Reporters Comm. for Freedom of the Press v. U.S. Customs & Border Protect., No. 18-00155, 2021 WL 4843970 (D.D.C. Oct. 18, 2021) (McFadden, J.)
Reporters Comm. for Freedom of the Press v. U.S. Customs & Border Protect., No. 18-00155, 2021 WL 4843970 (D.D.C. Oct. 18, 2021) (McFadden, J.)
Re: Records concerning Customs & Border Prot. ("CBP")'s interactions with Twitter
Disposition: Granting in part and denying in part defendant's motion for summary judgment; granting in part and denying in part plaintiff's motion for summary judgment
- Exemption 5, Deliberative Process Privilege; Attorney Work-Product Privilege; Attorney-Client Privilege; Foreseeable Harm and Other Considerations: The court reviews defendant's withheld categories, but first notes that, regarding foreseeable harm, "agencies must make two showings." "First, the agency must, as always, show that a FOIA exemption applies to withheld information." "Second, the agency must articulate, in a 'focused and concrete' way, the harm that would result from disclosure, including the basis and likelihood of that harm." "But even without a sufficient explanation from the agency, the 'context and purpose' of withheld information can support a finding of foreseeable harm." "An agency's failure to make both showings warrants disclosure."
First, the court relates that "Category 1 [of the withheld information] covers emails 'about the issuance of [a] 19 U.S.C. § 1509 summons,' including 'discussions about how to respond to Twitter's refusal to comply with the summons.'" "The Court agrees with the Government that the documents in Category 1 fall within the deliberative process privilege." "Emails sent before the decision to issue a summons were, by definition, predecisional." "And [plaintiff] does not contest the Government's declaration that those emails 'reflect[ ] internal agency deliberation about' the decision to issue a summons and thus formed a part of the agency's deliberative process." "The pre-issuance emails therefore are exempt from disclosure under the deliberative process privilege." "The privilege likewise covers the post-issuance emails." "CBP employees sent those before the agency decided to withdraw the summons – making them predecisional to the withdrawal." "And [plaintiff] again does not contest the Government's statement that those emails 'reflect the agency's internal deliberative process' about whether to withdraw the summons."
"Separate from CBP's explanation, however, [plaintiff] challenges the nondisclosure of some specific documents that the Court believes should be part of this category." "[Plaintiff] challenges the nondisclosure in full of six pages from a PowerPoint presentation titled 'Use of the Customs Summons in Trade Enforcement Cases 19 U.S.C. § 1509,' which was emailed as part of an invitation to a training series for CBP employees." "The Government has not justified withholding this." "The Vaughn Index says that the agency applied Exemption 5 to 'discussions within the presentation on matters of policy regarding the enforcement of summonses.'" The court finds that "[t]hat explanation fails to show how the presentation could be predecisional." "No record evidence supports that the presentation factored into the decision to issue or withdraw the Twitter summons." "The same analysis largely applies for the next document sought by [plaintiff]. " "The agency withheld a portion of an email that contained 'an investigative report regarding the emails released on Twitter.'" "[Plaintiff] correctly argues that this withheld report was not predecisional." "The agency fails to show, much less contend, that the report related to a decision that came later." "CBP suffers from the same issue for . . . an email-attached 'memorandum prepared for leadership as a summary of circumstances that led for issuance of [the] Twitter Summons.'" "Like the previous two documents, the email was sent after CBP withdrew the summons . . . and the agency identifies no other decision to which the memorandum contributed."
The court relates that "[plaintiff] challenges no other specific withholdings in this category." "Rather, it argues that the entire category should be disclosed under the so-called government-misconduct exception to the deliberative process privilege." The court finds that "[t]he Government correctly points out that courts in this circuit have not definitively answered whether the government-misconduct exception applies in the FOIA context." "This Court likewise need not render an opinion on the government misconduct exception because [plaintiff] successfully challenges the agency's foreseeable harm analysis." "CBP's discussion of foreseeable harm in Category 1 amounts to one sentence: 'Disclosure of such deliberative email communications would hamper CBP's day-to-day operations because employees would not feel comfortable to divulge their views on ongoing cases or issues knowing their pre-decisional thoughts may become public.'" The court finds that "[b]oth parts of CBP's one-sentence explanation thus fail to explain in a 'focused and concrete way' how disclosure of the Category 1 documents will impede future agency deliberations." "The Court also finds that the 'context and purpose' of these documents does not suggest foreseeable harm from disclosure."
