The Protest Flyer Is Already in Your Conduct File

In April 2024, a square Instagram flyer announced the Gaza Solidarity Encampment at Columbia University. It named a place, presented demands and circulated through public accounts connected to the campus protest movement. To supporters, it was an organizing document. To administrators, security staff and anyone monitoring the university from outside, it was also a lead.

The distinction matters because campus protest discipline no longer begins when an official hands a student a notice. It can begin days or months earlier, with a saved post and an attempt to attach the account behind it to a university identity.

Columbia’s encampment became one of the most visible sites in a national wave of student protest. Arrests, suspensions and conduct proceedings followed. Public reporting by the Columbia Daily Spectator and national outlets documented disputes over notice, access to evidence and the rules used against students. The Instagram flyer did not prove who pitched a tent, entered a building or ignored an instruction.

It did something more preliminary and, for an institution building cases at scale, more useful: it described the network.

A flyer tags organizations. Organizations repost speakers. Speakers follow organizers. Public accounts share legal-support forms, meeting locations and changes of plan.

Each connection can be preserved before the conduct office alleges a violation, leaving the university with a developed account of who appears central while the students named in it still think they are posting to an audience of peers.

The archive comes first

The raw material is ordinary. A public Instagram post. A screen recording of a disappearing story. A photograph sent through a campus reporting form.

A link forwarded by an alumnus, parent or outside advocacy group. Video gathered by university police can sit beside footage downloaded from X, TikTok or Telegram, even though each source carries different limits and incentives.

Open-source intelligence, often shortened to OSINT, means collecting and analyzing information available to the public. In a campus setting, it does not require sophisticated software. An employee can search names, save posts and compare profile photographs with a university directory. A contractor can do the same work across more accounts and package the result as a threat or risk assessment.

The archive expands through submission. Universities maintain bias-reporting portals, safety hotlines and conduct complaint forms that allow members of the public or campus community to upload screenshots. Some reports are good-faith attempts to document threats. Others come from political opponents who understand that a screenshot addressed to an institution acquires a second life.

The conduct office does not need to endorse the submitter’s politics to retain the material.

Outside monitoring supplies another layer. Canary Mission has long published profiles of students and academics associated with pro-Palestinian activism. Accuracy in Media deployed mobile billboards around campuses naming students after statements about the October 2023 attacks. Congressional committees and politically connected organizations demanded records, discipline and public answers from university leaders.

Public reporting has shown how these campaigns make individual identification part of the pressure placed on institutions.

A university does not have to copy an outside dossier into a charge letter for that dossier to shape the search. It can provide a name, an account handle or an allegation that staff then attempt to corroborate using university systems. The provenance becomes harder to see once an employee takes a fresh screenshot and places it in an internal report. Material produced for a political campaign has been washed into administrative evidence.

That square Columbia flyer is useful here. It was public, genuine and relevant to an event. None of those qualities established the identity or conduct of every person who shared it. The archive encourages the institution to treat circulation as association and association as a reason to keep looking.

Identification is the hidden decision

Formal campus proceedings tend to focus on whether specified conduct breached a rule. The more consequential decision may already have occurred: which students were selected for investigation.

Identification can begin with a name in an account biography, but campus protest accounts are often collective. Several people may have login access. A person tagged in a photograph may not have posted it, attended the event or approved the caption. Reposting a flyer can indicate support, journalistic interest, criticism or a desire to preserve information.

Platforms compress those acts into the same visible interaction.

Investigators can cross-reference public material with information unavailable to outside viewers, including enrollment records, student identification photographs, housing information or card-access data. The Family Educational Rights and Privacy Act, or FERPA, is the federal law governing disclosure of student education records; it does not prevent a university from using its own records for legitimate institutional functions. That leaves broad room for internal matching, subject to campus policy and the purpose claimed by the university.

This is where the power difference sharpens. The student sees a public post. The institution may see the post beside a directory photograph, a prior conduct report, building-access records and images submitted by people the student cannot identify. Even where a student eventually receives the evidence supporting a charge, the file may not show every discarded lead, every failed match or the outside tip that put their name into the search box.

