"Putting the fox in charge of the henhouse" may be an overused phrase — yet it's hard to think of another that more aptly describes the way the city of Colorado Springs responds to records requests for city officials' emails, the Indy has discovered.
While some agencies instruct IT personnel to comb servers for messages sought under the Colorado Open Records Act, the city simply leaves that job in the hands of those whose emails are being sought.
And the city contends that once an email is deleted, it's no longer a public record subject to CORA. Simple as that.
A case in point is the Independent's multiple requests recently for Mayor Steve Bach's emails to and from certain people. The city said there were no emails. But some did exist, and fell within the scope of the Indy's request. How do we know? Because the Indy obtained four emails from other sources and verified their authenticity.
Withholding those emails would seem to be a violation of CORA. Yet the city maintains it's not that simple.
What we do know is that based on the city's response to questions, the city interprets the state's open-records act to say that when anyone, including the media, formally requests emails from the city and is told none exist, there is no way to determine whether such records existed but were deleted by the author.
Even if the city wanted to scour its servers for emails, which it doesn't do, if an email is deleted more than 90 days before the CORA request is submitted, the mail isn't retrievable.
And it is unclear whether there is anything to keep a city employee from deleting emails after receiving such a records request and then saying there are no messages responsive to the request.
In effect, when it comes to emails — the mode by which much official business is conducted in the digital age — the city has unilaterally exempted itself from the spirit of state-mandated transparency.
That means the public is less likely to know as much about how the city does business than previously thought.
Attorney Luis Toro, an open-government expert with Colorado Ethics Watch, calls the city's position "a dangerous interpretation of the open records law that could end up in court." It also raises the question of what else the city is hiding, he says.
The Indy has encountered situations in recent years where CORA requests seeking emails didn't yield messages thought to exist.
A recent and blatant example arose when the Indy in April sought communications between Bach and community leaders.
On April 2, the newspaper requested emails, from Dec. 1, 2013, through April 2, 2014, between Bach and El Pomar Foundation CEO Bill Hybl; Broadmoor and Colorado Springs Gazette owner and billionaire Philip Anschutz; Broadmoor CEO Steve Bartolin; and Gazette publisher Dan Steever, editor Joe Hight and editorial writer Wayne Laugesen.
On April 7, the city provided two emails. One was a message from Hybl sent to Bach on Christmas Eve recommending an El Pomar employee for a city position. The other: About four hours later, Bach responded, saying, "Thanks, Bill."
Since then, the Indy has obtained two emails Bach wrote to the Gazette, and two emails the newspaper wrote back to him. Hight confirmed the emails are authentic.
Given that all four of the emails fell within the time-frame of the Indy's CORA request, the Indy again asked the city — on May 7 and again on May 19 — to produce emails between the mayor and the other individuals. Both times, the city said there were no records responsive to the request.
However, on Feb. 19, Bach wrote to Steever and Hight and copied Laugesen. He complained that a story about the city's City for Champions tourism venture "inappropriately furthers the impression of a Council-Mayor power struggle on this matter" and adds "fuel to the flames of controversy."
Hight wrote back the same day, saying, "I beg to differ with you that we are fueling controversy when we are simply stating facts..."
On March 15, Bach wrote another message to the Gazette, calling another C4C story "incomplete and misleading," because it didn't fully explain his "side." He then wrote a page-long polemic on his collaboration efforts, the oversight of C4C and city legal opinions.
Hight again responded the same day, noting the newspaper had published many stories about C4C "with various sides, including yours."
After the Indy urged the city on May 19 to search servers for any deleted emails, the city said an IT Department search had located no records responsive to the request and that city servers "only save data up to 90 days, so any data deleted prior to that 90-day period will not be recoverable."
The 90-day periods preceding all three of the Indy's CORA requests would have included the time-frame in which Bach exchanged emails with the Gazette.
City spokeswoman Julie Smith further clarified the city's capability in the course of handling the Indy's CORA request. "If they're kept in an inbox or put in a folder, they'll be there," she said, "but if it's been deleted and has to be found on the server, it [the server] only holds 90 days" worth of emails.
When pressed to explain why the emails weren't provided, the city said in written responses to questions that it didn't consider the emails public records, and that the city doesn't search for or try to recover deleted emails.
In a similar instance, the Gazette sought emails surrounding Bach's firing of City Council legislative aide George Culpepper earlier this year. The newspaper recently reported that one email thread wasn't provided to the Gazette under its CORA request, but it recently surfaced. In it, Bach, again using the BGS@springsgov.com address, notes that Culpepper worked with City Council President Keith King in the state legislature when King served as a legislator.
Bach told the Gazette in an interview after a June 17 news briefing that he had been instructed to delete emails and routinely does so.
Although Hight declined to discuss specific cases, he provided a statement about the issue in general:
"It is important that government allows utmost access to our public processes and communications, even more so today that technology has expanded our ways to communicate with each other. The public expects our government officials to be accountable."
Not public records
CORA contains no detailed instructions on what emails are to be retained and for how long. But it does require agencies to adopt retention policies. The city has adopted the boilerplate version recommended by the state of Colorado for use by municipalities, called the Municipal Records Management Manual.
The manual gives periods of time for retention of everything from bank statements (seven years) to proof of publication for legal notices (six years). It states that correspondence, including email, of enduring value is to be kept permanently. That includes those emails defined as containing "long-term administrative, policy, legal, fiscal, historical or research value; records that relate to policy issues and actions or activities in which an important precedent is set..."
