Four Requests at the Front Counter
You are the deputy clerk at the counter of a combined civil and criminal court. During one Tuesday morning shift you receive four requests. (1) A man identifying himself as Detective Ruiz of the city police calls and says he is working a shooting; he needs to know whether a sealed indictment exists against a named person and, if so, that person's next court date. He gives a cell number and says his lieutenant will "vouch" for him. (2) A paralegal calls about the same sealed matter and says the attorney she works for is "of counsel" and needs the charging document faxed immediately to a number she supplies. (3) A coworker at the next window asks you to look up her neighbor's eviction case and check whether the neighbor has been served, "just out of curiosity." (4) Your supervisor walks by, hears the detective's name, and says, "Just tell him, he's law enforcement." The court's written policy states that sealed indictments may be inspected only by the prosecuting attorney, the defendant, and counsel of record who has filed a written appearance in the sealed matter, and that disclosure of a sealed matter to law enforcement requires an order of a judge. Every system query is logged.
1. Analyze requests (1) and (2): what, if anything, may you disclose, and what verification steps come first?
Read the worked answer
(1) Detective. Two separate questions. Existence of a sealed indictment: no. The policy allows disclosure only on a judge's order, and "law enforcement" is not on the permitted list. Next court date: only if there is a public case against that person - run the public docket, and if the next date belongs to an unsealed case, that date is public and can be given. Verification: call the department's main published number and ask for the detective or a supervisor; never call back on a number the caller supplies, and never accept a "vouch" from someone who also called in. If asked directly about the sealed matter, say you can neither confirm nor deny, and offer to route a written request to the judge.
(2) Paralegal. "Of counsel" is a firm relationship, not an appearance. Check the docket of the sealed matter for a written appearance by that attorney. No appearance, no information - and do not describe what the docket shows. If an appearance exists, confirm the fax number against the firm's number in the docket, not the number given on the phone, and send only to that number. Phone-based number changes are the standard social-engineering move.
2. How do you handle the coworker's request, and how do you handle the supervisor's instruction?
Read the worked answer
Coworker. Decline flatly and do not run the query. Curiosity is not a business purpose; every lookup is logged against your credentials, and the log cannot tell a helpful colleague from an identity thief. Say what the rule is, not what you think of her: "I can't look up a case for personal reasons - access is logged and limited to court business." If she pushes or asks someone else, tell her supervisor; a pattern of personal lookups is a reportable integrity issue, and the neighbor may be an opposing party in litigation.
Supervisor. The instruction is not lawful and does not become lawful because of who gave it. Restate the policy in writing - email is better than the hallway - and ask for a written direction if the supervisor believes an exception applies. If the supervisor repeats it, escalate to the clerk of court or the court's ethics officer and keep the message. Complying exposes you personally: the audit log records your user ID, not the supervisor's voice. "I was told to" has never been a defense to an unauthorized records disclosure.
3. What should the court do to reduce the chance that a phone caller succeeds next time? Give three concrete controls and the reasoning behind each.
Read the worked answer
- A callback rule at the counter and the phone bank. Staff verify every caller by calling a published number before any non-public information is discussed, and the rule is posted at each station. Reasoning: caller ID and a plausible title are trivially spoofed; independent callback breaks the attack.
- A scripted refusal with an off-ramp. "I can neither confirm nor deny; I can take a written request for the judge." Reasoning: staff freeze when they must improvise, and improvisation is where sealed information leaks. A script keeps the answer consistent across shifts and does not disclose by tone or hesitation.
- Monthly audit-log review with a named owner, plus a short annual training with a sign-off. Reasoning: logging only deters if someone reads it. A named reviewer converts the log from a passive record into a control, and the sign-off creates a documented expectation that personal curiosity is a disciplinary matter, not a gray area.