[Cite as The Markup v. Ohio Dept. of Job & Family Servs. , 2023

- Ohio

- 623.]

IN T HE COURT OF CLAIMS OF OHIO

{¶1} This case arises from a publ ic records request mad e by a jour nalist intending to publi sh articles about the nature of a computerized frau d prediction s ystem implemented by the Ohio agency that processes unemployment in suran ce benefits

. Unless prove n exempt by law f rom disclosure
, Ohi o ’ s Public Records Act re quires o fficials
to make copies of public records available “ upon request by any person

. ” R.C.
149.43 (A)(1), (B)(1)

. T he Act must be construed liberally in favor of b road access, and any doubt is resolved in favor of disclosure of pu blic records. State ex rel. Rog ers v. Dept

. of Rehab. & Corr

., 155 Ohio St. 3d 545, 2018

- Ohio

- 5111, 122 N.E.3d 1208, ¶ 6. R. C.
2743.75 provides a special statu tory proceeding to enforce the Act in this court. {¶2} “ One of the salutary purposes of the Public Re cords Law is to ensure

ac countabi lity of government to those being governed. ” Strothers v. Wertheim , 80 Ohio St.3d 155, 158, 684 N.E.2d 1239 (1997). Journalists utilize the Act for this purpo se :

“ (I)n a so ciety in which each individual has but limited tim e and resources with whic h to obs erve at first hand the operations of his government, he relies necessarily upon the press to bring to him in convenient form the facts of those operations. Gr eat responsibil ity is accordingly placed upon the news media to r eport fully and accuratel y the pr oceedings of government, and official records and documents open to the public are the basic data of governmental operations. ” T HE MARKUP
Requester

v.

OHIO DEPARTMENT OF JOB AND FAMILY SERVICES
Respondent Case No. 20 2 2

- 00 27 9 PQ
Special Master Jeff Clark

REPORT AND RECOMMENDATIONCase No. 2 02 2

- 00279PQ

- 2

- REPORT AN D RECOMMENDA T ION

Kallstrom v. City of Columbus
, 165 F. Supp. 2d 6 86, 697 (S.D. Ohio 2001)
, quoting Cox Broad. Corp. v. Cohn , 420 U.S. 469, 49 2 , 95 S. Ct. 1029
, 43 L.Ed. 2d 328 (1975)

. The Ohio Supreme Court is in wholehearted agreement “ as to the importance of the media in gathering and disseminati ng informa tion to the public
, ” State ex rel. Cincinnati Enquirer v. Pike Ct

y. Coroner ’ s Office , 153 Ohio St. 3d 63 , 2017

- Ohio

- 8988, 101 N.E.3d 396, ¶ 54
, because [p] ublic records are one portal through which the people observe their government, ensuring its accountability, integrity, and equity while minimizing sovereign mischi ef and malf eas ance. See, e.g. State ex rel. Gannett Satellite Information Network, Inc. v. Petro (1997), 80 Ohio St. 3d 261, 264, 1997 Ohio 319, 685 N.E.2d 1223; State ex rel. Strot hers v. Wertheim (1997), 80 Ohio St. 3d 155, 157, 1997 Ohio 349, 684 N.E.2d 1239

. Public re cords afford an array of other utilitarian purposes necessary to a sophisticated democracy: they illuminate and foster understanding of the rationale underlying state decisions, White [ v. Clinton Cty. Bd. of Commrs
., 76 Ohio St.3d 416, 420, 667 N.E.2d 1 223 (1996)], promote cher ished rights such as freedom of speech and press, State ex rel. Dayton Newspapers, Inc. v. Phillips (1976), 46 Ohio St.2d 457, 467, 75 O.O.2d 51 1, 351 N.E.2d 127, and “ foster openness and * * * encourage the f ree flow of in formatio n w here it is not prohibi ted by law. ” State ex rel. The Miami Student v. Miami Univ . (1997), 79 Ohio St. 3d 168, 172, 1997 Ohio 386, 680 N.E.2d 956. (Ellipsis sic.) Kish v. Akron , 109 Ohio St. 3d 162, 2006

- Ohio

- 1244, 846 N.E.2d 811, ¶ 16.
Id . at ¶ 5 3. {¶3} O n November 29, 2021
, request er Todd Feathers , a journalist for a New York

based 1 media organization called The Markup
, 2 made a public records request to responden t Ohio Depa rtment of Job and Family Services (ODJFS) for : 1) All weekly statu s reports submi tted to the department by Google and/or Cara soft and their subsidiaries with re gard s to the attached contract (page four of the pdf, unde r the “ Data Load & Analy tics ” section

. 2) All “ repor t s on discover ed patter ns and behaviors identified in the analys is of the data provided ” su b mitt ed to the department by Google and /or

