Jonathan Gerhardson v. Chicopee, City of - Police Department (SPR 20252027)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records July 28, 2025 SPR25/2027 Officer Berit Bjerkadal Chicopee Police Department Records Access Officer 110 Church Street Chicopee, MA 01020 Dear Officer Bjerkadal: I have received the petition of Jonathan Gerhardson appealing the response of the Chicopee Police Department (Department) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On July 1, 2025, Mr. Gerhardson requested “records relating to the configuration, settings, metadata, and data from all network cameras manufactured by Axis Communications (‘Axis cameras’) in the department’s possession, as well as any associated analytical applications.” Specifically, Mr. Gerhardson sought: [1] Device Inventory[:] A complete inventory of all Axis cameras in use. For each camera, please provide: - The Model Number (e.g., AXIS P3717-PLE, AXIS P1465-LE, etc.). - The installed AXIS OS version. - The assigned Hostname or device label. - The general Device location (e.g., street intersection or neighborhood). [2] Camera Configuration Files[:] The complete configuration file for each camera. On many Axis devices, this is referred to as the “Plain config” file. This is the preferred format for the data requested in Section 3. [3] General Camera Configuration Settings[:] For each camera, please provide records reflecting the current settings for the following common parameters, where applicable to the model: One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Officer Berit Bjerkadal SPR25/2027 Page 2 July 28, 2025 - Video, Stream, and Image Settings: All configured Stream profiles, including Resolution, Frame rate, Compression, and Zipstream strength. - Image Enhancement: Wide Dynamic Range (WDR) settings and Day-night mode thresholds. - Privacy and Overlays: All configured Privacy masks and text/image Overlays. - Event Rules: A list of all configured Rules, including the Conditions that trigger an action and the corresponding Actions. - Storage and Audio: The configured Retention time for all storage and records indicating if “Include audio” is enabled. [4] Installed Applications and Associated Data A. A list of all installed AXIS Camera Application Platform (ACAP) applications on each camera (e.g., AXIS License Plate Verifier, AXIS Object Analytics, etc.). B. For each camera running the AXIS License Plate Verifier application, please provide the following additional records: - Application Configuration File: The application-specific configuration backup file, generated as a JSON file via the “Backup configuration” function. - License Plate Lists: A complete export, in .csv format, of all license plates contained in the “Allowlist” and “Blocklist.” This should include the license plate number and any associated Description or Schedule information. - Event Log: A complete export of the “Event log” from the last 90 days, in .csv format. Application Settings: Records reflecting the chosen operational mode (“Free flow” or “Access control”), event storage rules, detection parameters (Sensitivity, Allowed character deviation, Strict matching), and any configured Integration settings for pushing event data to external servers. The Department responded on July 11, 2025. Unsatisfied with the Department’s response, Mr. Gerhardson petitioned this office and this appeal, SPR25/2027, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26).

Officer Berit Bjerkadal SPR25/2027 Page 3 July 28, 2025 It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Department’s July 11th Response In its July 11, 2025 response, regarding Item 1 of the request, the Department provided “records denoting the model numbers and general device location of all Axis cameras in use by the department,” but stated “…the cameras do not have assigned hostnames or device labels and therefore the department does not have possession, custody, or control of any such record[.]” The Department also stated that it intends to withhold records pertaining to the version of the Axis OS (operating system) installed on the cameras pursuant to Exemption (n) of the Public Record Law. Regarding Items 2, 3, and 4 of the request, the Department stated, “[t]he Chicopee Police Department does not have possession, custody, or control of any such record…” Current Appeal In his appeal petition, Mr. Gerhardson stated, “CPD’s claim that it does not have possession of these records is false.” Mr. Gerhardson also argued that Exemption (n) is not applicable to the withheld records. In a telephone conversation between the Department and this office on July 17, 2025, the Department confirmed that it does not possess any “hostname or device label” responsive to Item 1, nor does it possess any records responsive to Items 2, 3, or 4 of the request. Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public

Officer Berit Bjerkadal SPR25/2027 Page 4 July 28, 2025 records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. Under Exemption (n), the Department stated: The Chicopee Police Department intends to withhold the OS (operating system) version installed on the cameras because it is the department’s belief that public disclosure of such information would constitute a breach of facility security. Operating systems are complex networks that manage all hardware and software of a device including memory, processes, and user applications. The OS relies on a device’s firmware to interact with the hardware as well as perform basic tasks. Knowledge of the OS version utilized by department operated cameras would provide insights into the architecture of the device’s software and the components that make up the camera system as well as reveal the structure of the firmware enabling anyone to access and exploit the vulnerabilities that exist within it. Item 1 (Operating System) Based on the Department’s response, although the requested operating system version may resemble the records listed as examples in the statute, the Department has not demonstrated that the records are the type that “a terrorist would find useful to maximize damage” as required under Exemption (n). Further, the Department did not provide sufficient factual heft to conclude that a reasonable person would agree that disclosure of the records is “likely to jeopardize public

Officer Berit Bjerkadal SPR25/2027 Page 5 July 28, 2025 safety or cybersecurity,” as required by Exemption (n). The Department must clarify these matters. Item 1 (Hostname/Device Label) and Items 2, 3, and 4 Regarding the “hostname or device label” requested in Item 1, as well as the requested records under Items 2, 3, and 4, please be advised that under the Public Records Law a custodian is not required to create a record in response to a public records request. See G. L. c. 66, § 6A(d). In addition, a public employee is not required to answer questions, or do research, or create documents in response to questions. See 32 Op. Att’y Gen. 157, 165 (May 18, 1977). Further, the duty to comply with requests for records extends to those records that exist and are in the possession, custody, or control of the custodian of records at the time of the request. See G. L. c. 66, § 10(a)(ii). Given that the Department has confirmed that it possesses no records responsive to the “hostname or device label” request under Item 1, nor does it possess records responsive to Items 2, 3, or 4 of Mr. Gerhardson’s request, and this office has no authority to compel the Department to create records, I find that this portion of Mr. Gerhardson’s appeal is resolved. Conclusion Accordingly, the Department is ordered to provide Mr. Gerhardson with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Mr. Gerhardson may appeal the substantive nature of the Department’s response within ninety (90) days. See 950 C.M.R. 32.08(1). Sincerely, Manza Arthur Supervisor of Records cc: Jonathan Gerhardson