UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

Dave Levinthal, et al., |

|

Plaintiffs, |

|

v. | Civil Action No. 15-1624 (APM)

| ECF

Federal Election Commision, |

|

Defendant. |

PLAINTIFFS’ CROSS-MOTION FOR SUMMARY JUDGMENT

AND OPPOSITION TO DEFENDANT’S MOTION FOR SUMMARY JUDGMENT

Plaintiffs, Dave Levinthal and the Center for Public Integrity, move for summary 

judgment pursuant to Federal Rule of Civil Procedure 56 and oppose Defendant’s Motion for 

Summary Judgment. Plaintiff’s Memorandum of Points and Authorities, Statement of Material 

Facts as to Which There Is No Genuine Issue and a proposed Order accompany this motion.

Respectfully submitted,

/S/

Peter Newbatt Smith 

D.C. Bar #458244

Center for Public Integrity

910 17th Street, N.W., 7th Floor

Washington, DC 20006-2606

202-481-1239

psmith@publicintegrity.org

Attorney for Plaintiff

April 8, 2016

Case 1:15-cv-01624-APM Document 14 Filed 04/08/16 Page 1 of 6
UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

Dave Levinthal, et al., |

|

Plaintiffs, |

|

v. | Civil Action No. 15-1624 (APM)

| ECF

Federal Election Commision, |

|

Defendant. |

MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF

PLAINTIFF’S CROSS-MOTION FOR SUMMARY JUDGMENT AND IN 

OPPOSITION TO DEFENDANT’S MOTION FOR SUMMARY JUDGMENT 

This is an action under the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552, as

amended, to secure the production of certain agency records from the Federal Election 

Commission (“FEC”), the Defendant. The remaining document, or set of documents, at issue in 

this case is an information-technology vulnerabililty assessment conducted for the FEC, along 

with a summary and appendices. Because the assessment was intended “to inform [thte FEC’s] 

decision regarding whether to implement information security standards and guidelines 

developed by the U.S. Department of Commerce’s National Institute of Standards and 

Technology (“NIST”) for federal information systems” (Decl. of Alec Palmer, ¶ 7), it has often 

been referred to as “the NIST Study.”

BACKGROUND

Plaintiffs Dave Levinthal and the Center for Public Integrity are engaged in investigative 

journalism. Mr. Levinthal’s assignments include covering the Federal Election Commission and 

the influence of money in federal politics.

Case 1:15-cv-01624-APM Document 14 Filed 04/08/16 Page 2 of 6
On July 6, 2015, Plaintiffs filed a FOIA request that sought, inter alia, “a copy of a 2015 

National Institute of Standards and Technology report — also known as the NIST study —

pertaining to the Federal Election Commission’s operations.” FEC staff withheld this study in 

full and on September 30, 2015, notified Plaintiffs that on appeal the Commission had upheld the 

denial of Plaintiffs’ request.

ARGUMENT

I. Standard of Review

Summary judgment is appropriate when there is no genuine issue as to the material facts, 

and the moving party demonstrates it is entitled to judgment as a matter of law. Fed. R. Civ. P. 

56; Diamond v. Atwood, 43 F.3d 1538, 1540 (D.C. Cir. 1995). A court reviews agency handling 

of a FOIA request de novo. 5 U.S.C. § 552(a)(4)(B).

In a case brought under FOIA, “the burden is on the agency to sustain its action.” 5 

U.S.C. § 552(a)(4)(B); see also Electronic Privacy Information Center v. Dep’t of Homeland 

Security, 384 F. Supp. 2d 100, 106 (D.D.C. 2005). While FOIA includes exemptions from 

disclosure, “these limited exemptions do not obscure the basic policy that disclosure, not secrecy, 

is the dominant objective of the Act.” Dep’t of the Air Force v. Rose, 425 U.S. 352, 361 (1976).

II. Release of the NIST Study would serve the important purpose of informing the 

public.

In its Memorandum in Support of Its Motion for Summary Judgment, at 1-2, Defendant 

notes the importance of cybersecurity within federal agencies. Precisely because this is an 

important issue, it is critical that citizens have the information necessary to judge whether an 

agency is adequately protecting data from hackers who might wish to steal or alter it. As the 

Supreme Court has explained, “[t]he basic purpose of FOIA is to ensure an informed citizenry, 

Case 1:15-cv-01624-APM Document 14 Filed 04/08/16 Page 3 of 6
vital to the functioning of a democratic society, needed to check against corruption and to hold 

the governors accountable to the governed.” NLRB v. Robbins Tire & Rubber Co., 437 U.S. 214, 

242 (1978) (citation omitted). 