1 “ Any perso n ” in c lu de s for ei gn
- stat e resi dent s. 2006 Ohio A tty.Gen.Ops. No. 2006

- 038.
2 A lthough Feathers e nter ed “ The Mar kup ” in t he field for “ N ame of person or organization that
m ade pub lic records request ” o n the com plaint form, t he Novemb er 29, 2021 request a nd a ll f o ll ow
- up c or res pond en ce w as m ade solely in Feathers ’ nam e . The Special Master determined th at F eathers is the real p arty in i ntere st and that despite misnaming his m e dia org ani zation as the “ requester ” th i s action is b rought by an individual person ra t her t ha n a co r po r at ion. (July 27, 2022 Order .)Case No. 2 02 2

- 00279PQ

- 3

- REPORT AN D RECOMMENDA T ION

Cara h a soft and their subsidiaries with regards to the attached contract (page fo ur of the pdf, under the “ Data Load & Analyti cs ” section).
3) All “ m odeling and design validation guidelines ” sub mitt ed to the department by Googl e and /or Cara h a soft and their subsidiaries with regards to the attached contract (page fo ur of the pdf, under the “Data Load & Analytics ” section).
4) All docume nts containing “ analysis of the data to determine the likel y in d icator or combination of i n dicato rs that might otherwise indicate that a given record is or is not eligible ” submitt ed to the department by Google and /or Cara h a soft and their subsidiaries with r egards to the attached contract (page fo ur of the pdf, un der t h e “Data Load & Analytics ” s e ctio n).
5) All “ detailed documentation o n exploratory ana lysis and analytics and knowle dge transfer ” submitted to the department by Google and /or Cara h a soft and their sub sidiaries with regards to the attached contract (page five of t he pdf, under the “ Delivera b l es ” section).
(Complaint at 5 .) On March 23 , 20 2 2
, ODJFS produced records in response to Request
No. 1 with redactions b as ed on th e security and in frastructure exemption s in R.C.
149.433

. ( Id

. at 7 .) ODJFS initially stated it was unable t o fulf ill Request s Nos. 2

- 5
bec ause they sought information rather than records and did not “ identify, with reasonable clarity, the r ecords yo u seek. ” ( Id

. ) However, ODJFS no longer asserts that Requests #2
thro ugh #5 are over ly broad . (Res ponse at 6.) {¶4} On Mar c h 28
, 202 2
, F eathers filed a complaint pursuant to R.C. 2743.75 alleging denial of access to public records in violation of R.C. 149.43(B). Following mediation, O DJFS filed a response and motion to dismiss (Response) on June 8 , 202 2

. On June 2 8 , 20 2 2
, Feathers filed a reply

. On October 27 , 2022, ODJFS filed a sur

- reply
, and also filed withheld records under seal. On January 11, 2023, ODJFS filed additional
withhel d records under seal
, and an explanatory pleading. Unemployment Insurance Fraud Prediction System {¶5} In respon se to fraud occurring in its dis tribution of state and federal moneys , ODJ FS con tracted with Google a nd C arahsoft to supply a computer application

– the

“ Google Fraud Dashboard ”

– that c an predict the likelihood of fraud in un empl oyment
in su rance claims su bmitted to the depa rtment

. ( Response at 2

- 4
, Exh. 2

– Sines Aff . at ¶
8 , Exh. 3

– Pride au Aff. at ¶ 15 .) The Dashboard applies algori thms to data factorsCase No. 2 02 2

- 00279PQ

- 4

- REPORT AN D RECOMMENDA T ION

se lected by ODJFS to create a model against which un employment insura nce applications are compared. ( I d . at ¶ 9 .) If an application contai ns data f a ctors that rise to

a weight or threshold level set by OD JFS
, it is flagged as potentially fraudulent an d reviewed by an ODJFS employee. (Sines Aff. at ¶ 10.) The factors, w eight s and
thresh olds are continually adjusted in response to observed fra ud patter ns

. ( Id . at ¶ 9 .) {¶6} S oftware used to operate a computer i s usually just the m eans of access to

r ecords, without itself me eting the definition o f a “record .” State ex rel. Recodat Co. v.
B uch an a n , 46 Ohio S t.3d 1 63, 165, 546 N.E.2d 203 (1989)

. Application s oftware is not a

“ record ” su bject to the Public Records A ct unless
, and then only to the extent that
, it
document s the activities of the office

. In this case, the Da shboard is not a shrink

- wrapped
commercial sof tware product but a cus tom application programmed in part with
institutio nal data factors, weights, and t hreshold values

. These parts of th e Dashboard
p rogramming serve to document policy decisions made b y ODJFS in the evolv ing
confi guration of its frau d c ontrol procedures

. D o cume nts kept by ODJFS that reflect these
choices thus meet the definitio n of “records ” of the office, R.C. 149.011(G)

