complainant's memorandum in support of action to compel compliance

8/18/2019 Complainant's Memorandum in Support of Action to Compel Compliance

http://slidepdf.com/reader/full/complainants-memorandum-in-support-of-action-to-compel-compliance 1/27

OAH 5-0305-33135

STATE OF MINNESOTA

OFFICE OF ADMINISTRATIVE HEARINGS

______________________________________________________________________________

Tony Webster,

Complainant,

COMPLAINANT’S MEMORANDUM

v. IN SUPPORT OF ACTION TO

COMPEL COMPLIANCE

Hennepin County and the (Minn. Stat. § 13.085)Hennepin County Sheriff’s Office,

Respondents.

______________________________________________________________________________

This action seeks to compel Hennepin County and the Hennepin County Sheriff’s Office

(collectively “Respondents”) to comply with the Minnesota Government Data Practices Act

(“MGDPA”), Minnesota’s freedom of information law. Respondents present an alarming

argument that, if the Court accedes, would create a new type of classification for all government

email: public in theory, but off-limits in practice. This is forbidden by the MGDPA.

The County and Sheriff’s Office are prolific users of biometric technologies, including

through the deployment of approximately 250 mobile fingerprint scanners1

and facial recognition

technology capable of comparing images and video frames against jail booking photographs.2

As

the most populous county in the state, Respondents have discussed, inquired, or been

propositioned by new vendors with evolving biometric technology solutions.3

1Evidentiary Hearing Exhibit (“Ex.”) 18 at 5.2Ex. 18 at 7.3Ex. 204 at 9–12 (search results indicating Respondents have emails referencing vendors and technologies

that Respondents do not currently use).



2

As a public records researcher and journalist with a background in software engineering,4

Tony Webster (“Complainant”)—investigating and reporting on these technologies—submitted a

request to Respondents on August 12, 2015, under the MGDPA.5

Webster’s request was

separated into 14 numbered items, three of which led to the production of some responsive data.6

Over the three months that followed, Respondents sent Webster repetitive, canned “still

processing your request” updates,7

while they ignored Webster’s pleas for additional information

and requests to begin a partial inspection of data.8

Webster thus feared Respondents were not

making meaningful efforts to comply. 9

On a November 3, 2015, phone call, County’s

responsible authority designee Lucie Passus said she could not disclose what Respondents were

doing to comply with Webster’s request, who was working on the request, or if Respondents

were having any trouble complying with the request.10

Fifteen weeks after submission of Webster’s request, in a November 25, 2015, letter,

County responsible authority Kristi Lahti-Johnson told Webster he could inspect some paper

contracts and reports, but said for the first time that Webster’s request to inspect electronic data

about five biometric technologies and five vendors was “too burdensome with which to

comply.”11

Lahti-Johnson described performing a “test” search on five accounts she believed

made more use of the search terms Webster provided,12

which took seven hours.13

Doing some

casual math,14

Lahti-Johnson wrongly assumed performing this search across the entire County

4Written Direct Examination of Tony Webster (“Webster Direct”) at 1–2, 16.5

Ex. 1, 2.6Ex. 18.7Exs. 7, 9, 12, 13, 15.8Exs. 11, 14, 16, 17.

9Webster Direct at 3.10Webster Direct at 5–6; Ex. 51 at 2; Cross-Examination of Lucie Passus (“Passus Cross”) at 3:02:25.11Ex. 18.12Written Direct Testimony of Kristi Lahti-Johnson (“Lahti-Johnson Direct”) at 7.13

Ex. 18 at 6.14Cross-Examination of Kristi Lahti-Johnson (“Lahti-Johnson Cross”) at 3:48:13.



3

“…would tie up Hennepin County’s servers 24 hours a day for more than 15 months…”15

But

this guesstimate was problematic: (1) not every County employee used the search terms as

heavily as this hand-selected group of five employees, so simple multiplication was an

ineffective estimation methodology;16

(2) the County used a flawed and unnecessarily laborious

email search process, which resulted in Respondents overestimating the purported burden of

Webster’s request;17

(3) the County forgot to apply the date limitations Webster provided;18

and

(4) the County performed this ‘test’ search on September 17, 2015, but waited over two months

to communicate the results—or Respondents’ claim of purported burden—to Webster.19

Webster responded on December 4, 2015, by disagreeing with the Respondents’

contentions, citing to the plain language of the MGDPA and three advisory opinions from the

Minnesota Department of Administration.20

Nevertheless, Webster significantly reduced the

scope of his request to seek only emails from the Sheriff’s Office, Security department, and

County staff providing support to those departments, from 2013 to present.21

Webster also asked

to see the ‘test search’ emails the Respondents indicated they found in the meantime.22

Over the

following month, Respondents did nothing to further comply with Webster’s reduced-scope

request,23

with the County and Sheriff’s Office pointing fingers at each other as to who would be

responsible to perform the search.24

15Ex. 18 at 7–8.16

Lahti-Johnson Direct at 7; Ex. 204 at 1; Cross Examination of Christopher Droege (“Droege Cross”) at

24:05.17

Cross-Examination of Tony Webster (“Webster Cross”) at 2:49:49.18Droege Cross at 23:59.19

Id. at 26:04; Ex. 18.20

Ex. 20.21

Id. at 5–6.22

Id. at 6.23Lahti-Johnson Cross at 3:54:29, 3:55:12.24

Cf. Id. (Lahti-Johnson testifying that she did nothing to respond to Webster’s December 4 letter

reducing the scope of his request, and that the Sheriff’s Office was primarily responsible for Webster’s

reduced-scope request) and Cross-Examination of Carrie Hill (“Hill Cross”) at 4:18:01 (Hill testifying



4

Meanwhile, despite telling Webster that he could setup an appointment with Carrie Hill,

Sheriff’s Office responsible authority designee, to view paper contracts and reports,25

it took

Webster five tries to secure an appointment to view the data,26

only for Hill to cancel the

appointment just hours before.27

When Webster was finally permitted to inspect the data at

separate Sheriff’s Office and County inspections on December 21, 2015, the Sheriff’s Office

asked Webster to produce identification, and data he inspected contained improper redactions,

lacking the denial citations and certifications as required by law and requested by Webster

repeatedly.28

At the County inspection, emails too old to be responsive to Webster’s request were

produced for inspection, and redactions were again made without proper denial citation.

