Public Records Officer,

I’ve collected every letter to OHA and its boards that you answered for, with the link logs. Microsoft’s systems (your email provider) opened the attachment and followed every link inside it within seconds of each request arriving.

(Note this is an attachment -- an inline one -- so if you see this image, you are viewing an attachment.)

What opened them

All of these came from Microsoft’s network (AS8070, Microsoft Corporation).

*OEBB request, sent 8:54 PM Oct 31*

* *8:55:05 to 8:55:07 PM.* One machine, [IP address] in San Antonio,
followed all 19 links in the letter within 2 seconds. Its browser
reports itself as Chrome 154 on a Mac, with a 1920×1080 screen, the
Pacific time zone and the language en-US.
* *13 of those 19 links appear only inside the attached PDF*, not in
the email:
o statute sections 192.311, 192.324, 192.324(1), 192.324(3),
192.324(4)(b), 192.324(5), 192.329, 192.329(2)(a), 192.338 and
192.345(3)
o two Inquiry 0 records (01KQSWSYDGFCENFKKH5JHF0KW2,
01M5ZTYWMR1EM9C7R3S815Z4FG)
o the request’s own line on the table
* *Nov 2, 8:04 AM.* [IP address] (Phoenix) opened the 192.329(2)(a)
link, a link that exists only inside the PDF. Its browser reports an
Android phone.
* *Nov 2, 8:36 AM.* [IP address] (Phoenix) opened the same PDF-only
link. Its browser reports Windows.
* Both of those openings came before her 9:10 AM letter saying the
attachment is not opened.

*OHA request, sent 10:23 PM Oct 31*

* *10:24:07 to 10:24:09 PM.* [IP address] (Phoenix) followed all 17
links within 2 seconds. That includes the same PDF-only statute and
record links, and the request’s own line on the table. The browser
profile is the same: a Mac with Chrome 152, 1920×1080, Pacific time,
en-US.

*Your 9:40 AM reply, ACPCI thread*

* *9:40:35 to 9:40:36 AM.* [IP address] (Phoenix) followed all 7 links
within a second of delivery, with the same Mac profile, now Chrome 155.

*Your 9:41 AM reply, OEBB thread:* no openings recorded.

The system that checks attachments

Oregon’s state agencies moved their email to Microsoft 365. Their own email servers were shut down on November 21, 2024, for 46 agencies, according to the state’s IT office (EIS) in its December 2024 bulletin.

Microsoft’s mail security service for Microsoft 365, Defender for Office 365, has a feature called Safe Attachments. In Microsoft’s words, it scans “incoming attachments in a special environment to detect malicious intent before they are delivered to recipients. This process is known as sandbox detonation.” A companion feature, Safe Links, checks every link.

The logs show that pattern. About a minute after each request arrived, a Microsoft machine opened the PDF and followed every link inside it within two seconds, from a scripted browser with the same fixed screen and time zone every time. Whether Microsoft’s sandbox or something else did it, the PDF was opened and checked inside the state’s mail system before the email reached anyone. “We do not open attachments sent from outside the agency” is contradicted by that log. On the morning of November 2, the PDF’s links were also opened from a phone and a Windows computer on Microsoft’s network, before she wrote that she cannot open it. The log doesn’t show who used those.

*The other mail:* the seven new records are ingested and waiting for “push”. The audit finds 0 problems and the redaction gate is clean.

Sources:

* Microsoft Tech Community: Email protection basics in Microsoft 365
(Safe Attachments)
* Microsoft Learn: Safe Attachments, detonation
* EIS Digest, December 2024 (state email moved to Microsoft 365)

Further, I searched high and low for a policy about this, and there is none.

Please open the attachment and follow the statute.

Robert Samuel White