Subpoenas Everywhere

Kayla is a former FBI special agent who handled national security cyber, criminal cyber, and counterterrorism cases. She served on the Crisis Negotiation Team and Evidence Response Team.

Note: Before reading further, read part one here.

In part one, we talked about federal grand jury subpoenas (GJS). In part two, we are going to delve into administrative subpoenas and privacy implications. An administrative subpoena allows agencies to issue a subpoena without prior approval from a grand jury, court, or other judicial entity. An administrative subpoena compels companies to produce the same information as a GJS.

How have subpoenas impacted everyday people in current events?

With the rise of immigration operations and protests against immigration operations in the U.S., Department of Homeland Security (DHS) and Immigration and Customs Enforcement (ICE) have been using administrative subpoenas to compel companies to provide subscriber information on protesters, as discussed in this New York Times video titled “How ICE Is Pushing Tech Companies to Identify Protesters”.

As a reminder, here is the list of what can be compelled through a subpoena, including an administrative subpoena:

What is the approval process for an administrative subpoena?

It is different depending on the agency. For the FBI, it depends on the violation. Under 21 U.S.C. § 876 and 18 U.S.C. § 3486, the authority to issue administrative subpoenas is given to the Attorney General. The Attorney General delegated authority to the FBI to issue administrative subpoenas in the following types of investigations:

• investigations related to controlled substances, listed chemicals, tableting machines, and encapsulating machines;
• child sexual exploitation and abuse investigations, and
• health care fraud investigations.

For investigations related to controlled substances and child sexual exploitation/abuse, an administrative subpoena must be approved by a supervisory special agent (SSA) or higher. This is an internal check as opposed to an external check. For health care fraud investigations, an administrative subpoena must be approved by an Assistant United States Attorney.

If the investigation does not have a nexus into any of the stated three investigations, then an administrative subpoena cannot be used. The investigator would have to pursue a GJS.

There’s more nuance than this describes, but within theses parameters, administrative subpoenas are much quicker than a GJS.

The administrative subpoena process for ICE is different. Under 8 U.S.C. § 1225(d)(4)(A), immigration officers (i.e., DHS/ICE)  are given broad authority to issue administrative subpoenas. Under regulations in 8 CFR § 287.4(a), these subpoenas may be signed by designated officials or “any other immigration officer” in matters material to immigration enforcement.

On the face of the law, there are no external, independent checks on the process. No explicitly stated requirement of higher-level supervisor approvals. No strict internal limitations.

An article published in January 2025 in the Columbia Law Review provided a “comprehensive account of the immigration subpoena power.” The article found that “investigations can extend beyond the individuals under investigation to anyone—including U.S. citizens—with whom they associate.” When it comes to issuing subpoenas and with the exception of a few specific scenarios, “the agency has essentially given its employees—from career law enforcement to political appointees—free rein.”

The repercussions are revealed in The New York Times video above.

And there’s more.

In February 2026, a Washington Post story revealed an instance in which the DHS subpoenaed a Gmail account of a U.S. citizen over an email sent to a DHS attorney. His email urged the attorney to “[e]rr on the side of caution” and “apply principles of common sense and decency” for an immigrant who had begged not to be deported for fear the Taliban would kill the immigrant if he was returned to Afghanistan.  

Investigators were sent to the U.S. citizen’s home.

What are the subpoenaed companies’ responsibilities?

Companies assert they do not comply with overly broad legal requests. While that is true, people wrongly assume these companies can guard people’s data from government overreach or prevent the government from abusing the use of investigative tools, like an administrative subpoena. That is not the case.

Why?

Companies review subpoenas for legal compliance not for the underlying investigative merit. They lack the authority to demand proof of relevance or to challenge the reasoning behind a request.

For example, while companies will reject a subpoena as "overly broad" if it improperly seeks message content, which requires a search warrant, they cannot gauge if an agency is otherwise abusing its power. If a subpoena is documented correctly, it compels compliance; companies rely on the presumption that law enforcement is acting lawfully and not abusing its authority.

If you are thinking the companies should push back more, then here is a follow up question. In a democracy, is the answer to government overreach increased power to tech companies that collect, store, and track enormous amounts of customer data?

If that’s not the answer, then is anyone doing anything about this?

To a degree, yes.

• The American Civil Liberties Union (ACLU) has challenged the uses of administrative subpoenas in a few cases. These subpoenas were withdrawn, including the case of the individual above.
• In March 2026, Congress sent a letter to certain tech companies seeking information into the use of administrative subpoenas by DHS.
• In April 2026, the ACLU of Pennsylvania filed a complaint under the Freedom of Information Act (FOIA) to obtain records into how DHS is using administrative subpoenas.
• In April 2026, the Electronic Frontier Foundation (EFF) sued DHS and ICE to demand public records on their use of administrative subpoenas.

[See these visual clues between a GJS and a DHS administrative subpoena]

What can each person do?

One: Share information like this with others. Democracy depends on public awareness and civic engagement.

Two: Grow in your own understanding of your privacy, learn what companies collect, and how to minimize your digital footprint.

Three: Consider supporting our work as we aspire to democratize and share this type of intelligence.