Brian Haugli v. Shrewsbury, Town of - (SPR 20242535)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records September 23, 2024 SPR24/2535 Kevin J. Mizikar Town Manager Records Access Officer 100 Maple Avenue Shrewsbury, MA 01545 Dear Mr. Mizikar: I have received the petition of Brian Haugli appealing the response of the Town of Shrewsbury (Town) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On June 24, 2024, Mr. Haugli requested the following: [1.] Every record . . . related to [an identified] January 2023 investigation . . .[;] [2.] The names and points of contact for all state agencies involved in the investigation[;] [3.] Latest Cybersecurity Program Documentation: [a.] Cybersecurity Incident Response Plan[;] [b.] User Training and/or Awareness Policy[;] [c.] User Training and/or Awareness Calendar of training and/or events[;] [4.] Cybersecurity Program Documentation Dates[;] [a.] Date and time of creation and all dates of review of the Cybersecurity Incident Response Plan. Include individual responsible for[;] [b.] Date and time of creation and all dates of review of the User Training and/or Awareness Policy[;] [c.] Dates and times of User Training and/or Awareness training and/or events since 2020[;] [5.] Names and responsibilities of current internal team responsible for cybersecurity[;] [6.] Name of current external providers that support cybersecurity . . . [including] contract award dates and RFP responded to[;] [7.] Date of last 3 external penetration tests on Town infrastructure[;] [8.] Cybersecurity standard followed for Town . . .[;] [a.] If a standard is in place, percentage of controls met and unmet[;] [b.] Written plans with dates to address unmet controls[;] One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Kevin J. Mizikar SPR24/2535 Page 2 September 23, 2024 [c.] Method to track and manage alignment to controls . . . [;] [9.] Annual budget and spend on cybersecurity, by year, since 2020[;] [10.] Qualifications and/or resumes of person(s) responsible for cybersecurity of the Town[.] Previous Appeal This request was the subject of a previous appeal. See SPR24/2203 Determination of the Supervisor of Records (August 19, 2024). In my August 19th determination, I ordered the Town to clarify its claims for withholding records responsive to Items 1 and 2 of the request under Exemption (f) and Items 3, 4, 7, and 8 under Exemption (n) of the Public Records Law. Further, I found that the Town must identify the records in its possession that are responsive to Items 1, 2, 3, 4, 7, and 8 of the request. Subsequently, the Town responded on August 30, 2024. Unsatisfied with the Town’s response, Mr. Haugli petitioned this office, and this appeal, SPR24/2535, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. Current Appeal In his appeal petition, Mr. Haugli asserts the following regarding Items 1 and 2 of his request: The Town cites that the letter from the Department of Homeland Security . . . exempts them from disclosing any records related to the matter. While the Town does identify the records, it . . . does not demonstrate how disclosure of any portion of the responsive records “would probably so prejudice the possibility of

Kevin J. Mizikar SPR24/2535 Page 3 September 23, 2024 effective law enforcement that such disclosure would not be in the public interest[,]” as required under Exemption (f). Regarding Item 3 of his request, Mr. Haugli states the following: The Town’s response to #3 produces record “CIP Master Policy CIP-003” last reviewed 10/11/2023 and signed by the SELCO CIP Senior Manager[.] . . . This policy was assessed[.] This policy states that the Town has the following records: . . . 3.1.4 - SELCO’s Cyber Security Awareness Plan [and] 3.1.7 - SELCO Cyber Security Incident Response Plan[.] . . . Even though their policies cite both records exist, the Town has failed to produce or identify these records in their possession responsive to my request. No Duty to Create Records Please be advised, under the Public Records Law a custodian is not required to create a record in response to a public records request. See G. L. c. 66, § 6A(d). In addition, a public employee is not required to answer questions, or do research, or create documents in response to questions. See 32 Op. Att’y Gen. 157, 165 (May 18, 1977). The duty to comply with requests for records extends to those records that exist and are in the possession, custody, or control of the custodian of records at the time of the request. See G. L. c. 66, § 10(a)(ii). In its August 30th response, regarding Items 4, 7, and 8 of the request, the Town states, “[u]pon further review, the Town does not have records responsive to th[ese] request[s].” Subsequently, in a telephone conversation with this office on September 23, 2024, the Town confirmed that it does not possess records responsive to Items 4, 7, and 8. The Town further confirmed that it does not possess additional records responsive to Item 3 of the request. Where the Town has confirmed that it does not possess additional records responsive to the request, I find that the portion of Mr. Haugli’s appeal regarding the existence of additional records is resolved. The Town’s August 30th Response In its August 30, 2024 response, the Town provides three responsive records and cites Exemptions (f) and (n) of the Public Records Law for withholding other responsive records. See G. L. c. 4, § 7(26)(f), (n). Exemption (f) Exemption (f) permits the withholding of: investigatory materials necessarily compiled out of the public view by law enforcement or other investigatory officials the disclosure of which materials would probably so prejudice the possibility of effective law enforcement that such

