It's a languid summer morning in your regional library on the Chesapeake Bay ... or at your Internet service provider (ISP) in Northern Virginia ... or at any information-centric business that might hold information on a member of the public. Suddenly, you receive a dreaded telephone call from an individual identifying herself as a police detective in a neighboring state. You are advised that they are investigating a crime involving threatening e-mails possibly traced to an IP address associated with your library. The police detective requests that you confirm the IP address, that you describe all system usage records maintained on your public-use computers, and that you provide all such records from both the hard drive of this machine and your server's.
Of course, there are many permutations of this scenario beginning with the official who's making the request. Instead of the detective in a neighboring state, it could be a detective in your county, a detective in another county in your state, or the FBI. Indeed, if we change the subject of the e-mail to insider-trading information, the demand could be from the Securities and Exchange Commission. Librarians know that any answer to these questions involves the need to protect patron confidentiality as required by law, and hence, requires appropriate judicial process. But that is the question: What is appropriate judicial process-a generic term used here to represent any form of government order to produce documents or information? This essay explores this relatively complex question given the differences in type of evidence sought ( e.g. , electronic communications or documentary records), the form of judicial process ( e.g. , search warrant, subpoena, or otherwise), the interest ( e.g. , law enforcement or intelligence) and, of course, the authority involved ( e.g. , local, state, or federal). In doing so, it is our intent to increase awareness of the relevant legal issues and to serve as a starting point for additional discussions with your legal counsel.
Understanding the Forms of Judicial Process
To begin our discussion, it is important to note that the terminology of judicial process is often used loosely in the media and in conversation (" We just received a court order! ") and hence has led to confusion. But the different forms of judicial process and authority need to be specified.
We begin our discussion with the forms of judicial process, which relate to the title of the document, the identity of the issuer, and hence the authority of the document. While judicially compelled production of information of any form is controlled by the 4th Amendment (and also state constitutional equivalents that may provide even greater citizen protection), the federal government and states have adopted a range of statutes to regulate the process more closely. In federal, criminal, law-enforcement investigations, the Electronic Communications Privacy Act (ECPA) controls access to electronic communications records. Enacted as amendments to the original wiretapping law passed in 1968 (often referred to as Title III in the literature), the ECPA has a four-tiered approach to acquiring a full range of electronic communications information. The range was broadened slightly by the USA Patriot Act to include:
- A real-time intercept order requires that more be shown than in a regular search warrant, and it must be authorized by the most senior levels of the Department of Justice. It applies to any real-time voice or data transmission, may be used only for specific crimes ( e.g. , murder, narcotics or terrorism), and only when normal investigative techniques for obtaining the information have failed, are likely to fail, or are too dangerous. The intercept order does two things: authorizes the law enforcement agency to conduct the intercept and the service provider to provide necessary assistance. And, when the provider cannot comply, Carnivore 1 may be deployed.
- A traditional search warrant is used for stored electronic communications ( e.g. , e-mail at a service provider and now voice mail, pursuant to the USA Patriot Act). It requires a determination by a federal judge that probable cause exists to believe that a crime has been committed and that the information sought is material to that offense.
- Less difficult yet is a court order to obtain transactional records. Such orders must be granted automatically if the government certifies that there are " ... reasonable grounds to believe data is relevant to ongoing criminal investigation. " Transactional records take three forms: "pen register" information (i.e., telephone numbers dialed), "trap and trace" information (i.e., incoming telephone numbers), and under the USA Patriot Act, "routing and address" information (i.e., electronic communications headers but not content).
- Least difficult of all is an administrative or grand jury subpoena, which is issued by the government itself, without judicial assistance, to obtain information. Typically in the electronic arena, such subpoenas are used to identify the subscriber, including addresses and means of payment.
Outside of ECPA, we are typically concerned with documentary evidence ( e.g. , business records, such as sign-in sheets for computer use), and here criminal law enforcement authorities at the federal and state level use either a search warrant or a subpoena duces tecum. The primary and most significant distinction between these forms of judicial process is that the former is served and executed immediately by law enforcement officers with or without one's cooperation, while the subpoena requires one to produce records at a specific future time and is thus substantially less intrusive than a search warrant. The following additional points more completely describe the scope and relationship of these two forms of process:
- First, search warrants under the Fourth Amendment reach not only " instrumentalities, fruits, or contraband " but indeed any item of " evidential value ." Warden of Maryland Penitentiary v. Hayden, 387 U.S. 294 (1967). This means, for example, that a search warrant may be directed to a library for any information, patron specific or otherwise, provided that it has evidentiary value.
