VIRGINIA FREEDOM OF INFORMATION ADVISORY COUNCIL COMMONWEALTH OF VIRGINIA

AO-03-08

March 19, 2008

Mark Hjelm
Woodbridge, Virginia

The staff of the Freedom of Information Advisory Council is authorized to issue advisory opinions. The ensuing staff advisory opinion is based solely upon the information presented in the correspondence and other materials you provided on January 16 and February 19, 2008.

Dear Mr. Hjelm:

You have asked whether Prince William County Public Schools (the School) complied with the Virginia Freedom of Information Act (FOIA) in its responses to two requests for public records you made on December 7, 2007 (the December request), and January 22, 2008 (the January request), respectively. As background, the December request was made in three parts, all of which concern different aspects of a visitor identification system recently adopted by the School. Briefly summarized, the December request asked for three things: (1) copies of identifications entered into the system; (2) a copy of the policy sent to Freedom High School regarding the visitor identification system; and (3) the name of all systems used to cross-check information entered into the visitor identification system, along with any relevant agreements or guidelines. You also provided several newspaper accounts describing this visitor identification system. In brief, it appears that as of December, 2007, the School requires all visitors to present government-issued photo identification which is then checked against sex-offender databases nationwide. The new visitor identification system keeps a record of visitors and replaces the sign-in visitors log formerly used by the School. The January request was also made in three parts: (1) it reiterated the December request; (2) it asked for records showing attorney's fees paid in relation to the December request; and (3) it asked to inspect FOIA requests, responses, and public records from January 1, 2007 to January 22, 2008. In both cases, you received response letters from the School's attorney. Each request and response is addressed separately below, with further facts presented as appropriate.

Subsection A of § 2.2-3704 of the Code of Virginia provides that [e]xcept as otherwise specifically provided by law, all public records shall be open to inspection and copying by any citizens of the Commonwealth during the regular office hours of the custodian of such records. The relevant policy of FOIA regarding access to public records as set forth in § 2.2-3700 requires that

the provisions of [FOIA] shall be liberally construed to promote an increased awareness by all persons of governmental activities and afford every opportunity to citizens to witness the operations of government. Any exemption from public access to records ... shall be narrowly construed and no record shall be withheld ... unless specifically made exempt pursuant to this chapter or other specific provision of law.

In following these provisions, therefore, all exemptions allowing records to be withheld are to be given a narrow construction, and any doubts regarding the application of any exemption are to be resolved in favor of public access.

The initial part of your December request asked for a copy of all identification that was scanned or manually entered into [the School's] Visitor Identification System at Gar-Field High School, Woodbridge High School, and Freedom High School from 12-3-07 to 12-7-07. The School denied this request in its entirety. The School cited four exemptions in this denial, each of which is considered separately below.

First, the School cited subdivision 6 of § 2.2-3705.1, which exempts from FOIA the following records: Vendor proprietary information software that may be in the official records of a public body. For the purpose of this subdivision, "vendor proprietary software" means computer programs acquired from a vendor for purposes of processing data for agencies or political subdivisions of the Commonwealth. While this is a valid exemption that would allow the School to withhold copies of any such proprietary software used in the visitor identification system, it does not appear to be relevant to your request. You asked for a copy of the identifications scanned into the system over a certain time period, but did not request any copies of software or computer programs. Therefore this exemption for proprietary software would not appear to apply to the type of records you requested.

Second, the School cited subdivision 6 of § 2.2-3705.2, which exempts from FOIA the following records:

Engineering and architectural drawings, operational, procedural, tactical planning or training manuals, or staff meeting minutes or other records, the disclosure of which would reveal surveillance techniques, personnel deployments, alarm or security systems or technologies, or operational and transportation plans or protocols, to the extent such disclosure would jeopardize the security of any governmental facility, building or structure or the safety of persons using such facility, building or structure.

Again, it does not appear that you requested records to which the cited exemption would apply. For purposes of this opinion it is presumed that the visitor identification system itself and its components could be considered a security system or technologies. This exemption would apply to records such as manuals showing how to operate the visitor identification system, as disclosure of such records might also reveal means of defeating the system and thus jeopardize the security of the schools or safety of persons therein. However, identifications entered into the system are not the same thing as manuals showing how to operate the system. Also, the fact that visitors are required to present identification that is then checked by the system has been widely publicized in newspaper accounts¹ as well as in the School's own regulations.² Records of the identifications entered into the system would appear to be the equivalent of a visitor log in paper format. In other words, the requested identification records would reveal who has visited the schools, but would not reveal anything about the visitor identification system itself that would jeopardize the security of the school or the safety of persons using the school. The requested records therefore do not appear to fall within the terms of this exemption.