Second, the court relates that "Category 2 of the withheld records contains 'email communications between individuals in various CBP offices . . . on how to handle and respond to the lawsuit filed by Twitter.'" The court finds that "these emails meet the requirements for the deliberative process privilege." "They are predecisional because the authors sent them before the agency decided how to respond to Twitter's lawsuit." "And they are deliberative because they include the 'give-and-take' of the agency's process; agency personnel gave their opinions on how the agency should respond to the lawsuit." The court finds that "[plaintiff] does contest the agency's foreseeable harm declaration for Category 2." "The agency summarized the harm from disclosure as follows: 'It is crucial for the functioning of government that employees involved in this type of decision-making share their views freely with their colleagues or subordinates and discuss potential adverse or positive implications of any action.'" "'If such discussions are routinely disclosed to the public, the individuals making recommendations would not seek guidance from their attorneys, peers, or superiors, and would not share their views for fear that their communications could be published.'" "To the agency's credit, this explanation comes much closer to a demonstration of foreseeable harm than the explanation in Category 1." "But it still falls short." "No one disputes that the privilege rests on the 'obvious realization that officials will not communicate candidly among themselves if each remark is a potential item of discovery.'" "CBP's merely restates those broad justifications for the privilege." "The harm that CBP identifies – the risk that agency officials might not seek guidance or share their views – undergirds the privilege in every case." "CBP therefore says nothing new about the harm of disclosure and fails to link the possibility of that harm to the information in Category 2." "Nor again does the context and purpose of these communications suggest a risk of foreseeable harm from disclosure."
Third, the court relates that "Category 3 'covers email communications between CBP employees on how to respond to requests for information in relation to the Twitter lawsuit from the DHS Inspector General, Congress, and the media.'" The court finds that "[t]he eventual response to outside inquiries, whether from Congress, the press, or an inspector general, qualifies as an agency policy." "So discussions about the proper response to those inquiries reflect the give-and-take of an agency's deliberative process." "Yet the larger theme continues here; [plaintiff] argues that CBP fails to establish a risk of foreseeable harm from disclosure." "The Court agrees." "CBP's declaration says the following about the risk of foreseeable harm in Category 3: 'The employees preparing responses to such inquiries must feel candid when they seek input from their colleagues, or individuals working in other CBP offices, in order to create more thorough and fulsome responses while preserving the agencies' operational interests in light of ongoing litigation.'" The court finds that "CBP continues to restate the generic rationale for the entire privilege." "[T] he agency identifies no risk that would be specific to that context – the agency is concerned only with a lack of candor affecting agency decisions." "Recall that this rationale undergirds the entire deliberative process privilege, and therefore cannot meet the independent foreseeable harm requirement . . . ." "Nor do these communications concern anything like the undercover tactics discussed by the FBI in that case." "Thus, the 'context and purpose' of the documents in Category 3 does not make 'manifest' a risk of foreseeable harm from disclosure."
Fourth, the court relates that "[t]he analysis of Category 4 follows the familiar pattern of the first three categories." "Category 4 'covers email communications between CBP employees about what changes, if any, to make to the existing agency policy on the use of the 19 U.S.C. § 1509 summons.'" "The Court is satisfied that these documents qualify for the deliberative process privilege." "The emails preceded the agency's decision to update its policy on the summons authority – making those emails predecisional." "And the various opinions in those emails form an 'internal agency dialogue' about how to modify an agency policy." "But yet again, the agency's foreseeable harm analysis falls short." "CBP explained the harm of disclosure for this category as follows: 'If these emails were to be disclosed, individuals involved in developing policies may not voice their ideas or concerns freely.'" "'Such freedom is imperative for ensuring better quality of not only agency policies, but government as a whole.'" "This explanation resembles that of Category 1: disclosure might stifle the ability of certain employees to speak freely and that would weaken agency policies." "Indeed, no court could disagree with that statement." "But the agency must do more." Additionally, the Court [cannot] say that communications about an updated summons directive make 'manifest' a risk of foreseeable harm without a better explanation from CBP."
