Full disclosure.
Open methodology.
This page documents who built PAID, how the research was conducted, every source cited, the gaps we know about, and how you can verify any claim we make. If we got something wrong, we want to know.
Who built this
John Peter Quigley, operating as Quigley Group — a systems advisory business based in Ulster County, New York. John's professional identity is Systems Advisor. Powered by AI. He helps organizations use AI to improve operations, reclaim time, and multiply resources.
The research itself was conducted by a team of AI research agents (legal, technical, economic, and data architecture) working under John's direction. A synthesis agent compiled the findings into a unified research paper. Two additional agents drafted the model ordinance and implementation playbook. This campaign website was built by AI agents under John's direction.
Business interest disclosure
John is a systems advisor who helps organizations use AI to improve operations. This toolkit demonstrates that capability: it is a substantial body of AI-assisted research, compiled and published openly.
If a municipality wants help implementing the recommendations in this toolkit — drafting a local law, standing up a data program, or evaluating vendors — that is a service Quigley Group could provide. The research itself is published freely. There is no paywall, no lead capture form, and no obligation to hire anyone.
This toolkit is informational research, not legal advice. It does not create an attorney-client relationship. Every statutory citation should be verified against primary sources before reliance. Consult your municipal attorney and the NY Committee on Open Government before adopting any ordinance or fee program. Several sources in this registry are flagged as unverified — those claims should be treated with extra caution.
This is research presenting an opportunity and the risks honestly. We are not arguing that every municipality should charge for data access. We are arguing that municipalities can lawfully do so, showing how, and being explicit about what we do not yet know. The research gaps section below is as important as the recommendations.
Research process
Parallel research streams
Four research agents worked in parallel — legal, technical, economic, and data architecture. Each agent was given a scoped research question and instructed to fetch primary sources.
Primary source collection
Each agent fetched primary sources directly: statutes (from Cornell LII, govinfo.gov, FindLaw), case law (from Wikipedia with full citations), vendor documentation (from official docs sites), RFCs (from rfc-editor.org), and government reports. Every source was logged in a central citation registry (sources.yaml) with a stable ID.
Source verification
Sources were verified against primary text where possible. When a source could not be fetched directly (403 errors, scanned PDFs, interactive search interfaces), it was flagged with status: unverified and a note explaining what verification is still needed. No unverified claim was presented as established fact.
Synthesis
A synthesis agent compiled all four research drafts and the citation registry into a unified research paper. Two additional agents then drafted the model ordinance and implementation playbook from the same source material.
Campaign site
The research paper, model ordinance, playbook, and data guide were published as a public-facing campaign website with interactive tools. The website was built by AI agents under John's direction.
Ground rules
- Every factual claim cites a primary source logged in the citation registry.
- No assertions without a citation. If a claim cannot be grounded, it is flagged as analysis or opinion explicitly.
- Unverified claims are explicitly flagged — never presented as established fact.
- Target audience: municipal officials with no technical or legal background. Every term is defined.
- Legal research is informational, not legal advice. This is stated in every artifact.
- Single source of truth: the project folder. No claims scattered outside it.
The agent fleet
Seven AI agents worked on this project — four researchers, one synthesizer, and two drafters. Each agent's scope and output:
Legal Research Agent
Scope: NY FOIL, FOIA, public records law, bot access, API gating, case law, prior municipal attempts
Output: drafts/legal_landscape.md + sources
Technical Research Agent
Scope: Web crawling, robots.txt, rate limiting, API metering, CDN/WAF, access controls
Output: drafts/technical_landscape.md + sources
Economic Research Agent
Scope: Existing fee structures (FOIL/FOIA fees, PACER, bulk data, open data portals), monetization precedents
Output: drafts/economic_models.md + sources
Data Architecture Research Agent
Scope: Data organization best practices, metadata standards (DCAT, DCAT-US), open-data platforms, formats, schemas, APIs
Output: drafts/data_organization.md + sources
Synthesis Agent
Scope: Compile all research drafts into a unified research paper
Output: deliverables/research_paper.md
Ordinance Drafting Agent
Scope: Draft the model NY ordinance from research findings
Output: legislation/model_ordinance.md
Implementation Playbook Agent
Scope: Draft the implementation playbook (in-house vs contractor vs hybrid, procurement, vendor management, staffing)
Output: implementation/playbook.md
Every source cited anywhere in this toolkit is logged below with a stable ID (S-NNN). Sources marked Verified were fetched and checked against primary text. Sources marked Unverified could not be directly fetched and should be treated with extra caution — the notes explain what each is intended to establish and what verification is still needed.
