FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

WILEY GILL; JAMES PRIGOFF;

TARIQ RAZAK; KHALED IBRAHIM;

AARON CONKLIN,

Plaintiffs-Appellants,

v.

UNITED STATES DEPARTMENT OF 

JUSTICE; MATTHEW WHITAKER, 

Acting Attorney General; 

PROGRAM MANAGER -

INFORMATION SHARING 

ENVIRONMENT; THE OFFICE OF 

THE PROGRAM MANAGER OF THE 

INFORMATION SHARING 

ENVIRONMENT,

Defendants-Appellees.

No. 17-16107

D.C. No.

3:14-cv-03120-RS

OPINION

Appeal from the United States District Court

for the Northern District of California

Richard Seeborg, District Judge, Presiding

Argued and Submitted October 18, 2018

San Francisco, California

Filed January 29, 2019
2 GILL V. USDOJ

Before: MILAN D. SMITH, JR. and ANDREW D. 

HURWITZ, Circuit Judges, and RICHARD K. EATON,*

Judge.

Opinion by Judge Milan D. Smith, Jr.

SUMMARY**

Administrative Procedure Act

The panel affirmed the district court’s summary 

judgment in favor of federal defendants in an action under 

the Administrative Procedure Act (“APA”) challenging the 

Functional Standard regarding the sharing of terrorismrelated information.

In the wake of 9/11, the federal government sought to 

standardize the sharing of terrorism-related information 

through the adoption of a Functional Standard. Plaintiffs are 

United States citizens who are the subjects of a Suspicious 

Activity Report (SAR) or Information Sharing Environment 

(ISE)-SAR, none of whom have been charged with a crime.

The panel held that the Functional Standard constituted 

final agency action because it had legal and practical effects.

 * Richard K. Eaton, Judge of the United States Court of International 

Trade, sitting by designation.

** This summary constitutes no part of the opinion of the court. It 

has been prepared by court staff for the convenience of the reader.
GILL V. USDOJ 3

The panel held that the Functional Standard was exempt 

from the APA’s notice and comment requirement because 

the significant discretion retained by agencies and their 

analysts in determining whether to disseminate information 

demonstrated that the Functional Standard was not a 

legislative rule. Legislative rules have the force of law, and 

are subject to notice and comment under the APA before 

becoming effective.

Plaintiffs argued that the Functional Standard was 

arbitrary and capricious under the APA because it was 

inconsistent with the “reasonable suspicion” standard for 

disseminating criminal intelligence information in 28 C.F.R. 

Part 23. The panel held that the Department of Justice’s 

decision to exclude SARs from Part 23 was not contrary to 

the record, and was consistent with the stated objectives of 

the Nationwide Suspicious Activity Reporting Initiative. 

The panel concluded that the Functional Standard was not 

arbitrary and capricious under the APA.

COUNSEL

Linda Lye (argued) and Julia Harumi, American Civil 

Liberties Union Foundation of Northern California Inc., San 

Francisco, California; Michael James Ableson and Stephen 

Scotch-Marmo, Morgan, Lewis & Bockius LLP, New York, 

New York; Christina Sinha, Asian Americans Advancing 

Justice—Asian Law Caucus, San Francisco, California; 

Hugh Handeyside, American Civil Liberties Union 

Foundation, New York, New York; Mitra Ebadolahi, 

American Civil Liberties Union Foundation of San Diego 

and Imperial Counties, San Diego, California; Jeffrey S. 

Raskin, Morgan Lewis & Bockius LLP, San Francisco, 

California; Peter Bibring, American Civil Liberties Union 
4 GILL V. USDOJ

Foundation of Southern California, Los Angeles, California;

for Plaintiffs-Appellants.

Daniel Aguilar (argued) and H. Thomas Byron III, Appellate 

Staff; Alex G. Tse, Acting United States Attorney; Civil 

Division, United States Department of Justice, Washington, 

D.C.; for Defendants-Appellees.

