Can an Arkansas school board hold a closed meeting to discuss responding to a ransomware attack?

Plain-English summary

After a cyberattack at the Little Rock School District, Senator Clarke Tucker asked whether its school board could meet privately to discuss a response and whether recording the meeting for release after the emergency would change the answer. The Attorney General answered no to both questions. He found no statutory exception allowing a school board to hold an executive session on district cybersecurity.

The opinion identifies four kinds of executive session permitted under the Arkansas FOIA: certain personnel matters, state licensing exam preparation and administration, security of public water or municipally owned utility systems, and child-maltreatment investigation procedures. The AG says none supplies an exception for school district cybersecurity. He also says the records exemption in A.C.A. § 6-15-1304 covers school cybersecurity records but does not authorize a closed meeting.

The AG describes two ways to limit disclosure during the required open process. A security consultant may email proposals to board members before a meeting if the email only distributes information, does not solicit a response, and is not used to discuss matters or reach decisions. During the public meeting, board members may refer to previously reviewed proposals without disclosing their full contents. The opinion says an exempt record does not lose its exemption merely because the board uses it at a public meeting.

What this means for you

School board members and district staff

The opinion requires an open meeting for the proposed discussion of district cybersecurity. It permits information-only email distribution under the stated conditions and says board members must not use email to discuss proposals or decide them. At the meeting, members may refer to proposals while the underlying records remain exempt under § 6-15-1304.

Residents seeking information

The opinion distinguishes the public's right to attend the school board meeting from access to exempt cybersecurity records. Its conclusion about the records exemption is limited to school records covered by § 6-15-1304.

Common questions

Can the board record a closed cybersecurity session and publish it afterward? No. The AG says later release of a recording does not create an exception to the open-meetings requirement.

Can board members discuss the response by email?
The opinion says an email distributing information without soliciting a response is not a meeting, but board members must not use email to discuss proposals or reach decisions.

Does the records exemption allow a closed meeting?
No. The AG cites an earlier opinion explaining that § 6-15-1304 exempts certain school records from disclosure but does not create an executive-session exception.

Does this opinion decide the rules for city or county cybersecurity meetings? It answers questions about a school board. Its description of a utility-security exception does not decide which other public bodies may invoke that exception.

Background and statutory framework

A.C.A. § 25-19-106(c) supplies the executive-session categories discussed in the opinion. The AG cites Laman v. McCord for the rule that open-meetings exceptions must be explicit. A.C.A. § 6-15-1304(1) and (2) exempt specified school security records and security-personnel information. Footnotes 9–11 cite a 2019 Arkansas Supreme Court decision on email exchanges among officials; footnote 8 cites Arkansas Attorney General Opinion 2020-044 on the difference between a records exemption and a meeting exception.

Citations

• A.C.A. § 25-19-106(c)
• A.C.A. § 6-15-1304(1) and (2)
• 20 U.S.C. § 1232g
• Laman v. McCord, 245 Ark. 401, 432 S.W.2d 753 (1968)
• 2019 Ark. 222, 578 S.W.3d 276
• Arkansas Attorney General Opinions 2009-077 and 2020-044

Source

• Landing page: https://arkansasag.gov/divisions/opinions-foia/attorney-general-opinions-search/

Original opinion text

Opinion No. 2023-027

May 25, 2023

The Honorable Clarke Tucker
State Senator
Post Office Box 7268
Little Rock, Arkansas 72217

Dear Senator Tucker:

You requested my opinion regarding the open-meetings requirement in the Arkansas Freedom of Information Act (FOIA). As background for your request, you explain that the Little Rock School District (LRSD) recently was the victim of a cyberattack in which the attackers accessed files “containing information about LRSD employees and patrons, including dates of birth, social security numbers, personal addresses, medical information, and personal banking information.” The attackers also obtained “student records, including FERPA 1 protected information.” You report that the “release of this information would have put those individuals at risk of having their personal information compromised” and that the cyberattack adversely impacted LRSD’s ability to educate its students and maintain its finances in several ways. A consultant hired by LRSD to guide the response to the attack “advised LRSD that public disclosure of information related to the attack would greatly increase the risk the of disclosure of personal information about LRSD’s patrons and employees, as well as increase the risk to their ability to maintain normal operations.”

You report that “LRSD is working diligently to be better protected the next time threat actors attempt a ransomware attack” and would like my opinion on “the steps a school board may take to minimize the risk to employees and patrons, to deal effectively with the threat actors, and to restore normal operations as quickly as possible.” You have asked three questions, which I have combined into the following two:

Question 1: Since there is significant risk regarding the disclosure of sensitive information during a public meeting discussing how to respond to a cyberattack, can a school board meet privately or in executive session to discuss how best to respond to threat actors in a situation of this nature?

1
FERPA is the Family Educational Rights and Privacy Act, which is codified at 20 U.S.C. § 1232g.
The Honorable Clarke Tucker
State Senator
Opinion No. 2023-027
Page 2

Question 2: Would the meeting described in the above question be allowed if the school board recorded the meeting for viewing by the public as soon as the emergency caused by the cyberattack was over?

