The DOJ Rule Change Behind the NYT North Korea Subpoena

The public record in the New York Times North Korea subpoena matter is still narrow. As of Aug. 4, 2026, what is publicly reported is this: Virginia prosecutors issued a February 2026 grand-jury subpoena to Matthew Cole, a freelancer for The New York Times, seeking more than two years of notes, contacts, and testimony connected to his reporting on a Sept. 5, 2025 North Korea story; FBI agents served the subpoena at Cole’s New York home; the subpoena remained secret until Cole disclosed it on Aug. 1; and the Justice Department has so far refused to withdraw it. No public ruling on Cole’s challenge is available from the materials reviewed here, and the venue should remain “Virginia prosecutors” unless a docket or other reliable public record supplies more detail. [1]

That restraint matters because the live legal question is not whether a subpoena to a reporter is alarming. It is. The question is which written rule made the subpoena administratively possible inside DOJ, and what checks that rule still requires before prosecutors may compel testimony or records from a member of the news media.

The answer starts less with the knock at Cole’s door than with the Bondi-era rewrite of 28 CFR § 50.10. On April 25, 2025, Attorney General Pam Bondi issued a memorandum reversing the Garland-era press policy. On May 2, 2025, DOJ published a final rule, effective immediately, revising the department’s policy on obtaining information from or records of members of the news media and on questioning, arresting, or charging them. [2]

The 2025 rule change did not merely “allow subpoenas.” It changed the kind of barrier DOJ must clear.

The central before-and-after is simple enough to summarize, but not simple enough to flatten. The 2022 version of § 50.10, adopted after the Garland memorandum, created a bright-line rule against using compulsory process to obtain information from, or records of, members of the news media acting within the scope of newsgathering. The 2025 final rule removed that categorical protection and restored a more discretionary balancing framework. [2]

That is not the same as saying DOJ may subpoena journalists whenever it wants. The current regulation still contains internal guardrails: Attorney General authorization, exhaustion of reasonable alternative investigative steps, negotiation with the affected news organization or journalist where required, narrow tailoring, and presumptive notice with limited delay periods. Those conditions remain in the current text of 28 CFR § 50.10. [3]

The practical difference is where the protection now sits. Under the 2022 rule, prosecutors first confronted a categorical bar when the journalist was acting within the scope of newsgathering. Under the 2025 rule, the fight moves into internal authorization, balancing, certification, notice, and later challenge.

What the 2025 rewrite deleted

The deletion that matters most for Cole is the loss of the bright-line newsgathering bar. The 2022 rule generally prohibited compulsory process against a member of the news media acting within the scope of newsgathering, subject to stated exceptions. The 2025 final rule removed that structure. Press-freedom advocates and law-firm analysts read the revision as restoring the pre-2022 balancing test, not as creating a new statutory power. [4][5][6]

The second deletion is quieter but important for newsroom and law-firm risk staff: the Privacy Protection Act “sole purpose” language attached to the suspect exception. The 2022 rule had limited use of the suspect exception in a way that tracked concern about prosecutors treating a journalist as a suspect merely to reach newsgathering material. The 2025 rewrite removed that “sole purpose” formulation. [4][5]

The third deletion is the former safeguarding section. The prior rule contained additional language on safeguarding information obtained from members of the news media. The 2025 version no longer carries that same section, a change flagged in press-freedom and law-firm comparisons because post-collection handling is often where source exposure becomes real, not theoretical. [4][6]

The fourth change concerns national-security certification. The current rule contains a national-defense path in § 50.10(c)(4)(iv), under which an agency head may certify to the Attorney General that unauthorized disclosure could cause harm to national defense or foreign relations and that the information was properly classified. Earlier language tied that function to the Director of National Intelligence in a different way; the 2025 rule uses the agency-head certification mechanism. [3][4]

What the current rule retained

Those retained requirements are not decorative. They are the department’s own stated process constraints. But they are internal constraints unless and until the journalist learns enough to challenge them, the news organization forces a dispute into court, or DOJ itself exposes the approval record. That is why the secrecy of Cole’s subpoena until his own disclosure is not a side detail. It goes directly to whether notice and delay rules give the press a meaningful chance to object before compliance pressure has already formed.