OPINION

M. SMITH, Circuit Judge:

In the wake of 9/11, law enforcement agencies at the 

federal, state, and local levels found that they were unable to 

communicate effectively about potential threats to our 

national security. In response, the federal government 

sought to standardize the sharing of terrorism-related 

information through the adoption of a “Functional 

Standard.” Aaron Conklin, Wiley Gill, Khaled Ibrahim, 

James Prigoff, and Tariq Razak (collectively, Plaintiffs) 

challenged the Functional Standard under the 

Administrative Procedure Act (APA).1 The district court 

granted summary judgment in favor of the federal 

defendants.

We affirm. Although the Functional Standard 

constitutes final agency action, it was not required to 

undergo the APA notice and comment procedure, nor was it 

arbitrary and capricious.

 1 Plaintiffs raised only an APA challenge and do not contend that 

the Functional Standard is unconstitutional or has been applied to them 

in an unconstitutional manner.
GILL V. USDOJ 5

FACTUAL AND PROCEDURAL BACKGROUND

I. Factual Background

In October 2007, President George W. Bush issued a 

National Strategy for Information Sharing concerning 

terrorism-related information. The Strategy created fusion 

centers that would ensure Suspicious Activity Reports 

(SARs) were “disseminated to and evaluated by appropriate 

government authorities,” and identify requirements to 

support a “unified process for reporting, tracking, and 

accessing” SARs. The nationwide effort to standardize this 

information sharing was called the Nationwide Suspicious 

Activity Reporting Initiative (NSI).

To “govern[] how terrorism information is acquired, 

accessed, shared, and used,” the Program Manager for the 

Information Sharing Environment (ISE) has issued three 

Functional Standards since the inception of the NSI, each 

superseding the previous one: Functional Standard 1.0 

(issued January 2008), Functional Standard 1.5 (issued May 

2009), and Functional Standard 1.5.5 (issued February 

2015).2 The current Functional Standard 1.5.5 focuses 

“exclusively on terrorism-related information.”

 2 The Program Manager sought input from various civil liberties 

groups throughout the process of refining the Functional Standards. 

After promulgating Standard 1.0, the Program Manager hosted a 

conference with advocates from the American Civil Liberties Union 

(ACLU) and other privacy and civil liberties groups. The ACLU noted 

its concerns with the overbroad behavioral categories and the Standard’s 

definition of a suspicious activity, suggesting a “reasonably indicative” 

standard. The ACLU also recommended that certain information should 

not be reported absent reasonable suspicion of criminality.
6 GILL V. USDOJ

The Functional Standard defines suspicious activity as 

“[o]bserved behavior reasonably indicative of preoperational planning associated with terrorism or other 

criminal activity.” After receiving a report of suspicious 

activity, an officer creates a SAR. The SAR then undergoes 

a two-part evaluation process. An analyst determines 

whether the SAR meets certain behavioral criteria and has a 

potential nexus to terrorism.

3 If the analyst concludes that it 

does, the SAR becomes an ISE-SAR, and is uploaded to the 

eGuardian repository, where it is available to all NSI 

participants. The ISE-SAR is also input into the Federal 

Bureau of Investigation (FBI) classified system and sent to 

the Department of Homeland Security Office of Intelligence 

Analysis.

Plaintiffs are United States citizens who are the subjects 

of a SAR or ISE-SAR, none of whom has been charged with 

a crime. The ISE-SAR on Gill notes his potential access to 

a “flight simulator type of game,” his conversion to Islam, 

and his “pious demeanor.” The FBI visited Gill’s sister and 

questioned her about Gill’s religious beliefs. Another SAR 

describes Razak as a male of believed Middle Eastern 

descent who “meticulously stud[ied] the entry/exit points” 

 

After the ISE issued Functional Standard 1.5, the Program Manager 

re-engaged with the ACLU to obtain their feedback on a draft privacy 

and civil liberties report. The ACLU again recommended that 

information meet the reasonably indicative standard before 

dissemination. In May 2013, the ISE held another conference with civil 

liberties groups, including the ACLU, to discuss Functional Standard 

1.5.5.