The third exemption cited was subdivision 7 of § 2.2-3705.2, which exempts from
FOIA [s]ecurity plans and specific assessment components of school safety audits, as provided in § 22.1-279.8. The use of this exemption was addressed in a prior opinion issued to you by this office.³ As stated therein, the exemption applies only to portions of the audit itself, a very specific document defined in § 22.1-279.8, and not to any and all records that may reference the School's security or security procedures. The discretion to withhold security plans and vulnerability assessments from the audit must be construed narrowly, and may only be applied to portions of the audit whose release would present a security threat or make public the portions of an analysis that uncover weaknesses in existing plans. It does not appear that the identification records you requested fall within the definition of school safety audit set forth in § 22.1-279.8.⁴ While it is possible that a school safety audit would contain records regarding the visitor identification system that would be exempt from disclosure, it does not necessarily follow that all records related to visitor identification system are part of a school safety audit. In this instance, it does not appear that the identification records you requested fall within the ambit of the exemption cited for school safety audits.

The fourth exemption cited was subdivision 1 of § 2.2-3705.4, which permits the School to withhold [s]cholastic records containing information concerning identifiable individuals, except that such access shall not be denied to the person who is the subject thereof, or the parent or legal guardian of the student. The term scholastic records is defined in § 2.2-3701 to mean those records containing information directly related to a student and maintained by a public body that is an educational agency or institution or by a person acting for such agency or institution. Because your request asked for identifications, such records clearly contain information concerning identifiable individuals. It appears the records are kept by the School, and therefore are maintained by a public body that is an educational agency or institution or by a person acting for such agency or institution. If such identification records also contain information directly related to a student, then these records are scholastic records to which the exemption applies. In other words, this exemption would allow student identifications entered into the visitor identification system to be withheld from disclosure. To the extent this exemption was used to withhold such student identifications, that use was in compliance with FOIA.

The second part of your December request sought a copy of policy for the Visitor Identification System that was sent to Freedom [High School]. The school responded by stating that no "policy" was sent to that high school, and included a copy of Regulation 926-1 concerning visitor identification. You pointed out that a different regulation numbered 501.06-1 is posted on the high school's website, which also addresses visitor monitoring and identification.⁵ Regulation 926-1 does not appear to be published on Freedom High School's website. Given the phrasing of your request and the School's reply, it would appear that Regulation 926-1 is what was sent to Freedom High School regarding the Visitor Identification System. Notably, Regulation 501.06-1 carries the subheading HUMAN RESOURCES and is dated November 14, 2007. Regulation 926-1 carries the subheading COMMUNITY RELATIONS and is dated December 3, 2007. Much of Regulation 926-1 is identical to the language of Regulation 501.06-1 concerning visitor badges and the visitor identification system. However, it appears that the older regulation, 501.06-1, contains references to visitor logs that have been removed from 926-1. Considering both Regulations together, it appears that Regulation 926-1 may be an updated version of Regulation 501.06-1, and that the School provided it as the Regulation that was sent to Freedom High School and that reflects current School policy. You noted, however, that Regulation 926-1 is not on the Freedom High School website, while Regulation 501.06-1 is posted there. It may be that the website has not been updated to reflect changes in the Regulations. On the other hand, noting that the two regulations have different subheadings (HUMAN RESOURCES and COMMUNITY RELATIONS, respectively), it may be that they are meant to apply concurrently to different areas of concern. In any case, FOIA does not impose any requirement for a public body to post its regulations on its website, or to provide an explanation of why one regulation is posted and another is not. Such postings are voluntary, and efforts to voluntarily increase the transparency of government operations are fully in compliance with the purposes and spirit of FOIA. Freedom High School and other public bodies are to be commended for such efforts, and encouraged to continue them. In summary, there does not appear to be any violation of FOIA in this response by the School.

The third aspect of the December request asked for the name of all systems used to cross-check names entered into the visitor identification system and any agreement or guidelines between the School and any named system. The School indicated it has a contract with Raptor Technologies to provide the software system to cross-check visitor names with the Registered Sex Offender Database. As a general rule, a contract with a public body is an open public record once it has been awarded, although various exemptions may apply to portions of the contract, depending on the exact circumstances involved.⁶ In such instances, subdivision B 2 of § 2.2-3704 provides that [w]hen a portion of a requested record is withheld, the public body may delete or excise only that portion of the record to which an exemption applies and shall release the remainder of the record. However, the School declined to provide a copy of this contract, citing three exemptions as bases for withholding it, each of which is considered separately below.

