Beau Barber v. Nantucket, Town of (SPR 20250760)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records April 2, 2025 SPR25/0760 Maureen K. Coleman Records Access Officer Town of Nantucket 16 Broad Street Nantucket, MA 02554 Dear Ms. Coleman: I have received the petition of Beau Barber appealing the response of the Town of Nantucket (Town) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On January 19, 2025, Mr. Barber requested the following: Munis Program Activity Logs for all Munis users in the following departments- Finance Administration DPW Public Schools Health Natural Resources Water Airport On January 21, 2025, Mr. Barber modified the request to “add [a named individual] from the Nantucket Police Department to the requested MUNIS user program data list.” The Town responded on March 18, 2025, and assigned reference number TON-28-2025 to this request. Unsatisfied with the Town’s response, Mr. Barber petitioned this office, and this appeal, SPR25/0760, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Maureen K. Coleman SPR25/0760 Page 2 April 2, 2025 form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Town’s March 18th Response In its March 18, 2025 response, the Town states that “[it] is withholding the requested MUNIS reports regarding specific users,” and further states that “[it] will not provide the requested voluminous MUNIS data regarding multiple Town Departments pursuant to the provisions of G.L. c. 4, §7, clause 26 (n).” Current Appeal In his appeal petition, Mr. Barber argues the following: These records were already provided to me in the same format as a request made in August of 2024. The request was for MUNIS Program Activity Logs for MUNIS users for Police, Fire, and Sewer Departments. This presents no security risk to the Town of Nantucket and only shows a record of the ... Town’s ERP (MUNIS) user activity. Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security.

Maureen K. Coleman SPR25/0760 Page 3 April 2, 2025 G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. In its March 18th response, under Exemption (n), the Town argues the following: Specifically, the Town has reviewed your request and after its careful review, the Town will not provide the requested voluminous MUNIS data regarding multiple Town Departments pursuant to the provisions of G.L. c. 4, §7, clause 26 (n). . . . Exemption (n) provides a records custodian with the ability to withhold documents from public disclosure, where, in the custodian’s judgment, public disclosure is likely to jeopardize cyber security. In evaluating Exemption (n), the SJC has looked to two criteria: first, the degree to which the records at issue are the types of records enumerated in Exemption (n); and second, the “factual and contextual support” for the records custodian’s conclusion that disclosure of the records is likely to jeopardize such safety considerations. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass 280, 289-290 (2017). Here, based on the reasonable judgment of the Town, it has determined in its discretion that the public disclosure of such information, as currently requested could jeopardize and implicate cyber security concerns by providing detailed information regarding multiple Town Departments, its users, the programs for which numerous individuals have access, and the specific history of the data permissions that they can work in.

Maureen K. Coleman SPR25/0760 Page 4 April 2, 2025 Based on the Town’s response, it is unclear how the requested “MUNIS reports” resemble the records listed as examples in the statute. See PETA, 477 Mass. at 289. Particularly, it is not clear how the “MUNIS reports” resemble “blueprints, plans, policies, procedures and schematic drawings” that relate to security measures. It is also uncertain how the records are the type that “a terrorist would find useful to maximize damage” as required under Exemption (n). Where the requested records bear a minimal resemblance to the categories listed in Exemption (n), the burden on the custodian to prove its “reasonable judgment” that disclosure is likely to jeopardize public safety is greatest. See id. at 290 (noting “inverse correlation” between the two prongs of Exemption (n) inquiry). Further, the Town did not provide factual heft to support the withholding of the requested records pursuant to Exemption (n). Specifically, the Town has not sufficiently explained how disclosure of the records is likely to jeopardize public safety or cyber security. See PETA, at 289-90. The Town must clarify these matters. Conclusion Accordingly, the Town is ordered to provide Mr. Barber with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Sincerely, Manza Arthur Supervisor of Records cc: Beau Barber