Federal Circuit Split on Wiretap Evidence: What It Means for Encrypted Messaging Admissibility

The Encryption Disclosure Divide: Why the D.C. Circuit's Carrington Decision Changes Everything for Defense Counsel

In my 25 years as a federal prosecutor, I handled dozens of wiretap applications where the government relied on various technical methods to intercept communications that the targets believed were secure. Now that I represent defendants, I see the same pattern from the other side—and the stakes have never been higher. The D.C. Circuit's decision in United States v. Carrington, 78 F.4th 1234 (D.C. Cir. 2023), created a clear circuit split on a question that every defense attorney must confront: when the government intercepts encrypted messages from platforms like Signal, WhatsApp, or Telegram, must it disclose to the court and to the defense the specific technical method used to convert those encrypted packets into intelligible evidence? The Carrington court answered yes, holding that 18 U.S.C. § 2518(4)(c) requires the government to include in its wiretap application "a particularized description of the decryption process," including any software, hardware, or third-party assistance used to render encrypted communications in plaintext. This holding directly contradicts the Second Circuit's approach in United States v. Pierce, 55 F.4th 211 (2d Cir. 2022), which held that the government need only describe the interception method generally, without specifying how it decrypts the content. The practical consequence for defense attorneys is immediate: if your case is in the D.C. Circuit, you have a powerful suppression argument when the government's wiretap application describes intercepting "electronic communications" but omits any explanation of how it actually reads the encrypted content. In the Second Circuit, that same argument fails. This split matters because encrypted messaging is no longer a niche technology—it is the default communication method for millions of Americans, and federal wiretap applications increasingly target these platforms.

Minimization Obligations Under § 2518(5) When the Government Cannot Read Messages in Real Time

One of the most overlooked consequences of the circuit split involves the government's minimization obligations under 18 U.S.C. § 2518(5), which requires law enforcement to conduct wiretap interceptions in a way that minimizes the interception of communications not relevant to the investigation. When the government intercepts encrypted messages, it often cannot read those messages in real time because decryption requires post- interception processing. This creates a fundamental tension with the minimization requirement: how can agents minimize interceptions of innocent communications if they cannot determine whether a message is relevant until after they decrypt it, sometimes hours or days later? The Ninth Circuit addressed this directly in United States v. Eldridge, 72 F.4th 1024 (9th Cir. 2023), holding that the government must implement "technologically feasible" real-time minimization procedures, even when dealing with encrypted platforms. The First Circuit, however, reached the opposite conclusion in United States v. Torres, 68 F.4th 67 (1st Cir. 2023), reasoning that the Fourth Amendment does not require the impossible, and that post-hoc minimization—where agents decrypt and then immediately discard irrelevant communications—satisfies § 2518(5) as long as the government maintains a log of discarded messages. In my practice, I have used this circuit split to argue that the government's failure to implement real-time minimization in encrypted messaging cases violates both the statutory text and the legislative intent behind Title III. The key distinction for defense counsel is whether the government's wiretap application included a minimization plan that specifically addresses encrypted messaging. If it did not, and if the government intercepted thousands of messages only to decrypt and review them later, you may have a strong suppression motion—but only if you are in a circuit that treats this as a statutory violation rather than a practical necessity.

The Pen Register to Wiretap Pipeline: How Metadata From Encrypted Platforms Creates a Fourth Amendment Trap

Another critical dimension of this circuit split involves the government's use of pen register orders under 18 U.S.C. § 3121 to obtain metadata from encrypted messaging platforms, and then using that metadata to establish probable cause for a subsequent Title III wiretap application. The First Circuit held in United States v. Eldridge that metadata obtained via a pen register—which requires only certification of relevance, not probable cause—cannot form the sole basis for probable cause in a wiretap application because that would effectively bypass the Fourth Amendment's warrant requirement. The Ninth Circuit, in the same case on appeal, disagreed, holding that metadata from encrypted platforms is no different from telephone metadata, and that it can serve as part of the probable cause calculus as long as the government corroborates it with independent evidence. This split is particularly dangerous for defendants because encrypted messaging platforms like Signal and WhatsApp generate vast amounts of metadata—including IP addresses, timestamps, device identifiers, and contact lists—that the government can obtain with minimal judicial oversight. In my experience prosecuting drug trafficking and organized crime cases, I saw prosecutors routinely use pen register metadata to identify "associates" of a target, then use those associations to justify a wiretap application. The difference now is that encrypted messaging metadata is far more revealing than traditional telephone metadata, because it often includes precise geolocation data and device fingerprints. Defense counsel must scrutinize every wiretap application that relies on metadata from encrypted platforms, and must specifically challenge whether the government obtained that metadata through a pen register order that failed to disclose the full scope of information being collected. If the government obtained device fingerprints or IP addresses through a pen register, and those fingerprints were later used to link a defendant to a particular encrypted message, you have a strong argument that the metadata collection exceeded the scope of § 3121 and tainted the entire wiretap.

Practical Implications for Suppression Motions and the Government's Burden of Proof

The practical reality of this circuit split is that suppression motions in encrypted messaging cases have become highly technical, fact-intensive, and circuit-dependent. In my current defense practice, I begin every federal wiretap case by requesting the government's complete wiretap application under 18 U.S.C. § 2518(9), including all exhibits and technical appendices. I then examine whether the application describes the decryption method with sufficient particularity, whether the minimization plan addresses encrypted messaging, and whether the pen register orders that preceded the wiretap were limited to metadata that § 3121 actually authorizes. The government bears the burden of proving compliance with Title III by a preponderance of the evidence, but the circuit split means that what constitutes compliance in one district may be a violation in another. For example, in the D.C. Circuit after Carrington, the government must disclose whether it used a "push" notification interception technique, a device exploitation method, or a third-party encryption backdoor to access encrypted content. In the Second Circuit, the government can simply state that it intercepted "electronic communications" and leave the decryption method undisclosed. This disparity creates significant strategic opportunities: if your case is in a circuit that requires particularized disclosure, and the government failed to provide it, you move to suppress the entire wiretap under § 2518(10)(a). If the government disclosed a specific decryption method, you can then challenge whether that method violated the defendant's Fourth Amendment rights or exceeded the scope of the original wiretap order. I have also found that many government wiretap applications in encrypted messaging cases fail to address the minimization issue at all, simply stating that "minimization will be conducted in accordance with standard procedures." This boilerplate language is almost certainly insufficient under § 2518(5) when the government cannot read messages in real time, and I have successfully used this argument to obtain evidentiary hearings in multiple district courts.

If you or your organization is facing a federal investigation involving encrypted messaging evidence, do not assume that the government's wiretap was lawfully obtained. The circuit split on wiretap evidence creates significant opportunities for suppression, but only if you challenge the government's compliance with Title III at the earliest possible stage. I have spent decades on both sides of these cases, and I know exactly where the government cuts corners—particularly when it comes to decryption disclosure, minimization procedures, and metadata collection. Contact my office today for a confidential consultation. We will review your wiretap order, the government's application, and the technical affidavits to determine whether the evidence against you can be suppressed. Time is critical: suppression motions under § 2518(10)(a) must be filed before trial, and the government will argue that any delay waives your objections. Let's put my 25 years of experience to work for you.