SANS Institute Guidelines for Non-Law Enforcement, Third-Party Requests

This webpage provides information for private parties, including civil litigants, that are seeking information from The Escal Institute of Advanced Technologies, Inc. or any of its affiliated legal entities (collectively referred to as “SANS Institute” or “SANS”).   SANS reserves the right to change the guidelines at any time.  These guidelines only apply to non-law enforcement requests. Law enforcement requests are governed by our requests for law enforcement agencies found on our website.

For requests for information that SANS maintains, including customer account records and related content (“Customer Information”), or for expert witness testimony, SANS requires a subpoena or other appropriate form of legal process be issued in accordance with applicable law.   This legal process must be issued in accordance with any applicable state or federal statutes, rules, and regulations.    Note, subpoena requests for witness testimony must be received greater than14 days prior to the date of the requested testimony or SANS will resist such subpoena request.

We store, maintain, use and disseminate Customer Information as described in our Terms and Conditions and applicable SANS entity’s Privacy Policy.  Accordingly, SANS only provides Customer Information requested in connection with a subpoena or other legal process when SANS reasonably believes it is required to provide such requested information.  To protect our customers’ privacy rights, we carefully review requests to ensure they comply with applicable law.  SANS will not provide Customer Information unless served with a valid subpoena or other legal request, issued by a court that has jurisdiction over the SANS legal entity and is authorized to issue such a legal subpoena or other legal process, provided that the requester is within the same jurisdiction as the issuing court. Please review these guidelines before submitting a request to SANS.

Required Information

SANS reviews requests and accompanying subpoenas or other legal process for both facial and substantive validity. SANS reserves the right to object to any request that it believes may be invalid, including overly broad or vague requests. Accordingly, please follow the following guidelines in your requests:

• Requests must be narrowly tailored, particularly describing the information requested with specificity, and with a defined timeframe for delivery.
• Requests must contain the law, statute, directive, or regulation used as the basis for the request.
• Requests must be for a specific and identified person, entity or reference to limit the scope of the request. For example, an identifiable person or legal entity or credit card number or other specific information to limit the scope.
• Requests must contain contact information of the third-party requester. This includes a name, title, address, e-mail address, and phone number.
• Requests must contain the reason for the request.
• Requests must be signed by a clerk of the court or other party authorized to sign the request.
• U.S. federal law does not allow private parties to obtain account contents such as messages using civil subpoenas. We will not provide such materials in response to a civil subpoena.

SANS reserves the right to place a request “on hold” pending more information from the requesting party in the event we deem, in our sole discretion, that we do not have enough information to comply or that we are unable to comply for any other reason. In the event a request is placed “on hold”, all deadlines for compliance will be tolled until the hold is released and will resume once the hold is lifted. SANS strictly construes requests for data and seeks to limit or object to requests that are overbroad or seek a large amount of information or affect a large number of users. SANS also objects where production is prohibited or where the process served is insufficient to compel production of the requested data under the Electronic Communications Privacy Act, 18 U.S.C. § 2701, et seq. or other applicable law. SANS reserves the right to appeal any request for information, where available, and shall not disclose the requested information until required to do so under applicable procedural rules.

These guidelines are intended to serve as an informational resource and do not create any obligation or waive any objection concerning how SANS will respond in any particular case or request. By submitting a subpoena or other legal request for information, the requesting agency agrees to reimburse SANS for any reasonable costs incurred in responding to the request, including but not limited to costs related to document retrieval, review, and production.

User Notice Policy

SANS’ policy is to notify customers of requests for their information and provide them with an opportunity to object to the disclosure 7 days prior to production unless such notification is prohibited by law. A third-party seeking non-disclosure of legal process should obtain an appropriate court order establishing that notice is prohibited before serving legal process on SANS.

Further, if your request places SANS on notice of an ongoing or prior violation of our policies, we reserve the right to take action to prevent further violations, including account termination and other actions that may notify the user that we are aware of the misconduct. If you believe in good faith that taking such actions will jeopardize ongoing litigation, you may request that SANS defer such action on your written request. SANS will evaluate such requests on a case-by-case basis. It is the responsibility of the requesting third-party to make this request, as it is SANS’ policy to enforce its terms of use.

Serving a Valid Third-Party Request & Contact Information

Third-party requests can be served on our registered agent. Courtesy copies of requests can be mailed to our headquarters or sent to the email address, both as detailed below.

Email Address for Questions and to Send Courtesy Copies of Subpoenas or other Legal Process: subpoenas@sans.org

Headquarters Mailing Address to Send Courtesy Copies of Subpoenas or other Legal Process:

SANS Institute Attn: Legal Department for Third-Party Request 11200 Rockville Pike, Suite 200 North Bethesda, MD 20852 USA

SANS’s acceptance of legal process does not waive any legal objections that it may have and may raise in response to the request, including for lack of jurisdiction or improper service.

Third Party Requests from Outside the United States

The SANS Institute and many of its affiliated entities are based in the United States of America. As applicable, legal requests for the SANS Institute’s U.S.-based legal entities coming from non-U.S. citizens or corporate entities should go through the U.S. Office of International Judicial Assistance (https://www.justice.gov/civil/evidence-requests), which is the U.S. Central Authority for the Hague Evidence Convention.