Fifth, the court relates that "CBP's fifth category of withheld documents relies not on the deliberative process privilege, but on the attorney-client and attorney work-product privileges." "The Government asserts that Category 5 'covers confidential communications between DHS and CBP attorneys, and CBP attorneys and CBP employees, about the Twitter lawsuit and the agency's use of the 19 U.S.C. § 1509 summons authority." "These include emails where CBP employees are seeking legal advice and CBP attorneys provide advice.'" "The category also encompasses 'discussions between DHS and CBP attorneys . . . about the scope of 19 U.S.C. § 1509, the proper interpretation of that statute, and the advice to convey to the client.'" The court finds that "CBP has established confidentiality across the category of documents." "Its declarations state that the emails are confidential and include instances when agency employees '[sought] legal advice and CBP attorneys provided advice,' as well as times agency lawyers discussed statutory advice to convey to the client." "More, the agency's Vaughn Index notes when emails originate in the CBP Office of Chief Counsel and are sent in response to agency requests for legal advice." Responding to plaintiff's objection, the court finds that "[e]ven though the discussion was about a statement that would be publicized, the exact contents of and deliberations preceding it qualify as a protected attorney-client communications."
However, the court relates that "CBP withheld excerpts of PowerPoint presentations on recordkeeping, use of the summons authority, and the False Claims Act." The court finds that defendant "fails even to mention whether these training presentations were bound for a limited audience." "CBP cannot carry its burden without more." The court relates that "[t]he parties also dispute the agency's withholding in full of an attachment to an email sent between lawyers in CBP's Office of Chief Counsel." "According to CBP, the attachment is a legal memorandum from 1997 relating to 'CBP's seizure authorities of prohibited merchandise with a value of under $500,000.'" "A senior agency attorney sent this attachment to a junior attorney as 'useful information' for the latter attorney's memo on CBP's 19 U.S.C. § 1509 authority." "The Court agrees with the Committee that the agency has not justified those privileges for the 1997 memo." "CBP tells the Court only that the attachment provides 'legal advice.'" "What CBP does not say is whether agency lawyers provided that 1997 guidance to 'protect [the agency's] interest' as part of some dispute or as a 'neutral, objective analys[i]s' of an agency statute." "That distinction matters because the latter does not receive protection under the privilege." "As for the work-product privilege, CBP does not say whether the 1997 memo was prepared in anticipation of litigation." "True, the attachment emerges amid a flurry of emails between lawyers worried about Twitter's response to the summons." "The Court does not doubt – and the Committee gives no argument otherwise – that those emails reflect the 'mental impressions' of agency lawyers worried about possible litigation with Twitter." "But someone wrote the 1997 memo well before the prospect of litigation with Twitter." "And the Government does not say whether that earlier author contemplated litigation when writing the memo." "The Court cannot fill in that detail for the agency."
The court relates that, "[l]astly, [plaintiff] challenges the agency's demonstration of foreseeable harm for this category." "Before the Court resolves that dispute, some background is necessary." "The D.C. Circuit has explicated the foreseeable harm requirement only in relation to the deliberative process privilege." "Such a limited focus in the caselaw does not cabin the requirement to that privilege – indeed, nothing in the provision's text limits it to any one exemption." "But Congress added the foreseeable harm requirement specifically to limit 'agency overuse and abuse of Exemption 5 and the deliberative process privilege.'" "So an agency's burden under the foreseeable harm requirement may be more easily met when invoking other privileges and exemptions for which the risk of harm through disclosure is more self-evident and the potential for agency overuse is attenuated." "Take the attorney-client privilege withholdings here." "The agency's declaration says: 'Routine disclosure of information protected by attorney-client and/or attorney work product privilege would shake the very foundation of the legal profession, as clients would not feel comfortable asking for advice and attorneys would not feel comfortable providing it.'" "Although the agency's language may be overwrought, the attorney-client privilege holds a prominent and sacrosanct role in the law." "Release of attorney-client communications would undoubtably undermine our legal culture." "Agencies would lose an important tool in their decisionmaking process – employees' ability to confidentially consult agency lawyers." "More, the 'observance of law' otherwise promoted by the privilege would be hampered during agency decisionmaking." "That rationale and benefit is especially applicable for federal officials making policy decisions." "Thus, the law already acknowledges and guards against the risk of harm that would come from disclosing attorney-client communications." "And CBP has articulated a fairly non-generalized description of that risk." "That is good enough."
