Since then, Director of Business and Operations Tina Darchicourt, who is also the district's Right-to-Know officer, has seen hundreds from a source called FOIA Buddy.
FOIA is the acronym for the Freedom of Information Act, a federal law that offers the public the right to request records from federal agencies. According to FOIA Buddy's website, the organization is designed to simplify the process of requesting public records.
Darchicourt, however, suspects that these FOIA Buddy requests aren't actually generated by humans.
Instead, she believes people who are not local are using artificial intelligence to craft the requests and send them en masse to schools and municipalities.
"We do not know if they are U.S. residents or from other countries," she said.
South Middleton Township's experience is one of several across Cumberland County and Pennsylvania.
ANONYMITY AND 'FRANK CURRY'
Jason Sabol, counsel at York-based law firm Stock and Leader, has seen FOIA Buddy requests at many of the firm's clients, including school districts and municipalities.
Stock and Leader represents several Cumberland County school districts, including South Middleton, Big Spring, Carlisle, Mechanicsburg and Camp Hill.
"Usually, the requests are very broad and pretty labor intensive," Sabol said.
For example, one might request a copy of all invoices, bills and subscriptions, or all Internet software, phones and cloud services for a several-month period.
Sabol started seeing the FOIA Buddy requests last spring and said many are identical across multiple entities.
"We had a district that received the exact same request to each one of their school buildings and to their office," Sabol said. "And then the same day, I had a municipality that I represent [receive] the exact same request [with the] exact same wording and the exact same capitalization and punctuation."
Aside from similar wording and a broad ask, Sabol said another commonality among the supposed AI-generated requests: the name "Frank Curry."
"[We] went on the FOIA Buddy website and found out that anybody or anything, a bot or whatever, can fill out a form and send it basically to every municipality [and] every school district in the state at the same time," Sabol said, adding that there's an option to make the request anonymous that generates an FOIA Buddy email address.
He believes the "Frank Curry" behind all the requests isn't a real person, but a fake name assigned to anonymous requests.
"We actually set up an FOIA Buddy account and had it generate a response for us to us, and it came back as we were Frank Curry," Sabol said.
Pennsylvania's Office of Open Records released a statement on its website that numerous agencies have contacted them regarding Right-to-Know requests from FOIA Buddy.
Officials do not believe FOIA Buddy is part of phishing or scamming activities and said agencies are responsible for handling FOIA Buddy requests according to Pennsylvania's Right-to-Know Law and their own policies that are compliant to that law.
PENNSYLVANIA'S RIGHT-TO-KNOW LAW
As opposed to FOIA, which applies to federal agencies, Pennsylvania's Right-to-Know Law governs access to public records for state or local agencies.
Media Law Counsel Melissa Melewsky with the Pennsylvania NewsMedia Association said this law requires public entities to respond to all Right-to-Know requests within five business days in one of three ways:
1. Grant the request and provide the records
2. Deny the request and explain appeal rights
3. Take a 30-day extension for specific cases
Pennsylvania's Right-to-Know law also requires people filing a request to be a U.S. citizen, meaning they don't have to reside in the district or municipality, or even the state from which they're seeking information.
Michael Statler, who recently stepped down as Big Spring's business manager and open records officer, said a response to a Right-to-Know request typically begins with documenting the date and time the request was received and assigning it a tracking number.
Then staff members determine what is needed and receive advice from the solicitor if necessary. If the information requested will take more than the five businesses days, the district submits an extension.
Once records are obtained, they are reviewed for any necessary redactions, Statler said.
If the request is fulfilled, the district letter, original request and records are sent to the requestor. If denied, a district letter with an explanation of why the request was denied and the original request are sent.
Requests that are denied can be appealed through the Office of Open Records.
CHALLENGES
If the district can't find a legal basis to deny the anonymous, allegedly AI-generated request, Sabol said the process of finding and providing the information can be labor intensive.
This can pose a challenge for Right-to-Know officers who, like Darchicourt and Statler, wear more than one hat within the district.
"You're having people who have legitimate Right-to-Know requests, who are maybe getting a 30-day extension on their Right-to-Know requests because of the labor involved in tracking down these bogus Right-to-Know requests, so it slows down transparency for everyone," Sabol said.
It also costs money to have solicitors review Right-to-Know requests, he said.
Darchicourt said some anonymous requests arriving at South Middleton are going to other district employees who aren't trained in the handling of these requests and don't know to pass them along to her. This makes it harder for the district to abide by the five-business day response required by law.
Big Spring Technology Director Robert Krepps believes the requests could open the district to cyber security threats.
"The information could be used to launch sophisticated phishing schemes," he said, adding Big Spring has received anonymous requests for budget information, IT staff contact information, tech service provider contracts and more.
Releasing certain information could let hackers know what to target in a ransomware attack, Krepps said.
Melewsky said Pennsylvania's Right-to-Know law begins with the assumption that all records for public agencies like school districts and municipalities are public. From there, it outlines a series of exceptions to that rule to account for security concerns.
SOLUTIONS
Both Big Spring and South Middleton are denying the anonymous, FOIA Buddy requests in accordance with solicitor recommendations.
"There's a provision in the Right-to-Know law that says agencies may [accept] verbal and anonymous requests, but it's a may, not a shall," Melewsky said. "So there is wiggle room in the law to either allow or disallow anonymous requests."
Sabol pointed to a Pennsylvania Office of Open Records determination between Frank Curry and FOIA Buddy and the South Western School District in which the office permitted the district to deny the request because it was anonymous.
This case law is used as a basis to recommend denying similar requests, he said.
A self-proclaimed transparency advocate, Melewsky said it shouldn't matter how a request is generated, whether hand-written or crafted using AI as an aid.
"What matters is, is the content of the request ... compliant with the law, and if the answer is yes, then the agency has to respond," she said. "If the content of the request is not compliant with the law, the agency can deny the request."
Even requests believed to be generated by bots were programmed by someone to fill out the Right-to-Know form, making that person the requester, she said.
As for concerns about denying valid requests believing them to be spam, Sabol said that's what the appeal process is for.
Of the roughly 75 anonymous, supposedly AI-generated requests Big Spring has denied, Statler said the district has not yet seen any appeals.
Pennsylvania's Office of Open Records' statement recommends that agencies review their policies regarding anonymous requests, saying if anonymous requests are not accepted, that policy should be posted clearly on that entity's website.
South Middleton School District is considering a policy update to clarify that the district will deny anonymous requests, though existing policies require the requester's name and address, indirectly preventing anonymity.
This change was discussed during the board's Aug. 5 meeting and could go before the school board for a vote Aug. 19.
"Adjusting the policy will allow us to better manage requests," Darchicourt said. "This will ensure that the requesters receive the requested information quickly and efficiently."
Maddie Seiler is a news reporter for The Sentinel and cumberlink.com covering Carlisle and Newville. You can contact her at mseiler@cumberlink.com and follow her on Twitter at: @byMaddieSei
©2024 The Sentinel (Carlisle, Pa.). Distributed by Tribune Content Agency, LLC.