- Second, while a search warrant must be predicated on probable cause that instrumentalities or evidence of a crime will be found (thus magistrates and judges typically ensure that such warrants are not broader than justified), your right to challenge the scope is limited to post-seizure-proceedings.
- Third, although the 1st Amendment provides no shield to library recipients of search warrants, the Supreme Court has acknowledged that when expressive rights are implicated, a search warrant must comply with the particularity requirements of the Fourth Amendment with "scrupulous exactitude." Zurcher v. Stanford Daily, 436 U.S. 547 (1978).
- Fourth, it also follows that a regular search warrant and not an ECPA order can and often is utilized to acquire electronic, computer-maintained information. Remember that the ECPA protects only electronic communications and related information.
- Fifth, and turning to the issue of subpoenas, the term subpoena is really shorthand. Subpoenas requiring a witness to appear are termed a " subpoena ad testificandum " and those requiring a witness to produce records at a specific time and place are termed a " subpoena duces tecum ."
- Sixth, a subpoena may be issued by state or federal law-enforcement authorities in the context of grand jury proceedings or other criminal investigation, by criminal defense counsel, and by regulatory agencies if authorized by law. In addition, parties in civil litigation may also utilize subpoenas, and it is possible to receive such process in the context of family law matters.
- Seventh, remember, that in both civil and criminal contexts, subpoenas may be contested through a Motion to Quash, and this was the essence of the recently noted litigation, Tattered Cover v. City of Thornton, 2002 Colo LEXIS 269, involving a rather limited warrant for bookstore records in a criminal, drug prosecution. Here, the Colorado Supreme Court held that when a search warrant implicates constitutional values, the ex parte warrant process should not apply in cases of innocent third parties.
- And, eighth, remember that at least in the federal sphere, the showing required to quash a criminal subpoena is difficult to meet since a criminal grand jury subpoena is deemed valid " unless the district court determines that there is no reasonable possibility that the category of materials the Government seeks will produce information relevant to the general subject of the grand jury investigation ." United States v. R. Enterprises, Inc., 498 U.S. 292 (1991).
What does this mean for our hypothetical librarian? To the extent that law enforcement is concerned with electronic communications ( e.g. , e-mail or the records concerning e-mail) then one of the four types of ECPA order will be received. To the extent library business records are sought ( e.g. , computer-use logs) then either a regular search warrant or subpoena would be received, depending largely on the discretion of law enforcement officials. So while your legal counsel might argue that a search warrant is not appropriate for an innocent third party, it could certainly be issued and executed. Indeed, the United States Supreme Court has held specifically that federal law permits the use of search warrants for the search and seizure of evidence in the possession of even innocent third parties (cf., the Zucher decision).
Does our librarian have another question? Yes, indeed, and that question concerns media discussions of secrecy: Can these law enforcement warrants ever be secret? The answer is yes, but it is not a frequently used authority. Among the USA Patriot Act changes was a provision that allows a court to delay immediate notification of the execution of any order if it would have an adverse result as established by a specific government showing. In point of fact, this authority is consistent with established case law and is not a substantial change in constitutional law.
Before leaving the sphere of criminal process, our librarian asks one more question: I've heard of exigent circumstances, but that can't apply to a library, can it? The answer is a definite "perhaps!" The courts have recognized this as an exception to the general requirement for a search warrant and have thus upheld an immediate, warrantless seizure when and where necessary to prevent the destruction of relevant evidence or in the words of the Department of Justice " some other consequence improperly frustrating legitimate law enforcement efforts ." Since exigent seizures are almost always challenged, the courts look generally to the degree of urgency involved ( e.g. , is the evidence about to be removed or destroyed or a crime about to be committed) and the amount of time necessary to obtain a warrant. Clearly, the destruction issue plays a prominent role when considering electronic information, and to the extent that a library's practice or policy would result in the loss of information, an immediate seizure could result. However, in every case, a finding of exigent circumstances is based on the specific facts, and generalized arguments will not suffice if the innocent third party makes clear his intention to preserve evidence pending the arrival of appropriate judicial process. Moreover, the authority extends only so far as is necessary to prevent immediate destruction and no further. Accordingly, an exigent seizure would not authorize a subsequent warrantless search since the exigency would typically have ended.
Defining the intelligence forms of process
If the ECPA for electronic communications, regular search warrants, and subpoenas for documentary evidence were not enough, yet another legal mechanism to obtain information exists. It is relatively unknown, it works in total secrecy, and it was substantially broadened in scope by the USA Patriot Act. It is the Foreign Intelligence Surveillance Act (FISA), and it is an authority that was used some 1000 times last year.