Full federal FOIA statute text verified via Cornell LII and govinfo.gov. Establishes three fee categories (commercial, news/educational, other), limits fees to direct costs of search/duplication/review, requires records available "to any person," covers electronic records.
5 U.S.C. § 552 (Pub. L. 89-554, Sept. 6, 1966, 80 Stat. 383)
Full text verified via Ballotpedia. §1 establishes the Bill of Rights for Local Governments. §2(c) grants every local government power to adopt local laws relating to its property, affairs, or government. §2(b)(1) requires the legislature to enact a Statute of Local Governments. §3(c) requires rights/powers be liberally construed.
N.Y. Const. art. IX, §§ 1-3
Ninth Circuit case on web scraping of public data. Key holdings: (1) scraping publicly available data likely does not violate the CFAA; (2) a preliminary injunction was warranted. Verified via Wikipedia with full case citations.
hiQ Labs, Inc. v. LinkedIn Corp., 938 F.3d 985 (9th Cir. 2019)
On remand from the Supreme Court (S-005), the Ninth Circuit re-affirmed that scraping publicly available data is permissible and that LinkedIn could not block hiQ under the CFAA. Verified via Wikipedia.
hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022)
Supreme Court granted certiorari and vacated the Ninth Circuit's 2019 decision, remanding for further review in light of Van Buren v. United States (S-006). The Court did not rule on the merits. Verified via Wikipedia.
LinkedIn Corp. v. hiQ Labs, Inc., 141 S. Ct. 2752, 210 L. Ed. 2d 902 (2021)
6-3 decision interpreting the CFAA. Held that "exceeds authorized access" means accessing files off-limits to the user — NOT that using authorized access for an improper purpose violates the CFAA. This narrowed the CFAA significantly. Verified via Wikipedia with full citations.
Van Buren v. United States, 593 U.S. 374, 141 S. Ct. 1648, 210 L. Ed. 2d 26 (2021)
Establishes that where a platform takes affirmative technical steps to block access AND notifies the scraper, continued scraping may constitute a CFAA violation. Key distinction from hiQ. Verified via Wikipedia with full citations.
Facebook, Inc. v. Power Ventures, Inc., No. 5:08-cv-05780 (N.D. Cal. 2009); aff'd, 844 F.3d 1058 (9th Cir. 2016)
Federal court electronic records system charging $0.10/page. Key precedent for government charging for electronic access to public records. Fee revenues exceeded costs by ~$150 million (2008), leading to litigation. Verified via Wikipedia.
PACER, managed by Administrative Office of the United States Courts; fee authority under 28 U.S.C. § 1914 and Judicial Conference policy
District court ruled PACER fees were impermissibly used to cover costs unrelated to the PACER system itself, violating the E-Government Act of 2002's requirement that fees be "reasonably necessary." Verified via Wikipedia.
Nat'l Veterans Legal Servs. Program v. United States, 291 F. Supp. 3d 123 (D.D.C. 2018)
Federal Circuit affirmed that PACER fees were improperly diverted. Case remanded. Ultimately settled for $100 million in refunds plus $25 million in attorney fees (March 2024). Verified via Wikipedia.
Nat'l Veterans Legal Servs. Program v. United States, nos. 2019-1081, 2019-1083 (Fed. Cir. Aug. 6, 2020)
NY's FOIL. The $0.25/page copy fee is at §87(1)(b)(iii); electronic records cost-of-reproduction standard is at §89(1)(c). NOTE: Direct text could not be fetched from primary sources (nysenate.gov returned 403); citations are widely cited but SHOULD BE VERIFIED against official McKinney's.
N.Y. Pub. Off. Law §§ 84-89 (McKinney)
Statutory implementation of NY Constitution Article IX home rule powers. MHRL §10(1)(i) grants local governments power to adopt local laws. NOTE: Direct text could not be fetched (nysenate.gov returned 403). SHOULD BE VERIFIED against official sources.
