Friday thoughts on expungement

The act of looking at something changes it., The Observer Effect: Seeing Is Changing
By Dhatfield – Own work, CC BY-SA 3.0,

(I am not a lawyer. I figure that I should say that up front.)

As an automated fingerprint identification system (AFIS) product manager, and in other roles related to AFIS, I have dealt with the concept of expungement.

The American Bar Association (ABA) defines expungement as follows:

In law, “expungement” is the process by which a record of criminal conviction is destroyed or sealed from state or federal record. An expungement order directs the court to treat the criminal conviction as if it had never occurred, essentially removing it from a defendant’s criminal record…

This post looks at various aspects of expungement, including its applicability outside of government (both in the US and in GDPR-land), the difference between sealing and destruction of records, how your (above) average technology product manager deals with expungement, and my huge philosophical question regarding the DOCUMENTING of expungement.

You can’t expunge the public record

Now obviously there are limits to the effects of expungement. If the California court system were to declare that some notorious criminal’s conviction were to be expunged, it would be impossible to treat the conviction “as if it had never occurred,” at least in the public eye. Millions of websites, newspaper and magazine articles, and books would have recorded the conviction for posterity, and it isn’t like you can go from house to house and remove every copy of the relevant People magazine article or New York Post article that mentioned the conviction.

New York Post, “OJ does ‘lard’ time!”

Well, at least you can’t remove them in my country.

Or maybe you can

It’s a different matter in the countries where the General Data Protection Regulation (GDPR) is in force, where at least the online public record of a conviction CAN be removed. Article 17 of the GDPR (the “right to erasure” or the “right to be forgotten”) says in part:

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies…

…the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject…

So in this case an expungement order CAN be extended beyond government records.

Or at least to the online search record. In late 2019, Google was ordered to remove record of three 1999 Der Spiegel articles that mentioned a convicted murderer.

But in a 2018 case, web archives did NOT have to remove records of a 1991 murder.

But perhaps there are dark web samizdat records that detail all of these non-forgotten facts, far from the prying eyes of the enforcers in Brussels.

The difference between sealing and destroying a record

Let’s return to government records in the U.S.

Because expungement is (mostly) a state process, the specific details of expungement differ from state to state. As the ABA notes, different states have different definitions of how records should be expunged.

  • The ABA notes that in Kentucky, it is sufficient to seal the record, which means that only certain privileged people can view the record, but the record still exists. (I was unable to independently confirm that this is still the case in Kentucky, but it appears that Arkansas generally only offers sealing, with the exception of juvenile records.)
  • The state of Washington, however, requires all expunged records to be destroyed so that NO ONE can see them. RCW 13.50.270 details how and when records should be destroyed when destruction is required.

How to implement expungement

As an AFIS product manager, I had to think about the consequences of expungement. For a live AFIS, the method for handling this varied.

  • In the cases where it was sufficient to seal a record, the whole process could be handled by role based access control. My products (Omnitrak and Printrak BIS) had long lists of access privileges, and different access privileges could be assigned to different roles. So, for example, the privilege to view a sealed record could be given to a “supervisor” role, but denied to a “trainee” role.
  • In the cases where you actually needed to destroy an expunged record, you would of course handle things differently. Someone whose role had the privilege to delete records would simply go to the record in question, double-check and triple-check to make sure that the right record was selected, ask the system to delete the record, and answer the inevitable “Are you sure?” question to actually delete the record.

Note that the descriptions above apply to a live AFIS. If you REALLY wanted to be thorough about this, you’d need to think about the backups. Any critical system such as an AFIS is backed up on multiple levels, with the backups stored in different areas. So perhaps an underground bunker several hundred miles from the AFIS site might contain a year old backup that may include an expunged record. Something to think about.

How to document expungement

But these concerns paled in comparison to the philosophical one that surrounds any mention of expungement.

Let’s say that I was convicted of burglary, my state allows me to expunge my burglary conviction, and my state is one of the states that requires destruction of expunged records. (For the record, I was never convicted of burglary. But how would you know?)

To start the process, I or my lawyer would have to fill out a form (here’s Illinois’ form) listing the case numbers of the records that I want expunged.

After I (or my lawyer) submitted my request, some process would need to take place to approve the request to expunge.

After that, the records would be expunged in accordance with the relevant state laws.

So far so good.

But what happens next?

From my perspective, I would want to make sure that the records were expunged as I requested. From the state’s perspective, the state would want to ensure that the expungement order was carried out.

But if I file a question with the state that asks whether my burglary conviction was expunged, I am acknowledging within state records that I was convicted for burglary. And if the state produces a report of the records that were expunged, and my burglary conviction is listed on it, then the state is acknowledging within state records that I was convicted for burglary.