3 The behavioral categories include both defined criminal activity, 

such as “Breach/Attempted Intrusion,” “Misrepresentation,” and 

“Cyberattack,” along with other activity, such as “Photography,” 

“Acquisition of Expertise,” and “Weapons Collection/Discovery.”
GILL V. USDOJ 7

of a train station. After the SAR was uploaded to eGuardian, 

the FBI questioned Razak. The SAR concerning Ibrahim 

notes his attempt to purchase “a large amount of computers.” 

Two reports concerning Ibrahim were uploaded to 

eGuardian.

Private guards prevented Prigoff, a professional 

photographer, from taking photographs of a work of public 

art near Boston, an incident resulting in the creation of 

multiple SARs. The FBI then visited Prigoff’s home and 

questioned a neighbor about him. In northern California, 

private security stopped Conklin, an amateur photographer, 

from photographing oil refineries, and during the subsequent 

questioning, the sheriff’s deputies told him he would be 

placed on an “NSA watch list.”

II. Procedural Background

In 2014, Plaintiffs sued the Attorney General, the 

Department of Justice, and the ISE Program Manager 

(collectively, the Department). The complaint asserted two 

APA challenges to the Functional Standard, contending that: 

(1) the promulgation of the Functional Standard without 

notice and comment was unlawful; and (2) the Standard was 

arbitrary and capricious because it did not comply with the 

“reasonable suspicion” standard in 28 C.F.R. Part 23 for the 

dissemination of criminal intelligence information.4

The Department moved to dismiss, arguing that 

Plaintiffs lacked standing, and that the Functional Standard 

 4 At the onset of this lawsuit, only Functional Standard 1.5 was at 

issue. Version 1.5.5 was not promulgated until February 2015. At the 

summary judgment stage, Plaintiffs challenged both versions.
8 GILL V. USDOJ

did not constitute final agency action pursuant to the APA. 

The district court denied the Department’s motion.

The parties later cross-moved for summary judgment. 

The district court granted summary judgment for the 

Department, finding that: (1) the Functional Standard is a 

policy guidance statement exempt from the notice and 

comment requirement; and (2) the Functional Standard is not 

arbitrary and capricious because it addresses data issues 

outside the scope of 28 C.F.R. Part 23. Plaintiffs timely 

appealed.

JURISDICTION AND STANDARD OF REVIEW

We have jurisdiction pursuant to 28 U.S.C. § 1291. We 

review de novo a district court’s grant of summary judgment, 

and we may affirm on any ground supported by the record. 

White v. City of Sparks, 500 F.3d 953, 955 (9th Cir. 2007).

ANALYSIS

I. Final Agency Action

The APA allows judicial review only of final agency 

actions. 5 U.S.C. § 704; see Ukiah Valley Med. Ctr. v. FTC, 

911 F.2d 261, 266 (9th Cir. 1990). Although it denied the 

Department’s motion to dismiss for lack of finality, the 

district court observed in its summary judgment order that 

there was “good reason to treat the Functional Standard as 

not constituting a final agency action.” We review de novo 

whether agency action is final. Havasupai Tribe v. 

Provencio, 906 F.3d 1155, 1161–62 (9th Cir. 2018).

For agency action to be final, it must “mark the 

consummation of the agency’s decisionmaking process” and 

“must be one by which rights or obligations have been 
GILL V. USDOJ 9

determined, or from which legal consequences will flow.” 

Bennett v. Spear, 520 U.S. 154, 177–78 (1997) (internal 

quotation marks omitted). “We focus on the practical and 

legal effects of the agency action” and interpret finality in a 

“pragmatic and flexible manner.” Or. Nat. Desert Ass’n v. 

U.S. Forest Serv., 465 F.3d 977, 982 (9th Cir. 2006); see also 

Indus. Customers of Nw. Utils. v. Bonneville Power Admin., 

408 F.3d 638, 646 (9th Cir. 2005) (considering any “direct 

and immediate effect on the day-to-day operations of the 

party seeking review,” and if “immediate compliance with 

the [action’s] terms is expected”). Regardless of an agency’s 

characterization, we consider the actual effects of the action 

to determine whether it is final. Columbia Riverkeeper v. 

U.S. Coast Guard, 761 F.3d 1084, 1094–95 (9th Cir. 2014).

