# United States Court of Appeals

FOR THE DISTRICT OF COLUMBIA CIRCUIT

Argued March 20, 2012 Decided May 11, 2012

No. 11

- 5233

E LECTRONIC P RIVACY I NFORMATION C ENTER

, A PPELLANT

v.

N ATIONAL S ECURITY A GENCY

, A PPELLEE

Appeal from the United States District Court
for the District of Columbia (No. 1:10

- cv

- 01533)

Marc Rotenberg argued the cause for appellant. With
him on the briefs was John Verdi

.

Catherine Y. Hancock , Attorney, U.S. Department of Justice, argued the cause for appellee. With her on the brief

were Tony West , Assistant Attorney General, Ronald C.
Machen Jr. , U.S. Attorney, and Douglas N. Letter , Attorney.

Before: B ROWN and K AVANAUGH

, Circuit Judges , and

G INSBURG

, Senior Circuit Judge

.

Opinion for the Court filed by Circuit Judge B ROWN

.2

B ROWN

, Circuit Judge : Plaintiff

- appellant Electronic Privacy Information Center (“EPIC”) filed a Freedom of

Information Act (“FOIA”) request with the National Security Agency (“NSA”) seeking disclosure of any communications between NSA and Google, Inc regarding encryption and cyber security

. NSA issued a Glomar response pursuant to FOIA Exemption 3, indicating that it could neither confirm nor deny the existe nce of any responsive records. EPIC challenged NSA’s Glomar response in the district court, and the par ties cross

- moved for summary judgment. The district court entered judgment for NSA

, and EPIC appealed. We
affirm.

I.

EPIC’s FOIA request arose out of a January 2010 cyber attack on Google that primarily targeted the Gmail accounts of Chinese human rights activists. 1

1 Gmail is a “cloud

- based” email program, meaning the data and applications of the user reside on remote computer servers operated by Google. Prior to January 2010, Google allowed Gmail users to encrypt the mail that passed through Google servers using Hyp ertext Transfer Protocol Secure , but it did not provide encryption by default. Google subsequently changed Gmail’s privacy settings to automatically encrypt all
traffic to and from its servers. David Drummond, Google’s Senior Vice President for Corporate Development a nd Chief Legal Officer, stated that the company was notifying other companies that may have been targeted and was “also working with the relevant U.S. authorities .” David Drummond, A New Approach to China, Official Google Blog (Jan. 12, 2010), http://goog leblog.blogspot.com/2010/01/new

approach

- to

- china.html. On February 4, 2010, the Wall Street

Journal and Washington Post reported that Google had

contacted the NSA imm ediately following the attack. Former3

NSA director Mike McConnell commented in the Wash ington
Post that collaboration between NSA and private companies

like Google was “inevitable.” Mike McConnell, Mike McConnell on How to Win the Cyber

- War We’re Losing, Washington Post (Feb. 28, 2010), http://www.washingtonpost.com/wp

dyn/content/article/2 010/02/25/AR2010022502493.html

.

On February 4, 2010, EPIC submitted a FOIA request to NSA, specifically requesting three categories of records:

1. All records concerning an agreement or similar basis for collaboration, final or draft, between the NSA and Google regarding cyber security;

2. All records of communication between NSA and Google concerning Gmail, including but not limited to Google’s decision to fail to routinely encrypt Gmail messages prior to January 13, 2010; and

3. All records of communications r egarding NSA’s role in Google’s decision regarding the failure to routinely deploy encryption fo r cloud

- based computing service

, such as Google Docs.

NSA responded to EPIC’s request on March 10, 2010 by invoking Exemption 3 of the FOIA and Section 6 of th e National Security Agency Act 2 to issue a Glomar response, in
which the agency neither confirmed nor denied the exist ence of any responsive records.

2 Section 6 of the National Securi ty Agency Act provides that

“n othing in this Act or any other law . . . shall be construed to require the disclosure of the organization or any function of the National Security Agency, [or] of any information with respect to
the activities thereof

. . . . ” Pub. L. No. 86

– 36, § 6(a), 73 Stat. 63, 64 (1959).4

EPIC filed suit in the district court challenging NSA’s
Glomar response. 3 The parties cross

- moved for summary judgment. In support of its motion for summary judgment, NSA filed a declaration by Diane M. Janosek, NSA Deputy Associate Director for Policy and Records (the “Janosek Declaration”)

. The district court held that NSA was entitled to summary judgm ent because the Janosek Declaration was “both logical and plausible ” and “contain[ed] sufficient detail, pursuant to Section 6, to support NSA’s claim that the protected informati on [sought by EPIC] pertains to ” NSA’s organization, functions, or activities

. Elec. Privacy Info. Ctr. v. NSA, 798 F. Supp. 2d 26, 31

– 32 (D.D.C. 2011). We review the district court’s grant of summary judgment de novo. See Larson v. Dep ’t of State, 565 F.3d 857, 862 (D.C. Cir. 2009).

