Why a Forged Police Email Can Still Get Your Company to Hand Over User Data
In 2022, the FBI issued a public notice confirming what security researchers had already found: criminals were breaking into police department email accounts and using them to send real-looking emergency data requests to phone carriers, social platforms, and ISPs - and getting real user data back. Discord, Apple, and Meta all complied with at least one forged request before anyone caught it. Four years later, the exposure hasn’t gone away. It’s shifted to every company whose user base grew enough to start receiving law enforcement demands regularly, without ever building the team built to catch this.
Emergency requests skip the one safeguard that normally exists
A subpoena or court order comes with a judge or a grand jury already in the loop. An emergency data request (EDR) exists precisely to skip that - it lets law enforcement claim an imminent risk of death or serious injury and ask a company to hand over account data immediately, no court order required. That’s the right call in an actual kidnapping or active-shooter situation. It’s also the exact mechanism criminals exploit, because the company receiving the request has no judge to lean on and, with roughly 18,000 separate police agencies in the US, no shared way to confirm the badge, the department, or the sender’s email account hasn’t been compromised. Verification is the company’s problem alone, on a clock it didn’t set.
The deadline problem doesn’t end once a request checks out
Even a verified, legitimate request isn’t one deadline - it’s several, and they don’t share a clock. A subpoena typically gives weeks to respond; a search warrant or court order usually comes with its own compliance window; a preservation request freezes data for 90 days, renewable, while law enforcement decides whether to seek a warrant. Layered on top is the non-disclosure order question: many requests arrive with a gag provision barring the company from telling the user their data was requested, until that order expires or a court lifts it - which means someone has to track NDO expiration dates on a rolling basis just to know when notification becomes legally required, not optional.
This used to be a big-tech problem. It isn’t anymore.
Meta and Apple built dedicated law enforcement response teams because they process these requests by the thousand. A mid-market telehealth app, a crypto exchange, a vehicle telematics company, or a dating app with a few million US users now sits exactly where those platforms sat a decade ago - receiving a steady trickle of subpoenas, EDRs, and preservation letters with no dedicated function to catch a forged sender, no system tracking which NDOs expire this month, and a shared legal@ inbox standing in for what should be a verification and audit workflow. That gap is the same one showing up in crypto and digital asset compliance more broadly: the regulatory exposure scales with the user base long before the internal process does.
The companies in corporate legal and litigation functions that get this right aren’t buying generic case management - they’re buying a system built around verifying the requester first, then routing by request type to the right deadline and disclosure rule. That’s a different pitch than e-discovery or contract lifecycle software, even though it often gets lumped in with both.
Talk to us if your outbound to companies holding user data still pitches generic legal ops software instead of the verification step that decides whether the data request in front of them is even real.