United States Court of Appeals

For the Eighth Circuit 

___________________________

No. 23-1620

___________________________ 

T. Keith Fogg

 Plaintiff - Appellant

v.

Internal Revenue Service

 Defendant - Appellee

____________

Appeal from United States District Court 

for the District of Minnesota

____________ 

Submitted: April 10, 2024

Filed: July 2, 2024 

____________

Before BENTON, GRASZ, and STRAS, Circuit Judges. 

____________

GRASZ, Circuit Judge.

T. Keith Fogg sought disclosure of certain redacted contents of the Internal 

Revenue Manual under the Freedom of Information Act (FOIA). See 5 U.S.C. 

§ 552. The district court1 conducted an in camera inspection of the unredacted 

1

The Honorable Susan Richard Nelson, United States District Judge for the 

District of Minnesota.
-2- 

manual per this court’s mandate. See Xanthopoulos v. I.R.S., 35 F.4th 1135, 1139

(8th Cir. 2022). The district court then granted summary judgment to the Internal 

Revenue Service (IRS), concluding the redacted contents were exempt from 

disclosure under the FOIA because they are techniques and procedures for law 

enforcement investigations and their disclosure could reasonably be expected to risk 

circumvention of the law. After conducting our own in camera inspection of the 

redacted contents, we affirm.

I. Background

Internal Revenue Manual (IRM) § 21.1.3.32 deals with third-party 

authentication. See Xanthopoulos, 35 F.4th at 1137. Its purpose is to “confirm the 

identification of the person calling prior to releasing sensitive information” to

“enhance protections for tax professionals and their clients.” IRM § 21.1.3.3(3). 

Much of § 21.1.3.3 is available to the public, but the IRS redacted some portions of 

the IRM “relating to ‘specialty situations’ in which the IRS uses ‘unique’ 

authentication procedures to combat unauthorized disclosure of sensitive taxpayer 

information, identity theft, and criminal fraud.” Xanthopoulos, 35 F.4th at 1137. 

In June 2019, Fogg and former co-plaintiff Nicholas Xanthopoulos submitted 

a FOIA request for the redacted contents of IRM § 21.1.3.3 so they could 

“understand how the IRS used or retained tax professionals’ data collected under the 

new procedures.” Id. The IRS claimed the redacted contents are exempt from FOIA 

disclosure under the FOIA’s Exemption 7(E) because the redacted contents are 

“records or information compiled for law enforcement purposes” and “techniques 

and procedures for law enforcement investigations.” See 5 U.S.C. § 552(b)(7)(E). 

Fogg and Xanthopoulos then sued the IRS in federal court, seeking court-ordered 

disclosure. See id. § 552(a)(4)(B). The district court originally denied their request 

to review the redacted contents in camera. On the parties’ cross-motions for 

summary judgment, the district court granted summary judgment to the IRS, holding 

2

Available at https://perma.cc/BDH9-ZD73 (April 16, 2024).
-3- 

Exemption 7(E) applied to the redacted contents. See Xanthopoulos, 35 F.4th at 

1137–38. After Fogg appealed to this court,3 we reversed both the grant of summary 

judgment to the IRS and the denial of Fogg’s request for in camera inspection, 

remanding to the district court to conduct the in camera inspection. Id. at 1139.

By the time the district court conducted its in camera inspection, the IRS had 

revised the IRM and voluntarily released some of its previously redacted portions. 

Thus, the district court reviewed the five remaining redactions in IRM § 21.1.3.3: 

first, “a ‘note’ under § 21.1.3.3(3)”; second, “an ‘exception’ under § 21.1.3.3(3)”; 

third, “all of § 21.1.3.3(4)”; fourth, “all of § 21.1.3.3(5)”; and fifth, “approximately 

two lines of text under § 21.1.3.3(8).” The district court also allowed the IRS to 

publicly file a declaration from King Donaghy, a Supervisory Tax Analyst for the 

IRS’s Customer Account Services. Donaghy’s declaration explained that the five 

redactions “set forth the techniques and procedures IRS employees are to follow to 

authenticate the identity of the purported [third-party tax preparers] in various nonstandard situations.” 

