UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
ELECTRONIC PRIVACY
INFORMATION CENTER
Plaintiff,
v. Civil Action No. 12-0333 (GK)
THE UNITED STATES DEPARTMENT
OF HOMELAND SECURITY
Defendant.
MEMORANDUM OPINION
Plaintiff Electronic Privacy Information Center ("Plaintiff"
or "EPIC") brings this action against Defendant the United States
Department of Homeland Security ("the Government" or "OHS") under
the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552. Plaintiff
seeks records concerning the Defense Industrial Base Cyber Pilot
("DIB Cyber Pilot"), a cyber-security pilot program jointly
conducted by the United Stat.es Department of Defense ("DoD") and
Defendant OHS. Government's Motion for Summary Judgment ("DHS' s
Mot.") at 2 [Dkt. No. 53].
The program, which "aim[ed] . to protect U.S. critical
infrastructure [,] [and] furnished classified thr.eat and
technical information to voluntarily participating [] companies or
their Commercial Service Providers[]." Id. EPIC, citing concerns
from the Department of Justice about the program "[running] afoul
-1-
of laws forbidding government surveillance of private Internet
traffic [,] . . sought records to determine whether . . the DIB
Cyber Pilot program complied with federal wiretap laws."
Plaintiff's Combined Opposition to Defendant's Motion for Summary
Judgment and Cross-Motion for Summary Judgment ("Pl.'s Mot.") at
2 [Dkt. No. 57].
OHS conducted a search for records responsive to EPIC' s
request, produced documents to EPIC, and provided a Vaughn index
for all documents that were withheld in full or in part under one
of FOIA' s several exemptions. § 552 (b); see also Defendant's Vaughn
Index for Challenged Withholdings ("Vaughn index") [Dkt. No.
53-4] . EPIC now challeng-es the sufficiency of the search conducted
by OHS, as well as the Government's application of FOIA Exemptions
1, 3, 4, 5, and 7(0) to withhold certain responsive information.
Upon consideration of the Motions, Oppositions, Replies, the
entire record herein, and for the reasons stated below, Plaintiffs'
Motion for Summary Judgment shall be denied without prejudice with
regard to Exemption 70 and otherwise denied in whole, and the
Government's Motion for Summary Judgment shall be granted in part
and denied in part without prejudice.
-2-
I . BACKGROUND
A. FOIA
The Freedom of Information Act ("FOIA"), 5 U.S.C § 552, was
enacted by Congress "to ensure an informed citizenry, vital to the
functioning of a democratic society." Critical Mass Energy Project
v. Nuclear Regulatory Comm'n, 975 F.2d 871, 872 (D.C. Cir. 1992)
("Critical Mass III"), cert. denied, 507 U.S. 984 (1993) (citing
FBI v. Abramson, 456 U.S. 615, 621 (1982)). "In enacting FOIA,
Congress struck the balance it thought right--generally favoring
disclosure, subject only to a handful of specified exemptions--
and did so across the length and breadth of the Federal
Government." Milner v. Dep't of the Navy, 562 U.S. 562, 571 n.5
(2011). FOIA's "basic purpose reflect[s] a general philosophy of
full agency disclosure unless information is exempted under
clearly delineated statutory language." Dep't of the Air Force v.
Rose, 425 U.S. 352, 360-361 (1976) (internal citations and
quotation marks omitted) .
When an ag-ency receives a request for records, the agency
must conduct a sufficient search within the scope of the request,
5 U.S.C. § 552_(a) (3) (A). The agency then must furnish the
information in a timely manner, unless the information is precluded
from disclosure by one of FOIA's nine exemptions. § 552(b). FOIA's
"goal is broad disclosure, [thus] the exemptions must be given a
narrow compass." Milner, 562 U.S. at 563 (citing United States
-3-
Oep't of Justice v. Tax Analysts, 492 U.S. 136, 151 (1989)). The
Government always bears the burden of proving exemptions apply for
any responsive information that is withheld.§ 552(a) (4) (B).
B. Factual Background
1. EPIC's FOIA Request
On July 26, 2011, EPIC submitted a FOIA request for documents
to OHS, as well as requests for news media fee status and a fee
waiver. Pl.'s Mot. at 2; OHS's Mot. at 2. EPIC's FOIA request was
for records related to the OIB Cyber Pilot program "to monitor
Internet traffic flowing through certain Internet Service
Providers ("ISPs") from Internet users to a select number of
defense contractors." ,Pl.' s Mot. at 2. Specifically, EPIC' s
request was for all information in the following categories:
1. All contracts and communications with Lockheed
Martin, CSC, SAIC, Northrop Grumman or any other
defense contractors regarding the new NSA [National
Security Agency] pilot program;
2. All contracts and communications with AT&T, Verizon
and CenturyLink or any other [ISPs] regarding the new
NSA pilot program;
3. All analyses, legal memoranda, and related ·records
regarding the new NSA pilot program;
4. Any memoranda of understanding between NSA and OHS or
any other government agencies or corporations
regarding the new NSA pilot program;
5. Any privacy impact assessment performed as part of
the development of the new NSA pilot program.
Id. at 2-3.
-4-
On August 3, 2011, DHS sent a letter to EPIC acknowledging
receipt of the FOIA request, notifying EPIC that no responsive
documents had been found for category 5, and indicating that it
had referred the request to the DHS National Protection and
Programs Directorate ("NPPD"). Pl.'s Mot at 3; DHS's Mot. at 2.
