# Kodex: the text of https://www.kodexglobal.com > Kodex is the law enforcement data request management platform that verifies LE agents, processes requests, and protects your subscribers from fraud. ## Home Source: https://www.kodexglobal.com/ The legal data exchange ## Legal requests handled, the way they should be. 15,000+ agencies and the companies that hold the data work the same request on Kodex. Every requester is verified before a request can move. Trusted by How it works ### Behind every stalled request is a real case. #### Verify The requester's identity and agency are confirmed against the network before anything is sent. #### Structure The request arrives complete, scoped, and in the format the company needs. #### Review Legal basis and scope are reviewed together, in one secure workspace. #### Respond Data moves through the exchange, in time to matter. #### Record Every step is recorded. Chain of custody and audit trail, kept for both sides. For companies ### Stop parsing and screening. Start responding. Know every request is real before anyone opens it. Turn a flood of formats into one structured queue with deadlines you can meet. Hand a regulator the audit trail without assembling it. For agencies ### Get complete answers, in time to use them. - Verified once, recognized by every company on the network. - Send requests companies can act on the first time. - Free for verified investigators. Outcomes ### Driving remarkable outcomes 45 min Average response time Measured from the moment a verified request is sent to the moment the company responds. Structured requests and one shared queue take out the back-and-forth that used to slow every request down. 15k+ agencies in the kodex network 140k+ Verified investigators 200k+ requests handled 35k+ fraudulent requests blocked Broward County PD "Kodex cut our data request turnaround from weeks to hours. It's become the standard tool in our unit for handling crypto and telecom requests." Ruben Perez Deputy Sheriff, Broward County Read the success story Coinbase "We used to have three people chasing down subpoenas in spreadsheets. Kodex cut our response time in half," Ashley Monico Head of Compliance, Coinbase Read the success story Kodex Global Keynote ### Building the legal data exchange Why verified requesters, structured requests and a shared record are changing how agencies and companies work together. Watch the keynote Platform ### One system, from intake to resolution. #### Requester verification Confirm who is asking before a request is opened. #### Request automation Intake, routing, deadlines and responses in one structured workflow. #### Sign in with Kodex Verified identity for investigators, accepted across the network. #### Cost recovery Invoice and collect statutory reimbursements without new headcount. #### Threat intelligence Fraud caught anywhere on the network is caught everywhere. #### API and integrations Connect Kodex to the systems you already run. Trust ### Built to be trusted by both sides, and by the people in between. Kodex is the honest broker. We verify the requester, we structure the request, and we keep the record. We don't decide what a company shares, and we never sell or mine the data that moves through the exchange. Visit the trust center SOC2 II EU Data Residency EU e-Evidence Section 314(b) ### The latest from Kodex View all resources The Call: a case solved #### The request arrived verified, the data arrived in time. Watch the documentary News #### A New Partnership for Financial Crime Investigators Read More News #### The Infrastructure Behind Every Government Data Request Read More Report #### The Revolut Breach, Explained Read More --- ## The Kodex API | Automate Law Enforcement Data Requests Source: https://www.kodexglobal.com/api Kodex API ### Build on our network. Some teams want the Kodex application. Others have already built their own. The Kodex API gives you programmatic access to the same network, verification engine, and data production workflow the application runs on. Build what you want on top of it. Request a demo #### Trusted by 15K+ government agencies and the world’s leading crypto, financial services, and telecom companies. Trusted by Outcomes 97.5% Fewer law enforcement tickets Coinbase case study → 99.9% Faster law enforcement verification Bitget case study → 99% Of legal request issues resolved Bitfinex case study → One surface #### Three APIs. One network. The Kodex API is one surface: the Verification API, the Targets API, and status webhooks. Same authentication, same network, same intelligence layer. Only the endpoint changes. ##### Verification API Pass in a requester. Get back a verified-or-not result, with the metadata your systems need to act on it. Drop it into your intake flow, your case opener, or your account access path: anywhere the trustworthiness of the counterparty changes what your team does. The same verification engine that gates the Kodex portal, exposed for your own systems. POST /v1/verification/lookup - Requester - 200 OK - Verified Verification API { "email" : "agent.smith@fbi.gov" , } { "status" : "ACTIVE" , "substatus" : "VERIFIED" , "agency" : "FBI Cyber Division" , "jurisdiction" : "US-Federal" , "verified_at" : "2024-08-14T19:22:00Z" , "last_active" : "2026-05-20T11:08:00Z" } ##### Targets API Automate the work of producing data on a verified request. Account lookups return programmatically from your backend. Drafts surface for review before they leave your environment. The data your team produces stays in your environment until you decide to deliver it. GET /v1/requests/{request_id}/targets - Validated Request - Pull the data from kodex - Returns the targets data Targets API { "request_id" : "req_3f8a..." , "targets" : [ { "type" : "email" , "value" : "user@example.com" , "validated" : true , "source" : "auto_extracted" }, { "type" : "client_uid" , "value" : "user-e9BZSuaGgK5nwjLMCm89JEg3" , "validated" : true , "validation_rule" : "openai_user_id" } ] } ##### Status webhooks Get notified the moment an agent’s credentials change. POST {your_webhook_url} - Agent account changes - Kodex detects problem - Kodex sends webhook to your server Status webhooks { "email" : "agent.smith@fbi.gov" , } { "event" : "agent.suspended" , "agent_id" : "agt_8a2f4b1c" , "previous_status" : "ACTIVE" , "current_status" : "SUSPENDED" , "reason" : "credential_compromised" , "timestamp" : "2026-05-21T14:32:00Z" } Patterns #### What you can build A few of the patterns customers run on the API today. ##### Smarter legal intake Verify the requester behind every inbound legal request before a case is ever opened. ##### Native integration Embed Kodex verification inside your own product, so your customers benefit from the network without ever leaving your surface. ##### Engineer-free workflows Pull the data behind a verified request directly from your systems of record, with no engineer in the loop. ##### Secure draft routing Route drafts through your existing review workflow before anything leaves your environment. ##### Complete audit trails Stream every verification, every production, every delivery into your SIEM and audit pipeline. Teams #### When the API is the right choice. Enterprise legal teams ##### Large enterprises with their own legal centre. You have the workflow, systems of record, and review process. The API brings the network’s verification and data production into them. Kodex is the trust layer underneath. Your product Verification API Verified Verification API beneath your product Platform & SaaS companies ##### Platform companies whose customers also handle requests. Embed Kodex’s verification engine into your own product so your customers benefit from it. The Verification API is what powers that motion. Verified request Email Status agent@leo.gov 2 risk signals detected Suspended agent@agency.gov Verified sus@leo.gov 1 risk signal detected Pending admin@agency.gov No account Infrastructure-minded teams. ##### Built for teams that think in systems. For teams that treat lawful data access the way a CISO treats identity, Kodex isn’t an application. It’s infrastructure, and the API is how you consume it. 01Verification API 02Data protection API 03Kodex Unified API JSON in, JSON out #### How it works. - 01 ##### Authenticate. Scoped API keys for service-to-service calls. OAuth for user-context flows. Same auth posture as the portal. - 02 ##### Call. Verification or Data Production endpoint. JSON in, JSON out. - 03 ##### Handle. The response is signed, logged, and replayable in your own systems. - 04 ##### Audit. Every call writes to the same audit trail the portal does. One source of truth across both surfaces. FAQ #### Questions Everything about building on the Kodex API. Request a demo What is the Kodex API? The Kodex API is programmatic access to the network. The Verification API returns a real-time verification status for any law enforcement requester from one email lookup. The Targets API automates producing data on verified requests. Status webhooks tell you when a standing changes. Who is the API for? Teams that already have their own systems: legal and compliance teams with an in-house legal center, platforms embedding verification in their own product, and engineering teams that treat lawful data access as infrastructure. If you’d rather use a finished application, that’s Kodex Core. How does a lookup work? Send a requester’s email to the Verification API. It returns the agent’s standing, their agency’s status, and the domain’s risk level, checked against the Kodex Global Network in real time. One call, JSON in, JSON out. How is the API authenticated? With scoped API keys, sent in a request header. Keys are created and managed by your admins, and every call is logged to the same audit trail as the Kodex application. A demo environment is available for integration testing. Can we test before going live? Yes. Kodex provides a demo environment with test data, so your engineers can build and validate the integration end to end before production keys are issued. The interactive reference at docs.kodexapi.com lets you try calls in the browser. How do I get access? Talk to your Kodex account team, or reach out through the contact page. API access is provisioned per organization, with keys scoped to what your integration needs. --- ## Cost Recovery for Law Enforcement Requests | Kodex Source: https://www.kodexglobal.com/cost-recovery Cost recovery ### The cost of compliance, recovered. Statutes in dozens of jurisdictions allow companies to recover the cost of producing data for law enforcement. Almost no one does. Kodex automates the work of claiming what the law already says is yours. Request a demo #### The legal and finance teams at the world’s largest crypto exchanges, banks, and telcos recover compliance cost through Kodex. Trusted by Outcomes 97.5% Fewer law enforcement tickets Coinbase case study → 99.9% Faster law enforcement verification Bitget case study → 99% Of legal request issues resolved Bitfinex case study → Revenue recovery #### A line item most companies leave on the table. Federal and state statutes give companies the right to recover the cost of complying with subpoenas, search warrants, and other legal process. The money is real. What’s been missing is a practical way to claim it. ##### How revenue recovery works - Identify qualifying requests - Calculate eligible costs - Invoice agencies - Follow up for payment—tasks Legal process claims Manual recovery process - 01 Identify qualifying requests - 02 Calculate eligible costs - 03 Send invoices to agencies - 04 Follow up for payment—tasks $135,000 Claim amount $4,386 Recovered amount The Kodex recovery cycle #### Tracking, invoicing, collections. We do all of it. Kodex tracks the jurisdiction, eligible costs, and billing agency on every qualifying request. Invoices go out automatically, collections run in the background, and the revenue comes back to you. ##### Track which jurisdiction’s statute applies ##### Calculate eligible costs ##### Invoice agencies ##### Follow up for payment⁠—tasks FAQ #### Questions teams ask before they claim. Request a demo What requests qualify for recovery? The statutes vary by jurisdiction, but most cover subpoenas, search warrants, and other formal legal process for stored records. The platform applies the applicable rule to each request. You don’t need to know the statute to claim under it. Do we need to change anything about our finance or legal workflow? No. Recovery runs alongside the workflow you already have. Invoices go out from Kodex. Payments come back to you. Your team sees the recovered amount in their existing reporting, with the audit trail attached. What happens when an agency disputes the invoice? The Kodex team handles the back-and-forth. If a dispute escalates beyond what we can resolve, we send it to you with the full audit trail and a recommended response. Most invoices clear without a dispute. Why aren’t we already doing this? Because the work to do it at scale, identifying the eligible request, calculating the cost, invoicing the right agency, following up until they pay, has always been more expensive than the recovery itself. That’s the problem Kodex solves. The math only works when the work is automated. --- ## Integrations | Kodex in the Systems You Already Run Source: https://www.kodexglobal.com/integrations Integrations ### We plug into the systems you already run Real APIs and maintained integrations for the tools your team already works in. Request a demoSee how integrations works #### The legal and engineering teams at the world’s largest crypto exchanges, banks, and telcos integrate Kodex into the systems they already run. Trusted by Outcomes 97.5% Fewer law enforcement tickets Coinbase case study → 99.9% Faster law enforcement verification Bitget case study → 99% Of legal request issues resolved Bitfinex case study → APIs #### Most “integrations” in this category are a CSV export. Ours aren’t. ##### Verify any requester from your own systems. The Verification API returns a verified-or-not result on any law enforcement requester your systems encounter. Drop it into your intake flow, your case opener, or your support escalation path: anywhere knowing the requester is real changes what your team does next. Your systems Intake flow Case opener Support escalation Verification API County sheriff’s office Agency confirmed Verified Unverified sender Not verifiedBlocked ##### Produce data without an engineer in the loop. The Data Production API automates the work of producing data on a request. Account lookups return automatically from your backend. Drafts get reviewed before they leave your environment. The data your team produces stays under your control until you decide to deliver it. Data Production API Your environment Account lookup · KX-24471 Returned from your backend Draft response In review Delivery Held until you deliver ##### Put the network on your own front door. Sign in with Kodex puts the network’s verification engine behind a single button on your own legal center. The same engine that powers the rest of Kodex, deployed into your portal instead of ours. Your legal center legal.company.com Sign in with Kodex 356 Verified 28 Blocked Your stack #### Where we connect with the rest of your stack. Jira ##### For enterprises that run legal work in Jira. Verified requests route directly into your Jira workflows. Fulfillment happens in the tool your team already runs. Status syncs back automatically. Kodex → Jira 01Route requests 02Review & assign 03Fulfill & sync Hummingbird ##### Compliance teams on Hummingbird. Kodex request and response activity syncs into Hummingbird for compliance teams running on that platform. Kodex → Hummingbird 01Capture activity 02Record compliance 03Generate audit trail Custom ##### For everything else, built to order. Scoped integrations into internal case management, ticketing, and workflow systems via the underlying APIs. The team that builds them is the team that built Kodex. Kodex → Your systems 01Scope integration 02Config APIs 03Deploy integration FAQ #### Questions teams ask before they integrate. Request a demo How is this different from what other platforms call an “integration”? Most of what gets called an integration in this category is a CSV export. Ours are real APIs and bidirectional connections to named systems. The Verification API and Data Production API are programmatic surfaces engineering teams can build on. Jira and Hummingbird sync both ways. CSV exports don’t make this list. Do we have to use all three APIs to get value? No. The Verification API, Data Production API, and Sign in with Kodex are independent. Use one, use all three, or start with one and add the others later. What if the system we use isn’t on your integrations list? Jira and Hummingbird are the named integrations we build and maintain. For anything else, the Kodex team builds scoped custom integrations on top of the same APIs. The same team that built the network builds the integration. Where does the data live during an integration? In your environment. The data your team produces stays under your control until you decide to deliver it. Kodex sees what your systems return at the moment of delivery, not before. Do we need to be a Kodex customer to use the integrations? Yes. The APIs are the same surface the Kodex application runs on, and so is Sign in with Kodex. The integrations bring the network into your systems. They don’t bypass it. --- ## Requester Verification: Know Who's Asking | Kodex Source: https://www.kodexglobal.com/kodex-requester-verification Requester verification ### Every requester, continuously verified Kodex verifies every requester against a network of 15,000 government agencies and 150,000+ vetted agents. Continuously, before they reach your team. Request a demoSee the verification process #### The legal and trust teams at the world's largest crypto exchanges, banks, and telcos run on Kodex. Trusted by Outcomes 97.5% Fewer law enforcement tickets Coinbase case study → 99.9% Faster law enforcement verification Bitget case study → 99% Of legal request issues resolved Bitfinex case study → The old way #### The old way of verifying a requester doesn't hold up anymore. ##### A system that can’t scale Most companies still confirm an agent's identity with a phone call. That was never built for today's volume, or today's threats. Legacy verification ##### The inbox can't be trusted In 2024 the FBI warned US companies about fraudulent emergency data requests. Compromised police emails are sold on dark web forums. Spoofed agency domains follow. Emerging reality ##### Delays, exposure, and lost trust Investigators lose time. Companies carry regulatory and reputational risk. And the people whose data sits in the middle get no assurance at all. The real cost ##### Kodex is the replacement. Kodex replaces manual checks with real-time verification of identity, jurisdiction, and authenticity. Investigators move faster, companies carry less risk, and the system earns back the confidence the old way lost. The answer Identity assurance #### Our identity assurance program. Identity assurance is a measured discipline. NIST publishes the standards the rest of the industry references. Kodex meets those standards and adds what NIST does not define. ##### Identity proofing NIST IAL2 for remote proofing, with IAL3-grade controls on the highest-risk reviews. Agency affiliation, credential validation, evidence collection, and trained human review. ##### Authentication NIST AAL2 enforcement, with phishing-resistant options available. ##### Network data Cross-customer signal correlation across 15,000 agencies and 150,000+ investigators. Detection at one company becomes protection for all of them. ##### Threat intelligence Dark web monitoring, stealer log indexing, threat actor tracking, forged document detection. Built for the law enforcement request channel and run continuously. Identity assurance is the floor. The threat intelligence and the network are the proof. How verification works #### How verification works. Every requester is checked against the Kodex Global Network before they get in, and the check never really ends. Verification on Kodex happens in four places, each one closing a gap the others can't see. ##### Onboarding Agency affiliation, credentials, device, network signal. Clean applicants clear automatically. The rest go to the Kodex Threat Intelligence team for human review. No one gets on the network on the strength of an email address alone. Applicant checks Agency affiliation State police Credentials Badge ID matched Device Known laptop Network signal Agency network Patrol officer · Cleared automatically Verified Unlisted sender · Kodex Threat Intelligence In review ##### Continuous Verification doesn't stop at sign-up. Every active agent is re-checked against sign-in metadata, behavioral patterns, and credential state in the wild. A credential compromised on Tuesday is flagged before it gets used on Wednesday. Active agent · Detective Re-checked Sign-in metadata Normal Behavioral patterns Normal Credential state Compromised Tuesday 16:20 Credential found in a stealer log Flagged Wednesday 09:05 Sign-in attempt Blocked ##### Per request Every request is re-verified against the live state of the requester at the moment of submission. Not the state at sign-up. Not the state last week. This is what closes the gap on procedurally correct requests sent from compromised accounts. KX-24471 · Emergency disclosure Legal process Attached Format Valid Requester state At sign-up · Mar 12 Agency and credentials confirmed Verified Last week · Oct 14 Active At submission · Oct 21, 10:42 Credential compromised Blocked ##### Network-wide Signals from one customer correlate against signals from every other customer. A device fingerprint flagged at a crypto exchange shows up the next day at a telco. One company sees what shows up at its door. The network sees the actor. Blocked an agent Crypto exchange · Device fingerprint flagged Blocked Kodex network sees the data Signal correlated across customers Agent blocked everywhere Telco · next day · Same device fingerprint Blocked Signal layer #### The signal layer Verification is built on six categories of signal. The engine reads all of them, every time. 01 ##### Identity Who they say they are. 02 ##### Network Where they're coming in from. 03 ##### Behavior What they do once they're in. 04 ##### Domain hygiene Whether the domain itself is real. 05 ##### External intelligence What the rest of the internet says about them. 06 ##### Cross-customer correlation What they look like across every other door. Service #### Verification on demand. Some want the engine; others want the engine and the team. With Verification On Demand, Kodex Threat Intelligence verifies requesters for you. Some use it to support a small team, others to replace one. Done by the team that built the network. Request a demo Hire the team Request Request Request Request Handling capacity AML Your team KOX Kodex team Requests verified by the team Verified Global verification network #### The network is the product Kodex works because verification improves as the network grows. Every new agency, company, and verified requester strengthens the system for everyone connected to it. Request a demo FAQ #### Questions teams ask before they deploy. Request a demo How does Kodex actually verify a requester? Identity proofing to NIST IAL2, authentication to NIST AAL2, threat intelligence against the law enforcement request channel, and cross-customer signal correlation across the network. Most requesters clear automatically. The high-risk ones go to the Kodex Threat Intelligence team. What happens to requesters who fail verification? They don't reach your team. The request is blocked at the gate and logged for your audit trail. Your reviewers only see requests from verified agents. Can we use Kodex without changing our intake surface? Yes. Verification can run as a gate on your Kodex portal, as a one-tap Sign in with Kodex button on your own legal center, or as a Verification API call from your existing systems. The engine is the same in all three. How is this different from a domain check or an agency lookup? A domain check tells you the email looks legitimate. An agency lookup tells you the agency is real. Neither tells you the person sending the request is who they claim to be, or that their credentials haven't been compromised since the last time you checked. Kodex verifies the requester, not just the envelope. What about emergency requests where there's no time to verify? Verification runs in the same window the request takes to submit. Legitimate requests clear in seconds. The fraudulent ones pay the cost of being slow. Do we have to staff a verification team to use this? No. Most customers run on the engine alone. If you want the team that built the engine to handle the highest-risk reviews on your behalf, that's Verification On Demand. How does this fit with our existing legal request workflow? Verification is the layer in front of whatever you already have. You don't have to replace your intake, your case management, or your review process to add it. --- ## Kodex Platform Overview | Law Enforcement Data Requests Source: https://www.kodexglobal.com/product-overview Products overview ### One system for the whole request lifecycle. Verify who's asking, work the request, and recover the cost. One platform for legal, trust & safety, compliance, and finance teams. Request a demoExplore Products #### Verified intake, case management, reporting, and cost recovery. Four jobs, one platform, one record. Products overview #### Core products - 01 ##### Sign in with Kodex One button puts Kodex verification on the front door of your existing legal center. Learn more → - 02 ##### Requester Verification Verify government agencies and vetted agents before requests enter your queue. Learn more → - 03 ##### Request Management Every requester is checked against the Kodex Global Network: 15,000 government agencies, 160,000+ verified agents, and 180+ countries. Learn more → - 04 ##### Cost Recovery Intake forms adapt to the jurisdiction and request type, so bad requests get corrected before they're submitted, not after. Learn more → Sign in #### You don't have to build the network. We already did. When a requester arrives, they tap Sign in with Kodex. Agency, email domain, credential, and network behavior are checked in one second. They land in your portal already verified. Request a demoExplore more Request verification ##### How Kodex verifies every requester, and never stops Every requester is checked against the Kodex Global Network before they get in, and the check never really ends. Verification on Kodex happens in four places, each one closing a gap the others can't see. Request a demoExplore more → Request management ##### Built for the entire request lifecycle From verified intake to secure delivery and executive reporting, every step of a law enforcement request happens in one platform, on one record. Less manual work, less risk, and nothing lost between systems. Request a demoExplore more → Report generation SAR Generated FINCEN Generated GDPR Generated Cost recovery ##### Tracking, invoicing, collections. We do all of it. Kodex tracks the jurisdiction, eligible costs, and billing agency on every qualifying request. Invoices go out automatically, collections run in the background, and the revenue comes back to you. - AT&T identified more than $4 million in recoverable cost. - Yahoo recouped $130,000 in their first year on the platform. Request a demoExplore more → Legal process claims Manual recovery process - 01 Identify qualifying requests - 02 Calculate eligible costs - 03 Send invoices to agencies - 04 Follow up for payment—tasks $135,000 Claim amount $4,386 Recovered amount Customers “At Coinbase regulatory compliance is a core part of our business. Kodex is a powerful tool and partner when engaging with regulators” John Kothanek VP of Global Intelligence Customer story “Having all our data in one place has revolutionized our investigative capabilities. This strategic intelligence helps us protect our platform more effectively." Shann Lu Head of AML Customer story “With Kodex, we don’t just manage compliance; we ensure trust, efficiency, and security at every step.” Hon Ng Bitget’s Chief Compliance Officer Customer story --- ## Law Enforcement Request Management | Kodex Source: https://www.kodexglobal.com/request-management Request management ### How a law enforcement request moves through our platform. Receive, respond, and report on every request, in one place. Request a demo #### The legal operations teams at the world’s largest crypto exchanges, banks, and telcos handle every law enforcement request through Kodex. Trusted by Outcomes 97.5% Fewer law enforcement tickets Coinbase case study → 99.9% Faster law enforcement verification Bitget case study → 99% Of legal request issues resolved Bitfinex case study → 01 · Receive #### One verified intake. Every request, every channel, every requester, handled through one verified intake. ##### One door, not a dozen. Email aliases, fax lines, legacy ticketing systems, and public contact forms collapse into a single intake on your own custom domain. ##### Verified before they get in. Every requester is checked against the Kodex Global Network: 15,000 government agencies, 150,000+ verified agents, and 180+ countries. ##### Structured intake, not PDF triage. Intake forms adapt to the jurisdiction and request type, so bad requests get corrected before they’re submitted, not after. 02 · Respond #### One secure workbench. Manage, fulfill, and deliver every request through one secure, auditable workflow. ##### One workbench, full history. Status, tasks, history, linked subjects, secure messages, preservation, and translation all live inside the case record. ##### Production stays in your environment. Account lookups return via API, drafts route for review, and data stays under your control until delivery. ##### Delivery, encrypted and auditable. Download links are encrypted, expire on schedule, and log chain-of-custody from production to delivery. 03 · Report #### The work reports itself. The same case data produces executive dashboards, regulatory reports, and recovered cost. ##### Live operational visibility. Dashboards show volume, response time, SLA performance, and trends by jurisdiction, agency, and request type. Internal reporting feeds monthly compliance reviews. Historical case search lets your team find patterns, prior decisions, and linked investigations across years of activity. 49 Requests verified 2 min Average response time Requests by jurisdiction This month ##### Transparency reports without spreadsheet work. Regulator-ready and public-facing transparency reports are generated from the same data your team is already working in. SAR, FinCEN, GDPR, and other structured compliance outputs come out of the platform without spreadsheet work. Report generation SAR Generated FINCEN Generated GDPR Generated ##### Cost recovered automatically. The cost of doing the work, which most companies absorb because invoicing every agency has never been practical at scale, gets recovered automatically. - AT&T identified more than $4 million in recoverable cost. - Yahoo recouped $130,000 in their first year on the platform. More on cost recovery → Invoice automation Invoice · Federal agency $1,240 Sent Invoice · State police $860 Sent Invoice · County sheriff’s office $415 Sent 240+ Invoices sent $45,600 Revenue recovered FAQ #### Before teams switch. The common operational, security, and migration questions teams ask before moving request management into Kodex. Request a demo How is this different from a ticketing system or a legal CLM? A ticketing system handles intake. A CLM handles contracts. Neither one verifies the requester or produces data on a verified request. Kodex is built around the request lifecycle, from the requester at the door to chain-of-custody at delivery. That’s a different shape of problem from anything in the adjacent categories. What about the email aliases and fax lines we already use? Most customers keep their legacy channels open during the transition and direct requesters to the verified path over time. Once the verified channel is carrying the work, the legacy aliases get sunset. You don’t have to flip a switch on day one. Do requesters need an account to send us a request? Yes. Every requester is verified through the Kodex network before they reach you. That verification is what makes the rest of the workflow possible. Most verified agencies clear sign-up automatically. The rest go through human review with the Kodex Threat Intelligence team. How does this connect to the systems our team already uses? Through API. Kodex connects directly to your case management, ticketing, and custom systems of record. Account lookups return from your backend. Drafts route through your existing review workflow. Nothing has to be rebuilt on Kodex to use Kodex. Where does the data live during a response? In your environment. The data your team produces stays under your control until you decide to deliver it. Kodex sees what you return at the moment of delivery, not before. --- ## Security & Compliance | Kodex Source: https://www.kodexglobal.com/security-compliance Security & compliance ### Controls that match the stakes. Subpoenas, warrants, and emergency disclosures, handled with enterprise authentication, encrypted exchange, configurable retention, and a complete audit trail. Request a demoCheck how security works #### The legal operations teams at the world’s largest crypto exchanges, banks, and telcos handle every law enforcement request through Kodex. Trusted by Outcomes 97.5% Fewer law enforcement tickets Coinbase case study → 99.9% Faster law enforcement verification Bitget case study → 99% Of legal request issues resolved Bitfinex case study → Control layers #### The work is consequential. The controls have to match. The data in Kodex protects people when it’s handled right, and harms them when it isn’t. That’s the standard. Three control layers run continuously. ##### Who’s in the system, what they can do, and how that access changes over time. Enterprise SSO and centralized access management through your existing identity provider, with automated provisioning, role-based permissions, and granular admin controls that ensure every team sees only what they need. Permissions Enterprise SSO Your identity provider · automated provisioning Verified Profile & role Access Legal operations lead Super admin Full access Compliance analyst Reviewer Assigned requests Security engineer Auditor Audit log, read only Contractor Deprovisioned March 26 Access removed ##### How data moves and where it lives. All data in Kodex is encrypted in transit and at rest, with multi-country data residency and configurable retention policies that keep sensitive information stored, governed, and retained according to your regulatory, contractual, and operational requirements. Encryption In transit Encrypted At rest Encrypted Retention policies Data type Residency · retention Report Subpoena California, USA 7 years Production Warrant Frankfurt, EU 5 years Request record Emergency disclosure London, UK 1 year ##### How the work becomes defensible on demand. Maintain a complete, timestamped audit trail of every action and request, with built-in support for major lawful data access frameworks and audit-ready exports available directly from the platform. No engineering effort required. Compliance CalECPA GDPR EU e-Evidence Data type Generated date Audit trail Subpoena · KX-31207 March 26, 12:30 PM Access log All users March 26, 12:31 PM Disclosure record Emergency disclosure March 25, 4:05 PM Download the audit report FAQ #### Questions teams ask before they sign off. Request a demo How is this different from a generic SaaS security posture? Generic SaaS controls are built for generic data. Kodex is built for data that arrives via subpoena, warrant, and emergency disclosure request. The retention, audit, and access controls match the legal exposure this workflow creates, not a baseline that fits everything. Where does our data live? In the jurisdiction your regulators, customers, and contracts require. Kodex supports multi-country data residency, configurable per workflow. Sensitive request data does not travel outside the regions you’ve set. Who at Kodex can see our data? Access by Kodex personnel is role-restricted, logged, and limited to support paths your team authorizes. The data your team produces inside Kodex stays under your control. What happens to our data if we leave? Retention is configurable per workflow and per jurisdiction. On exit, data follows the retention policy you’ve set. Audit-ready exports are available throughout the relationship. How do we get a security review with your team? Talk to security through the CTA below. Our team works directly with your CISO group on questionnaires, attestation review, architecture discussions, and the materials your evaluation requires. --- ## Law Enforcement Request Threat Intelligence | Kodex Source: https://www.kodexglobal.com/threat-intelligence Threat intelligence ### Caught at one company. Blocked at all. Threat intelligence built into every Kodex product, not a feed you subscribe to. Request a demoCheck how detection works #### The security and trust teams at the world’s largest crypto exchanges, banks, and telcos defend together on Kodex. Trusted by Outcomes 97.5% Fewer law enforcement tickets Coinbase case study → 99.9% Faster law enforcement verification Bitget case study → 99% Of legal request issues resolved Bitfinex case study → Defending together #### A single company can only see what shows up at its own door. ##### Defending alone means late. Sophisticated threats aren’t visible from one vantage point. A compromised police email is used at multiple companies before detection. A spoofed agency domain hits three platforms before any sees it twice. Defending alone means defending late. The Kodex Global Network connects 15,000 agencies and 150,000+ agents across 180+ countries. Every signal one customer detects benefits all. Fraudulent emergency data requests caught at one bank get caught everywhere. That’s the difference between defending alone and defending together. Kodex Global Network 15,000 Agencies 150,000+ Vetted agents 180+ Countries Fraudulent emergency data requestBlocked Caught at One bank Caught Everywhere on the network 01 · Detect #### Detection runs on every signal, every sign-⁠in, every time. The detection layer reads sign-in metadata, runs domain checks on credentials, monitors the dark web for compromised accounts, and watches for behavioral anomalies in the user base. ##### A single signal in isolation is noise. A signal correlated against 150,000 others is intelligence. Detect 24/7 Process - 01 Checks sign-in metadata - 02 Runs domain check - 03 Monitors dark web - 04 Watches behaviour anomalies Correlated against 150,000 others 02 · Assess #### Detection produces signals. Assessment turns signals into judgments. The Kodex Threat Intelligence team, who run Verification On Demand, continuously analyze network data. Each country has a risk tier, from In Good Standing to Rejection Likely, based on real data. Threat actors are tracked across customers and time, linking patterns no single company could see. The same domain spoofing used on three platforms, the same compromised credential surfacing in a new region: all connected here. The judgment is the product. The signals are the input. Signal Unknown request Signal Requester anomaly Assessing the riskIn review Kodex team + Network Country risk tier Rejection Likely Shares the threat signal to the network Sent 03 · Disseminate #### The intelligence moves in three directions. ##### Live propagation, network-⁠wide. When a credential is compromised, every active session using it is re-verified across every customer, automatically. No alert to triage, no patch to apply. The network updates itself. ##### Threat alerts and threat briefings. Threat alerts is a live feed of compromised emails and domains in Kodex Verify, searchable and integrated into your team’s workspace. Threat briefings is the monthly intelligence report: what the network saw last month and what’s coming next. ##### Read across the industry. The Kodex threat intelligence newsletter is read across the industry, cited in regulatory briefings and quarterly reviews, and often names threat actors first. FAQ #### Questions teams ask before they trust the network. Request a demo How is this different from a threat intelligence feed? A threat feed sends you data and leaves you to figure out what to do with it. The Kodex layer is built into the products your team is already running. The same engine that verifies a requester is the engine that flagged the compromised credential they’re using. No feed to integrate, no parsing to do, no separate workflow. Detection happens where the work happens. Can we get the threat intelligence without using the rest of Kodex? The intelligence is the network, and the network is the customers using the platform. You can read the monthly Threat Briefing without being a customer. The live signal layer, the part that protects you in real time, only runs where the platform runs. What’s the difference between Threat Alerts and Threat Briefings? Threat Alerts is the live feed of compromised emails and domains inside Kodex Verify. Threat Briefings is the monthly narrative report from the Kodex Threat Intelligence team: what the network saw, what to watch next. How quickly does a signal at one customer become protection at another? Live. A credential flagged at one company on the network is re-verified against every active session touching that credential on every other company on the network. There is no “syncing window.” Who is the Kodex Threat Intelligence team? The same analysts who run Verification On Demand on behalf of customers. They built the network and they work its data continuously. Threat profiles, regional risk tiers, alerts, and briefings come from this team. --- ## Kodex Verify | Is That Law Enforcement Request Real? Source: https://www.kodexglobal.com/verify Kodex Verify ### Verify any law enforcement email. Verify law enforcement email addresses in seconds against the Kodex Global Network of 15,000+ agencies and 150,000+ investigators. Sign upWatch Video #### Trusted by 15K+ government agencies and the world's leading crypto, financial services, and telecom companies. Trusted by Threat landscape #### The threat landscape has changed The old ways don't work anymore. Attackers have evolved, and so must your defenses. 01 ##### Local targets 86% of fraudulent domains target local agencies. They know where to strike hardest. 02 ##### Email Kits Compromised government emails are sold as kits on the dark web. Anyone can buy access. 03 ##### Forged orders Court orders built from leaked templates circulate freely. They look real because they are based on the real thing. 04 ##### AI acceleration Artificial intelligence is making impersonation faster and more convincing. The machines don’t sleep. Video #### See it in action Watch how verification, threat intelligence, and analytics work together Video Introducing Kodex Verify · 2:17 Pricing #### Pricing Plans Watch how verification, threat intelligence, and analytics work together ##### Starter $0 /mo - 20 requests / month - Basic Agent Verification - Essential threat intelligence summaries - Magic Link Auth - Task Assignment - User Admin Activate Now → ##### Scale $99 /mo - Complete Agent Verification Results - Full Threat Intelligence Summaries - Real-Time Intel for High-Risk Users - Continuous Agent Alerts - Analytics Dashboard - Email Support Sign up ##### Professional By Quote Includes Kodex Verify + Secure Intake & Case Management - Continuous Verification and Threat Intel - Secure Intake Portal - Integrated Case Management and Secure Messaging - Intelligent Case Triage and Routing - Automated Data and Target Extraction - Executive Insights and Transparency Reporting Request a demo → Existing customers #### Already have an account? Core and API customers get Verify at no cost. Log in with your existing Kodex credentials. Sign up FAQ #### FAQs Everything about verifying law enforcement requests. Sign up What is Kodex Verify? Kodex Verify is a real-time verification and threat intelligence platform powered by the Kodex Global Network. It lets you check whether a law enforcement email address is legitimate and monitor emerging threats like compromised credentials, suspicious domains, and new impersonation methods. Who is Kodex Verify for? Any company that receives law enforcement data requests. That includes legal, compliance, trust & safety, and information security teams at companies of any size. If someone claiming to be law enforcement contacts your organization, Verify helps you confirm they are who they say they are. How does verification work? Enter an email address into Verify. The platform checks it against the Kodex Global Network in real time and returns the verification status in seconds. The network includes 15,000+ agencies and 150,000+ investigators worldwide. What is the Kodex Global Network? The world's only continuously verified law enforcement network. 15,000+ agencies and 150,000+ investigators, monitored around the clock by a dedicated threat intelligence team. Every Kodex product is powered by this network. Is Kodex Verify free? Yes. The free tier includes 20 verification checks per month, access to the live threat signals feed, and personal search history. Paid tiers start at $99/month for higher check volumes, real-time monitoring, team-wide visibility, and analytics. How do I get access? Visit verify.kodexglobal.com and request access. Verify is restricted to verified companies to protect the sensitive intelligence on the platform. Most domains are approved within 24 hours. Why is access restricted? The verification and threat intelligence data in Verify is sensitive. Restricting access to verified companies ensures that the intelligence stays out of the hands of the threat actors it's designed to detect. I'm already a Kodex customer. Do I need to sign up separately? No. If you're a Kodex Core or API customer, you already have access to Verify at no cost. Visit verify.kodexglobal.com and log in with your existing credentials. Can I invite my team? Yes. You can invite teammates to Verify so your entire organization has access to verification and threat intelligence. Team-wide search history, activity monitoring, and analytics are available on paid tiers. What's the difference between Verify and Kodex Core Portal? Kodex Core Portal is the full platform for receiving, managing, and responding to law enforcement data requests. Verify is a standalone tool focused specifically on verification and threat intelligence. Many companies start with Verify and expand to Core Portal as their needs grow. Does Verify replace the Threat Intelligence Newsletter? Yes. The intelligence that was published monthly in the newsletter is now available as a live feed inside Verify. It's searchable, continuously updated, and accessible anytime. --- ## Law Enforcement Request Management for Crypto | Kodex Source: https://www.kodexglobal.com/industries/crypto Crypto ### Protect your users from law enforcement data request risks Crypto exchanges lose millions to email-based fraud and compliance failures. Kodex gives you a secure platform to manage government data requests, verify law enforcement, and demonstrate compliance. Request a demo Trusted by #### Trusted by crypto leaders to handle sensitive data requests and block impersonation attacks The risk #### Emails are putting your crypto exchange at risk Request a demo 01 ##### Brand trust One data breach destroys user trust. Email leaves you exposed to leaks and unauthorized access. 02 ##### Security & fraud Email-based attacks cost crypto companies millions. Bad actors impersonate law enforcement to steal user data and crypto assets. 03 ##### Compliance & fines Missed deadlines and improper data handling lead to penalties. Email makes audits and proving compliance extremely time-consuming, sometimes impossible. 04 ##### Operational burden Your team wastes hours taking requests, managing multiple inboxes, and manually verifying law enforcement agents. How Kodex helps #### How we protect your crypto exchange ##### Verify every request Block impersonators instantly. Automatic law enforcement verification stops fraudulent requests before they reach your team. 01 ##### Verify Every agent is verified before a request ever reaches your team. 01Agent verification system 02Threat actor detection 03Digital credentials verification ##### Secure data handling Control sensitive data with end-to-end encryption. Keep user information protected throughout the request process. 02 ##### Protect User data stays encrypted from the first request to the final file transfer. 01Encrypted workspace 02Secure file transfer 03Access controls 04API integration ##### Stay compliant Meet deadlines and requirements across jurisdictions. Generate compliance reports in one click. 03 ##### Comply Deadlines, audit trails and reports stay in step across every jurisdiction. 01Automated workflows 02Deadline tracking 03Audit trails 04Transparency reporting ##### Work efficiently Cut response time by 70%. Automated intake and assignment free your team from manual tasks. 04 ##### Automate Intake and assignment run on their own, so your team can focus on the response. 01Smart request routing 02Team collaboration tools 03Automated responses 04Progress tracking Customers #### Trusted by leading crypto exchanges SOC 2 Bank-level encryption “At Coinbase regulatory compliance is a core part of our business. Kodex is a powerful tool and partner when engaging with regulators.” John Kothanek VP of Global Intelligence, Coinbase Read the story “Having all our data in one place has revolutionized our investigative capabilities. This strategic intelligence helps us protect our platform more effectively.” Shann Lu Head of AML, Bitfinex Read the story “With Kodex, we don’t just manage compliance; we ensure trust, efficiency, and security at every step.” Hon Ng Chief Compliance Officer, Bitget Read the story FAQ #### Frequently asked questions What is a fraudulent law enforcement data request? A data request that looks like it comes from a real agency but doesn’t. Attackers use compromised or spoofed law enforcement email accounts (LEEC) to trick exchanges into handing over user data. How does Kodex verify law enforcement agents? Every agent is verified before a request ever reaches your team. Kodex checks identity, agency, and jurisdiction, and flags anomalies across the whole network. Do crypto exchanges have to respond to every request? No. You need to verify the request is real and legally valid first. Kodex gives your team the verification and audit trail to respond with confidence. --- ## Law Enforcement Request Compliance for Fintech | Kodex Source: https://www.kodexglobal.com/industries/fintech Fintech ### Control law enforcement data access and risk Fraudsters are increasingly impersonating law enforcement agents to access your customers’ data and funds. Regulators have raised the bar for data security under GLBA and RFPA, putting banks and financial institutions on notice. Kodex gives you a secure platform to verify law enforcement, manage government requests, and meet strict regulatory standards. Request a demo The risk #### Email requests expose financial assets Request a demo 01 ##### Brand & trust risk Financial data breaches destroy market confidence. Email-based data sharing lacks the security controls customers expect from modern financial services. 02 ##### Operational strain Request volumes outpace manual processes. Teams struggle with scattered inboxes, cross-department bottlenecks, and error-prone email workflows that can’t scale. 03 ##### Regulatory risk CFPB and FDIC scrutiny demands precision. Email chains fail to meet evolving financial regulations, creating audit gaps and compliance blind spots that risk severe penalties. How Kodex helps #### How we protect your financial platform ##### Verify every request Block unauthorized access instantly. Automatic verification stops fraudulent requests and validates regulatory credentials before they reach your team. 01 ##### Verify Every requester and regulatory credential is checked before a request reaches your team. 01Agent verification system 02Credential validation 03Multi-regulator authentication ##### Secure portal and data handling Control financial data with bank-grade security. Keep customer information protected throughout the request lifecycle. 02 ##### Protect Customer financial data stays inside a bank-grade portal for the whole request. 01Bank-branded secure portal 02End-to-end encryption and secure file transfer 03Chain-of-custody tracking 04Granular access controls ##### Meet regulatory standards Respond to regulatory requirements confidently. Generate audit reports and prove compliance to satisfy regulators with full audit trails for OCC and CFPB examinations. 03 ##### Comply A full audit trail is ready for every OCC and CFPB examination. 01Deadline tracking 02Compliance audit trails 03One-click transparency reporting ##### Work efficiently Cut response time by 85%. Transform manual processes into streamlined operations. 04 ##### Automate Manual steps become one streamlined workflow, from intake to response. 01Smart request routing 02Cross-team collaboration 03Secure internal and external communications 04Response templates 05Single dashboard to view all requests FAQ #### Frequently asked questions What is a fraudulent law enforcement data request? A data request that looks like it comes from a real agency but doesn’t. Attackers use compromised or spoofed law enforcement email accounts (LEEC) to trick financial platforms into handing over customer data. How does Kodex help compliance teams manage subpoenas and data requests? Kodex gives compliance teams one place to receive, verify, track, and respond to every law enforcement request, with deadline tracking and a full audit trail. Do fintech companies have to respond to every request? No. You need to verify the request is real and legally valid first. Kodex verifies the requesting agent before your team spends time on a response. --- ## Law Enforcement Request Management for Betting & Gambling | Kodex Source: https://www.kodexglobal.com/industries/gambling Betting & gambling ### Protect player data from law enforcement request risks The law treats betting operators as financial institutions, and legal process follows the money. Kodex gives you a secure platform to verify every law enforcement request, route it to the correct licensed entity, and keep the record examiners ask for. Request a demo The risk #### Email puts your betting operation at risk Request a demo 01 ##### Brand trust Players trust you with verified identity, payment data, and a full transaction history. A wrongful disclosure creates liability to the customer, not just the regulator. 02 ##### Security & fraud Forged subpoenas and compromised government email accounts target betting operators, because one production returns identity, banking, and location data together. 03 ##### Compliance & fines Operators are casinos and money services businesses under the Bank Secrecy Act, and obliged entities in the UK, EU, and Australia. Gaming commission examiners now sample case files and read for a complete record. 04 ##### Operational burden At many operators the whole function is one person and an inbox. Volume grows every year, requests arrive addressed to the wrong entity, and manual review cannot catch a compromised .gov account. Public institution pricing ##### Run a public lottery or a gaming commission? You qualify for public institution pricing. State, provincial, and tribal lotteries and gaming regulators get 30% off the list price of a Kodex subscription, with nothing removed from the product. Requests for player, retailer, and licensee records arrive either way. The rate is built for the budget that has to answer them. See public institution pricing → How Kodex helps #### How we protect your betting operation ##### Verify every request Every requester is verified before a human reads the request. 15,000+ government agencies and 150,000+ verified investigators across 180+ countries are already on the network. 01 ##### Verify Every requester is checked against the Kodex network before your team sees the request. 01Automated agent verification system 02Multi-jurisdiction verification 03Digital credentials verification ##### Secure data handling Protect player data with end-to-end encryption. Keep identity, payment, and wagering records safeguarded through the request lifecycle. 02 ##### Protect Identity, payment and wagering records stay encrypted through every request. 01Encrypted workspace 02Secure file transfer 03Granular access controls 04Cross-department collaboration ##### Meet regulatory requirements Meet BSA, state gaming commission, UKGC, and AUSTRAC expectations with a timestamped record from intake to resolution. Kodex is licensed as a gaming vendor in New Jersey and Pennsylvania. 03 ##### Comply Every request keeps a timestamped record from intake to resolution. 01Real-time deadline tracking 02Comprehensive audit trails 03Compliance reporting ##### Work efficiently Cut response time by 85%. Route requests by licensed entity from intake and resolve most productions with standard packages. 04 ##### Automate Requests reach the right licensed entity and resolve with standard packages. 01Smart request routing 02Cross-team collaboration tools 03Automated response templates 04Request timeline tracking FAQ #### Frequently asked questions Why do betting operators receive so many law enforcement requests? Betting operators hold what a bank holds: verified identity, payment instruments, transaction history, and geolocation records. Legal US sports betting expanded to 39 states plus DC in a few years, and request volume followed. How does Kodex verify law enforcement agents? Every agent is verified before a request reaches your team. Kodex checks identity, agency, and jurisdiction, and flags anomalies across the whole network. Is Kodex licensed as a gaming vendor? Yes. Kodex holds state gaming-vendor licenses in New Jersey and Pennsylvania, the two states that examine vendors in this workflow most closely. --- ## Law Enforcement Request Management for Telecoms | Kodex Source: https://www.kodexglobal.com/industries/telecommunications Telecommunications ### Protect subscriber data from law enforcement request risks Bad actors are increasingly exploiting lawful data requests to breach telecom networks and access sensitive subscriber data worth billions. Kodex gives you a secure platform to verify law enforcement, manage government requests, and maintain Cable Act compliance. Request a demo The risk #### Email puts your telecommunications network at risk Request a demo 01 ##### Brand trust Subscribers demand protection of their personal information. Email's lack of security and oversight drives customers to competitors. 02 ##### Security & fraud Email-based attacks expose sensitive subscriber data to breaches. Bad actors impersonate law enforcement to access customer records and location data. 03 ##### Compliance & fines Regulations like the Cable Act carry severe penalties for unintentionally divulging subscriber data. Law enforcement email impersonation makes it easier for hackers to gain access to this data than ever before. 04 ##### Operational burden Your team wastes hours processing requests, managing multiple jurisdictions, and manually verifying law enforcement credentials. How Kodex helps #### How we protect your telecommunications network ##### Verify every request Block unauthorized access instantly. Law enforcement verification ensures Cable Act compliance and stops fraudulent requests before they reach your team. 01 ##### Verify Every agent is verified across jurisdictions before a request reaches your team. 01Automated agent verification system 02Multi-jurisdiction verification 03Digital credentials verification ##### Secure data handling Protect subscriber data with end-to-end encryption. Keep sensitive customer information safeguarded throughout the request lifecycle. 02 ##### Protect Subscriber data stays encrypted throughout the request lifecycle. 01Encrypted workspace 02Secure file transfer 03Granular access controls 04Cross-department collaboration ##### Meet regulatory requirements Navigate complex telecom regulations confidently. Automate Cable Act, ECPA, and CALEA compliance across jurisdictions. 03 ##### Comply Cable Act, ECPA and CALEA requirements are tracked in every jurisdiction. 01Real-time deadline tracking 02Comprehensive audit trails 03Compliance reporting ##### Work efficiently Cut response time by 85%. Transform request management from a resource drain into a streamlined operation. 04 ##### Automate Requests are routed, tracked and answered from one streamlined workflow. 01Smart request routing 02Cross-team collaboration tools 03Automated response templates 04Request timeline tracking FAQ #### Frequently asked questions Why do telecom providers receive so many law enforcement data requests? Telecom providers hold subscriber records, call metadata, and location data, which makes them one of the highest-volume recipients of law enforcement requests in any industry. How does Kodex verify law enforcement agents? Every agent is verified before a request reaches your team. Kodex checks identity, agency, and jurisdiction, and flags anomalies across the whole network. How does Kodex help with transparency reporting? Every request is tracked in one system, so transparency reporting for law enforcement requests comes from real data instead of manual spreadsheets. --- ## Compliance Teams: Law Enforcement Request Management | Kodex Source: https://www.kodexglobal.com/teams/compliance For Compliance Leaders ### Control law enforcement data request risks for compliance teams Turn your data request process into a proactive shield against fraud and compliance violations. Build a secure, automated system that helps you detect patterns, prevent breaches, and stay ahead of regulators Request a demo The risk #### Key data request compliance management challenges Request a demo 01 ##### Fraud detection gaps Email-based data request handling makes it hard to connect the dots, making it easy to miss critical patterns of suspicious activity. 02 ##### Reporting & auditing Scattered information makes creating transparency reports, gathering metrics, and auditing time-consuming and frustrating. 03 ##### Cross-team coordination Fragmented communication between compliance, legal, and response teams creates blind spots in your investigation process. 04 ##### Regulatory exposure Basic tools leave you vulnerable to missed deadlines and unauthorized disclosures, putting your organization at risk of penalties. How Kodex helps #### How we power modern compliance teams Trusted by Leaders #### Powering compliance excellence at leading enterprises 85% less time spent on manual processes 1M$+ saved in compliance violations 5K+ law enforcement impersonators blocked --- ## Legal Teams: Law Enforcement Request Management | Kodex Source: https://www.kodexglobal.com/teams/legal For Legal Leaders ### Control law enforcement data request risks Data requests expose your company to reputational risks, compliance failures and costly penalties. Take control with a secure platform that protects your company from the rising risk of law enforcement impersonators while cutting out 80% of the manual work that goes into data response. Request a demo The risk #### Critical challenges for legal teams Request a demo 01 ##### Compliance liability Your team handles sensitive data requests through email. Each manual process creates exposure to regulatory penalties and missed deadlines. 02 ##### Resource limitations Your skilled legal staff stays stuck in basic tasks. Hours spent coordinating between departments means less time for strategic work. 03 ##### Control issues Basic tools like email and spreadsheets put your data at risk. You lack proper tracking, reporting capabilities, and compliance monitoring. 04 ##### Reporting limitations Without clear data and metrics, you can't demonstrate your throughput and impact. Manual processes keep you from being a true business partner. How Kodex helps #### How we protect your legal function Trusted by industry leaders #### Why the world's most trusted legal teams choose us for data requests 85% less time spent on manual processes 1M$+ saved in compliance violations 5K+ law enforcement impersonators blocked --- ## Security Leaders: Stop Fraudulent LE Data Requests | Kodex Source: https://www.kodexglobal.com/teams/security-leaders For Security Leaders ### Don't let law enforcement data requests be your next vulnerability Data requests are the new attack vector that threat actors exploit to get access to your company’s most sensitive data. Stay one step ahead and stop sophisticated attacks before they succeed. Request a demo The risk #### CISO priorities and risks Request a demo 01 ##### Growing attack surface Bad actors use legitimate law enforcement credentials and domains to bypass your security perimeter and socially engineer companies into handing over their most sensitive data. 02 ##### Security team overload Your experts waste hours coordinating manual requests across departments. Critical threat hunting and prevention work gets delayed. 03 ##### Threat detection gaps Your teams rely on email to process data requests, making social engineering all too easy. Data requests often go unverified and impersonators aren’t caught until data productions have already occurred. 04 ##### Audit trail issues Complex regulations demand complete visibility. Current tools leave dangerous gaps in your security documentation. How Kodex helps #### Secure your third-party data requests Trusted by Enterprises #### Why the world's most trusted Security Leaders choose us for data requests 85% less time spent on manual processes 1M$+ saved in compliance violations 5K+ law enforcement impersonators blocked --- ## Trust & Safety: Manage Law Enforcement Data Requests | Kodex Source: https://www.kodexglobal.com/teams/trust-safety For Trust & Safety Leaders ### Build a safer platform by managing law enforcement requests Automate 80% of manual data request processes and 90% of transparency reporting, all while protecting your users from the rising risk of fake data requests Request a demo The risk #### User protection challenges Request a demo 01 ##### Verification Your team fights daily against fraud, abuse, and harmful content. Without unified tools, threats slip through and put users at risk. 02 ##### Transparency reporting Users demand transparency about how you protect them. Manual reporting processes make it hard to show your commitment to their safety. 03 ##### Investigation speed Every delayed response puts your company at risk. Email-based processes slow down critical user protection efforts and mask important patterns. 