Can a Florida police and firefighters' pension board hire a cybersecurity vendor for penetration testing if the vendor might see confidential Social Security numbers and exempt personnel records?

Subject

Public records, cybersecurity testing

Plain-English summary

The Pompano Beach Police & Firefighters' Retirement System wanted to hire a cybersecurity firm to attempt to break into its computer systems (penetration testing) to find vulnerabilities. The catch was that during the test, the vendor would have potential access to records that were confidential or exempt under Florida's public records law: Social Security numbers of agency employees, plus home addresses, phone numbers, dates of birth, and photographs of active and former law enforcement officers and certified firefighters. The Board's legal counsel asked whether Chapter 119 forbade the engagement.

The AG said the proposed access would appear permissible if the Trustees made the findings discussed below and used a confidentiality and non-disclosure agreement. Two distinct legal categories applied. For confidential SSN data, the agency could disclose to a vendor under § 119.071(5)(a)(6)(g) if the testing was "for the purpose of the administration" of the pension fund. The AG cited Black's Law Dictionary's broad definition of "administration," Rule 1S-2.004's reference to penetration testing, and federal NIST standards. It described penetration testing as a widely recognized, prudent security measure. For merely exempt (not confidential) records about law enforcement personnel and firefighters, prior AG opinions had established that exempt records may be disclosed when there is a "substantial policy need" and the disclosure does not undermine the purpose of the exemption. The AG said potential vendor access under a confidentiality agreement would not appear inconsistent with the personnel-safety purpose of that exemption if the Trustees found a substantial policy need for the testing as ultimately proposed.

Footnote 1 leaves procurement authority, the final services and contract terms, testing safeguards, and alternative assessment tools outside the opinion's scope.

Currency note

This opinion was issued in 2019. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.

Common questions

What is penetration testing?

A specialized assessment in which an authorized third party attempts to break into an organization's information systems to identify vulnerabilities that adversaries could exploit. NIST defines it that way in Special Publication 800-53.

What is the difference between confidential and exempt records under Florida law?

Confidential records are not subject to public inspection and may be released only as a statute permits. The opinion cites WFTV, Inc. v. School Bd. of Seminole for that distinction. Exempt records are outside mandatory public disclosure, but the exemption does not itself prohibit showing them. The opinion cites Rameses, Inc. v. Demings for the exempt/confidential distinction and earlier AG opinions for disclosure based on a statutory or substantial policy need.

What was confidential here?

Social Security numbers under § 119.071(4)(a)1. SSNs of current and former agency employees held by the employing agency are "confidential and exempt."

What was merely exempt?

Home addresses, telephone numbers, dates of birth, and photographs of active or former sworn law enforcement personnel under § 119.071(4)(d)2. The same applied to current or former firefighters certified under § 633.408.

What rule lets the agency disclose SSNs to a vendor?

§ 119.071(5)(a)(6)(g) permits disclosure when "for the purpose of the administration of a pension fund administered for the agency employee's retirement fund, deferred compensation plan, or defined contribution plan." The AG said the SSN exception would appear to apply if the Trustees determine that vendor testing serves pension-fund administration.

What evidence supported treating penetration testing as "administration"?

The AG cited § 282.318(4)(d), which required state agencies to conduct comprehensive risk assessments every three years and permitted private vendors. Rule 74-2.002 required identification and documentation of asset vulnerabilities; Rule 1S-2.004 identified penetration testing as an appropriate security procedure for Supervisors of Elections. The opinion also cited NIST SP 800-53 and federal minimum security standards.

What rule lets the agency disclose merely exempt records to a vendor?

The "substantial policy need" framework. AG Op. 96-36 approved disclosure of exempt criminal investigative information to a private summary-and-analysis vendor under a confidentiality agreement, on the theory that the disclosure was not inconsistent with the exemption's purpose. The AG said that logic would conditionally support vendor access for the proposed testing.

What is the purpose of the law-enforcement-record exemption?

Protecting officers' safety. The AG said potential access under a confidentiality agreement would not appear inconsistent with that purpose if the Trustees found a substantial policy need for the testing. The proposed testing aimed to identify vulnerabilities in systems holding those records.

What did the agency need to do to comply?

