Levinthal v. Federal Election Commission

UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

_________________________________________

)

Dave Levinthal, et al., )

)

Plaintiffs, )

)

v. ) Civil No. 15-cv-01624 (APM)

)

Federal Election Commission, )

)

Defendant. )

)

_________________________________________ )

MEMORANDUM OPINION

I. INTRODUCTION

Plaintiffs Dave Levinthal and the Center for Public Integrity bring this suit under the

Freedom of Information Act (“FOIA”). On July 6, 2015, Plaintiffs submitted a FOIA request to

Defendant Federal Election Commission seeking: (1) a copy of a study that assesses

vulnerabilities in the Commission’s information technology (“IT”) systems and makes

recommendations to address those vulnerabilities; and (2) any emails and documents related to the

study. Defendant produced non-exempt materials related to the study, but withheld the study itself.

Plaintiffs brought this suit claiming that Defendant violated FOIA by failing to produce the study.

Upon consideration of the parties’ submissions and the record evidence, the court grants

Defendant’s Motion for Summary Judgment and denies Plaintiffs’ Cross-Motion for Summary

Judgment.

II. BACKGROUND

As required by Local Civil Rule 7(h)(1), Defendant Federal Election Commission

(“Commission” or “Defendant”) submitted a detailed statement of undisputed material facts.

See Def.’s Mot. for Summ. J., ECF No. 13 [hereinafter Def.’s Mot.], Def.’s Stmt. of Material Facts,

ECF No. 13-1 [hereinafter Def.’s Stmt.]. Plaintiffs, for their part, responded with a bare-boned

counter-statement that did not dispute Defendant’s factual assertions. Pls.’ Cross-Mot. for Summ.

J., ECF No. 14 [hereinafter Pls.’ Mot.], Pls.’ Stmt. of Material Facts, ECF No. 14-1 [hereinafter

Pls.’ Stmt.]. 1 Accordingly, the court treats Defendant’s proffered facts, recited below, as conceded

by Plaintiffs. See SEC v. Banner Fund Int’l, 211 F.3d 602, 616 (D.C. Cir. 2000) (“If the party

opposing the motion fails to comply with [the] local rule, then ‘the district court is under no

obligation to sift through the record’ and should ‘[i]nstead . . . deem as admitted the moving party’s

facts that are uncontroverted by the nonmoving party’s Rule [LCvR 7.1(h)] statement.’”

(alterations in original) (quoting Jackson v. Finnegan, Henderson, Farabow, Garrett & Dunner,

101 F.3d 145, 154 (D.D.C. 1996)).

A. Factual Background

In Fiscal Year 2014, the Commission hired an outside contractor, SD Solutions, LLC, to

determine whether there were vulnerabilities in the Commission’s IT systems and, if there were,

to provide remedial recommendations. Def.’s Stmt. ¶ 5; Def.’s Mot., Decl. of Alec Palmer, ECF

No. 13-2 [hereinafter Palmer Decl.], ¶ 7. The Commission ordered the study to assist it in deciding

whether to implement newly developed information security guidelines published by the U.S.

Department of Commerce’s National Institute of Standards and Technology (“NIST”). Def.’s

1

Plaintiffs later submitted a more fulsome statement of facts with their Reply Brief, see Pls.’ Reply, ECF No. 18, Pls.’

Stmt. of Genuine Issues of Fact, ECF No. 18-1, but that statement came too late, see LCvR 7(h)(1) (“T]he Court may

assume that facts identified by the moving party in its statement of material facts are admitted, unless such a fact is

controverted in the statement of genuine issues filed in opposition to the motion.” (emphasis added)).

2

Stmt. ¶ 6; Palmer Decl. ¶ 7. In preparing its report, SD Solutions examined the Commission’s

“physical and virtual information technology assets” and recommended measures for the

Commission to protect its infrastructure from “wrongful interference, circumvention, or unlawful

action by unauthorized persons.” Palmer Decl. ¶ 8. Furthermore, it assessed the “vulnerabilities

to unlawful breach present in the Commission’s technological infrastructure, describing sensitive

Commission systems and recommending specific security measures to address the vulnerabilities.”

