Request for Email Metadata (Information Technology)

To Whom It May Concern:

Pursuant to the Wisconsin Open Records Act, I hereby request the following records:

For all email accounts under the management of this city, please provide me the following information for all emails sent and received during January, 2019:

1. From address
2. To address
3. bcc addresses
4. cc addresses
5. Time
6. Date

E-mail metadata is trivially exportable from the IT infrastructure of any modern e-mail archiving or data retention system - such as Microsoft Outlook 365, Google, Datacove, etc. - and should be deliverable in a .CSV, .XLS, or other machine readable format.

Please note that I am not requesting the contents of each email. E-mail metadata does not include the contents of the specified e-mails, thus do not need individual review for redaction.

The requested documents will be made available to the general public, and this request is not being made for commercial purposes.

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response to this request within 10 business days.

Sincerely,

Matt Chapman - Free Our Info, NFP

Thank you for your response, however I respectfully disagree with most points provided within the rejection letter. For the points that I don't disagree with, I am more than happy to work out a set of narrowing criteria, as provided below.

The records responsive to my request already exist, and so there is no need to create any records in order to complete this request. Here is the technical documentation which describes how messages are stored within Exchange, which is used by your city for storing emails: https://msdn.microsoft.com/en-us/library/ee158780(v=exchg.80).aspx . The takeaway from this document is that while a message itself is an object (a record), there are subobjects (also records) for 1. the message body, 2. recipients and sender and 3. attachments. To the extent that you would likely consider an attachment to be a distinct record, despite being a component of an email message in its method of storage, then it follows that the recipient objects of an email would be a distinct record apart from the message themselves. This also means that the review of the emails themselves would not require review, as those are only a superset of the requested records, and are not responsive to this request.

In your rejection letter you state that there are several forms of social engineering attacks that can come from access to the information pursuant to this request. The use of such a rejection is rife for abuse towards many other classes of information and bears a chilling effect on transparency as a whole. Furthermore, much of the information responsive to this request is already listed online, strewn across many publicly available documents. The provided list of attacks should be treated as equally valid for the information already posted online, and should not apply to the records from this request.

The concern for private emails, however, is valid in the context of the provided case law. To remediate this concern, please narrow the scope of this request to only include .gov, cityofmadison.com, email addresses, and those listed in the attached document. The attached document contains email addresses scraped from https://cityofmadison.com, have already been released to the public by the City of Madison, and should be releasable in this request as well. The second column includes the source of the information, should the list require review. This document can be used in conjunction with excel, powershell, msaccess, or similar tools to assist with filtering records. Let me know if you would like any technical help with any filtration processes.

Lastly, the claim that there is no substantive information about the affairs of government or official acts of government officers/employees from the records is not correct. The records responsive to this request are incredibly useful for understanding the network and communication structure of any large group. The information would open many doors of graph theoretic analysis, similar to that which was done in the investigation of Enron to identify particular emails through social network analysis. In particular, the metadata will be used in conjunction with the other metadata sets across the other states that have received this request. As such, the records provide a large and granular picture of who is communicating with who, not just within Madison, but also throughout the United State. Please let me know if you have any further questions of how the information could be used.

It is my hope that the provided narrowing pushes this request to a point where very little review is required for completion.

Regards -
Matt Chapman
Free Our Info, NFP