 ATTORNEY GENERAL OF TEXAS GREG ABBOTT | |
|
May 30, 2003 Ms. Carol Longoria
OR2003-3662 Dear Ms. Longoria: You ask whether certain information is subject to required public disclosure under chapter 552 of the Government Code. Your request was assigned ID# 181890. The University of Texas (the "university") received a request for "[a]ssessments, reports, memoranda and other information concerning the vulnerability of UT-Austin's computer systems to unauthorized use" as well as e-mails among certain individuals "concerning the vulnerability of UT-Austin's computer systems to unauthorized use." You inform us that the university will release some information to the requestor but claim that other requested information is excepted from disclosure under sections 552.101, 552.108, 552.111, and 552.136 of the Government Code. We have considered the exceptions you claim and reviewed the submitted information.(1) We have also considered comments submitted by the requestor. See Gov't Code § 552.304 (providing for submission of public comments). We begin by addressing your arguments regarding section 552.108 of the Government Code. Section 552.108(a)(1) excepts from disclosure "[i]nformation held by a law enforcement agency or prosecutor that deals with the detection, investigation, or prosecution of crime . . . if. . . release of the information would interfere with the detection, investigation, or prosecution of crime[.]" A governmental body that raises section 552.108 must reasonably explain, if the requested information does not supply an explanation on its face, how and why section 552.108 is applicable to the information. See Gov't Code § 552.301(e)(1)(A); Ex parte Pruitt, 551 S.W.2d 706 (Tex. 1977); Open Records Decision No. 434 at 2-3 (1986). When an incident is still under active investigation or prosecution, section 552.108 may be invoked by any proper custodian of information relating to the incident. See Open Records Decision Nos. 474 at 4-5 (1987), 372 (1983); see also Open Records Decision No. 586 (1991). You have provided this office with letters from the chief of the university's police department and a United States Attorney. Both individuals state that their agencies are involved in the investigation and prosecution of a particular criminal incident and object to the release of information relating to that incident. Based on our review of the submitted documents and the representations of these individuals, we conclude that the release of the information represented by the documents at Tabs 7, 8, and 11 would interfere with the detection, investigation, or prosecution of crime. See Houston Chronicle Publ'g Co. v. City of Houston, 531 S.W.2d 177 (Tex. Civ. App.-Houston [14th Dist.] 1975), writ ref'd n.r.e. per curiam, 536 S.W.2d 559 (Tex. 1976) (court delineates law enforcement interests that are present in active cases). Thus, the university may withhold these types of information under section 552.108(a)(1) of the Government Code. You claim that records represented by the information you have submitted at Tab 6 are excepted from disclosure pursuant to section 552.136 of the Government Code. This section provides: (a) Information is excepted from the requirements of Section 552.021 if it is information that relates to computer network security or to the design, operation, or defense of a computer network. (b) The following information is confidential: (1) a computer network vulnerability report; and (2) any other assessment of the extent to which data processing operations, a computer program, network, system, or software of a governmental body or of a contractor of a governmental body is vulnerable to unauthorized access or harm, including an assessment of the extent to which the governmental body's or contractor's electronically stored information is vulnerable to alteration, damage, or erasure. Gov't Code § 552.136. To support your assertion that the type of information represented by Tab 6 is protected under this exception, you have provided a letter from the university's Vice President for Information Technology (the "vice president"). In his letter, the vice president informs this office that the university uses software to scan all of the computers on the university's computer network for all known vulnerabilities as well as for particular vulnerabilities. He explains that the information submitted at Tab 6 constitutes examples of the scans performed in the past year by his department's Information Security Office and states that such scans reveal vulnerabilities in the university's computer system. Based on these representations and our review of the information submitted at Tab 6, we agree that such records constitute "assessment[s] of the extent to which data processing operations, a computer program, network, system, or software of a governmental body . . . is vulnerable to unauthorized access or harm." We therefore conclude that this type of information must be withheld under section 552.136. In summary, information such as that submitted at Tabs 7, 8, and 11 may be withheld pursuant to section 552.108(a)(1). Under section 552.136, the university must withhold documents represented by those submitted at Tab 6. As our ruling on these issues is dispositive, we need not address your other claimed exceptions. This letter ruling is limited to the particular records at issue in this request and limited to the facts as presented to us; therefore, this ruling must not be relied upon as a previous determination regarding any other records or any other circumstances. This ruling triggers important deadlines regarding the rights and responsibilities of the governmental body and of the requestor. For example, governmental bodies are prohibited from asking the attorney general to reconsider this ruling. Gov't Code § 552.301(f). If the governmental body wants to challenge this ruling, the governmental body must appeal by filing suit in Travis County within 30 calendar days. Id. § 552.324(b). In order to get the full benefit of such an appeal, the governmental body must file suit within 10 calendar days. Id. § 552.353(b)(3), (c). If the governmental body does not appeal this ruling and the governmental body does not comply with it, then both the requestor and the attorney general have the right to file suit against the governmental body to enforce this ruling. Id. § 552.321(a). If this ruling requires the governmental body to release all or part of the requested information, the governmental body is responsible for taking the next step. Based on the statute, the attorney general expects that, within 10 calendar days of this ruling, the governmental body will do one of the following three things: 1) release the public records; 2) notify the requestor of the exact day, time, and place that copies of the records will be provided or that the records can be inspected; or 3) notify the requestor of the governmental body's intent to challenge this letter ruling in court. If the governmental body fails to do one of these three things within 10 calendar days of this ruling, then the requestor should report that failure to the attorney general's Open Government Hotline, toll free, at (877) 673-6839. The requestor may also file a complaint with the district or county attorney. Id. § 552.3215(e). If this ruling requires or permits the governmental body to withhold all or some of the requested information, the requestor can appeal that decision by suing the governmental body. Id. § 552.321(a); Texas Dep't of Pub. Safety v. Gilbreath, 842 S.W.2d 408, 411 (Tex. App.-Austin 1992, no writ). Please remember that under the Act the release of information triggers certain procedures for costs and charges to the requestor. If records are released in compliance with this ruling, be sure that all charges for the information are at or below the legal amounts. Questions or complaints about over-charging must be directed to Hadassah Schloss at the Texas Building and Procurement Commission at (512) 475-2497. If the governmental body, the requestor, or any other person has questions or comments about this ruling, they may contact our office. We note that a third party may challenge this ruling by filing suit seeking to withhold information from a requestor. Gov't Code § 552.325. Although there is no statutory deadline for contacting us, the attorney general prefers to receive any comments within 10 calendar days of the date of this ruling. Sincerely, Denis C. McElroy
c: Mr. Ralph K. M. Haurwitz
Footnotes 1. We assume that the sample of records submitted to this office is truly representative of the requested records as a whole. See Open Records Decision Nos. 499 (1988), 497 (1988). This open records letter does not reach and, therefore, does not authorize the withholding of any other requested records to the extent that those records contain substantially different types of information than that submitted to this office. POST OFFICE BOX 12548, AUSTIN, TEXAS 78711-2548 TEL: (512) 463-2100 WEB:WWW.OAG.STATE.TX.US |