N.Y. Mun. Home Rule Law § 10 (McKinney)
Enacted pursuant to NY Const. Art. IX §2(b)(1). Powers granted can only be repealed or diminished by re-enactment in two consecutive calendar years. NOTE: Direct text could not be fetched. SHOULD BE VERIFIED.
N.Y. Legis. Law §§ 10-24 (Statute of Local Governments)
Federal anti-hacking statute. Interpreted by Van Buren (S-006) to apply only to accessing off-limits files, not to terms-of-service violations. NOTE: Full text not directly fetched for this draft; statute citation is well-established. Verify against Cornell LII.
18 U.S.C. § 1030
The authoritative advisory body on FOIL, housed in the NY Department of State. Website verified with searchable FOIL advisory opinion database. NOTE: Specific individual advisory opinions were not fetched (search interface requires interactive queries).
N.Y. Pub. Off. Law § 87(2)(a); COOG, NYS Department of State
Federal law requiring courts to provide electronic access to records and governing PACER fee-setting. Fees must be "reasonably necessary" to reimburse costs. NOTE: Full text not directly fetched; citation established via PACER litigation coverage. Verify against congress.gov.
Pub. L. No. 107-347, 116 Stat. 2899 (2002)
IETF Standards Track document defining robots.txt. Explicitly states rules "are not a form of access authorization." Key source for advisory-only nature of robots.txt.
Koster, M., Illyes, G., Zeller, H., Sassman, L., 'Robots Exclusion Protocol,' RFC 9309, IETF, September 2022
IETF Standards Track document defining HTTP. Defines request/response protocol, user agents (includes spiders/bots), methods, status codes, and HTTP authentication. Foundational source for how web crawling works.
Fielding, R., Nottingham, M., Reschke, J., 'HTTP Semantics,' RFC 9110, STD 97, IETF, June 2022
Cloudflare's bot management product overview. Describes Bot Fight Mode (free), Super Bot Fight Mode (Pro/Business), and Bot Management for Enterprise.
Cloudflare, 'Identify and mitigate automated traffic to protect your domain from bad bots,' Cloudflare Developers, updated 2026-04-30
Describes Common and Targeted protection levels, Web Bot Authentication (WBA) for AI agents, and AI traffic monetization feature. States detection uses browser interrogation, fingerprinting, and behavior heuristics.
Amazon Web Services, 'AWS WAF Bot Control,' AWS WAF Developer Guide
Documents AWS WAF's AI traffic monetization feature: returns HTTP 402 Payment Required, client submits signed payment authorization, AWS verifies and settles on-chain. Direct technical precedent for per-request bot payment.
Amazon Web Services, 'AI traffic monetization,' AWS WAF Developer Guide
Kong Gateway: lightweight, cloud-native API gateway (reverse proxy), extensible via plugins. Supports authentication (key-auth, JWT, OAuth2, OpenID Connect), rate limiting, logging, load balancing. OSS and Enterprise editions.
Kong Inc., 'Kong Gateway,' Kong Documentation
Lists all Census Bureau datasets available via API: ACS, Decennial Census, Economic Census, Population Estimates, Business Dynamics, and more. Demonstrates breadth of federal data available through registered API access.
United States Census Bureau, 'Available APIs,' census.gov
Official Census API user guide. Documents API key requirement (free registration), query limits, and available data. Key precedent for registered, key-based, free government API access.
United States Census Bureau, 'Census Data API User Guide,' census.gov, updated 2026-05-12
Free plan ($0) includes DNS, DDoS protection, CDN, SSL, WAF, Bot Fight Mode. Pro ($20/mo). Business ($200/mo) with 100% uptime SLA. Enterprise (custom). Workers: $0.30/million requests beyond 100k/day free tier.
Cloudflare, 'Pricing,' cloudflare.com/plans/
The Sitemaps Protocol specification. Single sitemap: max 50,000 URLs, max 50 MB. Supports sitemap index files. Supports RSS/Atom and text formats. Can be referenced in robots.txt via 'Sitemap:' directive.
sitemaps.org, 'Sitemaps XML format,' sitemaps.org/protocol.html
Documents Cloudflare Bot Management for Enterprise: detects simple and sophisticated bots, headless browsers. Includes bot score, JA3/JA4 fingerprint, bot tags. Features: Block AI bots, AI Labyrinth, managed robots.txt. Custom pricing.