Based on its in camera inspection and Donaghy’s declaration, the district court 

concluded Exemption 7(E) applied to the redacted contents of IRM § 21.1.3.3. The 

district court determined the redactions serve a law enforcement purpose because 

they “specifically address exceptions to the[] standard procedures” and involve 

“exceptional situations [of] a heightened risk of fraud or identity theft.” It next 

concluded the redactions were “techniques and procedures for law enforcement 

investigations,” whose disclosure “could reasonably be expected to risk 

circumvention of the law.” See 5 U.S.C. § 552(b)(7)(E). Because it determined 

Exemption 7(E) applied to the redactions, the district court again granted summary 

judgment to the IRS. Fogg appeals once more, arguing Exemption 7(E) does not 

apply to the redacted contents. 

3

Xanthopolous elected not to pursue an appeal following the district court’s 

first grant of summary judgment, and he is no longer a party in this case. 
-4- 

II. Analysis

We review de novo the district court’s grant of summary judgment. 

Xanthopoulos, 35 F.4th at 1138. “In the FOIA context, summary judgment is 

available to the agency where it ‘proves that it has fully discharged its obligations 

under FOIA, after the underlying facts and inferences to be drawn from them are 

construed in the light most favorable to the FOIA requester.’” Id. (quoting Mo. Coal. 

for Env’t Found. v. U.S. Army Corps of Eng’rs, 542 F.3d 1204, 1209 (8th Cir. 2008)). 

“[D]isclosure, not secrecy, is the dominant objective of the [FOIA].” Dep’t of Air 

Force v. Rose, 425 U.S. 352, 361 (1976). The FOIA is intended to give the public 

access to government documents unless an enumerated exemption to disclosure

applies. See Mo. Coal., 542 F.3d at 1208. There are nine limited exemptions to 

disclosure—which we narrowly construe—and the government bears the burden of 

showing an exemption applies. Xanthopoulos, 35 F.4th at 1138.

In this case, the IRS claims the redacted contents of IRM § 21.1.3.3 are 

exempted from disclosure under Exemption 7(E). Under that exemption, the IRS 

may withhold from disclosing: 

(7) records or information compiled for law enforcement purposes, but 

only to the extent that the production of such law enforcement records 

or information . . . (E) would disclose techniques and procedures for 

law enforcement investigations or prosecutions, or would disclose 

guidelines for law enforcement investigations or prosecutions if such 

disclosure could reasonably be expected to risk circumvention of the 

law . . . .

5 U.S.C. § 552(b)(7)(E) (emphasis added). The district court determined—and 

neither party contests—that the redacted contents are compiled for “law enforcement 

purposes”; they protect taxpayer information from fraudulent attempts to access it. 

Thus, the IRS satisfied Exemption 7(E)’s threshold requirement that the redacted 

contents be for “law enforcement purposes.” 
-5- 

The IRS only asserts the IRM’s redacted contents are “techniques and 

procedures” for law enforcement investigations; it does not contend the redacted 

contents are “guidelines.” Thus, we first need to determine whether the redacted 

contents are “techniques and procedures for law enforcement investigations” under 

Exemption 7(E)’s plain language. If they are, we then must determine whether 

disclosure is nevertheless compelled by some other FOIA provision. 

A. Techniques and Procedures for Law Enforcement Investigations

Whether the redacted contents qualify as “techniques and procedures for law 

enforcement investigations” depends on the “‘ordinary, contemporary, common 

meaning’ of those terms when FOIA was enacted,” Xanthopoulos, 35 F.4th at 1138

(quoting Food Mktg. Institute v. Argus Leader Media, 588 U.S. 427, 433–34 (2019)). 

“A court cannot expand or constrict the exemption beyond what its terms permit.” 

Id. Because Congress enacted the current iteration of Exemption 7(E) in a 1986 

amendment to the FOIA, see Freedom of Information Reform Act of 1986, H.R. 

5484, 99th Cong. § 1802 (1986), we look to the meaning of exempting “techniques 

and procedures for law enforcement investigations or prosecutions” as it would have 

meant in 1986. 

