April 30, 2025
As government demands for user data continue to rise—and increasingly risk pushing the boundaries of lawful authority—having a well-trained, trusted team to handle law enforcement requests is more important than ever. Whether internal or supported by outside resources, a strong Law Enforcement Response Team (LERT) is a vital safeguard for both user privacy and corporate liability.
Responding to legal process is not merely an administrative function. It requires professional judgment, legal sophistication, and often a healthy dose of skepticism. In an era of spoofed legal documents, overbroad requests, and cross-border data grabs, LERT team professionals must be trained to spot irregularities. This includes recognizing mismatches between jurisdictional authority and the issuing agency, identifying signs of forged or outdated documents, and flagging requests that raise red flags based on the requesting party’s past practices or the current political context.
The intake process should be fairly rigorous. Companies need a program that verifies data requests for authenticity—not just in form, but in substance. This means confirming the identity and authority of the requestor and validating the legal process’s legitimacy. Teams may want to be particularly cautious with requests that could implicate the company in controversial actions, such as aiding in deportations, prosecutions of abortion access, or politically motivated investigations. In these situations, ensuring that that process is narrowly interpreted, and that all available objections are raised (including objections, like those under the First Amendment, that may available only in certain circumstances). For example, if a subpoena seeks sensitive location data, the team should demand a search warrant, citing the heightened legal threshold under the Fourth Amendment. Or if a subpoena appears to seek information about a confidential source with whom a journalist is communicating, reporter’s shield law objections or First Amendment issues may need to be raised.
Emergency data requests present the greatest risk of overreach. They bypass judicial review and rely solely on the requesting agency’s claim of urgency. For that reason, the LERT should treat these requests with heightened scrutiny. Emergency requests should be documented thoroughly and subject to verification processes that include confirming the imminent nature of the threat. Failure to do so can result in significant reputational and legal harm.
Recent lawsuits against providers for disclosing information in response to fake emergencies highlight the dangers of failing to rigorously vet emergency requests. In cases filed against telecommunications providers and others, plaintiffs have alleged that information has been disclosed based on invalid emergency demands, without adequate verification. These cases underscore the necessity of robust intake and verification procedures for all emergency disclosures.
There is also growing litigation risk when companies disclose data with insufficient process or to the wrong party. In one particular matter in North Carolina, a company was sued for disclosing data in response to a forged warrant sent by a stalker to find the home address of his intended victim. While the stalker was sentenced for his criminal behavior, including his fraud, the provider is still facing litigation for its alleged improper disclosure. Similarly, a Connecticut healthcare provider was ordered to pay $853,000 in damages after negligently disclosing a patient's medical records in response to a subpoena that did not meet HIPAA requirements and resulted in emotional distress for the patient. These examples should serve as warnings: when mistakes happen, the company—not the agency requesting the data—bears the brunt of the reputational and legal fallout.
A high-functioning LERT or subpoena response team does more than simply process documents. It serves as the company’s legal and ethical conscience—carefully weighing each request and standing firm when the law or principles of privacy demand it. In today’s environment of regulatory uncertainty and increasing politicization of law enforcement efforts, training, vigilance, and sound legal process are not luxuries. They are imperatives.