The Department does not dispute that the first finality 

requirement—consummation of the decisionmaking 

process—is met. Instead, it concentrates on the second 

Bennett prong, contending the Functional Standard “merely 

provides procedural guidelines for [agencies’] voluntary 

participation” and does not impose binding obligations. 

Plaintiffs counter that the Functional Standard has legal 

force because the Department can revoke an agency’s 

eGuardian membership for violating the terms of the 

eGuardian User Agreement, which requires compliance with 

the Standard. Plaintiffs also assert that compliance with the 

Functional Standard is a practical requirement of the NSI, 

and that this “condition on participation” renders the 

Functional Standard final. We agree; the Functional 

Standard constitutes final agency action because it has legal 

and practical effects.

The Functional Standard imposes “direct and 

appreciable legal consequences.” Bennett, 520 U.S. at 178. 

In Oregon Natural Desert, we held the Forest Service’s 
10 GILL V. USDOJ

issuance of annual operating instructions (AOIs) to 

permittees grazing livestock on national forest land 

constituted final agency action under the APA. 465 F.3d at 

979. The AOIs outlined restrictions on the permit holder’s 

right to graze. Id. at 980, 986. If a permittee did not comply 

with the directives in the AOI, the Forest Service could issue 

a notice of non-compliance and impose administrative 

sanctions, such as suspension or cancellation of the permit, 

against the permit holder. Id. at 987–88. We held that the 

AOIs had legal consequences because the Forest Service 

could take enforcement actions against a non-complying 

permittee, imposing “substantial and intricate legal 

obligations.” Id. at 988, 990.

The Functional Standard is not materially 

distinguishable. To be sure, participation in the NSI remains 

within the agencies’ discretion. And, absent that 

participation, the Functional Standard does not obligate 

analysts or agencies to send SAR information or penalize 

them for sending non-compliant SARs. But, as the 

Department conceded below, once an agency decides to 

participate, the eGuardian User Agreement permits the 

Department to revoke agency membership for violating 

various policies, including the Functional Standard. Like the 

suspension of permits in Oregon Natural Desert, 465 F.3d 

at 988, eGuardian membership revocation is a legal 

consequence.

The Functional Standard is also final agency action 

because of its practical effects. In Havasupai, we held a 

Forest Service Mineral Report was a “practical requirement 

to the continued operation” of a mine—and therefore final 

agency action—because the parties “understood that mine 

operations would not resume until” the Mineral Report’s 

determination of valid existing rights “was completed.” 
GILL V. USDOJ 11

906 F.3d at 1163. An agency action can be final even if its 

legal or practical effects are contingent on a future event. 

See Bennett, 520 U.S. at 170 (noting an agency could 

“technically” disregard the issued opinion, but to do so 

would subject it or its employees to “substantial civil and 

criminal penalties, including imprisonment”); City of 

Fremont v. F.E.R.C., 336 F.3d 910, 914 (9th Cir. 2003) 

(concluding agency orders that attach legal consequences to 

future proceedings satisfy the finality analysis).

Similarly, because the eGuardian User Agreement 

permits the Department to revoke participating agencies’ 

access for failure to comply with the Functional Standard, 

once an agency joined the NSI there was the immediate 

understanding that its analysts would conform to the 

Functional Standard when submitting SARs. Thus, we hold 

the Functional Standard constitutes final agency action.

II. Notice and Comment Procedure

The APA requires a notice and comment procedure for 

agency “rule making.”5 5 U.S.C. § 553. However, 

“interpretive rules, general statements of policy, or rules of 

agency organization, procedure, or practice” are exempt 

from the notice and comment requirement. 5 U.S.C. 

§ 553(b)(3)(A). The district court found the Functional 

Standard was “fundamentally a policy guidance statement” 

and therefore not subject to the notice and comment 

requirement. We review de novo the district court’s 

determination of the scope of the APA’s notice and comment 

 5 The APA defines “rule making” as “agency process for 

formulating, amending, or repealing a rule.” 5 U.S.C. § 551(5).
12 GILL V. USDOJ

requirement. Mada-Luna v. Fitzpatrick, 813 F.2d 1006, 

1011 (9th Cir. 1987).