04 ##### Data request risks Scattered data requests across inboxes make it impossible to spot fake requests targeting your users. One breach destroys user confidence. How Kodex helps #### Your Trust & Safety command center Trusted by Trust & Safety #### Why the world's most trusted teams choose us for data requests 85% less time spent on manual processes 1M$+ saved in compliance violations 5K+ law enforcement impersonators blocked --- ## CALEA Compliance Explained: Who’s Covered & What’s Required | Kodex Source: https://www.kodexglobal.com/calea CALEA · LAWFUL INTERCEPT ### CALEA, Explained: Who It Covers, What It Requires, and What It Doesn’t The Communications Assistance for Law Enforcement Act requires telecommunications carriers to build wiretap capability into their networks. Who’s covered, who isn’t, and what everyone else owes law enforcement instead. Request a demo See how Kodex verifies requesters, tracks deadlines, and responds securely. A legal team at a messaging platform gets a letter from a police department citing “CALEA obligations” and demanding real-time access to a user’s communications. The team has three questions: what is CALEA, does it apply to us, and what do we actually have to do? The letter doesn’t answer any of them. Often, neither does the officer who sent it. The Communications Assistance for Law Enforcement Act is a 1994 law that requires telecommunications carriers to build lawful-intercept capability into their networks, so that a court-ordered wiretap can actually be executed. That’s the whole statute in one sentence. Who counts as a carrier, what the capability must do, and what everyone else owes law enforcement instead is where it gets interesting, and where most of the confusion lives. #### What is CALEA? By 1994, phone networks were going digital and the FBI could see a future where a wiretap order arrived at a switch that couldn’t technically comply. CALEA (47 U.S.C. 1001-1010) was the answer: it obligates carriers to design their networks so that, when served with a lawful surveillance order, they can isolate the target’s communications and deliver them to the named agency, without capturing anyone else’s traffic and without tipping off the target. Two things CALEA is not. It’s not a surveillance authorization: the legal authority to intercept comes from a Title III wiretap order or its equivalents, signed by a judge. And it’s not a data-request statute: it governs the capability to intercept in real time, not the handing over of stored records. CALEA is plumbing. The court order is the water. #### Who does CALEA cover? Three categories, set by the statute and the FCC’s 2005 extension: - Telecommunications carriers. The traditional case: phone companies, wireless carriers. - Facilities-based broadband providers. ISPs that own the pipes. - Interconnected VoIP providers. Services that connect calls to the public phone network. Covered entities must build and maintain intercept capability, file System Security and Integrity plans with the FCC, and under section 105, protect the intercept function itself from unauthorized use. #### Who doesn’t CALEA cover? This is the answer the letter-waving detective usually has wrong. CALEA explicitly excludes “information services.” In practice, that means most of the modern internet is outside it: - Messaging apps and social platforms - Email providers - Websites, marketplaces, games, dating apps - Cloud storage and SaaS products - VoIP that doesn’t interconnect with the phone network If you run a platform rather than a network, CALEA almost certainly isn’t your statute. But that’s not the end of the conversation, because being outside CALEA doesn’t mean being outside lawful access. It means the legal process arrives through a different door: subpoenas, court orders, and search warrants under the Stored Communications Act, and Title III wiretap orders that carry their own compliance duty even without CALEA’s pre-built plumbing. Non-carriers don’t owe law enforcement a wiretap-ready network. They owe responses to valid legal process, one request at a time. #### CALEA vs. the legal process everyone actually receives CALEAECPA / Stored Communications Act Governs Network capability for real-time intercept Legal process for communications and records Applies to Carriers, facilities-based broadband, interconnected VoIP Essentially every provider holding user data Trigger Built in advance, used when a wiretap order arrives A subpoena, court order, or warrant arriving today Volume Rare (roughly 2,000 wiretap orders a year, nationwide) Constant (large platforms handle thousands of requests a month) The asymmetry in that last row is the point. For almost every company, the real lawful-access workload isn’t CALEA. It’s the daily stream of law enforcement data requests, each of which has to be verified, scoped, and answered correctly. #### What’s happening with CALEA now: the Salt Typhoon fight CALEA’s quietest section became its most controversial. Salt Typhoon, a Chinese state-sponsored group, spent 2024 inside at least eight U.S. carriers, and among the things it reached was the lawful-intercept infrastructure CALEA required carriers to build. The wiretap system became the wiretap target. The FCC’s response turned into a live policy reversal. In January 2025, the Commission ruled that CALEA section 105 obligates carriers to secure their entire networks against unlawful access. In November 2025, a reconstituted Commission revoked that ruling as unlawful and ineffective, 2 to 1, arguing the statute never stretched that far and that security is better handled through federal-private collaboration. Congress is still arguing about it. For covered carriers, the practical takeaway: the section 105 duty to secure the intercept function itself never went anywhere; what’s contested is whether CALEA makes the FCC a general network-security regulator. The episode also settled an old argument by demonstration: mandated access infrastructure is itself an attack surface. Anyone building or answering lawful-access systems now designs with that fact on the table. #### Whether or not CALEA covers you, the requests still come Here’s where the two halves of this page meet. Carriers handle CALEA capability plus a heavy stored-records docket. Platforms escape CALEA entirely and still face the docket. Either way, the operational problem is identical: a demand arrives claiming legal authority, and someone has to verify the requester is real, judge whether the process is valid and properly scoped, respond through a channel that isn’t an unencrypted inbox, and keep a record that holds up later. Salt Typhoon made the stakes concrete, and fraudulent requests from compromised agency email accounts make them daily. That layer is what Kodex is. Kodex is the network where law enforcement data requests get handled the way they should: requesters verified before they see anything, requests tracked from arrival to response, every exchange recorded. The statutes decide what you must build and what you must produce. Kodex is where the producing actually happens. Related reading: Section 314(b) for financial-institution information sharing, and EU E-evidence for cross-border requests. See how Kodex verifies every requester → FAQ #### Common questions Does CALEA apply to apps and websites? No. CALEA covers telecommunications carriers, facilities-based broadband providers, and interconnected VoIP providers. Messaging apps, social platforms, email providers, websites, and cloud services are “information services” outside CALEA’s scope. They still must respond to valid legal process, such as subpoenas, court orders, and search warrants under the Stored Communications Act. Is CALEA the same as a wiretap order? No. CALEA requires covered carriers to build the technical capability to execute intercepts. The legal authority to intercept anyone’s communications comes separately, from a Title III wiretap order or equivalent signed by a judge. CALEA is the infrastructure; the court order is the authorization. What is a System Security and Integrity plan? An SSI plan documents a carrier’s policies and procedures for supervising lawful intercepts and preventing unauthorized surveillance. CALEA-covered carriers must file their SSI plans electronically with the FCC before commencing service and refile within 90 days of a merger, divestiture, or policy change. Does CALEA cover VoIP? Partly. Since the FCC’s 2005 extension, interconnected VoIP services, meaning those that connect calls to the public telephone network, are covered by CALEA. VoIP services that do not interconnect with the phone network are not. What happened with CALEA and Salt Typhoon? Salt Typhoon, a Chinese state-sponsored hacking group, breached at least eight U.S. carriers in 2024 and reached lawful-intercept systems built under CALEA. In January 2025 the FCC ruled that CALEA section 105 requires carriers to secure their networks against unlawful access; in November 2025 the Commission revoked that ruling, calling it unlawful and ineffective. The narrower duty to secure the intercept function itself remains in force. --- ## EU E-evidence Regulation: Requirements for Service Providers | Kodex Source: https://www.kodexglobal.com/eu-e-evidence EU E-evidence · Regulation (EU) 2023/1543 ### The EU E-evidence Regulation: what it requires, and where it stands now The EU E-evidence Regulation (EU) 2023/1543 has applied since August 18, 2026. It lets a law enforcement authority in one EU member state order a service provider in another country to hand over electronic data, or preserve it, on deadlines as short as eight hours. It applies to any provider offering services to users in the EU, wherever the provider is based. This page covers what the regulation requires, who it covers, and where member-state readiness stands. Download the guide Ready to Receive: the complete EU E-evidence guide for service providers. #### What the regulation does Until now, a foreign authority that wanted data from you usually went through mutual legal assistance: government to government, slow, often months. EU E-evidence replaces that route inside the EU. From August 18, 2026, an authority in any member state can send a binding order directly to your company. The order arrives through a government system, and the deadline to act on it is measured in days or hours. Two things about this are new for your team: - Orders arrive from 26 member states, directly. No treaty process in between. - The deadlines are short and enforceable. Miss one and you have failed to execute a binding order. #### Who is in scope You are likely in scope if both of these are true: - You offer services to users in the EU. - You hold electronic data about those users: account data, traffic data, transactional data, or content. That covers communication services, cloud and SaaS platforms, online marketplaces, crypto exchanges, fintechs, telecoms, and most consumer platforms. Where you are headquartered does not matter. A US company with EU users is in scope. A provider with no establishment in the EU must appoint a legal representative there to receive orders on its behalf. #### The two orders and their deadlines The regulation creates two binding instruments: ##### European Production Order EPOC Hand over the data. 10 days · 8 hours in an emergency ##### European Preservation Order EPOC-PR Preserve the data while a production request follows. Up to 60 days The penalty for non-compliance is set by each member state, up to 2% of your total annual worldwide turnover. An order you never see still counts against you. That detail matters more than any other on this page, and the next section explains why. #### How orders reach you: one member state, one government portal The regulation uses a home-base model: - You register in one EU member state. That state is your home base. - Every EU order for your company, from any member state, arrives through your home-base state’s system. - Your team logs into that government portal to receive and answer orders. One registration, one portal. You will not operate 27 systems. That is the design. The ground looks different: the Commission’s readiness list of August 27 shows four member states ready in any capacity, and where a state’s system is not operational, Article 19(5) of the Regulation moves transmission to the most appropriate alternative means. Where the portal does exist, it sits outside the tools your team uses today. Someone has to watch it, because a binding order can arrive at any hour, and the clock starts when the order arrives, not when you notice it. An unwatched channel plus an eight-hour emergency deadline is how a company fails this regulation without ever deciding to. #### What to have in place now Five things, in order: - Confirm you are in scope. Services to EU users, plus electronic data held. The guide below includes a scoping walkthrough. - Choose your home-base member state and, if you have no EU establishment, appoint a legal representative there. - Notify the authorities. Register your designated contact and accepted languages with your home-base state. The deadline was August 18; if you have not registered, that is now overdue. - Decide how you will receive orders. The government portal, a system you build, or an existing network. This is the build-vs-buy decision, and the window to build is now short. - Set up the response process. Who reviews an order, who pulls the data, who answers, and who is on call for the eight-hour emergency window. Legal, compliance, trust & safety, and product all own a piece; name the owner for each. #### Your own endpoint on Kodex Kodex is the network where law enforcement data requests get handled. More than 40,000 law enforcement agents across Europe work through it today. Kodex is the network for law enforcement data requests, and for EU E-evidence it operates a receiving endpoint registered to your designated establishment. Orders are addressed to you, certificates are issued in your name, and every decision on every order stays with you. Where a member state’s system is not operational, Article 19(5) of the Regulation moves transmission to the most appropriate alternative means, and the Commission’s contingency guidance lists secure platforms run for law enforcement data requests among them. In practice, that means: ##### Orders reach you inside the process you already run EU E-evidence orders land in the same Kodex queue as the requests your team handles now. There is no separate portal to watch. ##### Every deadline is tracked Kodex tracks the clock on every order, flags emergencies, and escalates over email, Slack, and PagerDuty as a window closes. ##### The whole lifecycle is covered Production orders, preservation orders, deadline updates, grounds for refusal, withdrawals, extensions, and correspondence, all on one record. ##### It works where the government system does not API integration where a state’s system is live, and an Article 19(5) path where it is not. Evidence over 25MB cannot move through the government system at all; that path is permanent. FAQ #### Common questions Can we just use the government portal? Yes. It is a working option. The cost is operational: it is one more system to log into and monitor, outside your existing workflow, and the deadlines run whether or not anyone is watching it. Companies with steady request volume usually decide the portal is the riskier path. Can we build our own intake instead? Yes, and the regulation allows it. You would be building intake, routing, and deadline tracking from scratch while orders are already flowing. Kodex already runs across Europe, so the practical question is whether building buys you anything that adopting does not. Our member state’s portal isn’t ready. Does that delay anything? No. Your obligations started on August 18 regardless. Where a state’s system is not available, Article 19(5) of the Regulation requires transmission by the most appropriate alternative means, and the Commission’s contingency guidance lists secure provider platforms among them. The issuing authority selects the channel. What you control is having an endpoint to nominate when asked, as Germany’s BKA has already asked providers to do. How do we know if we’re in scope? If you offer services to EU users and hold electronic data about them, assume you are in scope and confirm the details. The guide below includes a scoping walkthrough. What happens if we miss a deadline? You have failed to execute a binding order. Member states set the penalties, up to 2% of total annual worldwide turnover. --- ## Fraudulent Emergency Data Requests (Fake EDRs) | Kodex Source: https://www.kodexglobal.com/fraudulent-emergency-data-requests Guide · Fraudulent EDRs Orders start arriving August 18, 2026 ### Fraudulent emergency data requests: how fake EDRs work and how to stop them A fraudulent emergency data request is a fake EDR: a criminal uses a compromised or spoofed law enforcement email account to demand user data from a company, exploiting the emergency exception that lets companies disclose without a warrant. Apple, Meta, Discord, and Verizon have all complied with fake EDRs. The data went to criminals who used it to stalk, extort, and defraud the very users it described. Try Kodex Verify Check whether a law enforcement request is real. #### What is an emergency data request? Start with the legitimate version, because the fraud only makes sense against it. Under US law, nearly every disclosure of user data to law enforcement requires legal process: a subpoena, a court order, or a warrant, each signed and each reviewable. The full ladder. The exception is 18 U.S.C. § 2702(b)(8): when a provider believes in good faith that someone faces danger of death or serious physical injury, it may disclose voluntarily, immediately, with no legal process at all. A kidnapping in progress can’t wait ten days for a court order. Real EDRs are common and mostly legitimate. Verizon received more than 36,000 of them in a single half-year and complied with around 90%; across the industry, emergency requests run somewhere between 5% and 30% of total law enforcement request volume. The emergency exception exists because it saves lives. That’s exactly what makes it worth stealing. #### How do fake EDRs work? The attack has three steps, and none of them is technically sophisticated. - Get a law enforcement email account. Criminals phish police officers, buy stolen credentials, or purchase already-compromised agency accounts on criminal forums. Foreign agency accounts work as well as domestic ones; a request from any recognizable agency address carries authority. - Send the emergency request. Using the real agency’s address, or a lookalike, the attacker emails a provider’s law enforcement contact claiming an imminent threat: a suicide risk, a kidnapping, a shooting threat. They attach forged paperwork if any is asked for. In an emergency, usually none is. - Receive the data. Name, home address, phone number, IP logs, sometimes message metadata. Delivered by the company, in good faith, often within hours. This is how members of the Recursion Team and Lapsus$, several of them teenagers, pulled user data out of Apple, Meta, and Discord in 2021 using forged emergency requests sent from hacked agency accounts. Bloomberg and Krebs on Security documented the wave in 2022, and it hasn’t stopped since. #### Why do fake EDRs work? Because everything about the emergency channel is optimized for speed, and every speed optimization is a verification gap. - No court is involved. A forged warrant has to imitate a document a judge signs. A fake EDR has to imitate an email. There’s no seal to check because there’s no process to fake. - The clock is the weapon. The request says someone will die. The person reading it wants to help. Slowing down to verify feels like the risky choice. - The attack surface is enormous. There are roughly 18,000 law enforcement jurisdictions in the US alone, and each one is a set of email accounts. Confirming that an email came from a police domain says nothing about who was typing. One compromised account anywhere in the world is enough. - Each company verifies alone. The same fraudulent requester can hit fifty companies, and each one sees a first-time contact with no history. Nobody sees the pattern, because nobody’s position lets them. A fraudulent EDR only has to work once. Verification has to work every time. #### How common are fraudulent EDRs? Common enough to have a price list. The trajectory since 2021: - 2021. Recursion Team and Lapsus$-affiliated actors obtain user data from Apple, Meta, and Discord with forged EDRs from compromised agency accounts. - March 2022. Krebs on Security and Bloomberg expose the trade; Senator Wyden opens an inquiry. Krebs’s framing still stands: hackers had gained the power of subpoena. - October 2023. A man poses as a police officer over email and obtains a woman’s home address and phone logs from Verizon with a fake EDR sent from a Proton Mail address, missing required paperwork. He shows up at her home armed. - November 2024. The FBI issues a public advisory: since August 2024, a documented uptick in criminal-forum posts selling government email credentials, some marketed explicitly for fraudulent EDRs, with actors claiming access to accounts from more than two dozen countries. - 2024 to 2026. The attack productizes. Fraudulent-EDR-as-a-service listings run from roughly $100 for how-to kits to $1,000-$3,000 per successful request, some advertising turnaround under an hour. Verified police email accounts sell for around $1,000 each. The direction is one way: cheaper, faster, more packaged. The emergency exception isn’t going away, and neither is the incentive to abuse it. #### What happens when a fake EDR succeeds? The data goes to someone whose next step is the reason they wanted it. Bloomberg’s reporting traced data from forged EDRs to campaigns sextorting women and minors: the attacker uses the real name and address to make the threat credible. The Verizon case put an armed stalker at a victim’s door. Fraudsters use EDR data to defeat identity checks at banks and exchanges. Doxing and swatting crews use it to attach a home address to an online handle. For the company, the harm compounds. It disclosed a user’s data to a criminal, in a channel with no court order to point to, under an exception that exists on good faith. The legal exposure is unsettled and being tested in litigation; the trust damage isn’t unsettled at all. #### How do you verify an emergency data request? Not by reading the email more carefully. Checking the sending domain, the letterhead, and the badge number verifies the costume, and the costume is the thing being faked. Verification that holds up answers three questions independently: is the agency real, confirmed against a registry of agencies rather than what the email claims; is the requester real, the individual investigator verified as a person who works there; and is the behavior right, does this request fit the requester’s history and their agency’s legitimate pattern of work. The third question is the one no company can answer alone, because no single company sees enough requests to know what normal looks like. That’s the argument for verifying at the network level: on Kodex, 15,000 government agencies and 150,000 investigators are verified once, and their request behavior is visible across every company they contact. A requester who fails verification at one company has failed it everywhere. No verification layer makes fraud impossible, which is why verification is layered with monitoring and revocation rather than resting on any single check. How requester verification works. Run this request through Kodex Verify — free #### What is law enforcement email compromise? Law enforcement email compromise, LEEC, is the upstream crime that makes fake EDRs possible: the takeover of law enforcement email accounts for use in fraud. It’s the law enforcement version of business email compromise, with one difference that changes everything: a compromised business account can move a company’s money, while a compromised police account can move any company’s data. Fake EDRs are the most dangerous use of LEEC, but not the only one. Compromised agency accounts also send forged subpoenas and forged court orders through the same trusted channel. See what the network catches. #### Is anyone fixing this? Slowly. Senators Wyden, Tillis, and Whitehouse introduced the Digital Authenticity for Court Orders Act, which would require digital signatures on court orders; it has not passed. The FBI’s 2024 advisory tells agencies to harden their email and tells companies to scrutinize emergency requests, which is sound advice aimed at the two parties least equipped to act on it alone. The structural fix doesn’t require legislation. Fake EDRs work because requests travel over open email between strangers. Verified infrastructure, where every requester is known before they can ask, removes the condition the fraud depends on. That’s the fix companies can adopt today, one at a time, and it gets stronger with each one that does. #### Related guides - How to verify a law enforcement request the five-step process that stops a fake EDR before data moves. - Subpoena management software intake and verification for every kind of legal process. - Law enforcement data request management the complete guide. FAQ #### Common questions What is the difference between an EDR and a subpoena? A subpoena is legal process, issued under legal authority and reviewable by a court. An emergency data request is a voluntary disclosure: the company may share data under the emergency exception in 18 U.S.C. § 2702(b)(8), but no law compels it. How do criminals get law enforcement email accounts? By phishing officers, buying stolen credentials, or purchasing already-compromised agency accounts on criminal forums. The FBI’s November 2024 advisory documented government email credentials from more than two dozen countries offered for sale. Is a company liable if it complies with a fake EDR? The law is unsettled and being tested in litigation. The emergency exception protects good-faith disclosure, but plaintiffs have argued that complying with requests missing required verification steps falls outside good faith. Which companies have been tricked by fake EDRs? Publicly documented cases include Apple, Meta, Discord, and Verizon. Given that the attack targets any company holding user data, the documented cases are a floor, not a census. How should a company verify an emergency data request? Independently of the email itself: confirm the agency exists, confirm the individual requester’s identity, and check the request against the requester’s known pattern of legitimate activity. Domain and letterhead checks verify only what the attacker controls. --- ## Gambling & Betting: Law Enforcement Request Response Source: https://www.kodexglobal.com/gambling-law-enforcement-requests Guide · Betting, Gambling & Prediction Markets Updated August 17, 2026 ### How should a betting or gambling operator handle a law enforcement request? The law treats a betting operator as a financial institution. Most request-response functions are not built to that standard. This page covers what arrives, how strong programs verify and produce, and what regulators check. Get the handbook The LE Request Response Handbook for Betting, Gambling & Prediction Markets. #### Why do betting operators get so many law enforcement requests? A sportsbook, an online casino, and a prediction market hold the same data a bank holds: verified identity, payment instruments, transaction history, and a geolocation record for every customer. US law treats a betting operator as a financial institution under the Bank Secrecy Act. UK, EU, and Australian law treats it as an obliged entity. Banks built their response functions over decades. Betting operators have had about five years. No betting operator publishes its request numbers. Comparable account-based money businesses do. Kraken reported 4,923 government requests in 2023 and 6,826 in 2024, a 38.6 percent increase. Coinbase has received more than ten thousand requests a year since 2022. Casinos and card clubs filed about 77,000 suspicious activity reports in fiscal 2025. The growth follows the market. Legal US sports betting expanded from a handful of states to 39 plus DC, and licensed operations in the UK, Europe, and Australia grew over the same period. At many operators, one person handles all of this volume. The intake address is often that person’s own inbox, because the first subpoena arrived there. The function sits in legal at some companies, and in compliance or financial crime at others. A single-person function has no coverage for vacation, sickness, or departure. The deadlines continue through all three. #### Is your volume compulsory process, or is it something else? Request volume in this vertical divides into two different jobs. Which job you have determines how to build the function. Most volume at a US-licensed operator is compulsory process: subpoenas, search warrants, and grand jury demands. Each carries a deadline set by a court or an agency. The job is to process every request before its deadline. At an internationally licensed group, a large share of volume arrives with no legal compulsion: a foreign police force asking without citing an authority, a financial intelligence unit requesting broadly, an agency asking for data it has no power to demand. The job is to decide, case by case, whether to disclose. A voluntary disclosure to the wrong requester creates liability to your own customer. Identify your mix before you design intake, staffing, or policy. A due-date policy written for subpoenas does not help an MLRO decide whether to answer a request with no legal force. #### How do you verify a law enforcement request is real? Forged legal process is cheap, good, and documented at the federal level. In November 2024 the FBI warned that criminals were using compromised US and foreign government email accounts to send fraudulent emergency data requests to US companies. Betting operators are a specific target because they house so much data: verified identity, Social Security number, bank accounts, home address, device data, and a complete financial-behavioral history sit in a single production. One fake subpoena returns a full doxxing kit. The threat comes in two forms: ##### The forged document FORGERY AI can draft a convincing subpoena in minutes from public court formats and an operator’s own published submission instructions. Review catches some of these ##### The compromised real account TAKEOVER A real account on a real government or police domain, sold by country and agency. The document and the domain both pass review. The sender is not the account owner. Passes every manual check Manual verification fails against the second form. The phone number printed on a forged subpoena connects to the forger. A compromised .gov account passes domain checks, document checks, and callback checks. The alternative is to verify requesters through a network, before first contact. Kodex verifies 15,000+ government agencies and 150,000+ verified investigators across 180+ countries. A requester’s identity is established once and monitored across every company on the network. For the verification procedure, see how to verify a law enforcement request. For the forged-EDR threat, see fraudulent emergency data requests. #### What kinds of requests show up beyond the subpoena? Subpoenas, warrants, and court orders are not the full list. Operators also receive these request types: - Emergency disclosure requests. In this vertical they are often geolocation-driven: a missing person or a fugitive placed a bet from a known location. Emergencies are also the request type forgers imitate most. - Keep-open requests. Law enforcement asks you to keep an account active and not tell the customer during an investigation. This requires a written policy, a review schedule, and a record. - Preservation demands. Hold the data, produce nothing yet. The standard term is 90 days, renewable. - FinCEN 314(a) and 314(b) inquiries. Financial institutions are on these distribution lists automatically, whether or not a team was set up to receive them. - Canadian production orders. These begin when an operator serves Ontario, and they have their own formal requirements. This is an AML vertical first, and the request types reflect that. FinCEN publishes sports-betting-specific laundering typologies. The crimes behind most requests are the ones an AML program already monitors: laundering, fraud, identity theft, account takeover, and proceeds of crime. #### What should you actually produce, and to whom? Verification establishes that the requester is real. Production is a separate question: does this document compel this data from this entity? Five rules cover most cases: - Define standard production packages before requests arrive. Requests track what the business holds: identity and KYC records, payment and transaction data, wagering and session activity, and customer communications. With packages defined, most production decisions reduce to a package and a date range. - Push back on overbroad requests. “Everything on this customer” is not a valid scope. Return it and ask for a proportionate request. Agencies rarely contest a stated scope policy. - Match production to the entity that was actually served. A request served on the Spanish entity gets the Spanish entity’s data only. Groups built by acquisition can run dozens of brands, and requests often name the public parent when a subsidiary holds the license. Map your entities in advance and route by entity at intake. - Give voluntary requests their own default. For requests with no legal compulsion, the safe default is no production unless a written policy states otherwise. Liability for a wrongful voluntary disclosure falls on the operator, not the requesting agency. - Set your own response deadline and hold it. Subpoena return dates are set by whoever drafted the subpoena. Set an internal deadline you can meet on a day when several subpoenas arrive at once, state it to requesting agencies, and do not miss it. Agencies accept a consistent deadline. They lose confidence when response times vary. #### What do regulators actually check? State gaming commission AML examinations now test whether the program works. Examiners sample case files and check for a complete, timestamped record from intake to resolution. A program that keeps this record as part of normal work answers the examiner in an afternoon. The same shift is visible in every jurisdiction: ##### FinCEN The effectiveness framework requires operators to show the program works, and FinCEN has published sports-betting-specific laundering typologies. ##### UK Gambling Commission Enforcement actions continue to accumulate, and obliged-entity duties make request handling part of the AML program. ##### AUSTRAC Multiple major operators are in or exiting enforcement simultaneously, with AML program failures at the center of each action. ##### Nevada Reg 5 Recent amendments assign AML responsibility to a named, personally licensed individual. Vendors in this workflow may also need state gaming-vendor licenses, in particular in New Jersey and Pennsylvania. The EU e-Evidence Regulation, with its 8-hour emergency deadlines, is also cited to this industry. A US-only operator with no EU offering is out of scope. For EU-facing operators, the regulation’s financial-services carve-out does not clearly cover gambling, and adjacent services such as chat and community features are the most likely route into scope. Confirm scope with counsel. FAQ #### Frequently asked questions Is a sportsbook or online casino legally required to respond to law enforcement requests? Yes. The legal basis differs by geography. In the US, licensed operators are casinos and money services businesses under the Bank Secrecy Act, with SAR filing obligations and standing distribution lists such as FinCEN 314(a). In the UK, EU, and Australia, licensed operators are obliged entities under their AML frameworks. Compulsory legal process, such as a subpoena or warrant, carries its own response deadline set by the issuing court or agency. What’s the difference between a compulsory request and a voluntary one? A compulsory request, such as a subpoena, warrant, or grand jury demand, has legal force and a deadline. A voluntary request does not. The agency is asking, not compelling. At internationally licensed groups, a meaningful share of volume is voluntary. Producing data against an unauthorized voluntary request creates liability to the customer whose data was disclosed. Does EU e-Evidence apply to gambling operators? For a US-only operator with no EU offering, no. For EU-facing operators, possibly. The regulation’s financial-services carve-out does not clearly cover gambling, and adjacent services such as chat and community features are the most likely route into scope. Confirm with counsel. How do you verify that a law enforcement request is genuine? Document inspection and phone callbacks do not catch a compromised government email account, because the domain and the document both pass review. The reliable method is to verify requester identity against a network where agencies and investigators are known before first contact and monitored across every company on the network. How fast should a betting operator respond to a subpoena? Set a deadline the team can meet on a day when several subpoenas arrive at once, state it consistently to requesting agencies, and do not miss it. A deliberate, consistent deadline matters more than a short one. --- ## How to Verify a Law Enforcement Request: 5 Steps | Kodex Source: https://www.kodexglobal.com/how-to-verify-law-enforcement-requests Guide · Request Verification Orders start arriving August 18, 2026 ### How to verify a law enforcement request: the five-step process Verifying a law enforcement request means confirming three things independently before any data moves: the agency exists, the requester actually works there, and the request fits a legitimate pattern of investigative work. Most companies check none of them. The request arrives on official-looking letterhead from an official-looking address, and it gets worked. That held up for decades, and then criminals noticed. This page is the manual process, step by step, and it’s honest about where the manual process stops scaling. Try Kodex Verify Check a request against the Kodex network, free. #### Why does verification come first? Because every other step in your response process executes faithfully on whatever gets past intake. Legal review checks whether the request is valid, not whether the requester is real. Production sends the data wherever the request said to send it. If the person on the other end is a criminal with a hacked police account, the rest of your process works perfectly on their behalf. That’s not hypothetical. Apple, Meta, Discord, and Verizon have all handed user data to criminals through forged emergency requests. In November 2024, the FBI warned that compromised government email credentials from more than two dozen countries were for sale on criminal forums, marketed for exactly this. How fake EDRs work. The short version: forged requests are now cheap, packaged, and sold as a service. Verification is the one step positioned to catch them, because it’s the only step that asks about the requester instead of the request. #### What exactly are you verifying? Four things, each checked independently: - The agency. It exists, and it’s the agency it claims to be. - The person. A real investigator who works there today. - The process. The paperwork is valid and matches the data sought. - The pattern. The request looks like this requester’s legitimate work. Independently is the operative word. Everything in the email, the domain, the signature block, the phone number, the letterhead, was put there by whoever sent it. Verification that relies on the contents of the request verifies nothing but the sender’s effort level. #### Step 1: Confirm the agency exists Start with a source that isn’t the email. There are roughly 18,000 law enforcement jurisdictions in the US, plus foreign agencies, and no analyst knows them all. Check the agency against an independent registry or directory, never against the domain that contacted you. Lookalike domains are standard tradecraft, and even the real domain proves little: the FBI’s 2024 advisory was about real agency accounts, compromised. #### Step 2: Confirm the requester works there Call the agency’s published main line, the number on its official website, and ask for the investigator by name. Never use the phone number in the request. Confirm they exist, that they’re assigned to something resembling this matter, and that they sent this request. It takes minutes, and it defeats the entire category of attack where the sender controls every contact detail you were given. #### Step 3: Confirm the legal process is valid Match the paperwork to the data being sought. In the US, a subpoena reaches basic subscriber information, a § 2703(d) order reaches records and metadata, and only a search warrant reaches content. The full process ladder. A request for message content on a subpoena isn’t a paperwork error to fix for them. It’s a signal. Emergency data requests are the special case, because there’s no paperwork to validate. Disclosure under 18 U.S.C. § 2702(b)(8) is voluntary and rests on your good-faith belief in the emergency. Good faith gets built the same way: a callback to the agency, a case number, incident details, a supervisor who confirms. If the emergency is real, thirty minutes of diligence doesn’t change the outcome. If it isn’t, it changes everything. #### Step 4: Check the request against the requester’s pattern Is this the first time this requester has contacted you? Is the data scope consistent with the agency’s mission and their history? A small-town department requesting records on accounts three time zones away deserves a harder look. This is the step where a single company hits a wall. You can see your own request history; you can’t see that the same account failed verification at three other companies last week. The patterns live across companies, and no one company’s vantage point contains them. #### Step 5: Record what you verified Write down who checked what, when, and what they found: the registry consulted, the callback number used, who answered, what the supervisor confirmed. For emergency disclosures, this record is your good-faith basis. For declined requests, it’s the reason your analyst gets backed up instead of blamed. Verification you can’t evidence didn’t happen. #### What are the red flags? - A free-mail or lookalike sender domain. The 2023 Verizon stalker case ran through a Proton Mail address and a made-up officer name. - Extreme urgency paired with secrecy. Real emergencies survive a callback. - Missing, garbled, or reused paperwork, or the wrong form for the process type. - Data scope that doesn’t match the stated emergency or investigation. - A requester who resists verification. Real investigators deal with callbacks all day. - Pressure to skip your own procedure. That pressure is the attack. Run this request through Kodex Verify — free #### What do you do when a request fails verification? Don’t respond with data, and don’t share your findings with the requester. Preserve the request and your verification record internally. Report it twice: to the real agency whose identity was borrowed, and to the FBI through IC3. Bring in counsel before any further contact. And if you’re on a verification network, the failure travels: a requester who fails verification at one company has failed everywhere. What the network catches. #### Can you run all of this manually? For a handful of requests a month, yes. The five steps above are a functioning manual program, and a disciplined small team can run them. The math turns at volume. Verizon fielded more than 127,000 law enforcement demands in a single half-year; Coinbase reported 12,716 requests in its most recent reporting year. At that scale, minutes per request per step becomes headcount, and the pattern check never really works, because your vantage point is one company’s inbox. That’s the problem Kodex removes. On Kodex, requesters are verified before they can submit: 15,000 government agencies and 150,000 investigators, each verified once, with behavior visible across every company they contact. Verification stops being a per-request project and becomes a property of the channel. Coinbase cut the time its team spent verifying law enforcement requesters by 99.9%. How requester verification works. Have a request in front of you right now? Run it through Kodex Verify, free. FAQ #### Common questions Is a .gov email address enough to verify a request? No. Compromised government email accounts are the standard entry point for fraudulent requests; the FBI’s November 2024 advisory documented credentials from more than two dozen countries for sale. The domain tells you where the email came from, not who wrote it. How do you verify an emergency data request when there’s no court order? Through diligence that builds good faith: call the agency’s published number, confirm the investigator and the case, get incident details, and have a supervisor confirm the emergency. Disclosure under § 2702(b)(8) is voluntary, so the decision is yours to make on the record you built. Who should verify law enforcement requests? The function that owns request response, usually legal, compliance, or trust and safety, following a written procedure. Verification decisions shouldn’t rest on whoever happens to read the shared inbox that morning. How long should verification take? Manually, minutes to days per request depending on callbacks. On a verification network, effectively zero, because the requester was verified before they could submit anything. Does verifying a request mean you have to comply with it? No. Verification establishes who’s asking. Whether and how to respond is a separate legal decision about the process itself. --- ## Law Enforcement Data Request Management: The Guide | Kodex Source: https://www.kodexglobal.com/law-enforcement-data-request-management Guide · Law Enforcement Data Requests Orders start arriving August 18, 2026 ### Law enforcement data request management: what it is and how it works Law enforcement data request management is the process a company uses to verify, track, and respond to the subpoenas, court orders, search warrants, and emergency requests it receives from government agencies seeking user data. This guide is for the companies on the receiving end: the legal, compliance, and trust and safety teams that hold the data. If you’re looking for records software for police agencies, this isn’t that. This is what happens on the other side of the request. Try Kodex Verify See how Kodex verifies requesters, tracks deadlines, and responds securely. #### What does law enforcement data request management involve? Every request that arrives moves through the same lifecycle, whether the company has built a process around it or not. - Verification. Confirming the request comes from a real agency and a real investigator, not a criminal with a compromised police email account. - Intake and triage. Getting the request out of a shared inbox and into a queue, classified by legal process type, jurisdiction, and deadline. - Legal review. Deciding whether the request is valid, overbroad, or objectionable, and whether the law compels a response at all. - Response. Producing the data, and only the data, the legal process actually covers, through a channel that isn’t email or fax. - User notice. Telling the account holder their data was requested, unless a court has ordered you not to. - Cost recovery. Billing the government for the cost of complying, which federal law says it must pay. - Transparency reporting. Publishing what you received and how you responded, in aggregate, once a period. Most companies handle steps two through four and skip the rest. The first one, verification, is the step that’s become dangerous to skip. #### What types of legal process can a company receive? In the US, the Stored Communications Act (18 U.S.C. § 2701 et seq.) sets a ladder: the more sensitive the data, the more legal process the government needs. - Subpoena. The lowest rung. Reaches basic subscriber information: name, address, connection records, means of payment. No judge is involved in issuing most of them. - Court order under § 2703(d). Reaches transactional records and metadata beyond basic subscriber info. A judge must find specific and articulable facts showing the records are relevant and material to an ongoing investigation. - Search warrant. The top rung, and the only process that reaches content: message bodies, file contents, stored photos. Requires probable cause. Since Carpenter v. United States (2018), historical cell-site location data requires a warrant too. - Emergency data request (EDR). Not legal process at all. Under § 2702(b)(8), a company may voluntarily disclose data when it believes in good faith that someone faces danger of death or serious physical injury. No judge, no signature, no waiting. That speed saves lives, and it’s also exactly what criminals now exploit with fraudulent EDRs. - Preservation request under § 2703(f). Requires you to hold data for 90 days, extendable once by another 90, while the agency obtains legal process. Preservation is not production; nothing leaves the building yet. - Non-disclosure order under § 2705(b). A gag: a court order barring you from telling the user about the request. These are routine, not rare. Meta reported that 76.6% of US requests in the second half of 2024 arrived with one attached. Each rung has its own validity requirements, response norms, and objection paths, which is why classifying process type correctly at intake matters more than any other triage decision. Subpoenas are the highest-volume rung by far, and handling them at scale is its own discipline: what subpoena management software does and who needs it. #### How do you verify a law enforcement request is real? This is the step the old way never had an answer for, because for decades nobody needed one. A request arrived on letterhead, from a .gov address, and that was that. Then criminals figured out that a compromised police email account is the power of subpoena. In 2022, hackers used forged emergency requests from hacked agency accounts to pull user data out of Apple, Meta, and Discord. In November 2024, the FBI warned that compromised government email credentials from more than two dozen countries were being sold on criminal forums, explicitly marketed for sending fraudulent EDRs. There are roughly 18,000 law enforcement jurisdictions in the US alone. Checking that an email came from one of them tells you almost nothing about who was typing. Letterhead and a .gov address were the whole check. That’s not verification, that’s typography. Real verification means confirming three things independently: the agency exists, the investigator is who they claim to be, and this request fits the pattern of their legitimate work. No single company sees enough requests to make that third judgment alone, which is why verification works as a network: 15,000 government agencies and 150,000 investigators, each verified once, with behavior visible across every company they contact. See how Kodex verifies requesters. #### What are the deadlines? Deadlines are where informal processes fail quietly and expensively. - Civil subpoenas (US federal). Under Rule 45, written objections are due before the earlier of the compliance date or 14 days after service. Miss the window and objections are generally waived, including the ones you had every right to make. - Preservation. The 90-day clock under § 2703(f) starts when the request arrives, whether or not anyone logged it. - EU production orders. From August 18, 2026, the EU e-Evidence Regulation lets an authority in any member state serve orders directly on any provider with users in the EU: ten days to produce in standard cases, eight hours in emergencies, with penalties up to 2% of global annual turnover. A company handling a handful of requests a month can track this in a spreadsheet. The companies that actually get requests don’t get a handful. Verizon reported 61,919 subpoenas in the first half of 2023 alone; Coinbase reported 12,716 requests in its most recent reporting year, up 19% year over year. #### Do you have to tell the user? Default practice at companies that take user trust seriously: yes, notify the account holder before producing, so they can seek their own legal remedy. The exception is a § 2705(b) non-disclosure order, and the exception has become the rule; most US requests to major platforms now carry one. The obligations run in both directions. Disclose under a gag and you’ve violated a court order. Fail to track when a time-limited gag expires and you’re silent when you no longer have to be. Microsoft sued the government over indefinite gag orders in 2016 and won a policy change: non-disclosure orders are now supposed to be limited in duration. Someone still has to track the duration. #### Can you recover the cost of complying? Yes, and most companies don’t. Under 18 U.S.C. § 2706, a government entity that obtains records under the SCA shall pay the provider a fee for the costs reasonably necessary and directly incurred in searching for, assembling, and reproducing the records. Parallel state statutes set their own rates. Compliance at volume is a real cost center: legal review hours, engineering time, production work. The reimbursement statute exists precisely because Congress recognized that. Companies leave the money unclaimed because invoicing thousands of agencies one at a time costs more than it returns. That’s a workflow problem, not a legal one. See how cost recovery works on Kodex. #### What about requests from other countries? Cross-border requests used to be slow enough to ignore. That’s over. - MLAT. The mutual legal assistance treaty process routes a foreign agency’s request through the US Department of Justice and a US court. It averages months to a year, which is why everyone involved has spent a decade building ways around it. - CLOUD Act. Since 2018, US legal process reaches data US providers store anywhere in the world. The same law created executive agreements, like the US-UK agreement in force since October 2022, that let partner-country authorities serve US providers directly. - EU e-Evidence. The biggest change yet. From August 18, 2026, production and preservation orders from any EU member state can be served directly on providers, EU-based or not. If you have users in the EU, you’re in scope, wherever you’re incorporated. The practical consequence: a US company’s request queue is no longer a US queue. Requests arrive under different legal standards, in different languages, on different clocks, and the process that handled a domestic subpoena in two weeks has eight hours for an EU emergency order. What the EU e-Evidence Regulation requires. #### What goes in a transparency report? The output end of the lifecycle. A transparency report is a company’s public accounting of the requests it received and how it responded: counts by legal process type, by country, and by outcome. Google published the first one in 2010; today it’s standard practice for platforms, telecoms, and exchanges, and under the EU’s Digital Services Act it’s becoming a legal requirement rather than a voluntary one. The operational truth about transparency reports: they’re a byproduct. Companies with a real request management process produce one in an afternoon, because every request was classified and counted on arrival. Companies without one spend weeks reconstructing a year of inbox archaeology. What to publish and how. #### What should a request management program include? The checklist, distilled: - Verification before anything else. Confirmed agency, confirmed investigator, visible history. Not an email-domain check. - One queue for every process type. Subpoenas, warrants, § 2703(d) orders, EDRs, preservation requests, foreign orders. Requests that live in three inboxes die in three inboxes. - Deadline tracking by jurisdiction. Rule 45 windows, preservation clocks, e-Evidence SLAs, each with escalation before the deadline rather than after. - Secure production. Data leaves through an encrypted channel to a verified recipient, never as an email attachment to whoever asked. - Notice and gag tracking. Who was told, who legally couldn’t be, and when each gag expires. - Cost recovery built in. Invoicing as a step in the response, not an annual project someone proposes and nobody does. - Reporting as output. Transparency numbers that fall out of the system, not a spreadsheet reconstruction. Some companies build this themselves. Zoom built a full law enforcement request system in-house, and if you have Zoom’s volume and Zoom’s engineering budget, you can too. What you can’t build alone is the verification layer, because verification is only as good as the network of agencies and investigators behind it. #### How Kodex handles it Kodex is the network where law enforcement data requests get handled the way they should. 15,000 government agencies and 150,000 verified investigators submit requests through Kodex; the companies that hold the data verify, triage, and respond in one place. Every requester is verified before they can submit. Every request lands in one queue with its process type, jurisdiction, and deadline attached. Production happens over an encrypted channel, cost recovery is a built-in step, and transparency reporting falls out of data you already have. Coinbase cut the time its team spent verifying law enforcement requesters by 99.9% on Kodex. Read the customer story. #### Related guides - How to verify a law enforcement request the five-step verification process. - Subpoena management software intake, verification, deadlines, and response. - Fraudulent emergency data requests (fake EDRs) how the scam works and how to stop it. - Transparency reporting what to publish and how. - CALEA compliance who’s covered by the lawful-intercept statute, and who isn’t. - Section 314(b) information sharing what financial institutions can share, and how. FAQ #### Common questions Do companies have to comply with every law enforcement request? No. A company must comply with valid legal process, and may challenge process that is invalid, overbroad, or improperly served. Emergency data requests are voluntary by law: a company may disclose under § 2702(b)(8), but nothing compels it. What’s the difference between a subpoena, a court order, and a search warrant? The data each can reach. A subpoena reaches basic subscriber information, a § 2703(d) court order reaches transactional records and metadata, and only a search warrant, issued on probable cause, reaches the content of communications. What is a preservation request? A demand under 18 U.S.C. § 2703(f) that a provider preserve specified records for 90 days, extendable once by 90 more, while the agency obtains legal process. It requires holding the data, not producing it. Can we object to an overly broad request? Yes. For US federal civil subpoenas, written objections are due before the earlier of the stated compliance date or 14 days after service; objections not raised in time are generally waived. Warrants and court orders are challenged by motion. Does the CLOUD Act apply to data stored outside the US? Yes. Since 2018, US legal process served on a US provider reaches data in the provider’s possession, custody, or control regardless of where it’s stored. What is a law enforcement response team? The function inside a company, usually in legal, compliance, or trust and safety, that receives, verifies, and responds to law enforcement data requests. At large platforms it’s a dedicated team; at most companies it’s part of someone’s job, which is exactly when process and tooling matter most. --- ## Section 314(b) Explained: What Banks Can Share & How | Kodex Source: https://www.kodexglobal.com/section-314b USA PATRIOT ACT · SECTION 314(b) ### Section 314(b), Explained: What Financial Institutions Can Share, and How to Actually Do It Section 314(b) lets financial institutions compare notes on suspected fraud and money laundering without a subpoena, a court order, or new liability. Here’s what the safe harbor covers, where it ends, and how a real exchange actually works. Request a demo See how Kodex verifies requesters, tracks deadlines, and responds securely. A fraud analyst at a regional bank flags an account: opened three weeks ago, small deposits, then a newly added payee and a $180,000 wire out. On its own, the pattern is suspicious but inconclusive. The receiving account sits at another bank, and that bank is looking at the other half of the same picture: a business account taking in large wires from institutions it has no history with, and draining them within hours. Neither institution can see the scheme. Together, they can. Section 314(b) of the USA PATRIOT Act is the provision that lets financial institutions compare notes without a subpoena, a court order, or new liability. It’s one of the most useful tools in the BSA toolkit, and one of the most underused, mostly because the hard part isn’t the law. It’s the logistics. This page covers what 314(b) actually permits, where the safe harbor ends, and what an exchange looks like when it works. #### What is Section 314(b)? 314(b) is a voluntary information-sharing program with a legal safe harbor attached. Once two financial institutions are both registered with FinCEN, either one can ask the other about individuals, entities, organizations, or countries, for the purpose of identifying and reporting possible money laundering, terrorist financing, or fraud and other specified unlawful activity. The safe harbor protects them from civil liability for the sharing itself. Participation is free. Registration takes about two business days. And the exchange can happen by phone, in writing, or electronically, directly between institutions or through an association. The one-sentence version: 314(b) converts “I can’t tell you that” into “here’s what we’re seeing,” for registered institutions, on the right subject matter. #### What can financial institutions share under 314(b)? FinCEN’s June 12, 2026 guidance put to rest a long-running question: fraud is in scope, and so are the signals underneath it. Institutions can share, among other things: - Transaction patterns. Newly added payees followed by large transfers. Rapid movement of funds through an account with no business rationale. - Identity signals. Multiple accounts opened with the same or similar identifying information across institutions. - Cyber and device data. IP addresses, device fingerprints, login activity from geographically impossible locations. - Physical evidence. Video surveillance footage of the person who stood at the teller window. - The subject itself. Names, account numbers, entities, and the institution’s basis for suspicion. The test isn’t a category list. It’s purpose. If the information is shared to identify or report possible money laundering, terrorist financing, or specified unlawful activity, it’s inside the harbor. #### What does the safe harbor not cover? This is the section most explainers skip, and it’s where institutions actually get hurt. You cannot share the existence of a SAR. SAR confidentiality survives 314(b) intact. You can share the underlying facts, the transactions, the patterns, the subject. You cannot say, or imply, that a SAR was filed. Compliance teams thread this needle every day: “we’re seeing activity consistent with X” is fine; “we filed on this guy” is a violation with personal liability attached. The counterparty must be a current registrant. The safe harbor only holds between institutions registered for the current annual period. Sharing with a lapsed registrant means sharing with no protection. Verifying current registration before every exchange isn’t a nicety. It’s the load-bearing wall. Purpose is a boundary, not a formality. Sharing for marketing, credit decisions, or general due diligence isn’t covered, even between two registered institutions. The harbor covers the fraud-and-laundering purpose and nothing else. The safe harbor is federal. It protects against liability arising from the sharing. It doesn’t repeal your privacy obligations elsewhere, so information security and confidentiality procedures around the exchange still matter. #### What’s the difference between 314(a) and 314(b)? The names invite confusion. The mechanics are opposites. 314(a)314(b) Direction Law enforcement → institutions, via FinCEN Institution ↔ institution Voluntary? No. Responses are mandatory. Yes. Both registration and each exchange. Trigger A government request naming a subject Either institution’s own suspicion Frequency Batched requests on FinCEN’s schedule Whenever the fraud happens 314(a) is the government asking you to search your records. 314(b) is you and a peer institution deciding to solve a problem together. Registering for one does nothing for the other. #### How do you register for 314(b)? - Registration runs through FinCEN’s Financial Institution Portal (the old SISS system was retired in May 2024). - Your designated contact, typically the BSA/AML officer or an alternate, submits the 314(b) certification. - FinCEN processes it within two business days and confirms by email. - Renew annually. A lapsed registration means a lapsed safe harbor. That’s it. Registration is the five-minute part of the program. #### What does a real 314(b) exchange look like? Back to the regional bank and the $180,000 wire. - The analyst identifies the receiving institution from the wire details and confirms, against FinCEN’s registrant list, that it holds a current 314(b) registration. So does her own bank. - She contacts the other institution’s 314(b) point of contact. Not a general fraud line. The named contact from the registration, because she needs to know the person on the other end is authorized to receive this. - She shares the pattern and the subject: account details, the payee addition, the wire, the login from an IP that doesn’t match any customer history. No mention of whether her institution has filed or will file anything. - The other institution responds with its half: the receiving account’s funnel behavior, two more inbound wires from other banks, an account opening document that reuses a phone number from a known mule network. - Both institutions now have a complete picture. Each makes its own filing decision, and each keeps a record of what was shared, with whom, on what basis, and when, because that record is what proves the exchange lived inside the safe harbor if anyone ever asks. Elapsed time in a well-run program: hours. Elapsed time in most programs: days, if the exchange happens at all. #### Where does 314(b) break down in practice? FinCEN keeps encouraging participation because registration numbers understate the problem. Plenty of registered institutions rarely use the program. Three failure modes account for most of it. Verification is manual. Confirming that the person you’re about to send account data to is actually the registered contact at an actually registered institution takes real effort, and it has to happen every time. Skip it and you’ve shared sensitive customer information with an unverified stranger. Fraudsters know this, and posing as a peer institution’s fraud team is an active social-engineering pattern. The channels are improvised. Exchanges happen over phone calls, unencrypted email, and one-off spreadsheets. The statute permits it. Your information security program winces at it. There’s no record. The safe harbor protects a purposeful, registrant-to-registrant exchange. When the exchange lives in a phone call with no documentation, proving those elements two years later is somebody’s very bad week. None of these are legal problems. They’re infrastructure problems. The law did its job in 2001; the execution layer never got built. #### The execution layer This is the problem Kodex works on. Kodex is the network where sensitive requests between institutions get authenticated and answered: every counterparty verified, every exchange on secure rails, every request and response recorded with who asked, what was shared, and when. It’s the same discipline companies use on Kodex to handle law enforcement data requests, applied to the exchanges institutions make with each other. Registration tells FinCEN you’re willing to share. Infrastructure is what lets you do it at the speed fraud actually moves. Related reading: CALEA and the lawful-access landscape, and EU E-evidence for cross-border requests. See how Kodex verifies every requester → FAQ #### Common questions Is 314(b) participation mandatory? No. 314(b) is voluntary at every level: registration is voluntary, and each individual exchange is voluntary. Its counterpart, 314(a), is the mandatory one, requiring institutions to search their records in response to government requests routed through FinCEN. Can we share fraud information under 314(b)? Yes. FinCEN’s June 2026 guidance confirms that suspected fraud and its underlying indicators, including transaction patterns, IP addresses, device data, and surveillance footage, fall within the 314(b) safe harbor when shared to identify or report possible money laundering, terrorist financing, or specified unlawful activity. Can we tell another institution that we filed a SAR? No. SAR confidentiality survives 314(b). You can share the underlying facts and patterns behind your suspicion, but you cannot disclose or imply that a suspicious activity report was filed. Violating SAR confidentiality carries personal liability. How long does 314(b) registration take? FinCEN processes registrations within two business days and confirms by email. Registration runs through FinCEN’s Financial Institution Portal and must be renewed annually. Do both institutions need to be registered before sharing? Yes. The safe harbor only applies between institutions with current 314(b) registrations. Before each exchange, verify that the counterparty holds an active registration; sharing with a lapsed or unregistered institution means sharing without the safe harbor’s protection. --- ## Subpoena Management Software for Companies | Kodex Source: https://www.kodexglobal.com/subpoena-management-software Guide · Subpoena Management Software Orders start arriving August 18, 2026 ### Subpoena management software: what it does and who needs it Subpoena management software is how a company intakes, verifies, tracks, and responds to the subpoenas and other legal orders it receives, so nothing arrives by surprise or leaves by email. Most of what ranks for this term isn’t built for you: some is eDiscovery software for law firms, some is served-document tracking for bank operations, some is case management for the agencies that send subpoenas. This page is for companies that hold user or customer data and receive legal process about it, and what software for that job has to do. Try Kodex Verify See how Kodex intakes, verifies, and answers legal process in one place. #### What does subpoena management software do? The job, end to end: - Intake from every channel. Subpoenas arrive by mail, fax, email, registered agent, and process server. The software’s first job is one queue, whatever the entry point. - Verification. Confirming the request comes from a real agency and a real requester before anyone acts on it. Almost no tool in this category does this, and it’s become the step that matters most. - Classification. Subpoena, court order, search warrant, emergency request, preservation demand. Each carries different obligations and deadlines. The full breakdown. - Deadline tracking across jurisdictions. Response windows, objection windows, and preservation clocks, each with escalation before the date, not after. - Secure response. Producing records to a verified recipient over an encrypted channel, with a record of exactly what left and when. - Cost recovery. Generating the reimbursement invoice the law entitles you to, as part of the response. - Reporting. Counts by process type, jurisdiction, and outcome, which is both your internal dashboard and your transparency report waiting to be published. #### Who needs subpoena management software? The buyer this category underserves: companies that hold user or customer data at scale. Crypto exchanges, banks and fintechs, telecoms, marketplaces, and platforms. If your company has accounts, transactions, or communications records, legal process about them is arriving, and volume scales with your user count whether or not your legal team does. The volumes are not hypothetical. Verizon reported roughly 17,600 civil subpoenas in 2024, on top of hundreds of thousands of criminal-investigation demands. Coinbase reported 12,716 law enforcement requests in its most recent reporting year, up 19%. Even at a fraction of that scale, a shared inbox and a spreadsheet stop working, usually without announcing it. Who this category isn’t for, so you can stop reading the wrong reviews: law firms responding to discovery (that’s eDiscovery software), banks tracking garnishments and levies (served-document ops tools), and government agencies issuing process (agency case management). #### What happens if you miss a deadline? The failure modes are specific and none of them is hypothetical. - Objections waived. Under Rule 45, written objections to a federal subpoena are due before the earlier of the compliance date or 14 days after service. Miss the window and the objections you were entitled to raise, including overbreadth, are generally gone. - Contempt. Ignore a subpoena and the issuing party moves to compel; noncompliance after that is contempt, with fines and, in criminal contexts, worse. - The clocks are getting shorter. From August 18, 2026, the EU e-Evidence Regulation puts an eight-hour deadline on emergency production orders for any provider with EU users, backed by penalties up to 2% of global annual turnover. Missed deadlines in this category are rarely dramatic. A request sits unread in a mailbox for two weeks, and the company’s options quietly expire. #### What should subpoena management software include? Six capabilities separate a real system from a tracking spreadsheet with a login page. The first is the one to press vendors on hardest. - Requester verification. The FBI warned in November 2024 that criminals are using compromised government email accounts to send fraudulent legal demands, including fake emergency data requests. A system that tracks requests without verifying requesters is filing the fraud neatly. Ask every vendor how they confirm the person behind the request. - One queue for every process type. Subpoenas plus warrants, court orders, emergency requests, and preservation demands. If the tool only understands civil subpoenas, half your legal process lives somewhere else. - Deadline tracking by jurisdiction, with escalation built in. - Secure production. If records leave as email attachments, the tool has organized your process and left the actual data exchange as exposed as before. - Cost recovery. Reimbursement invoicing as a workflow step, at the statutory rates. - Reporting as output. Every count your transparency report needs, from data the system already holds. #### Can you recover the cost of complying? Yes. Reimbursement for compliance costs is written into law, and most companies leave it unclaimed. - 18 U.S.C. § 2706 (SCA): the government must reimburse providers for costs reasonably necessary and directly incurred in searching for, assembling, and reproducing records. - 12 U.S.C. § 3415 and Regulation S: set specific rates for financial institutions, including per-quarter-hour search and retrieval fees, reproduction, and transport costs. - State statutes add their own schedules. California’s Evidence Code § 1563, for example, sets per-page copying rates and hourly clerical rates for business-records subpoenas. The money goes unclaimed for a mundane reason: invoicing thousands of agencies one request at a time costs more in staff hours than it returns, so nobody does it. Make the invoice a generated artifact of the response and the economics invert. How cost recovery works on Kodex. #### Should you build or buy? Large platforms have built their own law enforcement request systems; Zoom’s is the visible example. If you have that volume and an engineering team to spend on it, building the workflow layer is achievable: intake, queue, deadlines, production. What can’t be built in-house, at any budget, is the verification layer, because verification isn’t a feature. It’s a dataset. Knowing that a requester is real, and that their behavior matches their agency’s legitimate pattern, takes visibility across many companies’ request traffic. One company sees each requester in isolation; a network sees their history. On Kodex, that network is 15,000 government agencies and 150,000 verified investigators, each verified once, visible to every company they contact. Build the workflow if you want. The network is the part you join. #### How is Kodex different from eDiscovery tools? eDiscovery software answers: given these documents, how do we review and produce them? It starts after you’ve decided to respond. Kodex answers the questions that come first: is this request real, is it valid, what does it legally reach, when is it due, and how does the data get to a verified recipient without touching email? Then it handles what comes after: the reimbursement invoice and the transparency numbers. If your team also runs large document reviews, an eDiscovery tool complements this. It doesn’t replace it, because organizing documents for a fraudulent subpoena is not a capability, it’s a liability with good metadata. See how request management works. FAQ #### Common questions How long do you have to respond to a subpoena? The subpoena states its own compliance date. For US federal civil subpoenas, written objections are due before the earlier of that date or 14 days after service, and objections not raised in time are generally waived. Can we get reimbursed for complying with a subpoena? Often, yes. Under 18 U.S.C. § 2706, the government must reimburse providers for costs reasonably necessary and directly incurred in producing records under the Stored Communications Act, and financial institutions and several states have their own statutory rate schedules. What is the difference between a subpoena and a search warrant? Reach and standard. A subpoena reaches basic records and is issued without a judge’s probable-cause finding; a search warrant requires probable cause and is the only process that reaches the content of communications. Do we have to notify the customer about a subpoena? Sometimes you must, sometimes you may, and sometimes a court order under 18 U.S.C. § 2705(b) forbids it. A response process needs to track which of the three applies to every request. Is email an acceptable way to produce records? It’s common and it’s the weakest link in most response processes. Email offers no verification of the recipient and no control after sending; secure production means an encrypted channel to a verified requester. --- ## Transparency Reporting for Law Enforcement Requests | Kodex Source: https://www.kodexglobal.com/transparency-reporting-law-enforcement Guide · Transparency Reporting Orders start arriving August 18, 2026 ### Transparency reporting for law enforcement requests: what to publish and how A transparency report is a company’s public accounting of the