FISA is the federal law that regulates warrants for the acquisition of electronic information or physical searches, as well as court orders for the production of business records in national-security, counter-intelligence or counter-terrorism cases in the United States. The standard for granting such warrants is not probable cause of a crime or evidence, but rather probable cause to believe that the target is a member of a foreign terrorist group or an agent of a foreign power. Moreover, FISA was substantially amended by the USA Patriot Act. Now, intelligence cases may involve law enforcement aspects, which helps to resolve the practical conundrum that many intelligence cases do in fact develop evidence of federal crime. All forms of electronic orders are "roving," i.e., they apply to all applicable carriers without the necessity to name each carrier individually. More significantly, entities may be required to produce business records, including any "tangible thing," by simply showing "relevance" to an intelligence or terrorism investigation.
This new authority vis-à-vis business and financial records has generated substantial controversy, given the greater broadness and lesser judicial oversight involved. Hence, our hypothetical librarian asks, "Could the FISA now be used to seize entire databases rather than business records concerning a given person?" The answer from critics is "certainly yes!" While this is a possibility, I suggest it is doubtful, given precedents to date that have invalidated broad, general, non-particularized warrants, as well as warrants for seizure of equipment that are not elements of the criminal enterprise. Moreover, it is difficult to contemplate a circumstance where a federal judge would accept the bald assertion that all records maintained, for example, by a library are "relevant" to an investigation. But this concern aside, it is fair to say that this is a new challenge that our hypothetical librarian must be prepared to address.
There also exists a little known, FISA-related provision known as the National Security Letter (NSL) for certain electronic communications and financial records. Essentially the intelligence corollary to the administrative subpoena provisions for criminal investigations, the USA Patriot Act modified the provisions by which the Director of the FBI may use this authority to show relevance and existence of an "agent of a foreign power" in relation to an intelligence or terrorism investigation.
Our librarian is shocked at the scope of this authority, fears there is more to know, and asks, "So, what else is different about FISA orders and NSL demands?" The answer is that they are secret, and the recipient is barred from publicly disclosing their existence or the information provided. Hearing this, the library director inevitably asks another question: "Will I even know about it?" The answer is "yes," and the general secrecy provisions of FISA should not be interpreted as preventing the individual library employee who receives the order from fully disclosing it and its content to library management and legal counsel. Indeed, it is crucial that every library establish and communicate a policy statement insuring that no individual employee is authorized to act on or respond to any form of judicial order (whether law enforcement or intelligence) but must instead contact and refer the matter to the library director and legal counsel immediately.
So far, we have explored the challenges presented to our hypothetical library on the Chesapeake by a daunting array of legal process-intercept orders, search warrants, subpoenas, and even the very obscure National Security Letters. Now we must consider the issue of jurisdiction-a term that defines the legal reach of a given court. In our hypothetical case, could a Maryland state court (assuming the detective secured a court order of some type) compel a Virginia library to produce evidence? Or could a federal court in Maryland do so if we were concerned with a federal crime? To the disappointment of citizens and information professionals alike, the answer to both questions is " maybe ."
Jurisdiction at the federal level
The federal legal system can perhaps be best understood as an "overlay" of our respective state systems. Not infrequently, the same wrongful conduct can give rise to an investigation by state or federal authorities or jointly by both. Moreover, many permutations are possible: It is possible for a federal officer to apply for a warrant to a state court, and it is even possible for a given case to be investigated and prosecuted in both systems. But typically, prosecutors agree on a division of labor and whether the prosecution will head for federal or state court.
Assume for the moment in our hypothetical situation that we have a federal focus. The federal judicial system comprises 94 separate districts with each state having at least one district. These U.S. District Courts are the trial level, and it is U.S. district judges or the appointed magistrates for these districts that hear applications for and issue investigative process. In doing so, there are specific rules regarding the reach of its judicial process, some of which were modified by the recent USA Patriot Act.
In general, for documentary evidence, such as business records (in paper or electronic form), search warrants issued by federal judges are applied for and executed in a given district that has jurisdiction over the offense or property. This means, for example, that the U.S. District Court for the District of Maryland would have primary jurisdiction over a federal crime that occurred in Maryland and could issue search warrants for service in its jurisdiction. But what if some evidence is in Virginia? The answer, with two exceptions, is that federal law enforcement personnel must seek additional warrants in the district where specific evidence is located even if that means applications in multiple districts. This is largely an administrative burden because any federal officer may apply to any federal court without limitation.
