Washington County v. Sippel

• Court: Court of Appeals of Oregon
• Decided: September 11, 2024
• Docket: A180918
• Status: Published

Opinion

No. 649 September 11, 2024 1

IN THE COURT OF APPEALS OF THE STATE OF OREGON

WASHINGTON COUNTY, Plaintiff-Respondent, and OREGON SECRETARY OF STATE, Intervenor-Respondent, v. Tim SIPPEL, Defendant-Appellant. Washington County Circuit Court 22CV07782; A180918

Janelle F. Wipper, Judge. Submitted August 14, 2024. Stephen J. Joncus and Joncus Law P.C. filed the briefs for appellant. Jason Bush filed the brief for respondent Washington County. Ellen F. Rosenblum, Attorney General, Benjamin Gutman, Solicitor General, and Christopher A. Perdue, Assistant Attorney General, filed the brief for respondent Oregon Secretary of State. Before Tookey, Presiding Judge, Egan, Judge, and Kamins, Judge. TOOKEY, P. J. Affirmed. 2 Washington County v. Sippel Cite as 335 Or App 1 (2024) 3

TOOKEY, P. J. In this case concerning a public records request, defendant appeals a trial court judgment determining that a certain zip file is conditionally exempt from the disclosure requirements for public records and, further, that the public interest does not require disclosure of the file. The zip file at issue in this appeal contains a backup of the database from the November 2020 election in Washington County, which includes the data itself as well as a proprietary database architecture. In his first three assignments of error, defendant contends that the trial court erred when it determined that the zip file was conditionally exempt from disclosure because it was a “trade secret” under ORS 192.345(2), a “computer program” under ORS 192.345(15), and “informa- tion that would reveal * * * security measures” under ORS 192.345(23). In his fourth assignment of error, defendant contends that, even assuming that the zip file falls within one of the conditional exemptions from disclosure in ORS 192.345, the trial court erred when it determined that the public interest in disclosure did not require disclosure in the circumstances of this case. We agree with the trial court that the zip file is subject to the conditional statutory exemption for “computer programs” under ORS 192.345(15). That conclusion obviates the need to consider the trial court’s determinations that the “trade secrets” and “security measures” exemptions, ORS 192.345(2) and (23), apply in this case. We also con- clude that the public interest does not require disclosure in this case. Therefore, we affirm. I. BACKGROUND The relevant historical facts are undisputed. In October 2021, defendant made a public records request to the Washington County Elections Office for disclosure of “an electronic copy of the ballot database from a public test of the voting system.” Washington County (“the county”) denied that request in November 2021. Defendant appealed that denial to the Washington County District Attorney, and, in February 2022, the District 4 Washington County v. Sippel

Attorney issued an order requiring the county to “produce an electronic copy of the ballot database from a public test of the voting system,” including “ballot image files [and] the SQL database and all data files that it references.” The county then filed a complaint in the Washington County Circuit Court, seeking declaratory relief from public disclosure of that database backup of a public test of the voting system in Washington County. The state intervened in the litigation in support of the county, on the basis that it has an interest in maintaining the uniformity and security of elections. See ORCP 33 C (“At any time before trial, any person who has an interest in the matter in litigation may, by leave of court, intervene. In exercising its discretion, the court shall consider whether the intervention will unduly delay or prejudice the adjudication of the rights of the origi- nal parties.”). During the same period, in May 2022, the county, in connection with a different public records request, inadver- tently provided a zip file—the zip file at issue in this appeal, which contains a database backup of the November 2020 election in Washington County—to an individual who is not a party to this litigation. Defendant subsequently gained access to the zip file through that other individual. The county filed a motion for a temporary protective order to limit defendant’s use and dissemination of the zip file, which the trial court granted. A bench trial was held on September 20 and 21, 2022. Expert witnesses offered by all parties generally agreed about the contents of the zip file: It contains a single compressed text file in which the lines of text represent both the database’s underlying data as well as its associated sys- tem architecture (“such as tables, views, indexes, and stored procedures”), which are written in a computer programming language known as SQL. But the parties disagreed about the legal question of whether the zip file was exempt from public disclosure. The county and the state both argued that the zip file fell within three conditional statutory exemptions from disclosure: “trade secrets,” ORS 192.345(2); “computer Cite as 335 Or App 1 (2024) 5

