Defensible Discovery for Trade and Customs Fraud Investigations
Trade fraud is now a top civil and criminal enforcement priority for the U.S. Department of Justice (DOJ), U.S. Customs and Border Protection (CBP), and Homeland Security Investigations (HSI). Corporations and the law firms representing them that receive a Civil Investigative Demand (CID) or grand jury subpoena, or that identify potential trade fraud internally, must gather, analyze, and produce evidence that is credible, complete, and defensible. HaystackID brings together the advisory experts, project managers, certified forensic examiners, data scientists, and managed review teams that a leading eDiscovery and data management partner must provide to meet that standard.
The Trade Fraud Enforcement Landscape
The customs entry process is highly regulated, and the Importer of Record (IOR) cannot shift its obligation to exercise reasonable care onto its Customs Broker. Enforcement agencies now use AI-powered supply chain mapping to detect anomalies across millions of entry records that may suggest undervaluation, transshipment, misclassification, and other violations. The interagency Trade Fraud Task Force (TFTF), launched in August 2025, and the DOJ’s May 2025 designation of trade fraud as a white-collar criminal enforcement priority establish that corporations now should expect and be prepared for sophisticated, data-driven investigations.
$1B+
in civil and criminal trade fraud recoveries in under a year
The timeline of events relating to the increased focus on trade fraud is as follows:
May 12, 2025
In a DOJ memorandum to the DOJ Criminal Division, Matthew R. Galeotti, the Head of the Criminal Division, elevated trade fraud to a white-collar criminal enforcement priority instead of just an administrative error, signaling to corporations to expect sophisticated, data-driven investigations that may be a precursor to a criminal investigation.
August 29, 2025
The DOJ and U.S. Department of Homeland Security (DHS) launched the interagency TFTF, which leverages experienced resources for both civil and criminal enforcement actions.
July 6, 2026
The DOJ and DHS promulgated the Resource Guide to Trade Fraud Enforcement, citing federal laws that will be utilized in enforcement. Furthermore, the guide details how private citizens may use qui tam suits against potential defendants on behalf of the federal government.
July 14, 2026
In a press release, the DOJ announced that the TFTF had already surpassed $1 billion in civil and criminal trade fraud recoveries in less than one year.
August 13, 2026
Colin M. McDonald, Assistant Attorney General, issued a memorandum framing fraud as a major national problem, citing Government Accountability Office estimates that the federal government loses hundreds of billions of dollars annually to fraud. The memo also established the necessity of pursuing fraud claims of all sizes and forms, announced the planned expansion of DOJ trade fraud capabilities, and laid out enforcement priorities and mechanisms to accomplish that goal.
October 1, 2026
Colin M. McDonald sent a follow-up memorandum detailing the DOJ enforcement prioritizations specific to corporations and issued a 10-point factor test for determining whether to bring charges, negotiate pleas, or engage in other agreements.
As a result of the increased focus and prioritization from the federal government on trade fraud, an organization faces significant civil and criminal exposure from several directions simultaneously:
Civil penalties under 19 U.S.C. § 1592
Penalties scale with culpability, reaching up to the full domestic value of the merchandise tainted by trade fraud.
Criminal liability
Smuggling and related statutes under 18 U.S.C. §§ 541–551 carry imprisonment, fines, and forfeiture, and trade fraud can serve as a predicate for money laundering and Racketeer Influenced and Corrupt Organizations Act (RICO) charges.
False Claims Act exposure
Reverse false claims carry treble damages, and qui tam whistleblowers such as import managers, brokers, logistics staff, and former employees have financial incentives to report violations.
Forced labor enforcement
Withhold Release Orders (WROs), Uyghur Forced Labor Prevention Act (UFLPA) enforcement, mandatory restitution, and forfeiture of property traceable to forced labor create supply-chain-wide risk.
Competitor and consumer claims
False country of origin representations can lead to Lanham Act, state consumer protection, and Federal Trade Commission (FTC) made-in-USA claims.
In this environment, the scope of information that enforcement agencies request is broad. Discovery in a government investigation extends to any information reasonably related to the investigation, and courts will rarely be presented with, or narrow, agency requests. The quality of a corporation’s discovery response directly affects its credibility, the penalties it faces, and the terms of any resolution, making it essential that discovery compliance is achieved with best practices.