First, the School again cited subdivision 6 of § 2.2-3705.2, quoted in full above. To reiterate the scope of this exemption, it would apply to certain records the disclosure of which would jeopardize the security of any governmental facility, building or structure or the safety of persons using such facility, building or structure. While it is not clear how disclosure of the contract between the School and Raptor Technologies would cause such jeopardy, the contract may contain technical details or other information that would do so. If that is the case in fact, then it would be appropriate to redact those portions of the contract to which the exemption applies. However, other terms of the contract, the release of which would not jeopardize security or safety, would not fall within the terms of this exemption.⁷

Second, the School again cited subdivision 7 of § 2.2-3705.2 concerning school safety audits, also quoted above. The same reasoning that applied with regard to the identification records would also apply in this situation. A school safety audit is a very specific document defined by statute; the contract at issue does not appear to be part of a written assessment of safety conditions as set forth in that definition.⁸ Because the contract does not meet the definition of school safety audit, that exemption may not be used to withhold the contract.

Third, the School cited subdivision F 7 of § 2.2-3706, which permits the withholding of records of law enforcement agencies, to the extent that such records contain specific tactical plans, the disclosure of which would jeopardize the safety or security of ... the general public. This exemption by its own terms applies to records of law enforcement agencies. At first blush, it appears self-evident that the School is not a law enforcement agency. However, the Code of Virginia does not define law enforcement agency. Section 9.1-101 defines the terms law-enforcement officer and criminal justice agency, neither of which appear to include schools or school officers or employees. The same section also defines school resource officer to mean a certified law-enforcement officer hired by the local law-enforcement agency to provide law-enforcement and security services to Virginia public elementary and secondary schools. It also defines school security officer to mean

an individual who is employed by the local school board for the singular purpose of maintaining order and discipline, preventing crime, investigating violations of school board policies, and detaining students violating the law or school board policies on school property or at school-sponsored events and who is responsible solely for ensuring the safety, security, and welfare of all students, faculty, staff, and visitors in the assigned school.

Given this context, particularly the fact that officers who work at schools are separately defined, it appears that the School is not a law enforcement agency, but that law enforcement officers, especially school resource officers, may work at the School. It would logically follow that such officers are likely involved in the visitor identification program as part of their duties. However, the exemption is still limited to records of law enforcement agencies, which would not include a contract by a school for software that might be used by law-enforcement officers. Additionally, it is still not clear that the contract contains any specific tactical plans or how disclosure of the contract would jeopardize the safety or security of ... the general public. Given the narrow construction rule of FOIA, it seems too great a stretch to call the School a law enforcement agency and to characterize a contract as a specific tactical plan. Without those elements, this exemption cannot apply.

The first part of your January request simply reiterated your December request. The School provided the same response letter in reply as it did to your original December request. No additional factual or legal considerations were presented. The analysis of your December request and response given above therefore covers the first part of your January request and the School's reply to it as well.

The second part of your January request asked for a copy of all attorney fees, in detail, relating to [the December request]. The School's response explained that its attorney's fees are not separately billed but use "block billing," and therefore it has no records showing the amount of time spent or amount of fees incurred by its attorneys for any specific FOIA request. Particularly, the School stated that any attorney's fees which might have been incurred ... are not separately billed and the bill does not break out the time related to a FOIA request from other legal matters. There are, therefore, no documents reflecting the amount of time and/or the amount of attorney's fees incurred ... for work performed by legal counsel relating to any particular FOIA request. Following the School's explanation, it would appear that while there is a record of attorney's fees billed to the School, that record is not responsive to your request because it does not differentiate between charges for work related to the December request and other charges. Subdivision B 3 of § 2.2-3704 requires a public body to inform a requester when records responsive to a request do not exist. Subsection D of § 2.2-3704 provides that no public body shall be required to create a new record if the record does not already exist. Given that the existing billing record is not responsive to this request, and no other responsive record exists, it appears that the School properly informed you of these facts in compliance with FOIA.⁹

