# What Is an Emergency Disclosure Request (EDR)? | Kodex Source: https://www.kodexglobal.com/glossary/emergency-disclosure-request > An emergency disclosure request asks for user data without legal process, citing imminent danger. Learn how EDRs work and why they are widely abused. Legal Process ## Emergency Disclosure Request (EDR) An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive. Also known as EDR, emergency data request, exigent request The emergency disclosure request exists for a real and narrow purpose: a child has been abducted, a person has posted a credible suicide note, a hostage’s location is unknown. In those cases, waiting for a warrant costs lives. The mechanism is justified. It is also the single most exploited request type in the field, for exactly the reasons that make it necessary. ### What an emergency disclosure request is An EDR is a request, not an order. In the United States, 18 U.S.C. § 2702 permits a provider to voluntarily disclose subscriber information or even content to a governmental entity if the provider, in good faith, believes an emergency involving danger of death or serious physical injury requires disclosure without delay. Three features distinguish it from every other instrument: - It is voluntary. The provider may disclose. Nothing compels it. - No judge is involved. There is no prior review and no case number to check against a court docket. - The good-faith belief is the provider’s. The legal protection attaches to the provider’s own reasonable assessment, which makes the assessment the provider’s responsibility rather than the requester’s. That third point is the one most often missed. The statute does not protect a company that disclosed because it was asked. It protects a company that formed a good-faith belief. Forming that belief requires doing something. ### Why EDRs are the primary fraud target Emergency disclosure requestSearch warrant Compulsory No, voluntary Yes Judicial review None Required before issue Typical response window Hours Days to weeks Independent artefact to verify against None Court docket, issuing judge Attacker effort required Low High An attacker forging a search warrant has to fabricate an artefact that can be checked against a court. An attacker sending an EDR has to write a convincing email. When that email is sent from a genuine but compromised police mailbox, the technical checks a company might run all pass. ### What it means for a company receiving one The instinct to move fast is right. The instinct to skip verification because you are moving fast is the failure. - Verify the requester out of band. Call the agency on a number you sourced independently, never one supplied in the request. - Scope the disclosure to the emergency. If the stated danger is to one individual, a request covering five accounts does not match its own justification. - Record the basis for the decision. The statutory protection turns on a good-faith belief, so what you knew and when you knew it is the record that matters afterwards. - Do not treat a refusal to verify as neutral. A genuine officer in a genuine emergency will accept a two-minute callback. Resistance to verification is itself a signal. ### How EDRs differ from preservation requests The two arrive under similar urgency and are frequently confused. A preservation request asks a company to freeze data so it cannot be deleted while legal process is obtained; it does not ask for the data itself and it discloses nothing. An EDR asks for disclosure now. When a request is urgent but the legal basis for disclosure is thin, preservation is very often the correct response: it protects the evidence without handing over data on an unverified claim. FAQ ### Frequently asked questions Is a company legally required to answer an emergency disclosure request? No. In the United States the statute permits voluntary disclosure in a qualifying emergency but does not compel it. The decision rests with the company, which means the company also owns the consequences of getting it wrong in either direction: disclosing to a fraudster, or refusing a genuine request during an actual emergency. Why are EDRs abused more than other request types? They combine the three things an attacker wants. There is no court involvement, so nothing independent checks the claim. There is severe time pressure, so review is compressed. And refusing carries an implied moral cost, since the request asserts a life is at risk. That pressure is applied deliberately. What is a reasonable verification step under genuine time pressure? A callback to the agency on an independently sourced number is usually achievable within minutes and defeats most fraudulent requests, including those sent from compromised accounts. Verification and speed are not actually in tension; the tension is between speed and unverified trust. Glossary ### Related terms #### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. #### Preservation Request A preservation request asks a company to retain specified records so they are not deleted while law enforcement obtains legal process. It compels retention, not disclosure: no data is handed over. In the United States it is grounded in 18 U.S.C. § 2703(f) and generally runs for 90 days, renewable once. #### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. #### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. EDRs are the most abused request type there is. See how Kodex verifies them before data moves. Learn more