Frank Bajak v. Department of State Police - Commonwealth Fusion Center (SPR 20201586)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records September 21, 2020 SPR20/1586 Jason R. Stelmat Privacy Officer Department of State Police Commonwealth Fusion Center 124 Acton Street Maynard, MA 01754 Dear Mr. Stelmat: I have received the petition of Frank Bajak, on behalf of the Associated Press, appealing the response of the Department of State Police Commonwealth Fusion Center (Department) to his request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). Mr. Bajak requested records generated between May 1, 2020 and the present including: 1. Documents mentioning, describing or generated by the BlueLeaks release, the preceding hack or subsequent fallout, including but not limited to: (a) Damage assessments; (b) Emails; (c) Interagency communications (local, state or federal); (d) Communications with the press about BlueLeaks; and (e) Communications with Twitter or other social media or sharing platforms. 2. Documents mentioning or describing Distributed Denial of Secrets (DDoSecrets); and 3. Documents created by the Department of Homeland Security’s Intelligence & Analysis Office that discuss BlueLeaks and/or DDoSecrets. Waiver of fees In addition, Mr. Bajak requests that the Department waive all applicable fees, as he is a journalist; his primary purpose is to inform the public through his reporting, his request is in the public interest. Under the Public Records Law Access Regulations, a waiver of fees may be granted by the record custodian if: “[d]isclosure of a requested record is in the public interest; the request for records is not in the commercial interest of the requestor; or, the requestor lacks the financial ability to pay the full amount of the reasonable fee.” See 950 C.M.R. 32.07(2)(k)(l-3). Mr. Bajak is advised that while a record custodian may waive applicable fees, under the criteria One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Jason R. Stelmat SPR20/1586 Page 2 September 21, 2020 in 950 C.M.R. 32.07(2)(k)(l-3), the Supervisor of Records (Supervisor) has no authority to order that a record custodian do so. On August 27, 2020, the Department provided a response denying the request, in its entirety, under Exemption (f) of the Public Records Law due to an on-going investigation. The Department also claimed that, given the nature of the investigation, any related documents would also be exempt under Exemption (n) of the Public Records Law. Additionally, the Department claimed Exemption (a) stating, “…documents created by the Department of Homeland Security’s Intelligence & Analysis [O]ffice received by the Department, those materials would be exempt from disclosure under 6 U.S.C. 482, which dictates that information obtained by a State or local government from a Federal agency under this statute shall remain under the control of the Federal agency, and a State or local law authorizing or requiring such government to disclose information shall not apply to such information.” As a result of the Department’s August 27th response indicating it is withholding all the responsive records, Mr. Bajak petitioned the Supervisor, and this appeal was opened. In his petition, Mr. Bajak asserts, “[d]ocuments discussing the BlueLeaks release, hack or fallout that mention [DDoSecrets] do not necessarily relate to material evidence gathered for a criminal or any other investigation. The security exemption may apply to some sub-set of the documents I have requested, but certainly not all.” The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv) (written response must “identify any records, categories of records or portions of records that the agency or municipality intends to withhold, and provide the specific reasons for such withholding, including the specific exemption or exemptions upon which the withholding is based…”); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). Exemption (f) Exemption (f) permits the withholding of: investigatory materials necessarily compiled out of the public view by law