29

After multiple attempts to obtain denial certification30

and a commitment to perform the

reduced-scope email search,31

Webster filed this action on January 7, 2016. Respondents then

admitted to making improper redactions.32

Moreover, the County failed to explain or defend its multiple instances of dilatory

conduct in responding to Webster’s request: (a) Christopher Droege, the County’s Computer

that beyond being included in conversation with the County Attorney and Lahti-Johnson, the Sheriff’s

Office did nothing relating to the email search request after December 4, and that the County was

primarily responsible for Webster’s reduced-scope request); Cf. Lahti-Johnson Direct at 9 and Written

Direct Testimony of Carrie Hill (“Hill Direct”) at 4.25

Ex. 18 at 2–3.26

Ex. 19 (Dec. 1); Ex. 20 (Dec. 4); Ex. 22 (Dec. 9); Webster Direct at 9 (Dec. 9 and Dec. 10); Ex. 23

(Dec. 10); Ex. 28 (Dec. 10).27Ex. 29.28Webster Direct at 11–12; Ex. 33; Ex. 34; Ex. 42.29

Id. at 12–13; Ex. 39; Ex. 42.30Ex. 2 at 4 (Aug. 12); Ex. 16 at 2 (Oct. 28); Ex. 20 at 6 (Dec. 4); Webster Direct at 12 (Dec. 21); Webster

Direct at 13 (Dec. 21); Webster Direct at 13 (Dec. 22); Webster Direct at 13 (Dec. 28); Ex. 42 (Dec. 30).31Ex. 20 at 5–6 (Webster provided reduced scope request on Dec. 4); Ex. 27 at 1 (Webster seeking update

on email search on Dec. 10); Ex. 30 (Lahti-Johnson referring Webster to the Sheriff’s Office for the

ongoing email search on Dec. 16); Ex. 32 (Webster correspondence regarding email search on Dec. 18);

Ex. 33 (Sheriff’s Office still reviewing reduced-scope request on Dec. 21); Ex. 41 (Dec. 28 “continuing to

explore the options” email from the Sheriff’s Office); Webster Direct at 13 (Hill stating she was not sure

if Sheriff or County would be leading email search effort on Dec. 28); Ex. 42 (Dec. 30 correspondence

from Webster); Ex. 44 at 2–3 (County Attorney’s Jan. 7 letter sent shortly after filing of action, still

“analyzing” Webster’s reduced scope request).32Ex. 44 at 1–2.



5

Forensics Unit IT Supervisor, did not execute the first search until over a month after Webster

submitted his request;33

(b) Lahti-Johnson sat on the results for over two months before

informing Webster of the results and its denial position despite Droege testifying he believed that

he returned the results of that search within the same week;34

(c) after Webster reduced the scope

of his request, the County waited another month to conduct a search;35

and (d) after informing

Webster that data had been gathered, it took over three weeks for the County and Sheriff’s Office

to allow his inspection; seven weeks until the improper redactions were removed.36

A. Respondents violated the MGDPA by not keeping records containing government

data in such an arrangement and condition as to make them easily accessible for

convenient use pursuant to Minn. Stat. § 13.03, subd. 1.

The MGDPA is the Legislature’s “fundamental commitment to making the operations of

our public institutions open to the public.” Prairie Island Indian Cmty. v. Minn. Dep’t of Pub.

Safety, 658 N.W.2d 876, 883–84 (Minn. App. 2003). The Legislature drafted the MGDPA with

an “acute awareness that in any contest between…the public and a government agency…only the

agency has the advantage of knowing what types of data are maintained, how they are

maintained and how the data can be made accessible”. 37 This (prescient) “anticipat[ion] of

ingenious bureaucratic roadblocks” influenced the Legislature to incorporate “several anti-

gamesmanship provisions” into the MGDPA.38

33Ex. 204 at 1.34Droege Cross at 26:04; Ex. 18.35

Exs. 20, 204 at 2.36Exs. 18, 33, 48.37Donald A. Gemberling, Minnesota Government Data Practices Act: History & General Operation, in

GOVERNMENT LIABILITY 241 (Minn. State Bar Assoc., Minn. CLE, 1981) at 257–258.38Donald A. Gemberling and Gary A. Weissman, “Data Privacy: Everything You Wanted to Know About

the Minnesota Government Data Practices Act—From A to Z”, WILLIAM MITCHELL LAW R EVIEW: Vol.

8: Iss. 3, Article 1. (1982) at 583, available at: http://open.wmitchell.edu/wmlr/vol8/iss3/1.



6

“To preclude the artifice of making inquirers run the gauntlets of multiple storage

locations or obscure agency filing practices…”39

the MGDPA promulgates the requirement at

Minn. Stat § 13.03, subd. 3, that government entities “...shall keep records containing

government data in such an arrangement and condition as to make them easily accessible for

convenient use…” In Minnesota Department of Administration Advisory Opinion (“Advisory

Opinion”) 94-032, the Commissioner opined:

“This language places an affirmative duty on government agencies to design datastorage, data retrieval, records storage, records retrieval and filing systems in such

a way that those systems will assist and not hinder the public in gaining access to

government data. This particular language has been a part of legislatively enacted

public policy in this state since 1941. The language concerning convenient use ...was first enacted by the legislature in 1941 … Virtually all of the modern record-

keeping and management information systems, both manual and electronic, that

have come into existence in the state in the last 50 years have been subject to therequirement that they be designed and implemented so that the data contained

within them will be easily accessible for convenient use by the public.”

