European Regulation on ARPOKRAT

AI and Legal Privilege: The Third Party You Cannot Sue

Mon, 24 Aug 2026 00:00:00 +0000

When the FBI seized the devices of Bradley Heppner, a company executive charged with securities fraud, agents found on them thirty-one documents of a new kind. They were not emails, not notes, not exchanges with his lawyer. They were his conversations with a consumer artificial intelligence platform, in which he had laid out his defence strategy, weighed the arguments of fact and law he might raise, and anticipated what the prosecution would hold against him. He had those exchanges after receiving a grand jury subpoena, and without his counsel having asked him to.

On 10 February 2026, Judge Jed Rakoff, of the federal district court for the Southern District of New York, held that those documents were covered by no protection at all.

The same day, five hundred miles away, another federal court held the opposite.

Two decisions, two doctrines, one single act

In Warner v. Gilbarco , the federal district court for the Eastern District of Michigan refused to compel a plaintiff acting without a lawyer to produce records of her use of generative AI tools in preparing her case. The reasoning comes down to a single formula: AI platforms are tools, not people. Submitting a document to a tool is not the same as disclosing it to your opponent. The protection of litigation work product therefore survived.

In United States v. Heppner , whose written opinion was published on 17 February, the New York court concluded that the defendant’s exchanges with the platform were covered neither by attorney-client privilege nor by work product protection. The court relied on the platform’s terms of service, which state that inputs and outputs may be retained, used for training and shared with third parties, including public authorities. A user informed of that could not reasonably expect confidentiality.

Both outcomes are perfectly defensible. Attorney-client privilege falls as soon as there is disclosure to a third party, whoever that third party may be. Work product protection falls only on disclosure to the opposing party. Two distinct doctrines, one and the same act, two opposite results.

What neither decision examines is the assumption they share. And it is that assumption which does not survive contact with the rest of the law.

The comparison nobody makes

Entrusting client files to a hosting provider has never been treated, in itself, as a waiver of privilege.

Yet the host is a third party, beyond argument. It holds the documents on its own hardware. It can be compelled to produce them, and it has been, in several jurisdictions. No bar association, no court, no professional regulator has concluded from this that using a hosting service destroys privilege as a matter of principle.

The dividing line has therefore never been the mere presence of a technical intermediary. There is always one. The postal service carries the letter. The courier holds the file. The operator routes the call. Each is a third party in the literal sense, and none of them causes privilege to fall by its mere existence.

What set the host apart was narrower and more precise than what case law usually states. It stored without reading. It could infer nothing from the content. It had no capacity to know what it held.

What protected the host was not its legal status as a third party, it was its technical inability to know what it held.

That criterion has been operating in silence for two decades. Nobody needed to write it down, because no intermediary had yet put it to the test.

What the judges are actually deciding

Once the criterion is stated, the February decisions change in nature.

A court that treats the submission of a document to a generative AI system as disclosure to a third party is not applying an old rule to new facts. It is finding that this particular intermediary is not like the others. That it processes instead of storing. That something happens inside it which does not happen inside a hard drive.

The federal court for the District of Kansas put the practical dimension plainly in Jefferies v. Harcros Chemicals , on 25 March 2026. It extended the protective order to all material in the proceedings, including documents that are not confidential, on the ground that it is practically impossible to retrieve data once it has been submitted to an open AI tool, because it has served to train the model. Retention is not a commercial policy open to renegotiation. It is a property of how the system works.

Placed end to end, these decisions amount to recognising, in the vocabulary of the law of evidence, a capacity the law never had to attribute to a server.

The French position, and what its criteria presuppose

The clearest statement comes not from a court but from professional regulation.

The Conseil national des barreaux, the French national bar council, published its first practical guide on generative AI in September 2024, then adopted a guide on ethics and artificial intelligence on 17 March 2026 . The first is categorical on the central point: a lawyer must not pass to a generative AI system any data covered by professional secrecy, and that applies to the client’s name as much as to any strategic or confidential information. The recommended alternative is to work on pseudonymised data sets, in which the identifying elements have been replaced.

