数据资源的暴力扣押与隐私权

Article
The Journal of Criminal Law

2024, Vol. 88(2) 83–104
The Search and Seizure of Digital © The Author(s) 2024
Materials Under Warrant and Article reuse guidelines:

sagepub.com/journals-permissions
Protecting Privilege: Comparative DOI: 10.1177/00220183231223592

journals.sagepub.com/home/clj
Analysis and Recommendations

for Best Practice
Rebecca Mitchell
Northumbria University, UK
Michael Stockdale
Northumbria University, UK
Francis A. Gilligan
George Washington University Law School, USA
Abstract
Academic literature in England and Wales and New Zealand does not consider the protection
of legal professional privilege where digital material is seized under a search warrant. Academic
literature in the United States does engage with this subject but is not informed by a compara-
tive approach. This article fills both gaps. It examines practices that have been developed by
investigative teams and prosecuting authorities in all three comparator jurisdictions in their
attempts to provide safeguards necessary to preserve privilege. Such practices involve the
use of technology to increase the speed, cost effectiveness and/or efficiency of identifying pri-
vileged documents. The process of developing these practices has been informed by judicial
guidance, where they have been challenged before the courts, and by guidance from govern-
ment departments, Bar Associations or Law Commissions. Following comparative analysis, the
article recommends measures that should be included in legislation, codes of practice or guid-
ance in any jurisdictions where there is potential for legal professional privilege or an equiva-
lent concept to be undermined when digital material is seized under a search warrant.
Keywords
Search warrants, legal professional privilege, attorney-client privilege, digital material, filter
protocols, search technologies
Corresponding author:
Michael Stockdale, Head of Department, Northumbria Law School, Northumbria University, Newcastle upon Tyne, UK.
Email: m.w.stockdale@northumbria.ac.uk
84 The Journal of Criminal Law 88(2)
Introduction
The principles governing the operation of legal professional privilege date back to an era when commu-
nications were made or documented in handwriting. More recently, disclosure of documents in criminal
proceedings related to the time-consuming examination of files of typed paper documents. In the digital
age vast numbers of documents are now both created and saved in digital form. This increases the poten-
tial complexity and cost of disclosure. It also has ramifications for the protection of privileged commu-
nications. In the context of search warrants, huge amounts of digital material1 may be seized with the
danger that privileged material may fall into the hands of investigative teams and prosecuting authorities.
The storage of large quantities of material on devices such as phones, tablets, hard drives, on-site servers
or remote servers is inherently likely to lead to the over-seizing of material, with consequences for the
protection of privileged documents during the sifting process. Legislation concerning the scope of
search warrants makes provision for excluding privileged material from their ambit. It is crucial that prac-
tice both around applications for search warrants (including their drafting and approval) and concerning
the use of technology to search and sift privileged digital material keeps pace with technological devel-
opments relating to the storage and communication of such material.
Statutes authorising the issuance of search warrants in England and Wales, New Zealand and the
United States of America (the United States) do not lay down requirements concerning matters such
as the use of keyword searches to filter privileged material. Practices that have been developed by inves-
tigative teams and prosecuting authorities are relied upon to provide the safeguards necessary to preserve
privilege where search warrants authorise the search and seizure of digital material. The development of
these practices is informed by judicial guidance where their implementation, or attempts to implement
them, have resulted in challenges before the courts. It is also informed by guidance provided by govern-
ment departments (e.g., the Department of Justice [DOJ] in the United States), Bar Associations (e.g., the
Bar Council of England and Wales) or Law Commissions (English and Welsh and New Zealand). Such
practices increasingly involve the use of technology itself to increase the speed, cost effectiveness and/or
efficiency of identifying privileged documents and safeguarding privilege therein.
In this novel and significant article, practices adopted by specific investigative teams and prosecuting
authorities in England and Wales, New Zealand and the United States are compared as exemplars, along-
side guidance provided by the courts, Law Commissions and the DOJ. From this comparative analysis
recommendations are made which, if followed, will reduce the risk that privileged material will fall
into the wrong hands following execution of a search warrant. The analysis takes into account current
limitations of keyword searching and predictive modelling, the necessity of human involvement in the
search process and the importance of using personnel to filter material for privilege who are independent
of the investigative or prosecuting authority. It also recognises that any processes which are adopted must
be realistic and proportionate in terms of time and cost. The topography in this sphere is particularly
complex because regulations and practice frequently lag behind technological developments in the
storage of data in digital form.
The subject matter of this article is not dealt with by legal academic literature in England and Wales or
New Zealand and judicial guidance is extremely limited in those jurisdictions, although both have
attempted to grapple with the challenges through Law Commission consultations and reports. Whilst lit-
erature and judicial guidance are more extensive in the United States, these have not been informed by
comparative methodology. This article fills crucial gaps in the existing academic literature in all three
jurisdictions by dealing with a subject that legal academics in England and Wales and New Zealand
have not tackled and by providing valuable comparative insights which the academic literature in the
United States lacks. The recommendations made in this article will influence knowledge and practice
1. In this article, the terms ‘digital’ and ‘electronic’ are used interchangeably. See, for example, Council of Europe, Electronic
Evidence in Civil and Administrative Proceedings ISBN 978-92-871-8929-5 July 2019 at 13 which indicates that ‘electronic
evidence’ is ‘also known as “digital evidence”…’
Mitchell et al. 85
not only in the three jurisdictions considered but also in any other jurisdictions where there is potential for
legal professional privilege or an equivalent concept to be infringed in the context of search and seizure of
digital material.
The article’s focus is on powers of search and seizure under warrant. There are, of course, instances
where search and seizure may take place outside the warrant process. These are outside the scope of this
piece. Also outside its scope are jurisdictional issues concerning cloud storage of digital material.
Part I of this article considers the terminology of the search warrant and the intersection of search
warrants and electronic material. The latter is described by the English Law Commission in its 2018
report as ‘the area which is in most need of reform’2 because the myriad different search warrant pro-
visions3 largely pre-date the use of electronic devices and the various methods of storing electronic
data.
Part II covers filter protocols and the use of IT teams, independent lawyers, ‘taint teams’ or special
masters to filter out privileged material. It considers these subjects through the lenses of approaches
that have been developed by specific investigative or prosecuting authorities in England and Wales,
New Zealand and the United States.
In Part III, the approaches identified in Part II are compared and contrasted to identify transferable
good practice. Consideration is given to the optimal use of keyword searches, including the issue of key-
words that may reveal privileged information, and the desirability of legislation regulating the choice of
filtering method.
Informed by the comparative research described in the earlier sections, the article concludes with
significant recommendations for key measures that are not jurisdiction specific. The measures recom-
mended are relevant to inform the development or enhancement of legislation, regulations or codes of
practice in any jurisdiction in which there is potential for legal professional privilege (or an equivalent
concept) to be infringed in the context of search and seizure of digital material.
Part I
Drafting the Search Warrant
The execution of a search warrant has the potential to infringe Fourth Amendment rights in the United
States, rights safeguarded under the Human Rights Act 1998 in England and under the Bill of Rights
Act 1990 in New Zealand. There have been Law Commission consultations relating to search warrants,
which have included consideration of electronic and privileged material in New Zealand in 2017 and in
England in 2020. In the United States, the DOJ has issued guidance relating to both searches of computers
and obtaining electronic evidence. Ameliorating the risks of over-seizing leads to consideration of the
optimal manner in which to draft and execute search warrants. The key is to minimise the possibility
that privileged material will inadvertently be disclosed whilst allowing relevant law enforcement agencies
to carry out their functions effectively.
When drafting statutory powers to allow the search and seizure of information held in electronic
format, the terminology used to cover all possible formats and locations of information that are likely
to be searched requires some thought. Harvey notes the difficulties faced by legislators to try and encom-
pass searching and seizing intangible data, which is not at that point in any immediately readable format,
where the ‘ultimate fruit of the search will be the representation of the information in comprehensible
format…’4 The search and seizure process itself is also impacted where digitally stored information is
involved. Kerr noted that, where digital information is involved, the traditional ‘one-step search
2. Law Commission: Search Warrants, Cm 396 (2020) para 14.2.

