Reporters Committee for Freedom of the Press v. Federal Bureau of Investigation

United States Court of Appeals
FOR THE DISTRICT OF COLUMBIA CIRCUIT
Argued November 13, 2017 Decided December 15, 2017
No. 17-5042
REPORTERS COMMITTEE FOR FREEDOM OF THE PRESS AND
ASSOCIATED PRESS,
APPELLANTS
v.
FEDERAL BUREAU OF INVESTIGATION AND UNITED STATES
DEPARTMENT OF JUSTICE,
APPELLEES
Appeal from the United States District Court
for the District of Columbia
(No. 1:15-cv-01392)
Katie Townsend argued the cause for appellants. With her
on the briefs was Bruce D. Brown.
Joseph F. Busa, Attorney, U.S. Department of Justice,
argued the cause for appellees. With him on the brief was
Matthew M. Collette, Attorney.
Before: TATEL and KAVANAUGH, Circuit Judges, and
SILBERMAN, Senior Circuit Judge.
Opinion for the Court filed by Circuit Judge TATEL.
2
TATEL, Circuit Judge: In this Freedom of Information Act
case, the Reporters Committee for Freedom of the Press and
the Associated Press seek information from the Federal Bureau
of Investigation regarding its use of undercover tactics
involving impersonation of the media and creation of fake
news. After the Bureau turned over several pertinent records,
the district court granted summary judgment in its favor. We
reverse. As explained below, the Bureau has failed to
demonstrate that it “conduct[ed] a search for the requested
records, using methods which can be reasonably expected to
produce the information requested.” Oglesby v. U.S.
Department of the Army, 920 F.2d 57, 68 (D.C. Cir. 1990).
I.
In 2007, Seattle-area Timberline High School began
receiving anonymous bomb threats, which prompted daily
evacuations. See U.S. Department of Justice, Office of the
Inspector General, A Review of the FBI’s Impersonation of a
Journalist in a Criminal Investigation 1 (2016) (“OIG
Report”), Joint Appendix (J.A.) 538. Unable to trace the
emailed threats to their sender, local authorities called in
cybercrime experts from the FBI’s Seattle Division. Id. Sensing
the handiwork of a narcissist, the FBI agents devised a plan: if
they could flatter the culprit into clicking a link to what
appeared to be press coverage suggesting that he had
outsmarted the authorities, they could, in turn, outsmart him by
secretly delivering specialized malware that would reveal his
computer’s location. Id. at 11–12, J.A. 548–49. Warrant in
hand, an FBI Special Agent contacted an anonymous social-
media account associated with the threats, identified himself as
an Associated Press “Staff Publisher,” and requested input on
a draft article accessible through an emailed link. Id. at 14–15,
J.A. 551–52. The suspect took the bait, clicking the link and
unwittingly downloading the malware. Id. at 16, J.A. 553.
Within hours, the FBI had its man. Id.
3
Flash forward seven years to October 2014, when an
American Civil Liberties Union technologist spotted a
reference to the FBI’s ruse—which had previously drawn little
public attention—in a set of FBI documents released years
earlier to an electronic privacy organization. Troubled, the
technologist took to Twitter, and within days, news of the
media impersonation tactics employed at Timberline prompted
headlines nationwide. Facing outcry from news outlets, interest
groups, and members of Congress, then–FBI Director James
Comey, Jr., penned a letter to the New York Times justifying
the tactics. But the public’s interest had already been roused.
Among those wanting to learn more were the Reporters
Committee for Freedom of the Press and the Associated Press,
appellants here, which were concerned that “[t]he utilization of
news media as a cover for delivery of electronic surveillance
software” both “endangers the media’s credibility and creates
the appearance that it is not independent of the government”
and “undermines media organizations’ ability to independently
report on law enforcement.” Letter from Reporters Committee
for Freedom of the Press et al. to Eric H. Holder, Jr., Attorney
General, U.S. Department of Justice, and James B. Comey, Jr.,
Director, FBI, at 3 (Nov. 6, 2014), J.A. 384. Between them, the
two organizations (hereinafter “the Reporters Committee”)
submitted three requests under the Freedom of Information Act
(FOIA), 5 U.S.C. § 552, seeking FBI records on the Bureau’s
policies governing media impersonation, the use of such tactics
during the Timberline investigation, and any other occasions
on which the FBI had used fake news links to deliver malware.