Sixth, the court relates that Category 6 'covers the various drafts, and related email communications, about the updated 19 U.S.C. § 1509 summons directive.'" "CBP attests that the drafts include 'contextual recommendations, comments, and redline edits made by individuals from various CBP offices that convey the authors' opinions regarding the draft language.'" "CBP asserts the deliberative process privilege for those drafts." "The agency also notes that some drafts contain comments and edits made by CBP attorneys about the legal sufficiency of the directive." "The agency justifies withholding of those specific drafts under the attorney-client and attorney work-product privileges." The court finds that "CBP has met its burden to show that these drafts qualify for the privilege." "CBP declares that the drafts contain various deliberative thoughts from agency employees (a fact not rebutted by the Committee), and the parties agree that CBP ultimately issued an updated directive." "CBP has therefore shown a 'logical' application of the deliberative process privilege to these draft documents." "As to the foreseeable harm from disclosure of the records in this category, CBP states: 'Disclosure of the evolving iterations of the directive, and the communications discussing the drafts, would allow a reader to probe too deeply into the thought processes of the drafters and would have a chilling effect on communication between agency employees.'" "'Further, disclosure of the editorial process would stifle the creative thinking and candid exchange of ideas necessary to produce government policies and run a substantial risk of confusing the public, and/or intruding on the deliberative process of the agency.'" The court finds that "[t]his explanation barely carries CBP's burden." "The agency lists many of the generalized rationales for the privilege – stifled creative thinking, candor among employees, and a chilling effect on intra-agency communication." "But CBP also worries that disclosure would confuse the public." "The Court agrees that this is a foreseeable risk of harm for this category."
Seventh, the court relates that "Category 7 'contains email communications between CBP attorneys and CBP employees about how to process' [plaintiff's] FOIA requests." "The Court is satisfied that both privileges apply to this category." "Discussions about how to handle a FOIA request are predecisional because they occur before the decision to respond to the request." "CBP also describes those conversations as 'deliberative,' a fact that [plaintiff] does not dispute." "As for the discussions between the agency lawyers and agency employees, the Court has no reason not to apply its reasoning from Category 5 to those communications in Category 7." "[Plaintiff] does challenge, however, individual withholdings that likely fall into this category." "The first is . . . a 'document log created by [a] FOIA analyst.'" "[Plaintiff] argues that the agency makes no showing that the withheld material 'makes recommendations or expresses opinions on legal or policy matters.'" "The Court agrees." "The agency states only that the log contains the analyst's 'notes with respect to the processing of' [plaintiff's] requests." "That says nothing about whether the notes include the type of opinions and recommendations that the privilege protects." Additionally, the court finds that "the mere fact of review by a superior does not transform nondeliberative comments into deliberative ones." "CBP simply has not provided the Court with a sufficient basis to conclude that this document contains deliberative content." "The same analysis mandates the release of . . . an 'email between CBP FOIA employees.'" "CBP applied the deliberative process privilege to discussions 'regarding the review process for records being released under FOIA.'" "The agency says nothing more about this email, which means the Court has no idea whether the discussions contained there are deliberative."
"Beyond these individual documents, the agency's showing of foreseeable harm for this category is much briefer than for other categories: 'Disclosing this information would undermine the deliberative process privilege and the attorney-client privilege, and would have a chilling effect on communication between agency employees who regularly process FOIA requests.'" The court finds that "[t]his explanation differs slightly from previous explanations in that CBP mentions two privileges." "CBP has not shown enough for either privilege." "For the deliberative process withholdings, CBP says only that disclosure would 'undermine the deliberative process' and 'would have a chilling effect' on CBP employees who process FOIA requests." "CBP therefore offers nothing beyond the 'generic rationales' for the privilege itself." "CBP says even less on the attorney-client privilege, noting only that disclosure would 'undermine the attorney-client privilege.'" "Such a conclusory statement again does not suffice to show a risk of foreseeable harm." "True, the Court has already said that establishing the attorney-client privilege will go a long way to show the risk of foreseeable harm." "But an agency must still provide a non-generalized explanation on the foreseeable harm that would result from disclosure of attorney-client communications." "CBP has barely provided any explanation at all." "More, the record shows no obvious reason why disclosing these records would create a foreseeable harm."
