Why the release of Sherrill's military records is troubling

The mishandling of Rep. Mikie Sherrill’s military file is the latest example of a system without norms for restraint.

Rep. Mikie Sherrill on C-SPAN in 2022. (C-SPAN)

CBS News reported yesterday that the National Personnel Records Center (NPRC)—part of the National Archives and Records Administration (NARA)—had mistakenly sent the nearly unredacted military personnel file of Rep. Mikie Sherrill (D-N.J.), the Democratic nominee for governor of New Jersey, to a supporter of her opponent, Jack Ciattarelli (R). The file included her Social Security number on most pages, life insurance details, performance evaluations, and even the address of her parents. NPRC admits this was a serious error: a technician “should NOT have released the entire record,” the inspector general was notified, and Sherrill’s office has received apologies, along with “identity protection and free credit monitoring services.”

The backstory is straightforward: In May, a Freedom of Information Act (FOIA) request was filed for Sherrill’s records. NPRC at first replied that no records existed, having used an incorrect spelling to search. After some back and forth, a technician pulled her Social Security number, and the center sent the full file on June 30 to the Ciattarelli supporter, who said he was “shocked” by how much was included. NPRC Director subsequently wrote to him calling it a “serious error” and asking him not to disseminate the record further.

Ciattarelli’s campaign did not ask the supporter to request the records, and the request acknowledged that personal and medical details would be redacted.

One of my executive roles in my last assignment at CIA included overseeing the offices responsible for declassification, FOIA responses, and archival transfers to NARA. I understand how these systems are supposed to work. Official personnel files are available only to the persons themselves or their next of kin until 62 years after separation. Before then, only limited, redacted excerpts may be released to the public. FOIA guidelines explicitly prohibit “clearly unwarranted invasion of personal privacy,” and the Privacy Act of 1974 bars disclosure of records with personal identifiers absent consent or a valid exemption.

These are not trivial formalities. They are the safeguards to prevent exposing veterans’ and civil servants’ most intimate details. In this case, the safeguards failed—badly.

Yet the more urgent question lies not inside NARA but outside it. When campaigns receive material they know should not have been released, what are their obligations?

The proper answer is not mysterious. There is precedent.

In 2000, during the Bush–Gore presidential race, Gore debate aide Tom Downey opened a package postmarked from Austin, Texas. Inside were more than 120 pages of George W. Bush’s debate briefing materials and videotape of mock sessions. Downey stopped, called in legal counsel, and turned the materials over to the FBI. He recused himself from debate prep. The sender later pleaded guilty to mail fraud and perjury for stealing and transmitting the materials.

The Gore campaign never used them.

That was the right choice then. It remains the right choice now.

What the Sherrill release shows is not just a procedural failure but a vacuum of recipient norms. Agencies have rules for what they may release. But there is no equally accepted rule for what campaigns must do when they receive material they plainly shouldn’t have.

In 2023, the Air Force improperly released the personnel records of 11 people, including Reps. Don Bacon (R-Neb.) and Zach Nunn (R-Iowa). Outrage and investigations followed, but a codified bipartisan standard for how recipients should behave was not developed.

That vacuum is the story.

And it doesn’t exist in isolation. The absence of restraint in handling misreleased records reflects a wider political climate in which restraint itself has withered. After a sniper attacked an Immigration and Customs Enforcement (ICE) facility in Dallas on Wednesday, people—including President Donald Trump and Vice President JD Vance—quickly blamed critics of ICE or left-wing rhetoric, even as the FBI said it was investigating the incident as “targeted violence” and investigations remained ongoing.

The same reflex—narrative before confirmation—now collides with a records error primed for exploitation. Each side might exploit a lapse when it serves them and condemn it when it doesn’t. No ethical ground is gained, and public trust erodes with each cycle.

The standard is straightforward and does not require much thinking:

1. Sequester. Isolate the material, stop reviewing it, prevent dissemination.

2. Notify. Inform the issuing authority (here, NPRC) and the affected person.

3. Return or destroy. Comply with a clawback request and certify non-use.

4. Disclose. Publicly state what happened, what steps were taken, and that the campaign will not use the material.

That is the norm Gore’s campaign followed in 2000. It is the norm Ciattarelli’s campaign should follow now.

For NARA, the fix is practical. For campaigns, the fix is ethical: embrace a pledge across parties that says ill-gotten government records will not be used as political ammunition.

The alternative is clear. If we normalize exploiting these errors, then every veteran, every civil servant, and every intelligence officer who ever trusted the government with private data becomes a potential pawn in the next election.

The National Archives made a mistake. But the choice that matters now belongs to the recipients.

Brian O’Neill, a retired senior executive from the CIA and National Counterterrorism Center, is an instructor on strategic intelligence at Georgia Tech. His Safehouse Briefing Substack looks at what’s ahead in global security, geopolitics, and national strategy.

---