The third part of your January request asked for a time to inspect all FOIA request along with responses and all "public records" 2.2-3701 relating to above FOIA's from 1-1-07 to 1-22-08 [sic]. Subsection B of § 2.2-3704 requires that requests for public records shall identify the requested records with reasonable specificity. That requirement means that a request needs to be specific enough to enable a public body to begin to process the request and, if clarification is required, to ask relevant questions to understand the scope of the request.¹⁰ The language of this request on its face appears to ask for copies of all FOIA requests made from January 1, 2007 to January 22, 2008, along with all responses to those requests and all public records relating to those requests. However, it is not readily apparent what you meant by all "public records" 2.2-3701 relating to above FOIA's. This phrasing could mean all public records that were provided in response to FOIA requests made during the stated time period; it could mean all public records that were related to the responses made, such as internal memoranda or policy statements regarding how the FOIA requests would be addressed; it could encompass records created after the requests were made and answered that were related to the topic of older FOIA requests; it could mean all of these things, or any combination of them. As it is written, this aspect of your request does not identify the requested records with reasonable specificity because it is vague and easily susceptible to multiple interpretations.

In considering the School's response, first note that the General Assembly has stated in § 2.2-3700 the policy of FOIA that [a]ll public bodies and their officers and employees shall make reasonable efforts to reach an agreement with a requester concerning the production of the records requested. This office has advised that when a request is unclear, then following the policy of FOIA, a public body should contact the requester to clarify the matter. In this instance, the School replied to your request as follows:

As noted above and in the FOIA response dated December 11, 2007, your FOIA requests seek documents which are exempt from disclosure under Virginia FOIA and, therefore, your request to inspect such documents is denied. Moreover, this particular request, i.e. "a time to inspect FOIA responses and public records" from 1-1-07 to 1-22-08 is confusing, inasmuch as the [School] did not receive a FOIA request from you between January 1, 2007 and January 22, 2008.

Therefore the School denied your request, first on the basis that your FOIA requests asked for exempt records, and second, because the request is confusing, inasmuch as the [School] did not receive a FOIA request from you between January 1, 2007 and January 22, 2008. Addressing the second basis first, the initial facts and documentation you provided, as described above, indicate that the School did, in fact, receive a FOIA request from you on December 7, 2007, and replied to that request by letter December 11, 2007. The statement that the School did not receive a FOIA request from you between January 1, 2007 and January 22, 2008 therefore appears to be contradicted by the facts you have presented. If there is a factual dispute, then a court is the proper forum to resolve such a dispute, and so this issue will not be addressed further in this opinion.

Rather than a factual dispute, however, it appears the primary problem regarding this aspect of your request may be a misunderstanding and failure to communicate regarding the scope of your request. It appears that the School may have interpreted your request as a repetition of prior records requests you made during the stated time period. In other words, it appears that the School may view this third part of your January request as merely repeating the substance of prior requests already denied by the School, rather than as a new request seeking copies of those prior requests, responses, and any related public records. Additionally, the School's response indicates that it views the third aspect of your January request as asking only about requests you made, while the language of your letter asked for all FOIA request[s], which would also include requests made by other persons as well. On its face, the request appears to seek all public records requests made of the School, responses thereto, and related public records for a period of just over a year. This would seem to me at first blush to be asking for documentation of FOIA requests, responses, and other records such as memoranda regarding how FOIA requests would be handled. However, as evidenced by the School's own statement that the request was confusing, it is not entirely clear what was the intended scope of your request. Given the apparent confusion regarding this third part of your January request, the School should have contacted you to clarify what records you sought.

As previously quoted, requesters are required to identify the requested records with reasonable specificity, and [a]ll public bodies and their officers and employees shall make reasonable efforts to reach an agreement with a requester concerning the production of the records requested. It does not appear that either occurred in this instance. The request was confusing, yet the School acted by denying it rather than attempting to clarify what you sought. Once again, I am compelled to reiterate that the practical perspective of dealing with the application of FOIA on a daily basis has taught me that clear and concise communication between a requester and a government official is often the best way to successfully resolve any concerns about a FOIA request.¹¹ I would suggest that you rephrase your request to clarify exactly what records you seek. The School would be well-advised in the future to seek additional clarification from the requester whenever there is confusion about the scope of a request.