II.

The Freedom of Information Act, 5 U.S.C. § 552(a), provides that “[e]ach agency shall make available to the public” records in its possession unless the information is
covered by one of Section 552(b)’s nine statutory exemptions. As relevant here, FOIA Ex emption 3 shields from disclosure records that are “specifically exempted from disclosure by

statute ” if such statute either “ requires that the matters be withheld from the public in such a manner as to l eave no discretion on the issue” or “ establishes par ticular criteria for withholding or refers to particular types of matters to be withheld.” 5 U.S.C. § 552(b)(3).

3 EPIC initially filed an administrative appeal, arguing that NSA’s response was unlawful because the agency had failed to present factual evidence that the requested documents fell within Section 6, but filed suit in the district court prior to t he resol ution of that appeal.5

In addition to withholding records that are exempt, an

agency may issue a Glomar response, i.e.

, refuse to confirm or deny the existence or n onexistence of responsive records if the part icular FOIA exemption at issue would itself preclude

the ack nowledgement of such documents. See Wolf v. CIA, 473 F.3d 370, 374 (D.C. Cir. 2007). 4 An agency may issue a
Glomar response when “to answer the FOIA inquiry would cause harm cognizable under” an applicable statutory exemption. Id. The agency must demonstrate that acknowledging the mere existence of responsive records would disclose exempt information. Id

.

In Glomar cases, courts may grant summary judgment on the basis of agency affidavits that contain “reasonable specificity of detail rather than merely conclusory statements, and if they are not called into question by contradictory evidence in the record or by evidence of agency bad faith.”
Gard els v. CIA

, 689 F.2d 1100, 1105 (D.C. Cir. 1982). The supporting affidavit must justify the Glomar response based on “general exemption review standards established in non

Glomar cases.” Wolf, 473 F.3d at 37 4

– 7 5 . “Ultimately, an agency’s justification for invoking a FOIA exemption is sufficient if it appears ‘logical’ or ‘plausible.’” Larson, 565
F.3d at 862 . NSA need not make a specific showing of potential harm to national security in order to justify
withho lding information under Section 6, because “Congress has already, in enacting the statute, decided that disclosure of NSA activities is potentially harmful.” Hayden v. NSA, 608 F.2d 1381, 1390 (D.C. Cir. 1979). In reviewing an agency’s
Glomar response, t his Court exercises caution when the

4 The Glomar response takes its name from the Hughes Glomar Explorer

, “a ship built (we now know) to recover a sunken Soviet submarine, but disguised as a private vessel for mining manganese
nodules from the ocean floor.” Bassiouni v. CIA, 392 F.3d 244, 246 (7 th Cir. 2004).6

information requested “implicat[es] national security, a uniquely executive purview.” Ctr. for Nat’l Sec. St udies v. Dep’t of Justice, 331 F.3d 918, 926

– 27 (D.C. Cir. 2003).

NSA issued a Glomar response to EPIC’s re quest for records pertaining to the agency’s contact with Google, claiming that any responsive records would be exempt from disclosure under Exemption 3 and Section 6 of the National Security Agency Act, and that acknowledgement of the

existence of such re cords would cause harm cognizable under the exemption. Because Section 6 of the National Security Agency Act “is a statute qualifying under Exemption 3,” Founding Church of Scientology of Washington, D.C. v. NSA

, 610 F.2d 824, 828 (D.C. Cir. 1979) , the only question is
whether the withheld material satisfies the criteria of the exemption statute, i.e., whether acknowledging the existence or nonexistence of the requested material would reveal a function or an activity of the NSA. See Larson, 565 F. 3d at 868 (NSA “need only demonstrate that the withheld information relates to the organization of the NSA or any function or activities of the agency”). The agency bears the burden of proving that the withheld information falls within the exemption it in vokes. 5 U.S.C. § 552(a)(4)(B); King v. Dep’t of Justice, 830 F.2d 210, 217 (D.C. Cir. 1987).

EPIC claims its request seeks some records that are not covered by Exemption 3 and Section 6 of the NSA Act

— specifically , unsolicited communications from Google to NSA, which would fall within the second category of

information described in the request. In light of the broad language of Section 6, however, we find the Janosek Declaration provides adequate support for NSA’s Glomar

response. A s the Declaration ex plains, one of NSA’s primary cryptologic missions is its Information Assurance mission, under which NSA is tasked with protecting Government7

information systems. Because the Government is “largely dependent on commercial technology for its information

sys tems, ” NSA also monitors commercial technologies purchased by the government for security vulnerabilities.

