Kentucky city denies public records requests on hack attack; contends no data compromised

Published 4:59 am Friday, April 16, 2021

Scant information has surfaced regarding a hack into the City of Frankfort’s IT servers since news first broke of the breach a month ago.
No more came as a result of a round of open records requests filed by The State Journal for more information regarding the ransomware attack and the overall security of the city’s servers.
Three open records requests were denied last week based on Kentucky statute exemptions related to “a terrorist act” and attorney-client privilege.

Two requests sought records related to the city’s response to the hack and one asked for records prior to the city’s learning of the breach in mid-March regarding the city’s server security.

Two open records experts and advocates have called the city’s denial “nowhere close to sufficient” per state statute, particularly as it relates to a request asking for emails related to the security of Frankfort servers prior to when the hack was discovered.
In response to questions from The State Journal, City Clerk Chermie Maxwell — the primary records-keeper for the city — said that the city may have made a mistake in denying all potentially responsive records.

“Honestly, it looks like we just missed the dates on (the) third request since we have been so focused on the current events,” Maxwell wrote.

The response to that open records request is forthcoming.

Still, Amye Bensenhaver — a retired assistant attorney general who wrote open records and open meetings opinions for 25 years — quoted a recent Kentucky Supreme Court ruling against the University of Kentucky for blanketly denying a records request that might not have been entirely exempt.

“This is precisely the boilerplate response the Kentucky Supreme Court just declared wholly insufficient in UK v The Kentucky Kernel,” Bensenhaver said. “… The city needs to index the records, release any records that are not exempt, describe those that are and correlate the exempt records to the exemption in a response that is ‘detailed enough to permit the court to assess its claim and the opposing party to challenge it.’