"The Court has repeatedly found CBP's explanations as to the risk of foreseeable harm to be wanting here." "The agency could have said more, and it likely would have met its burden in many categories if it had done so." Notably, the court finds that "the agency never sought to update its declarations or provide supplemental briefing [in light of developments in the case law surrounding foreseeable harm], nor did it respond when the Committee notified the Court about [some of this updated case law]."
- Exemption 6; Exemption 7, Threshold; Exemption 7(C) & Litigation Considerations, Foreseeable Harm Showing: "The Court holds that CBP correctly withheld the names of all non-public-facing employees, except for [two]." First, the court relates that "CBP asserts that it is a law enforcement agency and thus that it compiled the withheld records for law enforcement purposes." "Not only does the Court treat that assertion with some deference . . . [plaintiff] does not dispute it." "So the Court need only consider whether the agency properly invoked Exemption 7(C)." "The agency presents a more than cognizable privacy interest here." The court finds that "individuals, whether they be 'suspects, witnesses, or investigators,' have a 'strong interest' not to be 'associated unwarrantedly with alleged criminal activity.'" "And that interest makes much sense – individuals associated with an unpopular agency action might be subject to public scrutiny and perhaps harassment." "On the other side of the equation, the Committee asserts a public interest in disclosing CBP's 'improper efforts' to use its summons authority to compel Twitter to unmask an account." "The Court accepts that as a significant public interest under Exemption 7(C)." "Yet [plaintiff] has not shown how that public interest outweighs the employees' privacy interest." "Knowledge of the employees' names would not matter here." "The Twitter summons is already in the public domain, as is the Inspector General's report on how CBP used its summons authority in its dealings with Twitter." "The Committee offers no suggestion as to how knowing names alone will clarify the agency’s activities, particularly after public dissemination of the summons and the IG Report." "The Court therefore finds that the agency properly invoked Exemption 7(C) for the names of almost all CBP non-public facing employees." "That holding does not apply, however, to the agency's redactions of the names of [two special agents]." "Their names appeared on the Twitter summons and in the subsequent litigation." "Their involvement with the summons therefore exists in the public domain, and CBP cannot withhold such public information under an otherwise valid exemption claim."
The court holds that "'[l]ike the withholdings under Exemption 5, the agency must establish a foreseeable harm from disclosure of these names." "CBP says disclosure of names would cause invasions of privacy for many CBP employees." "That assertion would likely be enough to meet the agency's burden." "But the agency goes beyond that relatively generalized assertion and cites specific examples of harassment and threats against CBP employees." "These examples explain in a 'focused and concrete way' how disclosure of the names would harm CBP employees." "CBP has shown a risk of foreseeable harm."
- Exemption 7(E) & Litigation Considerations; Foreseeable Harm Showing: The court holds that "CBP . . . properly withheld the documents . . . ." The court first relates that "[w]hat an agency must do to show foreseeable harm under Exemption 7(E) is an open question." "The D.C. Circuit's cases about the foreseeable harm requirement have exclusively discussed Exemption 5." "Recall, however, that fulfilling the terms of other privileges or exemptions goes a long way to meeting the foreseeable harm requirement. Exemption 7(E) is one such exemption." "As other courts have acknowledged, Exemption 7(E) by its own terms already requires that an agency show a risk of foreseeable harm." "The text of 7(E) allows withholding only when the withheld material 'could reasonably be expected to risk' circumvention of the law." "Put differently, an agency must show some risk of circumvention before withholding material under 7(E)." "The exemption's text thus already forces the agency to show some risk of harm." "The Court accepts [plaintiff's] response that the freestanding foreseeable harm requirement in 5 U.S.C. 552(a)(8) can still guard against general explanations and boilerplate language used to justify withholdings." "But the Court is also mindful of the D.C. Circuit's reasoning . . . [relying] on the 'context and purpose' of certain communications to show a risk of foreseeable harm."
