7(1)(v)

FOIA

Security vulnerability assessments and response plans

Read the full statute text on /statutes →

Jump to the 9 issues decided under this provision, with a drafting brief ↓

3 upheld (no violation found) · 7 rejected (violation found) · 1 partial violation · 2 closed / insufficient info / other, out of 13 documents.

Not legal advice, and not a per-exemption ruling — this reflects each document's overall disposition. See the FAQ disclaimer.

How the Public Access Counselor has treated 7(1)(v)

Section 7(1)(v) exempts vulnerability assessments, security measures, and response plans designed to identify, prevent, or respond to potential attacks or security threats. The protection applies only where disclosure could reasonably be expected to jeopardize the effectiveness of the measures or the safety of personnel or the public.

In these decisions, the PAC has applied the exemption narrowly and required proof by clear and convincing evidence. It found violations where public bodies relied on general fears that criminals could use routine operational information, such as addresses, response times, staffing numbers, camera locations, activity logs, or use-of-force reports. It found no violation or closed matters where records were specific risk assessments, jail security records, or facility vulnerability reports, and allowed only limited redactions where discrete security details were shown.

At a glance: 13 documents from 2021 to 2026(4 binding opinions, 9 determination letters). Most often cited alongside: 7(1)(c) (Personal privacy) (3); 7(1)(f) (Preliminary drafts, notes, and deliberative materials) (3); 7(1)(b) (Private information) (2); 7(1)(d) (Law-enforcement/administrative-proceeding records) (2); 7(1)(a) (Confidential under other federal or State law) (1).

Recurring issues

Public bodies withheld law enforcement operational data such as 911 response times, district staffing numbers, and ALPR camera locations on the theory criminals could exploit them. (911 call response time data from an emergency management office, Number of sworn officers per police district, ALPR camera cost, lease period, and locations)
Public bodies claimed housing addresses, police activity logs, and use-of-force reports were vulnerability assessments or security measures. (Excel file of scattered-site unit addresses and occupancy status, Police use-of-force reports for 2017, Police activity logs for a park)
Public bodies claimed security camera or platform video would reveal security capabilities or jeopardize security measures. (Police security camera footage of a building entrance during a protest, Train platform video of a fall onto the tracks)
Public bodies withheld specific risk assessments, jail inspection and security-round records, and civil-unrest response slides as vulnerability or security planning material. (Jail inspection reports and security-round logs, A risk management report on building safety, A slide deck on civil unrest emergency response strategies)

Practical points

A public body invoking 7(1)(v) must show by clear and convincing evidence how the record is a vulnerability assessment, security measure, or response plan and how disclosure could reasonably jeopardize its effectiveness or safety.
Do not withhold routine reports, logs, or datasets in full under 7(1)(v); review for discrete sensitive details that may support only limited redaction.
A requester can challenge a broad claim that operational numbers, locations, or incident reports must stay secret to prevent crime, as the PAC has often found such claims insufficient.

Summary drafted from the linked decisions and checked against them; read the decisions themselves before relying on it. Not legal advice.

All 13 documents citing 7(1)(v)

Issues decided under 7(1)(v)

Individual questions the Public Access Bureau decided under this provision, with the rule it applied, grouped by outcome. Extracted automatically from the letters; check each source letter.

9 issues across 9 determination letters:7 violation found · 1 no violation · 1 no determination / resolved.

Counts are per issue, not per letter, and come from automated extraction checked against sampled letters. Determination letters are not binding precedent.

Authorities the Bureau cites most on this issue

Ill. Att'y Gen. PAC Req. Rev. Ltr. 48212 cited 4 times
Chicago Sun-Times v. Chicago Transit Authority, 2021 IL App (1st) 192028 cited 4 times
Police employee attendance records (Pub. Acc. Op. No. 21-005) cited 1 times
Southern Illinoisan v. Illinois Department of Public Health, 218 Ill. 2d 390, 844 N.E.2d 1 (2006) cited 1 times
Lieber v. Board of Trustees of Southern Illinois University, 176 Ill. 2d 401, 407 (1997) cited 1 times
Excel file of scattered-site unit addresses and occupancy status (Pub. Acc. Op. No. 24-008) cited 1 times

How to challenge a denial on this issue

AI-generated summary of the decisions listed on this page, with each point linked to the letters it comes from. Determination letters are not binding precedent and this is not legal advice. Open the letter and check the PDF before relying on any point.

