Cause of Action Institute v. Export-Import Bank of the United States ( 2022 )

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
CAUSE OF ACTION INSTITUTE,
Plaintiff,
v. Civil Action No. 19-1915 (JEB)
EXPORT-IMPORT BANK OF THE
UNITED STATES,
Defendant.
MEMORANDUM OPINION
In round two of this Freedom of Information Act bout, the parties return to the Court to
dispute the updated document redactions and withholding rationales put forth by Defendant
Export-Import Bank of the United States in response to two FOIA requests by Plaintiff Cause of
Action Institute. Last spring, this Court delivered a mixed bag of results on cross-motions for
summary judgment. Complete resolution was not to be had, as the Court determined that EXIM
had not provided sufficient justification for several of its withholdings and thus gave the Bank
another shot.
On this second go-round, the Court is able to resolve all of COA’s challenges to 41
documents that EXIM has continued to withhold after reprocessing its original production in
light of the Court’s prior Opinion. The Court once again delivers a split verdict: it will affirm the
Bank’s withholding of some records and order the release of others.
1
I. Background
Having previously summarized the relatively straightforward background of this case in
its prior Opinion, see Cause of Action v. Export-Import Bank of the United States, 521 F. Supp.
3d 64 (D.D.C. 2021), the Court recounts it only briefly here.
COA, a non-partisan government-oversight organization, filed two FOIA requests
seeking records from EXIM Bank, an independent agency that finances exports of various goods
and services. The first, filed on September 20, 2018, sought “records reflecting communications
involving four senior EXIM officials regarding a series of individuals and business entities.” Id.(citing ECF No. 1-1 (FOIA Request # 201800076F)). COA filed a second request on May 24,
2019, seeking “additional records from agency officials pursuant to a handful of new search
terms.” Id. at 74 (citing ECF No. 1-3 (FOIA Request # 201900047F)). This request generally
sought “communications among EXIM employees during congressional hearings for Kimberly
Reed’s nomination to be the Bank’s President, as well as information relating to certain
Government Accountability Office oversight activities.” Id. (citing ECF No. 1 (Complaint)).
After EXIM did not immediately respond to the requests, Plaintiff filed suit on June 26,
2019. Id. The Bank eventually produced “783 responsive records totaling 7,633 pages between
August 2019 and February 2020.” Id. (citing ECF No. 27-3 (Declaration of Lennell Jackson),
¶ 47; ECF No. 22 (3/3/20 Joint Status Rep.) at 1–2). Many of these records were fully or
partially redacted, and Plaintiff indicated its intent to challenge certain of those withholdings. Id.(citing ECF No. 28-4 (Declaration of Ryan P. Mulvey), ¶ 6; id. at ECF pp. 30–474 (disputed
redacted records)). Both parties then moved for summary judgment, and, after reviewing the
documents in camera, this Court issued an Opinion granting in part and denying in part those
motions. Id. at 75–76, 96–97. The details of that 42-page Opinion need not be belabored here;
2
suffice it to say that this Court required EXIM to “go back and further show its work” if it
wished to maintain some of its redactions. Id. at 74.
EXIM did just that. The Bank proceeded to reprocess the withheld records and disclose
some of the previously redacted documents in part or in full. See ECF No. 40-2 (2d Declaration
of Lennell Jackson), ¶ 8. It produced these documents on April 6 and 7, 2021, maintaining
redactions primarily under FOIA Exemptions 4 and 5. Id., ¶¶ 8, 12. Plaintiff informed the Bank
of its intent to challenge 41 of these withheld records on April 23, 2021. Id., ¶ 10. The parties
agreed to consolidate the challenged documents in one production and prepared an updated
Vaughn Index reflecting that. Id., ¶ 11; see also ECF No. 40-5 (Updated Vaughn Index); ECF
No. 41-6 (2d Declaration of Ryan Mulvey, Exh. B – Redacted Records, Vol. 1); No. 41-7 (2d
Declaration of Ryan Mulvey, Exh. B – Redacted Records, Vol. 2). The Court refers to that
production and the updated Vaughn Index throughout this Opinion.
EXIM once again moved for summary judgment on June 25, 2021. See ECF No. 40
(Def. MSJ). In response to Plaintiff’s Opposition and Cross-Motion for Summary Judgment, see
ECF No. 41-1 (Pl. Opp./Cross-MSJ), this Court ordered EXIM to submit unredacted copies of
the challenged documents for in camera review, which the Bank did on December 14. See
Minute Order of December 10, 2021; ECF No. 47 (Note of Delivery). Having now reviewed
those documents and the parties’ briefing, the Court is prepared to rule.
II. Legal Standard
Summary judgment must be granted if “the movant shows that there is no genuine
dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed.
R. Civ. P. 56(a); see also Anderson v. Liberty Lobby, 477 U.S. 242, 247–48 (1986); Holcomb v.
Powell, 433 F.3d 889, 895 (D.C. Cir. 2006). A fact is “material” if it is capable of affecting the
3
substantive outcome of the litigation. See Liberty Lobby, 477 U.S. at 248; Holcomb, 433 F.3d at
895. A dispute is “genuine” if the “evidence is such that a reasonable jury could return a verdict
for the nonmoving party.” Liberty Lobby, 477 U.S. at 248; see also Scott v. Harris, 550 U.S.
372, 380 (2007); Holcomb, 433 F.3d at 895. “A party asserting that a fact cannot be or is
genuinely disputed must support the assertion” by “citing to particular parts of materials in the
record” or “showing that the materials cited do not establish the absence or presence of a genuine
dispute, or that an adverse party cannot produce admissible evidence to support the fact.” Fed.
R. Civ. P. 56(c)(1).
FOIA cases typically and appropriately are decided on motions for summary judgment.
See Brayton v. Office of the U.S. Trade Representative, 641 F.3d 521, 527 (D.C. Cir. 2011). In a
FOIA case, a court may grant summary judgment based solely on information provided in an
agency’s affidavits or declarations when they “describe the justifications for nondisclosure with
reasonably specific detail, demonstrate that the information withheld logically falls within the
claimed exemption, and are not controverted by either contrary evidence in the record nor by
evidence of agency bad faith.” Larson v. Department of State, 565 F.3d 857, 862 (D.C. Cir.
2009) (citation omitted). Such affidavits or declarations “are accorded a presumption of good
faith.” SafeCard Services, Inc. v. SEC, 926 F.2d 1197, 1200 (D.C. Cir. 1991). “Unlike the
review of other agency action that must be upheld if supported by substantial evidence and not
arbitrary or capricious,” FOIA “expressly places the burden ‘on the agency to sustain its action’
and directs the district courts to ‘determine the matter de novo.’” U.S. Department of Justice v.
Reporters Committee for Freedom of Press, 489 U.S. 749, 755 (1989) (quoting 5 U.S.C.
§ 552(a)(4)(B)).
4
III. Analysis
Congress enacted FOIA “to pierce the veil of administrative secrecy and to open agency
action to the light of public scrutiny.” Department of Air Force v. Rose, 425 U.S. 352, 361
(1976) (citation omitted). “The basic purpose of FOIA is to ensure an informed citizenry, vital to
the functioning of a democratic society, needed to check against corruption and to hold the
governors accountable to the governed.” John Doe Agency v. John Doe Corp., 493 U.S. 146,
152 (1989) (citation omitted).
To further that purpose, the statute provides that “each agency, upon any request for
records which (i) reasonably describes such records and (ii) is made in accordance with
published rules[,] . . . shall make the records promptly available to any person.” 5 U.S.C.
§ 552(a)(3)(A). The Government need not, however, turn over requested information that falls
into one of nine statutorily created exemptions from FOIA’s broad directive. See id.§ 552(b)(1)–(9). “Those exemptions,” the Supreme Court has explained, “are as much a part of
FOIA’s purposes and policies as the statute’s disclosure requirement.” Food Marketing Institute
v. Argus Leader Media, 139 S. Ct. 2356, 2366 (2019) (quoting Encino Motorcars, LLC v.
Navarro, 138 S. Ct. 1134, 1142 (2018)) (cleaned up). Where an agency withholds records, it
bears the burden of showing that at least one of the exemptions applies. See Vaughn v. Rosen,
523 F.2d 1136, 1144 (D.C. Cir. 1975). In order to carry that burden, the Government must
provide a “relatively detailed justification” for its withholding, “specifically identifying the
reasons why a particular exemption is relevant.” Morley v. CIA, 508 F.3d 1108, 1122 (D.C. Cir.
2007) (quoting King v. U.S. Department of Justice, 830 F.2d 210, 219 (D.C. Cir. 1987)). Courts
can compel the release of any records that do not satisfy the requirements of at least one
exemption. See Reporters Committee, 489 U.S. at 755.
5
Here, EXIM seeks to maintain redactions of 41 separate documents, most of which it
justifies with citations to FOIA Exemptions 4 and 5. See Vaughn Index. Before delving into
those exemptions, the Court considers three records that the Bank asserts fall outside of FOIA’s
scope entirely. It then moves on to Exemption 5, which is cited — sometimes alongside
Exemption 4 — to withhold the greatest number of records. The Court next takes up the
Exemption 4 withholdings, examining only redactions for which either Exemption 4 was the sole
exemption cited or that the Court determines are not supported by Exemption 5. See Center for
National Security Studies v. U.S. Department of Justice, 331 F.3d 918, 925 (D.C. Cir. 2003)
(explaining that court “need not address [any] other exemptions invoked” for particular
withholding justified by a single exemption). Finally, the Court briefly addresses Plaintiff’s
general challenge to Defendant’s decisions about segregability of withheld information.
