BERYL A. HOWELL, United States District Judge.
The plaintiff, Agility Public Warehousing Company K.S.C., brings suit against the National Security Agency ("NSA"), pursuant to the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552. As part of its FOIA request, the plaintiff sought "all [of the] email, letter, telephonic, or other communications" of the plaintiff in the NSA's possession. See Compl. ¶ 11, ECF No. 1. Relying on information leaked to the media regarding various classified NSA communication collection programs, the plaintiff argues that the NSA "indiscriminately collect[s] millions of telephone and email communications" from U.S. citizens and therefore maintains records of the plaintiff's historical communications. See Pl.'s Mem. Supp. Cross-Mot. Summ. J. ("Pl.'s Mem.") at 1, ECF No. 19-1. The NSA, however, issued a "Glomar" response — neither confirming nor denying the existence of records responsive to the plaintiff's request.
The plaintiff challenges the NSA's provision of a "Glomar" response regarding the requested documents as well as the adequacy of the NSA's search efforts for certain other requested documents. Now pending before the Court are the parties' cross motions for summary judgment. For the reasons stated below, the NSA's motion for summary judgment is granted and the plaintiff's cross-motion for summary judgment is denied.
The plaintiff is a Kuwaiti logistics company that provided food to U.S. troops
On December 19, 2013, the plaintiff submitted a FOIA request to the NSA seeking seven categories of documents: (1) "all email, letter, telephonic, or other communications" by the plaintiff; (2) the name of any U.S. or foreign communications provider that intercepted the plaintiff's communications; (3) documents relating to two contracts between the plaintiff and Defense Supply Center Philadelphia; (4) documents relating to the two lawsuits brought against the plaintiff in the Northern District of Georgia; (5) all communications between the NSA and any other investigative or law enforcement agency regarding the plaintiff; (6) documents pertaining to meetings among employees or contractors of any of the Department of Justice, the Office of the Director of National Intelligence, and the NSA regarding the plaintiff; and (7) documents pertaining to meetings between employees or contractors of the NSA and employees or contractors of the Federal Bureau of Investigation, the Central Intelligence Agency, the Department of Defense, and the Department of Homeland Security, relating to the plaintiff. Compl. ¶ 11.
Although the plaintiff and the NSA exchanged communications clarifying the scope of the plaintiff's FOIA request, the NSA never provided a response to the plaintiff prior to this litigation. Id. at ¶¶ 14-16. As a result, the plaintiff appealed to the NSA's FOIA Appeal Authority based on the NSA's constructive denial of its FOIA request. Id. The NSA indicated that processing of the plaintiff's appeal would be based on a "first-in, first-out" policy, but over the course of two months, the NSA never responded to the plaintiff. Id. at ¶¶ 17-19; Decl. of David J. Sherman ("NSA's Sherman Decl.") at ¶ 24, ECF No.
After the initiation of litigation, the Chief of NSA's FOIA/Privacy Act Office provided the plaintiff with a letter purporting to be a final response to the plaintiff's FOIA request. See NSA's Sherman Decl. ¶ 25. The NSA noted that, to the extent the plaintiff sought records concerning the contracts and lawsuits mentioned in the plaintiff's FOIA request, the NSA had conducted a thorough search and was unable to locate any responsive records. Id. ¶ 27. As detailed in two declarations, the NSA tasked "its Office of General Counsel, its acquisition organization, and its logistics organization" to conduct the relevant searches. Id. The NSA queried the records of the relevant organizations using variations of the plaintiff's name as specified in the plaintiff's FOIA request — Agility Public Warehousing Company, Agility, and the Public Warehousing Company — and the numbers for the relevant contracts. Supplemental Decl. of David J. Sherman ("NSA's Suppl. Sherman Decl.") at ¶ 3, ECF No. 23-1. The NSA's filing systems contained memoranda, meeting minutes, reports, manuals, and other documents. NSA's Sherman Decl. ¶ 27. Within the Office of General Counsel, attorneys searched their Microsoft Outlook email accounts while administrative personnel and paralegals searched the organization's litigation filings systems. Id. The NSA also searched the "contracting management information system database," which is maintained in support of the NSA's contracting activity. Id.
In addition, the NSA's response informed the plaintiff that, to the extent the plaintiff's FOIA request called for intelligence information, the NSA could not confirm or deny the existence of any such records as their existence or non-existence is protected by FOIA Exemptions 1 and 3. See id. ¶ 26. The NSA's "foreign intelligence mission includes the responsibility to collect, process, analyze, produce and disseminate signals intelligence (`SIGINT') information, of which communications intelligence (`COMINT') is a significant subset, for foreign intelligence and counterintelligence purposes to support national and departmental missions to include the conduct of military operations." Id. ¶ 5. In light of its mission, the NSA determined that "[a]cknowledging the existence or non-existence of responsive records on particular individuals or organizations subject to surveillance would provide ... adversaries with critical information about the capabilities and limitations" of the NSA and its operations. Id. ¶ 33. Likewise, "[c]onfirmation by NSA that a specific person's or organization's activities are not of foreign intelligence interest or that NSA is unsuccessful in collecting foreign intelligence information on their activities" would undermine the NSA's mission and permit adversaries to "accumulate information and draw conclusions about NSA's technical capabilities, sources, and methods." Id. As a result, the disclosure of such information "could reasonably be expected to cause exceptionally grave and irreparable damage to the national security by providing ... adversaries a road map that instructs them on which communication modes or personnel remain safe or are successfully defeating NSA's capabilities." Id. ¶ 34. Moreover, disclosure of such information would permit adversaries to change their communications behavior or otherwise "alert targets that their existing means of communications are potentially safe." Id. Accordingly, the NSA did not confirm the existence or non-existence of any such records.