Legislative rules have the “force of law,” and are subject 

to notice and comment under the APA before becoming 

effective Hemp Indus. Ass’n v. Drug Enf’t Admin., 333 F.3d 

1082, 1087–88 (9th Cir. 2003). Policy guidance statements, 

on the other hand, “do not have the force and effect of law 

and are not accorded that weight in the adjudicatory 

process,” see Shalala v. Guernsey Mem’l Hosp., 514 U.S. 

87, 99 (1995), and need not undergo notice and comment. 

“The critical factor to determine whether a directive 

announcing a new policy constitutes a legislative rule or a 

general statement of policy ‘is the extent to which the 

challenged [directive] leaves the agency, or its implementing 

official, free to exercise discretion to follow, or not to follow, 

the [announced] policy in an individual case.’” Colwell v. 

Dep’t of Health & Human Servs., 558 F.3d 1112, 1124 (9th 

Cir. 2009) (second and third alterations in original) (quoting 

Mada-Luna, 813 F.2d at 1013). That a policy “provid[es] 

direction—where once there was none”—does not 

automatically transform it into a legislative rule. Prof’ls & 

Patients for Customized Care v. Shalala, 56 F.3d 592, 600–

01 (5th Cir. 1995).

Plaintiffs contend the Functional Standard is a legislative 

rule because it creates a “binding norm” by establishing 

sixteen exclusive categories the agencies must use in 

defining suspicious activity. The Department responds that 

the Functional Standard is not a legislative rule because it 

provides only standardized guidance that does not have any 

legal effect. Although we “need not accept the agency 

characterization at face value,” Hemp Indus., 333 F.3d at 

1087, we agree with the Department that the Functional 
GILL V. USDOJ 13

Standard is not a legislative rule because it allows analysts 

to exercise discretion.

SARs undergo a two-part evaluation before being 

included in eGuardian. First, an FBI or fusion center analyst 

“reviews” the SAR information against the sixteen preoperational behaviors identified in the Functional Standard, 

“keeping in mind . . . the importance of context, facts, and 

circumstances.” If the SAR information reflects one or more 

of the pre-operational behaviors, then, based on the “context, 

facts, and circumstances,” the analyst uses “professional 

judgment” to determine whether the information has a 

potential nexus to terrorism. Only if—in the analyst’s 

judgment—a potential nexus to terrorism exists is the SAR 

disseminated as an ISE-SAR.

While the Functional Standard employs a combination 

of mandatory and discretionary language, it does not compel 

analysts or agencies to disseminate SAR information, nor 

does it require analysts to create an ISE-SAR when the 

information reflects a certain number of behavioral 

categories. Rather, if the SAR contains at least one of the 

categorized activities, the analyst must still ascertain 

whether it has a potential nexus to terrorism. No single 

category of behavior or aggregation of categories is 

determinative.

The Functional Standard is thus similar to the Food & 

Drug Administration’s policy guide at issue in Professionals 

and Patients for Customized Care. The FDA promulgated a 

policy utilizing nine factors to help the agency determine 

whether to initiate an enforcement action against a pharmacy 

engaged in drug manufacturing. 56 F.3d at 593. In holding 

that the policy did not constitute a legislative rule, the Fifth 

Circuit noted that although the nine factors “assist[ed] the 

FDA in identifying pharmacies engaged in the manufacture 
14 GILL V. USDOJ

of drugs,” the “ultimate decision whether to bring an 

enforcement action” remained with the agency. Id. at 601. 

Likewise, the Functional Standard aids agencies in 

determining whether an individual is engaged in suspicious 

activity, but the final decision to disseminate an SAR rests 

in the analyst’s discretion.

This significant discretion retained by agencies and their 

analysts in determining whether to disseminate information 

compels our decision that the Functional Standard is not a 

legislative rule. Therefore, the Functional Standard was 

exempt from the notice and comment requirement.

III. Arbitrary and Capricious

Agency action violates the APA if it is arbitrary or 

capricious. 5 U.S.C. § 706(2)(A). Plaintiffs argue that the 

Functional Standard is arbitrary and capricious because it is 

inconsistent with the “reasonable suspicion” standard for 

disseminating criminal intelligence information in 28 C.F.R. 

