Michele R. Murphy v. Division of Capital Asset Management (SPR 20221795)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records August 16, 2022 SPR22/1795 Christopher D. Guerin Office of the General Counsel Division of Capital Asset Management & Maintenance One Ashburton Place, 15th Floor Boston, MA 02108 Dear Mr. Guerin: I have received the petition of Michele Rivers Murphy appealing the response of the Division of Capital Asset Management & Maintenance (Division) to a request for public records. G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On June 24, 2022, Ms. Murphy requested “NOI, File# 194-0174, Pontoosuc Lake Extension of Orders for Drawdown Zoom Meeting link and/or notes re: April 15, 2022 meeting held by DCAMM, OCR with DEP, GZA, and Friends of Pontoosuc via zoom.” The Division responded on July 12, 2022, providing responsive records in redacted form. Unsatisfied with the Division’s response, Ms. Murphy appealed, and this case was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Att’y for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written good faith estimate must be One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Christopher D. Guerin SPR22/1795 Page 2 August 16, 2022 provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. Current Appeal In her appeal petition, Ms. Murphy contends that “[t]here were multiple state agencies involved in this requested zoom meeting, and therefore, public review of such should be furnished according to said public records request and further, as Vice President of Friends of Pontoosuc Lake, I was not informed of this meeting that listed Friends of Pontoosuc as the applicant of said Extension of Orders for Drawdown (DEP File# 194- 0174).” The Division’s July 12th Response In its July 12, 2022 response, the Division cites Exemption (n) of the Public Records Law for redacting responsive records. See G. L. c. 4, § 7(26)(n). Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the

Christopher D. Guerin SPR22/1795 Page 3 August 16, 2022 reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. Under Exemption (n), the Division argues the following: The redacted portion of the records include a link to Commonwealth computer network resources, the very records which are the focus of the exemption.... Knowledge of network paths and related technical resources exposes these valuable Commonwealth assets to threat actors and jeopardizes cyber security. It is therefore the determination of [the Division] that disclosure of the redacted portions of the subject record is likely to jeopardize public and cyber safety and security. Based on the Division’s response, it is unclear how the responsive records may be redacted pursuant to Exemption (n). Specifically, the links in question appear to have been included in an email sent to the Division by an outside organization. Further, based on the information provided in Ms. Murphy’s appeal petition, it appears that the meeting related to these links was intended for other members of the public. Consequently, it is unclear how disclosure of the redacted information is “likely to jeopardize public safety or cyber security.” See PETA, at 289-90. The Division must clarify these matters. Conclusion Accordingly, the Division is ordered to provide Ms. Murphy with a response to her request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within ten business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Sincerely, Manza Arthur Supervisor of Records cc: Michele Rivers Murphy