July 2, 2012

Ms. Patsy Spaw

Secretary of Senate

The Senate of The State of Texas

P.O. Box 12068

Austin, Texas 78711

OR2012-10192

Dear Ms. Spaw:

You ask whether certain information is subject to required public disclosure under the Public Information Act (the "Act"), chapter 552 of the Government Code. Your request was assigned ID# 457876.

The Offices of Senators Birdwell, Ellis, Hegar, Lucio, Nelson, Ogden, and Whitmire (collectively the "senators' offices") received a request for information pertaining to a specified incident and House Bill 2499. ⁽¹⁾ You state the senators' offices have released some of the requested information. You claim that the submitted information is excepted from disclosure under sections 552.101 and 552.139 of the Government Code. ⁽²⁾ We have considered the exceptions you claim and reviewed the submitted information. We have also received and considered comments submitted by the Texas Comptroller of Public Accounts (the "comptroller's office"). See Gov't Code § 552.304 (providing that interested party may submit written comments regarding why information should or should not be released).

The senators' offices and the comptroller's office each inform us this information was provided to a senator's office by the Texas Department of Information Resources ("TDIR") under the legislative privilege pursuant to section 552.008(b) of the Government Code, which states, in part, as follows:

[A] governmental body on request by an individual member, agency, or committee of the legislature shall provide public information, including confidential information, to the requesting individual member, agency, or committee of the legislature if the requesting member, agency or committee states that the public information is requested under [the Act] for legislative purposes.

Id. § 552.008(b). We note disclosure of excepted or confidential information to a legislator under section 552.008 does not waive or affect the confidentiality of the information or the right to assert exceptions in the future regarding that information, and provides specific procedures relating to the confidential treatment of the information. Id. Accordingly, we will consider the claims submitted by the senators' offices and the comptroller's office under sections 552.101 and 552.139 of the Government Code.

The senators' offices and the comptroller's office each claim the submitted information is excepted from disclosure under section 552.139 of the Government Code. Section 552.139 provides:

(a) Information is excepted from [required public disclosure] if it is information that relates to computer network security, to restricted information under Section 2059.055 [of the Government Code], or to the design, operation, or defense of a computer network.

(b) The following information is confidential:

(1) a computer network vulnerability report; [and]

(2) any other assessment of the extent to which data processing operations, a computer, a computer program, network, system, or system interface, or software of a governmental body or of a contractor of a governmental body is vulnerable to unauthorized access or harm, including an assessment of the extent to which the governmental body's or contractor's electronically stored information containing sensitive or critical information is vulnerable to alteration, damage, erasure, or inappropriate use[.]

Id. § 552.139(a)-(b)(2). You state the submitted information consists of web application vulnerability scanning reports and other network security reports completed by TDIR for the comptroller's office. You further explain the submitted information deals with network security breaches and network security remediation, and includes descriptions of security risks by threat class. Based on your representations and our review, we conclude the senators' offices must withhold the submitted information under section 552.139 of the Government Code. As our ruling is dispositive, we need not address the remaining arguments against disclosure.

This letter ruling is limited to the particular information at issue in this request and limited to the facts as presented to us; therefore, this ruling must not be relied upon as a previous determination regarding any other information or any other circumstances.

This ruling triggers important deadlines regarding the rights and responsibilities of the governmental body and of the requestor. For more information concerning those rights and responsibilities, please visit our website at http://www.oag.state.tx.us/open/index_orl.php, or call the Office of the Attorney General's Open Government Hotline, toll free, at (877) 673-6839. Questions concerning the allowable charges for providing public information under the Act must be directed to the Cost Rules Administrator of the Office of the Attorney General, toll free at (888) 672-6787.

Sincerely,

Lindsay E. Hale

Assistant Attorney General

Open Records Division

LEH/ag

Ref: ID# 457876

Enc. Submitted documents

c: Requestor

(w/o enclosures)

Ms. Ruth H. Soucy

Texas Comptroller of Public Accounts

P.O. Box 13528

Austin, Texas 78711-3528

(w/o enclosures)

Footnotes

1. You state the senators' offices sought and received narrowing of the request for information. See Gov't Code § 552.222(b) (stating that if information requested is unclear to governmental body or if large amount of information has been requested, governmental body may ask requestor to clarify or narrow request, but may not inquire into purpose for which information will be used).

2. We understand you to raise section 552.101 of the Government Code in conjunction with your arguments under section 2059.055 of the Government Code. See Gov't Code § 552.101 (excepting from disclosure "information considered to be confidential by law, either constitutional, statutory, or by judicial decision").

POST OFFICE BOX 12548, AUSTIN, TEXAS 78711-2548 TEL: (512) 463-2100 WEB: WWW.OAG.STATE.TX.US
An Equal Employment Opportunity Employer