Where HaystackID Fits on the Investigation Team
A trade fraud investigation typically involves five groups working together: the corporate legal and compliance departments, outside counsel, the eDiscovery service provider, the compliance expert, and the forensic accounting firm. The eDiscovery provider, working under the supervision of outside counsel, plays the leading role in data preservation and collection, data processing and search, and document review and production. HaystackID deploys best practices to fill that role and supports witness interviews and agency communications with the necessary data and analytics.
Legal and Compliance Departments
Outside Counsel
eDiscovery Service Provider
HaystackID
Compliance Expert
Forensic Accounting Firm
HaystackID operates as an agent of outside counsel so that investigative materials remain protected under the attorney-client privilege and work product doctrine. It also acts as the data hub for the other advisors, delivering organized financial, ERP, and customs entry data to the forensic accounting firm and policy, training, and communications evidence to the compliance expert, which avoids overlapping roles and duplicative “boil the ocean” efforts.
Protected under the attorney-client privilege and work product doctrine
The HaystackID Engagement Team
Each trade fraud engagement is staffed with a defined team whose roles map directly to the needs of outside counsel and the corporate legal department.
Senior Vice President
(Executive Sponsor)
Provides executive oversight and a single point of escalation for the general counsel and outside counsel. Commits resources for surge demands, aligns pricing with budget constraints, and participates in strategy sessions where discovery scope and agency expectations are set.
Vice President
(Engagement Lead)
Owns the discovery strategy and solution design. Translates the CID or subpoena into a data plan, prepares validated burden and cost estimates for scope negotiations, coordinates with the compliance expert and forensic accounting firm, and ensures the workflow remains defensible from end to end.
Global Advisory Experts
Delivers data mapping, information governance, privacy, and cross-border transfer guidance. Data intelligence specialists design and validate GenAI workflows, develop trade fraud issue frameworks, and document methodology so results can be explained to enforcement agencies.
Project Managers
Run day-to-day execution. They manage kickoff, legal hold tracking, collection schedules, processing and search functions and reports, review functions and metrics, and production logistics, and they deliver daily status reporting and a documented audit trail of every agreement and decision.
Forensics Team
Certified forensic examiners perform forensic and logical collections across laptops, servers, cloud, ERP, and mobile sources, maintain chain of custody, authenticate documents and digital media, and serve as expert witnesses to describe collection and processing to agencies.
Managed Review
ReviewRight® teams of experienced contract attorneys, quality control reviewers, foreign language reviewers, and review managers conduct first-level and privilege review, apply AI-assisted prioritization, and provide outside counsel with coded, quality-checked work product.
Trade Fraud Response Lifecycle Services
The Response Process
The goal of the response process centers on accuracy and completeness in gathering, reviewing, analyzing, and producing data, setting the stage for conducting witness interviews. A narrow approach may reduce near-term costs, but risks leaving the corporation unaware of whether a violation occurred. This approach may lead to incomplete or incorrect information being given to internal investigators or governmental agencies and may overlook mitigating or exculpatory evidence that the investigation is not focused on finding. HaystackID helps counsel strike the right balance between a wide context-gathering review and a targeted production.
The Response Process
Data Preservation and Collection
Data Processing and Search
Document Review and Production
Witness Interviews
STRUCTURING THE RESPONSE
HaystackID supports outside counsel through each step of the response process:
- 1
Preliminary assessment and team formation
The SVP and VP engage with the corporate legal department and outside counsel at the outset, while Global Advisory experts conduct custodian and data source interviews to build a data map aligned to the key facts, suspected violations, and timeline in the investigation plan.
- 2
Scope negotiation with the investigating agency
The VP and Global Advisory experts provide validated information on the burdens and costs of compliance, sample data sets that show the government what it will receive, and knowledgeable HaystackID personnel who can support counsel’s representations about sources of information. Case Insight™, HaystackID’s GenAI early case assessment capability, identifies key people, documents, and factual patterns across the broader data population, helping counsel decide which entries, products, suppliers, time periods, custodians, and issues warrant investigation before the facts are fully developed.
