| Form number | DOJ-361 (printed at the foot of the page as “FORM DOJ-361”) |
|---|---|
| Title as printed | Certification of Identity |
| Issued by | U.S. Department of Justice — a DOJ-wide form, not a BOP form |
| OMB control number | “FORM APPROVED OMB NO. 1103-0016” |
| OMB expiration as printed | “EXPIRES 05/31/2023” |
| Prescribed by | No “Prescribed by P____” line — not a BP-series form |
| Replaces | No supersession line printed |
| Governing Program Statement | 1351.05, Release of Information — September 19, 2002 (CN-1 April 2, 2015; CN-2 March 9, 2016) |
| Governing regulation | 28 C.F.R. § 16.41 (Privacy Act access); 28 C.F.R. § 16.3 (FOIA); 28 C.F.R. § 513.63 (requests on behalf of an inmate) |
| Published by BOP? | Yes — doj_361.pdf |
| Distribution as printed | None — no copy-distribution line |
| Pages | 1 |
Checked against the BOP form set · 2026-09-07 · How we verify
DOJ-361 is the one-page Department of Justice form on which a person identifies themselves as the subject of a government record and — optionally — names someone else who may receive it. It is what lets a family member or an attorney obtain a federal prisoner’s central file or medical records, and the surrounding process is on our FOIA and Privacy Act requests and Medical records access pages.
Unlike most BOP forms, DOJ-361 carries the full set of federal small print: a Privacy Act statement, an OMB control number, a paperwork-burden statement and a false-statement warning with dollar figures.
What this form is
DOJ-361 does two jobs. Job one is identity. Under 28 C.F.R. § 16.41(d), a person asking the Department for records about themselves “must verify the requester’s identity” by stating “full name, current address, and date and place of birth,” and must sign in a particular way. DOJ-361 collects exactly those items. The regulation adds that “[w]hile no specific form is required, the requester may obtain forms for this purpose” — DOJ-361 is that optional form, not a mandatory one. Job two is authorization: the middle block, headed “OPTIONAL,” is where the record subject names another person who may receive the records — which is why an incarcerated client signs a DOJ-361 for counsel or family.
It is a fillable PDF: labels and small print extract cleanly, boxes and layout do not, so every block below is named by the label DOJ printed on it. There is no “Prescribed by” line, no “Replaces” line and no copy-distribution line — this is a Department form BOP republishes, not a BP-series form.
On this page
Block by block
Header — “U.S Department of Justice / Certification of Identity” and the OMB block
Top left, the issuing department and the title. Top right, in a boxed block:
“FORM APPROVED OMB NO. 1103-0016 EXPIRES 05/31/2023”
Reproduced from Form DOJ-361, form face.
The printed expiration date is in the past, and BOP was still publishing the form at the address above on 2026-09-07. Whether the collection has been renewed under the same control number is a question for the Department; the form does not answer it, and neither does this page.
“Privacy Act Statement”
The first block of small print, and one of the two most important paragraphs on the page:
“Privacy Act Statement. In accordance with 28 CFR Section 16.41(d) personal data sufficient to identify the individuals submitting requests by mail under the Privacy Act of 1974, 5 U.S.C. Section 552a, is required. The purpose of this solicitation is to ensure that the records of individuals who are the subject of U.S. Department of Justice systems of records are not wrongfully disclosed by the Department. Requests will not be processed if this information is not furnished. False information on this form may subject the requester to criminal penalties under 18 U.S.C. Section 1001 and/or 5 U.S.C. Section 552a(i)(3).”
Reproduced verbatim from Form DOJ-361, form face.
“Requests will not be processed if this information is not furnished.” An incomplete identity block is not a slow request; it is a request the Department says it will not process.
“Public reporting burden…”
The paperwork-burden statement, printed immediately below:
“Public reporting burden for this collection of information is estimated to average 0.50 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Suggestions for reducing this burden may be submitted to the Office of Information and Regulatory Affairs, Office of Management and Budget, Public Use Reports Project (1103-0016), Washington, DC 20503.”
Reproduced verbatim from Form DOJ-361, form face.
The identity fields — “Full Name of Requester ¹” · “Citizenship Status ²” · “Social Security Number ³” · “Current Address” · “Date of Birth” · “Place of Birth”
Four ruled lines, three of them footnoted. Footnote 1 makes the first counter-intuitive: the “Requester” is the person the records are about, not the person mailing the envelope. Name, current address, date of birth and place of birth are the four items § 16.41(d) requires.
“OPTIONAL: Authorization to Release Information to Another Person”
The block that matters most when a family is retaining counsel, and the one most often left blank:
“OPTIONAL: Authorization to Release Information to Another Person
This form is also to be completed by a requester who is authorizing information relating to himself or herself to be released to another person.
