More Calendars - Immediate Disclosure Request

Mayor Breed and Mr. Heckel,

This is a new Immediate Disclosure Request under the San Francisco Sunshine Ordinance, made before start of business August 21, 2019. As you know, the SOTF Complaint Committee unanimously found on Aug 20 that the SOTF has jurisdiction, that the requested records are public, and to refer the matter to the SOTF for hearing, in both 19044 Anonymous v. City Attorney and 19047 Anonymous v. Mayor, regarding the refusal of the City Attorney and Mayor, respectively, to provide to me non-PDF electronic formats and metadata/headers for email and calendar information, among other things. I am requesting further calendar information below. It in no way replaces our complaint 19047 which we will continue to pursue.

** Note that all of your responses (including disclosed records) may be automatically and instantly available to the public on the MuckRock.com service used to issue this request (though I am not a MuckRock representative). **

I request under the San Francisco Sunshine Ordinance (Ordinance) and the California Public Records Act (CPRA):

"1. an electronic copy, (in the original electronic format, or alternatively in a format specified as "A" below, for all items held electronically, and a scanned copy for any physical papers), with all calendar item headers, email addresses, invitations (including but not limited to indications of who sent the invite and when), acceptances/declinations by guests, metadata, timestamps, attachments, appendices, exhibits, and inline images, except those explicitly exempted by the Ordinance, of the Mayor's *prospective/expected* calendar or schedule, with all expected events/items, from August 26 to Sept 3, 2019 (inclusive). We are specifically requesting ALL calendar/scheduling items for the Mayor, whether the Mayor herself possesses them or her staff, whether they are labeled "Prop G" or not, and whether they are on a computer or in physical form (such as a diary, a physical calendar on a wall, etc.). If any of the Mayor's staff uses any invitation/guestlist tracking systems on behalf of the Mayor (such as Outlook's invite mechanism), those calendars are also included within the scope of this request. Furthermore, we request that a City of San Jose v Superior Court (2017) search be performed of the Mayor, her chief of staff (and deputy chiefs), and all personal/secretarial/administrative assistants, such that each such official either provide all records responsive to this request present on their personal accounts/devices/property (solely to the extent the record or portion thereof relates to the public's business), or provide a declaration/affidavit that no such records exist. All such affidavits are also requested.

2. an electronic copy, (in the original electronic format, or alternatively in a format specified as "A" below, for all items held electronically, and a scanned copy for any physical papers), with all calendar item headers, email addresses, invitations (including but not limited to indications of who sent the invite and when), acceptances/declinations by guests, metadata, timestamps, attachments, appendices, exhibits, and inline images, except those explicitly exempted by the Ordinance, of the Mayor's *past* calendar or schedule, with all events/items, from August 5 to August 16, 2019 (inclusive). We are specifically requesting ALL calendar/scheduling items for the Mayor, whether the Mayor herself possesses them or her staff, whether they are labeled "Prop G" or not, and whether they are on a computer or in physical form (such as a diary, a physical calendar on a wall, etc.). If any of the Mayor's staff uses any invitation/guestlist tracking systems on behalf of the Mayor (such as Outlook's invite mechanism), those calendars are also included within the scope of this request. Furthermore, we request that a City of San Jose v Superior Court (2017) search be performed of the Mayor, her chief of staff (and deputy chiefs), and all personal/secretarial/administrative assistants, such that each such official either provide all records responsive to this request present on their personal accounts/devices/property (solely to the extent the record or portion thereof relates to the public's business), or provide a declaration/affidavit that no such records exist. All such affidavits are also requested.
"

We remind you of your obligations to provide electronic records in any format we request them in as long as either you hold them in that format, the format is available to you, or the format is easy to generate (Admin Code 67.21(l)). Therefore, calendars exported in the .ics, iCalendar, or vCard formats ("A") with all non-exempt headers, metadata, attachments, etc. are our desired formats. Such formats are easily exportable from Google Calendar, Microsoft Outlook, Microsoft Exchange or other common calendaring/email systems. However, if you choose to convert electronic calendar items, for example, to PDF or printed format, to easily redact them, you must ensure that you have preserved the full content of the original calendar item record (as specified in requests 1 and 2), which contains many detailed headers beyond the ones generally printed out. If you provide PDFs or printed items with only a few of the headers or lacking attachments/images, and therefore withhold the other headers/attachments without justification, you may be in violation of SF Admin Code 67.21, 67.26, 67.27, Govt Code 6253(a), 6253.9, and/or 6255, and we may challenge your decision. We *do not* waive the requirement of 67.21(l) discussed above, and are merely instructing you to preserve information even if you provide to us the undesirable PDF format.

