Cause of Action Inst. v. Exp.-Imp. Bank of the U.S., No. 19-1915, 2022 WL 252028 (D.D.C. Jan. 27, 2022) (Boasberg, J.)

Cause of Action Inst. v. Exp.-Imp. Bank of the U.S., No. 19-1915, 2022 WL 252028 (D.D.C. Jan. 27, 2022) (Boasberg, J.)

Re:  Requests for communications involving four senior Export-Import Bank officials regarding series of individuals and business entities

Disposition:  Granting in part and denying in part defendant's motions for summary judgment

• Procedural Requirements, "Agency Records":  "The [email] chain consists of several brief messages between an EXIM employee and Mark Calabria, then 'chief economist for Vice President Pence,' setting up a phone call."  "EXIM produced the messages from its employee, but it redacted the messages from Calabria as 'EOP [Executive Office of the President] not subject to FOIA.'"  "The Bank has not argued that the email chain should be understood as a series of separate records; rather, it contends that it has redacted portions of a single record — the email chain — claiming that they fall outside of FOIA's scope."  "Defendant has offered nothing comparable to that explicit declaration of continued control [wherein the White House explicitly expressed '"reservation of White House Control" and required the agency to "regularly transfer all [White House] Records in its possession to the White House"'], here."  "The Court, therefore, cannot conclude that the first two factors of the Burka test . . . weigh in favor of continued control by the EOP."  "Nor would it conclude, if consideration of the third and fourth factors were appropriate, that they weigh in the EOP's favor, as EXIM personnel have certainly 'read or relied upon the' emails, and the emails appear to have been fully 'integrated into the agency's record system or files.'"  "[T]he Court determines that these records fall within FOIA's scope and must be disclosed . . . ."
   
• Litigation Considerations, "Reasonably Segregable" Requirements:  "[T]he Court is satisfied that Defendant has discharged that obligation here, despite its misgivings last go-round."  "Unlike last time, the Bank has redacted almost no records in full, and the Court's in camera review did not reveal any instances of apparent over-redaction."  "EXIM has instead redacted specific portions of the records at issue and has explained to the Court's satisfaction the rationale for its withholdings."
   
• Exemption 5, Deliberative Process Privilege:  "The Court has little trouble finding that the EXIM Risk Register and the Enterprise Risk Assessment meet the inter-agency requirement."  "Those documents, much like the files in [a prior court decision], were 'created and used in on-going deliberations about various items' 'as part of [EXIM's] discussions in a number of policy areas.'"  In addition, "[t]he Bank appears to have turned them over to [Government Accountability Office ("GAO")] in their pre-existing form."  "As to the [EXIM Risk Register], EXIM explains that it was 'created as a tool to help guide the process of Enterprise Risk management at EXIM' and 'is not a policy or procedure.'"  "The Register 'represents a snapshot in time' and is intended 'to be used as a "living document"' that is 'constantly assessed and changed.'"  "Based on this description, . . . the Register is clearly 'generated before the adoption of an agency policy,' [] and contains 'evaluations' or 'analysis . . . prepared for senior-level review and decisionmaking.'"  "For similar reasons, the Enterprise Risk Assessment is also predecisional and deliberative."  "EXIM asserts that disclosure of both documents will produce a similar harm — namely, the release of information that bad actors could use to identify risk vulnerabilities at the Bank."  The court holds that "[t]hese records, therefore, were properly withheld."         
  
  "The Reponses to GAO Question No. 4 Re:  Past Fraud Matters poses a harder [threshold] question."  "Although that document contains information that was prepared for EXIM's own purposes and even includes some unaltered, pre-existing documents, it was compiled and formatted specifically to respond to GAO's inquiry."  In addition, "[past] reports reveal that GAO regularly conducts audits of EXIM's anti-fraud controls pursuant to statutory authority."  "[The statutory authority] makes clear that GAO's anti-fraud-procedures audits (though they may also aid EXIM's decisionmaking) are prepared for the benefit of congressional committees — a conclusion bolstered by the fact that the sample GAO reports are both addressed to 'Congressional Committees.'"  The court holds that this record "fails Exemption 5's threshold requirement."  
  
  "EXIM redacted in part three documents containing minutes from meetings of the Enterprise Risk Committee (ERC) in 2018."  "In its Vaughn Index, the Bank explained that the redacted portions convey information about 'specific parties and impaired transactions . . . that form a part of the Enterprise Risk Committee's (ERC) ongoing monitoring and discussion regarding impaired credits,' and 'discuss[] specific cybersecurity issues and risk assessments which are part of [a] continual and repeated process of cybersecurity risk management and monitoring by the ERC.'"  "The [Defendant's] Declarations also elaborate on the role that the information in each redaction played in the process of monitoring and formulating responses to EXIM's various risks."  "That assertion, and the several pages of description that accompany it, are sufficient to establish that the meeting minutes were properly characterized as predecisional and deliberative."  "[T]he Bank has also carried its burden to establish that disclosure would lead to reasonably foreseeable harm."  "As explained in its Vaughn Index, '[e]xposing internal staff deliberations about these matters would stifle open discussion, potentially undermine EXIM negotiating positions in some circumstances, potentially give outside parties insight into EXIM risk vulnerabilities,' and even 'harm[] relations with other countries.'"  "The Court finds that only one exception exists to the above conclusion."  "The Bank's briefing and declarations offer no argument as to why [one] specific line [from meeting minutes discussing cybersecurity issues] meets Exemption 5's requirements, and the Court's in camera review reveals that the line summarizes a past personnel decision."  "This line, accordingly, must be produced."     
  