3. Estimated at 176 by the Law Commission (Ibid, para 14.38).
4. David J Harvey, ‘Here’s the Thing: The Cyber Search Provisions of the Search and Surveillance Act 2012’ (2013) 10 Digital
Evidence and Electronic Signature Law Review 41–42.
process is replaced by a two-step search process’5 because computer hardware will often be seized and
taken off site for data on it to be copied. This copy will then be searched at a later place and time with
relevant material, minus any bookmarked data, handed to the investigating team. This raises a question
relating to the framing of the search warrant and whether the power to search and seize is related to the
device itself (such as the hard drive, tablet and mobile phone) or the information on the relevant device.
As is seen below, this conceptual challenge has been grappled with by the New Zealand Law
Commission and the Law Commission in England, as part of wider consultations on search warrants,
and by the DOJ in the United States. The choice of device or data may also have implications for the
way in which a search takes place and how privileged material is protected.
In general terms in the three jurisdictions considered in this article, search warrants must identify the
place to be searched and must identify the articles to be sought in reasonable detail.6 Drafting a search
warrant where material in electronic form is present gives rise to the choice of specifying whether the
warrant gives the power to search relevant electronic devices at the specified premises/location or
gives the power to search for relevant data at the specified premises/location. A search for devices
involves utilizing the ‘single item theory’.7 This approach and its ramifications have been considered
by both the English and New Zealand Law Commissions. The English Law Commission identified a
line of cases where the electronic device and the data stored on that device are viewed as a single
item, like a book, rather than being viewed as a container of numerous separate items compared to a
filing cabinet.8 This approach allows electronic devices found at the premises specified in the warrant,
such as mobile phones, computers, laptops and iPads, to be searched for and seized, even though each
device is likely to contain a significant amount of irrelevant material. It also avoids having to draft a
warrant which identifies which material on the device is being sought.9 In its 2020 report, the English
Law Commission identified that a warrant to search premises for electronic devices was far more
popular with investigators than a warrant to search and seize data.10
In its 2017 review of the Search and Surveillance Act 2012, the New Zealand Law Commission/
Te Aka Matua o te Ture grappled with issues around the detail required in a warrant where electronic
data and electronic devices are involved.11 The Commission considered provisions in the Search and
Surveillance Act 2012 (the Act) which they regarded as allowing an electronic device to be searched
in the same way as a physical receptacle12 (treating the electronic device like a filing cabinet) with no
requirement for further authorisation. This would be the case where the warrant related to a place or
vehicle rather than a thing and the device was present in that place or vehicle.13 The Commission felt
that this physical receptacle approach to searching devices found in a place or vehicle was no longer
appropriate, primarily because electronic devices can store such significant amounts of data – far
more than any physical object such as a filing cabinet (an issue that had been considered by the
New Zealand Supreme Court in Dotcom v Attorney-General14). The Commission described
the physical receptable approach as ‘outdated’15 and concluded that the statutory powers in the
5. Orin S. Kerr, ‘Search Warrants in an Era of Digital Evidence’ (2005) 75 Miss LJ 85, 87.
6. Police and Criminal Evidence Act 1984, s. 15 (6) (b); Search and Surveillance Act 2012, s. 6 and s.103; U.S. Const. Amend. IV
and Federal Rules of Criminal Procedure, 2021 edition, Rule 41.
7. See Law Commission, above n. 2 at para 14.42.
8. Ibid, para 14.43.
9. Police and Criminal Evidence Act 1984, s. 15 (6) (b) requires that the warrant specify the premises to be searched and ‘so far as
is practicable, the articles or persons to be sought’ s. 15 (6) (a) (iv) and (b).
10. See Law Commission, above n. 2 at paras 14.41 and 14.47.
11. Law Commission/Te Aka Matua o te Ture: Review of the Search and Surveillance Act 2012, NZLC R141 (2017), para 12.44.
13. Ibid, para 12.11. Where the warrant relates to a thing, that thing would have to be described in reasonable detail on the face of
the warrant (Search and Surveillance Act 2012, s. 103).
14. [2014] NZSC 199, paras 191, 192.
15. See Law Commission/Te Aka Matua o te Ture R141, above n. 11. at para 12.55.
Mitchell et al. 87
Act16 should not be seen as permitting an electronic device to be searched where that device is not
identified in the warrant.17 In its report, the English Law Commission suggested changes to clarify
what is permitted under the relevant warrant. In relation to devices, the warrant should first specify
the device to be searched for and seized and secondly should specify the information on the device
that is sought.18
In the United States, the device or data approach depends upon whether probable cause relates to a
device as, for example, an instrumentality of crime, or whether probable cause relates to data on a
device.19 For probable cause to relate to the device itself, it must be more than a container – it must
for example be ‘an instrumentality of the crime’.20 If probable cause relates to information on a
device that may be evidence of crime, the warrant should specify that it is data being seized and what
that data is with some degree of particularity.21 For example identifying ‘records that relate to a particular
crime and to include specific categories of the types of records likely to be found’.22 In considering the
Fourth Amendment protection from unreasonable search and seizure in the context of the huge amount of
data that can be stored in digital form on one device, the focus of the courts’ is ‘more on ‘how’ the agents
carried out the search’ rather than what the warrant allowed agents to search.23 Though such warrants
‘must be examined to determine if they are overly broad’.24
It has been acknowledged that regarding electronic devices as single items does lead to the greater
likelihood of privileged material being seized.25 This likelihood needs to be considered in the context
of the relevant legal framework covering the protection of privileged material which is considered in
detail in Part II.26 Clearly, in certain circumstances, seizing an entire electronic device increases the pos-
sibility of privileged material being seized.
All three jurisdictions recognise the challenges posed by large amounts of data in digital form being
held on one, small, device. The ‘easiest’ approach for investigators, as evidenced in the English Law
Commission report, is likely to be simply to draft the warrant in terms of searching for devices at the
relevant premises rather than specifying what data is being searched for on a particular device. The
English warrant application template27 includes describing what devices are being searched for, although
it doesn’t explicitly cover the information on the device that is being sought. Both the English and New
Zealand Law Commissions have proposed that greater detail should be included in the warrant in terms of
identifying the devices that are to be searched for at the relevant premises. Best practice would suggest
that some detail regarding the information on the device that is being sought should also be included.
Whilst drafting warrants to reduce the risk of unnecessary seizure of devices will reduce the risk that
16. Search and Surveillance Act 2012 s.110 (h).

17. See Law Commission/Te Aka Matua o te Ture R141, above n. 11. at para 12.55. There is some suggestion that s. 110 (h) of the
Search and Surveillance Act 2012 would allow this, see para 12.51.
19. Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations, 3rd edn (Department of
Justice, Office of Legal Education, Executive Office for United States Attorneys: 2009) 70 <https://www.justice.gov/
criminal-ccips/ccips-documents-and-reports> accessed 18 October 2023.
20. Davis v Gracey 111, F.3d, 1472, 1480 (10th Cir. 1997).
21. E.J. Imwinkelried, P.C. Giannelli, F.A. Gilligan, F.I. Lederer, L. Richter, Courtroom Criminal Evidence, 7th edn (LexisNexis:
New York, 2022) paras 19–54.
22. See Department of Justice above n. 19 at 7.
23. Larry Wszalek, ‘Smart Collection When Using a Search Warrant to Seize Voluminous Electronic Evidence: Have a Strategy
and a Plan’ (2020) 68 Dep’t of Just J Fed L & Prac 97, 98.
24. See Imwinkelried et al, above n. 21 at para 19–58.
25. Law Commission Consultation paper 235, 5 June 2018, para 10.24 (2) (c).
26. Police and Criminal Evidence Act, 1984 s.8 (1)(d), (2), s.10, s.19(6). Under s.8, a warrant may be issued provided that there are
reasonable grounds for believing that material on the premises (the subject of the warrant) does not consist of or include items
subject to legal privilege, see Department of Justice above n. 19 at 109.
27. The form can be found at <https://www.gov.uk/government/publications/application-for-search-warrant-under-s8-police-and-
criminal-evidence-act-1984> accessed 23 May 2023.
privileged digital material will be seized, a key issue is the adoption of processes that facilitate the sifting
of privileged information from the material seized without that information being disclosed to investiga-
tors or prosecutors. These issues are considered below.
Part II
Safeguarding Legal Professional Privilege When Seizing and Sifting Digital Material
In evaluating processes for safeguarding legal professional privilege in circumstances in which electronic
material to be seized may include privileged material, the obvious reference point is the rule of law ration-
ale that underpins the existence of legal professional privilege.28 This is reflected in the protection given
to privileged material in each of the three jurisdictions considered in this article. If clients believe that a
likely outcome of such processes is that privileged materials will come into the hands of those tasked with
investigating or prosecuting relevant offences, the risk is that they will be less likely to confide in their
legal advisers. The result is that the rule of law rationale, which regards the obtaining of legal advice as
being in the public interest, will be undermined. Conversely, if such processes are transparent and their
nature is such as to reassure clients that privileged material will not fall into the hands of investigators or
prosecutors, clients should feel able to communicate in confidence with their legal advisers and the pri-
vilege’s rationale will be upheld.
Such safeguarding processes could take a variety of forms. They could be designed to prevent initial
seizure of privileged electronic material or to optimise the sifting of such material after it has been seized.
They might involve different levels of human or machine-based interventions such as the deployment of
non-lawyers (e.g., digital forensics specialists) using search technologies such as keyword search terms.
They might involve the use of independent lawyers at a preliminary stage or at a later sifting stage fol-
lowing initial sifting by others and protection via deployment of ethical walls.
The Position in the English Legal System

