MLAT vs LERS vs Interpol: Which Channel, When

When a fraud, intrusion or exploitation case crosses a border, the evidence you need almost always sits somewhere else: on a platform's servers, inside a foreign bank, or with a suspect who has already left your jurisdiction. The fastest way to lose months is to send the wrong request down the wrong channel — firing off a treaty request for data a platform would have handed over through its law-enforcement portal in days, or expecting INTERPOL to "get the evidence" when INTERPOL does not collect evidence at all. This guide sets out the main cross-border channels, what each can and cannot deliver, and a decision flow for choosing between them. It is general, practitioner-oriented information, not legal advice; the exact procedure, authority and form depend on your own jurisdiction and the treaties in force.

The landscape: data, evidence, or people

The single most common mistake is treating these channels as interchangeable. They are not. Sort your problem into one of three buckets first, and the channel follows:

• Data the platform holds (subscriber records, login IPs, preservation) goes through the platform's law-enforcement portal, and increasingly through CLOUD Act or EU e-Evidence routes.
• Compelled, court-ready evidence (content, bank records, testimony) goes through MLAT or letters rogatory — slow, formal, government-driven.
• A person (locate, identify, arrest with a view to extradition) goes through INTERPOL, which coordinates but never compels.

Match the channel to the bucket before you draft anything. In real cases you will usually run more than one in parallel.

Platform law-enforcement portals (LERS): fast, but only for what the platform holds

Most large platforms — Meta, Google, Apple, Microsoft, X, Discord, the major exchanges — operate a Law Enforcement Response System (LERS) or equivalent online portal. These are the fastest route for two things:

• Preservation requests, which freeze an account's data so it is not deleted while you build legal process.
• Basic subscriber information (registration details, associated email or phone, IP login history) where your legal authority and the platform's policy permit voluntary disclosure.

The hard limit is content. Always send a preservation request through the portal the moment you know a platform holds relevant data, even when you know an MLAT is coming. Preservation buys you the months a treaty request takes without losing the evidence to retention limits.

The content wall: why a US provider will not hand you messages

For providers subject to United States jurisdiction, the Electronic Communications Privacy Act (ECPA) and its Stored Communications Act (SCA) are generally read to prohibit US-based providers from disclosing stored communications content directly to a foreign government. Message bodies, photos and stored files sit behind that wall, regardless of what a portal will show you for subscriber data.

That single rule explains the whole architecture below. To reach content held by a US provider, a non-US investigator has historically needed legal process valid in the provider's home jurisdiction — meaning an MLAT request to the US Department of Justice. The CLOUD Act was built specifically to create a faster, lawful exception to that bar for partner countries.

MLAT: the formal route for compelled evidence, including content

A Mutual Legal Assistance Treaty is a government-to-government agreement for obtaining evidence usable in court — the content data a platform will not surrender voluntarily, bank records, and compelled witness testimony. Requests do not travel police-to-police; they route through each country's designated central authority.

• United States: the central authority is the Attorney General, who has delegated the function to the Office of International Affairs (OIA) in the Criminal Division of the Department of Justice. OIA processes incoming and outgoing requests.
• India: under the Allocation of Business Rules, the Ministry of Home Affairs (MHA) is the nodal ministry and central authority, with its Internal Security-II (IS-II) Division handling requests.

Verify the correct central authority for any given country before drafting — misrouting adds months. The trade-off is speed: requests pass through multiple layers of review in both states and commonly take well over a year for content. Use MLAT when you need court-admissible evidence and no faster lawful route exists. Never use it for a fast lead or a preservation freeze.

Letters rogatory: the fallback where no treaty exists

A letter rogatory (letter of request) is a formal request from a court in your country to a court in another, asking it to perform a judicial act such as taking evidence or testimony. It rests on judicial comity rather than treaty obligation, customarily includes a promise of reciprocity, and can be declined by the receiving court.

Because it travels court-to-court and usually through diplomatic channels, it is typically even slower than an MLAT — six months to well over a year is normal. Reach for it only when there is no applicable MLAT between the two states. Where a treaty exists, the MLAT is faster and more reliable.

The faster modern routes: CLOUD Act and EU e-Evidence

Both were built specifically to cut the treaty delay for electronic data.

The United States CLOUD Act (2018) lifts the SCA blocking effect so US providers may disclose data — including content — directly to a foreign government, but only one that has signed a qualifying executive agreement with the US. The first such agreement was the US-UK Data Access Agreement, signed in October 2019 and in force from 3 October 2022; Australia and others have followed or are negotiating. If your country has a CLOUD Act agreement, that is dramatically faster than an MLAT for provider content. If it does not, you are back to the treaty route.