The opinion makes its conclusions conditional on two Trustees' determinations: (1) that the penetration testing was "for the purpose of the administration of a pension fund," to fit the SSN-disclosure exception, and (2) that there was a "substantial policy need" for the testing, to justify the incidental exposure of merely exempt records. The proposal included a confidentiality and non-disclosure agreement; the opinion did not assess the specific contract.

Did the opinion approve the specific contract or process?

No. The AG explicitly noted that procurement authority, contract provisions, and security safeguards for the testing operations were beyond the scope of the opinion. Those matters would require separate consideration.

Background and statutory framework

Confidential vs. exempt records

Florida's public records statute, Chapter 119, distinguishes between two categories of non-public records:

• Confidential: not subject to any public inspection and only releasable to entities listed in the statute (WFTV).
• Exempt: not subject to mandatory public disclosure; the exemption does not itself prohibit showing the information (Rameses). The opinion discusses disclosure when there is a statutory or substantial policy need consistent with the exemption's purpose.

This distinction matters because the AG's analysis differs for each category.

SSN confidentiality and the pension-administration exception

§ 119.071(4)(a)1 makes SSNs of current and former agency employees confidential. § 119.071(5) lists permissible disclosures, including § 119.071(5)(a)(6)(g): SSNs may be disclosed "for the purpose of the administration" of the agency's pension fund, deferred compensation plan, or defined contribution plan.

The AG left it to the Trustees to determine whether the testing served pension-fund administration. Black's Law Dictionary defines "administration" as "management or performance of the executive duties of a government, institution, or business; collectively, all the actions that are involved in managing the work of an organization."

Sources for treating cybersecurity as administration

• § 282.318(4)(d): state agencies must conduct comprehensive risk assessments (which can use private vendors) every three years.
• Fla. Admin. Code R. 74-2.002: requires identification and documentation of asset vulnerabilities.
• Fla. Admin. Code R. 1S-2.004: identifies penetration testing as an "appropriate" security procedure for Supervisors of Elections.
• NIST Special Publication 800-53: lists penetration testing among recommended security controls for federal information systems.

Law enforcement and firefighter exemption

§ 119.071(4)(d)2 exempts home addresses, telephone numbers, dates of birth, and photographs of active or former sworn law enforcement personnel and certified firefighters. § 119.071(4)(d)3 requires a custodian agency to maintain the exemption when the person or employing agency submits a written request.

The employing agencies had submitted written maintenance requests. Those requests triggered the custodian's duty to maintain the statutory exemption for the covered personnel information.

The "substantial policy need" framework

Earlier AG opinions, including 90-50 and 96-36, support disclosure of exempt records when there is a statutory or substantial policy need and the disclosure does not undermine the exemption's purpose. AG Op. 96-36 specifically approved disclosure of exempt criminal investigative information to a private vendor under a confidentiality agreement, where the disclosure was used to compile and summarize the information for the agency's own use. The opinion cites AG Ops. 14-07, 10-37, and 05-38 for the custodian's duty to maintain an exemption after a written request.

The 2019 opinion applied that reasoning conditionally: potential vendor access would not appear inconsistent with the safety exemption if the Trustees found a substantial policy need for the proposed testing.

Required Board determinations

The opinion assumed or required the following for its conditional conclusions:

1. Determine that the penetration testing was for the purpose of the administration of the pension fund (for the SSN exception).
2. Determine that there was a substantial policy need for the testing (for the merely exempt records).
3. Use the confidentiality and non-disclosure agreement described in the request; the opinion did not review its terms.

Citations

• § 119.071(4)(a)1, Fla. Stat. (SSNs confidential)
• § 119.071(4)(d)2, Fla. Stat. (law enforcement and firefighter records exempt)
• § 119.071(4)(d)3, Fla. Stat. (custodian must maintain exemption on request)
• § 119.071(5)(a)(6)(g), Fla. Stat. (pension-administration disclosure exception)
• § 282.318(4)(d), Fla. Stat. (state agency risk assessment)
• Fla. Const. art. I, § 24(a) (constitutional public records access)
• Fla. Admin. Code R. 1S-2.004 (penetration testing as appropriate security procedure)
• WFTV, Inc. v. School Bd. of Seminole, 874 So. 2d 48 (Fla. 5th DCA 2004)
• Rameses, Inc. v. Demings, 29 So. 3d 418 (Fla. 5th DCA 2010)
• Fla. AG Ops. 90-50, 96-36, 05-38, 10-37, 14-07
• NIST Special Publication 800-53 (security controls)
• FIPS PUB 200 (minimum security requirements)