In responding to this action, the County propounded the argument that an email term

search data-access request from the public is not a valid under the MGDPA, because: (1) it

requires the County to create or format data; (2) the County does not have its employees’ emails

organized by words in the English dictionary; and (3) searching nine million emails would lead

to an absurd result.40

Webster did not request that the County create data in response to his request. The data

exist, without dispute. To prevent government entities from “interposing technology as a barrier

to access,”41

the MGDPA expressly applies to all data, with the statutory section defining

government data to be inclusive, “regardless of its physical form, storage media, or conditions of

39 Id .

40Response of Hennepin County and Hennepin County Sheriff’s Office (“Response”) at 13–20.

41See Gemberling and Weissman, supra at 583.



7

use.”42

Email is government data, presumptively public under the MGDPA. And as with all

government data, the government has a duty to search for and retrieve that data upon request.43

Nor is Webster asking the County to change the format of data. Webster never demanded

a specific format other than to say he desired to inspect the data “in its original form”.44

The

County must provide access to data in whatever format the data are maintained.45

An EML file is

an email in its original and native form, just as it is at the time of creation and storage, with its

headers, content, and attachments.46

A PST file is a container for many emails in their native

form together in one file.47

In all of Droege’s search attempts, the standard output from his

searches were EML or PST files.

48

Notwithstanding access restrictions imposed by the County

on the computer it provided for Webster’s inspection, or the emails the County chose to print and

redact using a marker, the ‘test’ search emails the County produced for Webster’s December 21

inspection were in EML format, viewable by Webster using Microsoft Outlook,49

just as the

emails are viewable to County employees reading and writing those same emails.50

The remainder of the Respondents’ argument is essentially one of burden, but the

MGDPA has no provisions exempting the government from producing data on the basis of the

government storing a large amount of data, a requestor seeking a large amount of data, a request

requiring a significant amount of time, or on burden at all. Wherever a requestor has a legitimate

42Minn. Stat. § 13.02, subd. 7.43Advisory Opinion 00-026 (noting that government entities are obligated to search for and retrieve

government data if a requester provides criteria that would enable the government entity to identify and

retrieve the specific data sought)44

Ex. 2 at 2.45Minn. Stat. § 13.03, subd. 3(e); Advisory Opinion 09-006.46Webster Direct at 19; Droege Cross at 45:12.47

Id.48Ex. 204 at 2, 9, 12.49Webster Direct at 12; Ex. 39 at 3 (photograph of County’s computer screen shows Microsoft Outlook

logo in system tray); Droege Cross at 45:13 (testifying that an EML file will open as an original email in

Microsoft Outlook, and that PST files also open in Microsoft Outlook).50

Ex. 52 at 11 (Hennepin County 2013 Highlights document states employees use Microsoft Outlook);

Webster Direct at 20.



8

and continuing interest in the data, as Webster clearly does, Advisory Opinions have consistently

found that a government entity must comply with requests in a reasonable amount of time, that

“there is no limitation on the volume of data that may be requested and must be provided”, and

that a rolling production of data with ongoing updates satisfies the MGDPA.51

Regardless, this record indicates that Webster’s request is not especially burdensome:

once Respondents used the right technology, its email searches were swift. And, any purported

burden is one of the Respondents’ own making.

In a similar vein, the County postured that Webster’s request amounted to the County

“creat[ing] a personal e-mail database for him” and “act[ing] as [Webster’s] research assistant in

performing computer-aided searches”.52

Webster provided criteria that would enable Respondents to identify and retrieve the data

he was seeking, and Respondents are obligated to search for and retrieve that data, a situation

remarkably similar to that seen in Advisory Opinion 00-026, which also involved a government

entity unsuccessfully arguing that a subject-matter request constituted “research services.”

As discussed in Advisory Opinion 00-051, “If the [government entity] maintains the data,

pursuant to [the MGDPA], it must be able to locate the information so that it can respond to [a

requester] in an appropriate and prompt manner, and within a reasonable time.”

Providing no statutory or case law support, Respondents argue that before email and

computer-aided searches existed, the MGDPA did not require government to read every

51

Advisory Opinion 04-027 (Commissioner opining that a continual flow of data as a rolling production isreasonable for voluminous requests); 01-023 (Commissioner opining that a government entity compiled

with a voluminous request by gathering the responsive data and providing updates to the requestor

throughout the process); 01-031 (Commissioner opining that “[t]here is no limitation on the volume of

data that may be requested or that must be provided” and that only through the “unique and very specific

set of facts” of that case – abusive language, the failure to complete a first inspection of responsive data,

ongoing personal legal disputes with the entities, and a court restraining order – could the entity be

relieved of its obligations, “which is in no way intended to suggest that a government entity does not have

to respond to a data request merely because responding will be costly or time-consuming.”)52Response at 20.



9

document to locate documents containing certain words. But on the contrary, the focus of the

MGDPA is “information, not documents.” Nw. Pubs., Inc., v. City of Bloomington, 499 N.W.2d

509, 511 (1993). Broad dictionary definitions of “data” have been applied by the Supreme Court.

See, e.g., Westrom v. Minn. Dept. of Labor & Indus., 686 N.W.2d 27, 34 (Minn. 2004)

(“Although the term ‘data’ is not defined in the MGDPA, ‘data’ usually is said to mean

‘individual facts, statistics, or items of information’”); Schwanke v. Minn. Dept. of Admin., 851

N.W.2d 591, 593 (Minn. 2014) (“‘Data’ are ‘[f]acts that can be analyzed or used in an effort to

gain knowledge or make decisions’ or, more broadly, are ‘information.’”) (internal citations

omitted). “[A] conscious decision was made to direct the regulatory features of the [MGDPA] to

the most basic level of information organization which is maintained by the agencies…a focus

on data and not on files or records, must be ever present in analyzing issues arising out of the

[MGDPA]”.53

If requested data is distinguishable from other data, the government must search for and

retrieve the requested data.54

Further, “[i]t is…immaterial where the government data are

stored”.55 “If [requested] data exist, then [a government entity] must find a way to make them

available for [the public’s] inspection, free of charge”.56

And, what is the alternative? Would the Respondents invite the public into its datacenters

to conduct their own searches, or provide its entire 23-terabyte email store57

—nonpublic data

included—to every requestor seeking access to email? If there is an absurd result to be found, it

is the Respondents’ pattern of gamesmanship through its intransigence in this litigation.

