When law enforcement requests your client communications. What they actually get.
Short answer
When law enforcement requests communications between a lawyer and a client, the response depends on the channel: server-stored email gives up content under a search warrant, end-to-end encrypted messaging gives up only metadata, and phone calls leave call records. Knowing how each channel responds to each kind of demand, before the demand actually arrives, is what determines whether privilege survives the first production order.
The categories of legal demand
Three categories matter, each with very different evidentiary thresholds; treating them as interchangeable is the most common mistake firms make on intake.
The subpoena is the lowest threshold. Issued by a prosecutor or a grand jury, sometimes by opposing counsel in civil matters. Compelling production of documents and testimony. Subpoenas reach metadata, business records, and content stored by third-party providers in some configurations. They do not generally reach end-to-end encrypted message content because the content is not held by anyone but the participants.
The search warrant is the higher threshold. Requires probable cause, signed by a judge. Search warrants reach content held by third-party providers including email content, cloud-stored documents, and the content of messages on platforms that retain plaintext. The Stored Communications Act distinguishes content from non-content, but the practical effect of a warrant is broader.
The pen-trap order is a separate category for real-time metadata interception (the digital equivalent of a wiretap targeting non-content). Pen-trap orders capture call records, message metadata, and connection logs in real time without capturing content. They are easier to obtain than warrants and surprisingly common in extended investigations.
What each communication channel actually exposes
The most exposed channel. Your firm’s email server (whether self-hosted, on Microsoft 365, or on Google Workspace) holds plaintext content of every message sent or received. A warrant served on Microsoft or Google produces the content. A warrant served on the firm produces the content. The privilege analysis is preserved in court (the warrant does not waive privilege) but the production happens. The privilege fight is reactive, after disclosure, and the practical breadth of disclosure varies by court.
The metadata exposure is even broader. Subject lines, sender, recipient, time, IP address of the sender. A subpoena reaches all of this without the same evidentiary threshold required for content.
Phone calls
Phone records (the called number, the calling number, the duration, the time) are routinely subpoenaed and routinely produced. The records do not include content unless a wiretap is in place, which requires a separate, much higher legal standard. The metadata reveals which clients you spoke to and when, which is enough to establish patterns but does not reveal the substance of representation.
Voicemail is a separate exposure. Stored voicemail on a carrier is treated as stored content, reachable with a warrant. Voicemail on the device is a device-level subpoena. Voicemail transcripts in iCloud or Google Voice are cloud-stored and warrant-reachable.
Signal, WhatsApp, and end-to-end encrypted messaging
The cleanest privilege posture available for client communication. End-to-end encryption means the messaging provider cannot decrypt the content. A warrant served on Signal produces the date the account was created and the date it was last connected. A warrant served on WhatsApp produces a similar narrow set of metadata, plus, for some configurations, contact lists and group membership. The content of the messages is not held by the provider and cannot be produced by them.
The exposure on these channels is at the device level. A search warrant for a device produces whatever the device holds, including the message archive. Signal’s disappearing messages feature reduces this exposure on a per-thread basis. WhatsApp’s chat backup to iCloud or Google Drive (often enabled by default) introduces a major exposure: the backup is not E2EE on iCloud unless the user enabled the optional E2EE feature, and is plaintext-recoverable through a warrant served on the cloud provider.
Slack, Teams, and other workplace messaging
Workplace messaging is server-stored and platform-decryptable. The privilege analysis is the same one we walked through in document discovery and your client’s Slack history. A warrant served on the platform produces content. A warrant served on the firm produces content. Workplace messaging is not the right channel for privileged client communications.
What law enforcement actually gets, by request type
The matrix below shows what a properly executed warrant produces from each channel. The matrix is approximate. Specific cases can vary. The pattern is the practical guide.
Email content: produced. Email metadata: produced. Phone call metadata: produced. Phone call content (without separate wiretap order): not produced. Signal message content: not produced. Signal account metadata: produced (creation date, last connection). WhatsApp content (without backup access): not produced. WhatsApp content (with iCloud backup access): produced unless E2EE on iCloud is enabled. Workplace Slack/Teams content: produced. Cloud-stored documents (Drive, OneDrive): produced. Local device contents (with warrant for device): produced.
What firms are doing right
1. Channel hierarchy
Establish written policy on which channels are appropriate for which client communications. Phone for routine matters. Signal or another E2EE platform for sensitive substance. Email only for matters where document production is acceptable, and with the assumption that everything in email is producible. The hierarchy belongs in the engagement letter and the matter intake, not in the partner’s memory.
2. Disable backups for privileged threads
For Signal, the platform does not offer cloud backup by default, which is the right posture. For WhatsApp, the backup setting is the single most important one to address. Disable iCloud and Google Drive backups for any device used for client communication, or enable WhatsApp’s E2EE iCloud backup feature. Cloud backup is where privilege protection most often disappears without anyone noticing.
3. Disappearing messages by default
Set Signal disappearing messages to a default duration (24 hours, 7 days, depending on the matter) at the start of every privileged conversation. The setting reduces device-level exposure if the device is later searched. The setting does not affect the privilege analysis. It affects the inventory of producible content if the device is seized.
4. Train clients before the relationship starts
Most clients do not know any of this. Most clients have backed up every message they sent you to iCloud and stored every email you wrote them in Gmail. The training conversation belongs in the first meeting, not after a subpoena lands. The framework around privilege exposure is the same one we cover in your ChatGPT and Claude conversations are not protected: clients carry exposure that lawyers do not see until later.
Frequently asked questions
Does the attorney-client privilege block production under a warrant?
Not at the production stage. Privilege is asserted reactively: the warrant produces the content, the firm asserts privilege over specific items, the court rules. Filter teams (taint teams) sometimes review the production before the prosecution sees it. The procedural protection works in court. The protection does not prevent the third-party platform from producing the content in the first place.
Are warrants for lawyer communications subject to special rules?
Yes, somewhat. The DOJ’s policy on searches of lawyer offices and accounts requires senior approval and additional procedural safeguards, including the use of taint teams. The policy does not prevent the searches; it adds steps. State enforcement varies. Several states have their own enhanced procedures. The protections exist and work imperfectly. They do not eliminate the underlying exposure.
Does using a personal device for client communication change the analysis?
Marginally. A warrant for the device produces content regardless of whether the device is firm-issued or personally owned. The firm-versus-personal distinction matters for ownership of the device, for some discovery rules in civil matters, and for whether the firm’s IT can wipe it remotely. It does not change what law enforcement can obtain through warrant.
What about international clients and cross-border requests?
The framework changes. The CLOUD Act (2018, US) lets US authorities reach content stored by US providers regardless of where the user is located. Mutual legal assistance treaties cover cross-border requests in the other direction. EU GDPR applies if the client is an EU resident, and the GDPR carveout for law enforcement is narrower than the US equivalent. For matters with international exposure, get specialized counsel before the request lands. The complexity increases substantially. The mechanics of how these multi-jurisdiction requests actually move are mapped out in our piece on MLAT requests, CLOUD Act orders, and the informal channels law enforcement uses across borders.
There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.