Cloudflare, 'Enterprise Bot Management,' Cloudflare Developers, updated 2026-04-15
NYC Open Data portal. Free public data published by NYC agencies. Mandated by NYC Open Data Law. Provides dataset-level API access via Socrata/Datatrac platform. No API key required. Precedent for fully open municipal data access.
City of New York, 'Open Data for All New Yorkers,' opendata.cityofnewyork.us
Official NGINX documentation for rate limiting, connection limiting, and bandwidth limiting. Describes leaky bucket algorithm, limit_req_zone/limit_req directives, burst/nodelay/delay parameters, dry-run mode. Free/open-source.
F5 NGINX, 'Limiting Access to Proxied HTTP Resources,' NGINX Admin Guide
AWS WAF pricing: $5/web ACL/month, $1/rule/month, $0.60/million requests. Bot Control Common: $10/month + $1/million requests (first 10M free). Bot Control Targeted: $10/month + $10/million requests. AI traffic monetization: no additional charge.
Amazon Web Services, 'AWS WAF Pricing,' aws.amazon.com/waf/pricing/
States bots account for 53% of all web activity and bad bots 40% (citing 2026 Bad Bot Report). Describes multi-layered detection using 700+ dimensions. Claims 99.999% of legitimate users not served CAPTCHA. Enterprise pricing.
Imperva (Thales), 'Advanced Bot Protection,' imperva.com
Federal open data portal operated by GSA. Catalogs 549,178 datasets from across federal government. Free access.
U.S. General Services Administration, 'Data.gov,' data.gov
Documents JA3 and JA4 TLS fingerprinting in Cloudflare Bot Management. Identify TLS clients by connection initiation characteristics. Available only to Enterprise Bot Management customers.
Cloudflare, 'JA3/JA4 fingerprint,' Cloudflare Developers, updated 2026-05-06
Federal judiciary's electronic public access service. 1 billion+ documents. Charges $0.10/page, capped at $3.00/document. Quarterly waiver for users accruing ≤$30 (75% of users pay nothing). Key federal precedent for paid access to public records.
Administrative Office of the U.S. Courts, 'Public Access to Court Electronic Records (PACER),' pacer.uscourts.gov
Kong's Rate Limiting plugin. Limits requests per second/minute/hour/day/month/year. Keyed by IP or Consumer. Three strategies: local, cluster, redis. Returns HTTP 429 with RateLimit headers.
Kong Inc., 'Rate Limiting Plugin,' Kong Plugin Hub
HTTP APIs: $1.00/million requests. REST APIs: $3.50/million (first tier). Free tier: 1M REST + 1M HTTP + 1M WebSocket messages/month for 12 months.
Amazon Web Services, 'Amazon API Gateway pricing,' aws.amazon.com/api-gateway/pricing/
Documents Cloudflare's 1–99 bot scoring system. Score 1 = almost certainly bot; 99 = almost certainly human. Detection engines: Heuristics, Machine Learning, JavaScript Detections, Anomaly Detection. Granular scores only on Enterprise.
Cloudflare, 'Bot scores,' Cloudflare Developers, updated 2026-05-05
Major civic CMS/vendor serving 7,000+ public sector customers, 48 of 50 largest US cities, 8B annual government website views. Products include govAccess/OpenCities (websites/CMS), meeting management, public records request management (GovQA).
Granicus, 'Turn public sector digital experiences into proven impact,' granicus.com
Establishes three FOIA fee categories (commercial, news/educational, other) and limits fees to direct costs. Bars fees where collection costs exceed the fee; first 2 hours search / 100 pages free for non-commercial requesters. Full text verified via govinfo.gov.
5 U.S.C. § 552(a)(4)(A) (2022)
Paper copies capped at $0.25/page; other records at "actual cost of reproduction" which may include hourly salary + storage media + outside professional service, but excludes search time/admin costs. Electronic records must not be encrypted. Full text verified via FindLaw.
N.Y. Pub. Off. Law § 87(1)(b),(c)
Federal statute restricting disclosure of personal info from state DMV records. § 2721(e) explicitly allows states to charge an "administrative fee for issuance of a motor vehicle record." Template for permissible-use restrictions on government data. Full text verified via govinfo.gov.
18 U.S.C. § 2721 (2021)
Official PACER pricing page. $0.10/page for documents (capped at $3/document = 30 pages); $0.10/page for search results (no cap); $2.40/audio file. Quarterly billing; fees waived if ≤$30/quarter. Court opinions always free. Verified directly from pacer.uscourts.gov.