53Gemberling, supra at 258.54

See Advisory Opinion 99-023.55Gemberling and Weissman, supra at 610.56

Advisory Opinion 97-005.57Direct Testimony of Glen Gilbertson (“Gilbertson Direct”) at 1.



10

Finally, Respondents argue that “the word ‘request’ is ambiguous” and ask for

construction by the Court, which is not necessary because the plain language and legislative

intent of the MGDPA is not ambiguous or misunderstood. Even so, the Court’s “goal when

interpreting statutory provisions is to ‘ascertain and effectuate the intention of the legislature.’”

Brua v. Minn. Joint Underwriting Assoc., 778 N.W.2d 294 (Minn. 2010) (internal quotations and

citations omitted). That intention clearly favors public access.

B. Respondents used a flawed and unnecessarily laborious email search process, and as

a result, acutely and exponentially overestimated and overstated the purported

burden of Webster’s request.

A court need not study the architecture of any particular government entity’s electronic

storage or email infrastructure, because the law is clear: email is government data, government

entities are obligated to store government data in such an arrangement and condition as to make

them easily accessible for convenient use, and government entities are required to search for and

retrieve government data upon request. However, an analysis of the flaws of the County’s search

methodology demonstrably supports a finding that violations occurred, and that the Court can

remedy those violations through an order compelling compliance.

The majority of the continuing dispute before the Court relates to Item 14 of Webster’s

request, which originally sought County-wide electronic data pertaining to five biometric

technologies and five vendor names, later reduced in scope to seek emails within the Sheriff’s

Office and Security department, with supporting County staff, although the Respondents always

treated it as only an email search request.58

58Ex. 18 at 6.



11

Droege testified that he was the only County employee who performed email searches for

Webster’s request,59

performing three searches at the request of Kristi Lahti-Johnson on

September 17, 2015; January 6, 2016; and January 15, 2016.60

1. Droege’s first email search on September 17, 2015

Droege stated that he did not perform his first search until September 17, 2015, over a

month after Webster submitted his request.61

Although Webster’s original request was County-

wide, Lahti-Johnson asked Droege to perform a ‘test’ email search on only five employee

accounts from the County’s Department of Community Corrections and Rehabilitation,62

because Lahti-Johnson believed those accounts made more use of Webster’s search terms.

63

Droege went through an unnecessarily laborious forensic process of asking an email

administrator to manually copy the entire mailbox of each of these employees away from the

County’s cluster of high-performance mail servers64

and into PST files,65

which were then

transferred to a forensics server, and then transferred again to Droege’s personal computer and

loaded into Intella Vound software, where the actual search occurred.66

Droege testified that he “unfortunately forgot to” apply the date limitation Webster

provided in his request of 2013 to present,67

instead producing a large number of unresponsive

59Droege Cross at 23:27.60Ex. 204 at 1–2.61

Id. at 1.62Ex. 204 at 1; Droege Cross at 24:05 (testifying that Droege was asked to search these five individuals,

he did not select them).63Lahti-Johnson Direct at 7; Ex. 39 (a sampling of emails showing the names selected for the search were

individuals directly involved with purchasing and installation of biometric technologies).64

Cross-Examination of Glen Gilbertson (“Gilbertson Cross”) at 3:14:11, 3:23:48 (testifying that the

County’s email system consists of 19 servers in production, split between two data centers for resiliency,

that all the County’s email servers have four CPU processors, and that the servers controlling email

mailboxes have 32 gigabytes of RAM each, with 24 terabytes of storage each).65Droege Cross at 17:49.66

Ex. 204 at 1; Droege Direct at 3-4; Droege Cross at 17:49.67Droege Cross at 25:39.



12

emails dated as early as 2008.68

Of the 312 emails the County produced for Webster’s

December 21 inspection, only 139 fell within Webster’s date range.69

Droege testified that he performed this first September 17 search “right away”70

and that

he believed he returned the results of the search to Lahti-Johnson “within that week of

September 17”,71

but it was not until November 25 that the County informed Webster of the

results of this “test” search and first told Webster about its concerns over purported burden.72

Droege told Lahti-Johnson that this ‘test’ search took seven hours.73

In Lahti-Johnson’s

November 25 letter, she wrongly assumed that if it took seven hours to search five mailboxes of

individuals directly involved with biometric technologies, and the County has approximately

8,000 employees, it would thus take 15 months of 24-hours-a-day server time to conduct the full

search.74

When asked how she arrived at that estimate, Lahti-Johnson did not describe reviewing

established procedures or seeking technical guidance on how the search might best be performed,

instead sharply responding, “math”.75

However, not every County employee held as much responsive data as these hand-

selected group of staff directly involved with the technology Webster sought data regarding, so

search time and output would be exaggerated inflated through simple multiplication.76

Droege’s seven hours of work—five or six of which were ‘machine time’ not requiring

human interaction77

—included time for performing the manual copying of five employees’ entire

68Ex. 39 (showing a sampling of unresponsive emails older than 2013 produced for Webster’s inspection);

Ex. 38 (showing many of the emails Webster inspected were from the same email threads).69Ex. 204 at 2.70Droege Cross at 20:25.71

Id. at 26:04.72Ex. 18.73

Id.74Ex. 18 at 7–8.75Lahti-Johnson Cross at 3:47:49.76

Webster Direct at 20.77Droege Cross at 28:33.



13

mailboxes before conducting the search.78

Droege attributed much of the seven hours to the

processes he employed on that search, testifying that it took “quite a few hours because [he] had

to copy all the PSTs down”,79

and that the use of Webster’s date restrictions would have reduced

the search time, and consequently would have reduced Lahti-Johnson’s estimate.80

Droege’s testimony calls into question Lahti-Johnson’s suggestion that it was “not

possible to run a scan of all of the emails at one time as it would result in an excessive burden on

our servers”81

in at least one other way: all of the searching and processing effort Droege

described happened on his forensics personal computer, not on the County’s high-performance

servers.

