Reilly, Judith v. Executive Office of Housing and Livable Communities (SPR 20261351)

The Commonwealth of Massachusetts William Francis Galvin, Secretary of the Commonwealth Public Records Division Manza Arthur Supervisor of Records April 27, 2026 SPR26/1351 Adrian Walleigh, Esq. Counsel and Records Access Officer Executive Office of Housing and Livable Communities 110 Cambridge Street, Suite 300 Boston, MA 02114 Dear Attorney Walleigh: I have received the petition of Judith Reilly appealing the response of the Executive Office of Housing and Livable Communities (Office/EOHLC) to a request for public records. See G. L. c. 66 § 10A; see also 950 C.M.R. 32.08(1). On December 1, 2025, Ms. Reilly requested, “copies of all correspondence, paper or electronic, to or from the EOHLC relating to a fraud allegedly perpetrated against the Salem Housing Authority on or about September 12, 2025. Reportedly, the total fraud amount was $246,337.85.” Previous Appeals This request was the subject of previous appeals. See SPR26/0428 Determination of the Supervisor of Records (February 19, 2026) and SPR26/0712 Determination of the Supervisor of Records (March 13, 2026). In my March 13th determination, I ordered the Office to clarify how the responsive records could be redacted under Exemptions (a), (d), (f), (n) of the Public Records Law and attorney-client privilege. The Office provided a response on April 2, 2026. Unsatisfied with the Office’s responses, Ms. Reilly petitioned this office and this appeal, SPR26/1351, was opened as a result. The Public Records Law The Public Records Law strongly favors disclosure by creating a presumption that all governmental records are public records. G. L. c. 66, § 10A(d); 950 C.M.R. 32.03(4). “Public records” is broadly defined to include all documentary materials or data, regardless of physical form or characteristics, made or received by any officer or employee of any agency or municipality of the Commonwealth, unless falling within a statutory exemption. G. L. c. 4, § 7(26). One Ashburton Place, Room 1719, Boston, Massachusetts 02108 • (617) 727-2832• Fax: (617) 727-5914 sec.state.ma.us/pre • pre@sec.state.ma.us

Adrian Walleigh, Esq. SPR26/1351 Page 2 April 27, 2026 It is the burden of the records custodian to demonstrate the application of an exemption in order to withhold a requested record. G. L. c. 66, § 10(b)(iv); 950 C.M.R. 32.06(3); see also Dist. Attorney for the Norfolk Dist. v. Flatley, 419 Mass. 507, 511 (1995) (custodian has the burden of establishing the applicability of an exemption). To meet the specificity requirement a custodian must not only cite an exemption, but must also state why the exemption applies to the withheld or redacted portion of the responsive record. If there are any fees associated with a response a written, good faith estimate must be provided. See G. L. c. 66, § 10(b)(viii); see also 950 C.M.R. 32.07(2). Once fees are paid, a records custodian must provide the responsive records. The Office’s April 2nd Response In its April 2, 2026 response, the Office cited Exemptions (c), (d), (f), and (n) of the Public Records Law, as well as the attorney-client privilege and common interest doctrine in support of the redactions made to the requested records. See G. L. c. 4, § 7(26)(c), (d), (f), (n). Current Appeal In her April 12, 2026 petition to this office, Ms. Reilly objected to the redactions made pursuant to Exemptions (c), (d), (f), and (n), and attorney-client privilege and common interest doctrine. Exemption (c) Exemption (c) applies to: personnel and medical files or information and any other materials or date relating to a specifically named individual, the disclosure of which may constitute an unwarranted invasion of personal privacy; provided, however, that this subclause shall not apply to records related to a law enforcement misconduct investigation G. L. c. 4, § 7(26)(c). First Clause – Medical and Personnel Medical information that is of a personal nature and relates to a specifically named individual may be exempt from disclosure. Brogan v. Sch. Comm. of Westport, 401 Mass. 306, 308 (1987); Globe Newspaper Co. v. Boston Ret. Bd., 388 Mass. 427, 438 (1983). Generally, medical information is sufficiently personal to warrant exemption. Globe Newspaper Co., 338 Mass. at 432-34. There is a strong public policy in Massachusetts that favors confidentiality as to medical data about a person’s body. Globe Newspaper Co. v. Chief Med. Exam’r, 404 Mass. 132, 135 (1987).