In England and Wales, Annex A to The Attorney General’s Guidelines on Disclosure29 provides that,
other than where it is seized under the seize and sift powers created by Part 2 of the Criminal Justice
and Police Act 2001, digital material should not be seized if there are reasonable grounds to believe it
is subject to legal privilege.30 College of Policing guidance indicates that where the presence of privileged
material on premises is anticipated, the search warrant application should make this clear and explain the
safeguards that will be implemented to prevent it being seized, which may involve the instruction of inde-
pendent counsel to attend in an advisory capacity.31 Bar Council guidance recognises that a barrister may
be instructed as independent counsel to attend the search either where investigators believe that there may
be privileged material or because privilege has been claimed.32
28. See Three Rivers District Council and others v Governor and Company of the Bank of England (No 6) [2005] 1 AC 610 per
Lord Scott of Foscote at para 34, referring to A. Zuckerman, Civil Procedure. 1st edn (Lexis Nexis: London, 2003) paras 15.8–
15.10.
29. Attorney General’s Office: Attorney General’s Guidelines on Disclosure (2022). <https://assets.publishing.service.gov.uk/
government/uploads/system/uploads/attachment_data/file/1078194/AG_Guidelines_2022_Revision_Publication_Copy.pdf>
accessed 25 July 2022.
30. Ibid, para A28.
31. College of Policing, Search powers, and obtaining and executing search warrants, first published 23 October 2013, updated 28
April 2020 <https://www.college.police.uk/app/investigation/investigative-strategies/search-powers-and-obtaining-and-
executing-search-warrants> accessed 03 June 2023.
32. ‘Barristers instructed as “Independent Counsel”’, The Bar Council, issued 2010, last reviewed September 2020, <https://www.
barcouncilethics.co.uk/wp-content/uploads/2017/10/LPP-Independent-Counsel-in-relation-to-seized-material-2.pdf> accessed
22 July 2000 at [5], [18] and [21].
Mitchell et al. 89
Where seizure of material which may include privileged material does take place under Part 2 of the
2001 Act (i.e., because it is not reasonably practicable to separate the privileged material from the other
material on the premises33), College of Policing guidance recognises that whilst it is lawful for the officers
to seize the material, it should be examined and separated by independent counsel.34 Annex A to The
Attorney General’s Guidelines on Disclosure provides that privileged material and material which it is
suspected may be privileged (including unanticipated material discovered when reviewing material)
must be isolated from other seized material35 and members of investigative or prosecution teams
should not have access to privileged material.36 If ‘search terms or other filters’ are used to search volu-
minous material for privileged material, this must be ‘done by someone independent and not connected
with the investigation’.37 If material is identified as potentially privileged, there must be a review by ‘a
lawyer independent of the prosecuting authority’.38 Those who deal with privileged material must record
how the privileged material was handled, who had access to it and what decisions were made in relation to
it.39
The element of Annex A that would be most likely to cause concern to clients, on the basis that it might
seem to have potential to undermine the privilege’s rationale, would appear to be the potential involvement
of persons employed by investigative authorities, operating behind ethical walls, in the sifting process. The
exemplar of the Serious Fraud Office (SFO)’s approach is instructive in this regard. In Regina (McKenzie) v
Director of the Serious Fraud Office,40 the process adopted by the SFO was to deploy its own technical
staff, independent of the investigation team, using search terms provided by the owner of the devices or
their legal advisers, to search seized devices for privileged material. The IT staff comprised: a team
which downloaded the material onto a system called Autonomy, with the material being quarantined if
thought to contain privileged content; a second team which applied search terms, with material caught
by the search terms ending up in a specific folder; a third team which had expertise in the Autonomy
system and ensured that the material had been uploaded successfully. The former two teams were internal
to the SFO but were not part of the investigation team, the third team being external to the SFO. Whilst
some members of these IT teams could access the quarantined material to see if material had been uploaded
successfully, this did not involve reading the quarantined material (there was no obvious reason why they
would want to read it unless they wanted to act improperly). The IT process of quarantining material was
followed by review of the quarantined material by an independent lawyer, with the investigation team only
being given access to material that the independent lawyer found not to be privileged. Upon the facts of
McKenzie, the solicitors acting for the owner of the devices asserted that the SFO’s process was unlawful
and refused to provide the search terms that the second IT team needed.
The original 2011 version of Annex A (in the original para 31, a provision that was not replicated in
subsequent versions of Annex A) provided that, to determine whether it is privileged, material may be
examined by ‘a person independent of the investigation’, who may be employed by ‘an investigative
body’ but must not be connected with the relevant investigation.41 The Divisional Court held that
even though the former para 31 had been removed from the 2013 version of Annex A, the process fol-
lowed by the SFO was ‘not inconsistent’ with Annex A and in any event Annex A was not binding on the
SFO.42 More fundamentally, the Divisional Court held that:
33. Criminal Justice and Police Act 2002, s.50(2).

34. See College of Policing, above n. 31.
35. See Attorney-General’s Guidelines, above n. 29 at para A28.
36. Ibid, para A29.
37. Ibid, para A30.
38. Ibid, para A29.
39. Ibid, para A31.
40. [2016] 1 WLR 1308.
41. This was in the former para A31.
42. See McKenzie, above n. 40 per Burnett LJ at para 22.
‘a seizing authority has a duty to devise and operate a system to isolate potential LPP material from bulk mater-
ial lawfully in its possession, which can reasonably be expected to ensure that such material will not be read by
members of the investigative team before it has been reviewed by an independent lawyer to establish whether
privilege exists. That approach to LPP material imports the necessary rigour required by the law for its pro-
tection in this context…’.43
The Divisional Court accepted that ‘[n]o guidelines or processes can provide complete protection
against a deliberate breach of privilege’. It held that there was no requirement that, as a matter of
law, it was necessary for third parties to conduct the preliminary sift of electronic material, indicating
that44
‘[t]here is a world of difference between determining whether something is protected by LPP, which involves
close consideration of the content and context of a document or communication, and identifying a document,
file or communication as potentially attracting LPP, which does not. As is plain from the description of the
system for separating electronic files by the use of search terms there is in fact no need for the electronic
file to be viewed at all’.45
This former process, unlike the latter, will require consideration both of whether the prerequisites of a
valid claim of privilege are satisfied46 and, in appropriate circumstances, of whether the crime-fraud
exception47 is operational.
The court also indicated that guidance should be in place to deal with the situation in which an inves-
tigator inadvertently reads privileged material and that it should make provision for recording and report-
ing of the incident and for prevention of the information being used in the investigation. This might
require removing the investigator who read the material from the investigation.48 These were matters
of which the SFO was aware.49 The court held that the SFO’s process for quarantining material for
review by an independent lawyer was lawful.50
For an approach such as that adopted by the SFO to align with the rule of law rationale rather than
catalyse its erosion, it is necessary for clients to have confidence in the efficacy of the ethical wall put
in place by the investigative authority (including steps put in place to remedy those circumstances in
which privileged information erroneously falls into the hands of an active investigator). It is also neces-
sary for clients to have confidence in the role of the independent lawyer. The best current guidance con-
cerning the nature of this role is that which the Bar Council has for ‘Barristers instructed as “Independent
43. Ibid, para 34.

