Electronic Privacy Information Center v. United States Department of Homeland Security

UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

ELECTRONIC PRIVACY

INFORMATION CENTER

Plaintiff,

v. Civil Action No. 12-0333 (GK)

THE UNITED STATES DEPARTMENT

OF HOMELAND SECURITY

Defendant.

MEMORANDUM OPINION

Plaintiff Electronic Privacy Information Center ("Plaintiff"

or "EPIC") brings this action against Defendant the United States

Department of Homeland Security ("the Government" or "OHS") under

the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552. Plaintiff

seeks records concerning the Defense Industrial Base Cyber Pilot

("DIB Cyber Pilot"), a cyber-security pilot program jointly

conducted by the United Stat.es Department of Defense ("DoD") and

Defendant OHS. Government's Motion for Summary Judgment ("DHS' s

Mot.") at 2 [Dkt. No. 53].

The program, which "aim[ed] . to protect U.S. critical

infrastructure [,] [and] furnished classified thr.eat and

technical information to voluntarily participating [] companies or

their Commercial Service Providers[]." Id. EPIC, citing concerns

from the Department of Justice about the program "[running] afoul

-1-

of laws forbidding government surveillance of private Internet

traffic [,] . . sought records to determine whether . . the DIB

Cyber Pilot program complied with federal wiretap laws."

Plaintiff's Combined Opposition to Defendant's Motion for Summary

Judgment and Cross-Motion for Summary Judgment ("Pl.'s Mot.") at

2 [Dkt. No. 57].

OHS conducted a search for records responsive to EPIC' s

request, produced documents to EPIC, and provided a Vaughn index

for all documents that were withheld in full or in part under one

of FOIA' s several exemptions. § 552 (b); see also Defendant's Vaughn

Index for Challenged Withholdings ("Vaughn index") [Dkt. No.

53-4] . EPIC now challeng-es the sufficiency of the search conducted

by OHS, as well as the Government's application of FOIA Exemptions

1, 3, 4, 5, and 7(0) to withhold certain responsive information.

Upon consideration of the Motions, Oppositions, Replies, the

entire record herein, and for the reasons stated below, Plaintiffs'

Motion for Summary Judgment shall be denied without prejudice with

regard to Exemption 70 and otherwise denied in whole, and the

Government's Motion for Summary Judgment shall be granted in part

and denied in part without prejudice.

-2-

I . BACKGROUND

A. FOIA

The Freedom of Information Act ("FOIA"), 5 U.S.C § 552, was

enacted by Congress "to ensure an informed citizenry, vital to the

functioning of a democratic society." Critical Mass Energy Project

v. Nuclear Regulatory Comm'n, 975 F.2d 871, 872 (D.C. Cir. 1992)

("Critical Mass III"), cert. denied, 507 U.S. 984 (1993) (citing

FBI v. Abramson, 456 U.S. 615, 621 (1982)). "In enacting FOIA,

Congress struck the balance it thought right--generally favoring

disclosure, subject only to a handful of specified exemptions--

and did so across the length and breadth of the Federal

Government." Milner v. Dep't of the Navy, 562 U.S. 562, 571 n.5

(2011). FOIA's "basic purpose reflect[s] a general philosophy of

full agency disclosure unless information is exempted under

clearly delineated statutory language." Dep't of the Air Force v.

Rose, 425 U.S. 352, 360-361 (1976) (internal citations and

quotation marks omitted) .

When an ag-ency receives a request for records, the agency

must conduct a sufficient search within the scope of the request,

5 U.S.C. § 552_(a) (3) (A). The agency then must furnish the

information in a timely manner, unless the information is precluded

from disclosure by one of FOIA's nine exemptions. § 552(b). FOIA's

"goal is broad disclosure, [thus] the exemptions must be given a

narrow compass." Milner, 562 U.S. at 563 (citing United States

-3-

Oep't of Justice v. Tax Analysts, 492 U.S. 136, 151 (1989)). The

Government always bears the burden of proving exemptions apply for

any responsive information that is withheld.§ 552(a) (4) (B).

B. Factual Background

1. EPIC's FOIA Request

On July 26, 2011, EPIC submitted a FOIA request for documents

to OHS, as well as requests for news media fee status and a fee

waiver. Pl.'s Mot. at 2; OHS's Mot. at 2. EPIC's FOIA request was

for records related to the OIB Cyber Pilot program "to monitor

Internet traffic flowing through certain Internet Service

Providers ("ISPs") from Internet users to a select number of

defense contractors." ,Pl.' s Mot. at 2. Specifically, EPIC' s

request was for all information in the following categories:

1. All contracts and communications with Lockheed

Martin, CSC, SAIC, Northrop Grumman or any other

defense contractors regarding the new NSA [National

Security Agency] pilot program;

2. All contracts and communications with AT&T, Verizon

and CenturyLink or any other [ISPs] regarding the new

NSA pilot program;

3. All analyses, legal memoranda, and related ·records

regarding the new NSA pilot program;

4. Any memoranda of understanding between NSA and OHS or

any other government agencies or corporations

regarding the new NSA pilot program;

5. Any privacy impact assessment performed as part of

the development of the new NSA pilot program.

Id. at 2-3.

-4-

On August 3, 2011, DHS sent a letter to EPIC acknowledging

receipt of the FOIA request, notifying EPIC that no responsive

documents had been found for category 5, and indicating that it

had referred the request to the DHS National Protection and

Programs Directorate ("NPPD"). Pl.'s Mot at 3; DHS's Mot. at 2.

Despite deadlines imposed by FOIA, 5 U.S.C. § 552 (a) (6) (A), DHS

did not produce the requested documents or contact EPIC again for

five months. Pl.'s Mot. at 3. On January 5, 2012, 1 EPIC faxed an

administrative appeal to NPPD's FOIA Office, appealing NPPD's non-

responsiveness regarding categories 1-4 of EPIC' s FOIA Request. 2

Id. On January 23, 2012, a FOIA Specialist from NPPD contacted

EPIC by telephone regarding the status of the FOIA request and

informed EPIC that DHS was processing it. DHS's Mot. at 3. On March

1, 2012, EPIC filed this Complaint for Injunctive Relief

("Complaint") [Dkt. No. l], and the Government filed its Answer on

May 1, 2012 [Dkt. No. 7].