government and law enforcement requests it received for user data over a period, and how it responded. For fifteen years, publishing one was a choice companies made to earn trust. That era is ending: transparency reporting is becoming a legal obligation in the EU and a baseline expectation everywhere else, and the report turns out to be the easy part. The hard part is having tracked anything worth reporting. Try Kodex Verify See how Kodex turns tracked request data into a transparency report. #### What is a transparency report? The core of every transparency report is the same set of facts: how many requests for user data the company received, from which governments, under what legal process, and what happened to each one. Complied in full, complied in part, rejected. Google published the first one in 2010. Adoption grew slowly until the Snowden disclosures in 2013, after which the number of companies publishing grew 367% within a year. Today, somewhere near ninety companies publish them, from Apple and Meta down to mid-size SaaS companies whose entire report is one page and a table. The thin ones count too. A one-page report that says we received 14 requests and complied with 9 does the whole job: it tells users, regulators, and journalists that the company knows what’s moving through it. #### Are transparency reports required by law? In the US, no. Publishing is voluntary, and always has been. But the direction of travel is one way. - Germany’s NetzDG (2017) was the first mandate, requiring biannual reports from large social networks. - The EU Digital Services Act made it general. Article 15 requires intermediary services to publish transparency reports at least annually, machine-readable, within two months of period end; very large platforms report twice a year. The reports must count orders received from member state authorities, broken out by type, issuing country, and median response time. A November 2024 implementing regulation standardized the format. - The EU e-Evidence Regulation, applying from August 18, 2026, adds a new class of cross-border orders that will need counting from the day it takes effect. So the honest answer for a company with EU users: transparency reporting started as public relations and is finishing as compliance. The companies that built the habit voluntarily now have a head start on a legal requirement. #### What should a transparency report include? Reports vary widely, which is the field’s longest-standing criticism: numbers that can’t be compared across companies or even across one company’s years. The core taxonomy that makes a report useful: - Requests received, counted by legal process type: subpoenas, court orders, search warrants, emergency requests, preservation requests. A warrant count and a subpoena count are different facts. The full process ladder. - Accounts affected, since one request can name hundreds of users. - Outcomes: complied in full, complied in part, rejected or withdrawn. Compliance rate is the number sophisticated readers look for first. - Requesting country, for anyone operating across borders. - Content versus non-content, because handing over message bodies and handing over subscriber records are different events. - Notice: how many users were told, and how many requests carried gag orders that prevented it. Define each category once, publish the definitions alongside the numbers, and never change a definition without saying so. A report whose categories shift year to year isn’t transparency, it’s noise with a publication date. #### What can you legally disclose? Almost everything, with one carve-out: US national security process. Ordinary criminal legal process, subpoenas, warrants, court orders, can be reported in exact counts. National security letters and FISA orders cannot. Under the USA FREEDOM Act, companies may report those only in aggregate bands, in increments of 100, 250, 500, or 1,000 depending on the reporting format chosen, sometimes with a mandatory delay. That’s why every major report has a table that reads 0-249 national security letters. It’s not coyness. It’s the maximum the law allows. - Gag orders under 18 U.S.C. § 2705(b) restrict telling an individual user about a specific request. They don’t prevent aggregate reporting, which is precisely what makes the aggregate report valuable: it’s the disclosure no gag can reach. - Warrant canaries, the published statement that a company has not received secret process, designed to disappear when it has. Their legal standing has never been tested in court. Treat them as a supplement to a report, not a substitute for one. #### How do you actually produce one? Here is the operational truth most guides skip: a transparency report can’t be written, it has to be accumulated. The report is a byproduct of how requests were handled all year. You can’t report what you didn’t track. Companies with a real request management process produce a report in an afternoon, because every request that arrived was verified, classified by process type, and resolved with a recorded outcome. The report is a query. Companies without one assign a paralegal to a year of inbox archaeology, reconstructing counts from email threads and hoping the shared mailbox wasn’t cleaned out in March. For a company publishing its first report with a small team, the minimum viable version: - Pick a period you can actually reconstruct. A single half-year beats a fictional five-year history. - Count requests by process type and outcome. Skip country breakdowns and account counts if the data isn’t there yet; add them next period. - Publish the definitions next to the numbers. - State what you’ll report next time, and hold to the cadence. Then fix the pipeline so report two is a query, not a project. How request management works end to end. #### How often should you publish? Annual is the floor and the norm for a first report; the major platforms publish semiannually. The DSA requires annual publication for services in scope, biannual for the largest platforms. Pick the cadence you can sustain, because a report that appears once and never again reads worse than no report at all. For calibration on volume: Coinbase reported 12,716 law enforcement requests in its most recent reporting year, up 19%, with 53% from outside the US. Verizon reported 61,919 subpoenas in a single half-year. Your numbers will be smaller. Publish them anyway; the point of the report is the accounting, not the size. #### Transparency reporting from Kodex On Kodex, the report is the byproduct it should be. Every request arrives verified, classified by legal process type, jurisdiction, and outcome, so transparency-report metrics fall out of data the team already has. No reconstruction, no archaeology, no March mailbox problem. See how request management works. #### Related guides - Subpoena management software the intake and response system behind the numbers you report. - How to verify a law enforcement request the five-step verification process. - Fraudulent emergency data requests (fake EDRs) the requests that never should have been answered. FAQ #### Common questions Are transparency reports legally required? Not in the US, where publishing remains voluntary. In the EU, the Digital Services Act requires intermediary services to publish transparency reports at least annually, including counts of government orders received. Can a company report exactly how many national security letters it received? No. US law permits reporting national security process only in aggregate bands, such as 0-249, with the band size depending on the reporting format chosen under the USA FREEDOM Act. What is a warrant canary? A published statement that a company has not received secret legal process, designed to be removed if that changes. Its legal effectiveness has never been tested in court. What should a first transparency report include? At minimum: requests received in a defined period, broken out by legal process type, with outcomes (complied, partially complied, rejected) and the definitions used for each category. Which companies publish transparency reports? Roughly ninety, including Google, Apple, Meta, Microsoft, major telecoms like Verizon and AT&T, and crypto exchanges like Coinbase and Kraken. Access Now maintains the most complete public index. --- ## Customer Stories: Law Enforcement Request Management | Kodex Source: https://www.kodexglobal.com/customer-stories Customer stories ### How leading platforms handle law enforcement data requests Law enforcement data requests are the soft underbelly of most organizations. Not so for Kodex customers. Explore how the world’s leading brands are creating a new standard for data requests in the digital age. Request a demo Trusted by #### Stories Cryptocurrency / Fintech ##### How Coinbase fights crime through scaled requests. Read More → Crypto Trading / Blockchain ##### How Bitfinex protects millions while handling global law enforcement requests. Read More → Crypto Derivatives / Fintech ##### Bitget boosts security: streamlining law enforcement response for better collaboration Read More → Kodex customers #### Trusted by the world’s leading brands to make their data requests faster, safer, and more data-driven 99.9% decrease Time spent verifying law enforcement 75% decrease Time spent reporting 9.6% Repeat request rate 95.8% decrease Time spent on case management < 3 days First response time 0 seconds Request acknowledgment time 4 days Resolution time, from receipt of data request to resolution Customers #### Trusted by leading crypto exchanges SOC 2 Bank-level encryption “At Coinbase regulatory compliance is a core part of our business. Kodex is a powerful tool and partner when engaging with regulators” John Kothanek VP of Global Intelligence Read the story “Having all our data in one place has revolutionized our investigative capabilities. This strategic intelligence helps us protect our platform more effectively.” Shann Lu Head of AML Read the story “With Kodex, we don’t just manage compliance; we ensure trust, efficiency, and security at every step.” Hon Ng Bitget’s Chief Compliance Officer Read the story --- ## How Bitfinex Manages Global Law Enforcement Requests | Kodex Source: https://www.kodexglobal.com/customer-stories/bitfinex Customer story ### How Bitfinex manages global law enforcement requests Bitfinex handles law enforcement data requests across multiple jurisdictions for millions of customers. See how Kodex makes that manageable. Customer Stacey Wang Head of Marketing Last updated March 11, 2026 Bitfinex, a leading cryptocurrency exchange serving millions of customers globally, processes a high volume of law enforcement data requests while maintaining strict regulatory compliance across jurisdictions. For their Head of Anti-Money Laundering (AML) Shann Lu, protecting those customers and the platform from bad actors is a critical priority. A growing security concern for cryptocurrency exchanges is the impersonation of government officials attempting to gain unauthorized access to customer data through fake law enforcement requests. The challenge #### Email-based processes and fragmented data create operational burdens and security risks Bitfinex faced significant obstacles in managing law enforcement requests and extracting meaningful insights from their data. The team struggled with a fragmented, manual review process that was becoming increasingly unsustainable. Each request required extensive verification across different time zones and languages, creating a significant operational burden. Team members had to manually check agent credentials, cross-reference jurisdictional requirements, and maintain detailed documentation of all communications. Request data lived primarily in emails, making it challenging to extract meaningful data and impossible to spot trends and patterns holistically. This email-based approach created several critical challenges: - One-off correspondence made it impossible to see trends or connect dots between related requests to profile accounts or identify patterns of suspicious behavior - Difficulty verifying and communicating with law enforcement agents across global jurisdictions and in foreign languages and time zones created stress and operational burden for the team - Difficulty sharing information effectively when multiple law enforcement agencies were investigating related accounts - Limited ability to generate insights about emerging criminal trends or risky behaviors - No standardized and secure process for tracking and documenting all communications with agents Manual, email-based processes not only stretched resources thin but also created security vulnerabilities. Without a standardized system, the team faced pressure to protect against impersonation attempts while ensuring legitimate requests were processed efficiently. GDPR compliance added another layer of complexity, requiring careful handling of requests from non-compliant jurisdictions. Finding a solution #### Kodex doesn’t just streamline operations, but also unlocks request data to enable strategic insights and find bad actors After thorough security and compatibility reviews, Bitfinex implemented Kodex to automate and secure their law enforcement response process. “Kodex solves 99% of our pain points in handling law enforcement requests,” says Lu. The platform’s automated agent verification, secure case management, and comprehensive communication tracking have transformed how Bitfinex handles sensitive data requests. But the solution transformed not just Bitfinex’s operational efficiency, but also their entire approach to investigations and risk management. By centralizing all correspondence data, Bitfinex gained powerful new capabilities for investigations and risk management: - Customizable intake forms allow the team to automatically extract the metadata they need to profile high-risk accounts; report out strategic insights on request volumes, and crime trends; and conduct analyses to understand emerging crime types or suspicious behaviors - The ability to connect related requests helps coordinate investigations when multiple agencies are involved - Agent verification prevents law enforcement impersonators from compromising Bitfinex’s user data - Case assignment, automated workflows, and investigation tracking makes it easier and safer to intake and efficiently respond to requests across the globe - Single secure place for all internal and external data correspondence ensures all communications are organized in one place “Having all our data in one place has revolutionized our investigative capabilities,” Lu explains. “We can now identify behavioral patterns associated with high-risk accounts, even without traditional banking data points like shopping habits or mortgage information. This strategic intelligence helps us protect our platform more effectively.” The psychological impact on the team has also been remarkable. “No more early morning calls across time zones, no more stress about deadlines, and a renewed confidence in our ability to identify legitimate requests,” notes Lu. Looking ahead #### Leading the charge: how Bitfinex is helping to build a stronger crypto ecosystem, one data request at a time Through this implementation, Bitfinex has strengthened its position as a trusted partner to law enforcement while maintaining robust user protection. For leaders like Lu, it’s about more than just processing requests—it’s about leveraging data strategically to bridge the gap between cryptocurrency innovation and regulatory compliance. By identifying patterns, coordinating investigations, and removing bad actors, Bitfinex is helping create a safer digital financial ecosystem for everyone. Playbook ##### The Modern Request Response Playbook Get the playbook #### In their words The ability to connect the dots between requests and extract meaningful insights has transformed how we approach platform security. When we can efficiently cooperate with law enforcement and proactively identify risky behavior patterns, we raise the barriers for illicit activity across the entire crypto ecosystem. Shann Lu Head of AML, Bitfinex More stories #### More customer stories “At Coinbase regulatory compliance is a core part of our business. Kodex is a powerful tool and partner when engaging with regulators.” John Kothanek VP of Global Intelligence, Coinbase Read the story “With Kodex, we don’t just manage compliance; we ensure trust, efficiency, and security at every step.” Hon Ng Chief Compliance Officer, Bitget Read the story ##### Every customer story Crypto exchanges, banks, telcos, and platforms on how they run law enforcement requests through Kodex. View all customer stories --- ## Bitget Case Study: Law Enforcement Request Management Source: https://www.kodexglobal.com/customer-stories/bitget Customer story ### How Bitget streamlined law enforcement request management See how Bitget streamlined law enforcement request response with Kodex — improving compliance team efficiency and reducing response risk at scale. Customer Stacey Wang Head of Marketing Last updated March 11, 2026 #### At a glance 99.9% Decrease Time spent verifying law enforcement Source: Bitget story 95.8% Decrease Time spent on case management Source: Bitget story 75% Decrease Time spent reporting Source: Bitget story Industry Crypto Team Compliance As Bitget’s compliance team watched their law enforcement request volume surge from ~20 to 100+ weekly, their manual email-based system was collapsing. With 100+ million users across 200+ countries, they faced a critical challenge: how could a team effectively handle this growing workload while maintaining security standards? “Looking back to the days before the Kodex system was launched, I remember the endless challenges—stacks of files, unreliable storage, and the constant struggle to verify police credentials and to keep investigators updated. Every email was a question mark, every record a potential risk. Today, we don’t just manage compliance; we ensure trust, efficiency, and security at every step. Progress isn’t just about making things easier—it’s about making them right,” recalls Bitget’s Chief Compliance Officer. Unwilling to accept these limitations, Bitget’s forward-thinking compliance team implemented Kodex with the goals of improving efficiency, increasing security, and enhancing collaboration with government counterparties. The challenge #### Email-based processes created operational burdens and security vulnerabilities With a small dedicated team of just 3 members handling all global law enforcement requests from over 60 countries, Bitget’s email-driven approach was becoming increasingly unsustainable. In the span of a few years, request volumes had grown from ~20 to ~100 per week, and the team struggled with several critical challenges: - Time-consuming verification: At a time when law enforcement impersonation was on the rise, manual verification was becoming increasingly burdensome. The team had to verify police IDs and official letters, check email domains, and conduct due diligence to confirm legitimacy. This verification alone could take several hours per request, and often hit roadblocks when agencies refused to provide necessary documentation. - Fragmented organization: Scattered across email, data requests were impossible to organize, with no way to track related cases or identify patterns of suspicious behavior across multiple investigations. - Communication gaps: Without a status tracking system, law enforcement would wait without updates until final responses were ready, creating friction in these important relationships. - Labor-intensive reporting: Data reporting was extremely manual. The team had to count emails individually and categorize by jurisdiction for weekly management reports, a tedious process that could take hours. - Limited searchability: Finding historical case information meant tediously searching through old emails, making it difficult to reference previous investigations or identify connected accounts. “We were spending significant time on manual verification and organization instead of focusing on actual investigations,” explains a member of Bitget’s compliance team. “As our request volume more than tripled, this approach became completely unsustainable.” Finding a solution #### Kodex transforms case management while enabling better law enforcement collaboration After seeing industry leaders like Binance and Coinbase using Kodex to improve efficiency, Bitget implemented the platform to make data requests faster, safer, and more collaborative. In particular, Kodex allowed them to: - Automate verification: Identity verification became automated and reliable, eliminating hours of manual verification per request and dramatically reducing fraud risks from potential impersonation attempts. - Speed investigations and take action in the moment: Time-sensitive investigations that previously took days can now be addressed in hours, enabling Bitget’s team to act on warrants and seizure requests immediately, rather than missing opportunities to assist law enforcement. - Improve collaboration: The team could now send law enforcement status updates and holding responses, transforming relationships from occasionally antagonistic to consistently collaborative by keeping agencies informed throughout the process. - Run one-click reports: Data extraction and reporting transformed from manual counting to one-click operations. Weekly reports that previously took an hour now take just minutes to generate—a 95% reduction in reporting time. - Centralize records and organize cases: All files and records are now organized in one searchable system, making historical case reference simple compared to the previous tedious process of searching through old emails. - Identify previously inaccessible patterns: The team can now track suspicious users across multiple cases, identifying patterns that were impossible to see in isolated emails—a capability that has transformed how they approach investigations. “Having all our data in one place has revolutionized how we work with law enforcement,” notes a compliance team representative. “We can now identify connections between cases, respond more quickly, and provide better support for time-sensitive investigations.” Looking ahead #### Setting new standards for compliance collaboration Through this implementation, Bitget has strengthened its position as a trusted partner to law enforcement while maintaining robust user protection. As cryptocurrency adoption continues to accelerate globally, Bitget’s approach to law enforcement collaboration provides a blueprint for how exchanges can effectively balance security, compliance, and operational efficiency—ultimately contributing to a more trusted and secure digital asset ecosystem for everyone. Playbook ##### The Modern Request Response Playbook Get the playbook More stories #### More customer stories “At Coinbase regulatory compliance is a core part of our business. Kodex is a powerful tool and partner when engaging with regulators.” John Kothanek VP of Global Intelligence, Coinbase Read the story “Having all our data in one place has revolutionized our investigative capabilities. This strategic intelligence helps us protect our platform more effectively.” Shann Lu Head of AML, Bitfinex Read the story ##### Every customer story Crypto exchanges, banks, telcos, and platforms on how they run law enforcement requests through Kodex. View all customer stories --- ## Coinbase: Scaling Law Enforcement Requests at Volume | Kodex Source: https://www.kodexglobal.com/customer-stories/coinbase Customer story · Video ### How Coinbase manages law enforcement requests at scale Coinbase manages one of the highest volumes of law enforcement data requests in crypto. See how Kodex made that scalable without adding headcount. Customer Stacey Wang Head of Marketing Last updated August 21, 2026 The Call Coinbase case study · 2:20 #### At a glance 100M+ Verified users on the Coinbase platform Source: Coinbase story 4 – 5 K Law enforcement requests a year, handled by a team of 5–6 Source: Coinbase story 97.5% Fewer support tickets: from 10 a week to 1–2 a month Source: Coinbase story Industry Crypto Team Global Intelligence Reports to Chief Legal Officer Format Video + written story #### How scaling law enforcement requests enables Coinbase to protect users from financial crime As one of the world’s largest publicly traded cryptocurrency exchanges with over 100 million verified users and $10 billion in daily trading volume, Coinbase sets the standard for security and compliance in digital assets. For John Kothanek, Vice President of Global Intelligence reporting directly to the Chief Legal Officer, efficiently managing law enforcement data requests is crucial to identifying and removing bad actors from their platform. The challenge #### Email-based processes and fragmented data create security risks and operational burdens With a lean team of 5-6 members handling 4,000-5,000 law enforcement requests annually, Coinbase faced significant obstacles in managing their investigative workload. The team wasn’t just processing incoming requests. They were also leveraging this data to conduct proactive investigations into terrorism financing, human trafficking, nation-state threats, and cartel activities. Their email-driven, spreadsheet-based approach created an unsustainable process. Team members had to manually track and respond to law enforcement requests through email while maintaining separate spreadsheets for documentation. While they were able, with substantial effort, to meet compliance obligations, this created several critical challenges: - One-off correspondence made it harder to see trends or connect dots between related requests to profile accounts or identify patterns of suspicious behavior - Difficulty verifying and coordinating proactive investigations when multiple law enforcement agencies were involved - No centralized system for documenting and tracking communications with law enforcement - Reporting, including building transparency reports and responding to regulators and audits, was a slow, labor-intensive process Finding a solution #### Kodex transforms case management while enabling strategic investigation capabilities After connecting with Kodex’s founder Matt, Kothanek found a partner who shared his urgency about fighting financial crime. “It’s not just about having a solution,” Kothanek explains. “It’s about having a partner who understands that in our world, waiting six months for a feature isn’t an option.” Kodex greatly improved the Global Intelligence Team’s relationship with law enforcement, decreasing support tickets from 10/week to 1-2/month, a 97.5% decrease. It also transformed case management by enabling: - Automated workflows eliminate manual data entry burden and improve team morale - One-click transparency reports and structured metadata capture satisfy regulatory requirements instantly - Robust verification systems prevent law enforcement impersonation attempts - Comprehensive case histories maintain investigation continuity despite team changes - Secure platform ensures sensitive cases remain protected from exposure “When you have so much going on, the last thing you want to do is data entry. Kodex lets us focus on what matters – using law enforcement data to identify and remove bad actors from our platform.” John Kothanek, VP of Global Intelligence, Coinbase From The Call: Coinbase case study Looking ahead #### Building a more secure crypto ecosystem through efficient law enforcement collaboration Through this transformation, Coinbase has strengthened its position as a leader in cryptocurrency security and compliance. For Kothanek’s team, it’s about more than just processing requests efficiently. It’s about leveraging law enforcement data to proactively protect users from financial crime. The impact extends beyond just Coinbase. By enabling more efficient processing of law enforcement requests and closer coordination with agencies, the team is helping to raise security standards across the entire cryptocurrency ecosystem. Playbook ##### The Modern Request Response Playbook Get the playbook #### In their words In this industry, you need partners who you can trust. With Kodex, we trust that you guys care as much as we do about getting bad actors off our platform. John Kothanek VP of Global Intelligence, Coinbase More stories #### More customer stories “With Kodex, we don’t just manage compliance; we ensure trust, efficiency, and security at every step.” Hon Ng Chief Compliance Officer, Bitget Read the story “Having all our data in one place has revolutionized our investigative capabilities. This strategic intelligence helps us protect our platform more effectively.” Shann Lu Head of AML, Bitfinex Read the story ##### Every customer story Crypto exchanges, banks, telcos, and platforms on how they run law enforcement requests through Kodex. View all customer stories --- ## CPO Guide: Navigating Law Enforcement Data Requests | Kodex Source: https://www.kodexglobal.com/content/chief-privacy-officers-navigating-law-enforcement-data-requests The Ultimate Guide for Chief Privacy Officers ### Chief Privacy Officers’ Guide to Law Enforcement Data Requests Privacy vs. Public Safety Shouldn’t Be a Compromise. As a Chief Privacy Officer, you’re the gatekeeper of trust—balancing rigorous data privacy regulations, increasing law enforcement pressure, and the operational chaos that comes with every incoming subpoena, warrant, and emergency disclosure request. Imagine handling all of it—faster, smarter, and with complete confidence. Download our white paper and future-proof your response strategy. Get The Report What You’ll Learn 01 ##### How to Verify Law Enforcement Requests Without Falling for Social Engineering Protect your organization from fake emergency disclosures and credential compromises—Kodex’s “herd immunity” system flags impersonators using a global verification network of over 15,000 verified agencies and 80,000 investigators across 180+ countries. 02 ##### Build a Bulletproof Legal & Operational Framework Get a detailed playbook on how to design compliant, scalable, and jurisdiction-aware processes—from intake to secure data delivery, audit trails, and user notification. 03 ##### Turn Transparency Into a Trust Builder Learn how to craft transparency reports that meet industry best practices while reinforcing your company’s commitment to privacy and accountability. 04 ##### Leverage Real-World Use Cases Explore how CPOs can lead during high-profile investigations—like pig butchering scams—without compromising on user rights or corporate risk exposure. --- ## EDR Whitepaper: Fraudulent Law Enforcement Data Requests | Kodex Source: https://www.kodexglobal.com/content/edr-whitepaper Whitepaper ### Fraudulent Law Enforcement Data Requests A fraudulent emergency data request doesn’t look fraudulent. It looks urgent, official, and close enough to real that busy teams comply. This whitepaper covers how criminals use fake EDRs to pull sensitive data out of companies, why the attack keeps working, and what a verification process that stops it looks like. Get the whitepaper What you’ll learn 01 ##### How criminals use lawful data request channels to social engineer their way into sensitive company data. 02 ##### Why emergency disclosure requests have become a favored attack vector, and why traditional checks miss them. 03 ##### The verification practices that stop fraudulent EDRs before your team ever sees them. --- ## Law Enforcement Request Response Playbook | Kodex Source: https://www.kodexglobal.com/content/request-response-playbook Modern Request Response ### The Modern Law Enforcement Request Response Playbook Your data request process isn’t just inefficient—it’s vulnerable. Cybercriminals are selling fraudulent emergency data requests for $100; AI can generate convincing fake court documents in seconds; meanwhile, request volumes surge 40% annually. The old playbook is dead. Here’s the new one. Download the playbook What you’ll learn The soft underbelly of modern companies? Law enforcement data requests. This first-of-its-kind report shares how elite teams at Apple, Binance, Fidelity, and AT&T have transformed their request response operations from vulnerabilities into strategic strongholds. 01 ##### Why 100% of top performers have abandoned email-based processes 02 ##### The operational benchmarks that separate leaders from laggards 03 ##### How organizations achieve 80% automation while improving security 04 ##### The 5-level maturity model that takes teams from reactive to resilient 05 ##### Real transformation case studies with specific metrics and timelines --- ## Ready to Receive: The Service Provider's Guide to EU E-evidence | Kodex Source: https://www.kodexglobal.com/eu-e-evidence-ebook E-Book · Regulation (EU) 2023/1543 ### your action is required to continue receiving EU data requests. Ready to Receive is the service provider’s guide to EU E-evidence: the law, the deadlines, the readiness gap, and the one step that keeps you in control. Twelve chapters, one readiness checklist, free. - ✓ Sent instantly by email - ✓ Twelve chapters, one checklist - ✓ Unsubscribe anytime What’s inside 01 ##### From August 18, cross-border orders arrive as binding demands on fixed clocks: 10 days standard, 8 hours in an emergency. 02 ##### Every provider in scope registers in one member state and designates a contact empowered to respond. 03 ##### The orders and the four data categories in plain language, where every member state stands, and the readiness checklist your team runs before the deadline. 01 · What changes #### Requests will arrive through government portals. Today, a cross-border request comes into your own intake, on your own process. From August 18, authorities in any EU member state can send binding orders through a government portal in the state where you register: produce data in 10 days, or 8 hours in an emergency. Miss one, and the exposure runs to 2% of worldwide annual turnover. Implementing law in force - DE - HR - IT - LT - SK Draft law in progress - BE - CZ - FI - IE - NL - SE Not yet transposed - AT - BG - CY - EE - EL - ES - FR - HU - LU - LV - MT - PL - PT - RO - SI Opted out - DK Where member states stood in spring 2026. The deadline doesn’t move with their readiness: the obligation lands on August 18 either way. 02 · What providers have to do #### You must register, designate, and respond in time. Every provider in scope registers in one member state, its home base, and designates a contact empowered to receive and execute orders. From then on, every EU order routes through that state’s system: a second front door your team has to watch, on the regulation’s calendar, not your office’s. The clock starts when the order lands, not when someone sees it. 03 · Where the guide comes in #### This guide walks through the process. Ready to Receive covers the orders and the four data categories in plain language, where every member state actually stands, what operating the portal asks of your team, and the one step that keeps requests in the process you already run. It closes with a readiness checklist you can run this week. Accurate enough to brief counsel, plain enough to brief the board. --- ## EU e-Evidence Prep Talk: the recording and the Q&A Source: https://www.kodexglobal.com/eu-e-evidence-prep-talk-replay Webinar replay · August 6, 2026 ### EU e-Evidence Prep Talk: your questions, answered Webinar replay · August 6, 2026 Prep Talk: EU e-Evidence · 57:50 Q&A #### The questions we got, and what the panel said An hour of Q&A with no deck, and the questions were better than the ones we seeded. Here are the answers, summarized. This is the panel’s operational read, not legal advice, and the scope questions belong with your own counsel. Are we in scope if we’re US based with no EU entity? If you have customers or business operations in the EU, expect it to apply. The clearer tell is your existing mail. If you already receive MLAT requests or have any international law enforcement presence, plan on registering. When does the 10-day clock start? When the request arrives in whatever inbox the member state defined and you registered for. Web interface, API, Kodex, email. Receipt starts it. Whether the clock stops while you wait on enforcing authority approval is unsettled, and the Commission has raised it too, so have a written playbook for that case rather than a theory. What’s the difference between the issuing and the enforcing authority? The issuing authority is running the investigation and needs the data. The enforcing authority comes in when the request reaches outside that jurisdiction, or asks for a category like content data that triggers an extra approval. It’s usually also the member state where your legal entity sits. For a lot of Kodex customers that’s Ireland. Does the regulation apply retroactively to requests we already have? No. It shouldn’t convert requests received before August 18 into EPOCs or put them under the new deadlines. That reading comes from Article 34. Are request volumes going to jump? Kodex customers already see 15% to 30% annual increases in EU requests with no regulation in place, measured across hundreds of thousands of requests over two years. For after the 18th, the range being used in the project groups and in SIRIUS conversations runs from 30% to 300%. Nobody is forecasting a decrease. Is the 2% fine real? It’s in the regulation and it’s there to make providers hit the deadlines. It’s also a figure that appears across many EU regulations. Whether it gets enforced on day one is a separate question, and member states being behind on their own obligations is the basis for the hope that there’s an introduction period. Fines have landed under GDPR, the OSA and the DSA. What are the technical paths on day one? Three shapes are emerging. Member states with reference implementation infrastructure and an API path. Member states with neither, where email, existing intake channels and Kodex carry the traffic. And member states with a reference implementation, no API, and no appetite for alternatives. Expect a hybrid for a while. Where are the member states? Ireland looks like it wants a contingency period on August 18, with multiple intake paths. The Netherlands has moved tentatively to Q1 next year after setting out to build their own API. Sweden informally looks likely to start outside the DIS. Ireland, Germany and the Netherlands are the only three with real signal, and the API timelines are slipping partly because each member state is waiting for the others to go first. We only get a handful of EU requests. Do we need anything? The smaller teams are often under the most pressure, because there’s no dedicated function and a junior analyst ends up making a critical call about sharing data. Getting the intake path and the operating procedure right matters as much at low volume as at high, and it’s hard to derive either from reading the regulation. Transcript #### Full transcript The complete hour, lightly cleaned. Speaker names and timestamps included so you can jump to a moment in the recording above. John Weeke 00:00 We are live, everybody. Welcome to the first EU e-Evidence Prep Talk. I am John Weeke, your moderator today, and we have collected five of the foremost experts at Kodex when it comes to everything EU e-Evidence. Wanted to get together today to have a little conversation, share our knowledge, ask some questions, and find out what we should collectively be doing, and individually as companies be doing, to prepare for this big date coming up in less than two weeks. Ten days, I believe. So to introduce our panel, we've got three folks from the Kodex product team led by Jesse Goodman, Ike, and Avery, on the product and technical side. They've been going deep not only on Kodex's solution, but also talking to officials, talking to different companies, trying to figure out what the heck is going on. And then on the customer and growth side, we've got Mike and James. Mike, who leads our revenue function, and James, who if you are located in the EU or spend any time on LinkedIn, you've probably seen plenty. He has been having tons of conversations with folks out there. The format we're thinking today, we've got no slides, and we want this to be more of a quick rapid fire conversation and Q&A. Full disclosure, even on this panel, we're not all gonna necessarily agree with each other on what the right take should be. Maybe that's a good thing. We're trying to figure this out together. So EU e-Evidence goes live on August 18th. We're trying to figure out what this new world looks like. Let's say you've registered, it is 2:00 AM on a Sunday, and you've just received an emergency request from Bulgaria into the system. It is up to you to respond. How does this work in this new world, Jesse? Jesse Goodman 03:05 Thanks, John. Hey, everybody. Good to see you today. Appreciate you joining. So in this new world, what does this look like? We've obviously been working with all of our customers, with the member states, with ETSI, to understand the regulation and build systems and tools to be able to support this. A lot of our customers have been focusing on appointing a representative, determining whether they're in scope to have to register to be able to receive these requests in any member state, updating their policies potentially. And those things, in my mind, all matter. But I think one of the things that teams are missing when it comes to getting ready for day one is the technical systems and workflow and operating procedures. So the most important thing to me is what happens when you actually receive a request. Let's say it's in the middle of the night, on the weekend. What are the systems and processes that you have in place to be able to deal with that? If you dig into this a little bit deeper, that request comes in. Can you triage it in the right way? Can you determine whether it's an emergency? Do you have systems and tools to be able to notify an accountable person that's on call to be able to receive that request and deal with it right away? These eight-hour windows are tight. It's really different from what we've seen in the past, especially across the EU, where there is actually an enforceable deadline, an SLA, that's expected to respond to. And so being able to triage that, being able to validate the request, have the systems in place to check the signature of the request, and then as much as possible to automate all the things that can be done upfront so that if somebody's getting a page in the middle of the night, they already have a place to look at the request, to see whether they have responsive data to it, whether it's legally appropriate, whether there's enforcing state approval required, and to have all of that upfront work ready so that you can respond within that tight window. And to me, running through those scenarios, we're actually starting with our customers this week to test that specific scenario. Where you receive it, what do you do? What are the tools that are supported? Who does the request get assigned to? To me, that's the most important thing to have ready for day one. John Weeke 05:42 Agree there, Jesse. I can see we're getting a lot of questions about the Kodex platform specifically, which we love. We're gonna get into it, but first a couple more general questions about EU e-Evidence. One that we get often is, are we in scope, especially from our US-based companies. Even if we have no entity today in the EU, do we have to do anything? Mike. Mike Flores 06:18 Yeah. And I'll give the big disclaimer. Everybody should be working with their internal general counsel and any outside legal guidance on the specifics, because there are a lot of instances. But based off of what we know, if you have customers in the EU, you have business operations in the EU, the regulation would apply to you. And frankly, any company that's already receiving MLAT requests or has some sort of international law enforcement presence, or in the EU specifically, it is something that you should expect to need to register. But again, working with your internal legal team and really going through the regulation in depth is always gonna be our guidance. We are the tech provider. And for the companies that have already raised their hands saying that yes, this applies to me, and we need a way of being able to triage these and delineate them from other requests, we were working very closely. John Weeke 07:25 So another big question. In theory, not only does this change the process for service providers, it changes the process for requesters, and could make it a lot easier for law enforcement to make requests in the first place. We don't have a crystal ball, but I think we can make some assumptions as far as what impacts this could have on the demand side. James, what do you think? Are we going to expect higher request volumes on the 18th? James Clark 08:05 I mean, I'm always happy to make outlandish statements. Just from prep for this, one of the things that Jesse pointed out is that organically, most of our clients see annual increases of 15 to 30% without EU e-Evidence in existence. From the project groups that we've been involved with and the SIRIUS project, when we've been chatting to the teams there, it really varies. People are expecting somewhere between a 30% and a 300% increase in volume. No one's talking about a reduction in volume. And I think if I think about human nature, law enforcement have known that this is coming for a long time, and law enforcement know that they will now have a regulation where if they raise the request, they will get the data back. It's no longer about voluntary disclosure and a privacy team making that decision. So I can't see how there isn't something close to a tsunami level event of all of these agencies and law enforcement platforms that are waiting to be able to issue these orders and get this data back, having been frustrated basically since 2018 when GDPR came in. John Weeke 09:17 Agree. And Jesse, you just shared a stat that we're seeing an increase year over year in the number of requests already in the EU. Is that right? Jesse Goodman 09:31 Yeah. So we've run aggregated data analysis across our customer base, which is hundreds of thousands of requests over the past two years, and as James mentioned, we have seen on average about a 15 to 30% increase in requests to our customers across the EU. And that is pretty diverse. We see requests from most EU member states. Now whether or not, and this is where James and I and others have some interesting debate, there is enough resources and administrative support on the government side across these countries to be able to open the floodgates of requests. I think that's a great topic to discuss. As well, there are now mechanisms to alleviate sort of optional response or MLAT processes. We're not sure what the level of increase will be on top of what we've already seen. John Weeke 10:38 In addition to potential increases in volume, the number that keeps on getting thrown out is 2%. A 2% potential fine for non-compliance. Is this a real thing? This is of total revenue, so we could be talking a heck of a lot of money. Mike or Avery, what do you think? Avery Oracheff 11:07 I do think that this is something that's listed in the regulation and is a figure that's meant to encourage service providers to respond to these requests within the deadlines. That being said, this is a common figure that's in many different regulations across the EU, so we don't know for sure that this is going to be enforced on day one. But I'll let James go, I know you also have some context here. James Clark 11:30 Well, I think just the meetings that we've been involved with, with various national entities and the service providers that we're working with, there's this hope that there is a sensible introduction phase and they aren't coming out with fines on day one. Obviously there's some challenges in member states meeting the regulatory deadline in terms of getting architecture in place to issue this, and so there's a hope that there is a kind of sensible integration process to give service providers the chance to get up to speed. Obviously, we have seen fines in other regulatory regimes across GDPR, OSA, DSA, so it's definitely there. But we see this level of fine regularly included within a regulatory regime, so I don't think it's anything particularly special that anyone needs to think about differently. John Weeke 12:20 Let's get to the final general question before we dig into the Q&A, of which there are many, and they're great. Thank you for submitting. We're gonna get to as many of these as we can. Generally, what are our technical options when it comes to dealing with this? Ike, we haven't heard from you yet, and I know you're deep into it, so I'm gonna throw this to you. Ike Anude 12:46 Yeah. So the technical options for handling e-Evidence requests, or European production orders, is gonna be mainly the API that is supposed to be provided by the Commission, and their platform. They call it the reference implementation, the RI platform. Both of these platforms connect directly to eCODEX within your member state and are able to handle communication between member states. So eCODEX is kind of the infrastructure that already handles some of that interstate communication, but the main addition is going to be both the API and the reference implementation that allows service providers to handle requests directly from member states outside of their enforcing authority. John Weeke 13:32 Avery or Jesse, is there anything you'd like to add in terms of these technical options? Jesse Goodman 13:39 Yeah, I can start with that. What Ike referenced is definitely a big part of it that we've been preparing with our customers. We have built an API to the ETSI standard, which I suggest everybody take a look at if you haven't already. It is very detailed in terms of the technical architecture and how to set that up. I think that is the ideal solution down the road, when it is available, though we're seeing delays across pretty much every member state in opening that up for testing and implementation. We are also pursuing alternative paths. So Kodex, email, fax, regular portals that exist today are still applicable for member states that may be in scope for requests for you as a service provider, that do not have reference infrastructure in place or their systems in place to be able to serve and receive responses to requests. And that's where these alternative means, through Kodex or through other channels, are still available for the deadline, day one, especially if the bills for the legislation are passed within the member states that are in scope for you. That's definitely one method. We are also seeing a third channel where there might be a reference system in place for a member state, but no API and potentially no desire to use alternative channels. And so there are three different approaches that are definitely surfacing that I think will evolve over time. We're trying to understand those different scenarios and monitor each one of them. And from a Kodex perspective, we're prepared to receive requests manually just like we do today, through verified agents, through a centralized system, or through API. And even in the scenario where there's a member state that issues requests through their own system, there are still channels to be able to intake that manually and still use whatever case management system you have as a system of record. So there might be a bit of a hybrid approach to start, and ideally all of this then gets centralized and streamlined through API over time. Ike Anude 16:20 If I could go, I could take Monty's latest question. What he asked was, what are the latest timelines on the API implementation? When realistically do we believe the decentralized system will roll out? So I wanna separate two things. First off, the decentralized system, they call it the DIS. This is already preexisting. This is eCODEX. To call it a messaging platform might be a bit of a big word for what it is, but it's a decentralized network and messaging protocol to allow governments within the EU to communicate with each other. The API implementation will depend on the member state in terms of timeline. The API implementation is currently being developed by the European Commission. They have a testing group. There's a couple of companies and service providers that are testing with them currently. However, that API package needs to be sent to all the member states, who will then implement it under their own infrastructure. And that transition process should have happened a while ago. However, there's been all kinds of delays, all kinds of issues, and it is really hard to say for certain that they will be ready by X date. Some authorities are saying Q1 of next year, some are saying Q4 of next year. I think it's really hard to put an exact number on when that'll be done. But it is required by the regulation, so at the end of the day, they have to do it if they have transposed the regulation. John Weeke 17:56 Related question here from Luke. Can you confirm if Kodex are setting up APIs directly with member states, or just the European Commission as the decentralized IT system? You kind of touched on it. Anything that you'd wanna add? Ike Anude 18:13 Yeah. I touched on it a little bit, but again, the distinction is that the eCODEX system is something that the API connects to. Anything that the Commission is developing now connects to the eCODEX system. It's kind of the underlying infrastructure that connects all of these member states together. Jesse Goodman 18:34 I'll add to that, John. As far as the API connection, we are working through our customers as a technical implementation partner, which is specified in the regulation and standard, to be able to support them in connecting the Kodex API that we build according to the ETSI standard with a specific member state portal. And so as soon as those are available and ready for testing, we are ready and supporting our customers and making sure that they have the most scalable compliant solution. For any of the member states that are a little ahead of the game, like Ireland or Germany, some others, they are starting with sort of a phase one that includes some of the larger tech providers like Meta, Google, those that you would expect. And we are actually in discussion with those large tech providers to be able to share knowledge and best practice so that when they get to the next phase, we're able to learn from anything that happened previously and apply that to support our customers as their technical implementation resource. John Weeke 19:48 Great. So speaking of being the technical implementation resource, this is another question we've gotten a lot. What if a member state pushes back on working with Kodex as a third party? Obviously we want to be your solution for everything here, but we've seen some early signals that, can we even be in the room? Jesse Goodman 20:17 So the answer is, we have been in the room, and have been working with our customers who are in working groups with different member states and the EU Commission. And they have brought us as kind of a plus one to those sessions to be able to support them as their implementation partner. Through the registration process, we've also sent out guides, which we can share after the session, on how to register. And within that registration process, there are options to be able to select how you wanna receive requests for that specific member state. API is one of those options where you can select that, and we provide an endpoint URL on behalf of our service providers so that they can reference our standard API implementation as one of the options to receive requests when that technical capability is ready. John Weeke 21:19 So at the end of the day, it is your relationship with the member state. You're setting it up, you're creating your entity if you're creating it from scratch, and you can designate Kodex as the way of handling these requests. So we're all figuring it out together, but the conversation at the end of the day shouldn't be too tricky. Jesse Goodman 21:46 And I'll just... because we're in the spirit of challenging each other a little bit, John, I would say these words matter. The service provider is the legal entity that is signing up to receive requests, so those are our customers in this scenario. We are the technical implementation partner for service providers. And so I understand, we provide a service, and often that's a common term to use. In this case, I think that's where some of the confusion happens, because those terms are important and they have to tie back to the standard and the regulation. John Weeke 22:25 Agreed. And these are actual terms in the regulation itself, correct? Jesse Goodman 22:31 Yeah, exactly. So we'll learn, just like every company has its own acronyms and everything. There's a whole language here, and I think we're all learning that so that we're speaking the same language. John Weeke 22:43 So I think a related question here from Paula, maybe already asked and answered, but have you received assurances from the EC and/or EU member states that they will accept providers integrating with Kodex's solution as compliant? Answer in relation to both the short-term solution and the longer term eCODEX API integration we are offering. Is there a difference between the short term versus the long term? Ike Anude 23:12 I can take that one. Just to add to what Jesse said, 100%, words matter. We're not service providers, but the best way to think of us is as transparent to the member states. So for the most part, they are going to interact with our customers and see them as service providers. We're just handling, shuttling the requests back and forth and handling some of the operational business workflows. But in terms of assurances from the EC and the EU member states that they'll accept Kodex's solution as compliant, they will be developing according to a very specific standard that we had a hand in creating. So we've influenced some of the different endpoints and the business workflows within this particular spec. And as long as we are compliant with that spec and they are compliant with that spec, we should be compliant overall. James Clark 24:12 I was gonna say there's a good question that came in from Steve, which I am also keen to answer, just about how the requests that come in would be treated. Are they gonna appear as any other request? Are they delineated separately with different tabs? Ike and Avery are probably best placed, but I have seen this from a demonstration perspective. And from a user experience perspective, the clients that are already using Kodex and are used to that intake process, and how the analyst teams will be responding to intake, it's gonna look and feel exactly the same. It will be flagged as an EU e-Evidence regulatory intake. So from a user experience perspective, we don't expect any need for significant retraining of the team that are used to working in the platform. But it will be clear that the regulation applies to a specific ticket, and therefore you need to treat it with the timelines that are associated to it. Ten days, eight hours, et cetera. Mike Flores 25:12 Something that I would add to that, James. We haven't really talked a lot about the turnaround times. I know we talked about the penalties, but for some companies, 10 days to turn around a request is a pretty high hill to climb. And working a lot with companies that hadn't used Kodex before and they're transitioning from email or a Google form or maybe a self-built portal, I could see a major risk if one of those requests then gets blended in with all the other requests from their timeline or from their inbox. And then ultimately, if you already have a three to four-week delay, or I have some companies that have had like a two to three-month backlog on requests, that's a huge risk. And so I think having a way to triage those automatically, have them being set aside, having the ticklers on them and the reminders of, hey, this is how many days you have to respond. Which, if you are using Kodex as the backend, that's gonna be very clear. But even if some companies need to think about a dual path here, where okay, we need a separate solution or a separate instance for these EPOCs to come in. Just because we don't know what the volume's gonna be, we don't know what the impact's gonna be, I think it's a smart move, and we have many ways that we could explore doing that without a ton of lift. But it is important, certainly within Kodex, to have that delineation between, all right, I'm on the clock for these and there's a lot at stake, versus the ones that are just maybe your normal production orders. Jesse Goodman 27:05 John, if it's okay, I'd like to take a question from Mariel here. "Will the regulation also apply retroactively," referring to tickets presented before August 18th? Thank you. So again, I would suggest that you run this through counsel that you have supporting you. But the answer from my perspective is no. The regulation should not retroactively convert requests received before the deadline into EPOCs, or subject them to new response deadlines. That is an interpretation of Article 34 from the regulation. So as far as I'm concerned, the regulation does not allow for any of those requests to apply retroactively. John Weeke 28:02 Good to know. One more. Mike was talking about consequences. I have a fun question here regarding consequences. If we do not register, what happens? James Clark 28:15 We don't know. Who's gonna be the first to roll the dice and find out? Who wants to find out? Unclear. I don't think anyone can answer that at the moment. There'll certainly be repercussions. Ike Anude 28:34 Additionally, I wanna say it's better safe than sorry, because when you do register, depending on your member state, it's very common for people to fill out the forms wrong, the notification form incorrectly. And because of that, and unclear instructions on how to fill out the notification form, a lot of these member states are having trouble automatically approving people. So if you do make your best effort to register and document the entire process, this is obviously not legal advice, but it should give you a little bit of assurance in, okay, at least we tried, we made a good faith attempt, and if there's any challenge or any issues, we have documented every step of the way. John Weeke 29:31 If our member state of registration were to tell us they were ready to integrate tomorrow, are we ready to go immediately? And how long do you anticipate it would take to integrate once we get clear instructions? Jesse Goodman 29:49 The answer to ready to go is yes. We are ready to start testing, to look at the data going back and forth to make sure that's appropriate. The timeline shouldn't be more than a few weeks. But obviously we want the proof to be in the pudding once we have the opportunity to start testing. We have even gone so far as to vibe code a member state system. So we've tried to create and simulate a scenario that would involve integrating and testing with the system if and when they are ready. And so that's obviously something that's giving us more confidence to be able to apply that whenever we can, in quick order. So we're running the drills, we're doing the homework, and really building the muscle so that if and when the member states are ready, we're right there with them. John Weeke 30:54 Anything that you can share on readiness on the individual member states? I think that's been a hot topic as well. We've talked about Ireland and Germany. Any other signals, any specifics as far as status of those, if that's where our folks on the call are thinking about registering? Ike Anude 31:16 Yeah, I can speak to the Netherlands a little bit. The Netherlands wanted to originally build their own API. Now they're finding out that this is a little bit more difficult than they thought, so they are tentatively pushing it out to Q1 of next year. Now, I can't say, like I said earlier, I'm not sure if this is something that they're going to hold themselves to. And for the most part, from what we've heard from some of the bigger service providers, testing is a bit spotty on the Commission side. So I can't really give a very specific timeline for all the member states. We've only really heard about Ireland, Germany, and the Netherlands. John Weeke 32:00 Got it. Thank you. So we have another question from Monty. I don't think this has come up in any conversations internally before, so this could be a pass, but let's give it a try. Your perspective on future legislative tension between SCA and rejected Article 17 pushback. Do you have any EU perspective on the thousands of requests that could be tied up in courts weekly? Jesse, I see you're thinking hard on this one. Any thoughts? Jesse Goodman 32:34 I think for this one we have to pass on it. It's probably a whole other webinar in itself, and I think it's a super interesting question and an important one to address. But I would say it's a little nuanced to be able to get into a conversation today. John Weeke 32:53 We'll take this back to the lab, though. And maybe, who knows? I think Jesse just signed up for a whole other webinar. Jesse Goodman 33:01 Yeah, there we go. I'm always looking for another webinar excuse. John Weeke 33:06 All right, let's see what else we have. The deadline itself, and this is categorically similar to a question we've heard before and talked about internally. How hard is this deadline? How hard is the 2%? How hard is the 10-day, or the eight hour even? Obviously the blanket answer here is we don't know. But I'm curious, James, your thoughts on this, being geographically the closest to the EU. What's your guess? James Clark 33:44 I think it's gonna vary, and it's gonna vary on the provider, the case nature, and the severity to some degree. What we see typically when a regulation goes live is the implementation of the regulation deadline slips, but the expectation on the service providers to be able to comply with it often doesn't, and I think we've seen that repeatedly over multiple regulations going live across Europe. I suspect we're in a similar position again. So there are some things that mean the regulation isn't going to be delivered as expected on the 18th, but all of the conversations that we've seen is that the member states are making provisions so that even though their technical architecture isn't in place to support the API, they are going to be in a position to start to use this regulation to request the data that they want. Are they then going to enforce the 10-day deadline? I think perhaps to some degree at this stage it possibly depends on the relationship and the case nature. If they believe that you are working hard to try and address it, and that basically you are a kind of good corporate citizen in that response, maybe it buys you some flexibility. But from a legal perspective, I don't think that would stand up in court. There is a regulation that goes live. You have a compliance objective that you must meet, and then it's a question about how the enforcing agency would choose to see your behavior. Are we gonna see big fines early? Does Europe want to start making an example of service providers? It's like I'm answering questions with questions, but I would be taking every step I possibly could to be able to respond to this regulation as soon as it goes live, despite the technical limitations in member states being ready to use the API. Jesse Goodman 35:36 I'll add to that, John, and reference back to actually the first question of the webinar, which is, the deadline's here, what do I do? Or how do I prepare for that now, from today, for the next two weeks? And I think the answer is, if you're in scope and you've registered, and a member state has a means to be able to serve an EPOC or EPOC-PR, and the legislation has been passed within that member state, I think it's on service providers to be ready to respond to that request within the timelines defined for the regulation. And so preparing for that, and having the systems and clarity around how you receive those requests and how you respond, to me is the most important thing. Now, there are some gray areas that are really interesting that we've been discussing with our customers for a long time, that the EU Commission itself has even mentioned in their last webinar like this with service providers, and that is, when does the clock start? And I think the simple answer is, as soon as you receive it through whatever inbox has been defined by that member state and that you've registered for, that is when the clock starts. So that could be through a web interface for a country. That could be through API at some point in time. That could be through Kodex, through email. And as soon as you receive that, you are required to process and respond to that request within the SLA. Now there are some other gray questions, like if the issuing authority requires approval from the enforcing authority, are there stops in the clock along the way if you're waiting for that? And we've had some interesting discussions with our customers to say, well, if a specific EPOC does require enforcing authority approval, or may potentially require that approval, then we will wait five, six, seven days to determine whether we're able to respond, and then that last two or three days of the clock will be when everything is formally submitted. So there are different approaches to it. There's wait and see, but I think having the playbooks for those different situations operationally is the most important thing, so that you can try to meet those SLAs. John Weeke 38:17 Follow-up newbie question here. Can you define issuing versus enforcing authority? And who is responsible at the end of the day for judging whether you've met the 10-day deadline? Jesse Goodman 38:41 Sometimes I think of things in very simple ways. From my perspective, the issuing authority is the one that, in today's world outside of e-Evidence, is performing the investigation. There is an incident, or a situation that has occurred that's created the need for this data. And it's obviously the issuing authority's duty to go through the administrative process to get legal approval within their state to be able to receive the clearance through an EPOC to submit a data request. And so the issuing authority is essentially the one that is needing the data, and responding to some sort of investigative need. Now, that issuing authority may be requesting data outside of their jurisdiction, or a certain type of data that triggers an additional approval for situations like content data, for example, and that's where an enforcing authority may come in. And this translates pre e-Evidence, right? It's related to other types of GDPR interpretations and so on around cross-border data requests, and the legality for those requests. And so I think of the enforcing authority as the one that may need to approve the specific circumstance for certain types of data requests. And that enforcing authority may also be the primary location for which you have established your legal entity, or one of your legal entities, within the EU. And so that's kind of like your home base, I guess I would put it, is the enforcing authority, and they may need to provide additional approval if there's a request from an issuing authority outside of that jurisdiction. So for a lot of our customers, Ireland, for example, is their enforcing authority member state, where they're expecting to receive all of their requests from any country across the EU. And so there are these mechanisms in place to ensure the legality of those requests. John Weeke 41:05 Thank you. And that actually transitions to Monty's follow-up question. Ireland has been the number one topic in terms of our customers at Kodex thinking about whether it makes sense to register there. They're also farthest ahead in the implementation process. We've got actually some news this week. So Ike, can you reiterate your latest info on Ireland readiness, and any other detail you think might be useful? Ike Anude 41:34 So in terms of Irish readiness, they do appear to want us to be in a contingency period at the August 18th deadline. And this is still being more or less ironed out, there's still a bit of negotiation going on between large service providers and the Irish DOJ. But there will be multiple paths. Specifically the reference implementation, which is the web portal that's provided by the EU, plus any other kind of alternative methods, such as Kodex's portal or, for a large service provider, Meta's portal, to be able to handle requests. So that's why we said earlier that there's gonna be a lot of hybrid. There's gonna be a hybrid solution where there's not gonna be one specific channel where requests will be submitted and handled. However, this all will depend on what happens at go live, whether the Irish... And we're still pushing for the Irish to have this in writing, but based on the last working session, they said we'll be in the contingency period and there's gonna be multiple different avenues in which you can receive requests. I think maybe Avery could expand on that a little bit more, because she was also on the call. Avery Oracheff 42:55 Yeah, Ike, I think you did a great job summarizing