The manual requires routine correspondence — defined as "routine operating documentation or correspondence with limited administrative, legal, fiscal, historical, informational or statistical value" — to be kept for two years.
Correspondence of "extremely short-term value," including advertisements, drafts, worksheets, desk notes and the like, "including e-mail messages, with preliminary or short-term informational value" is to be kept until read.
The last category is the one into which the city contends Bach's email exchanges with the Gazette fall, because they had no "lasting value," and, therefore, could be deleted immediately and not archived.
"The Mayor determined that his e-mail communication was not worthy of long term retention when he deleted it," the city says.
Yet, the city oddly also argues that the emails weren't produced under CORA because they're not public records, so they're not even subject to retention management set out in the manual.
"The City interprets the requirements of the CORA to apply to records that are 'made, maintained or kept' by the City," the city states. "Deleted e-mails and records were 'made' by a city employee at some prior date, but once they are deleted, the intention is to no longer maintain or to keep that particular record."
Also, the city argues, while correspondence is included in CORA's definition of public records, CORA contains an exception for correspondence that is "without demonstrable connection to the exercise of functions required or authorized by law or administrative rule and does not involve the receipt or expenditure of public funds."
Bach's emails to the Gazette, the city notes, didn't involve a function required or authorized by law and didn't involve public money. The city further argues that retaining "every record that it ever makes," including the deleted emails in question, would pose "an enormous and unreasonable burden."
Lastly, the city relies solely on employees' honesty in retaining emails and producing them in response to a CORA request.
There is no regular involvement on the part of IT to check the server for deleted emails, because "CORA is silent regarding search methodology," the city says.
Retention of emails hasn't been tested in state court, other than in a school district case in Larimer County that led to a "poorly reasoned" ruling, says Steve Zansberg, a First Amendment attorney in Denver who represents media across the country. In that case, a judge ruled the district didn't violate CORA by ordering the destruction of records to avoid producing them in response to a CORA request.
"The over-arching purpose of CORA and a records retention schedule is to make available records for some period of time after they've been created," says Zansberg, president of the Colorado Freedom of Information Coalition, a group that advocates for government transparency.
Zansberg expressed disbelief that Colorado Springs is unable to recover emails beyond a 90-day window.
"Let's say this was the smoking-gun email," he says. "Let's say the attorney general says, 'We're going to investigate' and the FBI is coming in.
"Is it really the case that no one could go back to any email provider and they could not retrieve that document?"
He also dismissed the city's contention that the Bach emails aren't public records.
"An email from the mayor in which he expresses his office's official position on its legal authority to act as the city's representative in interactions with the state, other city offices, county commissioners and outlying mayors with respect to a significant city sports-and-events-center development is unquestionably a 'public record,'" he says.
"It was 'made' by the mayor, acting in his official capacity, using his official city email account, and the content of it unquestionably bears a direct connection to his official duties as mayor.
"It is inconceivable that anyone familiar with Colorado's Open Records Act would seriously contend to the contrary."
Toro, with Colorado Ethics Watch, agrees with Zansberg, saying it's shocking the city would argue that such emails aren't subject to CORA.
"If the mayor truly believes that his work on C4C is not 'authorized by law' he should cease working on it immediately," Toro says via email. "This raises a serious question [about] what other documents the City may be hiding under this broad claim that important mayoral work is not 'required or authorized by law.'"
Toro adds that records custodians must produce such records under CORA, "and if that means getting an IT person involved, that's what it means. It isn't sufficient to just ask the mayor to please forward any smoking-gun emails he has."
Allowing officials to make their own determinations of whether a document is of lasting value, Toro adds, is "an invitation to ... declare everything to be of 'extremely short-term value' and delete it."
In Washington state, Toro notes, records laws require an independent ombudsman to retrieve records, including emails.
The issue of email retrieval was highlighted by Todd Shepherd, an investigative reporter for the Independence Institute in Denver, on his news and political website The Complete Colorado when he reported earlier this month on his five-month campaign to obtain emails written by Jo Donlin, who headed external affairs at State of Colorado, Department of Regulatory Agencies, Division of Insurance. She reportedly had written messages about how nearly 250,000 insurance policy cancellations had been triggered by the Affordable Care Act. Shepherd reported he was given no emails written by Donlin, because the state told him they had been deleted and were no longer available.
Shepherd says via email that the technological age has outpaced open records laws and it's time for the state legislature to add specifics about retention of email by state and local governments.
Continuing problems in obtaining emails through CORA requests have led Jeff Roberts, executive director of the Colorado Freedom of Information Coalition, to contemplate a deeper look at email retention and requirements under laws in other states.
"My view," Zansberg says, "is the law needs to be tinkered with ... when it's less than clear and there's difficulty in administrating and applying the statute or, in this case, a records retention policy."
Toro, too, would like to see the General Assembly take a look at how emails are or are not retained under CORA.
But that seems like a long shot, given the rules state legislators themselves follow.
According to the Legislative Policies Related to Public Records and E-Mail, published in November 2013, "the best practice is to delete all e-mail within thirty days after you have received or sent it, unless there is an overriding reason to retain it for longer than thirty days Any e-mail that you retain may become the subject of an open records request."