I guess the workaround is for me to ask the state, “Hey state, could you provide me with a list of my criminal convictions?” At this point the state would respond, “Here’s your list of criminal convictions…hmm, you don’t have any.”

At this point I would ask, “Are you sure?”

So the state would respond, “Well, let’s check the backups.”


By DC Comics – Two-Face Year One #2, Fair use,

Case studies, revisited

A little over a month ago, I mentioned that Bredemarket was going to be getting some more case study work. And it has.

No, not that type of case! By Michael Kammerer (Rob Gyp) – Own work, CC BY-SA 4.0,

(I’m gonna run my “case” study visual joke all the way into the lost baggage room.)

So how is my client USING these case studies that I am helping the client to create?

To win more business from law enforcement customers.

When my client’s law enforcement customers are pleased with the client’s offering, they’re willing to participate in case studies addressed to OTHER law enforcement customers.

Case studies are effective because they speak to the needs of the readers. The reader has a problem, and the case study tells how a similar entity solved that same problem. In this case, a law enforcement agency learns of a solution that has already worked for another law enforcement agency. “If it worked for my friends in the next county, it will work for me also.”

“Hey, mate, did you read the case study about that software package that Bruce’s agency uses?” By Love Makes A Way –, CC BY-SA 2.0,

The power of case studies doesn’t just work for law enforcement. It can work in any industry where the customers band together to help each other out. E-commerce developers. Security experts. Mobile car washing services.

If you’re a company that provides identity solutions (or technology solutions, or other solutions), and you have customers who will rave about your product to other customers, then you’re a candidate to create a case study. If you want help, contact me.

Case studies: a win-win

I just found out that Bredemarket will be getting more case study work, which I’m looking forward to because case studies can often be enjoyable.

No, not that type of case! By Michael Kammerer (Rob Gyp) – Own work, CC BY-SA 4.0,

While case studies can take a variety of forms, my primary experience with case studies is when a customer explains how a vendor’s solution helped to solve a customer problem. While customers may sometimes want to avoid direct endorsements of a vendor products, a customer can truthfully state how a vendor product helped the customer solve the problem.

If I can use an example that predates my consulting career, I was once involved in a case study in which a law enforcement agency talked about a particular product for law enforcement customers.

  • This type of customer is all too happy to talk about something that keeps the bad people off the streets, since the case study lets the citizens know that the law enforcement agency is taking steps to protect the citizens.
  • And of course the product vendor is all too happy to be associated with this, since it provides a vivid demonstration of how the product works.

A win-win for both customer and vendor, both of whom can look like heroes with the proper case study.

Whenever constructing a case study that features a law enforcement agency or anyone else, it’s important to remember that the vendor’s solution is not the COMPLETE solution to whatever problem is solved in the case study. Again returning to the law enforcement example, the most amazing product gizmo is completely worthless unless a trained person actually applies the gizmo, and knows when to apply the gizmo. And most criminal cases are not solved with a single gizmo, but with multiple gizmos…and a lot of hard work from the law enforcement agency that brings everything together to solve the crime.

Of course, case studies aren’t restricted to law enforcement customers and software products. You can construct a case study out of anything. They can be medical (“Case Study: A Patient with Asthma, Covid-19 Pneumonia and Cytokine Release Syndrome Treated with Corticosteroids and Tocilizumab”), service-related (Direct Travel’s case study of a consumer goods manufacturer), or even relate to adult toys (SEO Design Chicago’s case study for a client who had to overcome advertising challenges due to Google restrictions on sensitive content).

Anyway, I’m looking forward to more case study work…in the biometric, secure document, or technology areas. (I’m not going to cure COVID with novelty items.) In the work I’m about to do, I’ll get to learn about the vendor, and about the vendor’s customer, and how they worked together to solve a particular problem. My part in the process is to help the vendor communicate the story, while emphasizing the benefits that the vendor’s product can provide to customers.

(If you’re interested in understanding benefits, and the difference between benefits and features, take a look at this Hubspot article.)

While brings us to the shameless plug (you knew this was coming after my last post): if you need assistance in coming up with the words for a case study, contact me. I can help with the initial ideas, participate in customer interviews to get information, and draft the words of the case study itself. Bredemarket’s collaborative process ensures that the final written product communicates the client’s desired message. For case studies, this includes mutual agreement on the objective and the outline, and client reviews of the draft iterations of the case study until the final text is delivered.

And even if you don’t use me, business leaders should be thinking about how case studies can help their business, and which of their customers would be willing to participate in a case study…for mutual benefit.