R.C. 149.433 provides that a record kept by a public office that falls under its definitions of a security record or infrastructure record is not a public record subject to mandatory release.

A “security” record includes:

• Any record that contains information directly used for protecting or maintaining the security of a public office against attack, interference, or sabotage.
• Any record assembled, prepared or maintained by a public office or public body to prevent, mitigate or respond to acts of terrorism, as described in a more detailed listing of eligible records at R.C. 149.433(A)(3)(b).
• A school safety plan adopted pursuant to R.C. 3313.536

An “infrastructure” record is defined as any record that discloses the configuration of a public office’s or chartered nonpublic school’s critical systems, including but not limited to communication, computer, electrical, mechanical, ventilation, water and plumbing systems, security codes, or the infrastructure or structural configuration of the building in which a public office or chartered nonpublic school is located. Simple floor plans disclosing only the spatial relationships of these entities or their buildings do not fall under this definition.

Unlike most other public records exceptions, which are waived if the office voluntarily releases a covered record to a member of the public, the disclosure of a security or infrastructure record to accomplish construction, renovation or remodeling does not waive this exception. R.C. 149.433(C)

This exception is complemented by an analogous provision in the Ohio Open Meetings Act that allows a public body to discuss privately the details of security arrangements and emergency response protocols, in executive session. R.C. 121.22(G)(6).

Since its enactment on May 15, 2002, only one reported case has addressed the application of the security and infrastructure exception. In State ex rel. Bardwell v. Cordray,¹ the Tenth District upheld, without detailed analysis, the use of the exception to withhold the cell phone number of an officer providing security to a public official, and an employee e-mail questioning whether the public official should attend a particular event. Both were found to be “security” records under R.C. 149.433(A)(3)(a).