Almost seven months before the plaintiff filed the FOIA request at issue, a United
In the aftermath of The Guardian's disclosure, the government began to release details regarding the telephony metadata program along with declassified and redacted copies of other FISC orders. See Ex. 11, Pl.'s Aviad Decl. (Press Release, DNI Clapper Declassifies Intelligence Community Documents Regarding Collection Under Section 501 of the Foreign Intelligence Surveillance Act (FISA), Nov. 18, 2013). These disclosures reveal that since at least May 2006, the FBI has sought orders from the FISC authorizing the bulk collection of telephony metadata from U.S. telecommunications providers pursuant to Section 215 of the USA PATRIOT Act, 50 U.S.C. § 1861. See In re Application of the Fed. Bureau of Investigation for an Order Requiring the Production of Tangible Things from [Redacted], No. BR 06-05, at 2 (F.I.S.C. May 24, 2006); see also Ex. 7, Pl.'s Aviad Decl. (Declaration of Teresa H. Shea, Signals Intelligence Director, NSA ("NSA's Shea Decl."), Smith v. Obama, No. 13-cv-0257 (D.Idaho Jan. 24, 2013), ECF No. 15-2).
Section 215 authorizes the FBI to "make an application for an order requiring the production of any tangible things (including books, records, papers, documents, and other items) for an investigation to obtain foreign intelligence information concerning a United States person or to protect against international terrorism or clandestine intelligence activities...." 50 U.S.C. § 1861. Under the program, the FBI seeks orders from the FISC "directing certain telecommunications service providers to produce all business records created by them (known as call detail records)" for a designated period of time. NSA's Shea Decl. ¶ 14. "FISC orders must be renewed every 90 days, and the program has therefore been renewed 41 times since May 2006." Am. Civil Liberties Union v.
Once collected from the telecommunications provider and stored in a secure database, strict procedures govern the NSA's access to and use of the collected telephony metadata. See In re Application of the FBI for an Order Requiring the Prod. of Tangible Things From [REDACTED], No. BR 13-80, 2013 WL 5460137 (F.I.S.C. Apr. 25, 2013) ("Primary Order"). The government is only permitted to access the collected telephony metadata for the purposes set forth in the Primary Order, which includes "purposes of obtaining foreign intelligence information" and technical maintenance. See Primary Order at 2-3; NSA Shea Decl. ¶ 18. The NSA may access the collected telephony metadata only by searching with a telephone number or other "identifier," that is associated with a foreign terrorist organization. NSA's Shea Decl. ¶ 20-21; Primary Order at 2-4. Before an identifier may be used, one of twenty-two designated officials must determine that a "reasonable articulable suspicion" exists that the identifier is associated with an international terrorist organization subject to an FBI investigation. NSA Shea Decl. ¶ 21; Primary Order at 2-3. Where the identifier is reasonably believed to be used by a U.S. person, such reasonable articulable suspicion may not be based solely upon protected First Amendment activities. NSA's Shea Decl. ¶ 21; Primary Order at 2. The reasonable articulable suspicion requirement was intended to prevent the generalized browsing of data. NSA's Shea Decl. ¶ 20. The NSA must destroy all metadata no later than five years after the initial collection. NSA's Shea Decl. ¶ 31; Primary Order at 4.
Before information pertaining to any U.S. person may be disseminated outside the NSA, certain high-level officials "must determine that the information identifying the U.S. person is in fact related to counterterrorism information and that it is necessary to understand the counterterrorism information or assess its importance." Primary Order at 3. The NSA may also share the results from searches of the metadata with the Executive Branch in order to permit the Executive Branch to determine if such "information contains exculpatory or impeachment information or is otherwise discoverable in legal proceedings" or to "facilitate their lawful oversight functions." Primary Order at 3.
Almost immediately following these revelations, individuals and public interest groups filed numerous lawsuits throughout the country challenging the constitutional and statutory basis for the program. See, e.g., Clapper, 785 F.3d 787; Smith v. Obama, 24 F.Supp.3d 1005 (D.Idaho 2014), No. 14-35555 (9th Cir. argued Dec. 8, 2014); Klayman v. Obama, 957 F.Supp.2d 1 (D.D.C.2013), No. 14-5004 (D.C.Cir.argued Nov. 4, 2014); Schuchardt v. Obama, 14-705 (W.D.Pa.); Paul v. Obama, 14-0262 (D.D.C.); First Unitarian Church of Los Angeles v. Nat'l Sec. Agency, 13-3287 (N.D.Cal.). Additionally, in at least one other instance, a plaintiff has sought records under FOIA that it believed to be in the possession of the NSA based on this bulk collection of metadata. See Competitive Enter. Inst. v. Nat'l Sec. Agency, No. 14-975, 78 F.Supp.3d 45, 49-50, 2015 WL 151465, at *1 (D.D.C. Jan. 13, 2015).
In addition to the NSA's telephony metadata program, the NSA's involvement in at least three other classified programs concerning the bulk collection of communications are implicated by the plaintiff's claim. Under the Pen Register and Trap and Trace ("PR/TT") program, the government sought FISC orders permitting the collection from service providers of certain electronic communications metadata, including the "to," "from," and "cc" lines of an email, along with the time and date of an email. See Ex. 11, Pl.'s Aviad Decl (Press Release, Office of the Director of National Intelligence, DNI Clapper Declassifies Additional Intelligence Community Documents Regarding Collection Under Section 501 of the Foreign Intelligence Surveillance Act, Nov. 18, 2013). Once collected, the information was stored in a secured database. Id. The maintenance and searching of the collected database records was subject to strict requirements similar to those set forth for the NSA's telephony metadata program. Id. The NSA has not acknowledged a partnership with any specific telecommunications provider regarding the PR/TT program and the program has since been discontinued. See id.