For physical calendar items, scanning to PDF format is acceptable.

Note that it is implausible that there would be no prospective scheduling information for upcoming events the Mayor must attend to, even though Prop G requires no such calendar be kept. All calendars you keep re: the public's business are public records.

Please provide only those copies of records available without any fees. If you determine certain records would require fees, please instead provide the required notice of which of those records are available and non-exempt for inspection in-person if we so choose.

I look forward to your immediate disclosure.

Sincerely,
Anonymous

** Note that all of your responses (including disclosed records) may be automatically and instantly available to the public on the MuckRock.com service used to issue this request (though I am not a MuckRock representative). **

Thank you for the Request 2 Prop G PDF.

Please note that I intend to immediately appeal/petition at least the following Sunshine violations in your Aug 22 response:
- Admin Code 67.21(l) - Your use of an image PDF instead of even the minimal use of a textual PDF. On information and belief, the PDF you provided is generated by printing out on physical paper the calendar from Outlook and then scanning it to generate an image PDF. You could have even more easily printed to text PDF from Outlook directly than doing all these extra steps which serve solely to make it harder for the public to analyze public records.
- Admin Code 67.25 - Your claim that no parts of the prospective future calendar/schedule for the Mayor are amenable to Immediate Disclosure. This is information that must be immediately available to the Mayor's staff.

I expect rolling production of all other responsive records as soon as they are available (67.25(d)). Do not wait until all records are available.

Note: I also intend to request in a future request all communications in all forms your department is using in order to determine how to proceed with the present request.

Thanks,
Anonymous

I would also like to remind you both here and in 19047 of the following quote from the Good Govt Guide "But if an official or employee maintains a personal work calendar,
it would be considered a public record, with exempt material subject to redaction. " (https://www.sfcityattorney.org/wp-content/uploads/2019/02/Good-Government-Guide-February-2019.pdf pg 121). Non-Prop G calendars are and always have been public records.

Thank you - Please provide the date, no later than Sept. 14, of your extension (GC 6253(c)).

https://www.timeanddate.com/date/dateadded.html?m1=8&d1=21&y1=2019&type=add&ay=&am=&aw=&ad=24&rec=

Supervisor of Records,

Attached is a new petition under SFAC 67.21(d) - ref # 79117. Also attached are 3 exhibits.

Thank you,
Anonymous

**RE: File 19047**

Good afternoon SOTF,

Attached is additional supporting evidence in case 19047; please add it to the file.

On Aug. 20, the complaint committee asked questions regarding what non-Prop G calendars the Mayor's Office may possess and what metadata is being withheld.

In order to avoid the respondents from skirting the issue through an odd interpretation of the phrase "the Mayor's calendar" in 19047, I requested in far more detail a lot more calendars immediately after that committee meeting.

1. The evidence (attached Exhibits A and C) shows the Mayor has *at least 2* computerized calendars, one labeled "PropG, Mayor (MYR)" and another "Calendar, Mayor (MYR)". All such calendars are public records.

2. As described in my new petition to the Sup. of Records (also attached), Exhibit C shows definitively that there is at least some metadata being withheld which has no relationship to IT security information - namely the "recurrence" of a calendar invite (how often the meeting repeats). This information is stored in the event data, hinted to at in Exhibit C (circles with arrows), but not provided.

3. Also as described in that petition and Exhibit B, the Mayor is now using Gov Code 6254(f) to withhold an entire calendar. The Mayor's Office is not a local police agency, and her calendar in entirety is not law enforcment investigation information. This is beyond any reasonable interpretation of the statute.

I will continue to pursue disclosure of all calendar records of the Mayor, and hope that the Task Force will issue an order under SFAC 67.21(e) that can be enforced at Superior Court under SFAC 67.21(f).

