United States District Court, D. Columbia.
[Copyrighted Material Omitted]
[Copyrighted Material Omitted]
[Copyrighted Material Omitted]
[Copyrighted Material Omitted]
For ELECTRONIC PRIVACY INFORMATION CENTER, Plaintiff: Marc Rotenberg , LEAD ATTORNEY, ELECTRONIC PRIVACY INFORMATION CENTER, Washington, DC.
For UNITED STATES DEPARTMENT OF HOMELAND SECURITY, Defendant: Lisa Zeidner Marcus, LEAD ATTORNEY, U.S. DEPARTMENT OF JUSTICE, Washington, DC; Tamra Tyree Moore, U.S. DEPARTMENT OF JUSTICE, Civil Division/Federal Programs Branch, Washington, DC.
Gladys Kessler, United States District Judge.
Plaintiff Electronic Privacy Information Center (" Plaintiff" or " EPIC" ) brings this action against Defendant the United States Department of Homeland Security (" the Government" or " DHS" ) under the Freedom of Information Act (" FOIA" ), 5 U.S.C. § 552. Plaintiff seeks records concerning the Defense Industrial Base Cyber Pilot (" DIB Cyber Pilot" ), a cyber-security pilot program jointly conducted by the United States Department of Defense (" DoD" ) and Defendant DHS. Government's Motion for Summary Judgment (" DHS's Mot." ) at 2 [Dkt. No. 53].
The program, which " aim[ed] . . . to protect U.S. critical infrastructure[,] . . . [and] furnished classified threat and technical information to voluntarily participating  companies or their Commercial Service Providers." Id. EPIC, citing concerns from the Department of Justice about the program " [running] afoul of laws forbidding government surveillance of private Internet traffic[,] . . . sought records to determine whether . . . the DIB Cyber Pilot program complied with federal wiretap laws." Plaintiff's Combined Opposition to Defendant's Motion for Summary Judgment and Cross-Motion for Summary Judgment (" Pl.'s Mot." ) at 2 [Dkt. No. 57].
DHS conducted a search for records responsive to EPIC's request, produced documents to EPIC, and provided a Vaughn index for all documents that were withheld in full or in part under one of FOIA's several exemptions. § 552 (b); see also Defendant's Vaughn Index for Challenged Withholdings (" Vaughn index" ) [Dkt. No. 53-4]. EPIC now challenges the sufficiency of the search conducted by DHS, as well as the Government's application of FOIA Exemptions 1, 3, 4, 5, and 7(D) to withhold certain responsive information.
Upon consideration of the Motions, Oppositions, Replies, the entire record herein, and for the reasons stated below, Plaintiffs' Motion for Summary Judgment shall be denied without prejudice with regard
to Exemption 7(D) and otherwise denied in whole, and the Government's Motion for Summary Judgment shall be granted in part and denied in part without prejudice.
The Freedom of Information Act (" FOIA" ), 5 U.S.C. § 552, was enacted by Congress " to ensure an informed citizenry, vital to the functioning of a democratic society."
Critical Mass. Energy Project v. Nuclear Regulatory Comm'n, 975 F.2d 871, 872, 298 U.S. App.D.C. 8 (D.C. Cir. 1992) (" Critical Mass. III" ), cert. denied, 507 U.S. 984, 113 S.Ct. 1579, 123 L.Ed.2d 147 (1993) (citing FBI v. Abramson, 456 U.S. 615, 621, 102 S.Ct. 2054, 72 L.Ed.2d 376 (1982)). " In enacting FOIA, Congress struck the balance it thought right--generally favoring disclosure, subject only to a handful of specified exemptions--and did so across the length and breadth of the Federal Government."
Milner v. Dep't of the Navy, 562 U.S. 562, 571 n.5, 131 S.Ct. 1259, 179 L.Ed.2d 268 (2011). FOIA's " basic purpose reflect[s] a general philosophy of full agency disclosure unless information is exempted under clearly delineated statutory language." Dep't of the Air Force v. Rose, 425 U.S. 352, 360-361, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976) (internal citations and quotation marks omitted).