III. The NIST Study is not exempt under FOIA Exemption 7(E).

A. The NIST Study is not a law enforcement record.

To withhold the NIST Study under Exemption 7(E), the FEC must meet the so-called 

“threshold” requirement of demonstrating that it falls within the category of “records or 

information compiled for law enforcement purposes ....” U.S.C. § 552(b)(7).

The standard established in the D.C. Circuit is that “[a] record is deemed to have been 

created or compiled for a law enforcement purpose only if (1) it arose from an investigation 

‘related to the enforcement of federal laws or to the maintenance of national security’ (the 

‘nexus’ requirement), and (2) ‘the nexus between the investigation and one of the agency's law 

enforcement duties [is] based on information sufficient to support at least “a colorable claim” of 

its rationality.’” Simon v. Dep't of Justice, 980 F. 2d 782, 783, (D.C. Cir. 1992) (quoting Pratt v. 

Webster, 673 F.2d 408, 420-21 (D.C. Cir. 1982)).

The FEC describes the NIST Study as “an information technology vulnerability 

assessment ....” (Palmer Decl., ¶ 18.) It is not connected to an investigation, and it was not 

“compiled for law enforcement purposes.” In its Memorandum, the FEC has cited cases that 

protect agency data from disclosure under Exemption 7, but in each of those cases the data were 

themselves law-enforcement records. The NIST Study undoubtedly describes systems that 

contain law-enforcement information (along with other information), but the Study itself is not a 

law-enforcement record.

B. The FEC has not established that the vulnerabilities described in the NIST 

Study still exist.

Case 1:15-cv-01624-APM Document 14 Filed 04/08/16 Page 4 of 6
The Declaration of Alec Palmer, at ¶¶ 18-21, asserts that information in the NIST Study 

could be used in cyberattacks on the FEC’s systems. The Declaration does not discuss whether, 

after the NIST Study was produced, the FEC has adopted measures to address identified 

vulnerabilities.

A major part of the NIST Study (the “Gap Analysis Final Report”) was completed by 

April 17, 2015. (Palmer Decl. ¶ 12.) Even assuming, arguendo, that Exemption 7(E) applies to 

portions of the NIST Study, to the extent that facts on the ground have changed since the 

preparation of the report, disclosure of previous vulnerabilities would not fall under Exemption 

7(E). Under FOIA, the Defendant has the burden of demonstrating that the claimed exemption is 

still applicable. In addition, the Defendant is required to segregate any non-exempt information 

(including no-longer-exempt information) and release it.

IV. The FEC’s failure to release any portion of the NIST Study is not consistent with 

FOIA’s requirements.

The FEC’s Memorandum, at 15-16 and 20-21, acknowledges the obligation to release 

any reasonably segregable non-exempt information, but it has not met this obligation. Plaintiffs 

do not doubt that the NIST Study contains predecisonal recommendations. But the FEC has 

admitted that there are segregable factual portions as well. It argues that “the Final Report’s 

factual descriptions of the Commission’s information technology systems and their vulnerabilities 

form the basis of the analysis in the Final Report and reflect the need for the recommended protocols 

that constitute the core of the NIST Study.” (Def.’s Memorandum, at 20.) The unexceptionable 

circumstance that the factual sections of the report are consistent with its recommendations is not 

sufficient to allow withholding of the factual sections under Exemption 5. Defendant has not 

established that they are actually “inextricably entwined” with deliberations. 

Case 1:15-cv-01624-APM Document 14 Filed 04/08/16 Page 5 of 6
CONCLUSION

For the foregoing reasons, the Court should grant Plaintiffs’ Motion for Summary 

Judgment and deny Defendant’s Motion for Summary Judgment.

Respectfully submitted,

/S/

Peter Newbatt Smith 

D.C. Bar #458244

Center for Public Integrity

910 17th Street, N.W., 7th Floor

Washington, DC 20006-2606

202-481-1239

psmith@publicintegrity.org

Attorney for Plaintiff

April 8, 2016

Case 1:15-cv-01624-APM Document 14 Filed 04/08/16 Page 6 of 6