Date:
02/20/2020
Subject:
Kurt Kruse/City of Madrid - Dismissal Order
Opinion:
The Iowa Public Information Board
|
In re the Matter of: Kurt Kruse, Complainant And Concerning: City of Madrid, Respondent |
Case Number: 19FC:0129
Dismissal Order
|
COMES NOW, Margaret E. Johnson, Executive Director for the Iowa Public Information Board (IPIB), and enters this Dismissal Order:
On October 27, 2019, Kurt Kruse filed formal complaint 19FC:0129 against the City of Madrid (City), alleging that the City violated Iowa Code chapter 22.
Mr. Kruse alleged that he made a request for the release of public records on October 8, 2019, requesting copies of audio from the October 5, 2019, council meeting; video footage of the council chambers from 6:00 a.m. to 6 p.m. on October 5, 2019; and server audit logs from June 1, 2018, to October 8, 2019.
He further alleged that the City produced one audio from the October 5, 2019, meeting, but did not produce the audio from the Mayor’s microphone and did not produce the requested video footage. The server audit logs were also withheld.
The City’s legal counsel responded to the complaint on November 5, 2019. Counsel noted that Mr. Kruse received a copy of all audio recordings from the October 5, 2019, meeting, as well as the video footage. The City does not place a microphone to specifically record comments made by the Mayor.
Counsel also noted that the server audit logs contained confidential material such as account names, security IDs, account domains, and logon IDs. He stated this information is confidential under Iowa Code section 22.7(50), which reads:
50. Information and records concerning physical infrastructure, cyber security, critical infrastructure, security procedures or emergency preparedness information developed, maintained, or held by a government body for the protection of life or property, if disclosure could reasonably be expected to jeopardize such life or property.
a. Such information and records include but are not limited to information directly related to vulnerability assessments; information contained in records relating to security measures such as security and response plans, security codes and combinations, passwords, restricted area passes, keys, and security or response procedures; emergency response protocols; and information contained in records that if disclosed would significantly increase the vulnerability of critical physical systems or infrastructures of a government body to attack.
The City provided a copy of five pages of server audit logs for IPIB review as a confidential record, as provided by Iowa Code section 23.6(6). A review of the confidential records confirm that each page contains information related to cyber security, which can be withheld as confidential pursuant to Iowa Code section 22.(50).
Mr. Kruse replied that confidential material could be redacted prior to release of the server audit logs and that the City provided a video recording from October 4, 2019, not from October 5, 2019. Since his initial record request, the October 5, 2019, video recording has been deleted, according to legal counsel.
Each page of server audit records encompassses about one minute of the normal workday (Monday through Friday, 8 to 4:30). Each day’s records will total around 510 pages of records. Mr. Kruse has requested over 16 months of records, which is at least 350 days or around 178,000 pages.
The City contacted two companies to inquire about the possible costs to review and redact confidential material from 178,000 pages. Estimated costs ranged from $100 to $200 per hour, although neither company was willing to risk the potential liability. The costs involved to review and redact the confidential information could be cost prohibitive.
An example of a redacted record was provided to the IPIB as a non-confidential record. If Mr. Kruse wants the redacted record, the City is willing to work with him to determine whether the record request can be modified to decrease the review and redaction costs.
The City does not have a record responsive to the record request for the October 5, 2019, video recording. Counsel noted that if Mr. Kruse had notified the City earlier of its mistake in the video dates, the City could have provided a copy of the next day’s video. It is strongly recommended that the lawful custodian double-check all future record requests to determine that the proper record has been provided. This appears to be a mistake and not an intentional violation of chapter 22.
Iowa Code section 23.8 requires that a complaint be within the IPIB’s jurisdiction, appear legally sufficient, and could have merit before the IPIB accepts a complaint.
IT IS SO ORDERED: Formal complaint 19FC:0129 is dismissed as legally insufficient pursuant to Iowa Code section 23.8(2) and Iowa Administrative Rule 497-2.1(2)(b).
Pursuant to Iowa Administrative Rule 497-2.1(3), the IPIB may “delegate acceptance or dismissal of a complaint to the executive director, subject to review by the board.” The IPIB will review this Order on February 20, 2020. Pursuant to IPIB rule 497-2.1(4), the parties will be notified in writing of its decision.
By the IPIB Executive Director
________________________________
Margaret E. Johnson
CERTIFICATE OF MAILING
This document was sent by electronic mail on the ___ day of February, 2020, to:
Kurt Kruse
John Flynn, legal counsel for the City of Madrid
Eight and a half hour work day multiplied by 60 pages per hour equals 510 pages. If someone could review and redact ten pages per minute, the time necessary to prepare the records for release would be 297.5 hours; at $100 per hour a potential cost of $29,750.00. At four pages per minute, the time would equal 743 hours, resulting in a cost of $74,300.