Adrian Walleigh, Esq. SPR26/1351 Page 3 April 27, 2026 While statutorily exempting personnel information from the expansive definition of public records, the Legislature did not explicitly define “personnel [file] or information.” G. L. c. 4, § 7(26)(c). Judicial decisions advise that the term is neither rigid, nor exact, and that the determination is case-specific. Worcester Telegram & Gazette Corporation v. Chief of Police of Worcester, 58 Mass. App. Ct. 1, 5 (2003). The custodian’s classification of materials as “personnel information” is not conclusive. Wakefield Teacher’s Ass’n v. Sch. Comm. of Wakefield, 431 Mass. 792, 798 (2000). Instead, the nature or character of the documents, as opposed to the documents’ label, is crucial to the analysis. See Worcester Telegram & Gazette Corp., 436 Mass. at 386. The Massachusetts Supreme Judicial Court (Court) has refined the analysis to be employed when considering the public record status of personnel records. The Court has held that personnel information that is “useful in making employment decisions regarding an employee” may be withheld pursuant to the first clause of exemption (c). Wakefield Teacher’s Ass’n, 431 Mass. at 798, quoting Oregonian Publ. Co.v. Portland Sch. Dist. No. 1J, 329 Or. 401 (1999). The Court further defined those records that may be withheld as personnel information to include, “employment applications, employee work evaluations, disciplinary documentation, and promotion, demotion, or termination information pertaining to a particular employee.” Wakefield Teacher’s Ass’n, 431 Mass. at 798. Second Clause – Privacy Analysis under the second clause of Exemption (c) is subjective in nature and requires a balancing of the public’s right to know against the relevant privacy interests at stake. Torres v. Att’y Gen., 391 Mass. 1, 9 (1984); Att’y Gen. v. Assistant Comm’r of Real Prop. Dep’t, 380 Mass. 623, 625 (1980). Therefore, determinations must be made on a case-by-case basis. This clause does not protect all data relating to specifically named individuals. Rather, there are factors to consider when assessing the weight of the privacy interest at stake: (1) whether disclosure would result in personal embarrassment to an individual of normal sensibilities; (2) whether the materials sought contain intimate details of a highly personal nature; and (3) whether the same information is available from other sources. See People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 292 (2017). The types of personal information which the second clause of this exemption is designed to protect includes: marital status, paternity, substance abuse, government assistance, family disputes and reputation. Id. at 292 n.13; see also Doe v. Registrar of Motor Vehicles, 26 Mass. App. Ct. 415, 427 (1988) (holding that a motor vehicle licensee has a privacy interest in disclosure of his social security number). This clause requires a balancing test which provides that where the public interest in obtaining the requested information substantially outweighs the seriousness of any invasion of privacy, the private interest in preventing disclosure must yield. PETA, 477 Mass. at 291. The public has a recognized interest in knowing whether public servants are carrying out their duties

Adrian Walleigh, Esq. SPR26/1351 Page 4 April 27, 2026 in a law-abiding and efficient manner. Id. at 292. Under Exemption (c), the Office argues the following: … HLC clarifies that the Exemption (c) redactions are limited. HLC applied Exemption (c) to redact limited information that identifies or could reasonably lead to the identification of specific individuals associated with the cyber fraud incident and its aftermath, including banking-related information, employee identifying details, claimant information, or other personal details appearing within the correspondence. . . The public interest in this request concerns the governmental handing of the cyber fraud incident, not the personal identifying details of the individuals whose information appears incidentally in the records. Disclosure of this information would not materially advance public understanding of government operations beyond what has already been disclosed through the substantive emails, but it would expose identifiable individuals to unwanted contact and potentially associate them personally with a cyber-fraud event. . . Based on the Office’s response, I find that it has met its burden to redact “banking-related information,” “employee identifying details,” “claimant information,” and “other personal details” under Exemption (c) of the Public Records Law. Exemption (d) Exemption (d) allows the withholding of: inter-agency or intra-agency memoranda or letters relating to policy positions being developed by the agency; but this subclause shall not apply to reasonably completed factual studies or reports on which the development of such policy positions has been or may be based. G. L. c. 4, § 7(26)(d). Exemption (d) is intended to avoid premature release of materials that could taint the deliberative process if disclosed. Its application is limited to recommendations on legal and policy matters found within an ongoing deliberative process. See Babets v. Sec’y of the Exec. Office of Human Servs., 403 Mass. 230, 237 n.8 (1988). Factual reports which are reasonably complete and inferences which can be drawn from factual investigations, even if labeled as opinions or conclusions, are not exempt as deliberative or policy making materials. G. L. c. 4, § 7(26)(d); see also Envtl. Prot. Agency v. Mink, 410 U.S. 73, 89 (1973) (purely factual matters used in the development of government policy are subject to disclosure). The Supreme Judicial Court (SJC) opined on the status of attorney work product under