Source

• Landing page: https://www.myfloridalegal.com/ag-opinions/public-records-cybersecurity-testing
• Official print view: https://www.myfloridalegal.com/print/pdf/node/1475

Original opinion text

Mr. Robert A. Sugarman

Legal Counsel to the Board of Trustees, Pompano

Beach Police & Firefighters' Retirement System

100 Miracle Mile, Suite 300

Coral Gables. Florida 33134

RE: PUBLIC RECORDS – BOARD OF TRUSTEES OF THE POMPANO BEACH POLICE & FIREFIGHTERS' RETIREMENT SYSTEM – ENGAGING CYBERSECURITY VENDOR TO CONDUCT PENETRATION TESTING OF AGENCY’S ELECTRONIC DATA STORAGE SYSTEMS – whether chapter 119 precludes an agency covered by that chapter from engaging a vendor to conduct penetration testing of the agency’s electronic data storage systems for the purpose of detecting and remedying vulnerabilities that would permit unauthorized persons ("hackers") to have access to information that is exempt from disclosure under sections 119.071(4)(d)2. a & d and confidential under section 119.071(4)(a)l. Sections119.071(4)(d)2. a & d and 119.071(4)(a)l, Fla. Stat.

Dear Mr. Sugarman:

This office has received your inquiry on behalf of the Board of Trustees of the Pompano Beach Police & Firefighters' Retirement System (“Trustees”), which you have described as “a local law defined benefit pension plan established by the City of Pompano Beach, Florida…to provide eligible police officers and firefighters and their survivors with retirement, death and disability benefits.” Specifically, you have asked for an opinion addressing the following [rephrased] question:

Does chapter 119 preclude “an agency covered by that chapter” from engaging a “vendor to conduct penetration testing of the agency’s electronic data storage systems for the purpose of detecting and remedying vulnerabilities” where such testing would potentially allow the vendor “to have access to information that is exempt from disclosure under sections 119.071(4)(d)2.a & d, Florida Statutes (2018), and confidential under section 119.071(4)(a)l., Florida Statutes” (pertaining to social security numbers)?

In sum:

If the Trustees determine that the vendor penetration testing will be “for the purpose of the administration of a pension fund” within the meaning of section 119.071(5), then it appears that any incidental disclosure to the cybersecurity vendor conducting penetration testing under a confidentiality and non-disclosure agreement would not violate chapter 119, Florida Statutes. Additionally, potential access to or incidental release of exempt information about law enforcement personnel and firefighters to a vendor under a confidentiality agreement, for the purpose of ascertaining and ensuring its cybersecurity, would not appear to be inconsistent with the purpose underlying the exemption (i.e., ensuring the safety of such personnel), if the Trustees determine there is a “substantial policy need” to undertake the vendor penetration testing (as ultimately proposed to be implemented).

In asking this question, you have briefly described the proposed vendor services:

In order to protect the sensitive and confidential information described above and otherwise protect the integrity of [its] computer data systems, the Retirement System, at the recommendation of its computer consultant, desires to engage a third-party cybersecurity vendor to conduct penetration testing. This testing will determine the security of the information stored in the Retirement System's database. In conducting such testing, the third party will attempt to penetrate ("hack") the Retirement System's electronic data storage systems. The purpose of the penetration testing is to detect any system vulnerabilities and remedy them, thereby ensuring the safeguarding of the sensitive and confidential information. However, if the vendor is successful in penetrating the Retirement System's database security measures, the vendor will be able to inspect and copy the sensitive and confidential information protected by the statutory sections cited above. The vendor will sign a confidentiality and non-disclosure agreement. Nevertheless, the vendor will have access to this exempt and confidential information about the Retirement System's members and families.[1]

You have advised that the database is maintained by the Trustees on computers maintained by the Trustees, separate from the computer networks of the City of Pompano Beach. You have also advised the database contains personal information of current and former agency employees, including their social security numbers.

