Court Opinion

ID: 9376513
Source: CourtListenerOpinion
Date Created: 2023-03-02 20:06:01.128566+00
Date Added: 2024-06-11T17:17:07.346976
License: Public Domain

[Cite as The Markup v. Ohio Dept. of Job & Family Servs., 2023-Ohio-623.]

                             IN THE COURT OF CLAIMS OF OHIO

 THE MARKUP                                            Case No. 2022-00279PQ

        Requester                                      Special Master Jeff Clark

        v.                                             REPORT AND RECOMMENDATION

 OHIO DEPARTMENT OF JOB
 AND FAMILY SERVICES

        Respondent

        {¶1} This case arises from a public records request made by a journalist intending
to publish articles about the nature of a computerized fraud prediction system
implemented by the Ohio agency that processes unemployment insurance benefits.
Unless proven exempt by law from disclosure, Ohio’s Public Records Act requires officials
to make copies of public records available “upon request by any person.” R.C.
149.43(A)(1), (B)(1). The Act must be construed liberally in favor of broad access, and
any doubt is resolved in favor of disclosure of public records. State ex rel. Rogers v. Dept.
of Rehab. & Corr., 155 Ohio St.3d 545, 2018-Ohio-5111, 122 N.E.3d 1208, ¶ 6. R.C.
2743.75 provides a special statutory proceeding to enforce the Act in this court.
        {¶2} “One of the salutary purposes of the Public Records Law is to ensure
accountability of government to those being governed.” Strothers v. Wertheim, 80 Ohio
St.3d 155, 158, 684 N.E.2d 1239 (1997). Journalists utilize the Act for this purpose:
        “(I)n a society in which each individual has but limited time and resources
        with which to observe at first hand the operations of his government, he
        relies necessarily upon the press to bring to him in convenient form the facts
        of those operations. Great responsibility is accordingly placed upon the
        news media to report fully and accurately the proceedings of government,
        and official records and documents open to the public are the basic data of
        governmental operations.”
Case No. 2022-00279PQ                              -2-       REPORT AND RECOMMENDATION

Kallstrom v. City of Columbus, 165 F.Supp.2d 686, 697 (S.D.Ohio 2001), quoting Cox
Broad. Corp. v. Cohn, 420 U.S. 469, 492, 95 S.Ct. 1029, 43 L.Ed.2d 328 (1975). The
Ohio Supreme Court is in wholehearted agreement “as to the importance of the media in
gathering and disseminating information to the public,” State ex rel. Cincinnati Enquirer
v. Pike Cty. Coroner’s Office, 153 Ohio St.3d 63, 2017-Ohio-8988, 101 N.E.3d 396, ¶ 54,
because
        [p]ublic records are one portal through which the people observe their
        government, ensuring its accountability, integrity, and equity while
        minimizing sovereign mischief and malfeasance. See, e.g. State ex rel.
        Gannett Satellite Information Network, Inc. v. Petro (1997), 80 Ohio St.3d
        261, 264, 1997 Ohio 319, 685 N.E.2d 1223; State ex rel. Strothers v.
        Wertheim (1997), 80 Ohio St.3d 155, 157, 1997 Ohio 349, 684 N.E.2d 1239.
        Public records afford an array of other utilitarian purposes necessary to a
        sophisticated democracy: they illuminate and foster understanding of the
        rationale underlying state decisions, White [v. Clinton Cty. Bd. of Commrs.,
        76 Ohio St.3d 416, 420, 667 N.E.2d 1223 (1996)], promote cherished rights
        such as freedom of speech and press, State ex rel. Dayton Newspapers,
        Inc. v. Phillips (1976), 46 Ohio St.2d 457, 467, 75 O.O.2d 511, 351 N.E.2d
        127, and “foster openness and * * * encourage the free flow of information
        where it is not prohibited by law.” State ex rel. The Miami Student v. Miami
        Univ. (1997), 79 Ohio St.3d 168, 172, 1997 Ohio 386, 680 N.E.2d 956.
        (Ellipsis sic.) Kish v. Akron, 109 Ohio St.3d 162, 2006-Ohio-1244, 846
        N.E.2d 811, ¶ 16.
Id. at ¶ 53.
        {¶3} On November 29, 2021, requester Todd Feathers, a journalist for a New York-
based1 media organization called The Markup,2 made a public records request to
respondent Ohio Department of Job and Family Services (ODJFS) for:
    1) All weekly status reports submitted to the department by Google and/or
       Carasoft and their subsidiaries with regards to the attached contract (page
       four of the pdf, under the “Data Load & Analytics” section.

