John Hawkinson v. Cambridge, City of - Office of the City Solicitor (SPR 20251085)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records May 5, 2025 SPR25/1085 Seah Levy Public Records Access Officer City of Cambridge Office of the City Solicitor 795 Massachusetts Avenue Cambridge, MA 02139 Dear Ms. Levy: I have received the petition of John Hawkinson appealing the response of the City of Cambridge (City) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On February 27, 2025, Mr. Hawkinson requested the following: Could you please produce any records the city has regarding the subject ETLs (those that produce the “Building Permits: New Construction” and “Building Permits: Addition/Alteration” datasets). That include: [1] Records of when these ETLs were created and modified [2] Records of what language(s) these scripts are written in [3] Records of what queries these scripts perform [4] Records of the file names and file sizes of the ETL scripts — how much are we talking about here? The City assigned reference number P250384-022725 to this request. Previous Appeal This request was the subject of a previous appeal. See SPR25/0742 Determination of the Supervisor of Records (March 31, 2025). In my March 31st determination, I ordered the City to clarify whether responsive records could be extracted, and to clarify its claims under Exemption (n) for withholding responsive records. Subsequently, the City responded on April 14, and April 18, 2025. Unsatisfied with the City’s responses, Mr. Hawkinson petitioned this office, and this appeal, SPR25/1085, was opened as a result. Subsequent to the opening of this appeal, the City provided a further response to Mr. Hawkinson and this office on May 1, 2025. In an email to the One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Seah Levy SPR25/1085 Page 2 May 5, 2025 City and this office on the same day, Mr. Hawkinson objected to the City’s further response. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The City’s May 1st Response In its May 1, 2025 response, the City indicates that it will provide additional records responsive to Items 1 and 4 of the request, and cites Exemption (n) of the Public Records Law for withholding records responsive to Items 2 and 3. See G. L. c. 4, § 7(26)(n). Items 1 and 4 In its May 1st response, the City states the following regarding Items 1 and 4 of the request: Regarding item 1 of the Request, “Records of when these ETLs were created and modified,” the City has located records it believes to be responsive; and will provide this record within ten (10) business days. This record will be in the form of a newly instituted log, and as such will provide accurate information regarding recent modifications to the scripts in question. Regarding item 4 of the request, “Records of the file names and file sizes of the ETL scripts,” this information will be provided within the same record to be produced in response to item 1 of the request. The City is advised that G. L. c. 66, § 10(b) provides, in pertinent part, that if the magnitude or difficulty of a request unduly burdens the other responsibilities of the agency or

Seah Levy SPR25/1085 Page 3 May 5, 2025 municipality such that the agency or municipality cannot provide records within 10 business days, the agency or municipality must inform the requestor in writing within 10 business days. With respect to the timeframe to produce responsive records, the written response shall: identify a reasonable timeframe in which the agency or municipality shall produce the public records sought; provided, that ... for a municipality the timeframe shall not exceed 25 business days following the initial receipt of the request for public records; and provided further, that the requestor may voluntarily agree to a response date beyond the timeframes set forth herein. G. L. c. 66, § 10(b)(vi). Where Mr. Hawkinson submitted his request on February 27, 2025, and the City has not provided records responsive to Items 1 and 4 of the request, I find the City has not met its burden in responding to these Items of the request in accordance with G. L. c. 66, § 10(b). Consequently, the City must provide an estimated date as to when it intends to complete the search and provide the responsive records. See G. L. c. 66, § 10(a) (records must be provided without unreasonable delay). To the extent possible, the City must provide responsive records on a rolling basis. Item 2 Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017).

Seah Levy SPR25/1085 Page 4 May 5, 2025 The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. In its May 1st response, regarding Item 2 of the request, the City argues the following: Regarding item 2 of the request, “Records of what language these scripts were written in,” the City reiterates its denial on the basis that responding to this would be answering a question, “i.e.: What language was used to create this script,” or the creation of a new record. Additionally, the information requested is exempt pursuant to Exemption 7(26)(n) of the Public Records law. . . . The Request asks for the disclosure of the language used to create the software which would directly jeopardize the City’s cyber security, squarely falling within the protection of Exemption (n) (exempting “records . . . the disclosure of which . . . is likely to jeopardize . . . cyber security.”). The Request requires the City to produce the software language of its building permit software. A hacker or programmer with knowledge of the specific software language utilized by an organization enables them to determine the best ways to probe and attack the City’s data system security, making it vulnerable to disruption, infiltration, and data theft. ... With knowledge of the specific programing language, the hacker or attacker can orchestrate a particular attack upon the City’s system, and in fact, the federal government has warned against using certain programming languages due to specific cyber-attack vulnerabilities that are well known. ... Each programming language contains strengths and weaknesses with regard to security. ... As such, knowing what specific type of software language used by the City’s databases directly jeopardizes the cyber security of the City. Attackers, such as terrorists or other dangerous individuals, could use this knowledge attempt to hack into the City’s databases. Knowing what language(s) the City uses gives significant advantages to attackers, and the City’s computer systems have been and continue to be subject to significant attacks by assailants. In fact, the City’s IT department constantly updates its security protocols, including requiring training by City employees to prevent unauthorized entry and disclosure of information.