programs,” ORS 192.345(15); and “security measures,” ORS 192.345(23). The county and the state also argued that the public interest in disclosure of the zip file was outweighed by the county’s interest in maintaining the confidentiality of the zip file. Defendant disagreed as to each of those points. Following the trial, the trial court issued an order making findings. The findings most relevant to this case are as follows: • In 2016, Washington County contracted with Clear- Ballot, an election software vendor, to purchase hard- ware, a software license, and staff training service to teach county officials to use the new system. The county now uses the ClearBallot system to “finalize bal- lot design, scan ballots, and compile election results,” including the results of the November 2020 election. • The zip file at issue in this case is a “compressed text file” that constitutes a backup of the relational database of the November 2020 election in Washington County. The purpose of that backup is to allow for the database to be reconstructed in a different county in the event that the tabulation system in Washington County is compromised, i.e. by a natural disaster or attack. • When the zip file is “uncompressed,” the resulting text file contains approximately 5,000 lines of computer code or script written in the SQL programming lan- guage. 3,500 of those lines of code are data entries; the remaining 1,500 are “system architecture, such as tables, views, indexes, and stored procedures.” That system architecture includes “computer instructions,” which are “commands that are distinct from data.” And that those instructions allow for “the rapid organiza- tion, storage, retrieval, compilation, and calculation of data.” Specifically, they allow for the “SQL database [contained in the zip file] to be rebuilt into its original form through use of a SQL software program such as MySQL.” • The architecture is a part of the ClearBallot soft- ware that the county purchased and uses to tabulate election results. That architecture is proprietary and ClearBallot has an interest in protecting it from com- petitors in the industry. 6 Washington County v. Sippel

• Election systems face a variety of potential threats from malicious actors. Public disclosure of the zip file would constitute a security risk to the administration of elec- tions in Washington County and in any other county using a ClearBallot system. Knowledge of features of the ClearBallot database architecture that are in the zip file could aid a malicious actor to plan and carry out an attack on ClearBallot elections systems. The confi- dentiality of the zip file, specifically the database archi- tecture, makes up one of the multiple “layer[s] of secu- rity” the county uses to protect the tabulation of election results, and public disclosure of the zip file would com- promise an important layer of the security in the ballot counting process. • As distinct from the database architecture, much of the data contained in the zip file can be—or has already been—obtained by the public for the purpose of inde- pendently verifying the accuracy of election results. Those data include “voter registration records, records of accepted and rejected ballots, images of each cast bal- lot, machine test information, and the cast vote record” (i.e., an “electronic log of how each ballot was counted in an election, after the being separated from its ver- ified voter signature”). Defendant himself had already obtained that data through other records requests, had used it to verify the accuracy of the November 2020 election results, and had reverse-engineered his own computer code to count ballots. After making those findings, the trial court ruled that all three exemptions that were raised—“trade secrets,” “computer programs,” and “security measures”—applied to the zip file, and that the county’s interest in maintaining the confidentiality of the zip file outweighed the public inter- est in disclosure. II. DISCUSSION On appeal, defendant challenges the trial court’s legal conclusions about the applicability of the three condi- tional exemptions to the zip file and the relative weight of the interests at play but does not challenge any of the trial court’s factual findings. Defendant raises four assignments of error. As noted, in his first three assignments of error, defendant contends that the trial court erred in applying Cite as 335 Or App 1 (2024) 7