Part 23 (Part 23). On summary judgment, the district court 

rejected that argument. We review the district court’s 

decision de novo. Nat’l Ass’n of Home Builders v. Norton, 

340 F.3d 835, 840–41 (9th Cir. 2003).

Pursuant to Part 23, criminal intelligence systems can 

retain criminal intelligence information “only if there is 

reasonable suspicion that the individual is involved in 

criminal conduct or activity.” 28 C.F.R. § 23.20(a) 

(emphasis added). Part 23 defines criminal intelligence 

information, in pertinent part, as “data which has been 

evaluated to determine that it: (i) is relevant to the 

identification of and the criminal activity engaged in by an 

individual who or organization which is reasonably 

suspected of involvement in criminal activity.” Id.

§ 23.3(b)(3). The Functional Standard, in contrast, defines 
GILL V. USDOJ 15

suspicious activity as “[o]bserved behavior reasonably 

indicative of pre-operational planning associated with 

terrorism or other criminal activity.” (emphasis added). 

Consequently, some SARs—including those related to 

Plaintiffs—do not reach the reasonable suspicion standard 

that Part 23 requires for criminal intelligence.

Plaintiffs’ arbitrary and capricious challenge is twofold. 

They contend that: (1) the Department initially failed to 

consider the applicability of Part 23; and (2) the rationale 

eventually offered for why Part 23 does not apply contradicts 

the record.

Several principles guide our analysis. An agency must 

“examine the relevant data and articulate a satisfactory 

explanation for its action including a ‘rational connection 

between the facts found and the choice made.’” Motor 

Vehicle Mfrs. Ass’n of U.S., Inc. v. State Farm Mut. Auto. 

Ins. Co., 463 U.S. 29, 43 (1983) (quoting Burlington Truck 

Lines, Inc. v. United States, 371 U.S. 156, 168 (1962)). A 

rule is arbitrary and capricious if the agency has “entirely 

failed to consider an important aspect of the problem, [or] 

offered an explanation for its decision that runs counter to 

the evidence before the agency.” Id. Our review of an

agency decision “is based on the administrative record and 

the basis for the agency’s decision must come from the 

record.” Norton, 340 F.3d at 841. That review is “narrow;” 

we may not “substitute [our] judgment for that of the 

agency.” FCC v. Fox Television Stations, Inc., 556 U.S. 502, 

513 (2009). And, we will “uphold a decision of less than 

ideal clarity if the agency’s path may reasonably be 

discerned.” Motor Vehicle, 463 U.S. at 43.

First, Plaintiffs challenge the ISE’s July 2010 

explanation concerning Functional Standard 1.5’s use of the 

“reasonably indicative” standard as a post-hoc 
16 GILL V. USDOJ

rationalization. But, Functional Standard 1.5.5, promulgated 

in February 2015, superseded version 1.5. The Executive 

Summary for version 1.5.5 provided a detailed explanation 

for why SAR information need not comply with Part 23 and 

the reasonable suspicion standard. Thus, Plaintiffs’ 

argument concerning the Department’s 2010 explanation for 

Functional Standard 1.5 is moot.

Second, Plaintiffs argue that the ISE’s 2015 explanation 

is inconsistent with Functional Standard 1.5.5. The 2015 

explanation states that SAR information “represents 

information about suspicious behavior” and “has a potential 

criminal nexus.” In contrast, it asserts that criminal 

intelligence “focuses on the investigative stage once a tip or 

lead has been received and on identifying the specific 

criminal subject(s), the criminal activity in which they are 

engaged, and the evaluation of facts to determine that the 

reasonable suspicion standard has been met.” Succinctly, 

according to the 2015 explanation, criminal intelligence is “a 

product of investigation.”