82

Now, months later, when asked how long that search would have taken, Droege testifies

that though it is “very hard to estimate,” he agrees with the 15 months estimate – but only “if

[he] used the same method of searching”.83

Droege should not use the same method of searching.

Although government entities must conduct diligent searches,84

nothing in the MGDPA

requires the County to perform forensically-sound duplicative snapshot captures of entire email

boxes and perform offline searches with evidentiary chain of custody trails.85 Although this

process may have been customary to Droege, who has a duty to “assure adherence to proper

investigative, forensic, technical and chain of custody standards” on investigative casework for

law enforcement purposes,86

it is not customary and routine for MGDPA requests.

78

Id. at 26:38.79 Id. at 26:49, 32:43 (testifying that using Exchange Control Panel eliminated the need and time involved

with copying PSTs before the beginning of the search).80

Id. at 29:52.81Ex. 18 at 8.82Droege Direct at 2–4 (referencing “Forensics PC”); Droege Cross at 22:30.83Droege Cross at 29:51.84

See, e.g., Advisory Opinions 00-026, 03-027.85

Webster Cross at 2:52:09.86Ex. 201 at 1.



14

Nor would this process have ever supported Webster’s request in the first place. When

discussing why he used Exchange Control Panel (“ECP”) in subsequent searches instead of

Vound Intella as he used in his first search, Droege testified that he uses Vound for forensic

work,87

and that Vound only supports up to 800 accounts, more than Webster’s initial search

required. He further testified that he made the change “because of the volume of emails [he] had

to cover, and the amount of emails. Bringing them up in Vound would have taken quite a while.”

Droge testified that in his ‘test’ search, the complete unfiltered mailboxes of the five

selected employees totaled 22 gigabytes that had to be copied over the network. However, the

County has 23.56 terabytes of emails stored in its servers, well over 1,000 times more than the

amount of data Droege was working with during his first search; many orders of magnitude more

than any commercially-available personal computer or single hard drive could store. Those

searches should have run “directly onto the server”88

with ECP.

Droege only performed the tasks Lahti-Johnson asked him to perform.89

Droege is a

skilled forensic investigator,90

and was using a forensic practice that he was most familiar with in

his forensics work.91 While he has assisted Lahti-Johnson with MGDPA searches in the past, his

other work involves internal employee and criminal investigations.92

Clearly, the process Droege

used for this type of search was not up for the task in the first place. Perhaps Droege would have

performed the search differently if the responsible authority had created policies and procedures,

if he knew Webster’s original request was County-wide instead of just being instructed to search

87Droege Cross at 38:55.

88 Id. at 24:31 (testifying that ECP allows for keyword searches directly on the County’s email servers).

89See, e.g., Id. at 24:08; Ex. 204.

90Ex. 201.91Droege Cross at 25:06 (Droege testifying that the reason he did not use Exchange Control Panel was

because the forensic process he used was his past practice, and that it is a better process forensically.)92Droege Cross at 14:17.



15

five mailboxes, or perhaps someone with a different skillset would have been selected to find

responsive data. Luckily, the Respondents found a better way.

2. Droege’s second email search on January 6, 2016

In Droege’s second search on January 6, 2016, he describes using the much faster 93

Exchange Control Panel instead of the previous manual forensic process,94

to perform a search

across “all employees in the Hennepin County Sheriff’s Office and Hennepin County

Security”.95

Droege testified that the reason he used ECP was “because we were gonna be

looking at so many email accounts at one time, I figured this was probably the best way to get

the information to Webster in a timely manner”.

96

Droege’s search was of all 801 Sheriff’s Office and 67 Security department employees97

for emails referencing vendor names of biometric technologies, about half of Webster’s search

terms.98

Droege broke the search into segments based on the first name of the employee,99

categories that existed prior to him conducting the search.100

Droege’s search took approximately seven hours of processing time, and initially resulted

in 10,791 emails.101 However, Droege testified that he tried to enter a date limitation at the time

of the search, but that the County’s software erred for some unknown reason and was not

returning date-limited results.102

Droege used Vound to apply the date limitation Webster

provided after the results were in, which brought the responsive email count down to 4,249.103

93Droege Cross at 32:41.94

Ex. 204 at 2–9.95 Id. at 2.


Ex. 204 at 9.98

Id. at 3; Ex. 50.99

Id. at 3.100Droege Cross at 35:26.101Ex. 204 at 9.102

Droege Cross at 41:39, 49:37.103Ex. 204 at 9; Droege Cross at 49:18.



16

Because Droege broke up the searches into multiple segments, the resulting emails are

only deduplicated within one search and not from one search to the next. By way of example,

Droege searched Sheriff’s Office employees with first names beginning A–C from 7:24 a.m. to

7:53 a.m., and then later searched first names beginning D–F from 10:47 a.m. to 11:23 a.m., and

so forth.104

The first search would have no way of coordinating with the second search to

deduplicate results between the two searches, and vice versa. Much of the County's

communication is internal or internal participants,105

and Droege did not describe performing a

final deduplication task, so 4,249 results may still be artificially inflated to an exponential

degree. This would create unnecessary and redundant data classification review time.

Nevertheless, the fact that this search for half of Webster’s search terms across the entire

Sheriff’s Office and Security departments took only seven hours should have been enough to

convince the Respondents that their initial estimates were incorrect. Droege made the emails

from this second search available to Lahti-Johnson for review,106

but Respondents have still not

provided Webster with an opportunity to inspect the data.

3. Droege’s third email search on January 15, 2016

Finally, Droege describes performing a third search on January 15, 2016, when he

searched all of Webster’s technology (not vendor) search terms across all Sheriff’s Office

employees with first names beginning D, E, or F.107

Droege was told to search those employees

and did not choose the grouping himself.108

This was a total of 88 employees, and the total

104Ex. 204 at 2–9.