PACER Service Center / U.S. Courts, 'PACER Pricing: How fees work'
Official fee schedule. Confirms $0.10/page, not to exceed 30 pages ($3 cap). Automatic exemption if quarterly accrual ≤$30. Content extracted from uscourts.gov.
Judicial Conference of the United States, Electronic Public Access Fee Schedule (issued pursuant to 28 U.S.C. §§ 1913, 1914, 1926, 1930, 1932)
NY's oversight body for FOIL. Issues advisory opinions, regulations, and annual reports. Confirms COOG is the authoritative interpreter of FOIL fee provisions; promulgates model rules for agencies. Verified at dos.ny.gov.
N.Y. Department of State, Committee on Open Government
Federal open data hub. ~549,178 datasets available. Free, no registration, no API keys required for bulk access. Demonstrates the federal default of free open data with no metered access. Verified directly from data.gov.
General Services Administration, data.gov
NYC's open data portal. Free public data, APIs available, no paid tier. Powered by Socrata/Tyler Technologies platform. Mandated by NYC Local Law 11 of 2012. Demonstrates municipal free-tier open data norm.
City of New York, NYC Open Data
Privacy Act provision allowing agencies to establish fees for making copies of an individual's record, excluding the cost of search/review. Illustrates cost-recovery-only fee standard. Full text verified via govinfo.gov.
5 U.S.C. § 552a(f)(5) (2022)
Announces a 2-cent/page increase ($0.10→$0.12) approved by the Judicial Conference Executive Committee to reimburse development costs of a new case management system. NOTE: Full page content not directly fetched; URL and details verified from search result metadata.
PACER Service Center, 'Temporary Fee Increase Effective Jan. 1, 2027' (announcement, June 26, 2026)
Referenced in DPPA framework discussion. Full text not fetched (nysenate.gov returned 403). Establishes NY DMV authority to charge fees for motor vehicle records.
N.Y. Veh. & Traf. Law § 2024
URLs returned 404/403 during research. NOAA data is generally free; specific policy document needed. Establishes federal precedent for free weather/climate data access.
NOAA Administrative Order 202-735D / NWS Information Dissemination Policy
sec.gov returned 403 on multiple paths. EDGAR is widely understood to be free including bulk downloads. Needs verification for current API/rate-limit details.
SEC EDGAR Bulk Data, https://www.sec.gov/edgar/sec-api-documentation
Platform supports API keys and rate limiting (confirmed via data.ny.gov S-308). Specific premium-tier/metered-billing features unverified. Needs verification from platform documentation.
Socrata platform documentation, Tyler Technologies
gao.gov returned 403 during research. These reports are widely cited in PACER criticism and fee-reform advocacy. Needs verification for specific report numbers and findings.
U.S. Government Accountability Office, reports on PACER fees
Needs verification of current bill number and status from congress.gov. Relevant to PACER fee reform discussion.
Open Courts Act of [year], Congress.gov
Survey not completed in this research pass. Recommended sources: Reporters Committee for Freedom of the Press, National Freedom of Information Coalition. Significant gap for national appendix.
Reporters Committee for Freedom of the Press state FOI survey; National Freedom of Information Coalition
Not verified; significant gap. County recorders sell bulk property/deed data to title companies and data brokers. Pricing and authority need primary-source documentation. Key gap for economic models.
Various county recorder offices; no single primary source identified
Not verified. USPS licenses postal data products commercially. Specific terms need verification from USPS.com.
USPS.com postal data products
Not verified. Indicative figures in economic draft are estimates based on general market knowledge. Current vendor pricing pages needed for calibration.
Various commercial data vendor pricing pages
W3C Recommendation defining 35 Best Practices for publishing data on the web. Covers metadata, licenses, provenance, quality, versioning, identifiers, formats, vocabularies, access, preservation. Key quotes on machine-readability and metadata. Verified directly from w3.org.
Lóscio, B.F., Burle, C., Calegari, N., 'Data on the Web Best Practices,' W3C Recommendation, 31 January 2017
W3C Recommendation defining the DCAT RDF vocabulary for data catalogs. Core classes: Catalog, Dataset, Distribution, Data Service. Designed to facilitate interoperability between data catalogs. Verified directly from w3.org.