Similarly, media reports have also discussed what have been referred to as the NSA's PRISM collection and the "upstream collection" program. Under the PRISM program, the NSA acquired electronic communications, including e-mails, directly from "compelled U.S.-based providers," such as Google, Apple, and Facebook. See Ex. 8, Pl.'s Aviad Decl. (Declassified Declaration of Frances J. Fleisch, NSA ("NSA's Fleisch Decl."), at ¶ 38, Jewel v. Nat'l Sec. Agency, No. 08-CV-04373 (N.D.Cal. May 5, 2014), ECF No. 227); Ex. 12, Pl.'s Aviad Decl. (Glenn Greenwald & Ewan MacAskill, NSA Prism Program Taps into User Data of Apple, Google, and Others, The Guardian, June 7, 2013). In the separate "upstream collection" program, "the NSA collects electronic communications with the compelled assistance of electronic communication service providers as they transit Internet `backbone' facilities within the United States." NSA's Fleisch Decl. ¶ 38; see [Redacted] Mem. Op., 2011 WL 10945618, at *9 (FISC Oct. 3, 2011). Between these two programs, the NSA "acquires more than two hundred fifty million Internet communications each year." [Redacted] Mem. Op., 2011 WL 10945618, at *9. Like the PR/TT program, the NSA has not acknowledged the identity of any service providers participating in either the PRISM or the upstream collection programs. See Pl.'s Mem. at 24 ("[T]he NSA has not specifically named any telecommunications or Internet service providers participating in its bulk electronic communications collections programs....").
Congress enacted the FOIA as a means "to open agency action to the light of public scrutiny." Am. Civil Liberties Union v. U.S. Dep't of Justice, 750 F.3d 927, 929 (D.C.Cir.2014) (quoting Dep't of Air Force v. Rose, 425 U.S. 352, 361, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976)). Disclosure is the "`basic policy'" of the Act. Citizens for Responsibility & Ethics in Washington v. U.S. Dep't of Justice (CREW), 746 F.3d 1082, 1088 (D.C.Cir. 2014) (quoting Dep't of Interior v. Klamath Water Users Protective Ass'n, 532 U.S. 1, 8, 121 S.Ct. 1060, 149 L.Ed.2d 87 (2001). At the same time, the statute represents a "balance [of] the public's interest in governmental transparency against legitimate governmental and private interests that could be harmed by release of certain types of information." United Techs. Corp. v. U.S. Dep't of Def., 601 F.3d 557,
The agency invoking an exemption to the FOIA "bears the burden of showing that a claimed exemption applies." Elec. Frontier Found. v. U.S. Dep't of Justice, 739 F.3d 1, 7 (D.C.Cir.2014); see also CREW, 746 F.3d at 1088; Loving v. U.S. Dep't of Def., 550 F.3d 32, 37 (D.C.Cir.2008); Assassination Archives & Research Ctr. v. CIA, 334 F.3d 55, 57 (D.C.Cir.2003). In order to carry this burden, an agency must submit sufficiently detailed affidavits or declarations, a Vaughn index of the withheld documents, or both, to demonstrate that the government has analyzed carefully any material withheld, to enable the court to fulfill its duty of ruling on the applicability of the exemption, and to enable the adversary system to operate by giving the requester as much information as possible, on the basis of which he can present his case to the trial court. See DeBrew v. Atwood, No. 12-5361, 792 F.3d 118, 122-23, 2015 WL 3949421, at *2 (D.C.Cir. June 30, 2015); see also CREW, 746 F.3d at 1088 ("The agency may carry that burden by submitting affidavits that `describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the information withheld logically falls within the claimed exemption, and are not controverted by either contrary evidence in the record nor by evidence of agency bad faith.'" (quoting Larson v. U.S. Dep't of State, 565 F.3d 857, 862 (D.C.Cir.2009)); Oglesby v. U.S. Dep't of the Army, 79 F.3d 1172, 1176 (D.C.Cir.1996) ("The description and explanation the agency offers should reveal as much detail as possible as to the nature of the document, without actually disclosing information that deserves protection... [which] serves the purpose of providing the requestor with a realistic opportunity to challenge the agency's decision.").
The FOIA provides federal courts with the power to "enjoin the agency from withholding agency records and to order the production of any agency records improperly withheld from the complainant." 5 U.S.C. § 552(a)(4)(B). Moreover, a district court has an "affirmative duty" to consider whether the agency has produced all segregable, non-exempt information. Elliott v. U.S. Dep't of Agric., 596 F.3d 842, 851 (D.C.Cir.2010) (referring to court's "affirmative duty to consider the segregability issue sua sponte" (quoting Morley v. CIA, 508 F.3d 1108, 1123 (D.C.Cir.2007))); Stolt-Nielsen Transp. Grp. Ltd. v. United States, 534 F.3d 728, 733-735 (D.C.Cir.2008) ("`[B]efore approving the application of a FOIA exemption, the district court must make specific findings of segregability regarding the documents to be withheld.'" (quoting Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1116 (D.C.Cir.2007))); see also 5 U.S.C. § 552(b) ("Any reasonably segregable portion of a record shall be provided to any person requesting such record after deletion
Summary judgment is appropriate when "there is no genuine dispute as to any material fact." Fed.R.Civ.P. 56. "In FOIA cases, `[s]ummary judgment may be granted on the basis of agency affidavits if they contain reasonable specificity of detail rather than merely conclusory statements, and if they are not called into question by contradictory evidence in the record or by evidence of agency bad faith.'" Judicial Watch, Inc. v. U.S. Secret Serv., 726 F.3d 208, at 215 (D.C.Cir.2013) (quoting Consumer Fed'n of Am. v. U.S. Dep't of Agric., 455 F.3d 283, 287 (D.C.Cir.2006) and Gallant v. NLRB, 26 F.3d 168, 171 (D.C.Cir.1994)). "Ultimately, an agency's justification for invoking a FOIA exemption is sufficient if it appears `logical' or `plausible.'" Judicial Watch, Inc. v. U.S. Dep't of Def., 715 F.3d 937, 941 (D.C.Cir. 2013) (quoting Am. Civil Liberties Union v. U.S. Dep't of Def. (ACLU/DOD), 628 F.3d 612, 619 (D.C.Cir.2011)); Larson v. U.S. Dep't of State, 565 F.3d 857, 862 (D.C.Cir.2009) (quoting Wolf v. CIA, 473 F.3d 370, 374-75 (D.C.Cir.2007)).