After the FBI responded to one request by declaring it had
found no responsive records, and failed to respond at all to the
other two, the Reporters Committee filed suit against the
Bureau and its parent agency, the Department of Justice,
claiming among other things that the FBI had conducted an
inadequate records search. During the course of litigation, the
4
FBI eventually located and released some responsive records,
most pertaining to Timberline and none identifying any other
instances of media impersonation. The Reporters Committee
insisted that the FBI’s search efforts were insufficient, but the
district court disagreed and granted summary judgment to the
agencies.
II.
“Designed ‘to facilitate public access to Government
documents,’ [FOIA] requires federal agencies to disclose
information to the public upon reasonable request unless the
records at issue fall within specifically delineated exemptions.”
Judicial Watch, Inc. v. FBI, 522 F.3d 364, 365–66 (D.C. Cir.
2008) (quoting Department of State v. Ray, 502 U.S. 164, 173
(1991)). No exemption is at issue in this appeal; rather, the lone
issue before us is whether the FBI responded to the Reporters
Committee’s FOIA requests by conducting a search adequate
to support summary judgment in the government’s favor. To
prevail on summary judgment, an “agency must show that it
made a good faith effort to conduct a search for the requested
records, using methods which can be reasonably expected to
produce the information requested,” which it can do by
submitting “[a] reasonably detailed affidavit, setting forth the
search terms and the type of search performed, and averring
that all files likely to contain responsive materials (if such
records exist) were searched.” Oglesby, 920 F.2d at 68.
“[S]ummary judgment is inappropriate” if “a review of the
record raises substantial doubt” as to the search’s adequacy,
“particularly in view of ‘well defined requests and positive
indications of overlooked materials.’” Valencia-Lucena v. U.S.
Coast Guard, 180 F.3d 321, 326 (D.C. Cir. 1999) (quoting
Founding Church of Scientology v. NSA, 610 F.2d 824, 837
(D.C. Cir. 1979)). “We review de novo the adequacy of the
[agency’s] search.” DiBacco v. U.S. Army, 795 F.3d 178, 188
(D.C. Cir. 2015).
5
Here, the government submitted two declarations from
David M. Hardy, Section Chief of the FBI’s
Record/Information Dissemination Section (“Records
Section”), which describe a two-phase search. In the first
phase, made up of so-called “targeted searches,” the Records
Section identified the Bureau divisions it considered
reasonably likely to hold responsive records, and transmitted to
each such division the verbatim text of the relevant FOIA
request along with instructions to “send an e-mail to each of its
employees asking them to search for all relevant records
pertaining to th[e] request” and “help identify all potentially
responsive documents, regardless of whether they may be
located in their office or elsewhere in the Bureau.” Declaration
of David M. Hardy ¶¶ 38–40, 43–45 (Mar. 28, 2016) (“First
Hardy Decl.”), J.A. 112–16; see also Declaration of David M.
Hardy ¶¶ 4, 6 (May 20, 2016) (“Second Hardy Decl.”), J.A.
492–93.
To facilitate the targeted searches, the FBI divided the
records sought into two groups. For Group One records—those
“concerning the FBI’s utilization of links to what are, or appear
to be, news media articles or news media websites to install”
certain malware—the Records Section ordered a targeted
search of only the Bureau’s Operational Technology Division
(“Tech Division”). First Hardy Decl. ¶¶ 34, 38–40, J.A. 110,
112–13. The Records Section reasoned that the Tech Division,
as the “Division responsible for the deployment and
implementation of” the malware used at Timberline, would be
“reasonably likely” to hold Group One records and that “no
other FBI Divisions or personnel would reasonably likely
possess” them. Id. ¶ 40, J.A. 113. For Group Two records—
including Timberline-specific documents and media-related
policy and training materials, as well as “[a]n accounting of the
number of times . . . the [FBI] has impersonated media
organizations or generated media-style material” to deliver
6
malware—the Records Section ordered targeted searches of
several internal divisions, including the FBI’s Seattle Division,
the Office of General Counsel, the Tech Division, the
Behavioral Analysis Unit, the National Covert Operations
Section, and the Training Division. Id. ¶¶ 34, 43, J.A. 110–11,
114–15.