The individual terms comprising Exemption 7(E) are broad. A “technique” is 

“a technical method of accomplishing a desired aim,” while a “procedure” is “a 

particular way of doing or going about the accomplishment of something.” Allard 

K. Lowenstein Int’l Hum. Rts. Project v. Dep’t of Homeland Sec., 626 F.3d 678, 682

(2d Cir. 2010) (hereinafter, Lowenstein Project) (quoting Technique, Webster’s 

Third New Int’l Dictionary 2348 (1986), and Procedure, Webster’s Third New Int’l 

Dictionary 1807 (1986)). Under those terms’ plain meaning, practically any way of 

doing something is a “technique” or a “procedure.” But Exemption 7(E) narrows 

the terms’ otherwise broad meanings by cabining the exemption to only those 
-6- 

“techniques” and “procedures” that are used in “law enforcement investigations.”4

 

“Law enforcement” refers to “the act of enforcing the law, both civil and criminal,” 

Pub. Emps. for Env’t Resp. v. U.S. Section, Int’l Boundary & Water Comm’n, U.S.-

Mex., 740 F.3d 195, 203 (D.C. Cir. 2014) (hereinafter, PEER) (citing Law 

enforcement, Black’s Law Dictionary 964 (9th ed. 2009)), while an “investigation” 

is a “detailed examination” or a “searching inquiry,” Investigation, Webster’s Third 

New Int’l Dictionary 1189 (1986). 

Even though “law enforcement investigations” may cover a wide swath of 

activities, the whole of Exemption 7(E)’s plain language imparts some limits. After 

all, a technique or procedure that serves a law enforcement purpose may not be a 

technique or procedure that serves a law enforcement investigation, as “‘law 

enforcement purposes’ involve more than just investigation and prosecution.” 

Milner v. Dep’t of Navy, 562 U.S. 562, 583 (2011) (Alito, J., concurring) (emphasis 

added). “Congress’ decision to use different language to trigger Exemption 7 

confirms that the concept of ‘law enforcement purposes’ sweeps in activities beyond 

investigation and prosecution.” Id. at 584.

It is especially important to scrutinize an agency’s assertion of Exemption 

7(E) when that agency is not solely a law enforcement agency, but instead serves 

“mixed law enforcement and administrative functions,” as the IRS does. 

Xanthopoulos, 35 F.4th at 1139 (emphasis added). Those parts of the IRM relating 

solely to “administrative matters” fall outside Exemption 7(E)’s scope, such as the 

parts dealing with organizational hierarchy and internal human resources. See id. 

Accordingly, Fogg argues the redacted contents of IRM § 21.1.3.3 pertain to the 

IRS’s routine, administrative functions and are not employed in “law enforcement 

investigations.” The IRS asserts the redacted contents are used for special, nonroutine scenarios “and are preventative in nature, and therefore are part of the IRS’s 

4

The IRS does not contend the redacted contents of IRM § 21.1.3.3 pertain to 

law enforcement “prosecutions” or have any prosecutorial component. 
-7- 

law enforcement investigation efforts,” likening the redacted contents to techniques 

and procedures for conducting background checks. 

Courts have concluded “law enforcement investigations” may include agency 

background checks into individuals seeking to obtain some government benefit. For 

example, the Second Circuit held the questions that U.S. Customs and Immigration 

Services “instructs its employees to ask visa applicants to detect ties to terrorism” 

are techniques and procedures for law enforcement investigations because they 

“identify potential terrorists and keep them from entering the United States . . . .” 

Knight First Amend. Inst. at Columbia Univ. v. U.S. Citizenship & Immigr. Servs., 

30 F.4th 318, 331–32 (2d Cir. 2022). Likewise, the D.C. Circuit noted the C.I.A.’s 

“security clearance procedures” can be procedures for law enforcement 

investigations because they “uncover[] background information on potential [C.I.A. 

officer] candidates.” Morley v. C.I.A., 508 F.3d 1108, 1129 (D.C. Cir. 2007). See 

also 100Reporters v. U.S. Dep’t of State, 602 F. Supp. 3d 41, 80–81 (D.D.C. 2022)