In the present case, "to the extent [the] plaintiff's [FOIA] request sought surveillance or other intelligence records, or communications about such records," the NSA issued the plaintiff a so-called "Glomar" response, which neither confirmed nor denied the existence of records relevant to the plaintiff's request.
A Glomar response is "an exception to the general rule that agencies must acknowledge the existence of information responsive to a FOIA request and provide specific, non-conclusory justifications for withholding that information." Roth v. U.S. Dep't of Justice, 642 F.3d 1161, 1178 (D.C.Cir.2011). Thus, a Glomar response allows an agency to respond to a FOIA request by neither confirming nor denying the existence of any records responsive to the request, on the grounds that "confirming or denying the existence of records would itself `cause harm cognizable under a[] FOIA exception.'" Id. (quoting Wolf, 473 F.3d at 374). In issuing a Glomar response, the agency bears the
A Glomar response may be challenged in two distinct but related ways. A plaintiff may challenge the agency's assertion that confirming or denying the existence of any records would result in a cognizable harm under a FOIA exemption. See, e.g., People for the Ethical Treatment of Animals v. Nat'l Institutes of Health, 745 F.3d 535, 540 (D.C.Cir. 2014); Elec. Privacy Info. Ctr. v. Nat'l Sec. Agency (EPIC/NSA), 678 F.3d 926, 932 (D.C.Cir.2012); Roth, 642 F.3d at 1172. Alternatively, or in addition, a plaintiff may demonstrate that the agency has "officially acknowledged" the existence of a requested record previously. See, e.g., ACLU/CIA, 710 F.3d at 427 ("[T]he plaintiff can overcome a Glomar response by showing that the agency has already disclosed the fact of the existence (or nonexistence) of responsive records, since that is the purportedly exempt information that a Glomar response is designed to protect."); Moore v. CIA, 666 F.3d 1330, 1333 (D.C.Cir.2011) ("Moore does not challenge the CIA's reliance on exemptions (b)(1) and (b)(3) .... [but instead], Moore argues that the CIA has officially acknowledged that it maintains information responsive to Moore's FOIA request...."); Wolf, 473 F.3d at 378 ("Although the CIA properly invoked Exemptions 1 and 3, Wolf asserts that the Agency waived both of them by officially acknowledging the existence of records...."). The official acknowledgment doctrine recognizes that, in certain circumstances, the agency may have waived its right to claim a FOIA exemption over the existence or non-existence of the records. See ACLU/CIA, 710 F.3d at 426 ("[W]hen an agency has officially acknowledged otherwise exempt information through prior disclosure, the agency has waived its right to claim an exemption with respect to that information.").
The plaintiff asserts both bases to overcome the NSA's Glomar response. See Pl.'s Mem. at 27 ("Even if the Court were to find that the information that [the plaintiff] seeks is properly protected under the exemptions (which it is not), ... the NSA's official acknowledgements over the last 18 months regarding its bulk collection programs... override even valid exemption claims."). The Court first addresses the propriety of the NSA's invocation of Exemptions 1 and 3 for its Glomar response before turning to the plaintiff's argument that the NSA has officially acknowledged the requested records.
The NSA grounds its Glomar response in Exemptions 1 and 3 of the FOIA statute. See Def.'s Mem. at 9. Although the plaintiff expressly challenges the propriety of the NSA's invocation of Exemptions 1 and 3 for purposes of its Glomar response, the plaintiff devotes only two brief paragraphs of the more than 55 pages of briefing to this argument, and for good reason.
"In reviewing an agency's Glomar response, this Court exercises caution when the information requested `implicat[es] national security, a uniquely executive purview.'" EPIC/NSA, 678 F.3d at
Exemption 1 protects from disclosure records that are "(A) specifically authorized under criteria established by an Executive order to be kept secret in the interest of national defense or foreign policy, and (B) are in fact properly classified pursuant to such an Executive order." 5 U.S.C. § 552(b)(1); see Milner v. U.S. Dep't of Navy, 562 U.S. 562, 580, 131 S.Ct. 1259, 179 L.Ed.2d 268 (2011) (noting that among the "tools at hand to shield national security information and other sensitive materials," the government has "[m]ost notably, Exemption 1 of FOIA [which] prevents access to classified documents."). Thus, an agency attempting to withhold information under Exemption 1 must show that the information has been classified in compliance with the classification procedures set forth in the relevant executive order and that only information conforming to the executive order's substantive criteria for classification has been withheld. See Judicial Watch, 715 F.3d at 941 (discussing "substantive and procedural criteria for classification"); Lesar v. Dep't of Justice, 636 F.2d 472, 483 (D.C.Cir.1980) ("To be classified properly, a document must be classified in accordance with the procedural criteria of the governing Executive Order as well as its substantive terms.")).
In this case, the NSA has sufficiently established that the existence or non-existence of responsive records is classified under Executive Order ("E.O.") 13,526. This E.O. sets forth four requirements for the classification of national security information: (1) an original classification authority must classify the information; (2) the U.S. Government must own, produce, or control the information; (3) the information must be within at least one of eight protected categories enumerated in section 1.4 of the E.O.; and (4) the original classification authority must determine that the unauthorized disclosure of the information reasonably could be expected to result in a specified level of damage to the national security, and the classification authority is able to identify or describe the damage. See E.O. 13526 § 1.1(a).
The NSA avers that "[a]cknowledgement of the existence or non-existence of intelligence information referencing Plaintiff would reveal information that is currently and properly classified as set forth in Section 1.4(c) of E.O 13,526," which covers "intelligence sources [or] methods." NSA Sherman Decl. ¶ 31. Specifically,
The plaintiff challenges whether the acknowledgment of the existence or non-existence of the requested records would implicate intelligence sources and methods and would otherwise cause national harm. According to the plaintiff, "the bulk data collection programs under which the NSA obtained the information [the plaintiff] seeks sweep up not just the communications data of individuals that the NSA has specifically targeted, but rather, the data of millions of people whose communications cross the United States border, whether those people are targets of the NSA or not."