that. I would just add that one of the biggest open questions that we had to the Irish DOJ is for a formal list of all member states that will, one, have transposed the regulation, and two, also be starting outside the DIS, so that service providers know what to expect on the 18th. But as Ike mentioned, today there's no commitment from member states that they'll share that with service providers, but we're really pushing to make sure that is clear so that everyone knows what's going on on the 18th. And then I may just jump into Paula's question about Sweden. We did hear, again informally, that they're likely going to start outside the DIS, but that would trigger the fallback plan. But in that sense, we don't have confirmation from Sweden that is the case. Ike Anude 43:43 To add to that, a lot of these countries, Germany and Ireland specifically, are waiting for everyone else to also be using the API, or to be integrated with the DIS. There's kind of this network effect issue where they want everyone to be using this API connected to DIS before they onboard. So it's kind of a weird catch-22, right? Where everyone is kinda waiting for everyone else to use the API before they use the API. So are they going to use the API? It's required. They have to. However, the timelines are just gonna get pushed out in the near term because of this kind of weird cat and mouse game. John Weeke 44:27 Last question, or second to last question. The EU-US CLOUD Act. Is it coming? How does it impact us? Jesse Goodman 44:38 I can take this one. Some of these questions are definitely important to have with legal counsel, so caveat that. This is a really important nuance for sure, and I would say that I would avoid saying Article 17 becomes entirely moot, but it should become substantially less relevant for conflicts based on US law. The anticipated EU-US agreement is specifically intended to remove these legal barriers that currently sit between US providers and qualifying European orders. However, as of today, official US and EU sources still describe the negotiations as ongoing, and no agreement has entered into force. So it's an interesting one, for sure, and I feel like those discussions are ongoing. John Weeke 45:56 Thank you. All right, one more from Paula here. Follow-up to the question of the DIS APIs. Avery, will we support outside the DIS? Avery Oracheff 46:10 Ike, actually I may lean on you for that question. I feel like you're the best person to answer that. Ike Anude 46:15 Yeah, I would like a bit of clarification here. What APIs are we referring to that are outside the DIS? The DIS is kind of the underlying infrastructure. The RI implementations connect to the DIS. I'm not sure which APIs we'd be able to integrate that wouldn't be part of the DIS, or at least connected in some way to the DIS. John Weeke 46:44 Paula, if you have any thoughts on that, feel free to follow up in chat or reply to the question. Jesse, anything you wanted to add there? Jesse Goodman 46:51 This is something I can say sort of not even specific to EU e-Evidence. If you were able to catch the last Kodex keynote, I talked about this a little bit in terms of how we think about overall infrastructure for the exchange of public-private data requests, or even in general system-to-system interactions. And so while we have built an API according to the ETSI standard for EU e-Evidence, we have also built essentially the infrastructure, we call it Intake Bridge, to be able to translate requests from any country or any system, and be able to interpret that and do the data mapping in order to ingest that request into Kodex as a centralized response source. And so outside of EU e-Evidence, we have been working around CLOUD Act, with Australia, with the UK for COPO, with India, as we see this trend across the board of governments moving to having platforms for issuing process and being able to exchange data for this type of business process and legal process. And so for us, while we're here obviously talking about this deadline and what is imminent and most top of mind, we're also preparing for that bigger picture, which is the full infrastructure regarding any API, and having the technical capability to do that translation and respond to any requests and have it feel close to the same. There's always gonna be nuances and specific legal requirements, but for us, the technical infrastructure we're hoping to standardize for any of these scenarios across the industry. John Weeke 49:03 Just to follow up, and I think you answered the question, Jesse. That's a follow-up to the Sweden-specific API implementation. But it sounds like Kodex is building the universal rails for any type of legal request, which by definition means that we will be able to support any type of API, any type of digital request. So I assume that means yes. Jesse Goodman 49:29 Yeah. And I think, ideally within the industry we align on best practices for authentication, for encryption, and that becomes a model that can be applied to any of these API specs. John Weeke 49:48 Hopefully that helps, Paula. Thank you. Ike, anything else? Ike Anude 49:52 Yeah. I just wanted to add that within the near term, if it complies with the ETSI specifications, we'll be able to handle it. And I think the intake bridge is our main... Like, as Jesse said, the intake bridge will handle any type of government to service provider translation from anywhere in the world. It is meant to be the kind of rails that all legal requests ride on. John Weeke 50:16 Everything into your own single portal. And going back to the question from 20 minutes ago, yes, you'll be able to see where it came from, as it's coming into your unified portal, handle things quickly, efficiently. All right, thank you Paula. James Clark 50:45 John, while you're doing that, I can just answer Steve's question. He asked early on, and I don't wanna not address Steve's important question, which was tell us about the opening rap song. I happen to know that Steve is a bit of a music producer in his spare time. I feel like Steve has just offered to help us with a more cynical European version of the introductory rap song for any future webinar that we might be hosting. So we'd definitely like to take you up on that, Steve. And thank you for the kind offer. John Weeke 51:16 Absolutely. You might join this webinar and think that Kodex is just wonky technical folks. Not true. We have style, we have talent. And so Steve, would love to chat later. And yes, if you stick around to the end, you're gonna be able to hear the song again as the outro. So I just had one other question. I feel like the folks on the call, they're deep into it, so this may or may not relate to you, but one of the questions we have gotten is, "If I'm a smaller provider, if I only receive a handful of requests today from the EU, do I need a solution at all? Should I just go ahead and register and monitor the inbox?" What do you suggest, Mike? Mike Flores 52:11 EU e-Evidence aside, I think there's a lot of companies that are on some side of the spectrum of how many requests they get on a daily basis, weekly basis perhaps. And I would say that just as far as best practice, we do have some walk-up usable version of Kodex that is for this exact purpose of receiving low volumes of EPOCs, making sure that they are covered from an audit trail perspective. And again, what I said earlier of having maybe a system that is set aside for these requests just to kind of cover your bases, I think would be wise. Especially if you do... I've worked with a lot of companies that are rapidly expanding internationally and have parts of their business that could be useful in an investigation. Think of it as insurance. Think of it as just thinking ahead, and you never wanna try to implement something too late. And we are interested if somebody is connecting and says, "I may get one of these in the next year. I may get 100." We are happy to talk through some options for anybody that just needs to have something in place, and we are being very flexible on anybody that needs to have an instance and somewhere to point these requests to. So my team would be happy to talk to anybody and just kind of walk through it. John Weeke 53:49 I think that, not to put words in your mouth, Mike, but I believe that we might have a... And most folks on the call are of course already Kodex customers, so this wouldn't apply to you, but as you were saying, Mike, anybody who's in that category of trying to figure something out, we've got a pretty special promo when it comes to helping you guys get set up, in the door easily. James Clark 54:15 John, I would just add something to that. Obviously the US team are often dealing with the very largest providers who already receive huge volumes of intake, and for them it's as much a capacity problem and a workflow problem about how they triage and manage that workflow. A lot of the European clients that I work with are at the other end of the spectrum. They are smaller in nature. They receive fewer number of intake requests. Typically, what that means is they don't have a dedicated team or a dedicated business function looking at this, and that falls to an analyst team or a team that is multifunctional across different areas. And one of the things that we've seen is that those teams are often the teams that need the most support. They need a dedicated platform. They need support with verification. And the platforms know that they've got what can often be a junior team making critical decisions about sharing data. So I think the smaller platforms that don't receive huge volumes, I would say it's as important to get best practice architecture, establish your standard operating procedures, and it can be difficult to do that reading through a regulation. If you take Kodex as a reference architecture, it helps to focus the mind in terms of what do we need to do? What decisions do we need to make? Who needs to be in the decision process? So we see a lot of the smaller clients with lower volumes still getting significant value from the platform. John Weeke 55:37 Everything much more manageable with Kodex, especially to your point, for smaller teams. All right, so that wraps it up, everybody. We are at time. So any last words of advice or anything like that? Anybody? All right, great. So you can find us on social media. All the folks here, tag them, follow up to questions. We are of course going to share this recording after the fact, and we learned some things here, so we're gonna update the EU e-Evidence handbook that you can see linked in the top right corner of the screen. If you don't already have that, please get your copy. And yeah, we are less than two weeks out, so good luck everyone, and we're here for you if you need anything. See y'all. --- ## EU E-evidence Starter Kit | Kodex Source: https://www.kodexglobal.com/eu-e-evidence-starter-pack EU E-evidence · Regulation (EU) 2023/1543 ### European Production Orders are addressed to your designated establishment. Kodex operates the endpoint they arrive at. The regulation has applied since August 18, 2026. In-scope cross-border orders run on clocks as short as 8 hours, and most member-state systems are not yet operational. Receive orders at your own Kodex endpoint, in the process you already run. Book your Starter Kit consultation Get ready in 30 minutes, with a Kodex expert. The orders #### A new kind of order, through a government portal. You register in one member state, and every EU order for your company arrives through that state's government system. Two orders matter most. EPOC ##### Production order Disclose the data. 10 days · 8 hours emergency EPOC-PR ##### Preservation order Hold the data, pending a request. Up to 60 days In scope: any provider serving EU users. Communications, cloud and SaaS, marketplaces, anyone holding data relevant to an investigation. The portal #### A government portal is a system you don't control. 01 ##### Outside your workflow A new system to log into and monitor, apart from the tools your team already runs. 02 ##### Easy to miss an order A binding order can sit in a portal nobody's watching until its deadline passes. 03 ##### On a tight clock 10 days to produce. 8 hours in an emergency. Build for it now, or sort it out under a live clock. Where Kodex fits #### We're already live across Europe. Kodex is the network for law enforcement data requests, and for EU E-evidence it operates the receiving endpoint registered to your designated establishment. Orders are addressed to you, certificates are issued in your name, and every decision on every order stays with you. Where a member state's system is not operational, Article 19(5) of the Regulation moves transmission to the most appropriate alternative means, and the Commission's contingency guidance lists secure platforms run for law enforcement data requests among them. 40,000+ LE agents in Europe Art. 19(5) The Regulation's own fallback route 25MB+ Evidence that always moves outside the government system Live In production today ##### Two intake paths Direct API where states are ready. An Article 19(5) path where they are not. ##### One queue EU E-evidence orders land with every other request. No new tool. ##### Deadlines tracked Kodex watches every clock, with alerts by email, Slack, and PagerDuty. EU E-evidence Starter Kit #### Get ready in 30 minutes. Book 30 minutes with a Kodex expert. We'll cover what the regulation asks of you, show you how orders move through Kodex, and help you register in your member state. - What the regulation means for your team now. - A live look at handling an EPOC in Kodex. - A registration path for your member state. - A plan, with time to spare. Book your consultation 30 minutes · with a Kodex expert Who this is for ##### In scope for EU E-evidence You offer services to users in the EU and hold electronic data covered by Regulation (EU) 2023/1543. ##### Ready to move now The regulation is already in force. Setup takes days. The EU E-evidence Starter Kit is for service providers in scope of Regulation (EU) 2023/1543 that process data of, or offer services to, users in the EU. Submitting this form is a request for a consultation, not a confirmed booking. Kodex reviews each request and confirms eligibility before scheduling. --- ## Law Enforcement Request Handbook for Betting & Gambling Source: https://www.kodexglobal.com/gambling-request-response-handbook E-Book · Betting, Gambling & Prediction Markets ### Every bookmaker became a bank. This is the handbook for what comes next. - ✓ Sent instantly by email - ✓ Seven parts, one maturity model - ✓ Unsubscribe anytime What’s inside 01 ##### The real request mix at a betting operator, from subpoenas and keep-open requests to FinCEN 314(a), and why your licensing map decides your inbox. 02 ##### Verification that holds against forged subpoenas and compromised government email accounts, the exact threat the FBI warned about in its November 2024 advisory. 03 ##### The five-level maturity model, the regulatory map across FinCEN, state gaming commissions, UKGC, AUSTRAC and the EU, and the rules for producing only what the law actually covers. 01 · What changed #### Betting operators became financial institutions. Since 2018, real-money wagering went from Las Vegas to 39 states plus DC, and regulated markets kept growing across the UK, Europe, and Australia. US commercial gaming revenue nearly doubled to $78.7 billion. Under US law, operators are financial institutions under the Bank Secrecy Act; under UK, EU, and Australian frameworks, obliged entities. Legal process follows money: Kraken’s government requests grew 38.6 percent in one year, Coinbase fields over ten thousand a year, and casinos filed roughly 77,000 suspicious activity reports in fiscal 2025. There is no reason to expect betting to be exempt. At many operators, the whole function is still one person with an inbox and a spreadsheet. 02 · The threat #### The requests are real. The requesters aren’t always. Forged subpoenas are cheap, good, and industrialized, and compromised law enforcement email accounts trade openly by country and agency. A betting operator’s response file holds verified identity, payment records, and a complete financial history, which makes this vertical a priority target. The handbook covers verification that works before any data moves: every requester, every time, at network scale. 03 · Where the handbook comes in #### The whole function, on the public record. Built on the public record: the enforcement ledger, the FBI’s own threat advisories, the statutes, and the operational playbook Kodex published for this function, translated for betting. Intake design, multi-entity routing, verification, production discipline, showing your work to regulators, and the maturity model to place your own operation. It closes with The Rules, one page your team can pin above the desk. --- ## Law Enforcement Request Management Resources | Kodex Source: https://www.kodexglobal.com/resources E-resources ### Law enforcement request research and reports Crime trends, benchmarks, and insights to stay ahead of emerging threats. Request a demo Resources Reports, e-books, keynotes, webinars, and guides on law enforcement data requests. --- ## The Revolut Breach, Explained | Free Kodex Report Source: https://www.kodexglobal.com/revolut-breach-explained-report 01 · What happened #### About 680 customers affected, according to reporting. Revolut says it disclosed customer records after receiving fraudulent requests from a legitimate government email domain. The exposed information included identity documents, verification selfies, and financial records. Reporting has since linked the requests to an Italian prefecture and described a campaign lasting months. Rival claimants have disputed responsibility, while reported ransom demands have added to the uncertainty. The report follows those developments and distinguishes confirmed statements from unresolved claims. 02 · How the requests appeared legitimate #### A genuine domain does not establish an authorized requester. An attacker controlling a real agency mailbox may send messages that pass email authentication. Italy’s certified email system can also provide a valid delivery record without establishing the sender’s authority to request customer data. The market for that access predates the Revolut disclosure. Listings collected by Kodex advertised Italian police email accounts for $200 and an EU police account for $1,000, with a matching forged ID offered for another $300. 03 · What your team can learn #### Use the evidence to review your own requests. Kodex flagged Italian police and Interior Ministry certified-email domains in January. Several accounts on the domain later identified in reporting attempted to register with Kodex during 2026. None passed verification. The report explains what those findings establish, how they inform verification, and what to look for in your own records: who requested the data, how they were checked, what was disclosed, and whether related requests reached other teams. --- ## Law Enforcement Request Benchmarks | Kodex Standard Report Source: https://www.kodexglobal.com/standard-report --- ## Prep Talk: EU e-Evidence | Live Q&A, August 6 | Kodex Source: https://www.kodexglobal.com/webinars/eu-e-evidence-live-discussion Q&A #### The questions we got, and what the panel said An hour of Q&A with no deck, and the questions were better than the ones we seeded. Here are the answers, summarized. This is the panel’s operational read, not legal advice, and the scope questions belong with your own counsel. Are we in scope if we’re US based with no EU entity? If you have customers or business operations in the EU, expect it to apply. The clearer tell is your existing mail. If you already receive MLAT requests or have any international law enforcement presence, plan on registering. When does the 10-day clock start? When the request arrives in whatever inbox the member state defined and you registered for. Web interface, API, Kodex, email. Receipt starts it. Whether the clock stops while you wait on enforcing authority approval is unsettled, and the Commission has raised it too, so have a written playbook for that case rather than a theory. What’s the difference between the issuing and the enforcing authority? The issuing authority is running the investigation and needs the data. The enforcing authority comes in when the request reaches outside that jurisdiction, or asks for a category like content data that triggers an extra approval. It’s usually also the member state where your legal entity sits. For a lot of Kodex customers that’s Ireland. Does the regulation apply retroactively to requests we already have? No. It shouldn’t convert requests received before August 18 into EPOCs or put them under the new deadlines. That reading comes from Article 34. Are request volumes going to jump? Kodex customers already see 15% to 30% annual increases in EU requests with no regulation in place, measured across hundreds of thousands of requests over two years. For after the 18th, the range being used in the project groups and in SIRIUS conversations runs from 30% to 300%. Nobody is forecasting a decrease. Is the 2% fine real? It’s in the regulation and it’s there to make providers hit the deadlines. It’s also a figure that appears across many EU regulations. Whether it gets enforced on day one is a separate question, and member states being behind on their own obligations is the basis for the hope that there’s an introduction period. Fines have landed under GDPR, the OSA and the DSA. What are the technical paths on day one? Three shapes are emerging. Member states with reference implementation infrastructure and an API path. Member states with neither, where email, existing intake channels and Kodex carry the traffic. And member states with a reference implementation, no API, and no appetite for alternatives. Expect a hybrid for a while. Where are the member states? Ireland looks like it wants a contingency period on August 18, with multiple intake paths. The Netherlands has moved tentatively to Q1 next year after setting out to build their own API. Sweden informally looks likely to start outside the DIS. Ireland, Germany and the Netherlands are the only three with real signal, and the API timelines are slipping partly because each member state is waiting for the others to go first. We only get a handful of EU requests. Do we need anything? The smaller teams are often under the most pressure, because there’s no dedicated function and a junior analyst ends up making a critical call about sharing data. Getting the intake path and the operating procedure right matters as much at low volume as at high, and it’s hard to derive either from reading the regulation. Transcript #### Full transcript The complete hour, lightly cleaned. Speaker names and timestamps included so you can jump to a moment in the recording above. --- ## Protect Subscriber Data from Law Enforcement Request Risks Source: https://www.kodexglobal.com/webinars/how-to-protect-subscriber-data-from-request-risks --- ## Live: Diving into the Data | Kodex Standard Report Webinar, November 12, 2026 Source: https://www.kodexglobal.com/webinars/standard-report-live --- ## Law Enforcement Data Request Glossary | Kodex Source: https://www.kodexglobal.com/glossary Glossary ### Law Enforcement Data Request Terms Plain-language definitions of the legal process, compliance, and verification terms that come up when a company receives a request for user data. Written for the legal, compliance, security, and trust & safety teams who have to act on them. #### A ##### Administrative Subpoena An administrative subpoena is issued by a government agency under a specific statutory grant of authority, rather than by a court or grand jury. Its reach is bounded by the statute that created it, which means the first question on receiving one is whether that agency has authority over your company at all. Also: agency subpoena, regulatory subpoena #### C ##### CLOUD Act The CLOUD Act establishes that US providers must produce data they control regardless of where it is stored, and creates a framework for bilateral agreements letting qualifying foreign governments serve orders on US providers directly. It also gives providers a route to challenge orders that conflict with foreign law. Also: Clarifying Lawful Overseas Use of Data Act ##### Chain of Custody Chain of custody is the documented record of who handled a piece of evidence, when, and what they did with it, from collection through to presentation. An unbroken chain supports the claim that evidence is what it purports to be and has not been altered; gaps invite challenges to its admissibility. ##### Cost Recovery Cost recovery is the reimbursement a company may seek for the expense of responding to legal process. In the United States, 18 U.S.C. § 2706 entitles providers to reasonable reimbursement for costs directly incurred in searching for, assembling, and producing the requested data. Also: reimbursement, 2706 reimbursement ##### Court Order A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires. #### E ##### Electronic Communications Privacy Act (ECPA) ECPA is the 1986 US statute governing government access to electronic communications. It has three parts: the Wiretap Act covering interception in transit, the Stored Communications Act covering data at rest, and the Pen Register Act covering real-time addressing data. Also: ECPA ##### Emergency Disclosure Request (EDR) An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive. Also: EDR, emergency data request, exigent request ##### European Production Order (EU e-Evidence) A European Production Order lets a judicial authority in one EU member state require a service provider in another to hand over electronic evidence directly, without routing through the second state’s government. Introduced by the EU e-Evidence Regulation, it carries short deadlines: generally ten days, or eight hours in an emergency. Also: EPOC, e-Evidence Regulation, European Preservation Order #### F ##### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. Also: fake EDR, fraudulent EDR, forged emergency request #### G ##### Grand Jury Subpoena A grand jury subpoena is issued in the name of a grand jury investigating potential criminal conduct, and compels the production of documents or testimony. It is issued by prosecutors without prior judicial review, and grand jury secrecy rules restrict what the prosecution may disclose about the proceeding. Also: federal grand jury subpoena #### L ##### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. Also: LEEC, police email compromise, law enforcement account takeover ##### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. Also: police impersonation, agency impersonation ##### Legal Hold A legal hold is an internal instruction suspending the routine deletion of records that may be relevant to anticipated or pending litigation or investigation. Unlike a preservation request, it is imposed by an organisation on itself, and the duty to issue one arises as soon as litigation is reasonably foreseeable. Also: litigation hold, preservation hold #### M ##### MLAT Request An MLAT request is a formal request for evidence made by one country to another under a mutual legal assistance treaty. Rather than a foreign agency contacting a company directly, the request travels government to government and is executed using the receiving country’s own legal process. Also: MLAT, mutual legal assistance treaty request #### N ##### National Security Letter (NSL) A national security letter is an administrative demand issued by the FBI, without prior judicial approval, for limited subscriber and transactional records in national security investigations. It can carry a non-disclosure requirement, and it cannot compel the contents of communications. Also: NSL ##### Non-Disclosure Order A non-disclosure order directs a company not to tell a user that their data was requested. It is a separate instrument from the process compelling production, is issued for a defined period, and requires the government to show that notice would cause a specific harm such as flight, evidence destruction, or danger to an individual. Also: gag order, NDO, 2705(b) order #### O ##### ORI Number An ORI number is a nine-character Originating Agency Identifier assigned by the FBI to US criminal justice agencies authorised to access national systems. It identifies which agency an action came from, and it is a useful corroborating signal in verification, though it is not a credential. Also: Originating Agency Identifier, ORI #### P ##### Pen Register and Trap and Trace A pen register records outgoing addressing information and a trap and trace device records incoming addressing information, prospectively and in real time. Both capture who communicated with whom, not what was said, and both are authorised on a certification standard lower than probable cause. Also: pen/trap, pen register order ##### Preservation Request A preservation request asks a company to retain specified records so they are not deleted while law enforcement obtains legal process. It compels retention, not disclosure: no data is handed over. In the United States it is grounded in 18 U.S.C. § 2703(f) and generally runs for 90 days, renewable once. Also: 2703(f) request, preservation letter, data freeze request #### R ##### Redaction Redaction is the permanent removal of information from records before they are produced, typically to withhold data about third parties or material outside a request’s scope. Effective redaction removes the underlying data rather than obscuring it visually, and failures here are usually technical rather than editorial. ##### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. Also: agent verification, law enforcement verification ##### Responsive Records Responsive records are the documents and data that actually fall within the scope of a specific request. Determining what is responsive is a scoping judgement, and getting it wrong in either direction means either failing to comply or disclosing more of a user’s data than the law required. Also: responsive data, responsive documents #### S ##### Search Warrant A search warrant is an order issued by a judge authorising a search or seizure, granted only on a showing of probable cause. In data request work it is the instrument required to compel the contents of communications, and it is the highest legal threshold a company is likely to encounter. Also: warrant, Rule 41 warrant ##### Stored Communications Act (SCA) The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach. Also: SCA, 18 U.S.C. 2701 ##### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. Also: subpoena duces tecum #### # ##### 2703(d) Order A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause. Also: d order, court order for records, 18 U.S.C. 2703(d) --- ## What Is a 2703(d) Order? Definition and Scope | Kodex Source: https://www.kodexglobal.com/glossary/2703d-order Legal Process ### 2703(d) Order A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause. Also known as d order, court order for records, 18 U.S.C. 2703(d) The 2703(d) order occupies the middle rung of the Stored Communications Act ladder. It exists because Congress recognised that not all non-content data is equally sensitive: the fact that an account exists is different from a detailed log of everywhere it connected from. #### What a 2703(d) order reaches It compels records concerning an electronic communication service or remote computing service. That is the transactional layer sitting between basic subscriber data and content: - Connection logs and session records - Addressing and routing information, such as who a user communicated with and when - Length and type of service used - Device and network identifiers associated with an account What it does not reach is the content of communications. That boundary is the point of the tiered structure. #### Where it sits between a subpoena and a warrant 2703(d) orderSubpoena Legal standard Specific and articulable facts Relevance to an investigation Who issues it A judge or magistrate Prosecutor, grand jury, or agency Prior judicial review Yes Not generally Reaches transactional records Yes Limited to basic subscriber information Reaches content No No Understanding the ladder matters at intake because requesters do not always ask for what their instrument can compel. A subpoena that demands detailed connection logs is asking for records that generally require a 2703(d) order, and a company producing them anyway has disclosed more than the law required of it. #### What it means for a company receiving one - Check the instrument against the ask. The most common problem is scope creep, where the attached request asks for content the order cannot compel. - Note the date range. Transactional records accumulate quickly, and an unbounded range is worth pushing back on. - Check for a separate non-disclosure order. A 2703(d) order can be accompanied by a § 2705(b) order restricting notice, but it does not restrict notice on its own. #### Why it is contested The tiering was designed in 1986, and technology moved. Location data was the sharpest example: cell site location information was long obtained under 2703(d), until the Supreme Court held in Carpenter v. United States (2018) that acquiring historical cell site records is a search requiring a warrant. That decision did not dismantle the 2703(d) framework, but it established that some categories of record are sensitive enough to demand probable cause regardless of which tier they nominally occupy. Similar arguments continue over other categories of transactional data. FAQ #### Frequently asked questions What does specific and articulable facts mean in practice? It requires the government to point to concrete facts supporting a reasonable belief that the records are relevant and material to an ongoing criminal investigation. It is more than a hunch and more than mere relevance, but it does not require showing that a crime probably occurred, which is what probable cause demands. Can a 2703(d) order compel message content? No. Content requires a search warrant. A 2703(d) order reaches records concerning an account (logs, connection records, addressing information, service use) but not what was written or stored inside it. Who issues a 2703(d) order? A court. Unlike a subpoena, which a prosecutor or agency can issue directly, a 2703(d) order requires a judge or magistrate to review the government’s factual showing and decide that the standard is met. Glossary #### Related terms ##### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. ##### Search Warrant A search warrant is an order issued by a judge authorising a search or seizure, granted only on a showing of probable cause. In data request work it is the instrument required to compel the contents of communications, and it is the highest legal threshold a company is likely to encounter. ##### Stored Communications Act (SCA) The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach. ##### Court Order A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires. Classifying process correctly is the whole intake decision. See how Kodex structures it. Learn more --- ## What Is an Administrative Subpoena? | Kodex Source: https://www.kodexglobal.com/glossary/administrative-subpoena Legal Process ### Administrative Subpoena An administrative subpoena is issued by a government agency under a specific statutory grant of authority, rather than by a court or grand jury. Its reach is bounded by the statute that created it, which means the first question on receiving one is whether that agency has authority over your company at all. Also known as agency subpoena, regulatory subpoena Administrative subpoenas are the most heterogeneous instrument a company receives, because there is no single administrative subpoena. There are dozens of statutory schemes, each with different scope, and the differences matter. #### What an administrative subpoena is It is a demand for records issued by an executive or regulatory agency under authority Congress or a legislature gave it directly. No court issues it and no grand jury stands behind it. The authority comes from the enabling statute, and so do the limits. That structure produces the defining question at intake: does this agency have statutory authority that reaches this company and these records? For a court-issued instrument the answer is usually straightforward. For an administrative subpoena it genuinely may not be. #### Where its limits come from Administrative subpoenaGrand jury subpoena Issued by A government agency Prosecutors, in a grand jury’s name Source of authority A specific enabling statute The court’s authority Typical context Regulatory or civil enforcement Criminal investigation Scope limits Defined by the enabling statute Broad, bounded by relevance Enforcement if refused Agency generally must seek a court order Contempt #### What it means for a company receiving one - Identify the statute. A valid administrative subpoena should cite the authority it is issued under. If it does not, ask. - Test whether that authority reaches you. Being a company that holds data is not the same as being a regulated entity under the cited statute. - Check the scope against the statutory purpose. Authority granted for a defined regulatory purpose does not extend to records unrelated to it. - Do not treat agency letterhead as authority. Some requests that look like administrative subpoenas are voluntary requests dressed in formal language. Whether the instrument actually compels anything is worth establishing before treating it as compulsory. #### Why this one deserves extra scrutiny Because the authority varies by statute, administrative subpoenas are harder to pattern-match than court process, and harder for an intake team to reject confidently. That ambiguity is exactly what makes them attractive to forge. A fraudulent request that cites a plausible-sounding statute and arrives on agency letterhead can survive a review that would catch a fake warrant immediately, because there is no court docket to check it against. Verifying the requester matters here for the same reason it matters with emergency requests: the document itself is not self-authenticating. FAQ #### Frequently asked questions Can any agency issue an administrative subpoena? No. The power has to be granted by statute, and the grant defines its limits. An agency with subpoena authority over healthcare records does not thereby have authority over an unrelated business. Confirming that the issuing agency has statutory authority reaching your company is the first validity check. Is an administrative subpoena enforceable without going to court? Generally the agency must seek judicial enforcement if the recipient does not comply. That said, non-compliance is not cost-free, and the safer route when a subpoena appears overbroad is a formal objection rather than silence. Does it reach the contents of communications? No. Like other subpoenas, it does not overcome the Stored Communications Act’s content protection. Content generally requires a warrant. Glossary #### Related terms ##### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. ##### Grand Jury Subpoena A grand jury subpoena is issued in the name of a grand jury investigating potential criminal conduct, and compels the production of documents or testimony. It is issued by prosecutors without prior judicial review, and grand jury secrecy rules restrict what the prosecution may disclose about the proceeding. ##### Court Order A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires. See how Kodex validates issuing authority at intake. Learn more --- ## What Is Chain of Custody for Digital Evidence? | Kodex Source: https://www.kodexglobal.com/glossary/chain-of-custody Request Operations ### Chain of Custody Chain of custody is the documented record of who handled a piece of evidence, when, and what they did with it, from collection through to presentation. An unbroken chain supports the claim that evidence is what it purports to be and has not been altered; gaps invite challenges to its admissibility. Chain of custody predates digital evidence by a long way, and the underlying question is unchanged: can you show this is the same thing you collected, unaltered? #### What the record establishes Two claims, both of which can be contested: - Authenticity. The data is what it is said to be, from the account and system claimed. - Integrity. It has not changed since collection. Neither is self-evident from the data itself. A file proves nothing about its own provenance. The record is what makes the claims testable. #### What a defensible chain contains For every step from collection to delivery: - Who performed the action, identified specifically - When, to a meaningful precision, with timezone - What system the data came from - What was done: collected, converted, redacted, transferred - Where it went next, and how it was protected in transit and at rest Cryptographic hashing is the part that does the heavy lifting for digital evidence. A hash computed at collection and re-verified at any later point demonstrates the content did not change in between, which no amount of narrative documentation can establish as convincingly. #### Where digital evidence differs Physical evidenceDigital evidence Alteration Usually leaves visible traces Can be undetectable without hashing Copying Produces a distinguishable copy Produces an identical copy Custody One holder at a time Can exist in many places at once Integrity proof Seals, signatures, storage records Cryptographic hashes The row that matters most is the last. Because a digital copy is indistinguishable from its source, the procedural controls that work for physical evidence do not transfer, and hashing is what replaces them. #### What it means for a company producing data - Timestamp and attribute every step, including automated ones. - Hash at collection, and record the hash where it can be produced later. - Log the export, including which query or scope produced the set. - Track redaction as a step in the chain, not outside it. A redacted production is a derived artefact and the derivation should be recorded. - Keep the record as long as the matter could live. Prosecutions and appeals run for years, and the person asked to attest to a collection may not be the person who performed it. That last point is the practical argument for making this systemic rather than procedural. A chain of custody that depends on one engineer remembering what they did in a particular week is not a chain of custody. FAQ #### Frequently asked questions Does chain of custody apply to data a company produces in response to a request? Yes. Data produced to law enforcement may end up as evidence in a prosecution, and the defence may test how it was collected, whether it could have been altered, and whether the producing company can attest to its integrity. A production with no supporting record is harder to authenticate. What does a defensible record actually contain? For each step: who performed it, when, what system the data came from, what was done, and where the data went next. Cryptographic hashes taken at collection and verified later are the strongest evidence that content did not change in between. What happens if the chain is broken? Evidence is not automatically excluded, but the gap becomes an argument. Opposing counsel can contend the data may have been altered or misattributed, and courts weigh the significance of the break. The practical cost lands on whoever has to testify about what happened during the gap. Glossary #### Related terms ##### Responsive Records Responsive records are the documents and data that actually fall within the scope of a specific request. Determining what is responsive is a scoping judgement, and getting it wrong in either direction means either failing to comply or disclosing more of a user’s data than the law required. ##### Redaction Redaction is the permanent removal of information from records before they are produced, typically to withhold data about third parties or material outside a request’s scope. Effective redaction removes the underlying data rather than obscuring it visually, and failures here are usually technical rather than editorial. ##### Legal Hold A legal hold is an internal instruction suspending the routine deletion of records that may be relevant to anticipated or pending litigation or investigation. Unlike a preservation request, it is imposed by an organisation on itself, and the duty to issue one arises as soon as litigation is reasonably foreseeable. See how Kodex maintains auditable records of every request and production. Learn more --- ## What Is the CLOUD Act? Cross-Border Data Rules | Kodex Source: https://www.kodexglobal.com/glossary/cloud-act Compliance & Regulation ### CLOUD Act The CLOUD Act establishes that US providers must produce data they control regardless of where it is stored, and creates a framework for bilateral agreements letting qualifying foreign governments serve orders on US providers directly. It also gives providers a route to challenge orders that conflict with foreign law. Also known as Clarifying Lawful Overseas Use of Data Act The CLOUD Act was Congress’s answer to a specific stalemate. Microsoft had refused a US warrant for email stored in Ireland, arguing the warrant could not reach outside US territory. The case reached the Supreme Court and was mooted when Congress legislated. #### What the CLOUD Act settled The first half of the statute is short and consequential: a US provider must preserve and produce data within its possession, custody, or control, regardless of whether that data is stored inside or outside the United States. This replaced a territorial test with a control test. Where the bytes physically sit stopped being the question. Whether the provider can reach them became the question. #### The bilateral agreement framework The second half addresses the reverse direction. Foreign governments investigating their own crimes frequently need data held by US providers, and the MLAT route took the better part of a year. The CLOUD Act allows the US to enter executive agreements with qualifying countries, under which their authorities can serve orders on US providers directly. Qualification is conditional. A partner country must afford robust substantive and procedural protections for privacy and civil liberties, and agreements carry restrictions including that orders may not target US persons or people located in the United States. CLOUD Act agreementMLAT Who serves the provider The foreign authority directly Domestic authority, after review Typical timeline Days to weeks Many months Government-to-government review of each request No Yes Available to any country No, only qualifying partners Wherever a treaty exists #### Conflict of laws Removing the territorial limit created an obvious problem: a US order could require a provider to do something another country’s law forbids. The comity mechanism lets a provider move to quash where the target is neither a US person nor located in the US and compliance would risk violating a qualifying foreign partner’s law. Courts weigh factors including the interests of both governments and the target’s connection to each. This is narrower relief than it first appears. It applies to qualifying foreign governments, and it does not resolve every tension. The relationship between US orders and the GDPR, in particular, is still argued over rather than settled. #### What it means for a company receiving requests - Storage location is not a defence to a valid US order if you control the data. - Check whether an order arrives under a CLOUD Act agreement, since that changes who may lawfully serve you and what limits apply. - Raise genuine conflicts early. The comity route exists, but it requires being invoked rather than discovered afterwards. - Expect the map to keep changing. New agreements come into force periodically, and each expands who can reach you directly. FAQ #### Frequently asked questions Does the CLOUD Act mean data location no longer matters? For the question of whether a US provider must respond to US legal process, largely yes. The test is control, not storage location. Data location still matters for other purposes, including local data protection law, sovereignty requirements, and whether producing the data would breach another country’s law. What is a CLOUD Act agreement? A bilateral executive agreement allowing a qualifying foreign government to serve orders directly on US providers for data relating to its own investigations, bypassing the MLAT process. Qualification requires the partner country to meet standards on privacy, civil liberties, and the rule of law, and agreements exclude targeting US persons. What happens if a US order conflicts with foreign law? The CLOUD Act provides a comity mechanism: a provider can move to quash where the target is not a US person, is not located in the US, and compliance would create a material risk of violating a qualifying foreign government’s law. The court then weighs the competing interests. Glossary #### Related terms ##### MLAT Request An MLAT request is a formal request for evidence made by one country to another under a mutual legal assistance treaty. Rather than a foreign agency contacting a company directly, the request travels government to government and is executed using the receiving country’s own legal process. ##### European Production Order (EU e-Evidence) A European Production Order lets a judicial authority in one EU member state require a service provider in another to hand over electronic evidence directly, without routing through the second state’s government. Introduced by the EU e-Evidence Regulation, it carries short deadlines: generally ten days, or eight hours in an emergency. ##### Stored Communications Act (SCA) The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach. Cross-border obligations are shifting. See Kodex’s guidance on the current landscape. Learn more --- ## What Is Cost Recovery for Data Requests? | Kodex Source: https://www.kodexglobal.com/glossary/cost-recovery Request Operations ### Cost Recovery Cost recovery is the reimbursement a company may seek for the expense of responding to legal process. In the United States, 18 U.S.C. § 2706 entitles providers to reasonable reimbursement for costs directly incurred in searching for, assembling, and producing the requested data. Also known as reimbursement, 2706 reimbursement Cost recovery is the part of a data request programme most likely to be sitting unused. The legal entitlement is well established; the operational capacity to exercise it usually is not. #### The statutory basis Section 2706 provides that a governmental entity obtaining information under the relevant provisions shall pay the provider a fee for reasonable reimbursement of costs directly incurred in searching for, assembling, reproducing, or otherwise providing the information. The amount is as agreed between the parties, or as determined by a court where they disagree. Exceptions apply, and the significant one for many providers concerns certain records of a provider’s own subscribers or customers sought by a government entity. Whether a given request is recoverable turns on its type and the records sought, so the analysis is per-request rather than global. #### Why entitlement does not translate into recovery What the statute allowsWhat most programmes can do The obstacle is measurement. An invoice has to be substantiated, and substantiation requires knowing what a specific request actually cost. Teams handling requests through shared inboxes and ad hoc workflows have no per-request record of effort, so there is nothing to bill from. The entitlement is not disputed; it is simply unexercised. #### What a recoverable programme needs - Per-request time capture. Not estimates after the fact, but recorded effort at each stage. - A defensible rate basis. Loaded cost of the roles doing the work, applied consistently. - A record of what was done. Searches run, records reviewed, volume produced. - A billing route. Agencies have processes for paying these invoices, and someone has to own submitting them. #### Why it matters beyond the money Cost recovery is often the mechanism by which a data request programme gets funded rather than tolerated. Legal and trust & safety teams handling growing request volumes usually compete for headcount against functions with clearer revenue stories. A programme that recovers its own costs changes that conversation, and the tracking that makes recovery possible is the same tracking that makes volume, response time, and staffing needs visible in the first place. FAQ #### Frequently asked questions Are companies entitled to be paid for responding to legal process? In the United States, 18 U.S.C. § 2706 provides for reasonable reimbursement of costs directly incurred in searching for, assembling, reproducing, and otherwise providing the data. There are exceptions, notably for certain records of a provider’s own subscribers sought by a government entity, so what is recoverable depends on the request type. Why do so few providers claim it? Because claiming requires per-request cost tracking that most programmes do not have. If nobody records how long a request took and what it involved, there is no basis to invoice. The entitlement goes unused not because it is contested but because the underlying data was never captured. What costs are recoverable? Costs directly incurred in responding: staff time searching for and assembling records, reproduction, and the mechanics of delivery. General overhead and the cost of building a compliance function are ordinarily not recoverable, since they are not attributable to a specific request. Glossary #### Related terms ##### Responsive Records Responsive records are the documents and data that actually fall within the scope of a specific request. Determining what is responsive is a scoping judgement, and getting it wrong in either direction means either failing to comply or disclosing more of a user’s data than the law required. ##### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. Most teams never invoice for work they are entitled to recover. See what your programme is leaving on the table. Learn more --- ## What Is a Court Order for User Data? | Kodex Source: https://www.kodexglobal.com/glossary/court-order Legal Process ### Court Order A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires. “Court order” is a category, not an instrument. Two documents both correctly described as court orders can carry completely different legal standards and compel completely different things. Reading past the label is the whole job. #### What falls under the label - Search warrants: probable cause, reach content. - 2703(d) orders: specific and articulable facts, reach transactional records. - Non-disclosure orders: compel silence, not production. - Pen register and trap-and-trace orders: authorise prospective collection of addressing information. - Preservation directives issued by a court: compel retention. The instruments differ in who applied for them, what showing was required, and what they authorise. #### Reading an order correctly Order compelling productionNon-disclosure order What it requires Hand over specified records Do not notify the user Typical statutory basis 2703(a)-(d), or Rule 41 18 U.S.C. § 2705(b) Has an expiry Compliance date Defined period, renewable Consequence of over-compliance Disclosing beyond scope None; silence has no scope Consequence of non-compliance Contempt Contempt #### What it means for a company receiving one - Establish the statutory basis first. It determines the ceiling on what can be compelled. - Distinguish the production obligation from the notice obligation. They are separate and frequently arrive as separate documents; having one does not imply the other. - Check that the issuing court has jurisdiction over you. Cross-border orders raise this directly. - Verify the order is genuine. Orders name a court, a judge, and a case number. Those can be checked with the issuing court, which is the definitive test and one a forgery cannot survive. #### Why classification is the highest-leverage step Almost every serious error in a data request programme traces back to misclassifying an instrument at intake. Producing content against an order that only reached transactional records over-discloses. Treating an assertion of secrecy as a non-disclosure order gives up a user’s notice rights for nothing. Treating a voluntary request as compulsory hands over data no one could have compelled. None of these are hard to avoid, but all of them require reading the instrument rather than the cover email. FAQ #### Frequently asked questions Is a court order the same as a warrant? A search warrant is one kind of court order, but not all court orders are warrants. A warrant requires probable cause and reaches content. Other orders, such as one issued under 18 U.S.C. § 2703(d), apply a lower standard and reach less. Treating every order as a warrant leads to over-disclosure. How do I tell what an order actually compels? Read the operative language and the statutory authority cited, not the caption. An order will state what the recipient must do and under what provision it was issued. Where the order is ambiguous, ask the issuing agency to clarify in writing before producing. Can a court order require a company to stay silent? Yes. A non-disclosure order, typically issued under 18 U.S.C. § 2705(b), directs a provider not to notify the user for a specified period. It is a separate instrument from the order compelling production, though the two often arrive together. Glossary #### Related terms ##### Search Warrant A search warrant is an order issued by a judge authorising a search or seizure, granted only on a showing of probable cause. In data request work it is the instrument required to compel the contents of communications, and it is the highest legal threshold a company is likely to encounter. ##### 2703(d) Order A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause. ##### Non-Disclosure Order A non-disclosure order directs a company not to tell a user that their data was requested. It is a separate instrument from the process compelling production, is issued for a defined period, and requires the government to show that notice would cause a specific harm such as flight, evidence destruction, or danger to an individual. See how Kodex classifies incoming legal process. Learn more --- ## What Is ECPA? The Three Parts Explained | Kodex Source: https://www.kodexglobal.com/glossary/ecpa Compliance & Regulation ### Electronic Communications Privacy Act (ECPA) ECPA is the 1986 US statute governing government access to electronic communications. It has three parts: the Wiretap Act covering interception in transit, the Stored Communications Act covering data at rest, and the Pen Register Act covering real-time addressing data. Also known as ECPA ECPA is best understood as an umbrella rather than a single rule. Asking “what does ECPA require” is usually the wrong question; the right one is which of its three titles applies. #### The three titles Title I: the Wiretap Act. Governs intercepting communications in transit. The standard is the highest in the statute: probable cause, plus a showing that other investigative techniques have been tried and failed or would be futile, plus ongoing judicial supervision and minimisation requirements. Live interception of content is treated as the most serious intrusion available. Title II: the Stored Communications Act. Governs access to communications and records at rest with a provider, through the tiered system where subpoenas reach basic subscriber information, 2703(d) orders reach transactional records, and warrants reach content. Title III: the Pen Register Act. Governs prospective collection of addressing information, under a certification standard rather than a factual showing. Wiretap ActStored Communications Act Data state In transit At rest Reaches content Yes Yes, with a warrant Standard Probable cause plus necessity Tiered by data type Ongoing obligation Yes, with supervision No, one-time production Frequency for providers Rare Routine #### Why the architecture creaks ECPA was written when email was downloaded from a server and deleted, cloud storage was not a consumer product, and a mobile phone did not generate a continuous location record. Several of its distinctions have aged poorly. The best-known is the 180-day rule, under which older stored messages were treated as abandoned and available on a lower standard, a distinction that made sense when storage was scarce and makes none now. Major providers have long required warrants for content regardless, and courts have supported that position. #### What it means for a company receiving requests - Identify the title first. It determines the standard, the obligation type, and whether you are producing once or operating a capability. - Do not rely on the 180-day distinction. Requiring a warrant for content regardless of age is the mainstream provider position and the defensible one. - Expect the Stored Communications Act to be the operative title in almost all routine work. FAQ #### Frequently asked questions What is the difference between the Wiretap Act and the Stored Communications Act? Timing. The Wiretap Act governs interception of a communication while it is in transit, and sets a very high bar because live interception is the most intrusive form of surveillance. The Stored Communications Act governs access to communications already at rest with a provider, under the lower tiered standards. Which part of ECPA applies to a typical data request? The Stored Communications Act, in nearly every case. Most requests a company receives concern data already stored: subscriber records, logs, message content at rest. Wiretap and pen/trap orders are comparatively rare and impose ongoing rather than one-time obligations. Has ECPA been updated for modern services? Only partially. The CLOUD Act amended it in 2018 to address cross-border access, and court decisions have reshaped parts of its application. The core architecture is still the 1986 design, and distinctions it draws map awkwardly onto services that did not exist when it was written. Glossary #### Related terms ##### Stored Communications Act (SCA) The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach. ##### Pen Register and Trap and Trace A pen register records outgoing addressing information and a trap and trace device records incoming addressing information, prospectively and in real time. Both capture who communicated with whom, not what was said, and both are authorised on a certification standard lower than probable cause. ##### CLOUD Act The CLOUD Act establishes that US providers must produce data they control regardless of where it is stored, and creates a framework for bilateral agreements letting qualifying foreign governments serve orders on US providers directly. It also gives providers a route to challenge orders that conflict with foreign law. See how Kodex supports compliant handling of legal process. Learn more --- ## What Is an Emergency Disclosure Request (EDR)? | Kodex Source: https://www.kodexglobal.com/glossary/emergency-disclosure-request Legal Process ### Emergency Disclosure Request (EDR) An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive. Also known as EDR, emergency data request, exigent request The emergency disclosure request exists for a real and narrow purpose: a child has been abducted, a person has posted a credible suicide note, a hostage’s location is unknown. In those cases, waiting for a warrant costs lives. The mechanism is justified. It is also the single most exploited request type in the field, for exactly the reasons that make it necessary. #### What an emergency disclosure request is An EDR is a request, not an order. In the United States, 18 U.S.C. § 2702 permits a provider to voluntarily disclose subscriber information or even content to a governmental entity if the provider, in good faith, believes an emergency involving danger of death or serious physical injury requires disclosure without delay. Three features distinguish it from every other instrument: - It is voluntary. The provider may disclose. Nothing compels it. - No judge is involved. There is no prior review and no case number to check against a court docket. - The good-faith belief is the provider’s. The legal protection attaches to the provider’s own reasonable assessment, which makes the assessment the provider’s responsibility rather than the requester’s. That third point is the one most often missed. The statute does not protect a company that disclosed because it was asked. It protects a company that formed a good-faith belief. Forming that belief requires doing something. #### Why EDRs are the primary fraud target Emergency disclosure requestSearch warrant Compulsory No, voluntary Yes Judicial review None Required before issue Typical response window Hours Days to weeks Independent artefact to verify against None Court docket, issuing judge Attacker effort required Low High An attacker forging a search warrant has to fabricate an artefact that can be checked against a court. An attacker sending an EDR has to write a convincing email. When that email is sent from a genuine but compromised police mailbox, the technical checks a company might run all pass. #### What it means for a company receiving one The instinct to move fast is right. The instinct to skip verification because you are moving fast is the failure. - Verify the requester out of band. Call the agency on a number you sourced independently, never one supplied in the request. - Scope the disclosure to the emergency. If the stated danger is to one individual, a request covering five accounts does not match its own justification. - Record the basis for the decision. The statutory protection turns on a good-faith belief, so what you knew and when you knew it is the record that matters afterwards. - Do not treat a refusal to verify as neutral. A genuine officer in a genuine emergency will accept a two-minute callback. Resistance to verification is itself a signal. #### How EDRs differ from preservation requests The two arrive under similar urgency and are frequently confused. A preservation request asks a company to freeze data so it cannot be deleted while legal process is obtained; it does not ask for the data itself and it discloses nothing. An EDR asks for disclosure now. When a request is urgent but the legal basis for disclosure is thin, preservation is very often the correct response: it protects the evidence without handing over data on an unverified claim. FAQ #### Frequently asked questions Is a company legally required to answer an emergency disclosure request? No. In the United States the statute permits voluntary disclosure in a qualifying emergency but does not compel it. The decision rests with the company, which means the company also owns the consequences of getting it wrong in either direction: disclosing to a fraudster, or refusing a genuine request during an actual emergency. Why are EDRs abused more than other request types? They combine the three things an attacker wants. There is no court involvement, so nothing independent checks the claim. There is severe time pressure, so review is compressed. And refusing carries an implied moral cost, since the request asserts a life is at risk. That pressure is applied deliberately. What is a reasonable verification step under genuine time pressure? A callback to the agency on an independently sourced number is usually achievable within minutes and defeats most fraudulent requests, including those sent from compromised accounts. Verification and speed are not actually in tension; the tension is between speed and unverified trust. Glossary #### Related terms ##### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. ##### Preservation Request A preservation request asks a company to retain specified records so they are not deleted while law enforcement obtains legal process. It compels retention, not disclosure: no data is handed over. In the United States it is grounded in 18 U.S.C. § 2703(f) and generally runs for 90 days, renewable once. ##### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. ##### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. EDRs are the most abused request type there is. See how Kodex verifies them before data moves. Learn more --- ## What Is a European Production Order? e-Evidence | Kodex Source: https://www.kodexglobal.com/glossary/european-production-order Compliance & Regulation ### European Production Order (EU e-Evidence) A European Production Order lets a judicial authority in one EU member state require a service provider in another to hand over electronic evidence directly, without routing through the second state’s government. Introduced by the EU e-Evidence Regulation, it carries short deadlines: generally ten days, or eight hours in an emergency. Also known as EPOC, e-Evidence Regulation, European Preservation Order The e-Evidence Regulation is the EU’s answer to the same problem the CLOUD Act addressed: criminal evidence sits with providers in another jurisdiction, and the government-to-government route is too slow to be useful. #### What the Regulation created Two instruments: - European Production Order (EPOC): compels a provider to hand over specified electronic evidence. - European Preservation Order (EPOC-PR): compels a provider to preserve data pending a subsequent production order. Both are issued by a judicial authority in one member state and served directly on a provider’s designated establishment or legal representative in another. The receiving state’s government is not an intermediary in the way it is under an MLAT. #### The deadlines are the story European Production OrderMLAT request Served on the provider by The issuing authority directly Domestic authority after review Standard deadline 10 days No fixed deadline in practice Emergency deadline 8 hours Not applicable Typical real-world elapsed time Days Many months An eight-hour emergency window is the operational headline. It is shorter than many providers’ escalation paths, and it does not pause for weekends. Meeting it is a staffing and tooling question before it is a legal one. #### Categories of data and thresholds The Regulation distinguishes between categories, with subscriber data and data requested solely to identify a user available on a broader basis, and traffic and content data subject to tighter conditions, generally limited to more serious offences. As with the Stored Communications Act’s tiers, matching the request to the category is the substantive review step. #### What it means for a company - Designate an establishment or legal representative. Without one there is no valid service address, and this is a precondition rather than a formality. - Build for eight hours, not ten days. The emergency path needs a named owner, out-of-hours coverage, and a decision route that does not depend on one person being reachable. - Verify the issuing authority. A short deadline is exactly the pressure a fraudulent request exploits, and the same verification logic that applies to emergency disclosure requests applies here. - Know the refusal grounds and the procedure for raising them. They exist, but they must be invoked properly and within the timeline. FAQ #### Frequently asked questions What are the response deadlines? The standard deadline is ten days from receipt. In cases of emergency, involving imminent threat to life, physical integrity, or critical infrastructure, the deadline drops to eight hours. Those windows are far shorter than most providers’ existing legal process workflows were built for. Does a provider need an establishment in the EU? Providers offering services in the EU are required to designate an establishment or a legal representative in a member state to receive and respond to orders. That designated point is where orders are served, which makes designating one a prerequisite rather than an optional step. Can a provider refuse a European Production Order? There are defined grounds for refusal, including where the order is manifestly abusive, where compliance would conflict with fundamental rights under the EU Charter, or where it conflicts with the law of a third country. Grounds must be raised through the Regulation’s procedure rather than by simply not responding. Glossary #### Related terms ##### MLAT Request An MLAT request is a formal request for evidence made by one country to another under a mutual legal assistance treaty. Rather than a foreign agency contacting a company directly, the request travels government to government and is executed using the receiving country’s own legal process. ##### CLOUD Act The CLOUD Act establishes that US providers must produce data they control regardless of where it is stored, and creates a framework for bilateral agreements letting qualifying foreign governments serve orders on US providers directly. It also gives providers a route to challenge orders that conflict with foreign law. ##### Emergency Disclosure Request (EDR) An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive. Kodex has a dedicated guide to preparing for EU e-Evidence. Learn more --- ## What