(holding Exemption 7(E) applied to State Department’s vetting techniques and 

procedures for preventing the furnishing of assistance to foreign security forces 

believed to have committed human rights violations). These cases reveal that 

Exemption 7(E)’s definition of “law enforcement investigations” includes 

background checks. Thus, Exemption 7(E) applies to background check techniques 

and procedures “even when the [redacted] materials have not been compiled in the 

course of a specific investigation” or ongoing criminal investigation. See Tax 

Analysts v. I.R.S., 294 F.3d 71, 79 (D.C. Cir. 2002). Our task is to determine whether 

the redacted contents are techniques and procedures to help the IRS conduct 

background checks—a type of law enforcement investigation—into third-party 

callers, or if the redacted contents merely pertain to administrative authentication, as 

Fogg claims they do.

Based on our review of Donaghy’s declaration and the redacted contents of 

IRM § 21.1.3.3, we conclude Exemption 7(E) applies; the redacted contents all 

involve techniques and procedures the IRS uses for law enforcement investigations. 

They are akin to background checks because they help the IRS to authenticate a 
-8- 

caller’s identity in special scenarios in which the caller raises a suspicion of fraud. 

These techniques and procedures are not “routine” and “already well known to the 

public,” such that any public domain exception should apply. See Cox v. U.S. Dep’t 

of Just., 576 F.2d 1302, 1310 (8th Cir. 1978); Knight, 30 F.4th at 332. Even if the 

concept of authenticating a caller’s identity is publicly known, Exemption 7(E) still 

“protects information that would reveal facts about such techniques or their 

usefulness that are not generally known to the public, as well as other information 

when disclosure could reduce the effectiveness of such techniques.” See Broward 

Bulldog, Inc. v. U.S. Dep’t of Just., 939 F.3d 1164, 1191 (11th Cir. 2019). As 

evidenced by our in camera inspection and Donaghy’s declaration, the IRM’s 

redacted contents apply in non-standard scenarios, not involving every third-party 

caller. The techniques and procedures help the IRS conduct its law enforcement 

investigation into callers’ identities, thus preventing tax fraud. 

This is not a case where the agency’s techniques and procedures only have a 

vague or tenuous connection to “law enforcement investigations.” In PEER, the 

D.C. Circuit determined a dam-managing agency could withhold “emergency action 

plans” taken by emergency personnel in case of a dam failure because those plans

constituted “guidelines for law enforcement investigations.” See PEER, 740 F.3d at 

204–05. “Those guidelines describe[d] the surveillance and detection of the cause 

of an emergency dam failure as well as the process for evaluating the dam failure 

when the emergency subsides.” Id. at 205. The agency argued, and the court agreed, 

Exemption 7(E) applied to the emergency plans because they could constitute 

guidelines pertaining to “law enforcement investigations”—rather than constituting 

emergency-management plans—if a subsequent investigation into the dam failure 

eventually revealed “a suspicion of criminal sabotage or terrorism.” Id. If PEER 

toed the line on what should qualify as a “law enforcement investigation,” the IRS 

demonstrates IRM § 21.1.3.3 stands at least a few steps on the safe side of it. 

For whatever reason an agency invokes Exemption 7(E), whether it seeks to 

withhold “techniques and procedures” or “guidelines,” the agency must show the 

redactions are for “law enforcement investigations or prosecutions.” The IRS has 
-9- 

carried its burden here. After all, the IRS did not invent its duty to prevent 

unauthorized third-party access to tax-payer information. Rather, Congress 

mandated the IRS conduct such investigations into the identities of third parties who

attempt to access taxpayer information. For example, 26 U.S.C. § 6103(a) forbids 

the IRS from disclosing tax return information to unauthorized third parties, while 

26 U.S.C. § 7431 awards taxpayers damages if the IRS even negligently discloses 

their taxpayer information. See Snider v. United States, 468 F.3d 500, 512 (8th Cir. 

2006) (affirming such an award). That Congress imposed these duties—and awards 

taxpayers when the IRS fails in its duties—reveals the techniques and procedures 

are for “law enforcement investigations.” 

