Certain records about a June 2023 cyberattack at the Colorado Department of Higher Education are subject to CORA’s deliberative process privilege and can’t be disclosed to a requester, a judge decided.

Denver District Court Judge Sarah Wallace reviewed the disputed documents in camera before making the determination last week in a civil action brought by the agency against Suzanne Taheri of the Public Trust Institute.

Taheri had argued that “boilerplate language” used by CDHE and its “vague descriptions of the withheld documents” did not adequately explain why disclosure of the emailed messages she requested would be harmful. The judge ordered the department to provide Taheri with a more detailed privilege log, also called a Vaughn index, but then granted the agency’s petition to restrict disclosure in a terse order.