The authors would like to thank Colby Galliher, Madison Gee, and Taylor Redd for their assistance.

The FBI’s execution of a search warrant on former President Donald Trump’s Mar-a-Lago home on August 8 raises the inevitable question: What crime(s) might he have committed? One thing is for sure – unlike the January 6 investigation, in which it is still unclear whether or not the Justice Department (DOJ) believes that Trump himself committed any crimes, the Mar-a-Lago search indicates that DOJ does believe that a crime has been committed or was being committed and that evidence of that crime was present on the premises. That much is clear, although we are still at the earliest stages of understanding this development and do not have the search warrant and attachments, much less the supporting affidavit. While DOJ and judicial approval of the search warrant doesn’t necessarily mean that Trump himself is suspected of a crime, it is highly likely that he is the focus of the investigation. 

To that end, it’s worth reviewing the possible federal criminal violations for which Trump might be charged. We do so below based on the evidence we have available so far, and recognizing that Trump may not be charged (including because of the possibility that the government is satisfied merely to recover the classified documents or for other as yet unknown reasons). Our experience is that search warrants often result in charges—but not always. 

We have formed that experience over a collective half-century plus of handling these issues as lawyers. Rangappa has addressed these matters as an FBI agent and as a legal analyst since that service. Eisen worked on these issues as the White House ethics czar, where he had responsibility for seeking compliance with presidential records rules during the Obama administration and the transition thereto. In his White House service, he also helped write Executive Order 13526 restructuring the classification system. Moss addresses these issues on a regular basis at the core of his legal practice, where they are also an important part of his firm’s work. 


We turn first to a review of the timeline of events, which may be relevant to any crime charged. In January 2022, news reports indicated that, following months of negotiations between the office of the National Archives and Records Administration (NARA) and Trump’s lawyers, 15 boxes of documents and government records, including classified ones, were retrieved by NARA from Trump’s home in Mar-a-Lago. The Presidential Records Act requires that all records relating to a president’s official duties be turned over to the National Archives at the end of their administration, under penalty of legal action. In February 2022, shortly after their retrieval of these documents, NARA officials referred the matter to the Justice Department, and one week later found among the recovered boxes “items marked as classified national security information.” 

Around this time, reports also emerged that some of the documents retrieved by NARA included papers that had been torn apart and pieced back together. Corroborating reports from 2018 of Trump’s tendency to rip up official documents, three White House officials told reporters in February 2022 that they had seen Trump tear apart papers after he had finished reviewing them. By May, the DOJ had launched a grand jury investigation into Trump’s handling of official government documents and issued a subpoena to NARA for the documents it had retrieved from Mar-a-Lago. As a part of this probe, over the course of April and May 2022, FBI agents conducted interviews with Trump aides working at Mar-a-Lago. In June, investigators from the Counterintelligence and Export Control section of the DOJ visited Mar-a-Lago, at which point Trump’s lawyers showed DOJ officials the location where the remaining documents were being kept. Five days later, on June 8, the DOJ advised Trump via a letter to secure the location they were shown. Aides subsequently added a padlock. 

This Monday, the FBI hauled away roughly 10 more boxes according to the Wall Street Journal

 18 U.S.C. 1924 – Unauthorized Removal and Retention of Classified Documents or Material

Since reporting indicates that the documents the agents were searching for included classified ones, this statute appears at first glance to be an obvious possible violation. Section 1924 makes it a crime to knowingly remove classified documents with the intent to retain them in an unauthorized location. There are a few problems with this statute, however, as applied to Trump. 

 One potential stumbling block is that the statutory provision limits its scope to an “officer, employee, contractor, or consultant of the United States.” There is scant case law addressing if the president of the United States would qualify as an “officer” in this particular statutory context, and the statute itself provides no clarity. A recent ruling in one of the January 6th civil lawsuits against Trump brought by, among others, two Members of Congress, concluded the statutory term “officer” could encompass holders of political office, such as a Member of Congress. While informative, how that analysis would be applied in a criminal context with respect to the then-president remains unclear. 

There is also the issue of whether Trump actually declassified the records prior to the end of his presidency. Former Trump staffer Kash Patel has publicly made this very argument, claiming that many of the records were declassified by Trump. 

If prosecuted under Section 1924 (or one of the Espionage Act provisions outlined below), this defense that Trump had declassified the records would certainly be front and center in the case. Whether that argument would hold up in court is difficult to predict with any real certainty because this is completely uncharted territory. There has never before been a president prosecuted for mishandling classified information. The only guidance that exists are the security classification rules that ordinarily apply to holders of access to classified information. 