Seah Levy SPR25/1085 Page 5 May 5, 2025 The City’s servers contain information which squarely falls into the categories protected by both statutory and Public Records law. On November 13, 2009, Massachusetts passed 201 CMR 17.00, which outlines the standards for the protection of personal information of residents of the Commonwealth. The core goal of this Act was to protect the personal information of the citizens of the Commonwealth. Organizations which handle Massachusetts residents’ personal information, must ensure the confidentiality and security of this data. This personally identifiable information includes, but is not limited to, information such as social security numbers, driver’s license and state issued identification cards, financial account numbers, and other information that could subject residents to identity theft and fraud. The City’s servers system in question contain records, which if hacked, fall directly into the categories protected from disclosure by exemption (n) confidential information about the services provided by the City. Such records include but are not limited to “blueprints, plans . . . which relate to internal structural elements, security measures,” including utility and water line plans servicing large buildings, blueprints of buildings that could be the target of terrorist attacks, and security measures and procedures implemented and carried out by the Police, Fire, and Emergency Communications Department. The City should not be required to disclose the programming language it uses to maintain and operate its computer systems and databases, as maintaining the security of the software utilized by the City is of prime importance for the safety of the City and the general public. Based on the information provided in the City’s May 1st response, the City has explained that the withheld records are related to cyber security, and are the type of record listed under Exemption (n). Further, where the City has explained that the withheld records would provide information on how to “probe and attack the City’s data system security,” I find the City has met its burden to withhold the responsive records pursuant to Exemption (n). Item 3 In its May 1st response, with regard to Item 3 of the request, the Town argues the following: Regarding item 3 of the request, the Requester has asked for: “Records of what queries these scripts perform.” The City previously denied the Requester’s request for the ETL scripts themselves, pursuant to SPR Bulletin 3-96, which defines software as a “tool to be used in the processing of data rather than a ‘record” and therefore not subject to mandatory disclosure. The Requester now asks for the underlying information as to what “queries” the script perform. This portion of the request is unclear, and can be interpreted one of two ways. The first interpretation is that item 3 is asking for what data is being produced by these

Seah Levy SPR25/1085 Page 6 May 5, 2025 scripts. Such information is freely available on the City’s Open Data Portal, as each of these scripts provides the information that is provided in the databases which are open and visible to the world, and which data may be easily exported into various formats. As such information is already available to the public, no response to item 3 is necessary. However, to the extent that item 3 for a list of the “queries” performed by the script, or the commands being issued by the ETL scripts, the City must reiterate its denial. There are no individuals performing “Google” searches querying information to create such lists. Instead, the software extracts the information utilizing “queries” that pull data from a database and extract and format that information for a website. As such, the “queries” that the Requester has asked for are once again the underlying code for the software which creates the databases in question. To the extent this is what item 3 is requesting, the City restates its denial on this request, both pursuant to SPR Bulletin 3-96, and pursuant to M.G. L. c. 4 § 7(26)(n). Software is a “tool to be used in the processing of data rather than a ‘record’ and therefore is not subject to mandatory disclosure.” SPR Bulletin 3-96, “Application of the Public Records Law to Electronic Records Access,” June 6, 1996. Additionally, there is no document responsive to Mr. Hawkinson’s request with respect to this interpretation of item 3, other than to produce the actual software code itself, which is not a “document.” On this basis alone, Mr. Hawkinson’s request under item should be denied, as there are no responsive public records. An individual would have to read through the code in order to create a new document, explaining the commands being issued by each line of the code, in order to enumerate the “queries” being carried out by the ETL script. Furthermore, not only would disclosing the underlying software code disclose the software language used, which as explained above is protected from disclosure under exemption (n), but disclosing the underlying code would provide the public, and potentially any terrorist or hackers, the means to determine how best to manipulate the source code and to gain access to the City’s computer systems and databases. Security firms call this “source code disclosure,” which could result in security vulnerabilities discovery, sensitive data exposure, and code manipulation. ... Disclosure of the underlying source code for the City’s software programs undisputably would jeopardize the City’s cyber security, and the safety and security of the public. If the City were required to disclose its source code for its software, databases maintained by the police, fire, water, emergency communications, and other departments with significant vulnerabilities with respect to the City and the public would be in significant jeopardy. In this instance, the source code disclosure would subject the Inspectional Services Department computer systems and databases to potential attack, with disclosure

Seah Levy SPR25/1085 Page 7 May 5, 2025 of sensitive public safety documents, including water and other utility plans, and/or other security or preparedness plans for large buildings in Cambridge. The source code for the City’s software necessarily falls within the protections of exemption (n), and Mr. Hawkinson’s request under Category 3 should be denied. Please be advised that it is permissible for the custodian of records to provide access to records via a website. See G. L. c. 66, § 6A(d) (“If the public record requested is available on a public website ... the records access officer may furnish the public record by providing reasonable assistance in locating the requested record on the public website.”); see also 950 C.M.R. 32.04 (5)(e) (“A records access officer shall ... to the extent feasible, furnish the public records by providing reasonable assistance in locating the records on an appropriately indexed and searchable public website”); 950 C.M.R. 32.07 (2)(a) (“A records access officer shall inform a requester of the availability of records online to avoid delays and fees associated with the provision of public records”). In this case, the City has confirmed that records responsive to Mr. Hawkinson’s request are available on a public website maintained by the City. Consequently, based on the City’s May 1st response, I find that the City has met its burden in responding to Part 3 of the request. Conclusion Accordingly, the City is ordered to provide Mr. Hawkinson with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Mr. Hawkinson may appeal the substantive nature of the City’s response within ninety (90) days. See 950 C.M.R. 32.08(1). Sincerely, Manza Arthur Supervisor of Records cc: John Hawkinson