- 3
Discovery and disclosure planning
Project managers convert the negotiated scope into a staged plan that produces the most important information first, limits custodians and less important, centralized sources where agreed, and documents every agreement reached with the agency.
- 4
Execution and reporting
HaystackID executes the plan through collection, processing, search, AI-assisted analysis, review, and production, with regular reporting that allows counsel to keep the agency informed of progress until all productions are complete.
MAPPING CID AND SUBPOENA REQUESTS TO DATA SOURCES
Enforcement agencies typically cast a wide net in trade fraud matters. HaystackID maps each request category to the systems that may hold responsive data and implements the best solution for a defensible response.
| Typical Request Category | Where the Data Resides | HaystackID Service |
|---|---|---|
| CBP submissions, including Forms 3461, 7501, and 29, and Partner Government Agency message sets. | Automated Commercial Environment (ACE) exports, trade compliance systems, and customs broker files. | Structured data extraction, normalization, and entry-level analytics. |
| Preparation of documents such as purchase orders, factory records, production schedules, bills of lading, routing and container records, and duty calculation spreadsheets. | ERP, procurement, logistics and transportation systems, shared drives, and collaboration sites. | Forensic and logical collection, ERP and database extraction, and spreadsheet analytics. |
| Communications with executives, sourcing teams, brokers, logistics staff, and manufacturers. | Email, Microsoft 365, Teams, Slack, text messages, WhatsApp, and WeChat. | Microsoft 365 preservation, MEDAL™ mobile forensics, and READI™ remote collection. |
| Evidence of reasonable care and Customs Broker due diligence. | Compliance policies, decision trees, ruling requests, training records, and broker correspondence. | Targeted collection and GenAI issue analysis. |
| Documents indicating suspected violations or trade fraud typologies. | Across the full data universe, including internal reports and hotline records. | GenAI red flag analysis, Case Insight, and prioritized review. |
Data Preservation and Collection
The preservation obligation begins upon reasonable anticipation of an investigation, and it requires suspending routine records destruction so that relevant information is not lost. Because the willful concealment or destruction of invoices, books, or papers relating to imported merchandise is itself a crime under 18 U.S.C. § 551, a defensible preservation program is essential. Preservation should cast a wider net than collection, since a misunderstanding of scope can result in the loss of key evidence and erode credibility with the investigating agency.
LEGAL HOLD AND PRESERVATION
Legal hold management
Project managers issue and track legal hold notices to employees, former employees, and third parties such as Customs Brokers and freight forwarders, and they manage reminders and compliance monitoring.
Microsoft 365 preservation
Implements in-place holds and preservation across mailboxes, OneDrive, SharePoint, and Teams.
Non-Microsoft and structured sources
Global Advisory and data science teams provide guidance on preserving ERP, procurement, and customs databases and mobile data, where native preservation features are often limited.
AI interaction records
HaystackID TRACE™ Suite captures and preserves enterprise AI interactions, such as Microsoft 365 Copilot and ChatGPT sessions, in a forensically sound format when employees may have used AI tools in classification, valuation, or sourcing decisions.
FORENSIC COLLECTION
Forensics First collections
Certified forensic examiners perform forensic imaging, which captures active, deleted, and partially deleted files, or logical collection of currently accessible files, based on the needs of the matter.
Mobile and messaging data
M365 with HaystackID Suite for Microsoft 365 Services provides remote triage, targeted extraction, and streamlined review of mobile content, including SMS, WhatsApp, WeChat, and other messaging applications that frequently hold supplier and broker communications.
Remote and cloud collection
HaystackID READI Suite enables remote collection from laptops and cloud platforms such as Box, Dropbox, Google Drive, and OneDrive, which is critical when custodians are dispersed across manufacturing and sourcing locations.
Cross-border data
Global Advisory experts manage collections subject to foreign privacy and data transfer laws, which is common when supply chains span multiple jurisdictions.
Chain of custody and testimony
The forensics team documents data acquisition, access, and metadata from collection through processing, and forensic experts are available to describe the process to enforcement agencies.