Further, pursuant to 5 U.S.C. Section 552a(b), I authorize the U.S. Department of Justice to release any and all information relating to me to:
[ruled line] Print or Type Name”
Reproduced verbatim from Form DOJ-361, form face. The ruled line above “Print or Type Name” is where the authorized person’s name goes.
Three things to note. The heading says OPTIONAL: the identity block works on its own; this block adds a third party. The authorization runs to a named person typed on the line, so a firm name without an individual is not what the form asks for. And it is written broadly — “any and all information relating to me” — with no space to narrow it. Its hook, 5 U.S.C. § 552a(b), is the Privacy Act provision under which no agency may disclose a record “except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains.”
The text above the signature line
This is the sentence the record subject signs, and it carries the false-statement warning:
“I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct, and that I am the person named above, and I understand that any falsification of this statement is punishable under the provisions of 18 U.S.C. Section 1001 by a fine of not more than $10,000 or by imprisonment of not more than five years or both, and that requesting or obtaining any record(s) under false pretenses is punishable under the provisions of 5 U.S.C. 552a(i)(3) by a fine of not more than $5,000.”
Reproduced verbatim from Form DOJ-361, the sentence immediately above the signature block.
The $5,000 figure is exactly what the statute says: 5 U.S.C. § 552a(i)(3) provides that a person who knowingly and willfully obtains a record under false pretenses “shall be guilty of a misdemeanor and fined not more than $5,000.”
The $10,000 figure is not in the statute the form cites. 18 U.S.C. § 1001 states no dollar amount at all — an offender “shall be fined under this title, imprisoned not more than 5 years … or both.” The ceiling comes from 18 U.S.C. § 3571(b)(3), under which an individual convicted of a felony may be fined “not more than $250,000.” The five-year figure on the form is right; the dollar figure understates the current ceiling.
“Signature ⁴” and “Date”, then the four footnotes
One ruled signature line, one date line, and four footnotes that carry more weight than the fields above them:
“1 Name of individual who is the subject of the record(s) sought.
2 Individual submitting a request under the Privacy Act of 1974 must be either “a citizen of the United States or an alien lawfully admitted for permanent residence,” pursuant to 5 U.S.C. Section 552a(a)(2). Requests will be processed as Freedom of Information Act requests pursuant to 5 U.S.C. Section 552, rather than Privacy Act requests, for individuals who are not United States citizens or aliens lawfully admitted for permanent residence.
3 Providing your social security number is voluntary. You are asked to provide your social security number only to facilitate the identification of records relating to you. Without your social security number, the Department may be unable to locate any or all records pertaining to you.
4 Signature of individual who is the subject of the record sought.”
Reproduced verbatim from Form DOJ-361, footnotes 1–4 as printed. The quotation marks inside footnote 2 are the form’s.
Footnote 3: the Social Security number is voluntary, and the form says so, along with the trade-off. Footnote 4 governs everything else on the page: the signature must be the record subject’s own. Not a spouse’s, not an executor’s, not counsel’s.
Notarized, or not
The regulation gives two routes and the form takes one. 28 C.F.R. § 16.41(d) requires that the requester “[s]ign the request, and the signature must either be notarized or submitted by the requester under 28 U.S.C. 1746, a law that permits statements to be made under penalty of perjury as a substitute for notarization” — or, “[w]hen available, use one of the Department’s approved digital services … to verify the identity of the requester through identity proofing and authentication processes.”
28 U.S.C. § 1746 lets a matter that would otherwise need a sworn affidavit be established by an unsworn declaration “subscribed by him, as true under penalty of perjury, and dated, in substantially the following form” — within the United States, “I declare (or certify, verify, or state) under penalty of perjury that the foregoing is true and correct. Executed on (date).”
DOJ-361’s printed declaration is written in that form and provides a date line. If an office asks for notarization anyway, ask which authority it is relying on — and date the signature either way, because both the statute and the Bureau’s three-month rule turn on the date.
When DOJ-361 cannot do the job
A deceased person. Footnote 4 requires the signature of “the individual who is the subject of the record sought,” and nobody can sign for them on this form. The route instead is a FOIA request supported by proof of death. 28 C.F.R. § 16.3(a)(4) provides that “[w]here a request for records pertains to a third party, a requester may receive greater access by submitting either a notarized authorization signed by that individual or a declaration made in compliance with the requirements set forth in 28 U.S.C. 1746 by that individual authorizing disclosure of the records to the requester, or by submitting proof that the individual is deceased (e.g., a copy of a death certificate or an obituary).” This is the route families use when they need records — including an autopsy report — after a death in custody.