A variant of the plaintiff's argument was considered and rejected in Competitive Enterprise Institute v. National Security Agency, 78 F.Supp.3d at 59-61, 2015 WL 151465, at *10, a case that also considered the NSA's issuance of a Glomar response in the context of documents allegedly maintained as a result of the bulk collection of telephony metadata. In Competitive Enterprise Institute, the Court expressly rejected the argument "that because the agency has admitted collecting the records in bulk, it would not reveal important intelligence information to acknowledge that EPA officials' calls were swept up in the collection." Id. The court reasoned that "were the agency required to confirm or deny the existence of records for specific individuals, it would begin to sketch the contours of the program, including, for example, which providers turn over data and whether the data for those providers is complete." Id. Indeed, the D.C. Circuit has cautioned, "`the fact that some information resides in the public domain does not eliminate the possibility that further disclosures can cause harm to intelligence sources, methods and operations.'" ACLU/DOD, 628 F.3d at 625 (quoting Fitzgibbon v. CIA, 911 F.2d 755, 766 (D.C.Cir.1990)). "Minor details of intelligence information may reveal more information than their apparent
The NSA's invocation of Exemption 3 is likewise proper. The NSA invokes a recognized withholding statute, Section 102A(i)(1) of the National Security Act of 1947, in support of its Glomar response. See ACLU/DOD, 628 F.3d at 619. Section 102A(i)(1) protects "intelligence sources and methods from unauthorized disclosure." 50 U.S.C. § 3024. The plaintiff's challenges to Exemption 3 mirror the arguments made in opposition to Exemption 1. Since the Court has found the plaintiff's argument on that score to be unpersuasive, the plaintiff's Exemption 3 argument is similarly unavailing.
The central dispute between the parties concerns whether the NSA has previously acknowledged the existence of the records requested by the plaintiff, thereby waiving its right to claim an exemption regarding the existence vel non of any responsive records. The plaintiff claims that the NSA has made "multiple official disclosures that it collects a broad and voluminous scope of the telephone and electronic communications data of Americans through a series of programs with the compelled assistance of some of the largest U.S. telecommunications and internet service providers." Pl.'s Mem. at 20. In light of these disclosures, the plaintiff argues that the NSA has waived its right to issue a Glomar response to the plaintiff's FOIA request, which encompassed "all email, letter, telephonic, or other communications" by the plaintiff. Id. at 18-28.
The D.C. Circuit has recognized that if "the agency has officially acknowledged
An agency's official acknowledgment must meet three criteria:
Fitzgibbon, 911 F.2d at 765; see also Moore, 666 F.3d at 1333; ACLU/DOD, 628 F.3d at 620-21; Wolf, 473 F.3d at 378. The plaintiff "bears the burden of pointing to `specific information in the public domain that appears to duplicate that being withheld.'" EPIC/NSA, 678 F.3d at 933 (quoting Wolf, 473 F.3d at 378). The plaintiff may not, however, point to mere media speculation. See id. at 933 n. 5 ("[T]he national media are not capable of waiving NSA's statutory authority to protect information related to its functions and activities."); Competitive Enter. Inst., 78 F.Supp.3d at 59, 2015 WL 151465, at *10 ("[S]peculation by the press — no matter how widespread — and disclosures in the press from unnamed sources are not sufficient to waive an agency's right to withhold information under FOIA.").
In the present case, the plaintiff points to the NSA's public acknowledgements regarding its various bulk data collection programs — the telephony metadata program, the PR/TT program, the PRISM program, and the upstream collection program — to argue that the NSA has waived its right to issue a Glomar response. As explained below, the Court finds that the NSA has officially acknowledged the collection of certain telephony metadata from Verizon Business Network Services from April 25, 2013 through July 19, 2013, but has not otherwise officially acknowledged its possession of any other records sought by the plaintiff.
The plaintiff has compiled multiple documents concerning the NSA's telephony metadata program, of which the NSA has acknowledged two publically released FISC orders detailing the program. Specifically, the plaintiff notes that the publically acknowledged FISC Secondary Order directed Verizon Business Network Services to provide to the NSA "on an ongoing daily basis ... all call detail records or `telephony metadata' created by Verizon for communications (i) between the United States and abroad; or (ii) wholly within the United States, including local telephone calls." Secondary Order at 2. The Secondary Order was limited to a 90-day period between April 25, 2013 and July 19, 2013, and included the originating and terminating telephone number along with the time and duration of the call. The plaintiff further contends that the NSA has conceded in public disclosures that the program has been in existence since at least May 2006 and that the NSA has admitted that as of January 3, 2014, "at least 15 different FISC judges have entered a total of 36 orders authorizing NSA's bulk collection of telephony metadata." Reply Supp. Pl.'s Cross Mot. Summ. J. ("Pl.'s Reply") at 9, ECF No. 26 (citing NSA's Shea Decl. ¶¶ 13-14). Taken together, the plaintiff argues that it communicated regularly with its legal counsel, a Verizon Business Network Services subscriber, and therefore, "based on the NSA's own admissions, some of [the plaintiff's] privileged communications with its counsel were almost certainly collected."
