Jeffrey Fournier v. Office of the State Auditor (SPR 20210295)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records February 22, 2021 SPR21/0295 Michael P. Ruane, Esq. Deputy General Counsel Office of the State Auditor One Ashburton Place, Room 1819 Boston, MA 02108 Dear Attorney Ruane: I have received the petition of Jeffrey Fournier appealing the response of the Office of the State Auditor (Office/OSA) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On December 18, 2020, Mr. Fournier requested the following records: “Any audit work papers associated with the December 7, 2017 audit of the Department of Children and Families that consist of T-SQL or PL/SQL code used to perform any data analysis completed in conjunction with, or in preparation for, that audit. Please remove/redact all references to networks, infrastructure, systems, servers, databases or that would allow any individual to present a cyber-security threat to the agency.” Previous appeal This request was the subject of a previous appeal. See SPR21/0017 Determination of the Supervisor of Records (January 20, 2021). Following the January 20th determination, the Office provided a response on January 4, 2021. Unsatisfied with the response, Mr. Fournier appealed and SPR21/0295 was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Michael P. Ruane, Esq. SPR21/0295 Page 2 February 22, 2021 order to withhold a requested record. G. L. c. 66, § 10(b)(iv) (written response must “identify any records, categories of records or portions of records that the agency or municipality intends to withhold, and provide the specific reasons for such withholding, including the specific exemption or exemptions upon which the withholding is based…”); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). The Office’s January 4th response In its January 4, 2021 response, the Office produced certain records and stated, “… OSA has applied redactions to the responsive document pursuant to Exemption (n) – the Cybersecurity Exemption – under the Public Records Law. Specifically, OSA has redacted all variables in the code so that only the SQL commands remain.” The Office posited, “… releasing unredacted MS SQL code, in this instance, constitutes a cybersecurity risk and jeopardizes cybersecurity.” In camera inspection In order to facilitate a determination as to the applicability of the Office’s Exemption (n) claim to redact portions of the records, the Office must provide this office with a representative sample of an un-redacted copy of the responsive records for in camera inspection. After I complete my review of the documents, I will return the records to your custody and issue an opinion on the public or exempt nature of the record, See 950 C.M.R. 32.08(4). The authority to require the submission of records for an in camera inspection emanates from the Code of Massachusetts Regulations, 950 C.M.R. 32.08(4); see also G.L. c. 66, § 1. This office interprets the in camera inspection process to be analogous to that utilized by the judicial system. See Rock v. Massachusetts Comm’n Against Discrimination, 384 Mass. 198, 206 (1981) (administrative agency entitled deference in the interpretation of its own regulations). Records are not voluntarily submitted, but rather are submitted pursuant to an order by this office that an in camera inspection is necessary to make a proper finding. Records are submitted for the limited purpose of review. This office is not the custodian of records examined in camera, therefore, any request made to this office for records being reviewed in camera will be denied. See 950 C.M.R. 32.08(4)(c). This office has a long history of cooperation with governmental agencies with respect to in camera inspection. Custodians submit copies of the relevant records to this office upon a promise of confidentiality. This office does not release records reviewed in camera to anyone under any circumstances. Upon a determination of the public record status, records reviewed in camera are promptly returned to the custodian. To operate in any other fashion would seriously impede our ability to function and would certainly affect our credibility within the legal community. Please be aware, any cover letter submitted to accompany the relevant records may be subject to disclosure.

Michael P. Ruane, Esq. SPR21/0295 Page 3 February 22, 2021 Order Accordingly, the Office is ordered to provide this office with a representative sample of an un-redacted copy of the responsive records for in camera inspection without delay. Sincerely, Rebecca S. Murray Supervisor of Records cc: Jeffrey Fournier