Tor for Legal Professionals

Legal professionals face specific surveillance threats. Government surveillance of legal communications: in national security and terrorism cases, government agencies have been documented monitoring attorney-client communications under FISA and similar authorities. Bar associations and ethics guidance have addressed this concern - the California Bar, New York Bar, and others have issued opinions addressing lawyer obligations when government surveillance is suspected. ISP-level monitoring: lawyers researching criminal law, immigration, or civil rights have the same ISP-level surveillance exposure as any user. ISPs can sell browsing data to data brokers, potentially revealing a law firm's client type and practice area specialization. Discovery in civil litigation: opposing parties can subpoena records from email providers, cloud storage services, and potentially ISP logs (within legal limits). Minimizing records helps reduce discovery exposure.

Attorney-client privilege protects communications between lawyers and clients. The privilege is waived if communications are shared with third parties. Digital third parties include: email providers who can access email, cloud document services, and ISPs who log traffic. Using Tor for attorney-client communications reduces third-party access: the content of communications between attorney and client via Tor-protected channels (Matrix E2EE, ProtonMail via .onion) is encrypted end-to-end and not accessible to network intermediaries. For high-stakes cases: set up a secure communication channel with clients using .onion-based messaging. Instruct clients to access the channel via Tor Browser. This creates a communication channel where: the ISP cannot see metadata, the communication provider does not have access to content, and no intermediary can be subpoenaed for communication records.

Research activities that benefit from Tor protection: researching specific statutes or regulations related to a case creates records that could reveal case strategy if discovered. Researching a specific company or individual creates records of the law firm's investigative focus. Researching expert witnesses or consultants reveals areas of legal theory being developed. Consulting academic databases for social science research reveals the basis for expert arguments. All of these research activities, conducted via clearnet browsers, create ISP-level traffic records. Conducting research via Tor Browser creates no ISP-level record of the research activity. For case-sensitive research: use a dedicated Tor Browser profile for each major case to prevent cross-case session linkage.

The initial client intake process involves collecting sensitive client information before the engagement is formalized and protections are clearly established. Secure intake channels: a SecureDrop instance or OnionShare receive-mode allows potential clients to submit initial documents and information anonymously if needed. This is particularly valuable for criminal defense (potential clients who are not yet charged and want to consult without creating police-accessible contact records), immigration law (undocumented clients concerned about record creation), and whistleblower representation. Document handling: client documents submitted via SecureDrop are received on an air-gapped workstation with no internet connection, providing maximum security for the intake process. The Freedom of the Press Foundation provides setup assistance for legal organizations seeking to implement SecureDrop.

State bars in the US and bar associations in other countries have issued guidance on attorney obligations regarding digital security. Common themes: competence includes understanding the security risks of electronic communication, lawyers must take reasonable measures to protect confidential client information, and cloud storage and email security require assessment before use for sensitive client data. Using Tor for sensitive communications and research is consistent with this guidance: it represents a reasonable precaution for lawyers who assess their practice as involving elevated surveillance risk. For lawyers working with government contractors, in national security-adjacent practice areas, or representing clients targeted by law enforcement: the 'reasonable measures' standard likely requires more than default email and cloud storage. Document your security assessment and the measures implemented to demonstrate compliance with competence and confidentiality obligations.