Illinois FOIA fight over SQL injection logic heads to court

A FOIA case turns into a database fight

Event date: February 25, 2025

An Illinois public-records dispute over a database schema has turned into a broader legal fight about what counts as a record, what counts as a security risk and how far public bodies can go in hiding information behind technical language. The account, published by sockpuppet.org, says Chicago refused a FOIA request for the schema of its CANVAS parking-ticket system and argued that answering with a database query would amount to creating a new record.

The source says the dispute went to court, where the author was called as an expert witness to explain SQL injection and database structure. It also says the issue helped prompt a bill in the 104th Illinois General Assembly. Those are the core verified facts: a request for a schema, a refusal, litigation and legislative fallout.

What makes the story more than a routine records fight is the technical layer. A schema is not the content of a database; it is the map of how the data is organized. That distinction mattered because the city reportedly treated the schema as a potential security exposure rather than a neutral descriptor of a public system.

The account describes Illinois FOIA as generally strong and quick, but limited by the idea that agencies do not have to create new records. That limitation is common in public-records law, yet the story shows how it becomes complicated once the requested information lives inside software instead of paper files.

The piece also makes a broader point about civic data. Public bodies increasingly store information in databases, which means access disputes can hinge on whether a request is for data, structure or a report that does not already exist. In this case, the difference became central enough to reach a courtroom and then lawmakers.

The source is a first-person account rather than a neutral court summary, so the article should not overstate every legal conclusion. Still, the legal and civic themes are clear enough to report: a FOIA request was denied, the city treated the schema as sensitive, a lawsuit followed, and the case helped inspire a legislative fix.

For readers, the takeaway is that database design is now part of public-information law. As governments keep more records in software systems, fights over access will increasingly revolve around technical definitions that most residents never used to have to think about. This case brought that shift into the open.