Document authentication
HaystackID VALID™ Suite helps authenticate digital documents and media, supporting investigations of forged certificates of origin, product safety certifications, and commercial invoices, since documentation from agents and third parties should not be accepted without confirming its authenticity.
Data Processing and Search
Processing extracts and indexes the content and metadata of collected files so that legal professionals can analyze them. HaystackID applies de-NISTing, de-duplication, email threading, near-duplicate detection, language identification, and concept clustering to reduce the review population, and it uses iterative search to narrow the data universe by date range, product, department, and issue. When results reveal gaps, the team reapplies collection and processing workflows to new data tranches.
Collected Data
Review Population
- De-NISTing
- De-duplication
- Email threading
- Near-duplicate detection
- Language identification
- Concept clustering
Iterative search narrows by
- Date range
- Product
- Department
- Issue
EARLY CASE INSIGHT AND SEARCH
Iterative, Documented Searches
Project managers and Global Advisory experts build and test search strategies, produce search term reports, and document the methodology to support negotiations with the agency.
Structured Data Analytics
HaystackID normalizes customs entry, ERP, and pricing data so that it can be analyzed alongside unstructured documents and shared with the forensic accounting firm.
Flexible Platforms
HaystackID Core® and CoreFlex™ provide access to leading platforms, including Relativity and Relativity aiR, within a secure, managed environment.
GENAI FOR TRADE FRAUD ANALYSIS
AI tools are now an essential part of an effective and efficient response to a trade fraud investigation, particularly because enforcement agencies are using AI to identify potential violations. HaystackID Core Intelligence AI™, powered by the company’s proprietary eDiscovery AI® technology, gives counsel an early and evidence-based understanding of the matter.
Given the document population and a brief case background, Case Insight classifies the data, surfaces the people, events, issues, and documents that matter most, and ties every conclusion to the underlying documents. CaseBot™ allows counsel to ask natural-language questions of the matter data, and its Specialized Skill Agents produce structured deliverables such as key-entity maps, fact narrative memoranda, and document-supported chronologies.
TYPOLOGIES AND RED FLAGS
HaystackID data intelligence specialists configure these capabilities around the trade fraud typologies and red flags identified by enforcement agencies and whistleblower counsel. Defined review criteria, evidence sources, and validation protocols guide testing across valuation, classification, origin, routing, trade program claims, and what the company knew, and GenAI review analyzes documents for trade fraud issues, red flags, knowledge indicators, and privilege with documented validation.
| Trade Fraud Typology | What GenAI Analysis Can Surface |
|---|---|
False country of origin and transshipment
|
Communications about rerouting through third countries, relabeling or covering “Made in” markings, and origin declarations that match the shipping port rather than the manufacturing facts. |
False Harmonized Tariff Schedule (HTS)
|
Discussions of describing finished goods as parts, reclassification after tariff changes, and pressure to use lower-duty codes. |
Undervaluation and first sale claims
|
Mismatches among commercial invoices, purchase orders, and payments, side agreements, and duty-savings calculations. |
ENTRY-LEVEL RECONCILIATION
Enforcement agencies see what the importer declared, while the company holds the evidence behind each declaration, and a trade fraud investigation often turns on whether the two match. HaystackID reconciles entry data and supporting customs records against the commercial record, running five comparisons entry by entry and tracing each discrepancy to its source documents. Each discrepancy, read together with supplier and factory correspondence, internal pricing and sourcing discussions, and the controls the company relied on, gives counsel a starting point to assess what happened, whether it matters, and what the company knew.
-
1Declared value
Tested against: Commercial invoices and payment records -
2HTS classification
Tested against: Product specifications and technical evidence -
3Country of origin
Tested against: Factory and production records -
4Routing
Tested against: Bills of lading and shipping records -
5Trade program claims
Tested against: Evidence supporting eligibility, such as FTA rules of origin documentation
SURFACING MITIGATING AND EXCULPATORY EVIDENCE
GenAI analysis is equally valuable for identifying mitigating and exculpatory evidence that supports the corporation’s position with enforcement agencies, including the following.
Reasonable Care
Policies, decision trees, consultations with customs professionals, and requests for classification or scope rulings.
Lack of Knowledge or Willfulness
Evidence that personnel acted in good faith, were uninvolved in or unaware of the conduct, or escalated concerns that were addressed.
