How PRISM, MICT, and United States v. Heppner Completed the Structural Destruction of Attorney-Client Privilege | Horizon Accord
Governance Patterns · AI & Surveillance
The Privilege Was Already Gone
On February 10, 2026, Judge Jed S. Rakoff of the Southern District of New York ruled that thirty-one documents generated by a criminal defendant using Anthropic's Claude were neither protected by attorney-client privilege nor by the work product doctrine. The ruling in United States v. Heppner is being discussed as a warning for tech-naive clients and an inflection point for AI in legal practice. That framing is too narrow. The ruling is not the beginning of a problem. It is the third panel of a triptych that has been assembling for more than two decades.
Attorney-client privilege is one of the oldest protections in common law. Its logic is simple: frank communication between a client and their attorney requires confidentiality, and confidentiality requires that the communication not be accessible to third parties — including the government — without the client's knowledge and an opportunity to assert the privilege. That assertion is a testimonial act. You claim it when compelled to produce. The entire doctrine presupposes that you know your communications exist somewhere you can protect them.
That presupposition is now false across every standard communication channel.
I. PRISM and the Assertion Window
In June 2013, Edward Snowden — then an NSA contractor at Booz Allen Hamilton — disclosed classified documents to journalists at The Washington Post and The Guardian revealing the existence of a surveillance program called PRISM. Under PRISM, the NSA collected stored internet communications — emails, documents, voice and video chats — directly from the servers of major technology companies including Microsoft, Google, Apple, Facebook, and Skype, operating under Section 702 of the Foreign Intelligence Surveillance Act.
The scope was not incidental. The Foreign Intelligence Surveillance Court had found that PRISM accounted for 91 percent of the roughly 250 million internet communications acquired annually under Section 702. Collection was not triggered by suspicion. It was the baseline.
Snowden identified the structural feature that matters most for this analysis. Surveillance restrictions under PRISM, he noted, "are policy-based, not technically based, and can change at any time," with audits that are "cursory, incomplete, and easily fooled by fake justifications." What a company's privacy policy says about government disclosure is not a technical barrier. It is a statement of current policy, subject to legal compulsion at any time, under a court order the target will never see.
The National Association of Criminal Defense Lawyers made the implication explicit in its amicus brief in Jewel v. NSA: "When every reasonable modern method of communication is apparently subject to routine mass search and seizure by the government, the right to consult with counsel, under the protection of the attorney-client privilege, simply disappears."
That brief was filed in 2014. Nothing changed.
· · ·II. MICT and the Physical Record
Physical mail has long been treated as the last protected channel. The Fourth Amendment requires a warrant to open a sealed letter. The legal profession, confronting the surveillance implications of digital communication, has pointed to physical correspondence as the fallback — the channel the government cannot touch without individualized judicial approval.
The fallback is incomplete.
Since 2001, the United States Postal Service has operated the Mail Isolation Control and Tracking program — MICT — which systematically records the exterior of mail processed through its systems, operating across more than 200 facilities nationwide. The program was created in the wake of the anthrax attacks. It does not open letters. It records the outside of every envelope that passes through its systems: sender, recipient, return address, postmark location.
The argument here does not require total surveillance. It requires something more precise: reliable, queryable metadata capture at the moment investigative attention is applied to a specific individual. That is what MICT enables.
The operational mechanism matters. An investigator can introduce controlled information into an investigation — a disclosed fact, a known contact, a deliberate signal — and then direct a mail cover request at the subject. What the government observes is not the content of any letter. It is the behavioral response: who the subject writes to, when, from where. That reaction becomes lead generation, relational confirmation, probable cause scaffolding. No warrant. No content. No visible intrusion.
When MICT became public, a former FBI agent with 34 years at the bureau told reporters: "Looking at just the outside of letters and other mail, I can see who you bank with, who you communicate with — all kinds of useful information that gives investigators leads that they can then follow up on with a subpoena." A mail cover request is granted for 30 days, extendable to 120.
The question is not whether every communication is captured. It is whether any meaningful communication can occur without leaving a trace at the moment it becomes relevant to an investigation. The letter is sealed. The relationship it reveals is not.