With this background in mind, the court finds that "[t]he first category covers the techniques and procedures that CBP uses 'to investigate unauthorized disclosure of information and cybersecurity threats.'" "According to CBP, these records include the techniques used by CBP to investigate whether the unauthorized release of internal emails occurred because of 'misconduct by a CBP employee' or 'a compromise in the security systems.'" "The agency asserts that this information 'could be exploited and used to develop and employ countermeasures to diminish the effectiveness of CBP's cybersecurity and counterintelligence measures.'" The court relates that [plaintiff] argues that the agency provides a 'near-verbatim recitation of the statutory standard' and fails to explain logically how these records might create circumvention of the law." "Not so." "CBP set forth the exact types of techniques it seeks to protect – those procedures used to investigate cybersecurity threats and disclosure of internal information." "Those specific procedures are hardly a verbatim recitation of the statute." "And disclosure would logically lead to an obvious harm: Bad actors would know how CBP responds to cybersecurity threats." "With that information, outsiders might tailor their activities to exploit vulnerabilities in the agency's detection and investigation techniques." "As to foreseeable harm, [plaintiff] argues that the agency gives only a boilerplate recitation of the foreseeable harm standard." "The Court disagrees." "The information withheld in this category shows step-by-step how CBP investigates potential cyber vulnerabilities." "The 'very nature' of such sensitive information conveys a risk of harm from disclosure." "And as described above, the agency's declarations have explained that risk." "The Court is satisfied that CBP has established a risk of foreseeable harm for this category."
The court relates that that "[t]he second category of information withheld under Exemption 7(E) details the 'techniques and procedures CBP uses to conduct internal investigations.'" "Those include the procedures that the agency 'routinely use[s]' and 'non-public details about when, how, and under what circumstances' the agency employs each procedure." "CBP says that if the public learned about the circumstances in which the agency uses these various techniques, 'bad actors will learn information that they can use to avoid law enforcement consequences.'" "The Court agrees that CBP has not provided much on the applicability of Exemption 7(E) to this category." "But the agency has identified the procedures that would be harmed by disclosure (the internal investigatory procedures), and the documents themselves highlight the risk of circumvention should those procedures be disclosed." The court finds that "the sensitive context of this information – the details about how CBP conducts internal investigations of cybersecurity breaches – shows a risk of foreseeable harm."
The court relates that "[t]he third category of material withheld under this exemption 'covers techniques and procedures related to the issuance or non-issuance of administrative summonses in specific investigations, some of which may be ongoing.'" "CBP withheld 'dates of investigations, PII on the individuals being investigated, circumstances of the alleged misconduct, location of the individual, whether large criminal activity was implicated, and specific techniques or procedures used to further the investigation.'" "CBP asserts that disclosure of this material would risk circumvention of law because individuals would know (1) which activities trigger a full investigation rather than a preliminary one; (2) the dates covered by a particular investigation; and (3) CBP's investigative techniques." The court finds that "[e]ven if the public knows of CBP's authority under § 1509, the Committee has not shown that the public knows anything about the finer details of that authority, such as when and how CBP relies on it." "Such information merits protection from disclosure under Exemption 7(E)." "More, release of those details – the exact type of information covered by this category – would divulge how CBP uses summonses to advance its mission." "As CBP explains, potential bad actors could easily use that information to identify deficiencies in the agency's procedures and adjust their behavior to avoid detection." The court finds that "[plaintiff] never meaningfully challenges the agency's explanation of foreseeable harm for this category." "Nor could it." "CBP identified that disclosure would give potential criminals some very specific information, including what behaviors trigger a full investigation and how CBP uses its summons authority to conduct investigations." "That explanation shows the risk of foreseeable harm from disclosure." "And even if the agency's explanation were insufficient, the record reflects a risk of foreseeable harm." "The material at issue deals with sensitive issues of law enforcement procedure and practice." "The nature of that information would be a boon to potential criminals."
- Litigation Considerations, "Reasonably Segregable" Requirements: The court relates that "CBP declares that it has released all reasonably segregable portions of the relevant records." "The agency noted that all withheld information is either exempt or 'not reasonably segregable.'" "And according to the agency's declaration, 'CBP analysts and attorneys reviewed each release of records line-by-line' to 'determine[ ] whether any segregable, non-exempt information could further be released.'" "The Court accordingly finds that the agency has fulfilled its segregability obligation."