### UNITED STATES DISTRICT COURT FORTHE DISTRICT OF COLUMBIA ELECTRONICPRIVACY INFORMATION CENTER, Plaintiff,


### v. NATIONAL SECURITYAGENCY, Defendant. ) ) ) ) 

### ) Civil Case No. 10-1533 (RJL) ) ) ) ) )


### MEMORANDUM OPINION (July)t, 2011) [#9, #11] PlaintiffElectronic Privacy Information Center ("EPIC" or "plaintiff')brings this action against the National Security Agency ("NSA" or "defendant") for failure to disclose informationpursuantto the Freedom ofInformation Act ("FOIA"). Plaintiff seeks material relating to NSA's possible relationship with Google following news ofan alleged cyber attack by hackers in China and ofa subsequent cooperation agreement between Google and NSA. Before this Court is defendant's Motion for Summary Judgment and plaintiff's Cross-Motion for Summary Judgment. After due consideration ofthe parties' pleadings, the relevant law, and the entire record herein, defendant's motion is GRANTED and plaintiffsmotion is DENIED. 

### BACKGROUND On February 4, 2010, following media coverage ofapossible partnership between the NSA and Google relating to an alleged cyber attack by hackers in China, EPIC submitted aFOIA request to NSA seeking: 11. All records concerning an agreement or similarbasis for collaboration, final or draft, between the NSA and Google regarding cyber security; 2. All records ofcommunication betweenthe NSA and Google concerning Gmail, including but not limited to Google's decision to fail to routinely encrypt Gmail messages priorto January 13,2010; and 3. All records ofcommunications regarding the NSA's role in Google's decision regarding the failure to routinely deploy encryption for cloud-based computing service, such as Google Docs. CompI.**~** 12. NSA denied EPIC's request. Letter from PamelaN. Phillips, NSA, FOIA/PA Office, Mar. 10,2010 [#9-3]. While it acknowledged working "with a broad range of commercial partners and research associates," the Agency refused to "confirm [or] deny" whether it even had arelationship with Google. Id. In support ofits response, NSA cited Exemption 3 ofFOIA and Section 6 ofthe National SecurityAgency Act of 1959 ("NSA Act"), explaining that any response would improperly reveal information about NSA's functions and activities. Id. Such aresponse - neither confirmingnor denying the existence ofrequested documents

- is known as a Glomar response. I On May 7, 2010, EPIC appealed through the agency's internal appeal process. Compi.**~** 21. However, afterNSA failed to respond to EPIC's appeal within the statutory deadline, EPIC filed the complaint initiating this lawsuit. PI.'s Opp'nto Mot. For Summ.

I The term "Glomarresponse" is derived from the ship the GlomarExplorer, and refers to the C.I.A.'s refusal to acknowledge the existence or non-existence ofany records pertainingto the ship. Phillippi v. C.I.A., 546 F.2d 1009, 1011 (D.C. Cir. 1976). 

### 2J. at 3 (Pl.'s Opp'n).2 On December 22, 2010, NSA filed its Motion for Summary Judgment, contending thatthe use ofa Glomar response was appropriate under the circumstances and thatthe requested information was protected from release by FOIA Exemption 3,5 U.S.C. § 552 (b)3, and Section 6 ofthe NSAAct, Sec. 6, Pub. L. No. 86- 36, 73 Stat. 63, 50 U.S.C. §402 note. Def.'s Mem. in SUpp. ofMot. Summ. J. ("Def.'s Mot.") at 3. In support ofits motion, NSA submitted a declarationby Diane M. Janosek, the Deputy Associate Director for Policy and Records for the NSA ("Janosek Declaration" or ·'Declaration"). Decl. ofDiane M. Janosek, Dec. 20, 2010 ("JanosekDecl.") [#9-1]. Specifically, the Declaration states that, as part ofits Information Assurance mission, NSA is responsible for "protectingDepartment ofDefense and othernational-security information systems, as well as providing direct supportto other agencies that help protect other U.S. government information systems and the nation's critical infrastructure and key resources." Id.**~** 4. The NSA also performs governmentvulnerability discovery and security testing, and participates in public-private security initiatives relating to the commercial technology that the U.S. Government uses for its information systems. Id.**,-]~** 5-6. With respect to EPIC's specific request, the Declaration states that "[t]o confirm
or deny the existence ofany such records would beto reveal whetherthe NSA
... determined that vulnerabilities or cybersecurity issues pertainingto Google orcertain of

