FOIA Cases

EPIC v. NSA: Google / NSA Relationship

US Court of Appeals for the District of Columbia Circuit

DOWNLOAD EPIC-v-NSA-Complaint pdf 214.7KB

Outcome

The U.S. Court of Appeals for the D.C. Circuit ruled on May 11, 2012, affirming the lower court judgment and upholding the National Security Agency’s “Glomar” response to EPIC’s Freedom of Information Act Request for communications sent to the NSA by Google related to a 2010 cyber attack. In response to EPIC’s request, the NSA stated that it could “neither confirm nor deny the existence of records” responsive records (a “Glomar” response). The court held that the NSA was not required to confirm the existence of the records because Section 6 of the National Security Agency Act exempts from disclosure “the organization or any function of the National Security Agency” and because “acknowledging the mere existence of responsive records would disclose exempt information.”

Background

On March 17, 2009, EPIC filed a complaint with the Federal Trade Commission (FTC), urging an investigation into Google’s cloud computing services to determine “the adequacy of the privacy and security safeguards.” The complaint followed a reported security breach of Google Docs. EPIC observed that Google repeatedly assured consumers that their services stored user-generated data securely, but had opted to not encrypt the personal information stored or transmitted on its computer network by default.

On June 16, 2009, Christopher Soghoian wrote an open letter to Google CEO, Eric Schmidt that was joined by 37 researchers and academics in the fields of computer science, information security, and privacy law. The letter pointed out that Google had already employed encryption techniques to protect individuals’ login information, but did not enable it to protect information transmitted over their network. The letter pointed out that, while the option to encrypt this information was available, it was difficult to locate, even for sophisticated users who were aware of what to look for.

Google opted to ignore both of these warnings.

On January 12, 2010, Google reported that the company had suffered a “highly sophisticated and coordinated” cyber attack originating from China. The attackers planted malicious code in Google’s corporate networks, and resulted in the theft of Google’s intellectual property, and at least the attempted access of the Gmail accounts of Chinese human rights activists. The following day, Google changed a key setting, causing all subsequent traffic to and from its electronic mail servers to be encrypted by default. On February 4, 2010, the Washington Post reported that Google had contacted the National Security Agency (“NSA”) regarding the firm’s security practices immediately following the attack. In addition, the Wall Street Journal stated that the NSA’s general counsel had drafted a “cooperative research and development agreement” within 24 hours of Google’s announcement of the attack, which authorized the Agency to “examine some of the data related to the intrusion into Google’s systems.”

EPIC’s Freedom of Information Act Requests and Subsequent Lawsuit

On February 4, 2010, EPIC filed a Freedom of Information Act (“FOIA”) request with the National Security Agency (“NSA”). EPIC requested the following agency records:

  • All records concerning an agreement or similar basis for collaboration, final or draft, between the NSA and Google regarding cyber security;
  • All records of communication between NSA and Google concerning Gmail, including but not limited to Google’s decision to fail to routinely encrypt Gmail messages prior to January 13, 2010; and
  • All records of communications regarding NSA’s role in Google’s decision regarding the failure to routinely deploy encryption for cloud-based computing service, such as Google Docs.

By letter dated March 10, the NSA acknowledged receipt of EPIC’s FOIA Request and granted EPIC’s request for a fee waiver. The NSA’s letter invoked FOIA exemption b(3) and Section 6 of the National Security Agency Act in order to issue a Glomar response. A Glomar response is the Agency’s act of neither confirming nor denying the existence of Agency records responsive to the Request.

On May 7, 2010, EPIC filed an administrative appeal stating that the NSA had failed to present factual evidence that the requested documents fell within Section 6 and that established FOIA exemptions could sufficiently conceal protected information. The NSA never replied to EPIC’s appeal or produced responsive documents. EPIC filed a complaint in United States District Court for the District of Columbia on September 13, 2010. The NSA argued that the Agency was under no obligation to conduct a search prior to determining that any potentially responsive records would implicate the Agency’s functions or activities. Judge Richard Leon deferred to the NSA’s judgment in a Memorandum Opinion dated July 8, 2011. EPIC filed a Notice of Appeal in the D.C. Circuit Court on September 9, 2011. The court heard oral argument on March 20, 2012, and decided the case on May 11, 2012. EPIC v. NSA, 678 F.3d 926 (D.C. Cir. 2012).

The Glomar Doctrine

In a unique category of FOIA cases, an agency may issue a “Glomar response” and refuse to confirm or deny the existence of records. Gardels v. CIA, 689 F.2d 1100, 1103 (D.C. Cir. 1982); see also Miller v. Casey, 730 F.2d 773, 776-77 (D.C. Cir. 1984); Phillippi v. CIA, 546 F.2d 1009, 1012 (D.C. Cir. 1976). Courts uphold Glomar responses when “to answer the FOIA inquiry would cause harm cognizable under” an applicable statutory exemption. Gardels, 689 F.2d at 1103. Glomar responses must be tethered to a specific exemption. The agency must demonstrate that acknowledging the mere existence of responsive records would disclose exempt information. Wolf v. CIA, 473 F.3d 370, 374 (D.C. Cir. 2007).

In Glomar cases, courts may grant summary judgment on the basis of agency affidavits that contain “reasonable specificity of detail rather than merely conclusory statements, and if they are not called into question by contradictory evidence in the record or by evidence of agency bad faith.” Gardels, 689 F.2d at 1104-05 (citing Halperin v, CIA, 629 F.2d 144, 148 (D.C. Cir. 1980)). The supporting affidavit must give a “logical” justification for the Glomar response based on “general exemption review standards established in non-Glomar cases.” Wolf, 473 F.3d at 375. “Very importantly, ‘the burden is on the agency to sustain its action.’” Founding Church of Scientology of Washington, D.C., Inc. v. NSA, 610 F.2d 824, 830 (D.C. Cir. 1979). This Circuit has made clear that “‘[c]onclusory and generalized allegations of exemptions’ are unacceptable; if the court is unable to sustain nondivulgence on the basis of affidavits, in camera inspection may well be in order.” Wolf, 473 F.3d at 375.

Legal Documents

EPIC v. National Security Agency, Case No. 10-1533 (RJL) (D.D.C. filed Sept. 13, 2010)

EPIC v. National Security Agency, Case No. 11-5233 (D.C.Cir. filed Sept. 9, 2011)

Freedom of Information Act Documents

Support Our Work

EPIC's work is funded by the support of individuals like you, who allow us to continue to protect privacy, open government, and democratic values in the information age.

Donate