RESPONSE

The answer to both questions is “no.” The FOIA does not allow executive sessions to discuss cyber-security for school districts under any circumstance.

DISCUSSION

The FOIA requires a meeting to be open to the public when three elements are met: (1) the entity holding the meeting is subject to the FOIA; (2) the meeting itself is a “public meeting” under the FOIA; and (3) no exceptions allow the meeting to be closed to the public. 2 As to the first and second elements, all school districts are entities subject to the FOIA, and all their meetings “shall be public meetings.” 3

As to the third element, the FOIA allows only the following four kinds of meetings to be held in executive session: (1) meetings regarding certain personnel matters; (2) meetings to prepare and administer a state licensing exam; (3) meetings regarding the security of public water systems or municipally owned utility systems; and (4) meetings regarding child maltreatment investigation procedures. 4 But the General Assembly has not created an exception—either in the FOIA or another statute—to the open-meetings requirement for discussing the cyber-security of school districts. Exceptions to the open-meetings requirement must be explicit and cannot be inferred. 5

Although there is no exception allowing school boards to meet in executive sessions to discuss cyber-security, the General Assembly has created a FOIA exemption for certain school records related to cyber-security. This exemption, codified at A.C.A. § 6-15-1304, shields from disclosure all records related to “emergency and security plans, school safety plans, procedures, risk assessments, studies, measures, [and] systems[,]” 6 as well as the number of and personal information for any “security personnel.” 7 In my opinion, these expansive terms include records related to cyber-security.

2
Ark. Att’y Gen. Op. 2009-077 (summarizing Arkansas statutes and decisions by the Arkansas Supreme Court interpreting those statutes). 3 A.C.A. § 25-19-106(c) (Supp. 2021).
4
A.C.A. § 25-19-106(c).
5
Laman v. McCord, 245 Ark. 401, 405–06, 432 S.W.2d 753, 755–56 (1968).
6
A.C.A. § 6-15-1304(1).
7
A.C.A. § 6-15-1304(2).
The Honorable Clarke Tucker
State Senator
Opinion No. 2023-027
Page 3

Question 1: Since there is significant risk regarding the disclosure of sensitive information during a public meeting discussing how to respond to a cyberattack, can a school board meet privately or in executive session to discuss how best to respond to threat actors in a situation of this nature?

No. As noted above, a school board cannot hold an executive session to discuss cyber-security for the school district. 8 But there are two ways for school boards to minimize the disclosure of cyber-security information contained in exempt public records used during a public meeting.

First, the information could be emailed to board members. The Arkansas Supreme Court has explained that some emails among board members do not violate the open-meetings requirement of the FOIA. 9 An email among board members is not considered a meeting if the emails: (1) distribute information only, (2) do not solicit a response, and (3) are not used to discuss matters or arrive at decisions. 10 Under this framework, before a public meeting, security consultants can email their proposals to school boards regarding how to respond to cyberattacks. But the board members must not use email to discuss the proposals or reach any decisions. 11

Second, once the public meeting has started, board members can refer to the proposals they previously reviewed without disclosing the full content of the proposals. A record that is exempt from disclosure does not lose that status just because it is used in a public meeting. 12 So any records or information covered by A.C.A. § 6-15-1304 are still exempt from disclosure if a school board discusses the record or information during a public meeting. 13

Question 2: Would the meeting described in the above question be allowed if the school board recorded the meeting for viewing by the public as soon as the emergency caused by the cyberattack was over?

8
See Ark. Att’y Gen. Op. 2020-044 (opining that A.C.A. § 6-15-1304 does not provide an exception to the open-meetings requirement of the FOIA). 9 2019 Ark. 222, 8–9, 578 S.W.3d 276, 280–81.
10
Id., 578 S.W.3d at 280–81.
11
Id. at 6–7, 578 S.W.3d at 280 (holding that the FOIA’s open-meetings requirement can apply to email exchanges between government officials if they are conducting public business). 12 John J. Watkins et al., THE ARKANSAS FREEDOM OF INFORMATION ACT 390–91 (6th ed. University of Arkansas Press, 2017). 13 See id. (explaining “if a governing body required to hold an open meeting must disclose exempt records considered at the meeting, the statutes recognizing the need to shield those records from public view would become meaningless”). The Honorable Clarke Tucker State Senator Opinion No. 2023-027 Page 4

No. There is no exception for a school board to hold an executive session to discuss security for the school district, even if that session is recorded and released to the public after the emergency is over. 14

Assistant Attorney General Jodie Keener prepared this opinion, which I hereby approve.

Sincerely,

TIM GRIFFIN
Attorney General

14
See also id. (stating “[u]nless [an executive session] is authorized by the FOIA or another statute, the governing body must meet in public, even though the record remains unavailable for public inspection”).