44. Ibid, para 40.
45. Ibid, para 40.
46. I.e. whether the elements of legal advice privilege or of litigation privilege exist (for a recent exposition of the ambit of the
former see, for example Regina (Jet2.com Ltd) v Civil Aviation Authority v Law Society [2020] QB 1027 and for a recent
exposition of the ambit of the latter see, for example, WH Holding ltd v E20 Stadium LLP [2018] EWCA Civ 2652). In the
US the equivalent would be the elements of the attorney client privilege or of the work product doctrine, which can vary
between different US jurisdiction (see, respectively, for example, Upjohn Co. v. United States, 449 U.S. 383 (1981) and
Federal Rules of Civil Procedure Rule 26(b)(3)(A). In New Zealand it would be the statutory elements (in the Evidence Act
2006) of the privilege for communications with legal advisers (s.53) or of the privilege for preparatory materials for proceedings
(s.56).
47. In English Law, legal professional privilege does not attach to communications made to further criminal, fraudulent or iniqui-
tous conduct (for a recent example see Addlesee v Dentons Europe LLP [2020] EWHC 238 (Ch)). In New Zealand the excep-
tion is codified by s.67(1) of the Evidence Act 2006. In the US, the ambit of the exception differs between different US
jurisdictions (see E.J Imwinkelried, The New Wigmore A Treatise on Evidence, Evidentiary Privileges 4th edn (Wolters
Kluwer: New York, 2022) at para 16.13.2.
48. See McKenzie, above n. 40 per Burnett LJ at para 36.
49. Ibid, paras 8 and 36.
50. Ibid, para 41.
Mitchell et al. 91
Counsel” to advise upon legal professional privilege in relation to seized material’.51 It recognises that
independent counsel may be instructed to perform their functions either when the warrant is executed
or at a later stage, such as when material that has been seized is to be sifted.52 A key element of this guid-
ance (so far as alignment with the rule of law rationale is concerned) is that independent counsel should:
‘ensure that [they] are instructed on the basis that [they] would not be permitted to divulge to the investigators
or those who instruct [them] any information seen by [them] or disclosed to [them] in the course of [their]
duties that is subject to the privilege of someone other than the investigating agency’.53
Another key point is that instructions should indicate whether communications with parties asserting
privilege are permitted.54 If they are permitted, instructions should indicate whether such communica-
tions are confidential between the independent counsel and the party(ies) asserting privilege.55 The inde-
pendent counsel should make clear to the party(ies) whether the communications are or are not
confidential.56 The guidance indicates that instructions to independent counsel may expressly require
them to determine whether the crime/fraud exception to legal professional privilege is applicable.57
Even where instructions do not raise this issue independent counsel should recognise that the issue
may still arise.58 The guidance provides that if counsel is not provided with sufficient information,
they should either refuse to advise on the issue or should provide qualified advice.59
The Law Commission recommended that where digital material is seized under a search warrant its
treatment should be governed by statute accompanied by a Code of Practice.60 It recommended that
statute should require investigators, within a reasonable time frame after seizure, to inform persons
with an interest in the material (if they requested this information) of the following matters. What was
seized, what action was taken on premises regarding electronic devices and how the digital material
will be examined.61 It recommended that statute should require investigators to return devices and
return or delete digital material as soon as reasonably practicable.62 It also recommended that persons
with an interest in digital material should be entitled under statute to apply to a judge to resolve disputes
regarding the investigator’s intended method for examining digital material, the return of electronic
devices or the return or deletion of data.63 The Law Commission did not recommend pre-search proto-
cols, preferring the use of protocols developed post seizure in the context of the other safeguards that it
recommended in its proposed statutory/code of practice regime.64
It was recognised by the Law Commission that investigative agencies require the flexibility to adopt a
process regarding the instruction of independent counsel that works for them in the context of a specific
investigation (e.g., as regards whether independent counsel should be instructed to conduct an ‘on-site
review’ or ‘post-search reviews’).65 It believed, however, that guidance for such agencies to assist
51. ‘Barristers instructed as “Independent Counsel”’, The Bar Council, issued 2010, last reviewed September 2020, <https://www.
barcouncilethics.co.uk/wp-content/uploads/2017/10/LPP-Independent-Counsel-in-relation-to-seized-material-2.pdf> accessed
22 July 2000.
52. Ibid, para 5.
53. Ibid, para 15.
54. Ibid, para 17.
55. Ibid.
56. Ibid.
57. Ibid, para 26.
58. Ibid.
59. Ibid.
61. Ibid.
62. Ibid.
63. Ibid.
64. Ibid, paras 15.74–15.82.
65. Ibid, para 11.26.
them in tailoring instructions to independent counsel to meet the needs of a specific investigation should
be incorporated in ‘a new Code of Practice governing investigations involving electronic material’.66 It
recognised that ‘[i]n modern, document-heavy criminal investigations’ material will mostly be electronic
and where hard copy material is seized the likelihood is that it will be scanned and uploaded to be
reviewed electronically.67
Concerning the overall content of the new Code of Practice, the Law Commission, whilst not intend-
ing to prescribe its overall content, recommended that the guidance it provided (which could be updated
as technology and digital forensics methods changed) should include the following matters. Integrity of
evidence and chain of custody, cooperation between investigators and defence teams, resolving disputes
out of court, applying for warrants for digital material, the conduct of searches, the formulation of post-
search protocols, examining devices and the instruction of independent counsel.68
Unlike the position in New Zealand, the current English statutory regime does not contain any specific
additional safeguards where a warrant is issued to search a lawyer’s premises. The application for search
warrant form, at 3(e), provides that where material (stored electronically or otherwise) may consist of or
include privileged material, the applicant must specify the arrangements that will be made to sift the
material.69 Clearly, a warrant to search lawyer’s premises will inherently fall within this category and
the warrant will therefore have to contain very clear provisions regarding safeguarding privileged mater-
ial. The Law Commission did not consider a specific regime for searches of legal premises in either its
consultation or its report.
In order to identify current good practice from English Law regarding the treatment of potentially pri-
vileged digital material seized under a search warrant, it has been necessary to consider a number of
sources: the Attorney-General’s Guidelines, the guidance provided by the Divisional Court in
McKenzie and the practices adopted by the SFO to which it refers, the College of Policing’s guidance
and the guidance provided by the Bar Council. The production of a Code of Practice, as recommended
by the Law Commission, could bring current good practice from England and Wales and that identified
from other jurisdictions together in one place, providing clear and valuable guidance for investigators and
prosecutors.
The Position in New Zealand

In New Zealand, the Search and Surveillance Act 2012, ss.142–147, cover the effect of privilege on
search warrants and search powers. One of the stated purposes of the Act was to modernise the law to
take account of technological advances relevant to search and surveillance.70 Legal professional privilege
is recognised in s.136. In New Zealand, there is a differential regime where searches of lawyers’ premises
or material held by lawyers is concerned,71 in that a search warrant may not be executed unless the lawyer
holding the privileged material (or their representative) is present. Prior to the search taking place, the
lawyer must have the opportunity to claim privilege on behalf of the client. The provisions applying
to searches other than of a lawyers premises/of material held by a lawyer require that a reasonable oppor-
tunity to claim privilege must be given if, having exercised a search warrant, there are ‘reasonable
grounds to believe that anything discovered in the search may be the subject of a privilege …’.72
Provisions relating to copying and securing intangible material are found at section 146 of the Act,
66. Ibid, para 11.27.

67. Ibid, para 11.33.
68. Ibid, paras 11.28, 15.78, 17.150, 17.151 and 17.152.
69. The form can be found at <https://www.gov.uk/government/publications/application-for-search-warrant-under-s8-police-and-
criminal-evidence-act-1984> accessed 23 May 2023.
70. Search and Surveillance Act 2012, s. 5 (a)
71. Search and Surveillance Act 2012, s. 143.
72. Search and Surveillance Act 2012, s. 145 (1) (b).
Mitchell et al. 93
including the process for involving the court to determine a claim of privilege. There are also require-
ments to detail any claims of privilege by provision of a particularised list.73
The New Zealand Law Commission has considered whether additional special procedures ought to be
in place in circumstances where computers are being searched, whether at a lawyer’s premises or through
remote access. For example, whether an independent expert should search any forensically copied mater-
ial, perhaps under the supervision of a judge or independent lawyer. The Commission concluded that
such additional measures were not necessary, because forensic copying does not involve any disclosure
of the copied material and because the measures proposed to preserve privilege (as outlined above) will
be equally efficacious during a search of a forensic copy.74 The latter would require that the lawyer is
given the opportunity to assert privilege prior to the search taking place, although at this point the material
may no longer be at the lawyer’s premises. If the warrant relates to material held by a non-lawyer, it can
be executed without that person being given an opportunity to claim privilege and in fact without that
person being present. For a forensic copy of intangible material, this therefore means that the copy
can be searched without there being any opportunity to claim privilege, until such time as the person con-
ducting the search has reasonable grounds to believe that material discovered might be subject to
privilege.
The difficulties presented by computer searches conducted by an enforcement agency, where physical
separation of intangible privileged material risks the integrity of the data, was considered by the Law
Commission.75 The Commission did not favour the use of an independent computer expert. The expertise
of enforcement agencies in computer searches, the risk to the integrity of an investigation of clandestine
searches of privileged material and the benefits of the search being conducted by a person with consid-
erable knowledge of the investigation were all considered to mitigate against recommending the use of
independent experts.76 Also considered but discarded was the requirement for an initial inspection of a
lawyer’s computer (preliminary screening), simply to identify relevant evidential material without further
inspection and then determine any claims for privilege over only this material, as a means of reducing the
scope of the search and the amount of material accessed. Again, the opportunity to assert privilege prior to
any search taking place was deemed to be a better approach than this, although there was a suggestion that
computer searches could take place in stages, with the lawyer having the opportunity to claim privilege at
each stage.77
In its subsequent issues paper in 2016, Review of the Search and Surveillance Act 2012, the
Commission identified the use of digital forensic units within enforcement agencies. These units are
used where searches deal with large amounts of digital material, to capture and search this material,
sending relevant material to investigators and ensuring that privileged material is not sent to investiga-
tors.78 It noted in relation to the requirement on the person claiming privilege to provide a particularised
list that in the context of digital material the practice was often, via discussion with the owner of the
material, to produce a customised plan to identify and isolate privileged material.79 This could include
provision of search terms by the owner of the material, a lawyer for one of the parties identifying the
materials of use to an independent lawyer or appointing an independent person to identify the material.80
The exemplar of procedures adopted by the Inland Revenue Department is valuable and the
Commission paid particular attention to them.81 The Inland Revenue Department has a Digital
73. Search and Surveillance Act 2012, s. 147.

