When the FCC voted to cap the exorbitant rates communications companies were charging for inmate phone calls, Securus Technologies of Dallas complained the bills needed to be high to cover sophisticated call-recording software. But a massive cache of records for more than 70 million phone calls leaked to The Intercept reveals Securus may be violating inmates’ constitutional rights.

The calls, recorded in 37 states from December 2011 to spring 2014, appear to include as many as 14,000 recorded conversations between inmates and attorneys. It seems more than likely at least some of those calls would fall under attorney-client privilege, meaning they should have been exempt from recording. By storing them, Securus could be violating constitutional protections for right to an effective council.

So who’s to blame for recording phone calls that should remain private between an attorney and his or her client? It’s hard to tell. Here are Jordan Smith and Micah Lee, reporters for the story:

“Exactly who is to blame for the recording of attorney calls is unclear. In many jurisdictions — including in Austin [Texas] — the onus is on lawyers or their clients to give phone numbers to prison officials so that they can be placed on a do-not-record list. Failing to provide up-to-date contact information would make any inadvertent recordings the attorney’s or inmate’s fault. But properly logging these numbers is the government’s responsibility. And the secure storage of these is squarely up to Securus — particularly given that it markets itself as providing a service to do exactly that.”

As The Intercept notes, that one anonymous hacker was able to reach the data is evidence that Securus’ systems are far from secure.

What’s more, Securus is far from alone when it comes to charging very high fees. Here are Smith and Lee in their story:

“It isn’t just Securus whose business model has relied on gouging people caught up in the criminal justice system. The industry’s other players, including the leading prison telecom company, Global Tel*Link, largely do the same. Prison and jail communications is a $1.2 billion a year business, whose handsome profits come from serving a captive and inelastic market. According to public relations materials, Securus provides communications platforms used by more than 1.2 million inmates across the country, who are confined in more than 2,200 facilities; by 2012 the company was processing more than 1 million calls each day. In 2014, Securus took in more than $404 million in revenue.”

The Intercept, which was founded as a way to report on the documents leaked by Edward Snowden, has moved into reporting on other leaked data. The cache of phone records was leaked to news organization via its own Secure Drop server, which allows anybody to anonymously blow the whistle.

Go read the full report right now: “Not So Securus.”