B. Circumvention of the Law

Even if the redacted contents are techniques and procedures for law 

enforcement investigations, Fogg argues the IRS should still disclose the redacted 

contents because their disclosure would not “reasonably be expected to risk 

circumvention of the law.” See 5 U.S.C. § 552(b)(7)(E). He invokes Exemption 

7(E)’s “circumvention clause,” which appears immediately after the “guidelines” 

clause. The circumvention clause provides another way for a party to obtain 

otherwise exempted contents under the guidelines clause. Our court has yet to 

determine whether the circumvention clause also applies to the “techniques and 

procedures” clause. We can confidently say it does not. As the Second Circuit 

explained, “basic rules of grammar and punctuation dictate that the qualifying phrase 

modifies only the immediately antecedent ‘guidelines’ clause and not the more 

remote ‘techniques and procedures’ clause.” Lowenstein Project, 626 F.3d at 681. 

Thus, under Exemption 7(E)’s plain language, Congress deemed that disclosure of 

“techniques or procedures for law enforcement investigations” presumptively risks 

circumvention of the law. Exemption 7(E), on its own, does not provide a party any 

other way of forcing an agency to disclose “techniques and procedures for law 

enforcement investigations.” 
-10- 

Even though the circumvention clause does not apply to the techniques and 

procedures clause, the IRS must still satisfy the standard set by 5 U.S.C. 

§ 552(a)(8)(A)(i), which Congress added to the FOIA in 2016 to curtail agency 

overuse of FOIA exemptions. See Leopold v. Dep’t of Just., 94 F.4th 33, 37 (D.C. 

Cir. 2024). That subsection requires an agency to disclose redacted information—

even if an exemption otherwise applies—unless “the agency reasonably foresees that 

disclosure would harm an interest protected by an exemption described in subsection 

(b)” or “disclosure is prohibited by law[.]” 5 U.S.C. § 552(a)(8)(A)(i)(I)–(II). This

“foreseeable harm” requirement is an independent burden on the agency. See Reps. 

Comm. for Freedom of the Press v. F.B.I., 3 F.4th 350, 369 (D.C. Cir. 2021); Seife 

v. U.S. Food & Drug Admin., 43 F.4th 231, 235 (2d Cir. 2022). Under this 

amendment, “[a]pplicability of a FOIA exemption is still necessary—but no longer 

sufficient—for an agency to withhold the requested information.” Seife, 43 F.4th at 

235. 

Neither the Supreme Court nor our sister circuits have addressed how the 

foreseeable harm requirement applies to Exemption 7(E), so we must begin by 

ascertaining what interests Congress intended Exemption 7(E) to protect before 

proceeding to examine whether disclosure would result in foreseeable harm to those 

interests. See id. at 239. One obvious interest is preventing “circumvention of the 

law.” 

At first blush, it could seem 5 U.S.C. § 552(a)(8)(A)(i) merely extends 

Exemption 7(E)’s circumvention clause to the techniques and procedures clause. 

But whereas Exemption 7(E)’s circumvention clause only requires the IRS to show 

how disclosing otherwise-exempted guidelines “could be reasonably expected to 

risk circumvention of the law,” see 5 U.S.C. § 552(b)(7)(E) (emphasis added), the 

foreseeable harm requirement requires the IRS to show how disclosure would 

foreseeably harm the IRS’s interest in preventing circumvention of the law, 5 U.S.C. 

§ 552(a)(8)(A)(i). 
-11- 

There is a material difference between speaking of a foreseeable risk of harm 

on the one hand, and foreseeable harm on the other. As written, the circumvention

clause allows an agency to withhold information if it can show a mere risk of harm, 

a minimal burden, requiring only the agency demonstrate “an expectation” of a risk. 

Mayer Brown LLP v. I.R.S., 562 F.3d 1190, 1193 (D.C. Cir. 2009). This is in contrast 

with § 552(a)(8)(A)(i), which demands the IRS show foreseeable harm stemming 

from disclosure. This showing requires more than just an expectation of a risk, but 

an actual expectation of harm. As the D.C. Circuit explained, “the foreseeability 

requirement means that agencies must concretely explain how disclosure ‘would’—

not ‘could’—adversely impair [an exemption’s protected interest].” See Reps. 