Albertoni, R., et al., 'Data Catalog Vocabulary (DCAT) - Version 3,' W3C Recommendation, 22 August 2024
Schema.org Dataset type, equivalent to dcat:Dataset. Properties include distribution, includedInDataCatalog, variableMeasured, creator, publisher, license, keywords. Used with JSON-LD for dataset discoverability via Google Dataset Search. Verified directly from schema.org.
Schema.org, 'Dataset' type, schema.org/Dataset
The US federal metadata schema for open data catalogs, expressed as a JSON file (data.json). Based on W3C DCAT. Required dataset fields: title, description, keyword, modified, publisher, contactPoint, identifier, accessLevel. The single most relevant metadata standard for US municipalities. Verified directly from project-open-data.cio.gov.
U.S. GSA / OMB, 'DCAT-US Schema v1.1,' resources.data.gov, November 6, 2014
Federal repository of open-data policies, tools, schemas, and guidance. Maintains DCAT-US 3.0 schema documentation, implementation guides, migration guidance, API documentation. Operated by GSA TTS, NARA OGIS, and OMB.
U.S. GSA TTS / OMB / NARA OGIS, 'resources.data.gov'
Free, open-source data management system. Powers data.gov (US), data.gov.uk, Canada, Australia, and hundreds of others. Recognized as a UN Digital Public Good. GitHub: 5.1k stars. Verified directly from ckan.org.
CKAN (Open Knowledge Foundation), 'CKAN,' ckan.org
Helps local governments use data and evidence at scale. Certification program recognizing cities for data-driven governance; since 2017, 100+ cities have achieved Certification. Verified directly from whatworkscities.bloomberg.org.
Bloomberg Philanthropies / Results for America, 'What Works Cities,' whatworkscities.bloomberg.org
NY State's open data portal, running on the Socrata (Tyler Technologies) platform. Over 1,500 catalog items across 62 state agencies. Established under Executive Order 95. Free public access; API available per dataset. Verified directly from data.ny.gov.
New York State Office of Information Technology Services, 'Open NY / data.ny.gov'
International standard for date and time representation. Calendar dates YYYY-MM-DD. DCAT-US requires ISO 8601 for modified, issued, temporal, and accrualPeriodicity fields. Verified via Wikipedia (the ISO standard itself is a paid publication).
ISO, 'ISO 8601-1:2019' (and ISO 8601-2:2019, Part 2: Extensions; amd ISO 8601-1:2019/Amd 1:2022)
Federal law ("Buckley Amendment") governing access to and disclosure of student education records. Grants parents access and control over disclosure. "Directory information" may be disclosed without consent IF public notice given. NOTE: Specific FERPA regulatory text not directly fetched.
20 U.S.C. § 1232g (Pub. L. 93-380, Aug. 21, 1974, 88 Stat. 571); implementing regs at 34 C.F.R. Part 99
Referenced in open-data practice as a Drupal-based alternative to CKAN. Current project status, feature set, and maintenance level not independently verified in this pass.
DKAN project, https://getdkan.org
Referenced as a platform used by many US local governments. Specific open-data and API capabilities not independently verified in this pass.
OpenGov, https://opengov.com
Referenced as a Latin-America-originated open-data platform. Not independently verified in this pass.
Junar, https://www.junar.com
Referenced in open-data practice for schema validation. Not independently fetched in this pass. Flagged as needs verification for current tool status.
Frictionless Data, https://frictionlessdata.io
Granicus (S-123) is confirmed as a major civic CMS vendor. Specific data-publication, open-data, and API-generation module capabilities not independently verified in this pass.
CivicPlus / Granicus platform documentation
Honesty demands that we publish what we don't know alongside what we do. These are the gaps identified during research — information that was needed but not available, or not verified against primary sources. No new sources were added to fill these gaps; they are flagged per the ground rules.
NY procurement law (GML §103, §104)
What's missing: No source covers NY's competitive bidding thresholds, small purchase rules, or the OGS centralized contract piggybacking mechanism.
Why it matters: A municipality implementing a paid access program will need to procure software and services. Without verified procurement thresholds, the playbook cannot tell officials when competitive bidding is required.
Verification needed: Verify against the current NY General Municipal Law text and the municipality's own procurement policy. Check ogs.ny.gov for centralized contract details.