Id. The Commission refers to SD Solutions’ final report and its related documents, collectively,

as the “NIST Study.” Def.’s Stmt. ¶ 8; Palmer Decl. ¶ 18.

The NIST Study consists of two parts. The first part is an overview memorandum prepared

by the Commission’s Office of the Chief Information Officer. The overview memorandum lists

measures the Office has used in the past to address IT vulnerabilities, summarizes SD Solutions’

final report, and discusses “the practicalities of implementing the [NIST] guidelines should the

Commission adopt the recommendations in the Final Report.” Def.’s Stmt. ¶ 10; Palmer Decl.

¶¶ 2, 9, 10. The overview memorandum includes two appendices: (1) an abridged version of the

full final report, and (2) a summary of both the recommendations in the report and the personnel

and financial resources that would be required to satisfy each recommendation. Id. ¶¶ 10, 11.

The second part of the NIST Study is the final report itself. As discussed, the report

describes the Commission’s IT network, assesses the security of each system and identifies the

vulnerabilities therein, and contains recommendations for security measures to address the

identified vulnerabilities. Id. ¶¶ 12, 14.

B. Procedural Background

Plaintiff Dave Levinthal is an investigative journalist employed by Plaintiff the Center for

Public Integrity. See Pls.’ Mot. at 1; Def.’s Mot. at 3; Def.’s Stmt. ¶ 4. On July 6, 2015, Plaintiffs

3

submitted a FOIA request to the Commission, seeking: (1) “a copy of the 2015 National Institute

of Standards and Technology Report—also known as the NIST study—pertaining to the Federal

Election Commission’s operations,” and (2) “any FEC emails, memoranda, correspondence or

other documents that, in any form or fashion, mention or refer to this National Institute of

Standards and Technology report, by name or otherwise.” Def.’s Stmt. ¶ 38; Def.’s Mot., Decl. of

Robert M. Kahn, ECF No. 13-3 [hereinafter Kahn Decl.], ¶ 6 & Ex. A [hereinafter FOIA Request].

On August 18, 2015, the Commission denied Plaintiffs’ request for a copy of the NIST

Study, but granted their request for documents that mention or refer to the study, subject to

applicable FOIA exemptions. Kahn Decl. ¶ 7 & Ex. C (Email from Robert M. Kahn to Dave

Levinthal (Aug. 18, 2015)). The Commission eventually produced more than 1,450 pages of non-

exempt records, and non-exempt portions of records, that mentioned or referred to the NIST Study.

Jt. Status Rep., ECF No. 11.

Plaintiffs filed an administrative appeal challenging the decision to withhold the NIST

Study, asserting that it “is likely to contain information that directly benefits the public’s

understanding of Federal Election Commission capabilities and operations during a high-profile

election season.” Kahn Decl. ¶ 8 & Ex. C. In September 2015, the Commission denied Plaintiffs’

appeal. Id. ¶ 10 & Ex. F (Email from Robert M. Kahn to Dave Levinthal (Sept. 30, 2015)).

Plaintiffs filed their Complaint in this court on October 5, 2015, challenging only

Defendant’s non-disclosure of the NIST Study. See Compl., ECF No. 1. On March 17, 2016,

Defendant filed a Motion for Summary Judgment, claiming that the NIST Study is exempt from

disclosure both as a law enforcement record under FOIA Exemption 7(E) and as deliberative

material under FOIA Exemption 5. Def.’s Mot. at 10–21. On April 8, 2016, Plaintiffs filed a

Cross-Motion for Summary Judgment, which contests categorizing the NIST Study as a law

4

enforcement record under Exemption 7(E). See Pls.’ Mot at 4. Additionally, although Plaintiffs

concede the applicability of Exemption 5, they argue that the Commission has failed to meet its

obligation under FOIA to release any “reasonably segregable non-exempt information.” Id. at 5.

III. LEGAL STANDARD

A court shall grant summary judgment “if the movant shows that there is no genuine

dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R.

