CYFD’s use of encryption software may violate law

Editor’s note: This story was originally published by Searchlight New Mexico, a nonprofit investigative news organization found at searchlightnm.org.

Since last year, the department tasked with overseeing foster care and child welfare in New Mexico has been encrypting and routinely deleting its communications, making much of its work essentially untraceable.

The leadership of the Children, Youth and Families Department has directed staff to use Signal, a secure communication app, and has set chats to automatically delete.

In contrast to standard text messages or emails — which could be accessed by attorneys, reporters and members of the public under the state’s open records laws — messages sent via Signal are all but impossible to retrieve. Once deleted, virtually no trace of a Signal conversation remains, even on the company’s server.

Attorneys and child advocates say the practice likely violates state open-records laws and could hamper any investigation into the

department, which has been subject to lawsuits and massive criticism for its management of the foster-care system.

Records of employee communications have been central to journalists’ coverage of state agencies.

“You can’t just encrypt and automatically delete communications between state employees,” said Melanie Majors, executive director of the New Mexico Foundation for Open Government. “That’s no different than putting official documents in the shredder at the end of every day.

“Improper destruction of public records is a fourth-degree felony,” she added.

On Wednesday, New Mexico Attorney General Hector Balderas confirmed his office is looking into the CYFD’s use of Signal.

“It is highly concerning that public employees are potentially deleting public information without a thorough legal process, and we are reviewing the matter,” Balderas said in a statement.

The announcement came a day after House Republicans sent a letter to Balderas calling for an investigation into the systematic deletion of government communications in the CYFD. The same letter asked Gov. Michelle Lujan Grisham to provide a report detailing “whether her office staff and or Cabinet level staff have been using data encryption and data dumping.”

In an interview with Searchlight, CYFD Secretary Brian Blalock said the department began using Signal near the outset of the COVID-19 pandemic. The move was part of an agencywide information technology upgrade, which Blalock said was needed in order to protect confidential records of children in state custody and to facilitate secure, remote communications.

Blalock acknowledged CYFD routinely deletes communications on Signal, but said that the information was not subject to New Mexico’s Inspection of Public Records Act.

“We destroy records every day because we have to; otherwise, we’d run out of space,” Blalock said, adding that the department also shreds paper communications and deletes conversations on other messaging software used by employees.

“Our lawyers have thoroughly vetted the use of all of our platforms,” he said. “None of our new technology is designed to make anything less transparent.”

Barring personnel records, medical records and several other narrowly defined exceptions, New Mexico law defines public records as those “that are used, created, received, maintained or held by or on behalf of any public body and relate to public business,” regardless of physical form.

Tripp Stelnicki, communications director for Lujan Grisham, did not return multiple requests for comment as to whether the governor’s office was aware of CYFD’s Signal use or whether other agencies have similar practices.

Blalock, who serves as the administrator for encrypted group chats between employees, has set at least some messages to automatically delete after 24 hours, according to screenshots of Signal messages and app settings shared by sources. Those screenshots reveal extensive conversations between employees — including Blalock and Deputy Secretary Terry Locke — about issues ranging from problems with private contractors to coordination during the 2021 legislative session.

Child advocates and attorneys interviewed for this story expressed alarm at the practice, saying that transparency is an integral part of the childwelfare system. Court-appointed child guardians, special advocates and attorneys regularly turn to agency records to ensure a child’s case is being handled appropriately.

Those records can include communications between CYFD staff members, attorneys interviewed for this story said. But if records are destroyed, there’s no way to access them or to know whether they might be relevant to a given case.

“By law we’re supposed to have access to all of these records,” said Bette Fleishman, executive director of Pegasus Legal Services for Children, a nonprofit law firm that represents children in CYFD custody.

“Our job and our obligation is to investigate, and do what’s best for the children. In order to keep the children safe, we need to have access to all the information. To have the state routinely deleting any sort of communications is outrageous.”