On August 31, 2012, EPIC narrowed its FOIA request, in part

to exclude draft documents, and specifically requested:

1 In Pl.' s Mot. and the Declaration of Amie Stepanovich [Dkt.

No. 18-1], the date is listed as January 5, 2011. However, DHS's

Mot. and additional materials in the r-e-cord indicate the correct

date is January 5, 2012.

2 Defendant disputes whether this constituted an administrative

appeal, but whether it did or did not does not affect the

Court's final ruling. DHS's Mot. at 3.

-5-

1. All contracts and communications with Lockheed

Martin, CSC, SAIC, Northrop Grumman or any other

defense contractors regarding the DIB Cyber Pilot;

2. All contracts and communications with AT&T, Verizon

and CenturyLink or any other [ISPs] regarding the DIB

Cyber Pilot;

3. All legal and technical analyses, including legal

memoranda, regarding the DIB Cyber Pilot;

4. Any memoranda of understanding between NSA and DHS or

any other government agencies or corporations

regarding the DIB Cyber Pilot.

Pl.' s Mot. at 4.

2. The Government's Search for Responsive Documents

In conducting its search for responsive records, DHS assigned

EPIC's FOIA request to NPPD. Second Holzer Deel. ~ 9. NPPD's FOIA

Office ("NPPD FOIA") began to process the request by "tasking out

the search" to subcomponents likely to have responsive records,

the Office of Cybersecurity and Communications ("CS&C"). Id. ~~

11, 29. NPPD also provided the DHS Office of General Counsel and

the Office for Selective Acquisitions with EPIC' s FOIA request

because those offices had been involved in supporting the DIB Cyber

Pilot and might have had responsive records. Id. ~ 16. NPPD did

not search other offices or department components because it

determined that those off ices and department components were not

likely to have any connection to the DIB Cyber Pilot. Id. ~ 17.

-6-

NPPD FOIA met with "subject matter experts" in the agency who

had been involved with the DIB Cyber Pilot to determine which sub-

of fices would likely have responsive records. Id. i 15. NPPD FOIA

and the subject matter experts created keyword search terms to be

used in electronic searches for responsive documents. Id. i 18.

The keyword search terms were provided to the identified offices,

where each employee was instructed to conduct searches using the

keywords and their own personal "knowledge of how and where they

stored their own documents . ." Id. i 19.

NPPD FOIA worked with the identified off ices to determine

which employees were involved with the DIB Cyber Pilot. Id. i i 22-

23. Each office and employee were instructed to conduct a search

for responsive documents. ~at i i 18-19. The -employees who were

involved with the DIB Cyber Pilot then searched electronic and

hard copies of their office and personal fiL~s. A search of the

classified network was also conducted. Id. i i 18-19, 2~-27, 29-

32.

Staff in one of the identified offices - the NPPD Office of

the Undersecretary ( "OUS") searched a database of taskings:

records of which employees were tasked with various assignments

and the files associated with those assignments. Id. at i i 22-23.

OUS used the database to further identify all staff who· may have

been involved with the DIB Cyber Pilot. Id.

-7-

Staff in the NPPO Privacy Office and the CS&C, along with

CS&C's subcomponents, searched electronic and hard copies of their

personal files. Id. at~~ 26-27, 29-32. Employees in those offices

conducted a further search of the classified network. Id. The OHS

Office of the General Counsel ("OGC") identified two attorneys who

would potentially have responsive documents and had them conduct

extensive manual and electronic searches of their computers and

files relating to the OIB Cyber Pilot. Id. at ~~ 33-38.

Staff in the Office of the Chief Procurement Officer ("OCPO"),

responsible for contracting for NPPO and other offices, and the

Office of Selective Acquisitions, an OCPO subcomponent which

handles classified and sensitive contracts, did similar searches

and located potentially responsive documents which were turned

over to the OHS Privacy Office for further processing. Id. at ~~

39-42. OHS did not search the various other offices within the

agency that had no involvement with the DIB Cyber Pilot. Id. ~ 17.

OHS' s searches initially resulted in approximately 16, 000

pages of potentially responsive documents. Id. ~ 43. That number

were reduGed to roughly 10, 000 pages after initial review by a

team of FOIA specialists and attorneys who spent several weeks

reviewing the documents, removing duplicates, and removing

documents that were clearly non-responsive. Id. The agency then

took a "page-by-page and line-by-line" approach to determine if

the documents were in fact responsive and whether any of FOIA's

-8-

exemptions applied to a part or the entirety of each document. Id.

<JI 44.

On April 15, 2013, DHS produced 1, 276 pages of responsive

documents to EPIC; 117 pages of those records were released in

their entirety and the remaining 1,159 pages were partially

redacted pursuant to FOIA exemptions. Id. <JI 46. On June 15, 2013,

DHS provided a partial preliminary Vaughn Index, and on June 22,

2013, DHS provided the remaining preliminary Vaughn Index. Pl.'s

Mot. at 6; see also Vaughn v. Rosen, 523 F.2d 1136 (D.C. Cir.

1975).

After receiving the documents, EPIC noticed that several

emails referenced attachments that EPIC believed were not included

in the DHS production. DHS's Mot. at 6. On June 20, 2015, EPIC

responded to DHS's initial production of documents with a list of

17 examples of documents that EPIC believed were missing from the

production. Second Holzer Deel. <JI 47; Pl.'s Mot. at 8.

DHS analyzed the specific documents referenced by EPIC and

found that 13 documents had been properly identified as non-

responsive, one responsive document had been inadvertently

identified as non-responsive, and three documents had been

inadvertently excluded. Second Holzer Deel. <JI 48. DHS produced the

four additional documents to EPIC on August ln, 2013. Id. <JI<JI 48-

49. In total, DHS has produced 1,386 pages of documents, some

released in full and some redacted, and withheld 362 pag.es of

-9-

documents in full under several of FOIA's exemptions. Id. ~ 50;

DHS's Mot. at 1; see also 5 U.S.C. § 552(b).

C. Procedural Background

On August 30, 2013, DHS filed its Motion for Summary Judgment.

On September 27, 2013, EPIC filed its combined Opposition to the

Government's Motion and Cross-Motion for Summary Judgment. On

November 4, 2013, the Government filed its Combined Opposition to

Plaintiff's Motion for Summary Judgment and Reply in Further

Support of Defendant's Motion for Summary Judgment ("DHS's Reply")

[Dkt. No. 61]. Finally, on November 25, 2013, Plaintiff filed its

Reply in Further Support of Plaintiff's Motion for Summary Judgment

("Pl.' s Reply") [Dkt. No. 63].

EPIC challenges the adequacy of the search performed by DHS

in response to its FOIA request, Pl.'s Mot. at 6, and also contends

that the Government improperly redacted and withheld many

documents under FOIA Exemptions 1, 3, 4, 5, and 7(D). Pl.'s Mot.

at 15, 24.

II. STANDARD OF REVIEW

A. Summary Judgment

Summary judgment should be granted only if the moving party

has shown that there is no genuine dispute of material fact and

that the moving party is entitled to judgment as a matter of law.

See Fed. R. Civ. P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317,

325 (1986); Waterhouse v. Dist. of Columbia, 298 F.3d 989, 991

-10-

( D. C. Cir. 2002) . "A fact is material if it 'might affect the

outcome of the suit under the governing law,' and a dispute about

a material fact is genuine 'if the evidence is such that a

reasonable jury could return a verdict for the nonmoving party.'"

Steele v. Schafer, 535 F.3d 689, 692 (D.C. Cir. 2008) (quoting

Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986)). "The

court must draw all reasonable inferences in favor of the nonmoving

party, and it may not make credibility determinations or weigh the

evidence." Reeves v. Sanderson Plumbing Prods., Inc., 530 U.S.

133, 150 (2000).

"To prevail on summary judgment [against a FOIA chall-enge],

the defending 'agency must show beyond material doubt []that it

has conducted a search reasonably calculated to uncover all

relevant documents.'" Morley v. C.I.A., 508 F.3d 1108, 1114 (D.C.

Cir. 2007) (quoting Weisberg v. U.S. Dep't of Justice, 705 F.2d

1344, 1351 (D.C. Cir. 1983)). "Summary judgment may be based on

affidavit, if the declaration sets forth sufficiently detailed

information 'for a court to determine if the search was adequate.'"

Students Against Genocide v. Dep' t of State, 257 F. 3d 828, 838

(D.C. Cir. 2001) (quoting Nation Magazine v. U.S. Customs Serv.,

71 F.3d 885, 890 (D.C. Cir. 1995)).

If an agency denies disclosure of responsive records, either

in whole or in part, based upon FOIA exemptions, it then "bears

the burden of proving the applicability of claimed exemptions." Am.

-11-

Civil Liberties Union v. U.S. Dep' t of Def., 62 8 F. 3d 612, 619

(D.C. Cir. 2011). "The government may satisfy its burden . by

submitting appropriate declarations and, where necessary, an index

of the information withheld [ (known as a "Vaughn index") ] . " Am.

Immigration Lawyers Ass'n v. U.S. Dep't of Homeland Sec., 852 F.

Supp. 2d 66, 72 (D.D.C. 2012) (citing Vaughn v. Rosen, 484 F.2d

820, 827-28 (D.C. Cir. 1973)).

There is no set formula for a Vaughn index or declarations,

but they must "provide[] a relatively detailed justification [for

any nondisclosure], specifically identif [y] the reasons why a

particular exemption is relevant and correlat[e] those claims with

the particular part of a withheld document to which they apply."

Judicial Watch, Inc. v. Food & Drug Admin., 449 F.3d 141, 146 (D.C.

Cir. 2006) (quoting Mead Data Cent., Inc. v. Dep't of the Air

Force, 566 F.2d 242, 251 (D.C. Cir. 1977)). But, "exemptions from

disclosure must be narrowly construed and conclusory and

generalized allegations of exemptions are unacceptable." Morley,

508 F.3d at 1114-15 (internal quotation marks and citations

omitted).

III. ANALYSIS

A. Sufficiency of the Search Conducted by OHS

I

EPIC contends that DHS did not conduct a sufficient search

for responsive documents because DHS failed to re-evaluate the

sufficiency of its search in light of examples of missing -email

-12-

attachments discovered by EPIC after DHS's initial production. See

Pl.'s Mot. at 8. EPIC believes there may be additional responsive

documents and, subsequent to DHS's supplemental production,

created an exhaustive list of every document referenced in the

emails that are potentially missing. Id.; Third Declaration of

Amie Stepanovich ~ 19 [Dkt. No. 57-4].

OHS argues that EPIC relies on a mistaken belief that many or

most of the "missing" documents EPIC references are responsive to

the FOIA request but were overlooked in the initial search. DHS's

Reply at 3. OHS states that the documents referenced by EPIC are

simply non-responsive which would explain why they were not

included in the OHS production. Id. at 5. OHS provided a chart

examining a sample of the documents cited by EPIC as po~entially

missing, indicating that many of the documents were already

released to EPIC, some documents were duplicates of documents that

had been released or withheld, and other documents were withheld

under a FOIA exemption and listed on the Vaughn index. DHS's Reply

at 4; Third Declaration of James V.M.L. Holzer ("Third Holzer

Deel.") ~ 5 [Dkt. No. 61-1]; Chart of Documents Referenced in

Plaintiff's Exhibit 4 [Dkt. No. 61-2].

EPIC nonetheless still contends that OHS should have

conducted a thorough additional search of email attachments in

light of the additional documents produced, and therefore, its

search is insufficient. Pl.'s Reply at 5.

-13-

"The court applies a 'reasonableness' test to determine the

'adequacy' of a search methodology, consistent with congressional

intent tilting the scale in favor of disclosure." Morley, 508 F.3d

at 1114 (internal quotation marks and citation omitted) . To prevail

in a summary judgment motion, an agency is not required to search

every system possible, but must show that it made a good faith

effort that would be reasonably expected to produce all the

requested information. See Steinberg v. United States Dep' t of

Justice, 23 F.3d 548, 551 (D.C. Cir. 1994). Summary judgment for

an agency is inappropriate only if the agency's responses "raise

serious doubts as to the completeness of the search or are for

some other reason unsatisfactory " Perry v. Block, 684 F.2d

121, 127 (D.C. Cir. 1982).

While agencies have broad discretion in determining what

constitutes a reasonable search under FOIA requests, the

Government "must revise its assessment of what is "reasonable" in

a particular case to account for leads that emerge during its

inquiry . [and] the court evaluates the reasonableness of an

agency's search based on what the agency knew at its conclusion

rather than what the agency speculated at its inception." Campbell

v. United States Dep't of Justice, 164 F.3d 20, 28 (D.C. Cir.

1998). The revision requirement does not require an agency to

"examine virtually every document in its files, following an

interminable traii of cross-referenced documents" though, nor does

-14-

"mere reference to other files establish the existence of

documents that are relevant to [the] FOIA request." Steinberg, 23

F.3d at 552 (D.C. Cir. 1994).

In Steinberg, a FOIA requester brought suit challenging the

sufficiency of the search conducted by two agency subdivisions.

The second subdivision relied on an affidavit to demonstrate the

adequacy of its search, "[describing] with particularity the files

that were searched, the manner in which they were searched, and

the results of the search." Id. The requester contended that

several specific documents "cross-referenced in several of the

disclosed documents" had not been properly examined by the

subdivision. Id. Our Court of Appeals disagreed, finding that the

search had been adequate. Id. Several years later, our Court of

Appeals reaffirmed this holding, finding that the ag.ency would not

be required to search every record referenced in disclosed

documents in order to conduct a sufficient search. See Morley, 508

F.3d at 1121-22.

As discussed above, the Government has shown that the initial

search conducted by DHS in response to EPIC' s FOIA request was

meticulous, organized, and thorough. As was done in the affidavit

provided by the second subdivision in Steinberg, the Second Holzer

Declaration explains in great detail how the search was conducted,

which subdivisions and employees of DHS conducted the search, and

the results of the search. See supra, Section I.B.2.

-15-

While EPIC contends that OHS should have performed an

additional search after EPIC discovered the existence of cross-

referenced documents, Pl.'s Mot. at 8, our Court of Appeals has

·made clear that agencies do not need to examine every cross-

referenced document uncovered after an initial disclosure. See

Morley, 508 F.3d at 1121. Although it is true that some documents

were responsive, it was a very small number and in no way detracts

from the Government's extraordinary efforts in executing its

search. Although it is possible to envision circumstances in which

the numerosity of overlooked documents calls into question the

adequacy of the search, that is not the case here. EPIC has

identified a limited number of potentially responsive documents it

believes were overlooked, and OHS has sufficiently accounted for

why many (although not all) of the documents flagged by EPIC were

properly excluded.3 FOIA does not require OHS to track down every

cross-referenced document. The Government here has done a

commendable job in performing its search, and the Court concludes

that it has shown completion of a sufficient search to satisfy

FOIA.

3 OHS provided an additional affidavit, the Third Holzer Deel.,

and an additional chart to address EPIC's concern that documents

cross-referenced in emails produced from DHS's initial disclosure

had been overlooked.

-16-

B. Exemptions under FOIA

Next, EPIC argues that OHS improperly withheld and redacted

documents under various FOIA exemptions. The Court will consider

each exemption in turn.

1. FOIA Exemption 1

FOIA Exemption 1 precludes disclosure of documents that are

"(A) specifically authorized under criteria established by an

Executive order to be kept secret in the interest of national

defense or foreign policy and (B) are in fact properly classified

pursuant to such Executive order." 5 U.S.C. § 552 (b) (1).

OHS withheld information pursuant to FOIA Exemption 1 because

the documents related to the classified activities of the National

Security Agency ("NSA"). The Government has stated that "[t]he

information in question reveals capabilities and/or

vulnerabilities of systems relating to the national security,

specifically electronic networks used by the defense industrial

base sector." Se.cond Holzer Deel. CJI 56.

As with all of FOIA' s exemptions, the burden of proof li-es

with the Government to show proper application of Exemption 1.

5 U.S.C. § 552{a) (4) {B). The Court makes a presumption of good

faith on the behalf of agency affidavits purporting to meet the

Government's burden. Negley v. FBI, 169 F-ed. Appx. 591, 5.94 (D.C.

Cir. 200-6). Thus, "summary judgment may be granted on the basis of

agency affidavits if they contain reasonable specificity of detail

-17-

rather than merely conclusory statements, and if they are not

called into question by contradictory evidence in the record or by

evidence of agency bad faith." Halperin v. Central Intelligence

Agency, 629 F.2d 144, 148 (D.C. Cir. 1980)

It is undisputed that the requirements for classifying

information relevant to this request are contained in Executive

Order 13292, which was in effect from March 2003 until June 2010,

and Exe cu ti ve Order 1352 6, which went into partial effect on

December 29, 2009, and into full effect in June 2010. The parties

agree that the differences between the two Executive Orders do not

impact the Exemption 1 analysis in this case. See DHS's Mot. at

20; Pl-'s Mot. at 9, n.1.

Executive Order 13526 provides that information may be

classified if:

(1) an original classification authority is classifying

the information;

(2) the information is owned by, produced by or for, or

is under the control of the United States ·Government;

( 3) the information falls within one or more of the

categories of information listed in section 1.4 of this

order; and

( 4) the original classification authority determines

that the unauthorized disclosure of the information

reasonably could be expected to result in damage to the

national security, which includes defense against

transnational terrorism, and the original classification

authority is able to identify or describe the damage.

Exec. Order No. 13526, 75 FR 707, 707 (De-c. 29, 2009).

-18-

EPIC bases its Exemption 1 challenge exclusively on whether

DHS has sufficiently shown that David J. Sherman, Associate

Director for Policy and Records at the National Security Agency,

has original classification authority pursuant to the Executive

Orders. Without original classification authority, the withheld

documents could not be properly classified. Pl.'s Mot. at 10. EPIC

thus contends DHS could not properly invoke Exemption 1 as the

basis for withholding any information, because the Government did

not prove Sherman has original classification authority or that

the documents were properly classified.

The Government explained in the Second Holzer declaration

that Sherman, "who serves as a TOP SECRET ~lassification

authority[,] . determined that certain information {related to

the NSA] meets the criteria for classification and is . . .

properly classified . . in accordance with E. 0. 1352 6." Se-cond

Holzer Deel. ~ 55.

Neither party cites to any case directly addressing the issue

- possibly because the issue is rarely contested.

In Darui v. U.S. Dep't of State, 798 F. Supp. 2d 32, 40

(D.D.C. 2011), a FOIA requester did dispute an agency's application

of Exemption 1, and specifically challenged an agency official's

original classification authority based on an affidavit that

merely stated the official had such authority. The court found

that the agency official's declaration established that she was a

-19-

proper classifying authority, reasoning that the requester had

brought forth "no evidence to support [the] contentions that [the

official] lacks the authority to classify information, that [the

official] is perjuring herself in her declaration, or that she has

failed to comply with the Exe cu ti ve Order's requirements for

classification authority." Darui, 798 F. Supp. 2d at 40.

EPIC contends that the Second Holzer Declaration, which

states that Sherman has TOP SECRET classification authority, was

insufficient because it did not "offer any basis to support

[Holzer's] claim of [] Sherman's alleged classification

authority." Pl's Mot. at 11. EPIC argues that DHS needed to provide

a declaration by Sherman himself, or other (unspecified)

documentation of Sherman's authority status. Pl.'s Mot. at 10-11.

However, EPIC fails to provide support for why the Government's

documents are insufficient. 4 Pl.' s Mot. at 11. As in Darui, EPIC

does not allege that Sherman actually lacks original

classification authority, that either Holzer or Sherman's

4 EPIC argues that Holzer did not allege personal knowledge of

Sherman's classification authority and cites only to Weisberg v.

Dept. of Justice, 627 F.2d 365 (D.C. Cir. 1980). Pl.'s Mot. at 11.

In that case, a declarant did not assert personal knowl.edge over

whether evidence had been destroyed, but instead stated what he

believed likely occurred, and thus the Court found a "permi·ssible

inference [for summary judgment purposes] that [the

declarant] fwas] incorrect in his belief." Weisberg, 627 F. 2d at

369. However, in this case, the Holzer declaration clearly asserts

personal knowledge that "Sherman serves as a TOP SECRET

classification authority." Second Holzer Deel. <JI 55.

-20-

declarations are perjured, or that Sherman failed to comply with

the requirements for classification authority.s

In that case, the FOIA requester did not challenge Sherman's

classification authority, but rather challenged Exemption 1

withholdings on other grounds. Elec. Frontier Found v. Dep't of

Justice, No. 12 Civ. 1441 (D.D.C. 2014). The Court found~ without

any reference to Sherman, that Exemption 1 was properly applied.

As the Court gives a presumption of good faith to Mr.

Holzer's affidavit, and b€cause EPIC has provided no support for

its allegation that the d€clarations provided by DHS are

insufficient, the Court concludes that the Second Holzer

declaration, along with the Sherman declaration from another case,

are sufficient to establish that he is an authority on classified

materials who properly identified documents to be withheld under

the Executive Orders pursuant to Exemption 1.

2. FOIA Exemption 3

FOIA Exemption 3 precludes release of information that has

been:

specifically exempted from disclosure by [another]

statute [that] (i) requires that the matters be

withheld from the public in such a manner as to leave no

discretion on the issue; or (ii) establishes particular

5 Although it believes the Holzer Declaration to be sufficient,

the Government also provided a declaration by Sherman from a

different matter explaining his credentials as an original

classification authority. DHS's Exhibit E-2 ~~ 1-2 [Dkt. No. ·61-

31

-21-

criteria for withholding or refers to particular types

of matters to be withheld.

5 U.S.C. § 552(b) (3). In determining whether Exemption 3 properly

applies, the Court conducts a two-part test: whether " [ 1] the

statute in question [is] a statute of exemption as contemplated by

exemption 3 [and] [2] the withheld material satisf[ies] the

criteria of the exemption statute." Fitzgibbon v. C.I.A., 911 F.2d

755, 761 (D.C. Cir. 1990) (citing C.I.A. v. Sims, 471 U.S. 159,

167 (1985)).

The Government withheld documents under Exemption 3 based on

two statutes: 18 U.S.C. § 798 ("Section 798u) and Section 6 of the

National Security Agency Act of 1959, Pub. L. No. 86-36, 73 Stat.

64 (codified at 50 U.S.C. § 3605) ("Section 6"). DHS's Mot. at 24-

25. While EPIC concedes "that Section 6 . [of the NSA Act] and

Section 798 are Exemption 3 statut~s for the purposes of FOIA,"

Pl.'s Mot. at 12, thus satisfying the first prong of the

Exemption 3 test, EPIC contends that the second prong is not

satisfied because the Government has not demonstrated how the

statutes apply to nondisclosure.

Section 798 prohibits disclosure:

[O]f any classified information concerning the

communication [of] intelligence activities of the United

States or any foreign government . . [or] obtained by

. the processes of communication intelligence from the

communications of any foreign government . . . .

18 u.s.c. § 798.

-22-

EPIC's sole argument for why the Government's withholding of

information under Section 798 was improper is based on its prior

contention that the Government has not shown that Sherman has

original classification authority and therefore the documents are

not properly classified. Thus, EPIC argues, the documents are

outside the scope of Exemption 3. Pl.'s Mot at 12-13. Since the

Court has found that the Government met its burden to show that

Sherman has such authority, this argument is not persuasive.

Section 6 of the NSA Act of 1939 requires information related

to NSA functions or activities be precluded from release, stating

in relevant part that:

[N]othing in this [Act] or any other law . . shall be

construed to require the disclosure of the organization

or any function of the National Security Agency, of any

information with respect to the activities thereof, or

of the names, titles, salaries, or number of the persons

employed by such agency.

50 U.S. C. § 3605. EPIC contends that documents withheld under

Section 6 are not related solely to NSA functions or activities,

and thus do not satisfy the criteria of S.ection 6. Pl.' s Mot.

at 13; Pl.' s Reply at 10. If Section 6, which is the underlying

exemption statute, is not applicable, then Exemption 3 is also not

applicable. EPIC argues that the statements made in the Vaughn

index are insufficient to justify nondisclosure of information

under Exemption 3. Pl.'s Mot. at 13.

-23-

However, the Government contends that "[t] he redactions of

information made by DHS on behalf of NSA consists of

information relating to the Agency's internal processes, and

activities, such as handling instructions for classified

information " DHS's Mot. at 26. The Government provided

many examples of why application of Exemption 3 is appropriate.

It also provided some examples of unredacted text where the

documents themselves plainly showed they were related to NSA

activities. See DHS's Reply at B.

Thus, the Court concludes that DHS has provided sufficient

details justifying application of Exemption 3 and the information

was properly withheld under Section 6 and Section 798.

3. FOIA Exemption 4

FOIA Exemption 4 precludes an agBncy from disclosing certain

commercial information when the following three requirements are

met : it is " [ 1 ] commercial or financial information [2]

obtained from a person and [ 3] pri vilegBd or confidential." 5

U.S.C. § 552(b) (4); see also Pub. Citizen Health Research Group v~

Food & Drug Admin., 704 F.2d 1280, 1290 (D.C. Cir. 1983); COMPTEL

v. FCC, 910 F. Supp. 2d 100, 114-115 (D.D.C. 2012).

EPIC contends that the Government improperly redacted and

withheld the identities of companies who participated in the DIB

-24-

Cyber Pilot under Exemption 46 because the company names are not

commercial information, were not obtained from a person, and are

not confidential. Pl.'s Mot. at 15. The Government maintains that

it has proven that the identities of participating companies are

properly withheld.

a. Commercial or Financial Information

The first element of Exemption 4 requires that the information

sought to be withheld be commercial or financial in nature.

§ 552 (b) ( 4) • "The terms in Exemption 4 are to be given their

ordinary meanings, and information is commercial under

this exemption if, in and of itself, it serves a commercial

function or is of a commercial nature. Nat'l Ass'n of Home Builders

v. Norton, 309 F.3d 26, 38 (D.C. Cir. 2002).

While commercial information is broadly interpreted to

"include any information in which the submitter has a 'commercial

interest,' such as business sales statistics, research data,

overhead and operating costs, and financial conditions," it is not

all encompassing. COMPTEL, 910 F. Supp. 2d at 115 (internal

citations omitted) . Information may be deemed commercial "even if

the provider's [] interest in gathering, processing, and reporting

the information is noncommercial." Critical Mass Energy Project v.

6 EPIC also challenges the Government's assertion of Exemption 7(D)

to withhold the same information. Pl.'s Mot. at 24. That argument

is addressed later in this section.

-25-

Nuclear Regulatory Comm'n, 830 F.2d 278, 281 (D.C. Cir. 1987)

("Critical Mass I"), vacated on other grounds, 975 F.2d B71 (D.C.

Cir. 1992) (en bane).

EPIC contends that the identities of companies participating

in the DIB Cyber Pilot are not commercial because a company's name

cannot be information in which a company would have a commercial

interest. Pl.'s Mot. at 15. EPIC cites Hodes v. United States Dept.

of Hous. And Urban Dev., 532 F. Supp. 2d 108 (D.D.C. 2008) for the

proposition that "identities of corporations [are] not exempt from

disclosure under Exemption 4." Pl.'s Mot. at 17. The Hodes court

was not stating a bright line rule, but rather noted in dicta that

if corporations preferred to be anonymous, they could take steps

to_protect their own identities. Hodes, 532 F. Supp. 2d at 118.

While the issue of disclosure of corporate identities in this case

arises in an entirely different context than in Hodes, these

companies nonetheless have taken affirmative steps to protect

their identities by using confidentiality agreements.

The Government argues, and the Court agrees, that while a

company may not always have a commercial interest in its name and

identity, the Court may also consider the context in which the

issue arises. The identities of which companies have participated

in the DIB Cyber Pilot, if disclosed, could have a commercial or

financial impact on the companies involved. DHS's Mot. at 24. The

companies are commercial enterprises doing business with the

-26-

Government and the reason they seek piotection from having their

participation disclosed is because of the potential effect that

disclosure would have on their businesses. Id. Consequently, the

Court concludes that the names of participants in the DIB Cyber

Pilot are correctly considered commercial information in this

particular context;

b. Obtained From a Person

Information is considered "obtained from a person" if the

information originated from an individual, corporation, or other

entity, and so long as the information did not originate within

the federal government. Bd. of Trade, 627 F. 2d at 404.

Additionally, even if information originated within the

government, it is protected if the information "summarize [s]

information obtained from another person." COMPTEL, 910 F. Supp.

2d at 115 (citing Gulf & W. Indus. v. United States, 615 F.2d 527,

529-30 (D.C. Cir. 1979)).

EPIC contends that the identities of the participating

companies were improperly withheld because many of t~e redacted

documents appear to be email correspondence between DHS staff, and

thus, EPIC argues the information could not possibly have been

obtained from a person. Pl.'s Mot. at 16. EPIC is correct that

inter-agency emails generally cannot be "obtained from a person."

See Id. However, the information redacted from the emails in this

case was the underlying identities of the participating companies

-27-

in the DIB Cyber Pilot. Declaration of Mark H. Herrington

("Herrington Deel.") '.II 10 [ Dkt. No. 53-5] . While those companies'

identities may have been discussed between OHS employees in email

conversations, the information originated with the corporations

which provided their identities to OHS in order to participate in

the program.

c. Privileged or Confidential

Our Court of Appeals, sitting en bane, has distinguished

between tests of confidentiality under Exemption 4 based on whether

the information was submitted to the government voluntarily or

involuntarily. See Critical Mass III, 975 F.2d at 874. Thus, in

evaluating whether information responsive to a FOIA request is

confidential, it must first be determined whether the information

was provided voluntarily or involuntarily. 7

The test for voluntarily submitted information was first

adopted by our Court of Appeals in Critical Mass III in 1992. See

975 F.2d 871. The Court ruled that voluntarily submitted

information subject to a FOIA request is confidential under

Exemption 4 when the information "is of a kind that would

customarily not be released to the public by the person from whom

7 Initially and without providing any case support, EPIC states

that before the Court can address confidentiality, information

must be established to be "private" because OHS characterized the

~ithheld information as "private information." Pl.'s Mot. at 18-

19. However, no authority has been cited to support this

statement.

-28-

it was obtained." Id. at 879; see also Baker & Hostetler LLP v.

United States DOC, 473 F.3d 312, 320 (D.C. Cir. 2006). Critical

Mass III, 975 F.2d at 879. Moreover, "[t]he court will generally

defer to the agency's predictive judgments as to the repercussions

of disclosure." Jurewicz v. U.S. Dep't of Agric., 741 F.3d 1326,

1331 (D.C. Cir. 2014) (citing United Techs. Corp. v. Dep't of Def.,

601 F.3d 557, 563 (D.C. Cir. 2010)) (internal quotation marks

omitted) .

The Government explains that companies participating in the

DIB Cyber Pilot did so on a voluntary basis and provided

information to the Government voluntarily, but with the

understanding that company identities would be kept confidential.

See Herrington Deel. ~~ 5, 7.

Companies voluntarily participated in the DIB Cyber Pilot to

allow OHS to help the companies better protect their own

information systems and enhance their cybersecurity. See Second

Holzer Deel. ~~ 3-7. Participating companies and the DoD Chief

Information Officer signed a confidentiality agreement stating

that the Government would take measures to protect the identities

of the participating companies. DHS's Mot. at 25.

EPIC's attempt to distinguish volunteering in the DIB Cyber

Pilot from volunteering one's identity is unsuccessful. The very

act of participating in the program included the act by which

companies volunteered their identity to the government.

-29-

In Critical Mass III, a FOIA requester sought nuclear safety

reports that were voluntarily provided by a nonprofit corporation

to a federal government agency under an agreement of

confidentiality and nondisclosure. 97 5 F. 2d at 8 7 4. The agency

denied the request after determining the information was

"confidential commercial information protected from

disclosure by Exemption 4," in part because it was disclosed to

third parties only upon consent from the nonprofit. Id.; see also

Critical Mass I, 830 F.2d at 280 (earlier proceeding explaining

the circumstances of the request) . The Court of Appeals agreed

with the agency that the information was submitted voluntarily and

would not ordinarily be disclosed to the public. Critical Mass

III, 975 F.2d at 880. Therefore, it was confidential information

and met the requirement for application of Exemption 4. Id.

The Court in Critical Mass III considered the parties'

nondisclosure agr.eements when determining whether the inf.ormation

was confidential and of the sort not customarily released to the

public. 975 F.2d at 880; see also Critical Mass I, 830 F.2d at

282. While such agreements are not sufficient in and of themselves

to establish confidentiality under Exemption 4, Green v.

Department of Commerce, 489 F. Supp. 977, 980 (D.D.C. 1980), they

are useful to the Court in evaluating whether intent existed to

shield the information from the public. Here, the confidentiality

-30-

agreements clearly reflect the desire of the companies to shield

their identities as participants in the program.

In addition, as the Herrington Deel. explains, the need to

keep the information confidential is essential because:

If a company's participation in the DIB Cyber Pilot

were publicly known, that company could face increased

cyber targeting, exposing the company to greater

business or financial loss [and]

participation . . . could be viewed as an admission of

cyber vulnerability; a company could face competitive

disadvantages or market loss if its participation were

revealed.

Herrington Deel. ~ 10. The Government further explains that, to

encourage participation from companies in the DIB Cyber Pilot and

similar programs in the future, the companies need to be assured

that their participation will be confidential and not revealed to

the public. See Id. ~ 11; cf. Critical Mass III, 975 F.2d at 874

(considering impairment to agency's ability to acquire information

in the future if agency not permitted to honor confidentiality

commitment).

EPIC makes a number of additional unpersuasive arguments. 8

For instance, EPIC states that because defense contracting

8 For example, EPIC argues that allowing the names of any and all

companies to be considered confidential under Exemption 4 "would

create a black hole for all access requests concerning business

records in the possession of a federal agency." Pl.'s Mot. at 22.

Whether identities of companies are released in record requests. in

the future will turn on the actual circumstances invol v-ed, and

thus a finding of confidentiality here will not leave any "black

hole" in its wake.

-31-

companies have preexisting, publically known relationships with

DHS, and because only defense contracting companies could have

participated in the DIB Cyber Pilot, the identities of the

participating companies are already publically known. Pl.'s Reply

at 11 n.2. If this were true, it is not clear why EPIC is still

seeking the information. In any event, in invoking Exemption 4,

the identities of which companies participated in this particular

program is at issue, not whether the companies are publically known

in other endeavors.

In considering the parties' confidentiality agreements, the

potential consequences of the information becoming public, and the

government's need for future cooperation from the companies, the

Court concludes that the identities of the companies would not

ordinarily be released to the public and are confidential. Thus,

DHS has met its burden of showing why Exemption 4 applies to the

identities of participants in the DIB Cyber Pilot program.

4. FOIA Exemption 5

FOIA Exemption 5 protects from disclosure "inter-agency or

intra-agency memorandums or letters which would not be available

by law to a party other than an agency in litigation with the

agency." 5 U.S.C. § 552(b) (5). Courts have construed this language

to exempt "those documents [,] normally privileged in the civil

discovery context," including those protected by the attorney work

product and attorney client privileges. NLRB v. Sears, Roebuck &

-32-

Co;, 421 U.S. 132, 149 (1975); see also Coastal States Gas Corp.

v. Department of Energy, 617 F.2d 854, 862 (D.C. Cir. 1980); Martin

v. Dep't of Justice, 488 F.3d 446, 455 (D.C. Cir. 2007). In

addition, "[t]he privilege . . . extends to all situations in which

an attorney's counsel is sought on a legal matter." Coastal States,

617 F.2d at 862. Therefore, "it is clear that an agency can be a

"client" and agency lawyers can function as "attorneys" within the

relationship contemplated by the privilege" Id. at 863.

EPIC contends that the Government did not meet its burden of

proving that a redacted portion of one particular document produced

by the Government - Document 276 - was a privileged attorney-

client communication. See Pl.'s Reply at 12-13.