Sincerely,
Anonymous

FOLLOWUP TO SEPT 6 2019 PETITION RE: MAYOR CALENDAR ITEMS

On Sept. 6, 2019 I made a petition to you from this email address re: the Mayor's calendar information. That petition is here: https://cdn.muckrock.com/outbound_request_attachments/94383620Anonymous/79117/79117-SupervisorPetition-20190906.pdf (Exhibits A, B, and C were sent in the original petition email). There are a variety of different petitions from various email addresses so please make sure you are looking at the right one.

In this petition I discussed among many other issues the improper withholding of recurrence metadata hinted at by circles with arrows in the print-outs.

Attached to this email is a new Exhibit D; it is further proof that the Mayor's Office did withhold a public part of a record. Exhibit D is a record provided by the Mayor's Office in a completely different CPRA request. It is what a print out of a calendar item looks like when it preserves much (but still not all) of the non-exempt metadata. Recall that I asked for in this present request "...all calendar item headers, email addresses, invitations (including but not limited to indications of who sent the invite and when), acceptances/declinations by guests, metadata, timestamps, attachments, appendices, exhibits, and inline images, except those explicitly exempted by the Ordinance, of the Mayor's *past* calendar or schedule, with all events/items, from August 5 to August 16, 2019 (inclusive). We are specifically requesting ALL calendar/scheduling items for the Mayor,..." The recurrence, organizer, free time, status, and importance information shown in Exhibit D is exactly that type of improperly withheld information in this petition. For some reason instead of actually printing out each of calendar item, the Mayor only printed out the summary view of the calendar which excludes a lot of information.

I also maintain the requests for determination in the remainder of the Sept. 6 petition.

Please remember that even if the Mayor's Office provides, voluntarily or perhaps by your intra-City prodding, a supplemental disclosure after my petition, and without you ordering them to do so, your office still owes a written determination under SFAC 67.21(d) whether any part of the records requested are public. There is no mootness rule in the Sunshine Ordinance.

You are very clear when you deny my petitions. Please be equally clear when you determine that I am correct, and that my petition should be granted, even in part, regardless of events occurring after the petition. Your determinations help build the "case law" that other members of the public can rely on without going through this drawn-out appeals process.

Thanks,
Anonymous

**** File 19047 ****

Please add this email and attached exhibit to file 19047. This is a follow up to Sup. of Records petition relevant to this case.

===============

From: "requests@muckrock.com"
<requests@muckrock.com>
To: supervisor.records@sfcityatty.org
Date: Thu, 12 Sep 2019 02:39:58 -0000

FOLLOWUP TO SEPT 6 2019 PETITION RE: MAYOR CALENDAR ITEMS

On Sept. 6, 2019 I made a petition to you from this email address re: the Mayor's calendar information. That petition is here: https://cdn.muckrock.com/outbound_request_attachments/94383620Anonymous/79117/79117-SupervisorPetition-20190906.pdf (Exhibits A, B, and C were sent in the original petition email). There are a variety of different petitions from various email addresses so please make sure you are looking at the right one.

In this petition I discussed among many other issues the improper withholding of recurrence metadata hinted at by circles with arrows in the print-outs.

Attached to this email is a new Exhibit D; it is further proof that the Mayor's Office did withhold a public part of a record. Exhibit D is a record provided by the Mayor's Office in a completely different CPRA request. It is what a print out of a calendar item looks like when it preserves much (but still not all) of the non-exempt metadata. Recall that I asked for in this present request "...all calendar item headers, email addresses, invitations (including but not limited to indications of who sent the invite and when), acceptances/declinations by guests, metadata, timestamps, attachments, appendices, exhibits, and inline images, except those explicitly exempted by the Ordinance, of the Mayor's *past* calendar or schedule, with all events/items, from August 5 to August 16, 2019 (inclusive). We are specifically requesting ALL calendar/scheduling items for the Mayor,..." The recurrence, organizer, free time, status, and importance information shown in Exhibit D is exactly that type of improperly withheld information in this petition. For some reason instead of actually printing out each of calendar item, the Mayor only printed out the summary view of the calendar which excludes a lot of information.

I also maintain the requests for determination in the remainder of the Sept. 6 petition.

