Frank Bajak v. Massachusetts Department of State Police (SPR 20201919)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records October 21, 2020 SPR20/1919 Jason R. Stelmat, Esq. Privacy Officer Department of State Police Commonwealth Fusion Center 124 Acton Street Maynard, MA 01754 Dear Attorney Stelmat: I have received the petition of Frank Bajak, on behalf of the Associated Press, appealing the response of the Department of State Police Commonwealth Fusion Center (Department) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). Specifically, Mr. Bajak requested records generated between May 1, 2020 and the present, including: 1. Documents mentioning, describing or generated by the BlueLeaks release, the preceding hack or subsequent fallout, including but not limited to: (a) Damage assessments; (b) Emails; (c) Interagency communications (local, state or federal); (d) Communications with the press about BlueLeaks; and (e) Communications with Twitter or other social media or sharing platforms. 2. Documents mentioning or describing Distributed Denial of Secrets (DDoSecrets); and 3. Documents created by the Department of Homeland Security’s Intelligence & Analysis Office that discuss BlueLeaks and/or DDoSecrets. Prior appeal These requested records were the subject of a prior appeal. See SPR20/1586 Determination of the Supervisor of Records (Supervisor) (September 21, 2020). In my September 21st determination, I found that the Department did not meet its burden of specificity in withholding all the responsive records under Exemptions (a), (f) and (n). The Department provided an October 5, 2020 response to my September 21st determination. The Department continues to withhold all the records, in their entirety, under Exemptions (a), (f) and (n). One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Jason R. Stelmat, Esq. SPR20/1919 Page 2 October 21, 2020 In its October 5th response, the Department asserts, “[w]hile there is no current timetable for the investigation, the Department is willing to readdress this matter upon [Mr. Bajak’s] request when the investigation and any subsequent criminal proceedings have been completed.” As a result of the October 5th response, Mr. Bajak petitioned the Supervisor, and the current appeal was opened. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv) (written response must “identify any records, categories of records or portions of records that the agency or municipality intends to withhold, and provide the specific reasons for such withholding, including the specific exemption or exemptions upon which the withholding is based…”); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). Exemption (f) Exemption (f) permits the withholding of: investigatory materials necessarily compiled out of the public view by law enforcement or other investigatory officials the disclosure of which materials would probably so prejudice the possibility of effective law enforcement that such disclosure would not be in the public interest G. L. c. 4, § 7 (26)(f). A custodian of records generally must demonstrate a prejudice to investigative efforts in order to withhold requested records. Information relating to an ongoing investigation may be withheld if disclosure could alert suspects to the activities of investigative officials. Confidential investigative techniques may also be withheld indefinitely if disclosure is deemed to be prejudicial to future law enforcement activities. Bougas v. Chief of Police of Lexington, 371 Mass 59, 62 (1976). An investigative agency is not required to demonstrate prejudice to withhold the identities of voluntary witnesses, informants, or complainants. Reinstein v. Police Comm’r of Boston, 378 Mass. 281, 290 n.18 (1979). Exemption (f) invites a “case-by-case consideration” of whether disclosure “would probably so prejudice the possibility of effective law enforcement that such disclosure would not be in the public interest.” See id. at 289-290.

Jason R. Stelmat, Esq. SPR20/1919 Page 3 October 21, 2020 The Department’s August 27, 2020 response asserts, “…any documents mentioning, describing or generated in response to the Blue Leaks release, the preceding hack or subsequent fallout, as well as any documents mentioning or describing [DDoSecrets] would be related to an on-going investigation and are exempt under [G. L. c. 4, § 7(26)(f)] (investigative exemption).” The Department’s August 27, 2020 response asserts, “…any documents mentioning, describing or generated in response to the Blue Leaks release, the preceding hack or subsequent fallout, as well as any documents mentioning or describing [DDoSecrets] would be related to an on-going investigation and are exempt under [G. L. c. 4, § 7(26)(f)] (investigative exemption).” In its October 5, 2020 response, the Department states that the records directly relate to an ongoing multi-agency investigation related to cyber security and a breach of personal data. The Department continues to assert, “[t]he responsive documents are sensitive in nature and contained within an investigation file that is only accessible to certain members of the Department with knowledge of the investigation. Segregating and identifying those records with specificity and subsequently disclosing the information to the public would compromise the investigation and create additional vulnerabilities for our Department and potentially other law enforcement and public safety agencies.” In addition, the Department posits that release of any of the records would reveal investigative techniques and render the law enforcement efforts ineffective. Finally, the Department states, “…disclosure of those records would provide unwanted advantages to any person or group with nefarious intentions related to this investigation and future law enforcement activities.” Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist would find useful to

