Scott Sobel Featured in Campus Legal Advisor

Scott Sobel, President of Media & Communications Strategies, Inc., co-authored a featured article for the October 2015 issue of Campus Legal Advisor. A PDF of the article can be found here, with the full article included below.

The Seven-Step Approach to University Crisis Management:

Public Relations and Legal Considerations

by Daniel I. Prywes, Esq., Bryan Cave LLP and Scott Sobel, Media & Communications Strategies, Inc.


            Sooner or later, a public relations (“PR”) crisis will hit your university.  A reputation for integrity, scholarship, and civic-mindedness nurtured over decades can be sundered overnight.  Almost always, a crisis will be accompanied by legal risks, sometimes involving large potential liabilities in today’s litigious society.  Recent surveys show a significant number of businesses are not prepared for any kind of crisis and think they have gaps in their crisis communications and decision making capabilities, among other deficiencies.

To best weather the storm, legal guidance and PR guidance – which may be at cross-purposes – will have to be harmonized.

Most often, the nature of the crisis will be unpredictable.  It could arise from sexual assaults, shootings or other crime, controversial speech, misbehaving athletes, academic fraud, medical practices at a university hospital, financial difficulties, or from a wide variety of other facets of today’s universities – many of which are effectively small cities.

While the exact nature of a crisis may not be foreseeable, preparation for a public relations crisis is still possible.  Indeed, it is unforgiveable in current times not to have a crisis management plan in place.  The plan should be practical, easy to activate, involve key campus administrators, and should be flexible. Regular training is also invaluable.

In this article, we discuss seven basic steps that should be part of most universities’ crisis management plan.  Of course, there is great diversity among institutions of higher education, so our suggestions may require adaptation to particular circumstances.

      Step 1:  Develop healthy relationships with journalists and first responders in advance of any crisis.  As a matter of routine – before any crisis strikes – a university should develop relationships with journalists (local and beyond) who cover the university, and who can be expected to cover the inevitable crisis when it hits.  Journalists are people, and they will be more receptive to hearing and even accepting the University’s viewpoint if they have previously developed a relationship of trust, or at least professional respect, for the university’s leadership.

In many cases, a university crisis may also involve local public-safety officials – police, fire, ambulance, and other first responders.  In the event of a crisis, those officials will have an important role in informing the public about the crisis.  University communication staff should get acquainted with their counterparts with public-safety organizations.  Even more importantly, universities should ensure that their security and facility managers have good working relationships with their first-responder counterparts.  The best time to get acquainted is not in the middle of a tornado.  Take advantage of calm times to foster the relationships that will be essential in tougher days.

Step 2:  Form the core crisis-management team.  Before a crisis strikes, each university should form a crisis-management team which includes a core set of campus leaders whose input will likely to be needed in most types of crises.  For larger universities, this team might include the university president, chief operations officer, general counsel, compliance director, communications officer, dean of students, campus police chief, the manager responsible for rape and mental health counseling, the athletic director, and risk management officer.  Smaller institutions without all such managers may form a smaller team of those with equivalent functional responsibilities.

  1. Each university should make advance arrangements for external public relations advisors, and legal counsel, to be on standby if a crisis metastasizes quickly. An objective outside counsel perspective can be crucial at a time when internal politics and career considerations can color decision. It is better to identify and vet potential advisors when that can be done with due deliberation, rather than on the fly during a crisis.
  2. Universities should identify the physical office space to be used as the “command center” in the event of a crisis, and ensure in advance that it has ample connectivity for telecommunications and Internet.
  3. Universities should determine the scope of crisis-management functions to be placed under the general counsel, because legal advice provided by the general counsel based on his or her investigation will often be shielded from disclosure under the attorney-client privilege.   In particular, it is important to determine whether public-relations advisors will report to the general counsel, or others, because it will sometimes be possible to treat their PR advice as privileged and confidential – even in later legal proceedings – if they report to the general counsel and provide advice as to how to the PR implications of various legal strategies.[1] This issue should be investigated before a crisis strikes, because the privilege issues relating to attorney communications with PR advisors may be treated differently in different states.       Here are a few basic training tips.

