Grace Ferguson v. Haverhill, City of - Public Schools (SPR 20212835)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Rebecca S. Murray Supervisor of Records November 9, 2021 SPR21/2835 Michael Pfifferling Assistant Superintendent of Finance & Operations Haverhill Public Schools 4 Summer Street; Room 104 Haverhill, MA 01830 Dear Assistant Superintendent Pfifferling: I have received the petition of Grace Ferguson of The Daily Dot appealing the response of the City of Haverhill (City) Public Schools (School) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On September 14, 2021, Ms. Ferguson requested: “[a]ny and all records, dating from March 1, 2021 to present, relating to the ransomware attack on the [School] in April 2021. This request includes but is not limited to records containing the terms: revil; babuk; conti; pysa; mespinoza; maze; for browser; bitcoin; ethereum; deep web; dark web; ransomware; malware; hack/hacking/hackers; cyberattack/cyber attack/cyber-attack; DDoS attack/denial of service attack; cybersecurity/cyber security/cyber-security.” Furthermore, Ms. Ferguson notes “…the list of search terms is not exhaustive. [The Daily Dot] is requesting any and all records relating to ransomware for the specified time period.” In an October 26, 2021 response, the City asserted, “[a]t this time, the [School] has already released any and all allowable responses to the Ransomware Attack to the Daily Dot.” Prior to the October 26th response, the School stated, “[t]he requests [Ms. Ferguson] made were identical to the request [Ms. Ferguson] made to the City. We are one entity. It is my understanding that [Ms. Ferguson] [has] already received a response to [Ms. Ferguson’s] request for information from the [Department] and our attorneys. There is no additional information we are able to provide [Ms. Ferguson] with.” As a result of the School’s response, Ms. Ferguson petitioned the Supervisor of Records (Supervisor), and this appeal was opened. In Ms. Ferguson’s petition, she contends that the School did not provide any records at all, without citing any statutory exemptions that would allow them to do so. While Ms. Ferguson received records from the City of Haverhill Police Department, Ms. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Asst. Sup. Michael Pfifferling SPR21/2835 Page 2 November 9, 2021 Ferguson petitioned the Supervisor of Records (Supervisor) pertaining to her request from the School. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any town of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv) (written response must “identify any records, categories of records or portions of records that the agency or municipality intends to withhold, and provide the specific reasons for such withholding, including the specific exemption or exemptions upon which the withholding is based…”); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. In its October 26th response, the School asserts, “[t]here is no additional information we are able to provide [Ms. Ferguson] with.” However, it is unclear whether the School possesses additional records responsive to the above request. Specifically, the School must clarify whether it possesses additional records that it is withholding. The duty to comply with requests for records extends to those records that exist and are in the possession, custody, or control of the custodian of records at the time of the request. See G. L. c. 66, § 10(a)(ii). Conclusion Accordingly, the School is ordered to provide Ms. Ferguson with a response to the request, in a manner consistent with this order, the Public Records Law and its Regulations within 10 business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of this response to this office at pre@sec.state.ma.us. Sincerely, Rebecca S. Murray Supervisor of Records cc: Grace Ferguson, The Daily Dot