RSG #341: How To Audit Contractors That Control Public Records

The government increasingly stores public information inside systems owned or operated by private contractors. Police evidence sits in commercial cloud platforms. Public school messages live in vendor portals. Benefit decisions are generated by private software. Transportation data, emergency records, inspection photographs, license plate searches, and agency communications may never touch a government server.

Then a public records request arrives.

Suddenly, the agency claims it cannot search the contractor’s system. The vendor demands an export fee. The contract says the government owns the information but does not explain how officials can retrieve it. Everyone begins staring at the word proprietary as if it descended from the heavens carrying a legal exemption.

This Resistance Survival Guide explains how to identify contractor controlled public records, examine the contract, test agency access, trace deletion and export rights, and determine whether outsourcing has quietly weakened the public’s ability to inspect government work.

Why Contractor Control Creates an Accountability Gap

A private company may host records without owning their legal substance. Government information does not necessarily lose its public character because an agency selected a commercial server, vendor portal, or software platform.

However, access laws differ. Federal FOIA generally applies to agency records, not every document created by a government contractor. Courts commonly examine whether an agency created or obtained the material and whether the agency controlled it when the request arrived.

State public records laws vary considerably. Some expressly include records created or received by contractors for public agencies. Other states examine whether a private entity performs a government function, receives public money, or acts as the functional equivalent of an agency.

Never assume that every contractor record is public. Never accept the opposite claim merely because the government placed a corporate logo above the login screen.

Know the Difference Between Ownership and Control

A contract may declare that the government owns all data. That language is useful, but ownership alone may not establish that every contractor held document is an agency record under federal FOIA.

A 2025 federal court decision summarized by the Justice Department Office of Information Policy found that contractual ownership did not automatically establish agency control when NASA had not exercised its right to obtain or access certain contractor records.

Different rules can apply when a contractor maintains records for an agency as part of records management. Justice Department guidance explains that agencies must have procedures enabling them to search and process responsive agency records held by a records management contractor.

The exact contract, agency practices, governing law, and nature of the requested information all matter. Public access does not improve when investigators replace legal analysis with extremely confident vibes.

Step by Step Guide

Step One: Identify the Government Function

Define what the contractor performs for the agency. It may store evidence, process benefits, manage permits, analyze surveillance data, host email, provide medical services, operate detention facilities, collect payments, maintain school records, or administer a public program.

Record which decisions remain with government employees and which actions the contractor performs independently. The closer the contractor comes to performing an ordinary government duty, the more important the public access analysis becomes.

Step Two: Identify Every Vendor and Subcontractor

Search contracts, invoices, council agendas, procurement records, privacy policies, system login pages, budget documents, and employee manuals.

Record the prime contractor, parent company, product name, former names, reseller, cloud provider, data supplier, and subcontractors. A government agency may describe one vendor while the records travel through four other companies.

Search USAspending.gov and SAM.gov contract data for federal purchases. For state and local systems, examine purchasing portals, board packets, and payment registers.

Step Three: Obtain the Complete Contract File

Request the original solicitation, vendor proposal, scoring records, executed contract, statement of work, amendments, renewals, change orders, pricing schedules, security exhibits, data agreements, and termination documents.

Do not stop at the main contract. Data ownership, export rights, deletion, subcontracting, public records duties, and transition services often appear inside attachments with names designed to encourage a nap.

Step Four: Build a Records Inventory

List every category of information created, received, processed, stored, changed, or exported through the system.

Include raw data, uploaded documents, messages, reports, photographs, recordings, audit logs, search histories, alerts, scores, notes, drafts, metadata, user lists, access records, deletion logs, and system generated reports.

Ask the agency for its official records inventory and retention schedule. Compare those documents with the vendor’s actual functions.

Step Five: Determine Who Can Access the Records

Request user manuals, permission charts, administrator instructions, support procedures, and records identifying authorized government and contractor users.

Determine whether agency employees can search, download, export, correct, preserve, and delete records without vendor assistance. Ask whether officials have direct access to audit logs and historical information.

An agency that can use a system every day but becomes mysteriously unable to search it after receiving a records request deserves a more detailed explanation.

Step Six: Examine Public Records Contract Language

Search the contract for public record, open record, FOIA, disclosure, retention, preservation, litigation hold, ownership, custody, export, retrieval, audit, termination, and cooperation.

Strong language should require the contractor to preserve covered records, assist with searches, provide information in usable formats, meet legal deadlines, support appeals and litigation, and avoid charging surprise retrieval fees.

Determine whether subcontractors must follow the same requirements. A public records clause that disappears one vendor down the chain is not much of a safeguard.