74. Law Commission/Te Aka Matua o te Ture: Search and Surveillance Powers, NZLC R97 (2007) paras 12.95–12.99.
75. Ibid, para 12.100.
76. Ibid, paras 12.101–12.103.
77. Ibid, paras 12.105–12.106.
78. Law Commission/Te Aka Matua o te Ture: Review of the Search and Surveillance Act 2012, NZLC IP40 (2016) para 6.16.
80. Ibid, 6.36.
81. Ibid, paras 6.37–6.38.
Forensics Unit (DFU) comprising computer forensics staff that operates independently from the investi-
gators.82 Normally the DFU will access, search and copy digital material but where the DFU cannot
attend on site either external staff will be contracted in or investigators will remove the devices (main-
taining a clear custody chain) for delivery to the DFU.83 The DFU does not release electronically
stored documents to the investigators until the owner of the material has had an opportunity to seek
legal advice and make particularised claims, the owner of the material being entitled to provide the
DFU with keywords for use in identifying privileged documents.84 If documents are identified via this
key word search process the owner of the material is then given an opportunity to claim privilege in
them,85 which in the case of a dispute between the person claiming privilege and the Commissioner
may ultimately end up before a district judge.86 The Commission recognised that DFU’s keep a
record of the search procedure followed during a search, but did not know whether enforcement agencies
lacking a DFU followed the same practice. It suggested that this practice could be required by statute.87 It
made other suggestions as follows. Statute could require the ‘issuing officer’88 to consider whether con-
ditions should be imposed on a search warrant for the purposes of restricting how much irrelevant mater-
ial is viewed and ‘preventing investigators from seeing privileged material’.89 Conditions regarding the
treatment of digital material could impose processes similar to the procedure followed by the Inland
Revenue Department.90 And legislation could provide that persons searching digital material should
‘take all reasonable steps to avoid seeing’ privileged material91 (though it believed that the DFU
process already achieved this goal).92
Good practice on the part of the Inland Revenue Department’s DFU as identified by the New Zealand
Law Commission seems largely to align with that adopted by the SFO in England and Wales in utilising a
technical team independent of the investigatory team to access, search, copy and sift digital material,
including cooperation with the privilege holders in devising keyword searches. The main difference
appears to be the use of an independent lawyer to review the quarantined material in England and
Wales, with a judge being relied on to resolve privilege disputes in New Zealand.
The Position in the United States

The issue of how to protect legal professional privilege when material is seized under a search warrant is
one which has produced much higher volumes of academic debate and judicial comment in the United
States than has been the case in England and Wales or New Zealand. The American courts are divided as
to how to protect privileged information seized during the execution of a search warrant. In the past most
courts routinely approved the use of taint teams (also known as filter teams or privilege teams), comprised
of prosecutors and agents not involved in the pending case, to review the seized materials and identify
unprivileged materials to be turned over to the prosecutors in the case. They are often used when
large quantities of electronically stored documents are seized.93 Apart from conducting privilege
82. Inland Revenue Department Operational Statement: The Commissioner of Inland Revenue’s Search Powers (OS 13/01,
September 2013) para 107.
83. Ibid, paras 107–108.
84. Ibid, para136.
85. See Law Commission/Te Aka Matua o te Ture NZLC IP40 above n. 78 at para 6.38.
86. See Inland Revenue Department Operational Statement above n. 82 at para 139.
87. See Law Commission/Te Aka Matua o te Ture NZLC IP40 above n. 78 at paras 6.42–6.44.
88. The judge or other person authorised to issue a search warrant (see the Search and Surveillance Act 2012 s. 3(1)).
89. See Law Commission/Te Aka Matua o te Ture NZLC IP40 above n. 78 at para 6.45.
93. Edward S Adams, ‘When Taint Teams Go Awry: Laundering Unconstitutional Violations of the Fourth Amendment’ (2023) 75
Ark L Rev 753, 755.
Mitchell et al. 95
reviews, filter teams can also be used to conduct searches on premises where there may be privileged
material (e.g., where lawyers are located), interview witness (such as lawyers) who may reveal privileged
information, examine covert recordings that may reveal privileged information, liaise with the defense
regarding the treatment of potentially privileged material and litigate issues of privilege.94 Best practice
as regards the use of filter team personnel at the search stage is to assign a filter agent, with a filter attorney
also available to be contacted, in the context of a search where potentially privileged material is reason-
ably likely to be present.95
The use of a privilege team is one of three options identified in the Justice Manual where the premises
of an attorney who is a subject of an investigation are searched.96 Today many courts are suspicious of
taint teams. These courts believe that there is a risk to the privilege – trusting a taint team comprised of
prosecutors is like allowing the fox to watch the ‘henhouse’.97 That concern certainly has merit; psycho-
logical research has underscored the effect that even subconscious bias can have on decision-making in
the criminal justice system.98 Even if at a conscious level a prosecutor or a taint team member strikes
mightily to make an objective, impartial, decision, at a subconscious level he or she may be tempted
to find that a particularly damning letter or email is unprivileged. Other dangers include ‘vague proce-
dures’ that allow documents to ‘fall through the cracks’ and ‘intentional misconduct’.99
Fundamentally, ‘the taint team and prosecution team are in the same organization, report to the same
leaders, and often share the same goals’.100 Department of Justice guidelines provide that:
[w]hen agents seize a computer that contains legally privileged files, a trustworthy third party must examine
the computer to determine which files contain privileged material. After reviewing the files, the third party will
offer those files that are not privileged to the prosecution team. Preferred practices for determining who will
comb through the files vary widely among different courts.101
The guidelines102 recognise that whilst there is a wide degree of variation between different courts as
regards the practices that are adopted, the three main variants are: an in camera review by the court
itself;103 the appointment by the court of a ‘special master’ to conduct the review; or the formation of
a ‘taint team’ or ‘filter team’104 to conduct the review. The guidelines105 indicate that the taint/filter
team is ‘a team of prosecutors or agents who are not working on the case’ which establishes an
94. Lindita V. Ciko Torza & Timothy J. Coley, ‘The Special Matters Unit: Best Practices for Addressing Attorney-Client Privilege
Issues’ (2022) 70 Dep’t of Just J Fed L & Prac 29, 34.
95. Ibid, 41.
96. US Department of Justice, Searches of Premises of Subject Attorneys 9-13.420 <https://www.justice.gov/jm/jm-9-13000-
obtaining-evidence#9-13.420> The other two options are a judicial officer or a special master.
97. In re Grand Jury Subpoenas (04-124-03 and 04-124-05), 454 F.3d 511, 523 (6th Cir. 2006); Steven J. Enwright, ‘The
Department of Justice Guidelines to Law Office Searches: The Need to Replace the “Trojan Horse” Privilege Teams with
Neutral Review’, (1997) 43 Wayne L. Rev. 1855, 1858 (‘[T]he privilege [taint] team is a prosecutorial `Trojan Horse’ that
undermines the attorney-client privilege.’).
98. Itiel Dror, ‘Meta-analytically Quantifying the Reliability and Biasability of Forensic Experts’, (2008) 53 J. Forensic Sci. 900;
Paul Giannelli, Scientific Evidence: Confirmation Bias’, (2007) 22 Crim. Just. 61.
99. See Edward above n. 93 at 757.
100. Ibid.
101. See Department of Justice above n. 19 at 110.
102. Ibid.
103. See Steven J. Enwright, ‘The Department of Justice Guidelines to Law Office Searches: The Need to Replace the “Trojan
Horse” Privilege Teams with Neutral Review’, (1997) 43 Wayne L. Rev. 1855, 1858–59. (‘This Note specifically concludes
that a neutral Special Master should be on-sight to assist the federal agents conducting a law office search and should seal all
arguably privileged material and bring it directly to a Magistrate for an in camera privilege determination.’)
104. Now described in the Justice Manual as a privilege team. See, for example, US Department of Justice, Searches of Premises of
Subject Attorneys 9-13.420 <https://www.justice.gov/jm/jm-9-13000-obtaining-evidence#9-13.420>
105. See Department of Justice above n.19 at 110.
<https://www.justice.gov/criminal-ccips/ccips-documents-and-reports> accessed 8 November 2021.
‘“ethical wall” between the evidence and the prosecution team, permitting only unprivileged files to pass
over the wall’106. The methods a filter team may use to filter material that may be privileged include
keyword searches.107 If a filter team is required to review material to which the crime fraud exception
to privilege may apply, when considering whether the exception may be applicable ‘[i]t is beneficial if
the filter team can become familiar with the prosecution team’s theory of the fraud’.108
A special master has been described as ‘a disinterested third party [who] could be anyone from a judi-
cial officer, an attorney, a law professor, to a former attorney for the DOJ’ and other examples have
included ‘a former judge’ and ‘a United States Magistrate Judge’, both appointed as special
masters.109 Frohock suggested that ‘When available, a judge or Special Master provides the advantage,
at least on optics, of a knowledgeable and neutral eye, bringing independence from outside the executive
branch’.110
As an exemplar of the approach to filtering privileged material in the United States, the DOJ’s
Criminal Division now has a Special Matters Unit (SMU) which has developed procedures to allow oper-
ation across Federal districts. Before considering the processes followed by the SMU, it is first important
to consider recent judicial restrictions on the use and operation of taint teams as the SMU’s processes are
intended to take account of such case law. In particular, two recent federal decisions – one from Court of
Appeals for the Fourth Circuit and another from the Eleventh Circuit – have called past practice concern-
ing the use of taint teams into question and recognised that when they are used ‘exacting requirements’111
need to be satisfied. The first, but not the second, concerned a search of lawyers’ premises.
The Fourth Circuit opinion, In re: Search Warrant Issued June 13, 2019,112 provides a road map for
lawyers who are faced with the use of a filter team. The case concerned an allegation that Lawyer A (a
partner in a twenty-partner law firm) had assisted drug dealers with criminal activities such that the crime-
fraud exception was applicable. An Internal Revenue Service (IRS) agent obtained a warrant to search the
relevant law firm’s offices. The warrant was obtained at an ex parte hearing in which the defense could
not participate. The warrant authorised a filter team, which was not involved with the investigation, and
included lawyers from another U.S. Attorney’s office, a legal assistant and a paralegal who also worked
there, agents of the IRS and of the Drug Enforcement Administration, and forensic examiners.
The process, proposed by the government in a Filter Protocol attached to the warrant application and
approved by the magistrate judge, allowed the filter team to determine, in the first instance, which materi-
als were potentially privileged and which were not. It permitted the team to turn over to the investigative
team those documents which it identified as non-privileged without any court determination. If the filter
team identified documents as privileged and ‘responsive to the search warrant’ it was required to categor-
ise them as: incapable of redaction; capable of redaction; or potentially privileged (e.g., where the crime-
fraud exception might be applicable). In relation to the latter two categories, if agreement could not be
reached with Lawyer A’s counsel, the matter would be determined by the court. If the client waived priv-
ilege, the documents could be given to the prosecution team without additional review.
106. See Teri J. Dobbins, ‘Great (and Reasonable) Expectations: Fourth Amendment Protection for Attorney-Client,
Communications’, (2008) 32 Seattle Univ. L. R. 35, 65–66 (discussing subpoena to turn documents over to the court or
the use of ‘taint’ team under rules of procedure to protect privileged information).
107. John Kosmidis & Jerrob Duffy, ’Crime-Fraud Litigation in White-Collar Prosecutions’ (2022) 70 Dep’t of Just J Fed L & Prac
17, 19.
108. Ibid.
109. Ellen S. Podgor; Wilma F. Metcalf, ‘“The Fox Guarding the Henhouse:” Government Review of Attorney-Client Privileged
Material in White Collar Cases’ (2023) Boston University Law Review, Forthcoming. 59 Pages Posted: 26 Apr 2022 Last
revised: 30 Jan 2023 at p 126 at fn 166. <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4087032> accessed 17/10/
October 2023.
110. Christina M. Frohock, ‘Special Matters: Filtering Privileged Materials in Federal Prosecutions’ (2021) 49 Am J Crim L 63, 70.
111. In re Sealed Search Warrant and Application for a Warrant by Telephone or Other Reliable Electronic Means 11 F.4th 1235
(11th Cir. 2021) at 1252.
112. 942 F.3d 159 (4th Cir. 2019).
Mitchell et al. 97
In executing the search warrant, the agents seized emails to Client A, and about 50,000 other emails.
Many of these related to other clients and attorneys. The law firm applied for a preliminary injunction,
which was granted on appeal. In the course of explaining its decision, the court identified a number of
errors that the magistrate judge had made when approving the filter team and the Filter Protocol. The
authorisation of the filter team and Filter Protocol by the magistrate judge had delegated a judicial func-
tion to the executive. This was compounded both by the fact that non-lawyers such as agents and para-
legals were authorised to categorise documents as non-privileged and the risk that filter teams might make
errors of judgement both in privilege determinations and in the transmission of privileged material.
The authorisation of the filter team via an ex parte hearing prior to the warrant being executed meant
that the magistrate judge had not been fully informed when he made his decision. For example, the timing
issue meant that the judge could not have known that only a tiny percentage of the emails seized was from
or to client A (with many concerning other clients). And had the hearing been adversarial, the magistrate
judge would have known more about the law firm, the firm’s clients and the seized materials.
In contrast to the flawed procedures employed by the magistrate judge, the court endorsed the ‘sens-
ible’113 procedures used in another case,114 when agents searched the law office of Michael Cohen. In
Cohen, adversarial proceedings re the proposed filter team had taken place four days after the materials
were seized and prior to their review by the filter team. Rather than authorising the filter team the court
appointed a special master. The procedures followed in Cohen had the following consequences.115 No
seized items were reviewed by Executive Branch personnel prior to a privilege review being conducted.
The court appointed a special master, a retired United States District Judge, to perform the privilege
review. Relevant clients were allowed to intervene and participate in the privilege review process. The
seized items were provided to the lawyer and relevant clients, who were given an opportunity to mark
items as potentially privileged and/or ‘highly personal’. Items not marked as potentially privileged by
the lawyer or relevant client(s) were provided to the Executive Branch. Items marked as potentially pri-
vileged or otherwise confidential were reviewed by the special master. The special master regularly con-
ferred with the lawyer and relevant client(s) about the proper designation for items as to which she had
questions or required further argument. The special master provided written reports and recommenda-
tions to the court on a rolling basis regarding the special master’s proposed privilege determinations.
The lawyer and relevant client(s) had an opportunity to object in writing to the special master’s
reports and recommendations. And the court conducted an independent review of the reports and recom-
mendations and the documents in question before issuing any rulings on the privilege determinations.116
The Fourth Circuit also identified a failure on the part of the magistrate judge and of the district court to
‘explicitly weigh those foundational principles that protect attorney-client relationships’,117 with the
result that ‘the Filter Protocol authorized government agents and prosecutors to rummage through
Lawyer A’s email files’, many of which ‘concerned other clients and other matters’.118 The court did
not totally preclude the use of filter teams. Rather, it issued a more limited ruling that under the circum-
stances the filter team and protocol were improper.119
113. Ibid, 179.