A. Records Outside of FOIA’s Scope
FOIA empowers federal courts “to order the production of any agency records
improperly withheld from the complainant.” 5 U.S.C. § 552(a)(4)(B) (emphasis added). While
the statute is clear that this power extends only to the release of “agency records,” it never
defines that term. Forsham v. Harris, 445 U.S. 169, 178 (1980). Courts have established,
nonetheless, that “agency” does not include “the President, his ‘immediate personal staff, or units
in the Executive Office whose sole function is to advise and assist the President.’” Judicial
Watch, Inc. v. U.S. Secret Service, 726 F.3d 208, 216 (D.C. Cir. 2013) (quoting Kissinger v.
Reporters Committee for Freedom of the Press, 445 U.S. 136, 156 (1980)) (cleaned up). In
addition, not all records in the possession of an agency subject to FOIA are “agency records” for
purposes of the Act; for instance, some may still qualify as executive records. Judicial Watch,
726 F.3d at 216.
6
The parties here clash over whether EXIM has properly withheld portions of a two-page
email chain. See Def. MSJ at 7–8; Pl. Opp./Cross-MSJ at 4–14; ECF No. 44 (Def. Repl./Opp.)
at 1–4. The chain consists of several brief messages between an EXIM employee and Mark
Calabria, then “chief economist for Vice President Pence,” setting up a phone call. See Vaughn
Index, line 15; 2d Jackson Decl., ¶ 33. EXIM produced the messages from its employee, but it
redacted the messages from Calabria as “EOP [Executive Office of the President] not subject to
FOIA.” See Redacted Records, Vol. 1 at 000067–000068. These withholdings are warranted,
says Defendant, because FOIA does not apply to units in the EOP whose sole function is to
advise the President, as Calabria’s is. See Def. MSJ at 7–8. EXIM made no other arguments to
justify these withholdings. Plaintiff counters that the redaction of these portions of the email
chain constitutes improper “segmentation” of a record — that is, splicing one record into several
smaller records to avoid producing some — and that, in any event, these portions fall within
FOIA’s scope. See Pl. Opp./Cross-MSJ at 4–14.
Given Plaintiff’s focus on Defendant’s supposed segmentation, the Court finds it helpful
to begin by defining the record at issue. Although COA suggests that Defendant has improperly
broken this email chain into separate emails, defining each as an individual record in order to
withhold the emails from Calabria, that misrepresents EXIM’s position. Id. at 5–8. The Bank
has not argued that the email chain should be understood as a series of separate records; rather, it
contends that it has redacted portions of a single record — the email chain — claiming that they
fall outside of FOIA’s scope. See Def. MSJ at 7–8; Def. Repl./Opp. at 4–10. Although the
Court finds it difficult to comprehend why the Bank insists on withholding the redacted portions
of this entirely innocuous email chain, it nonetheless endeavors to assess whether FOIA entitles
Plaintiff to the production of this record in full.
7
Whether the withheld emails fall outside FOIA’s scope turns on whether or not they are
“agency records.” That term “extends only to those documents that an agency both (1) ‘create[s]
or obtain[s],’ and (2) ‘control[s] . . . at the time the FOIA request [was] made.’” Judicial Watch,
726 F.3d at 216 (quoting U.S. Department of Justice v. Tax Analysts, 492 U.S. 136, 144–45
(1989)). There is no dispute that the first prong is satisfied, as EXIM has at least obtained the
emails, but the parties spar over the control prong.
Typically, courts in this Circuit look to four factors to determine “whether an agency has
sufficient ‘control’ over a document to make it an ‘agency record.’” Judicial Watch, 726 F.3d at
218 (quoting Tax Analysts v. U.S. Department of Justice, 845 F.2d 1060, 1069 (D.C. Cir. 1988)).
Those are:
(1) the intent of the document’s creator to retain or relinquish control
over the records;
(2) the ability of the agency to use and dispose of the record as it
sees fit;
(3) the extent to which agency personnel have read or relied upon
the document; and
(4) the degree to which the document was integrated into the
agency's record system or files.
Burka v. U.S. Department of Health and Human Services, 87 F.3d 508, 515 (D.C. Cir. 1996).
When the control question involves records obtained from or prepared in response to requests
from an agency not covered by FOIA, however, the D.C. Circuit has held that a modified version
of this test applies. Judicial Watch, 726 F.3d at 224. This “modified control test” “renders the
first two factors of the standard test effectively dispositive” and essentially asks in this case
whether the EOP has expressed its intent to retain control over the records. Id. at 221–24, 231.
Defendant argues, however, that this test has no application here, since Calabria’s status
as a member of a “unit of the Executive Office whose sole function is to advise and assist the
President” renders his communications exempt from FOIA under decisions of the Supreme Court
8
and the D.C. Circuit. See Def. MSJ at 7–8 (citing Kissinger, 445 U.S. at 156, and Judicial
Watch, 726 F.3d at 226); Def. Repl./Opp. at 1–4. That position, however, overstates the
holdings of those cases. In Kissinger, the Supreme Court established that FOIA does not extend
to “the President’s immediate personal staff or units in the Executive Office whose sole function
is to advise and assist the President,” 445 U.S. at 156, and the D.C. Circuit later clarified that that
group includes members of the Vice President’s office. Wilson v. Libby, 535 F.3d 697, 708
(D.C. Cir. 2008). Documents created by individuals in those offices are thus “not ‘agency
records’ when they [are] made,” and so it is “undisputed that a requester could not use FOIA to
compel the President or his advisors to disclose their own [documents].” Judicial Watch, 726
F.3d at 216 (quoting Kissinger, 445 U.S. at 156). That holding does not mean, however, that all
documents generated by members of the EOP can never be subject to FOIA; indeed, in Judicial
Watch, one of the two cases on which Defendant relies for this proposition, the D.C. Circuit did
not apply such a bright-line rule. Id. at 218–24. Instead, that court applied the modified-control
test to determine whether records created by the EOP but now in the possession of a FOIA-
covered agency were “agency records.” Id. The Court believes that the same approach is
appropriate here because, although the emails were created by EOP, they are now in the
possession of the Bank, which is a FOIA-covered agency.
The core inquiry under the modified-control test is whether the FOIA-exempt entity
“manifested a clear intent to control the document” at issue. Judicial Watch, 726 F.3d at 221
(internal quotation marks and citation omitted). Defendant, presumably because it does not
believe this inquiry relevant, has proffered nothing this time to demonstrate this intent. By
reference to a footnote in its Reply from the first round of summary-judgment briefing, the Bank
briefly argues that the Presidential Records Act establishes the requisite evidence of control. See
9
Def. Repl./Opp. at 3 (citing ECF No. 31 at 8 n.2). That argument holds no water, for the
manifestation of intent to control the document must not be “too general”; rather, it requires a
“specific showing of [EOP] intent to control documents sought by FOIA requesters.” United We
Stand America, Inc. v. IRS, 359 F.3d 595, 602 (D.C. Cir. 2004); see also Judicial Watch, 726
F.3d at 228 (“Congress did not intend the PRA to diminish the scope of FOIA.”).
In Judicial Watch, for example, a memorandum of understanding existed that led the
court to conclude that the FOIA-exempt agency had “manifested a clear intent to control the
document[s].” 726 F.3d at 221, 223. That memorandum explicitly directed that any information
provided to the FOIA-covered agency “is provided under an express reservation of White House
control” and required the agency to “regularly transfer all [White House] Records in its
possession to the White House.” Id. at 223 (internal quotation marks and citations omitted).
Defendant has offered nothing comparable to that explicit declaration of continued control here.
The Court, therefore, cannot conclude that the first two factors of the Burka test — which assess
the “intent of the document’s creator to retain or relinquish control over the records” and “the
ability of the agency to use and dispose of the record as it sees fit,” Judicial Watch, 726 F.3d at
218 (citations omitted) — weigh in favor of continued control by the EOP. Nor would it
conclude, if consideration of the third and fourth factors were appropriate, that they weigh in the
EOP’s favor, as EXIM personnel have certainly “read or relied upon the” emails, and the emails
appear to have been fully “integrated into the agency’s record system or files.” Id. Indeed, the
normal course of email exchanges would lead one to believe that emails they receive from
another entity do not remain in that entity’s control.
Since the Court determines that these records fall within FOIA’s scope and must be
disclosed, it need not address Plaintiff’s alternative argument that the Bank cannot withhold
10
portions of a responsive record as “part-agency records.” Cf. United We Stand, 359 F.3d at 603–
04. The Bank must therefore produce the portions of this email chain that are redacted as “EOP
not subject to FOIA.” It may, however, continue to redact Calabria’s email address under
Exemption 6, as the Court held in its previous Opinion. Cause of Action, 521 F. Supp. 3d at 92–
95.
B. Exemption 5
Moving to the specific exemptions, the Court starts with Exemption 5, which applies to
“inter-agency or intra-agency memorandums or letters that would not be available by law to a
party other than an agency in litigation with the agency.” 5 U.S.C. § 552(b)(5). Withholdings
are restricted to “those documents, and only those documents, normally privileged in the civil
discovery context.” NLRB v. Sears, Roebuck & Co., 421 U.S. 132, 149 (1975); see also United
States v. Weber Aircraft Corp., 465 U.S. 792, 798–99 (1984). The exemption encompasses three
distinct components — namely, the deliberative-process privilege (sometimes referred to as
“executive privilege”), the attorney-client privilege, and the attorney-work-product privilege.