Practitioner commentary on the French position, notably Baker McKenzie’s comparative privilege guide , draws four cumulative conditions from it. Privilege survives the use of a generative AI tool only if the platform preserves complete confidentiality, with no reuse, training or third-party access; if it is operated exclusively under the control of the lawyer or the firm; if it serves a legal purpose falling within the advisory or defence mandate; and if the output reflects the lawyer’s own reasoning rather than the system’s autonomous processing.

That last condition deserves a pause.

For privilege to hold, the system must not have contributed processing of its own.

A criterion drafted in those terms makes sense only if one takes the system to be capable of contributing processing of its own. Nobody writes a rule requiring that a filing cabinet not have reasoned about the documents it contains. The condition exists because it targets something a cabinet cannot do.

The same implicit recognition sits inside the pseudonymisation recommendation. Replacing identifying elements before transmission is necessary only if one assumes that the system might otherwise link them, retain them or infer something from them. A pure storage medium would call for no such precaution.

Not wanting to read, not being able to read

An objection arises immediately: the host can also be compelled to produce, so why does one intermediary destroy privilege and the other not?

The answer is in the CCBE Model Code of Conduct , and it is more precise than the objection assumes. A European lawyer must require his or her associates, staff and anyone engaged in the provision of the lawyer’s services to observe the same obligation of confidentiality. The obligation travels along the chain.

A hosting provider can be brought into that chain. It signs a processing contract. It accepts confidentiality undertakings. It can be audited, and it can be sued for breach. The third party is bound.

A generative AI platform that retains and trains on submitted content cannot be brought into the chain in the same way, because what would have to be prevented is not a behaviour but an architecture. An undertaking not to train on input data is a promise about an intention. It binds the provider, but it does not change what the system is built to do, and it cannot be verified from the outside.

That is the whole distance between a provider that does not want to read and a provider that cannot read. Only the second survives a change of shareholder, a revision of the terms of service or a court order. We examined exactly this mechanism in relation to the conflict between the Data Act and the CLOUD Act : a legal guarantee is never worth more than the jurisdiction that houses it, whereas a technical impossibility depends on none.

The asymmetry

This is where the analysis arrives somewhere uncomfortable.

The same legal order that agrees to recognise a processing capacity when the question is waiver of privilege refuses to recognise anything at all when the question is liability.

Electronic personhood was proposed by the European Parliament in its resolution of 16 February 2017 on civil law rules on robotics , at paragraph 59(f). The text suggested that the most sophisticated autonomous robots might eventually be given a status allowing them to be held liable for the damage they cause. The proposal was dropped after an open letter signed by several hundred experts opposed it. Their main objection was solid: granting personhood to machines would create a vehicle allowing manufacturers to offload a liability that properly belongs to them.

The position therefore settled. An autonomous system that causes damage is a product, a tool, the instrument of whoever deployed it. It has no legal personality. Liability falls back on a human actor or on a legal entity, and it has to, since there is nowhere else for it to fall.

Both propositions are now running at the same time.

Either the system is capable of receiving a communication in the legal sense of the term, in which case its capacity is recognised in order to strip a client of protection while being denied in order to spare anyone the burden of liability. Or it is a tool, and submitting a document to it is no more a disclosure than saving a file to a disk, in which case the February reasoning collapses.

The European context sharpens the imbalance rather than correcting it. The AI Liability Directive, announced as withdrawn as early as the Commission’s work programme of February 2025, was formally abandoned in October 2025 . That was the instrument meant to address precisely this difficulty. What remains is the revised Product Liability Directive , which now covers software and AI systems, but which requires a defect, damage and a causal link, and which protects natural persons against personal injury, property damage and the destruction of data. Its transposition is not due until 9 December 2026, and it will apply only to products placed on the market after that date.