114. Cohen v. United States, No. 1:18-mj-03161, 2018 WL 1772209 (S.D.N.Y. Apr. 13, 2018), ECF No. 6 at 4, 25, United States
v. Seal (In re Search Warrant Issued June 13, 2019), 942 F.3d 159, 179 (4th Cir. 2019).
115. Elliot Abrams, ‘A Road Map for Lawyers and Law Firms Responding to Searches, Seizures, and Subpoena of Client Files’,
(2020) 44 Champion 22, 26.
116. Ibid.
117. 942 F.3d 159 (4th Cir. 2019) at 180.
118. Ibid, 179.
119. In re Search Warrants Executed on April 28, 2021 U.S. Dist. LEXIS 101348, at *4 n.3 (S.D.N.Y. May 28, 2021) (‘[I]t did not
hold that the Government’s use of a filter team is categorically inappropriate’.). See also In re Sealed Search Warrant &
Application for a Warrant, 2020 U.S. Dist. LEXIS 174542 (S.D. Fla. Sept. 23, 2021); United States v. Keleher, 2021 U.S.
Dist. LEXIS 17345, at *12 (D.P.R. Jan. 28, 2021) (‘District courts in this circuit have held that ex ante restrictions in a
warrant [such at taint team] on how law enforcement may search an email account are not required’); Harbor Healthcare
In contrast to a law office search, the Eleventh Circuit Decision in In re Sealed Search Warrant and
Application for a Warrant by Telephone or Other Reliable Electronic Means120 involved the search of a
suite of family businesses. The items seized included the documents of in house counsel. The search
warrant authorised, inter alia, the seizure of emails and imaging or copying of computers or other
storage media. The Filter Protocol required that if communications with an attorney were identified by
the Government, the investigative team would cease its review until a filter team (of government attor-
neys and agents who were not involved in the investigation) had segregated communications to which the
attorney-client privilege might attach. The filter team would pass on non-privileged communications to
the investigative team but would not inform it of the content of communications with an attorney. If it
decided that communications with an attorney were not privileged, it could only pass them on if it
obtained a court order.
After the search, the owners, managers and controllers (collectively, the ‘Intervenors’) sought injunct-
ive relief to prevent the filter team from reviewing communications that might be privileged unless the
intervenors agreed, or the court reviewed them for privilege and ordered their disclosure. In the district
court, the magistrate judge imposed what is described throughout the Eleventh Circuit’s decision as a
‘Modified Filter-Team Protocol’. Under this Modified Protocol, the initial privilege review was to be
carried out by the Intervenors, who would identify communications in which privilege was asserted in
a ‘privilege log’ and release to the investigative team items which were not privileged. The filter team
could not contain staff from the branch office that was conducting the investigation, it could not share
a ‘first level supervisor’ with any investigation or prosecution team members and filter team supervisors
were to be ‘walled off’ from the investigation. The filter team could review items in the privilege log and
challenge the Intervenors’ assertions of privilege. The filter team and Intervenors would liaise to try to
resolve such challenges. In the absence of resolution, a dispute would be resolved by a ruling from
the court or a special master. The filter team would release communications to the investigative team
if the parties agreed or privilege was overruled by the court.
On appeal, the Eleventh Circuit, in upholding the Modified Protocol, recognised that, under it, the
Intervenors were entitled to carry out the initial privilege review and that the filter team could not inad-
vertently release privileged communications because either the Intervenors permission or that of the court
was required before allegedly privileged documents could be released. It gave three reasons for approving
the Modified Protocol. First, some other circuits had approved the use of filter teams. Secondly, no
authority had been identified for the Intervenors’ proposition that review by government agents of
allegedly privileged communications should never take place until a court had determined whether
they were privileged. Thirdly, the Modified Protocol did not exhibit any of the defects that had resulted
in specific protocols being disapproved by other courts.
In deciding that the Modified Protocol ‘compl[ies] with even the most exacting requirements other
courts that have considered such protocols have deemed appropriate’, the court distinguished the position
in In re: Search Warrant Issued June 13, 2019121 in which, as was seen above, the Fourth Circuit had not
approved a Filter Protocol. In the case before the Eleventh Circuit, an adversarial hearing had taken place
before the Modified Protocol was implemented. There was no suggestion that the bulk of the privileged
communications seized was irrelevant to the client under investigation. And, rather than delegating judi-
cial functions to the Executive, initial privilege review was conducted by the Intervenors with allegedly
privileged communications only released to the investigative team if the Intervenors agreed or the court
so ruled.
Sys., L.P. v. United States, 2021 U.S. App. LEXIS 20988, at *12 (5th Cir. July 15, 2021) (‘A taint team serves no practical
effect if the government refuses to destroy or return the copies of documents that the taint team has identified as privileged’.).
120. 11 F.4th 1235 (11th Cir. 2021).
121. 942 F.3d 159 (4th Cir. 2019).
Mitchell et al. 99
In the United States, ‘[t]here is no uniform, nationwide standard for conducting filter reviews, and
there is no one size-fits-all protocol that a filter team should follow’.122 The DOJ’s Criminal Division
now has its SMU, ‘an independent, specialized, in-house filter team’, established in 2020.123 Taking
into account recent case law concerning the use of taint teams, it has developed procedures which are
intended to be applicable across multiple Federal districts.124 In relation to digital evidence which
may include privileged material, its ‘“Attachment B” template’, which is included in search warrant
applications, articulates the following process.125 The SMU ‘will conduct an electronic review of the
data’ using ‘privilege search terms’, compiled ‘in consultation with the search team’, which ‘include spe-
cific names and generic words intended to identify potentially privileged information’.126 If this process
identifies material as ‘not potentially privileged’ it may be ‘released to the search team’ whereas where it
identifies material as ‘potentially privileged’ it is segregated for review by an SMU lawyer who deter-
mines whether or not it is ‘potentially privileged’.127 If the lawyer determines that it is not it may be
released whereas if it is the lawyer has three options. First, make an ex parte application to the court
for a determination.128 Secondly, defer making such an application and ‘segregate the documents in a
manner that makes them inaccessible to the search team’.129 Thirdly, disclose them to the party entitled
to claim privilege, requesting a privilege log if privilege is asserted and apply to the court for a ruling if an
agreement is not forthcoming.130 In the course of the filter process, the SMU does engage with privilege
holders ‘where practicable’ and in ‘many cases’ the protocols are agreed by the privilege holder or
approved by the court.131 This process was designed to deal with criticisms made by the courts in
cases such as In re Search Warrant.132
The SMU has been criticised on the basis that it is integral to the investigative and prosecuting author-
ity and works with the search team.133 Frohock argues that whether or not the Unit ‘makes sense’ depends
on whether prosecutions are adversarial or quasi-adversarial.134 It makes sense to Frohock (and proceed-
ings are better categorised as quasi-adversarial) if prosecutors, seeking ‘justice rather than convictions’
are ‘cast as ministers of justice’.135 If they are not so cast (and proceedings are better categorised as adver-
sarial) then, Frohock asserts, ‘every in-house privilege strategy rings hollow’.136
Even if prosecutors do strive to act as ministers of justice, this does not remove the possibilities, iden-
tified above, of subconscious bias in decision making or of procedural defects that result in unintended
disclosure. More fundamentally, it does not remove the likelihood that privilege holders will assume that
prosecutors will not act as ministers of justice, thus undermining the privilege’s rationale if it results in
reluctance to take legal advice. The practices adopted by the SMU and the approach of the Courts in the
two US cases considered above are compared in Part 3 to those that were identified above from England
and Wales and New Zealand.
122. See Lindita above n. 94 at 34.