See American Immigration Council v. U.S. Department of Homeland Security, 905 F. Supp. 2d
206, 216 (D.D.C. 2012). Here, the Court need only concern itself with the first.
The deliberative-process privilege shields internal agency “advisory opinions,
recommendations and deliberations” in order to “protect[] the decision making processes of
government agencies.” Sears, 421 U.S. at 150 (citations and internal quotation marks omitted).
It “rests on the obvious realization that officials will not communicate candidly among
themselves if each remark is a potential item of discovery and front page news.” Department of
Interior v. Klamath Water Users Protective Association, 532 U.S. 1, 8–9 (2001). In other words,
“if agencies were forced to ‘operate in a fishbowl,’” the “quality of administrative decision-
11
making would be seriously undermined . . . because the full and frank exchange of ideas on legal
or policy matters would be impossible.” Mead Data Center, Inc. v. U.S. Department of Air
Force, 566 F.2d 242, 256 (D.C. Cir. 1977).
To qualify under the privilege, a record must meet two requirements. First, it must be
predecisional — i.e., “generated before the adoption of an agency policy.” Judicial Watch, Inc.
v. U.S. Department of Defense, 847 F.3d 735, 739 (D.C. Cir. 2017) (citation omitted); see also
U.S. Fish and Wildlife Service v. Sierra Club, Inc., 141 S. Ct. 777, 785–86 (2021). Second, a
record must be deliberative, meaning that it “reflect[s] the give-and-take of the consultative
process.” Judicial Watch, 847 F.3d at 739 (citation omitted). In this way, Exemption 5 focuses
on documents containing information that composes “part of a process by which governmental
decisions and policies are formulated.” Sears, 421 U.S. at 150 (citation omitted).
Additionally, in the context of Exemption 5, “an agency may withhold information —
even if it falls within the four corners of the exemption — ‘only if . . . the agency reasonably
foresees that disclosure would harm an interest protected by’ [that] exemption.” Rosenberg v.
U.S. Department of Defense, 442 F. Supp. 3d 240, 256 (D.D.C. 2020) (quoting 5 U.S.C.
§ 552(a)(8)(A)(i)(I)); see also S. Rep. No. 114-4 at 8 (2015). To satisfy this standard, an agency
must “identify specific harms to the relevant protected interests that it can reasonably foresee
would actually ensue from disclosure of the withheld materials,” and it must “connect [such]
harms in a meaningful way to the information withheld.” Center for Investigative Reporting v.
U.S. Customs & Border Protection, 436 F. Supp. 3d 90, 106 (D.D.C. 2019) (cleaned up) (citation
omitted). While “boilerplate” articulations of harm are insufficient, id. (citation omitted), the
government need not “identify harm likely to result from disclosure of each of its Exemption 5
withholdings.” Rosenberg v. U.S. Department of Defense, 342 F. Supp. 3d 62, 79 (D.D.C.
12
2018). Rather, it “may take a categorical approach” and “group together like records,”
explaining “the foreseeable harm of disclosure for each category.” Id. at 78.
The Bank asserts that this privilege protects the majority of disputed documents from
disclosure. Plaintiff disagrees. For the most part, the parties diverge on the elements mentioned
above — viz., whether the documents are predecisional and deliberative and whether disclosure
will result in foreseeable harm. For one set of records, however, Plaintiff also contests the
preliminary requirement that the records qualify as inter- or intra-agency materials. See Pl.
Opp./Cross-MSJ at 20–23; Def. Repl./Opp. at 10–15. The Court begins with this last set of
records before moving to assess — guided by the agency’s declarations, the Vaughn Index, and
in camera review — whether the other records at issue meet the predecisional, deliberative, and
foreseeable-harm requirements. In doing so, the Court adopts the document groupings presented
by the parties.
GAO Audit Responses and Document Productions
The parties first clash over the withholding of three records that the Bank sent to the
Government Accountability Office in connection with an audit it conducted of EXIM’s anti-
fraud controls. See ECF No. 40-3 (1st Declaration of Kenneth Tinsley), ¶ 10; Vaughn Index,
lines 45–47. Two of these documents “pre-exist[ed]” the GAO audit: the EXIM Risk Register,
which is “a register of the risks that EXIM determines to be its high-level risks, and an
assessment of both the inherent likelihood and impact . . . and the residual likelihood and impacts
of such risks,” and the Enterprise Risk Assessment, which “gives an overall assessment of
EXIM’s risk profile at the time.” 1st Tinsley Decl., ¶¶ 10, 10(a), (c). The third document, the
EXIM Responses to GAO Question No. 4 Re: Past Fraud Matters, “summarizes, for each of a
number of fraudulent transactions that occurred in the early 2000s, how the fraud was conducted,
13
how it was discovered and if there was anything particularly different or interesting regarding the
fraud in the matter.” Id., ¶ 10(b). Although that record contains “documents that were [] pre-
existing,” ECF No. 44-2 (2d Declaration of Kenneth Tinsley), ¶ 12, and content that “had been
previously put together by EXIM over a considerable period,” it was created and “contains
information that was formatted to respond to the GAO question.” Id.; see also 1st Tinsley Decl.,
¶ 10. One portion of this final document — an Office of the General Counsel memorandum
contained within the responses to GAO’s question — is not at issue now, as this Court has
already upheld its withholding. See Cause of Action, 521 F. Supp. 3d at 91–92; see also Pl.
Opp./Cross-MSJ at 20 n.13; Def. Repl./Opp. at 12 n.3.
a. Inter-agency or Intra-agency
The first matter of business is to decide if these three documents even qualify as inter- or
intra-agency records; if they do not, they must be released. As a unit of the Legislative Branch,
GAO is not a FOIA-covered “agency,” and so, at first glance, it would seem that documents
shared with GAO cannot qualify as “inter-agency” memoranda. The D.C. Circuit has held,
however, that agency documents shared with a governmental entity that does not itself qualify as
an “agency” for FOIA purposes may still be withheld under Exemption 5 in certain
circumstances. See, e.g., Rockwell International Corp. v. U.S. Department of Justice, 235 F.3d
598, 604 (D.C. Cir. 2001). Fortunately, the parties agree on the legal test that applies to
determine whether these documents may be withheld, which the Court lays out now.
In Dow Jones & Co., Inc. v. U.S. Department of Justice, 917 F.2d 571 (D.C. Cir. 1990),
the D.C. Circuit considered whether a letter sent by a FOIA-covered Executive Branch agency to
Congress was properly withheld under Exemption 5. Id. at 572, 574. It held that it was not,
explaining that the statutory language of “inter-agency or intra-agency” records “will not stretch
14
to cover this situation, because Congress is simply not an agency.” Id. at 574. But the court
acknowledged that such external communications from a FOIA-subject agency may qualify for
protection when they “are part and parcel of the agency’s deliberative process.” Id. at 575.
Because the letter in question was drafted for the purpose of aiding the “deliberations of a non-
agency” — i.e., Congress — it could not qualify as either an intra- or inter-agency record. Id. at
572, 575.
The Circuit clarified the scope of this holding a decade later in Rockwell International,
when it considered an agency’s Exemption 5 withholding of several documents that the agency
had, once more, sent to Congress. See 235 F.3d at 603–04. This time, however, the court
reached the opposite outcome. Even though the files “were sent to assist” a congressional
subcommittee “in its deliberations,” they enjoyed protection under Exemption 5. Id. at 604.
That was because the documents had been “created [earlier] as part of the [agency’s] deliberative
process,” thus making them “precisely the kind of inter- and intra-agency memoranda Exemption
5 protects.” Id. The agency did not “waive[] Exemption 5 protection” for documents that were
drafted to serve the agency’s decisionmaking process, as opposed to that of Congress, simply by
later sending them to the legislature. Id. at 603–04.
In sum, documents exchanged “between an agency and Congress . . . receive protection
as intra-agency memoranda if they were ‘part and parcel of the agency’s deliberative process,’”
but not if they were “created specifically to assist” or for the “sole purpose of assisting”
Congress “with its deliberations.” Id. at 604 (quoting Dow Jones, 917 F.2d at 575); see also
Electronic Privacy Information Center v. Transportation Security Administration, 928 F. Supp.
2d 156, 164–65 (D.D.C. 2013) (finding no Exemption 5 protection for document “prepared to
assist with Congressional deliberations rather than agency deliberations”).
15
Plaintiff argues that these documents were created for the sole purpose of assisting a
legislative agency; indeed, COA says, “[T]he sine qua non of the records — the very reason for
their existence — was GAO’s audit into Ex-Im’s ‘anti-fraud processes.’” Pl. Opp./Cross-MSJ at
22. The Bank counters that two of the three documents had been previously prepared for
EXIM’s own deliberative processes and should not lose their protection merely because they
were later turned over to GAO. See Def. Repl./Opp. at 11–12. As to the third document, the
Bank asserts that the information therein was “already ‘part and parcel of [EXIM’s] deliberative
process’” since the record contains only pre-existing documents or pre-existing information that
has been reformatted. Id. at 12–13 (quoting Rockwell International, 235 F.3d at 604). Like the
two other documents, it should not lose its Exemption 5 protection when turned over to GAO.