The predictable objection, and the answer

An attentive reader will reply that the law routinely recognises a capacity for one object and not for another, without that amounting to an inconsistency. An animal can cause legally relevant damage without having personality. A company has personality for the purpose of contracting, and not for every purpose in every legal order. Recognising a processing capacity for evidentiary purposes therefore obliges nobody to recognise personhood for liability purposes. Different questions, different answers.

The objection is serious, and it would be decisive if the asymmetry ran both ways.

It runs only one way. Where the system’s capacity is upheld, the cost is borne by the client whose protection disappears. Where that same capacity would have served to allocate liability, it becomes impossible to find. The result always falls on the same side.

An asymmetry that systematically favours the same party is not a doctrinal distinction. It is an allocation of risk, and it ought to be discussed as one.

What this means in practice

None of this suggests that the legal professions should give up these tools. The European professional texts do not say so either, and the CCBE has published its own guide on the subject.

What it does suggest is that the decisive question is not which tool a firm chooses, but what that tool retains, and whether the answer is a matter of policy or a property of design. An undertaking not to retain can be withdrawn, reinterpreted or set aside by a court. An architecture that does not retain cannot be, because there is nothing to produce.

The reference documents for anyone wanting to look into the question:

The CCBE guide on the use of generative AI by lawyers , published on 2 October 2025, supplemented by a technical guide in March 2026
The ethics guide of the Conseil national des barreaux of 17 March 2026, which applies the classic principles of confidentiality and independence without creating a special law of AI
The Baker McKenzie comparative guide , useful for measuring the gap between national regimes

The angle Arpokrat takes

This reasoning goes well beyond law firms. It holds for any relationship in which someone entrusts a system with information they do not want to see resurface, and it comes down to a single question: does the guarantee rest on a promise or on an impossibility?

That is the principle governing the design of Arpokrat Messenger . Identity is generated locally from cryptographic keys, with no phone number and no email address, and private keys never leave the device. That choice is not an undertaking not to exploit a user directory. It is a choice not to build one. A production order addressed to infrastructure that does not hold the information does not produce a refusal, it produces a void.

The distinction deserves to be stated honestly, because it decides everything. A privacy policy, however sincere and however well drafted, is a declaration of intent backed by a company, by its shareholders of the moment and by the jurisdiction in which it is established. Those three things change. An architecture that does not collect does not change because a board changes. It is the same shift we described in relation to collecting today for decryption later : the risk does not sit at the moment the promise is made, it sits at the moment somebody else decides.

The law takes time to absorb that distinction, and the debate on legal privilege gives a good measure of it. The same goes for the protection of location data , where most of the legal construction bears on access to data whose existence is never questioned.

Conclusion

Case law will eventually settle. Appellate courts will resolve the split, regulators will publish criteria, firms will adjust their engagement letters and their clauses. None of that is in doubt.

But the underlying question will not be settled that way, because it is not really about legal privilege. It is about whether a legal order can recognise that a thing knows, without ever having to say who answers for what it does with that knowledge.

As long as that question stays open, the only variable a user genuinely controls is not the quality of the undertakings given to them. It is the amount of information they let exist.

This article offers a general legal analysis intended for discussion. It does not constitute legal advice or a legal opinion.

Sources

United States District Court for the Eastern District of Michigan, Warner v. Gilbarco Inc., 10 February 2026, Proskauer analysis
United States District Court for the Southern District of New York, United States v. Heppner , 10 February 2026, written opinion of 17 February 2026
United States District Court for the District of Kansas, Jefferies et al. v. Harcros Chemicals Inc. et al. , no. 2:25-cv-02352, 25 March 2026
Conseil national des barreaux, The CNB adopts a guide on ethics and artificial intelligence , 17 March 2026
Baker McKenzie, Global Privilege and Professional Secrecy Guide, France, Artificial Intelligence
CCBE, Model Code of Conduct for European Lawyers , 8 October 2021
CCBE, Guide on the use of generative AI by lawyers , 2 October 2025
European Parliament, Resolution of 16 February 2017 with recommendations to the Commission on Civil Law Rules on Robotics , 2015/2103(INL)
Open Letter to the European Commission on Artificial Intelligence and Robotics
EAPIL, European Commission Withdraws Two Proposals: Assignments of Claims Regulation and AI Liability Directive , 9 October 2025
Directive (EU) 2024/2853 of 23 October 2024 on liability for defective products

