What produced that result: preservation on day one; scope negotiation in week one; an internal investigation that finished before the government's did; identification of individuals; and remediation that was complete rather than promised.

Frequently asked questions

Can we tell people we received a subpoena? Grand jury secrecy binds the government, not the recipient. But limit distribution for practical reasons, and check whether any statute, court order, or the agency's request restricts disclosure — several regimes do.

Do we have to produce everything? You must produce what the demand covers after any negotiated narrowing. You need not produce privileged material, but you must log it.

Can our employees refuse to talk to the agents? Yes. Employees may decline an interview and may have counsel present. Tell them accurately, in writing, and stop there — anything suggesting they should not cooperate risks obstruction.

Should we pay for employees' lawyers? Usually, subject to advancement and indemnification provisions. It is standard, it is generally not viewed as improper, and it produces better-prepared witnesses.

Are we a target? Ask the prosecutor. They frequently answer, and the answer determines strategy.

Should we self-disclose other conduct we found? A separate and consequential decision requiring counsel. The credit for voluntary disclosure is substantial, and the risk of the government finding it later is real.

How long will this take? Months to years. Grand jury investigations commonly run one to three years; agency civil investigations similar.

What does cooperation actually require? Timely disclosure of all relevant facts about individuals, preservation and production including data abroad, deconfliction, and making witnesses available. It does not require waiving privilege as to communications, though the line requires management.

Conclusion

The response to government process is a project with a known structure: preserve, understand, negotiate, investigate, produce, and decide.

The failures that damage companies are almost never substantive. They are a retention policy that kept running for one more night, an executive who called a witness before counsel did, a certification signed before anyone verified it, and a privilege log so inflated that it destroyed the credibility of the claims that mattered.

Preservation buys the time to be strategic about everything else. It is the only step that cannot be done later.

Third-party subpoenas: when the demand is about somebody else

A substantial share of government process is directed at companies that are not under investigation at all. A bank receives a subpoena for a customer's records; a vendor receives one for its dealings with a target; a landlord receives one for a tenant's lease file. The response differs in important ways.

You still preserve. The hold obligation attaches to the material demanded, regardless of who the investigation targets.

Notice to the affected party. Whether you may — or must — tell the subject that their records have been demanded depends on the statute and the instrument.

  • The Right to Financial Privacy Act, 12 U.S.C. §§ 3401-3422, requires a financial institution receiving federal government process for a customer's records to give the customer notice and an opportunity to challenge, unless the government has obtained a delayed-notice order or an exception applies.
  • The Stored Communications Act, 18 U.S.C. §§ 2701-2712, restricts a provider's disclosure of customer communications and records, sets out the process the government must use for each category, and permits non-disclosure orders under § 2705(b) barring notice for a defined period.
  • Many grand jury subpoenas request, but do not command, non-disclosure. A request is not an order. Where the government wants secrecy it can obtain an order, and a recipient asked to keep a subpoena confidential should ask whether an order exists.
  • Contracts frequently impose their own notice obligations — most customer agreements, DPAs, and NDAs require notice of compelled disclosure and cooperation with the counterparty's efforts to quash, subject to any legal prohibition.

Cost recovery. Several statutes and agency practices provide reimbursement for the cost of producing another party's records, and it is worth asking.

Objections belong to whom. The subject's privileges are generally the subject's to assert, not yours. A recipient that produces without notifying a customer who had a right to notice creates its own problem; a recipient that resists on the customer's behalf without authority creates a different one. Give the notice the law requires, produce what the process compels, and let the affected party litigate its own objections.

Employees as third parties. When agents contact employees at home, the company may inform them of their rights and offer counsel. It may not instruct them to decline, monitor whether they spoke, or condition anything on their answer. The safe formulation, delivered in writing: you may speak with them or decline; you may have a lawyer present; the company will provide one if you want it; and tell the truth if you do speak.

Cross-border evidence and foreign data

Where responsive data sits outside the United States, or where a foreign entity holds it, the response acquires a second layer of law.

The CLOUD Act, 18 U.S.C. § 2713, confirms that a US provider must produce data within its possession, custody, or control regardless of where it is stored — resolving the question presented in United States v. Microsoft Corp., 584 U.S. 236 (2018), which was dismissed as moot after the statute's enactment. Storing data abroad does not place it beyond US process.

Blocking statutes and data protection law point the other way. The GDPR restricts transfers of personal data to third countries and requires a lawful basis for processing, and European regulators have taken the position that a foreign authority's demand is not by itself a lawful basis under Article 48 absent an international agreement. France's blocking statute criminalizes providing certain economic information for foreign judicial proceedings outside the Hague Evidence Convention channels, and China, Switzerland, and several other jurisdictions have their own restrictions, including China's Personal Information Protection Law and Data Security Law, which require government approval before providing data to foreign authorities.

How this is actually managed:

  • Raise it early with the issuing attorney. Agencies encounter this constantly and will usually work through it rather than around it.
  • Narrow to US-held data first, and demonstrate what remains.
  • Anonymize or pseudonymize where the investigative need permits.
  • Obtain consent where a lawful basis can be built on it, recognizing that employee consent is disfavored under the GDPR as a basis.
  • Use Article 49 derogations where applicable — establishment, exercise, or defense of legal claims — and document the assessment.
  • Consider whether the agency will proceed through mutual legal assistance or the Hague Evidence Convention, which is slower but resolves the foreign-law problem.
  • Note that Société Nationale Industrielle Aérospatiale v. United States District Court, 482 U.S. 522 (1987), holds that the Hague Convention is not the exclusive means of obtaining evidence abroad, and US courts weigh comity factors — the importance of the documents, the specificity of the request, whether the information originated in the United States, alternative means, and the competing interests of the two states.

Works councils and employee data. In several European jurisdictions, collecting employee mailboxes for an investigation requires works council consultation and employee notice, and skipping it creates exposure independent of the US matter. Build the sequence into the collection plan rather than discovering it after the review platform is loaded.

Related articles

This guide is provided for general informational purposes and does not constitute legal advice. Procedures, deadlines, and challenge mechanisms vary by agency and statute, and the consequences of a misstep are severe. Engage qualified counsel immediately upon receiving government process.