Adrian Walleigh, Esq. SPR26/1351 Page 5 April 27, 2026 Exemption (d) in DaRosa v. City of New Bedford, 471 Mass. 446 (2015). In DaRosa, the SJC concluded that “opinion” work product that was prepared in anticipation of litigation or for trial by or for a party or its representative falls within the scope of Exemption (d). Id. at 448. It also concluded that “fact” work product under Mass. R. Civ. P. 26(b)(3) that was prepared in anticipation of litigation or trial falls within the scope of Exemption (d) where it is not a reasonably completed study or report or, if it is reasonably completed, where it is interwoven with opinions or analysis leading to opinions. Id. Under Exemption (d), the Office argues the following: The work product doctrine is applicable to this production due to the confidential attorney analyses assessing exposure, legal options, anticipated coverage disputes, litigation risk, or recommended strategies for preserving claims and coordinating with law enforcement. HLC relies on work-product protection only for discrete portions of communications prepared by or for counsel in anticipation of potential litigation or coverage dispute, reflecting counsel’s legal analysis, mental impressions, and strategy; HLC does not claim Exemption (d) for routine factual, administrative, or claims-processing communications. Given how interwoven these issues are with the application of Exemption (f) and (n) . . . combined with the current assessment of cyberfraud attacks on local housing authorities, HLC requests the Supervisor to find these redactions appropriate. Based on the Office’s response, I find the Office has met its burden to redact portions of the responsive records under Exemption (d) of the Public Records Law, as the correspondence reflects “. . . counsel’s legal analysis, mental impressions, and strategy. . .” “. . . in anticipation of potential litigation or coverage dispute[s]” as contemplated in DaRosa. Exemption (f) Exemption (f) permits the withholding of: investigatory materials necessarily compiled out of the public view by law enforcement or other investigatory officials the disclosure of which materials would probably so prejudice the possibility of effective law enforcement that such disclosure would not be in the public interest. G. L. c. 4, § 7(26)(f). A custodian of records generally must demonstrate a prejudice to investigative efforts in order to withhold requested records. Information relating to an ongoing investigation may be withheld if disclosure could alert suspects to the activities of investigative officials. Confidential investigative techniques may also be withheld indefinitely if disclosure is deemed to be prejudicial to future law enforcement activities. Bougas v. Chief of Police of Lexington, 371 Mass. 59, 62 (1976). Redactions may be appropriate where they serve to preserve the anonymity

Adrian Walleigh, Esq. SPR26/1351 Page 6 April 27, 2026 of voluntary witnesses. Antell v. Att’y Gen., 52 Mass. App. Ct. 244, 248 (2001); Reinstein v. Police Comm’r of Boston, 378 Mass. 281, 290 n.18 (1979). Exemption (f) invites a “case-by- case consideration” of whether disclosure “would probably so prejudice the possibility of effective law enforcement that such disclosure would not be in the public interest.” See Reinstein, 378 Mass. at 289-90. As a matter of course, witness provided information is essential to efficient and effective law enforcement. This exemption is intended to allow investigative officials to provide an assurance of confidentiality to private citizens so that they will speak openly and voluntarily about matters. Bougas, 371 Mass. at 62. Any information contained in a witness statement, which if disclosed would create a grave risk of directly or indirectly identifying the voluntary witness is subject to withholding. Globe Newspaper Co. v. Boston Ret. Bd., 388 Mass. 427, 438 (1983). The disclosure of the names and other identifying information of victims, complainants and voluntary witnesses may deter other potential witnesses and citizens from providing information to law enforcement agencies in future investigations. Therefore, Exemption (f) will allow the withholding of the name and identifying details of any victims, complainants and voluntary witnesses, and where the individuals can be indirectly identified even with redaction. To properly claim that Exemption (f) applies, a custodian must demonstrate that the disclosure of the records would have a prejudicial effect on its investigative efforts. This can be accomplished by describing how the records fall into one of three categories. These are the three categories that justify withholding records under Exemption (f):  The records reflect an ongoing investigation, such that any information relating to an ongoing investigation that could potentially alert suspects or targets to the activities of investigative officials;  The records reflect internal techniques, procedures, or sources, such that their disclosure would prejudice not only ongoing, but future law enforcement efforts; or  Disclosure of records would cause a chilling effect, because the exemption allows investigative officials to provide an assurance of confidentiality to individuals so that they will speak openly about matters under investigation. Such records in this third category include: any details in statements that directly or indirectly identify a private citizen who volunteers as a witness; an entire statement if the identity of witnesses is known to the requestor; and information voluntarily provided by an individual or entity to aid in the investigation. Under Exemption (f), the Office argues the following: … HLC relied on Exemption (f) for portions of the correspondence that reflect the reporting, assessment, and handling of an alleged cyber fraud incident, including information shared for investigative, verification, of claim-support purposes. The withheld portions were compiled and exchanged in connection with the