When an agency receives a request for records, the agency must conduct a sufficient search within the scope of the request, 5 U.S.C. § 552(a)(3)(A). The agency then must furnish the information in a timely manner, unless the information is precluded from disclosure by one of FOIA's nine exemptions. § 552(b). FOIA's " goal is broad disclosure, [thus] the exemptions must be given a narrow compass."
Milner, 562 U.S. at 563 (citing United States Dep't of Justice v. Tax Analysts, 492 U.S. 136, 151, 109 S.Ct. 2841, 106 L.Ed.2d 112 (1989)). The Government always bears the burden of proving exemptions apply for any responsive information that is withheld.§ 552(a)(4)(B).
B. Factual Background
1. EPIC's FOIA Request
On July 26, 2011, EPIC submitted a FOIA request for documents to DHS, as well as requests for news media fee status and a fee waiver. Pl.'s Mot. at 2; DHS's Mot. at 2. EPIC's FOIA request was for records related to the DIB Cyber Pilot program " to monitor Internet traffic flowing through certain Internet Service Providers (" ISPs" ) from Internet users to a select number of defense contractors." Pl.'s Mot. at 2. Specifically, EPIC's request was for all information in the following categories:
1. All contracts and communications with Lockheed Martin, CSC, SAIC, Northrop Grumman or any other defense contractors regarding the new NSA [National Security Agency] pilot program;
2. All contracts and communications with AT& T, Verizon and CenturyLink or any other [ISPs] regarding the new NSA pilot program;
3. All analyses, legal memoranda, and related records regarding the new NSA pilot program;
4. Any memoranda of understanding between NSA and DHS or any other government agencies or corporations regarding the new NSA pilot program;
5. Any privacy impact assessment performed as part of the development of the new NSA pilot program.
Id. at 2-3.
On August 3, 2011, DHS sent a letter to EPIC acknowledging receipt of the FOIA
request, notifying EPIC that no responsive documents had been found for category 5, and indicating that it had referred the request to the DHS National Protection and Programs Directorate (" NPPD" ). Pl.'s Mot at 3; DHS's Mot. at 2. Despite deadlines imposed by FOIA, 5 U.S.C. § 552(a)(6)(A), DHS did not produce the requested documents or contact EPIC again for five months. Pl.'s Mot. at 3. On January 5, 2012, EPIC faxed an administrative appeal to NPPD's FOIA Office, appealing NPPD's non-responsiveness regarding categories 1-4 of EPIC's FOIA Request. Id. On January 23, 2012, a FOIA Specialist from NPPD contacted EPIC by telephone regarding the status of the FOIA request and informed EPIC that DHS was processing it. DHS's Mot. at 3. On March 1, 2012, EPIC filed this Complaint for Injunctive Relief (" Complaint" ) [Dkt. No. 1], and the Government filed its Answer on May 1, 2012 [Dkt. No. 7].
On August 31, 2012, EPIC narrowed its FOIA request, in part to exclude draft documents, and specifically requested:
1. All contracts and communications with Lockheed Martin, CSC, SAIC, Northrop Grumman or any other defense contractors regarding the DIB Cyber Pilot;
2. All contracts and communications with AT& T, Verizon and CenturyLink or any other [ISPs] regarding the DIB Cyber Pilot;
3. All legal and technical analyses, including legal memoranda, regarding the DIB Cyber Pilot;
4. Any memoranda of understanding between NSA and DHS or any other government agencies or corporations regarding the DIB Cyber Pilot.
Pl.'s Mot. at 4.
2. The Government's Search for Responsive Documents
In conducting its search for responsive records, DHS assigned EPIC's FOIA request to NPPD. Second Holzer Decl. ¶ 9. NPPD's FOIA Office (" NPPD FOIA" ) began to process the request by " tasking out the search" to subcomponents likely to have responsive records, the Office of Cybersecurity and Communications (" CS& C" ). Id. ¶ ¶ 11, 29. NPPD also provided the DHS Office of General Counsel and the Office for Selective Acquisitions with EPIC's FOIA request because those offices had been involved in supporting the DIB Cyber Pilot and might have had responsive records. Id. ¶ 16. NPPD did not search other offices or department components because it determined that those off ices and department components were not likely to have any connection to the DIB Cyber Pilot. Id. ¶ 17.