each of the three conditional exemptions raised. In his fourth assignment of error, defendant contends that, even assuming that the zip file falls under a conditional exemp- tion, the trial court erred in balancing the public interest against the interest of the public body when it determined that the public interest did not require disclosure. A. Public Records Requests Generally ORS 192.314(1) provides that “[e]very person has a right to inspect any public record of a public body in this state, except as otherwise expressly provided by ORS 192.338, 192.345, and 192.355.” Under the statutory scheme, “[d]isclosure of public records is the rule and exemp- tions from disclosure are to be narrowly construed[.]” Mail Tribune, Inc. v. Winters, 236 Or App 91, 94, 237 P3d 831 (2010) (citing Guard Publishing Co. v. Lane County School Dist., 310 Or 32, 37, 791 P2d 854 (1990)). A public body seek- ing to withhold a public record from disclosure “carries the burden of proving an exemption on judicial review.” Id. at 95 (citing Kluge v. Oregon State Bar, 172 Or App 452, 456, 19 P3d 938 (2001)). ORS 192.345 provides for conditional exemptions for particular types of public records. In determining whether a public record is exempt from disclosure under ORS 192.345, we determine (1) whether the public record falls under one of the listed exemptions, and, if so, (2) whether the public interest nevertheless “requires disclosure in the particu- lar instance.” See Mail Tribune, Inc., 236 Or App at 96 (so analyzing whether a public record is exempt from disclo- sure as a security measure under ORS 192.501(23) (renum- bered ORS 192.345(23) in 2015)). We address each prong of analysis—the statutory exemption prong and the public interest prong—in turn. B. The Conditional Statutory Exemptions in This Case Defendant contends that the trial court misapplied the statutory exemptions as a matter of law. “We review the applicability of exemptions from disclosure under the Public Records Law as a question of law.” In Defense of Animals v. OHSU, 199 Or App 160, 172, 112 P3d 336 (2005). Although defendant challenges the trial court’s determination that all 8 Washington County v. Sippel

three statutory exemptions raised in this case apply to the zip file, we examine only the applicability of the “computer programs” exemption under ORS 192.345(15), because our conclusion, explained below, that that exemption applies to the zip file obviates the need to consider the other two exemp- tions. See id. (“If any of the claimed exemptions applies to a particular record or portion of a record, we need not consider the applicability of other exemptions to that record or por- tion of a record.”). ORS 192.345(15) conditionally exempts from public disclosure all “[c]omputer programs developed or purchased by or for any public body for its own use.” That statute defines “computer program:” “ ‘[C]omputer program’ means a series of instructions or statements which permit the functioning of a computer system in a manner designed to provide storage, retrieval and manipulation of data from such computer system, and any associated documentation and source material that explain how to operate the computer program. ‘Computer program’ does not include: “(a) The original data, including but not limited to numbers, text, voice, graphics and images; “(b) Analyses, compilations and other manipulated forms of the original data produced by use of the program; or “(c) The mathematical and statistical formulas which would be used if the manipulated forms of the original data were to be produced manually.” Given that definition and the trial court’s findings, we conclude that the trial court did not err when it deter- mined that the zip file constituted a “computer program” within the meaning of ORS 192.345(15). As noted above, the trial court found that the zip file is written in the “SQL computer programming lan- guage”; it contains about 1,500 lines of code constituting “system architecture, such as tables, views, indexes, and stored procedures”; that system architecture “includes com- puter instructions, which are commands that are distinct from data”; and those “computer instructions” permit the Cite as 335 Or App 1 (2024) 9

“rapid organization, storage, retrieval, compilation, and cal- culation of data.” Specifically, they allow for the SQL data- base to be rebuilt into its original form through the use of the MySQL software program. That is, the zip file contains “instructions” which “permit the functioning of a computer system in a manner designed to provide storage, retrieval and manipulation of data from such computer system.” ORS 192.345(15). In seeking a different result, defendant first argues that the terms of ClearBallot’s contract with the county are “dispositive of the claimed computer program exemption.” Specifically, he argues that, under the terms of ClearBallot’s contract with the county, the zip file is “Work Product” and not “Licensed Software.” The difficulty with defendant’s argument is that, in spite of the terms of the contract between ClearBallot and the county, it is the statutory definition, and not the contract, that controls the legal question of whether the zip file falls within the statutory exemption for “computer programs” in ORS 192.345(15). Defendant also argues that the zip file falls into the statutory exception from the definition of “computer pro- grams” for “[a]nalyses, compilations and other manipulated forms of the original data produced by use of the program.” ORS 192.345(15)(b). The trouble with that argument is that we do not understand the computer instructions in the zip file to be either the “original data,” ORS 192.345(15)(a), or a “manipulated form[ ] of the original data produced by use of the program,” ORS 192.345(15)(b). Instead, as noted above, the trial court found that the zip file contains “computer instructions” and that those instructions are, in fact, “dis- tinct from [the] data.” We further note that the data within the zip file—as distinct from the database architecture—is not subject to the computer program exemption, or to any other exemption from disclosure raised by the parties. Consequently, the trial court did not err in deter- mining that the database architecture, and by extension the zip file, is conditionally exempt from public disclosure. We turn to whether the public interest nevertheless requires 10 Washington County v. Sippel

