How a data request reaches a tech company

The first move in most of these cases hands over nothing at all. An investigator who thinks an account might matter later can ask the company to freeze it: take a snapshot, hold it, do not run the deletion job. Under the US statute that hold lasts ninety days and can be renewed once. No judge signs it, and the user is never told.

So the question that decides everything, whether the data still exists next month, gets answered before anybody has demonstrated a right to it.

Everything after that is a queue.

It arrives as a ticket

There is no knock at the door. Every large platform runs a law enforcement portal: a drop down for the instrument type, a field for the account identifier, an upload for the signed document, a submit button.

On the receiving end is a department with a headcount, a rota and an internal target for clearing the queue. Published counts at the biggest platforms run into the hundreds of thousands of requests a year worldwide, with something produced in roughly three quarters of them. At that volume nothing can be dramatic. It is process work, closer to accounts payable than to anything you have seen in a film.

I run mobile proxy lines on carrier SIMs in Singapore and rent a rack of Android phones by the hour, so I hold a small version of these records myself: who paid, which line they got, when they used it. I have never been served with a production order and will not pretend otherwise. What I have is the operator’s view of what a record looks like before anyone asks.

Three tiers, three keys

The framework most global platforms operate under was drafted in 1986, before the web existed, and it survives because its central division still works. Three tiers of demand, three levels of authority, three different sets of things unlocked.

Tier one is basic subscriber information, and a subpoena is enough. A subpoena is weaker than a warrant, and in plenty of cases no judge issues one. What it buys is the identity envelope: the name on the account, the address given, how long the account has existed, session times and durations, the addresses used to connect, and the means of payment. That last field does more work than the rest combined, because a card number converts a pseudonym into a person in one step, and the payment processor is a separate company with its own portal.

Tier two needs a court order at a standard below probable cause. The US version asks for specific and articulable facts suggesting the records are relevant to an ongoing investigation. What it unlocks is the traffic record: who the account communicated with and when, login history, device identifiers, addresses seen across months. Everything around the message and none of the message.

Tier three is content, and content needs a warrant on probable cause, signed by a judge.

One wrinkle still gets quoted at people. As written, the statute let email older than 180 days be pulled with a subpoena, on the theory that anything left on a server that long had been abandoned. A US appeals court held in 2010 that content is protected regardless, and the major providers have demanded warrants ever since. Practice moved without the text.

What the review actually checks

The review team checks the instrument matches the ask, so a subpoena reaching for message content gets refused. It checks the identifier resolves to a real account, because a surprising share of requests name the wrong thing. It checks scope, narrowing a demand for everything since the account opened to the window under investigation. And it checks the request came from the agency it claims to.

That last one stopped sounding trivial in 2022, when it emerged that criminals had been submitting emergency data requests from compromised police email accounts, and several large platforms had answered them. The emergency lane exists for a real reason: a threat to life will not wait for a judge, and the statute permits voluntary disclosure where someone faces death or serious injury. It is also the only lane with no judicial paperwork to forge, which is why it was the one attacked.

So the review is genuine and bounded. A properly formed demand from a verified agency, inside a defensible scope, gets answered. The company is a custodian, not a court.

Nobody agrees whose law applies

This is the genuinely unsettled part.

The disks are in one country. The user is in a second. The company is headquartered in a third and incorporated in a fourth. Each of those states can construct an argument that its process governs.

The traditional route was a mutual legal assistance treaty: a police force asks its own government, which asks the other government, which asks its own courts, which finally asks the company. Commonly cited turnaround is around ten months, which for a live investigation is the same as not working.

So pressure went the other way. In 2013 a US warrant landed on a company for email stored in a Dublin data centre, and it refused on the grounds that a US warrant does not reach Ireland. The case ran five years and reached the Supreme Court before a 2018 statute made it moot by stating the rule flatly: a provider must produce data in its possession, custody or control, wherever that data sits. Control, not geography. Moving the disks does not move the obligation.