Please remember that even if the Mayor's Office provides, voluntarily or perhaps by your intra-City prodding, a supplemental disclosure after my petition, and without you ordering them to do so, your office still owes a written determination under SFAC 67.21(d) whether any part of the records requested are public. There is no mootness rule in the Sunshine Ordinance.

You are very clear when you deny my petitions. Please be equally clear when you determine that I am correct, and that my petition should be granted, even in part, regardless of events occurring after the petition. Your determinations help build the "case law" that other members of the public can rely on without going through this drawn-out appeals process.

Thanks,
Anonymous

** Note that all of your responses (including disclosed records) may be automatically and instantly available to the public on the MuckRock.com service used to issue this request (though I am not a MuckRock representative). **

Please see attached response and exhibit to your letter of Sept. 16

** Note that ALL of your responses (including disclosed records and your email messages) may be automatically and instantly available to the public on the MuckRock.com service used to issue this request (though I am not a MuckRock representative). Please redact correctly.**

Good Evening Mayor Breed and Mr. Heckel,

This is a new Immediate Disclosure Request under the San Francisco Sunshine Ordinance, made on Oct 9, 2019.

As you know, in case 19047, SOTF found that you violated the sunshine ordinance by failing to provide on request (see 10-02 SOTF 19047 motion minutes) the ICS format and non-Prop G calendars. While I await the signed order of determination on that case to receive those specific records, with those specific dates, I am making this separate new request to test your compliance.

What data you may or may not redact lawfully within the ICS format has not yet been adjudicated by the Task Force since you had never provided the ICS files in 19047. I suspect you will attempt to redact some of it in this request as well.

You may know that I made an offer in May to the City Attorney that in the email case 19044 that they determine a minimal set of email headers be public, and they did not accept. The only interest that I can see the City has in refusing to provide even minimal non-security-related headers is to avoid the labor required under 67.26 to minimally withhold exempt information. This labor argument (as opposed to genuine security reasons) will clearly not be upheld by SOTF as seen before; it is the City's responsibility to develop the tools and training required to redact records efficiently. I reject any distinction, not based in specific words of SFAC Chapter 67 or the CPRA, that you may make between "metadata" and "data" - unless you can show some citation in the public records laws for such definition and how they would apply to .ICS file data.

If you would like, I am happy for you to cc your DT Chief of Information Security on this email thread. He seemed like a reasonable person, and we can speak the same language. All three of us can informally negotiate the extent of non-exempt metadata in the ICS format. I am not sure what interest the City has in IT security concerns that cannot be asserted directly by your security personnel. On the other hand, if you refuse, we can I assume go inevitably back to SOTF to hash that out in this specific request if I dispute your over-redactions. I suspect that, given the composition, the Technology Committee will not be easily confused by fear, uncertainty, or doubt and will be more confident in their technical judgments in their metadata rulings, especially with independent, expert IT advice.

Furthermore, I am willing, in this and only this Oct. 9 request, and without waiving any rights under any other request (in 19047, in 19044, or earlier in this email thread), to accept the following redactions within the ICS format without dispute (you still need to justify them so I know which redactions are which):
1. The meeting unique identifier values (UID, UUID, and/or X-ENTOURAGE_UUID), but not the names of those rows.
2. The Active Directory/Microsoft Exchange/X.509 identifier/email address of the calendar account titled "Calendar, Mayor (MYR)," but not the names of those rows. I assume you don't want spammy invites coming to these accounts if they are not already restricted from receiving external email.
3. The Active Directory/Microsoft Exchange/X.509 identifier/email address of the calendar account titled "PropG, Mayor (MYR)," but not the names of those rows.
4. The specific version number of Microsoft Outlook or Exchange in the PRODID row, but not the name of the PRODID row and also not the general phrase Outlook or Exchange.
5. [I do not know of any IP addresses in ICS files so this may not be relevant:] Any IP address suffixes, or the host prefix of any fully-qualified hostnames, but NOT the names of those rows, and NOT any timestamps on those rows, and NOT the IP address subnetwork or domain name if that subnetwork or domain name is publicly owned by the City (and thus which identifies a record as originating from the City). As in, you can redact any of these identifiers in full if they are not owned by the City, but if it is owned by the City, redact only the portion that identifies the specific computer, and not the part that identifies that the record is from the City. As your security personnel should know, network and domain registration information are public through domain registries and the American Registry for Internet Numbers. You may also redact in full any IP or hostname identifiers of city personnel when not using City networks (i.e. using their cell phones or working from home).
6. Any personal, individual email address NOT on a city domain (but NOT business, government, organization, or city email addresses)
7. Cell phone numbers