EXIM further contends that, in any event, the GAO audit was “intended to assist EXIM in its
deliberative process of drafting internal fraud risk controls,” and so none of the documents
shared with GAO as part of this audit was created for the “sole purpose of assisting [the non-
FOIA agency] with its deliberations.” Id. at 14 (quoting Rockwell International, 235 F.3d at
604).
The Court has little trouble finding that the EXIM Risk Register and the Enterprise Risk
Assessment meet the inter-agency requirement. Those documents, much like the files in
Rockwell International, were “created and used in on-going deliberations about various items”
“as part of [EXIM’s] discussions in a number of policy areas.” 2d Tinsley Decl., ¶ 10(a), (c).
The Bank appears to have turned them over to GAO in their pre-existing form. Id. As in
Rockwell International, doing so did not constitute a waiver of Exemption 5 protection. See 235
F.3d 603–04; see also Murphy v. Department of the Army, 613 F.2d 1151, 1158–59 (D.C. Cir.
16
1979) (no waiver of Exemption 5 privilege even when shared with Congress without assurance
of continued confidentiality).
The Reponses to GAO Question No. 4 Re: Past Fraud Matters poses a harder question.
Although that document contains information that was prepared for EXIM’s own purposes and
even includes some unaltered, pre-existing documents, it was compiled and formatted
specifically to respond to GAO’s inquiry. See 2d Tinsley Decl., ¶ 12(b); 2d Jackson Decl.,
¶ 29(a). The Bank thus created a new record in response to GAO’s audit, and it is that record —
not its constituent parts — that the Court must consider. The rationale that applies to justify the
withholdings in the EXIM Risk Register and the Enterprise Risk Assessment therefore does not
extend to this third record.
EXIM is not out of luck, however, as its responses to GAO might not have been created
for the “sole purpose of assisting [GAO] with its deliberations,” Rockwell International, 235
F.3d at 604, if the Bank is correct that GAO’s audit ultimately served the purpose of informing
EXIM’s own deliberations about how to improve its anti-fraud controls. See Def. Repl./Opp. at
14. The Bank does not explain the impetus for the specific audit pursuant to which these records
were shared. Plaintiff, however, proffers two sample GAO audit reports as evidence of the
audits’ purpose, see Pl. Opp./Cross-MSJ at 23, and Defendant does not reject the analogy. See
ECF No. 46 (Pl. Repl.) at 14. Those reports reveal that GAO regularly conducts audits of
EXIM’s anti-fraud controls pursuant to statutory authority. See U.S. Gov’t Accountability
Office, Export-Import Bank: EXIM Should Explore Using Available Data to Identify
Applications with Delinquent Federal Debt, No. GAO-19-337 (May 2019), available at
https://bit.ly/3gkNf0U (May 2019 GAO Report); U.S. Gov’t Accountability Office, Export-
Import Bank: The Bank Needs to Continue to Improve Fraud Risk Management, No. GAO-18-
17
492 (July 2018), available at https://bit.ly/3D3aypV (July 2018 GAO Report). That alone is not
enough to defeat the Bank’s argument, but the language of the relevant statute is. See 12 U.S.C.
§ 635a-6(b).
Section 635a-6(b) provides in relevant part:
[T]he Comptroller General of the United States shall—(1) review
the adequacy of the design and effectiveness of the controls used by
the Export-Import Bank of the United States to prevent, detect, and
investigate fraudulent applications for loans and guarantees and the
compliance by the Bank with the controls . . . and (2) submit a
written report regarding the findings of the review and providing
such recommendations . . . to—(A) the Committee on Banking,
Housing, and Urban Affairs and the Committee on Appropriations
of the Senate; and (B) the Committee on Financial Services and the
Committee on Appropriations of the House of Representatives.
That makes clear that GAO’s anti-fraud-procedures audits (though they may also aid EXIM’s
decisionmaking) are prepared for the benefit of congressional committees — a conclusion
bolstered by the fact that the sample GAO reports are both addressed to “Congressional
Committees.” May 2019 GAO Report at 1; July 2018 GAO Report at 1. The GAO responses,
accordingly, were “created specifically to assist” GAO and ultimately Congress, not as “part and
parcel of [EXIM’s] deliberative process.” Rockwell International, 235 F.3d at 604 (quoting Dow
Jones, 917 F.2d at 575). That record thus fails Exemption 5’s threshold requirement that it be a
“inter-agency or intra-agency memorandum[]” and must be produced. See 5 U.S.C. § 552(b)(5).
b. Predecisional, Deliberative, and Foreseeable Harm
Having cleared its first hurdle, the Bank must still establish that the two records
remaining — the Enterprise Risk Register and the Enterprise Risk Assessment — are
predecisional and deliberative and that release would cause foreseeable harm. Judicial Watch,
847 F.3d at 739.
18
As to the first, EXIM explains that it was “created as a tool to help guide the process of
Enterprise Risk management at EXIM” and “is not a policy or procedure.” 2d Tinsley Decl.,
¶ 12a. The Register “represents a snapshot in time” and is intended “to be used as a ‘living
document’” that is “constantly assessed and changed.” Id. For each identified risk, the Register
includes “assessments of the nature of the risk, of the controls that are used to mitigate the risk,
and an assessment of the degree of the risk once those controls are applied.” Id. It is “used to
contribute to a wide array of intra-agency discussions pertaining to all the various risks listed.”
Id. Based on this description, which appears to accurately reflect the content observed in the
Court’s in camera review, the Register is clearly “generated before the adoption of an agency
policy,” Judicial Watch, 847 F.3d at 739, and contains “evaluations” or “analysis . . . prepared
for senior-level review and decisionmaking.” Machado Amadis v. U.S. Department of State, 971
F.3d 364, 370 (D.C. Cir. 2020).
For similar reasons, the Enterprise Risk Assessment is also predecisional and
deliberative. That document “was prepared by the accounting firm Ernst & Young, under a
contract with EXIM, and prepared in conjunction with discussions with several EXIM staff
members.” 2d Tinsley Decl., ¶ 12c. It “formed, and still forms, a step in EXIM’s overall
maturing of its Enterprise Risk Management,” but there “was and is no particular end-point
decision that arose or arises out of the Risk Assessment.” Id., ¶ 12(c)(i). As “a tool to be used as
one input into various policy discussions,” the Risk Assessment contains “the joint analysis of
various EXIM staff members and Ernst & Young regarding the state of EXIM risk management
at that time.” Id., ¶ 12c(i)–(ii). That description suffices to establish that this document, like the
Risk Register, is an input into EXIM’s decisionmaking processes and is predecisional and
deliberative.
19
EXIM asserts that disclosure of both documents will produce a similar harm — namely,
the release of information that bad actors could use to identify risk vulnerabilities at the Bank.
See Def. Resp./Opp. at 15–16; 2d Tinsley Decl., ¶ 12a, c(iii). “Informing outside parties how
EXIM assesses these risks allows malefactors to analyze weaknesses in EXIM’s assessments,
and then allows them to compile such information with other data it collects, and target
vulnerabilities in EXIM’s risk controls.” 2d Tinsley Decl., ¶ 12c(iii). EXIM staff who were
aware of the possibility that their risk identification and assessments might be revealed, “would
be ‘chilled’ or deterred from frankly assessing individual fraud matters, openly proposing plans
to address such fraud, or providing reports on past frauds to the GAO or other entities whose
function includes assisting EXIM in developing more secure measures to prevent future fraud.”
Def. Resp./Opp. at 15–16. “Such chilling of candid advice is exactly what the privilege seeks to
prevent.” Machado Amadis, 971 F.3d at 371. These records, therefore, were properly withheld.
Enterprise Risk Committee Meeting Minutes
EXIM redacted in part three documents containing minutes from meetings of the
Enterprise Risk Committee (ERC) in 2018. See Vaughn Index, lines 3–5. The redactions block
out “[i]nformation about specific parties and impaired transactions”; summaries of “information
presented to the ERC related to cybersecurity risk”; “the number of ‘top cross-cutting’ risks in
[EXIM’s] enterprise risk profiles”; “Country Cover” — i.e. “whether, and how, EXIM will
support transactions in certain countries” — and “a discussion of the EXIM risk related to human
capital.” 1st Tinsley Decl., ¶ 5a–e. Plaintiff, echoing the position that this Court set forth in its
last Opinion, asserts that the Bank has not provided sufficient explanation of why the redacted
material is predecisional and deliberative and risks causing foreseeable harm if disclosed. See
Pl. Opp./Cross-MSJ at 24–25.
20
To withhold documents under the deliberative-process privilege, the Bank must explain
“(1) what deliberative process is involved, (2) the role played by the documents in issue in the
course of that process, and (3) the nature of the decisionmaking authority vested in the office or
person issuing the disputed document[s], and the positions in the chain of command of the
parties to the documents.” Center for Biological Diversity v. EPA, 279 F. Supp. 3d 121, 147
(D.D.C. 2017) (internal quotation marks and citations omitted). In its Vaughn Index, the Bank
explained that the redacted portions convey information about “specific parties and impaired
transactions . . . that form a part of the Enterprise Risk Committee’s (ERC) ongoing monitoring
and discussion regarding impaired credits,” and “discuss[] specific cybersecurity issues and risk
assessments which are part of continual and repeated process of cybersecurity risk management
and monitoring by the ERC.” Vaughn Index, line 3. The Vaughn Index further specifies that the
Country Cover redactions include analysis of “proposed steps regarding whether and how EXIM
will support transactions in Belarus,” and a human-capital risk analysis that was “presented to
ERC as part of a broader discussion within the agency regarding human capital and the risks
related to human capital concerns.” Id., lines 4–5.
