Why Criminal-Defense Lawyers Are Turning to Claude — and What Went Wrong in U.S. v. Heppner

If you're a defense attorney staring down another 40-hour discovery dump, you already know the problem: bodycam footage, jail calls, police reports, and 911 audio keep piling up faster than any human can review them. That pressure explains why searches for "claude for lawyers" jumped 3,029% year over year — defenders are looking for a way to get through the evidence faster, and Claude's long context window (up to a million tokens on supported plans) makes it tempting for exactly this kind of volume work.

But before you paste a single jail-call transcript into a consumer chat window, you need to know what happened to the defendant in U.S. v. Heppner.

In that case, decided in the Southern District of New York in February 2026, Judge Rakoff ruled that a criminal defendant's conversations with consumer-tier Claude were neither privileged nor work product — and the exchanges were introduced at trial. The defendant was convicted on all counts in May 2026. The chats stopped being his words and became the government's evidence.

The ruling broke down into three failure points, and each one matters for how you use AI in your practice:

• AI is not an attorney. Communications with the model don't fall within the attorney-client relationship, no matter how much the defendant relied on them.
• The consumer terms of service failed the confidentiality prong. Anthropic's August 2025 consumer policy introduced opt-in model training with five-year data retention — a posture that can't support a confidentiality expectation.
• Counsel never directed the use. The defendant acted on his own. The court suggested the analysis might differ if the lawyer had directed the AI use — a distinction that turned out to be decisive.

Here's the part defenders should take seriously: the Kovel door remains open. Counsel-directed use of AI on a platform with contractual confidentiality might still preserve privilege — the court left that path available, even though enterprise-provider treatment with zero-retention agreements remains untested in court.

The practical takeaway is a two-part test before any AI touches your case file. First, the use must be counsel-directed and documented — GC AI's framework recommends recording deployment in a policy memo so the record shows the lawyer, not the client, drove the workflow. Second, the platform must have a real confidentiality posture: enterprise tiers like Claude for Work remain no-train, unlike consumer accounts.

This is also where a purpose-built workspace changes the calculus. Evidence Copilot's MCP server, for example, gives Claude read-only, org-scoped access to case evidence with revocable tokens and a full audit trail — the kind of counsel-directed, documented channel that maps to what Heppner says is missing from ad-hoc consumer use.

The privilege risk is real, but it isn't a reason to abandon AI. It's a reason to structure the workflow the way the court's own analysis points: under counsel's direction, on a platform built for confidentiality.

The Four Rules for Using Claude on Legal Work Without Risking Your Case

U.S. v. Heppner made the stakes concrete: a criminal defendant's consumer-tier Claude exchanges were ruled neither privileged nor work product, and were later introduced as evidence at his conviction. The good news is that GC AI has distilled the safe-use playbook into four rules that map directly onto ABA Formal Opinion 512's duties of competence, confidentiality, and supervision.

Rule 1: Use the right tier. Anthropic's August 2025 consumer policy shift introduced opt-in model training with five-year data retention — a non-starter for privileged work. Claude for Work and Team plans carry a no-training posture, which is the only defensible baseline for client material.

Rule 2: Document deployment as counsel-directed. The Heppner court hinted the analysis might change where counsel directs the AI's use — the Kovel analogy. Put it in writing: a short office policy memo stating that AI use is counsel-directed, on which platform, for what tasks.

Rule 3: Verify every citation against a primary source. Claude has no verified legal database behind its answers, and even Latham & Watkins got burned when Claude hallucinated citation details in a 2025 court filing. Anthropic's own plugins state output is "a draft for attorney review, not legal advice."

Rule 4: Match scope to the model. Long-context work fits Claude's strengths — a 200–300 page deposition transcript fits in one session. Niche jurisdictional analysis does not.