2 Once the suit was filed, NSA stoppedprocessingEPIC's appeal and filed an answer on October27,2010to EPIC's complaint. Def.'s Mot. at 4. 3its commercial technologies could make U.S. government information systems susceptibleto exploitation or attack." Id.**~** l3. The Declaration further clarifies that even
an acknowledgement ofarelationship between the NSA and a commercial entity could potentially alert "adversaries to NSApriorities, threat assessment, or countermeasures," and that, as such, the information relates to the Agency's core functions and activities under its Information Assurance mission. Id.**~~** l3-14. In response to NSA's Motion, EPIC filed a cross-motion on January 28, 2011. EPIC asserts two arguments: first, thatNSA was required under FOIA to search for relevant records and segregate and disclose non-exempt information priorto issuing a Glomarresponse; and second, that the Janosek Declarationwas "vague and conclusory," and, therefore, insufficient underthe law ofthis Circuit. Pl.'s Opp'n at 4. Forthe following reasons, I disagree. ANALYSIS Summaryjudgment is appropriate when the record demonstrates thatthere is no genuine issue ofmaterial fact in dispute and thatthe moving party is entitled tojudgment
as a matter oflaw. Fed. R. Civ. P. 56(a). The moving party bears the burden, and the court will draw "alljustifiable inferences" in favor ofthe non-moving party. Anderson v. LibertyLobby, Inc., 477 U.S. 242, 255 (1986). Nevertheless, the non-moving party "may not rest upon the mere allegations or denials ofhis pleading, but
... must set forth specific facts showing that there is a genuine issue for trial." Id. at 248 (internal quotations omitted). Factual assertions in the moving party's affidavits may be accepted

4as true unless the opposingparty submits its own affidavits, declarations or documentary evidenceto the contrary. Neal v. Kelly, 963 F.2d 453,456 (D.C. Cir. 1992). "When assessing a motion for summaryjudgmentunder FOIA, the Court shall determine the matter de novo." Judicial Watch, Inc. v. U.S. Dep't

## 0/HomelandSec., 598 F. Supp. 2d 93, 95 (D.D.C. 2009) (citing 5U.S.C. § 552(a)(4)(B». While the "burden is
on the agency to sustain its action," 5U.S.C § 552 (a)(4)(B), courts must give substantial weight to an agency's affidavits, Hayden v. NSAICSS, 608 F.2d 1381, 1387 (D.C. Cir. 1979), see MilitaryAuditProject v. Casey, 656 F.2d 724,745 (D.C. Cir. 1981). The court may rely on the agency's affidavits or declarations ifthey contain reasonable specificity ofdetail ratherthan merely conclusory statements, and ifthey are not called into question by contradictory evidence in the record orby evidence ofagency bad faith. See Halperin v CI.A., 629 F.2d 144, 150 (D.C. Cir. 1980). "Ultimately, an agency's justification for invoking a FOIA exemption is sufficient ifit appears logical or plausible."Larson v. Us. Dep 't a/State, 565 F.3d 857, 862 (D.C. Cir. 2009) (internal quotations omitted). When an agency issues a Glomar response - refusing to confirm or deny the existence ofdocuments

- it must establish that the requested information is protected by
one ofthe nine recognized FOIA exemptions. 5 U.S.c. § 552(b)(3); see Wolfv. CI.A., 473 F.3d 370, 375 (D.C. Cir. 2007). Exemption 3permits an agency to preventthe release ofrecords that are "specifically exempted from disclosure by statute." 5 U.S.C. § 552(b)(3). Although FOIArequests are traditionally "narrowly construed,"Dep'ta/the AirForce v. Rose, 425 U.S. 352, 361 (1976), Exemption 3 "differs from otherFOIA 5exemptions in that its applicability depends less on the detailed factual contents of specific documents," Golandv. C.I.A., 607 F. 2d 339,350 (D.C. Cir. 1978). Instead, "the sole issue for decision is the existence ofarelevant statute and the inclusion ofwithheld material within that statute's coverage." ld.; seeAss'n of RetiredR.R. Workers v. 

## us. R.R. Ret. Bd., 830 F.2d 331,336 (D.C. Cir. 1987). Itis well establishedthat Section 6 ofthe NSA Act is a statutory exemption under Exemption 3. See Hayden, 608 F.2d at 1389; Founding Church of Scientology of Washington, D. 

## c., Inc. v. NS.A., 610 F.2d 824, 826 (D.C. Cir. 1979). Section 6 ofthe NSA Act broadly prohibits the disclosure ofinformation pertainingto the organization, function, or activities ofthe NSA. National Security Agency Act of 1959, Sec. 6, Pub. L. No. 86-36, 73 Stat. 63, 50 U.S.C. §402 note. Specifically, the NSA need not disclose "the organization or any function ofthe National Security Agency, [or] any information with respect to the activities thereof." ld. While our Circuithas admonished that "courts must be particularly careful when scrutinizing claims ofexemptions based on such expansive terms," as those included in Section 6, Scientology, 610 F.2d at 829, this heightened scrutiny must be temperedby the recognition ofthe substantial challenges posed to the NSA in maintaining operational security, see Hayden, 608 F.2d at 1390 (interpreting the NSA Actto reflect congressional recognition ofthe agency's "peculiar security needs"). Thus, once the agency, through affidavits, has created "as complete apublic record as is possible" and explained "in as much detail as is possible the basis for its claim,"Phillippi, 546 F.2d at 1013, the "court is not to conduct a detailed inquiry to 6decide whether it agrees with the agency's opinions,"Halperin, 629 F.2d at 148. Further, "NSA is not required to showharm to national security under Section 6." Larson, 565 F.3d at 868; see also Hayden, 608 F.2d at 1390. As the Supreme Court explained in C.I.A. v. Sims, "bits and pieces ofdata 'may aid in piecing togetherbits ofother information even when the individual piece is not ofobvious importance in itself.'" 471 U.S. 159, 178 (1985) (quotingHalperin v. C.I.A., 629 F.2d 144,150 (D.C. Cir. 1980)). Here, NSA's supporting affidavits satisfy the criteria for non-disclosure under Section 6. 3 The Janosek Declaration contains sufficient detail, pursuantto Section 6, to support NSA's claim thatthe protected information pertains to "the organization or any function ofthe National Security Agency, [or]
... to the activities thereof." 50 U.S.C. § 402 note; see Hayden, 608 F.2d at 1388 (granting summaryjudgmentbased on affidavits that describe "the activity involved, the need for maintaining secrecy, and the reason for believing that disclosure ofany ofthe requested material could compromise legitimate secrecy needs"); Miller v. Casey, 730 F.2d 773, 776 (D.C. Cir. 1984) (describing as ample an affidavit which "demonstratesthat the information withheld logically falls