The Tinsley Declarations also elaborate on the role that the information in each redaction
played in the process of monitoring and formulating responses to EXIM’s various risks. See 1st
Tinsley Decl., ¶ 5a–e; 2d Tinsley Decl., ¶ 7a–e. For example, as to the summary of impaired
transactions, Tinsley states that the “information precedes the final resolution of the impairment .
. . [and] is [presented] to allow for fulsome discussion about the various issues raised in these
matters.” 2d Tinsley Decl., ¶ 7a(ii). This “selection of the facts that staff deems most pertinent,
along with staff analysis and commentary regarding those facts . . . [is] one part of the flow of
information that then goes into discussions regarding the best approach to take in resolving each
21
matter.” Id. That assertion, and the several pages of description that accompany it, are sufficient
to establish that the meeting minutes were properly characterized as predecisional and
deliberative. See Judicial Watch, Inc. v. U.S. Department of Treasury, 796 F. Supp. 2d 13, 28–
29 (D.D.C. 2011) (finding meeting minutes properly withheld under Exemption 5); see also
Leopold v. CIA, 89 F. Supp. 3d 12, 21 (D.D.C. 2015) (factual matter may be withheld under
Exemption 5 where “the selection or organization of facts is part of an agency’s deliberative
process”) (citation omitted).
The Court finds that only one exception exists to the above conclusion. One line in the
cybersecurity portion of the minutes from August 22, 2018, is withheld pursuant to Exemptions 5
and 6. The Bank’s briefing and declarations offer no argument as to why this specific line meets
Exemption 5’s requirements, and the Court’s in camera review reveals that the line summarizes
a past personnel decision. See Vaughn Index, line 3; Redacted Records, Vol. 1 at 000002; see
also 2d Tinsley Decl., ¶ 7(b)(ii) (making argument that line is properly withheld under
Exemption 6 without Exemption 5 argument). EXIM has thus not met its burden to establish
that this line is properly withheld under Exemption 5. Nor is it properly withheld under
Exemption 6, since the Bank’s assertion that disclosing this line would “reveal specific
information about [the individual in question’s] life,” 2d Tinsley Decl., ¶ 7(b)(ii), is insufficient
to establish the applicability of Exemption 6, and the Court’s in camera review leads it to
conclude that the release of the redacted information would not “constitute a clearly unwarranted
invasion of personal privacy.” 5 U.S.C. § 552(b)(6). This line, accordingly, must be produced.
As to the remainder of the records, the Bank has also carried its burden to establish that
disclosure would lead to reasonably foreseeable harm. As explained in its Vaughn Index,
“Exposing internal staff deliberations about these matters would stifle open discussion,
22
potentially undermine EXIM negotiating positions in some circumstances, potentially give
outside parties insight into EXIM risk vulnerabilities,” and even “harm[] relations with other
countries.” Vaughn Index, lines 3–4. That explanation is sufficient to satisfy the Bank’s
heightened burden. See Rosenberg, 442 F. Supp. 3d at 260–61 (finding agency adequately
established foreseeable harm where declarant stated disclosure would inhibit “frank discussions”
and impair efforts to furnish leadership with “the full and necessary understanding” required for
effective decisionmaking). The meeting minutes, therefore, were properly withheld.
Cyber Risk Acceptance Recommendations
Next up is a 14-page memorandum that “contains the CIO’s description of numerous
cybersecurity risks, an assessment of their potential impact on EXIM’s activities, and
recommendations for how the agency might mitigate those risks while concurrently accounting
for operational efficiency.” Spira Decl., ¶ 10; Vaughn Index, line 6. Plaintiff contends that, as
this Court found in its prior Opinion, EXIM has not provided a sufficient description of the role
of the memo in the Bank’s decisionmaking processes and has not addressed the potential for
adoption of the proposal contained therein. See Pl. Opp./Cross-MSJ at 26. As previously
directed by the Court, Defendant counters with several pages explaining the memorandum’s role
in the decisionmaking process surrounding cybersecurity risks, as well as the relationship
between the ERC and the Chief Information Officer. See Def. Repl./Opp. at 18–22; Cause of
Action, 521 F. Supp. 3d at 81.
The Bank explains, and the Court has confirmed through its own in camera review, that
the memorandum at issue presents to the ERC a series of the CIO’s assessments and
recommendations regarding various cybersecurity risks facing EXIM and, “[o]n the surface . . .
appears to be a document that seeks a final decision — i.e. the acceptance of the cybersecurity
23
risk assessments made by the CIO.” Spira Decl., ¶ 10. The ERC, however, “is not itself a
decision-making body”; rather, it “recommends plans, proposals etc. to the Chief Risk Officer,
for further discussion with the President of the agency, and the President’s staff in the ‘front
office.’” Id. The memorandum contains the results of the CIO’s information gathering, which
the “ERC then uses . . . to discuss the risks assessed, debate the possible course of action, and
provide input into the higher-level discussion with the Chief Risk Officer,” who, in turn,
deliberates with the President before a final decision is made. See Def. Repl./Opp. at 21–22;
Spira Decl., ¶ 10. The memorandum, accordingly, is “generated before the adoption of an
agency policy,” Judicial Watch, 847 F.3d at 739, and is thus predecisional.
It is also deliberative, as it falls squarely within the category of documents this privilege
covers — “recommendations, draft documents, proposals, suggestions, and other subjective
documents which reflect the personal opinions of the writer rather than the policy of the agency.”
Coastal States Gas Corp. v. Department of Energy, 617 F.2d 854, 866 (D.C. Cir. 1980). Release
of this memorandum, furthermore, would undermine the purpose at the core of the deliberative-
process privilege: “assur[ing] that subordinates within an agency will feel free to provide the
decisionmaker with their uninhibited opinions and recommendations without fear of later being
subject to public ridicule or criticism.” Id.Finally, the Bank has easily met its burden to establish foreseeable harm here. This
memorandum is, as the Bank notes, “a gift to malefactors.” Def. Repl./Opp. at 22. The
document identifies EXIM’s cyber vulnerabilities, and release would allow “cyber-criminals [to]
use this information to identify and attack EXIM.” Id. Fear of that result “would have a direct
chilling effect on EXIM staff’s ability to freely and openly discuss such critical issues in
24
writing.” Id. The harm here is not only reasonably foreseeable, but manifestly evident. This
memorandum was properly withheld.
Presentation Slides
On to the next. EXIM has withheld portions of an internal slide presentation on the
“Intersection of EXIM Finance and National Defense Strategy.” Vaughn Index, line 7. Once
again, Plaintiff contends that the Bank has failed to provide sufficient detail on the role this
document plays in EXIM’s decisionmaking processes. See Pl. Resp./Cross-MSJ at 27.
The Bank’s Vaughn Index explains that the “[r]edacted portions of this document set
forth a framework for consideration on how to address certain aspects of national security
through EXIM.” Vaughn Index, line 7. Because “[t]hese national security concerns are
continual and prolonged, . . . there is no ‘final decision’ point with regard to the redacted
portions of the documents.” Id. As part of the ongoing evaluation of these concerns, “[t]his slide
presentation formed the basis of discussion with the Department of Defense.” Def. Repl./Opp. at
23; see also 2d Tinsley Decl., ¶ 9.
That description is sufficient for the Court to conclude that the Bank “here met its burden
of identifying the decisionmaking process to which [the slides] contributed” — the study of how
EXIM could respond to certain national-security concerns — even without identifying a specific
end decision. See Access Reports v. Department of Justice, 926 F.2d 1192, 1196–97 (D.C. Cir.
1991) (rejecting need to pinpoint specific decision to which memorandum contributed). To the
extent some of the redacted information is factual, that, too, is properly considered deliberative,
since its exposure might “enable the public to probe [EXIM’s] deliberative processes,” and “the
selection or organization of facts is part of an agency’s deliberative process.” Leopold, 89 F.
Supp. 3d at 21 (citations omitted).
25
As with the last set of records, the harm here is self-evident. “[P]ublicizing these slides
would provide adversaries of the United States with insights into how EXIM and the United
States analyze international issues related to national security and what issues the United States
prioritizes.” 2d Tinsley Decl., ¶ 9b. That explanation satisfies the Bank’s obligation to “identify
specific harms to the relevant protected interests that it can reasonably foresee would actually
ensue from disclosure of the withheld materials and connect the harms in a meaningful way to
the information withheld.” Center for Investigative Reporting, 436 F. Supp. 3d at 106 (cleaned
up) (internal quotation marks and citations omitted). The redacted portions of the presentation
slides, too, were properly withheld.
Weekly Reports
The Court ends its Exemption 5 journey with EXIM’s largest category of withholdings.
The 25 records at issue here vary in their contents, but all are weekly reports compiling updates
from teams across the Bank and presented to internal, more senior decisionmakers. See Vaughn
Index, lines 9–11, 14, 17–19, 21–22, 24–26, 29–33, 35–43. In its last Opinion, the Court
determined that, while “select portions [of the withheld documents] contain internal staff
discussion that falls within the confines of the privilege,” the Bank had both over-redacted and
failed to sufficiently identify the decisionmaking processes to which the information contained in
the reports — much of which appeared to be factual — contributed. Cause of Action, 521 F.3d
at 82–84. Plaintiff contends that the same is true now, and that factual information that merely
provides ongoing updates to a decisionmaking group cannot be deliberative. See Pl. Opp./Cross-
MSJ at 28–29; Pl. Repl. at 19–20. EXIM responds with reprocessed records containing fewer
redactions and several pages of declarations explaining the content of each withholding. See 1st
Tinsley Decl., ¶ 8; 2d Tinsley Decl., ¶ 10.