123. Ibid, 30.
124. Ibid, 34.
125. Ibid, 35.
126. Ibid.
127. Ibid.
128. Ibid.
129. Ibid.
130. Ibid.
131. Ibid, 36.
132. Ibid.
134. See Frohock above n. 110 at 87.
135. Ibid, 90, 93.
136. Ibid, 90.
Part 3 Identifying Transferable Good Practice

The Processes Adopted by the SMU, the SFO and The Inland Revenue Department
(and its DFU) Compared
There are significant differences between the process delineated by the SMU’s template and those adopted in
England and Wales by the SFO, as approved by the Divisional Court in McKenzie and by the Inland Revenue
Department’s DFU in New Zealand. Under the SFO’s process as articulated in McKenzie, the search terms
were provided by the privilege holders, the IT process via which the search terms were applied to the elec-
tronic material was conducted solely by IT staff (who did not read the material) and quarantined material was
reviewed by an independent lawyer, not employed by the SFO. Similarly, under the Inland Revenue
Department’s processes in New Zealand, the DFU receives key words from the privilege holders who are
entitled to claim privilege in any material identified by this process. In contrast, the SMU team contains
agents and lawyers who, unlike the IT experts deployed in the other two jurisdictions, are employees of
the investigative/prosecution authority. Whilst not forming part of the investigative team, they are likely
to understand the privileged material and its significance to the investigation. This would seem to suggest
that when compared to the approach adopted by the SMU, both the SFO’s process and that adopted by
the Inland Revenue Department might reduce significantly the likelihood that investigators or prosecutors
may, by accident or design, be able to access privileged material and/or that decisions concerning the priv-
ilege status of quarantined documents may be contaminated by subconscious prosecutorial bias.
It is informative to review these respective processes through the lenses provided by the decisions In
re: Search Warrant Issued June 13, 2019 and In re Sealed Search Warrant and Application for a Warrant
by Telephone or Other Reliable Electronic Means. Provision of search terms by the privilege holder and
review of the content of documents by an independent counsel under the SFO’s process would appear to
come closer to an approach that the Fourth and Eleventh Circuits might have preferred (in involving the
privilege holders in the process) than the SMU’s process under which search terms are the product of
consultation between the SMU and the search team (even though the filter team will engage with the priv-
ilege holder ‘where practicable’), and the documents are reviewed by a filter team lawyer. Independent
counsel is more akin to a special master than is a filter team lawyer, even though independent counsel is
instructed by the SFO, not by the court. An issue with the SFO’s process that might have troubled the
Fourth and Eleventh Circuits is whether independent counsel would have been permitted to communicate
with the privilege holder (whether this is permissible is something which under the Bar Council’s
Guidance the instructions given to the independent counsel should make clear). This could also be a
problem with the SMU’s process. When review is by one of its lawyers and the lawyer determines
that the material is not potentially privileged, this review may take place in circumstances where it is
not ‘practicable’ to engage with the privilege holder before disclosing to the investigators.137 The
SMU has recognised, however, that ‘filter teams [should] remain cognizant of the state of the law and
proactively model their processes to reflect court guidance and anticipate future challenges’.138 The
Inland Revenue Department’s process does not involve an independent counsel, but a claim of privilege
may ultimately end up before a district judge.
The Use of Keyword Searches and the Potential for Legislation Regulating the Choice
of Filtering Method
In terms of identifying privileged material and keeping it from investigators and prosecutors what is the
ideal combination of technology and humans? Adams suggested that ‘search and privilege doctrine have
137. See Lindita above n. 94 at 37.

138. Ibid.
Mitchell et al. 101
evolved much more slowly than technology’139 but technology also has its limitations. Whilst the author-
ities considered in this article suggest that keyword searching is the norm where electronic communica-
tions which may contain privileged content have been seized under a search warrant, in future it may be
that the use of other filtering methods, such as predictive modelling,140 should also be considered. From
the context of disclosure/discovery in civil proceedings, it seems that keyword searching can perform
better than predictive modelling but that the opposite can also be true and that using predictive modelling
to compliment keyword searching increases the level of precision.141 The precision of document review
is significantly increased if predictive modelling is supplemented by subsequent manual review.142 Too
extreme a level of reduction of human input, with an overreliance on technology, increases the risk that
privileged material will not be identified and will slip through the net, because manual review will iden-
tify some documents that predictive modelling will miss.143
As regards keyword searches, selection of keywords can be crucial. If the keywords selected are too
broad this may result in increased expense if lawyers are required to review an unnecessarily high volume
of documents, whereas if they are too narrow this may result in privileged documents not being identi-
fied144. For example, in a recent decision of the High Court of New Zealand,145 the applicant, whose
devices and electronic documents had been seized by the New Zealand SFO under a search warrant, pro-
vided 67 key words which included a number of generic words, such as ‘affidavit, defense, defence, legal
brief, law, lawyer, trustee, beneficiary, barrister, and legal’.146 A search using these keywords identified
54,000 documents with an additional 500,000 documents attached to them or referenced in them.
Reducing this to 24 key words in the form of the full names of lawyers and law firms and domain
names (which the SFO indicated is what it would normally receive from a party asserting privilege)
reduced this to 4210 documents.
The practices adopted by the SMU, the SFO and the Inland Revenue Department’s DFU concerning
the use of keyword searches and the selection of keywords are not imposed by legislation. Rather, as has
been seen above, it is developing and enhancing practice on the part of investigative bodies, at times
driven or enhanced by judicial decisions endorsing or criticising such developing practice, that has
been the catalyst for change. In a recent decision of the European Court of Human Rights, Särgava
v. Estonia,147 the court found that the seizure and examination of a mobile phone and a laptop had
given rise to a violation of Article 8 of the European Convention on Human Rights (the right for
respect to private and family life, home and correspondence). The observations made by the European
Court of Human Rights148 included that whilst the investigative authority had provided an assurance
after the devices were seized that a keyword search would be used, domestic legislation did not
impose an obligation to carry out a keyword search. This resulted in a keyword search not being men-
tioned in the search warrant application and the warrants themselves not mentioning any such obligation.
In consequence, the decision whether to carry out a keyword search or use other filtering methods and the
choice of keywords was entirely for the investigatory authority and the law did not make clear how dis-
putes about which keywords or which filtering methods to use were to be determined.

