2019 Baltimore ransomware attack (Baltimore Mayor's Office)

Ms. Best,

The Mayor's Office is in receipt of your June 7, 2019 request, attached, for "emails, memos, and reports mentioning or describing the May 7th, 2019 ransomware attack on the City of Baltimore." The Maryland Public Information Act ("PIA"), codified in Sections 4-101, et. seq. of the General Provisions ("GP") Article of the Maryland Code, governs your request. A request for public information under the PIA must be submitted to the custodian of public records. GP § 4-202(a). Each governmental entity, including each Baltimore City agency, is the custodian of its own records. See Baltimore City Code, Art. 1 § 10-1. This response is on behalf of the Mayor's Office.

The law provides that a request for public information must sufficiently identify the records sought. See Sears v. Gottschalk, 502 F.2d 122, 125 (4th Cir. 1974) (Freedom of Information Act ("FOIA") requires a "reasonable description enabling the Government employee to locate the requested records"); see also MacPhail v. Comptroller of Maryland, 178 Md. App. 115, 119 (2008) (explaining that pertinent FOIA cases are "persuasive" authority in Maryland because the PIA and FOIA share "virtually identical" purposes"); see also Letter from Assistant Attorney General Kimberly Smith Ward to Deborah Byrd, Dorchester County Commissioner's Office (May 7, 1996). Therefore, you must identify the records you are requesting by providing a more limiting set of criteria for the search and review. For example, you have requested "emails, memos, and reports mentioning the ransomware attack on May 7th 2019." However, you have not identified any limiting timeframe from which those communications were to have taken place, nor have you provided any subject-matter limitation on the scope of the communications you are requesting by, for example, providing a list of keywords or search terms that would assist the custodians in retrieving the requested records. Please provide this information as soon as possible so the staff can locate the needed documents more efficiently.

Additionally, the City has no ability to search all e-mail accounts from a particular agency, but, instead, conducts its searches by account. The PIA requires a search of electronic records to be "similar" to what the government does when it looks for those same records. Glass v. Anne Arundel County, 453 Md. 201, 236, n..32. Accordingly, most requestors seek e-mails by making a request to the agency that has custody of the accounts within which the emails are sought, naming the account that they want searched, the key words to search for and a time-frame. Please clarify which email accounts, time frames and/or key words you wish to have searched.

Further, please note that the PIA permits the custodian to charge a reasonable fee for the actual costs incurred, beyond two non-compensable hours, for the retrieval, review, and preparation of a public record. GP § 4-206(b). Such costs include the prorated salaries for the actual time it takes individual employees to process the request, and includes media and mechanical processing costs. Id. Importantly, the PIA requires the custodian to review all potentially responsive records for mandatory and discretionary exemptions to disclosure. GP §§ 4-301 et seq. The City is unable to produce records without such a review because, to do otherwise, could subject its attorneys and employees to criminal penalties, in addition to monetary damages. GP §§ 4-401, 402. Because you have not identified the specific time frame and accounts for the communications you are requesting, we are unable to estimate what the fee would be if it were assessed.

Nothing in this response is intended to indicate that records sought from City agencies exist or to waive any privileges held by the Mayor and City Council. You may contest this response by filing a complaint in Circuit Court pursuant to GP Section 4-362.

Sincerely,

[cid:image001.png@01D21971.CFDD6E80]<http://www.baltimorecity.gov/>
Department of Law
Khadeja Farahmand, L.L.M
Legal Advice & Opinions
Baltimore City Department of Law
100 N. Holliday Street, Suite 101
Baltimore, MD 21202
Khadeja.Farahmand@baltimorecity.gov<mailto:Khadeja.Farahmand@baltimorecity.gov>
Office: (410)396-3257
Fax: (410) 396-3257