Louise Lipsker and Rob Cohen Warn of Foreign Intelligence Risks in Legal AI Use for New York Law Journal
August 12, 2026
Large language models are reshaping how lawyers work, but the sensitive client information they process often crosses borders and lands within reach of foreign governments. Harris St. Laurent LLP associate Louise Lipsker and partner Rob Cohen examine this underappreciated risk in a New York Law Journal article titled "LLMs: The New Foreign Intelligence Risk for Law Firms Nobody Is Discussing."
Lipsker and Cohen argue that the profession's focus on the familiar problems of pasting secrets into AI tools and hallucinated citations can crowd out a larger concern: hosted AI models route a client's most sensitive information into infrastructure that several governments can lawfully access, sometimes including states adversarial to the client. They trace how a single prompt can leave the building for servers a lawyer cannot locate, run by cloud hosts and subcontractors the firm never selected.
The authors map the legal mechanisms that can impact data once it sits on an AI’s global infrastructure. On the U.S. side, they analyze Section 702 of the Foreign Intelligence Surveillance Act and its incidental collection of communications involving U.S. persons, the 2024 Reforming Intelligence and Securing America Act's expansion of covered providers, and the CLOUD Act's reach over American providers' data stored overseas. They note that Section 702 lapsed on June 12, 2026, with collection continuing under existing Foreign Intelligence Surveillance Court certifications while reauthorization remains unresolved.
Lipsker and Cohen then turn to the European compliance side, tracing the GDPR's restrictions on transfers to countries lacking equivalent protection, the Court of Justice of the European Union's decision in Schrems II striking down Privacy Shield, and the pending challenge to the successor EU-U.S. Data Privacy Framework in Latombe v. Commission. They also caution that abandoning U.S. providers offers no refuge, pointing to Article 7 of China's National Intelligence Law as an example of a far less constrained access regime.
The article further examines how disclosure through AI tools can erode the legal protections attached to client information itself, including trade secret status under the Defend Trade Secrets Act and attorney-client privilege under the narrow agent exception of United States v. Kovel. The authors conclude that a lawyer's existing ethical duties of competence, confidentiality and client communication under the New York Rules of Professional Conduct already govern these choices, a view they note aligns with ABA Formal Opinion 512 and New York City Bar Formal Opinion 2024-5.
"The solution is not to put the tools down," Lipsker and Cohen write. "Instead, firms must ask the right question: whose sovereign reach does this client's information flow into?"
Read the full article here.
Louise Lipsker is an associate with Harris St. Laurent whose litigation practice is focused on a variety of commercial matters, white-collar defense cases and issues arising from developing AI and other technologies, as well as employment and workplace-related disputes.
Rob Cohen is a partner and commercial litigator who has litigated multi-billion-dollar disputes and led major government investigations.
