Law enforcement response, the basics

Once a website or app gets big enough, police and courts start asking it for information about its users. Somebody has to answer them. That work is called law enforcement response (people in the field often say LER), and it usually sits inside the Trust & Safety team, the people who protect users from harm.

The job balances three things: users' privacy, real police investigations, and tight deadlines. It runs on one main rule. Every request goes through the proper process, with the company's lawyers involved, no matter how urgent it sounds or how nice the officer is.

This is a practitioner's map, not legal advice. The names and rules change by country, and your legal team owns the details.

What shows up, from lightest to heaviest

The local names change, but the pattern is the same everywhere:

• A preservation request can usually get a saved copy of the data, shown to nobody yet. Save it fast and hand over nothing. Keeping data commits you to very little. Handing it over commits you to everything.
• A request for basic account details can usually get who owns the account, not what's in it. Check who's asking, and what law lets them ask, before anything moves.
• A content request goes after messages, uploads, and what the person actually said or posted. It's the highest bar everywhere. Your lawyers read exactly what it asks for, line by line.
• An emergency request can get whatever would stop someone from dying or being seriously hurt soon. It's the one exception, and it has its own written test, applied by someone allowed to say no.
• An informal ask gets nothing. Politely point them to the proper process. A badge in an email signature isn't a court order.

One pattern worth knowing: the most urgent-sounding request deserves the most care, because urgency is exactly what a scam sounds like.

Two things that look similar but aren't

Two other kinds of work look like this and have to stay separate, both in your head and in your tools.

The first is reporting child sexual abuse material. The platform does that on its own, on its own schedule, to groups like NCMEC in the US and similar groups in other countries.

The second is a government asking you to take something down. That's not a request for data. You check it against your rules and the law, count it, and report it publicly.

Mixing up these three is how platforms end up handing over data they only had to save.

Doing the job well

• Check that the person asking is real, using a phone number or address you already trust, before you discuss anything. Fake legal requests from real-looking email addresses are a known trick, and they have worked.
• Smaller is better. A request for everything on an account usually only supports handing over much less. Narrowing it down is the lawyers' job, with your help.
• Write down every request, every answer and every refusal, with dates. That record becomes your public report and your answer if anyone checks your work later.
• Know your rules on telling users: when a person hears that their data was requested, when the law says you have to wait, and who decides.
• Some of these requests connect to awful cases. You don't have to carry that alone. Your team's process for passing hard cases up the chain, and the wellbeing guide, apply to you too.

Who does this work

These teams hire people who've worked as paralegals, in compliance (making sure a company follows the law), in platform operations, and in law enforcement itself. The job rewards careful record keeping more than anything, so if you're the person who labels the folders, you may have found your calling.

It's also one of the steadier jobs in the field. Every platform needs it, the laws keep asking for more, and the skills carry from one company to the next almost unchanged.