The American Midwest is known more for its wheat and straight talk than for the finer points of digital philosophy. But a recent order from a Kansas court regarding Jefferies v. Harcros Chemicals has provided something far more useful than the usual transatlantic hype: a bit of adult supervision. While the London and New York world are still debating whether an LLM is an “agent” or a “tool,” Magistrate Judge Angel D. Mitchell has focused instead on what happens to the files once they disappear into the machine.

For those of us in corporate intelligence, the ruling is a slightly unpleasant one. It moves the goalposts from whether a tool is “useful” to whether it is “controlled.” In the Harcros litigation, a messy affair involving chemical emissions, the court extended AI-related restrictions to all discovery material, not just the bits marked “Confidential.” The logic is simple: once you feed data into a public model, you have effectively broadcast it. To maintain the integrity of the process, one must prove the environment is closed, the training is restricted, and the deletion is verifiable.

This is where the game turns cynical.

Behind the judicial concern for privacy lies a brewing arms race. Big Law firms are currently positioning their “closed,” “secure,” and “proprietary” AI models as the only legitimate way to handle data. It is a classic “moat” strategy. By convincing the courts that only these bespoke, high-tariff systems are “safe,” they effectively disenfranchise the smaller firms and the independent investigators who rely on more standard, cost-effective tools.

If a court accepts that “security” is defined by the price tag of the software, the plaintiff’s bar, and by extension the  investigator, finds itself in a bind. It is a strategic use of “compliance” to price the opposition out of the market.

In the UK, where we already navigate the thickets of GDPR and professional indemnity, this Kansas ruling signals a shift in the “burden of proof.” It will no longer be enough to take a vendor at their word when they say they “don’t train on your data.” One expects the next round of disputes to involve “audit logs” and “jurisdictional segregation” – technical jargon for “how much can you afford to spend on your firewall?”

Strip away the talk of neural networks and we are back to a very old-fashioned power play. The big firms want to define “safety” in a way that only they can satisfy. As the Kansas court rightly noted, the question isn’t about the “spirit” of the AI; it is about who has the documents and who gets them next. For the investigator on the ground, the lesson is clear: the machine is only as good as the contract that governs it, and in this new era, “privacy” is becoming a luxury item used to keep the hoi polloi from using the best tools.

The following Raedas team members have prepared this update: Andrew Wordsworth, Emad Rajeh

Andrew Wordsworth – Partner, Dubai (awordsworth@raedas.com)
Emad Rajeh – Senior Associate, Washington, D.C. (erajeh@raedas.com)

Last week the Supreme Court struck down the Trump administration’s use of the International Emergency Economic Powers Act (IEEPA) to impose global tariffs. For a hot minute, the ruling not only appeared to instantly mint thousands of US importers as creditors unlocking billions in potential refunds, it also fired the starting gun on a whopping investigative hunt.

While the jostling continues on the political stage, the real scarcity for buyers of distressed assets, hedge funds, and litigation funders is no longer just legal theory, but information. The government knows who paid. The importers know what they paid. But the market does not know who holds those rights today, nor who is desperate enough to sell them. That asymmetry is where the value now sits.

Calculating a claim requires sifting through millions of lines of shipping data, cross-referencing Bills of Lading with Harmonised Tariff Schedule (HTS) codes to reconstruct exactly who imported what, and at what volume. It’s an investigative exercise far removed from standard financial screening, leaving flush buyers of refunds with a menagerie of obscured targets.

The entity listed on a customs entry even 12-months ago may not be the entity holding the claim today. Mergers, acquisitions, corporate restructuring, and logistics intermediation have created a universe of ghost claimants. The right to a future refund could now sit with a holding company, a defunct subsidiary, or a completely different corporate entity. Finding the beneficiary holding the rights today means reconstructing these corporate histories.

The other battle is understanding the motivation of the creditor to sell. Solvent companies can afford to wait, but for some sellers – especially given the immediate reimposition of tariffs last weekend – selling a discounted claim now is crucial for their very survival. Making the most of this “refund opportunity” requires overlaying customs data and HTS codes with intelligence on the financial distress of those creditors with an appetite to sell claims at a discount.