As a final matter, in your January letter you noted that you felt that the School's denials of your December request were deficient in that they failed to identify with reasonable particularity the volume and subject matter of withheld records, as required by subdivision B 1 of § 2.2-3704. The School responded as follows: Since your request, repeated in [the December letter], delineated the documents that you were seeking, and [the School is] not declining to produce the records due to the volume of those records, there was no issue regarding the volume and subject matter of the records being withheld. The volume of a records request may be the cause of increased charges for production,¹² and may be grounds for a public body to seek additional time to respond.¹³ However, volume alone is not grounds for denial of a request. Subdivision B 1 of § 2.2-3704 requires an identification of the volume and subject matter of withheld records any time records are withheld in their entirety, regardless of why the records have been withheld. In its December response, the School did quote each of your requests before responding to them, and those December requests did identify the subject matter of the records you sought. Therefore by repeating your requests in its response, the School is correct that it satisfied its obligation to identify the subject matter of the withheld records. However, the School's response did not identify the volume of the withheld records in any way, and therefore failed to meet that requirement of subdivision B 1 of § 2.2-3704.

Thank you for contacting this office. I hope that I have been of assistance.

Sincerely,

Maria J.K. Everett
Executive Director

¹See, e.g., The sign-in for the 21st century, Potomac News, December 3, 2007, at A6; Genz, Sex-offender checks in schools, D.C. Examiner, Dec. 1, 2007 (available at http://www.examiner.com/a-1079707~Sex_offender_checks_in_schools.html).
²Subsection I D of Regulation 926-1 states that visitors shall be required to report to the main office of the school or School Division facility, provide and leave valid government photo identification, and state the nature of their visit to the School division facility. Subsection II C of the same Regulation states that all visitors must produce one of the several forms of valid government issued identification, containing a full name, date of birth, and photograph that the visitor identification system will cross-reference against states' sex offender registries.
³Freedom of Information Advisory Opinion 09 (2004).
⁴Subsection A of § 22.1-279.8 defines school safety audit to mean a written assessment of the safety conditions in each public school to (i) identify and, if necessary, develop solutions for physical safety concerns, including building security issues and (ii) identify and evaluate any patterns of student safety concerns occurring on school property or at school-sponsored events. Solutions and responses shall include recommendations for structural adjustments, changes in school safety procedures, and revisions to the school board's standards for student conduct.
⁵Available at http://freedom.groupfusion.net/modules/cms/pages.phtml?pageid=32352&sessionid=f51a03e608bb6ebec8b6be7156ec3756 (last accessed March 7, 2008).
⁶See, e.g., subdivision 12 of § 2.2-3705.1 (records related to the negotiation and award of specific contracts); subdivision 10 of § 2.2-3705.6 (referring to trade secrets or proprietary information protected under § 2.2-4342 of the Virginia Public Procurement Act); subdivision 11 of § 2.2-3705.6 (referring to similar protections under the Virginia Public-Private Transportation Act of 1995 and the Virginia Public-Private Educational Facilities and Infrastructure Act of 2002).
⁷For example, terms such as the named parties to the contract, the duration of any services provided, the costs involved, and any other terms that would not affect safety or security if publicly revealed.
⁸See n.4, supra (quoting the statutory definition of school safety audit in full).
⁹The School also referred to the exemptions for attorney-client privilege and work-product, subdivisions 2 and 3 of § 2.2-3705.1, respectively. It is unnecessary to address those exemptions under these facts because if no responsive records exist, there are no records to which exemptions might apply. However, I note that the use of these and other exemptions has been examined previously in the context of attorney billing statements. Generally, it was concluded that such billing statements are open to disclosure, but that portions might be redacted pursuant to specific exemptions. See Freedom of Information Advisory Opinions 10 (2004) and 25 (2003); 1987-1988 Op. Att'y Gen. Va. 30.
¹⁰Freedom of Information Advisory Opinions 01 (2008) and 01 (2000).
¹¹Freedom of Information Advisory Opinions 02 (2008), 25 (2004), and 16 (2004).
¹²It is presumable that charges allowed under subsection F of § 2.2-3704 in accessing, duplicating, supplying, or searching for a greater volume of records often will be correspondingly higher than the equivalent charges for a lesser volume of records.
¹³For example, a sufficiently large volume of records could constitute a condition that makes it not practically possible to provide the requested records or to determine whether they are available within the five-work-day period under subdivision B 4 of § 2.2-3704. Similarly, in cases where a public body and a requester cannot reach agreement on the production of records after making reasonable efforts to do so, subsection C of § 2.2-3704 provides that a public body may petition the appropriate court for additional time to respond to a request for records when the request is for an extraordinary volume of records.