NPPD FOIA met with " subject matter experts" in the agency who had been involved with the DIB Cyber Pilot to determine which sub-offices would likely have responsive records. Id. ¶ 15. NPPD FOIA and the subject matter experts created keyword search terms to be used in electronic searches for responsive documents. Id. ¶ 18. The keyword search terms were provided to the identified offices, where each employee was instructed to conduct searches using the keywords and their own personal " knowledge of how and where they stored their own documents . . . ." Id. ¶ 19.
NPPD FOIA worked with the identified offices to determine which employees were involved with the DIB Cyber Pilot. Id. ¶ ¶ 22-23. Each office and employee were instructed to conduct a search for responsive documents. Id. at ¶ ¶ 18-19. The employees who were involved with the DIB Cyber Pilot then searched electronic and hard copies of their office and personal files. A search of the classified network was also conducted. Id. ¶ ¶ 18-19, 26-27, 29-32.
Staff in one of the identified offices - the NPPD Office of the Undersecretary (" OUS" ) - searched a database of taskings: records of which employees were tasked with various assignments and the files associated with those assignments. Id. at ¶ ¶ 22-23. OUS used the database to further identify all staff who may have been involved with the DIB Cyber Pilot.
Staff in the NPPO Privacy Office and the CS& C, along with CS& C's subcomponents, searched electronic and hard copies of their personal files. Id. at ¶ ¶ 26-27, 29-32. Employees in those offices conducted a further search of the classified network. Id. The DHS Office of the General Counsel (" OGC" ) identified two attorneys who would potentially have responsive documents and had them conduct extensive manual and electronic searches of their computers and files relating to the OIB Cyber Pilot. Id. at ¶ ¶ 33-38.
Staff in the Office of the Chief Procurement Officer (" OCPO" ), responsible for contracting for NPPO and other offices, and the Office of Selective Acquisitions, an OCPO subcomponent which handles classified and sensitive contracts, did similar searches and located potentially responsive documents which were turned over to the DHS Privacy Office for further processing. Id. at ¶ ¶ 39-42. DHS did not search the various other offices within the agency that had no involvement with the DIB Cyber Pilot. Id. ¶ 17.
DHS's searches initially resulted in approximately 16,000 pages of potentially responsive documents. Id. ¶ 43. That number were reduced to roughly 10,000 pages after initial review by a team of FOIA specialists and attorneys who spent several weeks reviewing the documents, removing duplicates, and removing documents that were clearly non-responsive. Id. The agency then took a " page-by-page and line-by-line" approach to determine if the documents were in fact responsive and whether any of FOIA's exemptions applied to a part or the entirety of each document. Id. ¶ 44.
On April 15, 2013, DHS produced 1,276 pages of responsive documents to EPIC; 117 pages of those records were released in their entirety and the remaining 1,159 pages were partially redacted pursuant to FOIA exemptions. Id. ¶ ¶ 46. On June 15, 2013, DHS provided a partial preliminary Vaughn Index, and on June 22, 2013, DHS provided the remaining preliminary Vaughn Index. Pl.'s Mot. at 6; see also Vaughn v. Rosen, 523 F.2d 1136, 173 U.S. App.D.C. 187 (D.C. Cir. 1975).
After receiving the documents, EPIC noticed that several emails referenced attachments that EPIC believed were not included in the DHS production. DHS's Mot. at 6. On June 20, 2015, EPIC responded to DHS's initial production of documents with a list of 17 examples of documents that EPIC believed were missing from the production. Second Holzer Decl. ¶ 47; Pl.'s Mot. at 8.
DHS analyzed the specific documents referenced by EPIC and found that 13 documents had been properly identified as non-responsive, one responsive document had been inadvertently ...