SAN DIEGO (KGTV) — The City of San Diego could make the unorthodox move of refusing to reveal a directory of its 11,000-plus employees.
A new memo from City Attorney Mara Elliott's office says officials fear doing so could increase the risk of cyber attack.
"You have indicated that releasing all City employee email addresses at once could create a potential threat to the City's cybersecurity because it would make it substantially easier for bad actors to launch phishing attacks against the City, which could interrupt critical City operations," says the Sept. 20 memo.
The Union-Tribune recently made a California Public Records Act request for names, work email addresses and phone numbers of all city employees, which is disclosable under the act.
Cyber security experts say public agencies have been facing a barrage of hacking attempts because they control critical civic operations.
Last year, hackers shut down some operations at the Port of San Diego, and the city of Atlanta has spent millions to recover a system after a $50,000 ransomware attack.
Ted Harrington, an executive partner at Independent Security Evaluators, said hackers often try to get victims to open attachments in emails, known as phishing.
"It's an attack method where when the victim either clicks a link or downloads an attachment, that automatically installs some sort of malware or directors that particular victim to a malicious website, and then all kinds of bad things can happen from there," he said.
The City Attorney's memo existing case law suggests there are circumstances where not disclosing the list of workers outweighs the public interest in disclosing them, but leaves it up to the city on a final determination.
Jeff Light, the editor and publisher of the Union-Tribune, said in a statement that he understands the cyber security concern, but that it shouldn't keep the information from being disclosed.
"Public information law in California says that 'access to information concerning the conduct of the people’s business is a fundamental and necessary right of every person in this state,'" Light said. "I don’t see how that principle squares with this theory that the government should not reveal the phone extension or email of a city employee."
The City Attorney memo notes that while the city may not release a full directory, residents do have access to contact information for city officials they may need to contact. It says the decision should be made based on credible facts and information.