    2) All “reports on discovered patterns and behaviors identified in the analysis
       of the data provided” submitted to the department by Google and/or

        1 “Any person” includes foreign-state residents. 2006 Ohio Atty.Gen.Ops. No. 2006-038.
        2 Although Feathers entered “The Markup” in the field for “Name of person or organization that
made public records request” on the complaint form, the November 29, 2021 request and all follow-up
correspondence was made solely in Feathers’ name. The Special Master determined that Feathers is the
real party in interest and that despite misnaming his media organization as the “requester” this action is
brought by an individual person rather than a corporation. (July 27, 2022 Order.)
Case No. 2022-00279PQ                      -3-     REPORT AND RECOMMENDATION

      Carahasoft and their subsidiaries with regards to the attached contract
      (page four of the pdf, under the “Data Load & Analytics” section).

   3) All “modeling and design validation guidelines” submitted to the department
      by Google and/or Carahasoft and their subsidiaries with regards to the
      attached contract (page four of the pdf, under the “Data Load & Analytics”
      section).

   4) All documents containing “analysis of the data to determine the likely
      indicator or combination of indicators that might otherwise indicate that a
      given record is or is not eligible” submitted to the department by Google
      and/or Carahasoft and their subsidiaries with regards to the attached
      contract (page four of the pdf, under the “Data Load & Analytics” section).

   5) All “detailed documentation on exploratory analysis and analytics and
      knowledge transfer” submitted to the department by Google and/or
      Carahasoft and their subsidiaries with regards to the attached contract
      (page five of the pdf, under the “Deliverables” section).

(Complaint at 5.) On March 23, 2022, ODJFS produced records in response to Request
No. 1 with redactions based on the security and infrastructure exemptions in R.C.
149.433. (Id. at 7.) ODJFS initially stated it was unable to fulfill Requests Nos. 2-5
because they sought information rather than records and did not “identify, with reasonable
clarity, the records you seek.” (Id.) However, ODJFS no longer asserts that Requests #2
through #5 are overly broad. (Response at 6.)
      {¶4} On March 28, 2022, Feathers filed a complaint pursuant to R.C. 2743.75
alleging denial of access to public records in violation of R.C. 149.43(B). Following
mediation, ODJFS filed a response and motion to dismiss (Response) on June 8, 2022.
On June 28, 2022, Feathers filed a reply. On October 27, 2022, ODJFS filed a sur-reply,
and also filed withheld records under seal. On January 11, 2023, ODJFS filed additional
withheld records under seal, and an explanatory pleading.
      Unemployment Insurance Fraud Prediction System
      {¶5} In response to fraud occurring in its distribution of state and federal moneys,
ODJFS contracted with Google and Carahsoft to supply a computer application – the
“Google Fraud Dashboard” – that can predict the likelihood of fraud in unemployment
insurance claims submitted to the department. (Response at 2-4, Exh. 2 – Sines Aff. at ¶
8, Exh. 3 – Prideau Aff. at ¶ 15.) The Dashboard applies algorithms to data factors
Case No. 2022-00279PQ                                 -4-        REPORT AND RECOMMENDATION