According to the Hardy declarations, these internal
divisions “completed” the searches they were directed to carry
out. Id. ¶¶ 39, 44, J.A. 113, 115. In the case of the Group One
search, the Tech Division “advised [the Records Section] that
no records responsive to th[e] request were located within its
Division.” Id. ¶ 39, J.A. 113. In the case of the Group Two
searches, “the FBI was able to locate records responsive to [the
Reporters Committee’s] requests.” Id. ¶ 45, J.A. 116.
In the search’s second phase, the Records Section
conducted a limited index search of the FBI’s agency-wide
Central Records System (“the Index”), which “index[es] terms
in files that are useful to a particular investigation or that are
deemed potentially useful for future investigative/intelligence
retrieval purposes, such as names of individuals, organizations,
companies, publications, activities, or foreign intelligence
matters (or programs).” Id. ¶ 36, J.A. 112. Initially, the Records
Section searched the Index for Timberline records only, using
the search terms “Timberline,” “Timberline High School,” and
“Timberline Highschool.” Id. ¶ 57, J.A. 121. This search
yielded “the FBI’s main investigative file concerning” the
Timberline investigation. Id. After “[a] page by page review,”
however, the Records Section determined that the file
contained only records that the Seattle Field Office had already
unearthed through its targeted search. Id. Although the Records
Section at first declined to search the Index for Group One
records—i.e., records about other instances in which the FBI
used media links to install malware—because the Index would
7
not “programmatically or logically contain terms that would
lead to records responsive” to a request for information about
general investigatory tactics, id. ¶ 36, J.A. 112, the FBI did
later conduct an Index search for Group One records, using the
search terms “media impersonation” and “CIPAV,” the name
of the malware used in the Timberline investigation, Second
Hardy Decl. ¶ 5, J.A. 492–93. This search yielded no results.
Id.
The Reporters Committee argues that the Hardy
declarations fail to carry the government’s burden of showing
that it conducted an adequate search under this circuit’s
standards. We agree.
The declarations’ principal flaw lies in their failure to
“set[] forth the search terms and the type of search performed”
with the specificity our precedent requires. Oglesby, 920 F.2d
at 68. The declarations explain that the Records Section
“request[ed]” that each targeted office “conduct a search of
database systems, as well as paper and manual files, for records
responsive to” the Reporters Committee’s requests, and
“recommended” that each office email its employees, “asking
them to search for all relevant records.” First Hardy Decl.
¶¶ 38, 43, J.A. 112–15. The declarations go on to say that the
targeted divisions “completed” the requested searches, id.
¶¶ 39, 44, J.A. 113, 115, without ever describing how those
divisions in fact did so.
This circuit’s precedent has long made clear that an
affidavit containing “no information about the search strategies
of the [agency] components charged with responding to [a]
FOIA request” and providing no “indication of what each
[component’s] search specifically yielded” is inadequate to
carry the government’s summary-judgment burden. Morley v.
CIA, 508 F.3d 1108, 1122 (D.C. Cir. 2007); see also, e.g.,
8
Aguiar v. Drug Enforcement Administration, 865 F.3d 730,
738–39 (D.C. Cir. 2017) (affidavit identifying agency offices
“tasked with conducting a search” of specific files but not
explaining “how [the offices] searched within those files”
insufficient to support summary judgment); DeBrew v.