Is a Fraudulent Emergency Data Request? | Kodex Source: https://www.kodexglobal.com/glossary/fraudulent-emergency-data-request Verification & Fraud ### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. Also known as fake EDR, fraudulent EDR, forged emergency request The fraudulent emergency data request works because it attacks a process designed to be fast rather than a system designed to be secure. There is nothing technically sophisticated about most of them. #### How they are constructed Three approaches, in ascending order of effectiveness: - Fabricated agency, fabricated sender. A made-up department and a free email account. Caught easily by domain checks. - Spoofed domain. An imitation of a real agency’s domain. Usually caught by SPF, DKIM, and DMARC. - Compromised genuine account. Sent from a real police mailbox the attacker controls. Passes every technical check, because everything technical about it is authentic. This is law enforcement email compromise, and it is why domain-based defences are not sufficient. The third category is the one that matters. Defences built to catch the first two provide little protection against it. #### Why the emergency framing is the attack Fraudulent EDRForged warrant Verifiable against an external record No; no court is involved Yes; court docket and judge Expected response time Hours Days Independent review before disclosure None A judge, before issue Effort to produce convincingly Low High Observed frequency High Low An emergency request is uniquely attractive because there is nothing external to check it against. A warrant names a court and a case number that can be confirmed. An emergency request names an officer and a crisis, and both exist only in the email. #### Detection signals None of these are conclusive alone; together they justify slowing down. - The urgency asserted does not match the scope requested: a threat to one person, a request covering many accounts. - No prior contact history with the officer or the agency. - Resistance to a callback, or a callback number supplied inside the request itself. - The agency has no plausible jurisdictional connection to the account. - Formatting inconsistencies against genuine requests from the same agency. - Requests arriving outside business hours, when review is thinnest. #### What actually works Verify the person, not the paperwork. Since the document may be genuine and the account may be genuine, the only reliable check is establishing that the specific human sending it is a serving officer with authority to make the request, through a channel the attacker does not control. Default to preservation when verification is pending. Preserving data protects the evidence, costs a genuine investigation nothing, and discloses nothing to an unverified requester. It converts a high-stakes binary decision into a low-stakes one. Treat verification as compatible with speed. A callback takes minutes. The framing that verification and urgency are in conflict is the attacker’s framing, and accepting it is how disclosure happens. FAQ #### Frequently asked questions Who sends fraudulent emergency data requests? The population is broader than organised crime. Reporting has documented harassment and doxxing communities, individuals stalking specific people, and financially motivated actors seeking data to enable account takeover or extortion. The barrier to entry is low, which is a large part of the problem. What data do fraudulent requests typically target? Identifying information most often: names, addresses, phone numbers, email addresses, and IP addresses associated with an account. That is enough to locate a person, take over their accounts elsewhere, or escalate a harassment campaign, and it is the tier most readily disclosed under emergency provisions. Is a callback enough to stop them? A callback to an independently sourced agency number defeats the large majority, including requests sent from compromised accounts, because the attacker cannot intercept a call to a number they do not control. It fails only against an attacker who has also compromised the agency’s phone system, which is rare. Glossary #### Related terms ##### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. ##### Emergency Disclosure Request (EDR) An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive. ##### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. ##### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. See Kodex’s research on fraudulent emergency requests and how to stop them. Learn more --- ## What Is a Grand Jury Subpoena? | Kodex Source: https://www.kodexglobal.com/glossary/grand-jury-subpoena Legal Process ### Grand Jury Subpoena A grand jury subpoena is issued in the name of a grand jury investigating potential criminal conduct, and compels the production of documents or testimony. It is issued by prosecutors without prior judicial review, and grand jury secrecy rules restrict what the prosecution may disclose about the proceeding. Also known as federal grand jury subpoena A grand jury subpoena carries a courtroom’s name on it, which gives it more apparent weight than it has in the Stored Communications Act hierarchy. It is still a subpoena. #### What a grand jury subpoena is A grand jury is a body convened to determine whether there is sufficient evidence to bring criminal charges. To gather evidence it can compel testimony and documents, and prosecutors issue subpoenas on its behalf. No judge reviews the subpoena before it goes out. For a company receiving one, three features matter: - It is compulsory. Non-compliance risks contempt. - It reaches what a subpoena reaches. Basic subscriber information and non-content records, not content. - Secrecy rules bind the government, not you. This is the point most often got wrong. #### The notification misunderstanding Prosecutors sometimes assert, and recipients often assume, that grand jury secrecy forbids telling the user. Rule 6(e) imposes obligations on those conducting the proceeding. A witness or document custodian is not on that list. Grand jury subpoena aloneWith a 2705(b) order Compels production Yes Yes Restricts notifying the user No Yes Basis for the restriction None Court order on statutory findings Duration of restriction N/A Set by the order, and renewable Providers that have policies of notifying users absent a legal bar should apply that policy here, and should ask for a non-disclosure order if the government wants notice withheld. Treating an assertion of secrecy as though it were an order gives up something on the user’s behalf that the law did not require. #### What it means for a company receiving one - Confirm validity and service. Check the issuing district, the case reference, and that service was proper. - Read the scope against the instrument. A grand jury subpoena requesting content is asking for something a subpoena cannot compel. - Diarise the return date. These carry compliance deadlines and escalate when missed. - Decide the notification question deliberately, on the basis of whether a legal restriction actually exists. FAQ #### Frequently asked questions Does grand jury secrecy prevent a company from notifying its user? Not automatically, and this is widely misunderstood. Federal Rule of Criminal Procedure 6(e) imposes secrecy obligations on prosecutors, jurors, and court personnel, not on a witness or a subpoena recipient. To restrict a company’s ability to notify a user, the government generally needs a separate non-disclosure order. How is it different from an administrative subpoena? A grand jury subpoena is issued in connection with a criminal investigation conducted through a grand jury and carries the court’s authority. An administrative subpoena is issued by a regulatory or executive agency under a specific statute, typically for civil or regulatory enforcement, and its reach is bounded by that statute. Can a grand jury subpoena compel message content? No. It remains a subpoena for Stored Communications Act purposes, so it does not overcome the content protection. Content generally requires a search warrant regardless of how the subpoena was issued. Glossary #### Related terms ##### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. ##### Administrative Subpoena An administrative subpoena is issued by a government agency under a specific statutory grant of authority, rather than by a court or grand jury. Its reach is bounded by the statute that created it, which means the first question on receiving one is whether that agency has authority over your company at all. ##### Non-Disclosure Order A non-disclosure order directs a company not to tell a user that their data was requested. It is a separate instrument from the process compelling production, is issued for a defined period, and requires the government to show that notice would cause a specific harm such as flight, evidence destruction, or danger to an individual. See how Kodex handles subpoena intake, review, and production at volume. Learn more --- ## What Is Law Enforcement Email Compromise? | Kodex Source: https://www.kodexglobal.com/glossary/law-enforcement-email-compromise Verification & Fraud ### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. Also known as LEEC, police email compromise, law enforcement account takeover Law enforcement email compromise sits in an awkward gap. It is not quite phishing, because the attacker is not imitating anyone. It is not quite insider abuse, because the account holder is a victim. It is the use of a legitimate credential to make an illegitimate demand, and it breaks the assumption that most data request programmes are built on: that an email from a police domain came from the police. #### How law enforcement email compromise works The attack has three stages, and only the last one touches the target company. - Acquire the account. The attacker obtains credentials for a genuine law enforcement or government mailbox, typically through credential stuffing against reused passwords, a phishing campaign aimed at the agency, or credentials bought from an initial access broker. Small agencies are disproportionately targeted because they are less likely to enforce multi-factor authentication. - Study the format. Real legal process has a house style. Attackers read genuine requests already in the mailbox and copy the letterhead, case number format, statutory citations, and signature blocks. - Send the request. The fraudulent request goes out from the real account, usually framed as an emergency so that it is triaged quickly and reviewed lightly. Because stage three uses authentic infrastructure, the request passes every technical control that inspects the sender rather than the person. #### Why standard verification fails Most intake processes verify the channel, not the human. They check that the sending domain belongs to a real agency, that SPF and DMARC pass, and sometimes that the domain appears on an allowlist. Every one of those checks confirms something that is genuinely true during a LEEC attack. Spoofed requestLEEC request Sending domain Imitated or lookalike Genuine agency domain SPF / DKIM / DMARC Typically fails Passes Domain allowlist check Fails Passes Reply-to inspection Often mismatched Matches the real mailbox What actually catches it Email authentication Out-of-band identity verification The practical consequence is that a company can do everything its runbook asks and still disclose subscriber data to a criminal. #### What it means for a company receiving requests Treat the mailbox as untrusted infrastructure. If your process can be satisfied by anyone holding the password to a police inbox, then the security of your users’ data is only as strong as the password policy of the smallest agency that has ever contacted you, and you have no visibility into that. Three things move the needle: - Verify the individual, not the domain. Confirm the named officer is serving, is attached to the agency named, and is authorised to make the request. - Use an independently sourced callback number. Never a number supplied in the request itself, which the attacker controls. - Keep emergency requests inside the process, not around it. Urgency is the pressure an attacker applies deliberately. A fast path is reasonable; an unverified path is not. #### How to tell a real emergency request from a fraudulent one There is no single tell, which is the point. Useful signals are behavioural rather than technical: a request for an account with no plausible connection to the agency’s jurisdiction, an officer who has never contacted you before combined with unusual urgency, resistance to a callback, or a scope that is broader than the stated emergency would justify. None of these are proof on their own. All of them are reasons to verify before disclosing. FAQ #### Frequently asked questions How is LEEC different from a spoofed email? A spoofed email only imitates a government domain, so authentication checks like SPF, DKIM, and DMARC will usually fail and expose it. In law enforcement email compromise the attacker is sending from the genuine mailbox, so every one of those checks passes. Spoofing is a forgery problem; LEEC is an authentication problem, and it defeats domain-based defences entirely. Why do attackers target emergency requests specifically? Emergency disclosure requests are designed to bypass the normal legal process because a delay could cost a life, so they carry no court oversight and are expected to be answered in hours. That combination of urgency and missing judicial review is exactly what an attacker wants, because it removes both the time and the independent check that would otherwise catch a fraudulent request. What actually stops LEEC? Verifying the requester rather than the request. Because the email account is genuine, the only reliable defence is confirming that the specific individual sending it is a serving officer with authority to make the request, through an out-of-band identity check that does not depend on the compromised mailbox. Callback verification to an independently sourced agency number is the minimum bar. Glossary #### Related terms ##### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. ##### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. ##### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. ##### Emergency Disclosure Request (EDR) An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive. Domain checks cannot catch a compromised account. See how Kodex verifies the person behind the request. Learn more --- ## What Is Law Enforcement Impersonation? | Kodex Source: https://www.kodexglobal.com/glossary/law-enforcement-impersonation Verification & Fraud ### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. Also known as police impersonation, agency impersonation Law enforcement impersonation is older than the internet and works for the same reason it always has: most people do not challenge apparent authority, and the cost of appearing obstructive to a real officer feels higher than the cost of complying with a fake one. #### Common techniques - Fabricated identity. An invented officer at a real or invented agency, supported by a forged badge image or letterhead. - Real officer, wrong person. Using the name and credentials of an actual serving officer, found in public records or news coverage. Anyone who verifies only that the officer exists will be satisfied. - Spoofed communication channels. A lookalike domain, or caller ID spoofing so an incoming call displays an agency’s real number. - Pressure and urgency. Asserting that delay endangers someone, threatening obstruction charges, or demanding to escalate to a supervisor. - Partial truth. Referencing a real case number or a real ongoing investigation found in public reporting. #### What separates it from account compromise ImpersonationLaw enforcement email compromise The claimed officer May be invented or misappropriated Real The sending account Attacker-controlled, external Genuine agency mailbox Caught by verifying the officer exists Often No Caught by domain authentication Often No Caught by out-of-band callback Yes Yes The final row is the useful one. Both attacks fail against a callback to an independently sourced number, and neither reliably fails against anything else. #### Why caller ID cannot be trusted Caller ID spoofing is trivial and widely available. An inbound call displaying a police department’s real switchboard number establishes nothing. This inverts the intuitive control: the safe action is not answering a call from a trusted number, it is ending the call and dialling back on a number you looked up yourself. An impersonator controls what they can send you, never what happens when you initiate contact. #### What it means for a company - Never verify using contact details supplied by the requester. - Verify the individual holds authority, not merely that a person by that name exists. - Give staff explicit permission to pause. Impersonation exploits the fear of obstructing a real investigation. Making “I will call you back on your agency’s published number” the standard, expected response removes the social cost of using it. - Treat pressure as a signal. Genuine officers deal with verification routinely. Escalating hostility at a two-minute callback is information. FAQ #### Frequently asked questions How is impersonation different from law enforcement email compromise? Impersonation means pretending to be an officer from outside: a fabricated identity, a spoofed domain, a fake badge. Law enforcement email compromise means operating from inside a genuine officer’s real account. Impersonation can be caught by verifying the claimed identity is real; LEEC cannot, because the identity is real and only the authority is fake. Does impersonation only happen over email? No. Phone calls are common, and they add pressure that email does not. A caller can push back in real time against someone hesitating. Some attacks combine channels, sending a written request and following up with a call to add credibility and urgency. What is the single most effective control? An out-of-band callback to a number the company sourced itself. It breaks every impersonation technique that relies on controlling the communication channel, and it is cheap enough to apply to every request rather than only the suspicious ones. Glossary #### Related terms ##### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. ##### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. ##### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. See Kodex’s guidance on verifying law enforcement requests. Learn more --- ## What Is a Legal Hold? Definition and Triggers | Kodex Source: https://www.kodexglobal.com/glossary/legal-hold Compliance & Regulation ### Legal Hold A legal hold is an internal instruction suspending the routine deletion of records that may be relevant to anticipated or pending litigation or investigation. Unlike a preservation request, it is imposed by an organisation on itself, and the duty to issue one arises as soon as litigation is reasonably foreseeable. Also known as litigation hold, preservation hold The legal hold is the one obligation in this glossary that a company imposes on itself, which is precisely why it gets missed. Nothing arrives in the inbox to trigger it. #### When the duty attaches The duty to preserve begins when litigation is reasonably anticipated, not when it is filed. Events that can trigger it include: - Receiving a demand letter or a credible threat of suit - An internal investigation into conduct likely to lead to claims - Regulatory contact suggesting enforcement is contemplated - Awareness of an incident whose facts make litigation foreseeable Because the trigger is a judgement rather than a document, the practical risk is a gap between when the duty attached and when someone acted on it. Deletion continuing during that gap is where spoliation exposure accumulates. #### What a hold requires in practice - Identify custodians and systems likely to hold relevant material. - Suspend automated deletion for the material in scope. Retention policies that run automatically will otherwise destroy data on schedule. - Notify custodians clearly, and confirm they understood. - Monitor and reissue. Holds decay. New custodians join, systems change, and people forget. - Release deliberately when the matter concludes, with a documented decision. Legal holdPreservation request Who imposes it The organisation itself A government agency Trigger Litigation reasonably anticipated Receipt of a 2703(f) request Scope defined by The organisation’s own assessment The requesting agency Duration Until the matter concludes 90 days, renewable once Consequence of failure Spoliation sanctions Loss of evidence, non-compliance #### What it means for a data request programme Legal holds and government preservation requests overlap constantly, and treating them as one process causes problems in both directions. A preservation request has a fixed expiry, and continuing to retain data after it lapses conflicts with data minimisation obligations. A legal hold has no fixed expiry and must persist until the matter resolves. A single “do not delete” flag with no provenance and no end date satisfies neither obligation properly. The workable pattern is to record, for each hold, what triggered it, what it covers, who imposed it, and what event releases it. FAQ #### Frequently asked questions When does the duty to preserve begin? When litigation is reasonably anticipated, which is often earlier than a complaint being filed. A credible threat of suit, a demand letter, or internal awareness of facts likely to lead to litigation can each trigger it. Waiting for formal service is a common and expensive mistake. How is a legal hold different from a preservation request? Origin and authority. A legal hold is internal, self-imposed, and driven by the organisation’s own duty to preserve. A preservation request comes from a government agency and identifies records the agency has specified. Both suspend deletion, and the same data is often covered by both at once. What happens if relevant data is deleted after the duty attaches? It can be treated as spoliation. Under US Federal Rule of Civil Procedure 37(e), a court may impose measures to cure prejudice, and where a party acted with intent to deprive another of the information, may instruct a jury to presume the lost data was unfavourable or enter default judgment. Glossary #### Related terms ##### Preservation Request A preservation request asks a company to retain specified records so they are not deleted while law enforcement obtains legal process. It compels retention, not disclosure: no data is handed over. In the United States it is grounded in 18 U.S.C. § 2703(f) and generally runs for 90 days, renewable once. ##### Chain of Custody Chain of custody is the documented record of who handled a piece of evidence, when, and what they did with it, from collection through to presentation. An unbroken chain supports the claim that evidence is what it purports to be and has not been altered; gaps invite challenges to its admissibility. ##### Responsive Records Responsive records are the documents and data that actually fall within the scope of a specific request. Determining what is responsive is a scoping judgement, and getting it wrong in either direction means either failing to comply or disclosing more of a user’s data than the law required. See how Kodex tracks preservation and hold obligations. Learn more --- ## What Is an MLAT Request? Cross-Border Data | Kodex Source: https://www.kodexglobal.com/glossary/mlat-request Legal Process ### MLAT Request An MLAT request is a formal request for evidence made by one country to another under a mutual legal assistance treaty. Rather than a foreign agency contacting a company directly, the request travels government to government and is executed using the receiving country’s own legal process. Also known as MLAT, mutual legal assistance treaty request The MLAT is the traditional answer to a hard problem: evidence sits in one country, the investigation is in another, and neither country’s courts have straightforward authority over the other’s territory. #### How the mechanism works A mutual legal assistance treaty is an agreement between two states to help each other gather evidence. The path a request takes: - An investigator in the requesting country prepares a request. - It goes to that country’s central authority, which reviews it for treaty compliance. - It is transmitted to the receiving country’s central authority, which in the United States is the Department of Justice Office of International Affairs. - That authority reviews it and refers it to a domestic prosecutor. - The prosecutor obtains domestic legal process (a subpoena, order, or warrant) and serves it on the company. The company is served under its own country’s law, by its own country’s authorities. The foreign origin is largely invisible at the point of service. #### Why the speed problem matters MLAT requestDirect legal process Who serves the company Domestic authority Domestic authority Typical elapsed time Many months Days to weeks Foreign authority contacts company directly No N/A Legal standard applied Receiving country’s Receiving country’s The delay is not merely inconvenient. It is the structural pressure behind everything that has been built to route around MLATs, and it is also why fraudulent requests that promise to bypass process find willing audiences. An investigator who has been told an MLAT will take ten months is highly motivated to find another way. #### What it means for a company receiving one The most valuable thing to know is the negative case. A properly executed MLAT does not arrive as a letter from a foreign police force. It arrives as domestic legal process. A document that presents itself as an MLAT request while coming directly from a foreign agency is either a misunderstanding of the mechanism or a fraudulent request, and either way it should not be actioned as compulsory process. Where a genuine MLAT-derived instrument arrives, it is handled like any other domestic process of that type: validate it, scope it, and produce to the scope. #### What is changing The CLOUD Act enabled bilateral executive agreements that let qualifying foreign governments serve orders on US providers directly, subject to human rights and oversight conditions. The EU’s e-Evidence Regulation creates a comparable intra-EU mechanism with defined response deadlines. Both are attempts to keep lawful access workable at internet speed without abandoning the safeguards that made MLATs slow in the first place. FAQ #### Frequently asked questions Why are MLAT requests so slow? Because they pass through at least four hands: the foreign investigator, that country’s central authority, the receiving country’s central authority, and finally a domestic prosecutor who must obtain local legal process. Each stage involves review and translation. Ten months is a commonly cited average, and complex requests take considerably longer. Does a company receive an MLAT request directly? No, and that is a useful verification signal. If an MLAT has been executed properly, what arrives at the company is ordinary domestic legal process: a subpoena, order, or warrant issued by a local court. A document arriving directly from a foreign agency claiming MLAT authority is not how the mechanism works. What is replacing MLATs? Bilateral CLOUD Act agreements and, in the European Union, the e-Evidence Regulation both create faster channels that let qualifying foreign authorities reach providers more directly, under defined safeguards. Neither eliminates MLATs, which remain the fallback where no such arrangement exists. Glossary #### Related terms ##### CLOUD Act The CLOUD Act establishes that US providers must produce data they control regardless of where it is stored, and creates a framework for bilateral agreements letting qualifying foreign governments serve orders on US providers directly. It also gives providers a route to challenge orders that conflict with foreign law. ##### European Production Order (EU e-Evidence) A European Production Order lets a judicial authority in one EU member state require a service provider in another to hand over electronic evidence directly, without routing through the second state’s government. Introduced by the EU e-Evidence Regulation, it carries short deadlines: generally ten days, or eight hours in an emergency. ##### Court Order A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires. Cross-border process is changing fast. See Kodex’s guidance on EU e-Evidence. Learn more --- ## What Is a National Security Letter (NSL)? | Kodex Source: https://www.kodexglobal.com/glossary/national-security-letter Compliance & Regulation ### National Security Letter (NSL) A national security letter is an administrative demand issued by the FBI, without prior judicial approval, for limited subscriber and transactional records in national security investigations. It can carry a non-disclosure requirement, and it cannot compel the contents of communications. Also known as NSL The national security letter is unusual in the set: compulsory, issued without a court, and historically accompanied by open-ended secrecy. Its scope has been narrowed substantially through litigation and legislation. #### What an NSL is An administrative demand issued by the FBI under several statutory authorities, certifying that the records sought are relevant to an authorised national security investigation. No judge approves it in advance. Its reach is limited by statute to categories including: - Subscriber name and address - Length of service and type of service provided - Toll billing records or electronic communication transactional records Content is outside NSL authority. Whether particular categories of modern metadata fall within “electronic communication transactional records” has been contested, and the FBI’s reading has at times been broader than providers and courts accepted. #### The secrecy problem, and how it changed For years NSLs came with indefinite non-disclosure requirements and no clear route to challenge them. That drew sustained First Amendment litigation, and the USA FREEDOM Act introduced a reciprocal notice procedure requiring periodic review of whether secrecy remains necessary, plus judicial review on request. NSL2703(d) order Prior judicial approval None Required Issued by The FBI A court Reaches content No No Built-in secrecy Yes, subject to review No, requires a separate order Transparency reporting Banded ranges only Precise counts #### What it means for a company receiving one - Check the demand against the statutory categories. An NSL asking for content or for records outside its authority should be narrowed, and providers have successfully pushed back on overbroad readings. - Use the review procedures. Secrecy is reviewable, and recipients can trigger that review rather than treating the restriction as permanent. - Report within the permitted bands. Precise counts are not permitted, and the banding rules are specific. - Route these separately from criminal process. The authorities, the constraints, and the reporting rules all differ, and handling them in the same queue as ordinary subpoenas invites mistakes in both directions. FAQ #### Frequently asked questions Can a national security letter compel message content? No. NSL authority is limited to specified categories of subscriber and transactional records: name, address, length of service, and toll billing or electronic communication transactional records. Content requires other process, and NSLs have at times been read more broadly than the statute supports. Is the non-disclosure requirement permanent? Not automatically. The USA FREEDOM Act of 2015 introduced procedures requiring the FBI to review whether continued secrecy is justified and allowing recipients to seek judicial review. Recipients can trigger review, and NSLs have been unsealed as a result. How are NSLs counted in transparency reports? Under restricted rules. Providers may report NSLs only in wide numerical bands rather than exact counts, and with a delay. This is why transparency reports show national security process in ranges while ordinary criminal process is reported precisely. Glossary #### Related terms ##### Non-Disclosure Order A non-disclosure order directs a company not to tell a user that their data was requested. It is a separate instrument from the process compelling production, is issued for a defined period, and requires the government to show that notice would cause a specific harm such as flight, evidence destruction, or danger to an individual. ##### 2703(d) Order A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause. NSL reporting follows special rules. See how Kodex supports transparency reporting. Learn more --- ## What Is a Non-Disclosure Order (Gag Order)? | Kodex Source: https://www.kodexglobal.com/glossary/non-disclosure-order Compliance & Regulation ### Non-Disclosure Order A non-disclosure order directs a company not to tell a user that their data was requested. It is a separate instrument from the process compelling production, is issued for a defined period, and requires the government to show that notice would cause a specific harm such as flight, evidence destruction, or danger to an individual. Also known as gag order, NDO, 2705(b) order The non-disclosure order is where transparency policy meets legal obligation, and it is the instrument most often invoked informally when it has not actually been obtained. #### What a non-disclosure order does Under 18 U.S.C. § 2705(b), a court may order a provider not to notify anyone about the existence of a warrant, subpoena, or court order, where notification would result in one of the enumerated harms: - Endangering the life or physical safety of an individual - Flight from prosecution - Destruction of or tampering with evidence - Intimidation of potential witnesses - Otherwise seriously jeopardising an investigation or unduly delaying a trial The order compels silence. It compels nothing else, and it says nothing about what must be produced. #### Why the separation matters Production instrumentNon-disclosure order What it compels Handing over records Not telling the user Statutory basis 2703(a)-(d), Rule 41 18 U.S.C. § 2705(b) Required showing Varies by tier One of five enumerated harms Has an expiry Compliance date Defined period Arrives automatically with the other No No Many providers have a policy of notifying users about requests for their data unless legally barred. That policy only means something if the company distinguishes between an actual legal bar and an assertion of one. Prosecutors sometimes state that a matter is confidential, or cite grand jury secrecy, in circumstances where no order restricting the provider exists. Grand jury secrecy rules bind the government, not the witness. #### What it means for a company receiving one - Confirm an order actually exists. If notice is meant to be restricted, ask for the order. - Record the expiry date and act on it. When an order lapses, the restriction lapses. A provider that never revisits expired orders is withholding notice it is no longer required to withhold. - Notify when the bar lifts, if your policy is to notify. Delayed notice is still notice, and it is the only remedy the user gets. - Count them for transparency reporting. Aggregate numbers of requests received under non-disclosure orders are ordinarily reportable even when individual matters are not. #### The direction of travel Indefinite gag orders were routine for years, and they were narrowed by litigation rather than legislation. Microsoft’s 2016 suit challenging indefinite secrecy orders led to a Department of Justice policy change limiting their duration and requiring specific justification. The practical lesson for providers is that the scope of these orders has historically been set by whoever was willing to contest it. FAQ #### Frequently asked questions Does compulsory process automatically prevent notifying the user? No, and assuming otherwise quietly costs users their notice rights. A subpoena, order, or warrant compels production. Restricting notice requires a separate order. Where the government wants silence, it should be asked to obtain one rather than simply asserting that secrecy applies. How long does a non-disclosure order last? For the period the order specifies. Indefinite orders were common until they were challenged as prior restraints on speech; US Department of Justice policy now generally limits them to a defined term, typically a year, with extensions requiring fresh justification. When an order expires, the restriction lifts. Can a non-disclosure order be challenged? Yes. Providers have successfully challenged both indefinite orders and orders issued without adequate factual justification, on First Amendment grounds. Whether to challenge is a policy decision, but the option exists and litigation has meaningfully narrowed the practice. Glossary #### Related terms ##### Grand Jury Subpoena A grand jury subpoena is issued in the name of a grand jury investigating potential criminal conduct, and compels the production of documents or testimony. It is issued by prosecutors without prior judicial review, and grand jury secrecy rules restrict what the prosecution may disclose about the proceeding. ##### Court Order A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires. ##### National Security Letter (NSL) A national security letter is an administrative demand issued by the FBI, without prior judicial approval, for limited subscriber and transactional records in national security investigations. It can carry a non-disclosure requirement, and it cannot compel the contents of communications. Tracking gag order expiries is an operational obligation. See how Kodex manages it. Learn more --- ## What Is an ORI Number? Agency Identifiers | Kodex Source: https://www.kodexglobal.com/glossary/ori-number Verification & Fraud ### ORI Number An ORI number is a nine-character Originating Agency Identifier assigned by the FBI to US criminal justice agencies authorised to access national systems. It identifies which agency an action came from, and it is a useful corroborating signal in verification, though it is not a credential. Also known as Originating Agency Identifier, ORI The ORI number is frequently over-trusted in verification workflows. It is genuinely useful and it is not a password, and the gap between those two things is where mistakes happen. #### What an ORI is The FBI’s Criminal Justice Information Services division assigns each authorised agency a nine-character Originating Agency Identifier. It exists so that actions in national systems (record queries, submissions, transactions) can be attributed to a specific agency. The structure carries meaning. The leading characters identify the state, the middle portion the county or jurisdiction, and the final character conventionally denotes the agency type. That internal structure is what makes ORIs partially self-checking: an identifier whose state code contradicts the agency’s claimed location is inconsistent on its face. #### What it proves, and what it does not What an ORI establishesWhat it does not establish The critical limitation: ORIs are not confidential. They appear in court filings, public records, and agency documentation. An attacker researching a target agency can find its ORI without difficulty and cite it accurately. #### How to use it properly An ORI is a consistency check, not an authentication factor. Useful applications: - Confirm the ORI’s encoded state matches the agency’s claimed location. - Confirm the agency type suffix matches the kind of agency the request purports to come from. - Compare against prior legitimate requests from the same agency. - Treat a malformed, inconsistent, or unassigned ORI as a strong negative signal. What it cannot do is stand in for verifying the individual. A request citing a correct ORI from a compromised agency mailbox is entirely consistent. Every element checks out, because every element is real except the person’s authority to send it. FAQ #### Frequently asked questions Does a valid ORI number prove a request is legitimate? No. An ORI identifies an agency, not a person, and ORIs are not secret. They appear in public documents and directories. A fraudulent request can cite a real agency’s real ORI. It is corroborating context, useful alongside verification of the individual, and not a substitute for it. What does an ORI number actually encode? The format encodes the state, county or jurisdiction, and agency type. The first two characters are the state code, and the trailing character conventionally indicates the type of agency. That structure makes an internally inconsistent ORI a detectable red flag. Do all agencies contacting a company have an ORI? No. ORIs are assigned to US criminal justice agencies with access to national systems. Foreign agencies, many regulatory bodies, and civil litigants have none, so the absence of an ORI is not itself suspicious. It depends entirely on who is supposed to be contacting you. Glossary #### Related terms ##### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. ##### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. See how Kodex corroborates agency identity as part of requester verification. Learn more --- ## What Is a Pen Register and Trap and Trace Order? | Kodex Source: https://www.kodexglobal.com/glossary/pen-register-trap-and-trace Legal Process ### Pen Register and Trap and Trace A pen register records outgoing addressing information and a trap and trace device records incoming addressing information, prospectively and in real time. Both capture who communicated with whom, not what was said, and both are authorised on a certification standard lower than probable cause. Also known as pen/trap, pen register order Pen register and trap and trace orders are the surveillance instruments most often misunderstood by recipients, because they impose an ongoing obligation rather than a one-time production. Answering one is not a task you close; it is a capability you have to operate. #### What they capture The terms are historical, from telephone-era devices. In modern practice both refer to real-time collection of non-content addressing data: - Pen register: outgoing addressing information from a target account. - Trap and trace: incoming addressing information to a target account. In both cases the statute is explicit that the information captured must not include the contents of any communication. The line between addressing data and content is not always crisp in modern protocols, and that ambiguity is where most of the legal argument lives. #### The standard, and why it is low Pen/trap orderWiretap order What it captures Addressing information Communication content Standard Certification of relevance Probable cause, plus necessity Judicial weighing of facts Minimal Substantial Typical duration 60 days 30 days, renewable Notice to the target Generally delayed or none Required after the fact The certification standard means the judge’s role is closer to confirming the application was properly made than to independently assessing whether the intrusion is justified. That design reflects a judgement, made decades ago, that addressing data is meaningfully less sensitive than content, a judgement considerably more contested now than when it was made, given how much can be inferred from communication patterns alone. #### What it means for a company receiving one - Understand it is ongoing. The obligation runs for the order’s duration and needs an owner, a mechanism, and an end date. - Scope the capture to addressing data. Where a protocol blurs the line, err toward the narrower reading and raise the ambiguity rather than over-collecting. - Diarise the expiry. Collection must stop when the order lapses. Continuing past expiry is unauthorised interception. - Check for an accompanying non-disclosure order. These are typically paired. FAQ #### Frequently asked questions How is a pen/trap order different from a wiretap? A pen/trap captures addressing information: who contacted whom, and when. A wiretap captures the content of the communication itself. Because content is far more intrusive, wiretap orders require a much higher showing, including probable cause and a demonstration that other investigative methods have failed. What standard does a pen/trap order require? It is a certification standard rather than a factual showing. The applicant certifies that the information likely to be obtained is relevant to an ongoing criminal investigation, and the court issues the order on that certification. The judge does not independently weigh the evidence the way probable cause requires. Is a pen/trap order prospective or retrospective? Prospective. It authorises capturing addressing information going forward, generally for up to 60 days with extensions available. Historical records of past communications are obtained through a subpoena, a 2703(d) order, or a warrant instead. Glossary #### Related terms ##### Electronic Communications Privacy Act (ECPA) ECPA is the 1986 US statute governing government access to electronic communications. It has three parts: the Wiretap Act covering interception in transit, the Stored Communications Act covering data at rest, and the Pen Register Act covering real-time addressing data. ##### Court Order A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires. ##### 2703(d) Order A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause. See how Kodex manages ongoing collection obligations alongside one-off requests. Learn more --- ## What Is a Preservation Request? 2703(f) Explained | Kodex Source: https://www.kodexglobal.com/glossary/preservation-request Legal Process ### Preservation Request A preservation request asks a company to retain specified records so they are not deleted while law enforcement obtains legal process. It compels retention, not disclosure: no data is handed over. In the United States it is grounded in 18 U.S.C. § 2703(f) and generally runs for 90 days, renewable once. Also known as 2703(f) request, preservation letter, data freeze request The preservation request is the quietest instrument in the set and the one most often mishandled, because it looks like a data request and is not one. #### What a preservation request does It stops the clock. Providers delete data on a schedule; investigations move slower than deletion cycles. A preservation request bridges that gap by requiring the company to set aside a copy of specified records while the requesting agency assembles the legal process needed to actually obtain them. The mechanics under § 2703(f): - The request can be made by any governmental entity, informally, without a court order. - The obligation is to retain, for 90 days, renewable once for a further 90. - Nothing is disclosed. Disclosure requires a subpoena, a court order, or a warrant, arriving separately. #### Why it matters that preservation is not disclosure Preservation requestEmergency disclosure request What it compels Retention of records Nothing; it is voluntary Is data handed over No Yes, if the company agrees Judicial review None required None Risk if wrongly honoured Low; data is only held High; data leaves the company Appropriate response to an unverified urgent request Often yes Only after verification That last row is the practically useful one. When an urgent request arrives and the requester cannot be verified quickly, preserving the data is very often the correct answer. It protects the evidence against deletion, costs the investigation nothing, and discloses nothing to someone who may not be who they claim. A company that reflexively treats preservation as the safe interim step removes most of the pressure that makes fraudulent emergency requests work. #### What it means for a company receiving one - Classify it correctly at intake. A preservation request routed as a disclosure request wastes review effort and risks over-disclosure. - Actually preserve. The obligation is real, and ordinary automated deletion will breach it unless a hold is applied. - Track the expiry. Preservation obligations lapse. Holding data indefinitely because nobody closed the ticket is its own compliance problem, particularly under data minimisation obligations. - Expect follow-on process. A preservation request usually means a subpoena, order, or warrant is being prepared. #### Preservation and legal hold The two are cousins but not the same. A legal hold is an internal obligation that arises when litigation is reasonably anticipated, and it is imposed by the company on itself. A preservation request is external, arrives from a government agency, and covers records identified by that agency. They can and often do overlap on the same data, and both suspend ordinary deletion. FAQ #### Frequently asked questions Does a preservation request mean handing over data? No, and this is the most important thing about it. A preservation request compels retention only. The company freezes a copy of the specified records so they survive normal deletion cycles, and discloses nothing until separate legal process arrives. Confusing preservation with disclosure is a common and costly intake error. How long does a preservation obligation last? Under 18 U.S.C. § 2703(f) records must be retained for 90 days, and the government may renew for one additional 90-day period. If no legal process arrives by the time the obligation expires, the data returns to the company’s ordinary retention policy. Can a company notify a user about a preservation request? Section 2703(f) does not itself prohibit notice, unlike a non-disclosure order. Whether to notify is generally a policy decision, though a preservation request is frequently a signal that compulsory process and an accompanying gag order are coming. Glossary #### Related terms ##### Legal Hold A legal hold is an internal instruction suspending the routine deletion of records that may be relevant to anticipated or pending litigation or investigation. Unlike a preservation request, it is imposed by an organisation on itself, and the duty to issue one arises as soon as litigation is reasonably foreseeable. ##### Emergency Disclosure Request (EDR) An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive. ##### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. Preservation deadlines are easy to lose track of. See how Kodex tracks request lifecycles. Learn more --- ## What Is Redaction in Data Production? | Kodex Source: https://www.kodexglobal.com/glossary/redaction Request Operations ### Redaction Redaction is the permanent removal of information from records before they are produced, typically to withhold data about third parties or material outside a request’s scope. Effective redaction removes the underlying data rather than obscuring it visually, and failures here are usually technical rather than editorial. Redaction is where careful scoping gets implemented, and where it most often fails for reasons that have nothing to do with judgement. #### What gets redacted - Third-party data. Records about the named account frequently contain information about other people: the other side of a conversation, other names on a shared payment method, other users in a group. Those people are not the subject of the request. - Out-of-scope material. Records outside the date range or data type specified. - Material beyond the instrument’s authority. Content appearing in records responsive to a subpoena, for example. - Privileged material, where applicable. #### The technical failure mode The recurring problem is that redaction is treated as a visual operation. Covering text with a black rectangle in a PDF, changing the font colour to match the background, or cropping a screenshot in a viewer all leave the original data present in the file. Visual maskingTrue redaction Data present in the delivered file Yes No Recoverable by copy and paste Often No Recoverable by text extraction Yes No Survives format conversion No; often exposed Yes Suitable for production No Yes The correct approach is to remove the data and then generate the output file from the redacted source, or use tooling that genuinely deletes content rather than layering over it. Verifying by extracting text from the finished file (not by looking at it) is the check that catches the failure. #### Documenting redactions A production that silently omits material is difficult to distinguish from an incomplete one. Marking that a redaction was applied, and the basis for it, serves the recipient and the producer both: the agency can challenge a redaction it disputes, and the company has a record of a decision it may need to explain much later. #### Why this is a user protection Third-party redaction is the clearest case. A request concerns one account, but the data held about that account inevitably describes other people who are not suspects, are not named, and have no notice and no opportunity to object. Nobody is advocating for them in the process. Redaction is the mechanism by which their data stays out of an investigation that was never about them, and it only happens if the producing company does it deliberately. FAQ #### Frequently asked questions Why is drawing a black box over text not redaction? Because in most document formats the text remains in the file underneath the graphic. It can be recovered by copying the text, extracting the document’s contents programmatically, or simply moving the overlay. Genuine redaction deletes the underlying data and produces a file that never contained it. What typically needs redacting from a production? Information about third parties who are not the subject of the request, records outside the specified date range or data type, material protected by privilege, and content the instrument does not have authority to compel. The common thread is that it was never within scope. Does redaction risk non-compliance? Redacting non-responsive material is not withholding responsive material. Where the basis for a redaction might be contested, note that a redaction was applied and the reason, so the agency can raise it rather than discovering a gap later. Glossary #### Related terms ##### Responsive Records Responsive records are the documents and data that actually fall within the scope of a specific request. Determining what is responsive is a scoping judgement, and getting it wrong in either direction means either failing to comply or disclosing more of a user’s data than the law required. ##### Chain of Custody Chain of custody is the documented record of who handled a piece of evidence, when, and what they did with it, from collection through to presentation. An unbroken chain supports the claim that evidence is what it purports to be and has not been altered; gaps invite challenges to its admissibility. See how Kodex structures review and production. Learn more --- ## What Is Requester Verification? Definition | Kodex Source: https://www.kodexglobal.com/glossary/requester-verification Verification & Fraud ### Requester Verification Requester verification is the process of establishing that the person behind a data request is genuinely who they claim to be and holds authority to make it. It differs from validating the document, because a genuine-looking request sent from a real but compromised account will pass document checks. Also known as agent verification, law enforcement verification Verification is the point at which a data request programme either has a security model or does not. Everything else (intake, triage, scoping, production) assumes the requester is legitimate. Verification is the step that tests the assumption. #### Verifying the document versus verifying the person These are different activities and are routinely conflated. Document validation asks whether the request is well-formed: is it the right instrument for the data sought, is it signed, does it cite a plausible authority, is it within scope. This catches errors and unsophisticated forgeries. Requester verification asks whether the human behind it is real and authorised. This is what catches a well-crafted request from a compromised account, which document validation cannot. Document validationRequester verification What it checks The request artefact The person making it Catches fabricated agencies Yes Yes Catches spoofed domains Partly Yes Catches compromised genuine accounts No Yes Can be done from the request alone Yes No, requires an independent channel The bottom two rows are the whole argument. Any check performed entirely on material the attacker supplied can be satisfied by an attacker who controls that material. #### What verification actually involves - Independent channel. Contact the agency through a route the requester did not supply. - Identity of the individual. Confirm the named officer is serving at the agency named, not merely that the agency exists. - Authority for this request. A serving officer is not automatically authorised to make every kind of request. - Consistency with history. Prior legitimate contact from the same agency and officer is meaningful context; a first-ever contact arriving as an urgent emergency request is not. #### Why it is hard at scale A single callback is easy. Several hundred requests a month across dozens of jurisdictions, each with different agency structures, contact directories, and identity conventions, is an operations problem. Teams that verify manually tend to converge on verifying only the requests that already looked suspicious, which inverts the logic. The requests worth verifying most carefully are the ones designed to look routine. This is the structural argument for verification infrastructure rather than verification procedure: a check that only happens when someone is already worried is not a control. FAQ #### Frequently asked questions Is checking the sender’s email domain a form of verification? It verifies the channel, not the person. A domain check confirms the message came from an agency’s mail system, which is exactly what is true during a law enforcement email compromise attack. Domain checks are worth doing and are not sufficient on their own. What is the minimum viable verification step? A callback to the agency on a number sourced independently of the request, from the agency’s official website or a known directory, never from the request itself. It is fast, it requires no special tooling, and it defeats attackers who control a mailbox but not the agency’s phone system. How do you verify without slowing down genuine emergencies? By separating verification from disclosure. Preserve the data immediately, which costs a genuine investigation nothing, then verify before disclosing. A callback takes minutes, and a real officer in a real emergency will accept one. Glossary #### Related terms ##### Law Enforcement Email Compromise (LEEC) Law enforcement email compromise is an attack in which a criminal gains control of a genuine police or government email account and uses it to send fraudulent data requests. Because the request arrives from a real, verifiable government domain, ordinary domain checks pass and the data is often disclosed. ##### Fraudulent Emergency Data Request A fraudulent emergency data request is a fake request for user data that invokes an emergency to obtain disclosure without legal process. Because emergency requests carry no judicial review and demand a response in hours, they are the most exploited request type companies receive. ##### ORI Number An ORI number is a nine-character Originating Agency Identifier assigned by the FBI to US criminal justice agencies authorised to access national systems. It identifies which agency an action came from, and it is a useful corroborating signal in verification, though it is not a credential. ##### Law Enforcement Impersonation Law enforcement impersonation is a social engineering attack in which someone poses as a police officer or government official to obtain data, access, or compliance they have no authority to demand. Against companies it usually targets the data request process, where the appearance of authority substitutes for verified authority. See how Kodex verifies requesters against a network of 15,000+ agencies. Learn more --- ## What Are Responsive Records? Scoping Explained | Kodex Source: https://www.kodexglobal.com/glossary/responsive-records Request Operations ### Responsive Records Responsive records are the documents and data that actually fall within the scope of a specific request. Determining what is responsive is a scoping judgement, and getting it wrong in either direction means either failing to comply or disclosing more of a user’s data than the law required. Also known as responsive data, responsive documents Scoping is the least glamorous step in request handling and the one where most avoidable harm occurs. The legal analysis is usually settled by the time you get here. What remains is a careful reading. #### What makes a record responsive A record is responsive when it falls within the request’s defined scope, which is normally bounded on several axes at once: - Identifier: the specific account, user, device, or address named - Time: the date range specified - Data type: subscriber information, transactional records, or content - Legal ceiling: what the instrument is actually capable of compelling That last axis is the one most often forgotten. A request may ask for content while attaching a subpoena. The content is within the request’s stated scope and outside the instrument’s authority, which means it is not responsive in any sense that matters. #### The two failure modes Under-productionOver-production What happened Responsive records withheld Non-responsive records disclosed Who is harmed The investigation The user Detected when Agency follows up, or in litigation Often never Consequence Non-compliance, possible contempt Unauthorised disclosure of user data The asymmetry in the “detected when” row is why over-production persists. Nobody complains. The agency received more than it asked for and has no reason to object; the user does not know. A programme that only corrects the errors somebody notices will drift steadily toward over-disclosure. #### How to scope well - Read the instrument before the cover letter. The instrument sets the ceiling. - Write the scope down explicitly before searching: identifiers, date range, data types. - Search to that scope, rather than searching broadly and filtering afterwards. Broad retrieval followed by filtering makes over-production a slip rather than a decision. - Resolve ambiguity in writing with the agency, and keep the reply. - Record what was produced and why. A production log is the only way to answer questions about a request months later. #### Why this matters beyond compliance Every unnecessary record disclosed is a user’s data that left the company without legal compulsion. Users cannot audit this. They generally do not know a request occurred, and where a non-disclosure order applies they are not permitted to. The discipline of tight scoping is one of the few protections that operates entirely on the user’s behalf, exercised by a company they will never discuss it with. FAQ #### Frequently asked questions Who decides what is responsive? The recipient does, reading the request’s scope against what it actually holds. The requesting agency defines the scope; the company determines which of its records fall inside it. That judgement sits with the company, which is also why it carries the consequences of getting it wrong. What if a request is ambiguous about scope? Ask the issuing agency to clarify in writing, and produce against the clarified scope. Resolving ambiguity by producing generously is the wrong default. It discloses user data that was never properly compelled, and the written clarification is also the record protecting the decision. Is it acceptable to produce more than was asked for? No. Over-production discloses data the requester had no authority to obtain and that the user did not have to surrender. It is not a neutral act of helpfulness; it is an unauthorised disclosure, even though the underlying request was legitimate. Glossary #### Related terms ##### Redaction Redaction is the permanent removal of information from records before they are produced, typically to withhold data about third parties or material outside a request’s scope. Effective redaction removes the underlying data rather than obscuring it visually, and failures here are usually technical rather than editorial. ##### Chain of Custody Chain of custody is the documented record of who handled a piece of evidence, when, and what they did with it, from collection through to presentation. An unbroken chain supports the claim that evidence is what it purports to be and has not been altered; gaps invite challenges to its admissibility. ##### Court Order A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires. See how Kodex structures review and production. Learn more --- ## What Is a Search Warrant for User Data? | Kodex Source: https://www.kodexglobal.com/glossary/search-warrant Legal Process ### Search Warrant A search warrant is an order issued by a judge authorising a search or seizure, granted only on a showing of probable cause. In data request work it is the instrument required to compel the contents of communications, and it is the highest legal threshold a company is likely to encounter. Also known as warrant, Rule 41 warrant A search warrant is the instrument that carries the most legal weight and, correspondingly, the most procedural protection. When one arrives, the question is rarely whether to comply. It is whether the warrant is valid and what its scope actually covers. #### What a search warrant requires Four elements have to be present: - Probable cause, supported by a sworn affidavit. - A neutral magistrate or judge who reviews that affidavit and decides independently whether the standard is met. - Particularity: the warrant must describe specifically the place to be searched and the items to be seized. - Proper issuance and service by an authority with jurisdiction over the recipient. The neutral-judge requirement is the structural protection. Unlike a subpoena, a warrant is not something an investigator can issue for themselves. #### What data a warrant reaches Under the Stored Communications Act, a warrant is the instrument required to compel the contents of communications: message bodies, stored files, photos, drafts. Everything a subpoena or a § 2703(d) order can reach, a warrant can also reach. Search warrant2703(d) order Legal standard Probable cause Specific and articulable facts Who decides Judge or magistrate Judge or magistrate Reaches content Yes No Reaches transactional records Yes Yes Relative frequency Lower Higher #### What it means for a company receiving one Compliance is mandatory, but three review steps still matter and are frequently skipped under time pressure. - Check jurisdiction. A warrant issued by a court without authority over your company is not automatically enforceable against you. Cross-border warrants raise this squarely, and the CLOUD Act framework governs much of that terrain. - Read the scope narrowly and produce to it. Particularity is a legal requirement, and producing beyond the described scope is a disclosure your users did not have to bear. If the described scope is genuinely ambiguous, the right move is to ask the issuing agency to clarify in writing, not to guess generously. - Check for an accompanying non-disclosure order. Whether you may notify the user is a separate legal question from whether you must produce, governed by a separate instrument. #### How to validate a warrant Warrants are forged less often than emergency requests, precisely because they leave a verifiable trail, but forgeries do occur, and the trail is what catches them. A warrant names an issuing court, a judge, and a case number, all of which can be checked against the court directly. The signature and the docket are the artefacts a fraudulent request cannot easily reproduce, and confirming them with the issuing court is the definitive check. FAQ #### Frequently asked questions What is probable cause? Probable cause is a reasonable basis, supported by facts, for believing that a crime has been committed and that evidence of it will be found in the place to be searched. It is a meaningfully higher bar than the relevance standard that supports a subpoena, and a neutral judge rather than the investigator decides whether it is met. Does a warrant let law enforcement take anything they ask for? No. A warrant must particularly describe the place to be searched and the things to be seized. A warrant authorising seizure of communications over a defined period does not authorise the entire account history, and a recipient is entitled to produce only what falls inside the described scope. Can a company tell the user their data was seized under a warrant? It depends on whether a separate non-disclosure order accompanies the warrant. A warrant alone does not automatically prohibit notice, but in practice one is frequently paired with a court order under 18 U.S.C. § 2705(b) that does. Absent such an order, many providers notify as a matter of policy. Glossary #### Related terms ##### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. ##### 2703(d) Order A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause. ##### Court Order A court order is any directive issued by a judge that compels a party to act. In data request work the term usually refers to an order compelling disclosure of records, but it also covers non-disclosure orders and preservation directives, so the label alone does not tell you what an order requires. ##### Stored Communications Act (SCA) The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach. Warrants demand careful scope review. See how Kodex structures request review and production. Learn more --- ## What Is the Stored Communications Act (SCA)? | Kodex Source: https://www.kodexglobal.com/glossary/stored-communications-act Compliance & Regulation ### Stored Communications Act (SCA) The Stored Communications Act governs when US providers may disclose stored communications and account records to the government and to private parties. It sorts data into tiers and assigns a different legal instrument to each, and it is the statute that decides what a subpoena, an order, or a warrant can reach. Also known as SCA, 18 U.S.C. 2701 The Stored Communications Act is the load-bearing statute for US data requests. Almost every question about what an instrument can compel resolves back to it. #### The tiered structure The SCA’s central design is that different categories of data warrant different levels of protection, and each tier is unlocked by a different legal instrument. Data tierInstrument required Basic subscriber information covers identity-level details: name, address, session times and durations, length and type of service, and payment information. Transactional records cover the more detailed picture of how an account was used. Content is what was written or stored. #### The prohibition, and its exceptions The SCA’s default is prohibitive. A covered provider is barred from divulging the contents of communications, subject to enumerated exceptions. The exceptions that matter most operationally: - Disclosure to the government under proper legal process, per the tiers above. - Disclosure with the lawful consent of the originator or intended recipient. - Voluntary emergency disclosure where the provider believes in good faith that an emergency involving danger of death or serious physical injury requires it. - Disclosure necessarily incident to providing the service or protecting the provider’s rights. The consent exception is the one that resolves most civil disputes, since a party who wants their own messages can usually authorise their release directly. #### What it means for a company receiving requests - Classify the data before classifying the request. What tier the requested data falls into determines which instruments can compel it. - Do not let a request’s ask exceed its instrument. A subpoena that demands content is common and does not become valid because it was asked confidently. - Treat private-party requests differently. Civil subpoenas for content generally cannot be honoured, and the SCA is the reason. - Document the basis for voluntary disclosures. The emergency exception protects a good-faith belief, so the record of what you believed and why is what the protection rests on. #### Where the boundaries are unsettled Carpenter v. United States (2018) held that acquiring historical cell site location records is a Fourth Amendment search requiring a warrant, notwithstanding that such records had been obtained under the lower 2703(d) standard. The decision did not rewrite the SCA, but it established that constitutional protection can attach to data the statute places in a lower tier. Similar arguments continue over other categories of transactional data, and the safe posture is to treat the statutory tiers as a floor rather than a settled ceiling. FAQ #### Frequently asked questions Does the SCA apply to companies outside the United States? It applies to providers of electronic communication service and remote computing service to the US public, which can capture foreign-headquartered companies serving US users. Whether it reaches a particular company