As noted previously, another decision in this District considered the propriety of an NSA Glomar response in light of the NSA's public statements regarding the bulk collection of telephony metadata. In Competitive Enterprise Institute, the plaintiff cited many of the same documents relied upon by the plaintiff in the present case: public statements by agency officials; an administration white paper; declarations of agency officials; newspaper reports; court opinions; and the Primary and Secondary Orders. See 78 F.Supp.3d at 55-61, 2015 WL 151465, at *7-10. After examining the statements, the court concluded that the "the sources ... do not give any indication that the government collects metadata for all U.S. phone customers or even the subset of all Verizon Wireless users. As such, they do not show that the government has the specific records they seek." Id. at 54, 2015 WL 151465, at *5 (emphasis in original). The court's analysis turned on whether the NSA had acknowledged the participation of a service provider in the collection program. The plaintiff seeks to distinguish Competitive Enterprise Institute by noting that while the plaintiff in Competitive Enterprise Institute sought records relating to Verizon Wireless, the plaintiff in the present case has sought records pertaining to Verizon Business Networks Services, an acknowledged participant in the program. See Pl.'s Supp Aviad. Decl. ¶ 2. The plaintiff is correct, but only with respect to those documents obtained as a result of the officially acknowledged Secondary Order, i.e., the telephony metadata collected from Verizon Business Network Services between April 25, 2013 and July 19, 2013.
With respect to other telephone service providers and other periods of time, the plaintiff has not pointed to any disclosures documenting the specific telephone service providers that participated in the program and during what periods of time. Such imprecision will not suffice to overcome the NSA's Glomar response. The D.C. Circuit has expressly directed courts to apply the "official acknowledgement" exception "strictly," such that the "official acknowledgement" only extends to the specific records that are acknowledged by the agency. See Moore, 666 F.3d at 1333; Wolf, 473 F.3d at 378-79. Indeed, this Circuit requires that a plaintiff "pinpoint an agency record that both matches the plaintiff's request and has been publicly and officially acknowledged by the agency." Moore, 666 F.3d at 1333 (emphasis added). The plaintiff has been unable to pinpoint specific disclosures regarding the participation of other telephone service providers in the NSA's telephony metadata program, a circumstance present in other cases where courts have determined that the NSA did not officially acknowledge any additional participants in the telephony metadata program. See Elec. Frontier Found. v. U.S. Dep't of Justice, No. 11-CV-5221, 2014 WL 3945646, at *5-7 (N.D.Cal. Aug. 11, 2014) (rejecting argument that the identity of participants in the telephony metadata program "has lost
Rather than pinpoint specific acknowledged disclosures, the plaintiff instead makes a series of logical deductions based on the nature of the telephony metadata program and general media speculation regarding the scope of the program to claim that the NSA has acknowledged other participants in the telephony metadata program. See Pl.'s Mem. at 7 (discussing implication of "Federal Communications Commission (FCC) report" discussing AT & T, Verizon, and Sprint as the nation's "three largest international telephone call providers"), id. at 8 n.6 ("[T]he NSA's draft report strongly suggests that AT & T and Verizon have assisted the NSA in collecting both telephonic and email communications in the past); id. at 22-25. Logical deductions may not substitute for official acknowledgements, however. See Valfells v. CIA, 717 F.Supp.2d 110, 117 (D.D.C.2010) ("Logical deductions are not, however, official acknowledgments."), aff'd sub nom. Moore v. CIA, 666 F.3d 1330 (D.C.Cir.2011).
The plaintiff's further reliance on ACLU v. CIA, 710 F.3d 422, 428-29 (D.C.Cir. 2013), is inapposite. In ACLU, the D.C. Circuit addressed the ACLU's FOIA request for documents relating to drone strikes. The D.C. Circuit rejected the CIA's Glomar response because the CIA "proffered no reason to believe that disclosing whether it has any documents at all about drone strikes will reveal whether the Agency itself — as opposed to some other U.S. entity such as the Defense Department — operates drones." ACLU/CIA, 710 F.3d at 428-29. Instead, the CIA's acknowledgment of its possession of documents relating to drones would reveal only that the CIA maintained an intelligence interest in drones. Id. at 428. In light of official acknowledgments by the CIA and the President, the Court concluded that it was neither "logical or plausible" for the CIA to contend that confirming the CIA's interest in drones would reveal information not already publically acknowledged. Id. Similarly, in the present case, the NSA officially acknowledged the collection of telephony metadata information from Verizon Business Network Services, making it neither logical nor plausible for the NSA to deny this fact now. The NSA's acknowledgement of its possession of telephony metadata from Verizon Business Network Services would reveal no new information not already in the public domain. This is not the case, however, with respect to telephony metadata records from other time periods or other service providers. See EPIC/NSA, 678 F.3d at 933 ("EPIC has failed to meet its burden because its blanket request for `[a]ll records of communication between NSA and Google concerning Gmail' covers a substantially broader swath of information than what NSA has voluntarily published on its website."); Students Against Genocide v. U.S. Dep't of State, 50 F.Supp.2d 20, 25 (D.D.C.1999) ("[T]here is certainly no `cat out of the bag' philosophy underlying FOIA so that any public discussion of protected information dissipates the protection which would otherwise shield the information sought."). The NSA has not acknowledged any additional participants in the telephony metadata program or acknowledged receiving metadata from Verizon Business Network Services for any period outside of April 25, 2013 to July 19, 2013. To require the NSA to acknowledge the existence or non-existence of materials beyond that limited period would require the NSA to acknowledge information that has not otherwise been publically disclosed.
Although the plaintiff compiled a robust record detailing the public disclosures of the NSA's telephony metadata program, the plaintiff has made no such showing regarding any of the other electronic communications programs — the PR/TT program, the PRISM program, and the upstream collection program.
Although the NSA's Glomar response was improper with respect to certain Verizon Business Network Services documents, this finding does not end the inquiry into the NSA's FOIA response. The NSA makes the alternative argument that even if its Glomar response was improper as to the limited set of documents relating to Verizon Business Network Services, the terms of the Primary Order and Secondary Order do not permit the NSA to disclose any records to the plaintiff. See Mem. Further Supp. Def.'s Mot. Summ. J. ("Def.'s Reply") at 13-15, ECF No. 23.