As a method of redaction, I will accept the City simply editing the exported .ics file, removing the portions they redact with for example [Redaction #1] or [Redacted per Gov Code Sec X] etc, or a reasonable alternative that you propose. The SFPD has previously done this for plain-text-like files (in their case they were redacting text message metadata). Of course, the City is not *required* to program a computer, but your IT staff may choose to write a very simple script to redact certain values in the .ics as it may be less total labor than manual redaction.

The following redactions will NOT be accepted and will be disputed:
1. Names of any city employee.
2. Timestamps and start and end meeting times.
3. City employee email addresses.
4. The structure of the ICS file, including the full content of any lines with the prefix "BEGIN:" or "END:", or the value of the line "VERSION:" (which is the version of the ICS format, not of your Outlook program)
5. The names and punctuation (colons, equals, etc.) of any rows regardless of their value.
6. The title or subject of any meeting.
7. The body or the description.
8. The attachments (you may however redact the base64 attachment data in the .ics file, if you provide the attached file separately in its original attached format)
9. The list of invitees or attendees and their statuses.
10. The location of any meeting.
11. Creator or modifier identity.
12. Creation or modification time
13. any conversion out of the .ics format, printing/scanning, etc.

Everything that is not in either of those lists may be negotiable. I understand that specific attachments, images, names etc. may be withheld in specific cases with those specific redacted items justified under some reason OTHER than your belief that you can simply withhold metadata - but those cases may be judged individually as always.

I request under the San Francisco Sunshine Ordinance (Ordinance) and the California Public Records Act (CPRA):

"1. an electronic copy, in .ICS format, with all calendar item ICS data (with the caveats above), email addresses, invitations (including but not limited to indications of who sent the invite and when), acceptances/declinations by guests, timestamps, attachments, appendices, exhibits, and inline images, except those explicitly exempted by the Ordinance, of the Mayor's calendar or schedule (on every govt account, Prop G or not), with each event/item, from August 26 to Sept 3, 2019 (inclusive). Every entry must be provided, not just a summary view. The accounts "Calendar, Mayor (MYR)" and "PropG, Mayor (MYR)" must be included, and also any other calendar accounts holding any parts of the Mayor's business schedule.
"

Please provide only those copies of records available without any fees. If you determine certain records would require fees, please instead provide the required notice of which of those records are available and non-exempt for inspection in-person if we so choose.

I look forward to your immediate disclosure.

Sincerely,
Anonymous

** Note that ALL of your responses (including disclosed records and your email messages) may be automatically and instantly available to the public on the MuckRock.com service used to issue this request (though I am not a MuckRock representative). Please redact correctly.**

First, thank you for the individual PDFs. (I will note that the file "Memo Style 8" has a line "Mayor’s Office Staff;" in the past your *non-Prop G* calendar does indeed list specific staff and it is that kind of, as you refer to it, "substantiative non-metadata" information that is something the public can learn only from "Calendar, Mayor (MYR)" and not from "PropG, Mayor (MYR).")

I do not dispute that there is no ruling on ICS metadata, since SOTF has never had a chance to issue either positive or negative rulings.

ICS as a format and non-Prop-G calendars do however now have such a ruling. Therefore I am not understanding your comment "There were no other responsive calendars for the days requested." I still would like the "Calendar, Mayor (MYR)" entries, even if they are subject to your time extension.

I believe Chair Wolfe previously suggested a method of inquiry where we compare existing, published City public records (ex: https://sanfrancisco.nextrequest.com/documents?filter=.ics&documents_smart_listing[sort][upload_date]=asc ) to the Mayor and/or City Attorney's position of what a properly redacted record looks like. The City Attorney has already provided such an example in 19044 for email, and I hope that you will submit information re: ICS metadata to the Task Force agenda packet by the Oct. 16 deadline so that we can have a fruitful discussion over what in an ICS file should be withheld vs not.

I also hope that you or Mr. Cote invite the City's cybersecurity head and/or the persons who redact records on Oct. 22.