The archive therefore does more than document an incident. It sets the population from which disciplinary subjects will be drawn. Students who organize visibly, speak to the press or maintain public accounts become easier to identify than people who commit the same alleged acts without leaving a searchable trail. Enforcement can look neutral at the hearing stage while the selection process remains tilted toward visibility.

A screenshot loses its edges

Social posts arrive with context that screenshots are bad at preserving. A full thread may show that a disputed line was quoted from another account. A story may have been followed by a correction. A video can begin after police or security staff issued an instruction, removing the sequence needed to assess a student’s response.

Group-account authorship may remain unresolved.

A screenshot also freezes platform information that changes. Usernames can be edited. Display names are not unique identifiers. Time stamps can reflect the viewer’s location, and reposts can separate content from its original caption.

None of this makes screenshots worthless. It makes them records that require provenance: who captured the material, when they captured it, what appeared before and after it, and whether the account attribution was independently checked.

Universities have reasons to preserve online material quickly. Posts disappear. Administrators face demands to respond before facts settle, while lawyers, donors, trustees, elected officials and campus groups scrutinize every delay. The cheaper administrative move is to save broadly and sort later.

Sorting later is where restraint tends to fail. Security offices are rewarded for finding risks before they become crises. Communications teams want early warning. Conduct offices need a record that can support an allegation.

Outside monitoring vendors sell attention to what clients might otherwise miss. None of these actors receives much institutional credit for deleting an irrelevant screenshot or deciding that an account match remains too uncertain to use.

The result is an archive built under one standard and deployed under another. Staff may collect a post because it could become relevant, then present it because its presence in the file makes it look relevant already. Repetition adds authority. The same image appears in a tip, a security report and a conduct packet, producing three records without three independent sources.

Process begins after the institution has a head start

Students often encounter this machinery through a notice that presents the investigation as newly opened. By then, the university may have preserved posts, interviewed staff and assembled a chronology. The student enters at the allegation stage, not the collection stage.

That timing limits the available response. A student can explain a caption, but may no longer be able to retrieve the surrounding story. They can dispute authorship, but collective accounts rarely preserve an accessible log showing who published each post. They can challenge a photograph, though the institution may decline to disclose the person who submitted it or the full route by which it arrived.

Campus procedures vary, and public reporting across Columbia and other universities has shown substantial differences in access to advisers, evidence and appeal. The shared problem sits earlier than any hearing rule. A formal process can offer a student a chance to answer the institution’s file without offering a meaningful way to examine how that file was constructed.

A defensible system would separate leads from evidence. It would retain the original link and surrounding material, record the source of each capture, require corroboration before attributing a collective account to an individual, and disclose whether an outside group supplied the initial identification. Material that does not support a charge should face a clear deletion schedule rather than indefinite storage in a safety database.

Those protections cost time. They also limit institutional flexibility, which is why universities tend to describe broad collection as necessary while treating narrow retention rules as an operational burden. The current arrangement works for the institution. It preserves options.

The square flyer from Columbia remains an organizing artifact available to anyone who saw it. Inside an institutional archive, however, the same image can become the first page of a file about people whose names never appeared on it. The transformation happens before the accused student receives anything to contest.

Questions people ask

Can a university use a public social-media post in student discipline?

Yes. Public posts can be reviewed and preserved, and universities may use relevant material in conduct proceedings under their policies. Public availability does not settle whether the account was correctly attributed, whether the screenshot is complete or whether sharing a post proves participation in the alleged conduct.

Where do campus investigators get screenshots?

Screenshots may come from university employees, campus police, students, parents, alumni, public reporting portals or outside political groups. Investigators can also capture posts directly. The critical issue is provenance: the conduct file should show who supplied the image, how it was preserved and what context surrounded it.

Does deleting a protest post remove it from the university’s records?

Usually not if someone already saved it. Screenshots, screen recordings and archived links can remain in security or conduct systems after the original disappears. Deletion can also remove context that would have helped explain the post, including later corrections or the sequence of a video.

What would make social-media evidence less one-sided?

Universities could distinguish investigative leads from hearing evidence, preserve full threads, require corroboration for identity claims and disclose outside submissions. Clear retention limits would also keep an unproven screenshot from following a student through unrelated reviews long after the protest ends.