selected by ODJFS to create a model against which unemployment insurance
applications are compared. (Id. at ¶ 9.) If an application contains data factors that rise to
a weight or threshold level set by ODJFS, it is flagged as potentially fraudulent and
reviewed by an ODJFS employee. (Sines Aff. at ¶ 10.) The factors, weights and
thresholds are continually adjusted in response to observed fraud patterns. (Id. at ¶ 9.)
        {¶6} Software used to operate a computer is usually just the means of access to
records, without itself meeting the definition of a “record.” State ex rel. Recodat Co. v.
Buchanan, 46 Ohio St.3d 163, 165, 546 N.E.2d 203 (1989). Application software is not a
“record” subject to the Public Records Act unless, and then only to the extent that, it
documents the activities of the office. In this case, the Dashboard is not a shrink-wrapped
commercial software product but a custom application programmed in part with
institutional data factors, weights, and threshold values. These parts of the Dashboard
programming serve to document policy decisions made by ODJFS in the evolving
configuration of its fraud control procedures. Documents kept by ODJFS that reflect these
choices thus meet the definition of “records” of the office, R.C. 149.011(G).
        Responsive Records Provided, With Redactions
        {¶7} Feathers confirms that the documents referenced in Request #1 have been
provided. (Reply at 1.) During litigation, ODJFS produced additional emails responsive to
Request #1 as well as a Technical Design Document (TDD) responsive to Requests #2
through #5. (Response at 6, Exh. 1 – Sullivan Aff. at ¶ 4-5, Exh. 2 – Sines Aff. at ¶ 15.b.;
Reply at 1, 129-188 – redacted copy of TDD) Feathers has not asserted that any
additional records exist responsive to his requests.
        {¶8} ODJFS does not dispute that these records are, absent applicable
exemptions, public records kept by a public office. The issue before the court is whether
ODJFS properly applied public records exemptions to redact information within the
documents provided. To its credit, and facilitating the court’s review, ODJFS’ redactions
largely avoid obscuring email and TDD text other than the particular information described
in its pleadings and affidavits as subject to the claimed exemptions, in compliance with
R.C. 149.43(B)(1).3

        3 Based on comparison with the unredacted documents in camera. R.C. 149.43(B)(1) provides in
pertinent part: “If a public record contains information that is exempt from the duty to permit public inspection
Case No. 2022-00279PQ                                  -5-        REPORT AND RECOMMENDATION

        Burden to Prove Exemptions4
        {¶9} The burden to establish the applicability of an exemption rests on the public
office. Cincinnati Enquirer v. Pike Cty. Coroner’s Office, 153 Ohio St.3d 63, 2017-Ohio-
8988, 101 N.E.3d 396, ¶ 15. Exceptions to disclosure are strictly construed against the
public-records custodian. Rogers v. Dept. of Rehab. & Corr., 155 Ohio St.3d 545, 2018-
Ohio-5111, 122 N.E.3d 1208, ¶ 7. A custodian does not meet this burden if it has not
proven that the requested records fall squarely within the exception. State ex rel.
Cincinnati Enquirer v. Jones-Kelley, 118 Ohio St.3d 81, 2008-Ohio-1770, 886 N.E.2d 206,
paragraph two of the syllabus. When a public office claims exceptions based on risks that
are not evident within the records themselves, the office must provide more than
conclusory statements in affidavits to prove the assertion. State ex rel. Besser v. Ohio
State Univ., 89 Ohio St.3d 396, 400-404, 732 N.E.2d 373 (2000). Any doubt should be
resolved in favor of disclosure of public records. State ex rel. James v. Ohio State Univ.,
70 Ohio St.3d 168, 169, 637 N.E.2d 911 (1994).
        {¶10} ODJFS first asserts that portions of the records were redacted pursuant to
R.C. 149.433 as “infrastructure records,” “security records,” or both. (Response at 9-14;
Supp. Response, Exh. 5 – Privilege Log passim.) These exemptions are separately
defined and will be analyzed separately.
        Infrastructure Records
        {¶11} R.C. 149.433(A) provides that:
        “Infrastructure record” means any record that discloses the configuration of
        critical systems including, but not limited to, communication, computer,
        electrical, mechanical, ventilation, water, and plumbing systems, security
        codes, or the infrastructure or structural configuration of a building.
By this language, listed systems are potentially but not automatically “critical” systems.
“Critical,” in the context of systems, means “extremely important to the progress or

or to copy the public record, the public office * * * shall make available all of the information within the public
record that is not exempt.” See also R.C. 149.43(A)(13) “Redaction” means obscuring or deleting any
information that is exempt from the duty to permit public inspection or copying from an item that otherwise
meets the definition of a “record” in section 149.011 of the Revised Code.
         4 A public records exception is a law prohibiting or excusing disclosure of records that would

otherwise be public. The terms “exemption” and “exception” are used interchangeably in this report.
Case No. 2022-00279PQ                         -6-     REPORT AND RECOMMENDATION