  "The Bank explains, and the Court has confirmed through its own in camera review, that [a cybersecurity risk assessment] memorandum . . . presents to the ERC a series of the [Chief Information Officer ("CIO")]'s assessments and recommendations regarding various cybersecurity risks facing EXIM and, '[o]n the surface . . . appears to be a document that seeks a final decision — i.e. the acceptance of the cybersecurity risk assessments made by the CIO.'"  "The memorandum contains the results of the CIO's information gathering, which the 'ERC then uses . . . to discuss the risks assessed, debate the possible course of action, and provide input into the higher-level discussion with the Chief Risk Officer,' who, in turn, deliberates with the President before a final decision is made."  The court finds that "[i]t is also deliberative, as it falls squarely within the category of documents this privilege covers . . . ."  "This memorandum is, as the Bank notes, 'a gift to malefactors.'"  "The document identifies EXIM's cyber vulnerabilities, and release would allow 'cyber-criminals [to] use this information to identify and attack EXIM.'"  "This memorandum was properly withheld."
  
  "The Bank's Vaughn Index explains that the '[r]edacted portions of this document, ["an internal slide presentation,"] set forth a framework for consideration on how to address certain aspects of national security through EXIM.'"  "That description is sufficient for the Court to conclude that the Bank 'here met its burden of identifying the decisionmaking process to which [the slides] contributed' — the study of how EXIM could respond to certain national-security concerns — even without identifying a specific end decision."  The court finds that "the harm here is self-evident" as "'publicizing these slides would provide adversaries of the United States with insights into how EXIM and the United States analyze international issues related to national security and what issues the United States prioritizes.'"    
  
  With regard to EXIM's largest category of withheld records, "[t]he 25 records at issue here vary in their contents, but all are weekly reports compiling updates from teams across the Bank and presented to internal, more senior decisionmakers."  "Before moving to the specifics of each group, the Court notes that all the reports share a common feature that increases their likelihood of falling within Exemption 5:  they are prepared by lower-level employees for the benefit of upper-level decisionmakers."  In the first set of reports, "'the redacted information [wa]s chosen from an array of data to support the proposed approach EXIM is taking in these matters,' [] and 'was not assembled for an agency actor merely to pass along to outsiders, but rather for purely internal deliberative purposes.'"  The court finds that "'details concerning the Bank's rolling efforts to monitor, manage, and conduct due diligence on certain of its existing, pending, and prospective transactions and broader portfolio alike' are properly considered predecisional and deliberative."  "Disclosure of such information, moreover, would make it 'very difficult' for EXIM to 'fulfill its mission' because fear of the release of this information, which 'applicants customarily keep . . . confidential,' would discourage applicants from participating in EXIM programs."  "A similar rationale supports the withholding of EXIM's second set of documents . . . ."  "'[P]ublic disclosure of this information would publicize both EXIM's specific and general approach to these matters[,] . . . significantly undermin[ing] EXIM's negotiating position . . . [and] pressur[ing] EXIM staff to curtail putting such information in writing, thus making appropriate Senior Staff review more difficult.'"  "At the risk of repeating itself, the Court again finds that [the third set of reports] were properly withheld for much the same reasons as the previous two sets."  For the fourth set of reports, the court relates that, "[d]ifferent records, same story." For the last set, the first two types of records "were properly withheld for substantially the same reasons as the other weekly reports discussed."  For the final two records of weekly reports, "[t]he Court is not convinced, however, that the Bank has established that it is deliberative." 
   
• Exemption 4:  "As to the [Office of Small Business ("OSB")] reports, the Court concludes fairly easily that EXIM has established that most of the redacted information came from customers of the Bank."  "Indeed, the redacted information does not appear to include EXIM analysis or manipulation, but rather is a recitation of customers’ plans or statistics about their businesses.  That is information 'obtained from a person.'"  "Only one set of redactions in this group does not fall clearly into this category."  "[This] information appears to be the amount of an EXIM-approved credit limit, the recipient of that credit limit, and the cotton exporter that will be supported by the IBCL."  "The Court, accordingly, concludes that EXIM has not met its burden to establish that this information is 'obtained from a person,' and the information must be disclosed."  For the other information redacted in the report, "[a]lthough EXIM would ideally have solicited input from the specific exporters discussed in these reports, the Court finds that it may rely here on its 'decades of accumulated experience and interaction with participants on the question of confidentiality' to conclude that 'this type of information is customarily kept confidential by the parties that submit it to EXIM.'" 
  
  "EXIM contends that disclosure of the information in OSB reports would harm the submitting customers by essentially 'telling all of their competitors that [the country in which they have concentrated their sales] is where the business is.'"  "Publication of information participants expect the Bank to keep confidential, moreover, would 'severely hamper[]' EXIM's ability to perform its function; '[i]f EXIM transaction parties were to lose faith in EXIM's ability to keep [confidential] information private,' the Bank would lose access to information it 'relies upon to complete its underwriting of transactions, to monitor transactions as they proceed, and to settle, or work-out transactions that run into difficulties.'"  The court finds "[t]hat suffices to 'directly articulate[] [a] link between the specified harm and the specific information contained in the material withheld.'"    
  
  "EXIM explains that the redacted portion of [an Office of Policy and International Relations ("OPAIR") weekly report] refers to the terms of a guarantee made to PEFCO."  "But EXIM also states that the redacted terms were 'issued by EXIM to [the Private Export Finance Corporation ("PEFCO")],' [] which would seem to eliminate the possibility that this information came from PEFCO to EXIM."  The court holds that this "leads to the conclusion that this information was not obtained from a person, as Exemption 4 requires."