RTK request for computer logins partially approved and denied by OOR
SOMERSET ― The Pennsylvania Office of Open Records filed its determination Sept. 27 concerning a right-to-know request filed by Lester Younkin and denied by Somerset County Commissioners, giving each party a victory.
Younkin said this week he will appeal the determination.
His request, seeking certain computer log information for specified county employees, was determined as granted in part and denied in part. Granted was the county's point that disclosure of the active directory logs is likely to pose a risk to the county's computer security, but that access to employees' names and login and logout times can be released under the state's Right-to-Know Law.
However, the OOR determined the county doesn't have those records that Younkin is asking for because the server log showing the login and logout information doesn't exist within the county's possession, custody or control.
"The county NEVER disputed the existence of the log. In fact, the IT director submitted an unredacted Active Directory log in their appeal in an attempt to justify why they can’t release the information," Younkin said in an email. "The county has the information. They simply do not want to release it. The county claim that they would need to purchase software to extract the data is blatantly false."
More: Somerset commissioners say they have no evidence employees abusing time-off policies
County solicitor Christopher Furman, on behalf of the county commissioners, issued this statement:
"On Sept. 27, 2023, the Office of Open Records issued its Final Determination in OOR Appeal No. 2023-1983, granting the appeal in part, denying it part. The request was for daily computer and Exchange server login and logout times for certain personnel. Because the county does not use an Exchange server, that part of the appeal was denied. Regarding the computer login information, the county’s software is not currently capable of producing the requested information without producing certain other information embedded with it that, if disclosed, would pose a risk to the county’s computer security. Put simply, to provide the requested data, the county will need different software. Because Section 1307(g) of the RTKL provides that the necessary cost incurred in complying with the RTKL is the requester’s burden, the OOR directed the county to provide the requester with a cost estimate for the software needed to extract the public information so it can be provided separately. The county identified the software and provided a cost estimate to the requester. Accordingly, the non-threatening public records can be provided If the requester pays for the software to extract it."
Right-to-Know Law
Under the Right-To-Know Law, state and local government agency records are public, and if the commissioners want to withhold a record, they must prove that they can, under the RTKL, another law or regulation, privilege (such as attorney-client privilege), or court order.
More: Employee timesheets is the basis for Right-to-Know requests
Younkin said in a commissioners meeting last month that his right-to-know requests for login and logout information is to find out if certain county employees are or are not working when they claim they are and are getting paid for. The commissioners told him their information technology person said those records don't exist because the county's computers show only the last time a person logged on or off of the computer or laptop.
"All I ever asked for was the time stamp. Nothing more," Younkin said about the OOR determination. "What time did the employee log in and what time did they log out? Employees are (have been) being paid for not working. And the commissioners along with HR knows it."
According to the PA Office of Open Records website, if either party disagrees with the OOR's final determination, they may appeal to the Commonwealth Court. Appeals of an OOR final determination must be filed within 30 days of the mailing date of the final determination. An appeal puts a hold on the release of records until the court decides the matter.
"My next step is to forward everything over to the Attorney General," Younkin said.
RTK requests
As of Sept. 26, the commissioners received 91 right-to-know requests this year, a considerable jump compared to 2009 when they received 23 requests all year. Of those requests, Younkin has made 16 this year alone, the commissioners said.
This article originally appeared on The Daily American: Determination reached for request for Somerset County employee computer logins