105See, e.g. Ex. 39 (showing many of the emails the County produced for Webster’s December 21

inspection had multiple County employees in the ‘to’ or ‘cc’ fields, thereby creating multiple copies of

those identical emails).106Droege Cross at 44:39; 48:22.107

Ex. 204 at 9.108Droege Cross. at 50:24.



17

search time was two hours.109

The searches returned a total of 3,033 emails, but again, date

limitations were not honored at the time of search.110

Applying the date limitations brought the

results down to 1,726 emails.111

However, there are many problems with this search.

First, because the search was broken up into multiple segments, the search results were

again not deduplicated from one search segment to the next, which would artificially inflate the

number of results. Moreover, if an email contains the phrase biometric in this search, and

FaceFirst in the previous search, it would be counted at least twice to begin, but then

exponentially higher depending on the number of recipients.

Second, Droege inconsistently applied the search terms. Sometimes he searched phrases

in quotes, while other times he did not. As Droege testified, searching “facial recognition” in

quotes searches for the exact phrase “facial recognition” being used in an email, while searching

without quotes would return a result if both the words ‘facial’ and ‘recognition’ were used in the

email, even if they were far apart in the email.112

Droege reflected that he should have applied

consistent quotes around search terms, and that search attempts may have failed because he

didn’t.113 The consequences of this can be seen in the search logs: in one failed search attempt

for “facial recognition” without quotes, the results approached 877 hits, while with quotes

another failed search attempt approached 582 hits, with a final successful result of 675 items.114

Droege testified that this third search on January 15, 2016, was his final search in

response to Webster’s request, and that nobody else has done any searches since then.115

As

explained herein, simple multiplication is a flawed method for estimating search time. However,

109 Id. at 12; Droege Cross at 55:26.

110Ex. 204 at 12.

111 Id.


Id. at 51:06, 51:36.114

Ex. 204 at 10–11.115

Droege Cross at 57:12.



18

Droege’s third search was for 88 employees with first names starting D, E, or F, so it was a much

more random set of employees than manually selecting out five employees known to heavily use

the specific technology Webster sought information regarding. To that end, if it took two hours

to search 88 mailboxes, it might take approximately 20 hours to search 868 mailboxes. Droege

provided the results of his third search to Lahti-Johnson,116

but Webster has still not been able to

inspect the data.

4. The County’s email infrastructure was not designed with the MGDPA’s

requirements in mind.

Respondents described many technical encumbrances in performing email searches.

None of these exempt them from the requirements set forth by the MGDPA. Asked whether the

County considered the “easily accessible for convenient use” requirement when transitioning its

email system in 2013, CTO Glen Gilbertson—who heard about Webster’s request for the first

time the week prior to the hearing117

—testified that the County did “just standard best practice at

the time for any Exchange server or platform…we just wanted the standard installation,

basically”.118

If computer limitations create a laborious and time-consuming process, that itself is

an indication that a government entity is not in compliance with the MGDPA.119

B. Respondents violated the MGDPA by failing to comply with the appropriateness

and timeliness requirements of Minn. Stat. § 13.03, subd. 3.

The MGDPA requires responsible authorities to “establish procedures…to insure that

requests for government data are received and complied with in an appropriate and prompt

manner”.120

Additionally, the responsible authority “shall establish procedures to…provide for a

116Droege Cross at 53:55.117Gilbertson Cross at 3:13:58.118

Id. at 3:29:00.119

See Advisory Opinion 03-025.120Minn. Stat. § 13.03, subd. 2(a).



19

response to a request for access within a reasonable time”.121

As such, government entities are

obligated to know what type of data they have, how to access that data, and how that data is

classified; obligations that arise before a request is submitted pursuant to the MGDPA.

This issue can be separated into two parts: (1) did the Respondents have procedures

ensuring it provided for the public’s access within a reasonable time, and (2) did the Respondents

provide for an appropriate and timely response to Webster’s request? The answer to both is no.

Lahti-Johnson testified that the she is the County’s responsible authority, but that the

County’s procedures were incomplete, and that policies were created before she became

responsible authority.

122

However, some of these policies must be updated every year.

123

Hill

testified to not knowing whose responsibility it was to ensure Sheriff’s Office data was organized

to be accessible for convenient use,124

and not knowing whether the County or Sheriff’s Office

IT staff manage email,125

despite her receiving most Sheriff’s Office formal data requests under

the MGDPA and her being the only person now identified on the County’s website for data

requests.126

If Respondents had procedures, many of the problematic technical issues may not

have surfaced. Without procedures established in advance, compliance is not possible.127

Respondents have delayed compliance with Webster’s request by nearly eight months.

While the Respondents’ dilatory conduct as a whole is inexcusable, it can be further scrutinized

through the record before the Court.

First, Webster submitted his request on August 12, 2015, but Lahti-Johnson did not ask

Droege to conduct the first email search until September 17, 2015, over a month later. Droege

121Minn. R. 1205.0300, subp. 3.

122Lahti-Johnson Cross at 3:45:23.123Minn. Stat. § 13.025, subds. 2–3.124Hill Cross at 4:04:14, 4:21:22.125

Id. at 4:10:05.126

Id. at 4:19:53; Ex. 43 at 12.127

See Advisory Opinion 95-006.



20

testified that he believed he returned the results of his September 17, 2015, search to Lahti-

Johnson that same week, but the results of that search – and the County’s denial position – were

not communicated to Webster until November 25, 2015. Moreover, in a phone call on

November 3, 2015, Lucie Passus actively refused to provide any information about the request,

who was processing the request, or a timeline for production, merely stating that the

Respondents’ 128

remaining efforts were “just verifying a couple of items.”

Lahti-Johnson testified that she considered contacting Webster sooner than November 25,

but that she intentionally did not do so because she “believed a comprehensive response was

needed because otherwise [she] believed it would lead to more questions.” Lahti-Johnson’s

November 25 written denial as it relates to Item 14 was not brimming with technical detail or

legal argument; rather, it was a single paragraph of facile and flawed logic. It should not have

taken Lahti-Johnson as long as it did to express her concerns of purported burden.