Civ. P. 56(a). To make this determination, the court must “view the facts and draw reasonable

inferences in the light most favorable to the [non-moving] party.” Scott v. Harris, 550 U.S. 372,

378 (2007) (internal quotation mark omitted). A dispute is “genuine” only if a reasonable fact-

finder could find for the nonmoving party, and a fact is “material” only if it is capable of affecting

the outcome of litigation. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248–49 (1986). A non-

material factual dispute cannot prevent the court from granting summary judgment. Id. at 249.

Most FOIA cases are appropriately decided on motions for summary judgment.

See Defenders of Wildlife v. U.S. Border Patrol, 623 F. Supp. 2d 83, 87 (D.D.C. 2009). A court

may award summary judgment in a FOIA case by relying on the information included in the

agency’s affidavits or declarations if they are “relatively detailed and non-conclusory,” SafeCard

Servs., Inc. v. SEC, 926 F.2d 1197, 1200 (D.C. Cir. 1991) (internal quotation marks omitted), and

if they describe “the documents and the justifications for nondisclosure with reasonably specific

detail, demonstrate that the information withheld logically falls within the claimed exemption, and

are not controverted by either contrary evidence in the record nor by evidence of agency bad faith,”

Military Audit Project v. Casey, 656 F.2d 724, 738 (D.C. Cir. 1981).

The agency bears the burden of demonstrating that each FOIA exemption applies, and its

determinations are subject to de novo review in district court. U.S. Dep’t of Justice v. Reporters

5

Comm. for Freedom of the Press, 489 U.S. 749, 755 (1989) (citing 5 U.S.C. § 552(a)(4)(B)). To

prevail on a motion for summary judgment, the agency must demonstrate that “each document that

falls within the class requested either has been produced, is unidentifiable, or is wholly exempt

from the Act’s inspection requirements.” Goland v. Cent. Intelligence Agency, 607 F.2d 339, 352

(D.C. Cir. 1978); see also Students Against Genocide v. Dep’t of State, 257 F.3d 828, 833 (D.C.

Cir. 2001).

IV. DISCUSSION

A. FOIA Exemption 7(E)

The court first considers whether the NIST Study is exempt from disclosure under FOIA

Exemption 7(E). Def.’s Mot at 10–17; Pls.’ Mot. at 3–4.

Under Exemption 7(E), an agency may withhold information (1) “compiled for law

enforcement purposes” if (2) its release “would disclose techniques and procedures for law

enforcement investigations or prosecutions, or would disclose guidelines for law enforcement

investigations or prosecutions,” and (3) such “disclosure could reasonably be expected to risk

circumvention of the law.” 5 U.S.C. § 552(b)(7)(E). Exemption 7(E) “sets a relatively low bar

for the agency to justify withholding,” Blackwell v. FBI, 646 F.3d 37, 42 (D.C. Cir. 2011), and

“where an agency ‘specializes in law enforcement, its decision to invoke [E]xemption 7 is entitled

to deference,’” Lardner v. Dep’t of Justice, 638 F. Supp. 2d 14, 31 (D.D.C. 2009) (quoting

Campbell v. Dep’t of Justice, 164 F.3d 20, 32 (D.C. Cir. 1998)). This does not excuse an agency,

however, from the requirement of describing its “justifications for withholding the information

n with specific detail.” Am. Civil Liberties Union v. Dep’t of Def., 628 F.3d 612, 619 (D.C. Cir.

2011).

6

In this case, Plaintiffs offer a single argument challenging Defendant’s invocation of

Exemption 7(E): the NIST Study was not “compiled for law enforcement purposes.” Pls.’ Mot.

at 4.2 The court has little trouble rejecting that contention.

A record is “compiled for law enforcement purposes” so long as there is (1) a rational

“nexus” between the record and the agency’s law enforcement duties, and (2) a connection

between the subject of the record and a possible security risk or violation of federal law.

See Campbell, 164 F.3d at 32; see also Pratt v. Webster, 673 F.2d 408, 420 (D.C. Cir. 1982). The

latter requirement must be satisfied “to establish that the agency acted within its principal function

of law enforcement, rather than merely engaging in a general monitoring of individuals’ activities.”

Pratt, 673 F.3d at 420. The NIST Study satisfies both requirements.