The same statute opened executive agreements, letting one country’s authorities serve orders directly on another’s providers and skip the treaty queue. The first took effect between the US and the UK in 2022.

Europe went its own way. A regulation adopted in 2023 lets an authority in one member state send a production order straight to a provider in another, with the receiving state reduced to a notification across most categories, and it starts applying this year. Meanwhile EU data protection law says a foreign court order is not by itself a lawful basis to transfer personal data out. A company can therefore be legally compelled to produce and legally barred from producing at once, by two systems that each consider themselves correct. That conflict has not been resolved. It gets managed.

Whether you are told

Every policy is worded the same way. We notify users about requests for their data, unless we are prohibited, or unless there is an emergency.

The prohibition is common. A court can order silence on a finding that notice would endanger someone or risk destruction of evidence. One large platform sued its own government in 2016 over how routinely those orders arrived with no expiry, and the justice department revised its policy the following year so gags are meant to be time limited and justified case by case. That is policy. The statute did not move.

The national security lane runs separately: a letter issued by the bureau itself, no judge, covering subscriber and transactional records, historically with a permanent bar on saying it arrived. A 2015 statute required periodic review of those gags. You can see the residue in how companies report them, as a band rather than a number, somewhere between zero and 499.

When notice does come, it usually comes late. A year on, or when the case closes, or when a gag lapses and somebody remembers to run the job.

Encryption settles more of this than policy does

A company cannot hand over what it cannot read.

When a device maker rebuilt its phone encryption in 2014 so the keys derived from the user’s passcode, it removed itself as a party. The demand still arrives. The answer is arithmetic. The sharpest published example is a messenger that responds to legal process with two facts: the date the account registered and the date it last connected. That is the entire inventory.

Here is where intuition breaks. End to end encryption protects message content and does nothing for the backup. A messenger sealed in transit, whose backup lands in a general purpose cloud account under a key the cloud provider holds, is answerable through the cloud account. One manufacturer shipped an opt in setting in December 2022 extending encryption over most of that backup, then withdrew it for new users in one country in early 2025 after a formal notice under that country’s surveillance law. I am not characterising anyone’s legal process. The mechanism is the point: the same design choice, offered in one jurisdiction and withdrawn in another, changes what the demand returns.

And metadata is almost never encrypted, because the service has to route the traffic. Account identifiers, timestamps, frequencies, addresses, device details, message sizes and recipients all stay legible to the operator. That answers most of what an investigation asks. Who is connected to whom, where they were, when it started. Content is the part everyone pictures and the part least often required, because association and timeline usually close the question. A tunnel or an anonymity network moves that same question to whoever operates the far end, which is a separate subject.

I had this backwards about my own setup for years. I store no messages, so I assumed I held nothing worth asking for. Then I wrote out what my systems keep: who paid, by which method, which line was assigned, and a timestamp on every session. That is tier one almost item for item, built without a thought about legal process, because billing needs it and you cannot debug a dead line without it. Retention is an engineering decision, made when somebody sized a database and picked a deletion window. What a demand returns was fixed then.

What a transparency report leaves out

These reports are voluntary. One company started publishing counts in 2010 and the others followed. Nobody mandates the format, so the format is whatever each company chose.

What you get is real: how many requests arrived, how many accounts were touched, what share ended with some data produced, broken out by country. What you do not get is the shape. The produced something figure covers a single field and a full mailbox equally. Categories blend instruments with very different thresholds. National security numbers arrive in bands. The emergency lane, the one with no judge in it, is reported thinly or not at all. And there is no denominator, so a rising count could mean more policing, more users, or a better portal.

A transparency report is a company’s own account of its own compliance, in a format it designed, over categories it chose to count. Worth having. Not an audit.

More on the machinery running underneath the ordinary internet at The Hidden Internet.

Get new guides and videos first — join the Telegram channel.