Why the national-defense path puts pressure on every safeguard

Cole’s subpoena reportedly concerns his North Korea reporting, not an ordinary civil discovery dispute or a routine criminal subpoena to a third-party witness. Reuters described the subpoena as connected to an investigation by Virginia prosecutors into the disclosure of classified information. The subpoena reportedly seeks more than two years of notes, contacts, and testimony. [1]

That setting matters because § 50.10(c)(4)(iv) gives national-defense leak investigations a special internal route. If the relevant agency head certifies to the Attorney General that unauthorized disclosure could harm the national defense or foreign relations and that the information was properly classified, the Attorney General may authorize compulsory process under that part of the rule. [3]

The certification does not erase the other requirements on the face of the regulation. Exhaustion, negotiation, narrow tailoring, and notice still appear in the rule. But a national-defense certification changes how much weight prosecutors can put on secrecy, urgency, and source-identification needs when they describe why other routes are inadequate.

Exhaustion is the easiest guardrail to state and the hardest to audit from outside. In a leak investigation, prosecutors can say they reviewed access logs, interviewed government personnel, examined communications records, and still need the journalist’s testimony or materials. The public cannot test that claim unless the internal record becomes visible in litigation or through later disclosure.

Negotiation can also become thin in practice. A meaningful negotiation lets counsel narrow categories, protect source-identifying material, stage production, or tee up a motion to quash. A formal negotiation merely tells the reporter what the government has already decided to demand. The current rule preserves negotiation language, but a classified-leak posture gives prosecutors obvious arguments for limiting what they can say and how much time they can give. [3]

Notice raises the same problem in sharper form. The rule presumes notice, but it also permits delay. When process is served secretly and the public learns about it only because the journalist discloses it, the legal analysis cannot stop at “notice exists in the regulation.” It has to ask when notice was given, to whom, what was disclosed, whether delay was authorized, and whether the 45-day structure in § 50.10(e) was observed. [3]

Attorney General authorization is a serious checkpoint, but it is not an external judicial finding. It tells lawyers that the matter reached the top of the department’s approval chain. It does not, by itself, prove that exhaustion was real, that negotiation was meaningful, or that the subpoena was as narrow as the rule requires.

Applying the rule to Cole without pretending to know the sealed record

The reported demand for “more than two years” of notes, contacts, and testimony is the place to start. A subpoena to a journalist’s notes and contacts is not just a request for ordinary third-party business records. It can expose confidential sources, reveal unsuccessful reporting paths, identify people who spoke but were not quoted, and reconstruct editorial decision-making. That is why the narrow-tailoring requirement matters more here than it would in many conventional subpoena fights. [1][3]

A properly tailored demand would have to explain why the government needs the specific categories sought and why narrower date ranges, topics, custodians, or forms of testimony would not suffice. The public reporting does not provide the subpoena text, the government’s internal authorization memorandum, or the certification record. Without those materials, no responsible analysis can conclude that DOJ complied with § 50.10. It can only identify the rule DOJ would have had to navigate.

The same is true for exhaustion. If prosecutors already had direct evidence of the alleged leaker, they would have less need to compel Cole. If they lacked that evidence after pursuing reasonable alternatives, they would argue that the subpoena is justified. Those are different records. At the moment, the public sees the demand and the department’s refusal to withdraw it, not the investigative sequence that supposedly made the demand necessary. [1]

Notice and secrecy require their own file review. The subpoena was issued in February 2026 and was not publicly known until Cole disclosed it on Aug. 1, according to Reuters. [1] That does not automatically prove a violation of the rule. It does mean the delayed-notice provisions and any extensions should be treated as central, not procedural clutter.

The better reading, on the public record available now, is that Cole’s matter is the first high-profile test of the 2025 rule in which the government has publicly not backed down. That is an inference from the available public record, not a judicial holding and not a sourced characterization from DOJ. It may change if the department withdraws the subpoena, if a court rules, or if sealed materials become public.

What outside law does, and does not, add

It is tempting to call a journalist subpoena “illegal” as shorthand. That is not legal analysis. The First Amendment supplies the constitutional objection; DOJ’s media policy supplies internal executive-branch procedure; the Privacy Protection Act supplies statutory limits for searches and seizures of certain newsroom materials; and federal privilege doctrine supplies a patchwork of circuit-specific arguments. They do not all do the same work.

The Supreme Court’s 1972 decision in Branzburg v. Hayes rejected a First Amendment privilege that would categorically excuse reporters from appearing before grand juries. The decision is the main reason federal reporters do not have a simple, nationwide shield rule against grand-jury subpoenas. [7]

That does not mean reporters have no arguments. Some lower courts recognize qualified reporter’s privilege in particular contexts, and lawyers still press First Amendment, relevance, burden, overbreadth, and bad-faith arguments. But those arguments are not the same as a federal shield statute, and they do not make every subpoena to a journalist void on arrival.