26
The Court considers the withheld records in groupings based on the author of the weekly
report, adopting the structure put forward by Defendant. See Def. Repl./Opp. at 25–27; 1st
Tinsley Decl., ¶ 8; 2d Tinsley Decl., ¶ 10. For each grouping, the Court focuses on a
representative document and then applies its conclusion to other records the Bank has stated (and
the Court has confirmed through in camera review) are substantially similar.
Before moving to the specifics of each group, the Court notes that all the reports share a
common feature that increases their likelihood of falling within Exemption 5: they are prepared
by lower-level employees for the benefit of upper-level decisionmakers. As the D.C. Circuit has
recognized, “[A] document from a subordinate to a superior official is more likely to be
predecisional, while a document moving in the opposite direction is more likely to contain
instructions to staff explaining the reasons for a decision already made.” Coastal States, 617
F.2d at 868. “A recommendation to a supervisor on a matter pending before the supervisor,”
furthermore, “is a classic example of a deliberative document.” Abtew v. U.S. Department of
Homeland Security, 808 F.3d 895, 899 (D.C. Cir. 2015).
While things thus start off looking good for the Bank, its withholdings are complicated
by the fact that much of the redacted information appears to be factual rather than staff
evaluations or analysis. See 1st Tinsley Decl., ¶ 8 (“The reports are mostly informational and
provided to give the President and Senior Staff a snapshot of what is going on.”). “Purely factual
material usually cannot be withheld under Exemption 5, [but] it can be where it reflects an
exercise of discretion and judgment calls and where its exposure would enable the public to
probe an agency’s deliberative processes.” Leopold, 89 F. Supp. 3d at 21 (citations and internal
quotation marks omitted). Whether this information is nonetheless protected for its role in a
deliberative process forms the focus of the Court’s analysis here.
27
a. Office of Board Authorized Finance reports
EXIM’s first set of withheld documents consists of weekly reports from the Office of
Board Authorized Finance (OBAF), which “handles the origination and monitoring of all
transactions large enough to require approval by the Board of Directors.” Vaughn Index, line 9.
“The redacted portions of [the representative] report cover proposed plans for handling
transactions generally, as well as specific and confidential applications, monitoring and
negotiating plans for specific impaired transactions[,] . . . and both aggregated and individual
information regarding pending transactions.” Id. EXIM represents that these reports “provide
the Senior Staff, and the President and her staff, with information . . . [that] can be incorporated
into any number of different decisions senior managers may have to make” about the handling of
the transactions referenced in the documents. See 2d Tinsley Decl., ¶ 10(b)(iv).
Although much of the information therein is best described as “factual,” it may be
properly withheld under deliberative process when “it reflects an exercise of discretion and
judgment calls and where its exposure would enable the public to probe an agency’s deliberative
processes.” Leopold, 89 F. Supp. 3d at 21 (quoting Ancient Coin Collectors Guild v.
Department of State, 641 F.3d 504, 513 (D.C. Cir. 2011)) (internal quotation marks omitted).
Here, “the redacted information [wa]s chosen from an array of data to support the proposed
approach EXIM is taking in these matters,” 2d Tinsley Decl., ¶ 10(b)(iv), and “was not
assembled for an agency actor merely to pass along to outsiders, but rather for purely internal
deliberative purposes.” Electronic Privacy Information Center, 928 F. Supp. 2d at 167–68. That
supports the conclusion that it “must be protected in order to safeguard the agency’s deliberative
process.” Id. at 168. As this Court recognized in its prior Opinion, “[D]etails concerning the
Bank’s rolling efforts to monitor, manage, and conduct due diligence on certain of its existing,
28
pending, and prospective transactions and broader portfolio alike” are properly considered
predecisional and deliberative. Cause of Action, 521 F. Supp. 3d at 82; see also Center for
Public Integrity v. U.S. Department of Defense, 486 F. Supp. 3d 317, 336–37, 346 (D.D.C. 2020)
(finding “weekly reports [giving] an overview of funding and related issues,” “contain[ing]
advice on actions that should be taken,” and providing subordinate’s “determination of which
issues are most relevant and important for the department” properly withheld under Exemption
5).
Disclosure of such information, moreover, would make it “very difficult” for EXIM to
“fulfill its mission” because fear of the release of this information, which “applicants customarily
keep . . . confidential,” would discourage applicants from participating in EXIM programs. See
2d Tinsley Decl., ¶ 10(b)(iv). The Bank has therefore discharged its obligation to establish the
foreseeable harm that would result from the release of this predecisional and deliberative
information, and the reports identified at lines 9, 17, 24, 30, and 37 were properly withheld. See
Vaughn Index, lines 17, 24, 30, and 37 (representing that “[t]he same type of information is
redacted” in these records as in record at line 9).
b. Office of the General Counsel reports
A similar rationale supports the withholding of EXIM’s second set of documents, which
comprises reports from the Office of the General Counsel and Corporate Secretary. See Vaughn
Index, lines 10, 18, 25, 32, 39. The redacted information in these reports “pertains to impaired
transactions” and “includes analytical information regarding EXIM’s approach to these matters.”
1st Tinsley Decl., ¶ 8(c). Much like the information in the first set of reports, this information,
though factual, is assembled for the benefit of senior decisionmakers, contributes to the
monitoring of EXIM transactions, and feeds into “intra-agency discussion” about how to handle
29
these transactions. See 2d Tinsley Decl., ¶ 10(c)(ii). “[P]ublic disclosure of this information
would publicize both EXIM’s specific and general approach to these matters[,] . . . significantly
undermin[ing] EXIM’s negotiating position . . . [and] pressur[ing] EXIM staff to curtail putting
such information in writing, thus making appropriate Senior Staff review more difficult.” Id.For much the same reasons given above, the Bank has justified withholding of these reports.
One further points bears mention. In the July 25, 2018, weekly report, there appears a
“Business Development Travel” section that is absent from the other reports in this group. That
section includes “both factual information obtained during the travel in question, as well as
analysis and synthesis of the information [] obtained.” Vaughn Index, line 18. This information
“is for the benefit of senior staff in discussions regarding EXIM’s competitiveness with foreign
export credit agencies,” id., and its disclosure would “reveal[] to the foreign export credit
agencies the competitiveness issues that have drawn EXIM’s attention, and the steps EXIM is
considering to re-balance the competitiveness.” 2d Tinsley Decl., ¶ 10(c)(iii). The Court
concludes that this, too, qualifies as predecisional and deliberative, as its in camera review
confirms EXIM’s representation that this section includes analysis that may inform future
decisions.
c. Office of Risk Management reports
The third set of withheld documents contains weekly reports from the Office of Risk
Management. See Vaughn Index, lines 11, 19, 26, 33, 40. At the risk of repeating itself, the
Court again finds that these were properly withheld for much the same reasons as the previous
two sets. Redacted portions of these documents “address internal reorganizational steps being
discussed among senior managers relating to re-alignment of risk management within the
agency,” “analys[es] of economic conditions in [] countries for discussion relating to ‘country
30
cover,’ and internal emergency procedures related to continueing [sic] operations of government
in the event of a disaster (COOP).” Vaughn Index, line 11. These reports are predecisional and
deliberative because they feed into and discuss ongoing decisionmaking processes about the
“restructuring of risk management within EXIM,” “transaction due diligence” by EXIM loan
officers, and “steps being taken in connection with the Government[’]s ‘Continuity of Operations
Plan.’” 2d Tinsley Decl., ¶ 10(d)(ii)–(iv). Disclosure, furthermore, would “provide outside
parties with information they could use to undermine the effectiveness of risk management
within the agency” or “reveal the type of information that EXIM relies upon to make [its
transaction-due-diligence] analyses,” thereby “put[ting] at risk EXIM’s and the U.S.
Government’s ability to engage openly and honestly with some of these countries.” Id. These
records were properly withheld.
d. Office of the Chief Information Officer reports
Different records, same story. This time the records withheld are updates on EXIM’s
ongoing efforts to maintain and upgrade its cybersecurity defenses. Like the other records
discussed, these contain largely factual information that is used to inform the Bank’s monitoring
of and decisionmaking around cybersecurity initiatives. See 2d Tinsley Decl., ¶ 10(g). And like
those previously discussed, the documents at Vaughn Index lines 14, 22, 29, 36, and 43 were
properly withheld. See also supra, Sec. III.B.3 (concluding similar discussion of cybersecurity
issues properly withheld).
e. Miscellaneous documents
Finally, the terminus for Exemption 5. The last set of documents consists of three types
of records, two of which the Court concludes were properly withheld. The first — two weekly
reports from the Office of Policy and International Relations (OPAIR) — were properly withheld
31
for substantially the same reasons as the other weekly reports discussed. These records, at
Vaughn Index lines 21 and 35, provide “factual and analytical” information to inform
negotiations with the OECD and a specific country. See 2d Tinsley Decl., ¶ 10(f)(ii). The fact
that these negotiations have since terminated does not take these records outside of Exemption 5,
since “no specific decision was made with regard to the information” contained therein. See
Vaughn Index, line 21; see also Gold Anti-Trust Action Committee, Inc. v. Board of Governors
of the Federal Reserve System, 762 F. Supp. 2d 123, 135–36 (D.D.C. 2011) (“[E]ven if an
internal discussion does not lead to the adoption of a specific government policy, its protection
under Exemption 5 is not foreclosed as long as the document was generated as part of a definable
decision-making process.”).