Sincerely,
Anonymous

Mr. Heckel,

1) First, at your discretion, you may postpone all responses or other work on this specific request, EXCEPT for the production of the following items, if you can produce these and submit them to the SOTF Oct. 22 agenda packet, by the Oct. 16, 5pm deadline for the Metadata discussion:
- .ICS file, redacted however you wish, for Prop G Sept. 3 meeting "Meeting Re: Government Affairs and City Operations on Sept. 3"
- .ICS file, redacted however you wish, and all non-Prop G calendar corresponding entries of the Sept. 3 meeting "Meeting Re: Government Affairs and City Operations on Sept. 3" (regardless of the actual title you have used in those other calendars)

Frankly, if you are willing to produce all Prop G and non-Prop G versions, in both .ICS and .PDF formats, of any single Mayor meeting that has a recurrence (even if you choose to redact that recurrence or other information), and add it to the Oct. 22 agenda packet, you may hold off on this entire request until after Oct. 22. The above meeting was specifically chosen because it appears to be a completely standard meeting, but will still have a recurrence that should be completely innocuous (as it is in City Hall).

There is no need to waste City time on repeated ICS redaction if we're just going to have do this multiple times later on.
Let's get one ICS file produced from each of the "PropG, Mayor (MYR)," and "Calendar, Mayor (MYR)," and every other calendar account holding any of the Mayor's scheduling information, go to the Task Force, and just debate over those as examples.

(Note that this has no bearing on the actual 19047 case, just this request)

If you are willing to do this, please inform me.

2) Also, having re-listened to the Oct. 2 oral argument, I realize the City sometimes wishes to argue for absolute withholding of metadata in the native formats, but in doing so, it appears the City has made the Task Force highly skeptical of the portion of the City's arguments that *are* genuine security risks.
This is not the outcome I want, so I will be arguing, myself, at the Oct. 22 meeting in *support* of withholding certain information under 6254.19.
Regardless of innuendo or assumptions the City may make against me for exercising my records rights, I have no interest in the City releasing genuinely risky material - as the City also protects information about me and my emails like it does everyone else.

I do however have an interest in the City ensuring it has the training and tools to efficiently give all non-exempt information to the public, and protect all exempt information, as required by SFAC 67.26, and to use a consistent policy to do so.

3) You also mentioned in 19047 a risk of disclosing IP addresses and security protocols; while that may (and does) apply to 19044 (emails), I do not believe it applies to 19047 (calendars), to my knowledge.

4) You also stated in 19047, that I have failed to indicate to the City (in 19044) what headers may or may not be "information security records." This is not some secret I am keeping from the City - unfortunately the City Attorney has also withheld the names of the email headers so I cannot even articulate my position.

5) If you need to exempt specific information inside an ICS for IT security (6254.19), I believe the City must make a finding that the specific portions withheld are
- "information security record(s)," AND
- it would reveal vulnerabilities OR that it would increase the risk of a breach

I believe it is quite difficult to argue information like timezones or the time an employee created a calendar invite is an "information security record."

Thanks,

Anonymous

** Note that ALL of your responses (including disclosed records and your email messages) may be automatically and instantly available to the public on the MuckRock.com service used to issue this request (though I am not a MuckRock representative). Please redact correctly.**

You mentioned that the Mayor's calendar does not use Outlook invites.
Because of that (if that is true), the amount of information to redact should actually be a lot *less* than I showed.

Therefore I have created a test ICS from my own Calendar, without using invites.
Attached is the redacted ICS.

Three lines were redacted:

PRODID:-//Microsoft Corporation//Outlook [[Redacted Gov Code 6254.19]] MIMEDIR//EN
UID:[[Redacted Gov Code 6254.19]]
X-ENTOURAGE_UUID:[[Redacted Gov Code 6254.19]]

Outlook version (under 6254.19: reveal vulnerabilities), and 2 unique identifiers of the meeting (under 6254.19: increased risk of attack - spoofing).
I do not concede these portions are information security records, nor do I concede these are valid exemptions in general, but I want to move this along.

This ICS intentionally has a recurrence as a demonstration.

