RSG #311: How To Detect A Coordinated Government Records Destruction Pattern

Resistance Survival Guide #311

Government records disappear for many reasons. A website may be redesigned. A database may be migrated. Temporary records may reach the end of an approved retention period. An employee may leave before their files are properly transferred. None of these events automatically proves that evidence was deliberately destroyed.

A coordinated records destruction pattern looks different. It emerges when missing records coincide with investigations, lawsuits, leadership changes, public records requests, inspector general inquiries, or politically sensitive decisions. The pattern becomes stronger when several systems fail at the same time, retention policies suddenly change, legal holds are ignored, and officials cannot produce the documents authorizing destruction.

This Resistance Survival Guide explains how to distinguish routine records management from suspicious deletion. It also shows how to preserve evidence, examine records schedules, trace missing email accounts, identify unexplained database gaps, and report potential unauthorized destruction without making claims that the available evidence cannot support.

Why Government Records Matter

Government records document how public power is exercised. They can show who approved a policy, who received a contract, who attended a meeting, who raised an objection, and how an agency responded to warnings.

Federal law requires agency heads to create and preserve adequate documentation of their organizations, policies, decisions, procedures, and essential transactions. These records must also protect the legal and financial rights of the government and people affected by government activity.

Federal records do not have to be retained forever. However, they cannot be legally destroyed merely because an official considers them inconvenient, outdated, embarrassing, or unnecessary. Federal records must be covered by a National Archives and Records Administration approved records schedule. Unscheduled records must be treated as permanent until an approved schedule covers them.

The rules for state and local records vary. Every investigation must therefore begin by identifying the jurisdiction, the agency, the type of record, and the retention schedule that applies.

Routine Disposal Versus Suspicious Destruction

Routine disposal should leave a paper trail. Investigators should be able to identify the records schedule, the specific schedule item, the triggering event, the retention period, the date of disposal, and the official responsible for approving or documenting the action.

A credible routine disposal explanation should also apply consistently. If a schedule says that every routine administrative email is retained for three years, investigators should not find that only the emails of one controversial official disappeared after six months.

Suspicion rises when an agency cannot identify the schedule authorizing destruction. It also rises when records disappear before the retention period expires, when destruction affects only a politically sensitive subject, or when officials change the retention policy shortly before records become eligible for deletion.

The strongest cases do not depend on a single missing file. They show a repeated pattern across custodians, accounts, devices, databases, public websites, contractor systems, backup environments, and records management policies.

Warning Signs Of A Coordinated Pattern

Targeted Gaps

A database that contains continuous records for several years but suddenly has no entries during a controversial decision period deserves examination. The same applies when sequential identification numbers skip a block, meeting minutes vanish for only one committee, or enforcement data disappears during a leadership transition.

A gap is an investigative lead. It is not proof of intentional destruction. The next step is to determine whether the records were never created, were moved, were withheld, were corrupted, or were destroyed.

Sudden Retention Policy Changes

Compare the current retention schedule with earlier versions. A shortened retention period may be legitimate, but the agency should be able to show when the change was proposed, who approved it, what records it covered, and whether it applied retroactively.

For federal agencies, proposed disposal of temporary federal records is generally subject to public notice and an opportunity for comment. This allows the public to review proposed schedules before disposal authority is approved.

Unavailable Employee Accounts

An agency may claim that an employee’s email account was deleted after departure. That explanation should be tested against the employee exit procedure, mailbox retention policy, automatic archiving system, legal hold system, records transfer requirements, and information technology service tickets.

The important question is not simply whether the account still exists. The question is whether official records were captured in an authorized recordkeeping system before the account was closed.

Missing Devices

A wiped phone or reassigned computer may be part of ordinary government operations. Concern increases when the device belonged to a central decision maker, contained official communications, was wiped outside the normal replacement cycle, or was destroyed after litigation became reasonably foreseeable.

Request the device inventory, assignment history, wipe date, wipe authorization, disposal certificate, information technology ticket, and applicable device retention policy.

Contradictory Explanations

One office may claim that records were deleted under a schedule. Another may say they never existed. A third may say they were transferred to an archive. Contradictory explanations are important because they may reveal weak controls, poor searches, or an attempt to avoid responsibility.

Document each explanation exactly. Record who made it, when it was made, and what evidence was offered.