The Department asserts that its interpretation of Part 23 

is entitled to Auer deference, which requires an agency’s 

interpretation of its own ambiguous regulation to control 

unless “plainly erroneous or inconsistent with the 

regulation.” Turtle Island Restoration Network v. U.S. Dep’t 

of Commerce, 878 F.3d 725, 733 (9th Cir. 2017) (quoting 

Auer v. Robbins, 519 U.S. 452, 461 (1997)). “But Auer 

deference is warranted only when the language of the 

regulation is ambiguous.” Christensen v. Harris Cty., 

529 U.S. 576, 588 (2000). If the language of a “regulation 

is unambiguous, we apply the terms as written.” 

Christopher v. SmithKline Beecham Corp., 635 F.3d 383, 

392 (9th Cir. 2011). The Department identifies no ambiguity 

in Part 23, and we find none. Thus, we independently 
GILL V. USDOJ 17

determine whether the ISE’s decision to exclude the 

Functional Standard from Part 23’s scope is consistent with 

the regulation.

Plaintiffs focus on the one sentence in the Department’s 

explanation of Functional Standard 1.5.5, which states that 

Part 23 “[c]riminal intelligence information is a product of 

investigation.” They argue that SARs are also criminal 

intelligence subject to the reasonable suspicion standard of 

Part 23 because an official conducts “initial investigation or 

fact gathering” before creating a SAR. That narrow focus 

distorts the ISE’s explanation.

As originally conceived in October 2007, SARs involved 

“tips and leads” information, that is, an “uncorroborated 

report or information that alleges or indicates some form of 

possible criminal activity.” Tips and leads required only 

“mere suspicion,” a lower standard than the reasonable 

suspicion required for criminal intelligence data. In 

response to concerns regarding Functional Standard 1.0, 

version 1.5 implemented a somewhat stricter standard—

“reasonably indicative”—albeit one still less demanding 

than the reasonable suspicion standard. Given the lower 

reasonably indicative standard utilized by the Functional 

Standard, some SARs do not rise to the level of criminal 

intelligence. This lower threshold underscores the purpose 

of ISE-SARs disseminated in accordance with Functional 

Standard 1.5.5: to determine whether to engage in “followup information gathering” about potential terrorist activity, 

not necessarily to determine whether a crime has occurred.

The distinction between criminal intelligence and SAR 

information is admittedly not always precise. The ISE 

Program Manager early on recognized the potential for 

SARs to contain criminal intelligence subject to Part 23. 

Thus, the ISE’s Initial Privacy and Civil Liberties Analysis 
18 GILL V. USDOJ

of September 2008 stated, “agencies should clearly articulate 

when 28 C.F.R. Part 23 should be applied . . . . ISE-SAR 

information . . . may be subject to the requirements of 28 

C.F.R. Part 23.” Further, an investigating officer “gathers 

additional facts through personal observations, interviews, 

and other investigative activities before creating a SAR, 

suggesting that the “product of investigation” phrase is not 

dispositive of whether SAR information comes within the 

ambit of Part 23.

“We will . . . uphold a decision of less than ideal clarity 

if the agency’s path may reasonably be discerned.” Motor 

Vehicle, 463 U.S. at 43. From the outset, the ISE has 

consistently pronounced that an ISE-SAR need not meet the 

reasonable suspicion standard in order to expand the base of 

information gathered. The 2015 explanation, published with 

Functional Standard 1.5.5, also makes clear that the 

government intentionally seeks more than reports showing a 

reasonable suspicion that terrorism-related crimes have 

occurred. Considering the entirety of the 2015 rationale and 

the historical explanations before us, we find the 

Department’s decision to exclude SARs from Part 23 is not 

contrary to the record, and is consistent with the stated 

objectives of the NSI. Accordingly, we hold that the 

Functional Standard was not arbitrary and capricious.

CONCLUSION

The Functional Standard endeavors to standardize 

terrorism-related information sharing nationwide. Although 

the Functional Standard constituted final agency action, it 

was not a legislative rule because it requires significant 

analyst discretion. It therefore was exempt from the notice 

and comment requirement. And, the Standard was not 

arbitrary and capricious because the ISE’s 2015 explanation 

distinguishing Part 23 information and SARs is consistent 
GILL V. USDOJ 19

with the ISE’s objectives. We affirm the judgment of the 

district court.

AFFIRMED.