Janosek Dec’ l ¶ 6. If NSA concludes that vulnerabilities in those commercial technologies pose a threat to U.S. Government information systems, NSA may t ake action against the threat.

The Declaration further explains that if NSA disclosed whether there are (or are not) records of a partnership or communications between Google and NSA regarding Google’s security, that disclosure might reveal whether NSA investigated the threat, deemed the threat a concern to the security of U.S. Government information systems, or took any measures in response to the threat. As such, any information pertaining to the relationship between Google and NSA would reveal pr otected information about NSA’s implementation of its Information Assurance mission. T he

existence of a relationship or communications between the NSA and any private company certainly constitutes an “activity” of the agency subject to protection under Se ction 6. Whether the relationship

— or any communications pertaining to the relationship

— w ere initiated by Google or NSA is
irrelevant to our analysis

. Even if EPIC is correct that NSA possesses records revealing information only about Google,

those record s, if maintained by the agency, are evidence of some type of interaction between the two entities , and thus

still constitute an NSA “activity” undertaken as part of its

Information Assurance mission , a primary “function” of the

NSA

. Moreover, if private entities knew that any of their attempts to reach out to NSA could be made public through a FOIA request, they might hesitate or decline to contact the agency, thereby hinde ring its Information Assurance m ission.8

EPIC’s attempt to liken this case to Found ing Church of Scientology, in which this Court found the agency’s affidavit too conclusory to support the NSA’s rejection of a FOIA
request, s ee 610 F.2d at 833, is unpersuasive. The affidavits at issue in the two cases differ substantially in their level of specificity. In Founding Church of Scientology, the affidavit summarily stated, without further elucidation, that “[d]isclosure of specific information which may be related to a specific individual or organization . . . in the context of [ the agency’s ] singular mission would reveal certain functions and
activities of the NSA

. . . . ” Id. at 831. Here, by contrast, the
NSA’s affidavit describes which functions and activities would be implicated by disclosure, as well as how acknowledging the existen ce or nonexistence of requested
records would reveal those functions or activities.

EPIC also attempts to distinguish this Court’s prior interpretations of Section 6 because those cases involved requests for records relating to the NSA’s cl assified intelligence gathering activities and sources. See, e.g.

, Larson, 565 F.3d at 867

– 69. EPIC contends that the same logic that requires secrecy in intelligence gathering does not apply to t he NSA’s Information Assurance m ission because it is public knowled ge that the U.S. gove rnment uses Google applications and that NSA is investigating security vulnerabilities in Google’s commercial products. The language of the NSA Act, however, does not distinguish between the agency’s various missions , and does not inv ite this Court to do so. Rather, the statute broadly exempts any information pertaining to the agency’s “activities” or
“functions.” NSA’s determination that certain security vulnerabilities in Google technologies pose (or do not pose) a risk to the gove rnment’s information systems constitutes an “activity” of the agency, as does a relationship between the agency and Google.9

Moreover, NSA does not waive its protection under FOIA by disclosing basic information about its information
assurance activities . The fact that limited information regarding a clandestine activity has been released does not
mean that all such information must be released. See Students Against Genocide v. Dep’t of State

, 257 F.3d 828, 836 (D.C. Cir. 2001)

. See also Wilner v. NSA

, 592 F.3d 60, 69

– 70 (2d Cir. 2009) (holding that the President’s decision to make public the existence of an NSA intelligence

- gathering program did not force the government to reveal the program’s operational details). A plaintiff asserting a claim of prior disclosure bears the burden of pointing to “specific information in the public domain that appears to duplicate that being withheld.” Wolf, 473 F.3d at 378. EPIC has failed to

meet its burden because its blanket req uest for “[a]ll records of communication between NSA and Google concerning Gmail” covers a substantially broader swath of information than what NSA has voluntarily published on its website. General security guidance, even involving recommended security se ttings for Gmail, does not “appear[] to duplicate” private communic ations between NSA and Google; it does not even disclose whether the two entities have engaged in
such communications. 5

5 EPIC’s claim that collaboration between Google and NSA was “widely reported in the national media and acknowledged by the
former director of the NSA” is similarly unavailing. Appellant’s

Br. 19. NSA has neve r officially acknowledged a collaborative relationship with Google, and the national media are not capable of waiving NSA’s statutory authority to protect information related to
its functions and activities. See Frugone v. CIA, 169 F.3d 772,

774

– 75 (D.C. Cir. 1999) (holding that only official acknowledgement from the agency from which the information is being sought can waive an agency’s protective power over records sought under the FOIA); Wolf, 473 F.3d at 378 (waiver of10

III

.