Destruction During A Hold

A valid records schedule does not authorize destruction when records are subject to a legal hold or another preservation requirement. NARA guidance explains that federal records needed for litigation or responsive to a pending Freedom of Information Act request must not be disposed of under an otherwise approved schedule.

Agency counsel may issue a litigation hold or destruction moratorium when records could be relevant to pending or reasonably anticipated litigation. The Department of Justice manual directs agency counsel to impose and manage an appropriate litigation hold once litigation is reasonably anticipated.

Step by Step Guide

Step One: Define The Suspected Loss

Begin with a precise description of what appears to be missing. Identify the record type, agency, office, date range, subject, known custodians, and system where the records should have existed.

Do not begin with a conclusion such as “the agency destroyed evidence.” Begin with a testable statement such as “monthly inspection reports appear online from January 2021 through March 2025, but no reports are available from April through September 2025.”

This framing protects the credibility of the investigation. It also makes public records requests easier to draft.

Step Two: Establish The Event Timeline

Create a timeline containing every event that could have affected preservation. Include public records requests, subpoenas, lawsuits, inspector general inquiries, congressional letters, employee departures, leadership changes, system migrations, device replacements, website redesigns, and policy revisions.

Timing is often the most important evidence. Records destroyed years before a controversy may have been disposed of routinely. The same destruction occurring after a subpoena, records request, or internal warning requires much closer scrutiny.

Use exact dates whenever possible. Save the source supporting each date.

Step Three: Identify Every Possible Record Custodian

Records are often duplicated across multiple offices. An email may exist in the sender’s mailbox, the recipient’s mailbox, an archive, a mobile device, a contractor account, a case management system, or an attachment repository.

Identify the officials who created, received, approved, stored, or transmitted the records. Then identify the records officer, information technology administrator, agency counsel, program office, contractor, and archive responsible for the systems involved.

This prevents an agency from limiting its search to one convenient location.

Step Four: Locate The Controlling Retention Schedule

Search the agency website, NARA records schedule collections, state archives, municipal records policies, and earlier archived versions of those sources. For federal administrative records, also review the General Records Schedules. These schedules generally cover common administrative functions rather than records documenting an agency’s central mission.

Record the schedule number, item number, description, retention period, triggering event, approval date, and superseded schedule.

Words such as “destroy when no longer needed” require special attention. Determine who decides when the record is no longer needed and whether the agency documented that decision.

Step Five: Build An Expected Records Inventory

List the records that should normally exist based on the agency’s operations. This may include calendars, meeting notices, agendas, minutes, email, text messages, memoranda, draft reports, final reports, database entries, audit logs, contracts, invoices, access logs, telephone records, and information technology tickets.

For each record class, identify the expected frequency. A daily report system should produce a different pattern from an event based complaint system.

The inventory gives you a baseline. Without a baseline, it is difficult to distinguish an actual gap from a record that was never routinely created.

Step Six: Preserve Public Evidence Immediately

Save the current page before notifying the agency of the discrepancy. Capture the page address, visible content, access date, linked files, file names, and relevant metadata.

Use the nonprofit Internet Archive Wayback Machine to search earlier versions and save current public pages. Its Save Page Now function creates a dated capture that can later support your timeline. (Wayback Machine)

For complex pages, interactive databases, or content that requires navigation, use ArchiveWeb.page. It can create browser based archives and export them in standard web archive formats.

Keep local copies as well. A public archive should not be your only copy of critical evidence.

Step Seven: Document File Integrity

For every downloaded file, record the source address, download date, file name, file size, page count, and visible publication date. Create a cryptographic hash when possible. A hash acts as a digital fingerprint and can later show whether the file changed.

Do not rename the only original copy. Preserve one untouched copy and create a separate working copy for notes or annotations.

Screenshots are useful, but they should not replace the original file, its metadata, or a full page capture.

Step Eight: Compare Archived And Current Versions

Look for removed sections, changed dates, missing attachments, revised descriptions, altered retention periods, broken links, and changed database fields.

Do not examine only the main page. Open linked documents and compare file names, page counts, tables, appendices, and document properties.

A changed web page may reflect an ordinary update. A more serious pattern appears when a page changes, the linked source file disappears, the archived schedule is removed, and the agency later denies that the record existed.

Step Nine: Request The Records Management Trail

Submit a public records request for the schedule, disposition authorization, destruction log, certificate of destruction, transfer documentation, records inventory, policy version history, and communications concerning the disposal.

