24-ORD-094
April 3, 2024
In re: Stephen Sherman/Kentucky Department of Revenue
Summary: The Kentucky Department of Revenue (“Department”)
violated the Open Records Act (“the Act”) when it denied a request to
inspect records without citing an exception and explaining how it
applied to the records withheld. The Department also violated the Act
when it failed to properly invoke KRS 61.872(5) to delay access to
records. The Department’s belated reliance invoking the “homeland
security” exception is improper because it failed to comply with
KRS 61.878(1)(m)3.
Open Records Decision
On February 9, 2024, Stephen Sherman (“Appellant”) submitted a request to
the Department for “Final and draft versions of the manuals, handouts, presentations
or other materials used to train [Department] staff regarding the Kentucky fuels tax
from 2020 through 2024.” On February 16, 2024, the Department responded to the
Appellant’s request by citing KRS 61.872(5), stating that it “will require additional
time to review and redact or withhold any documents that are exempt from
disclosure,” and advising the Appellant that a response would be issued on or before
March 1, 2024. On February 26, 2024, the Department stated that it had produced
all responsive records but was withholding a single document “because it is training
on internal processes, which are not released to the public.” This appeal followed.
Upon receiving a request to inspect records, a public agency must decide within
five business days whether to grant the request, or deny the request and explain why.
KRS 61.880(1). Or, if the responsive records are “in active use, storage, or not
otherwise available,” a public agency may delay access to them by stating the earliest
date on which they will be available and giving a detailed explanation of the cause of
the delay. KRS 61.872(5). Here, although the Department responded to the request,
it neither granted nor denied the request within five business days. Instead, it statedthat the requested records “are still in the process of being compiled” and the
Department needed “additional time to review and redact or withhold any documents
that are exempt from disclosure.” The Department did not assert that the records
were in “active use, storage, or not otherwise available.” Accordingly, the
Department’s initial response did not comply with KRS 61.872(5).
Further, “[a]n agency response denying, in whole or in part, inspection of any
records shall include a statement of the specific exemption authorizing the
withholding of the record and a brief explanation of how the exception applies to the
record withheld.” KRS 61.880(1) (emphasis added). Here, the Department’s final
response, issued on February 26, 2024, did not cite any exception to the Act or explain
how it applied. Rather, it simply stated, “A single document has been withheld
because it is training on internal processes, which are not released to the public.” As
such, the Department violated the Act because its final response failed to comply with
KRS 61.880(1).
On appeal, for the first time, the Department asserts the record was properly
withheld under what has been referred to as the “homeland security exemption,” or
KRS 61.878(1)(m)1., which exempts “[p]ublic records the disclosure of which would
have a reasonable likelihood of threatening public safety by exposing a vulnerability
in preventing, protecting against, mitigating, or responding to a terrorist act.” The
Department asserts that the record details “procedures Department employees use
to input confidential tax information in the Department’s data systems.”
However, “the same day that a public agency denies a request to inspect a
public record for a reason identified in [KRS 61.878(1)(m)], that public agency shall
forward a copy of the written denial of the request, referred to in KRS 61.880(1), to
the executive director of the Kentucky Office of Homeland Security and the Attorney
General.” KRS 61.878(1)(m)3. (emphasis added). As discussed, the Department’s final
response under KRS 61.880(1), which was issued on February 26, 2024, did not cite
KRS 61.878(1)(m) as an exception. But more importantly, the Department has
provided no proof that it sent a copy of its February 26 response to either the Attorney
General or the executive director of the Kentucky Office of Homeland Security on the
same day it was issued to the Appellant.1 Rather, the Department’s first attempt to
invoke KRS 61.878(1)(m) was made on appeal, after the Appellant challenged the
Department’s wholly inadequate response.
1
The Office notes that, although it has received two such letters this year from two other agencies,
it has no record of the Department having sent a copy of a denial based on KRS 61.878(1)(m).Apart from the Department’s failure to comply with KRS 61.878(1)(m)3., its
response on appeal also is insufficient to invoke KRS 61.878(1)(m). The Office has
found that public agencies carry a heavy burden to explain how the exception applies.
See, e.g., 09-ORD-100 (finding that an agency failed to carry its burden that the
designs of a 300-foot radio antenna were exempt under KRS 61.878(1)(m)). That is
because, by its express terms, KRS 61.878(1)(m) is a narrow exception. It applies only
to a potential “terrorist act,” defined as “a criminal act intended to” “[i]ntimidate or
coerce a public agency or all or part of the civilian population,” “[d]isrupt a system
identified in [KRS 61.878(1)(m)1.f.],” or “[c]ause massive destruction to a building or
facility
owned,
occupied,
leased,
or
maintained
by
a
public
agency.”
KRS 61.878(1)(m)2. The Office has found that records that merely expose a security
vulnerability are not exempt under KRS 61.878(1)(m) in the absence of proof that a
“reasonable likelihood” exists that the information could be used to carry out a
“terrorist act.” See, e.g., 15-ORD-041 (rejecting a law enforcement agency’s claim that
security footage inside the agency’s facility was exempt under KRS 61.878(1)(m)
despite its potential to show the camera’s “blind spots”).
The Department does not explain how release of the record would create a
“reasonable likelihood” that a terrorist act would occur. There is no basis to conclude
there is a “reasonable likelihood” that release of the record would lead to a criminal
act intended to “[i]ntimidate or coerce a public agency or all or part of the civilian
population” or “[c]ause massive destruction to a building or facility owned, occupied,
leased, or maintained by a public agency.” Accordingly, the only potential “terrorist
act” that could arguably occur is a criminal act intended to “disrupt a system
identified in” KRS 61.878(1)(m)1.f. But the only “system” under which the
Department might qualify is “information technology.” Still, the only concern the
Office can imagine if the record is released, given the Department’s lack of
explanation, would be to expose vulnerabilities in the Department’s software that
could lead to the criminal act of identity theft. Such a criminal act is, of course, a
serious concern, and perhaps some enactment of the General Assembly or federal law
would allow the Department to withhold the record on that ground. See
KRS 61.878(1)(k) and (l); see also 22-ORD-025 (law enforcement records describing
tactical responses to riots were not exempt under KRS 61.878(1)(m) but were exempt
under KRS 17.150(2)(c) as intelligence reports which, if released, could endanger
officer safety). But KRS 61.878(1)(m) may only be invoked to prevent certain kinds of
crime, not crimes in general.
At bottom, the Department puts forth no proof that release of the record has a
reasonable likelihood of leading to a “terrorist act.” Further, because the Departmentdid not comply with KRS 61.878(1)(m)3. in the first instance, the Office cannot find
that it properly withheld the records under KRS 61.878(1)(m)1.f.
A party aggrieved by this decision may appeal it by initiating an action in the
appropriate circuit court under KRS 61.880(5) and KRS 61.882 within 30 days from
the date of this decision. Under KRS 61.880(3), the Attorney General shall be notified
of any action in circuit court, but shall not be named as a party in that action or in
any subsequent proceedings. The Attorney General will accept notice of the complaint
emailed to OAGAppeals@ky.gov.
Russell Coleman
Attorney General
/s/ Zachary M. Zimmerer
Zachary M. Zimmerer
Assistant Attorney General
#156
Distributed to:
Stephen A. Sherman
Maurette Harris
Sherry D. Dungan
Bethany Atkins Rice