Potential Vendor Access to Social Security Numbers

As observed in your request, under section 119.071(4)(a)l, “[t]he social security numbers of all current and former agency employees which are held by the employing agency are confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution.”

“If information is made confidential in the statutes, the information is not subject to inspection by the public and may only be released to the persons or organizations designated in the statute.”[2] However, section 119.071(5), Florida Statutes, provides certain exceptions to this general rule of confidentiality. As applicable here, it provides that “[s]ocial security numbers held by an agency may be disclosed if:…[t]he disclosure of the social security number is for the purpose of the administration of a pension fund administered for the agency employee's retirement fund, deferred compensation plan, or defined contribution plan.”[3]

“Administration” is defined as the “management or performance of the executive duties of a government, institution, or business; collectively, all the actions that are involved in managing the work of an organization.” Black's Law Dictionary (10th ed. 2014). While you have cited no statute addressing the proposed cybersecurity testing of the subject computer systems as applied to the Pompano Beach Police & Firefighters' Retirement System, there are statutory and rule provisions affecting state agencies and Supervisors of Elections which contemplate cybersecurity risk assessments to identify threats to information technology resources.

For example, section 282.318(4)(d), Florida Statutes—which establishes information technology services management requirements for state agencies—provides, among other things, that each “state agency head shall, at a minimum:…(d) Conduct, and update every 3 years, a comprehensive risk assessment, which may be completed by a private sector vendor, to determine the security threats to the data, information, and information technology resources, including mobile devices and print environments, of the agency. The risk assessment must comply with the risk assessment methodology developed by the Agency for State Technology[.]” Although the promulgated risk assessment regulations do not specifically mention penetration testing, they do require that state agencies “[i]dentify and document asset vulnerabilities.” Fla. Admin. Code R. 74-2.002.

Further, rule 1S-2.004 of the Florida Administrative Code, which applies to Supervisors of Elections, does identify “penetration testing” as an “appropriate” security procedure. It provides that the “Supervisor of Elections or a governing body may use a certified voting system in an assessment to examine or evaluate the system's security procedures, access control, system reliability and accuracy.” It also requires Supervisors of Elections to “implement appropriate procedures,” which “may be conducted as a routine test, a system audit or an examination of the functionality of the software and firmware, including penetration testing.” The rule also provides that, “although the Supervisor of Elections is responsible for the conduct of an assessment, he or she may use the services of an independent professional person or entity. The services of an appropriate skill assessment team who are educated and experienced in assessments and whose credentials have been approved by the governing body may be used.”

Penetration testing is a “specialized type of assessment conducted on information systems or individual system components to identify vulnerabilities that could be exploited by adversaries.”[4] Pursuant to the Federal Information Security Act, 40 U.S.C. § 1331, the National Institute for Standards and Technology (“NIST”) has published standards that provide minimum information security requirements for non-defense federal information systems maintained by federal agencies.[5] These minimum security requirements include “seventeen security-related areas with regard to protecting the confidentiality, integrity, and availability of federal information systems and the information processed, stored and transmitted by those systems.” Id. at 2. Among those security recommendations are “access control,” “audit and accountability,” “certification, accreditation and security assessments,” “risk assessment,” and “system and information integrity.” Id. at 2-3. In conjunction with federal defense and intelligence agencies, and to implement these minimum security standards, NIST has published NIST Special Publication 800-53, which sets forth information security controls. See NIST SP 800-53. Penetration testing is among the recommended controls for implementing the minimum security standards. See id. at appx. F-CA, p. F-42. Among the “control enhancements” recommended by NIST is the use of independent penetration testing agents, which are independent groups who conduct impartial penetration testing of the organization’s information systems. It would thus appear that penetration testing by independent agents is a widely recognized and prudent measure to detect and remediate any vulnerabilities in government information systems.

If the Trustees determine the vendor penetration testing will be “for the purpose of the administration of a pension fund” within the meaning of section 119.071(5), then it appears that any incidental disclosure to the cybersecurity vendor conducting penetration testing under a confidentiality and non-disclosure agreement would not violate chapter 119, Florida Statutes.