Strictly speaking, even if Trump ordered the declassification of the records (verbally or in writing), what is likely to matter for purposes of handling and storing the records after he left the White House was if the mandatory follow-on actions occurred. Classified documents have classification markings in the header and footer of each page, indicating the level of classification for the document as a whole. Furthermore, classified records have cover sheets that specifically indicate when the record was classified, by whom, and under what authority, as well as when the classification expires. 

If Trump did in fact order the declassification, he still needed to make sure his staff took the necessary next steps to modify the classification markings on the documents before he could actually handle and store the records (as a private citizen) as if they were unclassified. Under security classification rules, a classification marking on a document has to be treated as valid and binding unless and until a subsequent marking replaces it. Appropriate government staffers would have needed to cross out the classification markings in the headers and footers, and stamped “declassified” on the record noting when it was declassified, by whom and under what authority. Since that does not appear to have been done with the classified documents reportedly identified to date, the documents remain classified and had to be treated as classified for handling and storage purposes. 

These are Security Classification 101 procedures, but none of them were material to Trump while he was still the president. He held ultimate authority over classification issues until noon on January 20, 2021. When Joe Biden became the President, however, Trump became just another private citizen who was obligated by federal law not to willingly remove classified records from a secure location and place them in an unsecured basement at Mar-a-Lago. When he took the records from the White House, shipped them to Florida, and stored them at Mar-a-Lago, he arguably ran afoul of Section 1924. Further factual development will, of course, be necessary to know for sure. 

 18 U.S.C. 2071 – Concealment, Removal, or Mutilation Generally

This is perhaps the most-discussed statute since the search, including because it carries as one of its penalties the possible disqualification from holding public office. (Whether that disqualification could apply to the presidency, or whether it would be an impermissible variation of the constitutionally established qualifications for that office, is a question for another day.) Section 2071 makes it a crime to willfully and unlawfully remove a government record with the intent to conceal or destroy it or to conceal or destroy such documents already in one’s custody. This is a more attractive statute for a prosecutor to apply to Trump than Section 1924, mainly because it does not require that the documents be classified – it applies to all government records.

It also seems to fit the facts we know so far, namely that the FBI reportedly searched locations within Mar-a-Lago other than the room originally shown to DOJ during their June visit – suggesting that they had received information in the interim that additional documents were being stored, or concealed, elsewhere. For example, FBI agents allegedly searched Trump’s personal safe and his closet. Evidence that Trump had failed to reveal the full scope or all the locations where government records were being stored both to NARA and then to DOJ would also meet the heightened intent standard required by Section 2071, which is that the defendant act “willfully.” This is a heightened standard which typically requires knowledge of the defendant that the conduct is generally illegal. It would be surprising if Trump was not repeatedly informed of the laws for the handling of government documents while he was in office. Moreover, it is also likely that DOJ and NARA warned Trump in writing that retention of such documents would be unlawful.

A question remains, however, whether the statutory requirement that the records in question be “filed or deposited” with a court or a public office or public or judicial officer would apply in this case. Given that any charge would undoubtedly be appealed to the Supreme Court, this textual reading of the statute may offer Trump a counterargument that any records or classified documents in his possession would not be a “filing” in the strictly technical sense. Here too more review is necessary to form a final judgment on the applicability of the statute. 

18 U.S.C. 641 – Public Money, Property or Records

A partially overlapping offense to Section 2071 can be found in 18 U.S.C. 641, which provides for criminal penalties against anyone who “steals, purloins, or knowingly converts to his use or the use of another” government property. The argument here would be that Trump did just that with respect to the documents at issue. This statute has gotten less attention in the immediate post-search discourse. It is perhaps a looser fit than Section 2071, which specifically references records, papers, and documents (but only slightly looser since Section 641 does reference “any record”). But, on the other hand, the penalties are potentially greater, with imprisonment of up to ten years depending on the circumstances. 

18 U.S.C. 1361 – Government Property or Contracts

 Section 1361 applies to anyone who “willfully injures or commits any depredation against any property of the United States, or of any department or agency thereof.” The severity of the penalty depends on the extent of the damage done to the government property in question, in this case the official documents that Trump is alleged to have mishandled including during his White House tenure.

This statute might come into play given, for example, the numerous reports and recent photographs evidencing Trump’s penchant for ripping up notes and attempting to flush them down the toilet. While an isolated episode might normally not trigger the statute, here there appears to be a consistent pattern. In that regard, also relevant are public reports that the January 6 Committee received pieces of paper that had been taped together from shreds after the Supreme Court ordered the National Archives to provide the committee with relevant documents from the Trump White House. 

It should be noted that Sections 1924, 2071, and 1361 concern removal, storage, and destruction. All of these are serious offenses – particularly as they pertain to classified documents – but prosecution of violations risks being seen as excessive given that Trump was at least by appearances trying to cooperate with government officials. 

Given that DOJ decided to take the especially aggressive step of executing a search warrant at Mar-a-Lago – despite prior attempted coordination with Trump and his lawyers – it’s possible that even more serious charges are in play. For those we turn to the suite of espionage statutes contained in Chapter 37 of the U.S. Code, Title 18. A hint that these might be the underlying crimes is suggested by the June 2022 visit to Mar-a-Lago of the Counterintelligence and Export Control section of DOJ: The Justice Department website states that this section focuses on “national security, foreign relations, and the export of military and strategic commodities and technology.” In particular, this section prosecutes crimes relating to “espionage, sabotage, neutrality, and atomic energy.” 

18 U.S.C. 793 – Gathering or Transmitting Defense Information

This statute, which does not contain the “officer” qualifier of 18 U.S.C. 1924, covers criminal liability for anyone who improperly possesses, disseminates or disposes of “information relating to the national defense.” While that phrase is not limited to information that is classified under executive order, it is commonplace for the two designations to overlap in the criminal context and likely would do so here. 

At least two subsections of this statute could be viable in the case of Trump’s actions, and both operate from the likely premise that Trump originally had authorized access and control over the records prior to the end of his term. 

Subsection (d) concerns the willful delivery of the information to any person not entitled to receive it or the retention of the information and failure to return it to the United States when demanded. By having the records transferred through unsecured means from the White House to Mar-a-Lago after he was no longer the president, and then having those records stored in an unsecured location at Mar-a-Lago, Trump arguably ran afoul of this provision. This was even made more clear by the fact that after Trump returned the initial 15 boxes’ worth of records in February the FBI reportedly found more classified records at Mar-a-Lago in June. 

Subsection (f) contains two prongs of potential applicability to Trump. 

The first, which was discussed at great length during the investigation into Hillary Clinton’s email server, is when the individual “through gross negligence” permits the information to be removed from its proper place of custody. The statute does not define what qualifies as “gross negligence,” and what little case law exists on the matter focused instead on whether the provision mandated the involvement of a third party to qualify (the court concluded it did not). 

Assuming for the moment the provision is not unconstitutionally vague, Trump’s exposure to this provision would be the byproduct of his haphazard and lackadaisical manner of having the records boxed up and shipped to Mar-a-Lago. In a conventional White House not consumed with efforts to overthrow an election, the White House Counsel’s Office and relevant personnel would have sorted through the president’s records weeks before Inauguration Day and ensured that any classified records were properly secured. Reporting indicates that Trump’s White House was focused on “other matters” until the final days of Trump’s presidency, and the resulting failure to separate out classified records may have been the result. 

 The second prong, failing to promptly return national defense information upon learning it was illegally removed from a secure location, would have particular relevance in light of media reporting that Trump continued to have classified records at Mar-a-Lago even after his staff returned records in February. The fact that the FBI had to go so far as request that Trump staffers at Mar-a-Lago secure the room where the remaining classified records were still stored (which the aides then did with a padlock), and that the FBI’s search warrant authorized opening of safes and other locations both give reason to believe the government suspected there were more classified records stored at Mar-a-Lago. 

A third potential subsection is 793(e). This subsection is identical to subsection (d) except that it applies to information that is in the subject’s unauthorized possession. This would be unlikely to apply to Trump’s conduct while in office, of course. However, it could be considered for his continued possession of the record after January 20, 2021, particularly given the indication Trump was informed he had no right to the documents, was asked to return them, and chose not to do so. 


As noted above, we are still in the earliest stages of understanding the dramatic new development represented by the execution of the search warrant at Mar-a-Lago. Important information has begun to emerge in the public reporting since Trump’s premises were searched, and we can expect still more in the period to come. In important cases, the search warrant and the attachments providing some additional detail, sometimes including one or more of the crimes as to which probable cause was found, tend to emerge. Having the underlying government affidavit that was presented to the court would be even more helpful, although we can be even less certain that it will be published, including because it may well contain sensitive information concerning Trump’s handling and retention of classified documents. But even in an uncertain landscape, indeed, particularly in those circumstances, it is important to have some points of reference. We offer this guide in that spirit. 

This essay addresses rapidly evolving events and will be updated as the facts warrant. Reader comments are welcome. 

Image: Local law enforcement officers are seen in front of the home of former President Donald Trump at Mar-A-Lago in Palm Beach, Florida on August 9, 2022. – Former US president Donald Trump said August 8, 2022 that his Mar-A-Lago residence in Florida was being “raided” by FBI agents. (Photo by GIORGIO VIERA/AFP via Getty Images)