3.8.5 Legal Discovery

Some situations, such as legal discovery, will require the account admin to obtain data from its account members. If escrow is enabled, an EA with the escrow-read permission can request from the server escrowees’ data ciphertexts (such as emails encrypted with escrowee PUKs) and ciphertexts containing the escrowee PUKs (encrypted for the virtual escrow device, the secret key of which is known to the EA devices), and therefore decrypt the necessary data without cooperation from other account members.