success of something.” See https://dictionary.cambridge.org/us/dictionary/english/critical
(Accessed Nov. 17, 2022.)
       {¶12} ODJFS provides the testimony of information security and fraud control staff
that the computerized Google Fraud Dashboard is an important component of efforts to
prevent, detect, and mitigate incidents of fraud occurring in the state’s Unemployment
Insurance Program. (Response at 4, Exh. 2 – Sines Aff. at ¶ 8 and 15d., Exh. 3 – Prideau
Aff. at ¶ 15; Sur-reply at 2-6.) ODJFS states that hundreds of millions of dollars in
unemployment insurance payments have been and continue to be obtained from ODJFS
fraudulently (Response, Exh. 3 – Prideau Aff. at ¶ 10-14) and argues that these massive
losses would be even worse but for use of the Dashboard.
       {¶13} Feathers argues that the system is not a “critical” one because the contract
to develop the Dashboard provides that the program need only operate at a “moderate
level baseline” as defined in National Institute of Standards and Technology 800-53 Rev.
3. (Reply at 2, Exh. 1 at 38.) ODJFS counters that the “critical” nature of a system is not
determined by design criteria or industry standards but by the impact on the office of loss
of confidentiality, integrity, or availability of the system. (Sur-reply at 3-5.) ODJFS attests
that release of Dashboard information could be expected to have a serious adverse effect
on organizational operations, including a significant degradation in mission capability to
an extent and duration that the organization may still be able to perform its primary
functions, but the effectiveness of those functions is significantly reduced. (Sur-reply, Exh.
4 - Supp. Sines Aff. at ¶ 5-13.) Feathers further emphasizes that ODJFS has lost
hundreds of millions of dollars to fraud despite the use of the Dashboard. However, past
and continuing loss of funds does not make the program’s design and purpose any less
“critical.” Weighing the evidence submitted, the Special Master concludes that ODJFS
has shown that the Dashboard falls squarely within the meaning of the term “critical
system” as used in R.C. 149.433(A).
       {¶14} ODJFS next attests that portions of the requested documents meet the
statutory definition by disclosing the “configuration of” this critical system. In common
usage, the configuration of a system is the arrangement or relationship of its elements.
See merriam-webster.com/dictionary/configuration (Accessed Feb. 7, 2023.) Examples
of records that disclose system configuration include electrical schematics, HVAC plans,
Case No. 2022-00279PQ                        -7-     REPORT AND RECOMMENDATION

computer network diagrams, plumbing layouts, and security code generation algorithms.
Shaffer v. Budish, Ct. of Cl. No. 2017-00690-PQ, 2018-Ohio-1539, ¶ 18.
        {¶15} ODJFS asserts that the factors used in the Dashboard software to flag
potentially fraudulent applications, and the weights and thresholds assigned to each
factor that then trigger detailed review, “constitute ‘relative arrangements of parts or
elements,’ or the ‘configuration’ of a critical system—software used to detect fraud in
applications.” (Response at 11.) ODJFS submits the affidavit of its former Agency Chief
Information Security Officer, now Deputy Director of IT Risk and Compliance, who attests
that:
   1. Redactions to the weekly status reports of SpringML/Google removed specific
        references to how the models were created and information and data that was
        used to create them. (Response, Exh. 2 - Sines Aff. at ¶ 15a.)
   2. Redactions of the Technical Design Document would disclose how the Google
        Fraud Dashboard AI/ML models were architected, and obscure diagrams and text
        containing specifics to the Ohio Job Insurance Database tables and fields, file
        names, job names, and to the weight, factors, and conditions used to create the
        models for the Dashboard. (Id. at ¶ 15b.), and
   3. Redactions of the May 13, 2021 email and attachment from John Skinner to Ward
        Loving contain data, flags, and insights into the model for the Dashboard. (Id. at ¶
        15c.)
        {¶16} The Special Master finds that the data factors, flags, weights, and thresholds
entered into the Dashboard software meet the definition of “infrastructure records.”
Review of the redacted information in camera shows that for the most part ODJFS has
redacted material that falls squarely within the exemption as listed in the privilege log.
However, ODJFS was overinclusive in redacting some chapter titles, two sentences that
merely contain the word “configuration,” and certain other innocuous text.
        {¶17} In isolation, merely showing the name or picture of a system component
without juxtaposing it with other components does not reveal the configuration of the
system. Shaffer v. Budish, Ct. of Cl. No. 2017-00690-PQ, 2018-Ohio-1539, ¶ 16-18.
Moreover, the general principles and indicators of computerized fraud detection systems
are not secret. The court may take notice that some features of the Google Fraud
Case No. 2022-00279PQ                        -8-      REPORT AND RECOMMENDATION

