If users bring their own device (BYOD) and they have corporate Exchange (or Goodlink email) on that device, could the other email accounts on that device be open to a legal search?

  1. Would the SMS messages (WhatsApp, or other) be open to a legal search?

  2. If the answer is yes, both accounts could be searched, what if the person used two different devices for work and personal (or business1 and business2 for that matter)? Could both physical devices be searched?

  3. Are there any corporate policies that could limit the search to just corporate data, and protect the investigation of our user's personal lives in a BYOD scenario?

I'm mostly interested in anything that applies to the US or UK

  • It would help if you would specify what country, region are you subject to?
    – Matiss
    Jul 20, 2015 at 21:34
  • Ask Hillary Clinton.
    – emory
    Jul 20, 2015 at 22:10

1 Answer 1


In the United States, generally anyone can subpoena anyone or anything as part of the "discovery" process. It is up to the presiding Judge to decide whether or not this is relevant or allowable.

In a civil action, as opposed to a criminal one; some typical protections (e.g. 5th amendment protection against self-incrimination) do not apply. Thus, it is far easier to compel disclosure of information during a civil case than during a criminal one in the United States.

So to answer your question's points:

1) Yes, they would be open to a subpoena; this is distinct from a "legal search" conducted by law enforcement personnel. The party receiving a subpoena would be compelled to hand over the information in an unedited/original form. In a criminal case however, yes, law enforcement would be able to subpoena the provider or the individual to obtain this information for investigation, or just seize it themselves.

2) Yes, the information on these devices could be subpoenaed if it is relevant to the case or controversy at hand. The court could order the devices analyzed by a forensic analyst, or simply they be turned over, etc.

3) Corporate policies do not trump the sovereignty of the state. As Max Weber famously stated, "The state is the entity with the monopoly on the legitimate use of force." Since force majeure, in the form of a subpoena carrying with it threat of criminal charges like contempt of court, trumps any corporate policy -- no policy could prevent a court from ordering disclosure of your information as long as it resides within the court's jursidiction. If data relevant to a court case is subpoenaed, and the court grants such a request, no corporate policy can defend you.

I am not an attorney and you should consult a knowledgeable attorney on these matters when devising corporate policies and strategies for BYOD and measures to mitigate risks of discovery actions.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .