ELECTRONIC PRIVACY INFORMATION CENTER v. UNITED STATES DEPARTMENT OF HOMELAND SECURITY, No. 1:2012cv00333 - Document 68 (D.D.C. 2015)
Court Description: MEMORANDUM OPINION to the Order on the Cross-Motions for Summary Judgment. Signed by Judge Gladys Kessler on 8/4/15. (CL)
Download PDF
<![CDATA[
ELECTRONIC PRIVACY INFORMATION CENTER v. UNITED STATES DEPARTMENT OF HOMELAND SECURITY Doc. 68 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA ELECTRONIC PRIVACY INFORMATION CENTER Plaintiff, Civil Action No. 12-0333 (GK) v. THE UNITED STATES DEPARTMENT OF HOMELAND SECURITY Defendant. MEMORANDUM OPINION Plaintiff Electronic Privacy Information Center ("Plaintiff" or "EPIC") brings this action against Defendant the United States Department of Homeland Security ("the Government" or "OHS") under the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552. Plaintiff seeks records concerning the Defense Industrial Base Cyber Pilot ("DIB Cyber Pilot"), a cyber-security pilot program conducted by the United Stat.es Department of Defense Defendant OHS. Mot.") jointly ("DoD") Government's Motion for Summary Judgment and ("DHS' s at 2 [Dkt. No. 53]. The program, infrastructure [,] which "aim[ed] [and] . to protect U.S. furnished critical classified thr.eat and technical information to voluntarily participating [] companies or their Commercial Service Providers[]." Id. EPIC, citing concerns from the Department of Justice about the program "[running] afoul -1- Dockets.Justia.com of laws forbidding traffic [,] Cyber . Pilot government surveillance of private Internet the DIB . sought records to determine whether . . program complied with federal wiretap laws." Plaintiff's Combined Opposition to Defendant's Motion for Summary Judgment and Cross-Motion for Summary Judgment ("Pl.'s Mot.") at 2 [Dkt. No. 57]. OHS conducted a search for records request, produced documents to EPIC, responsive to EPIC' s and provided a Vaughn index for all documents that were withheld in full or in part under one of FOIA' s several exemptions. Index for Challenged § 552 (b); see also Defendant's Vaughn Withholdings ("Vaughn index") [Dkt. No. 53-4] . EPIC now challeng-es the sufficiency of the search conducted by OHS, as well as the Government's application of FOIA Exemptions 1, 3, 4, 5, and 7(0) to withhold certain responsive information. Upon consideration of the Motions, Oppositions, Replies, the entire record herein, and for the reasons stated below, Plaintiffs' Motion for Summary Judgment shall be denied without prejudice with regard to Exemption 70 and otherwise denied in whole, and the Government's Motion for Summary Judgment shall be granted in part and denied in part without prejudice. -2- I . BACKGROUND A. FOIA The Freedom of Information Act ("FOIA"), 5 U.S.C § 552, was enacted by Congress "to ensure an informed citizenry, vital to the functioning of a democratic society." Critical Mass Energy Project v. Nuclear Regulatory Comm'n, 975 F.2d 871, 872 (D.C. Cir. 1992) ("Critical Mass III"), cert. denied, 507 U.S. 984 FBI v. (1982)). "In enacting FOIA, Abramson, 456 U.S. 615, 621 (1993) (citing Congress struck the balance it thought right--generally favoring disclosure, and did subject only to a handful of specified exemptions-- so across the Government." Milner v. length and breadth Dep't of the Navy, (2011). FOIA's "basic purpose reflect[s] full agency disclosure unless of the Federal 562 U.S. 562, 571 n.5 a general philosophy of information is exempted under clearly delineated statutory language." Dep't of the Air Force v. Rose, 425 U.S. 352, 360-361 (1976) (internal citations and quotation marks omitted) . When an ag-ency receives a request for records, the agency must conduct a sufficient search within the scope of the request, 5 U.S.C. § 552_(a) (3) (A). The agency then must furnish the information in a timely manner, unless the information is precluded from disclosure by one of FOIA's nine exemptions. "goal is broad disclosure, narrow compass." Milner, § 552(b). FOIA's [thus] the exemptions must be given a 562 U.S. -3- at 563 (citing United States Oep't of Justice v. Tax Analysts, 492 U.S. 136, 151 (1989)). The Government always bears the burden of proving exemptions apply for any responsive information that is withheld.§ 552(a) (4) (B). B. Factual Background 1. EPIC's FOIA Request On July 26, 2011, EPIC submitted a FOIA request for documents to OHS, as well as requests for news media fee status and a fee waiver. Pl.'s Mot. at 2; OHS's Mot. at 2. EPIC's FOIA request was for records related to the OIB Cyber Pilot program "to monitor Internet traffic Providers defense ("ISPs") flowing from contractors." through Internet ,Pl.' s Mot. certain users at to 2. Internet a select Service number Specifically, EPIC' s request was for all information in the following categories: 1. All contracts and communications with Lockheed Martin, CSC, SAIC, Northrop Grumman or any other defense contractors regarding the new NSA [National Security Agency] pilot program; 2. All contracts and communications with AT&T, Verizon and CenturyLink or any other [ISPs] regarding the new NSA pilot program; 3. All analyses, legal memoranda, and related ·records regarding the new NSA pilot program; 4. Any memoranda of understanding between NSA and OHS or any other government agencies or corporations regarding the new NSA pilot program; 5. Any privacy impact assessment performed as part of the development of the new NSA pilot program. Id. at 2-3. -4- of On August 3, 2011, DHS sent a letter to EPIC acknowledging receipt of the FOIA request, notifying EPIC that no responsive documents had been found for category 5, had referred the request Programs Directorate to ("NPPD"). the DHS and indicating that it National Pl.'s Mot at 3; Despite deadlines imposed by FOIA, 5 U.S.C. § Protection DHS's Mot. and at 2. 552 (a) (6) (A), DHS did not produce the requested documents or contact EPIC again for five months. Pl.'s Mot. at 3. On January 5, 2012, 1 EPIC faxed an administrative appeal to NPPD's FOIA Office, appealing NPPD's nonresponsiveness regarding categories 1-4 of EPIC' s FOIA Request. 2 Id. On January 23, 2012, a FOIA Specialist from NPPD contacted EPIC by telephone regarding the status of the FOIA request and informed EPIC that DHS was processing it. DHS's Mot. at 3. On March 1, 2012, EPIC ("Complaint") filed this Complaint for Injunctive Relief [Dkt. No. l], and the Government filed its Answer on May 1, 2012 [Dkt. No. 7]. On August 31, 2012, EPIC narrowed its FOIA request, in part to exclude draft documents, and specifically requested: 1 In Pl.' s Mot. and the Declaration of Amie Stepanovich [Dkt. No. 18-1], the date is listed as January 5, 2011. However, DHS's Mot. and additional materials in the r-e-cord indicate the correct date is January 5, 2012. 2 Defendant disputes whether this constituted an administrative appeal, but whether it did or did not does not affect the Court's final ruling. DHS's Mot. at 3. -5- 1. All contracts and communications with Lockheed Martin, CSC, SAIC, Northrop Grumman or any other defense contractors regarding the DIB Cyber Pilot; 2. All contracts and communications with AT&T, Verizon and CenturyLink or any other [ISPs] regarding the DIB Cyber Pilot; 3. All legal and technical analyses, including memoranda, regarding the DIB Cyber Pilot; legal 4. Any memoranda of understanding between NSA and DHS or any other government agencies or corporations regarding the DIB Cyber Pilot. Pl.' s Mot. at 4. 2. The Government's Search for Responsive Documents In conducting its search for responsive records, DHS assigned EPIC's FOIA request to NPPD. Second Holzer Deel. 9. NPPD's FOIA Office ("NPPD FOIA") began to process the request by "tasking out the search" to subcomponents likely to have responsive records, the Office of Cybersecurity and Communications ("CS&C"). Id. 11, 29. NPPD also provided the DHS Office of General Counsel and the Office for Selective Acquisitions with EPIC' s FOIA request because those offices had been involved in supporting the DIB Cyber Pilot and might have had responsive records. not search other offices or department Id. components 16. NPPD did because it determined that those off ices and department components were not likely to have any connection to the DIB Cyber Pilot. Id. -6- 17. NPPD FOIA met with "subject matter experts" in the agency who had been involved with the DIB Cyber Pilot to determine which subof fices would likely have responsive records. Id. i 15. NPPD FOIA and the subject matter experts created keyword search terms to be used in electronic searches for responsive documents. Id. i 18. The keyword search terms were provided to the identified offices, where each employee was instructed to conduct searches using the keywords and their own personal "knowledge of how and where they stored their own documents . ." Id. i 19. NPPD FOIA worked with the identified off ices to determine which employees were involved with the DIB Cyber Pilot. Id. i i 2223. Each office and employee were instructed to conduct a search for responsive documents. i i 18-19. The -employees who were involved with the DIB Cyber Pilot then searched electronic and hard copies of their office and personal classified network was also conducted. Id. A search of the i i 18-19, 29- 32. Staff in one of the identified offices - the NPPD Office of the Undersecretary ( "OUS") searched a database of taskings: records of which employees were tasked with various assignments and the files associated with those assignments. Id. at i i 22-23. OUS used the database to further identify all staff who· may have been involved with the DIB Cyber Pilot. Id. -7- Staff in the NPPO Privacy Office and the CS&C, along with CS&C's subcomponents, searched electronic and hard copies of their personal files. Id. 26-27, 29-32. Employees in those offices conducted a further search of the classified network. Id. The OHS Office of the General Counsel ("OGC") identified two attorneys who would potentially have responsive documents and had them conduct extensive manual and electronic searches of their computers and files relating to the OIB Cyber Pilot. Id. at 33-38. Staff in the Office of the Chief Procurement Officer ("OCPO"), responsible for contracting for NPPO and other offices, Office of Selective Acquisitions, an OCPO and the subcomponent which handles classified and sensitive contracts, did similar searches and located potentially responsive documents which were turned over to the OHS Privacy Office for further processing. Id. at 39-42. OHS did not search the various other offices within the agency that had no involvement with the DIB Cyber Pilot. Id. OHS' s searches initially resulted in pages of potentially responsive documents. 17. approximately 16, 000 Id. 43. That number were reduGed to roughly 10, 000 pages after initial review by a team of FOIA specialists and attorneys who spent several weeks reviewing the documents, removing duplicates, documents that were clearly non-responsive. Id. and removing The agency then took a "page-by-page and line-by-line" approach to determine if the documents were in fact responsive and whether any of FOIA's -8- exemptions applied to a part or the entirety of each document. Id. <JI 44. On April 15, 2013, documents to EPIC; their entirety DHS produced 1, 276 pages of responsive 117 pages of those records were released in and the remaining 1,159 pages redacted pursuant to FOIA exemptions. Id. were partially 46. On June 15, 2013, <JI DHS provided a partial preliminary Vaughn Index, and on June 22, 2013, Mot. DHS provided the remaining preliminary Vaughn Index. at 6; see also Vaughn v. Rosen, 523 F.2d 1136 Pl.'s (D.C. Cir. 1975). After receiving the documents, EPIC noticed that several emails referenced attachments that EPIC believed were not included in the DHS production. DHS's Mot. at 6. On June 20, 2015, EPIC responded to DHS's initial production of documents with a list of 17 examples of documents that EPIC believed were missing from the production. Second Holzer Deel. 47; Pl.'s Mot. at 8. <JI DHS analyzed the specific documents referenced by EPIC and found that responsive, identified 13 documents been properly identified responsive document been non-responsive, and one as had had three inadvertently excluded. Second Holzer Deel. In total, had 2013. Id. <JI<JI DHS has produced 1,386 pages of documents, released in full and some redacted, -9- been 48. DHS produced the four additional documents to EPIC on August ln, 49. non- inadvertently documents <JI as 48some and withheld 362 pag.es of documents in full under several of FOIA's exemptions. DHS's Mot. at 1; see also 5 U.S.C. C. § Id. 50; 552(b). Procedural Background On August 30, 2013, DHS filed its Motion for Summary Judgment. On September 27, 2013, EPIC filed its combined Opposition to the Government's Motion and Cross-Motion for Summary Judgment. On November 4, 2013, the Government filed its Combined Opposition to Plaintiff's Motion for Summary Judgment and Reply in Further Support of Defendant's Motion for Summary Judgment ("DHS's Reply") [Dkt. No. 61]. Finally, on November 25, 2013, Plaintiff filed its Reply in Further Support of Plaintiff's Motion for Summary Judgment ("Pl.' s Reply") [Dkt. No. 63]. EPIC challenges the adequacy of the search performed by DHS in response to its FOIA request, Pl.'s Mot. at 6, and also contends that the Government improperly redacted and withheld many