State Public Records Act Covers Government E-Mail Metadata,

and not just the e-mail text, says the Washington Court of Appeals, in O'Neill v. City of Shoreline (decided Monday). Unsurprising, but I thought I'd note it because I hadn't heard about such a holding before.

Albatross (www):
Interesting. Here in Texas, a request for documents doesn't have the weight of the Public Information Act behind it unless it is in writing. An oral request doesn't cut it.

On the other hand, pretty much all documents held by a governmental entity are subject to an open records request, and I believe that includes any e-mails contained in the government's servers regardless of who sent them.
7.23.2008 9:23pm
Bill Poser (mail) (www):
On the surface this seems like the correct result, but it seems to me that it presents a potential problem. Suppose that a government entity accepts anonymous complaints, suggestions, or tips via email. There are ways for people to anonymize their email themselves, but presumably few people know how to do this, so the obvious way to offer such a service is to strip the identifying information from the metadata on arrival, before any human sees the email. Unless special efforts are made to destroy the mail processing logs, which may simply fail to be made or may present other legal problems, the metadata will in fact be recoverable by knowledgeable IT staff. It thus seems that making email metadata available to the public on request conflicts with the privacy rights of those who wish to submit anonymous email to the government as well as the common benefit that arguably results from permitting this.
7.23.2008 11:51pm
BruceM (mail) (www):
Also worth noting that one should always expressly include requests for the production of corresponding metadata along with any other responsive computer data in discovery requests.
7.24.2008 2:07am
Smokey:
...pretty much all documents held by a governmental entity are subject to an open records request...
Seems that the numerous FOIA requests for James Hansen's and Michael Mann's taxpayer-funded NASA data and computer algorithms that were used to scare the public re global warming are exempt from disclosure. Mann asserts that even though the info was paid for 100% by the government, it's his "intellectual property" and he refuses to publicly archive it or provide it under the FOIA.

Some folks are special, I guess. Or maybe Mann ginned up bogus data?

See Climate Audit for the complete story.
7.24.2008 9:42am
Matt C. Sanchez (mail) (www):
It looks like there's not much "meta" about metadata when it comes to the law. This reminds me of the case against TorrentSpy, where the court found that identifying information left by site visitors in the site's computer's RAM are discoverable even if the site had a policy of not recording it.
7.24.2008 9:54am
zippypinhead:
The actual decision doesn't break a lot of new ground, IMHO, and is likely consistent with the result you would expect in most jurisdictions, including under the Federal Freedom of Information Act. And if the request was made in a different procedural posture, the result is what you would get under any civil discovery rules, such as the revised Federal Rules of Civil Procedure (caveat: I'm not familiar with Washington State rules or procedure, which is why I'm citing the Federal rules as a crutch).

The substantive content of the "metadata" that was specifically requested was, in fact, merely the sort of information one would be entitled to receive in response to any governmental information request that demanded this information, whether for paper or electronic communications to government officials. The Deputy Mayor deleted the identity of the sender of the e-mail (and probably the other standard "short header" info such as the date and time of transmission and the recipients' e-mail addresses) before providing it to the requester. All records act statutes I'm familiar with require disclosure of the correspondent's identity, addressees, and date of correspondence unless there is some specific legal exemption or privilege. In fact, as the Court observed, "the City does not dispute in its brief that the metadata associated with the e-mail is a public record."

The "interesting" part of this decision was the court's characterization of the deleted information as "metadata" rather than something more generic like "the identity of the author." Thus, this case could perhaps be the foot in the door for future litigation seeking to require other metadata, such as IP addresses, or logs detailing when the message was opened, to whom it was forwarded within the government, etc.
7.24.2008 10:21am
Fub:
zippypinhead wrote at 7.24.2008 9:21am:
The "interesting" part of this decision was the court's characterization of the deleted information as "metadata" rather than something more generic like "the identity of the author."
I wondered about that also. I'm not an FOI maven, but it seemed like a pretty obvious characterization that the court could have made. And it's much more narrow than "metadata" generally.
Thus, this case could perhaps be the foot in the door for future litigation seeking to require other metadata, such as IP addresses, or logs detailing when the message was opened, to whom it was forwarded within the government, etc.
Or at least the extended header data, the routing data that is by commonly accepted standards part of the email as stored on the server.

The recitation of facts in the case certainly reveals how governments waste tremendous time and resources merely trying to cover up the stupid errors or intentional misdeeds of officials. It's enough to make one wonder whether they have time to do anything else.

So, if the court "opened the door", to broader FOI requests, we should thank them for not ruling so narrowly as they might.
7.24.2008 12:56pm
Ben P (mail):

Suppose that a government entity accepts anonymous complaints, suggestions, or tips via email.


That could be a problem but wouldn't the court have the power in a particular case such as that to protect such information because it would undermine the policy of having anonymous reporting in the first place?
7.24.2008 2:00pm
Woof!:
Suppose that a government entity accepts anonymous complaints, suggestions, or tips via email.

That could be a problem...

Yes, that could be a problem, but mostly because the concept of anonymous e-mail is itself a problem: unless the sender goes through an anonymous proxy remailer, even a made-up handle can be traced back through the mail provider to the originating IP address.

And since in this day and age the lack of e-mail anonymity is relatively well-known by minimally techno-literate people, most agencies that want to solicit anonymous tips, complaints, etc., don't ask for e-mail. The anonymous government "tip-line" web sites I'm familiar with generally use a web-based comment box format (not unlike the one I'm typing in now). Those agencies really interested in preserving anonymity presumably don't create server logs showing the IP addresses of folks hitting their comment page. No record, no obligation to produce the record (and I know of no FOIA-like law requiring the creation of web server logs).

On the other hand I have heard stories about one particular public agency that has an "anonymous complaint line" but does keep and use server logs. Every once in a while when the agency receives an anonymous complaint that makes credible allegations of criminal conduct, the sender's IP address is allegedly used as the basis for an ECPA subpoena to the associated ISP, seeking connection information and the subscriber's identity. The "anonymous" complainant then may get a friendly follow-up visit from an inquisitive fellow with a badge.

Or to put it differently, the famous New Yorker cartoon was wrong. On the Internet, everybody DOES know you're a dog...
7.24.2008 5:06pm
Ben P (mail):

The anonymous government "tip-line" web sites I'm familiar with generally use a web-based comment box format (not unlike the one I'm typing in now). Those agencies really interested in preserving anonymity presumably don't create server logs showing the IP addresses of folks hitting their comment page. No record, no obligation to produce the record (and I know of no FOIA-like law requiring the creation of web server logs).


I was already thinking of "Tip Box" type inputs for anonymous complaints.

But unlike you, perhaps rightfully or wrongfully, I assumed that most agencies would in fact keep server logs of complaints that had been submitted merely because most server software that allows web line posting does that. At least the examples I've seen put the IP address of the recieved post in the default information. IE it has "7.24.2008 at 4:06pm, posted by IP address 123.456.7.8"

They might have the ability to turn this off, or if their software is custom designed for anonymous tips it might not include it in the first place, but I didn't really want to make that assumption.
7.24.2008 6:32pm
Albatross (www):
Smokey said: Seems that the numerous FOIA requests for James Hansen's and Michael Mann's taxpayer-funded NASA data and computer algorithms that were used to scare the public re global warming are exempt from disclosure.

I was talking about Texas open records law specifically, not the federal law. Sorry if I wasn't clear.
7.24.2008 10:11pm