The first exception with respect to documentary or physical evidence is based on the recognition that we live in a mobile age and hence Rule 41(a) of the Federal Rules of Criminal Procedure permit a federal judge to issue a warrant for evidence outside the district if it "... is within the district when the warrant is sought but might move outside the district before the warrant is executed."
The second exception requires that we broaden our consideration of documentary evidence to include electronic communications information and consider the USA Patriot Act's several substantive changes within the reach of judicial process. Today, all ECPA-orders for electronic communications information ( e.g. , search warrants for stored e-mail and voice-mail messages, as well as court orders for transactional records) are valid nationwide, whereas previously, and anachronistically, only wiretap orders were so valid. Additionally, search warrants for documentary or physical evidence in terrorism cases- but only terrorism cases -are now valid nationwide. Both of these enlargements of jurisdiction presume, of course, that the issuing federal court has jurisdiction over the offense. What is the impact of these changes for our hypothetical case? It means that a Maryland federal court could issue an ECPA order valid in Virginia for electronic communications information but not, in general, a search warrant for library business records, unless the case involved terrorism.
Moving our discussion from search warrants to subpoenas for documentary evidence (and/or attendance of a witness) in non-terrorism criminal matters, this form of process is issued typically by clerks of the court upon application of the government, usually in the context of grand jury proceedings or a trial, or by myriad federal agencies with statutory subpoena authority, or even by defense counsel. Such subpoenas are regulated by Rule 17 of the Federal Rules of Criminal Procedure and may be served at any place within the United States and by any U.S. Marshal or any other person ( e.g. , a private person employed for such a purpose) provided only that they are not a party and at least 18 years of age. Typically the individual serving a subpoena issued on behalf of the government will be a Deputy U.S. Marshal from your judicial district or an FBI Special Agent. So, what can our hypothetical librarian anticipate? Quite certainly, a federal prosecutor in any state could issue, and require compliance with, a subpoena for library records in Virginia. And, as discussed previously, the choice of the more intrusive search warrant or less intrusive subpoena is left to the discretion of the federal government.
Last, with respect to intelligence investigations, FISA (Foreign Intelligence Surveillance Act) orders of all types are valid nationwide and, in light of USA Patriot Act amendments, intercept, pen register, as well as trap and trace orders are "roving" and thus apply to any holder of the information and need not be specifically named.
Understanding jurisdiction at the state level and inside a given state
With respect to states, and within the borders of a given state, the reach of judicial process depends exclusively on the jurisdictional authority of the specific state court, as defined by state statute. Let us consider examples that represent the two general circumstances. And in all instances it is important to recognize that, first, judicial process in general and judicial process for electronic communications follow separate and specific rules. Second, the results in other states, of course, will vary and depend on the statutes in that state. As such, consultation with local counsel is imperative.
Virginia is an example of those states allowing for a wide reach of process in general but also a degree of complexity with respect to electronic communications information. Search warrants may be issued by magistrates who are appointed to given state districts, composed of one or more counties, as well as general district courts (courts not of record) and circuit courts (of record) that sit in each county and independent city. While the magistrate or judge may only issue a warrant within his own geographical jurisdiction, it may be directed to any law enforcement authority-state, city, or federal-anywhere in the state of Virginia. See Code of Virginia § 19.2-56 and Commonwealth v. Stepp, 1998 Va. Cir. Lexis 102 (holding that a magistrate in Loudoun County, where traffic death occurred, may issue search warrant for execution in Fairfax County). However, for electronic communications search warrants, the rules are different: Intercept warrants as well as "pen register" and "trap and trace" warrants must be issued by a judge within the jurisdiction where the warrant is to be executed, while non-content warrants ( e.g. , subscriber-identifying information) follow the general rule and may be issued by any authority within the state. See Code of Virginia § 19.2-66 (wiretaps), § 19.2-70.2 (trap and trace) and § 19.2-70.3 (non-content).
Maryland, however, is an example of other states having certain limitations on the reach of in-state courts. In Maryland there are circuit courts-common law courts of general jurisdiction in each county-where the jurisdiction and reach of process is limited to the given county. However, Maryland also has the District Court, a unified court of limited statutory jurisdiction created in 1970, where the jurisdiction is statewide and allows the issuance of a search warrant for execution in any county. See Birchead v. State, 317 Md. 691 (1989). Thus, if we modify slightly the facts of our hypothetical , a detective located in any Maryland county could secure a valid search warrant for execution on the Eastern Shore, but only from the District Court. As for electronic communications information, the circuit courts are the only courts authorized to issue process for wiretaps (Md. Courts & Judicial Proceedings Code §§ 10-410-414), stored communications and transactional records (Md. Courts & Judicial Proceedings Code §§ 10-4A-01 through 08), as well as "pen register" and "trap and trace" data (Md. Courts & Judicial Proceedings Code §§ 10-4B-01 through 05), and thus geographical limitations apply.