First, the NIST Study meets the rational “nexus” requirement because a federal agency,

like the Commission, cannot effectively carry out its law enforcement function unless it has a

secure and reliable IT system. The Commission is responsible for investigating violations of the

Federal Election Campaign Act. See Def.’s Mot. at 5–6; Def.’s Stmt. ¶¶ 1–3; 52 U.S.C.

§ 30109(a)(1)–(2). Its IT system contains sensitive information related to investigations, including

“subpoenas, requests for information and documents, reports of investigation, and responses to

Commission-issued subpoenas and requests.” Palmer Decl. ¶ 17. The system also contains a

“confidential scoring system, the Enforcement Priority System, which identifies significant cases

for enforcement[.]” Id. ¶ 16. In short, the Commission’s IT system is central to its law

2

The court, therefore, treats as conceded the remaining elements of Exemption 7(E)—namely, that the exempted

record (1) “would disclose techniques and procedures for law enforcement investigations or prosecutions, or would

disclose guidelines for law enforcement investigations or prosecutions” and (2), if disclosed, “could reasonably be

expected to risk circumvention of the law.” 5 U.S.C. § 552(b)(7)(E). See Wilkins v. Jackson, 750 F. Supp. 2d 160,

162 (D.D.C. 2010) (“It is well established that if a plaintiff fails to respond to an argument raised in a motion for

summary judgment, it is proper to treat that argument as conceded.”); Sykes v. Dudas, 573 F. Supp. 2d 191, 202

(D.D.C. 2008) (“[W]hen a party responds to some but not all arguments raised on a Motion for Summary Judgment,

a court may fairly view the unacknowledged arguments as conceded.”).

7

enforcement function. See id. (“The Commission’s information systems network allows it to fulfill

its statutory obligation to administer and enforce campaign finance laws.”).

The NIST Study in turn was designed to promote the integrity of that system and thus itself

serves a law enforcement function. The study’s purpose was to “assess the vulnerabilities of the

Commission’s information technology systems” and to make “recommendations about how the

Commission could protect its systems from wrongful interference, circumvention, or unlawful

action by authorized persons.” Palmer Decl. ¶¶ 7, 8. A study designed to evaluate and improve a

critical law enforcement tool, such as an IT system, easily meets the rational nexus requirement.

Second, there is a connection between the NIST Study and a possible security risk or

violation of federal law. According to the Commission’s Chief Information Officer, Alec Palmer,

the NIST Study is the type of assessment “that, if publicly disclosed, could be used by persons

with malicious objectives to do great harm.” Id. ¶ 19. Palmer asserts that “information contained

in the NIST Study could be used to gain unlawful access to the Commission’s technology systems,

obtain and manipulate sensitive and confidential data about candidates, officeholders, party

committees, and others who interact with the Commission, or obtain and manipulate data stored

within the Commission’s systems regarding [Commission] enforcement matters.” Id. Further,

Palmer explains that a person with access to the NIST Study “could use the information contained

[therein] to seriously threaten the Commission’s ability to fulfill its civil enforcement and other

statutory duties.” Id. Finally, Palmer attests that the NIST Study “provides a blueprint to the

Commission’s networks” and that its public disclosure “could thus enable hackers to bypass the

Commission’s current protection mechanisms.” Id. ¶ 21. This court observed in Long v.

Immigration and Customs Enforcement, 149 F. Supp. 3d 39, 53 (D.D.C. 2015), that “[j]udges are

not cyber specialists, and it would be the height of judicial irresponsibility for a court to blithely

8

disregard . . . a claimed risk” of a cyber-attack or a security breach. The court will not disregard

such risk in this case. Accordingly, the court finds that the NIST Study satisfies the second prong

of the “compiled for law enforcement purposes” inquiry.

Plaintiffs offer two rejoinders. First, they contend that the NIST Study is not “compiled

for a law enforcement purpose” because “[i]t is not connected to an investigation.” Pls.’ Mot. at

4. That argument misconstrues the law. The Court of Appeals consistently has held that records

do not have to be linked to a specific investigation to be properly withheld under Exemption 7(E).