If you were to redact the recurrence, the 13th line from the bottom:
RRULE:FREQ=WEEKLY;UNTIL=20200402T235959;INTERVAL=1;BYDAY=WE;WKST=SU
would be instead:
[[Redacted Gov Code 6254(f)]]

I do not concede this is a valid exemption in general, but again I want to move this along. I will also contest the Mayor's future meetings separately under SOTF 19108.

Since you have no reason to believe me, I would ask that you have your cybersecurity personnel review my arguments as needed.

Sincerely,
Anonymous

(The ICS is the unredacted one, with the redactions explained above)

** Note that ALL of your responses (including disclosed records and your email messages) may be automatically and instantly available to the public on the MuckRock.com service used to issue this request (though I am not a MuckRock representative). Please redact correctly.**

Mr. Heckel,

You were asked by the Committee to show even a single line the City wanted redacted from my .ICS that I had not already pointed out, and you and the City were unable to do so. I also pointed out that SFAC 67.26 never discusses the term 'redaction' - you may mask or delete exempt parts from the file (with a list of justifications). The only way to segregate exempt info from an .ICS is to delete it, so that is what must be done. No need for PDF gymnastics for redaction, and therefore the time you claim for PDF work would not be considered part of the burden, since you don't need to do it.

As the hearing has now passed and the City did not produce its one .ics file redacted however it wished, this entire request remains pending. Please produce all records in a rolling fashion, and send over the first redacted .ics as soon as you have it.

Sincerely,

Anonymous

** Note that ALL of your responses (including disclosed records and your email messages) may be automatically and instantly available to the public on the MuckRock.com service used to issue this request (though I am not a MuckRock representative). Please redact correctly.**

The City made an interesting concession last night at SOTF: that a requester may receive parts of the (non-exempt) metadata if they specifically ask for such a datum, even if the City refuses to provide the full native file or all metadata. We shall now test this theory. Remember under 67.21, both public records AND information are disclosable.

This is thus a *NEW* immediate disclosure request for:
- all creation timestamps of the September 3, Prop G event titled "Chase Center Opening Gala" - this is also called the DTSTAMP or CREATED fields in the iCalendar
- all modification timestamps of the September 3, Prop G event titled "Chase Center Opening Gala" - this is also called the LAST-MODIFIED field in the iCalendar

You may provide this public information in any format you wish.

This will be immediately appealed if not provided. Only 2 date/times have been requested.

The older request received by you Oct 10 is not in anyway affected.

Sincerely,
Anonymous

Mr. Heckel, I had postponed this *on the condition* that you would present even a single ICS file redacted by you at the committee. You office did not do so:
"First, at your discretion, you may postpone all responses or other work on this specific request, EXCEPT for the production of the following items, if you can produce these and submit them to the SOTF Oct. 22 agenda packet, by the Oct. 16, 5pm deadline for the Metadata discussion:"

--Anonymous

Mr. Heckel,

Where are the full responses for the Oct 9 and Oct 23 requests on this email address?

NOTE: Please be certain you have properly redacted all of your responses. Once you send them to us, there is no going back. The email address sending this request is a publicly- viewable mailbox. All of your responses (including all responsive records) may be instantly and automatically available to the public online via the MuckRock.com FOIA service used to issue this request (though the requester is an anonymous user, not a representative of MuckRock). Nothing herein is legal, IT, or professional advice of any kind. The author disclaims all warranties, express or implied, including but not limited to all warranties of merchantability or fitness. In no event shall the author be liable for any special, direct, indirect, consequential, or any other damages whatsoever. The digital signature, if any, in this email is not an indication of a binding agreement or offer; it merely authenticates the sender. Please do not include any confidential information, as I intend that these communications with the City all be disclosable public records.

No, we'd like our original Oct 9 and 23rd requests fulfilled. If you've figured out how to do the more recent request, there's no material difference in difficulty in fulfilling these.

As a summary, from Oct 23:
- all creation timestamps of the September 3, Prop G event titled "Chase Center Opening Gala" - this is also called the DTSTAMP or CREATED fields in the iCalendar
- all modification timestamps of the September 3, Prop G event titled "Chase Center Opening Gala" - this is also called the LAST-MODIFIED field in the iCalendar
- You may provide this public information in any format you wish.