The Privacy Protection Act also has to be kept in its lane. It is concerned principally with government searches and seizures of work product and documentary materials held by people engaged in First Amendment activities, subject to exceptions. It is not a general federal reporter’s privilege against every subpoena. The significance of the 2025 § 50.10 rewrite is that DOJ removed language that had narrowed how its own suspect exception interacted with that statute in the department’s media policy. [4][5]

For risk purposes, that distinction is not academic. If a partner briefing collapses Branzburg, the Privacy Protection Act, circuit privilege, and DOJ policy into one generic “press shield,” the advice will be wrong in several directions at once. Cole’s strongest public-facing issue is not that subpoenas to journalists are unknown to federal law. It is that DOJ recently rewrote the internal policy that had made this kind of process substantially harder to approve.

The parties are already speaking in litigation posture

The public statements are useful, but only if kept in their evidentiary place. Cole’s lawyer, David A. O’Neil, said he would defend press freedom and the First Amendment. New York Times spokesperson Charlie Stadtlander called the subpoena “another brazen and illegal attack” on press rights. DOJ, by contrast, said it “will use all available legal tools” to enforce the law and protect national security. [8]

Those statements show adversarial posture. They do not answer the § 50.10 questions. The court, if it reaches the issue, will need a record: what was authorized, what alternatives were exhausted, what negotiations occurred, what notice was given or delayed, what national-defense certification was made, and why the subpoena’s scope was necessary.

The contrast with other 2026 matters is limited but still helpful. DOJ withdrew subpoenas in the Air Force One reporting matter on July 23, 2026, before Judge Arun Subramanian. [9] It also withdrew subpoenas connected to Wall Street Journal reporter Warren P. Strobel and Washington Post reporter Ellen Nakashima in June 2026, according to the U.S. Press Freedom Tracker’s incident record. [10] Avoiding precise reporter counts is prudent because public accounts of the Air Force One matter have not been perfectly uniform.

Cole therefore appears, on the public record now available, to be the first high-profile 2026 press-subpoena matter in which the government has publicly refused to withdraw process. That sentence should be read exactly that narrowly. It is not a claim that no similar sealed dispute exists. Grand-jury practice makes that impossible to know from the outside.

The compliance question the rule change leaves exposed

The Cole subpoena is legally legible because the 2025 final rule removed the bright-line newsgathering bar that the 2022 policy had placed at the front of the analysis. DOJ no longer has to begin from the same categorical prohibition when a journalist was acting within the scope of newsgathering. It can proceed through a balancing-and-authorization system instead. [2][3]

But the rule did not repeal all process constraints. It still purports to require Attorney General authorization, reasonable exhaustion, negotiation, narrow tailoring, and presumptive notice. In a national-defense leak investigation, § 50.10(c)(4)(iv) adds a certification path that may make those safeguards easier for DOJ to satisfy internally and harder for outsiders to test promptly. [3]

That is the point on which future coverage should stay fixed. The open issue is not whether the subpoena feels aggressive; it plainly does. The open issue is whether the surviving DOJ guardrails bind in practice when the Attorney General receives a national-defense certification, or whether they function mostly as an internal paper trail until a journalist, publisher, or court forces them into view.

References

1. US Justice Department subpoenas New York Times freelancer over North Korea story, Reuters, August 1, 2026
2. Policy Regarding Obtaining Information From or Records of Members of the News Media; and Regarding Questioning, Arresting, or Charging Members of the News Media, Federal Register, May 2, 2025
3. 28 CFR § 50.10 - Policy regarding obtaining information from, or records of, members of the news media; and regarding questioning, arresting, or charging members of the news media, Legal Information Institute, Cornell Law School
4. DOJ rescinds news media guidelines analysis, Reporters Committee for Freedom of the Press
5. AG Permits Journalist Subpoenas in Leak Investigations, Ballard Spahr, May 2025
6. Department of Justice Reverses Course on Media Policy, Cleary Gottlieb
7. Branzburg v. Hayes, 408 U.S. 665 (1972), Justia
8. New York Times reveals Trump administration subpoena over North Korea story, The Guardian, August 1, 2026
9. New York Times reporters’ subpoenas withdrawn, Politico, July 23, 2026
10. DOJ subpoenas Wall Street Journal amid internal leak investigation, U.S. Press Freedom Tracker