Step 3:   Train the core team, and others, in crisis-management skills. There are public relations skills that will be necessary in managing any crisis, and any university action or communication could also have legal ramifications. Training is therefore invaluable. Some institutions even engage in training simulations, so-called “table-top simulations” where a mock “crisis” is managed over a period of time.

  1. Anyone who will be interacting with journalists or key constituencies should be trained in basic PR skills. Most importantly, university leaders should avoid the temptation early in a crisis to cast blame, or assert excuses, based on incomplete information, rumors, or speculation. At the same time a university should move as quickly as possible to investigate the facts, and disclose those which it is confident are accurate. Otherwise, all public statements should be qualified as based on “the facts currently known” in order to preserve credibility if those facts prove wrong. Spokesmen should avoid “no comment” responses, or their equivalent, and instead should reinforce the message that the university is investigating the facts and is determined to act appropriately upon its findings. Comments on criminal matters are best left to law-enforcement authorities.
  2. Everyone in a university will have an opinion about any crisis. But internal discipline from campus managers is vital to ensure that the university speaks with one voice. Administrators, deans, department chairs, and lower-level managers should be trained to refrain from public comment on controversies, and to refer media to the designated university spokespersons.
  3. Journalists will try in a variety of ways to extract confidential information about a campus crisis. A university needs to train its managers how to professionally rebuff media attempts to obtain leaks.
  4. The core team should also receive training in basic legal issues likely to be of concern in managing a crisis. Managers need to understand the type of statements that could lead to claims of defamation; the privacy rights of persons involved in a crisis; and standards of liability for negligence. Some basic training may avert careless comments that can jeopardize a university’s legal defenses, or lead to defamation or negligence claims.  Additional areas of training are discussed below.

Step 4:  Identify one or more managers to serve as the university’s spokesperson in times of crisis, and train those managers in communication skills.  It is vital for journalists and the public to know who is authorized to speak for the university in any crisis.  Inconsistent information can suggest either incompetence or a cover-up.  A university should appoint more than one spokesperson, because some crises extend over lengthy periods and can exhaust a single individual.   

From a PR perspective, the best university spokesman is one with both clout and deep knowledge of the relevant facts. That could be a university president or provost, whose prominent role can help assure the public that the university takes the controversy seriously. From the legal perspective, however, it is often best to avoid using high-level administrators as a spokesperson. Even an inadvertent factual error by high-level leaders’ statements can lead to a harsh public reaction, and can be harder to disavow in legal proceedings. So, it could be prudent to select a PR spokesperson to comment on discreet issues that could have great liability and an upper echelon administrator who can comment on more inspirational messages, but those with less liability.The Model Rules of Professional Conduct state that a “lawyer who is participating or has participated in the investigation or litigation of a matter shall not make an extrajudicial statement that the lawyer knows or reasonably should know will be disseminated by means of public communication and will have a substantial likelihood of materially prejudicing an adjudicative proceeding in the matter.” (Model Rule 3.6(a).)             Significantly, an attorney may also make public statements to rebut misinformation provided by others. The ethical rules provide that “a lawyer may make a statement that a reasonable lawyer would believe is required to protect a client from the substantial undue prejudicial effect of recent publicity not initiated by the lawyer or the lawyer’s client,” if the statement is “limited to such information as is necessary to mitigate the recent adverse publicity.” (Model Rule 3.6(c).)            

Step 5:   Train the crisis-management team to understand the types of information that cannot be disclosed without infringing legally-protected privacy interests. In many crises, privacy laws may interfere with the ability of universities to exonerate themselves in the court of public opinion. The crisis-management team should understand what disclosures these laws allow and disallow. But under FERPA, information about students can be disclosed in certain circumstances.   

