By Jeffrey A. Roberts
CFOIC Executive Director

A CORA request seeking information about a June cybersecurity attack at the Colorado Department of Higher Education has led to a court dispute over records withheld under the law’s deliberative process privilege.

In a Denver District Court filing last week, Suzanne Taheri of the conservative Public Trust Institute asserts that “boilerplate language” used by CDHE and its “vague descriptions of the withheld documents” do not adequately explain why disclosure of requested email messages would be harmful.

“These are public records related to a security breach of public data,” Taheri wrote. “That alone is a matter of public concern, and the public has a right to know how the agency responds to the breach.”

Under the Colorado Open Records Act, government entities may keep certain records from the public “if the material is so candid or personal that public disclosure is likely to stifle honest and frank discussion within the government.” When invoking the deliberative process privilege, a records custodian must produce an affidavit “specifically describing each document withheld, explaining why each such document is privileged, and why disclosure would cause substantial injury to the public interest.”

If a requester believes the privilege has been misapplied, they can require the records custodian to ask a district court for permission to restrict disclosure. That’s what Taheri did after CDHE provided her with 166 documents in response to her CORA request but withheld another 28.

In a petition filed in late September, state Assistant Solicitor General Michael McMaster argues that the court should not review the messages sought by Taheri unless she shows that “the withheld materials may not be privileged and that there is a specific need for disclosure.”

The 28 withheld emails “are both predecisional and deliberative,” he wrote, with department staffers discussing matters such as possible courses of action, requests for assistance, talking points and recommendations for responding to the cyberattack.

“[A] key question in a deliberative process privilege case is whether disclosure of the material would expose an agency’s decisionmaking process in such a way as to discourage discussion within the agency and thereby undermine the agency’s ability to perform its functions,” McMaster added, quoting from City of Colorado Springs v. White, a 1998 Colorado Supreme Court decision that recognized the deliberative process privilege the year before the General Assembly made it part of CORA.

But the “vagueness” of CDHE’s document descriptions in its affidavit “along with the generic claim that disclosure would result in substantial injury to the public interest for boilerplate reasons” make it difficult for the Public Trust Institute to counter the agency’s denial, Taheri argued. A judge’s in-camera review of the records is needed, she wrote, “so that PTI’s right to public disclosure can be preserved.”

“PTI does not know what the documents contain — only that CDHE does not wish to provide them,” Taheri’s brief says. “Because PTI does not know what they contain, PTI is left unable to make a full legal argument for their disclosure. This is the very reason why an in-camera review is needed.”

CDHE announced Aug. 4 that it had been the victim of a “cybersecurity ransomware incident” between June 11 and June 19. Some of the impacted records “include names and social security numbers or student identification numbers, as well as other education records.” 

There is another civil case in Denver District Court that also pertains to a state agency’s denial of emails under CORA’s deliberative process privilege. In a lawsuit brought by Complete Colorado, a judge in September ordered the Colorado Department of Health Care Policy and Financing to turn over the contested documents so she can determine if they were properly withheld.

Follow the Colorado Freedom of Information Coalition on Twitter @CoFOIC. Like CFOIC’s Facebook page. Do you appreciate the information and resources provided by CFOIC? Please consider making a tax-deductible donation.