is a legal question that turns on its services and user base, and one worth settling with counsel rather than assuming. Can a private litigant subpoena user content from a provider? Generally no. The SCA prohibits providers from disclosing content to private parties, and civil subpoenas do not override that prohibition. This surprises litigants regularly. The usual route is to obtain the content from the account holder themselves, who can consent to disclosure. Why is the SCA considered outdated? It was enacted in 1986, when stored email worked very differently and cloud storage did not exist. Distinctions the statute draws (such as treating messages over 180 days old differently) map poorly onto modern services, and courts and providers have spent decades working around assumptions the technology invalidated. Glossary #### Related terms ##### Electronic Communications Privacy Act (ECPA) ECPA is the 1986 US statute governing government access to electronic communications. It has three parts: the Wiretap Act covering interception in transit, the Stored Communications Act covering data at rest, and the Pen Register Act covering real-time addressing data. ##### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. ##### Search Warrant A search warrant is an order issued by a judge authorising a search or seizure, granted only on a showing of probable cause. In data request work it is the instrument required to compel the contents of communications, and it is the highest legal threshold a company is likely to encounter. ##### 2703(d) Order A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause. See how Kodex supports compliant handling of legal process. Learn more --- ## What Is a Subpoena? Definition for Data Requests | Kodex Source: https://www.kodexglobal.com/glossary/subpoena Legal Process ### Subpoena A subpoena is a legal order compelling a person or company to produce documents or testimony. In data request work it is the lowest-threshold instrument: it does not require a judge’s prior approval and generally reaches basic subscriber information rather than the contents of communications. Also known as subpoena duces tecum The subpoena is the workhorse of the data request world. It is the instrument a company receives most often, it carries the lowest legal threshold of the compulsory processes, and it is the one most likely to arrive in volume. #### What a subpoena is A subpoena is an order to produce. Two forms matter here: - A subpoena duces tecum compels the production of documents, records, or data. This is the form companies receive. - A testimonial subpoena compels a person to appear and give evidence. The defining characteristic is that a subpoena can generally be issued without a judge approving it first. A prosecutor acting through a grand jury, or an agency acting under statutory authority, can issue one directly. That absence of prior judicial review is the reason its reach is limited. #### What data a subpoena can reach In the United States the boundary is drawn by the Stored Communications Act, which sorts data into tiers and assigns a different legal instrument to each. SubpoenaSearch warrant Legal standard Relevance to an investigation Probable cause Prior judicial approval Not generally required Required Typical data reached Basic subscriber information, non-content records Content of communications, stored files Who issues it Prosecutor, grand jury, or agency Judge or magistrate Can the user be notified Often yes, unless separately restricted Often restricted by an accompanying order The practical rule of thumb is that a subpoena reaches information about an account and a warrant reaches what is inside it. The boundary is contested at the edges, and location data has been the most heavily litigated of those edges. #### What it means for a company receiving one A subpoena is compulsory, so it cannot simply be declined, but it is not self-executing either. The recipient has a genuine role: confirming the subpoena is valid and properly served, confirming the issuing authority has jurisdiction, and confirming the scope actually matches what the law permits that instrument to reach. Three failure modes recur: - Over-production. Answering a subpoena with content because the request asked for it, when the instrument does not reach content. - Under-scrutiny of scope. Producing records for a date range far broader than the request justifies. - Missing the deadline. Compliance dates are real, and an unanswered subpoena escalates. #### How subpoenas differ from other legal process A subpoena sits at the bottom of a ladder. A court order under 18 U.S.C. § 2703(d) sits above it, requiring specific and articulable facts and reaching more detailed transactional records. A search warrant sits above that, requiring probable cause and reaching content. Emergency disclosure requests sit outside the ladder entirely: they are voluntary rather than compulsory, and they carry no judicial oversight at all. Knowing which rung an instrument occupies is the whole of the intake decision. Everything downstream depends on classifying it correctly. FAQ #### Frequently asked questions Can a subpoena compel the contents of emails or messages? Generally no. Under the Stored Communications Act, content held by a provider is protected by a higher standard, and US law enforcement ordinarily needs a search warrant based on probable cause to obtain it. A subpoena typically reaches non-content records: subscriber name, addresses, session times, payment information, and similar identifying details. Does a judge review a subpoena before it is issued? Usually not. Grand jury and administrative subpoenas are issued without prior judicial review, which is precisely why the categories of data they reach are narrower. Judicial oversight in the subpoena process is generally after the fact, arriving only if the recipient objects and moves to quash. What happens if a company objects to a subpoena? The recipient can file a motion to quash or modify it, typically arguing the subpoena is overbroad, unduly burdensome, or seeks material it has no authority to compel. Filing must usually happen before the compliance date. Ignoring a subpoena rather than objecting to it risks contempt. Glossary #### Related terms ##### Grand Jury Subpoena A grand jury subpoena is issued in the name of a grand jury investigating potential criminal conduct, and compels the production of documents or testimony. It is issued by prosecutors without prior judicial review, and grand jury secrecy rules restrict what the prosecution may disclose about the proceeding. ##### Administrative Subpoena An administrative subpoena is issued by a government agency under a specific statutory grant of authority, rather than by a court or grand jury. Its reach is bounded by the statute that created it, which means the first question on receiving one is whether that agency has authority over your company at all. ##### Search Warrant A search warrant is an order issued by a judge authorising a search or seizure, granted only on a showing of probable cause. In data request work it is the instrument required to compel the contents of communications, and it is the highest legal threshold a company is likely to encounter. ##### 2703(d) Order A 2703(d) order is a court order compelling a provider to disclose transactional records about an account. It requires specific and articulable facts showing the records are relevant to an investigation, which sits above a subpoena’s relevance standard but below a warrant’s probable cause. Processing subpoenas at volume is an operations problem. See how Kodex handles intake, review, and production. Learn more --- ## Kodex Blog | Law Enforcement Request Insights & Research Source: https://www.kodexglobal.com/blog Blog ### Blog: law enforcement request insights Your go-to resource hub for everything about data requests and the people who manage them. #### Search Showing 41 results of 41 items. Category Sort By Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach: Day 5 Update September 15, 2026 · Kodex News Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → News ##### Why I Joined Kodex September 9, 2026 · Brad Brooker Read More → News ##### Former FBI General Counsel Brad Brooker Joins Kodex Global August 20, 2026 · Kodex Read More → News ##### EU e-Evidence is live today. Here’s what actually changed. August 18, 2026 · Jesse Goodman Read More → Product ##### Kodex Product Update | August 2026 August 18, 2026 · Kodex Read More → News ##### Everybody’s Arguing About the Wrong Part of the CLARITY Act August 6, 2026 · Matt Donahue Read More → Product ##### Kodex Product Update | July 2026 July 16, 2026 · Kodex Read More → News ##### The Infrastructure Behind Every Government Data Request June 30, 2026 · Kodex Read More → News ##### A New Ally for Crypto Investigators in Africa and Latin America June 24, 2026 · Kodex Read More → News ##### A New Partnership for Financial Crime Investigators June 18, 2026 · Kodex Read More → News ##### Joining the Fight to Disrupt Illicit Virtual Assets June 15, 2026 · Kodex News Read More → Product ##### June 2026 Product Update: Bulk Targets & On-Demand Verifications June 11, 2026 · Kodex Read More → Product ##### May 2026 Product Update: Next Action Dates & Jurisdiction Access May 15, 2026 · Kodex Read More → News ##### Kodex Global Keynote | March, 2026 March 26, 2026 · Matt Donahue Read More → Product ##### February 2026 Product Update: NDO Preservation & Submission Blocking February 26, 2026 · Kodex Read More → Product ##### January 2026 Product Update: Targets 2.0 Goes International January 30, 2026 · Kodex Read More → Product ##### December 2025 Product Update: Submission 2.0 & VPN Checks December 22, 2025 · Kodex Read More → Product ##### November 2025 Product Update: Agent Submission 2.0 November 21, 2025 · Kodex Read More → News ##### 100,000 Strong: A Law Enforcement Request Milestone October 15, 2025 · Kodex Read More → Product ##### October 2025 Product Update: Targets 2.0 & Custom User Notices October 10, 2025 · Kodex Read More → Product ##### August 2025 Product Update: Data Retention Controls & Alerts August 19, 2025 · Kodex Read More → Product ##### July 2025 Product Update: Kodex API & View as Law Enforcement July 11, 2025 · Kodex Read More → Product ##### May 2025 Product Update: A Faster Agent Sign-Up Experience May 6, 2025 · Kodex Read More → Product ##### April 2025 Product Update: Combo Search & Analytics Dashboard April 14, 2025 · Kodex Read More → Product ##### February 2025 Product Update: Real-Time Transparency Reports February 16, 2025 · Kodex Read More → News ##### Managing Law Enforcement Investigation Complexity in Brazil February 13, 2025 · Nick Pailthorpe Read More → Fraud ##### Removing Friction for LERT Teams: Legal and Technical Advances February 6, 2025 · Kodex Read More → ##### Why Are We Still Faxing Law Enforcement Requests? February 6, 2025 · Kodex Read More → Fraud ##### Modernizing Law Enforcement Response for Business February 6, 2025 · Matt Donahue Read More → Security · News ##### Account Security at Kodex February 6, 2025 · Kodex Read More → Fraud · Product · News ##### Kodex Raises $10M Seed for Law Enforcement Response February 6, 2025 · Kodex Read More → Fraud ##### Law Enforcement Data Requests: The Supply Chain Vulnerability February 6, 2025 · Brian Donahue Read More → News ##### Herd Immunity: Protecting Against Fraudulent Law Enforcement Requests February 6, 2025 · Matt Donahue Read More → Security · Fraud ##### Understanding Law Enforcement Email Compromise (LEEC) February 6, 2025 · Brian Donahue Read More → Fraud ##### Securing the Front Door to Legal is Now Mission Critical February 6, 2025 · Matt Donahue Read More → Security · Fraud ##### Cybersecurity and Law Enforcement Requests: Q&A with Yahoo CISO Sean Zadig February 6, 2025 · Kodex Read More → News · Fraud ##### Investing in Public Safety: Modernizing Law Enforcement Response February 6, 2025 · Kodex Read More → News ##### User Notifications: Overcoming Law Enforcement Request Complexity February 6, 2025 · Kodex Read More → --- ## 100,000 Strong: A Milestone in LE Request Verification Source: https://www.kodexglobal.com/blog/100-000-strong-more-than-a-milestone News ### 100,000 Strong: A Law Enforcement Request Milestone Kodex has processed 100,000 law enforcement requests, a milestone that reflects growing adoption and the scale of the fraud problem we’re solving together. Kodex Team Kodex Published October 15, 2025 We’re proud to share that over 100,000 verified law enforcement professionals are now part of Kodex Global. But this isn’t really about us. It’s about impact. Every single connection on our platform represents the possibility of a crime stopped, a family protected, or a community made safer. Stories like the ones below remind us why bridging the gap between public and private matters so much. #### 2.5 Million Lives Saved at a Lady Gaga Concert Large-scale events bring joy to thousands, but they can also attract bad actors. When intelligence surfaced on a planned attack at a Lady Gaga concert at Copacabana Beach in Rio de Janeiro, Brazil, law enforcement launched ‘Operation Fake Monster’ and needed a fast, trusted way to collaborate with private sector partners. Through Kodex, those law enforcement agents were able to quickly verify requests, connect with the right stakeholders, and share the information needed to neutralize the threat. What could have been a tragedy became a story of prevention, and thousands of fans enjoyed a night of music, safely. “Kodex was essential in this investigation. The platform acted as a secure and efficient bridge between law enforcement and Discord, allowing us to obtain emergency data tied to profiles involved in a serious threat. The information shared via Kodex helped us identify connections between users and confirm that there was, in fact, a coordinated plan to cause harm. This support was critical to advancing the investigation and protecting public safety.” ‍ - Police Commander of Piauí State, Brazil, Alesandro Gonçalves Barreto said about the incident. #### Just in Time: 2 Children Saved from a Sexual Predator In another case, an investigation uncovered a predator preparing to harm two innocent children. Timeliness was extremely critical. Using Kodex, law enforcement connected instantly with private sector partners, verified identities, and exchanged the information needed to act decisively. The suspect was stopped before he could carry out his plans. Two children were kept safe. And a predator was brought to justice. Here is a note our CEO, Matt Donahue, received from the law enforcement agent who made the arrest: ‍ #### The $400,000 Comeback: a crypto crime undone Toronto Police launched an investigation into an investment fraud scam carried out over the phone, where a husband and wife were tricked into sending $400,000 to scammers. The lead investigator worked seamlessly with a Kodex Partner to help regain a “significant portion” of the couple’s lost funds from intake, and judicial authorizations, all the way through to the successful recovery of funds. This case is a great example of how Kodex bridges the gap between public investigators and private industry, creating a secure, efficient channel for collaboration. What began as a devastating phone scam became a story of recovery and resilience. ‍ #### More Than a Milestone Reaching 100,000 verified law enforcement professionals is proof that this model works. Kodex sets the standard for how companies and law enforcement communicate with each other, and these standards help stop crime on a global scale. By breaking down silos and building trust between the public and private sectors, we’re enabling faster responses, stronger partnerships, and real-world impact. Every story like these reminds us why we do what we do. And with 100,000+ professionals on the platform, our hope is to continue to build safer communities, together. ‍ #### How you can play a part Give yourself, your community, your business and your customers the best chance to be safe in our digital world, by staying educated on the latest trends and scams. Brian Krebs is one of many investigative journalists deep-diving into scams and spreading awareness of these bad actors. Know2Protect For parents and trusted guardians, there are resources from the Department of Homeland Security, which shares information that helps educate families on personal digital safety. The Modern Request Response Playbook If you work for a company within Legal, Trust and Safety, Compliance, CISO/Security, or any other role that receives or works with subpoenas or data requests from law enforcement, know that Kodex and our community are a resource for you and your team. Our Modern Request Response Playbook is a first-of-its-kind knowledge share for those who work with lawful data requests. Because of our unique position as the bridge between public and private sectors, we have insights that no one else has, including the first-ever operational benchmarks. See how your process compares to others around the globe, and where you can improve. “In this industry, you need partners who you can trust. With Kodex, we trust that you guys care as much as we do about getting bad actors off our platform“ ‍ - John Kothanek, Vice President of Global Intelligence at Coinbase Monthly Newsletter We share updates on the latest threats and trends impacting teams responding to lawful data requests. We include a list of the latest compromised email domains to watch for and avoid. Quarterly Reports Explore our findings in our more in-depth reporting. These reports not only share the latest compromised domains, but also rising trends that explore how bad actors are building a business around fraud, scams, and data breaches. Real-world case studies included. Our LinkedIn page also shares the latest information and resources daily. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Managing Law Enforcement Investigations in Brazil Source: https://www.kodexglobal.com/blog/a-step-together-addressing-the-complexity-of-investigations-in-brazil News ### Managing Law Enforcement Investigation Complexity in Brazil Brazil’s law enforcement request landscape is complex — multiple agencies, evolving legal frameworks, and language requirements. Here’s how to navigate it. Nick Pailthorpe Global Director Published February 13, 2025 In late April, we joined more than 1,200 local investigators and law enforcement agents in Brazil for an in-person and virtual discussion on how to work effectively with private sector companies when conducting investigations. Alongside our team, were partners from Binance, Bumble Inc., Discord, Google, Grupo OLX, Match Group, Mercado Livre Brasil, and Microsoft. Brazil is a large country with multiple police agencies facing a multitude of different types of crime including homicide, school shootings, cryptocurrency crimes, domestic violence, organized crime, and terrorism. Local law enforcement knows that to keep their communities safe, they need a safe, secure, and efficient line of communication with tech platforms. Concerns discussed at this event emphasized the importance of legal, prompt, and efficient digital evidence acquisition. Increased complexity for companies and law enforcement committed to public safety in Brazil underscores many of these concerns. #### Private Sector Concerns Throughout my career, I’ve seen a growing desire from companies to engage and support law enforcement investigations, especially to improve public safety. Today, many companies have dedicated Trust and Safety, and Law Enforcement Operations teams actively engaged in protecting platform safety and user privacy. However, companies are rightfully worried about ensuring that only verified and legitimate investigators can obtain information through legal processes. Instances of law enforcement data breaches and compromised networks globally, including in South America, have heightened companies’ vigilance to prevent unauthorized data requests. Kodex recently published an in-depth white paper on the risks of fraudulent emergency data requests (EDRs) with a case study on how we recently detected a compromised law enforcement email domain and blocked fraudulent requests from reaching customers on our platform. Our modus operandi is not to trust someone simply because they have access to a law enforcement email address since email compromises are a known threat. That’s why we simultaneously run global signals intelligence and account heuristics, monitoring for suspicious activity to flag abnormal behavior for all our customers. Maintaining public trust and proving compliance with privacy and data protection laws is also important to these companies. Kodex gives them the ability to audit activity on every law enforcement request and create public-facing transparency reports in minutes. #### Key Needs of Law Enforcement On the law enforcement side, investigators and agents have also grown in their desire and ability to work with companies on legal investigations. Historically, police were shocked when a company reached out proactively to engage in shared public safety concerns. It often felt like pulling teeth to confirm and organize productive discussions between law enforcement and private companies because there was so much suspicion on both sides. Today, law enforcement understands that they need to follow legal process and submit appropriately scoped requests to the appropriate companies. Learning how to do that takes time and access to the necessary guidelines from each company. Nearly every modern crime involves some kind of digital evidence, and it’s often very time-consuming for authorities to access that data. Some friction is necessary, including legal process to ensure the requests are lawful. Yet, once legal requirements are met, a slow and inefficient process makes it difficult for law enforcement to protect vulnerable individuals. For example, a single investigation may require law enforcement to engage with numerous companies that may or may not publicize contact information or guidelines for how they can receive law enforcement requests. This often leaves investigators to make an educated guess about how to engage with the right contact at each company, which not only wastes time but risks exposing sensitive details about an active investigation to the wrong person. Once verified on Kodex, investigators can easily engage with our customers in one place. This helps them investigate crime more efficiently. Kodex also makes it easy for law enforcement to contact the appropriate team at any company on our platform with the necessary information to process a legal request with complete documentation to maintain and prove the chain of custody. I joined Kodex because I’m passionate about preventing real-world harm and protecting user privacy. At the event in Brazil, it was impossible to ignore the importance of what Kodex does to improve trust and peace of mind throughout the entire process. Companies and law enforcement are eager for a safer, more secure, and more efficient way to work together. ‍ Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Account Security at Kodex Source: https://www.kodexglobal.com/blog/account-security-at-kodex Security · News ### Account Security at Kodex How Kodex protects your account and the law enforcement request data your team manages — from authentication to access controls. Kodex Team Kodex Published February 6, 2025 We use multiple layers of defense with built-in redundancies to verify law enforcement agents and prevent their Kodex accounts from unauthorized use. #### Law Enforcement Account Verification Law enforcement officers are required to sign up with a verified agency email. However, criminals know that law enforcement agencies often have weaker security than the companies they’re trying to exploit, so agency email domains are a popular target. This is one reason why additional verification is required for individual accounts to gain authorization for Emergency Data Requests (EDRs). We immediately notify our customers if an unauthorized account attempts to submit an EDR to them through our portal. #### Suspicious Behavior Detection Law enforcement agents have varying technical capacity, so Kodex maintains a continuous system of verification to detect and mitigate unauthorized access to Kodex accounts. Kodex has mitigated threats ranging from individual agents having a shared password leaked from another service to entire email domains being compromised. This continuous verification uses technical signals, combined with a global threat intelligence team, to prevent law enforcement agent compromise. To date, we’ve blocked thousands of imposters attempting to submit fraudulent requests. Occasionally, we even see fraudsters trying to scam each other with advertisements for access to Kodex accounts which have already been blocked from submitting requests. #### Global Threat Intelligence One of our greatest strengths is the experience of our security and engineering teams including former law enforcement officers, seasoned cybersecurity experts, and anti-fraud investigators. Our vast knowledge and expertise in identifying, defending against, and disrupting criminal attacks against online accounts is not only built into Kodex technology, it’s strengthened by our expansive threat intelligence network. It’s not uncommon for our team to notify law enforcement about a potential compromise in their systems because of the information we have about underground criminal networks. Criminals looking to steal personal data know that law enforcement agencies often have weaker security than the companies that collect the data. So agency email domains are now a popular target for criminals hoping to scam companies into giving up sensitive data by emailing fake requests. That’s why we don’t stop at email verification when vetting law enforcement requests, nor do we stop verifying accounts at login. Our team includes seasoned cybersecurity experts and former law enforcement officials; we’ve seen it all and we’re always monitoring for impersonators. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Everybody’s Arguing About the Wrong Part of the CLARITY Act | Kodex Source: https://www.kodexglobal.com/blog/clarity-act-crime-fighting-bill News ### Everybody’s Arguing About the Wrong Part of the CLARITY Act Everyone is scoring the CLARITY Act as a crypto markets bill. Matt Donahue, former FBI, on the illicit-finance provisions that actually decide whether victims get paid back. Matt Donahue Founder/CEO @ Kodex Published August 6, 2026 Update, August 6: Still no vote. The cloture petition was filed too late to allow a weekend session, and the holdup is ethics language still being negotiated with the White House. August 7 is the last scheduled working day before the Senate leaves on August 10, so this comes down to hours of floor time. CoinDesk has a clear rundown of where it can still land. ‍ There’s a version of this week where the Senate passes the biggest crypto bill in history and every story about it is a story about market structure. SEC or CFTC. Which token is a security. Whether Congress can define “decentralized” without laughing. I don’t have a take on that. I’ve got a take on the part nobody’s writing about, and it’s the part that decides whether a 71-year-old in Ohio ever sees her money again. So here’s a thing that happened to me a hundred times at the Bureau, give or take. You catch a case. Money’s already moving. You get on the phone with an exchange, and here’s what people don’t understand about that call: the person who picks up usually wants to help you. They’re often a former agent. Sometimes literally someone you worked with. They can see the wallet on their screen while you’re talking to them. And then they have to go ask their lawyer. And the lawyer, who is also not a bad guy, says: we can’t touch it without proper legal process, because if we freeze a customer’s funds and we’re wrong, that customer sues us into the ground and nobody in this building has a job. The lawyer is right. That’s the part that used to make me want to put my head through a wall. The lawyer was right. Everybody on that call wanted the same thing and the law gave them no way to do it fast. By the time the paperwork clears, that money’s been through six wallets and two jurisdictions and it’s gone. Not “hard to find.” Gone. Now here’s what’s actually in the CLARITY Act, buried under all the market structure noise. There’s a provision people are calling the hold law. It says if law enforcement asks you to pause a suspicious transaction, and you do it, you can’t get sued for doing it. That’s it. That’s the whole thing. I know how boring that sounds. I promise you it isn’t. That single provision takes the worst conversation in my old job and deletes it. The analyst who wants to help can help. The lawyer can say yes without betting the company. And the freeze happens in the window where a freeze still means something, which is measured in hours, not weeks. There’s also a pilot program for companies and federal agents to actually share intelligence about this stuff. Right now that happens through relationships. Some guy knows some guy. It works great until the guy takes another job, and then a decade of institutional knowledge walks out the door with him and everybody starts over. And the bill puts crypto firms under the Bank Secrecy Act. Real AML programs, know your customer, suspicious activity reports. The whole apparatus banks have had for fifty years. Worth remembering next time somebody tells you this industry wants to operate outside the law... the industry is asking, in writing, to be regulated like Citibank. Now, the objection. Some serious people say the bill is soft on illicit finance, that there are loopholes, that we’ll regret it. I don’t think they’re arguing in bad faith and I’m not going to pretend the bill’s perfect. I’ve read enough legislation to know none of them are. But I keep coming back to this. Whatever we’re protecting by leaving things exactly as they are... it isn’t victims. Pig butchering is eating people alive out there. Grandparents are wiring their retirement to a guy they think they’re dating. And all of that is happening right now, under today’s rules, with today’s protections. If the status quo were working I’d defend it with you. Honestly, the thing that gets me about this whole debate is how close everybody already is. The prosecutor and the compliance officer are not enemies. I’ve sat in rooms with both of them for five years now and they want the identical outcome. The victim gets paid back. The scammer gets cuffed. What’s between them isn’t ideology, it’s plumbing... a bunch of statutes written back when a fax machine was cutting edge technology, before I was born. You can fix plumbing. That’s the good news here. This is one of the rare problems in Washington where somebody just has to write the permission slip and the rest of us will go build the thing. Pass the damn bill. Lets get it. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Cybersecurity & LE Requests: A Q&A with Yahoo’s CISO Source: https://www.kodexglobal.com/blog/cybersecurity-law-enforcement-requests-qa-yahoo-ciso Security · Fraud ### Cybersecurity and Law Enforcement Requests: Q&A with Yahoo CISO Sean Zadig Yahoo CISO Sean Zadig on why cybersecurity teams need to own the law enforcement request process — and what happens when they don’t. Kodex Team Kodex Published February 6, 2025 Sean Zadig is the Chief Information Security Officer for tech giant Yahoo. He brings to the role a significant amount of experience investigating cybercrime, including as a Special Agent in the Office of the Inspector General at NASA. His unique blend of corporate cybersecurity leadership and law enforcement experience gives him a distinctive point of view on the intersection of SecOps and the expanding risks around law enforcement data requests. #### Q: How did your experience with cyber investigations influence how you lead security at Yahoo? When I started at Yahoo, working on cyber defense, I suggested to our then-CISO that we look at child safety online. As an email provider, that was important to Yahoo. My prior experience at Google and NASA also contributed to my interest in this area. When we did that and shared what we were seeing and learning, there was broad agreement within the company that it should be part of our focus as the security team. Today, my team works on a broad scope of security issues - spam, phishing, financial fraud, account takeover, etc. - but also there is user safety, child exploitation, child sex trafficking, threats of harm, harassment, and so on. It runs the gamut of what you might see on a large email provider like ours. We want to protect our customers from this harmful stuff and prevent our products from being used to harm anyone. #### Q: Do most CISOs see the law enforcement response process as an active attack vector? Generally speaking, is it on their radar? No, I don’t think many CISOs are closely tracking this attack vector, but they should be. Whether an adversary can technically exploit a company’s infrastructure through a technical vulnerability or social engineer their way in by impersonating law enforcement to obtain data - the outcome is the same. And because companies are legally obligated to respond to legitimate law enforcement requests, bad actors try to use that same infrastructure for their purposes. Adversaries have successfully attacked the legal requests function, exploiting even some of the world’s largest, best-resourced companies, so it needs to be a higher priority for everyone. Often, these functions (security and law enforcement response) sit in different areas of an organization, so even when there is awareness of the risk by CISOs, it’s not always at the top of their minds or their highest priority. #### Q: True. SecOps and LERT teams are typically separate. How can they work together to reach successful outcomes? We have a law enforcement response team at Yahoo, which is part of the legal organization. Our Trust and Safety team conducts day-to-day content moderation and escalations. They are also part of the legal team. They are not part of my infosec team, but we work closely together because we recognize a lot of overlap in what we do. Folks who work in this space - especially when we’re talking about child safety - all want to get the mission accomplished. So, there’s a lot of understanding and collaboration. When new folks come in, we take them through an educational process about the work we do and why it’s essential. #### Q: Responding to law enforcement requests can be complex and highly confidential, so it’s often a bit isolating. How did you address that at Yahoo? I realized that people are doing really tough work, sometimes looking at the worst situations and doing their best to protect people. Yet once that part was done, there was never any follow-up or closure. So, I built a program we call “reporting outcomes” that involves all relevant stakeholders sharing the results of investigations whenever we can. When we get a positive outcome, like a child being rescued, and we prevent a dangerous situation from escalating, we share that information with our cross-functional team - which includes security, legal counsel, LERT, trust & safety, product engineering, and company executives. We also highlight who contributed to the outcome and how. It makes people feel like they are part of something larger and that their work really matters. The security industry often clings to a “secret squirrel” mentality, but you have to share these success stories to raise awareness of the very real impact it is having. It also benefits the security team because business leaders know what we’re doing and why, which can help when we have other resource requests. #### Q: Yahoo is in the process of deploying Kodex. Why did you choose their platform rather than build tools internally for your law enforcement response process? Even at a large company like Yahoo, resources are limited. Sometimes, bringing in a partner like Kodex with experience building and scaling specialized tools makes sense. And because Kodex also has deep experience in law enforcement and already has other companies on its platform, I benefit from the shared knowledge of risks across the board. For example, if a company using Kodex gets a fake law enforcement request and the same attacker tries to target another company, Kodex can stop it. Without that connecting layer, we’d be in a vacuum. Other than picking up the phone and notifying other companies, there is no way other than a platform like Kodex to share that information. The verification capabilities and the ability to customize the intake process are also important. We get a lot of requests for data we don’t even have. So, being able to narrow requests upfront and ensure law enforcement is submitting them correctly and in compliance with legal requirements eliminates the back and forth between law enforcement and our team, which saves us time and money. More importantly, this also protects the privacy of our users by appropriately limiting the scope of what otherwise would be overbroad requests. These are all pluses for my team, and I’m excited to have Kodex on board. #### Q: Yet, all law enforcement data requests come from one government agency or another. Having worked in the public sector, what are your thoughts on if the government can provide a solution rather than a private technology company? From my vantage point, it has to come out of the private sector because there’s this little thing called the Constitution and the 4th Amendment. As a private company, we legally cannot act as an agent of a government. So, all the things we’ve talked about - fighting child abuse, fraud, and so on - we do them because we want to protect our platform and our users. Not because we are trying to catch criminals. That’s not a bad outcome, but my team is not law enforcement. If law enforcement or a government agency made a system that interfaces with us and our data, we would have a tough time saying we’re not working on behalf of the government. At the same time, we also feel an intense obligation to protect our users’ privacy. So, we want to be able to limit data requests to only what the law allows and not more. Kodex helps with that by preventing overly broad requests. Sometimes, the impression on the law enforcement side (and I know because I was there) is that companies can just hand over whatever you ask for, which isn’t true. So, everyone benefits from a solution that streamlines and clearly defines the request process for each company, and you end up with a more tightly-scoped request. #### Q: When you look back at your experience in the public sector fighting cybercrime through your current lens as a CISO, how have things changed? It used to be that when law enforcement requests came into companies, it was for a cybercrime case and there just weren’t that many. Now, it doesn’t matter what the crime is - drugs, guns, financial fraud, etc. - everything has a digital component. So, the amount of requests that come into a business has dramatically increased and each one needs to be carefully reviewed. At the same time, there has been a proliferation of companies that collect and store consumer data - it’s not just Google, Facebook, or Yahoo; it’s everywhere. For some of these companies that are smaller and don’t have the resources or background to correctly respond to legal requests for data, that is a growing challenge. Yahoo is more mature in how we interact with law enforcement requests, and we understand what is appropriate and what isn’t. But a lot of companies are not in that position. For less mature companies who are receiving their first law enforcement requests – or just launched a new feature like video or chat that attracts significant attention from law enforcement – and are freaking out, solving that alone in a vacuum is challenging and expensive. A solution like Kodex can help protect their data from people impersonating law enforcement. Read the Kodex white paper here on protecting against fraudulent law enforcement requests Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## EU e-Evidence Is Live Today: What Actually Changed | Kodex Source: https://www.kodexglobal.com/blog/eu-e-evidence-live-today-what-actually-changed News ### EU e-Evidence is live today. Here’s what actually changed. EU e-Evidence applies from today. Jesse Goodman on what’s live, what’s still catching up, and the operational gap most providers haven’t rehearsed. Jesse Goodman VP Product Delivery Published August 18, 2026 As of this morning, competent judicial authorities in participating EU member states can issue European Production Orders directly to service providers. You have ten days to answer, or eight hours in an emergency. Non-compliance can carry penalties of up to 2% of worldwide annual turnover. On our August 6 practitioner session we opened with a hypothetical: an emergency order arriving at 2am on a Sunday. From today, that can actually happen. Most of the coverage of this deadline is about whether Europe is ready. The legal framework is. The technical infrastructure isn’t, at least not everywhere. I’ll go through the details below. But those readiness problems will resolve themselves over the next few quarters, and the regulation will still be here. I think the more useful thing to explain is what kind of change this is, because it’s a bigger one than the compliance date suggests. #### The infrastructure is still catching up The regulation applies starting today, even though the decentralised IT system built on e-CODEX, JUDEX (the Justice Digital Exchange), isn’t operational everywhere. The regulation anticipated this and provides for alternative means when the system can’t be used. Germany’s federal police wrote to service providers in June and described the practical reality directly. “It is highly likely that JUDEX is not available in every country on August 18th, 2026.” Bundeskriminalamt, letter to service providers, June 29, 2026 There’s no published list of which member states are starting inside the system and which aren’t. We’ve asked for one in the working sessions we’re part of, and no member state has committed to producing one. Technical implementation also varies significantly by country. Part of the reason, as Ike Anude on our team put it on the session, is that “everyone is kind of waiting for everyone else to use the API before they use the API.” If you registered to receive orders through an API, that doesn’t mean authorities will be able to reach you that way on day one. But orders can still be issued starting today. #### This has happened before GDPR took effect in 2018 while regulators were still hiring. The DSA and the OSA both went live before their enforcement machinery did. James Clark, who works with our EU customers, described the pattern on the same session: “the implementation of the regulation deadline slips, but the expectation on the service providers to be able to comply with it often doesn’t.” The regulation anticipated that the technical infrastructure might not be available everywhere on day one. Article 19(5) provides for alternative means of transmission when communication through the decentralised system isn’t possible. Those alternatives must be swift, secure and reliable, and allow the recipient to establish authenticity. Kodex can serve as one of those alternative channels, providing a secure and auditable path for orders when the decentralised system isn’t available. Here’s what that means in practice: the regulation became applicable this morning, and orders can reach service providers through alternative channels while the common technical infrastructure comes online. The German letter I quoted above goes on to ask each provider which alternative channel it prefers. That’s not a workaround. It’s a scenario the regulation expressly anticipated. #### The actual change Until yesterday, cross-border access to electronic evidence often depended on slower mechanisms such as European Investigation Orders or mutual legal assistance, or on voluntary cooperation with service providers. From today there’s a new formal instrument with a standard format, a deadline, a penalty, and eventually an API behind it. Twenty-six EU countries just adopted a common framework for cross-border production and preservation orders for electronic evidence. Other governments are moving in a similar direction: the CLOUD Act agreements, the UK’s COPO regime, Australia and India. What I see across jurisdictions is the same direction of travel: more standardized, direct and increasingly machine-readable processes. Volumes were already growing before the regulation existed. Across our customers, EU request volume has grown 15% to 30% a year for the past two years, measured over hundreds of thousands of requests. The exact impact of e-Evidence is impossible to predict, but nobody I’ve spoken to is forecasting a decrease. The mechanism is straightforward: investigators now have a direct legal instrument with a defined response deadline. #### The gap that’s left Most of the preparation work I’ve seen over the past six months went into scope analysis, appointing representatives, filing notifications, and updating policies. That work was necessary, and most companies we work with have done it. The gap is operational: what happens in the first twenty minutes after an order arrives. Who gets notified? Can they tell it’s an emergency? Can they see if you hold responsive data? Do they know if enforcing-authority approval is needed? And then there’s automation. Preservation workflows and user lookups are two of the clearest places to start. For companies processing meaningful volume, these are repeatable workflows that shouldn’t require someone to manually work through the same steps every time. The goal should be to automate them end to end where the requirements are clear and the appropriate controls are in place. Eight hours isn’t enough time to figure any of this out from scratch. You can’t assemble an intake process at two in the morning while the clock is running. We’ve spent this year on that gap. We run the 2am scenario with customers as a drill: inject an emergency order, walk the intake end to end, see what breaks. Since no member state system was open for testing, we built a simulated one and test integrations against it. If you want the mechanics, scope, the clocks, the channels, and what an EPOC looks like when it arrives, our e-Evidence page covers them in detail. #### What happens now Nothing dramatic today. The first orders will trickle in, some will be defective, and many may arrive through alternative channels while the decentralised infrastructure comes online. If you do three things this week: decide which alternative channel you’d nominate if an authority asked, run one emergency drill before a real one arrives, and identify the repeatable work, starting with preservation workflows and user lookups, that you can automate. The readiness guide covers the rest in about ten minutes. We’ll write up what the first real orders look like once they’ve moved. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Former FBI General Counsel Brad Brooker Joins Kodex Source: https://www.kodexglobal.com/blog/former-fbi-general-counsel-brad-brooker-joins-kodex News ### Former FBI General Counsel Brad Brooker Joins Kodex Global Kodex Global has named Brad Brooker, former General Counsel of the FBI and Acting General Counsel of ODNI, as its new General Counsel. Kodex Team Kodex Published August 20, 2026 Brooker takes on the same role he held at the FBI, after nearly seventeen years advising the U.S. government’s most senior national security leaders on lawful access, privacy, and the rules that govern how sensitive data moves. Kodex Global, the company building the trusted rails for data exchange between government agencies and private companies, today announced that Brad Brooker has joined as General Counsel. Brooker previously served as General Counsel of the FBI and as Acting General Counsel of the Office of the Director of National Intelligence. Every day, legal demands for records move between investigators and the companies that hold the data, from tech platforms to financial institutions and hospitality companies. Kodex is where that exchange happens for 15,000 government agencies and 160,000 verified agents. The rails carry requests at the speed investigations require, and they check every demand on the way in: the requester is verified, the legal process is valid, and the scope is what the law allows. Companies on the network respond faster because they can trust what arrives. Brooker spent his government career on exactly this ground. At the FBI and the Office of the Director of National Intelligence, his job was making lawful access work while answering for the privacy and civil liberties questions it raises. At Kodex, he takes on that mandate for the network itself. “Speed is critical to a law enforcement investigation. When lawful requests stall, crimes don’t get solved,” said Brooker. “The rails serve another purpose too: they help make sure legal demands are compliant on the front end, so companies aren’t handing over data to invalid or overbroad requests. It’s the right data, at the right time, under the right process. Having spent much of my career in the national security community, I see this as a natural extension of what I’ve long been committed to: protecting the integrity of the law enforcement process and the privacy and security of the sensitive data it depends on.” Before joining Kodex, Brooker was a partner at Holland & Knight in Washington, D.C., advising clients on data privacy, artificial intelligence, and national security. He came to private practice after nearly seventeen years in government. At the FBI, he served as General Counsel and, before that, as Deputy General Counsel leading the National Security and Cyber Law Branch, advising the FBI Director on intelligence operations, cybersecurity law, and privacy. At the Office of the Director of National Intelligence, he served as Principal Deputy General Counsel and spent three years as Acting General Counsel, coordinating legal and policy issues across the intelligence community. He clerked for the Honorable Reggie B. Walton of the U.S. District Court for the District of Columbia and the Honorable Eric T. Washington of the District of Columbia Court of Appeals. “Brad spent seventeen years on the hardest questions in this space: how the government gets the data it lawfully needs, and how everyone’s privacy survives the process,” said Matt Donahue, co-founder and CEO of Kodex. “Agencies trust the network because every requester is verified. Companies trust it because compliance is built into the rails. Nobody alive has spent more time earning trust on both sides of that line than Brad.” Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Herd Immunity: Block Fraudulent Law Enforcement Requests Source: https://www.kodexglobal.com/blog/herd-immunity-protecting-the-kodex-community-from-fraudulent-law-enforcement-data-requests News ### Herd Immunity: Protecting Against Fraudulent Law Enforcement Requests Every platform that verifies law enforcement agents on Kodex protects the entire network. Here’s how the herd immunity model works — and why it scales. Matt Donahue Founder/CEO @ Kodex Published February 6, 2025 Every day, law enforcement response teams (LERT) within corporations do their best to respond to the significant number of data requests they receive from law enforcement. But they are outnumbered by the volume of requests and the growing number of threat actors. It’s easier to steal confidential information through a fake law enforcement request than trying to hack a corporate network. Hiring enough staff to address the volume of requests and scrutinize all law enforcement credentials to ensure their validity isn’t sustainable. Moreover, it would not solve the fundamental problem of companies working in isolation. They don’t have visibility into compromised credentials or fake Emergency Data Requests (EDRs) that have been used to target other companies; LERTs can only see what comes into their company’s dedicated email inbox or through their in-house CRM. And for every fraud they do detect, they do so within the confines of their company–the information they uncover is not shared with other businesses that may also be a target. It’s like learning the plumber you hired is a total fraud who stole your copper pipes and even when you get rid of them, they will likely just go on to fool someone else–in fact, they probably already are. If you could warn others about this imposter (or be warned yourself, ahead of time), an entire community would be inoculated against their deception. That’s why herd immunity is critical to enabling a sustainable process for identifying fake credentials, EDRs, and other attempts to steal sensitive user data by exploiting vulnerabilities in archaic LERT systems prone to human error. Having a community and platform for exchanging information about police and government officials who submit requests makes it easier for everyone to know who can be trusted at any given moment and act accordingly. #### How herd immunity tackles social engineering at scale A secure platform that verifies massive volumes of law enforcement investigators and agencies is the foundation for building herd immunity. Additionally, it must be global, able to detect compromised credentials in real-time, and take action for the entire community of organizations that could be the target of an attack. Given the number of individual law enforcement investigators and agencies operating globally — each issuing local forms of legal process and emergency requests — it quickly becomes a massive challenge for companies to verify them all. We knew that when we started Kodex. We also knew that building such a platform was the only way to ensure companies had visibility into all of the compromised or flagged law enforcement requests across the globe - not just the ones they are dealing with. With Kodex, when a law enforcement investigator signs up every customer on our platform knows they’ve gone through rigorous verification before they can submit a request, including multiple rounds of verification to submit EDRs. Our customers don’t have to cross their fingers and hope a request is legitimate, or do their own investigation, which takes time, resources, and expertise most companies don’t have. Legitimate law enforcement agents want to be authenticated and verified - it helps streamline the request process and can save valuable time, particularly when an EDR is involved. That’s why so many have registered on our platform. Today our global network includes more than 12,000 verified agencies, and over 60,000 verified investigators in more than 180 countries, with more being added every day. However, herd immunity requires more than volume. It also demands vigilance. A verified government email today could be a compromised email tomorrow, demonstrating a specific type of Business Email Compromise (BEC) called Law Enforcement Email Compromise (LEEC). That’s why, in addition to detailed account verification, we use always-on suspicious account activity monitoring and global threat and signals intelligence to identify compromised law enforcement domains before requests are sent. #### Joining the herd can help future-proof your LERT When one door closes, another opens, particularly for bad actors who want to steal sensitive data. While corporate networks continue to harden their defenses against intrusion, law enforcement networks are an easy and highly appealing attack vector. Many companies still employ a simple inbound email address accessible to anyone to handle data requests from law enforcement - hardly the most secure channel. Even large companies, who may have an in-house verification solution, are still working in a very dark silo, with limited contextual information about the investigator, agency, and legal justification for the request. This information vacuum is fertile ground for social engineering attacks, including AI-generated fraudulent warrants and identities. In short, the work for LERTs will get harder and more complex as attackers enhance and accelerate their ability to steal data by compromising law enforcement domains. You can get an in-depth look at this rapidly evolving landscape, the types of threat actors operating within it, and read about actual case studies of bad actors penetrating corporations in our white paper. Meanwhile, if you’re interested in joining other leading companies who want to protect their users and organizations - and in the process, protect other community members - contact us to learn about signing up for the Kodex platform. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Invest in Public Safety: The Modern Law Enforcement Response Source: https://www.kodexglobal.com/blog/investing-in-public-safety-modernizing-law-enforcement-response News · Fraud ### Investing in Public Safety: Modernizing Law Enforcement Response Modernizing law enforcement response isn’t just a compliance issue — it’s a public safety investment. Here’s the case for getting it right. Kodex Team Kodex Published February 6, 2025 It’s a question we hear often at Kodex: “You’re solving a really important problem. So why hasn’t anyone done this before?” The answer is both simple and complex, and we set out to explore this issue and much more in a recent webinar with Kodex founder and CEO Matt Donahue and Bradley Tusk, Co-founder and managing partner, Tusk Venture Partners. It was a lively discussion which revealed why innovative solutions like Kodex, which serves both public sector agencies and large private sector companies, are starting to get more attention from technology investors. Below we summarize some key points from the discussion, however these are just brief excerpts. We encourage you to watch the full webinar recording here. #### Understanding the long held venture capital aversion to investing in GovTech As co-founder of the world’s first venture capital fund that invests solely in early stage startups in highly regulated industries, Bradley Tusk has a keen understanding of what makes the GovTech sector uniquely challenging. As he discussed in detail in the webinar, startups that plan to rely on revenue from government entities may be in for an uphill battle. “Government procurement is a miserable process, very slow, risk averse, and it’s bureaucratic and political. So any business that wants to generate revenue has to fight through all that,” Tusk said. However, he advised that doesn’t mean the sector should be ignored. Crunchbase put it this way: “It’s easy to miss that the public sector isn’t just the government anymore. In many cases, it’s one of the primary drivers of new growth for these businesses—a backdoor to getting the attention of the commercial Fortune 500 on both the public sector and the commercial side of the house.” Targeting the private sector side of GovTech equation is the solution to circumventing some of the entrenched issues with penetrating government agencies to secure contracts. Kodex takes this approach by working with public sector agencies to provide them a service that the company’s private sector clients - who also benefit from the solution - pay for. It’s proven to be a win-win for for everyone. But that doesn’t mean it was easy to convince others that the Kodex platform was the right way to solve the messy, risky, and costly process of responding to law enforcement requests. #### From FBI Agency to Company Founder: Why Experiencing the Problem Firsthand Matters If you’re a startup founder or investor, you’ll appreciate hearing Matt Donahue recall how many times people either asked him why no solution like Kodex existed or telling him he was crazy to leave a secure job with the FBI to launch a tech startup. “When you work in government you have a better appreciation for how hard those jobs can be,” Donahue notes. It was his work on investigations at the FBI that revealed just how archaic and risk-prone the law enforcement response process was, and ultimately led him to create Kodex. Like many other successful companies, Kodex was born of first hand experience with the problem that they set out to solve. “People think it’s as easy as you give me a subpoena, I give you back data. In reality, it is a lot more nuanced and complex,” according to Donahue. He explained that “Pre-Kodex,” companies were using Google Sheets, Dropbox, Zendesk, or other tools to track various aspects of law enforcement requests, including compliance with privacy and data protection laws. There was no one tool that did everything, until Kodex. Donahue also heard repeatedly that a solution like Kodex “would never be a business.” Having worked directly with companies trying to get time sensitive data to solve a case, he knew that simply wasn’t true. “That mindset ignores the reality that law enforcement has been relegated to a templatized approach to subpoenas; the problem with that approach is that the world is ever-changing and so are companies.” In other words, each company’s data sets, structures, types and access controls are unique. How could law enforcement possibly provide a request in a way that a company can quickly and accurately respond to? Kodex solves that issue by onboarding companies and identifying their data types so depending on the type of request - subpoena, warrant or emergency data request - the agency can submit the request the right way to get a fast response. #### Envisioning Kodex’s future and GovTech investing In addition to the topic areas briefly highlighted here, both Tusk and Donahue had some interesting things to say about what opportunities are ahead for Kodex, and how the government can use technology to help society in new and exciting ways. We invite you to watch the full webinar to get the most out of their discussion. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Why Are We Still Faxing Law Enforcement Requests? Source: https://www.kodexglobal.com/blog/ive-never-sent-a-fax-in-my-life-and-this-is-the-fbi-what-are-we-doing-here Blog ### Why Are We Still Faxing Law Enforcement Requests? Fax machines. Email threads. PDF attachments. How most platforms handle law enforcement data requests hasn’t changed in 20 years. Let’s talk about why. Kodex Team Kodex Published February 6, 2025 #### Decipher Security Podcast Interview with Kodex CEO Matt Donahue Matt recently joined the Decipher Security podcast with host Dennis Fisher and Nick Selby, a seasoned CISO and law enforcement officer, to discuss the challenges organizations face when responding to data requests and how companies can address them. One of the greatest challenges for organizations is verifying that requests come from legitimate law enforcement officers. Matt, Dennis, and Nick talk about why email verification isn’t enough and how Kodex solves that challenge for its customers. Listen to the rest of their discussion using the links below. - Spotify - Apple Podcasts Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex Builds the AI Rails for Government Data Requests Source: https://www.kodexglobal.com/blog/kodex-builds-the-rails-for-government-data-requests News ### The Infrastructure Behind Every Government Data Request Kodex’s second Global Keynote unveiled AI request processing and system-to-system intake for government data requests. See how it works. Kodex Team Kodex Published June 30, 2026 BOSTON, June 30, 2026 — Every day, law enforcement and government agencies ask private companies to hand over data those companies hold about their users. Account records, communications, location history, the most sensitive information an organization keeps. Today Kodex unveiled the infrastructure that carries those requests: a structured, automated, and verified rail that moves a request from the moment a government submits it to the moment a company is ready to respond. The announcement came at the company’s second Kodex Global Keynote and closed with the global premiere of The Call, the first Kodex original documentary, on a real case the network helped solve. Last quarter, Kodex named the network: 15,000 agencies and 150,000 verified investigators, one trusted place where agencies and companies exchange data. Today is about what runs underneath it. For years, a government request landed and a person at the company read it, interpreted it, found the data, and sent it back, one step at a time, by hand. Kodex is now the infrastructure that carries the full lifecycle. The request gets to the right place, gets understood, and gets acted on, with verification of who is asking underneath every step. This is a consequential category, and a contested one. The volume of government requests for user data climbs every year, and the expectation is that companies respond fast. At the same time, AI has made it cheaper and more convincing to fake one. Kodex’s own threat intelligence has tracked compromised government email accounts, forged court orders, and fraudulent requests sold as a service, all aimed at tricking companies into handing user data to people posing as law enforcement. “Government requests for user data are growing, and getting faster isn’t optional,” said Matt Donahue, co-founder and CEO of Kodex. “The only real question is whether they move on infrastructure you can verify and audit, or on fax machines and email from someone you can’t confirm. We built the rails.” Reading the request, automatically. With AI Structured Data, Kodex reads an inbound request, extracts the data it asks for, and validates and structures it as it comes off the document. The first hour of an analyst’s day, the manual read and triage of a document that can run to hundreds of pages, now happens before anyone opens it. AI Structured Data launches for the US market, in English. The front door, automated. With Intake Bridge, government systems hand requests to Kodex directly, system to system, already structured, with no human at the entrance on the submission side. The first place it goes live is the EU’s e-Evidence Regulation, which sets binding requirements and response times for cross-border requests and applies from August 18, 2026. Kodex operates an established secure channel for these requests under the Regulation. As EU member-state platforms come online later this year, Kodex customers connect through the intake process they already use. Bring your own AI. Kodex previewed a Kodex MCP server that lets a company’s own AI agent work the rail directly: find new requests, look up the data they ask for, prepare a response, and stage a case, through controlled, scoped, and auditable tools. Every agent action is logged and marked as agent-driven. Enterprise customers asked Kodex to connect their AI agents to the network rather than build the plumbing themselves. The capability is forward-looking and not yet generally available. The company still decides. None of this releases data on its own. The infrastructure verifies the requester, structures the request, and prepares the response, and a person at the company reviews it, decides what to produce, and approves every send. “The system understands the request, finds the data, and prepares the response,” said Jesse Goodman, VP Product Delivery at Kodex. “But the person at the company still decides what gets produced and still hits send. The infrastructure does the work. The human makes the call.” The same verification that prepares a request, applied continuously to every requester, is also what protects users from the fraudulent requests Kodex’s threat intelligence tracks every day. The keynote closed with The Call, a documentary short on a real case the network helped solve. ##### About Kodex Kodex operates the Kodex Global Network, the verified network for law enforcement data requests, connecting 15,000 agencies and 150,000 verified investigators with the companies that hold the data they request. Learn more at kodexglobal.com. ##### Media contact marketing@kodexglobal.com Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex Joins IVAN to Disrupt Illicit Virtual Assets Source: https://www.kodexglobal.com/blog/kodex-joins-ivan News ### Joining the Fight to Disrupt Illicit Virtual Assets Kodex is an official partner of the Illicit Virtual Asset Notification (IVAN), a public-private effort to detect and disrupt illicit crypto. See how. Kodex News Kodex Published June 15, 2026 Kodex is now an official partner of the Illicit Virtual Asset Notification (IVAN) public-private partnership. It’s a natural step for us, and it’s worth explaining why. Illicit money moves quickly through virtual assets. The people chasing it, investigators in government and the compliance and intelligence teams inside companies, often hold different halves of the same picture. One side sees a wallet tied to a case. The other sees the activity running across its platform. Neither can act fast on what the other knows, because there has never been a trusted, structured way to share it. That gap is where ransomware operators and fraud networks live. IVAN exists to close that gap. It’s a first-of-its-kind effort that brings government and industry together to identify and disrupt the use of virtual assets in illicit activity, and to share what each side sees in a way both can trust. The partnership is stewarded by MITRE as its trusted third party, and it reflects a whole-of-government collaboration rather than the priorities of any single agency. Members announced their involvement in a press release in October 2024. Joining is a natural extension of what Kodex already does. Kodex is the network where law enforcement data requests get handled the way they should: agencies send legally valid requests, companies verify who is really asking, and both sides keep an accountable record of what happened. The hard part has never been the data. It’s the trust between the two sides, and the structure to act on it quickly. That’s the same problem IVAN is solving, on one of the highest-stakes fronts there is. “I spent years on the other side of this problem, watching investigations stall because there was no trusted way for government and industry to share what each side already knew,” said Matt Donahue, founder and CEO of Kodex. “IVAN is the kind of collaboration that should have existed a long time ago. Kodex was built to make this work, and we intend to do our part.” Trust between government and industry isn’t a nice-to-have in this category. It’s the thing that decides whether a lead becomes a case. That’s the work IVAN is built for, and it’s the work Kodex was built for too. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex Global Keynote March 2026: Real-Time LE Verification Source: https://www.kodexglobal.com/blog/kodex-keynote News ### Kodex Global Keynote | March, 2026 From broken fax-based workflows to real-time verification, Kodex is redefining how law enforcement and companies exchange data securely. Matt Donahue Founder/CEO @ Kodex Published March 26, 2026 #### The Network March 25, 2026 Law enforcement intelligence used to be a human business. Investigators knew their contacts. Relationships were local. When you needed something, you called somebody. That world is gone. Today, everything that matters lives inside private companies, and every investigation that touches digital life requires a data request to one of them. Often several. Often across borders. There is no standard for how those requests work. No shared process. No verification system. Investigators send subpoenas by fax and email to companies that have no way of confirming who they are. Companies receive urgent requests from addresses they don’t recognize, for data they’re not sure they should hand over. The result: sensitive data gets compromised. Trust and safety teams are permanently underwater. And the people committing crimes online operate with the confidence that the system can’t keep up with them. This is why, in 2021, I left my job at the FBI to found Kodex. And today is the most important day for this company since then. Here’s what we announced in today’s Kodex Global Keynote. #### Kodex Global Network Over the last four years, Kodex has quietly built the largest verified law enforcement network in the world. More than 15,000 agencies across six continents. More than 150,000 individual investigators, each one verified and continuously monitored. On the other side, the private companies receiving and responding to their requests, including Coinbase, Stripe, and AT&T. Today, we’re formally naming what this is: Kodex Global Network. It is the world’s only continuously verified law enforcement network. Every investigator credential is validated. Impersonation attempts are detected and stopped in real time. Compromised accounts are flagged before they can be used. All of this is powered by a dedicated threat intelligence operation that has been running since the day we launched, led by my co-founder Brian Donahue. His team’s monthly Threat Intelligence Newsletter has become one of the most forwarded documents in the industry, because nobody else is doing this work at this scale. Kodex Global Network is not a product. It’s the infrastructure underneath everything we do. It’s the reason law enforcement agencies trust us enough to send their most sensitive requests through Kodex, and it’s the reason companies trust us enough to respond to them. Every product Kodex has ever shipped sits on top of this network. And the two products we’re announcing today extend it in ways we’ve been working toward since the beginning. #### Kodex Verify Until now, the intelligence behind Kodex Global Network has been mostly invisible to the market. If you were a Kodex Core customer, you benefited from it every time a request came through verified and clean. But you didn’t see the underlying work. If you weren’t a customer, the only window was Brian’s newsletter: a monthly PDF summarizing the threat landscape. Incredibly valuable, but still just a snapshot. Kodex Verify changes that. It’s a standalone platform, live today at verify.kodexglobal.com, that gives you direct access to the intelligence and verification capabilities of Kodex Global Network for the first time. The core use case is straightforward: you get a request from someone claiming to be law enforcement. You check their email against the network. In seconds, you know whether they’re verified or not. That alone solves a problem that most trust and safety teams are still handling manually, if they’re handling it at all. But Verify goes well beyond single lookups. The Threat Intelligence Newsletter is now a live feed inside the product, continuously updated with emerging threats, compromised credentials, and patterns across the network. You can set up alerts for changes that affect you. You can see analytics on verification trends, search volume, top agencies and jurisdictions. You can invite your team and get visibility into how your entire organization is handling government requests. Kodex Verify is free. There’s a paid tier for teams that need real-time monitoring, deeper analytics, and organizational visibility, but the core verification and threat intelligence capabilities cost nothing. Access is restricted to companies with verified domains. This is a security decision, not a marketing one: the intelligence in Verify is sensitive, and it has to stay out of the wrong hands. If you’re a current Kodex customer, you have access today. If you’re not, you can request it and we’ll get back to you within 24 hours. #### Sign In with Kodex Kodex Verify gives companies access to the network. Sign In with Kodex lets them build the network into their own platform. A lot of our customers operate their own portals for handling law enforcement requests. Many already integrate with our verification API to pull investigator data into their workflows. Sign In with Kodex takes that further: - Any company can embed a single button into their portal, intake form, or whatever system they use. When a law enforcement officer clicks it, their credentials are authenticated against Kodex Global Network in real time. - The company gets verification data back immediately: who the investigator is, what agency they’re with, whether they’re verified. No manual lookup, no email chains, no guesswork. The analogy is Sign In with Google, except the thing being verified isn’t an email account. It’s a law enforcement officer’s identity and authority. For companies that process hundreds or thousands of government requests, this collapses what used to be days of back-and-forth into a single click. Sign In with Kodex is available now. If you’re interested, reach out to your Kodex representative and we’ll get you set up. #### What this means Four years ago, we set out to build a trust layer between law enforcement and the private sector. That trust layer is now live, global, and growing. 15,000 agencies. 150,000 investigators. Defended by a threat intelligence operation that doesn’t sleep. With Kodex Global Network, we gave that infrastructure a name. With Kodex Verify, we made the intelligence inside it accessible to anyone who needs it. With Sign In with Kodex, we made it embeddable anywhere. Three announcements, one argument: this industry finally has a standard. We showed all of it at our first ever Kodex Global Keynote earlier today. The full product demos, the story behind the network, and a few stories from the field that I think will stay with you. I’d encourage you to watch it. The network keeps getting bigger. The intelligence keeps getting sharper. We have a lot more to share in the months ahead. Watch the Kodex Global Keynote: kodexglobal.com/keynote Try Kodex Verify: verify.kodexglobal.com Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex Partners with Financial Crime Investigators (IAFCI) Source: https://www.kodexglobal.com/blog/kodex-partners-with-iafci News ### A New Partnership for Financial Crime Investigators Kodex is partnering with the IAFCI, connecting the investigators, banks, and fraud teams already responding to financial crime. See how. Kodex Team Kodex Published June 18, 2026 The IAFCI’s members are the two sides of the Kodex network: the investigators who request data, and the companies that respond. Kodex is partnering with the International Association of Financial Crimes Investigators. It’s a natural fit. The people the IAFCI brings together are the same people Kodex was built to connect. The IAFCI has spent more than fifty years bringing those groups into one room. Founded in 1968, the association is roughly a third law enforcement, a third banking, and a third retail and service. Its members trade what they know about financial fraud, how to investigate it, and how to prevent it. That membership maps almost exactly onto the two sides of the Kodex network. Financial crime moves across that divide constantly. An investigator working a fraud case needs records from a bank. The bank’s team needs to know the request is real, and legitimate, before they hand anything over. Too much of that exchange still runs on email, fax, and trust nobody can verify. It’s slow for the investigator and risky for the company, and the people committing the fraud count on both. That’s the gap Kodex closes, and it’s the gap the IAFCI’s members live in every day. Together, we’ll bring the network closer to the investigators and institutions who do this work. The work of responding to financial crime has always depended on investigators and companies trusting each other enough to move fast. This partnership puts that trust on better footing. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Combo Search, Analytics Dashboard: Kodex April 2025 Source: https://www.kodexglobal.com/blog/kodex-product-update-april-2025 Product ### April 2025 Product Update: Combo Search & Analytics Dashboard Combo Search, the Analytics & Insights dashboard, and expanded self-service settings. See what shipped in April. Kodex Team Kodex Published April 14, 2025 #### What’s New ##### Combo Search, find what you need faster A powerful new way to search right from the homepage: one enhanced free-text search bar to start quickly, smart filters and preset options to narrow results with a click, and all the flexibility of advanced search seamlessly integrated for complex searches. ##### Analytics & Insights Dashboard, smarter decisions and trends A new view of your operations. Track trends like volume and response times, monitor active requests and action items at a glance, and surface high-level KPIs for your team or execs. Flexible filters by timeframe, agency, case nature, jurisdiction, and request type let you slice the data across individual organizations or in a unified view. ##### Self-Service Features: Key Organization Settings The Self-Service Hub now gives you more control over how your organization operates: attachment storage locations and data retention period, minimum due date settings, and applicable requester jurisdictions and NDO workflow. Set it once and manage at your pace, no tickets needed. #### Coming Soon - Kodex API Enhancements: Improved technical documentation and new self-service API endpoints for account lookups and data production attachments. - Agent Case Sharing: Enable multiple vetted law enforcement agents to securely access and collaborate on specific requests. - Reimbursements: Enhanced reporting and notifications for tracking reimbursement collections and payment statuses. - Target Revamp: A redesigned UI for target submissions and internal reviews, supporting structured data collection, automated lookups, and faster investigations. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Data Retention Controls, Alerts: Kodex Aug 2025 Update Source: https://www.kodexglobal.com/blog/kodex-product-update-august-2025 Product ### August 2025 Product Update: Data Retention Controls & Alerts Enhanced data retention controls, reporting updates, and verification timeline alerts. See what shipped in August. Kodex Team Kodex Published August 19, 2025 #### What’s New ##### Enhanced Data Retention Controls (launching August 28) A new setting lets you control retention separately for your team and for law enforcement. Keep productions accessible internally for as long as you need, while setting a shorter access window for law enforcement agents to view or download files. Find it under Settings > Organizational Settings > Request/Document Type Retention. ##### Reporting Updates Case Assignments is now available in the Data Insights module, enabling smart capacity planning and balanced case allocation. Add filters for Analyst Name, Jurisdiction, Case Nature, Legal Process, Request Type, and Request Status (filters persist when leaving the page), and compare team assignments and completions by time period or legal process type. Median response time now displays in hours instead of days across UI charts and exported reports, for greater precision and alignment with industry and regulatory standards. ##### Verification Related Timeline Updates It is now easier to see when a law enforcement agent’s verification status changes on active requests. Alongside timeline notifications, assignees of those requests are emailed. When an agent’s “Verified for EDR” status changes, a timeline event is created on each active Emergency request they created; when status, substatus, or status reason fields change, a timeline event is created on each active request they created. #### Coming Soon - Targets 2.0 analyst UI: Expected the first week of September for power-user testing, with a refreshed design that makes it easier to edit targets, perform bulk actions, and label target IDs. - New integration, Hummingbird Case Creation: Automatically or manually create Hummingbird cases from Kodex to support deeper investigations. - Self-Serve Company Profile Editing: Edit your company profile as it appears to law enforcement directly in the Self-Service Hub. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex Product Update | August 2026 Source: https://www.kodexglobal.com/blog/kodex-product-update-august-2026 Product ### Kodex Product Update | August 2026 EU e-Evidence orders now arrive as Kodex requests, related requests surface on target selectors, new validation options, and curated agency signup. Kodex Team Kodex Published August 18, 2026 An order arrives from a Belgian prosecutor at 9pm on a Tuesday, cites an eight-hour deadline, and lands in a queue built for subpoenas measured in days. From 18 August, that stops being an edge case. Most of this release is about that date. The rest is a run of work on Targets that decides how much a search is worth before an analyst spends an afternoon on it, plus a change to how agents find their agency when they sign up. #### EU e-Evidence Regulation 2023/1543 requires that service providers can receive, review and respond to European Production Orders and Preservation Orders through a standardised interface from 18 August. The clocks are the part that catches people. An order can carry an eight-hour deadline, and it runs from when the order was issued rather than from when someone on your side noticed it. ##### How orders reach you before member states connect Not every member state will have its own system live on the 18th. Where one isn’t, authorities can sign in to Kodex directly and submit orders by hand. What lands in your queue is an ordinary Kodex request, with the e-Evidence fields, priority, emergency flag and non-disclosure handling already populated from the order itself. Deadlines come from the order’s priority rather than from whoever happens to open it. An eight-hour emergency order shows an eight-hour clock, and nobody has to work out the date by hand. The timeline carries a system entry summarising the order as it came in, so an analyst picking the case up cold can see what was asked for without opening the PDF. Saved searches, dashboard filters and exports all read e-Evidence fields now. You can route an emergency order to email, Slack or PagerDuty, and get a second alert two hours before it expires if it’s still open. The manual submission guide walks through what an authority sees on their side. This goes live on 18 August, and it’s enabled per organization, so if you haven’t talked to your CSM about setup yet, this is the week to do it. ##### The ETSI API, ready for testing The other path is machine to machine. Our ETSI-compliant API is built and waiting for member states to bring their own systems online. As each one does, orders will arrive over the standard interface and open in your queue with nothing rekeyed by anyone. If you expect volume across several member states, your CSM can get you testing against it now rather than in the week it matters. #### Targets Three changes to how targets get submitted and searched. Admins get two new ways to say what a usable submission looks like before it arrives, and analysts get a view of where a target has already turned up. ##### Seeing when a target already appears on another request You open a request and scan its selectors. One of them now carries a count in the Related Requests column, where previously nothing told you that another analyst had already worked the same email address on a different case. Click the count and you get a search view scoped to those matches, using whatever columns you normally work in. From there you pick. Tick the requests that are genuinely related, add them, and they appear in the sidebar with an entry on the timeline so the next person to open the case can see the connection and who made it. Nothing links itself, which matters when a shared selector is a coincidence rather than a lead. It’s enabled for power users today, and your CSM can turn it on for your team. ##### Deciding what makes a search worth running A name on its own returns thousands of records, which is not something an analyst can act on. You can now write that judgement into the product instead of catching it after the fact. Required selector combinations let you say which selectors have to travel together. Wallet address with transaction hash for crypto work, name with date of birth for social. Minimum identity confidence sets the same idea at the organization level: either one unique identifier such as an email address or account ID, or two non-unique ones such as a name and a date of birth. Neither rule blocks a submission. An agent who is missing something gets told while they are still in the form, and the gap is visible on the request before anyone starts work on it. Your CSM sets both up for your organization. ##### Choosing between an exact match and a broader one Target search now separates “is” from “is like”. Use “is” when you have the exact value and want only that. Use “is like” when you are working from a partial or slightly wrong selector and want close matches back as well. Previously you got one behaviour and had to infer which. This is on for everyone. #### For law enforcement and government requesters Everything above is for the providers who receive requests. This part is for the agencies sending them. ##### Finding your agency the first time Creating a Kodex account used to start with an empty box and your agency’s name. Enough people typed a slightly different version of the same department that a single police force could end up spread across a dozen records, none of which matched the one their colleagues were using. You now pick from the agencies already verified against your email domain, and your address is checked as you enter it. Adding a new agency is still there for the case where yours genuinely isn’t listed. It takes a deliberate step now, because that path sends your account for manual review. The reason to care is how long you wait at the start. Landing in the right agency makes your account eligible for automatic approval, rather than sitting in a queue until someone moves you across and closes the duplicate behind you. There is nothing to switch on, and it applies to everyone signing up now. #### In Case You Missed It July’s release brought live date filters and unread-comment filtering to advanced search, let analysts re-group target selectors after submission, added notifications for next action dates, and moved multi-factor authentication into the agent sign-up flow. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Submission 2.0 Rollout, VPN Checks: Kodex Dec 2025 Update Source: https://www.kodexglobal.com/blog/kodex-product-update-december-2025 Product ### December 2025 Product Update: Submission 2.0 & VPN Checks Company profile editing, timezone settings, VPN checks, agent suspension appeals, and the Submission 2.0 rollout. See what shipped in December. Kodex Team Kodex Published December 22, 2025 #### What’s New ##### Edit Your Company Profile (launched 12/17) Admins can now edit your organization’s agent-facing guidelines directly in Kodex. Go to Settings > Theme Settings > Company Profile, then click Edit to open the rich text editor. Supports simple and advanced formatting including links and Vimeo-hosted videos. ##### Timezone settings (including UTC) All date fields now display timezone in the UI. Starting in January, you can also choose a timezone for your organization that applies across all date fields so each user’s view is consistent (options include UTC, ET, PT, and more). ##### New VPN checks for agent signup and signin (agent-facing) Both agent signup and signin flows now detect VPN usage from law enforcement agents. If an agent is using a VPN, they receive a warning and can disable it before proceeding. ##### New agent suspension and appeals process (agent-facing) Qualifying agents who are rejected or deactivated now receive an automated email explaining the action, with a direct link to submit an appeal by re-applying online, without contacting you or Kodex support. Re-applications are reviewed by the Kodex verification team, and agents are notified of the decision. ##### Submission 2.0 live across English-speaking countries (agent-facing) Agent Submission 2.0 is now live for agents in the US, Canada, the UK, Ireland, Australia, and New Zealand. Remaining jurisdictions planned for January. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Transparency Reports, Settings Hub: Kodex Feb 2025 Source: https://www.kodexglobal.com/blog/kodex-product-update-february-2025 Product ### February 2025 Product Update: Real-Time Transparency Reports Timeline UI refresh, the Self-Service Settings Hub, and real-time transparency reports. See what shipped in February. Kodex Team Kodex Published February 16, 2025 We’re excited to launch three major enhancements this week, built directly from your feedback to make Kodex more intuitive, efficient, and flexible. #### What’s New ##### Timeline UI: A more intuitive, refreshed interface Analysts spend much of their time managing cases, yet outdated navigation slows them down. The refreshed timeline interface delivers better case navigation so your teams can work smarter. ##### Self-Service Settings Hub Configure key settings independently in real time, giving you even greater flexibility and control. Launching with tags and notifications, with customizations, storage, retention and agent form workflows coming soon. ##### Reporting & Insights Real-time, industry-standard transparency reports. The most commonly reported fields are now available in one place. Generate transparency reports with a single click. #### Who Benefits - Analysts: Work smarter with an enhanced UI and better case navigation. - Admins: Configure key settings in real time without dependencies. - Operations and Leadership: Generate transparency reports with a single click. #### What’s Next - Combo Search: A powerful homepage search combining an enhanced free-text search with existing advanced search capabilities. - New Insights Module: Expanded operational metrics and business intelligence for data-driven decisions. - More Self-Service Controls: Additional org-level settings for agent submission workflows, storage, and retention. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## NDO Preservation, Submission Blocking: Kodex Feb 2026 Source: https://www.kodexglobal.com/blog/kodex-product-update-february-2026 Product ### February 2026 Product Update: NDO Preservation & Submission Blocking NDO Collection for Preservation, invalid-submission blocking, localized date pickers, and smarter VPN handling. See what shipped in February. Kodex Team Kodex Published February 26, 2026 #### What’s New ##### NDO Collection for Preservation Requests A new setting lets you collect NDO (Non-Disclosure Order) details directly within the preservation request submission flow. When enabled, it adds a dedicated step to collect NDO information during submission and automatically sends reminder emails to law enforcement 1 to 10 days before expiration and again on the expiration date. Turn on under Settings > Form Settings > Enable NDO for Preservation Requests. ##### Block Submission When Target Data Is Invalid A new setting prevents request submission when invalid target information is entered, ensuring cleaner data upfront. The “Next” button stays greyed out until all target data meets your configured validation rules. ##### Rolled Out Localized Date Pickers for Agents & Analysts Localized date pickers are live for agents and analysts so date formatting stays consistent across the application. Formats adapt to each user’s locale. ##### VPN Handling Project Enhanced VPN handling in the Kodex Portal. The system detects logins from restricted networks and prompts qualified users to disable their VPN and retry instead of automatically rejecting access, reducing unnecessary rejections while maintaining strong security controls. #### Coming Soon - EU eEvidence Customer Briefing: A customer-only briefing on how Kodex is preparing for EU eEvidence and what it means for cross-border law enforcement response operations. - Agent Case Sharing: Lets agencies hand off cases themselves, with no manual transfers, sharing limited to active fully verified agents, and fewer delays from back-and-forth coverage. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Targets 2.0 Goes Global, NDO Queue: Kodex Jan 2026 Update Source: https://www.kodexglobal.com/blog/kodex-product-update-january-2026 Product ### January 2026 Product Update: Targets 2.0 Goes International Mark All as Read, NDO queue upgrades, homepage timestamps, and the Targets 2.0 international rollout. See what shipped in January. Kodex Team Kodex Published January 30, 2026 #### What’s New ##### Mark all messages as read in one go A new button at the top of all cases lets you mark all messages and comments as read in a single click, clearing the red-dot indicators. ##### New queue and statuses for NDO Enhancements to the NDO workflow for better request tracking and status accuracy. When a Completed request’s associated NDO either expires without action or is extended, the system automatically sets the request status to Reopened so it always reflects the current state of the NDO. Optional auto-tagging can mark reopened requests as “NDO Expired” or “NDO Extended,” and the tag is removed automatically once the request returns to Completed. This is configurable at the organization level, contact your CSM to enable. ##### Timestamps added to homepage Timestamps now show on the homepage so you can see exactly when a request was created, updated, and more. Especially helpful for prioritizing time-sensitive investigations. ##### Rollout of Targets 2.0 internationally (1/20) Agent Submission 2.0, the updated flow designed to capture more accurate target information upfront, is now live for all agents internationally. #### Coming Soon - Localized date pickers for agents and analysts: Launching in February, supporting locale-aware formats. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex API, View as Law Enforcement: July 2025 Update Source: https://www.kodexglobal.com/blog/kodex-product-update-july-2025 Product ### July 2025 Product Update: Kodex API & View as Law Enforcement View as Law Enforcement, reimbursement insights, the Kodex API and Developer Center, and case assignments. See what shipped in July. Kodex Team Kodex Published July 11, 2025 #### What’s New ##### View as Law Enforcement You can now see what law enforcement sees when logging into Kodex, on your overview page and your customized legal request process form. Go to Settings > Theme Settings > Screen Previews to see more. ##### Insights into Reimbursements New tools to help you collect faster: automated notifications and follow-ups for outstanding payments, plus a dashboard giving a clear view of incoming revenue and budget impact. You can now see how much you are actively getting back in dynamic Insights reports. ##### Unlock Possibilities with the Kodex API A new API workflow for target lookup and data production, along with a dedicated Developer Center to streamline implementation. Key benefits: - Efficiency: Automate routine tasks like selector lookup, “no data” filtering, and data packaging. Up to 30% of requests can be instantly resolved. - Accuracy: Minimize errors in file mapping and query construction, avoiding back-and-forth with law enforcement. - Security: Remove the need to download files locally, reducing insider-threat and unauthorized-access risk. - Compliance and auditability: A complete, traceable chain of custody through secure, immutable activity logs. ##### Case Assignments Now available in the Data Insights module, enabling smart capacity planning and balanced case allocation based on factors like risk, jurisdiction, and complexity, with deeper visibility into individual performance. #### Coming Soon - Targets 2.0: Smarter grouping, bulk uploads, and real-time data validation for law enforcement, plus a streamlined UI for analysts to edit targets, perform bulk actions, and label target IDs. - Strengthening the verification feedback loop: Clearer suspension reasons, real-time status change alerts, and new tools to help law enforcement resolve access issues quickly. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex Product Update | July 2026 Source: https://www.kodexglobal.com/blog/kodex-product-update-july-2026 Product ### Kodex Product Update | July 2026 July’s Kodex update adds relative-date and unread-comment search filters, post-submission target grouping, next action date alerts, and MFA at sign-up. Kodex Team Kodex Published July 16, 2026 This month sharpens how teams find and follow their requests. Search learns live date logic and unread-comment filters, analysts can re-group target selectors after submission, timed follow-ups now come find you, and multi-factor auth moves into the sign-up flow. ##### Advanced Request Search: Live Date Filters and Unread Comments The advanced search builder now understands relative dates like “is overdue,” “is today,” and “within” or “older than” a number of days, and re-evaluates them every time the search runs. Build a saved view like “overdue, two or more unread agent comments, unassigned” once and it stays accurate without editing. A new unread-agent-comment filter and a sortable unread-comments column round it out. Best for analyst teams who triage from saved searches and need to see what needs attention right now. Available to all customers. ##### Analyst Target Grouping Analysts can now re-group target selectors after a request is submitted: drag selectors between groups or out on their own, and create new groups directly from the Selector view. When an agent’s original grouping doesn’t line up, an analyst can fix it so searches return meaningful results instead of noise. Best for analysts cleaning up high-volume or inconsistent submissions. Available to all customers. ##### Search Within Large Selector Lists Requests with long target lists now have a search box built right into the selector table. Type a selector value, a selector type, or an identifier, and the list filters as you go: groups with a match stay in view, and collapsed ones expand on their own. Analysts checking that what law enforcement entered matches the legal process no longer have to fall back on the browser’s find. Best for analysts working high-volume requests. Available to all customers. ##### Next Action Date Notifications When a request’s next action date arrives, Kodex now sends an email and an in-app notification that links straight to the request, so NDO check-ins, Enforcing Authority notification windows, and other timed follow-ups don’t slip through. It works across every request type, not just eEvidence. Best for teams juggling waiting periods and scheduled follow-ups. If your team hasn’t set up a next action date field yet, your CSM can help. Available to all customers. ##### Multi-Factor Authentication at Sign-Up New agents are now prompted to set up multi-factor authentication as they create their account, and existing users without MFA get a periodic reminder to turn it on. The result: more requester accounts protected by default. Rolling out to all requesters. ##### In Case You Missed It June’s launches: Normalized Target Search, Bulk Target Submission, Prefer Not to Disclose Target Role, Enforce Produce / Do Not Produce, On-Demand Verifications, and the PagerDuty integration. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Bulk Targets, On-Demand Verifications: Kodex June 2026 Update Source: https://www.kodexglobal.com/blog/kodex-product-update-june-2026 Product ### June 2026 Product Update: Bulk Targets & On-Demand Verifications Normalized target search, bulk target submission, produce decision enforcement, on-demand verifications, and PagerDuty alerts. See what shipped in June. Kodex Team Kodex Published June 11, 2026 This month brings more accurate target search, more flexible submission, clearer per-target production decisions, and self-serve verification. Here’s what’s new. ##### Normalized Target Search Analysts can now match the same target across requests even when it was entered differently. Search normalizes case and formatting, so an email written as BadApple@gmail.com and badapple@gmail.com resolves to one target, and phone numbers match across formats. It all runs against encrypted data, so connecting the dots never exposes it. Best for analysts working across high request volumes. ##### Bulk Target Submission Agencies sending large requests can upload many targets at once and group them, so a request with hundreds of selectors stays organized from submission through review. We built it first for the highest-volume requesters. Contact your CSM to enable it. ##### Prefer Not to Disclose Target Role When submitting a target, requesters can now select “prefer not to disclose” for the target’s role instead of being required to choose one. That keeps a submission moving when the role isn’t known or can’t be shared, rather than forcing an inaccurate label. Best for requesters who can’t always specify a target’s role. ##### Enforce Produce / Do Not Produce Analysts record a produce or do-not-produce decision on each target, and Kodex enforces it through data production, so every request carries an explicit, auditable record of exactly what was shared and what wasn’t. Customers turn this on themselves under Settings, then Organizational Settings, then the target section. Best for teams that need defensible, per-target production decisions. ##### On-Demand Verifications Enterprise teams can request agent verifications on demand, by jurisdiction and service tier, with fulfillment running through the existing reverification flow. It replaces the back-and-forth of one-off verification requests. Rolling out to select customers now, so talk to your CSM about access. ##### PagerDuty Integration Customers can now route Kodex request alerts to PagerDuty, so the right on-call responder is paged the moment a new law enforcement request arrives instead of waiting in an inbox. See the setup guide to turn it on. Best for teams with on-call rotations who can’t afford to miss a time-sensitive request. ##### In Case You Missed It May’s launches: Accepted Request Sources, Jurisdiction-Based Access, and assigning requests across multiple organizations. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Faster Law Enforcement Agent Sign-Up: Kodex May 2025 Source: https://www.kodexglobal.com/blog/kodex-product-update-may-2025 Product ### May 2025 Product Update: A Faster Agent Sign-Up Experience A faster law enforcement agent sign-up experience: better data collection, mobile-friendly entry, quicker verification. See what shipped in May. Kodex Team Kodex Published May 6, 2025 Law Enforcement Agents have a new sign in flow. Take a scroll to see what it looks like and the benefits of this update on verification and ease of use. The new Kodex Account Signup flow — Agency Verification step #### Introducing a Faster, Smarter Law Enforcement Agent Sign Up Experience ##### Enhanced Data Collection for Stronger Verification We’ve introduced a more structured data intake process to improve the accuracy and completeness of information collected during signup. Capturing key details like agency address, fingerprint ID, language preference, and role expertise strengthens our ability to verify the legitimacy of government officials — and supports ongoing monitoring to detect any anomalous behavior over time. ##### Improved Efficiency and Clarity Law Enforcement Agents will find a redesigned signup flow that is more intuitive than before. Errors are flagged in real time, steps are easier to follow, and the password setup and reset process is much clearer. ##### Mobile-Friendly Entry Point It is now easier to start the signup process from a mobile device by entering an email to receive clear instructions for completing registration on a desktop or laptop. To note when on mobile devices, Safari works best. The redesigned Agent Details step with structured data collection #### Helpful Tip: Update Your Training Materials We realize this may impact your outreach materials, training or support comms with agents so we wanted to let you know. Find a new deck here that you can reference with new screenshots that outline the flow for agents. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Next Action Dates, Jurisdiction Access: Kodex May 2026 Source: https://www.kodexglobal.com/blog/kodex-product-update-may-2026 Product ### May 2026 Product Update: Next Action Dates & Jurisdiction Access Next Action Date, Date & Time custom fields, accepted request sources, jurisdiction-based access, and multi-org assignment. See what shipped in May. Kodex Team Kodex Published May 15, 2026 This month’s updates focus on helping teams better manage request intake, streamline access and follow-up workflows, and support more structured operational processes across organizations. #### Better Request Tracking ##### Next Action Date, available to filter in Dashboard A new internal field to help your team stay on top of follow-ups. Set a future date for when you need to revisit a request or check in with an agent about an NDO. Best for teams managing NDO follow-ups, pending clarification, or requests that require future action. ##### New Date & Time Custom Field Capture a specific time as a custom field, ideal for logging when an event occurred on a request. Best for incident-based workflows where precise event timestamps matter. #### More Admin Control ##### New Self-Serve Setting: Accepted Request Sources Admins now control who can submit requests to your organization(s). In addition to law enforcement agencies, you can accept requests from law firms, government-funded legal defense (public defenders), government-funded task forces, and debt collection agencies. Update under Settings > Form Settings > Accepted Request Sources. ##### Jurisdiction-Based Access to Team Members Control which requests each team member can access based on the jurisdictions they handle. Default access remains all jurisdictions. Configure under Settings > User Management > Account Access. #### Easier Multi-Entity Management ##### Assign Requests Across Multiple Organizations Assign requests across multiple organizations to manage them across entities. Select the checkbox next to each request, then click Assign Requests. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Agent Submission 2.0, Macro Templates: Kodex Nov 2025 Source: https://www.kodexglobal.com/blog/kodex-product-update-november-2025 Product ### November 2025 Product Update: Agent Submission 2.0 Rich text macro templates plus Agent Submission 2.0 with smarter law enforcement request intake and bulk uploads. See what shipped in November. Kodex Team Kodex Published November 21, 2025 #### What’s New ##### Macro Template Update (launched November 13) A small but mighty update to macro templates. There is now a rich text option so you can add bold, italics, and links to your macro template messages. Navigate to Settings > Organizational Settings > Comment Variables and Templates. ##### Agent Submission 2.0 (agent-facing) A redesigned request form built to capture more accurate target information upfront, making review easier and faster for your team. Rolling out to all U.S. agents first, with additional regions to follow. - Smarter intake: Qualifying questions guide agents through target submission, explaining the role of targets and tailoring the flow to the data they have, encouraging more complete submissions. - Grouping: Selectors are grouped by target type (for example Suspect vs Victim) for more structured data, surfaced in the Targets 2.0 UI. - Built-in validation: Real-time checks confirm valid formats for emails, phone numbers, and other identifiers. Invalid entries are flagged but do not block submission. - Bulk uploads: Agents can upload 10+ targets at once with automatic validation, instead of relying on attached PDFs or spreadsheets. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Targets 2.0, Custom User Notices: Kodex Oct 2025 Update Source: https://www.kodexglobal.com/blog/kodex-product-update-october-2025 Product ### October 2025 Product Update: Targets 2.0 & Custom User Notices Custom user notice subjects and Targets 2.0: redesigned table, bulk actions, and target summaries. See what shipped in October. Kodex Team Kodex Published October 10, 2025 #### What’s New ##### Customize Subject for User Notice You can now create custom subjects for User Notice by editing the User Notice macros you already have. The same variable fields work too. For the subject line to appear, select email as the medium and “notify users” as the action. ##### Targets 2.0: Review Targets with Greater Efficiency A refreshed experience that makes reviewing and managing targets easier, built from your feedback and designed to help meet transparency and reporting requirements. - Redesigned Targets Table: A detailed view of all target selectors submitted with a request, with their identifiers, statuses, and available actions in one place. - Smarter selector and identifier management: New buttons to add selectors and identifiers in one go, plus more flexibility to edit selectors or identifiers. - Bulk actions for common workflows: Select multiple selectors at once to add identifiers, mark “Does Not Exist,” copy, or delete. - Target Identifier View: A detailed look at selectors tied to each identifier, with key fields for internal tracking and external reporting. - Targets Summary: A high-level view of selectors and identifiers across a request, including counts from external vs internal sources and production outcomes, tying directly into Transparency Reports. #### Coming Soon - Redesigned Targets submission process: improved grouping by user (Suspect vs Victim), enhanced data validation, and bulk uploads of specific target types. - Edit Your Company Guidelines: A new Theme Setting to edit law enforcement guidelines as policies change, with a rich text editor, links, and embedded photos and videos. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex Product Update | October 2026 Source: https://www.kodexglobal.com/blog/kodex-product-update-october-2026 Product ### Kodex Product Update | October 2026 Request Scoring for every customer, Allowed Jurisdictions, self-serve Slack, automatic acknowledgments, e-Evidence updates, and file hashes for agents. Kodex Team Kodex Published October 22, 2026 Request Scoring is on for every customer this month, and admins can now set which countries’ agencies may send them requests and connect Slack themselves, without going through Support. For EU e-Evidence, notified orders are easier to spot and fewer standard requests arrive flagged as e-Evidence by mistake. Agents get a file hash they can copy straight into their case notes. #### Working the queue Changes for the analysts who work requests every day. ##### Request Scoring, now for every customer Every request in your queue now carries a priority of Critical, High, Medium, or Low, with a plain-English reason next to it. Hover over a priority to see which factors drove it. Admins set how much each factor counts with weighting sliders, and a preview shows how the queue would reorder before anything is saved. Teams that accept requests from the United States can also weight by the agency’s jurisdiction state. Your dashboard sorts by priority, so the most urgent requests rise to the top. After a limited launch in September, scoring has been on for all customers since October 8, with default weights that work without any setup. Admins can turn scoring on or off for their organization. Priority scores and their breakdowns are also available in the Kodex API. Read more in the Kodex docs. ##### A redesigned in-app notifications panel The Notifications panel, which you open from the left-side menu, has been redesigned. Notifications are grouped by the day they arrived, newest first, and each one shows the request number, the type of update, the time it arrived, and a short description of what happened. Switch between All and Unread to catch up quickly after time away. Open a notification to go straight to its request, dismiss one at a time, or mark them all as read. See “Viewing In-App Notifications” in the Kodex docs for everything that changed. ##### Clearer country fields in search, columns, and exports Search filters, dashboard columns, and exports now use the same names for the same data, and clearly separate two fields that were easy to mix up: Requestor Country, where the requesting agent is located, and Requestor Jurisdiction Country Code, the country of the agency’s jurisdiction. #### Admin controls New settings admins can manage for their own organization, and one that Kodex Support sets up for you. ##### Choose which countries can send you requests Admins can now decide, country by country, which agencies are allowed to submit requests to their organization, with no ticket to Kodex Support. Allowed Jurisdictions replaces the old Allowed Request Location dropdown and its fixed bundles. Pick countries from a searchable list, select a whole region (AMER, EMEA, or APAC) at once, or allow everyone and block a few. A preview such as “40 of 195 jurisdictions are allowed” shows the result before you save. Your current setting has carried over. If you manage more than one organization, each one keeps its own setting. Agents from a jurisdiction you haven’t allowed see a message telling them they aren’t authorized to submit to you. Only admins can change this setting. Find it under Settings → Form Settings. ##### Connect Slack yourself, and move to the new Kodex Slack app by December 31 Admins can now connect Slack to Kodex straight from the portal and decide which notifications go to which channels from the Integration Settings page, with no ticket to Kodex. Use Quick add for a simple rule or Advanced rule for a more specific one. Rules set on a parent organization now apply to its child organizations as well. If your team already gets Kodex notifications in Slack, move to the new app by December 31, 2026. After that, Kodex will no longer support the old integration. To migrate: - Choose the channels you want notifications in. Your team must own each one, so if Kodex owns your current channel, create a new one first. - Connect the new Kodex Slack app from Integration Settings, then invite it to each channel with /invite @kodex. You may need approval from your Slack admin. - Send a test notification from Integration Settings and confirm it arrives. - Remove the old app, which now shows as “Kodex (Legacy)”, and any Kodex users who were added to your channels. Read the Slack integration guide. Questions? Email help@kodexglobal.com. ##### An automatic acknowledgment when a request arrives Kodex can now post a message on new requests automatically, such as “We’ve received your order and it is being processed.” The message appears in the request’s activity about 30 seconds after the request comes in, and the requesting agency is notified just as if someone on your team had commented. You choose which requests get it, for example every e-Evidence order or only subpoenas. It never changes the request’s status, and each request gets one message at most. To set it up, contact help@kodexglobal.com. Read more about request rules. #### EU e-Evidence Two months into live orders, this month’s e-Evidence changes make notified orders easier to spot and catch mis-flagged submissions earlier. ##### EA Notified, at a glance Requests where the Enforcing Authority has been notified now carry an EA Notified chip next to the e-Evidence deadline. It’s also a dashboard column you can sort and filter on, and an Advanced Search filter. ##### Fewer submissions marked e-Evidence by mistake When an agent marks a manual submission as a European Production Order or European Preservation Order, they now confirm they’re attaching the signed Annex I or Annex II form before it goes through. That gives the agent a chance to catch a standard request flagged as e-Evidence by accident, before it reaches your queue. It builds on September’s change, which let analysts correct a mis-flagged submission themselves. Live since September 25, with nothing to configure. ##### An intake setting for e-Evidence-only teams If your organization only handles EU e-Evidence through Kodex, it can now be set to accept e-Evidence orders only. Agents submitting to you get e-Evidence forms, and other request types are turned away before they reach your queue. Contact your CSM to turn it on. #### Kodex API Additions and fixes for teams that integrate with Kodex. ##### More of the request in the Kodex API Internal notes can now be read and written through the Requests API. The list requests endpoint has new filters for request type, legal process, case nature, nondisclosure order, and assignee. Request priority scores and their breakdowns are available too (see Request Scoring above). A subsequent production sent through the API now updates the preservation request it follows: the preservation status changes, the timeline records it, and the production order is linked to the preservation request. Fixes. - Sending a large number of targets no longer returns an error. - Resending target lookups no longer creates duplicate entries. - Target lookups no longer fail when an organization’s types are inherited from its parent organization. - Older files can now be downloaded through the Kodex API following an encryption update. #### For law enforcement and government requesters Everything above is written for provider admins and analysts. This part is for the agencies sending requests in. ##### A file hash you can copy into your case notes Every document on your request now shows its SHA-256 hash in the Agent Portal, for files you send and files you receive. Copy the full hash with one click into your evidence log, and you have a record that the file hasn’t changed since it arrived. You’ll find hashes in View Documents on the request timeline and on the Documents tab. Older files that were uploaded before hashing was added don’t show the option. Agents asked for this in training sessions, where their own rules require documented evidence handling. ##### Confirm the signed form when you submit an e-Evidence order When you submit a European Production Order or European Preservation Order through the portal, you’ll now confirm that you’re attaching the signed Annex I or Annex II form. The provider receives the form with the order, so there’s less back and forth before work starts. ##### Find a request with part of a name or number You can now find one of your requests by typing part of the provider’s name or part of the request number. You don’t need the exact value. #### Coming soon Kodex MCP. We’re starting the beta program for the Kodex MCP, which lets customers connect their AI assistant to Kodex and work their queue with our new tools to support prioritizing requests, pulling request details and attachment metadata, and getting agent details on a request. Customer admins control which tools are enabled for their company. The current beta cohort is closed, but if you’re interested, reach out and we’ll send you the documentation. We expect to open sign-ups again in the near future. Faster request lists in the Kodex API. A new updatedSince filter on list requests will return only the requests that changed since your last pull, and a faster list implementation with the same search filters as the in-app request dashboard is rolling out. #### Resources The How to Use Kodex guides for the Request Portal, including the request management, notifications, Slack, and request rules pages linked above, are in the Kodex docs. #### In Case You Missed It September’s release brought a request audit log feed in the Kodex API, e-Evidence notifications routed by request type and legal framework, Form 3 auto-fill, legal framework on every export, and the how-to guides for the Request Portal. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → News ##### Kodex Global Keynote | March, 2026 March 26, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex Product Update | September 2026 Source: https://www.kodexglobal.com/blog/kodex-product-update-september-2026 Product ### Kodex Product Update | September 2026 A request audit feed for your SIEM, Form 3 auto-fill and secure delivery for e-Evidence, and how-to guides for the Kodex Request Portal. Kodex Team Kodex Published September 28, 2026 The e-Evidence regulation went live on August 18 and the first orders arrived within hours. Most of what shipped this month came out of that first month of live traffic. Alongside it, security teams get an audit feed they can wire into their own tooling, and the how-to guides for the Request Portal are live in the docs. #### Security and integrations One addition for the teams who watch how Kodex itself gets used inside your organization. ##### Request audit log feed in the Kodex API Your security team can now read every action taken on your requests through a pull-based endpoint in the Kodex API: who opened a request, who downloaded an attachment, who changed target data. Events carry a cursor, so a SIEM polls on its own schedule and picks up where it left off, and 90 days of history load when the feed is switched on. Request content stays out of the payload. A parent organization sees events across its child organizations. Best for security and compliance teams that want abuse detection, such as a bulk-download alert, running in their own tooling. Your CSM turns it on per organization, and the setup guide is in the Kodex API docs. #### EU e-Evidence, one month in The manual submission flow has been live since August 18. Admins got a rundown on September 10 of the first round of changes: notification preferences that filter on legal framework, with Slack alongside email and PagerDuty; converting a mis-flagged e-Evidence request back to a standard one; and blocking submissions from authorities in your own member state of establishment. The changes below came after that, from what analysts ran into with real orders. ##### Form 3 with less typing Your legal representative’s contact details are stored once and filled into Form 3 automatically. The Form 3 wording on the request has also been tightened up based on customer feedback. ##### Secure delivery for large productions For requests that arrive through the e-Evidence API, productions over 25 MB are delivered to the authority via a secure download link, as required by the API technical specifications. The download is logged against the recipient, so you can see who collected what and when. ##### Legal framework on every export A legal framework column now appears in search, transparency report, and Insights exports, so e-Evidence volume can be reported separately from the rest of your requests. #### Resources Documentation for the people who work the queue every day. ##### How-to guides for the Request Portal The first eight how-to guides are live in the Kodex docs, with a direct entry point from the docs home page. They cover the everyday work of the portal step by step, and pages on notifications and admin settings are on the way. Access is granted per user, so if the link asks you to sign in and you don’t have an account yet, ask your CSM. #### For law enforcement and government requesters Everything above is for the providers who receive requests. This part is for the agencies sending them. ##### Large files from EU providers arrive as a secure download When a provider responds through the e-Evidence API to a European Production Order with more than 25 MB of data, the response carries a link to a secure download page instead of an attachment. Enter your email to verify your identity and the files are yours. You don’t need a Kodex account. If you already have one, you’ll sign in with it, and if you don’t, you can create one from the same page. Each download is recorded, so there’s a clean record of who collected the production and when. #### Coming soon Request Scoring. Your queue sorted by what matters, with a plain-English priority on every request and weighting sliders your admins control. A limited launch with a small group of customers starts this month, with rollout to all customers shortly after. Kodex MCP. Connect Claude or another AI assistant to Kodex with your own Kodex login and ask it what to work on, or for a briefing on a request, without opening the portal. Read-only to start. A private beta opens this fall. #### In Case You Missed It August’s release brought EU e-Evidence manual submission, Related Requests on selectors and identifiers, required selector combinations and minimum identity confidence, clearer search operators, and curated agency signup for requesters. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → News ##### Kodex Global Keynote | March, 2026 March 26, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex Raises $10M Seed for Law Enforcement Response Platform Source: https://www.kodexglobal.com/blog/kodex-raises-10m-seed-delivering-the-only-complete-solution-for-law-enforcement-response Fraud · Product · News ### Kodex Raises $10M Seed for Law Enforcement Response Kodex raised $10M in seed funding to build the only complete law enforcement response platform — covering request verification, processing, and compliance. Kodex Team Kodex Published February 6, 2025 BOSTON, November 20, 2023 — Kodex, the only complete solution for law enforcement response, raised a $10 million seed round, led by a16z with participation from Tusk Venture Partners and other strategic investors (full list below). This brings the company’s total funding to $12 million to date. With the new investment Kodex is expanding global support for enterprise customers in more than 120 countries. The company is also hiring for roles in engineering, sales, and customer success. Prior to joining the FBI, Kodex founder Matt Donahue assumed something like Kodex already existed; namely, a standardized, secure, and transparent way for the public and private sectors to communicate. Instead, he saw behind the curtain and quickly discovered how difficult it was for companies to comply with legal obligations even when both sides are committed to the same thing – stopping abuse online and in the physical world. The breaking point for Donahue was when a counterterrorism investigation stalled because a social media company didn’t know how to appropriately or safely respond to his squad’s legal requests for sensitive information. “That case was incredibly eye opening for me,” said Donahue, founder and CEO of Kodex. “On the outside looking in, we were seeing a multi-billion dollar company trying to be obstructive, but in reality it’s a team of well-intentioned but under-resourced people working without modern tools. Data requests are the main part of a modern investigation and I just couldn’t let myself become numb to the fact that urgent requests for data in life or death situations could come down to the equivalent of fighting a fire with a squirt gun. Neither the company nor law enforcement want that.” #### Efficient Request, Response, and Compliance Procedures Each year, millions of data requests are sent from governments and law enforcement to companies who are legally required to respond. Currently, most data requests are sent through a combination of faxes, emails, and snail mail, making it difficult for companies to verify, track, and respond to requests securely and on time. The chaos created by bespoke and manual processes also makes it difficult for companies to document and prove compliance with applicable laws, including data protection and privacy regulations. This chaos is then perpetuated and compounded when every law enforcement officer from every agency has to learn each bespoke process; resulting in companies receiving invalid, broad, and poorly tailored requests. Kodex provides companies with an enterprise-grade solution to efficiently manage, and respond to, all the requests they receive, and puts the guardrails in place for law enforcement to do their job properly. Additionally, Kodex enables companies to customize their intake process, providing law enforcement guidelines in advance about the kind of data they do and don’t have (even apps owned by the same company vary in what data they collect and how it’s stored internally), the necessary legal process (e.g. warrant, subpoena, etc), and any company-specific information (e.g. user ID) required for a valid, legal request. This ensures the legal request is narrowly tailored for the proper information, rather than having to deal with overly broad requests. “Law enforcement data requests are currently managed through a patchwork of inefficient and often unsecure programs and processes, creating a drag on both public and private sector resources,” said Katherine Boyle, General Partner at a16z. “As former law enforcement officers, engineering, and security experts, the Kodex team is very familiar with the intricacies of this problem and how best to solve it.” “We are used to seeing clunky and outdated software on the government side, but when it comes to law enforcement response, the private sector has historically been in the same boat,” said Jordan Nof, Co-Founder and Managing Partner of Tusk Venture Partners. “Matt and the Kodex team have lived both sides of this problem and solved it with the platform they built.” #### Protection Against Fake Requests Criminals know that law enforcement agencies often have weaker security than the companies they want to exploit, so they target agency emails hoping to gain access to sensitive and personal data by impersonating law enforcement. While most companies lack the ability to protect against this threat because they rely solely on email verification for government requests, Kodex assumes you can’t trust the person operating the email inbox, even if the domain is legitimate. Instead, the company proactively runs a multi-step verification process for law enforcement accounts combining signals intelligence with technical controls commonly used by fraud detection, account security, and threat intelligence teams. Since launching in 2021, Kodex has identified and blocked requests from thousands of law enforcement imposters, while alerting agencies that their email domain has been compromised. When this happens, all Kodex accounts registered with that agency are suspended and must be reverified individually. #### Trusted Beyond Law Enforcement Requests Kodex is already used by LER and Trust and Safety teams across a wide range of industries including financial services and technologies, gaming, social media, dating apps, and web3. Whether a company needs to field inbound reports of platform abuse or legal requests from law enforcement, Kodex allows companies to easily and securely connect with verified third parties to safeguard their communities in digital and physical space. #### Seed Investors - a16z - Tusk Venture Partners - Govtech Fund - Y Combinator - Pioneer Fund - Sound Ventures - Thiel Capital - A-Star Capital #### About Kodex Kodex is the complete solution for law enforcement response. Every day, companies receive numerous subpoenas and summons for sensitive information, often adding up to tens of thousands of incoming requests each year. Each request must be processed and responded to in accordance with applicable laws and regulations. Kodex has solved this daunting challenge with a safe and robust portal built by a team of public safety, engineering, and privacy experts. Our solution is purpose-built to boost efficiency, trust, and peace of mind. Learn more at kodexglobal.com. Press Contact Press@KodexGlobal.com Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Kodex Sponsors Crypto Investigators in Africa, Latin America Source: https://www.kodexglobal.com/blog/kodex-sponsors-basel-institute-crypto-communities-of-practice News ### A New Ally for Crypto Investigators in Africa and Latin America Kodex is the inaugural sponsor of the Basel Institute’s Crypto Communities of Practice, backing investigators who trace illicit digital assets. See how. Kodex Team Kodex Published June 24, 2026 Kodex is the inaugural sponsor of the Basel Institute on Governance’s Crypto Communities of Practice in Africa and Latin America, backing the investigators who trace and recover illicit digital assets where support is thinnest. Kodex is partnering with the Basel Institute on Governance as the inaugural sponsor of its Crypto Communities of Practice in Africa and Latin America. It is a natural fit. The communities bring together the people Kodex was built to support: the investigators, prosecutors, and financial intelligence specialists who chase illicit crypto across borders. The communities are run by the Basel Institute’s International Centre for Asset Recovery (ICAR), and they are practitioner-led. They run on operational knowledge, investigative technique, and real case experience rather than classroom theory, and they give investigators what most capacity-building efforts do not: a trusted peer network, hands-on training, and the cross-border channels that jurisdictional friction usually blocks. The gap they close is the gap Kodex closes every day. Across both regions, the people working crypto cases often have the least access to specialized expertise, the right tools, and the international partnerships these investigations demand. Kodex connects the agencies that request data with the companies that hold it on one verified network, replacing email and fax with a system that confirms who is asking and moves legitimate requests in minutes instead of weeks. For investigators following assets that cross borders in seconds, that speed and certainty decide whether funds get recovered. Basel runs the communities; Kodex funds them and stays out of the way. Sponsors do not influence who takes part, what gets discussed, or where the work goes. That independence is the point, because a practitioner community is only worth as much as the practitioners trust it. Backing this work, in the regions where support is thinnest, is the same job Kodex does every day, from a different angle: helping investigators access data lawfully, efficiently, and across borders to counter financial crime, fraud, sanctions evasion, and other crypto-related offenses. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Law Enforcement Data Requests: Supply Chain Vulnerability Source: https://www.kodexglobal.com/blog/law-enforcement-data-requests-the-supply-chain-vulnerability-nobodys-talking-about Fraud ### Law Enforcement Data Requests: The Supply Chain Vulnerability Law enforcement data requests are now a supply chain attack vector — and most platforms aren’t prepared. Here’s what that means and what to do about it. Brian Donahue Head of Operations at Kodex Published February 6, 2025 Law enforcement and government agencies have always been an attractive target for criminal hackers. By stealing and using their credentials or spoofing government domains, criminals obtain a perception of authenticity that helps them social engineer businesses. Unfortunately, there has been an upward trend in public sector targeting for some time. A 2022 report from Lookout analyzed mobile data specific to federal state and local government entities, and found that almost 50% of phishing attacks aimed at government personnel in 2021 specifically sought to steal credentials, up from 30% in 2020. In 2024, law enforcement will become an even more attractive target, as threat actors gain awareness of the historical vulnerabilities that enterprises often overlook surrounding law enforcement requests for information. Business email compromise has long been a fan favorite for scammers to defraud their targets of money, information, data etc. and when bad actors learn that the only defense an enterprise has in this area is “good faith,” they see a target ripe for exploitation. Here are the key factors influencing the potential for an increase in attacks on law enforcement, and how to prepare and protect your organization. #### 1. Global threat actors are teaming up to target large corporations, governments and law enforcement. The bad guys have figured out that there is power in numbers - and opportunity for financial gain. By collaborating with other threat actors, criminal hacking groups can learn from one another, broaden their reach to sell stolen data, build their reputations, and recruit employed individuals with classified access or direct agency knowledge to build insider threat capabilities. The mafia-inspired Five Families consortium is just one example, but there are others. These groups are global—hailing from countries like Brazil, Romania, England, Czech Republic, Russia, Mexico, Canada, Germany, and the United States. They sell information from data breaches, especially logs containing law enforcement passwords. While their exploits tend to focus on large multinational corporations, the groups also include so-called hacktivists who often target law enforcement, political or judicial organizations or individuals, furthering the need for tighter cybersecurity among law enforcement (see number 2 below). Increased collaboration and sophistication among various threat actor groups could also mean a potentially broader scope for targets including smaller companies through increased social engineering efforts. In this environment, businesses of all sizes must take a close look at how they receive and respond to law enforcement requests to ensure they are verified as genuine. Additionally, service providers should consider introducing or enhancing behavior-based account security measures to ensure that simply having access to law enforcement credentials doesn’t guarantee the full range of account capabilities. This is especially important given the consequences of a company getting it wrong; it’s not just reputation risk, it’s data privacy compliance, user trust, and safety of human life. #### 2. Vulnerabilities in law enforcement security will be more exploited than ever. Investment in cybersecurity infrastructure and training has long lagged in the public sector, particularly in police departments and investigatory organizations. At the same time, their attack surface has increased as mobile devices, field work and communications all become more digitized and connected. Now criminal hackers have realized that credentials, sensitive information in case files, and other valuable data held by law enforcement agencies can be used very effectively as a trojan horse into a private corporation, or to launch ransomware or other attacks. Expect more frequent exploitation of bad security habits - particularly within law enforcement in developing countries - like password reuse, lack of 2FA and sloppy data security. Agencies everywhere should increase their investment in securing their network infrastructure and vulnerable endpoints. For companies, this means even more signals are needed to verify the validity of law enforcement data requests. Email domains are not enough to confirm that the person sending the request has authority to do so; standard operating procedure should be to not trust whoever is operating the inbox solely based on access to that inbox. Check with your company’s legal counsel on how to push back on requests that seem suspicious or lack proper legal process. #### 3. Criminal toolkits continue to expand faster than law enforcement’s ability to keep up. While law enforcement credential theft continues to be a popular way to gain entry to a corporation, other highly effective methods continue to evolve. For example, emergency data request (EDR) templates are sold over the dark web and crafted to manipulate recipients into participating in unauthorized data sharing, under the guise of immediate threat to life that withholding the data would cause. Mobile devices are another highly vulnerable attack vector. Indeed, unmanaged and outdated mobile devices are pervasive in law enforcement and the public sector. The Lookout analysis mentioned earlier found that “around 13% of devices used at the federal level are unmanaged, and a whopping 38% of devices at the state and local level are unmanaged.” And while mobile phishing is still highly effective and will continue unabated, their analysis found that the objective of phishing has shifted: “Malware delivery used to be the main event, but when it comes to targeting federal, state, and local governments, nearly half of all phishing attacks sought to steal credentials in 2021.” Phishing requests will expand to exploit various channels, including the insecure forms of mail, email, and fax, in an attempt to evade rigorous verification processes and behavior based account monitoring such as that offered by Kodex. Threat actors will continue to execute personalized phishing campaigns, posing as victims if needed, especially with companies commonly targeted by law enforcement requests. SIM swapping will emerge as another tactic to gain access to two-factor authentication (2FA) credentials of law enforcement email accounts. Agencies need to bolster 2FA security and explore more resilient authentication methods. Unmanaged and expired domains can also be used to impersonate law enforcement and government organizations, and we expect to see increased abuse of old domains. Law enforcement agencies should do a thorough inventory to secure old domains and implement robust measures against unauthorized access to live domains. As a result of these vulnerabilities, behavior-based account security becomes even more critical. Login credentials alone are not sufficient to protect against abuse by criminals using stolen (yet legitimate) law enforcement credentials and domains, especially given the sensitivity of data at hand. #### 4. Corporations and law enforcement will up their game in response to these rising threats. For too long, the vulnerable channel of communication between law enforcement and private corporations has been left wide open. Bad actors have taken note. In fact, in 2023, Kodex rejected more than 10% of verification requests because of association with identified threat actors, while thousands of signup attempts used email addresses from a previously rejected domain. Their methods included credential stuffing, and leveraging exposed email usernames or passwords linked to law enforcement officers from data breaches. This intensifying threat is one reason corporations and law enforcement alike increasingly rely on us to protect the integrity of the law enforcement response process. Through our Globally Verified Network, clients can confidently confirm the legitimacy of a request. No matter how resourceful or well capitalized a company is, they are more vulnerable when they operate alone in a silo . Our global network can gather behavior-based signals from across industries and geographies that no one company can access on their own. As a result, all companies who join Kodex help protect each other like a de facto herd immunity. When a law enforcement account is flagged as compromised, every company in our network is notified. In 2024, we’re already seeing a continued surge in verification requests, reflecting the growing adoption of our platform by law enforcement and the private sector’s increasing reliance on verification. We stand ready as a strategic ally for the private and public sectors to guard against these evolving threats and protect the individual privacy entrusted to these companies. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Reducing Friction for LERT Teams: Legal & Technical Advances Source: https://www.kodexglobal.com/blog/removing-friction-for-lert-teams-with-legal-and-technical-advancements Fraud ### Removing Friction for LERT Teams: Legal and Technical Advances LERT teams face friction at every step — from agent verification to data delivery. Here’s how Kodex addresses it legally and technically. Kodex Team Kodex Published February 6, 2025 It’s no secret that laws often lag behind the pace of technology. As criminals increasingly adopt the use of technology in their campaigns to harm others, the volume of law enforcement requests for data from private companies has increased exponentially. Meta’s most recent transparency report (for the year 2022) shows the company received nearly 500K requests regarding 800K+ accounts in 2022. Most companies don’t receive nearly this many requests, but each request, whether it be dozens or several thousand each year, must be carefully vetted and managed according to applicable laws. So both legal and technical advancements can help ease the burden on companies. On August 18, 2023 the European Council adopted a new law for cross-border access to electronic evidence (e-evidence). Originally proposed by the European Commission back in 2018, the regulation aims to ‘simplify’ access by law enforcement authorities to personal data held by private online service providers established in other Member States, by allowing such authorities to send requests directly to companies. There is a 3 year deadline for the law to be implemented. According to the Council, e-evidence refers to digital data, such as emails, text messages and traffic data, that is used to investigate and prosecute criminal offenses. Until now, the framework of judicial cooperation required law enforcement authorities to work through their counterparts in the EU country where the company is established in order to request access to the data. The council reports that cross-border requests are made in over 50% of all criminal investigations in the EU. The new directive also requires all service providers based outside the EU but that offer services within the Union to designate a legal representative within a member state. This legislation also establishes high standards for government access to personal data and creates a pathway towards greater alignment between the US and EU with regards to data sharing for government access. We built Kodex to assist companies in responding to data requests from global law enforcement, so customers don’t need to recreate the wheel with every new regulation. Our secure, configurable, intuitive platform makes it easier for law enforcement to send legal requests with the appropriate level of specificity, and for companies to respond based on their policies and relevant data protection laws. Ultimately, this new legislation improves agencies’ access to electronic evidence via legal process and is an important step forward for public safety in the EU. #### What this means for LERT teams The e-evidence regulation requires service providers to respond to law enforcement requests within 10 days for non-emergency cases and within 8 hours for emergencies including subscriber and identification data. Service providers then have up to 96 hours to provide any additional information requested for an emergency case. These tight deadlines are meant to significantly speed up investigation procedures and the law supports hefty financial consequences if companies don’t comply. As a result, many companies, with existing LERT teams, now find themselves under increased pressure to act quickly, while companies that do not have a dedicated LERT or legal compliance team face an even steeper path to adopt appropriate procedures and tools that enable them to comply with these new requirements. #### What this means for law enforcement In recent years law enforcement has become increasingly dependent on electronic evidence to investigate and prosecute criminal offenses. Today, nearly every crime involves some kind of e-evidence and it’s often very time consuming for authorities trying to access that data. Some friction is necessary, including legal process to ensure the requests are lawful. In some cases, local data protection and privacy laws may instruct companies to deny certain requests. But the communication process among agencies and with companies should be easy – and the new EU law is catching up to technical realities. With Kodex it’s easy for law enforcement to prove legal process to private companies and for those companies to receive all the information they need upfront to respond quickly to valid requests. Once verified, agencies can submit requests to multiple companies using our platform, track responses, and securely download the provided data. #### What’s next? Emerging laws, like the new e-evidence regulation often introduce new challenges and compliance risks for service providers. Kodex helps companies meet those requirements by providing a way to verify, process, and safely respond to information requests from law enforcement agencies and governments around the world. If you’re interested in learning more about the Kodex platform, let us know at kodexglobal.com/contact/ or follow us on LinkedIn at Kodex. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Revolut Breach: Day 5 Update | Kodex Source: https://www.kodexglobal.com/blog/revolut-breach-day-5-update News · Fraud ### Revolut Breach: Day 5 Update Day five of the Revolut breach: a claimed six-month operation through Italian law enforcement systems, a disputed 10,000 bitcoin demand, and what Revolut has confirmed. Kodex News Kodex Published September 15, 2026 The Revolut story is moving fast. Here is where things stand today. - A six-month operation, according to a new claimant. IAmNotAVillain says compromised Italian law enforcement systems were used to request Revolut customer records over several months. - Responsibility is disputed. The new claimant says a former associate received a small sample of the data and then took credit for the breach. - A reported demand for 10,000 bitcoin. People claiming responsibility have threatened further releases of customer information. Revolut has not confirmed the ransom amount. - 147GB of police data allegedly stolen. That figure refers to material reportedly taken from Italian law enforcement systems, separate from the Revolut records. - Nearly 700 customers notified. Revolut has confirmed the disclosure. The broader claims about the operation’s duration, police access and other companies remain unverified. The person now claiming responsibility for the Revolut breach says the operation lasted six months, involved access to several Italian law enforcement departments and yielded 147GB of police data alongside Revolut customer records. That account would substantially expand an incident first disclosed as fraudulent requests sent from a government email address. The claims remain unverified. Reporting on the six-month claim It also challenges the story that emerged over the weekend, when customer documents began circulating and a reported demand for 10,000 bitcoin became public. The new claimant, using the name IAmNotAVillain, says a former associate was given a small sample of the data and then claimed responsibility for the breach. Reported ransom demand, account of the competing claim That leaves two questions at the centre of the investigation: who obtained the records, and how much activity preceded the disclosure? #### Timeline - Friday, September 11. Revolut emails affected customers. The notice says the request “carried valid domain authentication credentials.” Confirmed. - Saturday, September 12. Revolut confirms to TechCrunch “a sophisticated external impersonation scam” through a government agency domain, and says systems and customer funds are unaffected. Confirmed. - Sunday, September 13. Customer documents appear on Telegram and X. A group posting as Revolut Smilik threatens “more and more data everyday.” Claim. - Monday, September 14. The demand is reported at 10,000 bitcoin. The ICO says it is assessing a report. Affected customers speak on the record. The demand is a claim; the ICO report is confirmed. - Tuesday, September 15. The count is put at about 680. The FCA confirms it is investigating. IAmNotAVillain claims six months inside Italian law enforcement systems and 147GB of police data, and says an associate took credit. Il Sole 24 Ore reports an interno.it address. The count and the FCA are confirmed; the rest is claimed or disputed. Over the weekend, a group calling itself Revolut Smilik threatened to publish more customer information unless it was paid. City AM reported that the group confirmed it was seeking payment in exchanges on Telegram. The reported demand was 10,000 bitcoin. Revolut has not confirmed that amount. City AM, Disruption Banking Posts on the Revolut Smilik Telegram channel, September 13 to 14, 2026, as captured by Marcel van Oost. Redactions are his. A website associated with IAmNotAVillain subsequently offered a different account. According to statements reproduced by fintech commentator Marcel van Oost, its operator says the person taking credit had worked with them and received only a small portion of the records. The operator claims that Revolut and other companies supplied the data directly to them. Account of the website’s claims The IAmNotAVillain site, September 14, 2026, as captured by International Cyber Digest. The domain no longer resolves. This does not establish which account is true. But it means the people publicising the data and demanding money cannot simply be assumed to be the people who originally obtained it. Nor does possession of a sample establish possession of the full dataset. #### Not one incident. Six months of fraudulent requests. In an interview reported by International Cyber Digest, IAmNotAVillain said the operation targeting Revolut ran for six months. They claimed to have compromised multiple Italian law enforcement departments and used those systems to send requests for customer information. Interview account reproduced here If substantiated, that would mean investigators need to reconstruct months of activity: which accounts were used, how many requests were sent, what each requested and which companies answered. The reference to other companies raises the possibility that Revolut was one of several recipients. No other company’s involvement is established by that statement, and the material reviewed does not establish the use of government credentials from countries beyond Italy. #### Hackers claim to have 147GB of user data The claimant says they also obtained 147GB of material from the Italian law enforcement systems, including internal documents, calendars and personal communications. That is the claimed police dataset, separate from the Revolut customer records. Its size and contents have not been independently verified. Reporting on the claimed police data The allegation would make the agencies victims of data theft themselves, while their systems were also being used to obtain information from companies. Il Sole 24 Ore separately reported that documents circulated by the attacker showed an address ending in interno.it, the domain of Italy’s Ministry of the Interior. Neither Revolut nor the ministry has publicly confirmed that identification. #### What Revolut has confirmed Revolut says an unauthorised party submitted fraudulent requests through an email account on a legitimate government agency domain. The messages passed domain authentication checks, and the company disclosed customer information believing the requests were genuine. The company says it blocked the address, alerted the agency and relevant authorities, and notified affected customers. Its systems and customer funds were unaffected. Revolut’s statement reported by The Block Revolut told Il Sole 24 Ore it notified just under 700 people; the Financial Times reported 680. The customer notice listed information that may have been disclosed, including identity documents, verification selfies, addresses, phone numbers, account statements and transaction histories, including bitcoin transactions. Those records can connect a person’s identity and home address to detailed financial activity. The Block #### The question for every company receiving these requests Revolut’s confirmed account and the broader allegations meet at the same point: the requests arrived through a government domain. Email authentication cannot establish whether the person using an account is an authorised investigator or whether a particular request is legitimate. If an attacker controls a genuine agency account, messages sent through it can still pass authentication. The six-month claim makes the history of those requests especially important. If the same compromised accounts contacted multiple companies over time, each recipient may hold only part of the evidence needed to understand the operation. For companies reviewing their own records, the immediate questions are practical: who requested the information, how was their authority established, and what was released? The next developments to watch are confirmation of the agency involved, the period during which its accounts were used and whether other companies received requests. Those answers will determine how far this incident extends beyond the customers Revolut has already notified. Teams handling government requests can check a requester’s verification status through Kodex Verify. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Criminals Don’t Need AI to Steal Customer Data | Kodex Source: https://www.kodexglobal.com/blog/revolut-law-enforcement-email-compromise News · Fraud ### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data Revolut sent KYC files to a request from a real government email address. Matt Donahue, ex-FBI, on why law enforcement email compromise keeps working. Matt Donahue Founder/CEO @ Kodex Published September 14, 2026 Over the last week, I’ve seen roughly 500,000 articles and X posts about how AI is going to compromise every system, take over the world, etc. Then on Friday, with far less attention, we learned that a flesh-and-blood human got Revolut to hand over passports, selfies, bank statements, and full transaction histories belonging to some of its wealthiest customers. No AI required. How did he do it? He sent an email asking for it. Then Revolut gave it to him. I’ve said it for years, and I’ll say it again: this shouldn’t still be possible. #### What actually happened It’s still under investigation, and Revolut hasn’t said much. Here’s how it looks so far, from what Revolut has said and what’s been reported: - A criminal got hold of an email account at a real government agency. Revolut’s word for it is “unauthorised.” We don’t know who, which agency, or how. Malware that steals saved passwords. Someone talked into handing it over. A login bought on a forum. Or an account somebody created from the inside. Take your pick. - Using that account, they sent fraudulent requests to Revolut for specific customer records. - Revolut checked the email. It came from the agency’s real domain, with what Revolut calls “valid domain authentication credentials.” That part checked out. Which tells you which server sent the message. It tells you nothing about who was at the keyboard. - The request passed review, and Revolut produced the data: identity documents, verification selfies, personal contact details, account information, and transaction histories. - Later, Revolut figured out the requests were fake. Reports say it went back to the agency, which said it never sent them. 😬 - Revolut blocked the address, notified regulators and police, and began emailing affected customers on September 11. The email was real. The person behind it wasn’t who they claimed to be. That’s the gap. #### This is not an isolated incident If you’re new to this world, this might sound like a weird, isolated story. It isn’t. We named it years ago: law enforcement email compromise, or LEEC. Whatever happened here, this part is routine. Right now, you could go on the dark web and buy a real police email login. Prices vary by country. A fake emergency request sent from one starts at about $100. Once you have one, you can send emails as a police officer. Claim you’re working a critical case. Ask for someone’s personal information. Say you need it immediately. My company, Kodex, has flagged more than 5,000 criminals impersonating law enforcement to get customer data. And this has been happening in public for years. And it isn’t only email. In 2025, a group created a fraudulent account inside Google’s Law Enforcement Request System, the portal police use to ask Google for data. Google caught it and said no requests were submitted and no data was accessed. The attempt is the part worth noticing. The law enforcement request channel is now a target in its own right. Revolut deserves credit for catching it, alerting the agency and regulators, and telling affected customers. Most companies would never know. The request looked right, the domain checked out, the file went out. Why would anyone look again? How many companies have answered one of these and never found out? Nobody knows. That’s the part that should bother you. Meanwhile, request volume is growing roughly 40% a year. More requests. Less time to verify each one. And at too many companies, verification still means a person squinting at a domain name. #### Why this is so hard to defend against Criminals love this scam. Why spend all that energy breaking into a company’s systems when you can get the company to send you the data? Two things make it especially difficult to stop. First, companies have real obligations to respond to valid legal requests, often under tight deadlines. Second, police agencies around the world have wildly uneven security. Many lack the basic protections a company would expect: single sign-on, strong access controls, even two-factor authentication. One email account. Enormous power. Sometimes very little security. And the people handling these requests don’t just want to comply. They want to help. Having worked counterterrorism for the FBI, I know what legitimate access to this information makes possible: finding people in danger, recovering stolen funds, and making our communities safer. That urgency is real. So is the willingness to help. Criminals exploit both. A team shouldn’t have to choose between moving quickly on a legitimate investigation and protecting its customers. It needs a reliable way to tell who’s asking, and whether they’re entitled to the information. #### The answer I’ve been saying this for seven years. One more time: We need real KYC. Know Your Cop. Globally. We need to verify the person behind the request, the authority to make it, and whether their account is still under their control. And we need these exchanges to happen in a grown-up, 2026 kind of way. Too many companies and agencies are still relying on email, PDFs, and, literally, faxes. This is a hard problem. But the infrastructure to address it already exists. The Kodex Global Network connects 15,000 agencies and more than 160,000 verified investigators. Requests go through a secure channel, with requesters checked every time. Verification doesn’t stop because someone passed a check six months ago. Companies like Stripe, AT&T, Coinbase, and Amazon use Kodex to verify, process, and respond to these requests. It’s fast: about 15 hours instead of about six weeks. Roughly 60 times faster. It’s built for exactly this: a stolen mailbox doesn’t come with a verified identity attached. And it helps legitimate investigators do their jobs while protecting people from those impersonating them. That’s what I care about most. Revolut, credit where it’s due: you caught it, and you told your customers. For everyone else, take a look at how your company handles these requests. What actually stands between an impostor with a government email address and your customers’ most sensitive information? We need to stop pretending an inbox is a security control. I’ll spare you the full product pitch. But if you’re wondering whether your company or agency is exposed to this, that’s a conversation worth having. Find us at Kodex Global. OK, rant over. Until the next one. Matt Donahue is the co-founder and CEO of Kodex, the verification network for law enforcement data requests, and a former FBI counterterrorism agent. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News ##### Kodex Global Keynote | March, 2026 March 26, 2026 · Matt Donahue Read More → All blog posts --- ## Understanding Law Enforcement Email Compromise (LEEC) Source: https://www.kodexglobal.com/blog/understanding-the-threat-of-law-enforcement-email-compromise-leec-and-how-to-safeguard-against-it Security · Fraud ### Understanding Law Enforcement Email Compromise (LEEC) LEEC attacks use compromised law enforcement email accounts to submit fraudulent data requests. Learn how to detect them and what Kodex does to stop them. Brian Donahue Head of Operations at Kodex Published February 6, 2025 Law enforcement email compromise (LEEC) is an attack in which criminals use compromised or spoofed law enforcement email accounts to send companies fraudulent data requests — and walk away with user data. It is one of the fastest-growing threats facing any company that holds user data, and it works because most teams have no way to verify that a request really came from the agency it claims. Business Email Compromise (BEC) is a financially motivated crime targeting businesses for financial gain. Attackers often use phishing, domain spoofing, and email account compromise to trick employees into transferring money or revealing sensitive information. For example, an attacker might spoof or hack into a CEO’s email account to email employees with instructions to make a large purchase or send money. The primary risk of BEC for companies is typically financial loss and operational disruptions. However, a new threat has emerged that demands attention: Law Enforcement Email Compromise (LEEC). Law enforcement email accounts are compromised every day. One reason is the vast amount of personal information available about individual investigators from social media platforms, law enforcement agency websites, online services, and other miscellaneous websites. Some of this information is publicly available, but if even one of these sites experiences a data breach, additional data about individuals in law enforcement can be exposed. For example, if a law enforcement officer’s work email address appears in a data breach, an attacker can search for this individual on Google, Facebook, or LinkedIn to gather additional details such as name, appearance, interests, and social connections. This information helps the attacker build a convincing persona for social engineering attacks. They might send phishing links to the individual’s family members hoping they share passwords, or they might use old passwords found in other data breaches to attempt a credential-stuffing login. If the officer does not have multi-factor authentication (MFA) enabled on their work email or other professional accounts, chances are significantly higher that an attacker could gain access. Once inside, they impersonate the officer to send legal requests to companies like Meta or Google, aiming to victimize, threaten, intimidate, compromise, or otherwise harm people who use these services. Our Global Threat Intelligence Team is uniquely positioned to monitor and track LEEC’s, notifying and protecting every company on the Kodex platform from fraudulent requests. We recently published a white paper on the growing threat of fake Emergency Data Requests (EDRs), the threat actors behind them, and how we detect them. You can download it here. We also share select threat intelligence and trends in a monthly newsletter, which you can subscribe to here. #### What Is Law Enforcement Email Compromise (LEEC)? Similar to the kinds of attacks that target companies, attackers target law enforcement looking for credentials, sensitive information in case files, and other data for their own purposes or to sell it to someone else. Like with BEC attacks, stolen law enforcement email addresses can be used in credential-stuffing attacks to gain access to individual email accounts. However, LEEC differs from BEC in two key ways. First, LEEC exploits public trust in law enforcement. Compromised email accounts can be used to impersonate police officers and law enforcement investigators to obtain a perception of authenticity that helps them social engineer businesses through weaknesses in historical law enforcement data request processes and tools. This allows attackers to steal the same information that they would get from a corporate breach to attack members of the public with swatting, extortion, harassment, and intimidation. Kodex customers benefit from herd immunity due to advanced warnings from our global signals intelligence (SIGINT) network and information shared by other companies on our platform. When we detect a compromised law enforcement domain every Kodex customer is notified, and all law enforcement accounts associated with that domain are suspended until they complete a multi-phase re-verification process with our team. Another difference is that LEEC directly impacts public safety. When law enforcement email accounts are compromised it causes disruptions in law enforcement operations, records management, and data handling. This can distract and divert attention and resources from other priorities. For example, once communication channels are compromised, it’s much harder for law enforcement to coordinate critical activities that protect the surrounding community. #### How Do You Spot a LEEC Attack? Cybersecurity and IT personnel at law enforcement agencies should watch for the following red flags: - Suspiciously Deleted Emails: Monitor for unusual deletion patterns. - Unauthorized Password Changes: Confirm password changes with the account owner. - Unrecognized Devices: Track logins to the agency’s email and network from unknown devices. Consider limiting access to systems, data, or functionality until new devices are verified with the account owner. - Phishing Training: Educate personnel on the risks and common tactics used in social engineering, including shared or reused passwords. Create an easy way for them to report suspicious communications with your IT or cybersecurity experts, and then train them on that process. - IP Mismatch: Monitor for (and limit) logins from unusual IP addresses. #### How Do You Prevent Law Enforcement Email Compromise? By taking the following precautions, law enforcement agencies can strengthen their email security and defend against LEEC attacks: - Password Security: The most important characteristic of a strong password is its uniqueness, meaning it’s not used for multiple accounts or services. Password managers are a helpful tool for creating and storing strong, unique passwords for all your online accounts. Additionally, password changes for law enforcement systems and email accounts should require approvals from IT to ensure they’re only made by authorized personnel. - Multi-Factor Authentication (MFA): It’s standard best practice to enforce MFA for all accounts, avoiding email, text, or call-based signals that can be spoofed or intercepted. Authentication apps like Duo Security or Google Authenticator are recommended. Hardware keys like Yubikey or Apple’s embedded Touch ID add additional security. - Account Management: Unused or expired accounts aren’t monitored by the original owners, making them vulnerable entry points for threat actors. These accounts should be deleted regularly. - Data Retention: Maintaining logs for account logins, systems access, and database changes can provide critical signals for detecting a potential compromise and assisting the incident response team with subsequent investigations. Ultimately, the most significant consequence of LEEC isn’t only the disruption of law enforcement operations: it’s also a serious risk for businesses. The dual obligation of companies to assist with public safety by complying with lawful data requests while preserving individual privacy and meeting data protection regulations is no easy task. It often requires trade-offs based on legal requirements and company values, with the underlying need to ensure that the person requesting any personal data is truly who they say they are – because if you’re not using trusted verification procedures like Kodex, it’s hard to be sure. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## User Notifications: How to Handle Law Enforcement Requests Source: https://www.kodexglobal.com/blog/user-notifications-overcoming-complexity News ### User Notifications: Overcoming Law Enforcement Request Complexity Sending user notifications in response to law enforcement data requests is more complex than it looks. Kodex handles the legal and technical challenges. Kodex Team Kodex Published February 6, 2025 Kodex celebrates 1,000+ user notices sent through our secure portal. When companies receive legal process from law enforcement, such as subpoenas or warrants, for personal information about their users or customers, the first thing they need to do is review each request to confirm it satisfies applicable laws, including privacy and data protection regulations. If a request asks for too much information, companies typically try to narrow it, and in some cases will object to producing any information at all. Then, they must decide whether to notify the individual(s) whose information has been requested. Maintaining control over user notifications presents a multitude of challenges. First, companies must navigate a complex web of legal requirements and jurisdictional differences, ensuring compliance with varying local, state, and federal laws. Additionally, balancing transparency with user privacy is crucial, as premature or unauthorized notifications could compromise ongoing investigations or violate legal directives. The need for robust and secure systems to manage these notifications is critical, as any breach could lead to unauthorized access to sensitive information. Furthermore, companies must often deal with the ethical implications of user trust, ensuring that their notification policies align with their commitment to protecting user rights while fulfilling their legal obligations. This intricate interplay of legal, technical, and ethical considerations makes the task of managing user notifications both demanding and essential. In 2011, the Electronic Frontier Foundation (EFF) published its first “Who Has Your Back,” report which evaluated companies’ commitments to protecting users when government agencies (including law enforcement) ask for personal data. In their initial report, the EFF evaluated 13 of the largest internet companies, at the time, against six criteria: - Do they require a warrant before they’ll release user content? - Do they inform users of government data requests? - Do they publish transparency reports? - Do they publish law enforcement guidelines? - Do they fight for users’ privacy rights in court? - Do they fight for users’ privacy rights before Congress? The initial report was a wake-up call for many of the companies who, until that point, had never made a public commitment in these areas. For the next decade, public pressure from the EFF and resulting press coverage helped privacy, security, Trust & Safety, and law enforcement response teams advocate internally for greater transparency and consistent decision-making when responding to requests from law enforcement. Over time, the number of companies profiled in the EFF report grew, specific industries were highlighted and the criteria evolved. The last report was published in 2019 with a different focus: content moderation policies and transparency of online platforms. #### Notification Before Disclosure In privacy policies and law enforcement guidelines, many companies reserve the right to notify their users if their information is impacted by a law enforcement request unless prohibited by law or in exceptional circumstances, such as child exploitation cases, emergencies, or when notice would be counterproductive. In most cases, companies that notify users do so before the disclosure. This practice informs users about potential privacy intrusions so they can take necessary actions, such as seeking legal counsel or understanding the scope and implications of the request. By doing so, companies demonstrate their commitment to protecting user rights and fostering an open relationship with people who use their services. Additionally, such notifications can provide users with peace of mind, knowing that their service providers are proactive in maintaining ethical standards and prioritizing user consent whenever possible. #### Delayed Notification Some requests from law enforcement prohibit user notification to preserve the integrity of ongoing investigations. If companies were allowed to notify users, it could lead to the destruction of evidence, flight from jurisdiction, or other actions that might obstruct justice. Maintaining confidentiality can also help protect the safety of law enforcement personnel and potential witnesses. By ensuring that law enforcement requests remain undisclosed, authorities can conduct more effective investigations and enhance public safety, balancing the necessity of privacy with the imperative of security. Sometimes notification isn’t prohibited entirely, but is delayed until a statutory or court-ordered non-disclosure order (NDO) period has expired. For security reasons, some companies don’t send notifications to the user if their account is disabled or hacked. #### Transparency Reports: Delayed, Aggregated Notification Many companies share the aggregated number and types of requests they receive in annual transparency reports. In an era where data privacy is a significant concern, users want to know how their personal information is being handled and under what circumstances it might be shared with external entities, such as law enforcement. By publishing transparency reports, companies demonstrate their commitment to protecting user privacy and holding themselves accountable, fostering a sense of security and trust among their users. Transparency reports also provide a measure of accountability and oversight. They offer a detailed account of the number and types of requests received, how many of these were complied with, and the legal basis for such requests. This level of detail allows stakeholders, including users, advocacy groups, and policymakers, to scrutinize the practices of both the company and the requesting law enforcement agencies. It ensures that the requests are being made and handled appropriately and that any potential misuse of power can be identified and addressed. This scrutiny can drive improvements in both corporate practices and public policy regarding data privacy and law enforcement access. Lastly, these reports play a vital role in the broader conversation about data privacy and digital rights. As the Trust and Safety Professional Association notes on its website, by openly sharing information about law enforcement requests, companies contribute to a greater understanding of the landscape of government surveillance and the implications for individual privacy. This transparency can inform public debate, influence legislation, and inspire other companies to adopt similar practices. Kodex makes it easy to create transparency reports for public disclosure and internal auditing. We support global regulatory requirements for reporting as well as customized reports based on real-time data about every request received. With Kodex you can quickly and confidently publish accurate reports for internal decision-makers and external stakeholders. #### Harmonizing Transparency and Compliance Balancing transparency with legal obligations is inherently challenging. Companies strive to build trust with their users by being open about how their data is handled, but they must also comply with lawful requests that may require confidentiality. Navigating this fine line requires careful consideration and tools that can enforce a nuanced approach. One of the primary challenges companies face in managing user notifications is the sheer volume and complexity of legal requests that they receive. Each request may come from different jurisdictions, each with its own set of regulations and confidentiality requirements. Additionally, the language used in these requests can vary significantly, making it difficult to standardize or automate the process of identifying which ones include NDOs. Another factor is the potential for human error. With numerous employees handling data requests, there’s always a risk that a request could be misinterpreted or mishandled, leading to unintentional notification of users when it is prohibited or violating your own privacy policies by not notifying users when you promised you would. Implementing comprehensive training and clear protocols can mitigate this risk, but it cannot eliminate it entirely. Kodex’s secure portal makes it easy for law enforcement to indicate confidentiality requirements upfront in their initial request. On the flip side, companies can use Kodex to track and enforce immediate, delayed, or prohibited user notifications. Schedule a demo today. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Why the FBI’s Former General Counsel Joined Kodex Source: https://www.kodexglobal.com/blog/why-i-joined-kodex-brad-brooker News ### Why I Joined Kodex Brad Brooker spent 17 years at the FBI and ODNI on lawful access. He explains why he joined Kodex to build the rails that verify every legal demand. Brad Brooker General Counsel Published September 9, 2026 In August, I joined Kodex as its first in-house General Counsel. I came from Holland & Knight, where Kodex was a client and I spent the better part of a year working with the company’s incredible leadership. By the time the conversation turned to joining, I had watched this team work firsthand for months. In 2008, I joined the Office of the Director of National Intelligence. The agency was about three years old, and much of it still needed to be built: the processes, the relationships, and the legal frameworks for problems no one had confronted before. ODNI was the government’s version of a start-up, and the people drawn to it wanted to build. I spent the next seventeen years in the intelligence community and at the FBI, leading teams that ranged from 3 people to 350. Kodex has that same early-days energy. I get to help lay a foundation from scratch, and I find that invigorating in a way that is hard to overstate. The problem drew me in as much as the team did. Matt left a career at the FBI because legal process for data still ran on fax machines while everything else in an investigation had gone digital. I recognized every part of that story from my side of the table. Speed is critical to a law enforcement investigation. When lawful requests stall, leads go cold, suspects go unidentified, and crimes go unsolved. Kodex helps investigations move at the speed the mission requires, and I saw the benefit to law enforcement the first time I understood what the company had built. What kept me interested was a feature of the design that is easy to overlook. The same infrastructure that moves a request also verifies it. Every requester is verified, and companies have additional tools to scrutinize every legal demand on the front end. That means companies are not handing over data in response to invalid or overbroad requests, and the people whose data is at stake receive the protection the process owes them. My entire career has run along that line: making lawful access work while protecting privacy and civil liberties. FBI leadership would frequently emphasize the importance of doing the right thing, in the right way, and for the right reason. Kodex has built that standard into its infrastructure, a network designed to confirm that every request meets it. Trust is what makes the exchange work, and it matters to every party: the agency that needs the data, the provider that holds it, and the person it describes. Each of them has to be able to rely on the process. A general counsel typically supports a single institution. My role at Kodex is broader. I am supporting Kodex, and I am also helping to protect the integrity of an exchange that thousands of institutions depend on. That is the same commitment I have carried since 2008, in a new form. And the exchange keeps growing. Each of us produces more digital records every day, and the companies holding that data now extend well beyond the traditional technology and social media companies to include hospitality, financial services, health care, insurance, retail, and media. The demand for this information is not limited to criminal investigations. Kodex has only begun to address it. What does a company’s first General Counsel actually do? Some of it looks like any GC role. Much of it is building: the legal function, the compliance posture, the relationships with regulators and law enforcement partners, and the internal habits that allow a company in a consequential space to grow without cutting corners. Matt says he hired me for my gray hair and experience. I have considerably more experience than hair, so I understand the emphasis. This is my first startup and my first fully remote job, after a career spent inside some of the most tradition-bound institutions in American government. When I left public service, I wondered whether I would find a way to continue supporting the mission from the private sector. I have found one. If you are on either side of this network, as an agency or as a provider, I would like to hear what is working for you and what is not. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Modernizing Law Enforcement Response for Business Source: https://www.kodexglobal.com/blog/why-kodex-is-on-a-mission-to-modernize-law-enforcement-response-for-business Fraud ### Modernizing Law Enforcement Response for Business Law enforcement response protocols was built for a fax-and-email world. That’s a liability for modern platforms. What modernization actually looks like. Matt Donahue Founder/CEO @ Kodex Published February 6, 2025 Today, most crimes involve some element of technology - whether that’s using online platforms to communicate with others to plan a terrorist attack or an abuser luring children through private messages. This means most law enforcement investigations will involve following some kind of digital footprint to gather the necessary facts and evidence. Even the nature of crime itself is evolving – drug dealers can avoid potential physical harm involved with selling on the street when they can sell it on an app, receive an online payment, and deliver their product through the mail. Unfortunately, while criminals appear to understand and embrace the power of technology to reach their goals, law enforcement and corporate legal teams, historically, have not. I saw this first hand while doing counterterrorism intelligence for the FBI. It was my childhood dream to be in the FBI or CIA, and at age 25 I found myself in Quantico at the FBI Academy. I was thrilled to be there, and there was a lot about the job that lived up to the hype in the movies -- the hotel room meets with sources, the envelopes full of cash, and the burner phones all felt surreal. Yet, it was also disillusioning to see how things really worked in the “back office.” In particular, I was shocked by the “seemingly simple” process of issuing subpoenas and getting data back to move our investigations forward. The first time I was told to fax a subpoena to a telecom provider in Southern California…I thought they were hazing the “new guy.” Unfortunately, they were serious. I remember thinking, this is the FBI and you’re sending faxes? And then waiting until they…fax you back? Or worse, snail mail you the response to the request? Not only was this wasting valuable time, it was a highly insecure way to submit a data request. Even as email became more common, it was fraught with security risks and delays. Imagine the most sensitive information you can imagine to go through a Gmail or an Outlook account with no idea who was bcc’d or what was forwarded. I knew there had to be a better way. Actually, pre-FBI, I naively thought there was a standardized and secure way for the public and private sectors to engage when it comes to requesting and transferring sensitive information. I was shocked there wasn’t. And that’s why I started Kodex. #### Taking on a multi-dimensional and mission-critical challenge When I left the Bureau, I had no idea what starting a company entailed. But I understood the problem from the inside out - and I also knew it was about more than making things more efficient. It also had to address security risks and the privacy concerns of businesses and their customers. I joined the FBI because, as corny as it sounds, I grew up wanting to catch bad guys, and I started Kodex for the same reasons – technology and communication failure in this process has real human consequences. A big misconception is that government data requests are just a big tech problem; in reality it affects businesses across the spectrum of industry - beyond headliners like Facebook and Google. It also impacts the entire range of law enforcement, not just the FBI and the CIA. In fact, the scope and volume of legal data requests is huge and growing all the time. The problem is also global, so I knew Kodex had to be, too. (We are currently in 120 countries.) Today, companies receive subpoenas, warrants, or other legal requests for information from all over the world - each one unique, each delivered in a different way, and some with extreme urgency where lives are literally at stake. Unfortunately, it’s still hard for companies to assess the validity of a legal request, especially when it comes from outside their home country. This doesn’t make the human impact any less significant, but it makes the timeliness of response a lot more difficult. Meanwhile law enforcement, while historically reliant on human intel to investigate, has seen an exponential increase in the need for data to put the pieces of the puzzle together. However, it often isn’t clear where to submit a request or what information is truly necessary from individual companies to move an investigation forward. And with more and more crimes moving across platforms and channels - from social media to cell phones - today agencies often have to make multiple requests of many companies in several industries, all for a single investigation. The process is manual, error prone, and a drain on public resources, which would be better used solving the actual crime. The harder it is for law enforcement to understand how to engage with Company A vs Company B, the more error prone the requests are – it’s a vicious cycle that needs to be fixed. We built Kodex to streamline and scale both sides of the equation. By having companies on our portal, government entities can submit their requests using customized specifications that each business sets up within Kodex, including the required legal process. No more second-guessing what is required or having to bird dog an email address to submit to (and hoping it’s the right one when you push send.) As more and more companies adopt Kodex, the more centralized the process is for government agencies. Kodex customers are businesses, including large enterprises. In addition to managing the volume of requests they receive, there is also the problem of trust and security. I personally experienced a time-sensitive subpoena being ignored by a large tech company because they assumed the request wasn’t authentic. And who could blame them? Government email credentials are often compromised and sold, and sometimes fake credentials are created. That’s why we included a robust multi-step verification process for law enforcement accounts on Kodex which combines signals intelligence with technical controls commonly used by fraud detection, account security, and threat intelligence teams. Finally, it was important for me to build our portal and our company to help ease confusion and concern over people’s rights when it comes to government access to their data. I know corporations and consumers are (rightly) sensitive to this issue. That’s why we have businesses customize their intake process so they can let law enforcement know exactly what data they do (and don’t) have, and the laws they’re subject to that define a valid legal request. This prevents legal overreach by ensuring requests are targeted and accompanied by the required legal documentation. Companies can also use Kodex to document compliance with global data protection and privacy laws as they intersect with law enforcement requests. #### From Quantico to Kodex: An Amazing Journey is Underway I’m often asked why I would leave the FBI to launch a startup. (Some didn’t even ask - they just called me crazy). My answer? Like most founders, I saw a problem and I had a solution to fix it. Only in my case, I knew that in doing so, I could help prevent harm and even save lives. It’s a mission I believe in. I’m honored that so many others believe in it, too, including our investors, and our dedicated team of experts in public safety, privacy and engineering. We are actively hiring to fill a variety of roles, so if you’d like to join us, follow us here on LinkedIn for updates and job postings. And just so you know, our office most definitely does not have a fax machine. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## Securing the Front Door to Legal is Now Mission Critical Source: https://www.kodexglobal.com/blog/why-securing-the-front-door-to-legal-is-now-mission-critical Fraud ### Securing the Front Door to Legal is Now Mission Critical Your inbox is a target. Fraudulent law enforcement data requests are increasing in volume and sophistication. Most platforms have no front-door defense. Matt Donahue Founder/CEO @ Kodex Published February 6, 2025 Kodex’s team at a recent offsite in Nashville We are seeing a massive shift happening in how crimes are investigated and solved. The best witness has evolved from a human to a company, but law enforcement doesn’t intuitively know how to navigate the appropriate legal channels at most companies. Confusion bubbles, frustration ensues, and now law enforcement and companies are fighting each other instead of the bad guys. This is the frustration I felt in the FBI and why I left to start Kodex. #### Inefficiency Creates Big Brother Behavior Lawful data requests have replaced witness canvassing as the primary component of a modern investigation. These requests are regulated by several privacy and data protection laws including GDPR, CALEA, RFPA, and ECPA. Law enforcement and companies are expected to comply with these regulations for compiling and transferring data related to lawful investigations. An overly broad scope or an inappropriate request from law enforcement often generates the feeling of “Big Brother” among companies and their users. Yet, these kinds of requests are usually the result of law enforcement investigators not knowing how or what to ask for. Because data structures around identifiers differ across industries and companies, wide nets get cast to compensate for a shallow or inaccurate understanding of data practices inside individual companies. Law enforcement doesn’t want to sift through more data than they need because it slows down their investigation. They want to be both precise and accurate in their requests. Companies that use Kodex can enforce their unique guidelines for law enforcement to ensure requests are appropriately scoped to be precise and accurate for their business. On the flip side, law enforcement investigators using Kodex know upfront what kind of data can be requested from each company and what information needs to be provided in the initial request. A more efficient process makes it easier for everyone to comply with data protection and privacy regulations by eliminating inaccurate or overly broad requests. #### As investigations evolve, so do the hackers A perfect storm is happening for legal response teams: the volume of lawful requests is increasing, while the risk of responding to fraudulent law enforcement requests is also at an all-time high. The lawful data response process has been a major security weak spot for corporations. I call it the black sheep of data security strategy because often internal responders, like Law Enforcement Response Teams (LERT), don’t have a centralized home within the organization. And they may not be connected to relevant teams within their company. Response duties are typically spread across functions, from legal to customer support, with security, privacy, and compliance often out of the loop. In this environment, inconsistent procedures, policies, and operations are common. This allows major gaps in the response process and creates repositories of unstructured data, all of which are very inviting to data thieves. #### Getting from ‘maybe someday’ to ‘mission critical’ In calling attention to the weaknesses in the lawful response process, I use the term mission critical intentionally. The textbook definition of mission-critical is an activity or system that, should it fail or be disrupted, could cause significant harm to businesses, humans, or both. Today, protecting your company against fraudulent lawful data requests, especially law enforcement, fits squarely into that high-priority category. Outdated systems face new and evolving risks In just the three years since building and launching the Kodex platform, I’ve been astounded by the inventiveness and aggressiveness of hackers targeting corporations through the law enforcement data request channel (which for many companies today, consists of an insecure email inbox.) Here are some recent trends I want to call out: - Hackers, data thieves, and extortionists discovered the ‘soft underbelly’ of the law enforcement data request channel. In turn, they have rapidly escalated the sophistication and frequency of attacks using compromised credentials, fake Emergency Data Requests (EDRs), and other methods to steal targeted, highly sensitive personal data. As our monthly threat intelligence reports show, law enforcement email compromise (LEEC) is on the rise with new attacks on a weekly basis. - In a major shift, IBM found that stealing credentials is now a hacker’s number one go-to method. Their research reveals that bad actors prefer using stolen valid credentials over phishing and other methods of compromise to access employee and company data. - The dark web is increasingly awash in low-cost tools to manipulate the request process. Stolen EDR templates, unmanaged or expired law enforcement domains, forged court orders and more are all for sale to criminals online. - Large, tech-savvy companies are not immune. While they may have a more organized approach to legal data requests, big companies can still make mistakes. For example, in 2022, Apple and Meta gave user data to criminals using forged EDRs and compromised law enforcement email accounts. And then there is the complex and quickly evolving issue of data protection and privacy regulations around the world. Many jurisdictions have specific requirements for companies that pertain to the scope, user notice, and public transparency of law enforcement requests. #### The threats are real, and so are the results for Kodex customers. Despite the intensifying threats and organizational complexities facing businesses as they struggle to respond to more and more data requests, things are starting to change. In my conversations with business leaders across industries, I am seeing a growing awareness of the vulnerabilities of their current process and many are ready to take action. In fact, we’ve seen a strong response to our solution and that is incredibly gratifying. There are many success stories we can share, but here are a couple of examples of how the Kodex platform has enabled a more secure and efficient response process for our customers. ###### Setting a new standard for security and efficiency Every company adopting Kodex as their ‘front door’ to external requesters is adopting a zero-tolerance policy for sending private data to bad actors. During request intake, they are capturing structured data via Kodex’s dynamic intake forms instead of sifting through freeform responses via email. With structured data in hand, they are easily connecting external and internal identifiers, and producing the exact amount of data to comply with requests. I’m extremely proud of the results. A few to share: - Kodex customers have been shielded from thousands of fake requests using compromised government emails including several .gov hacks that would have been indistinguishable without Kodex’s threat monitoring. - A messaging app using Kodex responds to emergency data requests in under 12 minutes, without opening up the company to risk. - Another online brand has leveraged our APIs so that each inbound request requires only two quick reviews by a team member, with automation handling the verification and data production pieces. This saves each ops person 12+ hours a week. #### The bad guys never let up, so neither do we. My experience working at the FBI taught me how criminals think and how they adapt their strategies to changing conditions. This insight has helped us build a comprehensive and forward-looking solution that is constantly expanding and improving in anticipation of new threats. In addition, we are focused on how we can meet the growing needs of our customers, who are facing an unprecedented volume of law enforcement requests. ###### Our mission is critical and our vision is clear A while back I shared the story of what inspired me to build Kodex. That passion - to help protect society from real and credible threats while enabling the highest possible level of user privacy and trust - has only increased for me and my amazing team. As the pressure on businesses to increase operational efficiency without sacrificing security or customer privacy continues to grow, Kodex customers have peace of mind that a requester is legitimate. They can receive requests in a standardized format to enforce internal and regulatory requirements and eliminate time-intensive back-and-forth communication upfront. And they can access data for audits and transparency reporting with a single click. If you’d like to join the many businesses in the Kodex community or learn how the Kodex platform works please contact us. You can also learn more by downloading our latest whitepaper on the security and privacy risks created by fake emergency data requests. Guide ##### Your Guide to EU E-Evidence Download More posts #### More from the blog Product ##### Kodex Product Update | October 2026 October 22, 2026 · Kodex Read More → Product ##### Kodex Product Update | September 2026 September 28, 2026 · Kodex Read More → News · Fraud ##### Revolut Breach Shows: Criminals Don’t Need AI to Steal Customer Data September 14, 2026 · Matt Donahue Read More → All blog posts --- ## About Kodex | Law Enforcement Request Management Platform Source: https://www.kodexglobal.com/about-us About Kodex ### Creating the first secure standard for law enforcement data requests Kodex moves critical data exchanges from faxes and emails to a verified, encrypted platform that keeps bad actors away from our data, and off the streets Explore job opportunities Trusted by Trusted by 15K+ government agencies worldwide and the world’s leading companies in crypto, financial, telecom and more Our story #### At Kodex, we're changing the way companies manage legal data requests through a centralized, secure platform that protects both compliance obligations and user privacy. Matt Donahue CEO / Co-founder Our vision goes beyond typical security solutions. We're building a future where public and private sectors can safely exchange sensitive information with integrity, setting a global standard for law enforcement response with the highest levels of data protection. Founded in 2020 in Boston, our story began when former FBI counterterrorism agent Matt Donahue noticed a major problem: the linchpin of the modern investigation — the data request — is the most broken part. Today, we offer more than just a portal; we're creating an ecosystem. Through our verification systems, encrypted workflows, and standardized processes, we make secure compliance accessible to all enterprises while stopping thousands of fake law enforcement requests to maintain the integrity of legitimate ones. Leadership #### Executive leadership Kodex moves critical data exchanges from faxes and emails to a verified, encrypted platform that keeps bad actors away from our data, and off the streets - Matt Donahue CEO / Co-founder - Danny Mendoza CTO / Co-founder - Brian Donahue Co-Founder & VP, Trust & Intelligence - Nick Pailthorpe Head of Government Relations - Jesse Goodman VP of Product - Darya Dehnad VP, Customer Success - Brad Brooker General Counsel Our backers #### Backed by Life at Kodex #### Beyond work: the people who make us More than just colleagues, we’re a team that supports, celebrates, and grows together—creating meaningful connections beyond the workplace. Explore job opportunities --- ## Contact Kodex | Law Enforcement Request Management Source: https://www.kodexglobal.com/contact Contact ### Contact us If you are an agent looking to sign up to Kodex, visit app.kodexglobal.com. For all press inquires, please email press@kodexglobal.com. At Coinbase regulatory compliance is a core part of our business. Kodex is a powerful tool and partner when engaging with regulators John Kothanek VP of Global Intelligence “Having all our data in one place has revolutionized our investigative capabilities. This strategic intelligence helps us protect our platform more effectively." Shann Lu Head of AML “With Kodex, we don’t just manage compliance; we ensure trust, efficiency, and security at every step.” Hon Ng Bitget’s Chief Compliance Officer --- ## Trust & Safety Jobs — Kodex Community Job Board Source: https://www.kodexglobal.com/trust-and-safety-jobs Refreshed weekly · October 30, 2026 ### Community Job Board Open roles in law enforcement response, investigations, trust & safety, and financial crime — pulled straight from company career boards. 33 open roles across 13 companies Remote only 33 roles #### Threat Intelligence Specialist – APAC (Australia Applicants Only) Kodex , Sydney Featured Investigations Remote #### Special Agent, Global Security American Express , California, US Investigations Remote #### Financial Crimes Investigator, Luxembourg Stripe , Luxembourg Financial Crime & AML #### Safety Threat Investigator, Safety Investigations Roblox , San Mateo, CA, United States Investigations #### Law Enforcement Liaison, Kansas Roblox , Remote Law Enforcement Response Remote #### Trust and Safety Policy, Ads Policy, Lead (Europe) Reddit , Remote - United Kingdom Trust & Safety Remote #### Trust and Safety Policy, Ads Policy, Lead (Europe) Reddit , Remote - The Netherlands Trust & Safety Remote #### Trust and Safety Policy, Ads Policy, Lead (Europe) Reddit , Remote - Ireland Trust & Safety Remote #### Trust and Safety Policy, Ads Policy, Lead Reddit , Remote - United States Trust & Safety Remote #### Head of Canada Insider Investigations TD Bank , Toronto, ON, Canada Insider Risk #### Senior Trust and Safety Operations Analyst Twitch , Sydney, Australia Trust & Safety #### Fraud Investigator Robinhood , Chicago, IL; Denver, CO; Westlake, TX Investigations #### Operations Associate, Financial Crimes EDD/PEP Stripe , Mexico City Financial Crime & AML #### Sanctions, Operations Associate(CDMX) Stripe , Mexico City Sanctions #### Operations Associate, Sanctions Stripe , Bengaluru Sanctions #### Operations Associate, Financial Crimes (AML Investigations) Stripe , Mexico City Financial Crime & AML #### Manager, Global Sanctions Stripe , United States Sanctions #### Payments Fraud Investigator Stripe , Ireland Investigations #### Abuse Investigator Stripe , Dublin Investigations #### Abuse Investigator Stripe , Dublin Investigations #### Abuse Investigator Stripe , Seattle, San Francisco, New York City Investigations #### Risk Operations Analyst, Financial Crimes Stripe , Dublin, Ireland Financial Crime & AML #### Financial Crimes Analyst, Crypto Investigations Stripe , United States Financial Crime & AML #### Manager, Global Sanctions Stripe , Ireland Sanctions #### Payments Fraud Investigator Stripe , Remote - US Investigations Remote #### Fraud Investigator - Customer Protection Robinhood , Denver, CO; Lake Mary, FL Investigations #### Senior Onchain Investigator Coinbase , Remote - USA Investigations Remote #### Financial Crimes Compliance Strategist Ramp , New York, NY (HQ) Financial Crime & AML #### Police Officer Starbase Police Department , Starbase, TX Law Enforcement Response #### Trust & Safety Ads Operations Analyst, Programs OpenAI , San Francisco Trust & Safety #### Senior Financial Crimes Compliance Controls Strategist Ramp , New York, NY (HQ) Financial Crime & AML #### Investigator 2, Security Comcast , 2 Locations Investigations #### Technical Threat Investigator, Threat Intel Engineering OpenAI , San Francisco Investigations Subscribe for regular updates on trust & safety jobs. Curated by Kodex — the portal for managing law enforcement data requests. Roles link to each company’s official careers page. --- ## Law Enforcement Data Requests, One Verified Account | Kodex Source: https://www.kodexglobal.com/verified-requester Join the Kodex Request Network ### Get verified once and send requests to every company on the network. Kodex is where 16,000 government agencies and the companies that hold the records they need work the same request. A verified account puts your authority on file with every one of those companies before your first subpoena or warrant goes out. Get verifiedSign in Free account. Most requesters are verified within a few days. 16K+ verified government agencies on the network 160K+ verified investigators worldwide 24/7 threat intelligence monitoring the network What you get #### Your requests land where companies are already waiting for them. Companies on Kodex receive, verify, and respond to legal process here: subpoenas, search warrants, court orders, preservation letters, and emergency disclosure requests. Your request arrives in the queue their legal team already works from, structured the way they asked for it, with your authority confirmed. You skip the search for the right contact at each company, and the time a legal team spends confirming who you are comes off the front of your request. What changes when you join #### Four things that move faster once you’re verified. 01 ##### Arrive already verified Kodex confirms your authority once. Every company you reach through the network sees that confirmation before it opens your request. Some requests still call for a second check on the company’s side. 02 ##### Find the right company in seconds Search the network directory for the company, pick the request type, and send. When a company isn’t on Kodex yet, we tell you where it accepts legal process. 03 ##### Get complete answers the first time Structured forms collect what each company needs before you submit, so fewer requests bounce back for missing details. Follow-up happens in a message thread attached to the request. 04 ##### Keep a record you can put in the case file Every submission, message, and response sits in one time-stamped thread. When the case goes to court, the history of the request is already written. The other side of the request #### The companies on the other end are already faster because of us. These are results from companies on the network. Their side of the request runs on the same infrastructure yours does, which is why your requests move. 97.5% fewer law enforcement tickets after adopting Kodex Coinbase case study → 99.9% faster law enforcement verification Bitget case study → 99% of legal request issues resolved Bitfinex case study → Becoming a verified requester #### Become a verified requester across our Request Network. Kodex confirms your authority, giving companies confidence that requests made through the network come from a legitimate requester. Here’s how that happens, from account to first request. 01 ##### Click Get Verified Start this process by clicking “Get Verified” at the top of this page. This step should be completed through your agency’s official channels, not personal or public devices. 02 ##### Create your account Sign up with your official agency, prosecutor’s office, or firm email. This is the first step toward getting verified. 03 ##### Get approved Our verification team confirms your authority to request records. You’ll get an email the moment your account is active. 04 ##### Submit your first request Choose a company from the network, pick the request type, and send. A case thread keeps track of it. Who can join #### Built for law enforcement and open to everyone involved in secure casework. The Kodex Request Network extends beyond sworn officers. It supports government agencies, legal professionals, and other organizations that securely request and exchange data as part of their investigative casework. Primary ##### Law enforcement Sworn officers and investigators, verified with an official agency email and credential. Also welcome ##### Prosecutor’s offices Prosecutors and staff can verify and request records for active casework. Also welcome ##### Law firms Verified attorneys and investigators, including public defense offices, can reach the companies on Kodex that accept law-firm requests. Also welcome ##### Regulators Regulatory agencies can verify and request records as part of official investigations and enforcement actions. Before you start #### A few things that help your verification move faster. Transparency helps move things along: complete, accurate information upfront helps us confirm your identity and authority quickly, so you can start using the network sooner. Your agency’s network ##### Allowlist Kodex before you apply Agency email and network filters often block Kodex’s verification messages silently, so you’ll just see ‘no code.’ Share this exact list with your IT department to allowlist: *.kodexglobal.com, cognito-idp.us-west-1.amazonaws.com, and cognito-identity.us-west-1.amazonaws.com. Your connection ##### Apply without a VPN Applying with your VPN off helps your verification go smoothly from the start. If you’re using one, it’s worth turning it off before you apply. Your details ##### Use your official agency information Sign up with your official agency name, email, and credentials, plus an agency-issued phone number or email we can use to follow up. This helps us confirm your authority and reach you quickly. Group accounts ##### Skip group or shared logins Group accounts are assumed to share login credentials, which raises the risk of law enforcement email compromise. Each authorized requester should sign up individually. Questions we hear most #### FAQs Does “Get Verified” mean I need to create an account first? Yes. Getting verified is a two-part process: you create a free account, then submit your credential so our team can confirm your authority to request records. “Get Verified” is the outcome: clicking it takes you to account creation, which is the first step. Who can create a Kodex account? Law enforcement officers and investigators, prosecutor’s offices, and, for a subset of companies on Kodex, law firms (including public defense offices) and regulators can all sign up using an official agency or firm email address. What do I need to verify my account? Create an account and provide complete details about you, your agency, and your unit. The more thorough the information, the faster we can verify you. How long does verification take? Verification times can vary depending on your agency and case. We’ll email you as soon as your account is approved. If it’s urgent, contact help@kodexglobal.com. Can I use a shared or group account? No. Group accounts are assumed to share login credentials, which increases the risk of law enforcement email compromise (LEEC). Each authorized requester needs their own individual account. Is there a cost to sign up? No, creating and verifying a Kodex account is free. Kodex was founded by former law enforcement to give legitimate authorities a way to submit legal process through secure, encrypted channels: a powerful tool built by law enforcement, for law enforcement. Can I set up training for my department? Yes. We offer free, live training for investigative teams, about 45 minutes long, covering registration, submitting requests, and time-saving features. Email outreach@kodexglobal.com to schedule one.