Potential Vendor Access to Exempt Employee Information

Section 119.071 also provides, in subsection (4)(d)2, that the “home addresses, telephone numbers, dates of birth, and photographs of active or former sworn…law enforcement personnel” and the “home addresses, telephone numbers, dates of birth, and photographs of current or former firefighters certified in compliance with s. 633.408” are “exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution.”[6] Under section 119.071(4)(d)3., Florida Statutes, an agency that is not the employer of, but is the custodian of records pertaining to, one of the persons enumerated in section 119.071(4)(d), Florida Statutes, is required to maintain such person’s exemption if the person or his or her employing agency submits a written request to the custodian.[7] In your letter, you have indicated that “[t]he employing agencies of the members have submitted a written request for maintenance of the exemption under subsection 119.071(4)(d)3 of the Florida Statutes.”

Notwithstanding these statutory provisions, a distinction is made between public records that are “exempt” from disclosure and records that are “confidential.”[8] “If records are not confidential but are only exempt from the Public Records Act, the exemption does not prohibit the showing of such information.”9 Based upon this distinction, this office has concluded that, in cases when there is a statutory or substantial policy need to disclose exempt information to a requesting agency or entity, the information may be disclosed.[10]

For example, in Florida Attorney General Opinion 96-36, the City of North Miami Police Department was interested in contracting with a company that compiled, integrated, synthesized, and summarized raw police and other data from a variety of sources and provided informational reports to law enforcement in a format that was “helpful and user friendly.” As explained by the Department, it “would enter into an agreement with the entity in which the entity would agree to maintain the confidentiality of such information.” The Department further indicated that it believed “that the police department's relationship with such an entity is both necessary and appropriate.” Observing that the “release of exempt criminal investigative information to a company that compiles and summarizes raw police data and provides informational reports to law enforcement in a format that is helpful and user friendly” was “not inconsistent with the purpose underlying the exemption for active criminal investigative information,” this office concluded “that the police department may release active criminal investigative information exempted by section 119.07(3)(b) [now 119.071(2)(c)1], Florida Statutes, to the company for the purpose of compiling, synthesizing, and summarizing such information for the police department.”

As applied here, information about law enforcement personnel and firefighters is exempt from disclosure in the interest of ensuring the safety of such personnel. Potential access to or incidental release of such information to a vendor under a confidentiality agreement, for the purpose of ascertaining and ensuring its cybersecurity, would not appear to be inconsistent with the purpose underlying the exemption, if the Trustees determine there is a “substantial policy need” to undertake the vendor penetration testing (as ultimately proposed to be implemented).

Sincerely,

Ashley Moody

Attorney General

AM/tlm

1 It is beyond the scope of this analysis to address whether the Trustees are generally authorized to enter into vendor agreements for services, and whether the procurement process, ultimate description of services, specific contract provisions addressing the security of penetration testing operations, or consideration of alternative cybersecurity assessment tools (matters this description does not disclose) might provide additional safeguards for exempt or confidential information.

2 WFTV, Inc. v. School Bd. of Seminole, 874 So. 2d 48, 53 (Fla. 5th DCA 2004).

3 § 119.071(5)(a)(6)(g), Fla. Stat. (2019) (emphasis added).

4 See National Institute for Standards and Technology, Special Publication 800-53 Revision 4, “Security and Privacy Controls for Federal Information Systems and Organizations”, at appx. F-CA, p. F-62, available at http://dx.doi.org/10.6028/NIST.

SP.800-53r4 (Last Visited May 15, 2019) (hereinafter “NIST SP 800-53”).

5 See FIPS PUB 200 “Minimum Security Requirements for Federal Information and Information Systems”, available at https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.

FIPS.200.pdf (Last Visited May 15, 2019).

6 § 119.071(4)(d)2.a, d, Fla. Stat. (2019).

7 See Ops. Att’y Gen. Fla. 14-07 (2014); 10-37 (2010); 05-38 (2005).

8 See Rameses, Inc. v. Demings, 29 So. 3d 418, 421 (Fla. 5th DCA 2010) (“[T]he Public Records Act is construed liberally in favor of openness, and exemptions from disclosure are construed narrowly and limited to their designated purpose.”).

9 Id.

10 See Op. Att’y Gen. Fla. 90-50 (1990); see also Inf. Op. to Hon. Don R. Amunds, Chair of Okaloosa Bd. of County Commissioners (June 8, 2012).