The verification rule deserves extra attention for defense work, because the failure mode is subtle:

• Claude conflates "I did not find it" with "it does not exist" — a Quinn Emanuel of counsel watched it confidently deny a termination-at-will clause it simply hadn't located.
• Answers grounded in model knowledge can't be checked against anything; answers grounded in your discovery can.
• Every claim you put in a motion needs a clickable path back to the source — the page of the police report, the second of the bodycam.

That last point is why we built Evidence Copilot's read-only MCP server: Claude can query your cases and pull citations into the exact video moment or PDF page, so verification is a click, not a scavenger hunt. Every AI output is marked AI-generated and pending human review — the same human-in-the-loop posture Anthropic's own documentation requires.

The four rules aren't about avoiding AI. They're about using it the way ABA 512 already demands: competently, confidentially, and under your supervision — with the citation trail to prove it.

The Copy-Paste Problem: Why Raw Claude Chats Fail on Evidence Review

Rupert Goodway, Of Counsel at Quinn Emanuel, learned this the hard way: Claude ran a keyword search on a document, found nothing, and confidently reported that a termination-at-will clause didn't exist. The model had conflated "I didn't find the keyword" with "the right doesn't exist." The fix, per Goodway, is insisting Claude read the whole document — then confirming it actually did.

That failure mode matters even more in criminal defense, where the stakes of a missed clause are a missed suppression argument, a missed impeachment line, a missed Brady inconsistency.

The raw-chat workflow breaks down in three specific ways for defense evidence:

• No word-level timestamps. Paste bodycam or interrogation footage transcripts into chat and you get text with no time anchors. You can't verify an answer against the exact second of video — and "the officer said X" is worthless on cross if you can't find the moment it was said.
• No speaker diarization QC. Chat-pasted text has no reliable speaker attribution. Who said "I didn't consent to a search" — the driver or the passenger? Claude can't tell you, and neither can you, once the attribution is lost in a paste.
• No way to check the answer against the source. A ~100,000-token transcript — roughly 200–300 pages of deposition — fits in Claude's context window, and contradiction-flagging across a single long document works well. But the answer is only as good as your trust in the model's memory of what it read.

The Quinn Emanuel anecdote is the cautionary tale: even sophisticated litigators hit the gap between what the model found and what exists in the file. About 75% of lawyers cite accuracy as their biggest AI concern, and Anthropic's own legal documentation requires disclaimers that AI summaries must be reviewed by legal professionals — because the model's say-so is not verification.

This is where MCP — Model Context Protocol — changes the workflow. Instead of pasting text into a chat and hoping the model remembers it correctly, MCP connectors let Claude query your case data directly: search the transcripts, read a specific window, pull a citation. The answer comes back tied to the source, not reconstructed from model memory. Thomson Reuters built exactly this kind of integration connecting Claude to CoCounsel Legal, and their CTO's framing is the point: trust in AI is "a property of the system itself, built into the architecture and verifiable at every step."

For defense work, that architecture looks like a grounded evidence-review workspace: timestamped, diarized transcripts and OCR'd document text that Claude can query through an MCP server — read-only, org-scoped, with revocable tokens and a full audit trail. Evidence Copilot's MCP integration exposes exactly those tools (list_cases, list_evidence, search_evidence, read_window, get_citation), so every answer Claude gives can be checked against the exact video second or PDF page it came from.

The copy-paste problem isn't that Claude can't read your evidence. It's that without grounded citations, you're asking a very capable model to testify from memory — and cross-examining it later is impossible.

Step-by-Step: Connecting Claude to Your Case Evidence via Evidence Copilot's MCP Server

The hard part of connecting Claude to case evidence isn't the model — it's the channel. In U.S. v. Heppner, a judge held that a criminal defendant's consumer-tier Claude exchanges carried no privilege, partly because counsel had not directed the use. The court suggested the analysis might change if counsel directed the work on a platform with contractual confidentiality — but that treatment is untested in court, so the setup you choose matters as much as the questions you ask.

Evidence Copilot's MCP server is built for that posture: read-only, org-scoped, revocable tokens, fully audited. Here's the workflow.