Jurisdiction vis-à-vis out-of-state courts
The enforcement of out-of-state criminal judicial process ( e.g. , a criminal subpoena for documentary evidence) is often not explicit in state laws and typically proceeds on general common law and constitutional precepts of comity or mutual recognition and cooperation among levels of government or among various courts. In numerous cases each year, an out-of-state law enforcement agency must attempt to secure documentary evidence from a witness or institution within another state--in our hypothetical a Maryland-to-Virginia reach. In general, the process is that the out-of-state law enforcement agency first obtains a subpoena from a court in its own state and then requests that the foreign law enforcement agency duplicate the process in a court in the foreign state. In our hypothetical case, the Maryland detective would first seek a court order from a Maryland court in the appropriate county, have that order presented and a similar order entered in Virginia, and have the new Virginia order served by local law enforcement-all in all a tedious but not difficult process. In this regard it should be noted that some states are easing this process. For example, this year Delaware enacted a law that permits the Delaware attorney general to issue a subpoena in any criminal case where the out-of-state agency has obtained a court order from its own state court.
Similar processes apply for witnesses in criminal prosecutions but are more explicitly regulated by statute-all U.S. states have adopted a version of the " Uniform Act to Secure the Attendance of Witnesses from Without a State in Criminal Proceedings ." The Virginia law is quite typical and indicates that when a foreign witness is required by a given state, the authorities in that state shall certify the need under the seal of their court and present that certificate to a court of record where the witness is located and where, after a hearing to determine that the witness is material and necessary and his attendance will not cause undue hardship, an appropriate order to appear is issued. See Code of Virginia §§ 19.2-272 through 282. For the substantially similar process in other states, see Md. Code Courts & Judicial Proceedings § 9-301-307, as well as the case In re State of California , 57 Md. App. 804 (1984) for a discussion of the law and the process.
An interesting question has arisen in several states as to whether this Uniform Act that secures witnesses from outside a state also authorizes the issuance of a subpoena duces tecum to compel merely the production of documentary evidence. While the principle of comity allows such subpoenas (as we have discussed above), the benefits of statutory authority increase certainty. Most, if not all state courts, have allowed use of the Uniform Act to consider this issue in this additional manner, including those in New York, New Jersey, Massachusetts, West Virginia, Alabama, Florida, and Georgia. See , e.g. , Ex Parte Simmons , 668 So.2d 901 (Ct. Crim. App. Ala. 1995).
Considering the issue of voluntary disclosure
Law enforcement personnel may always ask for information and citizens may generally comply-except when specific laws preclude such cooperation often for reasons of confidentiality. Librarians, of course, are well aware of state confidentiality laws for patron-specific information, and hence the need for appropriate judicial process before releasing such information. Does the statutory protection cover all information held by a library, which law enforcement may request? Is there information that a library may voluntarily provide? The answer is yes in several regards:
- First, data that is considered public information, there being no privacy or confidentiality interest, may be shared voluntarily. Examples include acknowledging that a given person has been seen in a public building. However, we must be cautious as to the arguable anonymity rights of patrons, and no disclosure of information concerning patron use of the facilities and materials may be disclosed. For further information on this issue there are two excellent ALA resources:
- Second, another example of public data would be information available under the state freedom of information (FOI) statute. An example relevant to our hypothetical case would be disclosing the IP addresses of a library's public Internet computers.
- Third, under USA Patriot Act amendments to the ECPA, the content of messages and subscriber data may be shared voluntarily (1) where immediate danger is presented, or (2) if necessary to protect ISP property. In such cases, the Patriot Act also clarifies immunity to allow good faith reliance on this statutory authority.
What do these concepts allow in our hypothetical? Could our Chesapeake librarian confirm that a given person had visited the library? I suggest that the answer to this limited question is yes , but, of course, there would be no requirement to do so. Could our Chesapeake librarian disclose electronic content sent by the user or other user information? I suggest here that the answer is probably no , unless there was a reasonable showing of immediate danger to an individual or a threat to a library's electronic infrastructure. The bottom-line-immediately discuss any such requests with your legal counsel before taking any action.