For instance, in Tax Analysts v. Internal Revenue Service (IRS), the court held that IRS materials

related to law enforcement activities “outside of the context of a specific investigation” met the

threshold for materials “compiled for law enforcement purposes” under Exemption 7(E). See 294

F.3d 71, 73, 78–79 (D.C. Cir. 2002). In so holding, it observed that Congress amended

Exemption 7 in 1986 to make clear that 7(E) “was not limited to records or information addressing

only individual violations of the law.” Id. at 79. More recently, in Blackwell v. Federal Bureau

of Investigation, the Court of Appeals held that the FBI had properly withheld methods of data

collection, organization, and presentation contained in certain reports under Exemption 7(E). 646

F.3d at 42. The methods were developed for the FBI to meet the agency’s “investigative needs,”

rather than linked to a specific investigation. Id.

Moreover, as Defendant correctly points out, Def.’s Mot. at 11, 13–14, courts in this

District repeatedly have held that information connected to law enforcement databases qualifies

for exemption under 7(E). See, e.g., Long, 149 F. Supp. 3d at 44 (holding that requests for metadata

and database schema of law enforcement information databases qualify for exemption under 7(E));

Strunk v. U.S. Dep’t of State, 905 F. Supp. 2d 142, 146–48 (D.D.C. 2012) (holding that computer

transaction and function codes that reveal how to navigate and retrieve information from a law

9

enforcement database were properly withheld under Exemption 7(E)); Miller v. U.S. Dep’t of

Justice, 872 F. Supp. 2d 12, 29 (D.D.C. 2012) (holding that numerical codes used to identify

information and individuals, as well as codes “relate[d] to procedures concerning the use of law

enforcement resources and databases . . . [and] case program and access codes[,]” were properly

withheld under Exemption 7(E)); Skinner v. U.S. Dep’t of Justice, 893 F. Supp. 2d 109, 113–14

(D.D.C. 2012) (holding that user access codes that facilitated access to a law enforcement database

were properly redacted under Exemption 7(E)), aff’d sub nom. Skinner v. Bureau of Alcohol,

Tobacco, Firearms & Explosives, No. 12-5319, 2013 WL 3367431 (D.C. Cir. May 31, 2013)).

Thus, the fact that the NIST Study does not pertain to a particular investigation does not place it

outside Exemption 7(E).

Second, Plaintiffs argue that Exemption 7(E) is inapplicable because Defendant “has not

established that the vulnerabilities described in the NIST Study still exist.” Pls.’ Mot. at 4. More

specifically, Plaintiffs argue that, even if Exemption 7(E) applies “to portions of the NIST Study,

to the extent that facts on the ground have changed since the preparation of the report, disclosure

of previous vulnerabilities would not fall under Exemption 7(E).” Id. at 5. That argument is a

nonstarter. Again, the Palmer Declaration, which the court described above, amply supports

Defendant’s contention that the public release of the NIST Study—or any portion of it—would

run the risk of compromising the Commission’s law enforcement function. According to Palmer,

if released, unauthorized readers of the NIST Study could “gain unlawful access to the

Commission’s technology systems, obtain and manipulate sensitive and confidential data about

candidates, officeholders, party committees, and others who interact with the Commission, or

obtain and manipulate data stored within the Commission’s systems regarding [Commission]

enforcement matters.” Id. ¶ 19. Additionally, Palmer states that an unauthorized individual or

10

government armed with the NIST Study could “seriously threaten the Commission’s ability to

fulfill its civil enforcement and other statutory duties” and “alter the disclosure data that the

Commission makes available on its public website, thereby providing false disclosure information

that could adversely influence the outcome of an election.” Id. ¶¶ 19–20. Further, disclosing the

NIST Study could allow hackers to gain access to the Commission’s networks, enabling them to

“distort or prevent access to campaign finance reports,” or “expose sensitive information about

parties regulated by the Commission.” Id. ¶¶ 21, 24. Palmer’s Declaration credibly demonstrates

that disclosure of any portion of the NIST Study would pose a present and genuine security threat

to the Commission’s law enforcement function. Accordingly, the court rejects Plaintiffs’ argument

that the NIST Study is not exempt under 7(E).

B. FOIA Exemption 5 and Segregability

Defendant also invokes FOIA Exemption 5 to withhold the NIST Study. Def.’s Mot. at

17. Exemption 5 shields disclosure of “inter-agency or intra-agency memorandums or letters

which would not be available by law to a party other than an agency in litigation with the agency.”

