# Law Enforcement Data Request Glossary | Kodex Source: https://www.kodexglobal.com/glossary > Definitions of the legal process, compliance, and verification terms used in law enforcement data request management. Built for legal and trust & safety teams. Glossary ## Law Enforcement Data Request Terms Plain-language definitions of the legal process, compliance, and verification terms that come up when a company receives a request for user data. Written for the legal, compliance, security, and trust & safety teams who have to act on them. ### A #### Administrative Subpoena An administrative subpoena is issued by a government agency under a specific statutory grant of authority, rather than by a court or grand jury. Its reach is bounded by the statute that created it, which means the first question on receiving one is whether that agency has authority over your company at all. Also: agency subpoena, regulatory subpoena ### C #### CLOUD Act The CLOUD Act establishes that US providers must produce data they control regardless of where it is stored, and creates a framework for bilateral agreements letting qualifying foreign governments serve orders on US providers directly. It also gives providers a route to challenge orders that conflict with foreign law. Also: Clarifying Lawful Overseas Use of Data Act #### Chain of Custody Chain of custody is the documented record of who handled a piece of evidence, when, and what they did with it, from collection through to presentation. An unbroken chain supports the claim that evidence is what it purports to be and has not been altered; gaps invite challenges to its admissibility. #### Cost Recovery Cost recovery is the reimbursement a company may seek for the expense of responding to legal process. In the United States, 18 U.S.C. § 2706 entitles providers to reasonable reimbursement for costs directly incurred in searching for, assembling, and producing the requested data. Also: reimbursement, 2706 reimbursement #### Court Order A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires. ### E #### Electronic Communications Privacy Act (ECPA) ECPA is the 1986 US statute governing government access to electronic communications. It has three parts: the Wiretap Act covering interception in transit, the Stored Communications Act covering data at rest, and the Pen Register Act covering real-time addressing data. Also: ECPA #### Emergency Disclosure Request (EDR) An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive. Also: EDR, emergency data request, exigent request #### European Production Order (EU e-Evidence) A European Production Order lets a judicial authority in one EU member state require a service provider in another to hand over electronic evidence directly, without routing through the second state’s government. Introduced by the EU e-Evidence Regulation, it carries short deadlines: generally ten days, or eight hours in an emergency. Also: EPOC, e-Evidence Regulation, European Preservation Order ### F #### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. Also: fake EDR, fraudulent EDR, forged emergency request ### G #### Grand Jury Subpoena A grand jury subpoena is issued in the name of a grand jury investigating potential criminal conduct, and compels the production of documents or testimony. It is issued by prosecutors without prior judicial review, and grand jury secrecy rules restrict what the prosecution may disclose about the proceeding. Also: federal grand jury subpoena ### L #### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. Also: LEEC, police email compromise, law enforcement account takeover #### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. Also: police impersonation, agency impersonation #### Legal Hold A legal hold is an internal instruction suspending the routine deletion of records that may be relevant to anticipated or pending litigation or investigation. Unlike a preservation request, it is imposed by an organisation on itself, and the duty to issue one arises as soon as litigation is reasonably foreseeable. Also: litigation hold, preservation hold ### M #### MLAT Request An MLAT request is a formal request for evidence made by one country to another under a mutual legal assistance treaty. Rather than a foreign agency contacting a company directly, the request travels government to government and is executed using the receiving country’s own legal process. Also: MLAT, mutual legal assistance treaty request ### N #### National Security Letter (NSL) A national security letter is an administrative demand issued by the FBI, without prior judicial approval, for limited subscriber and transactional records in national security investigations. It can carry a non-disclosure requirement, and it cannot compel the contents of communications. Also: NSL #### Non-Disclosure Order A non-disclosure order directs a company not to tell a user that their data was requested. It is a separate instrument from the process compelling production, is issued for a defined period, and requires the government to show that notice would cause a specific harm such as flight, evidence destruction, or danger to an individual. Also: gag order, NDO, 2705(b) order ### O #### ORI Number An ORI number is a nine-character Originating Agency Identifier assigned by the FBI to US criminal justice agencies authorised to access national systems. It identifies which agency an action came from, and it is a useful corroborating signal in verification, though it is not a credential. Also: Originating Agency Identifier, ORI ### P #### Pen Register and Trap and Trace A pen register records outgoing addressing information and a trap and trace device records incoming addressing information, prospectively and in real time. Both capture who communicated with whom, not what was said, and both are authorised on a certification standard lower than probable cause. Also: pen/trap, pen register order #### Preservation Request A preservation request asks a company to retain specified records so they are not deleted while law enforcement obtains legal process. It compels retention, not disclosure: no data is handed over. In the United States it is grounded in 18 U.S.C. § 2703(f) and generally runs for 90 days, renewable once. Also: 2703(f) request, preservation letter, data freeze request ### R #### Redaction Redaction is the permanent removal of information from records before they are produced, typically to withhold data about third parties or material outside a request’s scope. Effective redaction removes the underlying data rather than obscuring it visually, and failures here are usually technical rather than editorial. #### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. Also: agent verification, law enforcement verification #### Responsive Records Responsive records are the documents and data that actually fall within the scope of a specific request. Determining what is responsive is a scoping judgement, and getting it wrong in either direction means either failing to comply or disclosing more of a user’s data than the law required. Also: responsive data, responsive documents ### S #### Search Warrant A search warrant is an order issued by a judge authorising a search or seizure, granted only on a showing of probable cause. In data request work it is the instrument required to compel the contents of communications, and it is the highest legal threshold a company is likely to encounter. Also: warrant, Rule 41 warrant #### Stored Communications Act (SCA) The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach. Also: SCA, 18 U.S.C. 2701 #### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. Also: subpoena duces tecum ### # #### 2703(d) Order A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause. Also: d order, court order for records, 18 U.S.C. 2703(d)