A Management Response to Judicial Process
A records management program
Having considered the complex world of legal process, we turn to the first of two management processes that are of critically important: an adequate and proper records-management program. Whenever judicial process is received, certain questions inevitably are voiced: "Do we collect this information?" "Have we preserved this information?" "Must we preserve this information?" As we shall see, these questions are answered by the adoption of an adequate and proper records-management program, which is a critical management mandate for your institution.
The USA Patriot Act and records management
We begin our discussion by noting that neither the USA Patriot Act nor any other law requires a provider to change his current data retention practices or to reconfigure his system to collect information if presented with judicial process. That said, several factors should be noted. First, the FBI could insist on deployment of their Carnivore system if the provider could not comply with the judicial process. Second, a provider is obligated to preserve specific existing information, if so requested by law enforcement pending issuance of an appropriate court order or other process. And, third, the term "obligated" should be interpreted as "required" given that the law generally prohibits the destruction of information once notice is given or one has reason to believe that it has evidentiary value.
Developing the legal and operational basis for library business
However, the luxury not to change our data systems does not mean that libraries are free to maintain few if any records or to destroy records on an ad hoc or arbitrary basis. We must remember that a library is a business and often a government entity, and that in either event there is one important concept that provides the needed foundation for almost every legal and operational activity of a business-an adequate records management program (RMP). Indeed, too often institutions have neglected to adopt the key element of a RMP-detailed records control schedules (RCS) or records retention plans to ensure that records are kept for, and only for, the time they are needed for operational, legal, fiscal, or historical purposes. Without an RCS, your institution is in legal jeopardy for many reasons. You might keep records too long and endanger patron confidentiality, or destroy records on an ad hoc basis and risk charges of illegal destruction. Without a detailed RCS, both preserving and destroying records is risky business!
Creating an RCS begins with appraisal which is the process by which we evaluate the totality of our physical and electronic records in order to determine their final disposition. Typically, the records are designated as either permanent (so determined by historic value), or temporary where they may be destroyed when no longer needed or after a certain period of time. Also typically, records that are yet unappraised are treated as permanent in order to avoid inappropriate destruction, and all appraisal decisions should be approved by the appropriate state archivist.
Essential to the appraisal process are several specific activities.
- First is the records inventory, which is a review of the agency functions as reflected in its program responsibilities, structure, and authorities.
- Second is the designation of records series, a convenient way of grouping files to permit their management as a group because they relate to a particular subject or function or have some other relationship arising out of their creation, receipt, or use.
- Third is the creation of a file plan, a day-to-day tool for records managers, as well as program and administrative personnel to ensure that records are organized and retained as they are created and/or received.
- And fourth is scheduling, the determination and recording of the business and historic value of each record series in terms of the time the records will be retained ( i.e. , the retention period). The key point in this discussion is that a records control schedule is not optional administrative overhead. It is a requirement of law, as well as a critical facet of asset management since records are a business asset. Moreover, as we have noted, a records control schedule is the predicate to responding effectively and legally to any judicially compelled disclosure of records.
A frequent question is " How do we build an RCS? " The answer starts, of course, with the appraisal process but can be substantially assisted by the adoption of applicable general records schedules (GRS), a term used in the federal government, or common record schedules or categories, a term used by certain state governments. These general or common schedules include items such as budget, accounting, personnel, and computer administration records that may be created by any local government agency. These would be augmented then by institution-specific record schedules that are created by a specific agency and reflect the unique activities of that agency. Most often, your state archivist will have promulgated relevant general and specific schedules that reflect applicable state law and greatly assist in building your RCS. It is critical to note here that state schedules may mandate specific retention periods that you are not free to change without negotiation and agreement with your state archivist. For example, some states require that circulation records be maintained for three years. Depending on how such records are defined, your automated circulation data collection may not be compliant. In any event and as a point of reference, a typical library may have an RCS of 10-25 specific records series, containing a total of 100-300 line entries.
Of course as previously stated, building the RCS is merely one step in the adoption and administration of an adequate records management program (RMP). The other elements include: storage of inactive records-to ensure speedy retrieval in case of operational or legal need; timely destruction of unneeded records-to ensure that records no longer required by operational or legal needs are maintained at a cost and perhaps legal risk to the organization; identification and protection of vital records-to ensure the absolute availability of those records essential to the organization's continued existence in the event of disaster; special identification and protection of records deemed legally relevant-to ensure on an ad hoc basis the absolute protection of those records deemed to be at issue in a specific administrative, regulatory, or litigation challenge; creation of filing systems-to ensure access to the active records and the knowledge contained therein-often referred to as adoption of a file series nomenclature within an overall, comprehensive business file plan; utilization of imaging systems-to ensure survival and reduce costs; adoption of forms management system-to ensure the collection of critical information and as an aid in controlling records from their creation; and adoption of reports management-to ensure the creation of information critical to the organization.