The government points out that the document consisted of a

string of emails, virtually all of which the Government does not

object to releasing. However, the particular portion redacted by

the Government contains a communication between a DHS employee and

a DHS attorney seeking legal review and advice. See Third Holzer

Deel. <[ 10. Thus, there is no question that the redaction was

properly exempted under the attorney-client privilege prong of

Exemption 5.

5. FOIA Exemption 7(0)

FOIA Exemption 7(D) precludes disclosure of responsive

documents, records or information that has been:

-33-

compiled for law enforcement purposes, but only to the

extent that the production of such law enforcement

records or information (D) could reasonably be

expected to disclose the identity of a confidential

source, including . . any private institution which

furnished information on a confidential basis, and, in

the case of a record or information compiled . . . by an

agency conducting a lawful national security

intelligence investigation, information furnished by a

confidential source.

5 u.s.c.' § 552 (b) (7).

Information withheld under Exemption 7 must "first meet a

threshold requirement: that the records were compiled for law

enforcement purposes." Elec. Privacy Info. Ctr. v. U.S. Dep't of

Homeland Sec., 777 F.3d 518, 522-23 (D.C. Cir. 2015) (citing Pub.

Employees for Env't Responsibility v. United States Section, Int'l

Boundary & Water Comm'n, U.S.-Mexico, 740 F.3d 195, 202-03 (D.C.

Cir. 2014)) (internal quotation marks omitted) . It is undisputed

that the information withheld by DHS was compiled for law

enforcement purposes and meets the threshold requirement.

Part (D) of Exemption 7 requires that the information must

come from a "confidential source." 5 U.S.C. § 552 (b) (7) (D). "Giving

the word "source" its plain and ordinary meaning, it would appear

simply to refer to the originator of information, encompassing

within its scope nonfederal entities such as state, l~cal, and

foreign law enforcement agencies as well as individuals such as

private citizens and paid informants." Lesar v. U.S. Dep' t of

Justice, 636 F.2d 412, 489 (D.C. Cir. 1980); see also Black's Law

-34-

Dictionary 1522 (9th ed. 2009) (defining source as "[t]he

originator or primary agent of an act, circumstance, or result").

A source's confidentiality is determined on a case-by-case

basis. U.S. Dep't of Justice v. Landano, 508 U.S. 165, 179-80

(1993). There is no "presumption that a source is confidential

within the meaning of Exemption 7(D) whenever the source provides

information to [a law enforcement agency] in the course of a

criminal investigation." Id. at 181. Rather, "[a] source is

confidential within the meaning of Exemption 7(D) if the source

provided information under an express assurance of confidentiality

or in circumstances from which such an assurance could reasonably

be inferred." Williams v. F.B.I., 69 F.3d 1155, 1159 (D.C. Cir.

1995) (quoting Landano, 508 U.S. at 172).

DHS has withheld the identities of companies participating in

.DIB under Exemption 7 (D), stating that the companies acted as

sources and provided information under an express or implied

understanding of confidentiality. EPIC challenges these

withholdings, arguing that DHS improperly regards participants in

DHS's program as "sources." Pl.'s Mot. at 25-26. It does not

dispute that any information provided by particip.ating companies

to the government was given under assurances of confidentiality,

nor does it allege that a source loses its "source" status under

Exemption 7 when the government provides the source with

information." Pl.'s Reply at 16.

-35-

The crux of EPIC's challenge is whether every participating

company in the DIB Cyber Pilot actually provided information to

the government, in addition to receiving information from the

Government. For purposes of Exemption 7(D), sources include

participating companies who have provided records or information

under a promise of confidentiality. Companies that merely receive

information but do not provide any information would not qualify

for protection under Exemption 7(D).

EPIC contends that DHS improperly withheld ". records

documenting exchanges of information between DIB participants and

the government." Pl.'s Mot. at 26 (emphasis added). EPIC further

states, "[tJhe main flow of information was not from DIB

participants to the government, but from the government to the

participants II

Id. at 27. Under EPIC' s theory, the

Government was the "source" of information to the companies--not

the other way around.

Here, in most instances where Exemption 7(D) has been invoked

in the Vaughn Index, the Government refers to the participating

companies as "sources," without sufficiently explaining why the

companies are sources. For example, in many Vaughn index entries

asserting a 7 (D) exemption, the Government states that "[t] he

participating companies volunteered with an express promise of

confidentiality and are thus confidential sources of law

enforcement information." See, e.g., Vaughn index at 12.

-36-

While the express promise of confidentiality is relevant, DHS

has not contended that the companies provided any information

pursuant to that promise. Nor has DHS shown that mere participation

in the DIB Cyber Pilot program turns each company into a "source"

of information for purposes of Exemption 7(D).

DHS's other Exemption 7(D) explanations fare no better,

merely stating that the document "could reasonably be expected to

disclose the identity of a confidential source." See e.g., id. at

209-11. Although the Government's reference to the companies as

"sources" arguably implies that the companies provided

information, the Court is not willing to rely on such a weak

assumption. Therefore, the Vaughn index alone is not sufficiently

detailed to justify withholding under Exemption 7{D).

For these reasons, the Court finds that the Government has

failed to carry its burden to show that every participating company

provided information to the Government. If in fact there are some

companies that merely receive, but do not provide, information

through the program, the Government has failed to distinguish

between them. Thus, the Government's application of Exemption

7{D) is not justified.

IV. CONCLUSION

For the foregoing reasons, Plaintiffs' Motion for Summary

Judgment shall be denied without prejudice with regard to Exemption

7D and otherwise denied in whole, and the Government's Motion for

-37-

----------···--·----·---------~-----------

Summary Judgment shall be granted in part and denied in part

without prejudice. The Government prevails on its Motion for

Summary Judgment with respect to the adequacy of the search

performed and its withholding under FOIA Exemptions 1, 3, 4, and

5. However, the Government has failed to meet its burden under

FOIA Exemption 7(0). The Government shall have an opportunity to

file a revised Vaughn Index, and therefore Plaintiff's Motion shall

be denied without prejudice with respect to that Exemption. An

Order shall accompany this Memorandum Opinion. 9

August 4, 2015

Copies to: attorneys on record via ECF

9 The Court greatly regrets the delay in ruling on this Motion.

Sometimes, Judges have no excuse to offer and this is one of those

times.

-38-