Brian Haugli v. Shrewsbury, Town of - (SPR 20242203)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records August 19, 2024 SPR24/2203 Kevin J. Mizikar Town Manager Records Access Officer 100 Maple Avenue Shrewsbury, MA 01545 Dear Mr. Mizikar: I have received the petition of Brian Haugli appealing the response of the Town of Shrewsbury (Town) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On June 24, 2024, Mr. Haugli requested the following: [1.] Every record . . . related to [an identified] January 2023 investigation . . .[;] [2.] The names and points of contact for all state agencies involved in the investigation[;] [3.] Latest Cybersecurity Program Documentation: [a.] Cybersecurity Incident Response Plan[;] [b.] User Training and/or Awareness Policy[;] [c.] User Training and/or Awareness Calendar of training and/or events[;] [4.] Cybersecurity Program Documentation Dates[;] [a.] Date and time of creation and all dates of review of the Cybersecurity Incident Response Plan. Include individual responsible for[;] [b.] Date and time of creation and all dates of review of the User Training and/or Awareness Policy[;] [c.] Dates and times of User Training and/or Awareness training and/or events since 2020[;] [5.] Names and responsibilities of current internal team responsible for cybersecurity[;] [6.] Name of current external providers that support cybersecurity . . . [including] contract award dates and RFP responded to[;] [7.] Date of last 3 external penetration tests on Town infrastructure[;] [8.] Cybersecurity standard followed for Town . . .[;] [a.] If a standard is in place, percentage of controls met and unmet[;] [b.] Written plans with dates to address unmet controls[;] One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Kevin J. Mizikar SPR24/2203 Page 2 August 19, 2024 [c.] Method to track and manage alignment to controls . . . [;] [9.] Annual budget and spend on cybersecurity, by year, since 2020[;] [10.] Qualifications and/or resumes of person(s) responsible for cybersecurity of the Town[.] On July 2, 2024, the Town responded to Mr. Haugli, providing a fee estimate of $150.00, which it subsequently received payment for, and indicating that the Town would need 25 business days following its initial receipt of the request to produce responsive records. See G. L. c. 66, § 10(b)(vi). The Town provided a further response on July 25, 2024. Unsatisfied with the response, Mr. Haugli petitioned this office and this appeal, SPR24/2203, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Town’s July 25th Response In its July 25, 2024 response, the Town provides records responsive to Items 3, 5, 6, 9 and 10 of Mr. Haugli’s request and advises that “some records responsive to [his] request must be withheld from disclosure.” The Town cites Exemption (f) of the Public Records Law to withhold records responsive to Items 1 and 2 in their entirety. The Town additionally claims Exemption (n) to withhold partial records responsive to Item 3 and records responsive to Items 4, 7, and 8 in their entirety. Current appeal In his appeal petition, Mr. Haugli states that “[t]he records requested do not meet the exemption from disclosure” and argues that the Town “has not provided sufficient factual heft” in its partial and complete withholding of records responsive to Items 1, 2, 3, 4, 7, and 8 of his