NY data breach notification law
What's missing: No source covers NY's breach notification statute (General Business Law §899-aa / State Technology Law §208).
Why it matters: A municipality handling automated access registrations collects contact and billing data. Breach notification obligations must be understood before launching any program.
Verification needed: Verify the current statute text via the NY Senate legislative database or a qualified municipal attorney.
Socrata/Tyler Technologies commercial pricing (S-214)
What's missing: The $10,000–$50,000/year estimate for a Socrata subscription is unverified.
Why it matters: The economic models and playbook cite this cost range. If the actual price differs significantly, the cost-benefit analysis for in-house vs. contracted data platforms shifts.
Verification needed: Obtain a current quote from Tyler Technologies or a verified public RFP award document.
County recorder bulk data sales (S-218)
What's missing: County recorders sell bulk property/deed data to title companies — one of the most established government-to-commercial-data-buyer markets — but pricing and legal authority were not verified.
Why it matters: This is the closest existing analog to what PAID proposes. Without verified pricing, the economic model cannot be calibrated against a real precedent.
Verification needed: Research individual county recorder fee schedules, state recorder association surveys, and title industry trade publications.
Commercial data API pricing (S-220)
What's missing: Indicative pricing for Zillow, ATTOM, CoreLogic, LexisNexis, D&B, ZoomInfo was not verified against current vendor pricing pages.
Why it matters: The economic model uses these vendors as market comparables to argue municipalities are underpricing their data. Without verified comparables, the revenue argument is weaker.
Verification needed: Request current pricing from each vendor's sales page or sales representative.
Municipality-specific bot traffic data
What's missing: No primary source provides actual bot traffic volume or cost data for NY municipal websites. The Imperva (53% bot traffic) and Cloudflare data is global/cross-industry.
Why it matters: Revenue projections ($500–$75,000/year gross) are estimates. A municipality cannot make an investment decision without knowing its own bot traffic volume.
Verification needed: A municipality should instrument its own site using a CDN's bot analytics (Cloudflare, AWS WAF) or a log analysis tool (AWStats) before making investment decisions.
Existing municipal paid API programs
What's missing: No specific examples of NY (or other) municipalities that have implemented paid automated-access programs were found, nor any legal challenges to such programs.
Why it matters: Without a working precedent, the legal analysis is theoretical. Knowing whether any municipality has tried this — and what happened — would materially strengthen or weaken the case.
Verification needed: Search municipal code databases, news archives, and COOG advisory opinions for any prior paid-access ordinances.
COOG advisory opinions on automated access (S-015)
What's missing: The COOG database at dos.ny.gov requires interactive search. Specific opinion numbers addressing electronic records fees, bulk data, and automated requests were not retrieved.
Why it matters: COOG advisory opinions are the authoritative non-binding interpretation of FOIL in NY. If COOG has opined on automated access or bulk data fees, that opinion would be the strongest guidance available to a municipality.
Verification needed: Search the COOG advisory opinion database at dos.ny.gov/coog using terms like "electronic records," "bulk data," "automated," and "API."
Specific statutory text of POL §§86–89 and MHRL §10 (S-011, S-012)
What's missing: The legal research notes that nysenate.gov returned 403 errors and the exact statutory language could not be directly verified.
Why it matters: The model ordinance cites specific sections of the Public Officers Law and Municipal Home Rule Law as its legal authority. If the section numbers or language are wrong, the ordinance's legal foundation is shaky.
Verification needed: Verify against official McKinney's Statutes, the NY Senate legislative database, or the printed NY Consolidated Laws. Consult a municipal attorney.
50-state open-records fee survey (S-217)
What's missing: The national appendix's 50-state fee comparison was not completed.
Why it matters: Without a state-by-state survey, the national appendix cannot tell officials in other states whether their open-records law permits fees for electronic access.
Verification needed: Complete the survey using the Reporters Committee for Freedom of the Press state FOI survey and the National Freedom of Information Coalition resources.
PACER revenue figures (S-215)
What's missing: Public reporting on PACER's annual fee revenue could not be verified against a primary source (GAO or Judicial Conference budget document).
Why it matters: PACER is the most-cited federal precedent for paid electronic access. Verified revenue figures would strengthen the economic argument by showing how much a government program can actually earn.