Adrian Walleigh, Esq. SPR26/1351 Page 7 April 27, 2026 assessment of suspected fraud, coordination with relevant entities, and evaluation of facts necessary to determine the nature and scope of the incident and the appropriate response. . . This matter was promptly referred to law enforcement to investigate. As far as HLC is aware, law enforcement still has an ongoing investigation regarding cyber fraud attack. . .Were the details of the investigation into the Salem incident to become public, it could give the criminals an advantage by allowing them to cover their tracks, hide evidence, and shift their tactics to become less detectable and better able to continue to strike other organizations. The redactions prevent release of critical details of how the incident occurred, how the perpetrators were caught, and what occurred following the incident, including how HLC counsel advised Salem Housing Authority related to their insurance claim and referral to law enforcement. Disclosure of these portions would prejudice the effectiveness of fraud-related review and response efforts by revealing the substance of internal fraud reporting, evidentiary assessment, and incident-handling steps that are expected to occur outside public view. . . HLC also notes that some of the withheld information was voluntarily provided by non-public actors in the course of reporting the incident and pursuing insurance recovery. . . To the extent the redactions protect identifying details or substantive information voluntarily provided to aid the response to the fraud matter, disclosure would risk discouraging the full and candid sharing of information in future fraud investigations and incident-response efforts. Based on the Office’s April 2nd response, I find that to the extent that the Office claims the disclosure of redacted portions of the responsive records would reveal the course of its ongoing investigation and chill the cooperation of witnesses, the Office may properly claim Exemption (f) of the Public Records Law to redact the responsive records. See G. L. c. 4, § 7(26)(f). It should be noted that a change in the status of the investigation could impact the applicability of Exemption (f). Exemption (n) Exemption (n) applies to: records, including, but not limited to, blueprints, plans, policies, procedures and schematic drawings, which relate to internal layout and structural elements, security measures, emergency preparedness, threat or vulnerability assessments, or any other records relating to the security or safety of persons or buildings, structures, facilities, utilities, transportation, cyber security or other infrastructure located within the commonwealth, the disclosure of which, in the reasonable judgment of the record custodian, subject to review by the supervisor of public records under subsection (c) of section 10 of chapter 66, is likely to jeopardize

Adrian Walleigh, Esq. SPR26/1351 Page 8 April 27, 2026 public safety or cyber security. G. L. c. 4, § 7(26)(n). Exemption (n) allows for the withholding of certain records which if released would jeopardize public safety. The first prong of Exemption (n) examines “whether, and to what degree, the record sought resembles the records listed as examples in the statute;” specifically, the “inquiry is whether, and to what degree, the record is one a terrorist ‘would find useful to maximize damage.’” People for the Ethical Treatment of Animals (PETA) v. Dep’t of Agric. Res., 477 Mass. 280, 289-90 (2017). The second prong of Exemption (n) examines “the factual and contextual support for the proposition that disclosure of the record is ‘likely to jeopardize public safety.’” Id. at 289-90. The PETA decision further provides that “[b]ecause the records custodian must exercise ‘reasonable judgment’ in making that determination, the primary focus on review is whether the custodian has provided sufficient factual heft for the supervisor of public records or the reviewing court to conclude that a reasonable person would agree with the custodian’s determination given the context of the particular case.” Id. PETA also provides that “[t]hese two prongs of exemption (n) must be analyzed together, because there is an inverse correlation between them. That is, the more the record sought resembles the records enumerated in exemption (n), the lower the custodian’s burden in demonstrating ‘reasonable judgment’ and vice versa.” PETA at 290. Under Exemption (n), the Office argues the following: . . . The materials in this request are not identical to “blueprints” or “schematic drawings,” but Exemption (n) is broader than those examples and expressly includes records relating to “security measures,” “threat or vulnerability assessments,” and “cyber security.” The redacted portions here concern the specific operational content of a real cyber-fraud incident and responsive measures taken or recommended in light of that incident. In context, they are closely analogous to records concerning cyber-security measures and vulnerabilities. . . HLC used Exemption (n) to redact limited, sensitive information that would reveal the manner in which the cyber fraud incident was detected, escalated, analyzed, or addressed, including internal security protocols, system-response practices, account-security measures, investigative routing, escalation chains, incident-response steps, and insurance policy considerations. . . The concern here is not merely abstract sensitivity. In the context of a cyber fraud incident, disclosure of the withheld portions would provide a roadmap to malicious actors by identifying operational vulnerabilities, response methods, and control points inside government and quasi-public housing operations. Most importantly,

