Amy Friedman v. Malden City Clerk's Office (SPR 20210973)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records May 3, 2021 SPR21/0973 Kathryn M. Fallon, Esq. City Solicitor City of Malden Office of the City Solicitor 215 Pleasant Street, Suite 420 Malden, MA 02148 Dear Attorney Fallon: I have received the petition of Bruce Friedman appealing the response of the City of Malden (City) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On January 6, 2021, Mr. Friedman requested “. . . any and all contracts effective for the years 2017 through the date you respond to this request for email services provided to the City of Malden, and any departments thereunder. This request also specifically seeks the EULA (End User License Agreement(s)) agreed to for said services by the City and or any of it’s [sic] Departments.” Previous Appeal This request was the subject of a previous appeal. See SPR21/0158 Determination of the Supervisor of Records (February 5, 2021). In my February 5th determination, I found the City’s response did not contain the specificity required in a denial of access to public records. The City was ordered to provide Mr. Friedman with a response to the request, in a manner consistent with the order, the Public Records Law and its Regulations. The City provided said response on April 15, 2021. Unsatisfied with the City’s response, Mr. Friedman petitioned this office, and SPR21/0973 was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Kathryn M. Fallon, Esq. SPR21/0973 Page 2 May 3, 2021 form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The City’s April 15th response In its April 15th response, the City states “[b]ased on security concerns, the City advised Mr. Friedman these records were exempt from disclosure pursuant to MGL c. 4 §7(26)(n).” Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” PETA, 477 Mass. at 289-90. The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise

Kathryn M. Fallon, Esq. SPR21/0973 Page 3 May 3, 2021 ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. The City indicates “[d]isclosing specific vendor information, DNS services, EULA information, and information sought by this requesting party may breach the City of Malden’s information and cyber security, because it permits an individual insight into the internal working and operations of the City's information systems and cyber systems, and allows nefarious actors to conduct attacks on the City's information and cyber systems. Exposing this information as public could potentially expose the City's operational systems to a variety of security risks, malware, phishing scams, hackers and viruses.” The City explains “[t]he information requested defines the City's vendors, software, and products used to protect our internal infrastructure, financial systems, perimeter securities, email systems and filtering, and providing that information as public places the City in a vulnerable position of exposure to security attacks.” The City contends “[s]imilar to the email ransomware attack recently orchestrated against the Commonwealth of Massachusetts motor vehicle inspection system, which has halted operations for motor vehicle inspections across the state, the revelation of the information requested, including vendor contracts and end user license agreements, which define systems the City uses to prevent information breaches and protect email and cyber security profiles, could similarly be used to disrupt and breach City security systems in place.” The City posits “[t]he request itself demonstrates that Mr. Friedman is eliciting information in order to determine the City's cybersecurity profile. Once the information is released as public…will cause this information to be accessible to anyone else as a means to potentially target or attack City information and cyber systems, allowing individuals with extensive IT and email administration knowledge to create attack vectors against the City.” The City further posits “[t]his is precisely the documentation intended as exempt under MGL c. 4 §7(26)(n). It is not in the City of Maiden's cyber security or operational interests, nor in the public interest to reveal this exempt information.” Despite the City’s response, I find it has not met its burden to withhold records in their entirety under Exemption (n) of the Public Records Law. The City is advised that to deny access to a record under the Public Records Law, a records access officer must identify the record, categories of records, or portions of the record it intends to withhold. G. L. c. 66, § 10(b)(iv); see also 950 C.M.R. 32.06(3)(c)(4). Any non-exempt, segregable portion of a public record is subject to mandatory disclosure. G. L. c. 66, § 10(a). In camera inspection In order to facilitate a determination as to the applicability of the Exemption (n) claim made by the City to withhold responsive records, in their entirety, the City must provide this

Kathryn M. Fallon, Esq. SPR21/0973 Page 4 May 3, 2021 office with un-redacted copies of the responsive records for in camera inspection as soon as practicable. See 950 C.M.R. 32.08(4). After I complete my review of the record, I will return the records to the City’s custody and issue an opinion on the public or exempt nature of the records. The authority to require the submission of records for an in camera inspection emanates from the Code of Massachusetts Regulations. 950 C.M.R. 32.08(4); see also G. L. c. 66, § 1. This office interprets the in camera inspection process to be analogous to that utilized by the judicial system. See Rock v. Mass. Comm’n Against Discrimination, 384 Mass. 198, 206 (1981) (administrative agency entitled deference in the interpretation of its own regulations). Records are not voluntarily submitted, but rather are submitted pursuant to an order by this office that an in camera inspection is necessary to make a proper finding. Records are submitted for the limited purpose of review. This office is not the custodian of records examined in camera, therefore, any request made to this office for records being reviewed in camera will be denied. See 950 C.M.R. 32.08(4)(c). This office has a long history of cooperation with governmental agencies with respect to in camera inspection. Custodians submit copies of the relevant records to this office upon a promise of confidentiality. This office does not release records reviewed in camera to anyone under any circumstances. Upon a determination of the public record status, records reviewed in camera are promptly returned to the custodian. To operate in any other fashion would seriously impede our ability to function and would certainly affect our credibility within the legal community. Order Accordingly, the City is ordered to provide this office with un-redacted copies of the responsive records for in camera inspection without delay. Sincerely, Rebecca S. Murray Supervisor of Records cc: Bruce Friedman