. Responsive Records Provided , With Redactions {¶7} Feathers confirm s that th e documents referenced in Request #1 have be en provided. (Reply at 1.) During litigation
, ODJFS produced additional emails responsive to Request #1 as well as a Technical Design Document (TDD) respo n sive to Requests #2 through #5. (Response at 6, Exh. 1

– Sul livan Aff . at ¶ 4

- 5 , Exh. 2

– Sines Aff. a t ¶ 1 5. b. ; Reply at 1 , 129

- 188

– redacted copy of TDD ) Feathers has not assert ed that any additional records exist responsive to h is reques t s. {¶8} OD JFS d oes not dispute that the se records are , absent applicable

ex em ption s , pu b lic record s kept by a public of fice. Th e i ssue before the court i s whether ODJFS properly app lied public records exempt ions to redact i nformatio n within the
documents provided. To its credit
, and faci litating the court ’ s review, ODJFS ’ redactions large ly avoid obscur ing email and TDD te xt other than the particular information described
in its pleadings and affidavits as subject to the claim ed exemptions
, in compliance with R.C. 14 9.4 3 (B)(1). 3

3 Based on comparison w ith the unredacted documents in camera

. R.C. 149.43(B)( 1) provides in pertinent part: “ If a publi c record con tains information that is exempt from the duty to permit public inspectionCase No. 2 02 2

- 00279PQ

- 5

- REPORT AN D RECOMMENDA T ION

Burden to Prove Ex em ption s 4 {¶9} T he burden to est ablish t h e applica bility of an exempt ion rests on the public
office

. Cincinnati Enqu i rer v. Pike Cty. Coroner’ s Office , 153 Ohio St.3d 63, 2 017

- Ohio

8988, 101 N.E.3d 396, ¶ 15. Exc eptions to disclosur e are strictly construed again st the public

- record s cust odian

. Ro gers v. D ep t

. of Rehab. & Corr

. , 155 Ohio St. 3d 545, 2018

- Ohi o
- 51 11, 122 N.E.3d 1208, ¶ 7. A custodian does not meet this burden if it has not proven that th e requested records fall squarely within the excep tion. State ex rel. Cincinnati Enquirer v. Jones

- Kelley , 1 18 Ohio St.3d 81, 2008

- Ohio

- 1770 , 886 N.E.2d 206,
pa r agr aph two of the syllabu s

. When a p ublic o ffice claims exception s base d on risks that
are not evident within the records themselves
, the office must provide mo re than
conclusor y stateme nts in affidavits to prove th e assertion

. State e x rel. Besser v. Ohio
State Univ

., 89 Ohio St.3d 396, 4 00

- 404, 732 N.E.2d 373 (2000)

. Any doubt should be
resolve d in favor of disclosure of public recor ds

. State ex rel. James v. Ohio State Univ.
, 70 Oh io St.3d 168, 169, 6 3 7 N.E.2d 911 (1994)

. {¶10} ODJFS firs t asserts tha t portions of the records were redacted pursuant to R.C. 149.433 as “infrastructure record s , ” “ security record s , ” o r both. ( Response at 9

- 14; Supp. Response , Exh. 5

– Privilege Log passim .) These exemptions are separately
defined and will be a naly zed separately.
Infrastructure Records {¶11} R.C. 149.433(A) provides that : “Infrastructure reco rd” means an y record that discloses the configuration of critical systems inclu ding, but not limited to, communication, comp uter, electrical, mechanic al, venti l ation, water, and plumbing systems, security codes, or the infrastructure or structural configur ation of a b uilding. By this language, listed systems a re po tentially but not automatically “ critical ” systems

.

“ Critical
, ” i n t h e context of systems , m ean s “ e x tremely important to the progress or

or to co py the public record, the public office * * * shall make available all of the information within the public record that is not exempt. ” See also R. C. 149.43(A)(1 3) “ Redaction ” means obscuring or deleting any information that is exempt from the duty to p erm it public inspection or co pying from an item that otherwise meets the definition of a “ record ” in section 149.011 of the Revised Code.

4 A public reco rds excepti o n is a law p ro hibiting or excusing discl osu re of records that wou ld
o therwise be public. T h e t er ms “ exempti on ” and “ exce ption ” are used interchangeably in this report.Case No. 2 02 2

- 00279PQ

- 6

- REPORT AN D RECOMMENDA T ION

success of something

. ” See https://dictionary.cambridge.org/us/d ictionary / en glish/critical ( A ccessed No v. 17, 2022.) {¶12} OD JFS provides th e testimo ny of information security and fraud control sta ff
that the computerize d Go ogl e Fraud Dashboard is an important component o f efforts to prevent, dete ct, and mi tigate incidents of f raud occurring in the state ’s Unemployment
Insurance Program