FOIA confers jurisdiction on the district court to compel an agency to release requested records only if those records are "improperly withheld." Morgan, 923 F.2d at 196 (internal quotation marks omitted). An improper withholding does not occur, and the FOIA does not apply, when documents are withheld pursuant
Ultimately, "the proper test for determining whether an agency improperly withholds records [subject to a court order] is whether the [order], like an injunction, prohibits the agency from disclosing the records." Morgan, 923 F.2d at 197 (emphasis in original). The agency bears the burden of demonstrating that the responsive records are not subject to disclosure under the terms of a court order. Id. at 198. Merely stating that responsive records are subject to a court order or other restriction is insufficient to demonstrate that "the court issued the [order] with the intent to prohibit the agency from disclosing the records," as required under the Morgan standard. See Morgan, 923 F.2d at 198 ("If the [agency] obtains a clarifying order stating that the [order] prohibits disclosure, the [agency] is obviously entitled to summary judgment."); see also Awan v. U.S. Dep't of Justice, 10 F.Supp.3d 96, 107 (D.D.C.2014) (finding "that the defendants have not established the Southern District's sealing order as a proper basis for withholding the over decade old material witness warrant affidavit under the FOIA" where defendants lacked clarifying order), vacated 46 F.Supp.3d 90, 92 (D.D.C.2014) (concluding "that the government's withholding of the material witness warrant affidavit in compliance with the sealing order does not constitute an improper withholding under the FOIA" after the government obtained clarifying order); Concepcion v. FBI, 699 F.Supp.2d 106, 111-114 (D.D.C.2010); Senate of Commw. of P.R, 1993 WL 364696, at *6-7, (D.D.C. Aug. 24, 1993).
The agency may satisfy its burden under Morgan by referring to (1) the order itself; (2) extrinsic evidence, such as papers filed with the court that provide the rationale for the sealing; (3) orders of the same court in similar cases that explain the purpose of the order; or (4) the court's general rules of procedures governing the order. Morgan, 923 F.2d at 198; Concepcion, 699 F.Supp.2d at 111. Upon finding that an order prohibits the agency from releasing the records, the agency is entitled to summary judgment on its withholding of the records. Morgan, 923 F.2d at 198. A review of the Morgan factors reveals that the NSA has no discretion to disclose the requested documents and its
The text of the Primary Order makes plain the NSA's lack of discretion to access and disclose to the plaintiff the requested metadata. Indeed, the Primary Order permits the agency to access metadata records only in certain defined circumstances. Specifically, the Primary Order "prohibit[s]" the government "from accessing business record metadata acquired pursuant to this Court's orders in the above-captioned docket and its predecessors... for any purpose except as described herein." Primary Order at 2 (emphasis added). The Primary Order designates two purposes. First, certain authorized technical personnel "may access the ... metadata for purposes of obtaining foreign intelligence information." Id. Second, "technical personnel may access the ... metadata to perform those processes needed to make it usable for intelligence analysis." Id. Neither scenario affords the NSA the discretion to access the metadata for purposes of complying with the plaintiff's FOIA request.
Although the Primary Order does not make specific reference to FOIA, the Primary Order is clear that the metadata may not be accessed "for any purpose except as" permitted by the Primary Order. Given the context of the Primary Order, the broad language regarding "any purpose" is sufficient to encompass FOIA. Such strict limitations regarding access to the collected metadata make abundant sense. In permitting the NSA to collect large amounts of personal information regarding U.S. citizens, the FISC was careful to put limitations on its access and use. The metadata may be accessed only for certain limited purposes (foreign intelligence) and only in certain limited ways (using specially approved searches). To permit FOIA plaintiffs (and thereby the public at large) access to all of the collected metadata would be to undermine the careful architecture erected by the FISC and enshrined in the Primary Order.
Likewise, the Primary Order restricts the subsequent dissemination of metadata information. Before the NSA may disseminate information pertaining to any U.S. person, certain high-level officials "must determine that the information identifying the U.S. person is in fact related to counterterrorism information and that it is necessary to understand the counterterrorism information or assess its importance." Primary Order at 3. To be sure, the Primary Order does contemplate disclosure of the accessed metadata beyond the NSA in certain limited scenarios, including disclosure to the Executive Branch in order to (1) "enable them to determine whether the information contains exculpatory or impeachment information or is otherwise discoverable in legal proceedings" and (2) "facilitate their lawful oversight functions." Id. While such language might ordinarily weigh against the NSA in the Morgan analysis, the Primary Order's relative flexibility on disclosure is of less importance in the present case. As discussed, the NSA is forbidden under the terms of the Primary Order from accessing the collected telephony metadata in order to respond to the plaintiff's FOIA request. In other words, the only responsive telephony metadata records that the Primary Order might permit the NSA to disseminate concern telephony metadata records previously accessed as a result of an authorized search as part of an ongoing investigation. Consequently, the NSA "would only have communications in its searchable intelligence files of entities that are related to foreign intelligence investigations" because those were the only searches that would have been previously authorized under the Primary Order. Def.'s Reply at 9. Yet
Both the limitations upon the Court's holding and the peculiar circumstances of this case require highlighting. The instant case presents multiple competing interests all of significant public concern: personal privacy; national security; and transparency in government, along with the related concern of ensuring agency accountability. Under the plaintiff's theory on the applicability of the FOIA in this case, the telephony metadata records (and any email communications) held in databases by the NSA could potentially be searched and accessed by any person through the timely submission of a FOIA request.
As noted, the NSA did not issue a Glomar response as to the entirety of the plaintiff's FOIA request. Rather, the NSA conducted a search for documents relating to the non-intelligence records sought by the plaintiff, i.e., the plaintiff's request for documents relating to its business contracts and pending civil and criminal cases. The NSA's search yielded no results and the plaintiff correspondingly challenges the adequacy of the NSA's search for responsive records.
