Todd Wallack v. Department of Criminal Justice Information Services (SPR 20241758)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records July 2, 2024 SPR24/1758 Agapi Koulouris, Esq. General Counsel Department of Criminal Justice Information Services 200 Arlington Street, Suite 2200 Chelsea, MA 02150 Dear Attorney Koulouris: I have received the petition of Todd Wallack, of WBUR, appealing the response of the Department of Criminal Justice Information Services (DCJIS) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On April 26, 2022, Mr. Wallack requested: [1] Any data showing the number of times that people with access to the CJIS systems have accessed [a named individual’s] CORI record[;] [2] Any data showing the number of times that people with access to the CJIS systems have accessed [a named individual’s] CORI record[;] [3] Any audits DCJIS has created or received since 2017 on people improperly accessing CORI reports[;] [4] Any statistics DCJIS has compiled since 2017 on people repeatedly accessing CORI reports for high-profile individuals. Previous Appeals; in camera review This request was the subject of previous appeals and a subsequent in camera review. See SPR22/1538 Determination of the Supervisor of Records (July 19, 2022), SPR22/1817 Determinations of the Supervisor of Records (August 19, 2022; November 7, 2022), SPR22/2942 Determination of the Supervisor of Records (January 9, 2023); SPR23/0375 Determination of the Supervisor of Records (March 10, 2023) and SPR23/0938 Determination of the Supervisor of Records (May 23, 2023). In my May 23rd determination, I ordered DCJIS to provide the records for an in camera inspection without delay. Please be advised that, unlike the materials provided for in camera review, any additional correspondence would be placed in the file for this appeal and would be subject to public disclosure as a public record. One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Agapi Koulouris, Esq. SPR24/1758 Page 2 July 2, 2024 On May 28, 2024, DCJIS provided a response. Unsatisfied with the response, Mr. Wallack petitioned this office and this appeal, SPR24/1758, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(d)(iv) (written response must “identify any records, categories of records or portions of records that the agency or municipality intends to withhold, and provide the specific reasons for such withholding, including the specific exemption or exemptions upon which the withholding is based…”); 950 C.M.R. 32.06(3); see also Dist. Att’y for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. DCJIS’ May 28th Response In its May 28, 2024 response, DCJIS states: DCJIS interprets your public records request to request the following records: (1) In regard to paragraph (1) DCJIS understands that you are seeking a confidential CJIS audit report that would display confidential Criminal Justice Information, including but not limited to Criminal Offender Record Information (CORI), from the CJIS system that would show if any CJIS users queried former [an identified individual]. (2) The same would apply for paragraph (2) except the subject of the query would be ..., [an identified individual]. (3) CJIS audit records from 2017 to 2022 involving any allegations of improper access to CORI. Said CJIS audit records would include confidential Criminal Justice Information including, but not limited to, CORI. (4) DCJIS has previously responded that it does not possess records responsive to Item number 4 as it does not compile said statistics involving high profile individuals.

Agapi Koulouris, Esq. SPR24/1758 Page 3 July 2, 2024 In summary DCJIS asserted in its responses that the requested records are exempt from public disclosure pursuant to the provisions of M.G.L. c. 4, §7 clause 26(a) and (f), M.G.L. c. 6, § 172, 28 CFR 20.33, 18 USC 2721 and the FBI CJIS Security Policy. DCJIS asserted these exemptions, as described in more detail in the referenced responses, as the information contained in CJIS audit reports contains Criminal Justice Information that is exempt from disclosure. As stated, DCJIS understands that the information that you are requesting includes CJIS audit reports that would include highly confidential data that is exempt from disclosure under the referenced statutes, regulations and policy. Current appeal In his appeal, Mr. Wallack asserts, “I also disagree with the agency’s recharacterization of my request as seeking ‘confidential’ reports. I am seeking public records on the misuse of the DCJIS systems, including any audits that found misuse of the system and the number of times that people have improperly looked up [identified individuals].” In compliance with the Public Records Law, the Supervisor of Records may only issue determinations where a violation of G. L. c. 66, § 10 has occurred. See G. L. c. 66, § 10A(a). As Mr. Wallack is seeking to clarify his request, Mr. Wallack has not alleged a violation of G. L. c. 66, § 10 by DCJIS. Where Mr. Wallack has indicated that DCJIS’ May 28th response does not respond to the records he seeks, I encourage the parties to communicate directly to enable Mr. Wallack clarify and describe the records he is looking for. Conclusion Accordingly, I will now consider this administrative appeal closed. If issues remain after further communication, Mr. Wallack may file an appeal. Sincerely, Manza Arthur Supervisor of Records cc: Todd Wallack