Substantial Transformation
Manufacturing, processing, cost, and investment records from third-country facilities that support the declared country of origin.
Parts Versus Finished Goods
Engineering, assembly, and product specification documents that support the declared classification.
Every AI workflow is designed for defensibility. Outputs are cited to the underlying documents, validated by HaystackID experts and counsel through sampling and quality metrics, and run in secure environments certified to ISO 27001, SOC 2 and SOC 3, and compliant with HIPAA standards, supporting counsel’s ethical obligations when using AI tools.
DOCUMENT REVIEW AND PRODUCTION
HaystackID Global Managed Review, powered by ReviewRight, provides teams of experienced contract attorneys who perform first-level review under the supervision of outside counsel. With a network of more than 35,000 reviewers and more than 6,000 completed review matters, including trade fraud and other government investigation reviews, HaystackID can staff trade fraud reviews quickly and at scale.
35,000+
Reviewer Network
6,000+
Completed Review Matters
HaystackID also provides contract data lawyers who extend the capacity of law firm teams on trade fraud matters. These attorneys combine legal training with hands-on expertise in eDiscovery technology, analytics, and GenAI, and they work under the direction and supervision of outside counsel as an extension of the firm. Data lawyers can draft ESI protocols and production specifications, prepare search term and burden analyses for scope discussions with the agency, develop and validate GenAI prompts and issue frameworks tied to trade fraud typologies, prepare privilege logs, and assemble chronologies and witness materials. This model allows law firm attorneys to focus on strategy, agency communications, and advocacy while keeping the cost of discovery tasks lower and more predictable.
Review Workflow
- 1
AI-Assisted Culling and Prioritization
GenAI and technology-assisted review set aside clearly irrelevant material and route the most important documents to reviewers first.
- 2
Reviewer Selection and Training
ReviewRight Match AI™ selects reviewers with trade fraud and other government investigation experience, and outside counsel trains the team on the matter, the coding protocol, and sample documents.
- 3
First-Level Review
Reviewers code documents for relevance, trade fraud issues, and privilege in custodian-based batches.
- 4
Quality Control
Dedicated QC reviewers review up to 10% of each reviewer’s prior-day work to catch analytical and coding defects before they become systemic.
- 5
Second-Level and Privilege Review
Senior reviewers handle privilege, non-English language documents, and critical issues, and outside counsel receives regular sets of coded documents for feedback.
- 6
Production and Logging
Project managers produce documents in compliance with published agency specifications and prepare privilege logs in the agreed format.
Review Capabilities
Foreign Language Review
ReviewRight Translate® sources and tests reviewers on real-world review tasks in the required language, which is vital when supplier and factory documents are written in Chinese, Vietnamese, Spanish, and other languages.
Technology-Assisted Review
ReviewRight Automate® supports both predictive coding (TAR 1.0) and continuous active learning (TAR 2.0) to reduce cost and improve accuracy on large document populations.
Reporting and Transparency
Review managers provide daily progress, accuracy, and throughput reports to outside counsel.
Privilege Protections
HaystackID supports categorical and email-thread privilege logging, metadata-based logs, and clawback agreements negotiated with the agency.
Productions
HaystackID has a history of productions under DOJ specifications and supports staged, rolling, and sample productions under the discovery and disclosure plan.
WITNESS INTERVIEWS
Witness interviews are a primary method for outside counsel to establish the facts related to potential trade law violations. Ideally, document review is substantially complete before interviews begin, although early interviews can help focus the investigation. Trade fraud witnesses may be located around the world and present language and cultural barriers, and employees may use the complexity of classification and valuation rules as a shield from scrutiny.
Witness preparation materials
CaseBot Specialized Skill Agents and review teams produce key-entity maps, document-supported chronologies, hot document sets, and interview preparation kits for each witness.
Consistency analysis
AI tools help identify whether outline questions have been asked, flag potential inconsistencies between a witness’s account and other witnesses or documents, and summarize testimony after the interview.
Language support
Foreign language reviewers and translation resources help counsel prepare for interviews of overseas personnel and third parties.
