Now Available:

line

Featured Resources:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Rebecca.

« Two U.S. Federal Data Protection Bills Approved: One May Actually Make It Through | Main | Insider Threat Example: Engineer Leaks U.S. Military Secrets »

The Importance of Policies...Breathalyzer = Drug Test = Physical Search = 4th Amendment Violation?: Iowa High School Students Given Breathalyzer Tests at the Prom

I'm always interested in reading about information security and privacy issues reported here in the heartland.

A story in my local daily paper, the Des Moines Register, caught my eye and filled my thoughts today and points out, among other things, the importance of having policies and communicating them.

The Urbandale (a suburb of Des Moines) high school students were required to pass a breathlyzer test before they could enter the prom. In case you're interested, the tool used for the test was the AlcoBlow Breath Alcohol Screen.

Why are they doing breathalyzers at the prom? As explained by Urbandale's principal, Richard Hutchinson,

""Our whole goal is we want young adults to come to our events, but we don't want them there under the influence of alcohol. It's unfortunate, but we feel this was a step we needed to take."

The Des Moines Register editorial made the argument that the breathalyzer is the same as a drug test which is the same as a physical search, and in this case without cause, which the writer claims violates the student's Fourth Amendment rights.

The article also reports that one of the Wes Des Moines (another Des Moines suburb) high schools also used breathalyzers at their prom, and that a private West Des Moines high school, Dowling Catholic, was also going to use them at their prom this weekend.

"Ben Stone, executive director of the American Civil Liberties Union of Iowa, said the Urbandale tests appear to be a clear violation of Iowa Code. "Iowa Code section 808A states quite clearly that students cannot be searched, and it's very obvious from court decisions that a breath test is a search. It reveals things about your inner being," Stone said. "School officials can't search students without individualized, reasonable suspicion. The ACLU of Iowa would "love to hear from" an Urbandale parent interested in exploring the legality of this practice."

This is a compelling argument from a purely letter-of-the-law legal and privacy-focused perspective without accounting for the circumstances, but I'm not sure the ACLU will hear from many parents.

On the flip side of this argument are the parents who have often talked the schools into doing such tests because they were concerned for the safety of their children at a school-sponsored event. The numbers of deaths and accidents on prom night are significant, and parents are justifiably concerned that their children, minors for whom they are responsible, will be injured or meet an untimely death because of someone drinking alcohol. A large number of students are also concerned for how safe they will be when attending such events. According to National Highway Traffic Safety Administration (NHTSA), during the 2004 Prom and Graduation Season (April, May, June), 713 youths under the age of 21 died in alcohol-related traffic fatalities nationwide.

There are even numerous websites dedicated to this concern, as demonstrated here.

Consider that the schools sponsoring the proms, along with the parents of the children, are legally responsible for taking due care measures to protect their children. Trying to balance the privacy rights of minors has always been a tricky thing to accomplish simply because parents and schools are legally responsible to protect them. The perspectives of privacy zealots with no children often conflict with the perspectives of parents afraid for their underage children's safety, and such arguments routinely surface for not only proms, but also homecoming events, and other elementary and secondary extracurricular activities.

School is increasingly seen as a target for terrorists, the mentally unstable, and violent extremists. Parents now want their children to be as safe as possible when at school facilities, and they accept that security checks are, sadly, necessary to try and prevent harm to the children.

It is also important to consider that as the sponsor for the prom, the school established the breathalyzer test as one of the conditions of attending the extracurricular event. They've made it their policy and they've communicated this ahead of time to the students. The students know ahead of time before going to the prom that they will get a breathalyzer test; it was not a surprise upon arriving at the door. If the students did not want to have a breathalyzer test, then they could choose not to attend the prom.

This parallels many other types of checks adults accept that could be argued by the editorial writer as tromping on privacy rights...

* As a condition of work: U.S. individuals must consent to background checks, which for certain positions includes drug tests, if requested if they want to be considered to be employed at many different types of organizations.

* As a condition of travel: In the U.S. and other locations throughout the world we now go to the airport knowing we will pass through the security checkpoints and must consent to having our luggage and our bodies checked. Just a couple of weeks ago I was randomly chosen at the airport security checkpoint to be wanded and have a more thorough search performed while my family watched from the side.

* As part of work: Employer policies exist and login banners inform employees that the electronic communications are business property and are subject to monitoring in most U.S. companies. If you want to work at the company you must accept that your keystrokes are not private.

I think a key take-away for this is that the policies were established and communicated ahead of time by the organization (school) hosting the optional event (prom), and they were ultimately responsible for the activities that go on there. It appears that by having documented policies that were communicated to everyone involved, the organization followed due care for managing their facilities and activities.

Establishing well-worded, comprehensive policies are important for all organizations, as is communicating the policies to everyone through periodic training and ongoing awareness communications.

BTW, the online comments to the Des Moines Register editorial are overwhelmingly for the breathalyzer tests.

TrackBack

TrackBack URL for this entry:
http://www.realtime-itcompliance.com/type/mt-tb.cgi/404

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Rebecca Herold's Bio:

Rebecca Herold,CISSP, CIPP, CISM, CISA, FLMI, has been providing information security, privacy and regulatory assistance and services to organizations from a wide range of industries for over 18 years. Rebecca was instrumental in building the information security and privacy program while at Principal Financial Group, which was awarded the CSI Information Security Program of the Year Award in 1998. IT Security ranked Rebecca as one of the top 59 IT security influencers, and Computerworld put Rebecca their list of the 25 top privacy experts and on their list of the 9 best privacy consulting firms. Rebecca has been CPO for two consulting organizations, and has had her own information privacy, security and compliance business since 2004. Rebecca has written chapters for several books, dozens of articles, and has been writing a monthly privacy column for the CSI Alert newsletter since the beginning of 2001, and is working on her 11th book. Some of her other books include The Privacy Papers, Managing an Information Security and Privacy Awareness and Training Program, The Definitive Guide to Security Inside the Perimeter (Realtime Publishers), The Shortcut Guide to Improving IT Service Support through ITIL (Realtime Publishers), and The Practical Guide to HIPAA Privacy and Security Compliance. In addition, Rebecca is the leader of The Realtime IT Compliance Community where she posts to her IT Compliance weblog. You can contact Rebecca at: rebecca_herold@realtimepublishers.net.