Verification needed: Locate GAO reports (e.g., GAO-18-429, GAO-23-105737) or Judicial Conference budget documents on uscourts.gov.
NOAA/NWS Information Dissemination Policy (S-212)
What's missing: URLs returned 404/403 during research.
Why it matters: NOAA is the standard federal example of free weather/climate data. The specific policy document would confirm the legal basis for that free access.
Verification needed: Search the NOAA Administrative Order database or contact NOAA directly.
SEC EDGAR bulk data access documentation (S-213)
What's missing: sec.gov returned 403 on multiple paths during research.
Why it matters: EDGAR is the standard federal example of free bulk financial data. Current API/rate-limit documentation would confirm whether EDGAR imposes any access restrictions.
Verification needed: Access sec.gov/edgar/sec-api-documentation from a non-blocked network or request documentation from SEC staff.
PACER reform legislation (S-216)
What's missing: Open Courts Act / Electronic Court Records Reform Act — needs verification of current bill number and status.
Why it matters: Pending federal legislation could change PACER's fee structure, which would affect the economic model's calibration point.
Verification needed: Search congress.gov for current PACER reform bills.
USPS ZIP code data licensing terms (S-219)
What's missing: USPS postal data licensing terms were not verified.
Why it matters: USPS is a federal example of a government agency that licenses data commercially. Verified terms would provide a pricing comparable.
Verification needed: Check usps.com for current postal data product licensing terms.
Several vendor/product verifications
What's missing: CivicPlus, OpenGov, Tyk, Gravitee, Apigee, Akamai Bot Manager, DKAN, Junar, Frictionless Data/goodtables, Sunlight Foundation guidelines, Code for America/18F guides, HIPAA Privacy Rule text, OMB M-13-13, NY Executive Order 95, and ISO 19115 were referenced but not independently verified.
Why it matters: These products and documents appear in the technical and data-organization research. Without independent verification, claims about their features or contents rest on secondary references.
Verification needed: Fetch each source from its primary URL or purchase the paid standards documents (ISO 19115, ISO 8601).
Every claim in this toolkit is tied to a source ID. You can — and should — verify any claim yourself. Here's how to check the main categories of sources we cite.
Federal statutes
Federal statutes (FOIA, CFAA, DPPA, E-Government Act, Privacy Act, FERPA) are codified in the United States Code. The most accessible free source is Cornell Legal Information Institute (law.cornell.edu). The official government source is govinfo.gov (U.S. Government Publishing Office).
NY statutes
NY statutes (FOIL, Municipal Home Rule Law, Statute of Local Governments) are available at nysenate.gov/legislation. Note: this site returned 403 errors during our research, which is why several NY statutes are flagged as unverified. You can also check FindLaw (codes.findlaw.com) or the official McKinney's Statutes at a law library.
Case law
Federal case law (hiQ v. LinkedIn, Van Buren, Facebook v. Power Ventures, NVLSP v. United States) is available free at CourtListener (courtlistener.com) and PACER (pacer.uscourts.gov). PACER charges $0.10/page but waives fees under $30/quarter. Our case law citations include full reporter citations for manual lookup.
NY Committee on Open Government (COOG)
COOG is the authoritative advisory body on FOIL. Their searchable advisory opinion database is at dos.ny.gov/coog. If you are a NY municipal official, searching this database for opinions on electronic records, bulk data, and automated requests is the single most valuable verification step you can take.
Vendor pricing
Technical sources (Cloudflare, AWS WAF, Kong, NGINX, Imperva) are documented on each vendor's official docs site. Pricing pages change frequently — always check the live pricing page before relying on a cost figure. The accessed date on each source card tells you when we last checked.
Open data portals
Federal and state open data portals (data.gov, data.ny.gov, NYC Open Data) are live websites you can visit directly. Check them to see what free, API-accessible data already looks like — and to understand the baseline against which a paid access program would need to justify itself.
Found an error? Tell us.
This is a research project, not a sales funnel. If you find a factual error, a broken citation, a missing source, or a gap we haven't listed, we want to know. Corrections improve the toolkit for every municipality that uses it.
This transparency page is part of the PAID toolkit. The full research paper, model ordinance, implementation playbook, and data organization guide are available from the navigation above. The source registry on this page is the single source of truth for every citation in the toolkit — if a claim doesn't trace back to an entry here, it shouldn't be in the research.