. (Response at 4 , Exh. 2

– Sines Aff. at ¶ 8 a nd 15 d

. , Exh. 3

– Pridea u Aff. at ¶ 15 ; Sur

- r eply at 2

- 6

. ) ODJFS states that hundre ds of millions of dollars in unemploym ent insurance payment s ha ve been and continue to be obtained from ODJFS fraudulently (R esponse, Exh. 3

– Prideau Aff . at ¶ 10

- 1 4 ) and argues that the se massive
losses would be even worse but for use of the Dashboard

. {¶13} Feathers argue s that the system is not a “ critica l ” one b e ca use the cont ract
to de velop the Dash board provide s that the program need only operate at a “ moderate
level baseline ” as defined in National Institute of S tanda rds and Technology 800

- 53 Rev.
3

. (Reply at 2 , Exh. 1 at 38 .) ODJFS c ounters t hat t he “ c r itical ” nature of a system is not determined by design criter ia or industry standards but by the impact on the office of loss
of confide ntiality, integrity, or availab ility of the syst em. (Sur

- reply at 3

- 5.) ODJFS attes ts
that release o f Dashboa rd info rm a tion could be expected to have a serious adverse effect on organizational operations, including a signif icant degradation in mission capa bili ty to
an extent a nd duratio n that the organi zation may still be able to perform its primary
function s, but th e effecti v ene ss of th ose functions is significantly reduce d . (Sur

- reply, Exh.
4

- Supp. Sines Aff. at ¶ 5

- 13.) Feathers further emphasizes that O DJFS has lost
hundre ds of mil lions of dollar s to frau d despite the use of the Dashboar d. H owe ver, past
and continui ng loss o f funds does not make the program ’ s design and purpose any less

“ critical. ” Weig hing the evidence submitted, the Special Master co ncludes that ODJFS
has shown th at the Dashboard falls squarely within the me aning of the term “ criti cal
sy ste m ” as us ed in R.C . 149.433(A). {¶14} ODJFS next attests that portions of the requested documents mee t the statutory definition by disc losin g the “ configu ration of ” th is critical system

. In common usage, the conf iguration of a sys t em i s the arrangeme nt or relationship of its elements. See merriam

- webster. com/dictionary/ configuration (Accesse d Feb. 7, 2023 .) Examp les
of records that disclose system configura tion include electrical schemat ics, HVAC plans,Case No. 2 02 2

- 00279PQ

- 7

- REPORT AN D RECOMMENDA T ION

computer network di agrams, plumbi ng layouts, and security code generation algorithms. S haffer v. Budis h
, Ct . of C l. No. 20 17

- 00690

- PQ, 2018

- Ohio

- 1539
, ¶ 18

. {¶15} ODJFS asserts that the factors use d in the Dashboa rd so ftware to flag potentially fr audul ent applicati ons, and the we ights an d t hres holds assigned to each
factor that t hen trigger detailed review, “ con stitut e ‘ relative arrangements of parts or elements, ’ or the ‘ configuration ’ of a critical system

— softwar e used to dete ct fraud in appli cations. ” ( Response a t 11.) ODJFS s ub mit s th e affidav i t of its former Agency Chief Information Security Officer, now Deputy Director of IT Risk and Compliance
, who attests
that : 1. R edactions to the weekly statu s reports of Spr ingM L/Google removed specific

r eferences to how th e models were c reate d and informati on and data that was

us ed to create them. (Response, Exh. 2

- Sines Aff. at ¶ 15a

. )
2. Redact ions of the Technical Design Document would disclose how the Google
Fra ud Dashbo a rd AI/ML m odels were architect ed , and obscure dia grams and te xt
conta ining specifics to the Ohio J ob Insurance Database tables and fi elds, file names, job names , and to the weight, factors, and conditions used to create the
models for the Dashboard. ( Id. at ¶ 15 b .) , and
3. Redactions of the May 13, 20 21 e mail and attach ment from Jo hn Skinne r to Ward Loving co ntain data, flags, and insight s into the model for the Dashboard

. ( Id. at ¶
15 c .) {¶16} The Special Master finds that the d ata factors, flags, weights
, and th resh olds
entered into t he Dashb oard s oftware meet the definition of “ infrastruc ture record s

. ”
R eview of the redact ed in f ormation in camera sh ows that for the mo st part ODJF S has
redacted material that f alls squarely within th e exemption as listed in the pr ivilege log

. However, ODJFS was overinclusive in redacting some chapter titles
, two sentences that
merel y contain the wor d “ conf iguration
, ” and certain other innocuous tex t

. {¶17} In isolation, m erely showing the name or picture of a system component without ju xtaposing it with other compone nts does not reve al the configuration of the system. Sh affer v. Budish , Ct. of Cl . No