Within the EU, the e-Evidence Regulation (EU) 2023/1543 creates the European Production Order and European Preservation Order, letting a judicial authority in one member state require a service provider offering services in another member state to hand over or preserve electronic evidence directly — bypassing the authorities of the provider's state. It entered into force on 18 August 2023 and becomes directly applicable on 18 August 2026 after its transition period. It binds all EU member states except Denmark, and reaches providers offering services in the EU.

INTERPOL: locate and identify people, not evidence

INTERPOL is frequently misunderstood. It is not a route for obtaining evidence and it cannot compel any member country to act. It connects 196 member countries through the secure I-24/7 network and issues colour-coded Notices to share alerts and requests. The action that follows is always taken by national authorities under their own law:

• Red Notice — to seek the location and arrest of a person wanted for prosecution or to serve a sentence, with a view to extradition, surrender or similar lawful action. It is a request for provisional arrest, not an international arrest warrant; each country decides whether to act.
• Blue Notice — to collect additional information about a person's identity, location or activities in relation to a criminal investigation.
• Green Notice — to warn about a person's criminal activities where the person is considered a possible threat to public safety.
• Yellow Notice — to help locate a missing person, often a minor, or identify someone unable to identify themselves.

Use INTERPOL when your problem is "where is this suspect" or "who is this person", and pair it with an MLAT or extradition process for anything you need as evidence or to bring the person to court.

Decision matrix: what you need to which channel

What you need	Best channel	Typical speed	Limits
Stop data being deleted right now	Platform LERS preservation request	Hours to days	Freezes only; does not disclose. Follow with legal process.
Basic subscriber and account info, login IPs	Platform LERS	Days to weeks	Subject to platform policy and your legal authority; no content.
Stored content (messages, files) from a foreign provider	CLOUD Act or EU e-Evidence if available, otherwise MLAT	Days to weeks (agreement) vs months (MLAT)	Direct disclosure needs a qualifying agreement; otherwise central-authority route.
Court-admissible evidence, bank records, compelled testimony	MLAT (via central authority)	6 to 24 months	Slow; routed government-to-government; treaty must exist.
Evidence where no MLAT exists	Letter rogatory (court-to-court)	6 months to 2 years or more	Discretionary; based on comity; slowest route.
Locate, identify or arrest a person abroad	INTERPOL (Notice plus I-24/7)	Variable	Not evidence; cannot compel action; national authorities decide.

How to choose your channel, step by step

1. Preserve first, always. The moment you know a platform holds relevant data, send a preservation request through its LERS portal. This buys you the months an MLAT may take without losing the evidence to retention limits.
2. Sort the request. Separate it into people (locate or identify), non-content records (subscriber data, IPs, transaction logs) and content (messages, files). Each maps to a different channel.
3. Take the fast lawful route for data. For non-content records, use the platform portal. For content, check whether a CLOUD Act executive agreement (or, within the EU, e-Evidence once applicable) lets you go direct — far faster than an MLAT.
4. Use MLAT for compelled, court-ready evidence. Where the fast routes do not reach (content with no qualifying agreement, bank records, testimony), draft through your central authority — OIA in the US, MHA IS-II in India; verify the authority for the relevant country — and budget many months.
5. Fall back to letters rogatory only with no treaty. If there is no MLAT between the two states, prepare a letter rogatory through the court and expect it to be slower still.
6. Run INTERPOL in parallel for the person, not the evidence. If a suspect's location or identity is in question, request the appropriate Notice and use the I-24/7 channel alongside — never instead of — your evidence route.

Frequently asked questions

Can I just send an MLAT to get someone's WhatsApp or Gmail messages? You can, but for a US provider that is often the only lawful route to content unless your country has a CLOUD Act executive agreement with the US — and it can take well over a year. Send a LERS preservation request immediately so the content still exists when the MLAT lands.

Does an INTERPOL Red Notice mean the suspect will be arrested abroad? No. A Red Notice is a request to locate and provisionally arrest with a view to extradition; it is not an international arrest warrant. Each country decides, under its own law, whether to act, and INTERPOL cannot compel an arrest or produce evidence.

Who do I send a cross-border evidence request to? For formal assistance, not your foreign police counterpart directly — the designated central authority. In the US that is the DOJ Office of International Affairs; in India, the Ministry of Home Affairs IS-II Division. Verify the correct authority for the specific country before drafting, because misrouting adds months.

Is the EU e-Evidence Regulation usable today? Not yet in practice. It entered into force in August 2023 but only becomes directly applicable on 18 August 2026, after a transition period for member states and providers to prepare. Until then, EU cross-border requests still rely on existing instruments.

This guide is part of our Guides for Investigators & Police reference series, covering Foundations, Mobile, Web & Social, Crypto, Cloud and AI.