3 Plaintiffs argumentregarding the public dissemination ofinformationrelating to a purported GooglelNSA agreement is misleading. The agency has not waived its FOIA protections by official disclosure ofthe requested information. See Wolfv. C.I.A., 473 F.3d 370,378 (D.C. Cir. 2007). Nordoes plaintiffever contestthis point. Rather, plaintiffincorrectly argues that information, which is widely reported in the media, is stripped ofits FOIAprotections. Pl.'s Opp'n at 9-10. Indeed, while Glomar responses are deemed inappropriate whenthe specific information has already been officially and publicly disclosed by the solicited agency, such disclosure "cannotbe based on mere speculation, no matterhowwidespread." Id. The agency, itself, must waive FOIA protections through an official disclosure. Id. 7within the claimed exemption, and [is] not controvertedby eithercontrary evidence in the record norby evidence ofagency bad faith" (internal quotations omitted)). Indeed, as the Janosek Declaration makes clear, the requested information relates to the NSA's cryptologic Information Assurance mission, which is designed to protect national security information systems and critical infrastructure resources. Janosek Decl.**~** 5. Because ofthe reliance by the U.S. government on commercial systems, this mission includes the assessment ofcommercial technologies and the Agency'sparticipation in public-private security initiatives. Id.**~~** 5-6, 12. Thus, with respect to plaintiffs first request
- all records concerning an agreement betweenNSA and Google regarding cyber-security

- the Janosek Declaration explains that "any acknowledgementby NSA ofthe existence or nonexistence ofarelationship or agreement with Google
... would reveal whether or not NSA consideredthe alleged attack to be ofconsequence for critical U.S. government information systems." Id.**~** 13. Further, with respect to plaintiffs second and third requests
- NSA/Google communications regarding encryption ofGmail and cloud-based computing service, such
as Google Docs

- the Janosek Declaration clarifies that "to confirm or deny the existence ofany such records would be to reveal whetherNSA, in fulfilling one ofits key missions, determined that vulnerability or cyber security issues pertainingto Google or certain of its commercial technologies could make U.S. government information systems susceptibleto exploitation or attack by adversaries
..." ld.**~** 13. TheDeclaration then adds, "[i]n addition to revealing information about NSA functions and activities, such information falling in either category could alert our adversaries to NSA priorities, threat 8assessments, or countermeasures that mayormay not be employed against future attacks." Id. This Declaration provides more than cursory details concerningthe relationship betweenthe withheld material and NSA's organization and function. 

### See Scientology, 610 F.2d at 831. To the contrary, it explains the relevance ofthe Information Assurance mission to national security, the cleartie between the requested information and the Information Assurance mission, and the cognizable harm posed by acknowledging the existence/non-existence ofthe information. 4 Thus, because NSA's answer is both logical and plausible,5 the Declaration satisfies all the requirements set forth by our Circuit. 

### See Larson, 565 F.3d at 862; 

### Halperin, 629 F.2d at 148; 

### Hayden, 608 F.2d at 1388.

4 EPIC argues that the NSA's single supporting declaration is conclusory and fails to demonstrate that the requested informationpertains to the NSA's Information Assurance mission and is protected by the NSA Act exemption. Pl.'s Opp'n at 7-8. EPIC also challenges that its requests are broad enough to include documents that "do not reflect on the NSA's activities in any way." PI.'s Opp'n at 6. These claims understate the Janosek Declaration's depiction ofthe NSA's Information Assurance mission, as well as the explanation ofhow the requested records wouldreveal information relating to NSA activities. Simply put, it is the relationship between Google and the NSA notjustthe content ofrecords that warrants protections. 

### See Goland, 607 F. 2d at 350. 5NSA also argues that revealing a relationship with Google could dissuade other companies from working with the agency in the future or self-reporting on problems. Def.'s Reply at 10. This is a serious concern which also warrants finding for the NSA. 

### See Sims, 471 U.S. at 175. 9CONCLUSION For all ofthe foregoing reasons, the Court GRANTS defendant's Motion for Summary Judgment [#9] and DENIES plaintiffs Cross-Motion for Summary Judgment [#11]. An Orderconsistent with this decision accompanies this Memorandum Opinion.

10