documents under FOIA Exemptions 1, 3, 4, 5, and 7(D). Pl.'s Mot. at 15, 24. II. STANDARD OF REVIEW A. Summary Judgment Summary judgment should be granted only if the moving party has shown that there is no genuine dispute of material fact and that the moving party is entitled to judgment as a matter of law. See Fed. R. Civ. P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317, 325 (1986); Waterhouse v. Dist. of Columbia, -10- 298 F.3d 989, 991 ( D. C. Cir. 2002) . "A fact is material if it 'might affect the outcome of the suit under the governing law,' and a dispute about a material fact is genuine 'if the evidence is such that a reasonable jury could return a verdict for the nonmoving party.'" Steele v. Schafer, 535 F.3d 689, Anderson v. Liberty Lobby, Inc., 692 (D.C. 477 U.S. Cir. 242, 2008) 248 (quoting (1986)). "The court must draw all reasonable inferences in favor of the nonmoving party, and it may not make credibility determinations or weigh the evidence." Reeves v. Sanderson Plumbing Prods., Inc., 530 U.S. 133, 150 (2000). "To prevail on summary judgment the defending has conducted [against a FOIA chall-enge], 'agency must show beyond material doubt a search reasonably calculated to []that it uncover relevant documents.'" Morley v. C.I.A., 508 F.3d 1108, 1114 Cir. 1344, 2007) 1351 affidavit, (quoting Weisberg v. (D.C. if Cir. the 1983)). declaration U.S. Dep't of Justice, all (D.C. 705 F.2d "Summary judgment may be based on sets forth sufficiently detailed information 'for a court to determine if the search was adequate.'" Students Against Genocide v. (D.C. Cir. 2001) Dep' t of State, (quoting Nation Magazine v. 257 U.S. F. 3d 828, 838 Customs Serv., 71 F.3d 885, 890 (D.C. Cir. 1995)). If an agency denies disclosure of responsive records, either in whole or in part, based upon FOIA exemptions, it then "bears the burden of proving the applicability of claimed exemptions." Am. -11- Civil Liberties Union v. U.S. Dep' t of Def., 62 8 F. 3d 612, 619 . by (D.C. Cir. 2011). "The government may satisfy its burden submitting appropriate declarations and, where necessary, an index of the information withheld [ (known as a "Vaughn index") ] . " Am. Immigration Lawyers Ass'n v. U.S. Dep't of Homeland Sec., 852 F. Supp. 2d 66, 72 (D.D.C. 2012) (citing Vaughn v. Rosen, 484 F.2d 820, 827-28 (D.C. Cir. 1973)). There is no set formula for a Vaughn index or declarations, but they must "provide[] a relatively detailed justification [for any nondisclosure], specifically identif [y] the reasons why a particular exemption is relevant and correlat[e] those claims with the particular part of a withheld document to which they apply." Judicial Watch, Inc. v. Food & Drug Admin., 449 F.3d 141, 146 (D.C. Cir. 2006) (quoting Mead Data Cent., Inc. v. Dep't of the Air Force, 566 F.2d 242, 251 (D.C. Cir. 1977)). But, "exemptions from disclosure must be narrowly construed and conclusory and generalized allegations of exemptions are unacceptable." Morley, 508 F.3d at 1114-15 (internal quotation marks and citations omitted). III. ANALYSIS A. Sufficiency of the Search Conducted by OHS I EPIC contends that DHS did not conduct a sufficient search for responsive documents because DHS failed to re-evaluate the sufficiency of its search in light of examples of missing -email -12- attachments discovered by EPIC after DHS's initial production. See Pl.'s Mot. at 8. EPIC believes there may be additional responsive documents and, subsequent to DHS's supplemental production, created an exhaustive list of every document referenced in the emails that are potentially missing. Amie Stepanovich Id.; Third Declaration of 19 [Dkt. No. 57-4]. OHS argues that EPIC relies on a mistaken belief that many or most of the "missing" documents EPIC references are responsive to the FOIA request but were overlooked in the initial search. DHS's Reply at 3. OHS states that the documents referenced by EPIC are simply non-responsive which would included in the OHS production. explain Id. at 5. why they indicating that many of the not OHS provided a chart examining a sample of the documents cited by EPIC as missing, were documents were already released to EPIC, some documents were duplicates of documents that had been released or withheld, and other documents were withheld under a FOIA exemption and listed on the Vaughn index. DHS's Reply at 4; Deel.") Third Declaration of 5 [Dkt. No. James V.M.L. 61-1]; Holzer Chart of Documents ("Third Holzer Referenced in Plaintiff's Exhibit 4 [Dkt. No. 61-2]. EPIC nonetheless still contends that OHS should have conducted a thorough additional search of email attachments in light of the additional documents produced, search is insufficient. Pl.'s Reply at 5. -13- and therefore, its "The court applies a 'reasonableness' test to determine the 'adequacy' of a search methodology, consistent with congressional intent tilting the scale in favor of disclosure." Morley, 508 F.3d at 1114 (internal quotation marks and citation omitted) . To prevail in a summary judgment motion, an agency is not required to search every system possible, but must show that it made a good faith effort reasonably that would be requested information. expected See Steinberg v. Justice, 23 F.3d 548, 551 to produce all the United States Dep' t of (D.C. Cir. 1994). Summary judgment for an agency is inappropriate only if the agency's responses "raise serious doubts as to the completeness of the search or are for some other reason unsatisfactory " Perry v. Block, 684 F.2d 121, 127 (D.C. Cir. 1982). While constitutes agencies a have reasonable broad discretion search under in determining what FOIA requests, the Government "must revise its assessment of what is "reasonable" in a particular case to account for leads that emerge during its inquiry . [and] the court evaluates the reasonableness of an agency's search based on what the agency knew at its conclusion rather than what the agency speculated at its inception." Campbell v. United States Dep't of Justice, 1998). The revision "examine virtually 164 F.3d 20, requirement does not every document in its 28 (D.C. Cir. require an agency to files, following an interminable traii of cross-referenced documents" though, nor does -14- establish the existence of "mere reference to other files documents that are relevant to [the] FOIA request." Steinberg, 23 F.3d at 552 (D.C. Cir. 1994). In Steinberg, a FOIA requester brought suit challenging the sufficiency of the search conducted by two agency subdivisions. The second subdivision relied on an affidavit to demonstrate the adequacy of its search, "[describing] with particularity the files that were searched, the results several of the manner in which they were searched, the search." specific documents disclosed documents" had Id. The requester contended and that "cross-referenced in several of the not been properly examined by the subdivision. Id. Our Court of Appeals disagreed, finding that the search had been adequate. Id. Several years later, our Court of Appeals reaffirmed this holding, finding that the ag.ency would not be required to search every record referenced in disclosed documents in order to conduct a sufficient search. See Morley, 508 F.3d at 1121-22. As discussed above, the Government has shown that the initial search conducted by DHS in response to EPIC' s meticulous, organized, and thorough. FOIA request was As was done in the affidavit provided by the second subdivision in Steinberg, the Second Holzer Declaration explains in great detail how the search was conducted, which subdivisions and employees of DHS conducted the search, and the results of the search. See supra, Section I.B.2. -15- While EPIC contends that OHS should have performed an additional search after EPIC discovered the existence of crossreferenced documents, ·made clear that Pl.'s Mot. at 8, our Court of Appeals has agencies do not need to examine every cross- referenced document uncovered after an initial disclosure. See Morley, 508 F.3d at 1121. Although it is true that some documents were responsive, it was a very small number and in no way detracts from the Government's extraordinary efforts in executing its search. Although it is possible to envision circumstances in which the numerosity of overlooked documents calls into question the adequacy of the search, that is not the case here. EPIC has identified a limited number of potentially responsive documents it believes were overlooked, and OHS has sufficiently accounted for why many (although not all) of the documents flagged by EPIC were properly excluded.3 FOIA does not require OHS to track down every cross-referenced document. The Government here has done a commendable job in performing its search, and the Court concludes that it has shown completion of a sufficient search to satisfy FOIA. 3 OHS provided an additional affidavit, the Third Holzer Deel., and an additional chart to address EPIC's concern that documents cross-referenced in emails produced from DHS's initial disclosure had been overlooked. -16- B. Exemptions under FOIA Next, EPIC argues that OHS improperly withheld and redacted documents under various FOIA exemptions. The Court will consider each exemption in turn. 1. FOIA Exemption 1 FOIA Exemption 1 precludes disclosure of documents that are "(A) specifically authorized Executive order to be kept under criteria secret established by an in the interest of national defense or foreign policy and (B) are in fact properly classified pursuant to such Executive order." 5 U.S.C. § 552 (b) (1). OHS withheld information pursuant to FOIA Exemption 1 because the documents related to the classified activities of the National Security Agency information ("NSA"). in vulnerabilities of The Government has question systems reveals relating to stated that "[t]he and/or capabilities the national security, specifically electronic networks used by the defense industrial base sector." Se.cond Holzer Deel. CJI 56. As with all of FOIA' s exemptions, the burden of proof li-es with the Government to show proper application of Exemption 1. 5 U.S.C. § 552{a) (4) {B). The Court makes a presumption of good faith on the behalf of agency affidavits purporting to meet the Government's burden. Negley v. FBI, 169 F-ed. Appx. 591, 5.94 (D.C. Cir. 200-6). Thus, "summary judgment may be granted on the basis of agency affidavits if they contain reasonable specificity of detail -17- rather than merely conclusory statements, and if they are not called into question by contradictory evidence in the record or by evidence of agency bad faith." Halperin v. Central Intelligence Agency, 629 F.2d 144, 148 (D.C. Cir. 1980) It is undisputed that the requirements for classifying information relevant to this request are contained in Executive Order 13292, which was in effect from March 2003 until June 2010, and Exe cu ti ve Order 1352 6, which went into partial effect on December 29, 2009, and into full effect in June 2010. The parties agree that the differences between the two Executive Orders do not impact the Exemption 1 analysis in this case. See DHS's Mot. at 20; Pl-'s Mot. at 9, n.1. Executive Order 13526 provides that information may classified if: (1) an original classification authority is classifying the information; (2) the information is owned by, produced by or for, or is under the control of the United States ·Government; ( 3) the information falls within one or more of the categories of information listed in section 1.4 of this order; and ( 4) the original classification authority determines that the unauthorized disclosure of the information reasonably could be expected to result in damage to the national security, which includes defense against transnational terrorism, and the original classification authority is able to identify or describe the damage. Exec. Order No. 13526, 75 FR 707, 707 (De-c. 29, 2009). -18- be EPIC bases its Exemption 1 challenge exclusively on whether DHS has sufficiently shown that David J. Sherman, Associate Director for Policy and Records at the National Security Agency, has original classification authority pursuant to the Executive Orders. Without original classification authority, the withheld documents could not be properly classified. Pl.'s Mot. at 10. EPIC thus contends DHS could not properly invoke Exemption 1 as the basis for withholding any information, because the Government did not prove Sherman has original classification authority or that the documents were properly classified. The Government explained in the that Sherman, "who authority[,] serves as a Second Holzer declaration TOP SECRET the NSA] . determined that certain information {related to meets the criteria for classification and is . . . properly classified . Holzer Deel. . in accordance with E. 0. 1352 6." Se-cond 55. Neither party cites to any case directly addressing the issue - possibly because the issue is rarely contested. In Darui v. U.S. Dep't of State, 798 F. Supp. 2d 32, 40 (D.D.C. 2011), a FOIA requester did dispute an agency's application of Exemption 1, and specifically challenged an agency official's original classification authority based on an merely stated the official had such authority. affidavit that The court found that the agency official's declaration established that she was a -19- proper classifying authority, reasoning that the requester had brought forth "no evidence to support [the] contentions that [the official] lacks the authority to classify information, that [the official] is perjuring herself in her declaration, or that she has failed to comply with the Exe cu ti ve Order's requirements for classification authority." Darui, 798 F. Supp. 2d at 40. EPIC contends that the Second Holzer Declaration, which states that Sherman has TOP SECRET classification authority, was insufficient [Holzer's] because claim it of did [] not "offer Sherman's any basis to support classification alleged authority." Pl's Mot. at 11. EPIC argues that DHS needed to provide a declaration by Sherman himself, or other (unspecified) documentation of Sherman's authority status. Pl.'s Mot. at 10-11. However, EPIC fails to provide support for why the Government's documents are insufficient. 4 Pl.' s Mot. at 11. As in Darui, EPIC does not allege classification that authority, Sherman that 4 actually either lacks Holzer or original Sherman's EPIC argues that Holzer did not allege personal knowledge of Sherman's classification authority and cites only to Weisberg v. Dept. of Justice, 627 F.2d 365 (D.C. Cir. 1980). Pl.'s Mot. at 11. In that case, a declarant did not assert personal knowl.edge over whether evidence had been destroyed, but instead stated what he believed likely occurred, and thus the Court found a "permi·ssible inference [for summary judgment purposes] that [the declarant] fwas] incorrect in his belief." Weisberg, 627 F. 2d at 369. However, in this case, the Holzer declaration clearly asserts personal knowledge that "Sherman serves as a TOP SECRET classification authority." Second Holzer Deel. <JI 55. -20- declarations are perjured, or that Sherman failed to comply with the requirements for classification authority.s In that case, the FOIA requester did not challenge Sherman's classification authority, but withholdings on other grounds. rather challenged Exemption 1 Elec. Frontier Found v. Dep't of Justice, No. 12 Civ. 1441 (D.D.C. 2014). The Court without any reference to Sherman, that Exemption 1 was properly applied. As the Court gives a presumption of good faith to Mr. Holzer's affidavit, and b€cause EPIC has provided no support for its allegation insufficient, that the the Court d€clarations concludes provided that the by Second DHS are Holzer declaration, along with the Sherman declaration from another case, are sufficient to establish that he is an authority on classified materials who properly identified documents to be withheld under the Executive Orders pursuant to Exemption 1. 2. FOIA Exemption 3 FOIA Exemption 3 precludes release of information that has been: specifically exempted from disclosure by [another] statute [that] (i) requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue; or (ii) establishes particular 5 Although it believes the Holzer Declaration to be sufficient, the Government also provided a declaration by Sherman from a different matter explaining his credentials as an original classification authority. DHS's Exhibit E-2 1-2 [Dkt. No. ·6131 -21- criteria for withholding or refers to particular types of matters to be withheld. 5 U.S.C. applies, 552(b) (3). In determining whether Exemption 3 properly § the Court conducts a two-part test: whether " [ 1] the statute in question [is] a statute of exemption as contemplated by exemption 3 [and] [2] the withheld material satisf[ies] the criteria of the exemption statute." Fitzgibbon v. C.I.A., 911 F.2d 755, 761 (D.C. Cir. 1990) (citing C.I.A. v. Sims, 471 U.S. 159, 167 (1985)). The Government withheld documents under Exemption 3 based on two statutes: 18 U.S.C. 798 ("Section 798u) and Section 6 of the § National Security Agency Act of 1959, Pub. L. No. 86-36, 73 Stat. 64 (codified at 50 U.S.C. § 25. "that Section While EPIC concedes 3605) Section 798 are Exemption 3 Pl.'s Mot. Exemption at 3 12, test, satisfied because thus EPIC ("Section 6"). DHS's Mot. at 24- 6 . [of the NSA Act] for the purposes of FOIA," satisfying contends the Government that has the the not first prong of the is not demonstrated how the second prong statutes apply to nondisclosure. Section 798 prohibits disclosure: [O]f any classified information concerning the communication [of] intelligence activities of the United States or any foreign government . . [or] obtained by . the processes of communication intelligence from the communications of any foreign government . . . . 18 u.s.c. § and 798. -22- EPIC's sole argument for why the Government's withholding of information under Section 798 was improper is based on its prior contention that the Government has not shown that Sherman has original classification authority and therefore the documents are not properly classified. Thus, EPIC outside the scope of Exemption 3. argues, the documents are Pl.'s Mot at 12-13. Since the Court has found that the Government met its burden to show that Sherman has such authority, this argument is not persuasive. Section 6 of the NSA Act of 1939 requires information related to NSA functions or activities be precluded from release, stating in relevant part that: [N]othing in this [Act] or any other law . . shall be construed to require the disclosure of the organization or any function of the National Security Agency, of any information with respect to the activities thereof, or of the names, titles, salaries, or number of the persons employed by such agency. 50 U.S. C. § 3605. EPIC contends that documents withheld under Section 6 are not related solely to NSA functions or activities, and thus do not satisfy the criteria of S.ection 6. Pl.' s Mot. at 13; Pl.' s Reply at 10. If Section 6, which is the underlying exemption statute, is not applicable, then Exemption 3 is also not applicable. index are EPIC argues that the statements made in the Vaughn insufficient to justify nondisclosure of information under Exemption 3. Pl.'s Mot. at 13. -23- However, the Government contends that "[t] he redactions of information made activities, DHS on relating information by to the such information as behalf of Agency's handling " DHS's Mot. NSA consists internal instructions at 26. of processes, for and classified The Government provided many examples of why application of Exemption 3 is appropriate. It also provided documents some themselves examples plainly of showed unredacted text they related were where to the NSA activities. See DHS's Reply at B. Thus, the Court concludes that DHS has provided sufficient details justifying application of Exemption 3 and the information was properly withheld under Section 6 and Section 798. 3. FOIA Exemption 4 FOIA Exemption 4 precludes an agBncy from disclosing certain commercial information when the following three requirements are met : it is " [ 1 ] obtained from a U.S.C. § commercial or financial information person and [ 3] [2] pri vilegBd or confidential." 