When a challenge is strong

The withheld record contains factual information (like ALPR locations, names, departments, or building identifiers) that does not describe a security measure, vulnerability assessment, or response plan. The Bureau has consistently found that mere factual or identifying records are not exempt under 7(1)(v) because they do not reveal security strategies designed to prevent or respond to attacks.Based on: 2026 · ALPR camera cost, lease period, and locations · Animal research protocol and medical records
The record is a routine law enforcement or operational document (such as a police log, use of force report, or standard employee list) that does not involve a targeted security assessment or plan. The exemption is limited to measures specifically designed to identify, prevent, or respond to potential attacks; routine administrative or enforcement records fall outside that scope.Based on: Police activity logs for a park · Police use-of-force reports for 2017 · Employee work-from-home policies and remote-wor…
The public body withheld surveillance footage, but you can show the camera is used for routine monitoring or general safety, not a specific security measure designed to prevent terrorist or similar attacks. The body must demonstrate the camera is a security measure aimed at preventing attacks, and the PAC ruled that routine monitoring does not qualify.Based on: Police security camera footage of a building en…
The information you requested is already publicly known or non-specific, and the public body has not explained how disclosure would undermine the effectiveness of any security measure. The Bureau requires the body to show that release would jeopardize security; publicly available or vague information does not meet that burden.Based on: A slide deck on civil unrest emergency response…

When the public body usually wins

The record contains surveillance video from a sensitive transit platform (like CTA) and the body can reasonably show that release would jeopardize the effectiveness of its security measures. In such a case, the Bureau upheld the exemption because disclosure could reveal security blind spots or methods.Based on: Train platform video of a fall onto the tracks
The public body has already established that the record is exempt under another FOIA provision. The Public Access Counselor may decline to address the 7(1)(v) claim at all, so your challenge on this ground becomes moot even if it might have been strong.Based on: A school district's tip-line policies and secur…

Points to put in your letter

State that the withheld information is factual or merely identifies people/departments/buildings, not a vulnerability assessment or security measure — cite D1497.2 or D857.3.Based on: 2026 · ALPR camera cost, lease period, and locations · Animal research protocol and medical records
Argue that the record is a routine operational document (like a police log or use of force report), not a plan designed to respond to potential attacks — cite D1078.1 or D918.6.Based on: Police activity logs for a park · Police use-of-force reports for 2017
If the record is video, point out that the camera does not appear to be a targeted security measure against attacks, but merely a routine monitoring tool — cite D1105.1.Based on: Police security camera footage of a building en…
Show that the information is already public or non-specific, and demand that the body explain exactly how disclosure would undermine security — cite D976.2.Based on: A slide deck on civil unrest emergency response…

Common mistakes

Assuming that any record held by law enforcement or any mention of security automatically qualifies for the 7(1)(v) exemption.Based on: Police activity logs for a park · Police use-of-force reports for 2017
Forgetting to check whether the public body also cited another FOIA exemption; if it did, the challenge on 7(1)(v) alone may not be enough.Based on: A school district's tip-line policies and secur…
Believing that redacting names, departments, or building identifiers is always justified as a security measure.Based on: Animal research protocol and medical records
Accepting a denial without requiring the public body to explain specifically how disclosure would jeopardize the effectiveness of a security measure.Based on: A slide deck on civil unrest emergency response… · Police security camera footage of a building en…

Facts to gather first

Whether the record is a list of employees, names, or locations that do not describe security systems or response procedures.
Whether the information already appears in public sources, news reports, or the body's own non-restricted publications.
The stated purpose of any camera or footage (e.g., routine monitoring, traffic enforcement, general safety vs. specific anti-terrorism use).
Any evidence that the record is part of ordinary law enforcement administration rather than a vulnerability assessment or security plan.

These notes are based on non-binding determination letters; each case depends on its specific facts, so verify the cited PDFs and consider obtaining legal advice for your situation.

Drafting brief for an AI assistant

Copy this into your assistant to help draft a request, appeal, or challenge to a denial that turns on this issue. It carries the rules and decisions, not your facts: add those yourself. Machine-readable version: foia-7-1-v.json.

TOPIC: 5 ILCS 140/7(1)(v) - Security vulnerability assessments and response plans
SOURCE: Illinois Attorney General Public Access Bureau decisions compiled at https://illinoisfoia.org/exemptions/7-1-v/
NOTE: Determination letters are not binding precedent; they show how the Bureau applies the law. Verify every decision against the source PDF before citing it.

VIOLATION FOUND (7):
- Withholding ALPR locations under section 7(1)(v)
  Rule: ALPR locations are factual, not vulnerability assessments or security measures designed to prevent attacks, so section 7(1)(v) does not exempt them.
  Decision: ALPR camera cost, lease period, and locations (non-binding determination letter, April 23, 2026) https://illinoisfoia.org/opinions/letter-83705/
- Withholding surveillance camera footage under section 7(1)(v)
  Rule: A public body must show the camera is a security measure designed to prevent attacks, not routine monitoring, to withhold footage under section 7(1)(v).
  Decision: Police security camera footage of a building entrance during a protest (non-binding determination letter, July 29, 2025) https://illinoisfoia.org/opinions/letter-84026/
- Redaction of police log columns under section 7(1)(v)
  Rule: A public body must show that redacted records are vulnerability assessments, security measures, or response plans designed to identify, prevent, or respond to potential attacks, not merely routine law enforcement activity.
  Decision: Police activity logs for a park (non-binding determination letter, September 24, 2024) https://illinoisfoia.org/opinions/letter-82465/
- Section 7(1)(v) redactions of slide deck
  Rule: Public body must show disclosure would undermine effectiveness; publicly known or non-specific information does not qualify for exemption.
  Decision: A slide deck on civil unrest emergency response strategies (non-binding determination letter, October 13, 2022) https://illinoisfoia.org/opinions/letter-70212/
- Part five withheld under section 7(1)(v)
  Rule: Section 7(1)(v) applies only to vulnerability assessments, security measures, and response policies or plans concerning potential attacks, not to a basic employee list.
  Decision: Employee work-from-home policies and remote-work approval lists (non-binding determination letter, September 14, 2021) https://illinoisfoia.org/opinions/letter-62833/
- Section 7(1)(v) vulnerability assessments
  Rule: Use of force reports are not vulnerability assessments or response policies, so the exemption does not apply.
  Decision: Police use-of-force reports for 2017 (non-binding determination letter, September 13, 2018) https://illinoisfoia.org/opinions/letter-53887/
- Redaction of names under security measures exemption
  Rule: Records merely identifying names of people, departments, companies, and buildings are not vulnerability assessments or security measures.
  Decision: Animal research protocol and medical records (non-binding determination letter, July 14, 2015) https://illinoisfoia.org/opinions/letter-35091/