Further, despite knowing that data collected through Droege’s September 17 search

included data responsive to Webster’s request, the County did not conduct a classification review

until after Webster had to ask to inspect it a second time in his December 4, 2015,

correspondence. “Government entities have an affirmative obligation to make the determinations

of data classification as necessary to provide prompt access to public data”.129

Webster limited the scope of his request in that December 4, 2015, letter, but Droege—

again, the only employee performing email searches—testified that he did nothing in between

providing the search results of the first search the week of September 17, 2015, and when he

128See Advisory Opinion 98-012 (“…the only communication from the [government entity] providing any

clear response … did not explain why the [government entity] is still gathering the data. The [government

entity’s] response was not timely.”129Advisory Opinion 95-006.



21

began his second search on January 6, 2016.130

The County offered no defense for ignoring

Webster’s reduced-scope request in December, because it has no defense: the County had no

intention of complying with Webster’s request.

We know this because Passus, when testifying about weekly Data Governance meetings

that have been going on since she started in her position, said the last time the team discussed

Webster’s request was “at the close” on December 21, 2015, when Webster viewed the results of

the ‘test’ search.131

But Webster’s request was not closed.

Meanwhile, despite Droege discovering how quickly ECP allowed him to perform his

January 6 and 16 searches, and those searches returning emails responsive to Webster’s request,

nothing in the record indicates Respondents have even begun to do a classification review.

Finally, Respondents made no attempt to explain the delay between November 25, 2015,

when it told Webster purchasing and policy documents were available for his inspection, and

December 21, 2015, when Webster actually inspected the documents. Further, although Webster

expressed concern about improper redactions and denial certification the day of his inspections

and in subsequent communication on December 21 and 28, Webster was not actually permitted

to reinspect the data without those redactions until January 14, 2015, at which point the Sheriff’s

Office suddenly found a responsive document it had failed to previously produce.132

“Reasonable time” is not defined by the MGDPA, but it is “relative to the volume and

substance of the data requested”,133

and again, rolling productions are favored for voluminous

requests.134

Given the County’s minimal effort at an email search, and the Sheriff’s Office

producing only 160 pages for Webster’s inspection—with many of those documents being

130Droege Cross at 36:18.131Passus Cross at 3:07:38.132Hill Cross at 4:10:19; Ex. 48.133

Advisory Opinion 09-017.134

See Advisory Opinion 04-027.



22

lengthy contracts and federal grant documentation—there was not a large amount of data

considered by the Respondents.

To the extent Respondents deemed Webster’s request unclear, broad, or vague, its

obligation is to ask a requester for clarification.135

The record indicates Webster repeatedly

offered clarification and conversation, but was met with silence.

C. Respondents violated the MGDPA’s denial determination, certification, and citation

requirements pursuant to Minn. Stat. § 13.03, subd. 3(f).

Respondents violated this provision of the MGDPA in three ways: (1) by failing to

provide its denial determination and citation at the time of Webster’s request or as soon as

possible thereafter; (2) by failing to provide its denial certification and citation upon Webster’s

multiple requests; and (3) by failing to provide any denial determination, certification, or citation

with regard to its denial to perform an email search.

Minn. Stat. § 13.03, subd. 3(f) begins, “If the responsible authority or designee

determines that the requested data is classified so as to deny the requesting person access, the

responsible authority or designee shall inform the requesting person of the determination either

orally at the time of the request, or in writing as soon after that time as possible , and shall cite

the specific statutory section, temporary classification, or specific provision of federal law on

which the determination is based…” (emphasis added).

Webster submitted his request on August 12, 2015, but Respondents did not tell Webster

it was redacting or withholding any data until Webster observed the redactions at his

December 21, 2015, inspections.136

135See Advisory Opinions 01-001 (“When a government entity receives a request that is not clear, its

obligation is to ask the requester for clarification”); 98-012 (submission of a vague request is still a

“request” under the MGDPA, and a government entity should ask for clarification).136Lahti-Johnson Cross at 3:44:00.



23

There were several opportunities for the Respondents to inform Webster that data was

being withheld from him. First, government entities have an obligation to know how their data is

classified to be able to respond to a request in a timely manner,137

and—even if they did not

know specific emails—should have known at the time of the request that some data would be not

public, and known the basis for that data being withheld.

Second, Droege performed his email search beginning on September 17, 2015, and

testified that he believed he provided the responsive data back to Lahti-Johnson the same week.

If a review of that responsive data had taken place right away, Respondents would have known

some data would be not public. Additionally, the Respondents’ November 25, 2015 letter

indicated that responsive data for Items 1–3 were ready for Webster’s inspection, indicating that

the data was presumably already redacted at the time. The County did not comply with this

provision of law, and it is notable that in responding to this action, Respondents selectively

omitted this first half of the statutory subdivision of denial certification.

Section 13.03, subd. 3(f) continues, “Upon the request of any person denied access to

data, the responsible authority or designee shall certify in writing that the request has been

denied and cite the specific statutory section, temporary classification, or specific provision of

federal law upon which the denial was based.”

137See Advisory Opinion 95-006 (“…government entities are required to develop procedures to assure that

the public is provided prompt access to public data. In order to develop and implement proper public data

access procedures, entities must determine the classification of the data they maintain. The requirementthat entities determine the classification of the government data they maintain is fundamental to the

operation of all of Chapter 13. It is not possible for them to comply with the requirements of the statute if

they do not make these determinations … the [government entity] should have been able to determine

how the data sought by [a requester] were classified at the time he made his request, based on an

examination of the public report … and other reference materials. If the [government entity], as a matter

of practice, were to determine the classification of its data in advance of public requests for access, it

would be better able to respond promptly, i.e. without delay, to those requests … an entity's compliance

practices are not reasonable if it must make data classification determinations any time it receives a

request for access to data.”)