Jason R. Stelmat, Esq. SPR20/1919 Page 4 October 21, 2020 maximize damage.” PETA, 477 Mass. at 289-90. The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise 'reasonable judgment' in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian's determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, 477 Mass. at 290. In its August 27th response, the Department asserts, “…given the nature of the investigation, any related documents would also be exempt under [Exemption n].” In its October 5th response, the Department asserts, “…records that are likely to jeopardize individual safety, public safety and/or cyber security are exemption from public disclosure. Given that the records in question are directly related to an active law enforcement investigation into a cyber-security breach of personal information, clause (n) permits the withholding of those records. Aside from jeopardizing the investigation, revealing the records would also jeopardize the safety of individuals who data was accessed unlawfully and also reveal the methods utilized by those responsible for the breach.” Exemption (a) The Department’s August 27th and October 5th responses indicate that any documents created by the Department of Homeland Security’s Intelligence & Analysis Office, and other materials in the Department’s possession that were generated by other federal agencies, are exempt from disclosure under 6 U.S.C. 482. Exemption (a), known as the statutory exemption, permits the withholding of records that are: specifically or by necessary implication exempted from disclosure by statute G. L. c. 4, § 7(26)(a). A governmental entity may use the statutory exemption as a basis for withholding requested materials where the language of the exempting statute relied upon expressly or necessarily implies that the public’s right to inspect records under the Public Records Law is restricted. See Attorney Gen. v. Collector of Lynn, 377 Mass. 151, 54 (1979); Ottaway Newspapers, Inc. v. Appeals Court, 372 Mass. 539, 545-46 (1977).

Jason R. Stelmat, Esq. SPR20/1919 Page 5 October 21, 2020 This exemption creates two categories of exempt records. The first category includes records that are specifically exempt from disclosure by statute. Such statutes expressly state that such a record either “shall not be a public record,” “shall be kept confidential” or “shall not be subject to the disclosure provision of the Public Records Law.” The second category under the exemption includes records deemed exempt under statute by necessary implication. Such statutes expressly limit the dissemination of particular records to a defined group of individuals or entities. A statute is not a basis for exemption if it merely lists individuals or entities to whom the records are to be provided; the statute must expressly limit access to the listed individuals or entities. 6 U.S.C. 482 Section 482 of 6 U.S. Code pertains to the procedures for determining the extent of sharing homeland security information with other federal agencies, including state and local personnel. The pertinent language of Section 482 provides that the information received by the state and/or local personnel remains in federal control. Section 482(e) specifically states: Under procedures prescribed under this section, information obtained by a State or local government from a Federal agency under this section shall remain under the control of the Federal agency, and a State or local law authorizing or requiring such a government to disclose information shall not apply to such information 6 U.S.C. 482(e). Burden of specificity Under the Public Records Law, the burden shall be upon the custodian to prove with specificity the exemption which applies. G. L. c. 66, § 10(b)(iv); -se-e -al-so- -G-lo-b-e- N-e-w-s-p-ap-e-r- C-o-. v. Police Comm’r, 419 Mass. 852, 857 (1995); Flatley, 419 Mass. at 511. The Department did not meet its burden of demonstrating how the responsive records, in their entirety, are exempt under Exemptions (f), (n) and (a) of the Public Records Law. Based on the Department’s response, it is unclear what records and categories of records the Department has in its possession that it withheld in their entirety under Exemptions (a), (f) and (n). Therefore, I find that the Department must provide a custodial index of the records to account for the all the records the Department is withholding. See 950 C.M.R. 32.08(5)(a)-(c). Conclusion Accordingly, the Department is ordered to provide Mr. Bajak with an index of the records responsive to the request, in a manner consistent with this order, the Public Records Law and its Regulations within 10 business days. A copy of any such response must be provided to this

Jason R. Stelmat, Esq. SPR20/1919 Page 6 October 21, 2020 office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. Sincerely, Rebecca S. Murray Supervisor of Records cc: Frank Bajak, Associated Press