Pennsylvania eliminates public employee email directory, transparency concerns follow

---

The Pennsylvania Office of Administration withdrew its public email directory, preventing public access to Commonwealth employee emails. The decision was made for cybersecurity reasons, but many were concerned about the potential repercussions surrounding transparency and accessibility to public officials. 

Key Players

The Commonwealth of Pennsylvania Office of Administration (POA) assists official state government organizations with “deployment of technology, including standards, prioritization, security” and supports employees regarding “salaries, benefits, diversity, training, workplace safety, labor relations, and more.”

Gov. Josh Shapiro, a Democrat from the Philadelphia area, serves as the 48th governor of Pennsylvania. He won the position in November 2022 after serving as the state’s attorney general since 2017. Shapiro has refused to publish information about campaign party donors and does not publish his daily agenda. Additionally, his staff were required to sign strict non-disclosure agreements upon his election. 

The Commonwealth Court, founded in 1968, is one of Pennsylvania’s intermediate appellate courts. In 2013, the Commonwealth Court decided that under the state’s Right-to-Know Law, government-issued emails are personal information and therefore, are not required to be made public. However, in 2015, the same court ruled that employees’ email addresses should be provided when requested. 

Further Details

In May 2023, the POA removed its employee email directory, while employee phone numbers remained available to the public. Four months later, POA communications director Dan Egan emailed a statement about the change to the Pennsylvania digital newspaper Spotlight. 

“Having every Commonwealth employee email address publicly available in a searchable directory represents a cybersecurity risk and is not a best practice,” Egan stated. 

“Today’s bad actors are increasingly sophisticated in their tactics and often conduct research on specific individuals to craft targeted phishing messages,” he wrote, adding that “phishing emails represent the number one threat vector Commonwealth employees face today.” Over the previous 12 months, Egan attested, some 400 million possibly threatening emails were captured by government filters. 

The decision led experts to question the repercussions of removing this database. 

“I recognize that cybersecurity is a very real threat, but if we look around at business, and we know Pennsylvania is open for business, we see technology advancing to protect information, not remove it,” stated Terry Multcher, former director of the Office of Open Records. 

While the email directory was removed, the Office of Open Records has kept employee emails available to the public. However, to gain access, users must pass a more complex CAPTCHA test to signify that they are not robots. 

Herbert Lin, senior research scholar at Stanford University’s Center for International Security, noted that augmenting cybersecurity is expensive, and that removing the database could hamper public accessibility to state officials. 

“The only thing you can do is to strike a balance…how you choose to balance them is a question of politics and policy,” Lin stated. 

Susan MacManus, political analyst and political science professor at the University of South Florida, echoed this sentiment. “It cannot be a singular decision without every person that both uses and protects the data at the table to discuss,” she stated. “That’s why you have to have the chain of decision-making well laid out.” 

Outcome 

Texting platform substitutes for email database 

As the decision remains in force, Shapiro’s press office has not yet released an official statement to the public regarding the removal of the email database. 

On Sept. 15, 2023, Shapiro’s office initiated a new program to provide Pennsylvanians the opportunity to text his administration. Shapiro will also be able to send his constituents messages via SMS app Community.

“No matter how you choose to access government, you need to know you’re going to get help, whether you’re walking into a building or sending me a text,” Shapiro stated.