EXCLUSIVE: Cyber expert explains how universities handle FOIA requests

The following is a written account of a verbal interview conducted by Campus Reform Senior Editor Jared Gould.

Chris Mallow is a part-time freelance journalist and a 25-year cyber security veteran. During his more than two-decade career in cyber security, he spent nearly 4 years at the University of Oklahoma, where he served as Sr. IT Security and Forensic Analyst, per his LinkedIn.

In those roles, he performed email searches to fulfill public record requests. Campus Reform spoke with Mallow to get his insight into the way universities handle public record requests.

Campus Reform: During your time at the public university, how did the process of fulfilling public record requests for email searches work? Could you walk us through the steps involved?

Mallow: So everything that I did was on the technical side … [requests would be sent to me … and I would pull] the raw results and would export [the results] out of the email system and hand those back over to the open records office … [the records office] would have to redact stuff that [the office] couldn’t release, or things were like part of, you know, some private personnel decisions or whatever.” 

[RELATED: University charges Campus Reform $357,400 to conduct public record request]

Mallow went on to discuss that universities often face challenges with regard to storage capacity, and potentially run into technical challenges when trying to pull records for requests that demanded files from many years past. But, he explained that most records requests were easily searchable, saying they were not “big deals.”  

Presidents and other high-level officials are typically the suspects of most public records requests, Mallow further explained, but their emails and other records are typical on “legal hold,” as those officials are often involved in lawsuits against the university. This “means their emails never get seen,” Mallow said. 

Campus Reform: When universities are given narrow search criteria, is it relatively easy for the tech team to produce requested documents? Is the delay in receiving documents caused by the administrators involved?

Mallow: Yes, absolutely. In my experience, again, if I’m given a [narrow] search, let’s say it’s something … six or nine months ago, and it’s from … a two or three week period, we’re looking for seven people with … five keywords that are pretty specific, yeah, that’s gravy. That’s stuff that we can turn around pretty quickly … After that, everything is in the hands of the people that are handling, getting those results redacted, and then getting them back over to whoever made the request.

Campus Reform: In cases when record requests are reasonable, not causing undue burden on tech teams, but instead are narrow in scope yet production is still delayed, do you think that delays in fulfilling public record requests have caused people to think negatively of public institutions like universities? 

Mallow: The trust level has gotten so low for so many reasons. 

He continued, explaining that universities craft a variety of reasons to delay records, often because documents reveal them in a bad light. 

Campus Reform: Have you been witness to college administrators blaming its tech teams for delays, even when it might not be true?

Mallow: I never had experience being blamed as the delay for one of these requests. That doesn’t mean it didn’t happen …  I would be skeptical of anyone that tried to make technical excuses for [production delays] … [and]  But I’d be skeptical of anyone that’s trying to tell you that it’s going to take hundreds of 1000s of dollars to fulfill the request.

Campus Reform: What recommendation would you make to improve the transparency and efficiency of public record request processes at universities, considering both the cybersecurity aspects and the need for accountability?

Mallow: I think that for requesters, I would say …  don’t go on fishing expeditions, know what you’re looking for, and give reasonable scope in terms of time, number of people you want searched and number of keywords you want, that are going to be relevant. For universities, I’d say … make it easy … If you want to build trust … put online forums up that say that help guide the people that are making requests …  [try] to balance what they’re looking for against what you’re going to be able to provide.

Campus Reform: Please discuss anything that has yet to be mentioned that people should know. 

Mallow: I will say one additional thing … [administrators] know that they’re subject to record requests … So honestly, the bulk of the really sensitive, really meaty stuff that that someone would be looking for from those sort of high impact players … simply don’t put that stuff in email. But a lot of the time they have those discussions by phone or in person, because then there’s no trail, there’s nothing that can be picked up in an open records request.

Campus Reform: How can we trust universities to provide all records related to the search when the requesters do not know what exists? How can a requester be sure a university is not hiding documents? 

Mallow: You are to a large degree dependent on what they’re going to provide … it’s down to their character and their sense of ethics and we often don’t have people in those positions that understand that. 

[RELATED: EXCLUSIVE: How 12 public universities spent $230K on DEI training over 20 years]

Mallow concluded by speaking about his freelance journalism experience, saying that relying on universities to be honest about records is not enough. Instead, it is on journalists and other public actors to create relationships within universities, developing contacts that can provide inside information. 

Campus Reform remains committed to seeking transparency and accountability from public institutions. 

Follow Jared Gould on Twitter for more stories like this.