5G, Location Data and the Law's Targeting Error

Tue, 18 Aug 2026 00:00:00 +0000

In 2011, Detroit police asked a mobile operator for the cell site records of Timothy Carpenter’s phone. They obtained 12,898 location points spread over 127 days, around a hundred a day. Seven years later, the Supreme Court of the United States held that the request amounted to a search and required a warrant.

Those 12,898 points came from fourth-generation towers, each covering a radius of several kilometres. The same request, addressed today to an urban 5G network, would not return a hundred points a day accurate to a few kilometres. It would return a far larger volume, accurate to a few dozen metres.

The technology has changed scale. The legal reasoning has stayed at the same point in the chain.

A legal interest that judges recognise on both sides of the Atlantic

There is an interest almost everyone accepts and almost no legal text protects effectively: the right to be somewhere without that fact being recorded.

European case law established it unambiguously. In Digital Rights Ireland (joined cases C-293/12 and C-594/12, 8 April 2014), and then in Tele2 Sverige and Watson (joined cases C-203/15 and C-698/15, Grand Chamber, 21 December 2016), the Court of Justice of the European Union held that such data, taken as a whole, allow very precise conclusions to be drawn concerning people’s private lives: daily habits, places of residence, movements, activities carried out and social relationships.

The Supreme Court of the United States reached a comparable conclusion in Carpenter v. United States , 585 U.S. 296 (2018). It stressed a point American scholarship has commented on at length: the inescapable and automatic nature of that collection. Nobody consents to being attached to a cell tower; you are attached because you own a phone that is switched on.

The legal interest therefore exists, and it is recognised by the two courts that matter in this field. The problem lies elsewhere.

What 5G actually changed

A common confusion treats location as data the phone transmits, in the same way as a message or a photograph. It is not. Location is a physical consequence of how the network works. The operator knows which tower the device is attached to because it has to know in order to route a call. There is no key with which to encrypt that information, because it is not content but a property of the connection itself.

That is precisely what makes 5G significant in legal terms rather than technical ones.

Earlier architectures relied on wide cells. A 4G tower commonly serves a radius of several kilometres, and the position inferred from attachment alone was measured in hundreds of metres in cities, sometimes in tens of kilometres in rural areas. 5G rests on massive densification: urban cells typically cover a few hundred metres, and the engineering literature works with densities on the order of forty to fifty base stations per square kilometre, against four or five in the 3G era.

The consequence is mechanical. According to Ericsson’s white paper on 5G positioning , infrastructure deployed for connectivity alone reaches an accuracy of twenty to fifty metres outdoors and one to three metres indoors, dropping below a metre in favourable urban conditions. This is not a location feature switched on somewhere, but what the network knows by construction, with no application installed and no permission granted. We set out all of these mechanisms, along with the countermeasures that actually work, in our article on how your phone tracks your location .

The intrusion has therefore grown by several orders of magnitude. The applicable legal framework remains the one designed for 2G and 3G. No normative adjustment has accompanied that change of scale.

The law protects access, not generation

European law carefully regulates who may access location data, on what conditions and under what supervision. Directive 2002/58/EC lays down the principle of confidentiality of communications, and the Court of Justice held, in La Quadrature du Net (joined cases C-511/18, C-512/18 and C-520/18, Grand Chamber, 6 October 2020), that Article 15(1) of that directive, read in the light of Articles 7, 8, 11 and 52(1) of the Charter, precludes the general and indiscriminate retention of traffic and location data on a preventive basis. The Court nonetheless allowed framed derogations where a Member State faces a serious threat to national security that is genuine and present or foreseeable, subject to effective review.

