The emergency disclosure request exists for a real and narrow purpose: a child has been abducted, a person has posted a credible suicide note, a hostage’s location is unknown. In those cases, waiting for a warrant costs lives. The mechanism is justified.
It is also the single most exploited request type in the field, for exactly the reasons that make it necessary.
What an emergency disclosure request is
An EDR is a request, not an order. In the United States, 18 U.S.C. § 2702 permits a provider to voluntarily disclose subscriber information or even content to a governmental entity if the provider, in good faith, believes an emergency involving danger of death or serious physical injury requires disclosure without delay.
Three features distinguish it from every other instrument:
- It is voluntary. The provider may disclose. Nothing compels it.
- No judge is involved. There is no prior review and no case number to check against a court docket.
- The good-faith belief is the provider’s. The legal protection attaches to the provider’s own reasonable assessment, which makes the assessment the provider’s responsibility rather than the requester’s.
That third point is the one most often missed. The statute does not protect a company that disclosed because it was asked. It protects a company that formed a good-faith belief. Forming that belief requires doing something.
Why EDRs are the primary fraud target
| Emergency disclosure request | Search warrant | |
|---|---|---|
| Compulsory | No, voluntary | Yes |
| Judicial review | None | Required before issue |
| Typical response window | Hours | Days to weeks |
| Independent artefact to verify against | None | Court docket, issuing judge |
| Attacker effort required | Low | High |
An attacker forging a search warrant has to fabricate an artefact that can be checked against a court. An attacker sending an EDR has to write a convincing email. When that email is sent from a genuine but compromised police mailbox, the technical checks a company might run all pass.
What it means for a company receiving one
The instinct to move fast is right. The instinct to skip verification because you are moving fast is the failure.
- Verify the requester out of band. Call the agency on a number you sourced independently, never one supplied in the request.
- Scope the disclosure to the emergency. If the stated danger is to one individual, a request covering five accounts does not match its own justification.
- Record the basis for the decision. The statutory protection turns on a good-faith belief, so what you knew and when you knew it is the record that matters afterwards.
- Do not treat a refusal to verify as neutral. A genuine officer in a genuine emergency will accept a two-minute callback. Resistance to verification is itself a signal.
How EDRs differ from preservation requests
The two arrive under similar urgency and are frequently confused. A preservation request asks a company to freeze data so it cannot be deleted while legal process is obtained; it does not ask for the data itself and it discloses nothing. An EDR asks for disclosure now. When a request is urgent but the legal basis for disclosure is thin, preservation is very often the correct response: it protects the evidence without handing over data on an unverified claim.