House Republican leaders plan to ask the Attorney General’s Office and the state auditor to investigate whether a state agency violated New Mexico’s public records laws in using a secure communications app for encrypted messaging.
Searchlight New Mexico reported Tuesday the app, Signal, has been employed by leaders in the state Children, Youth and Families Department since at least the outset of the coronavirus pandemic more than a year ago.
The Searchlight story said the app can set chats to automatically delete, making them inaccessible under the state’s open-records laws. Some of those CYFD Signal messages were between employees, the news organization reported.
Some communication between state employees is considered public record.
Republican lawmakers reacted quickly, questioning whether the use of the app shields the agency from public scrutiny.
“That is unconscionable,” said Rep. Rod Montoya, R-Farmington. “That is purposefully hiding something from the people they are governing.”
But a spokesman for Children, Youth and Families wrote in an email Tuesday the practice is used by federal agencies and others to provide stronger protection for sensitive information.
“CYFD’s adoption of paid Zoom with encryption and Signal is a best practice for public sector entities as they move to address the growing risk to cybercrime — a risk that has only grown with the advent of wide-scale remote work by state employees,” wrote spokesman Charlie Moore Pabst.
“Signal is widely used by many public sector organizations, including the federal government.”
Renee Narvaiz, a public information officer for the state Department of Information Technology, wrote in a text message that both the department’s regulations and those of the federal Health Insurance Portability and Accountability Act guidelines “require us to encrypt sensitive information to protect their integrity and confidentiality.”
Matt Nerzig, a spokesman in the Governor’s Office, said he would check but could not immediately answer when asked if other state agencies are using the Signal app.
In a news release, House Republicans asked Gov. Michelle Lujan Grisham “to provide a reporter detailing whether her office staff and or cabinet level staff have been using data encryption and data dumping.”