"The court applies a reasonableness test to determine the adequacy of a search methodology." Morley, 508 F.3d at 1114 (internal quotations and citations omitted) "[T]he adequacy of a FOIA search is generally determined not by the fruits of the search, but by the appropriateness of the methods used to carry out the search." Iturralde v. Comptroller of Currency, 315 F.3d 311, 315 (D.C.Cir. 2003). "An agency may establish the adequacy of its search by submitting reasonably detailed, nonconclusory affidavits describing its efforts." Baker & Hostetler LLP v. U.S. Dep't of Commerce, 473 F.3d 312, 318 (D.C.Cir.2006). "`Agency affidavits are accorded a presumption of good faith, which cannot be rebutted by purely speculative claims about the existence and discoverability of other documents.'" DeBrew, 2015 WL 3949421, at *2 (quoting SafeCard Servs., Inc. v. SEC, 926 F.2d 1197, 1200 (D.C.Cir.1991)).
Agency affidavits should identify the terms search and explain how the search was conducted. See Morley, 508 F.3d at 1122 (citing Oglesby v. U.S. Dep't of Army, 920 F.2d 57, 68 (D.C.Cir.1990)).
The NSA presents two affidavits from the NSA's Associate Director for Policy and Records in support of its search for records in the present case. The NSA tasked "its Office of General Counsel, its acquisition organization, and its logistics organization" to conduct the relevant searches. NSA's Sherman Decl. ¶ 27. These organizations were chosen as they were deemed to be the organizations "that would possess records responsive to the Plaintiff's FOIA request, if any such records existed," as only those organizations maintained contract and litigation-related records. Id. The NSA determined that "[n]o other non-intelligence organization within the NSA would have such records" and that "if any non-intelligence related information response to the Plaintiff's FOIA request existed at the NSA, it would have been located by these three organizations in their respective filing system based on the search methodology" employed. NSA's Suppl. Sherman Decl. ¶¶ 2, 4. The NSA queried the records of the relevant organizations using three variants of the plaintiff's name and the numbers for the relevant contract. The records databases contained memoranda, meeting minutes, reports, manuals, and other documents. NSA's Sherman Decl. ¶ 27. Within the Office of General Counsel, attorneys also searched their Microsoft Outlook email accounts while administrative personnel and paralegals searched the organization's litigation filings systems. Id. The NSA also searched the "contracting management information system database," which is maintained in support of the NSA's contracting activity. Id. No responsive records were found as a result of any of these searches.
The plaintiff objects to the adequacy of the NSA's search, challenging both the scope of the search and the search terms employed. Neither objection withstands scrutiny. First, the plaintiff attacks the NSA's decision to limit its search of records to those contained in the Office of General Counsel, the acquisitions organization, and the logistics organization. The plaintiff argues that "[b]ecause those organizations only handle matters on behalf of the NSA, there was no reason for them to possess documents regarding contracts and lawsuits that did not involve the Agency." Pl.'s Mem. at 30. The plaintiff misconstrues the nature of the NSA's search. The NSA searched these organizations because "[n]o other non-intelligence organization within the NSA would have [contract or litigation related records] because these other organizations would only have records of individuals and organizations... that have some affiliation with the NSA." NSA's Suppl. Sherman Decl. ¶ 2 (emphasis added). The fact that these
Second, the plaintiff attacks the use of search terms employed by the NSA. The NSA used three variations of the plaintiff's name and the contract numbers for its search.
"In general, the adequacy of a search is `determined not by the fruits of the search, but by the appropriateness of [its] methods.'" Hodge v. FBI, 703 F.3d 575, 579 (D.C.Cir.2013) (quoting Iturralde, 315 F.3d at 315). "[T]here is no bright-line rule requiring agencies to use the search terms proposed" by a plaintiff. Physicians for Human Rights v. U.S. Dep't of Def., 675 F.Supp.2d 149, 164 (D.D.C.2009). Federal agencies have discretion in crafting a list of search terms that "they believe[] to be reasonably tailored to uncover documents responsive to the FOIA request." Id. Where the search terms are reasonably calculated to lead to responsive documents, the Court should not "micro manage" the agency's search. See Johnson v. Executive Office for U.S. Attorneys, 310 F.3d 771, 776 (D.C.Cir.2002) ("FOIA, requiring as it does both systemic and case-specific exercises of discretion and administrative judgment and expertise, is hardly an area in which the courts should attempt to micro manage the executive branch."); Liberation Newspaper v. U.S. Dep't of State, No. 13-0836, 80 F.Supp.3d 137, 146-47, 2015 WL 709197, at *6 (D.D.C. Feb. 19, 2015) ("Where the agency's search terms are reasonable, the Court will not second guess the agency regarding whether other search terms might have been superior.").
The plaintiff's insistence on its own preferred search terms does not undermine the reasonableness of the NSA's search terms. Moreover, the plaintiff's terms are not without their own criticism. Indeed, the plaintiff proffers no explanation for how the inclusion of legal case numbers would be likely to yield responsive documents when the NSA already searched by the plaintiff's name. Moreover, while the NSA could have also used an abbreviation of the plaintiff's name as a search term, an abbreviation in a record typically follows after the full name is used, and the search terms used employed both full and shortened versions of the plaintiff's name. In short, the plaintiff offers only speculation as to the results of an alternative search, but speculation as to the potential results of a different search does not necessarily undermine the adequacy of the agency's actual search. Although the NSA could have used additional variations of the plaintiff's name or the
Through two declarations by the NSA's Associate Director for Policy and Records, the NSA identified the records systems searched, the rationale for searching those records systems, the search terms employed, and averred that all files likely to contain responsive materials were searched. The plaintiff has presented no grounds for upsetting the presumption of regularity afforded to these declarations, and the Court finds that the declarations are reasonably detailed and the NSA's search was reasonably calculated to lead to responsive documents.
For the foregoing reasons, the NSA's Motion for Summary Judgment is granted and the plaintiff's Cross-Motion for Summary Judgment or, in the Alternative, for Limited Discovery is denied. An appropriate Order accompanies this Memorandum Opinion.