Jason R. Stelmat SPR20/1586 Page 3 September 21, 2020 enforcement or other investigatory officials the disclosure of which materials would probably so prejudice the possibility of effective law enforcement that such disclosure would not be in the public interest G. L. c. 4, § 7 (26)(f). A custodian of records generally must demonstrate a prejudice to investigative efforts in order to withhold requested records. Information relating to an ongoing investigation may be withheld if disclosure could alert suspects to the activities of investigative officials. Confidential investigative techniques may also be withheld indefinitely if disclosure is deemed to be prejudicial to future law enforcement activities. Bougas v. Chief of Police of Lexington, 371 Mass 59, 62 (1976). An investigative agency is not required to demonstrate prejudice to withhold the identities of voluntary witnesses, informants, or complainants. Reinstein v. Police Comm’r of Boston, 378 Mass. 281, 290 n.18 (1979). Exemption (f) invites a “case-by-case consideration” of whether disclosure “would probably so prejudice the possibility of effective law enforcement that such disclosure would not be in the public interest.” See id. at 289-290. The Department’s August 27, 2020 response asserts, “…any documents mentioning, describing or generated in response to the Blue Leaks release, the preceding hack or subsequent fallout, as well as any documents mentioning or describing [DDoSecrets] would be related to an on-going investigation and are exempt under [G. L. c. 4, § 7(26)(f)] (investigative exemption).” Under Exemption (f), the Department did not meet its burden of specificity in claiming Exemption (f) to withhold all the responsive records, in their entirety. The Department did not explain how release of even redacted records might prejudice any on-going investigation. Exemption (n) The Department further asserted, “…given the nature of the investigation, any related documents would also be exempt under [Exemption n].” Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n).

Jason R. Stelmat SPR20/1586 Page 4 September 21, 2020 Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute; specifically, the “inquiry is whether, and to what degree, the record is one a terrorist would find useful to maximize damage.” PETA, 477 Mass. at 289-90. The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise 'reasonable judgment' in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian's determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, 477 Mass. at 290. Based on the Department’s August 27th response, the Department has not specifically demonstrated that the record(s) in their possession responsive to Mr. Bajak’s request is a record or are records that resemble(s) the records listed as examples in the statute. Nor has the Department provided any factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.” See PETA, 477 Mass. at 289-90. I find that the Department has not provided sufficient factual heft for the Supervisor to conclude the records may be withheld in their entirety. See id. at 290. Exemption (a) The Department’s August 27th response also indicates that any documents created by the Department of Homeland Security’s Intelligence & Analysis Office and received by the Department, are exempt from disclosure under 6 U.S.C. 482. Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977).

Jason R. Stelmat SPR20/1586 Page 5 September 21, 2020 This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. 6 U.S.C. 482 Section 482 of 6 U.S. Code pertains to the procedures for determining the extent of sharing homeland security information with other federal agencies, including state and local personnel. The pertinent language of Section 482 provides that the information received by the state and/or local personnel remains in federal control. Section 482(e) specifically states: Under procedures prescribed under this section, information obtained by a State or local government from a Federal agency under this section shall remain under the control of the Federal agency, and a State or local law authorizing or requiring such a government to disclose information shall not apply to such information 6 U.S.C. 482(e). While 6 U.S.C. 482(e) restricts the Department from disseminating information received from Homeland Security, and under the control of Homeland Security, it is unclear whether 6 U.S.C. 482(e) as it operates through Exemption (a) restricts access to all of the requested records in their entirety. Burden of specificity; duty to segregate Under the Public Records Law, the burden shall be upon the custodian to prove with specificity the exemption which applies. G. L. c. 66, § 10(b)(iv); see also Globe Newspaper Co. -------------------- v. Police Comm’r, 419 Mass. 852, 857 (1995); Flatley, 419 Mass. at 511. The Department did not meet its burden of demonstrating how the responsive records, in their entirety, are exempt under Exemptions (f), (n) and (a) of the Public Records Law. The Department must produce any non-exempt, segregable portions of the public records. G. L. c. 66, § 10(a). In addition, the Department did not identify the records, categories of records or portions of records in its possession that are responsive, to Mr. Bajak’s itemized requests, and withheld under Exemptions (f), (n) and (a). To deny access to a record under the Public Records Law, a

Jason R. Stelmat SPR20/1586 Page 6 September 21, 2020 records access officer must identify the record, categories of records, or portions of the record it intends to withhold. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3)(c)(4). Conclusion Accordingly, the Department is ordered to provide Mr. Bajak with a response to the request, in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. Sincerely, Rebecca S. Murray Supervisor of Records cc: Frank Bajak