November 6, 2000



FROM: Robert J. Freeman, Executive Director

The staff of the Committee on Open Government is authorized to issue advisory opinions. The
ensuing staff advisory opinion is based solely upon the information presented in your

Dear Mr. Moore:

As you are aware, I have received your letter of September 28.

You asked whether the federal ID and bank account numbers of the Scotia-Glenville School
District may be deleted prior to disclosure of the District's bank statements. In addition, you
questioned whether the e-mail addresses of District faculty, staff and administrators may be withheld
under the Freedom of Information Law.

In this regard, as you may be aware, the Freedom of Information Law is based upon a
presumption of access. Stated differently, all records of an agency are available, except to the extent
that records or portions thereof fall within one or more grounds for denial appearing in §87(2)(a)
through (i) of the Law.

From my perspective, the only ground for denial of potential significance is §87(2)(i), which
authorizes an agency to withhold "computer access codes". Based on its legislative history, that
provision is intended to permit agencies to withhold access codes which if disclosed would provide
the recipient of a code with the ability to gain unauthorized access to information. Insofar as
disclosure would enable a person with an access code to gain access to information without the
authority to do so, or to shift, add, delete or alter information, i.e., to make electronic transfers, I
believe that the bank account or ID number could justifiably be withheld. On the other hand, insofar
as disclosure would not permit an individual to gain unauthorized access information or the ability
to alter the information, §87(2)(i) would not likely be applicable.

If indeed either of those items may properly be withheld, I do not believe that your inspection
of the bank statements would necessarily have created or resulted in a right to obtain a copy [see
McGraw-Edison v. Williams. 509 NYS2d 285 (1986)].

With respect to the e-mail addresses, while an e-mail address might not have been created
to be used as a computer access code, it can be used in to gain unauthorized access to a computer or
to transmit a virus or an "e-mail bomb" , for example, to one or perhaps many more computers.
Although there is no judicial decision of which I am aware that deals with the situation raised, the
cited provision might justifiably be asserted to withhold e-mail addresses. However, if your
statement is accurate, that hundreds of students or others not employed by the District have free
access to the e-mail addresses, it would be unlikely in my opinion that the District could justify a
denial of access to those items.

I hope that I have been of assistance.


cc: Superintendent