The article unpacks that a bit. IIUC, he did refuse the request, and purged the files and verified the purge using his own tools. With lawyers involved, the cit

The article unpacks that a bit. IIUC, he did refuse the request, and purged the files and verified the purge using his own tools. With lawyers involved, the city became inclined to accept that as sufficient to protect city interests. Had he dug in completely, the city was treating the situation as if they would bring charges under the Computer Fraud and Abuse Act (which I don't think precisely fits, but might have been the only leverage the city had to prevent a potential bad actor from capitalizing on their mistake).