Atwood, 792 F.3d 118, 121–22 (D.C. Cir. 2015) (affidavit
identifying agency employees tasked with conducting search,
explaining why those employees were chosen, and detailing
search’s results insufficient “because it [did] not disclose the
search terms used by the [agency] and the type of search
performed”); Weisberg v. DOJ, 627 F.2d 365, 371 (D.C. Cir.
1980) (affidavit that fails to “denote which files were searched
or by whom, . . . reflect any systematic approach to document
location, . . . [or] provide information specific enough to enable
[a plaintiff] to challenge the procedures utilized” is
insufficient). This is so, we have explained, because “[a]
reasonably detailed affidavit, setting forth the search terms and
the type of search performed, . . . is necessary to afford a FOIA
requester an opportunity to challenge the adequacy of the
search and to allow the district court to determine if the search
was adequate in order to grant summary judgment.” Oglesby,
920 F.2d at 68.
Here, the Hardy declarations are utterly silent as to which
files or record systems were examined in connection with the
targeted searches and how any such searches were conducted,
including, where relevant, which search terms were used to
hunt within electronically stored materials. This defect is
particularly conspicuous when viewed alongside the
declarations’ far more specific description of the Index search
the Records Section conducted for Timberline records. This
latter discussion explains the Index’s nature and functionality,
identifies the search terms used to look within the Index,
describes the search results, and attests that FBI personnel
9
undertook “[a] page by page review” of those results. First
Hardy Decl. ¶ 57, J.A. 121.
Even though the Reporters Committee’s brief cites our
consistent line of cases requiring that government affidavits
describe precisely how agency components searched for
responsive documents, the government’s brief is virtually
silent on this precedent, stating only in conclusory fashion that
“[a]n agency affidavit, describing a targeted search of a specific
office as part of a broader search, does not need to elaborate
further” to achieve the level of detail FOIA requires.
Appellees’ Br. 22. This question-begging assertion fails
entirely to engage with the standards our court has developed
for determining when an affidavit has adequately “describ[ed]
a targeted search of a specific office.” Id. The government
seeks support from our 35-year-old decision in Perry v. Block,
684 F.2d 121 (D.C. Cir. 1982) (per curiam), which, as the
government points out, stated that an affidavit need not “set
forth with meticulous documentation the details of an epic
search for the requested records,” id. at 127. In Perry, however,
we also made clear—in a passage not quoted by the
government—that an affidavit must “explain in reasonable
detail the scope and method of the search conducted,” and
“urge[d] agency affiants and counsel to provide as much
specificity as possible to facilitate intelligent assessment of the
submitted information.” Id. Although the Perry court
ultimately determined that summary judgment for the
government was appropriate on the specific facts of that case,
the affiants there attested that they had personally participated
in searches of specifically identified records systems—and,
even so, the court found the affidavits “arguabl[y]
inadequa[te]” and remarked that they “could have been more
detailed.” Id. at 127 & nn.20–21.
10
Pressed at oral argument to reconcile the government’s
position here with circuit precedent, government counsel
offered a new explanation for the Hardy declarations’ failure to
describe the targeted searches with anything resembling
precision. According to counsel, in “all of [our] prior cases
talking about search terms,” plaintiffs sought “specific
information about an identifiable individual or code word . . .
or administrative warrants known to exist within a single
investigative file,” Oral Arg. at 18:12–29, whereas the FOIA
requests here sought “something nebulous and vague, not
known to exist,” id. at 21:30–33. This proposed distinction is
both wrong and irrelevant. It is wrong because our cases have
demanded greater specificity from the affidavit in connection
with equally generic FOIA requests. See, e.g., DeBrew, 792
F.3d at 121–22 (affidavit insufficient to determine adequacy of
search for “[a]ll documentation for making Conducting a
Business . . . a prohibited act” under Bureau of Prisons
guidelines). And it is irrelevant because the specifics of a
particular FOIA request have no logical bearing on an agency’s
ability to make a factual representation of what steps it has
taken to honor the request. Here, for example, the FBI could
have explained that it was difficult to come up with search
terms reasonably calculated to turn up the records the Reporters
Committee sought and then gone on to describe how it
attempted to work around that difficulty. Because the FBI
failed to offer any such explanation, the Reporters Committee
was left without “information specific enough . . . to challenge
the procedures utilized,” Weisberg, 627 F.2d at 371, and this
court lacks any basis for “determin[ing] if the search was
[sufficiently] adequate in order to grant summary judgment” to
the government, Oglesby, 920 F.2d at 68.