NO VIOLATION (1):
- Denial of CTA platform video footage under section 7(1)(v)
  Rule: CTA platform video footage is exempt from disclosure under section 7(1)(v) because its release could reasonably be expected to jeopardize the effectiveness of CTA's security measures.
  Decision: Train platform video of a fall onto the tracks (non-binding determination letter, August 15, 2024) https://illinoisfoia.org/opinions/letter-80130/

NO DETERMINATION / RESOLVED (1):
- Applicability of section 7(1)(v) exemption
  Rule: Because the records are exempt under section 7(1)(ll), the Public Access Counselor declines to address the applicability of section 7(1)(v).
  Decision: A school district's tip-line policies and security protocols (non-binding determination letter, June 24, 2025) https://illinoisfoia.org/opinions/letter-81643/

MOST-CITED AUTHORITIES: Ill. Att'y Gen. PAC Req. Rev. Ltr. 48212; Chicago Sun-Times v. Chicago Transit Authority, 2021 IL App (1st) 192028; Ill. Att'y Gen. Pub. Acc. Op. No. 21-005; Southern Illinoisan v. Illinois Department of Public Health, 218 Ill. 2d 390, 844 N.E.2d 1 (2006); Lieber v. Board of Trustees of Southern Illinois University, 176 Ill. 2d 401, 407 (1997); Ill. Att'y Gen. Pub. Acc. Op. No. 24-008

TASK FOR THE ASSISTANT: Using only the decisions above, help draft a letter. Argue from the rule and cite the decision by name and date. Do not invent decisions.

Violation found (7)

Withholding ALPR locations under section 7(1)(v)
Rule: ALPR locations are factual, not vulnerability assessments or security measures designed to prevent attacks, so section 7(1)(v) does not exempt them.
Violation found ALPR camera cost, lease period, and locations · April 23, 2026
Withholding surveillance camera footage under section 7(1)(v)
Rule: A public body must show the camera is a security measure designed to prevent attacks, not routine monitoring, to withhold footage under section 7(1)(v).
Violation found Police security camera footage of a building entrance during a protest · July 29, 2025
Redaction of police log columns under section 7(1)(v)
Rule: A public body must show that redacted records are vulnerability assessments, security measures, or response plans designed to identify, prevent, or respond to potential attacks, not merely routine law enforcement activity.
Violation found Police activity logs for a park · September 24, 2024
Section 7(1)(v) redactions of slide deck
Rule: Public body must show disclosure would undermine effectiveness; publicly known or non-specific information does not qualify for exemption.
Violation found A slide deck on civil unrest emergency response strategies · October 13, 2022
Part five withheld under section 7(1)(v)
Rule: Section 7(1)(v) applies only to vulnerability assessments, security measures, and response policies or plans concerning potential attacks, not to a basic employee list.
Violation found Employee work-from-home policies and remote-work approval lists · September 14, 2021
Section 7(1)(v) vulnerability assessments
Rule: Use of force reports are not vulnerability assessments or response policies, so the exemption does not apply.
Violation found Police use-of-force reports for 2017 · September 13, 2018
Redaction of names under security measures exemption
Rule: Records merely identifying names of people, departments, companies, and buildings are not vulnerability assessments or security measures.
Violation found Animal research protocol and medical records · July 14, 2015

No violation (1)

Denial of CTA platform video footage under section 7(1)(v)
Rule: CTA platform video footage is exempt from disclosure under section 7(1)(v) because its release could reasonably be expected to jeopardize the effectiveness of CTA's security measures.
No violation Train platform video of a fall onto the tracks · August 15, 2024

No determination / resolved (1)

Applicability of section 7(1)(v) exemption
Rule: Because the records are exempt under section 7(1)(ll), the Public Access Counselor declines to address the applicability of section 7(1)(v).
No determination / resolved A school district's tip-line policies and security protocols · June 24, 2025