Mitchell Kosht v. New Bedford, City of - Police Department (SPR 20211277)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records June 7, 2021 SPR21/1277 Lisa Presby Office of the City Solicitor City of New Bedford 133 William Street, Room 203 New Bedford, MA 02740 Dear Ms. Presby: I have received the petition of Attorney Mitchell Kosht appealing the response of the New Bedford Police Department (Department) to a request for public records. G. L. c. 66, § l0A; see also 950 C.M.R. 32.08(1). On April 8, 2021, Attorney Kosht requested a spreadsheet containing “fields of data for all personnel employed by the New Bedford Police Department.” The Department provided a response on April 23, 2021. Unsatisfied with the Department’s response, Attorney Kosht petitioned this office, and SPR21/1277 was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Lisa Presby SPR21/1277 Page 2 June 7, 2021 Department’s April 23rd Response In its April 23, 2021 response, the Department declined to “produce the employee identification number for all personnel employed by the New Bedford Police Department pursuant to M.G.L. c. 4, section 7(26)(n).” The Department explained that Exemption (n) excludes from public disclosure records “likely to jeopardize public safety or cyber security.” In Attorney Kosht’s May 21, 2021 appeal to this office, he states it is unclear “how an employee identification number would permit a cyber terrorist to access the city's financial software. Presumably such a terrorist would also need a password of some sort to gain access to the system. I would also note that dozens of other police departments have shared this information through public records requests without noting the New Bedford Police Department's concerns.” Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” PETA, 477 Mass. at 289-90. The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id.

Lisa Presby SPR21/1277 Page 3 June 7, 2021 In the April 23rd response, the Department, regarding the first prong test, stated “the employee ID numbers closely resemble the records listed as examples in the statute because they relate to the cyber security of the City. The employee ID numbers may be used to access the City’s financial software which contains citywide payroll information and individual employees' personal information.” The Department explained that “disclosure of the employee ID numbers, especially in connection with their names would be useful to a terrorist in maximizing damage because it would provide a cyber-terrorist with critical information, he or she could use to attempt to access the City’s financial software which poses a threat to its cybersecurity and the cybersecurity of the individual employees.” Despite the Department’s response, it is unclear how employee ID numbers closely resemble the examples of exempt records as listed in the statute. See PETA, 477 Mass. at 289-90 The Department must clarify this. Conclusion Accordingly, the Department is ordered to provide Attorney Kosht with a response to the request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within 10 business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. Sincerely, ~ ~· ·o ,J') ..d ~ ~ ~ M ~ . . ' . .. Rebecca S. Murray Supervisor of Records cc: Mitchell Kosht, Esq. Elizabeth Treadup Pio, Esq. Michael Boswell, RAO