disclosure of the zip file under the circumstances of this case. See ORS 192.345. C. Public Interest In his fourth assignment of error, defendant con- tends that, even if one of the three statutory exemptions raised in this case applies to the zip file, the trial court erred in determining that the public interest does not require dis- closure of the zip file. In defendant’s view, an “extraordinary public interest” in “determining whether our elections are free and fair” outweighs any interest of the county in main- taining the confidentiality of the zip file. Once a trial court concludes that a conditional exemption to the Oregon public records disclosure require- ment applies to the record at issue, the “trial court must determine, as a matter of both law and fact, the nature and significance of two competing inter- ests—the public’s interest in disclosure and the public body’s interest in confidentiality. Then, the court must bal- ance those competing interests and determine, as a matter of law, which interest predominates.” American Civil Liberties Union v. City of Eugene, 360 Or 269, 271, 380 P3d 281 (2016). The presumption in favor of disclo- sure remains when weighing the public’s interest against the public body’s interest. In Defense of Animals, 199 Or App at 175-76. With regard to the public’s interest in disclosure, generally, under the statutory scheme, that interest is the “interest in information about the manner in which public business is conducted and the right of the public to moni- tor what appointed officials are doing on the job.” Id. at 176 (internal citations and quotation marks omitted). And we agree with defendant that the public has some interest in disclosure of the zip file in this case. But we disagree with defendant that the public’s interest in disclosure of the zip file is “extraordinary.” The record indicates that defendant’s purpose in requesting the zip file is to conduct iId. (“Evidence of the purpose for which the requestor is seeking the records may be relevant to the Cite as 335 Or App 1 (2024) 11

question whether the public interest requires disclosure.”). But that interest has already largely been served through the disclosure of data about the November 2020 Election in Washington County. As the trial court found: “[Defendant] and other members of the public can and have gained access to voter registration records, records of accepted and rejected ballots, images of each cast bal- lot, machine test information, and the cast vote record. * * * [Defendant] already has other sources that provide the same information for significant portions of the data (non-architecture) that is available in [the zip file].” On the other hand, the county has a compelling interest in maintaining the confidentiality of the zip file. First, as the trial court found, election systems face a vari- ety of potential threats from malicious actors and public dis- closure of the zip file “would reveal features of the system’s architecture, such as the names of database objects, that would assist an attacker in creating malicious code,” such that disclosure of the zip file “would compromise an import- ant layer of the security in the ballot counting process.” Moreover, because 15 counties in Oregon use ClearBallot software, disclosure of the zip file could put the security of elections in many Oregon counties at risk, not just elections in Washington County. Second, the trial court found that ClearBallot “has a commercial interest in protecting the design of its [ ]zip architecture from competitors,” and that public disclosure of the file would allow “its competitors to build a competing product without having to make similar investments to cre- ate their competing product.” That type of commercial inter- est in the confidentiality of software—an interest that the trial court specifically found was important in this case—is one of the reasons that the conditional exemption in ORS 192.345(15) exists. See, e.g., Exhibit K, Senate Committee on Judiciary, SB 219, Apr 2, 1987 (letter of support from City of Eugene Information Services Director Randy Kolb) (“If we were forced to make the software code public, no vendor would sell their products to us and we would be forced to create all software ourselves. This would increase costs to the public.”). 12 Washington County v. Sippel

For those reasons, we conclude that the county met its burden to show that the county’s interest in the confiden- tiality of the zip file predominates over the public’s inter- est in disclosure, even when considering the presumption in favor of disclosure. Consequently, the trial court did not err in determining that the public interest did not require disclosure of the zip file in this case. Affirmed.