  1. When a student or parent sues a university, a university may disclose a student’s education records “to the court,” but only to the extent that such records are relevant to the university’s defense. 34 CFR § 99.31(a)(9)((iii)(B).  Similarly, when a university sues a parent or student, it may disclose to the court those student education records “that are relevant for the [university] to proceed with the legal action as plaintiff.”  34 CFR § 99.31(a)(9)((iii)(A).
  2. When campus police prepare records of student arrests, or receive complaints of criminal activity, that information may be publicly disclosed. 20 U.S.C. § 1232g(a)(4)(B)(ii); 34 CFR § 99.8(d).
  3. FERPA permits a university to disclose the final results of a disciplinary proceeding which determines that a student committed any crime of violence (including forcible sex offenses), or a nonforcible sex offense (such as statutory rape or incest), in violation of the university’s policies. 20 U.S.C. § 1232g(a)(6)(B).
  4. FERPA permits a university to disclose education records in connection with a health or safety emergency if the recipient’s knowledge of the information is necessary to protect the health or safety of the student or other individuals. 34 CFR § 99.31(a)(11), § 99.36. The U.S. Department of Education has announced that its policy is “not to substitute its judgment” for that of the university if the university had a rational basis for its determination based on the information available at the time.[3] 34 CFR § 99.36(c).           

Step 6:   Train the crisis-management team to understand the types of information that must be disclosed under applicable laws. Universities do not have as much freedom as others to control the flow of information, especially about campus crime. It is vital for the crisis-management team to understand how required disclosures must be taken into account when responding to a crisis.            Under the Act, universities must report publicly certain types of crimes (ranging from homicide to liquor-law violations) considered to be a threat to students and employees, in a manner that is “timely and that will aid in the prevention of similar occurrences.” 20 U.S.C. § 1092(f)(3). Universities are also required to follow their emergency notification procedures, and provide a warning to the university community, if there is an immediate threat to the health or safety of students or employees. 34 CFR § 668.46(e) & (g).             However, disclosure can be withheld in several circumstances, such as (a) where disclosure would jeopardize the confidentiality of the victim, (b) where there is clear and convincing evidence that disclosure would jeopardize an ongoing criminal investigation or an individual’s safety, cause a suspect to flee or evade detection, or result in the destruction of evidence, or (c) the disclosure is prohibited by law. 20 U.S.C. § 1092(f)(4); 34 CFR § 668.46(f).             There is wide variation among different states “open records” laws, and different approaches to the interplay between those laws and student privacy restrictions in FERPA.[6]

Step 7:   Plan your social-media strategy.   A social media strategy is essential to any crisis-management plan. Universities must be prepared to monitor and respond to social media rumors and allegations. They must also be prepared to disseminate their own messages proactively through social media channels. And planning is vital.

  1. Before any crisis strikes, each university should identify and catalog the social media sites through which students and other constituencies communicate about issues of concern. These may include websites or blogs of campus organizations, student newspapers, staff organizations, alumni groups, and local community groups.
  2. Universities should ensure that communications managers on the crisis-management team are savvy in social media, and that a social-media “rapid response” team is prepared to mobilize when a crisis strikes.
  3. Universities should establish their own authorized “social media” channels, and publicize them as such. In the event of a crisis, the campus community and others will recognize that statements on those particular social media channels (whether a website, Facebook page, twitter feed, etc.) truly speak for the university administration.

The crisis-management team should also be trained as to the types of social medial activities that are not allowed or that involve legal risk. For example, universities should be cautious about accessing a person’s personal social media account (even if it can technically be accessed through a university-run network) without that person’s consent, as that may violate federal law as well as state common-law privacy rights.[1] Many states have enacted laws that limit employers from requesting that their employees provide access to their personal social media accounts, and other states are considering such legislation.[2] Some states (such as Arkansas, Illinois, Louisiana, New Hampshire, Oregon, Rhode Island, Wisconsin) also restrict educational institutions from seeking students’ passwords or access to their social media accounts, and others are considering such legislation.[3] Public universities must also ensure that any unauthorized review of student or employee records comports with Fourth Amendment protections against warrantless searches.


Good planning will allow good execution in crisis management. Without such planning, the race for the hearts and minds of the public may be over before a university leaves the starting blocks.   With the seven steps outlined above, universities should be well prepared to meet the challenge.