The second type of withheld document is another weekly report from OPAIR. See
Vaughn Index, line 42. The redacted portions “pertain to two unrelated conceptual proposals
made by outside parties that will need to be explored and discussed.” 2d Tinsley Decl.,
¶ 10(f)(iii). A “combination of selected factual information and analysis,” the redacted
information constitutes “staff’s internal analysis[, which] is not necessarily the final EXIM
analysis.” Id. Such “advisory opinions, recommendations, and deliberations,” especially when
provided by staff to senior decisionmakers, are precisely what the deliberative-process privilege
is intended to shield. Sears, 421 U.S. at 150; see also Coastal States, 617 F.2d at 868.
The final two records are weekly reports from the Office of Congressional and
Intergovernmental Affairs. See Vaughn Index, lines 31, 38. Only one line is redacted from these
reports, and the Bank contends that the redaction is justified because “it summarizes the gist of
an internal discussion regarding a potential reorganization within the agency, and whether that
reorganization required a report to Congress.” 2d Tinsley Decl., ¶ 10(h). That this material is
32
predecisional is evident: it is “presented to the Senior Staff expressly as an ‘action item.’” Id.The Court is not convinced, however, that the Bank has established that it is deliberative.
Although EXIM argues that the redacted information summarizes ongoing discussions and “is a
part of the broader discussion regarding the issue,” id., it is not clear to the Court what a reader
of this line could glean about EXIM’s decisionmaking processes from its content. At most, one
might be able to identify the decision the Bank’s leaders must make, but identifying the decision
does not risk exposing anything about the process itself; indeed, it is something agencies seeking
to assert Exemption 5 are required to do. See Center for Biological Diversity, 279 F. Supp. 3d at
147 (requiring agency to identify “deliberative process . . . involved). These last reports,
consequently, must be produced in full.
C. Exemption 4
At last departing the shores of Exemption 5, the Court now travels to the land of
Exemption 4, which the Bank cites to justify the withholding of 24 records. The Court need only
consider seven of those records here, however, because it has already determined that EXIM
properly withheld the redacted information in the others pursuant to Exemption 5. See Center
for National Security Studies, 331 F.3d at 925. The only Vaughn Index lines at issue are thus
12–13, 20, 27–28, 34, and 41.
Those records may be sorted into two categories. The first contains weekly reports from
the Office of Small Business (OSB), which “covers those transactions and programs not
requiring Board of Directors approval.” Vaughn Index, line 12; see also id., lines 20, 27, 34, 41.
Each update is produced largely unredacted, with redactions “pertain[ing] to specific confidential
information regarding identified exporters[, s]pecifically . . . the business concentration, or
planned concentration, in specific countries.” 1st Tinsley Decl., ¶ 8(e). The second set is in fact
33
one document produced twice, which is a weekly update from OPAIR. See Vaughn Index, lines
13, 28. The lone redaction in that report “refer[s] to specific terms of a guarantee issued by
EXIM to the Private Export Finance Corporation (PEFCO).” 1st Tinsley Decl., ¶ 8(f)(i).
Exemption 4, which EXIM contends justifies these redactions, shields from disclosure
“commercial or financial information obtained from a person and privileged or confidential.” 5
U.S.C. § 552(b)(4). To demonstrate that this exemption shelters the information withheld, the
Bank must show that it is “(1) commercial or financial, (2) obtained from a person, and (3)
privileged or confidential.” Public Citizen Health Research Group. v. FDA, 704 F.2d 1280, 1290
(D.C. Cir. 1983). There is no dispute about the first prong, so the Court focuses its discussion on
the second and third elements.
Obtained From a Person
“Information is considered ‘obtained from a person’ if the information originated from an
individual, corporation, or other entity, and so long as the information did not originate within
the federal government.” Electronic Privacy Information Center v. U.S. Department of
Homeland Security, 117 F. Supp. 3d 46, 63 (D.D.C. 2015) (citing Board of Trade of City of
Chicago v. Commodity Futures Trading Commission, 627 F.2d 392, 404 (D.C. Cir. 1980)). The
D.C. Circuit has held, however, that information originating within the Government may still be
considered “obtained from a person” when it summarizes information supplied by an external
party or is a portion of a document “from which information supplied by [the third party] could
be extrapolated.” Gulf Western Industries, Inc. v. United States, 615 F.2d 527, 529–30 (D.C.
Cir. 1979). Agency-generated records that constitute agency analysis of third-party information
(as opposed to mere summary), on the other hand, are not “obtained from a person.”
Philadelphia Newspapers, Inc. v. Department of Health and Human Services, 69 F. Supp. 2d 63,
34
66–67 (D.D.C. 1999). “[T]he key distinction — which will obviously be blurry in many
instances — is between information that is either repeated verbatim or slightly modified by the
agency, and information that is substantially reformulated by the agency, such that it is no longer
a ‘person’s’ information but the agency’s information.” Southern Alliance for Clean Energy v.
U.S. Department of Energy, 853 F. Supp. 2d 60, 68 (D.D.C. 2012).
COA maintains that the records withheld under Exemption 4 fall into the latter category,
or, at least, that EXIM has not provided sufficient information to establish that the redacted
information came from outside the agency. See Pl. Opp. and Cross-MSJ at 17–18. The Bank
rejoins that its Vaughn Index and declarations demonstrate that this information was collected
from applicants and customers of the Bank, and the unveiling of any ensuing analysis would
allow the extrapolation of the underlying data. See Def. Repl./Opp. at 5–7.
As to the OSB reports, the Court concludes fairly easily that EXIM has established that
most of the redacted information came from customers of the Bank. Although the Bank does not
specify the method by which it acquired each piece of information — which “may come from
documents that EXIM has received, or it may be oral information EXIM collects by phone or in
meetings,” 2d Jackson Decl., ¶ 22 — it represents that the information was provided by the
customers or partners being discussed in the report and is presented with “very selective edits.”
Vaughn Index, line 12. The Court’s in camera review confirms that this is the case. Indeed, the
redacted information does not appear to include EXIM analysis or manipulation, but rather is a
recitation of customers’ plans or statistics about their businesses. That is information “obtained
from a person.” 5 U.S.C. §552(b)(4); see Southern Alliance for Clean Energy, 853 F. Supp. 2d
at 68 (information recited or minimally modified may be “obtained from a person”); Electronic
35
Privacy Information Center, 117 F. Supp. 3d at 63 (information from a corporation is “obtained
from a person”).
Only one set of redactions in this group does not fall clearly into this category. Those are
the redactions under the “New Issuing Bank Credit Limit (IBCL)” heading in the record at
Vaughn Index, line 20. See Redacted Records, Vol. 1 at 000084. The redacted information
appears to be the amount of an EXIM-approved credit limit, the recipient of that credit limit, and
the cotton exporter that will be supported by the IBCL. EXIM offers no explanation specific to
this record (arguing instead that it simply follows the determination of the record at Vaughn
Index, line 12), and it is not clear to the Court why this information would have been obtained
from an outside party, rather than from inside the Bank. See Vaughn Index, line 20; 1st Tinsley
Decl., ¶ 8(e); 2d Tinsley Decl., ¶ 10(e). The Court, accordingly, concludes that EXIM has not
met its burden to establish that this information is “obtained from a person,” and the information
must be disclosed.
This trend continues with the OPAIR weekly report. EXIM explains that the redacted
portion of this report refers to the terms of a guarantee made to PEFCO. See Vaughn Index, line
13; 1st Tinsley Decl., ¶ 8(f); 2d Tinsley Decl., ¶ 10(f)(i). But EXIM also states that the redacted
terms were “issued by EXIM to [PEFCO],” 2d Tinsley Decl., ¶ 10(f)(i), which would seem to
eliminate the possibility that this information came from PEFCO to EXIM. Indeed, this
establishes that the redacted information moved in the opposite direction. EXIM rejoins that
“terms or conditions . . . are arrived at by agreement,” and “the term or condition would not exist
but for . . . PEFCO’s agreement so in that sense the terms and conditions came from PEFCO.”
Id. That argument is unavailing. See Southern Alliance for Clean Energy, 853 F. Supp. 2d at 68
(citing In Defense of Animals v. National Institutes of Health, 543 F. Supp. 2d 83, 102–03
36
(D.D.C. 2008)) (“[T]he mere fact that information was the product of negotiations between a
‘person’ and the agency does not make that information ‘obtained from a person’ under
Exemption 4.”). A more natural reading of EXIM’s description, supported by the Court’s in
camera review of the redacted information, leads to the conclusion that this information was not
obtained from a person, as Exemption 4 requires. The records at Vaughn Index lines 13 and 28
shall be disclosed.