5 U.S.C. § 552(b)(5). Exemption 5 has been interpreted to incorporate the three traditional civil

discovery privileges—the attorney work product privilege, the deliberative process privilege, and

the attorney-client privilege. Burka v. U.S. Dep’t of Health & Human Servs., 87 F.3d 508, 518

(D.C. Cir. 1996). Here, Defendant asserts the deliberate process privilege as the basis for invoking

Exemption 5. Def.’s Mot. at 17–21; see Tax Analysts v. IRS, 117 F.3d 607, 616 (D.C. Cir. 1997)

(describing the deliberative process privilege as covering records that are both “predecisional” and

“deliberative”).

Plaintiffs do not contest the applicability of the deliberative process privilege to the NIST

Study. See Pls.’ Mot. at 5 (“Plaintiffs do not doubt that the NIST Study contains predecisional

11

recommendations.”). Instead, they challenge whether Defendant has satisfied its duty to segregate

and produce non-exempt factual material contained within the NIST Study. Id. Specifically,

Plaintiffs argue that Defendant “has not established that [the factual material is] actually

‘inextricably entwined’ with deliberations.” Id.; see Mead Data Cent., Inc. v. U.S. Dep’t of the

Air Force, 566 F.2d 242, 260 (D.C. Cir. 1977) (collecting cases and explaining that “[i]t has long

been a rule in this Circuit that non-exempt portions of a document must be disclosed unless they

are inextricably intertwined with exempt portions”). The court disagrees.

Because “the focus of FOIA is information, not documents . . . an agency cannot justify

withholding an entire document simply by showing that it contains some exempt material.” Mead

Data Cent., 566 F.2d at 260. FOIA therefore requires that “[a]ny reasonably segregable portion

of [the] record shall be provided to any person requesting such record after deletion of the portions

which are exempt.” 5 U.S.C. § 552(b). An agency must provide a “detailed justification” and not

just make “conclusory statements” to support its segregability determination. Mead Data Cent.,

566 F.2d at 261. Agencies, however, “are entitled to a presumption that they complied with the

obligation to disclose reasonably segregable material,” which can be overcome by contrary

evidence produced by the requester. Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1117 (D.C.

Cir. 2007).

The Palmer Declaration provides a “detailed justification” for the Commission’s decision

that no part of the NIST Report is segregable, and Plaintiffs have not offered any evidence to the

contrary. According to Palmer, the Commission’s Office of the Chief Information Officer

conducted a line-by-line analysis of the NIST Study to determine if any portion could be

segregated and released without jeopardizing the security of its networks. Palmer Decl. ¶¶ 25–27.

Palmer observes that the “factual descriptions of the Commission’s information technology

12

systems and their vulnerabilities in the Final Report form the basis of the Report’s analysis[] . . .

and they reflect the need for the recommended protocols that constitute the core of the NIST

Study.” Id. ¶ 26. If the factual content of the NIST Study were publicly disclosed, Palmer explains,

it “would effectively release many of the NIST Study’s recommendations, as well as the substance

of the vulnerability analysis that [the Office of the Chief Information Officer] submitted to the

Commission for its determination on whether to accept those recommendations.” Id. ¶ 27. “The

factual descriptions expose the Commission to risk of a security breach of its network and

information technology systems.” Id.

Palmer’s Declaration clearly establishes that the factual portions of the NIST Study are

“inextricably intertwined” with its deliberative elements. Mead Data Cent., 566 F.2d at 260. It

also sets forth with “reasonable specificity” why those factual portions cannot be segregated.

Armstrong v. Exec. Office of the President, 97 F.3d 575, 578–79 (D.C. Cir. 1996). Accordingly,

the court rejects Plaintiffs’ argument that Defendant has not met its duty of segregability.

V. CONCLUSION

For the foregoing reasons, the court grants Defendant’s Motion for Summary Judgment

and denies Plaintiffs’ Cross-Motion for Summary Judgment. A separate final order accompanies

this Memorandum Opinion.

Dated: November 23, 2016 Amit P. Mehta

United States District Judge

13