· · ·III. Heppner and the Retroactive Waiver
Bradley Heppner was a Dallas financial services executive indicted in October 2025 on charges of securities fraud and wire fraud. After receiving a grand jury subpoena and retaining counsel at Quinn Emanuel, but before his arrest, Heppner used the consumer version of Anthropic's Claude to research his legal exposure. He fed information he had received from his attorneys into the tool, generated 31 documents of prompts and responses, and transmitted those documents to his lawyers. When FBI agents executed a search warrant at his arrest in November 2025, they seized the devices containing those documents.
Defense counsel asserted attorney-client privilege and work product protection. Judge Rakoff denied both.
The privilege analysis turned on three failures. The AI platform is not an attorney. The communications were not confidential — Anthropic's privacy policy permits data collection, model training, and disclosure to governmental regulatory authorities. And Heppner consulted the tool on his own initiative, not at counsel's direction. The work product doctrine failed for the same reason: the materials were not prepared by or at the direction of an attorney and did not reflect defense counsel's strategy.
The footnote in Rakoff's written opinion is where the full weight of the ruling lands. Even if certain information Heppner input into Claude had been privileged — meaning the original advice from his attorneys — he waived that privilege by sharing it with the AI platform, "just as if he had shared it with any other third party."
A separate case decided the same week — Warner v. Gilbarco in the Eastern District of Michigan — reached the opposite conclusion on work product in a civil context, finding that a pro se plaintiff's AI use in litigation preparation was protected. The law is not settled. But the direction of travel in criminal cases, where the government has the most to gain, is now established by Rakoff's ruling.
· · ·IV. The Complete Architecture
Read separately, PRISM is a national security story, MICT is a postal curiosity, and Heppner is a cautionary tale about a defendant who should have known better. Read together, they describe a complete architecture — and they share a common structure.
None of these systems requires total visibility. Each requires only timely visibility at the moment a communication becomes legally relevant. That is a narrower claim and a harder one to dismiss.
Under PRISM, digital communications are collected before any proceeding, before any subpoena, before any assertion of privilege is possible. The assertion window does not exist because collection precedes the moment it could be opened.
Under MICT, physical correspondence is not read. But the relational signal it carries — who wrote to whom, when, from where — is observable precisely when investigative pressure is applied. The system does not need to watch everything. It needs to watch what changes after the government acts.
Under Heppner, the client's attempt to understand their own legal situation — to think through what their attorney told them — constitutes a third-party disclosure that dissolves privilege retroactively. The system does not need to intercept the attorney's advice. It only needs to wait for the client to process it somewhere accessible.
There is no standard communication channel that is simultaneously accessible, practical, and invisible to the government at the moment it becomes relevant to an investigation. The architecture is complete.
· · ·V. The Sixth Amendment Problem
The Sixth Amendment guarantees the right to counsel. The Supreme Court has held that this means effective counsel — not merely the formal presence of an attorney, but assistance that is actually capable of serving the client's defense. Effective assistance requires frank communication. Frank communication requires confidentiality. And confidentiality, across every practical communication channel available to an ordinary person in 2026, has been structurally compromised.
The Brennan Center for Justice identified the implication clearly: the scope of mass surveillance, combined with weak protections for privileged attorney communications, "undermines our legal system." The Electronic Frontier Foundation has noted that despite years of calls for reform, nothing significant has been done to limit the government's ability to access data collected through PRISM, close the backdoor that allows the government to purchase personal information without a warrant, or create meaningful oversight of AI-assisted surveillance.
The right to counsel survives as text. The infrastructure that would make it meaningful does not.
This is not a prediction. It is a description of the current state of the law, documented through primary sources, derivable from public record. Edward Snowden disclosed the architecture of PRISM in 2013 and said then that restrictions on surveillance "are policy-based, not technically based, and can change at any time." He was describing digital communications. The same logic now applies to physical mail through MICT and to AI-assisted legal research through Heppner.
What Snowden revealed was not a scandal that could be fixed by better policy. It was a description of what the infrastructure had become. Heppner is the courts catching up to that description — one channel at a time.
· · ·