Staff recommends Council provide direction regarding Resolution 10-18929 after considering staff's recommendation to discontinue the City's current practice.

Resolution 10-18929 requires the City to post Mayor/Council emails online, subject to limited privacy, privilege, and medical information exceptions. This creates two key risks:

• Third-party privacy: Emails to Council can contain private information about uninvolved third parties who have no notice it's being made public.
• Liability exposure: Posting is a voluntary act, not a legal duty (unlike responding to records requests). Posted emails aren't vetted with the same rigor as records-request responses, and aren't screened for defamatory content at all, increasing the City's liability compared to producing the same records only upon request.

Since these emails remain available via public records request regardless of posting status, the added staff time and liability risk of posting them proactively outweighs the benefit to the few who read them online.

Following the September 21 work session, Staff added disclaimer language to additional sites on the City's webpage and developed an AI tool at the request of Council. After some testing, Staff have determined the tool will be used to assist in identifying personally identifiable information or emails which may contain threats. However, the AI tool is unable to identify confidential criminal justice information and false or defamatory information in emails, which is a significant concern and results in civil liability for the City. Additionally, disclaimers are helpful to provide notice to a person sending an email but it does not absolve the City of potential liability for its action of voluntarily re-publishing emails with defamatory or false information.  

Resolution 10-18929 sets forth a policy that requires the posting of all emails to and from the Mayor and City Council unless they contain content that is pertinent to the right of privacy, that is excluded by law or attorney-client privilege from being made public, or that contains private health care or medical information. See attached Resolution. The policy provides, "[w]ith few exceptions, the public cannot expect confidentiality when communicating via email with the Mayor and City Council members individually or collectively on matters of City business." The problem with the current process is that members of the public sometimes email Council with private or false information about other third parties that should not be made public or posted on the City's site. In those cases, that third party would have no idea their private or false information has been disclosed to Council and is being made public. Another example of a problematic email would be one that contains information about a confidential criminal investigation where a victim is entitled to confidentiality. 

Subject to the exceptions mentioned above, these emails would certainly be public records under Montana law. The City has a duty to produce public information upon request and a duty to protect information which the law has deemed non-public (i.e., confidential). While posting these emails on the internet is a move toward transparency, it is not required by law as is a public records request. The City choosing to post the emails on the internet increases the City’s risk should the emails contain defamatory statements or confidential criminal justice information. The difference between the City engaging in a voluntary act versus one completed in fulfillment of a duty bears significance. The latter may provide certain protection from liability for the City while the former acts to increase it. For this reason at least, the City bears some responsibility to review each Council email carefully before posting it online. And, even upon review, the City may not be in a position to evaluate whether statements made about third-parties are false or not. 

The City Attorney’s Office as a matter of practice, individually vets and reviews responses to public records requests when they contain City emails, prior to release. This is done to ensure the release of information complies with a complex legal framework of constitutional, legislative, administrative, and case law requirements. It would be contrary to this effort for the posting of Council emails to continue without similar handling.  

Also, when the City Attorney’s Office produces emails in response to public records requests, they are not reviewed for defamation issues. This is in part due to the fact that the City has a statutory duty to produce records regardless of content to a public records request, unless there is legal authority requiring them to be withheld or redacted. These requirements for withholding and redacting emails do not include the existence of material which is potentially libelous. A website disclaimer may provide some protection against the voluntary publication of defamatory material in Council emails, but the risk of liability for re-publishing such emails remains. 

Whether posted or not on the City’s website, Council emails remain public records which are required to be produced in response to a public records request subject to the limited exceptions noted above. A cost benefit analysis might suggest that the time spent properly vetting Council emails prior to posting is being expended for the benefit of only a relative few who visit the site to read them while at the same time exposing the City to liabilities that otherwise simply would not exist. Further, producing those same emails as a response to a public records request to those few individuals who wish to read them comes with little to no risk in comparison to the potential risks associated with publicly posting them. A large portion of the risk lies with the public posting itself of the emails. 

The IT department was consulted about whether there is an AI tool that could assist in this process. The IT department believes it could develop an AI-assisted workflow to perform an initial review of Council emails and identify or propose redactions for predefined categories of information. However, there is no substitute for the human eye or the performance of the complex legal analysis in determining what can be provided to the public. The Legal Department would still be required to review the emails to determine whether anything was missed or inappropriately redacted, which would not make the process more efficient. Attached to this memo is a detailed assessment outlining the cybersecurity concerns, technical feasibility, limitations of AI-assisted review, and considerations if Council chooses to continue proactive publication. Ultimately, based on an IT risk perspective, it is preferable to discontinue the automatic posting of Council emails without prior review to avoid several additional cybersecurity and operational risks associated with maintaining a public web archive.

The Council Operations subcommittee discussed this matter on September 14, 2026, and voted 2-1 to recommend to the full Council a rescission of the policy and process of automatically posting emails to and from Mayor/Council on the City's website.

Council discussed this recommendation on September 21, 2026, at a work session and asked staff to create an AI tool that would screen and flag problematic emails. Additionally, Council suggested adding disclaimer language in more places on the City's website. Staff have completed both of these tasks. The AI tool has been used and tested and is helpful to a certain degree. However, staff who review Council emails have suggested a secondary level of review from the Legal department instead of primarily relying on the AI tool. As stated above and as discussed at the September 21, 2026, work session, Legal's time would be better spent reviewing these emails as they are requested in a public records request instead of spending time on a daily review of emails which are likely viewed by a relatively small number of people.

The AI tool has value and is being used to assist the Clerk's office in reviewing emails, but it is not relied on to identify emails that cause the most significant concerns, which are emails containing confidential criminal justice information, defamatory content or unsubstantiated and false allegations. Again, the act of voluntarily publishing these types of emails creates a significant risk of liability to the City as there is no general immunity or statutory privilege which applies to the act of republishing emails containing these types of information.  

Administrative Costs. Meaningful review of Council emails prior to posting, screening for privacy, privileged, and defamatory content, requires attorney or staff time comparable to that expended on public records request processing. Unlike records requests, however, this cost would be incurred for every covered email regardless of public demand, representing a recurring administrative burden disproportionate to actual public use of the website postings.

Contingent Liability. Because posting is a voluntary act rather than a legal duty, this exposes the City to avoidable liability not otherwise present for privacy claims from third parties whose personal information is disclosed via Council email without their knowledge or consent; and for defamation claims arising from potentially libelous content that, unlike most records request responses, receives no legal screening prior to posting.

These liabilities are not readily quantifiable in advance but represent open-ended exposure to litigation, settlement, and judgment costs that would not exist under a records request only model.

The City incurs a predictable administrative cost to mitigate an unpredictable liability risk, in service of a public benefit, online access for a relatively small number of viewers, that is already available through the existing, lower-risk public records request process.

This is a discussion item and Council may provide direction to staff regarding the email access policy.