140. For an explanation of how predictive modelling operates in this context see Robert Keeling, Rishi Chhatwal, Peter Gronvall &
Nathaniel Huber-Fliflet, ‘Humans against the Machines: Reaffirming the Superiority of Human Attorneys in Legal Document
Review and Examining the Limitations of Algorithmic Approaches to Discovery’ (2020) 26 Rich JL & Tech 1 at 4.
141. Ibid, 29 and 45.
142. Ibid, 11 and 64.
143. Ibid, 11.
144. Ibid, 19.
145. Peters v Serious Fraud Office [2022] NZHC 2063 (see Gordon J at 70–77).
146. Ibid at para 72.
147. Särgava v. Estonia 16.11.2021 (app. no. 698/19).
148. At paras 105–107.
Reference to Särgava suggests that statutory provisions that authorise and regulate the issuance of
search warrants might be enhanced by the inclusion of specific provisions concerning how the method
or methods for filtering electronic evidence is or are to be determined. And how disputes concerning
the method or methods to be used and the implementation of such methods (e.g., the selection of key-
words) are to be resolved. Given the speed of technological change, however, the inclusion of statutory
obligations to utilise a particular filtering method, would be less desirable. It could restrict the implemen-
tation of developments, such as blending keyword searches with predictive modelling and manual review
in appropriate cases; developments which might both increase the efficiency of the filtering process and
reduce the overall cost of the process. Responsiveness to technological change is one reason why the Law
Commission recommended a combination of statutory safeguards and a related Code of Practice, with the
latter being easier to modify in the context of ongoing and rapid technological development.149 It recog-
nised that sifting digital material has cost implications and can require the expenditure of ‘large volumes
of resources’.150
A common theme of the approaches adopted by the SMU, the SFO and the Inland Revenue
Department’s DFU is the use of personnel who are independent of the investigation itself but integral
to the investigative or prosecuting authority. A recent Canadian decision (of the Supreme Court of
British Columbia) preferred the use of an independent court appointed computer forensics technician
to the use of a forensics team integral to but operationally independent of the investigative authority.151
One of the risks that the privilege holder had asserted was that ‘keywords themselves can reveal solicitor-
client privileged materials’.152 The problem that the court identified was that;
‘…using specific keywords likely results in a more thorough isolation process, but may result in divulging
privileged information by mistake. On the other hand, using general keywords reduces the likelihood of key-
words containing privileged information but may result in incomplete review of files, an under-inclusive iso-
lation effort, and subsequent inadvertent disclosure of solicitor-client privileged materials’.153
The Court believed that the advantage of an independent technician over a technician within an investi-
gative authority was that a privilege holder would provide the former with more information than they
would provide to the latter and could have an ‘open dialogue’ with the independent technician, which
would make the process of filtering privileged material more effective.154
It seems unlikely that the courts in England and Wales, New Zealand or the United States could be
persuaded to mandate the adoption of a similar approach as a general rule (not least due to concerns
regarding cost) or (and equally unlikely) that such a rule would be imposed by statute. It is clear,
however, that there are circumstances in which courts in the United States will appoint a special
master to replace a filter team155 and it may be that in appropriate circumstances and on the facts of a
specific case a court in England and Wales, New Zealand or the United States might prefer an independ-
ent forensics technician to one integral to an investigative team or prosecuting authority. This might be
the case if, for example, discussions/information to identify the most effective keywords (maximising the
likelihood of capturing privileged documents most accurately and, potentially, most cost-efficiently)
could reveal privileged information.

150. Ibid, para 14.121.
151. Solicitor-Client Privilege of Things Seized (Re) 2019 BCSC 91.
152. Ibid, para 68.
153. Ibid, para 69.
154. Ibid.
155. See, Wszalek above n. 23 at 104.
Mitchell et al. 103
Conclusion
In this article, the strengths and weaknesses of methods of protecting legal professional privilege in the
context of seizure of digital material under search warrants in three jurisdictions have been compared,
with particular reference to the practices adopted by specific authorities in each jurisdiction as exemplars.
Informed by this comparative analysis, we now conclude with recommendations. We suggest that to
achieve transparency and consistency and maximise the likelihood that the rights of privilege holders
to effectively assert privilege will be observed, relevant processes and safeguards should be enshrined
in statute with associated regulations, codes of practice or guidance to allow flexible response to techno-
logical change. Exactly what form such legislation, regulations, codes of practice or guidance should take
may vary between jurisdictions, but they must be realistic and proportionate in terms of resultant work-
load/costs implications. Our recommendations are not intended to be jurisdiction specific but identify key
elements of relevance to any jurisdiction where legal professional privilege or an equivalent concept
exists and may be infringed by the exercise of search and seizure powers.
Legislation, regulations or codes of practice designed to preserve legal professional privilege in the
context of seizure of digital material should address the following issues. Where a search warrant includes
electronic devices, these should be described on the warrant and there should be sufficient clarity in the appli-
cation about what information on the device is being sought to enable the authorising judge or equivalent to
determine the likelihood of over seizing. The application should inform the judge or equivalent if there is a
likelihood that digital material seized may include privileged communications. If there is such a likelihood,
the application should articulate the process that will be adopted to ensure that, when seized, privileged
material is filtered from other material and does not fall into the hands of investigators or prosecutors.
Where there is a likelihood that digital material will include privileged material (e.g., a law firm or in
house legal department), a lawyer independent of the investigative and prosecuting authorities should be
involved in the search and seizure process. The use of a lawyer employed by an investigating or prosecuting
authority, even if not assigned to the case and belonging to a different unit or command, gives rise to at least
the perception of bias and the possibility of subconscious bias should be avoided. The devices or material
should be seized by a digital forensics team operating independently of the investigating or prosecuting
teams. Digital forensics teams must be independent of the investigating or prosecuting team but can be inte-
gral to the investigating or prosecuting authority provided that the process they conduct does not involve
them in reading any of the seized material. If potentially privileged material is discovered in circumstances
in which it was not expected, the sifting of the material should not be undertaken by investigators or prose-
cutors but by a combination of an IT team operating independently of the investigating or prosecuting team
and an independent lawyer, special master or judge. The IT team using technology such as keyword searches
to sift provisionally privileged material must be independent of the investigating or prosecuting team but can
be integral to the investigating or prosecuting authority provided that the process they conduct does not
involve them in reading any of the seized material. It is crucial that the privilege holder and their legal advi-
sers have the opportunity of claiming privilege from as early a stage of the search and seizure process as
possible. This should include opportunities to communicate with an independent lawyer, where one is
deployed. It should also include opportunities to input their views in the context of the sifting process,
for example, when keyword search terms are being formulated. It is also crucial that any process designed
to reduce the risk that privileged material will fall into the wrong hands is realistic in terms of the workload/
costs implications that it imposes. This makes the selection of appropriate keyword search terms particularly
important. It also means that legislation, codes of practice and guidelines should not hamper the introduction
of new technologies that make the filter process faster and cheaper, provided that they do not increase, or
indeed reduce, the risk that privileged digital material seized under a warrant will fall into the wrong hands.
Legislation, regulations or codes of practice should make provision for expedited judicial resolution of
privilege disputes. They should also make clear that where the filter protections fail such that privileged
material falls into the hands of an investigator or prosecutor, the relevant personnel are precluded from
any further involvement in the investigation or prosecution.
Declaration of Conflicting Interests

The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of
this article.
Funding
The author(s) received no financial support for the research, authorship, and/or publication of this article.

数据资源的暴力扣押与隐私权

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

数据资源的暴力扣押与隐私权

Uploaded by

Copyright:

Available Formats

Article

The Journal of Criminal Law

Materials Under Warrant and Article reuse guidelines:

Protecting Privilege: Comparative DOI: 10.1177/00220183231223592

Analysis and Recommendations

2. Law Commission: Search Warrants, Cm 396 (2020) para 14.2.

16. Search and Surveillance Act 2012 s.110 (h).

The Position in the English Legal System

33. Criminal Justice and Police Act 2002, s.50(2).

43. Ibid, para 34.

The Position in New Zealand

66. Ibid, para 11.27.

73. Search and Surveillance Act 2012, s. 147.

The Position in the United States

113. Ibid, 179.

122. See Lindita above n. 94 at 34.

Part 3 Identifying Transferable Good Practice

137. See Lindita above n. 94 at 37.

139. See Edward above n. 93 at 780.

149. See Law Commission, above n. 2 at para 17.144.

Declaration of Conﬂicting Interests

You might also like