Kevin J. Mizikar SPR24/2203 Page 3 August 19, 2024 request. He further indicates that he does not contest the Town’s response to his request concerning Items 5, 6, 9, and 10. Exemption (f) Exemption (f) permits the withholding of: investigatory materials necessarily compiled out of the public view by law enforcement or other investigatory officials the disclosure of which materials would probably so prejudice the possibility of effective law enforcement that such disclosure would not be in the public interest G. L. c. 4, § 7(26)(f). A custodian of records generally must demonstrate a prejudice to investigative efforts in order to withhold requested records. Information relating to an ongoing investigation may be withheld if disclosure could alert suspects to the activities of investigative officials. Confidential investigative techniques may also be withheld indefinitely if disclosure is deemed to be prejudicial to future law enforcement activities. Bougas v. Chief of Police of Lexington, 371 Mass. 59, 62 (1976). Redactions may be appropriate where they serve to preserve the anonymity of voluntary witnesses. Antell v. Att’y Gen., 52 Mass. App. Ct. 244, 248 (2001); Reinstein v. Police Comm’r of Boston, 378 Mass. 281, 290 n.18 (1979). Exemption (f) invites a “case-bycase consideration” of whether disclosure “would probably so prejudice the possibility of effective law enforcement that such disclosure would not be in the public interest.” See id. at 289-90. In its July 25th response, the Town states the following: Town’s Response to [Item] #1: Records responsive to this request are exempt from disclosure under the “investigatory exemption” to the Public Records Law… These records pertain to an active law enforcement investigation that is open and ongoing as of the date of this letter. Disclosure of these records could compromise and prejudice investigative efforts and may alert suspects to law enforcement activities and techniques. Even in redacted form, disclosure of these records poses a likelihood that suspects may learn details of the ongoing investigation such that law enforcement efforts could be compromised. . . . Town’s Response to [Item] #2: See Town’s Response to #1. Although the Town claims it has an open investigation regarding the records responsive to Items 1 and 2, it is unclear how the records, in their entirety, can be withheld under Exemption (f). It is unclear from the Town’s response whether the records contain confidential investigative techniques that would be prejudicial to the ongoing investigation if disclosed. The Town also did

Kevin J. Mizikar SPR24/2203 Page 4 August 19, 2024 not demonstrate how disclosure of any portion of the responsive records “would probably so prejudice the possibility of effective law enforcement that such disclosure would not be in the public interest[,]” as required under Exemption (f). Reinstein, 378 Mass. 289-290 (the statutory exemptions are narrowly construed and are not blanket in nature). Any non-exempt, segregable portion of a public record is subject to mandatory disclosure. G. L. c. 66, § 10(a). Further, I find that the Town must identify the records in its possession that are responsive to the request. To deny access to a record or portion of a record under the Public Records Law, a records access officer must identify the record, categories of records, or portions of the record it intends to withhold. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3)(c)(4). The Town must clarify these matters. Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought

Kevin J. Mizikar SPR24/2203 Page 5 August 19, 2024 resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” Id. at 290. In its July 25th response, the Town states the following: Town’s Response to [Item] #3: Enclosed with this letter are certain records responsive to your request that may be disclosed by the Town. . . . Other records responsive to this request are exempt from disclosure under the “cyber security exemption” to the Public Records Law, with respect to “records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to … cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security” . . . . Disclosure of these records would likely jeopardize the Town’s cyber security, providing information to individuals and entities that is instructive on the methods and protocols the Town uses to maintain cyber security. Disclosure of these records would be akin to disclosing the blueprints of a secured building showing security camera locations and alarm specifications. Upon review of the responsive records the Town enclosed with its July 25th response, in conjunction with the information provided in Mr. Haugli’s appeal petition, it is my understanding that the Town did not provide any records responsive to Items 4, 7, and 8 of the request. Instead, it appears that the Town reiterates “[s]ee Town’s Response to [Item] #3” in its response to Items 4, 7, and 8 of Mr. Haugli’s request to communicate that it withheld records responsive to Items 4, 7, and 8 in their entirety under Exemption (n). I find that the Town did not provide factual heft to support the withholding of the requested records pursuant to Exemption (n). Specifically, the Department has not sufficiently explained how disclosure of the records are “likely to jeopardize public safety.” See PETA at 289-90. Further, the Town did not identify the records in its possession that it intends to withhold from disclosure. It is also unclear if the Town could provide segregable portions of the responsive records. Any non-exempt, segregable portion of a public record is subject to mandatory disclosure. G. L. c. 66, § 10(a). The Town must clarify this matter. Conclusion Accordingly, the Town is ordered to provide Mr. Haugli with a response to his request, provided in a manner consistent with this order, the Public Records Law, and its Regulations within ten business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us.

Kevin J. Mizikar SPR24/2203 Page 6 August 19, 2024 Sincerely, Manza Arthur Supervisor of Records cc: Brian Haugli David C. Snowdon