552(b) (4); see also Pub. Citizen Health Research Group 5 Food & Drug Admin., 704 F.2d 1280, 1290 (D.C. Cir. 1983); COMPTEL v. FCC, 910 F. Supp. 2d 100, 114-115 (D.D.C. 2012). EPIC contends that the Government improperly redacted and withheld the identities of companies who participated in the DIB -24- Cyber Pilot under Exemption 46 because the company names are not commercial information, were not obtained from a person, and are not confidential. Pl.'s Mot. at 15. The Government maintains that it has proven that the identities of participating companies are properly withheld. a. Commercial or Financial Information The first element of Exemption 4 requires that the information sought § to be 552 (b) ( 4) • ordinary this withheld "The terms meanings, exemption if, be in Exemption and in commercial or are 4 information and of itself, financial is it to be in nature. given commercial serves a their under commercial function or is of a commercial nature. Nat'l Ass'n of Home Builders v. Norton, 309 F.3d 26, 38 (D.C. Cir. 2002). While commercial information is broadly interpreted "include any information in which the submitter has a interest,' such as business sales statistics, to 'commercial research data, overhead and operating costs, and financial conditions," it is not all encompassing. COMPTEL, 910 F. Supp. 2d at 115 (internal citations omitted) . Information may be deemed commercial "even if the provider's [] interest in gathering, processing, and reporting the information is noncommercial." Critical Mass Energy Project v. 6 EPIC also challenges the Government's assertion of Exemption 7(D) to withhold the same information. Pl.'s Mot. at 24. That argument is addressed later in this section. -25- Nuclear Regulatory Comm'n, 830 F.2d 278, 281 (D.C. Cir. 1987) ("Critical Mass I"), vacated on other grounds, 975 F.2d B71 (D.C. Cir. 1992) (en bane). EPIC contends that the identities of companies participating in the DIB Cyber Pilot are not commercial because a company's name cannot be information in which a company would have a commercial interest. Pl.'s Mot. at 15. EPIC cites Hodes v. United States Dept. of Hous. And Urban Dev., 532 F. Supp. 2d 108 (D.D.C. 2008) for the proposition that "identities of corporations [are] not exempt from disclosure under Exemption 4." Pl.'s Mot. at 17. The Hodes court was not stating a bright line rule, but rather noted in dicta that if corporations preferred to be anonymous, they could take steps to_protect their own identities. Hodes, 532 F. Supp. 2d at 118. While the issue of disclosure of corporate identities in this case arises in companies an entirely different nonetheless have taken context than affirmative in Hodes, steps to these protect their identities by using confidentiality agreements. The Government argues, and the Court agrees, that while a company may not always have a commercial interest in its name and identity, the Court may also consider the context in which the issue arises. The identities of which companies have participated in the DIB Cyber Pilot, if disclosed, could have a commercial or financial impact on the companies involved. DHS's Mot. at 24. The companies are commercial enterprises -26- doing business with the Government and the reason they seek piotection from having their participation disclosed is because of the potential effect that disclosure would have on their businesses. Id. Consequently, the Court concludes that the names of participants in the DIB Cyber Pilot are correctly considered commercial information in this particular context; b. Obtained From a Person Information is considered "obtained from a information originated from an individual, entity, the person" if the corporation, or other and so long as the information did not originate within federal government. Additionally, government, even it is if Bd. of information protected if 627 Trade, the F. 2d within originated information at 404. the "summarize [s] information obtained from another person." COMPTEL, 910 F. Supp. 2d at 115 (citing Gulf & W. Indus. v. United States, 615 F.2d 527, 529-30 (D.C. Cir. 1979)). EPIC contends that the identities of the companies were improperly withheld because many of participating redacted documents appear to be email correspondence between DHS staff, and thus, EPIC argues the information could not possibly have been obtained from a person. Pl.'s Mot. at 16. EPIC is correct that inter-agency emails generally cannot be "obtained from a person." See Id. However, the information redacted from the emails in this case was the underlying identities of the participating companies -27- in the DIB Cyber Pilot. Declaration of Mark H. Herrington ("Herrington Deel.") '.II 10 [ Dkt. No. 53-5] . While those companies' identities may have been discussed between OHS employees in email conversations, the information originated with the corporations which provided their identities to OHS in order to participate in the program. c. Our Court Privileged or Confidential of Appeals, sitting en bane, has distinguished between tests of confidentiality under Exemption 4 based on whether the information was submitted to the government voluntarily or involuntarily. See Critical Mass III, 975 F.2d at 874. Thus, evaluating whether information responsive to a in FOIA request is confidential, it must first be determined whether the information was provided voluntarily or involuntarily. 7 The test for voluntarily submitted information was first adopted by our Court of Appeals in Critical Mass III in 1992. See 975 F.2d 871. information Exemption 4 The subject when Court to the a ruled FOIA that request information "is voluntarily is of submitted confidential a kind that under would customarily not be released to the public by the person from whom 7 Initially and without providing any case support, EPIC states that before the Court can address confidentiality, information must be established to be "private" because OHS characterized the information as "private information." Pl.'s Mot. at 1819. However, no authority has been cited to support this statement. -28- it was obtained." Id. at 879; see also Baker & Hostetler LLP v. United States DOC, Mass III, 473 F.3d 312, 320 (D.C. Cir. 2006). Critical 975 F.2d at 879. Moreover, "[t]he court will generally defer to the agency's predictive judgments as to the repercussions of disclosure." Jurewicz v. U.S. Dep't of Agric., 741 F.3d 1326, 1331 (D.C. Cir. 2014) 601 F.3d 557, 563 (citing United Techs. Corp. v. Dep't of Def., (D.C. Cir. 2010)) (internal quotation marks omitted) . The Government explains that companies participating in the DIB Cyber Pilot information to did the so on a voluntary