Dashboard in general and Carahsoft modifications in particular have been disclosed in
legal and promotional materials available to the public. The general principles and
parameters of the system are available online by a web search of “google fraud detection
states.” See also Google’s patent for fraud detection using predictive modeling at
https://patents.google.com/patent/US5819226A/en. (Accessed Feb. 3, 2023). Carahsoft
has posted blogs and public webinars explaining that fraud indicators specifically include
repetitive appearance of phone numbers, email addresses and other contact information
in multiple claims. See, e.g., https://www.carahsoft.com/blog/f5-unemployment-fraud-
impact-blog-2021. (Accessed Feb. 3, 2023.) These application and payment data
indicators are similar to other economic crime and fraud indicators that law enforcement
agencies generally do not keep secret, but instead publicize to help the public detect and
report offenses. However, it is the role of the legislature and not the courts to determine
public policy and define the particular records it subjects to a statutory exemption. State
ex rel. WBNS TV, Inc. v. Dues, 101 Ohio St.3d 406, 2004-Ohio-1497, 805 N.E.2d 1116,
¶ 36-37.
       {¶18} The combination of factors, flags, weights, and thresholds developed for
ODJFS is unique to the agency’s particular implementation of the fraud-detecting
Dashboard. The Special Master concludes that most of the information so identified in
ODJFS’ privilege log falls squarely under the statutory definition of “infrastructure record,”
with the few exceptions identified in the tables at the end of this report.
       Security Records
       {¶19} R.C. 149.433 provides, in pertinent part:
       (A) As used in this section: * * * “Security record” means any of the following:
           (1) Any record that contains information directly used for protecting or
           maintaining the security of a public office against attack, interference, or
           sabotage; * * *

       (B)(1) A record kept by a public office that is a security record is not a public
       record under section 149.43 of the Revised Code and is not subject to
       mandatory release or disclosure under that section.

       {¶20} To meet the burden of proof regarding alleged security records, a public
office must offer more than its own conclusory labeling:
Case No. 2022-00279PQ                       -9-     REPORT AND RECOMMENDATION

      The department and other agencies of state government cannot simply
      label a criminal or safety record a “security record” and preclude it from
      release under the public-records law, without showing that it falls within the
      definition in R.C. 149.433.
State ex rel. Plunderbund Media, L.L.C. v. Born, 141 Ohio St.3d 422, 2014-Ohio-3679,
25 N.E.3d 988, ¶ 29. Even records produced by a designated security system or security
protection operation must individually meet the statutory definition. Rogers v. Dept. of
Rehab. & Corr., 155 Ohio St.3d 545, 2018-Ohio-5111, 122 N.E.3d 1208, ¶ 15-21; State
ex rel. Miller v. Pinkney, 149 Ohio St.3d 662, 2017-Ohio-1335, 77 N.E.3d 915, ¶ 1-4;
Shaffer v. Budish, Ct. of Cl. No. 2017-00690PQ, 2018-Ohio-1539, ¶ 21-24.
      {¶21} The standard of proof is strictly applied against the public records custodian.
Rogers at ¶ 7. “As we made clear in Plunderbund, every record claimed under the
security-record exception to disclosure must be considered separately.” Id. at ¶ 21.
      Unless it is otherwise obvious from the content of the record, the proponent
      invoking the security-record exemption under R.C. 149.433(A)(1) must
      provide evidence establishing that the record clearly contains information
      directly used for protecting or maintaining the security of a public office
      against attack, interference, or sabotage.
Welsh-Huggins v. Jefferson Cty. Prosecutor’s Office, 163 Ohio St.3d 337, 2020-Ohio-
5371, 170 N.E.3d 768, ¶ 51. Such evidence is often provided through fact and expert
testimony establishing that the records meet the statutory elements. In Plunderbund,
respondent provided the detailed testimony of             several law-enforcement and
telecommunications experts connecting the disclosure of the requested information to
future risks. Welsh-Huggins at ¶ 52, Plunderbund at ¶ 22-31.
      {¶22} Supporting affidavits must be evaluated for their sufficiency in proving the
exemption for each record claimed. In Rogers, the Court found on review that
      DRC has not met its burden to show that the requested video falls squarely
      within the security-record exception codified in R.C. 149.433(B). * * * Here,
      DRC has provided only two affidavits, one of which merely concludes that
      “it is [DRC] policy that security videos within correction institutions are not
      public records, and are therefore not disclosed in response to public records
      requests.” Bobby’s affidavit contains more information regarding the
      applicability of the exception, yet even his testimony is general and
      insufficient to meet DRC’s burden in this case. Beyond these bare
      allegations, DRC has not attempted to explain how the video recording at
      issue actually constitutes “information directly used for protecting or
Case No. 2022-00279PQ                       -10-      REPORT AND RECOMMENDATION

