HomeWAV, a video visitation provider used by prisons across the US, exposed private calls of inmates with their families and attorneys, on an unprotected server
Thousands of calls were spilling from an unprotected server. — Fearing the spread of coronavirus, jails and prisons remain on lockdown. Tweets: @zackwhittaker , @somilbtrivedi , @lorakolodny , @zackwhittaker , @campuscodi , and @zackwhittaker Tweets: Zack Whittaker / @zackwhittaker : New: A security lapse at a prison video visitation company exposed thousands of inmate phone calls to the open internet. Some of the calls were between inmates and their defense lawyers, and protected by attorney-client privilege, the lawyers told me. https://techcrunch.com/... Somil Trivedi / @somilbtrivedi : A company called HomeWAV operates video software for lawyers and their clients in prison—helpful during #COVID. Then it transcribes the privileged convos and doesn't password protect them—less helpful. Also, as I told @TechCrunch, illegal. https://twitter.com/... Lora Kolodny / @lorakolodny : injustice is served https://twitter.com/... Zack Whittaker / @zackwhittaker : ACLU's @SomilBTrivedi told me: “Technology cannot fix the fundamental failings of the criminal legal system — and it will exacerbate them if we're not deliberate and cautious.” https://techcrunch.com/... Catalin Cimpanu / @campuscodi : Recording attorney-client conversations is **very** illegal. Some —if not multiple— state attorneys general need to start an investigation https://twitter.com/... Zack Whittaker / @zackwhittaker : I spoke with two lawyers whose conversations were found on the exposed system. Both were alarmed that their calls, which they said were protected by attorney-client privilege, were recorded.
Context & Ripple Effects
HomeWAV's exposed server is a rerun of a known failure mode: Securus Technologies' breach in 2015 compromised 70 million recorded inmate calls, including attorney conversations, and nothing about the intervening years suggested prison telecom vendors had fixed their data hygiene. What changed is dependence — critics warned in 2018 that jails were swapping in-person visits for video calls to cut costs, and coronavirus lockdowns made HomeWAV's platform the only family contact many inmates have.
That dependence is what turns a routine misconfiguration into a rights problem. ACLU attorney Somil Trivedi flagged that the leaked calls included defense-lawyer conversations protected by attorney-client privilege, meaning the exposure touches not just privacy but case outcomes.
First-order effects
- Inmates whose family and attorney calls spilled onto the open internet face immediate harm — particularly defendants whose privileged strategy conversations were exposed to anyone who found the server.
- HomeWAV faces scrutiny from the correctional facilities that contract it, with lawyers already on record confirming privileged calls were among the leaks.
Second-order effects
- Facilities that eliminated in-person visits in favor of video calling now carry the reputational and legal risk of that choice, giving advocates concrete ammunition to demand restored face-to-face visitation rather than vendor swaps.
- Public defenders and legal-aid groups — already working to close a digital-evidence gap with law enforcement per the Legal Aid Society's efforts — gain another argument for independent technical audits of prosecution-adjacent systems holding defense communications.
Third-order effects
- With prisons now exploring AI analysis of inmate calls, each new analytics layer multiplies the blast radius of exactly the kind of unsecured storage HomeWAV just demonstrated — pointing toward binding data-security standards for the prison telecom industry, which has now had two major privilege exposures in five years.
The trend: Prison communication technology is digitizing faster than any governance regime around it, turning every vendor lapse into an attorney-client and civil-rights incident.