A useful request can state:

Please provide the records schedule and specific schedule item authorizing the destruction, deletion, transfer, or disposal of the identified records. Please also provide any disposition logs, destruction certificates, approval records, information technology tickets, transfer forms, policy versions, and communications documenting when the disposition occurred and who authorized it.

MuckRock is a nonprofit newsroom and public records platform that allows requesters to file, track, and share public records requests. It also publishes guides on requesting text messages, retention schedules, data inventories, and agency records policies.

Step Ten: Request Hold And Preservation Records

Request records identifying any litigation hold, preservation notice, destruction moratorium, subpoena, congressional preservation request, inspector general request, or agency counsel instruction covering the disputed records.

Also request communications about implementing the hold. A written hold is less meaningful if no one identified the custodians, suspended automatic deletion, preserved mobile messages, or confirmed compliance.

A private preservation letter can place an agency on notice of a potential records issue. However, it is not automatically equivalent to a court order or an agency issued litigation hold. Anyone facing active litigation should consult qualified legal counsel.

Step Eleven: Examine Employee Departure Procedures

Request the separation checklist, mailbox closure policy, device return record, account suspension date, data transfer record, and supervisor certification for relevant employees.

Determine whether official records were transferred before the account was deleted. Ask whether the employee used personal email, encrypted messaging, collaborative workspaces, or contractor systems for government business.

The use of an unofficial system does not necessarily mean the records ceased to be government records. The content, purpose, and applicable law matter more than the device or account used.

Step Twelve: Test Backup And Migration Explanations

Agencies often explain missing data as a system migration problem. Request the migration plan, data map, validation report, error log, reconciliation report, system acceptance document, and list of records excluded from transfer.

Compare record counts before and after migration. Look for missing date ranges, changed identification numbers, altered fields, duplicate records, and entries that lost attachments.

Backups should not be assumed to contain every official record. Backup systems may be designed for disaster recovery and may follow short rotation cycles. Request the backup policy rather than assuming a recoverable copy exists.

Step Thirteen: Analyze Database Gaps

Download public data at regular intervals. Record the number of rows, earliest date, latest date, column names, file size, and publication timestamp.

Look for sudden drops in volume, missing identification numbers, duplicate identifiers, altered date formats, removed categories, or a change in the agency’s definition of the dataset.

A database may appear complete while silently excluding records through a new filter. Compare the data dictionary and methodology notes as carefully as the data itself.

ChangeDetection.io can monitor public pages and alert users when visible content changes. The project also provides an open source version for people who prefer to operate their own monitoring system. (

Step Fourteen: Search For Unauthorized Disposition Cases

NARA maintains case files concerning allegations of unauthorized federal records disposition. The agency accepts reports from federal agencies, news organizations, and private citizens.

Search for the agency name with terms such as “unauthorized disposition,” “unauthorized destruction,” “records management assessment,” “records loss,” and “corrective action.”

Also search Oversight.gov for inspector general audits and investigations involving email preservation, missing files, recordkeeping systems, device management, information technology controls, or incomplete databases.

Step Fifteen: Contact The Responsible Records Officials

For a federal investigation, identify the agency records officer through the NARA Federal Agency Records Officer list. NARA also maintains a list of senior agency officials responsible for records management.

Send a concise factual inquiry. Identify the record series, date range, suspected gap, relevant schedule, and evidence supporting your concern.

Do not accuse individual employees of crimes. Ask the official to explain the disposition authority, preservation status, search locations, and corrective action.

Step Sixteen: Report A Potential Unauthorized Disposition

Federal agencies are required to notify the Archivist of actual, impending, or threatened unlawful removal, alteration, deletion, erasure, corruption, or destruction of federal records. NARA may also review allegations submitted by members of the public.

A useful report should identify the agency, record series, date range, suspected destruction date, applicable schedule, known holds, relevant officials, supporting documents, and prior attempts to obtain an explanation.

Inspector general complaints should be equally precise. The NARA Inspector General recommends complete sentences, full names, official titles, organizational units, accurate dates, and a clear statement of the concern.

Step Seventeen: Build An Evidence Matrix

Create a separate entry for every suspected records gap. Include the record type, expected location, expected date range, observed gap, applicable schedule, authorized destruction date, actual disappearance date, hold status, agency explanation, supporting source, and confidence level.

Rate the evidence conservatively.

An anomaly means a record is unavailable.

A process conflict means the disappearance does not match the known schedule or procedure.

A legal conflict means the record may have been destroyed despite a hold, pending request, subpoena, or other preservation obligation.