       maintaining the security of a public office against attack, interference, or
       sabotage,” or was “assembled, prepared, or maintained by a public office *
       * * to prevent, mitigate, or respond to acts of terrorism.” R.C. 149.433(A)(1)
       and (2).

Rogers at ¶ 19.
       Certain Requested Data Would Facilitate Interference
       {¶23} ODJFS argues that the information it withheld could be used to breach the
security of the Dashboard, which is itself designed and used to protect the security of the
office’s Unemployment Insurance Program from attack, interference, or sabotage.
(Response at 11-14; Sur-reply at 5-6.) ODJFS provides the court with affidavits containing
at least somewhat more than bare assertions that particular items are security records.
ODJFS asserts that the withheld records “include what is effectively a ‘user guide’ for the
Google Fraud Software: the Technical Design Document.” (Emphasis sic.) (Response at
13), arguing that this information would enable bad actors to craft fraudulent applications
more likely to elude detection. As noted earlier, ODJFS attests that disclosure of
Dashboard information could be expected to have a serious adverse effect on
organizational operations, including a significant degradation in mission capability to an
extent and duration that the organization is still able to perform its primary functions, but
the effectiveness of those functions is significantly reduced. (Sur-reply, Exh. 4 - Supp.
Sines Aff. at ¶ 5-13.) The evidence offered by ODJFS thus supports, minimally but
sufficiently, that the indicator, flag, weight, and “user manual” records fall squarely within
the security records exemption.
       Weekly Updates
       {¶24} ODJFS withheld portions of seven one-page weekly updates. (Respondent’s
Jan. 11, 2023 Explanatory Pleading at 13-18.) ODJFS offers no explanation as to how
disclosure of redacted portions of the updates meets the statutory definition of a “security
record” other than that some contain labels of certain “flags” used in the Dashboard. On
review in camera, each update consists of comments presented in three columns;
Achievements/Key Updates, Upcoming Activities, and Issue/Risks and Mitigation. The
weekly reports contain no algorithms. The bullet-pointed comments consist mainly of the
progress status of very generally labeled tasks, generally described needs for permission
Case No. 2022-00279PQ                      -11-     REPORT AND RECOMMENDATION

or information, the fact that calls/meetings were held or should be held, and reference to
“fuzzy logic” that is elsewhere disclosed as a type of processing rather than a specific
indicator or flag. The update also contains a Status indication among options of Complete,
On Track, Delayed, Behind, or Not Started. The Special Master finds that none of the
redacted weekly report information, other than the listed flags, disclose a security record
on its face.
       {¶25} The Special Master concludes that ODJFS has met its burden to prove that
some but not all of the data referenced as security records in the privilege log falls
squarely under the exception for “information directly used for protecting or maintaining
the security of a public office against attack, interference, or sabotage,” as identified in
the tables at the end of this report.
       Trade Secret
       {¶26} ODJFS labels some withheld data as trade secret information. The Ohio
Uniform Trade Secrets Act defines “trade secret” as:
       information, including the whole or any portion or phase of any scientific or
       technical information, design, process, procedure, formula, pattern,
       compilation, program, device, method, technique, or improvement, or any
       business information or plans, financial information, or listing of names,
       addresses, or telephone numbers, that satisfies both of the following:
       (1) It derives independent economic value, actual or potential, from not
       being generally known to, and not being readily ascertainable by proper
       means by, other persons who can obtain economic value from its disclosure
       or use.
       (2) It is the subject of efforts that are reasonable under the circumstances
       to maintain its secrecy.
R.C. 1333.61(D).
       {¶27} Like the infrastructure and security record exemption, this is not a “name-it-
and-claim-it” exemption but must be proven with evidence showing that the information
falls squarely within the full definition of trade secret. “An entity claiming trade secret
status bears the burden to identify and demonstrate that the material is included in
categories of protected information under the statute and additionally must take some
active steps to maintain its secrecy.” (Emphasis added.) Besser II, 89 Ohio St.3d 396,
400, 2000-Ohio-207, 732 N.E.2d 373 (2000). To meet its burden, the entity must provide
Case No. 2022-00279PQ                      -12-       REPORT AND RECOMMENDATION

