Conclusive Security Claims Do Not Justify Blanket FOIL Withholding: Mandatory In Camera Review for Cybersecurity Contracts and Executive Calendars

1. Introduction

Case: Matter of Newsday, LLC v. County of Nassau, 2026 NY Slip Op 05310 (App Div, 2d Dept Sept. 16, 2026).
Parties: Petitioner-appellant Newsday, LLC (a news organization) vs. respondents County of Nassau and its FOIL Appeals Officer (Gregory Kalnitsky).
Procedure: CPLR article 78 proceeding seeking (i) production of records under FOIL and (ii) attorneys’ fees and litigation costs under Public Officers Law § 89(4)(c).

The dispute arose from two FOIL requests:

  • Cybersecurity contracts: In April 2023, Newsday requested all County cybersecurity contracts “in effect for the last 5 years.” The County denied under Public Officers Law § 87(2)(i) (information technology security exemption), asserting disclosure could enable attacks on County IT assets.
  • County Executive public calendars: In September 2023, Newsday requested the County Executive’s public calendars from January 1, 2022 through June 30, 2023. The County denied under Public Officers Law § 87(2)(f) (life/safety exemption), asserting disclosure would endanger the County Executive. Newsday appealed; the County did not respond.

The Supreme Court denied the petition and dismissed the proceeding. The Second Department modified, holding the County’s showings were too conclusory to sustain categorical withholding and directing production of unredacted records for in camera judicial review to determine what—if anything—may be properly redacted.

2. Summary of the Opinion

The Appellate Division held that Nassau County failed to carry its burden to justify blanket FOIL denials for:

  • Cybersecurity contracts: The County submitted affidavits asserting any disclosure would jeopardize IT security, but the affidavits did not explain how disclosure of the limited information Newsday sought—“the vendors’ names, the cost, [and] the duration”—would jeopardize IT assets.
  • Past public calendars: The County relied on an affirmation from the County Executive’s security officer describing threats and asserting that even past schedules could reveal patterns. The court found this insufficient to show that disclosing any portion of the past public calendars could endanger life or safety.

Because the actual records were not in the appellate record, the court did not order immediate disclosure. Instead, it directed the County to produce the records unredacted to Supreme Court for in camera inspection so the court can determine what material fits the asserted exemptions and what non-exempt material must be disclosed with appropriate redactions.

The request for attorneys’ fees and litigation costs was deemed premature pending the outcome of the in camera review and resulting disclosure determinations.

3. Analysis

3.1. Precedents Cited

FOIL’s presumption of access and narrow construction of exemptions

  • Matter of Lane v County of Suffolk and Matter of Sarkodie v Kings County Dist. Attorney: Cited for FOIL’s purpose—open government and public accountability—and the broad duty to make records available.
  • Matter of Lockwood v County of Suffolk and Matter of Law Offs. of Cory H. Morris v County of Nassau: Reaffirm that agency records are presumptively open unless a specific exemption applies.
  • Matter of Roth & Roth, LLP v Queens County Dist. Attorney's Off. and Matter of New York Civ. Liberties Union v Village of Freeport: Emphasize the agency’s burden; an agency must provide “particularized and specific justification” for withholding.
  • Matter of Lane v Port Wash. Police Dist.: Supplies two key principles used by the court here—(i) FOIL litigation review is “much more stringent” than typical CPLR article 78 deference, and (ii) if exemptions are not proven, “FOIL compels disclosure, not concealment.”
  • Matter of Gould v New York City Police Dept.: Central to the remedy. When a court cannot determine whether withheld documents fall within an exemption, it should conduct in camera inspection and order disclosure of nonexempt material with redactions.

Public Officers Law § 87(2)(i): information technology security

  • Matter of TJS of N.Y., Inc. v New York State Dept. of Taxation & Fin.: Defines § 87(2)(i) as protecting material that, if disclosed, would jeopardize the capacity to guarantee the security of information technology assets, including systems and infrastructure.
  • Matter of Freedom Found. v New York City Dept. of Citywide Admin. Servs. and Matter of Miller v New York State Div. of Human Rights: Used by comparison (“cf.”) to underscore that agencies must connect the withheld content to the asserted harm; conclusory assertions do not suffice.

Public Officers Law § 87(2)(f): endangerment to life or safety

  • Matter of New York Civ. Liberties Union v Village of Freeport and Matter of Burns v Cooke: Provide that § 87(2)(f) permits denial if disclosure “could endanger” life or safety.
  • Matter of Bellamy v New York City Police Dept. (quoted in Matter of Burns v Cooke): Establishes that the agency need only show a “possibility of endanger[ment]” to invoke the exemption—but it must still demonstrate that possibility with record-based support rather than speculation.
  • Matter of Dilworth v Westchester County Dept. of Correction and Matter of Journal News v City of White Plains: Cited to show that generalized safety claims do not automatically justify total nondisclosure, particularly where the information concerns past events and where redaction may address legitimate risks.