. 2017

- 00690

- PQ, 2018

- Ohio

- 1539
, ¶ 16

- 18. Moreover, the general principles and indicators of computerized fr aud d etection system s
are not se cret. T he court may take no tice that some features of the Google FraudCase No. 2 02 2

- 00279PQ

- 8

- REPORT AN D RECOMMENDA T ION

Dashb oard in general and Cara h soft m odifications in particular have been disclosed in legal and promotional materia ls a vailable to the publ ic

. T he general p ri n ci ples an d
pa ram e ters of t he system are availa ble online by a web search of “ goo gle f r aud det ection
st ates

. ” See also Go ogle ’ s patent for f raud detection u sing predictive modeling at https://patents.google.com/patent/US58 19226A/en

. ( Accessed Feb. 3, 2023 )

. Ca ra h sof t has posted blog s and public webinars expla inin g that f raud indicators specifically include repeti tive appearanc e of phone n umber s, email addresses and other c ontact information
in multiple cl aims

. See, e .g., https://www.carahsoft.com/blog/f5

- une mployment

- fraud

impact

- blo g
- 202 1

. (Accessed Feb. 3, 2023

. ) Th e se application and paymen t data
indicators are similar to other economic crim e and fr a ud indicator s that law enforcement
age ncies ge nerally do not keep secr et , but instead publicize to h elp the public detec t and report o ffe nses

. However, it is the rol e of the legislature and not the courts to determine public policy and de fine the part icular records it subject s to a statutory exemption

. State ex rel. WBNS TV, Inc. v. Dues , 101 Ohio St. 3d 406 , 2004

- Ohio

- 1497, 805 N.E.2d 11 16, ¶ 36

- 37. {¶18} T he combination o f factors, flags, weights, and thresh olds developed for ODJFS is unique to th e agenc y ’ s particular implementation of the fraud

- detecting
Dashboard

. The Special Master conclu des that most of the information so identified in OD JFS ’ pr ivilege log falls square ly under th e sta tutory definition of “ infrastruct ure record
, ”
with the few exceptions identified in the table s at the end of this repor t

. Security Records {¶19} R.C. 149.433 provides, in pertinent part : (A) As u sed in t h is section: * * * “ Security rec ord ” m eans any of the following: ( 1 ) Any record that contains info rmati on direc tly u sed for protecting or maintain ing the security of a public off ice against attack, interference, or sabotage; * * *
(B) (1) A rec ord kept by a public office that is a securi ty re c ord is no t a public
re cord under section 149.43 of the Rev is ed Co de and i s not subject to mandatory release or disclosure under that section

. {¶20} To meet the burden of proof regar ding a lleged security records
, a public
office must offer more than its own co nc lusory l a beli ng:Case No. 2 02 2

- 00279PQ

- 9

- REPORT AN D RECOMMENDA T ION

The department a nd other agencies of state government cann ot simply label a crim i nal or safety record a “security r ecord” an d preclude it from release under the public

- recor d s law, without sho wing that it falls withi n the definition in R. C. 149.4 3 3.
S tate ex rel. Plunderb und Media , L.L.C. v. Born, 141 Ohio St. 3d 422, 2014

- Ohio

- 3679,
2 5 N.E.3 d 988
, ¶ 29. Ev en r ecords pr oduced by a designated security system or s ecurity protection operation must individually meet the st atut or y defini tion. Rogers v. D ept. of Rehab. & Corr

., 155 Ohio St.3 d 545, 2018

- Ohio

- 5111, 122 N. E.3d 1208, ¶ 1 5

- 21 ; Sta t e ex rel. Miller v

. Pinkney

, 149 Ohio St.3d 662, 2017

- Ohio

- 13 3 5, 77 N .E.3d 915, ¶ 1

- 4 ; Sha ffe r v. Budish , Ct. of Cl. No. 2017

- 00690PQ, 20 18

- O h i o
- 1539, ¶ 21

- 24

. {¶21} The s t andard of proof i s strict ly ap plied against the public recor ds custodian

. Rogers at ¶ 7. “As we made clear in Plunderbund , ev ery re cord claimed under the security

- reco rd exception to disclo s ure mu st be considere d separate ly. ” Id. at ¶ 21

. Unless it is o therwise obvious from the content of the re cord, the propo nent invoking the security

- record exemption under R.C. 149.433(A)(1) must provide evidence est ablishing that th e record clea rly contains information direc tly used for protecting or maintaini ng t he s ecurity of a public o ffice against a ttack, interference, o r sabotage.
Welsh

- Huggins v. Jefferson Cty. Prose c utor ’ s Office , 163 Ohio St. 3d 337, 2020

- Ohio

5371
, 170 N.E.3d 7 68
, ¶ 51. Such evidence i s often provided through fact and expert
testimon y establish ing that the records meet the sta tutory elements. In Plunde r bund
,
res pondent provided the detailed testimony of several law

