Tom Shea v. Hampden County Regional Retirement Board (SPR 20251716)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records June 27, 2025 SPR25/1716 Karen P. Martin Executive Director Hampden County Regional Retirement Board 67 Hunt Street, Suite 202 Agawam, MA 01001 Dear Ms. Martin: I have received the petition of Tom Shea appealing the response of the Hampden County Regional Retirement Board (Board/HCRBR) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On February 16, 2025, Mr. Shea requested “…HCRBR assigned email addresses of the HCRBR Board Members.” Previous Appeal This request was the subject of a previous appeal. See SPR25/0714 Determination of the Supervisor of Records (March 25, 2025). In my March 25th determination, I closed SPR25/0714 in light of the Board providing a response on March 17, 2025. Unsatisfied with the Board’s response, Mr. Shea petitioned this office and this appeal, SPR25/1716, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Karen P. Martin SPR25/1716 Page 2 June 27, 2025 must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Board’s March 17th Response In its March 17, 2025 response, the Board cited Exemptions (b) and (n) of the Public Records Law to withhold the responsive email addresses. In addition, the Board stated: ...We at the HCRRB, have a long history with Mr. Shea and crafted a Communication Policy in part to deal with his harassment… Mr. Shea was constantly emailing our attorney questions that could have been answered by our Director or myself. The attorneys who were relatively new, were just doing their job, but it cost us almost two thousand dollars in legal fees to answer his questions. Which is why the policy was put in place, approved and accepted by [an identified individual] of PERAC. We recently had an election and now have two new board members. The board members meet about two hours each month at the HCRRB office. Their limited amount of knowledge of the total workings of the retirement board is also why we have a communication policy. Under this policy all questions, comments, or correspondences go to the communication officer. Current Appeal In his appeal petition, Mr. Shea states: Exemption B is not applicable. The email addresses are public records... They are not “solely” for internal purposes of the HCRBR. I’ll also note that proper performance of the HCRBR does not require such withholding. The HCRBR “Communication Policy” has no bearing on the statutory rights under the Public Record Laws… Exception N is not applicable… The email addresses are public record. My having them does not constitute any security or cyber threat… The HCRBR should have sufficient internal controls and firewalls that the simple knowledge of an email address should not pose a security or Cyber Threat… In support of his appeal petition, Mr. Shea provided the following supplemental information on June 17, 2025:

Karen P. Martin SPR25/1716 Page 3 June 27, 2025 The denial of my request does not fit Exemption N. The exception is for written documents such as blueprints, policies and procedures relating to structures, security or vulnerability assessments as well as cyber security… [I] am not asking for any of the items mentioned… I have requested email addresses which have no association with security or cybersecurity documents, policies, procedures and plans etc. Exemption (b) Exemption (b) permits the withholding of records that are: related solely to internal personnel rules and practices of the government unit, provided however, that such records shall be withheld only to the extent that proper performance of necessary governmental functions requires such withholding G. L. c. 4, § 7(26)(b). There are no authoritative Massachusetts decisions interpreting Exemption (b). The general purpose of the cognate federal exemption is to relieve agencies of the burden of assembling and maintaining for public inspection materials in which the public cannot reasonably be expected to have an interest. See Dep’t of the Air Force v. Rose, 425 U.S. 352, 362-70 (1976) (interpreting the federal Freedom of Information Act, which provides an exemption for records which are “related solely to the internal personnel rules and practices of an agency”); see also Globe Newspaper Co. v. Boston Ret. Bd., 388 Mass. 427, 432 (1983) (Massachusetts Public Records Law modeled on federal Freedom of Information Act). The courts have interpreted the federal exemption to allow withholding of materials that, if released, could cause agency rules or regulations to be circumvented. See Fiumara v. Higgins, 572 F. Supp. 1093, 1102 (1983) (internal codes are exempt where disclosure may enable outsiders to circumvent agency functions). The analysis employed by the federal courts requires a two-pronged test. Material is exempt if it is predominantly used internally and if disclosed would significantly risk circumvention of agency regulations and statutes. See Marrera v. United States Dep’t of Justice, 622 F. Supp. 51, 55 (D.D.C. 1985) (Bureau of Prisons access and identity codes were properly withheld as materials in which the public would have no legitimate interest or which would compromise security if disclosed). In its March 17, 2025 response, the Board stated, “I feel under Exemption (b) that the emails of board members are solely for internal personnel practices of the government entity. These board members relate solely to the internal workings of the board.” In this case, the Board has not demonstrated how the requested email addresses are solely related to internal personnel rules and practices of the government unit. Additionally, the Board has not established how disclosure of the email addresses would hinder the proper performance

Karen P. Martin SPR25/1716 Page 4 June 27, 2025 of necessary governmental functions. Consequently, the Board has not met its burden of specificity to withhold the responsive email addresses under Exemption (b). Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. In its response, under Exemption (n), the Board stated: I believe reasons under Exemptions (n) applies because of security-related measures and cyber security measures. This exemption allows for the withholding of certain records which, if released, will likely jeopardize cyber security. My

Karen P. Martin SPR25/1716 Page 5 June 27, 2025 email was recently used in spoofing. The person tried to use my email address to steal $24,000,000 out of our account and redirect to another account. Based on the Board’s response, it is unclear how the requested email addresses resemble the records listed as examples in the statute. See PETA, 477 Mass. at 289. Particularly, it is not clear how the records resemble “blueprints, plans, policies, procedures and schematic drawings” that relate to security measures. It is also uncertain how the records are the type that “a terrorist would find useful to maximize damage” as required under Exemption (n). Where the requested records bear a minimal resemblance to the categories listed in Exemption (n), the burden on the custodian to prove its “reasonable judgment” that disclosure is likely to jeopardize public safety is greatest. See id. at 290 (noting “inverse correlation” between the two prongs of Exemption (n) inquiry). Further, the Board did not provide factual heft to support the withholding of the requested records pursuant to Exemption (n). Specifically, the Board has not sufficiently explained how disclosure of the email addresses is likely to jeopardize public safety or cyber security. See PETA, at 289-90. As a result, the Board has not met its burden to withhold the requested records under Exemption (n). Conclusion Accordingly, the Board is ordered to provide Mr. Shea with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Mr. Shea may appeal the substantive nature of the Board’s response within ninety (90) days. See 950 C.M.R. 32.08(1). Sincerely, Manza Arthur Supervisor of Records cc: Tom Shea