Confidential
Even after establishing that the OSB reports are “obtained from a person,” EXIM may
withhold them under Exemption 4 only if it also demonstrates that they are “privileged or
confidential.” Public Citizen Health Research Group, 704 F.2d at 1290. Only the “confidential”
nature of the records is at issue here. To satisfy this requirement, the Bank must show that the
withheld commercial or financial information is “both customarily and actually treated as private
by its owner.” WP Company LLC v. U.S. Small Business Administration, 502 F. Supp. 3d 1, 12
(D.D.C. 2020) (quoting Food Marketing, 139 S. Ct. at 2366). In other words, the information
must be “customarily kept private, or at least closely held, by the person imparting it.” Food
Marketing, 139 S. Ct. at 2363. The critical question is “how the particular party customarily
treats the information, not how the industry as a whole treats the information.” Center for Auto
Safety v. National Highway Traffic Safety Administration, 244 F.3d 144, 148 (D.C. Cir. 2001)
(citing Critical Mass Energy Project v. Nuclear Regulatory Commission, 975 F.2d 871, 872,
878–80 (D.C. Cir. 1992)).
An agency seeking to establish customary treatment may “proceed solely on its sworn
affidavits.” Judicial Watch, Inc. v. U.S. Department of Commerce, 337 F. Supp. 2d 146, 171
(D.D.C. 2004). Those affidavits must be “made on personal knowledge,” Animal Legal
37
Defense Fund, Inc. v. Department of the Air Force, 44 F. Supp. 2d 295, 303 (D.D.C. 1999)
(quoting Fed. R. Civ. P. 56(e)), which can be demonstrated in a variety of ways. An agency may
“relay[] that the submitters themselves told the agency that the information is confidential, . . .
indicat[e] that the agency reached an ‘understanding’ with the submitters ‘that the information
w[ould] be held in confidence by the U.S. and not publicly divulged,’ . . . point[] to confidential
markings on the documents themselves or to the existence of a non-disclosure agreement, or . . .
provid[e] descriptions of the documents that demonstrate their confidential nature.” Center for
Investigative Reporting, 436 F. Supp. 3d at 110–11 (quoting Judicial Watch, 337 F. Supp. 2d at
171). Excluded from the list of acceptable methods are “[c]onclusory statements by an agency
official about what the agency official may believe about how a submitter customarily treats the
information at issue.” Id. at 111.
“Complicating matters,” the Supreme Court in 2019 suggested that “the plain meaning of
the word ‘confidential’” might require the government to establish an “additional necessary
condition” before invoking Exemption 4 — namely, that “the party receiving the information . . .
‘provide[d] some assurance that it [would] remain secret.’” Renewable Fuels Association v.
U.S. EPA, 519 F. Supp. 3d 1, 10 (D.D.C. 2021) (quoting Food Marketing., 139 S. Ct. at 2363).
The Court, however, did not resolve whether this second condition is mandatory, see Food
Marketing, 139 S. Ct. at 2363, and this Court has since explained that binding Circuit precedent
compels an answer in the negative. See Renewable Fuels Association, 519 F. Supp. 3d at 12
(“The current law of the D.C. Circuit . . . is that information is confidential under Exemption 4
‘if it is of a kind that would customarily not be released to the public by the person [or entity]
from whom it was obtained.’”) (alteration in original) (quoting Critical Mass, 975 F.2d at 879).
This Court, accordingly, declines to “read the word ‘confidential’ to impose a blanket
38
requirement that the government provide an assurance of privacy in every case in which it asserts
Exemption 4.” Id. It acknowledges, however, that an assurance of confidentiality may be
relevant to determining whether information is “confidential.” See Shapiro v. Department of
Justice, No. 12-313, 2020 WL 3615511, at *25 (July 2, 2020).
EXIM contends in its declarations and Vaughn Index that the redacted information is not,
“in EXIM’s experience[,] . . . generally shared publicly.” Vaughn Index, line 12. COA rejoins
that the Bank has put forth nothing more than “conclusory” claims about the customary treatment
of this information. See Pl. Opp./Cross-MSJ at 16–17. In response, the Bank’s declarant stated
that the redacted information “is not customarily publicized by exporters as it reveals
competitively valuable information,” and he notes that EXIM did not redact information where it
established that an exporter had diverted from its customary practice. See 1st Tinsley Decl.,
¶ 8(e). He declared, furthermore, that the information is “precisely the kind of information that
U.S. exporters supported by EXIM have identified over the years as sensitive and that such
companies do not customarily divulge publicly.” 2d Tinsley Decl., ¶ 10(e)(i). That knowledge
is based on Tinsley’s “40-plus years at EXIM” and his “many direct conversations or
communications with EXIM customers regarding their confidentiality expectations.” Id.,
¶ 6(a)(iii). It is also drawn from the Bank’s “long experience with U.S. exporters,” from which it
has made “determinations regarding the customary habits of those exporters based on
generalizations gleaned over thousands of communications covering decades.” Id., ¶ 8(e)(i).
Although EXIM would ideally have solicited input from the specific exporters discussed in these
reports, the Court finds that it may rely here on its “decades of accumulated experience and
interaction with participants on the question of confidentiality” to conclude that “this type of
39
information is customarily kept confidential by the parties that submit it to EXIM.” Id.,
¶ 6(a)(viii); see Center for Investigative Reporting, 436 F. Supp. 3d at 110–11.
The Bank has declared, furthermore, that it “assures transaction applicants, exporters and
other transaction participants that it will protect the information they provide to EXIM from
disclosure to the maximum extent permitted.” 2d Jackson Decl., ¶ 17; see also ECF No. 40-6
(Exhibit B, Copy of Memorandum re: Treatment of Confidential Materials). To the extent that
evidence of assurance of confidentiality is necessary, EXIM has satisfied that requirement. At
the very least, this evidence of assurance supports the conclusion that the redacted information is
“confidential.” Shapiro, 2020 WL 3615511, at *25.
Foreseeable Harm
An agency may withhold information under Exemption 4 — even if it falls within the
scope of the exemption — “only if . . . the agency reasonably foresees that disclosure would
harm an interest protected by [that] exemption.” 5 U.S.C. § 552(a)(8)(A)(i)(I); see also
Reporters Committee for Freedom of Press v. FBI, 3 F.4th 350, 369–70 (D.C. Cir. 2021). To
satisfy this standard, an agency must “identify specific harms to the relevant protected interests
that it can reasonably foresee would actually ensue from disclosure of the withheld materials,”
and it must “connect [such] harms in a meaningful way to the information withheld.” Center for
Investigative Reporting, 436 F. Supp. 3d at 106 (cleaned up) (citation omitted).
Plaintiff points out that Defendant mounts no foreseeable-harm arguments specific to
Exemption 4 in its briefing. See Pl. Opp./Cross-MSJ at 36–37; Pl. Repl. at 20–21. Defendant,
however, has put forth bases for the harm of disclosing each document in its Vaughn Index and
its declarations. See Def. Repl./Opp. at 27–28 (noting as much). EXIM contends that disclosure
of the information in OSB reports would harm the submitting customers by essentially “telling
40
all of their competitors that [the country in which they have concentrated their sales] is where the
business is.” 2d Tinsley Decl., ¶ 10(e)(i). Publication of information participants expect the
Bank to keep confidential, moreover, would “severely hamper[]” EXIM’s ability to perform its
function; “[i]f EXIM transaction parties were to lose faith in EXIM’s ability to keep
[confidential] information private,” the Bank would lose access to information it “relies upon to
complete its underwriting of transactions, to monitor transactions as they proceed, and to settle,
or work-out transactions that run into difficulties.” 2d Jackson Decl., ¶ 19. That suffices to
“directly articulate[] [a] link between the specified harm and the specific information contained
in the material withheld.” WP Company LLC v. U.S. Small Business Administration, No. 20-
1240, 2021 WL 5881972, at *4 (D.D.C. Dec. 13, 2021) (quoting Reporters Committee, 3 F.4th at
371) (finding similar harms sufficient to satisfy foreseeable-harm requirement).
The OSB weekly reports, identified at Vaughn Index lines 12, 20, 27, 34, and 41, were
thus properly withheld under Exemption 4.
D. Segregability
Plaintiff’s last challenge is a general critique of Defendant’s failure “to show that it
released all reasonably segregable portions of the records at issue.” Pl. Opp./Cross-MSJ at 37–
38. While COA is of course correct that EXIM bears the burden of releasing “[a]ny reasonably
segregable portion of a record” and must “take reasonable steps necessary to segregate and
release nonexempt information,” the Court is satisfied that Defendant has discharged that
obligation here, despite its misgivings last go-round. See 5 U.S.C. § 552(a)(8)(A)(ii)(II); 552(b);
Cause of Action, 521 F.3d at 96. Unlike last time, the Bank has redacted almost no records in
full, and the Court’s in camera review did not reveal any instances of apparent over-redaction.
EXIM has instead redacted specific portions of the records at issue and has explained to the
41
Court’s satisfaction the rationale for its withholdings. See Hodge v. FBI, 703 F.3d 575, 582
(D.C. Cir. 2013) (finding segregation obligation met where court found redactions consistent
with application of claimed exemptions).
* * *
For those still keeping score, the final results are now in, and EXIM must release the
documents at the following lines of the Vaughn Index: 3 (in part), 13, 15 (in part), 20 (in part),
28, 31, 38, and 46 (in part). The others are properly withheld.
IV. Conclusion
For the foregoing reasons, the Court will grant in part and deny in part the Motions for
Summary Judgment. A separate Order so stating will issue this day.
/s/ James E. Boasberg
JAMES E. BOASBERG
United States District Judge
Date: January 27, 2022
42