- enforc ement and
telecom municati ons e xperts connecting the disclosu re of the requested information to future risks. Welsh

- Huggins at ¶ 52
, Plunder bund at ¶ 22

- 31. {¶22} Supporting a ffidavits must be evaluated for their sufficiency in provin g the exemption for each record c laimed

. I n Rogers , the Court found on review that DRC has not met its burden to s how that the requested video falls squar e ly within the security

- record exception codif ied in R. C. 149.433(B). * * * Here, DRC has provided only two affidavits, one of which merely concludes that

“ it is [DRC] policy that s ecurity videos wit hin c orrection i nstitutio ns are not public records, and a re therefore not disclosed in response to pub lic recor ds requests. ” Bobby ’ s affidavit contains more information regarding t he applicability of the exception, yet even his testimony is general and ins uffic ient to mee t DRC ’ s b urden in this case. Beyond thes e bare allegations, DRC has not attempted to e xplain ho w the video recording at issue actually constitutes “ information dire ctly used for protecting orCase No. 2 02 2

- 00279PQ

- 10

- REPORT AN D RECOMMENDA T ION

maintaining the security of a public office agai nst a ttack, inte rference, or sabotage, ” or was “ assemble d , prepared, or maintained by a public office * * * to prevent, mitigate, or respond to acts of terrorism. ” R.C. 149.433(A)( 1) and (2).
Rogers at ¶ 1 9

. Certain Reques t ed Data Would Facil itate Int erference {¶23} ODJF S argues that the information it withheld co uld be used to brea ch the

se curity of the Dashboard , which is its el f designed and used to protect the security of the
office ’ s Une mployme n t Ins urance Program from attack, in terference , or sabotage. (Response at 11

- 14 ; Sur

- re p ly at 5

- 6 .) O DJFS provides the court with affidavit s containing
at least somewhat more th an bare assertions that particular items are security records

. OD JFS asserts that the withheld records “ include what is effectively a ‘ user guide ’ for the Google Fraud So ftware : the Technical Design Document. ” (Emphasis sic .) ( Response at
13 )
, arguing that this informati on would enable bad actor s to craft fraudulent applications

mor e likely to el ude dete ction

. As noted earlier, ODJFS attes ts that disclosure of
Dashboard info rm a tion could be expected to have a serious adverse effect on organizational operation s, includ ing a signif icant degradation in mission capabili ty to an
extent a nd duration that the organi zation is still able to perform its primary functions, but
the effecti v ene ss of th ose function s is significantly reduce d . (Sur

- reply, Exh. 4

- Supp. Sines Aff. at ¶ 5

- 13.) The evidence offered by ODJFS thus supports, minimally but sufficiently
, that the indicator, flag, w ei g ht, and “ user manual ” reco rds fall squarely within the security records exe mption

. Weekly Updates {¶24} ODJFS withheld porti ons of se ven one
- page weekly update s

. (Respondent ’ s Jan. 11, 2023 Explanatory P leading at 13

- 18. ) ODJFS of fers no explanation as to how
disclosure of redacted portion s of the updates meets the statut ory definitio n of a “ security
record ” other than that som e contain labels of certain “ flags ” used in the Dashboard. On
review in camera
, e ach update consist s of comment s presented in three columns;
Achie vements/Key Updates, Upcoming Activi ties, and Issue/R isks and Miti gation. The weekly reports conta in no algorit hms

. The bull et

- pointed commen ts consist mainly of the progress status of very generally labeled tasks, gen erally described needs for permissionCase No. 2 02 2

- 00279PQ

- 11

- REPORT AN D RECOMMENDA T ION

or information, the fact that calls/ me etings were held or sho uld b e held , and re ference to

“ fu zzy logic ” that is e l se where d isclosed as a type of processing rather than a specific
indicator or flag

. The update also contains a Status indication among options of Complete, On Track, Delayed, Be hind, or Not Sta rted. The Spec ial Master finds that n one of the
redacted w eekly report in formation
, other than the listed flags
, disclose a security record
on it s face. {¶25} The Special M ast er c o nclude s that OD JFS has met its burd en to prove that
some but n ot all of the data referenced as security r ecords in the privilege log f a ll s
square ly under th e exception for “ information directly used for prote cting or maintaining the security of a p ubl ic off ice against attack, interference, or sabotage
, ” as identified in
the table s at the end of this repor t