Step Seven: Test the Export Function

Ask the agency to demonstrate or describe how it exports a complete record set. Identify available formats, search fields, metadata, attachments, audit history, file relationships, and date limitations.

Request records showing previous bulk exports, migrations, legal holds, audits, or contract transitions. These events may prove that retrieval is technically possible even when the agency describes your request as an unprecedented burden upon modern civilization.

Step Eight: Trace Search Costs and Vendor Fees

Request pricing for searches, exports, technical support, storage restoration, archived data, redaction tools, and litigation assistance.

Determine whether the agency agreed to pay the contractor each time someone requests public information. Compare quoted fees with the contract and previous invoices.

A government cannot improve transparency by purchasing a records system that converts every request into a premium feature.

Step Nine: Compare Retention Rules

Locate the agency’s retention schedule and the vendor’s deletion policy. Record which rule governs each record category.

Determine whether the vendor automatically deletes information before the government retention period expires. Ask about backups, archived accounts, inactive users, overwritten logs, terminated contracts, and information removed by automated processes.

For federal records, National Archives guidance states that contractors holding federal records must manage them according to applicable federal records laws and regulations.

Step Ten: Investigate Missing or Destroyed Records

Request incident reports, deletion logs, data loss notices, corrupted exports, restoration attempts, legal hold failures, and communications concerning missing information.

Federal agencies must report actual or threatened unlawful destruction or removal of records to the Archivist. The National Archives accepts information about unauthorized disposition, including reports from private citizens and journalists.

For state or local records, identify the applicable records officer, archivist, auditor, inspector general, or enforcement authority.

Step Eleven: File a Precisely Written Records Request

Send the request to the government agency unless state law or the contract establishes another procedure. Identify the vendor, product, government program, date range, record categories, likely users, and requested formats.

State that the request includes responsive agency records maintained for the agency by its contractor. Ask the agency to search its own systems and require the contractor to search any system reasonably likely to contain responsive records.

Request native spreadsheets, searchable documents, complete attachments, original file names, and associated metadata when available.

Step Twelve: Audit the Response

Record which systems were searched, who performed each search, what terms were used, whether the contractor participated, and what formats were produced.

Compare the response with contracts, manuals, invoices, screenshots, and previous exports. Look for missing attachments, absent logs, unexplained date gaps, broken relationships between files, and reports referenced elsewhere but not produced.

If the agency claims it lacks control, ask who uses the records, who directs their creation, who can demand an export, who pays for storage, and what happens to the information when the contract ends.

Step Thirteen: Prepare for Termination Before It Happens

Request transition plans, data migration procedures, destruction certificates, continuing access terms, escrow provisions, and final export requirements.

Determine whether the agency receives a complete usable copy before the contractor deletes or disables the system. Test whether the export preserves metadata, relationships, permissions, and audit history.

Government information should not become a corporate hostage because procurement forgot to plan for a breakup.

Red Flags That Require Closer Examination

Major warning signs include contracts with no public records clause, agencies unable to search their own information, vendors charging unlisted retrieval fees, automatic deletion that conflicts with retention schedules, missing audit logs, and subcontractors outside the agency’s access requirements.

Other concerns include proprietary formats, incomplete exports, ownership without practical access, records available only through vendor employees, systems that cannot preserve litigation holds, and termination clauses allowing deletion before the government confirms a complete transfer.

The largest red flag is an agency insisting that a contractor performs essential public work while claiming the resulting records are entirely private. Government cannot outsource a duty and then pretend the paperwork wandered off to join the private sector.

Turning the Findings Into Accountability

Create a findings table identifying the agency, vendor, public function, record categories, government access, contract requirements, retention period, export rights, fees, subcontractors, and documented failures.

Send the evidence to the agency records officer, inspector general, auditor, legislative oversight committee, archivist, affected community, and independent journalists.

Recommend mandatory public records clauses, direct agency access, complete audit logs, open export formats, short retrieval deadlines, contractor cooperation, preservation requirements, reasonable fees, routine testing, and verified data return before contract termination.

The objective is not to prevent agencies from using private technology. It is to ensure that purchasing technology does not purchase an escape hatch from transparency.

Closing RK Thoughts

Public records laws are supposed to reveal how government performs public business. That promise becomes fragile when the evidence sits inside a private system the agency cannot search, export, preserve, or explain.

Follow the function. Obtain the contract. Inventory the records. Test the access. Trace the fees. Compare retention rules. Then determine whether the government controls its information or merely rents permission to look at it.

Resistance Kitty understands that agencies need software. She simply prefers public records systems that can survive both a records request and a vendor invoice without collapsing onto a fainting couch.