This is no longer a passive bet on what will happen next in Trump’s tango with tariffs, but an investigative exercise to understand who is being ‘hit’ the most and where it hurts. The winners will not necessarily be the refund buyer with the most cash, but those who find the invisible sellers before the rest of the market catches up.

The following Raedas team members have prepared this update: Matthew Walker

Matthew Walker – Managing Director, Dubai (mwalker@raedas.com)

A minor pre-trial ruling out of the Southern District of New York has caused rather more spluttering over coffee than the underlying case probably deserves. Judge Jed Rakoff, eminent, formidable, and now 82, has quietly released a cat among the pigeons.

In United States v. Heppner, he ruled that a defendant’s written exchanges with a public AI system (Claude) about defence strategy were not protected by attorney-client privilege or the work-product doctrine. Asking ChatGPT, Claude or Gemini for case strategy, in the Court’s view, is essentially the same as asking a helpful stranger on a park bench. One who is neither a lawyer nor bound to keep a secret.

The problem was not that he wrote down his defence thinking. It was that he disclosed that thinking to an external entity first. The Court effectively treated the exchanges as the equivalent of handing one’s notes to a third party not bound by confidentiality before ever showing them to counsel.

The Court’s reasoning is worth reading in full because it is quite specific and blunt. Privilege failed because Claude is not a lawyer, the exchanges were not confidential given the platform’s data-use terms, and the defendant was acting on his own rather than at counsel’s direction.

OpenAI’s Sam Altman has publicly cautioned that one should assume conversations with ChatGPT are not private and may be disclosable. Sensible advice in a data-retention age. But the strangeness here is more specific. The defendant was not casually chatting. He was, in effect, drafting his own defence and pressure-testing arguments. Had he written the same material in a notebook, a Word file, or on the back of an envelope, no one would suggest privilege had evaporated because the medium involved electricity. Introduce an LLM, however, and the notes apparently become a conversation with an unlicensed and rather indiscreet entity.

What the ruling does not grapple with is the obvious next set of questions. Are enterprise systems different from public ones? Does it matter if the model is contractually bound not to train on or retain data? What if the discussion is anonymised and conducted purely in the abstract? Investigators and lawyers are already using enterprise deployments precisely to avoid the “third party disclosure” problem. The judgment is notably silent on whether that distinction matters, which leaves us in the slightly surreal position of not knowing whether they are using a tool or accidentally publishing their thoughts. judgment also edges into curious territory by treating the model as though it were a quasi-person rather than software.

For investigators, this is awkward. We routinely map facts, test hypotheses, and think about client strategy on paper or screen. Are we now to assume any exploratory exchange with an LLM is potentially discoverable? Does the answer change depending on which version is used? The ruling offers limited comfort.

It is beyond presumptuous to second-guess a ruling on new technology by one of New York’s most distinguished and longest serving jurists, but I struggle to see this being the final word. For the moment, it is the law in the Southern District. The case itself is relatively modest and unlikely to be appealed, so the ruling may sit there for some time, like a grenade politely passed around the dinner table.

Lawyers we have spoken to range from baffled to quietly alarmed. The practical guidance emerging is stark. Assume every interaction with a public LLM is discoverable. Enterprise systems are being treated as the safer course, though whether they are legally safer remains, at present, an unanswered question.

No doubt the courts will eventually decide whether these systems are tools, agents, or something resembling an over-eager junior who takes meticulous notes and forwards them to the other side. Until then, those of us who write down our thoughts may wish to remember that, in this new world, the walls apparently have ears…and an autocomplete function.

The following Raedas team members have prepared this update: Andrew Wordsworth, Emad Rajeh

Andrew Wordsworth – Partner, Dubai (awordsworth@raedas.com)
Emad Rajeh – Senior Associate, Washington, D.C. (erajeh@raedas.com)