. Trade Secret {¶26} ODJFS labels some withheld data as trade secret information. The Ohio
Uniform Trade Secrets Act d efin es “ t rade secret ” as: infor mation, including the whole or any porti on or p hase of a ny scientific or te chnical information, d esig n, p roces s, procedure, formula, pattern,
com p i l ation, program, device, m ethod, technique, or improvement, or any business in form ati on or plans, financ ial i nformation, or listing of names, address es, or telephone numbers, that sati sfies both of the foll owin g: ( 1) It derives independent economic value
, a ctual or potential, from not being generally known to, and not being readily asce rta inable by proper
me ans b y, other persons who can obtain economic value from its disclosure
or use. (2) It is the subject of e ffor ts th at are reasonable under the circums t a n ces to maintain its secre cy. R.C. 1333.61(D). {¶27} Like the i nfra structure and security record e xemption, this is not a “ name
- it

and

- claim

- it ” exemption but must be proven with e vide n ce s howing that th e inf ormatio n fa lls s quarely within the full definition of trade secret

. “ An entity c laiming trade secre t
st atu s bears the burden to id entify and demonstrate that the material is inc luded in categories of protecte d information under the statu te and additionally must take some acti v e steps to maintain its se crec y. ” (Emph asis added.) Besser II , 89 Ohio St.3d 396, 400, 2000

- Ohio

- 207 , 7 32 N.E.2d 373 (2000 ). To meet it s burden, t he entity must provi deCase No. 2 02 2

- 00279PQ

- 12

- REPORT AN D RECOMMENDA T ION

more than con clusory statements in affidavits t o show whic h, if any , informat ion is a “ trade
secret. ” I d

. at 400

- 404

. Accord Hance v. Cleveland Clinic , 2021

- Ohio

- 1 493 , 172 N.E.3d 478, ¶ 27

- 32 (8 th Dist.) ; Harris v . Belvoir Energy, Inc ., 8th Dist. Cuyaho ga No. 103460,
2017

- Ohio

- 2851, ¶ 16

. The follow ing fac tors ar e used by Ohio cour ts in trade secret analysis: (1) The ex te n t to w hich the information is known outside the business; ( 2) the ex tent to which it is known to thos e inside the business, i.e., by the employees; ( 3) the precautions taken by the hol der of the t rade se cret to gua rd th e secrecy of the information; (4) th e savin gs effected and the v alue to the holder in having the informat ion as against competitors; (5) t he
amoun t of effort or money expended in obtaini ng and developing the information; and (6) the amou nt of time and expe nse it would take for others to ac qu i r e and duplicate the infor m ation.
Besser II at 399

- 400. {¶28} ODJFS does not claim information as its own t r ade secret
, stating only t hat “Google asked ODJFS to redact several portions of t he [TDD] as trade secrets. ” (R esponse at 6, fn. 3

. ) Further and fatally
, ODJFS has not submi tted any testimony from Google identifying any pa rticula r information as a trade secret, much less demonstrating by evidence that it satis f i e s the Be s ser II factors

. Instead, ODJFS offers only a vague

as sertion that “ it i s industry

- standard to consider data alg orit hms as ‘ trade secrets ’ or

‘ intellectual proper ty ’ and to w ork ha rd to protect these algorithms as part of their
business. ” (Sur

- reply at 4 , Sine s A ff. II a t ¶ 16

. ) Even accept ing th is a ssertion arguendo
, ODJFS does no t label any specific i tem in the records as a “ data algorithm

. ” In th e absence of informed evidence from the putative holder of any trade secret , n on e of the

re dacted portions of the records sel f

- identify as data al gorithm s

. N or are any of the Besser
II factors demonstrated on the face of the record s

. {¶29} The Special Mast er fi nd s that ODJFS has failed to meet its burden t o prove that any of the withheld records falls squarel y w ithin the trade secr et e xemptio n. Legen d for Exemptio n Tabl es :

• Not cl

a imed

– O D JFS has not asserted th e exemption for th e li sted item

• Not proven

– O DJFS submit ted no e vidence beyond the bare assertion of th e exemption, and examination o f the item in cam era does not sh ow that the item falls squarely within th e exem ptionCase No. 2 02 2

- 00279PQ

- 13

- REPORT AN D RECOMMENDA T ION

• B y a ff

. – a ffid avit testimony persuades the Special Master at least minimally that the item falls squarely within the exemption

• B y exam

– on examination in camer a the Special Master finds tha t application of th e ex em ption i s self

- evide n t
It ems that are found not to meet th e statu tory definition of any exemption and must be
disclosed are highlighted in bold underline