An additional step is designing software and administrative systems to collect, save, and dispose of electronic data in accordance with the RCS. All too often, we believe that we maintain a certain level of patron-specific data only to discover our reports reflect that level of data but our system maintains more. Or, we discover that the system can reconstruct older patron-specific information from a combination of preserved transactions data ( e.g. , log data), back-up files, or system utilities that rebuild links or recover de-indexed data. Two information technology facts must be remembered: First, a paper or electronic report reflects only what a programmer instructed the system to write or display. It may not reflect the totality of the system information. Second, unless data is overwritten, it can often be recovered even if linkages have been broken. Both criminal investigations and civil cases can reach such data. In sum, the RCS is the authority by which every information professional interacts with the information in his charge.
A staff policy for judicial process
We turn to the second essential management procedure-a policy to guide staff in the receipt and handling of judicial process. Employees should not be placed in a position of interpreting and responding to judicial process. But that is exactly the situation when management does not promulgate clear policies, in which only senior management ( e.g. , the library director) and legal counsel are authorized to act on received judicial process. A proposed policy follows:
Library Policy for Receipt and Response to Judicial Process
"Judicial process" is a general term used in this policy directive to encompass a complex array of demands for information under the authority of a court or judicially-related process. The complexity comes from the differences in types of evidence sought, e.g. , electronic communications information or documentary records; the form of judicial process, e.g. , intercept order, search warrant, court order, subpoena, or otherwise; the interest, e.g. , criminal law enforcement, government regulatory, intelligence, or civil; the government authority involved, e.g. , local, state, or federal; and the issuing authority, e.g. , judge, magistrate, court clerk, law enforcement or private authority.
Moreover, it is not unusual to receive verbal requests from law enforcement and other government officials without benefit of any judicial process. While it is not unlawful to request information, it may well result in criminal prosecutions, and it is certainly unlawful for library staff to release patron-specific information under such circumstances.
Accordingly, it is the policy of this library to comply with all proper judicial process while preserving patron confidentiality to the extent allowed by law. However, given the complexity of these matters, it is critical that any form of judicial process be handed over immediately to the library director and library counsel for action. No other staff member, except as specifically authorized by the director, should release library or patron information. This policy directive sets forth these facts and the steps that each member of the library staff must follow in such matters.
Policy and Process for Responding to Judicial Process
- No member of the library staff is authorized to respond substantively to any form of judicial process or to provide any patron-specific or library-business information, in writing or in oral form, to a law enforcement officer or other person.
- Written requests in the nature of judicial process (or otherwise requesting information) received by mail or delivery service should be forwarded immediately to the library director by fax and their receipt confirmed by telephone.
- Oral requests by a law enforcement officer present delicate questions. Without judicial process, no officer can require cooperation with an investigation, including answers to questions or the production of records. Indeed state laws prohibit such answers or disclosures if they contain patron-specific information. However, as citizens and library employees, we have an interest in the effective functioning of our law enforcement and intelligence agencies and may wish to cooperate. To the extent that an officer requests non-confidential information ( e.g. , whether a person in a photograph has been in your library), the employee may respond. However, the sometimes subtle distinctions between confidential and non-confidential information and the ease by which questions progress to confidential matters suggest caution. If there is any doubt, library management should be consulted.
- Any law enforcement officer (or other individual) presenting judicial process should be invited into a private office by the senior library staff member present. That staff member should request identification (a badge, a current law enforcement agency-issued photo identification credential, and a business card) and should record the name, title, agency, and telephone number of the officer and request a copy of the process and any associated documents.
- If the document is a subpoena or other form of judicial process that requires production at a future time, the officer may simply leave a copy. If a signature is requested, inform the officer that you are not authorized to accept service of process and that you will notify the library director and counsel. In all events, the person authorized to accept the subpoena should note orally and in writing that " service is accepted in official capacity only ."
- If the document is a search warrant that authorizes immediate search and seizure, inform the officer that the library director and counsel will be contacted immediately and request the patience of the officer.
