The devil in the metadata - Page 3

San Francisco struggles with a different kind of public record

“The fundamental problem for the city is that it has no authority to legislate a new general exception of exemption from the CPRA (California Public Records Act), and that’s what’s being advanced here.”
“The city’s scofflaw position represents the status quo ante, the old law that used to allow an agency to provide a copy of computer data ‘in a form determined by the agency.’ The city’s position has been directly and completely repudiated by the legislature. If the city disagrees with the law, it should come to Sacramento and get a bill,” wrote Thomas Newton, general counsel for the California Newspaper Publishers Association (CNPA).
As for the hacker scare, Zac Multrux, an independent technology consultant was invited to the Sep. 26 hearing by task force member Bruce Wolfe to speak about the dangers of metadata. He suggested a number of technological tools that are available for purchase or are free online, that will “scrub” metadata from documents. He said that while it’s true that someone with ill intent could mess with metadata, “I think someone would need a whole lot more than the name of a computer” to hack into the city’s system. “Personally, I don’t see it as a significant security risk,” he said.
It was also pointed out at the hearing that a variety of city, state, and federal departments already make Word and Excel documents available. Wolfe did a quick online search and found more than 96,000 Word documents on the State of California web site. “They’re not afraid to make Word documents public online,” he said.
Over the course of two hearings the task force found no basis for Zarefsky’s claims in either the city’s law or the California Public Records Act - both of which explicitly state a document should be released in whatever format is requested, as long as the document is regularly stored in that format or does not require any additional work to provide.
The task force found Young in violation of the ordinance and she was told to make the documents available in Word format. No restrictions or rulings were made for future requests, but task force member Sue Cauthen said, “I think this whole case is a test case for how the city provides documents electronically.”

What’s next?
As requested, Young had the Sunshine Ordinance, in Word format, pulled from the city’s files and posted on a separate server outside of the city’s system to be viewed. Crossman, noting the added labor and resources for that provision, wondered if that would happen to all public records requested in Word format, so he cooked up another request to test his theory.
He asked for all the pending and accepted legislation for the month of September from the Board of Supervisors, in Word format.
While the Sunshine Ordinance Task Force had found that withholding documents because of metadata was against the law, redaction of privileged information is still legally necessary, and Young continued to follow the city attorney’s advice that a PDF with no metadata was still the safest, easiest way to comply. She told us, “I don’t take their advice lightly.”
Zarefsky’s opinion said departments “may” provide PDFs instead of Word documents and that “metadata may include a wide variety of information that the City has a right -- and, in some cases a legal duty -- to redact. Young’s office does have pending legislation in Word format, she says it does not fall within the expertise of her staff to review and redact the metadata in those documents because they didn’t author them. “Since we don’t create the documents, how could we ever know whether the metadata should be released? We don’t know what it is,” she told us. “We couldn’t even hire expertise that would know.”
“I can’t imagine there’s so much toxic stuff in Board of Supervisors records they can’t let out,” Grossman told us. “This is a whole mystery to me.”
“It’s just data,” says Crossman. “City employees created it on our dime.