As local units of government report an influx of time-consuming public records requests they suspect of being phishing attempts, Hoosier lawmakers are cracking down.
“This bill addresses a real and emerging threat that is happening largely out of public view,” said John Wilson, representing the Allen County Board of Commissioners.
“This threat is the large-scale harvesting of government data, often by bots or AI-driven systems outside of our state,” he told the House’s government committee Wednesday.
Wilson described how the county received a commercial public records request seeking a spreadsheet of every purchase from 2021 to the present, including unit pricing, vendor IDs, quantities, totals and more — in the requester’s own format.
“We don’t think this is a request for transparency. We think this is a request to replicate our internal purchasing system,” he said. “If I’m someone committing fraud, I want to appear as legitimate as possible. A unit of government is about as legitimate as it gets.”
Other requests, per Wilson, sought 10 years worth of purchase orders above a certain threshold and, also in the requester’s own format, internal capital planning information “across nearly every category of public infrastructure.”
After an amendment taken Wednesday, House Bill 1360 would allow — but not require — state and local public agencies to set up online public records portals distinguishing bots from humans and Hoosiers from out-of-staters.
A portal could incorporate CAPTCHAs or other mechanisms to ensure a requester is human, and log submissions suspected of being automated or “to have originated from known sources of phishing or data scraping.”
Those logs would get reported to the Office of the Public Access Counselor. The PAC would also track requests to identify patterns or sources of such “suspect” requests.
A portal could also require verification of a requester’s physical address and indicate to the public agency if the requester is an Indiana resident.
A public agency would be able to charge supplemental fees to out-of-state requesters — capped at 25 cents per page or $25 per staff hour — and to prioritize asks filed by Indiana residents and for non-commercial uses.
Those would include civic, journalistic, academic or personal purposes.
“When non-Hoosiers and non-humans consume our resources, both the state and the local government should be able to recoup these costs,” Allen County’s Wilson said.
“Some of these out of state requests are legitimate …” he added. “But many (have) fake names, (from) companies that don’t show up when you Google them.”
The bill’s author, Rep. Matt Lehman, said the measure isn’t meant to hurt journalistic data-gathering efforts by out-of-state outlets or using automated tools. He noted Hoosier agencies can waive fees if they determine a request serves the public interest.
“You have to be able to make your argument as to why … gathering the data is journalistic,” Lehman, R-Berne, told the Capital Chronicle. “So if you say, ‘Look, I’m getting 50 states data on this particular thing to write a story,’ I think that makes sense.”
Indiana Capital Chronicle is part of States Newsroom, a nonprofit news network supported by grants and a coalition of donors as a 501c(3) public charity. Indiana Capital Chronicle maintains editorial independence. Contact Editor Niki Kelly for questions: info@indianacapitalchronicle.com.
