Custody Without Possession

ERA, Data at Rest, and the Question NARA Didn’t Answer

NARA’s Electronic Records Archives was built as a destination for permanent digital records. Its lesser-known “data at rest” concept suggested something more radical: that records might enter archival custody without entering an archival repository.

A permanent record that never arrives

Imagine that a federal agency identifies a large cloud-hosted dataset as permanently valuable. The schedule is approved — which authorizes eventual disposition but does not, by itself, transfer custody. NARA then accepts legal custody through a formal accessioning instrument and a distributed custody agreement. The records become legally accessioned holdings of the National Archives of the United States. Archivists establish intellectual control, monitor integrity, apply preservation requirements, manage restrictions, and in time open the records to the public.

But the data never moves. No transfer drive is mailed, no SFTP session runs overnight, no upload crosses into a NARA-controlled repository. The bits stay exactly where the agency’s contractors put them.

Has the record been accessioned?

Let me be precise about what kind of question this is. Under NARA’s ordinary electronic-record transfer procedures, the answer is no: ERA 2.0 transfer requests convey both physical and legal custody, and cloud-to-cloud transfer remains available only on a limited, ad hoc basis.¹ But NARA policy already recognizes a narrow form of custody without possession. Its affiliated archives program provides that an organization may retain physical custody and perform archival functions under agreement while the records have been accessioned into NARA’s legal custody — and NARA’s own accessioning guidance states that the agency takes legal custody and, “in most cases,” physical custody, a phrase that quietly concedes the exceptions. The most instructive digital instances are two. At the Government Publishing Office, specified bodies of govinfo content have been legally accessioned by NARA while GPO retains the copies in its physical custody and continues preservation and public-access services. And at the University of North Texas Libraries, NARA has since 2006 legally accessioned the CyberCemetery — harvested websites and publications of defunct federal agencies and commissions — into the Archives of the United States while a state university a thousand miles from College Park keeps physical custody and public access.²

So the scenario is not legally unthinkable. It is institutionally unbuilt: there is no operational, scalable version of that arrangement for permanent records that remain in agency-controlled cloud environments. And the question exposes an assumption so old we rarely notice we hold it: that archival custody is a place, and that records become archival by arriving there. For a brief period in the development of the Electronic Records Archives, the National Archives and Records Administration appeared prepared to ask whether that assumption was still necessary. The question was filed under an unassuming borrowed phrase — data at rest — and it remains, two decades into ERA’s life, the most consequential question the program raised and did not answer.

The phrase hidden in plain sight

In information security, “data at rest” conventionally denotes stored data rather than data being transmitted or actively processed; encryption is one of the principal controls applied to it. The focus, as the federal control language puts it, is not the device or the frequency of access but the state of the information.³ In that vocabulary, data at rest is principally a protection problem.

When NARA reached for the phrase in its 2016–2018 Open Government Plan, it meant something else entirely. The passage deserves quotation in full, because it is the clearest statement the agency ever published of the more radical path:

“Government agencies are increasingly managing their electronic records in the cloud, and NARA would like to be able to take advantage of a ‘Data at Rest’ concept where records in the cloud do not need to be repeatedly moved to come under NARA control, be processed, or made accessible.”⁴

Read the three verbs slowly. Come under NARA control. Be processed. Be made accessible. NARA used the phrase to describe an architectural and potentially custodial problem, not a protection problem. That is the entire archival lifecycle — accessioning, treatment, and public access — performed without relocation.

And the 2016 plan was not inventing the model; it was restating one, for at least the third time. The earliest published trace I have found is a 2012 lessons-learned paper by NARA’s Megan Phillips, in the proceedings of that year’s IS&T Archiving conference. Recounting the roughly 300-terabyte transfer of the 2010 Census — which arrived at the archives as a shipment of the Census Bureau’s own storage hardware, “on a truck, still the most efficient way to transfer very large volumes” — she wrote that NARA was “interested in exploring other possible models in the future, including avoiding the transfer problem altogether by archiving big data at rest.”⁵ That sentence appeared in print in the same year the Managing Government Records Directive was issued, and before it. The following year, the feasibility study conducted under that directive examined the model with considerable specificity — records remaining in the clouds used for agency business while preservation, disposition, accessioning, and access controls operated there. The Open Government Plan’s 2016 sentence is best read as the third surfacing of an idea the agency had already named in public and studied in private: born on the loading dock, of the transfer problem, in the year the truck arrived.

Three distinct ideas hide inside the borrowed phrase: protecting stored data, which is a security problem; processing data where it is stored, which is a computing architecture; and assuming archival control without physically taking the data, which is a redefinition of custody itself. NARA’s sentence quietly contained all three — and the agency’s own documents drifted among them. Some NARA texts use “data at rest” in the conventional storage-security sense; a 2017 Inspector General report uses it more narrowly, for bringing processing to data and reducing network movement; the Open Government Plan reaches the custodial meaning.⁶ The concept was never given a stable institutional definition, which is part of why it could be endorsed repeatedly and implemented never: each restatement could be read as the modest version by anyone disinclined to build the radical one.

There is an irony in the borrowing that archivists should savor. In preservation practice, “at rest” names a threat condition, not a safe one. Bit rot is what happens to data at rest. The entire apparatus of digital preservation — the NDSA’s levels with their geographically separated copies, the fixity regimes, the format monitoring — exists because stored digital records decay in place unless someone continuously intervenes.⁷ Permanent records are never truly at rest. What a responsible archive provides is better described as managed archival rest: the condition in which records are not undergoing a current transfer, transformation, or access transaction, but remain under continuous controls that preserve their identity, integrity, context, intelligibility, and availability.

Data at rest becomes archival only when an institution can demonstrate what the data represents, where it came from, what has happened to it, and how an authentic record can be produced from it. The question NARA raised in 2016 was whether that demonstration required possession.

MetaArchivist is built around the kind of research that rarely fits into a quick post: following forgotten concepts through government reports, records schedules, archival descriptions, technical documents, and the institutional record itself. Paid subscriptions make that work possible. If this kind of independent archival investigation is valuable to you, please consider supporting it with a paid subscription.