- Be polite and friendly. It is important that the matter not be treated as adversarial since it is the policy of the library to cooperate, and negotiation of the scope of the judicial process can often minimize the intrusion. Remember that many stories of "over-reaching" by law enforcement can be attributed at least in part to a break down in communications.
- The officer may inform you that the terms of the warrant are " secret " or " sealed " and that you may not disclose any information relating to the warrant or execution. This may, in fact, be correct (if, for instance, the process is issued by the U.S. Foreign Intelligence Surveillance Court or by other courts in particularly sensitive matters), but it does not preclude notification of the library Director and counsel.
- If a search warrant has been presented and the law enforcement officer will not wait for the director and counsel, politely remind the officer that the library is an innocent third party and that constitutional considerations and good faith suggest that a brief delay is appropriate.
- If the officer declines to delay, you should carefully inspect the warrant and monitor the search. Remember that the objective is to minimize disruption to the operations of the library but not to impede or obstruct. Some specific steps that you should undertake:
- Enlist the assistance of one other senior member of the staff to work with and accompany you in order to record and remember relevant facts and events.
- Ensure that the warrant is signed by a magistrate or judge.
- Note exactly what records or items are authorized to be seized.
- Volunteer to assist the officer by locating the information, enlisting the assistance of those on the staff who are knowledgeable, and offering to provide copies of electronic information in lieu of seizure of hardware. If recordable media is seized, request the opportunity to make copies before it is removed.
- Whether or not the officer accepts your offer of assistance, you should monitor the search and seizure process.
- Note areas and rooms entered, files and computers inspected, and/or specific actions taken.
- Attempt to make copies of all records seized.
- Note and advise the officer if information is being seized that appears to be in excess of that authorized by the warrant.
- Note and advise the officer if information is being seized that is privileged ( e.g. , patron-specific information, employee records, or attorney/client), and ask that it be so marked.
- At the conclusion of the search, the officer should provide an inventory. If he does not, request a copy, but do not sign any statement confirming that the inventory is accurate or complete.
- Whether or not the judicial process is secret or sealed, ask all involved staff not to discuss the matter with the media, patrons, family, or other employees since decisions in this regard must be made by the library director and counsel.
As we have seen, understanding judicial process is certainly complex. But what is the realistic extent of the impact of these law enforcement and intelligence authorities on information professionals including librarians? It is, of course, difficult to know because there are no centralized records of law enforcement orders, and FISA orders are secret. However, according to reports by the American Civil Liberties Union, FISA warrants have been served on at least 220 colleges (as of May 2002), including Cornell, Harvard, and the University of Texas. Others have been served on booksellers and libraries, and here the recipients include Queens in New York. But many, many more, perhaps thousands, have been served on ISPs and portals, including AOL and Yahoo! The University of Illinois surveyed 1,020 public libraries in January and February of 2002 and found that 85 had been asked by law enforcement officers for information about patrons. What is certain and necessary, however, is the importance of initially and immediately involving your legal counsel whenever judicial process is received.
There is also a second question relating to impact. What does this complex world of judicial orders mean for our hypothetical librarian in management terms ? We considered two of the most significant management actions: an adequate records-management plan, as well as an institutional policy regulating response. But there is more. The first is the need to build a relationship with your legal counsel. The receipt of judicial process is not the time to begin your brief to counsel. The second is your ability to negotiate with law enforcement officers concerning the scope and execution of any orders. Despite your fears, law enforcement and intelligence officials are invariably willing to discuss your ability to respond in a manner that is reasonable and does not unduly disrupt your operations. And the third is the importance of good public relations when dealing with such matters. The imbroglios resulting from statements by information professionals in the aftermath of September 11th require a continual emphasis on the legal rules we have considered, which exist to balance individual constitutional rights and effective law enforcement. When we as librarians comply with the advice of our counsel, we ensure that balance is maintained.
1 Carnivore, more recently renamed DCS-1000, is in essence a special filtering tool that can be inserted into a communication network and configured to gather information authorized by court order-and only that information. In other words, it is a LAN or packet sniffer that identifies and copies (by IP address) those packets so authorized. It does not change any constitutional or statutory requirements for warrants and court orders, but it has been the subject of enormous controversy over civil liberties because of the possibility of intentional or accidental misuse. However, because of these concerns, former Attorney General Reno convened an impartial revue by a leading US university. On 21 November 2000, the Illinois Institute of Technology completed its report and verified that the system operates as stated, albeit that proper use relies on the operator's ability to configure the filter correctly and fully.
Lee Strickland is a Visiting Professor, College of Information Studies at the University of Maryland. He can be reached at firstname.lastname@example.org .