III.
Although the Hardy declarations’ inadequate detail is
alone sufficient to require reversal, the Reporters Committee
11
has identified two additional aspects of the FBI’s search that
concern us.
A.
The Reporters Committee argues that the FBI failed to
justify its decision to limit its search for Group One records,
i.e., “records concerning the FBI’s utilization of links to what
are, or appear to be, news media articles or news media
websites to install” malware, to the Tech Division, while
searching more broadly for “documents referring to the
decision to create the fake [Associated Press] news article in
the Timberline High School case.” First Hardy Decl. ¶ 34, J.A.
110–11. Because the former set of requested records
encompasses the latter, the Reporters Committee insists, the
FBI acted illogically in declining to consider that locations
reasonably likely to hold Timberline-specific records would be
similarly likely to hold records pertaining more generally to
other instances of media impersonation.
We agree that the FBI could have better justified its search
methods. For Timberline documents, the Records Section
ordered targeted searches of a number of Bureau divisions,
including the Office of General Counsel, the Tech Division, the
Behavioral Analysis Unit, the National Covert Operations
Section, and the Training Division, id. ¶ 43, J.A. 114–15; by
contrast, for the broader set of Group One documents, Records
ordered a targeted search of the Tech Division alone, id. ¶ 38,
J.A. 112–13. Attempting to justify this distinction, the FBI
points out that the Group One request sought records linking
media impersonation to the installation of malware, whereas
the Timberline request sought records relating only to the
decision to impersonate the press in the first place. Because
“the FBI’s policy specifically states that [the Tech Division] is
solely responsible for the deployment and collection of all
lawfully conducted electronic surveillance [B]ureau wide,”
12
Second Hardy Decl. ¶ 4, J.A. 491, the FBI reasoned, nowhere
else was likely to hold records regarding the use of malware.
This does not follow. Certainly, the Tech Division’s role
in approving malware use makes it likely to hold relevant
records. But that hardly means that “no other FBI Divisions or
personnel would reasonably likely possess records” regarding
the tactics used to deploy such malware. First Hardy Decl. ¶ 40,
J.A. 113. Indeed, the Timberline incident provides a ready
illustration of just what those other divisions might be. For
example, record evidence demonstrates that the agents
involved in the Timberline investigation conferred with the
Behavioral Analysis Unit regarding how best to deliver
malware. See OIG Report at 12, J.A. 549. Further undermining
its claim that malware-related records were likely to appear
nowhere but the Tech Division, the Bureau on its own accord
elected to group the request for “an accounting of the number
of times . . . that the [FBI] has impersonated media
organizations or generated media-style material . . . to deliver
malicious software,” First Hardy Decl. ¶ 34, J.A. 111
(emphasis added), with the Group Two requests for which it
ordered multiple targeted searches and not with the Group One
request for which it searched only the Tech Division.
Put simply, given the FBI’s determination that certain
divisions were “reasonably likely” to hold records relating to a
specific instance where media impersonation was used to
deliver malware, its failure to search these very same divisions
for records relating to other such instances leaves us unable to
conclude, barring some explanation, that the FBI searched for
the latter records in a manner “reasonably expected to produce
the information requested.” Oglesby, 920 F.2d at 68.
In making this observation, we take no position on the
adequacy of the FBI’s explanation for performing an Index
13
search for Timberline records but, at least initially, not for the
broader set of Group One records. The Hardy declarations
justified this distinction by remarking that the Timberline
request referenced a particular, named event likely to be
indexed (and thus searchable) in the Index, First Hardy Decl.