Data source interviews
The forensics team conducts technical custodian interviews to confirm where relevant data resides and to identify additional sources.
Evidentiary foundation
HaystackID forensic experts can provide information and testimony on the original location, authenticity, and evidentiary foundation of documents, which enforcement agencies often require as part of cooperation obligations in resolutions.
Supporting Agency Communications, Disclosure, and Compliance
HaystackID’s support continues after documents are produced. The same data, metrics, and documentation help counsel communicate with enforcement agencies, pursue voluntary disclosure, and modernize the trade law compliance program.
Agency communications
Defensibility reports, search and review metrics, and chain-of-custody documentation support counsel’s presentations on the merits, including arguments that the IOR exercised reasonable care.
Voluntary disclosure
Structured entry data analysis helps identify the merchandise and entries involved, a requirement for a valid prior disclosure to CBP, and supports prompt production of documents to earn cooperation credit. Entry-level discrepancy analysis and CaseBot Specialized Skill Agents assemble the source-linked factual record needed to identify the affected entries, explain the issue, and support a potential prior disclosure or agency response, while counsel makes the legal judgment.
Resolution obligations
HaystackID helps corporations meet deferred prosecution agreement requirements to assemble, organize, and timely provide documents and information on request.
Compliance program modernization
Global Advisory’s information governance, privacy, and compliance practices help build active auditing and supply chain verification capabilities, and HaystackID COMET™; enables scheduled, recurring collection of business mobile communications for ongoing compliance oversight.
HaystackID also uses software and AI technology to conduct trade fraud compliance assessments. The same issue framework developed for the investigation is applied to ongoing import activity, running the same five entry-level comparisons of declared value, HTS classification, country of origin, routing, and trade program claims against the commercial record described above. GenAI review then analyzes supplier and factory correspondence, internal pricing and sourcing discussions, and the controls the company relied on for red flags and knowledge indicators. The result is anomaly identification, control testing, and periodic auditing, with every finding traced to its source documents, giving counsel, the compliance expert, and the Board of Directors an evidence based view of compliance gaps and remediation priorities while counsel retains the legal judgment.
Ongoing Compliance Assessment
-
Anomaly identification
-
Control testing
-
Periodic auditing
Why HaystackID
Investigation Expertise
HaystackID’s White Collar Investigation Practice combines digital forensics, advanced analytics, and 24/7 rapid response teams for complex, multi-jurisdictional investigations.
Proven AI Innovation
Core Intelligence AI, Case Insight, and CaseBot apply GenAI across the legal data lifecycle with the transparency and evidentiary integrity that high-stakes regulatory matters demand.
One Investigation Process
HaystackID brings customs data, commercial evidence, communications, and AI-assisted analysis into a single workflow, giving counsel both the factual findings and the source record that supports them.
Scale and Quality in Review
ReviewRight’s global reviewer network, AI-enabled reviewer matching, and foreign language testing deliver fast, accurate review.
Security and Privacy
HaystackID maintains ISO 27001, SOC 2 and SOC 3, and HIPAA certifications and prioritizes the confidentiality, integrity, and availability of client data.
Recognized Leadership
HaystackID is ranked in Band 2 of the 2026 Chambers Litigation Support Guide and the 2026 Chambers Crisis & Risk Management Guide for cyber investigations and global advisory services.
Global Reach
HaystackID supports clients across North America, Latin America, Western Europe, the Middle East, and Asia-Pacific.
About HaystackID
HaystackID solves complex data challenges related to legal, compliance, regulatory, and cyber requirements. Core offerings include Global Advisory, Cybersecurity, Core Intelligence AI™, and ReviewRight® Global Managed Review, supported by its unified CoreFlex™ service interface and eDiscovery AI® technology. Recognized globally by industry leaders, including Chambers, Gartner, IDC, and Legaltech News, HaystackID helps corporations and legal practices manage data gravity, where information demands action, and workflow gravity, where critical requirements demand coordinated expertise, delivering innovative solutions with a continual focus on security, privacy, and integrity. Learn more at HaystackID.com.
This fact sheet is provided for informational purposes only and does not constitute legal advice. Service availability and capabilities may vary by engagement.
Assisted by GAI and LLM technologies.