I have asked a government agency, under Freedom of Information legislation, to release two SQL queries they ran to produce a table which they published in a report.
That is, the agency published these two tables of figures showing, for each year, the number of cases completed under various categories and some aggregated statistics for each category. I want to see the query used to generate each table, in order to see how the data was filtered and precisely how the agency defined each category.
The agency has refused my request on the basis that releasing any SQL queries will prejudice their information security.
Under the relevant legislation, I now have the opportunity to apply for a review of this decision, in which I would have to explain why the agency's reasoning is flawed.
To my mind, the only way this could possibly be a security risk is where an attacker uses the information about table and column names to launch an SQL injection attack. However, the database in question is an internal data warehouse with no publicly-accessible web applications accessing it and, in any case, the agency has strict coding standards and penetration testing, etc, for preventing things like SQL injection vulnerabilities.
I can also imagine that if the agency was, say, the US National Security Agency, and the database was called 'overseas_phone_taps_by_country', then the table/column names would themselves be sensitive information. In this case, however, we are talking about an accounting database held by a pretty boring regulatory agency.
Again if the query was one used to generate lists of cases, then I could see the issue, since the query would contain things like the threhold at which a case will be considered for enforcement action, etc. However, that is not the case here.
How could releasing the text of an SQL query be a security risk?
EDIT: The agency provided the following explanation in their refusal letter:
SQL queries contain information about the agency's information systems (information related to the content, location and storage of sensitive information), which, if released, could reasonably be expected to increase the risk of compromise to the agency's information systems.
As such, I consider that disclosure of the SQL queries represents a potential security risk to the agency.
The advice from the agency's security expert reads:
I am of the opinion that the release of the SQL queries, even in a redacted form, would provide information about the programmable interfaces and logic flow within our systems, and give information about identifiers, pointers and references that would compromise the security and safety of the agency's systems.