24

The County’s defense was that Webster asked for written certification and citation on

December 30, 2015, and the County responded by providing it – and an appointment for Webster

to inspect improperly-redacted data – on January 7, 2016, so there was no violation.

In actuality, Webster’s asked for written certification and citation in his original request

on August 12, in his October 28 correspondence, in his December 4 letter reducing the scope of

his request, and in his December 30 letter, in addition to asking the day of the inspection on

December 21, attempting to ask December 22, and asking Hill on a phone call on December 28.

The County finally provided written certification and citation on January 7 when it

admitted to making improper redactions.

138

. The County Attorney put a great deal of effort into

drawing the Court’s attention to the timestamp on the Complaint being within ten minutes of

Respondents finally providing citation, but a violation still occurred, and—improper redactions

being made—had still not been remedied.

Finally, the County’s November 25, 2015, letter denied Webster’s request with regard to

an email search, stating Webster’s request was “complete” and “closed”,139

relying on a faulty

estimation of burden. Respondents failed to provide statutory citation to support such a denial.140

“A political subdivision resisting disclosure of data bears the burden of identifying the law

preventing its disclosure.” Demers v. City of Minneapolis, 458 N.W.2d 151 (Minn. App. 1992).

D. Respondents violated the MGDPA’s requirement that upon request, a person shall

be permitted to inspect and copy public government data at reasonable times and

places pursuant to Minn. Stat. § 13.03, subd. 3(a).

Respondents did not allow Webster to inspect and copy public government data upon

request, or at reasonable times, a violation highly intertwined with its other violative conduct in

138Ex. 44 at 1–2.139Ex. 18 at 8.140Webster Cross at 2:49:11; See Advisory Opinion 06-029 (“In responding, the entity must provide the

data, advise that the data are classified such as to deny the requestor access, or inform the requestor that

the data do not exist.”)



25

this matter. Through its numerous delays, and especially its delays in scheduling an appointment

to allow Webster to inspect data, the Respondents violated this provision of the MGDPA.

E. The County’s remaining effort to be ordered by the Court.

Between Droege’s second and third search attempts, he has completed searches for all the

vendor terms Webster supplied across all Sheriff’s Office and Security department employees,

and he has completed a search for all technology terms Webster supplied across Sheriff’s Office

employees with first names beginning D, E, or F. The remaining search effort is for technology

terms Webster supplied across Sheriff’s Office employees with first names beginning A–C, and

G–Z, and Security employees. Droege estimated this would take approximately 18 hours, which

is processing time, not time he would need to be operating a computer.141

Droege already has 5,975 responsive emails from his previous searches. Again, this is

without deduplication, so that number may be exponentially higher than the actual number of

unique emails at stake. After completing the remaining searches, Droege should deduplicate all

responsive emails and provide those emails to the County Attorney for data classification review

and for Webster’s ultimate inspection. Conservatively, there is no reason why this could not be

completed within a week.

The issue then turns to the County’s capacity for classification review. The County

estimated it would take two minutes to review each of the responsive emails, a task it could have

a contractor complete.142

However, “an entity's compliance practices are not reasonable if it must

make data classification determinations any time it receives a request for access to data”.143

141Droege Cross at 55:18 (testifying that applying the D–F search to all Sheriff’s and Security department

employees would take approximately 20 hours (subtract two hours for the completed third search), which

was processing time, not time Droege needed to be sitting at the machine clicking something.)142

See Advisory Opinion 00-067.143Advisory Opinion 95-006.



26

As reflected in Complainant’s Proposed Order, Webster believes a reasonable approach

would be to order Respondents to complete a search within 15 days, and—to the extent they

have not already—begin classification review and ultimate production of 5,000 emails per

month, due every 30 days thereafter.

Considering the County’s violations, and especially considering its failure to establish a

litigation hold,144

Webster wishes for the Court to conduct an in camera review of any

responsive data that the County completely withholds from him, including data previously

withheld from him in full. Webster believes the most effective and least burdensome method

would be through the creation of a privilege log to be updated and provided to Webster with each

production, that uniquely identifies each not-public email in some reasonable manner, and, upon

the conclusion of the production of all public emails for Webster’s inspection, submission of the

fully withheld data and privilege log to the Court for in camera review. This task need not

burden the Court, as “an entire document may be withheld only when the public and nonpublic

information is so inextricably intertwined that segregating the material would impose a

significant financial burden and leave the remaining parts of the document with little

informational value.” Nw. Pubs., Inc., v. City of Bloomington, 499 N.W.2d 509, 511 (1993).

CONCLUSION

The record before the Court establishes Respondents’ failure to comply with the

MGDPA; noncompliance that was lackadaisical at times, willful at others. Due to a combination

of bureaucracy, poor communication, lack of planning and procedures, and mismanagement, the

County’s dilatory conduct disregarded the statutory purpose and presumption of openness under

144Cf. Webster Direct at 13 (testifying that on a December 28 phone call, Hill stated data, and specifically

emails, were being preserved so nothing could be deleted) and Hill Cross at 4:09:19 (testifying that she

does not actually know who manages Sheriff’s Office emails, and that she was unsure how to answer

questions regarding litigation holds); Ex. 204 at 2 (a litigation hold was not placed on some data until

January 6, 2016, a month after a litigation preservation demand from Webster’s counsel).



the MGDPA, and is an illustration of the very government gamesmanship the MGDPA was

designed to prevent.

Webster’s positions throughout this matter are supported by the plain statutory language

of the MGDPA, advisory opinions, and case law, and this brief has carefully analyzed and

balanced the remaining efforts required by Respondents to comply with his request. Webster

respectfully asks the Court to issue an order compelling Respondents’ compliance.

Dated: April 8, 2016 Respectfully submitted,

s/ Scott M. FlahertyScott M. Flaherty (#388354)

BRIGGS AND MORGAN, P.A.

2200 IDS Center 80 South Eighth Street

Minneapolis MN 55402

Tel: (612) [email protected]

ATTORNEY FOR COMPLAINANT

TONY WEBSTER

complainant's memorandum in support of action to compel compliance

Documents