more than conclusory statements in affidavits to show which, if any, information is a “trade
secret.” Id. at 400-404. Accord Hance v. Cleveland Clinic, 2021-Ohio-1493, 172 N.E.3d
478, ¶ 27-32 (8th Dist.); Harris v. Belvoir Energy, Inc., 8th Dist. Cuyahoga No. 103460,
2017-Ohio-2851, ¶ 16. The following factors are used by Ohio courts in trade secret
analysis:
       (1) The extent to which the information is known outside the business; (2)
       the extent to which it is known to those inside the business, i.e., by the
       employees; (3) the precautions taken by the holder of the trade secret to
       guard the secrecy of the information; (4) the savings effected and the value
       to the holder in having the information as against competitors; (5) the
       amount of effort or money expended in obtaining and developing the
       information; and (6) the amount of time and expense it would take for others
       to acquire and duplicate the information.
Besser II at 399-400.
       {¶28} ODJFS does not claim information as its own trade secret, stating only that
“Google asked ODJFS to redact several portions of the [TDD] as trade secrets.”
(Response at 6, fn. 3.) Further and fatally, ODJFS has not submitted any testimony from
Google identifying any particular information as a trade secret, much less demonstrating
by evidence that it satisfies the Besser II factors. Instead, ODJFS offers only a vague
assertion that “it is industry-standard to consider data algorithms as ‘trade secrets’ or
‘intellectual property’ and to work hard to protect these algorithms as part of their
business.” (Sur-reply at 4, Sines Aff. II at ¶ 16.) Even accepting this assertion arguendo,
ODJFS does not label any specific item in the records as a “data algorithm.” In the
absence of informed evidence from the putative holder of any trade secret, none of the
redacted portions of the records self-identify as data algorithms. Nor are any of the Besser
II factors demonstrated on the face of the records.
       {¶29} The Special Master finds that ODJFS has failed to meet its burden to prove
that any of the withheld records falls squarely within the trade secret exemption.
       Legend for Exemption Tables:
   •   Not claimed – ODJFS has not asserted the exemption for the listed item
   •   Not proven – ODJFS submitted no evidence beyond the bare assertion of
       the exemption, and examination of the item in camera does not show that
       the item falls squarely within the exemption
Case No. 2022-00279PQ                        -13-     REPORT AND RECOMMENDATION

     •   By aff. – affidavit testimony persuades the Special Master at least minimally
         that the item falls squarely within the exemption
     •   By exam – on examination in camera the Special Master finds that
         application of the exemption is self-evident
Items that are found not to meet the statutory definition of any exemption and must be
disclosed are highlighted in bold underline.