Subsection (b) of the FOIA provides that “[a]ny reasonably seg regable portion of a record shall be provided to any person requesting such record after deletion of the portions which are exempt under this subsec tion.” 5 U.S.C. § 552(b) . In response to a FOIA request, agencies “must make a good faith effort to conduc t a search for the requested records, using methods which can be reasonably expected to produce the information requested.” Nation Magazine, Washingto n Bureau v. U.S. Customs Serv.

, 71 F.3d 885, 890 (D.C. Cir. 1995). “ [ E ] ven if [the] agency establishes an exemption, it must nonetheless disclose all reasonably segregable, nonexempt portions of the requested record(s).” Roth v. Dep’t of Justice, 642 F.3d 1161, 1167 (D.C. Cir. 2011).

EPIC argues that Section 552(b) requires NS A to search for responsive documents and conduct a segregability analysis prior to issuing a Glomar response. We rejected a similar argument in Wolf , and EPIC is no more persuasive . In Wolf, the requester claimed that de novo review of the agency’s

respo nse “requires the district court to order the Agency to search for responsive records and to submit a Vaughn index.”
473 F.3d at 374 n.4. The Court disagreed, explaining that the requester’s argum ent “misunderstands the nature of a Glomar response, which narrows the FOIA issue to the existence of

records vel non. ” Id. When the agency takes the position that it can neither confirm nor deny the existence of the requested records, “there are no relevant documents for the court to

examine other than the aff idavits which explain the A gency’s

protection under the FOIA “cannot be based on mere public speculation, no matter how widespread”).11

refusal.” Id

. ; s ee also Wheeler v. CIA, 271 F. Supp. 2d 132, 141 (D.D.C. 2003) (affirming a Glomar response when the agency did not identify “whether or to what extent it had conducted a search”). The same logic applies here. Because
we find the Janosek Declaration sufficient to support NSA’s
Glomar response, requiring NSA to conduct a search and segregability analysis would be a meaningless

— not to mention costly

— exercise.

EPIC claim s this Court has upheld Glomar responses “only in cases where it is apparent from the record that the Agency first conducted a search and segregability analysis, and even disclosed or withheld specific responsiv e records,” Appellant’s Br. 25. This is inacc urate

. In the cases cited by EPIC, the agency conducted a search and segregability analysis of its own volition prior to issuing the Glomar

response. See, e.g., Larson, 565 F.3d at 861

– 62. In none of these cases, however, did the Court hold

— or even imply

— that such a search and analysis is required. See People for the Am. Way Found. v. NSA, 462 F. Supp. 2d 21, 30 n.5 (D.D.C. 2006) (“[A] Vaughn index is not required here, where it could

cau se the very harm that s ection 6 was intended to prevent.”). Likewise, EPIC’s assertion that “[a]gencies are not exempt from performing a segregability analysis, even in cases where they assert a Glomar response,” Appellant’s Br. 24, is also
incorrect. Al though EPIC cites Wolf in support of its proposition, that case expressly rejected EPIC’s argument in a
footnote. See Wolf, 473 F.3d at 374 n.4.

EPIC’s reliance on Jefferson v. Dep’t of Justice, Office of Prof’l Resp.

, 284 F.3d 172 (D.C. Cir. 2002), is also misplaced . In Jefferson, the Court held that the Office of Professional Responsibility (“OPR”) was not entitled to make

a Glomar response as to all of its files in the absence of an evidentiary showing to support that response. Id. at 179

. But12

tha t case turned on two factors not present here: (1) it applied Exemption 7(C), which protects only “records or information compiled for law enforcement purposes ,” 5 U.S.C. § 552(b)(7) ; and (2) not all records of the OPR are necessarily
law enforcement recor ds. Jefferson, 284 F.3d at 178

– 79

. Because the request asked for “all records” pertaining to a particular AUSA, and not simply those compiled for law enforcement purposes, the Court held that Glomar response was inappropriate in light of OPR’s failure to show that all of the responsive records were covered by the Exemption, i.e., were compiled for law enforcement purposes. Id. at 179. Here, by contrast, it is apparent that any response to EPIC’s FOIA request might reveal whether NSA did or did not consider a particular cybersecurity incident, or the security settings in particular commerci al technologies, to be a potential threat to U.S. Government information systems. Any such threat assessment, as well as any ensuing action or
ina ction, implicates an undisputed NSA “function”

— its

Information Assurance mission

— and thus falls within the broad ambit of Section 6 of the National Security Agency

Act.

IV

.

For the foregoing reasons, the decision of the district

court is Affirmed.