And, separately, from Oct. 9:
"1. an electronic copy, in .ICS format, with all calendar item ICS data (with the caveats above [N.B. caveats are specified in the Oct. 9 email]), email addresses, invitations (including but not limited to indications of who sent the invite and when), acceptances/declinations by guests, timestamps, attachments, appendices, exhibits, and inline images, except those explicitly exempted by the Ordinance, of the Mayor's calendar or schedule (on every govt account, Prop G or not), with each event/item, from August 26 to Sept 3, 2019 (inclusive). Every entry must be provided, not just a summary view. The accounts "Calendar, Mayor (MYR)" and "PropG, Mayor (MYR)" must be included, and also any other calendar accounts holding any parts of the Mayor's business schedule.
"

Your office has made recent progress on disclosing email headers and it is long past time that calendars need to be done correctly too.
We are also requesting exact copies and rolling response: As soon as you've got anything ready to produce please give it to us. We are long past all deadlines anyway.

As a refresher to avoid going backwards: GC 6253.9(f) only (at its maximum extent) can exempt the electronic format in which you held the information, not other formats (which, by definition since they are not-original, cannot threaten the *original* format). ICS is easily-generated, per SOTF. Ease of redaction is never mentioned in SFAC 67.21(l), just ease of generation. Regardless of format, minimal withholding of information is required, and only the specific portions that constitute genuine IT security threats can be withheld; you cannot exempt everything because you think it "might" be exempt. Deletion (as opposed to masking by black bars) of exempt portions is explicitly allowed by 67.26, as long as you still provide the clear references to 67.27 justifications.

If you recall, on Oct. 2 as memorialized in the audio record, the City's own witness, CISO Makstman, testified in each of 19044 and 19047 that not *every* part of the ICS rows or Email headers I entered into the record were in fact IT security risks, which will be a basis for SFAC 67.26 non-minimal withholding allegations we bring hereafter.

Please provide only those copies of records available without any fees. If you determine certain records would require fees, please instead provide the required notice of which of those records are available and non-exempt for inspection in-person if we so choose.

NOTE: Please be certain you have properly redacted all of your responses. Once you send them to us, there is no going back. The email address sending this request is a publicly- viewable mailbox. All of your responses (including all responsive records) may be instantly and automatically available to the public online via the MuckRock.com FOIA service used to issue this request (though the requester is an anonymous user, not a representative of MuckRock). Nothing herein is legal, IT, or professional advice of any kind. The author disclaims all warranties, express or implied, including but not limited to all warranties of merchantability or fitness. In no event shall the author be liable for any special, direct, indirect, consequential, or any other damages whatsoever. The digital signature, if any, in this email is not an indication of a binding agreement or offer; it merely authenticates the sender. Please do not include any confidential information, as I intend that these communications with the City all be public records.

Sincerely,
Anonymous

Thank you. We look forward to your complete response to the Oct. 9 request as well.

We will continue to pursue all lawfully disclosable metadata.
There is no difference recognized by the Sunshine Ordinance between the instant metadata (or the metadata you have begun disclosing in emails), vs the remaining lines in the ICS, which we will find out in response to the Oct 9 request.
Your reservation of rights cannot make anything that is lawfully disclosable exempt - only the voters of SF or a pre-empting state law get to decide that.

NOTE: Please be certain you have properly redacted all of your responses. Once you send them to us, there is no going back. The email address sending this request is a publicly- viewable mailbox. All of your responses (including all responsive records) may be instantly and automatically available to the public online via the MuckRock.com FOIA service used to issue this request (though the requester is an anonymous user, not a representative of MuckRock). Nothing herein is legal, IT, or professional advice of any kind. The author disclaims all warranties, express or implied, including but not limited to all warranties of merchantability or fitness. In no event shall the author be liable for any special, direct, indirect, consequential, or any other damages whatsoever. The digital signature, if any, in this email is not an indication of a binding agreement or offer; it merely authenticates the sender. Please do not include any confidential information, as I intend that these communications with the City all be public records.

I don't even understand why anyone would produce records the way you did, Outlook to text file to PDF. It doesn't even make sense.

Metadata is not a format. It is information retained in your computers. It is going to be provided in one format or another, but somehow it is going to be provided. No way is someone going to buy that your timezones, timestamps, RSVP status, and other info is a security record.

We will return to filing complaints.