Potential Cybersecurity Threat Linked to FOIA Requests
Aug 19, 2024
Share to:
Several public bodies have received Freedom of Information (FOIA) requests from a business going by the name of FOIA Buddy. The requests typically reference staffing, budget, and other details of cyber systems. This company purports to be requesting information on behalf of a person named Frank Curry. However, the website for FOIA Buddy does not appear legitimate, and the contact information provided by Frank Curry does not lead to any actual person.
An investigation undertaken by the local FBI revealed the following:
“Several clients have identified malware/viruses embedded in the links used in the request (all submitted via email). Preliminary investigation seems to indicate the sender is routing through multiple servers and ISPs.”
Moreover, based on information available online, it seems the actor is also causing similar issues in Pennsylvania, as numerous cases were filed against FOIA Buddy under Pennsylvania’s Right to Know Law. Specifically, in June of 2024, the Office of Open Records issued a decision on the matter of Frank Curry and FOIA Buddy v. South Western School District, denying FOIA Buddy’s appeal of the District’s denial of its FOIA request. The decision in favor of the District was made because the request was submitted anonymously, and therefore the District had no duty to fulfill the request under the Right to Know Law. Under Illinois law, a FOIA request can be submitted anonymously.
Although these decisions do not apply in Illinois and it is still unclear what the intentions of FOIA Buddy are, if you receive a FOIA request from FOIA Buddy or Frank Curry, please be sure to carefully review all elements of the request and responsive records to determine whether denial or redaction under the Freedom of Information Act is needed to protect cybersecurity.
As always, schools should continue to review and process all FOIA requests with the assistance of counsel. If you have any questions or need assistance reviewing FOIA requests or exemptions, please reach out to your Robbins Schwartz attorney.