Government basis voluntarily, and but provided with the understanding that company identities would be kept confidential. See Herrington Deel. 5, 7. Companies voluntarily participated in the DIB Cyber Pilot to allow OHS to help the companies better protect information systems and enhance their cybersecurity. Holzer Deel. 3-7. Information Officer their own See Second Participating companies and the DoD Chief signed a confidentiality agreement stating that the Government would take measures to protect the identities of the participating companies. DHS's Mot. at 25. EPIC's attempt to distinguish volunteering in the DIB Cyber Pilot from volunteering one's identity is unsuccessful. The very act of participating in the program included the act by which companies volunteered their identity to the government. -29- In Critical Mass III, a FOIA requester sought nuclear safety reports that were voluntarily provided by a nonprofit corporation to a federal government agency confidentiality and nondisclosure. denied the request "confidential after commercial under agreement an 97 5 F. 2d at determining the 8 7 4. of The agency information was protected from information disclosure by Exemption 4," in part because it was disclosed to third parties only upon consent from the nonprofit. Id.; see also Critical Mass I, 830 F.2d at 280 (earlier proceeding explaining the circumstances of the request) . The Court of Appeals agreed with the agency that the information was submitted voluntarily and would not ordinarily be disclosed to the public. III, Critical Mass 975 F.2d at 880. Therefore, it was confidential information and met the requirement for application of Exemption 4. Id. The Court in Critical Mass III considered the parties' nondisclosure agr.eements when determining whether the inf.ormation was confidential and of the sort not customarily released to the public. 975 F.2d at 880; see also Critical Mass I, 830 F.2d at 282. While such agreements are not sufficient in and of themselves to establish confidentiality under Exemption 4, Green v. Department of Commerce, 489 F. Supp. 977, 980 (D.D.C. 1980), they are useful to the Court in evaluating whether intent existed to shield the information from the public. Here, the confidentiality -30- agreements clearly reflect the desire of the companies to shield their identities as participants in the program. In addition, as the Herrington Deel. explains, the need to keep the information confidential is essential because: If a company's participation in the DIB Cyber Pilot were publicly known, that company could face increased cyber targeting, exposing the company to greater business or financial loss [and] participation . . . could be viewed as an admission of cyber vulnerability; a company could face competitive disadvantages or market loss if its participation were revealed. Herrington Deel. 10. The Government further explains that, to encourage participation from companies in the DIB Cyber Pilot and similar programs in the future, the companies need to be assured that their participation will be confidential and not revealed to the public. See Id. 11; cf. Critical Mass III, 975 F.2d at 874 (considering impairment to agency's ability to acquire information in the future if agency not permitted to honor confidentiality commitment). EPIC makes a number of additional unpersuasive arguments. 8 For instance, EPIC states that 8 because defense contracting For example, EPIC argues that allowing the names of any and all companies to be considered confidential under Exemption 4 "would create a black hole for all access requests concerning business records in the possession of a federal agency." Pl.'s Mot. at 22. Whether identities of companies are released in record requests. in the future will turn on the actual circumstances invol v-ed, and thus a finding of confidentiality here will not leave any "black hole" in its wake. -31- companies have preexisting, DHS, publically known relationships with and because only defense contracting companies could have participated in the DIB Cyber Pilot, the identities of the participating companies are already publically known. Pl.'s Reply at 11 n.2. If this were true, seeking the information. it is not clear why EPIC is still In any event, in invoking Exemption 4, the identities of which companies participated in this particular program is at issue, not whether the companies are publically known in other endeavors. In considering the parties' confidentiality agreements, the potential consequences of the information becoming public, and the government's need for future cooperation from the companies, the Court concludes that the identities of the companies would not ordinarily be released to the public and are confidential. Thus, DHS has met its burden of showing why Exemption 4 applies to the identities of participants in the DIB Cyber Pilot program. 4. FOIA Exemption 5 FOIA Exemption 5 protects from disclosure "inter-agency or intra-agency memorandums or letters which would not be available by law to a party other than an agency in litigation with the agency." 5 U.S.C. § 552(b) (5). Courts have construed this language to exempt "those documents [,] normally privileged in the civil discovery context," including those protected by the attorney work product and attorney client privileges. NLRB v. Sears, Roebuck & -32- Co;, 421 U.S. 132, 149 (1975); see also Coastal States Gas Corp. v. Department of Energy, 617 F.2d 854, 862 (D.C. Cir. 1980); Martin v. Dep't of Justice, 488 F.3d 446, 455 (D.C. Cir. 2007). In addition, "[t]he privilege . . . extends to all situations in which an attorney's counsel is sought on a legal matter." Coastal States, 617 F.2d at 862. Therefore, "it is clear that an agency can be a "client" and agency lawyers can function as "attorneys" within the relationship contemplated by the privilege" Id. at 863. EPIC contends that the Government did not meet its burden of proving that a redacted portion of one particular document produced by the Government - Document 276 - was a privileged attorney- client communication. See Pl.'s Reply at 12-13. The government points out that the document consisted of a string of emails, virtually all of which the Government does not object to releasing. However, the particular portion redacted by the Government contains a communication between a DHS employee and a DHS attorney seeking legal review and advice. See Third Holzer Deel. <[ 10. Thus, there is no question that the redaction was properly exempted under the attorney-client privilege prong of Exemption 5. 