February 29, 2012

Mr. David Brown

Assistant General Counsel

Texas Department of Information Resources

P.O. Box 13564

Austin, Texas 78711-3564

OR2012-03087

Dear Mr. Brown:

You ask whether certain information is subject to required public disclosure under the Public Information Act (the "Act"), chapter 552 of the Government Code. Your request was assigned ID# 446808.

The Texas Department of Information Resources (the "department") received a request for "all communication (electronic, print or phone records) between [the department] and the office of the governor, office of the attorney general[,] and AT&T regarding the award of any and all contracts to AT&T and AT&T's performance fulfilling contracts with [the department]." ⁽¹⁾ You claim that the submitted information is excepted from disclosure under section 552.139 of the Government Code. You also explain this information may contain third party proprietary information subject to exception under the Act. Accordingly, you have notified AT&T of the request for information and of its right to submit arguments to this office as to why the submitted information should not be released. See Gov't Code § 552.305(d); Open Records Decision No. 542 (1990) (statutory predecessor to section 552.305 permitted governmental body to rely on interested third party to raise and explain applicability of exception to disclosure under certain circumstances). We have considered the exception you claim and reviewed the submitted information.

We note an interested third party is allowed ten business days after the date of its receipt of the governmental body's notice under section 552.305(d) to submit its reasons, if any, as to why requested information relating to that party should be withheld from disclosure. See Gov't Code § 552.305(d)(2)(B). As of the date of this letter, AT&T has not submitted any comments to this office explaining how release of the submitted information would affect its proprietary interests. Accordingly, the department may not withhold any of the submitted information on the basis of AT&T's proprietary interests. See id. § 552.110; Open Records Decision Nos. 661 at 5-6 (1999) (stating business enterprise claiming exception for commercial or financial information under section 552.110(b) must show by specific factual evidence release of requested information would cause that party substantial competitive harm), 552 at 5 (1990) (party must establish prima facie case information is trade secret).

Next, we note you state that the submitted information consists of "embedded attachments, all of which have been printed and attached in their entirety." We thus understand you to inform us that information other than that submitted exists and is responsive to the request.  Accordingly, to the extent any additional information responsive to the request existed on the date the department received the request, we assume you have released it. If you have not released such information, you must do so at this time. See Gov't Code §§ 552.301(a), .302; see also Open Records Decision No. 664 (2000) (if governmental body concludes that no exceptions apply to requested information, it must release information as soon as possible).

Section 552.139 of the Government Code provides in pertinent part:

(a) Information is excepted from [required public disclosure] if it is information that relates to computer network security, to restricted information under Section 2059.055 [of the Government Code], or to the design, operation, or defense of a computer network.

(b) The following information is confidential:

(1) a computer network vulnerability report;

(2) any other assessment of the extent to which data processing operations, a computer, a computer program, network, system, or system interface, or software of a governmental body or of a contractor of a governmental body is vulnerable to unauthorized access or harm, including an assessment of the extent to which the governmental body's or contractor's electronically stored information containing sensitive or critical information is vulnerable to alteration, damage, erasure, or inappropriate use[.]

Id. § 552.139. You state the submitted information comprises "the statement of work for managed security services for the Network Security Operation Center (NSOC)." You further state the information "is directly related to the components of the security system of a state agency, in this case [the department] and NSOC," and "the entirety of the document is a conversation between [the department] and its services provider with respect to the management of the security-related aspects of state computer resources and affected networks." You indicate release of this information could result in risking "the confidentiality, integrity or availability of the state's information." Based on these representations and our review, we conclude you have demonstrated the submitted information relates to computer network security. Accordingly, the department must withhold the submitted information under section 552.139. As our ruling is dispositive, we need not address your remaining argument.

This letter ruling is limited to the particular information at issue in this request and limited to the facts as presented to us; therefore, this ruling must not be relied upon as a previous determination regarding any other information or any other circumstances.

This ruling triggers important deadlines regarding the rights and responsibilities of the governmental body and of the requestor. For more information concerning those rights and responsibilities, please visit our website at http://www.oag.state.tx.us/open/index_orl.php, or call the Office of the Attorney General's Open Government Hotline, toll free, at (877) 673-6839. Questions concerning the allowable charges for providing public information under the Act must be directed to the Cost Rules Administrator of the Office of the Attorney General, toll free at (888) 672-6787.

Sincerely,

Sean Opperman

Assistant Attorney General

Open Records Division

SO/dls

Ref: ID# 446808

Enc. Submitted documents

c: Requestor

(w/o enclosures)

Ms. Juanita Harris

AT&T

One AT&T Plaza

Dallas, Texas 75202

(w/o enclosures)

Footnotes

1. You state, and provide documentation showing, the department asked for and received clarification of the request. See Gov't Code § 552.222(b)(providing that if request for information is unclear, governmental body may ask requestor to clarify the request); see also City of Dallas v. Abbott, 304 S.W.3d 380, 387 (Tex. 2010) (holding that when a governmental entity, acting in good faith, requests clarification or narrowing of an unclear or overbroad request for public information, the ten-day period to request an attorney general ruling is measured from the date the request is clarified or narrowed).

POST OFFICE BOX 12548, AUSTIN, TEXAS 78711-2548 TEL: (512) 463-2100 WEB: WWW.OAG.STATE.TX.US
An Equal Employment Opportunity Employer