Puerto Rico CISA Assessments

To Whom It May Concern:

Pursuant to the Freedom of Information Act, I hereby request the following records:

Reports show that Puerto Rico has been the subject of several "hacks" over the last three years:
https://www.notiuno.com/noticias/puerto-rico-sufre-m-s-de-450-millones-de-ataques-cibern-ticos-a-hospitales-y/article_c58ff970-425e-11ee-b181-e378c3b1bbfc.html
https://www.nbcnews.com/news/latino/cyberattack-cripples-puerto-rico-toll-collection-system-rcna24993

Therefore, I request the following records:

1) All records produced through risk and vulnerability assessments (RVA), critical infrastructure assessments, or any other type of assessments done on the security of Puerto Rican government agencies' digital systems.

2) Any presentations, presentation attachments, and instructional materials (these include but are not limited to audio, video, PowerPoint presentations, and slide formats) concerning the results of these assessments meant to explain these findings to Puerto Rican government officials.

3) Any communications, messages, emails, and attachments between your department and Puerto Rican government agencies (including but not limited to: Puerto Rico Police Department, Office of the Governor (La Fortaleza), and the Municipality of San Juan) concerning the results of these assessments.

This request is for all records produced between January 1, 2022 and the time this request is processed.

This request is not being made for commercial purposes. I am an independent journalist and the documents obtained through this request will be used in the course of reporting about cyber security vulnerabilities within Puerto Rico.

The requested documents will be made available to the general public, and this request is not being made for commercial purposes.

In the event that there are fees, I would be grateful if you would inform me of the total charges in advance of fulfilling my request. I would prefer the request filled electronically, by e-mail attachment if available or CD-ROM if not.

Thank you in advance for your anticipated cooperation in this matter. I look forward to receiving your response to this request within 20 business days, as the statute requires.

Sincerely,

Carlos Berríos Polanco

Dear FOIA Officer,

This letter serves as a follow-up to my previous Freedom of Information Act (FOIA) request dated April 30, 2024, regarding records concerning the security of Puerto Rico's government digital systems.

I submitted my original request on April 30, 2024, and pursuant to 5 U.S.C. § 552(a)(6)(A)(i), agencies are required to respond to FOIA requests within 20 business days of receipt. It has now been nearly two months since my request, and I have yet to receive any communication regarding my request.

Given the statutory obligation under the FOIA and the legal precedents supporting timely responses, I am prepared to take appropriate legal action, including filing a lawsuit in federal court, if necessary, to enforce my rights under the FOIA.

Therefore, I urgently request an update on the status of my request. Please confirm receipt of my initial request and provide a specific timeline for when I can expect a response. If there are any issues or delays in processing my request, please specify the reasons for the delay and provide an updated expected date of completion.

Should you require any additional information or clarification to expedite the processing of my request, please contact me promptly at 787-449-4731 or via email at carlosBP@protonmail.com.

I emphasize the importance of expeditiously fulfilling this request in accordance with the FOIA and trust that you will promptly address this matter to avoid any further legal recourse.

Thank you for your immediate attention to this request. I look forward to your prompt response.

Sincerely,

Carlos Berríos Polanco