John Hawkinson v. Cambridge, City of - Office of the City Clerk (SPR 20250742)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records March 31, 2025 SPR25/0742 Seah Levy Public Records Access Officer City of Cambridge Office of the City Solicitor 795 Massachusetts Avenue Cambridge, MA 02139 Dear Ms. Levy: I have received the petition of John Hawkinson appealing the response of the City of Cambridge (City) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On February 27, 2025, Mr. Hawkinson requested the following: Could you please produce any records the city has regarding the subject ETLs (those that produce the “Building Permits: New Construction” and “Building Permits: Addition/Alteration” datasets). That include: • Records of when these ETLs were created and modified • Records of what language(s) these scripts are written in • Records of what queries these scripts perform • Records of the file names and file sizes of the ETL scripts — how much are we talking about here? The City responded on March 13, 2025, and assigned reference number P250384-022725 to the request. Unsatisfied with the City’s response, Mr. Hawkinson petitioned this office, and this appeal, SPR25/0742, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Seah Levy SPR25/0742 Page 2 March 31, 2025 § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The City’s March 13th Response In its March 13, 2025 response, the City denies the request, and states that “the City is not required to create a new record in order to respond to a public records request.” The City also cites Exemption (n) of the Public Records Law for denying the request. See G. L. c. 4, § 7(26)(n). Records in Existence In its March 13th response, the City argues the following: The City first denies your request for the reason that the items in your request ask for an answer, or the creation of a new record, in order to respond to your request: • “Records of when these ETLs were created and modified.” This portion of your request would require the extraction of metadata from the original file, and for this extracted data to be created and kept in a second separate record format. Furthermore, this information might be incorrect, if the metadata is extracted from a copy of the original script, or if the original script no longer exists. • “Records of what language(s) these scripts are written in.” This portion of your request would require an examination of the scripts and the architecture of the software and the creation of a new record in order to respond to this request. • “Records of what queries these scripts perform.” This portion of your request would require a staff member to examine each script and create a document detailing which functions each individual script performs. • “Records of the file names and file sizes of the ETL scripts.” This portion of your request would require a new record to be created that includes the name and current file size of each active ETL Script. Under the Public Records law, the City is not required to create a new record in order to respond to a public records request.

Seah Levy SPR25/0742 Page 3 March 31, 2025 Based on the City’s March 13th response, it unclear whether the requested records can be extracted. The City is advised that extracting records or information from records that are already in existence and in its possession, custody, or control, is not creation of a record. The duty to comply with requests for records extends to those records that exist and are in the possession, custody, or control of the custodian of records at the time of the request. See G. L. c. 66, § 10(a)(ii). The City is directed to a 2020 Supreme Judicial Court decision relative to creating a record versus extraction of information from databases in order to produce records or information in response to a public records request. In Att’y Gen. v. Dist. Attorney for the Plymouth Dist., et al. (Plymouth Dist.), the Court stated: …where public records are in electronic form, as they increasingly are and will be, a public records request that requires a government entity to search its electronic database to extract requested data does not mean that the extracted data constitute the creation of a new record under the public records law. This interpretation of the public records law is supported by the regulations promulgated by the supervisor, who is required to adopt regulations to implement the public records law. Plymouth Dist., 484 Mass. 260, 275 (2020). The City is further advised that 950 C.M.R. 32.07(1)(f) also provides that “furnishing a segregable portion of a public record shall not be deemed to be creation of a new record. This applies to a responsive record in the form of an extract of existing data, as such data exists at the time of the request and is segregable from nonresponsive and exempt data.” Consequently, the City must clarify whether the requested records can be extracted. Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n).

Seah Levy SPR25/0742 Page 4 March 31, 2025 Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. In its March 13th response, the City argues the following under Exemption (n): The City additionally denies your request for the above items pursuant to G.L. c. 4 §7(26)(n), as the release of this information would compromise the City’s cybersecurity. Knowing what query a script performs, and why it is performed, can reveal information about the source of the data. This information can include the name of a server or database or other information about the query, which would enable a bad actor to attack the City’s underlying systems. Similarly, knowing the language used in a script to extract or transform data can inform a bad actor on methods to seek out vulnerabilities of that programming language in order to carry out an attack. Furthermore, the structure of a database and/or the method used to extract data from that database is information that could allow data to be manipulated or compromised, which endangers public safety. The City therefore denies your request for information regarding the structure of the City’s databases. Based on the City’s response, it is unclear how the requested records, in their entirety, resemble the records listed as examples in the statute. See PETA, 477 Mass. at 289. Particularly, it is not clear how the records resemble “blueprints, plans, policies, procedures and schematic drawings” that relate to security measures. It is also uncertain how the records are the type that “a terrorist would find useful to maximize damage” as required under Exemption (n). Where the requested records bear a minimal resemblance to the categories listed in Exemption (n), the burden on the custodian to prove its “reasonable judgment” that disclosure is likely to jeopardize public safety is greatest. See id. at 290 (noting “inverse correlation” between the two prongs of Exemption (n) inquiry). Further, the City did not provide factual heft to support the withholding

Seah Levy SPR25/0742 Page 5 March 31, 2025 of the requested records pursuant to Exemption (n). Specifically, the City has not sufficiently explained how disclosure of the records is likely to jeopardize public safety or cyber security. See PETA, at 289-90. The City must clarify these matters. Further, although portions of the records may fall under Exemption (n), it is unclear how the records can be withheld in their entirety. The City must explain whether the records can be redacted so that segregable portions can be provided. See Reinstein, 378 Mass. at 289-90 (the statutory exemptions are narrowly construed and are not blanket in nature). Any nonexempt, segregable portion of a public record is subject to mandatory disclosure. G. L. c. 66, § 10(a). Conclusion Accordingly, the City is ordered to provide Mr. Hawkinson with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Sincerely, Manza Arthur Supervisor of Records cc: John Hawkinson