. Technical Design Document (TDD)
Page(s ) Section I nfras truc ture (I nfr

. ) or Security (S ec

. ) Record Tra de Secret

2 C o ntent s N o t prov en Not proven

5 High Leve l Architec tu re I nfr

. by aff

. & exa m, Sec

. not proven No t proven

6

- 7 Flags and Thresho lds Infr

. and Sec

. by aff & exam Not proven
7

- 9 Data Sources & Stora ge I nf r

. by aff

. & exa m, Sec by aff

. Not clai med
10

- 12 Data In gestio n & Lo ading I nf r

. by aff

. & exa m, Sec by aff

. Not claimed
13 Data Processing Wo r kflow I nf r

. by aff

. & exa m, Sec by aff

. Not clai med

13 Data Processing and Flag

Score Generati on I nf r

. by aff

. & exa m, Sec by aff

. Not proven

13 Fuzz y Logi c P rocess ing I nf r

. by af f

. & exa m, Sec by aff

. Not proven
14 Fuzzy Logi c Processing I nf r

. by aff

. & exa m, Sec by aff

. Not cl aimed
15 Fuzzy Logi c Processin g I nf r

. by aff

. & exa m, Sec by aff

. Not proven
16

- 17 Fuzzy Logi c Proc essing I nf r

. by aff

. & e xa m, Sec by aff

. Not cla imed

18

- 19 Flag Generator or Score

Computation I nf r

. by aff

. & exa m, Sec by aff

. Not claimed

20 BigQu e ry I nf r

. by aff

. & exa m, Sec by aff

. Not proven
20

- 21 Existi ng Data Sets I nf r

. by aff

. & exa m, Sec by aff

. Not cl aimed
21

- 22 D ata Studio Dash boards I n f r

. by aff

. & exa m, Sec by aff

. Not proven
23 Dat a Studio Dashboar ds I nf r

. by aff

. & exa m, Sec by aff

. Not proven

23 F rau d Analysis Dashboard

Filters

- Program I nf r

. by aff

. & exa m, Sec by aff

. Not proven

23 Frau d Analysis Dashbo a rd

Filters

– F lag Bucke t I nf r

. by aff

. & exa m, Sec by aff

. Not claimed

24

- 25 Frau d Analysis Dash board

Filters

– To tal Payments I nf r

. by aff

. & exa m, Sec by aff

. Not claimed

25 Managed Data Sources I nf r

. by aff

. & exa m, Sec by aff

. No t provenCase No. 2 02 2

- 00279PQ

- 14

- REPORT AN D RECOMMENDA T ION

26 Managed Data Sources I nf r

. by a ff

. & exa m, Sec by aff

. Not p roven 27 Link ed Fields I nf r

. by aff

. & exa m, Sec by aff

. Not proven
28 Linked Fields I nf r

. by aff

. & exa m, Sec by aff

. Not claimed

29

- 37 Infra structure

Configu ration and Setup I nf r

. by aff

. & exa m, S ec by aff

. Not claimed

Weekl y Status R eport Emails
P age s Email Infrastructure /Secur ity Trade Secret
49

- 53 May 13, 2021 I nf r

. by aff

. & exa m, Sec by aff

. Not proven

54

- 5 7 May 13, 2021

-

Attachment Not claimed Not pr oven

Weekly Sta tus Report s Primary pagination in this table is to Responde nt ’s Jan. 11, 2023 Explanatory Pleading

. Pag ination for the unredacted document s under seal is in parenthes es . Pages 14, 15, & 17 contain some permissible exemptio ns , as noted by table cell text without emphas es. Page Report Date Infra structure /Se c urity Trade Secre t
13 ( 65) May 17, 2 021 Flags are infra structure/ sec urity records

. Not claimed

14 (66) May 10, 2 02 1 Flags are infra structure/ security record s

. E xemption s not proven for bullet point 2

or for processing term in bullet point 1 Not claimed

15 (67) May 3, 2021 Flags are infrastructure/ security records Exemption s not proven for Issue/Risk
text N ot claime d

16 (68) A pr

. 26, 2021 No exemption proven Not c laimed

17 (69) Apr

. 19, 2021 Issue/Risk text contains infras tructure rec d s. No exemption p r oven for remainder Not claimed

1 8 (70) Apr

. 12, 2021 Not proven Not clai med

Concl usio nCase No. 2 02 2

- 00279PQ

- 15

- REPORT AN D RECOMMENDA T ION

{¶30} Accor dingly, t he Specia l Master recommend s the court order respondent t o provide requester with copies of the records and portions of records identified in the
Exem p tio n Ta bles in bold underline as not falling under a proven exemption

. I t is
recommended that costs be assessed t o respondent

. {¶31} P u rsu ant t

o R.C. 2743.75(F)(2), ei ther party may fil e a written objectio n w ith
the clerk of the C ourt of C laims of Ohio within s even (7) business d ays a fter receiv

ing this report and rec om mendation. Any objection shall be specific and s tate with particulari t y a ll
gr ounds for the objection. A party shall not assign as error on app eal the court’s adopti on of any factual findings or l egal conclusions in this rep ort and recommendation unless a timely objection was filed thereto. R.C. 2 743.75 (G)( 1 ).

JEFF C L ARK Sp ecial Master

Filed February 7 , 2023 Sent to S.C. Reporter 3/ 2 /23