This piece was originally published on Just Security, an online forum for analysis of U.S. national security law and policy.

Over the last several weeks, there have been a number of news stories outlining the use of private email accounts and devices by members of the Trump administration. Politico reported that the White House had initiated a probe into staff use of private email after it was revealed that President Donald Trump’s son-in-law, Jared Kushner, as well as a number of other senior White House officials, used private email accounts to conduct government business. Apparently hundreds of White House emails were also sent to a third Kushner family account hosted on a private domain. Now it turns out White House chief of staff John Kelly’s personal smartphone was compromised for months, although he reportedly uses it infrequently relative to his government-issued device.

Private email account interaction with official White House email accounts presents several potential legal issues, including record preservation, security, and subpoena compliance.

All the Trump White House staff who have used private-to-private email account platforms to communicate about official matters trigger an obligation to forward those emails to official, archived White House accounts. For those communications that occurred more than 20 days ago without having been forwarded, those White House aides have violated the law.

The Presidential Records Act requires that almost all communications with White House staff on official matters be preserved. The act, 42 U.S.C. Chapter 22, requires that records demonstrating the “activities, deliberations, decisions, and policies that reflect the Performance of the President’s constitutional, statutory, or other official or ceremonial duties … are preserved and maintained.” Section 2209 (added in 2014) indicates White House staffers such as Kushner “may not create or send a Presidential or Vice-Presidential record using a non-official electronic message account” unless they copy an official account or forward it to an official account “not later than 20 days” after it was created. If they fail to do so intentionally, they may be subject under the act to administrative sanctions including removal, suspension, demotion, or pay penalty. The White House counsel’s office is tasked with policing email use and creating a culture of compliance.

I generally caution against outrage over any use of private email for official purposes. A White House staffer cannot control the content of emails sent to his or her personal account. Anyone who has worked in the White House has received tour requests, meeting requests, and some more substantive inquiries on personal email accounts that he or she had prior to the person entering government. In addition, there can be exigent and unforeseen circumstances. When I was working in the White House, I once had connectivity problems when doing legal review during a tropical storm/hurricane disaster declaration. Time was of the essence, and it would have been reasonable to switch to my personal device to ensure I didn’t hold up the works for people affected by the storm. The PRA’s 20-day grace period acknowledges these realities. In these circumstances, personal device/account use is a venal rather than mortal sin.

However, if White House officials use separate technology architecture in order to avoid preserving a record of their communications or in order to obstruct investigative activity, it is a much more serious issue.

The White House emails sent to the private Kushner family account reportedly “include nonpublic travel documents, internal schedules and some official White House materials.” They were apparently largely sent by the president’s daughter Ivanka Trump; her assistant, Bridges Lamar; and other White House staffers who work specifically with the Kushners. The Politico story notes that the “emails to the third account were largely sent from White House accounts but occasionally came from other private accounts.”

All emails to or from a White House account are automatically preserved for future archival processing under the PRA, so none of those email exchanges present a PRA problem. (That is true unless there is a technological problem, which is not unheard of in my White House experience, as seen in this judicial opinion, as well as this 2001 Government Accountability Office report and my appended comments.)

However, to the extent that “emails from other private accounts” contain presidential records and are sent to the Kushner family account, then the PRA would have required that those emails be forwarded to an official, archived White House account within 20 days.

Similar to Secretary of State Hillary Clinton’s use of a private email server, the Kushner family account presents two security issues. One is whether the substance of the emails contains classified national security information that is not fit for an unclassified system. The emails from White House accounts to this account presumably do not contain classified information or else they would not have been allowed to be created or stored on the White House unclassified email system. However, I would note that White House schedules may not be formally classified, but they are certainly security-sensitive if they contain future movements by people protected by the Secret Service, like the Kushners. We do not know whether emails sent from third-party accounts to the Kushner accounts about official matters contain anything classified.

The second security issue is vulnerability of the private email account or hosting device to exploitation by cyberespionage. This was one of the major concerns when it came to Clinton’s use of a private server, although evidence has never surfaced that her server was compromised. Kelly’s compromised personal smartphone is a good example of why this is a concern.

The more immediate political consequence of these stories is how White House staff use of private accounts and personal devices will affect ongoing criminal and congressional investigations. While the purpose of the PRA is record creation and preservation, it has long been politically relevant in the context of subpoena compliance. The litigation surrounding records management in the Bill Clinton White House resulted in a clear White House understanding that it needed to establish PRA-compliant technology platforms that were amenable to subpoena compliance searchability.

Widespread use of nonarchived devices raises investigators’ suspicions. The White House staff who have engaged in such conduct have now jeopardized the privacy of their personal email accounts, text messages, and social media accounts. Special counsel Robert Mueller’s team will likely want to review those accounts and platforms for certain witnesses. It will also make it harder for the White House to narrow the scope of the documents it’s required to provide investigators and preserve potentially applicable privileges. Recall that email production compliance related to the Benghazi investigation morphed into interest in all of Secretary Clinton’s emails. In the Trump administration, it has already prompted a letter from the Senate Select Committee on Intelligence to Kushner’s lawyer, as well as a separate, bipartisan records management investigation by my old committee: House Oversight and Government Reform.

I can tell you that my experience over the last 20 years is that White House email investigations that start with sloppiness tend to take on an unhappy momentum of their own.

More from Just Security:

The Increasingly Unsettling Indifference Toward the U.S. Citizen “Enemy Combatant”

Evidence Mounts That White House Anticipates Damaging Results From Russia Investigation