Kevin J. Mizikar SPR24/2535 Page 4 September 23, 2024 disclosure would not be in the public interest G. L. c. 4, § 7(26)(f). A custodian of records generally must demonstrate a prejudice to investigative efforts in order to withhold requested records. Information relating to an ongoing investigation may be withheld if disclosure could alert suspects to the activities of investigative officials. Confidential investigative techniques may also be withheld indefinitely if disclosure is deemed to be prejudicial to future law enforcement activities. Bougas v. Chief of Police of Lexington, 371 Mass. 59, 62 (1976). Redactions may be appropriate where they serve to preserve the anonymity of voluntary witnesses. Antell v. Att’y Gen., 52 Mass. App. Ct. 244, 248 (2001); Reinstein v. Police Comm’r of Boston, 378 Mass. 281, 290 n.18 (1979). Exemption (f) invites a “case-by- case consideration” of whether disclosure “would probably so prejudice the possibility of effective law enforcement that such disclosure would not be in the public interest.” See id. at 289-90. In its August 30th response, regarding Items 1 and 2 of the request, the Town states the following: Town’s Further Response to [Item] #1: As previously stated in the Town’s July 25 response letter . . . the records responsive to this request are exempt from from [sic] disclosure under the “investigatory exemption” to the Public Records Law. . . (M.G.L. c. 4, § 7(26)[(f)]). These records pertain to an active law enforcement investigation that is open and ongoing as of the date of this letter. Disclosure of these records could compromise and prejudice investigative efforts and may alert suspects to law enforcement activities and techniques. Even in redacted form, disclosure of these records poses a likelihood that suspects may learn details of the ongoing investigation such that law enforcement efforts could be compromised. Upon receipt of the Supervisor of Records’ August 19 letter, the Town submitted your public records requests to the Department of Homeland Security, which has been involved with the referenced investigation. The Town received [an identified] Assistant Chief [Counsel’s] . . . August 28 letter in response, and the letter states that the release of the requested records could potentially impede or prejudice an ongoing law enforcement investigation, citing 6.C.F.R. §5.48(b). Further, [the] . . . August 28 letter states that the fact that the Town is already in possession of these records does not provide the authority to produce them as they are records covered by federal regulations. Records responsive to Request #1 being withheld at this time are as follows: 1. Incident Report – [identified incident number].