3.2. Legal Reasoning

(A) Cybersecurity contracts: exemption requires a demonstrated link between disclosure and IT jeopardy

The County invoked § 87(2)(i) to withhold entire cybersecurity contracts. The appellate court did not reject the premise that some cybersecurity contract terms could be sensitive. Instead, it rejected the County’s attempt at categorical withholding without explaining why even the limited fields Newsday sought—vendor names, contract cost, and duration—would jeopardize IT security.

The court focused on the evidentiary deficiency: four employee affidavits “summarily concluded” harm, but did not “explain[] how disclosure” of the particular information sought would jeopardize security. Under FOIL, especially given the stringent review standard described in Matter of Lane v Port Wash. Police Dist., such conclusory statements do not satisfy the agency’s burden.

Remedy followed Matter of Gould v New York City Police Dept.: since the contracts themselves were not in the appellate record, the proper course was to require production of unredacted records for in camera review, allowing the trial court to order disclosure of nonexempt material and redact only what truly fits the exemption.

(B) County Executive calendars: “possibility of endangerment” still requires a non-speculative showing as to the records withheld

The County asserted that disclosure of past “public calendars” could endanger the County Executive because bad actors might infer patterns and anticipate future movements. The Second Department accepted that threats existed and took the safety concerns seriously, but found the showing insufficient to justify withholding any portion of the calendars, including public appearances.

Critically, the court treated “possibility of endanger[ment]” (from Matter of Bellamy v New York City Police Dept. and Matter of Burns v Cooke) as a lower threshold than “probability,” but not as a license for blanket denials. The County needed to connect the claimed danger to the requested records in a way that permits judicial evaluation—e.g., identifying what kinds of entries create risk and why redactions would not suffice. The affirmation’s generalized “pattern” theory did not establish that disclosure of all past calendar information “could endanger” the County Executive.

As with the contracts, the solution was in camera review and tailored redaction, not wholesale withholding.

(C) Attorneys’ fees: premature until the ultimate disclosure outcome is known

The court held that fees and costs were premature (citing Matter of Lane v Port Wash. Police Dist.) because entitlement often depends on the extent to which the requester “substantially prevailed” and on the agency’s justification—questions that cannot be resolved until after the in camera review and final disclosure/redaction rulings.

3.3. Impact

  • Anti-blanket-withholding principle in security contexts: The decision reinforces that agencies may not treat “cybersecurity” or “executive protection” as categorical labels that automatically justify total nondisclosure. Even when exemptions are potentially relevant, the agency must provide a particularized explanation tied to the specific information requested.
  • Operational effect: more targeted productions and more in camera review: Agencies facing FOIL requests for security-adjacent records may respond with narrower redactions and stronger affidavits anticipating judicial scrutiny, while courts may be more willing to require unredacted submission for in camera inspection when affidavits are conclusory.
  • Calendar/public-schedule requests: The decision signals that “past public calendars” are not inherently exempt under § 87(2)(f). Agencies must show why disclosure of particular calendar content (even if historical) creates a present safety risk, and why redaction cannot mitigate it.
  • Fees leverage after remand: By holding fees premature rather than foreclosing them, the decision preserves a potential incentive for agencies to resolve disclosure disputes without forcing prolonged litigation once the scope of proper redactions becomes clearer.

4. Complex Concepts Simplified

  • FOIL presumption of access: Government records are presumed open; the agency must justify secrecy with a specific statutory exemption.
  • “Particularized and specific justification”: The agency must explain, with record-based detail, why releasing the requested information would cause the harm the exemption is meant to prevent; broad conclusions are not enough.
  • Public Officers Law § 87(2)(i): Allows withholding if disclosure would jeopardize the security of information technology assets (systems/infrastructure). It does not automatically cover every document that touches IT.
  • Public Officers Law § 87(2)(f): Allows withholding if disclosure could endanger life or safety. The agency need only show a “possibility” of endangerment, but it must still demonstrate that possibility with more than speculation.
  • In camera inspection: The judge privately reviews unredacted records to decide what must be disclosed and what may be redacted under FOIL exemptions.
  • Redaction: Sensitive portions may be blacked out while the rest is disclosed—FOIL favors partial disclosure over total withholding when feasible.
  • CPLR article 78 in FOIL cases: Although article 78 often gives agencies deference, FOIL challenges are reviewed more stringently; courts narrowly construe exemptions and presume openness.

5. Conclusion

Matter of Newsday, LLC v. County of Nassau strengthens the practical rule that security-based FOIL exemptions cannot be sustained by conclusory affidavits and generalized risk theories. When an agency cannot specifically justify withholding—and especially when the requester seeks limited, non-technical fields like vendor identity, contract cost, and duration, or seeks past public calendar information—the proper judicial response is often not outright denial but in camera inspection with tailored redactions. The decision thus advances FOIL’s core commitment: disclosure is the default, and secrecy must be proven with specificity.