These are real protections, and it would be absurd to play them down. But they all come into play after the fact. They presuppose that the data exists and is retained, and then organise the conditions of its use.

Yet if location is an unavoidable by-product of how the network operates, the relevant point of intervention is not confidentiality. It is persistence.

An instantaneous position, needed to route a communication and erased immediately afterwards, is not an instrument of surveillance. A history of positions kept for months is one, whatever access safeguards surround it.

The difference between the two is not legal, it is architectural. And the European timetable makes the question urgent rather than theoretical. The Commission withdrew the proposed ePrivacy Regulation in 2025, for lack of agreement between the co-legislators. It has since been working on a separate instrument on data retention for criminal purposes, announced for 2026 and intended to harmonise national regimes that have grown disparate since the 2006 directive was annulled. In other words, the text that will set the regime for location metadata for a decade is being written right now, on the basis of reasoning conceived in the era of kilometre-wide cells.

The precedent 5G created for itself

The most interesting aspect of the file is that the right answer is already in the technical standard, but applied to a different object.

Up to 4G, the subscriber’s permanent identifier, the IMSI, travelled in the clear over the radio interface during attachment. That is what made IMSI catchers possible, those fake base stations which, according to the Electronic Frontier Foundation’s reference description , transmit more strongly than legitimate towers in order to attract handsets and capture their identifier.

Since Release 15 of the 3GPP specifications, published in 2019, 5G has offered an elegant answer. The permanent identifier, now called the SUPI, can be replaced on the radio interface by the SUCI, a concealed identifier obtained by encrypting the subscriber-specific part using elliptic curve cryptography, with the home operator’s public key. Only the home network, which holds the corresponding private key, can decrypt it. The result is unique on each computation, which prevents correlation from one session to the next.

The logic adopted deserves to be underlined, because it is exactly the logic that should guide lawmakers: you do not encrypt the position, which would be technically impossible, you encrypt the identity. A position with no attachable identity has very limited value for individualised surveillance.

The flaw: an optional protection

There is, however, a considerable caveat, and in our view it is the most concrete point of intervention in the whole file.

The NIST CSWP 36A white paper , published in March 2026 by the National Institute of Standards and Technology, states it bluntly. Handsets and network functions compliant with Release 15 or later are required to support the SUCI, but enabling it remains optional for the operator. Three conditions must be met: the equipment vendor must support it, the operator must enable it on its network, and the SIM card must carry the elements needed for the computation.

A configuration trap comes on top of that. The standard provides for a null protection scheme, in which the SUCI format is formally used but without effective encryption, so that the identifier travels in the clear. NIST writes that operators need to configure their networks with a non-null protection scheme, and recalls that a report by CSRIC, the advisory body of the Federal Communications Commission, recommended as early as 2021 that the null scheme be reserved for emergency calls placed by a handset unknown to the network.

The formulation is worth stating plainly. The best available protection against mobile device tracking has existed in the technical standard since 2019. It rests on a configuration choice left to the operator’s discretion. An American federal agency finds it useful to publish a document in 2026 to remind everyone that it ought to be switched on. And no European legal instrument requires it.

It should be added that the SUCI does not close the subject. The work presented under the title 5G SUCI-catchers: still catching them all? documents linkability attacks that allow sessions to be recorrelated despite the encryption, and the protection falls entirely if the attacker forces the handset to downgrade to an earlier generation. A legal obligation would therefore not settle everything. It would nonetheless remove a gap with no defensible justification: the one between what the standard allows and what commercial networks do.

Three coherent interventions

If we take seriously the idea that location should be minimised by design rather than protected after the fact, three measures follow logically.