Comm., 3 F.4th at 369–70. Congress’s addition of the foreseeable harm requirement 

may mean that Exemption 7(E)’s circumvention clause is left with little independent 

effect, even in guidelines cases. But such an interpretation is consistent with 

Congress’s “concern” that the exemptions’ built-in restrictions had proved 

insufficient to prevent “overus[e].” Leopold, 94 F.4th at 37.

Even though the district court did not analyze the redacted contents under the 

heightened foreseeable harm requirement—only analyzing whether the IRS cleared 

the “low bar” of Exemption 7(E)’s circumvention clause—the record still supports 

the IRS’s withholding under the heightened standard. First, Donaghy’s declaration 

specifically references the IRS’s determination that lax authentication procedures 

allowed wrongdoers to access taxpayer information in the past. The IRS adopted 

the redacted techniques and procedures of IRM § 21.1.3.3 to improve its third-party 

authentication procedures and prevent ongoing circumvention of the law. Thus, the 

IRS can reasonably foresee harm stemming from disclosing the redacted contents 

because the harm preceded the adoption of the techniques and procedures. Indeed, 

the IRS adopted those techniques and procedures in response to ongoing

unauthorized third-party access to taxpayer information.5

5

That is not to say a withholding agency satisfies its burden under the 

foreseeable harm requirement simply by showing it adopted techniques or 

procedures in response to past harm. Mere demonstration of past harm is no 

guarantee that disclosing the adopted techniques or procedures inevitably leads to 
-12- 

Second, Donaghy explains, to the greatest extent possible, how disclosure of 

the redacted contents leads to circumvention of the law. See Cox, 576 F.2d at 1311 

(A withholding agency “must articulate its reasoning with specificity, to the degree 

that it can do so without revealing . . . the content of the material in question.”). As 

to Redaction 1, Donaghy states this redacted material “explains the identity 

authentication elements required of a third-party purportedly holding the taxpayer’s 

[power of attorney] or [tax information authorization] as modified for certain nonstandard circumstances.” She explains that disclosing these techniques would 

inform wrongdoers “of the modified authentication elements that satisfy the IRS’s 

investigation or the non-standard circumstances for which they are modified,” which 

would enable those wrongdoers to circumvent those procedures, and thus 

circumvent the law. 

As to the other four redactions, Donaghy likewise describes the techniques 

and procedures to the greatest extent she can without revealing the content of the 

redacted material. Redaction 2 “describes alternative identity authentication 

procedures for a particular group of purported [power of attorney] and/or [tax 

information authorization] holders”; Redactions 3 and 4 “describe[] certain 

procedures IRS employees are instructed to follow with respect to callers who 

present another specific non-standard circumstance”; and Redaction 5 “describes 

alternative identity authentication procedures for certain purported [power of 

attorney] and/or [tax information authorization] holders under certain other nonstandard circumstances.” She also explains that disclosing these procedures could 

reduce their “effectiveness in accurately identifying callers and distinguishing those 

with taxpayer-authorized access from those attempting to obtain return information 

fraudulently or without a taxpayer’s authorization.” 

Granted, Donaghy references how disclosure would lead to a foreseeable

“risk” of circumvention of the law, invoking the language of Exemption 7(E)’s 

that harm repeating. The agency must still justify its withholding by explaining how

disclosure of the withheld techniques or procedures leads to foreseeable harm.
-13- 

circumvention clause. But even though she does not specifically invoke the 

foreseeable harm requirement, her affidavit and accompanying materials 

nevertheless establish that disclosure would lead to foreseeable harm. This is not 

the case when an agency attempts to withhold information based only on overly 

broad generalizations. See Reps. Comm., 3 F.4th at 370 (holding the agency’s 

“assertion of harm in [two] umbrella paragraphs” of its declaration did not address 

foreseeable harm when those paragraphs were “scanty,” “wholly generalized and 

conclusory,” and “just mouthing the generic rationale for the [exemption] itself”). 

Even though Fogg accuses Donaghy’s declaration of containing some conclusory 

language as to why the IRS expects greater circumvention of the law, the declaration 

also contains enough redaction-by-redaction specifics to meet the heightened burden

for withholding. 

III. Conclusion

We affirm the district court. 

______________________________