                               Technical Design Document (TDD)
                                           Infrastructure (Infr.) or
 Page(s) Section                                                               Trade Secret
                                           Security (Sec.) Record
 2           Contents                      Not proven                          Not proven
                                           Infr. by aff. & exam, Sec. not
 5           High Level Architecture                                           Not proven
                                           proven
 6-7         Flags and Thresholds          Infr. and Sec. by aff & exam        Not proven
 7-9         Data Sources & Storage        Infr. by aff. & exam, Sec by aff.   Not claimed
 10-12       Data Ingestion & Loading      Infr. by aff. & exam, Sec by aff.   Not claimed
 13          Data Processing Workflow      Infr. by aff. & exam, Sec by aff.   Not claimed
             Data Processing and Flag
 13                                        Infr. by aff. & exam, Sec by aff.   Not proven
             Score Generation
 13          Fuzzy Logic Processing        Infr. by aff. & exam, Sec by aff.   Not proven
 14          Fuzzy Logic Processing        Infr. by aff. & exam, Sec by aff.   Not claimed
 15          Fuzzy Logic Processing        Infr. by aff. & exam, Sec by aff.   Not proven
 16-17       Fuzzy Logic Processing        Infr. by aff. & exam, Sec by aff.   Not claimed
             Flag Generator or Score
 18-19                                     Infr. by aff. & exam, Sec by aff.   Not claimed
             Computation
 20          BigQuery                      Infr. by aff. & exam, Sec by aff.   Not proven
 20-21       Existing Data Sets            Infr. by aff. & exam, Sec by aff.   Not claimed
 21-22       Data Studio Dashboards        Infr. by aff. & exam, Sec by aff.   Not proven
 23          Data Studio Dashboards        Infr. by aff. & exam, Sec by aff.   Not proven
             Fraud Analysis Dashboard
 23                                        Infr. by aff. & exam, Sec by aff.   Not proven
             Filters - Program
             Fraud Analysis Dashboard
 23                                        Infr. by aff. & exam, Sec by aff.   Not claimed
             Filters – Flag Bucket
             Fraud Analysis Dashboard
 24-25                                     Infr. by aff. & exam, Sec by aff.   Not claimed
             Filters – Total Payments
 25          Managed Data Sources          Infr. by aff. & exam, Sec by aff.   Not proven
Case No. 2022-00279PQ                       -14-     REPORT AND RECOMMENDATION

26         Managed Data Sources           Infr. by aff. & exam, Sec by aff.    Not proven
27         Linked Fields                  Infr. by aff. & exam, Sec by aff.    Not proven
28         Linked Fields                  Infr. by aff. & exam, Sec by aff.    Not claimed
           Infrastructure
29-37                                     Infr. by aff. & exam, Sec by aff.    Not claimed
           Configuration and Setup

                             Weekly Status Report Emails
Pages     Email                           Infrastructure/Security             Trade Secret
49-53     May 13, 2021                    Infr. by aff. & exam, Sec by aff.   Not proven
          May       13,     2021      -
54-57                                     Not claimed                         Not proven
          Attachment

                                  Weekly Status Reports
Primary pagination in this table is to Respondent’s Jan. 11, 2023 Explanatory Pleading.
Pagination for the unredacted documents under seal is in parentheses. Pages 14, 15, &
17 contain some permissible exemptions, as noted by table cell text without emphases.
Page      Report Date      Infrastructure/Security                            Trade Secret
13 (65) May 17, 2021 Flags are infrastructure/security records.               Not claimed
                           Flags are infrastructure/security records.
14 (66) May 10, 2021 Exemptions not proven for bullet point 2                 Not claimed
                           or for processing term in bullet point 1
                           Flags are infrastructure/security records
15 (67) May 3, 2021        Exemptions not proven for Issue/Risk               Not claimed
                           text
16 (68) Apr. 26, 2021 No exemption proven                                     Not claimed
                           Issue/Risk text contains infrastructure recds.
17 (69) Apr. 19, 2021                                                         Not claimed
                           No exemption proven for remainder
18 (70) Apr. 12, 2021 Not proven                                              Not claimed

       Conclusion
Case No. 2022-00279PQ                       -15-     REPORT AND RECOMMENDATION

        {¶30} Accordingly, the Special Master recommends the court order respondent to
provide requester with copies of the records and portions of records identified in the
Exemption Tables in bold underline as not falling under a proven exemption. It is
recommended that costs be assessed to respondent.
        {¶31} Pursuant to R.C. 2743.75(F)(2), either party may file a written objection with
the clerk of the Court of Claims of Ohio within seven (7) business days after receiving this
report and recommendation. Any objection shall be specific and state with particularity all
grounds for the objection. A party shall not assign as error on appeal the court’s adoption
of any factual findings or legal conclusions in this report and recommendation unless a
timely objection was filed thereto. R.C. 2743.75(G)(1).

                                            JEFF CLARK
                                            Special Master

Filed February 7, 2023
Sent to S.C. Reporter 3/2/23