Pre-Indictment Federal Investigation Triage

1. The witness, subject, and target distinction (DOJ Justice Manual 9-11.151)

Federal prosecutors classify every person connected to a grand jury investigation into one of three tiers, and the tier dictates almost everything that follows — what notice is given, what protections apply, whether a proffer is feasible, and how quickly charges may come. The classification framework lives in the Department of Justice Justice Manual at section 9-11.151, and although the categories carry no statutory definition, prosecutors treat them as operating doctrine.

A witness is a person whose testimony or documents the grand jury wants but who is not believed to have committed a crime. A subject is a person whose conduct is within the scope of the grand jury investigation — the prosecutor has reason to investigate them but does not yet have probable cause to indict. A target is a person against whom the prosecutor has substantial evidence linking them to a crime and who, in the prosecutor's judgment, is a putative defendant. Target letters are sent to formalize this status and to invite presentation before indictment.

The boundaries between these tiers are permeable. A cooperating witness who turns out to be untruthful can become a subject overnight. A subject whose conduct emerges in detail can become a target the following Tuesday. Counsel's first job in any pre-indictment investigation is to assess actual status, not stated status — because the United States Attorney's Office may have told a witness they are "just a witness" while privately tracking them as a subject.

2. The grand jury process and federal investigation tools

Federal grand juries operate under Federal Rule of Criminal Procedure 6 and convene continuously in every federal district. A grand jury sits for 18 months, can be extended for six months, and votes indictments by a majority of at least 12 jurors. Its proceedings are secret under Rule 6(e) — the prosecutor, court reporter, and witnesses present cannot disclose what occurred, with narrow exceptions for the witness's own testimony.

Several tools flow from grand jury authority. Subpoenas ad testificandum compel testimony before the grand jury. Subpoenas duces tecum compel production of documents and tangible items. Subpoenas may also issue for forensic analysis or computer images. The grand jury cannot itself execute search warrants, but its investigative momentum drives Article III magistrate judges to issue Rule 41 warrants based on probable cause established by parallel agent investigation.

Outside the grand jury, federal investigations operate through agency interviews under FBI Form FD-302 or equivalent, voluntary requests for documents, civil investigative demands from DOJ Civil Division or HHS-OIG, administrative subpoenas under specialized statutes such as 21 U.S.C. §876 for DEA matters, and court-authorized intercepts under Title III. Each tool comes with different procedural protections and different risks for the person who responds without counsel.

3. Document preservation duties pre-indictment (obstruction risks 18 U.S.C. §1519)

The single most dangerous moment in a federal investigation is the period between awareness of the investigation and engagement of counsel. People in that window do things — destroy documents, edit files, delete emails, wipe phones, instruct employees to "clean up" — that convert a manageable investigation into an indictment for obstruction.

The governing statute is 18 U.S.C. §1519, which criminalizes knowingly altering, destroying, mutilating, concealing, covering up, falsifying, or making a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States, or any case filed under title 11, or in relation to or contemplation of any such matter or case. The statute carries a 20-year maximum and — critically — does not require that any investigation be pending. Contemplation of an investigation is enough.

Document preservation duties extend to every form of electronic information: email, Slack, Microsoft Teams, text messages including iMessage and SMS, cloud storage including Google Drive, OneDrive, Dropbox, and iCloud, server backups, automated retention systems, surveillance footage, telephone recordings, calendar entries, and the personal devices of officers and employees. A litigation hold memorandum issued through counsel — directing affected employees to preserve all potentially relevant materials and suspending normal deletion routines — is the single most important early step for any business that learns of a federal investigation.

4. Communication boundaries: agents, co-targets, and employees

Communications during a federal investigation fall into three categories, each with its own rules.

Communications with federal agents are governed by the principle that anything said may be used as substantive evidence at trial, and any false statement — even a minor one made under stress at the front door — is itself a federal felony under 18 U.S.C. §1001 carrying up to five years in prison. There is no Miranda warning required because the encounter is not custodial. Counsel uniformly advises that no person, target or not, should speak with federal agents without counsel present.

Communications with co-targets, co-conspirators, and other potential subjects create severe legal exposure. Statements that appear to coordinate stories, harmonize testimony, or align document responses can be charged as obstruction under 18 U.S.C. §1512 (witness tampering) or conspiracy to obstruct. The safer path — once an investigation is known — is to route all coordination through joint defense agreements (sometimes called common interest agreements) negotiated by counsel, which can preserve privilege over coordinated communications while protecting against tampering charges.

Communications with employees require Upjohn warnings when conducted by company counsel during an internal investigation. The Supreme Court in Upjohn Co. v. United States, 449 U.S. 383 (1981), held that the corporate attorney-client privilege belongs to the company, not the employee — meaning company counsel must warn the employee that the privilege is the company's to waive, that the company may share what the employee says with the government, and that the employee should consider whether to seek separate counsel. Upjohn warnings are the bedrock of any properly conducted corporate internal investigation.

5. Proffer, queen-for-a-day, and cooperation

Once the investigation reaches the stage where charges appear likely, several pre-indictment vehicles exist for the defense to present information to prosecutors. Each carries different risks.

A proffer agreement — sometimes called a "queen-for-a-day" letter — is a written agreement under which the defendant or potential defendant meets with prosecutors and agents to describe what they know, with limited protections against use of the statements in the government's case-in-chief. Standard proffer letters carve out important exceptions: the government may use proffer statements for impeachment if the defendant testifies inconsistently at trial, to rebut a defense theory inconsistent with the proffer, and to derive leads. Proffer statements are not Fifth Amendment-protected — once made, they live forever in the prosecutor's notes.

A cooperation agreement goes further. The cooperator pleads guilty, agrees to testify against others, and may earn a downward departure motion under U.S.S.G. §5K1.1 or, after sentencing, under Federal Rule of Criminal Procedure 35(b). Cooperation is the most powerful sentencing mitigation tool in the federal system but carries severe personal costs — public testimony, exposure to retaliation, and the burden of complete truthfulness about all crimes, including those the prosecutor does not yet know about.

A pre-indictment presentation to the United States Attorney's Office — sometimes called a "declination presentation" — is a structured submission of defense facts, legal argument, and exculpatory material aimed at persuading the office not to indict, to indict a lesser offense, or to defer prosecution. These presentations are most effective when grounded in documentary evidence the prosecutor has not seen and when delivered before charging momentum has crystallized.

6. When to engage counsel versus when to engage prosecutors

Counsel comes first, always. The decision to approach prosecutors — to seek a proffer, to make a declination presentation, to negotiate a pre-indictment plea — is a tactical decision made by counsel after thorough fact development, document review, and analysis of the strength of the government's case.

The trigger points for counsel engagement are well defined. Any contact from a federal agent — a knock at the door, a phone call, a card left in a doorway — triggers counsel. Any subpoena, civil or criminal, triggers counsel. Any search warrant execution triggers counsel before any post-warrant agent interview. Any target letter triggers counsel within days, not weeks. Any rumor of grand jury activity affecting the person's industry, employer, or known associates triggers counsel for a defensive consultation.

The triggers for prosecutor engagement are different and later. Counsel approaches the prosecutor only after fact development is sufficient to support the request being made, only after document review confirms the defense theory holds together under cross-examination, only after the client has been thoroughly debriefed and prepared for the specific vehicle chosen. Premature engagement — a proffer made before counsel has heard the full story, a declination presentation made before key documents are reviewed — almost always damages the defense position.