Step 1: Get the discovery into a reviewable state. Upload the dump — bodycam video, 911 audio, jail calls, interrogation footage, scanned police reports — by web upload or the per-case email address, up to 2 GB per file. Transcription runs with speaker diarization and word-level timestamps; scanned PDFs and photos go through OCR so they become searchable, citable text. Originals stay immutable.

Step 2: Connect Claude Desktop or Claude Code. Generate an org-scoped token in Evidence Copilot, add the MCP server to your Claude client, and you're connected. The token is revocable at any time, and every query is logged — which matters if you ever need to document the deployment as counsel-directed, the posture GC AI's framework recommends for privileged work.

Step 3: Work through the five tools. Claude can call:

• list_cases and list_evidence — see what's in the case and what's in each file without leaving your chat.
• search_evidence — full-text search across every transcript and document. Ask: "find every mention of consent to search across the bodycam and the report."
• read_window — pull the exact transcript segment around a hit, like the precise second the officer reads Miranda rights.
• get_citation — retrieve the clickable citation into the exact video moment or PDF page behind any answer.

Step 4: Verify against the source. Every answer comes back with a citation that seeks the exact source moment — so "the jail call contradicts his statement" is checkable in one click, not taken on the model's word. That's the failure mode Quinn Emanuel's Rupert Goodway hit when Claude conflated "no keyword found" with "the right doesn't exist." With roughly 75% of lawyers citing accuracy as their biggest AI concern, per an ABA survey, verifiability isn't optional.

Every AI output is marked AI-generated and pending human review, and the product never makes legal conclusions — consistent with Anthropic's own guidance that output is "a draft for attorney review, not legal advice". Claude does the searching; you do the judging.

What This Costs and What It Doesn't Replace

Let's talk numbers, because you've been burned by "contact sales" pricing before.

Claude Team runs roughly $20–25 per user per month with a 2-seat minimum, per pricing comparisons. Harvey, by contrast, is estimated at $1,000–$1,200 per lawyer per month plus minimum seats — and even the sources reporting those figures flag them as unconfirmed estimates. If you're a solo defender or a two-person firm, the math isn't close.

Evidence Copilot publishes its pricing on the site, no sales wall: Solo is $39/user/month with 15 media-processing hours included, Firm is $99/user/month with 60 hours and a priority queue, and the PD Office tier is $750/attorney/year with 100 hours. Overage is metered and hard-capped at 3x included hours, so a surprise 40-hour bodycam dump can't run your bill up unbounded. Every plan includes the full workspace — there are no feature tiers holding redaction or cross-exam drafts hostage.

Now the part that matters more than price: what this stack does not do.

• Claude drafts — motions, cross-exam questions, summaries. It does not decide anything for you.
• The evidence agent surfaces inconsistencies and cross-exam questions tied to quoted sources — suggested questions only, no credibility conclusions.
• Every AI output is marked AI-generated and pending human review; originals stay immutable.
• No tool in this workflow makes legal conclusions. Attorney judgment stays in the loop, full stop.

That boundary isn't a marketing hedge — it's the same rule Anthropic itself operates under. Its own legal plugins state output is "a draft for attorney review, not legal advice, not a legal conclusion, not a substitute for a lawyer," and its official legal summarization guidance requires review disclaimers on every AI summary. And remember U.S. v. Heppner: a criminal defendant's consumer-tier Claude exchanges carried no privilege. Use enterprise or work tiers, document the use as counsel-directed, and verify every citation against the primary source — the Quinn Emanuel anecdote where Claude conflated "no keyword found" with "the right doesn't exist" is why the clickable citations matter.

So the honest summary: Claude is a capable drafting engine at a price most defenders can justify, and a grounded evidence-review workspace makes that drafting verifiable against the actual bodycam second or PDF page. Neither replaces your judgment.

If you want to see the workflow on your own discovery, book a 20-minute walkthrough at evidencecopilot.com/book — or skip the call and start on the Solo plan at evidencecopilot.com/signup.