[1]           The federal Stored Communications Act, 18 U.S.C. §§ 2701 et seq., generally prohibits anyone from obtaining unauthorized access to a person’s private social media account.


[2]           See  D. Prywes & J. Valdetero, Proceed at Your Peril:  Questions Abound With New State Laws Restricting Employer Access to Employees’ Personal Social Media Accounts, 02 Bloomberg BNA Social Media Law & Policy Report 23 (June 4, 2013);  D. Prywes, Should You Ask Job Applicants or Employees for Their Social Media Passwords, 17 Bloomberg BNA Electronic Commerce Report 741 (April 18, 2012). (listing state legislation).


[3]           See Ark. Code Ann. § 6-60-104;  105 Ill. Comp. Stat. 75/10;  La. Rev. Stat. Ann. § 1954; Or. Rev. Stat. § 326.551(1);  R.I. Gen. Laws § 16-103-3 ; Wis. Stat. § 995.55(3)(a)(1).


[1]           M. Beardslee, The Corporate Attorney-Client Privilege:  Third-Rate Doctrine for Third-Party Consultants, 62 SMU L. Rev. 7272 (Spring 2009); Spin Control and the High-Profile Client – Should the Attorney-Client Privilege Extend to Communications with Public Relations Consultants?, 55 Syracuse L. Rev. 545 (2005); In re Copper Market Antitrust Litigation, 200 F.R.D. 213, 219 (S.D.N.Y. 2001) (recognizing privilege for communications between PR advisor and in-house and outside counsel which helped counsel provide legal services);  Hadjih  v. Evenflo Co., Civ. No. 10-cv-02435-RBJ-KMT, 2012 U.S. Dist. LEXIS 76100, at *14 (D. Colo. May 31, 2012).


[2]           North Carolina State Bar v. Nifong, N.C. St. B. Disc. Hearing Comm’n, No. 06 DHC 35, 23 Law. Man. Prof. Conduct 330 (June 16, 2007).


[3]           See  N. Tribbensee, Privacy and Confidentiality:  Balancing Student Rights and Campus Safety, 34 Journal of College and University Law 393 (2008).


[4]           The U.S. Department of Education used an “implied student waiver” rationale when issuing its regulation that permitted universities to disclose education records when sued by a student in court.  See 65 Fed. Reg. 41852, 41858  (July 6, 2000); 34 CFR § 99.31(a)(9)((iii)(B).

[5]           See (University of Notre Dame’s Security Police Department was subject to state open records law because the Department exercised police powers authorized by state law).


[6]           R. Nowadzky, A Comparative Analysis of Public Records Statutes, 28 Urb. Law. 65, 86 (1996) (“there is substantial variance in how each state classified confidential personnel information”; “[i]n most states, these types of records are not open to inspection when disclosure would constitute a violation of the subject’s right to privacy”); M. McGee-Tubb, Deciphering the Supremacy of Federal Funding Conditions:  Why State Open Records Law Must Yield to FERPA, 53 Boston College L. Rev. 1045, 1058 (2012); W. Kaplan & B. Lee, 1 The Law of Higher Education 1057-64 (5th ed. 2013).


[7]           The federal Stored Communications Act, 18 U.S.C. §§ 2701 et seq., generally prohibits anyone from obtaining unauthorized access to a person’s private social media account.


[8]           See  D. Prywes & J. Valdetero, Proceed at Your Peril:  Questions Abound With New State Laws Restricting Employer Access to Employees’ Personal Social Media Accounts, 02 Bloomberg BNA Social Media Law & Policy Report 23 (June 4, 2013);  D. Prywes, Should You Ask Job Applicants or Employees for Their Social Media Passwords, 17 Bloomberg BNA Electronic Commerce Report 741 (April 18, 2012). (listing state legislation).


[9]           See Ark. Code Ann. § 6-60-104;  105 Ill. Comp. Stat. 75/10;  La. Rev. Stat. Ann. § 1954; Or. Rev. Stat. § 326.551(1);  R.I. Gen. Laws § 16-103-3 ; Wis. Stat. § 995.55(3)(a)(1).