Glossary
Law Enforcement Data Request Terms
Plain-language definitions of the legal process, compliance, and verification terms that come up when a company receives a request for user data. Written for the legal, compliance, security, and trust & safety teams who have to act on them.
A
C
CLOUD Act
The CLOUD Act establishes that US providers must produce data they control regardless of where it is stored, and creates a framework for bilateral agreements letting qualifying foreign governments serve orders on US providers directly. It also gives providers a route to challenge orders that conflict with foreign law.
Chain of Custody
Chain of custody is the documented record of who handled a piece of evidence, when, and what they did with it, from collection through to presentation. An unbroken chain supports the claim that evidence is what it purports to be and has not been altered; gaps invite challenges to its admissibility.
Cost Recovery
Cost recovery is the reimbursement a company may seek for the expense of responding to legal process. In the United States, 18 U.S.C. § 2706 entitles providers to reasonable reimbursement for costs directly incurred in searching for, assembling, and producing the requested data.
Court Order
A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires.
E
Electronic Communications Privacy Act (ECPA)
ECPA is the 1986 US statute governing government access to electronic communications. It has three parts: the Wiretap Act covering interception in transit, the Stored Communications Act covering data at rest, and the Pen Register Act covering real-time addressing data.
Emergency Disclosure Request (EDR)
An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive.
European Production Order (EU e-Evidence)
A European Production Order lets a judicial authority in one EU member state require a service provider in another to hand over electronic evidence directly, without routing through the second state’s government. Introduced by the EU e-Evidence Regulation, it carries short deadlines: generally ten days, or eight hours in an emergency.
F
G
L
Law Enforcement Email Compromise (LEEC)
Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed.
Law Enforcement Impersonation
Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority.
Legal Hold
A legal hold is an internal instruction suspending the routine deletion of records that may be relevant to anticipated or pending litigation or investigation. Unlike a preservation request, it is imposed by an organisation on itself, and the duty to issue one arises as soon as litigation is reasonably foreseeable.
M
N
National Security Letter (NSL)
A national security letter is an administrative demand issued by the FBI, without prior judicial approval, for limited subscriber and transactional records in national security investigations. It can carry a non-disclosure requirement, and it cannot compel the contents of communications.
Non-Disclosure Order
A non-disclosure order directs a company not to tell a user that their data was requested. It is a separate instrument from the process compelling production, is issued for a defined period, and requires the government to show that notice would cause a specific harm such as flight, evidence destruction, or danger to an individual.
O
P
Pen Register and Trap and Trace
A pen register records outgoing addressing information and a trap and trace device records incoming addressing information, prospectively and in real time. Both capture who communicated with whom, not what was said, and both are authorised on a certification standard lower than probable cause.
Preservation Request
A preservation request asks a company to retain specified records so they are not deleted while law enforcement obtains legal process. It compels retention, not disclosure: no data is handed over. In the United States it is grounded in 18 U.S.C. § 2703(f) and generally runs for 90 days, renewable once.
R
Redaction
Redaction is the permanent removal of information from records before they are produced, typically to withhold data about third parties or material outside a request’s scope. Effective redaction removes the underlying data rather than obscuring it visually, and failures here are usually technical rather than editorial.
Requester Verification
Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks.
Responsive Records
Responsive records are the documents and data that actually fall within the scope of a specific request. Determining what is responsive is a scoping judgement, and getting it wrong in either direction means either failing to comply or disclosing more of a user’s data than the law required.
S
Search Warrant
A search warrant is an order issued by a judge authorising a search or seizure, granted only on a showing of probable cause. In data request work it is the instrument required to compel the contents of communications, and it is the highest legal threshold a company is likely to encounter.
Stored Communications Act (SCA)
The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach.
Subpoena
A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications.
#
No terms match that search.