Stecklow, Sam v. Department of Criminal Justice Information Services (SPR 20260194)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records February 4, 2026 SPR26/0194 Agapi Koulouris, Esq. General Counsel Department of Criminal Justice Information Services 200 Arlington Street, Suite 2200 Chelsea, MA 02150 Dear Attorney Koulouris: I have received the petition of Sam Stecklow, of Invisible Institute, appealing the response of the Department of Criminal Justice Information Services (DCJIS) to a request for public records. See G. L. c. 66, § 10A; see also 950 C.M.R. 32.08(1). On October 19, 2025, Mr. Stecklow requested, “... copies of any electronic datasets maintained by the MDCJIS sufficient to show all ORI [Originating Agency Identifier] numbers that have been issued for MA agencies by the FBI. The MDCJIS is the CJIS Services Agency in MA that interfaces between individual agencies seeking ORI numbers and the FBI, which grants them.” DCJIS responded on November 5, 2025 and November 17, 2025. Unsatisfied with the responses, Mr. Stecklow petitioned this office and this appeal, SPR26/0194, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Agapi Koulouris, Esq. SPR26/0194 Page 2 February 4, 2026 must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. Current Appeal In his appeal, Mr. Stecklow states, “I write now to ask the Secretary of State’s office’s assistance in reviewing this matter. As I also explained to DCJIS, several other peer CSAs make this information affirmatively public, in addition to the outdated listing on the DOJ’s website. DCJIS did not provide any formal designation of these numbers from the FBI as classified. Further, the exemption relied upon by DCJIS hinges on the records custodian making a ‘reasonable judgment’ that the release of the records ‘is likely to jeopardize public safety or cyber security’. DCJIS has made no such showing.” DCJIS’ November 5th and November 17th Responses In its November 5, 2025 response, DCJIS stated, “[t]he ORI numbers you have requested are issued by the FBI upon submission of a completed and approved request by a criminal justice agency. Since these numbers are not issued by DCJIS itself, we must contact the FBI to determine how it classifies this type of information. Additional time is needed to review your request. DCJIS will provide a follow up response as soon as additional information is available.” In its November 17, 2025 response, DCJIS cites Exemption (n) of the Public Records Law to withhold the requested records. Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security. G. L. c. 4, § 7(26)(n).

Agapi Koulouris, Esq. SPR26/0194 Page 3 February 4, 2026 Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist would find useful to maximize damage.” PETA, 477 Mass. at 289-90. The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[because the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA, at 290. In its response, DCJIS asserted as follows: DCJIS received a reply from the FBI. DCJIS was informed that the ORI numbers are law enforcement sensitive information/techniques that can be used to query the Criminal Justice Information System. Accordingly, DCJIS asserts that the ORI numbers are exempt from public disclosure pursuant to M.G.L. c. 4, § 7 clause 26(n) as, “…records…which relate to the internal layout and structural elements, security measures, emergency preparedness, threat, or vulnerability assessments, or any other records relating to…cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgement of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize public safety or cyber security.” For this reason, DCJIS is prohibited from disclosing the ORI numbers, issued by the FBI, that you have requested. Based on the DCJIS’ response, it is unclear how the requested records resemble the types of records listed in the statute, nor how the information is one a terrorist would find useful to maximize damage. PETA, 477 Mass. at 289. Where the records bear little resemblance to the types listed in the statute, the burden on the custodian is correspondingly at its highest. See id. at 290-91. Further, I find that DCJIS has not provided “sufficient factual heft” to conclude that a reasonable person would agree that disclosure of the records is “likely to jeopardize public safety or cyber security” as required by Exemption (n). Id. at 290-91. DCJIS must clarify these matters.

Agapi Koulouris, Esq. SPR26/0194 Page 4 February 4, 2026 Conclusion Accordingly, DCJIS is ordered to provide Mr. Stecklow with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Mr. Stecklow may appeal the substantive nature of DCJIS’ response within ninety (90) days. See 950 C.M.R. 32.08(1). Sincerely, Manza Arthur Supervisor of Records cc: Sam Stecklow