Dawn Raids and Investigations

Home › Cybercrime (in German) › Dawn Raids and Investigations

A search usually catches a company unprepared. Where the allegations involve IT, servers, cloud accounts, laptops and smartphones are quickly at stake, and the business cannot run without them. We support companies during searches and investigations with an IT connection, in particular on securing data, handing over hardware and protecting client and trade secrets. Where criminal defence in the narrower sense is needed, we work with specialist defence lawyers.

What to do during the search

• Stay calm and do not obstruct. Resistance or deleting data makes matters considerably worse.
• Ask for the search warrant and read it: who is the suspect, what is the allegation, which premises and items are covered?
• Call a lawyer and ask the officers to wait for their arrival or allow a phone consultation.
• Appoint one contact person to accompany the officers. Instruct staff not to comment on the matter.
• Make no statement on the substance. Personal details are mandatory; everything else only after access to the file.
• Object to voluntary handover and insist on formal seizure. This preserves your remedies.
• Offer copies instead of originals, such as disk images or cloud exports, so the business can keep running.
• Insist on a complete list of seized items and have any defects noted in the record.
• Keep your own notes: times, names of officers, rooms searched, conversations.

Seizure of hardware and cloud data

The legal bases are Sections 94 et seq. of the German Code of Criminal Procedure (StPO) for seizure and Sections 102 et seq. StPO for searches. Storage media are often not examined on site but taken away for review (Section 110 StPO). Review is not yet seizure: only afterwards does the public prosecutor decide which data is relevant as evidence. Irrelevant data must be returned or deleted. We press for a prompt review limited to the allegations named in the warrant.

Under Section 110(3) StPO, separate storage that can be accessed from the searched device, such as cloud storage, may also be reviewed if the data would otherwise be lost. Where data is held abroad, questions of international jurisdiction and the EU e-Evidence Regulation arise. Prosecutors can also request data directly from cloud providers.

Passwords and unlocking devices

As a suspect you do not have to disclose passwords or PINs; this follows from the privilege against self-incrimination. Witnesses are generally obliged to testify but may rely on rights to refuse. Whether and when investigators may unlock a device using the suspect’s fingerprint by force is a matter of case law and depends on the circumstances. We discuss the approach before any credentials are handed over.

The company as witness or affected party

Many searches are directed not at the company but at employees, customers or unknown persons (Section 103 StPO). The company is then a third party. Instead of a search, a production order under Section 95 StPO may be issued, which can often be pre-empted by an orderly handover of copies. Providers also receive requests for subscriber and traffic data under the Telecommunications Act (TKG) and the TDDDG. If proceedings target senior managers, the company faces a corporate fine under Section 30 of the Administrative Offences Act (OWiG) and confiscation.

Typical IT-related allegations

• Data espionage, interception, handling stolen data and preparatory acts (Sections 202a to 202d StGB), for example after an employee moves to a competitor.
• Computer fraud (Section 263a StGB).
• Data tampering and computer sabotage (Sections 303a, 303b StGB).
• Unlawful exploitation of copyright works (Section 106 UrhG), for example software under-licensing.
• Breach of trade secrets (Section 23 GeschGehG) and unlawful processing of personal data (Section 42 BDSG).

Remedies against search and seizure

A complaint under Section 304 StPO can be lodged against the search warrant, also after the search has ended to establish that it was unlawful. A court decision under Section 98(2) StPO can be sought against the seizure and the manner of the review. The usual aim is the prompt return of hardware and the deletion of irrelevant data.

Frequently asked questions

Do we have to give officers access to our cloud systems?

Suspects are not obliged to cooperate actively. It can still make sense to offer a targeted export so that whole systems are not secured. Agree this with your lawyer.

What about data of clients and professionals bound by secrecy?

Seizure prohibitions under Section 97 StPO and protective rules under Section 160a StPO apply. Point this out expressly during the search and have it recorded.

When will we get the hardware back?

As soon as it is no longer needed for the proceedings. For business-critical devices we apply for release against a forensic copy.

Related topics

• Cybercrime (in German)
• Cyber attack and ransomware
• Trade secrets (in German)
• Data protection
• Software, SaaS and cloud