The Storage Room, the Shred Vendor, and the FOIA Request
You are the records custodian for a garrison administrative office. Renovation requires clearing a storage room that holds 12 boxes of contract files from FY2016–FY2018. A branch supervisor says, “They’re old-shred them tomorrow so the movers can get in.” Your agency records schedule says contract files are destroyed six years after final payment. Some files show final payment in 2019; others in 2021. While checking boxes, you find one containing 40 personnel files with Social Security numbers and a government laptop that is not tagged or encrypted. You also learn that a FOIA request for one of the 2018 contracts arrived last week, and an IG hotline inquiry is open on a 2017 award. The shred vendor is scheduled for 0900 tomorrow. The moving deadline is Friday. Your supervisor is on leave.
1. Should you authorize shredding? What should you do with the 12 boxes?
Read the worked answer
No. The boxes are not eligible as a block. The records schedule uses final payment as the trigger, and some files show final payment in 2021, so they are still within the six-year retention period. More importantly, the FOIA request and the open IG inquiry create preservation obligations. Destroying records that are subject to a request, an investigation, or a reasonably anticipated legal hold can be a serious violation, even if the vendor is already scheduled.
Cancel or postpone the vendor. Then inventory the boxes at the file level, separating eligible from ineligible records and isolating any file tied to the FOIA request or IG inquiry. Place a written hold on those files and store them in a locked, access-controlled space. Consult the agency records manager and legal counsel before any destruction. If space is the pressing issue, request temporary storage or a moving sequence that leaves the records room intact.
Document the inventory, the hold, the vendor cancellation, and the instructions you received. A short written record protects you and the agency.
2. How should you handle the personnel files with Social Security numbers and the untagged, unencrypted laptop?
Read the worked answer
Treat both as security and privacy incidents, not as routine records. Do not open the personnel files more than necessary, do not copy them, and do not email them. Secure the box in a locked container with limited access, record who had custody, and notify the privacy officer and the security office the same day. The presence of SSNs means the office must assess whether a reportable breach occurred and whether notification or credit monitoring is required.
The laptop is a separate problem. An untagged, unencrypted government device outside accountable property records may indicate lost or improperly stored equipment. Do not connect it to the network or attempt to log in. Contact the IT security office or information system security officer, preserve the device as found, and document the chain of custody.
Keep the two issues separate in your reporting. Combining them can obscure the facts and delay the required notifications. Use official channels, not personal email or text messages.
3. What documentation and communication should you provide while your supervisor is on leave?
Read the worked answer
Send your supervisor a concise written summary the same day: what the schedule requires, why the shred cannot proceed, what holds are in place, what security notifications you made, and what decision you need. Copy the acting supervisor or branch chief so the issue does not sit unread. Avoid waiting for the supervisor’s return if the vendor or movers require an immediate answer.
Prepare a one-page memo for the file with a box-level inventory, retention cutoff dates, the FOIA and IG references, the location of the secured records, and the name of the person who authorized any temporary storage. Notify the mover in writing that the storage room is not releasable until records screening is complete, and propose a revised move date.
Documentation matters because records decisions are reviewed later. A clear record shows that you applied the schedule, honored the holds, and protected the information rather than simply blocking the renovation. It also gives the agency a defensible basis for the delay.