A coordinated pattern means comparable gaps appear across multiple custodians, systems, or offices during the same event window.

Direct evidence means there is a destruction instruction, system log, disposal certificate, admission, audit finding, or documented order.

This method prevents circumstantial evidence from being presented as direct proof.

How To Evaluate A Preservation Letter

A preservation letter should identify the relevant subject, dates, custodians, record types, systems, and foreseeable proceeding. It should ask the recipient to suspend routine deletion and preserve email, texts, attachments, databases, device data, logs, backups, contractor records, and related metadata.

Keep the request narrow enough to be credible. An unlimited demand to preserve every agency record may be ignored or challenged as unreasonable.

A preservation letter is most useful when paired with a dated factual basis. Explain what event created the need for preservation, such as a filed lawsuit, announced investigation, pending records request, documented records gap, or anticipated administrative proceeding.

Keep proof of delivery.

What Does Not Prove Records Destruction

A missing web page does not prove that the underlying government record was destroyed. The page may have moved to a different address.

A Freedom of Information Act response stating that no responsive records were found does not necessarily prove that the records never existed. It may reflect the scope of the search, the offices contacted, the search terms used, or the agency’s interpretation of the request.

A missing Wayback Machine capture does not prove that a page was absent. The page may not have been captured.

An unavailable email account does not prove that every message was destroyed. Messages may have been retained in recipient accounts, archives, exports, or official recordkeeping systems.

A suspicious coincidence is not direct evidence. Strong reporting explains the coincidence, identifies the missing evidence, and states what additional records would confirm or refute the theory.

Common Investigative Mistakes

Do not begin by publicly accusing a named person of obstruction or criminal destruction. Establish the record class, schedule, timeline, and preservation obligations first.

Do not rely only on the agency website. Important records may be held by contractors, archives, oversight bodies, courts, recipients, state partners, legislative committees, or former officials.

Do not edit original evidence. Keep untouched copies and document every processing step.

Do not access private accounts, restricted systems, stolen material, or improperly obtained credentials. A legitimate public interest investigation does not authorize unlawful access.

Do not publish personal information unrelated to government activity. Preserve public accountability without exposing private individuals unnecessarily.

Fact Check And Legal Limits

Federal agency records are generally governed by the Federal Records Act. Presidential and vice presidential records are governed separately under the Presidential Records Act.

On April 1, 2026, the Department of Justice Office of Legal Counsel issued an opinion asserting that the Presidential Records Act is unconstitutional. That document is an executive branch legal opinion. It is not a Supreme Court ruling and should not be described as a final nationwide judicial determination.

NARA continues to publish information describing the Presidential Records Act and its role in preserving presidential records after an administration. Investigators should therefore distinguish disputed presidential records issues from the requirements governing ordinary federal agency records.

State, county, municipal, court, legislative, and law enforcement records may follow entirely different laws. Always verify the controlling state statute, local ordinance, court rule, and approved retention schedule.

This guide provides investigative information. It is not a substitute for legal advice in an active lawsuit or criminal investigation.

How To Publish The Findings Responsibly

Present the evidence in chronological order. Begin with what records normally existed, when the gap appeared, and what policy governed the records.

Separate verified facts from unresolved questions. Use phrases such as “the agency has not produced the authorization,” “the records are missing from the public database,” or “the available schedule appears to require a longer retention period.”

Link directly to schedules, policies, archived pages, inspector general reports, court filings, and agency responses. Upload primary source documents to a stable repository such as DocumentCloud, which is operated by the nonprofit MuckRock Foundation.

Give the agency a fair opportunity to respond. Publish its explanation accurately, even when the explanation is incomplete or disputed.

The most credible investigation does not overstate the evidence. It shows readers exactly what is known, what is missing, and what records would resolve the remaining questions.

In Closing

Government records destruction is rarely proven by finding one empty folder. It is detected by reconstructing the entire records lifecycle.

Investigators must identify what should have been created, where it should have been stored, how long it should have been retained, whether a legal hold applied, who authorized any disposal, and whether the same gaps appear across several systems.

Routine disposal leaves schedules, approvals, logs, and consistent results. A coordinated destruction pattern leaves contradictions, selective gaps, policy changes, missing authorizations, failed preservation procedures, and unexplained losses clustered around consequential events.

The goal is not to turn every missing document into a conspiracy. The goal is to recognize when ordinary records management no longer explains the evidence.