Sean Sheridan v. Brockton, City of (SPR 20212697)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records October 26, 2021 SPR21/2697 Allison M. Cogliano, Esq. Assistant City Solicitor City of Brockton 45 School Street Brockton, MA 02301 Dear Attorney Cogliano: I have received the petition of Sean Sheridan appealing the response of the City of Brockton (City) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On September 9, 2021, Mr. Sheridan requested, “. . . copies of public facing digital files on the Brockton public web server . . . before August 25, 2010 midnight and after August 27, 2021 midnight.” Previous appeal This request was the subject of a previous appeal. See SPR21/2456 Determination of the Supervisor of Public Records (October 1, 2021). The City responded on October 13, 2021. Unsatisfied with the response, Mr. Sheridan petitioned this office and this appeal, SPR21/2697, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(d)(iv) (written response must “identify any records, categories of records or portions of records that the agency or municipality intends to withhold, and provide the specific reasons for such withholding, including the specific exemption or exemptions upon which the withholding is based . . .”); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Atty. Cogliano SPR21/2697 Page 2 October 26, 2021 burden of establishing the applicability of an exemption). The City’s October 13th response In its October 13, 2021 response, the City cited Exemption (n) of the Public Records Law to withhold the requested records. Exemption (n) Exemption (n) permits the withholding of: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L c. 4, § 7(26)(n). Under Exemption (n), a records custodian may withhold a record if its release is likely to jeopardize public safety or cyber security. It is the duty of the custodian to exercise “reasonable judgment” to determine whether disclosure of the record may impact public safety. Id. Exemption (n) requires a two prong analysis. People for the Ethical Treatment of Animals (PETA) v. Dep’t. of Agric. Res., 477 Mass. 280, 286 (2017). The first prong examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute”; specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” Id. at 289-90. With regard to a prong one analysis, if the requested record is not expressly listed in the text of the exemption, then Exemption (n) does not apply unless the record is related to one of the statute’s enumerated examples. See PETA, 477 Mass. at 288 (“we must interpret the ‘any other records’ clause as embracing only those records that, when released, are ‘likely to jeopardize public safety [or cyber security]’ in a similar way to one of the examples listed in exemption (n)”). The second prong examines whether, in the the record custodian’s reasonable judgment, the requested records are factually and contextually likely to jeopardize public safety or cyber security. Id. at 289-90. However, the “reasonable judgment” language in Exemption (n) does not imply a heightened level of deference to the records custodian’s initial denial. Id. at 291. “[T]he

Atty. Cogliano SPR21/2697 Page 3 October 26, 2021 primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records . . . to conclude that a reasonable person would agree with the custodian's determination given the context of the particular case.” Id. at 289-90. The first prong On January 1, 2017, the Public Records Law was amended to insert the phrase “cyber security” into the text of G. L c. 4, § 7(26)(n). Instead of listing cyber security as an enumerated example, the Legislature included it in the “any other records” clause. Id. at 281 n. 3. Thus, the first prong will only be met if the City’s public facing digital files are analogous to one of the statute’s enumerated categories. A website’s digital files are similar to “blueprints,” “plans,” and “schematic drawings” because, when taken together, a complete collection of digital files may utilized to identify the structural limitations of a website’s internal coding mechanism in the same way that blueprints, plans, and schematic drawings can be used to harm a building. Indeed, disclosure of these records may expose network information that a terrorist “would find useful to maximize damage.” Id. at 289-90. Accordingly, I find that a website’s digital files satisfy the first prong of Exemption (n). The second prong In the City’s October 13th response, the City stated that it “cannot produce records responsive to [the] request as they are exempt pursuant to [Exemption (n)], which exempts documents [that] pose a threat to cyber security.” The City asserts that, “[t]he documents . . . would contain usernames, IP addresses, MAC addresses, and other sensitive information which could endanger the City's cyber security.” Pursuant to the City’s October 13th response, I find that the custodian did not provide factual heft to support the withholding of the requested files. It is unclear how the release of the requested public facing digital files on the Brockton public web server would jeopardize public safety or cyber security. This City must clarify this issue. Conclusion The City is ordered to provide Mr. Sheridan with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within 10 business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us.

Atty. Cogliano SPR21/2697 Page 4 October 26, 2021 Sincerely, Rebecca S. Murray Supervisor of Records cc: Sean Sheridan