5. FOIA FOIA Exemption 7(0) Exemption 7(D) precludes disclosure documents, records or information that has been: -33- of responsive compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information (D) could reasonably be expected to disclose the identity of a confidential source, including . . any private institution which furnished information on a confidential basis, and, in the case of a record or information compiled . . . by an agency conducting a lawful national security intelligence investigation, information furnished by a confidential source. 5 u.s.c.' 552 (b) (7). § Information withheld under Exemption 7 must "first meet a threshold requirement: that the records were compiled for law enforcement purposes." Elec. Privacy Info. Ctr. v. U.S. Dep't of Homeland Sec., 777 F.3d 518, 522-23 (D.C. Cir. 2015) (citing Pub. Employees for Env't Responsibility v. United States Section, Int'l Boundary & Water Comm'n, U.S.-Mexico, Cir. 2014)) that the 740 F.3d 195, 202-03 (internal quotation marks omitted) . information withheld by DHS was (D.C. It is undisputed compiled for law enforcement purposes and meets the threshold requirement. Part (D) of Exemption 7 requires that the information must come from a "confidential source." 5 U.S.C. § 552 (b) (7) (D). "Giving the word "source" its plain and ordinary meaning, it would appear simply to refer to the originator of information, encompassing within its scope nonfederal entities such as state, and foreign law enforcement agencies as well as individuals such as private citizens and paid informants." Lesar v. U.S. Dep' t of Justice, 636 F.2d 412, 489 (D.C. Cir. 1980); see also Black's Law -34- Dictionary 1522 (9th ed. 2009) (defining source as "[t]he originator or primary agent of an act, circumstance, or result"). A source's confidentiality is determined on a case-by-case basis. U.S. (1993). Dep't of Justice v. Landano, 508 U.S. 165, 179-80 There is no "presumption that a source is confidential within the meaning of Exemption 7(D) whenever the source provides information to criminal [a law enforcement investigation." Id. at agency] 181. in Rather, the course "[a] confidential within the meaning of Exemption 7(D) of a source is if the source provided information under an express assurance of confidentiality or in circumstances from which such an assurance could reasonably be inferred." Williams v. 1995) F.B.I., 69 F.3d 1155, 1159 (D.C. Cir. (quoting Landano, 508 U.S. at 172). DHS has withheld the identities of companies participating in .DIB under Exemption 7 (D), sources and provided understanding of stating that information under confidentiality. the an EPIC companies express acted as or implied challenges these withholdings, arguing that DHS improperly regards participants in DHS's program as "sources." Pl.'s Mot. at 25-26. It does not dispute that any information provided by particip.ating companies to the government was given under assurances of confidentiality, nor does it allege that a source loses its "source" status under Exemption 7 when the government information." Pl.'s Reply at 16. -35- provides the source with The crux of EPIC's challenge is whether every participating company in the DIB Cyber Pilot actually provided information to the government, Government. For in addition purposes to of receiving Exemption information 7(D), from sources the include participating companies who have provided records or information under a promise of confidentiality. Companies that merely receive information but do not provide any information would not qualify for protection under Exemption 7(D). EPIC contends that DHS improperly withheld ". records documenting exchanges of information between DIB participants and the government." Pl.'s Mot. at 26 (emphasis added). states, "[tJhe main flow of information was EPIC further not from DIB participants to the government, but from the government to the participants 27. II Id. at Under EPIC' s theory, the Government was the "source" of information to the companies--not the other way around. Here, in most instances where Exemption 7(D) has been invoked in the Vaughn Index, the Government refers to the participating companies as "sources," without sufficiently explaining why the companies are sources. For example, in many Vaughn index entries asserting a 7 (D) exemption, the Government states that "[t] he participating companies volunteered with an express promise of confidentiality and are thus confidential sources enforcement information." See, e.g., Vaughn index at 12. -36- of law While the express promise of confidentiality is relevant, DHS has not contended that the companies provided any information pursuant to that promise. Nor has DHS shown that mere participation in the DIB Cyber Pilot program turns each company into a "source" of information for purposes of Exemption 7(D). DHS's other Exemption 7(D) explanations fare no better, merely stating that the document "could reasonably be expected to disclose the identity of a confidential source." See e.g., id. at Although the Government's reference to the companies as 209-11. "sources" arguably information, the implies Court is that not companies the willing to provided rely on such a weak assumption. Therefore, the Vaughn index alone is not sufficiently detailed to justify withholding under Exemption 7{D). For these reasons, the Court finds that the Government has failed to carry its burden to show that every participating company provided information to the Government. If in fact there are some companies that merely receive, through the program, Thus, between them. the but do not provide, Government has failed to information distinguish the Government's application of Exemption 7{D) is not justified. IV. CONCLUSION For the foregoing reasons, Plaintiffs' Motion for Summary Judgment shall be denied without prejudice with regard to Exemption 7D and otherwise denied in whole, and the Government's Motion for -37- Summary Judgment shall without prejudice. Summary Judgment The with be granted Government respect to in part and denied prevails the on its adequacy of performed and its withholding under FOIA Exemptions 1, 5. However, in part Motion the 3, for search 4, and the Government has failed to meet its burden under FOIA Exemption 7(0). The Government shall have an opportunity to file a revised Vaughn Index, and therefore Plaintiff's Motion shall be denied without prejudice with respect to that Exemption. An Order shall accompany this Memorandum Opinion. 9 August 4, 2015 Copies to: attorneys on record via ECF 9 The Court greatly regrets the delay in ruling on this Motion. Sometimes, Judges have no excuse to offer and this is one of those times. -38-
]]>
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You
should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google
Privacy Policy and
Terms of Service apply.