A stale authorization. For Bureau records, 28 C.F.R. § 513.63 provides that a request by an authorized representative “will be treated as in § 513.61, on receipt of the inmate’s or former inmate’s written authorization,” that “[t]his authorization must be dated within three (3) months of the date of the request letter,” and that “[i]dentification data, as listed in 28 CFR 16.41, must be provided.” Three months is the only deadline here, and it runs backwards from the request letter: a DOJ-361 signed in January and mailed in June is out of time on its face.
How BOP’s own policy uses this form
DOJ-361 appears in the policy exactly once, and not where you would expect. It is named in the section on Privacy Act requests by Bureau employees and former employees, which provides that such a requester “must provide identification data, as listed in 28 CFR 16.41, and may use a Certification of Identity Form (DOJ-361) or self-sworn declaration.” (PS 1351.05 at p. 27.) For inmates and former inmates the policy does not name the form at all — it requires the § 16.41 identification data, which is what DOJ-361 collects. The form is a sensible way to supply that data; it is not, in the Bureau’s own text, required.
Inmate records are handled under FOIA, not the Privacy Act. The binding rule is 28 C.F.R. § 513.50: “Because inmate records are exempt from disclosure under the Privacy Act (see 28 CFR 16.97), inmate requests for records under the Privacy Act will be processed in accordance with the FOIA.” Program Statement 1351.05 reproduces it at p. 26. That is why a request styled as a Privacy Act request comes back processed as a FOIA request.
The binding text is in 28 C.F.R. parts 16 and 513; the Program Statement only tells staff how to apply it.
What happens next, and what to do if it comes back wrong
A completed DOJ-361 travels with the request letter. Under PS 1351.05 the letter and envelope should be marked “FREEDOM OF INFORMATION ACT REQUEST,” should describe the records sought and their approximate dates, and — for an inmate or former inmate — go to the Director, Federal Bureau of Prisons, 320 First Street NW, Washington, DC 20534. (PS 1351.05 at pp. 30–31.) The Office of General Counsel’s FOIA/PA Administrator reviews it and may forward it on.
The fix depends on what failed. Incomplete identity data means one of the four § 16.41(d) items was blank, or the signature undated. A stale authorization means the § 513.63 window closed; the answer is a freshly dated form, not an appeal. A denial in whole or in part is different: 28 C.F.R. § 513.66 provides that the requester “shall be advised that he or she may appeal that decision to the Office of Information and Privacy, U.S. Department of Justice, Suite 570, Flag Building, Washington, D.C. 20530,” with “[b]oth the envelope and the letter of appeal itself … clearly marked: ‘Freedom of Information Act Appeal.'” A document withheld from inmate review is a central file question as much as a FOIA one.
Applied Insight — Christopher Zoukis, JD, MBA, Managing Director: The two failures we see most often on DOJ-361 are both fixable in thirty seconds. One is the name field — people write the name of the person making the request, when footnote 1 asks for the person the records are about. The other is the date: undated fails § 16.41(d); more than three months old fails § 513.63.
Legal representation is provided by Elizabeth Franklin-Best and the firm’s attorneys. See also Federal Bureau of Prisons policy and what families should know about federal prison.
Frequently Asked Questions About the Certification of Identity
Does DOJ-361 have to be notarized?
28 C.F.R. § 16.41(d) says the signature “must either be notarized or submitted by the requester under 28 U.S.C. 1746,” the statute permitting an unsworn declaration under penalty of perjury as a substitute for notarization. DOJ-361’s printed declaration is written in that penalty-of-perjury form and provides a date line.
Can I use DOJ-361 to get records about someone who has died?
No. Footnote 4 requires the signature of “the individual who is the subject of the record sought.” The route is a FOIA request with proof of death: 28 C.F.R. § 16.3(a)(4) allows a third-party requester to submit “proof that the individual is deceased (e.g., a copy of a death certificate or an obituary).”
How long is a signed DOJ-361 good for?
For Bureau records, 28 C.F.R. § 513.63 requires the authorization to “be dated within three (3) months of the date of the request letter.” The window runs backwards from the request, so an old form does not become usable by mailing it later.
Do I have to give my Social Security number?
No. Footnote 3 says “[p]roviding your social security number is voluntary,” requested “only to facilitate the identification of records relating to you” — while warning that without it “the Department may be unable to locate any or all records pertaining to you.”
Why does the form say $10,000 when the statute doesn’t?
The declaration cites 18 U.S.C. § 1001 “by a fine of not more than $10,000.” That section states no dollar figure; the ceiling for an individual convicted of a felony is set by 18 U.S.C. § 3571(b)(3) at “not more than $250,000.” BOP’s own BP-A0224, Notification to Visitor prints $250,000 for the same statute.
Reviewed for legal accuracy by Elizabeth Franklin-Best, Esq., Principal Attorney·September 2026