Despite deadlines imposed by FOIA, 5 U.S.C. § 552 (a) (6) (A), DHS
did not produce the requested documents or contact EPIC again for
five months. Pl.'s Mot. at 3. On January 5, 2012, 1 EPIC faxed an
administrative appeal to NPPD's FOIA Office, appealing NPPD's non-
responsiveness regarding categories 1-4 of EPIC' s FOIA Request. 2
Id. On January 23, 2012, a FOIA Specialist from NPPD contacted
EPIC by telephone regarding the status of the FOIA request and
informed EPIC that DHS was processing it. DHS's Mot. at 3. On March
1, 2012, EPIC filed this Complaint for Injunctive Relief
("Complaint") [Dkt. No. l], and the Government filed its Answer on
May 1, 2012 [Dkt. No. 7].
On August 31, 2012, EPIC narrowed its FOIA request, in part
to exclude draft documents, and specifically requested:
1 In Pl.' s Mot. and the Declaration of Amie Stepanovich [Dkt.
No. 18-1], the date is listed as January 5, 2011. However, DHS's
Mot. and additional materials in the r-e-cord indicate the correct
date is January 5, 2012.
2 Defendant disputes whether this constituted an administrative
appeal, but whether it did or did not does not affect the
Court's final ruling. DHS's Mot. at 3.
-5-
1. All contracts and communications with Lockheed
Martin, CSC, SAIC, Northrop Grumman or any other
defense contractors regarding the DIB Cyber Pilot;
2. All contracts and communications with AT&T, Verizon
and CenturyLink or any other [ISPs] regarding the DIB
Cyber Pilot;
3. All legal and technical analyses, including legal
memoranda, regarding the DIB Cyber Pilot;
4. Any memoranda of understanding between NSA and DHS or
any other government agencies or corporations
regarding the DIB Cyber Pilot.
Pl.' s Mot. at 4.
2. The Government's Search for Responsive Documents
In conducting its search for responsive records, DHS assigned
EPIC's FOIA request to NPPD. Second Holzer Deel. ~ 9. NPPD's FOIA
Office ("NPPD FOIA") began to process the request by "tasking out
the search" to subcomponents likely to have responsive records,
the Office of Cybersecurity and Communications ("CS&C"). Id. ~~
11, 29. NPPD also provided the DHS Office of General Counsel and
the Office for Selective Acquisitions with EPIC' s FOIA request
because those offices had been involved in supporting the DIB Cyber
Pilot and might have had responsive records. Id. ~ 16. NPPD did
not search other offices or department components because it
determined that those off ices and department components were not
likely to have any connection to the DIB Cyber Pilot. Id. ~ 17.
-6-
NPPD FOIA met with "subject matter experts" in the agency who
had been involved with the DIB Cyber Pilot to determine which sub-
of fices would likely have responsive records. Id. i 15. NPPD FOIA
and the subject matter experts created keyword search terms to be
used in electronic searches for responsive documents. Id. i 18.
The keyword search terms were provided to the identified offices,
where each employee was instructed to conduct searches using the
keywords and their own personal "knowledge of how and where they
stored their own documents . ." Id. i 19.
NPPD FOIA worked with the identified off ices to determine
which employees were involved with the DIB Cyber Pilot. Id. i i 22-
23. Each office and employee were instructed to conduct a search
for responsive documents. ~at i i 18-19. The -employees who were
involved with the DIB Cyber Pilot then searched electronic and
hard copies of their office and personal fiL~s. A search of the
classified network was also conducted. Id. i i 18-19, 2~-27, 29-
32.
Staff in one of the identified offices - the NPPD Office of
the Undersecretary ( "OUS") searched a database of taskings:
records of which employees were tasked with various assignments
and the files associated with those assignments. Id. at i i 22-23.
OUS used the database to further identify all staff who· may have
been involved with the DIB Cyber Pilot. Id.
-7-
Staff in the NPPO Privacy Office and the CS&C, along with
CS&C's subcomponents, searched electronic and hard copies of their
personal files. Id. at~~ 26-27, 29-32. Employees in those offices
conducted a further search of the classified network. Id. The OHS
Office of the General Counsel ("OGC") identified two attorneys who
would potentially have responsive documents and had them conduct
extensive manual and electronic searches of their computers and
files relating to the OIB Cyber Pilot. Id. at ~~ 33-38.
Staff in the Office of the Chief Procurement Officer ("OCPO"),
responsible for contracting for NPPO and other offices, and the
Office of Selective Acquisitions, an OCPO subcomponent which
handles classified and sensitive contracts, did similar searches
and located potentially responsive documents which were turned
over to the OHS Privacy Office for further processing. Id. at ~~
39-42. OHS did not search the various other offices within the
agency that had no involvement with the DIB Cyber Pilot. Id. ~ 17.
OHS' s searches initially resulted in approximately 16, 000
pages of potentially responsive documents. Id. ~ 43. That number
were reduGed to roughly 10, 000 pages after initial review by a
team of FOIA specialists and attorneys who spent several weeks
reviewing the documents, removing duplicates, and removing
documents that were clearly non-responsive. Id. The agency then
took a "page-by-page and line-by-line" approach to determine if
the documents were in fact responsive and whether any of FOIA's
-8-
exemptions applied to a part or the entirety of each document. Id.