Tom Shea v. Hampden County Regional Retirement Board (SPR 20252171)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records August 5, 2025 SPR25/2171 Karen P. Martin Executive Director Hampden County Regional Retirement Board 67 Hunt Street, Suite 202 Agawam, MA 01001 Dear Ms. Martin: I have received the petition of Tom Shea appealing the response of the Hampden County Regional Retirement Board (Board/HCRBR) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On February 16, 2025, Mr. Shea requested “…HCRBR assigned email addresses of the HCRBR Board Members.” Previous Appeals This request was the subject of previous appeals. See SPR25/0714 Determination of the Supervisor of Records (March 25, 2025) and SPR25/1716 Determination of the Supervisor of Records (June 27, 2025). In my June 27th determination, I found that the Board had not met its burden to withhold the requested email addresses under Exemptions (b) and (n) of the Public Records Law and ordered it to provide Mr. Shea with a further response. The Board responded on July 14, 2025. Unsatisfied with the Board’s response, Mr. Shea petitioned this office and this appeal, SPR25/2171, was opened as a result. While this appeal was pending, the Board provided a supplemental response on July 25, 2025. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832 • Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Karen P. Martin SPR25/2171 Page 2 August 5, 2025 It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response, a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Board’s July 14th Response In its July 14, 2025 response, the Board cited Exemptions (b) and (n) of the Public Records Law to continue withholding the responsive email addresses. Current Appeal In his appeal petition, Mr. Shea stated, “[t]he HCRBR has not complied with your decision requiring it to provide me the HCRBR email addresses of the board members… [The Board] has defied your order of June 27…” Exemption (b) Exemption (b) permits the withholding of records that are: related solely to internal personnel rules and practices of the government unit, provided however, that such records shall be withheld only to the extent that proper performance of necessary governmental functions requires such withholding G. L. c. 4, § 7(26)(b). There are no authoritative Massachusetts decisions interpreting Exemption (b). The general purpose of the cognate federal exemption is to relieve agencies of the burden of assembling and maintaining for public inspection materials in which the public cannot reasonably be expected to have an interest. See Dep’t of the Air Force v. Rose, 425 U.S. 352, 362-70 (1976) (interpreting the federal Freedom of Information Act, which provides an exemption for records which are “related solely to the internal personnel rules and practices of an agency”); see also Globe Newspaper Co. v. Boston Ret. Bd., 388 Mass. 427, 432 (1983) (Massachusetts Public Records Law modeled on federal Freedom of Information Act). The courts have interpreted the federal exemption to allow withholding of materials that, if released, could cause agency rules or regulations to be circumvented. See Fiumara v. Higgins,

Karen P. Martin SPR25/2171 Page 3 August 5, 2025 572 F. Supp. 1093, 1102 (1983) (internal codes are exempt where disclosure may enable outsiders to circumvent agency functions). The analysis employed by the federal courts requires a two-pronged test. Material is exempt if it is predominantly used internally and if disclosed would significantly risk circumvention of agency regulations and statutes. See Marrera v. United States Dep’t of Justice, 622 F. Supp. 51, 55 (D.D.C. 1985) (Bureau of Prisons access and identity codes were properly withheld as materials in which the public would have no legitimate interest or which would compromise security if disclosed). In its July 14, 2025 response under Exemption (b), the Board stated, “[t]he email addresses are solely for internal purposes and not used for anything else and are connected to the user’s personal phones and home laptops… [W]e suggest you use our established Communication Policy guidelines and send emails to whom you wish through our director… Simply address email to [the director], and to the appropriate board member’s attention since we have the protection for our office devices through our internal controls and security systems.” In its supplemental responses on July 25, the Board stated, “[y]ears ago, we used the Board member’s personal email addresses but realized the vulnerability of that and changed to an internal office system with firewalls and cyber security programs.” Although the Board states that the email addresses are solely for internal purposes, the Board has not demonstrated how the email addresses relate solely to internal personnel rules and practices of the government unit. The Board has also not established how disclosure of the email addresses would hinder the proper performance of necessary governmental functions. Consequently, the Board has not met its burden of specificity to withhold the responsive email addresses under Exemption (b). Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically,

Karen P. Martin SPR25/2171 Page 4 August 5, 2025 the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. In its July 14, 2025 response under Exemption (n), the Board stated, “[t]he HCRRB does not safeguard or provide cyber security measures on their personal devices. At HCRRB, we do have sufficient internal controls and firewalls to possibly protect from incoming cyber threats and security issues.… I am enclosing the reports of numerous cyber problems throughout the State to illustrate my point and the ongoing threats.” In its supplemental response on July 25, 2025, a Board official stated: I am responsible for approximately $580,410,000.00 in retirement funds as the Treasurer of the HCRRB. We have safeguards against cyber theft and malware insertions on our systems, which is why I feel that channeling emails through our system via our established communication policy is a plausible solution for Mr. Shea… Since there are so many hackers out there that can insert malware into emails, we feel we need to try to keep our employees and board members somewhat protected from identity theft, spoofing, hacking, and trojan malware or viruses in any way we can. Years ago, we used the Board member’s personal email addresses but realized the vulnerability of that and changed to an internal office system with firewalls and cyber security programs. Based on the Board’s responses, it is unclear how the requested email addresses resemble the records listed as examples in the statute. See PETA, 477 Mass. at 289. Particularly, it is not clear how the records resemble “blueprints, plans, policies, procedures and schematic drawings” that relate to security measures. It is also uncertain how the records are the type that “a terrorist would find useful to maximize damage” as required under Exemption (n). Where the requested records bear a minimal resemblance to the categories listed in Exemption (n), the burden on the custodian to prove its “reasonable judgment” that disclosure is likely to jeopardize public safety is greatest. See id. at 290 (noting “inverse correlation” between the two prongs of Exemption (n) inquiry). Further, the Board did not provide factual heft to support the withholding of the

Karen P. Martin SPR25/2171 Page 5 August 5, 2025 requested records pursuant to Exemption (n). Specifically, the Board has not sufficiently explained how disclosure of the email addresses is likely to jeopardize public safety or cyber security. See PETA, at 289-90. As a result, the Board has not met its burden to withhold the responsive email addresses under Exemption (n). Conclusion Accordingly, the Board is ordered to provide Mr. Shea with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Mr. Shea may appeal the substantive nature of the Board’s response within ninety (90) days. See 950 C.M.R. 32.08(1). Sincerely, Manza Arthur Supervisor of Records cc: Tom Shea