ORDER P-874
Appeal P-9400492
Ontario Hydro
NATURE OF THE APPEAL:
This is an appeal under the Freedom of Information and Protection of Privacy Act (the Act). Ontario Hydro (Hydro) received a request for access to the names of all computer networks to which Ontario Hydro is connected together with a list of all newsgroups and/or mailing lists and the names of subscribers in each group. The requester also sought access to all user names with Unix-to Unix Copy Program (UUCP) addresses. Hydro identified a list of user accounts as being responsive to the latter part of the request. Hydro indicated that no records exist for the other parts of the request.
The requester appealed Hydro's decision.
During mediation, Hydro provided the appellant with an affidavit outlining the searches undertaken by Hydro to identify computer networks to which Hydro is connected. The affidavit also explained why Hydro does not maintain such information. As a result, this part of the appellant's request was satisfied.
The record at issue in this appeal consists of the list of user accounts which Hydro claims is exempt from disclosure on the basis of the following exemptions:
- security - section 14(1)(i)
- economic and other interests - section 18(1)(c).
A Notice of Inquiry was provided to the appellant and Hydro. Representations were received from Hydro only.
DISCUSSION:
SECURITY
Section 14(1)(i) of the Act reads:
A head may refuse to disclose a record where the disclosure could reasonably be expected to,
endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required;
In my view, the phrase "could reasonably be expected to" in section 14(1) of the Act requires that a reasonable expectation of probable harm exist. The mere possibility of harm is not sufficient to meet this part of the test. Previous orders have held that, at a minimum, the institution must establish a clear and direct linkage between the disclosure of the specific information and the harm which is alleged (Orders P-557, P-756 and M-202).
In its representations, Hydro provides details with respect to how disclosure of the list of user accounts could endanger the security of a system established to protect items for which protection is reasonably required. The items requiring protection consist of information stored on Hydro computers pertaining to its business and facilities and include the nuclear generating stations. Unauthorized access to this information could compromise the security of this system.
Hydro describes how knowledge of user account names could lead to penetration of the security barrier and entry into the internal systems, thereby establishing a reasonable expectation of harm in the circumstances of this appeal.
I have carefully reviewed the evidence before me and I am satisfied that sufficient evidence has been provided to demonstrate a direct linkage between the disclosure of the information in the record and the harm alleged in section 14(1)(i) of the Act.
Since the issue has been disposed of under section 14(1)(i), I do not need to consider the application of section 18(1)(c).
ORDER:
I uphold Hydro's decision.
Original signed by: February 23, 1995
Mumtaz Jiwan Inquiry Officer