Kevin J. Mizikar SPR24/2535 Page 5 September 23, 2024 2. 46 emails dated from November 2022 - June 2024. 3. Documents: a. Dept. of Homeland Security- Report of Investigation - January 1, 2023. b. Complaint Referral Form - December 8, 2022. c. CJISWEB printout Generated on December 6, 2022. d. Contact Card Report - December 6, 2022. e. A letter from the Town’s Police Department to the Town Manager - December 5, 2022. f. Record Report WHOIS, DNS & Domain Info Domain Tools – December 5, 2022. g. A letter with bank transaction routing instructions. h. A letter concerning a bank claim. Disclosure of these records may alert suspects to law enforcement activities and techniques, and may allow suspects to avoid detection, destroy evidence, and otherwise compromise an ongoing law enforcement investigation. Even in redacted form, disclosure of these records poses a likelihood that suspects may learn details of the investigation and investigatory methods. Further, the Town is not in a position to disregard instructions from the Department of Homeland Security, set forth in [an identified] Assistant Chief [Counsel’s] . . . August 28 letter, that the records you have requested may not be released. . . . Town’s Response to [Item] #2: The Town has provided the letter from [an identified] Assistant Chief Counsel . . . Homeland Security Investigations - Boston, dated August 28, 2024. Any other records responsive to this request have been identified in Response #1 above and are withheld for the reasons stated in Response #1 above. Based on the Town’s August 30th response, in conjunction with a telephone conference between this office and the Town on September 23, 2024, I find that the Town may permissibly withhold the records responsive to Items 1 and 2, in their entirety, under Exemption (f) at this time. Please note that any future change to the status of the ongoing investigation may affect the applicability of Exemption (f). Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable

Kevin J. Mizikar SPR24/2535 Page 6 September 23, 2024 judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” Id. at 290. In its August 30th response, regarding Item 3 of the request, the Town states the following: Town’s Response to [Item] #3: Enclosed with this letter are additional records responsive to your request that may be disclosed by the Town. . . . These records are as follows: 1. Shrewsbury Electric and Cable Operations - CIP Master Policy CIP-003 2. SELCO PYW - Cybersecurity Guidance Poster The Town continues to withhold the following record responsive to this request: 1. SELCO’s CIP-002 BES Cyber System Identification and Categorization Assessment and Annual Review, completed in compliance with CIP-002-5.1a This record is withheld under the “cyber security exemption” to the Public Records Law . . . (M.G.L. c. 4, § 7(26)[(n)]. . . . CIP-002 is a form to record critical utility infrastructure. Disclosure of this record would jeopardize the Town’s and national cyber security, and therefore public safety, by providing

Kevin J. Mizikar SPR24/2535 Page 7 September 23, 2024 sensitive infrastructure information to individuals and entities that is instructive on the methods and protocols the Town uses to maintain cyber security. Disclosure of this record would be akin to disclosing the blueprints of a secured building showing security camera locations and alarm specifications. In camera inspection In order to facilitate a determination as to the applicability of the Exemption (n) claim made by the Town to withhold the record responsive to Item 3 of the request, the Town must provide this office with an un-redacted copy of the responsive record for in camera inspection. See 950 C.M.R. 32.08(4). After I complete my review of the record, I will return the record to the Town’s custody and issue an opinion on the public or exempt nature of the record. The authority to require the submission of records for an in camera inspection emanates from the Code of Massachusetts Regulations. 950 C.M.R. 32.08(4); see also G. L. c. 66, § 1. This office interprets the in camera inspection process to be analogous to that utilized by the judicial system. See Rock v. Mass. Comm’n Against Discrimination, 384 Mass. 198, 206 (1981) (administrative agency entitled deference in the interpretation of its own regulations). Records are not voluntarily submitted, but rather are submitted pursuant to an order by this office that an in camera inspection is necessary to make a proper finding. Records are submitted for the limited purpose of review. This office is not the custodian of records examined in camera, therefore, any request made to this office for records being reviewed in camera will be denied. See 950 C.M.R. 32.08(4)(c). This office has a long history of cooperation with governmental agencies with respect to in camera inspection. Custodians submit copies of the relevant records to this office upon a promise of confidentiality. This office does not release records reviewed in camera to anyone under any circumstances. Upon a determination of the public record status, records reviewed in camera are promptly returned to the custodian. To operate in any other fashion would seriously impede our ability to function and would certainly affect our credibility within the legal community. Please be aware, any cover letter submitted to accompany the relevant records may be subject to disclosure. Conclusion Accordingly, the Town is ordered to provide this office with un-redacted copy of the responsive record for in camera inspection without delay.

Kevin J. Mizikar SPR24/2535 Page 8 September 23, 2024 Sincerely, Manza Arthur Supervisor of Records cc: Brian Haugli