Adrian Walleigh, Esq. SPR26/1351 Page 9 April 27, 2026 disclosure would likely jeopardize cyber security because the redacted portions reveal how this kind of fraud was manifested, what indicators were noticed, what payment and vendor controls were implicated, what response and reporting steps were triggered, and what protective measures were emphasized to comparable public entities. Such information could be used to evade detection, exploit known workflows, or compromise future incident-response efforts. . . Based on the Office’s response, I find the Office has shown how the requested records are the type of records listed under Exemption (n). Further, where the Office has explained that a bad actor could use the redacted information to “. . .identify operational vulnerabilities, response methods, and control points inside government and quasi-public housing operations,” I find the Office has met its burden to redact these portions of the responsive records pursuant to Exemption (n). Common Law Attorney-Client Privilege A records custodian claiming the attorney-client privilege under the Public Records Law has the burden of not only proving the existence of an attorney-client relationship, but also (1) that the communications were received from a client during the course of the client’s search for legal advice from the attorney in his or her capacity as such; (2) that the communications were made in confidence; and (3) that the privilege as to these communications has not been waived. See Suffolk Constr. Co. v. Div. of Capital Asset Mgmt., 449 Mass, 450 n.9 (2007); see also Hanover Ins. Co. v. Rapa & Jepsen Ins. Servs., 449 Mass. 609, 619 (2007 (stating that the party seeking the attorney-client privilege has the burden to show the privilege applies). Records custodians seeking to invoke the common law attorney-client privilege “are required to produce detailed indices to support their claims of privilege.” Suffolk, 449 Mass. at 460. Pursuant to the Public Records Law, in assessing whether a records custodian has properly withheld records based on the claim of attorney-client privilege the Supervisor of Records “shall require, as part of the decision making process, that the agency or municipality provide a detailed description of the record, including the names of the author and recipients, the date, the substance of such record, and the ground upon which the attorney-client privilege is being claimed.” G. L. c. 66, § 10A(a). Under attorney-client privilege, the Office argues the following: … The redacted portions reflect confidential attorney-client communications in which Salem Housing Authority sought or conveyed information for the purpose of obtaining legal advice specifically related to the active cyber-attack, and counsel responded with legal guidance and recommendations. Those communications were made in confidence for the purpose of legal consultation and have not been waived. . .

Adrian Walleigh, Esq. SPR26/1351 Page 10 April 27, 2026 The legal purpose of these communications is apparent from the record context. The email threads include discussions about beginning the insurance-claim process, the submission of notice of claim, questions concerning what documents should be provided, and legal guidance concerning next steps and response obligations. . . HLC recognizes that communications involving counsel are not privileged merely because an attorney is copied. The redactions at issue, however, were not based on counsel’s presence alone. They were limited to portions that reveal the substance of confidential requests for legal advice or counsel’s legal analysis and recommendations concerning the handing of the cyber fraud matter and associated claim-submission issues. Non-privileged portions were produced where reasonably segreagable. Upon review, the Office has satisfied the requirement that the communications were received during the course of the Salem Housing Authority’s search for legal advice from the Office’s attorney in his or her capacity as such. Further, the Office has satisfied the requirement that the communications were made in confidence and the requirement that the privilege as to these communication has not been waived. However, the Office’s response did not contain the specificity required to redact records pursuant to the attorney-client privilege. Based on the Office’s April 2nd response, it is unclear which specific records have been redacted pursuant to the privilege. Specifically, the Office must provide an index comprised of a detailed description of each record redacted pursuant to the attorney-client privilege, including the names of the author and recipients, the date, the substance of each record, and the grounds upon which the privilege is being claimed. See G. L. c. 66, § 10A(a). Conclusion Accordingly, the Office is ordered to provide Ms. Reilly with a response to the request, provided in a manner consistent with this order, the Public Records Law and its Regulations within ten (10) business days. A copy of any such response must be provided to this office. It is preferable to send an electronic copy of the response to this office at pre@sec.state.ma.us. Ms. Reilly may appeal the substantive nature of the Office’s response within ninety (90) days. See 950 C.M.R. 32.08(1).

Adrian Walleigh, Esq. SPR26/1351 Page 11 April 27, 2026 Sincerely, Manza Arthur Supervisor of Records cc: Judith Reilly