Make effective concealment of the identifier mandatory. Require the SUCI to be enabled and prohibit null protection schemes on commercial networks, apart from the residual case of emergency calls. This is not about prescribing a new technology, or funding a rollout, but about requiring the activation of a function standardised seven years ago and already present in the equipment.
Treat retention as the exception, not the default. The position needed to route a communication should be erased as soon as that function is fulfilled. Building a history should call for specific justification. That is the difference between a network that knows where you are and a network that remembers where you have been.
Make custody of the key the relevant connecting factor. Locating servers in the Union does not mean much if the keys that make the data intelligible are held elsewhere. The legally significant criterion should be effective control of the means of decryption, a question we examined in detail in relation to the conflict between the Data Act and the CLOUD Act .

The angle Arpokrat follows

This reasoning is not specific to telecommunications law. It is the one we apply to our own architectural choices, and it fits in a sentence: what has not been produced does not need to be protected.

That is why ArpokratOS removes GPS, Bluetooth and NFC at kernel level rather than disabling them in a menu. A switch is a policy: it can be bypassed by a privileged component, re-enabled by an update, ignored by a compromised system. Removing the code path removes the question. It is the transposition, at device scale, of the same shift we are calling for at the scale of the law: intervening on generation rather than on access.

It must be said straight away what this does not do. No operating system removes a handset from the geometry of the network. As long as a SIM card is active, the operator knows the serving cell, and routing all traffic through Tor changes nothing, since it protects content and destination, not the radio layer. That is precisely why the subject is a legal one. There is a category of risks that no individual configuration reduces, and for which the only available variable is the rule applicable to the operator.

The same concern governs the rest of our work. Data that does not exist cannot be requisitioned, resold, exfiltrated, or decrypted ten years from now by a machine nobody has today, a question we addressed from the angle of encryption harvested now and broken later .

Conclusion

Public debate on mobile surveillance focuses almost exclusively on access: who can consult the data, on what basis, with what authorisation. That debate is legitimate, and the rulings handed down by the Court of Justice since 2014 have had tangible effects. But it comes too late in the chain.

The prior and more decisive question is whether the history should exist at all. A database built today for a legitimate purpose remains available tomorrow for another, and the safeguards around it depend on later political decisions that nobody controls at the moment of collection. It is a bet on the stability of institutions, made for a period nobody sets.

5G has multiplied the resolution of this information without any normative adjustment. It has simultaneously shown, through the SUCI mechanism, that the workable path is to dissociate position from identity rather than attempt to encrypt a physical property of the network. The technical standard supplied the answer seven years before the law asked the question.

The European text on data retention is being written now. It will deal with metadata, therefore with location, therefore with what 5G now produces at a granularity its drafters never knew. Whether it will settle for organising access to a history taken for granted, or dare to question the necessity of that history, is probably the most important privacy question of the coming years in Europe. And it is a question the technical sector, for once, has already settled the right way.

Sources

Court of Justice of the European Union, Digital Rights Ireland , joined cases C-293/12 and C-594/12, 8 April 2014
Court of Justice of the European Union, Tele2 Sverige and Watson , joined cases C-203/15 and C-698/15, Grand Chamber, 21 December 2016
Court of Justice of the European Union, La Quadrature du Net and Others , joined cases C-511/18, C-512/18 and C-520/18, Grand Chamber, 6 October 2020
Supreme Court of the United States, Carpenter v. United States , 585 U.S. 296, 2018
National Institute of Standards and Technology, Protecting Subscriber Identifiers with Subscription Concealed Identifier (SUCI) , NIST CSWP 36A, March 2026
Ericsson, 5G positioning: Locating devices anywhere
Merlin Chlosta et al., 5G SUCI-catchers: still catching them all? , ACM WiSec, 2021
Electronic Frontier Foundation, Gotta Catch ‘Em All: Understanding How IMSI-Catchers Exploit Cell Networks
European Digital Rights, The ePrivacy Regulation proposal has been withdrawn, but the fight for your privacy is far from over
heise online, Data Retention: Commission to present proposal by mid-2026