¶ 41, J.A. 114, whereas an Index search for Group One records
would likely have garnered little because “it would be highly
unlikely for FBI personnel to index files . . . under the name of
a specific technique generally or specifically in reference to
impersonating a member of the media,” Second Hardy Decl.
¶ 2, J.A. 490. Suffice it to say that the FBI did eventually
conduct an Index search for Group One records, and save a
passing mention in a footnote in its opening brief, the Reporters
Committee does not challenge the adequacy of this search.
B.
The Reporters Committee also argues that the search was
inadequate because the record contains “lead[s] that [are] both
clear and certain,” Kowalczyk v. DOJ, 73 F.3d 386, 389 (D.C.
Cir. 1996), that should have prompted the FBI to search
additional offices—i.e., the FBI Director’s Office, field offices
other than the Seattle office, and the offices responsible for
assisting with a 2016 Office of the Inspector General (OIG)
report concerning Timberline and the FBI’s media
impersonation policies. Beginning with the Director’s Office,
we consider each of these offices in turn.
Recall that the Reporters Committee and the Associated
Press submitted their FOIA requests amidst a national
controversy over revelations regarding the FBI’s media
impersonation tactics. The Attorney General and FBI Director
were receiving letters from concerned interest groups and even
members of Congress. At the same time, the FBI was
responding to articles covering the matter in the popular press,
and the FOIA requests specifically referenced these responses.
14
See Letter from Raphael Satter, Associated Press, to FBI, at 2
(Nov. 6, 2014), J.A. 27 (citing an FBI special agent’s comment
to the Seattle Times); Letter from Adam Marshall & Hannah
Bloch-Wehba, Reporters Committee for Freedom of the Press,
to FBI, at 2 n.1 (Oct. 31, 2014), J.A. 31 (citing Washington Post
article that contains remarks from FBI officials).
The record unmistakably establishes that the FBI
Director’s Office was intimately involved in coordinating the
Bureau’s response. Indeed, in his letter to the editor in the New
York Times, then-Director Comey called the Timberline tactics
“proper and appropriate under Justice Department and [FBI]
guidelines at the time,” while reassuring the public that by the
time of the letter’s November 2014 publication, “the use of
such an unusual technique would probably require higher level
approvals than in 2007.” James B. Comey, Director, FBI,
Letter to the Editor, “To Catch a Crook: The F.B.I.’s Use of
Deception,” New York Times, Nov. 6, 2014. Although the
Director’s letter reveals that he was privy to information
covered by the FOIA request for “records concerning the FBI’s
guidelines and policies concerning undercover operations or
activities in which a person may act as a member of the news
media,” First Hardy Decl. ¶ 34, J.A. 111, the Bureau never
searched his office.
We acknowledge that “it will be the rare case indeed in
which an agency record contains a lead so apparent that the
[agency] cannot in good faith fail to pursue it.” Kowalczyk, 73
F.3d at 389. Nevertheless, we find this exacting standard
satisfied here, where the record reveals an agency office
directly and conspicuously weighing in on a pointedly relevant,
highly public controversy to which a FOIA request expressly
refers. See Valencia-Lucena, 180 F.3d at 327 (“[I]f an agency
has reason to know that certain places may contain responsive
15
documents, it is obligated under FOIA to search barring an
undue burden.”).
By contrast, we disagree with the Reporters Committee
that references in the record to regional offices other than
Seattle’s and the September 2016 release of an OIG report
concerning Timberline and the FBI’s media impersonation
policies constitute “clear and certain” indications that
additional, unsearched offices held responsive records.
Kowalczyk, 73 F.3d at 389.
On the first point, the Reporters Committee identifies
fleeting references in the record to other FBI field offices that
have utilized malware in conducting investigations. None of
these references, however, offers any hint—let alone a clear
indication—that the FBI used media impersonation as the
particular means of deploying the malware.
On the second point, while the OIG report certainly
indicates that the offices assisting with its preparation held
records at some point prior to September 2016, the FBI utilized
cutoff dates of January 6, 2015, and earlier, directing its
divisions to search only for records held prior to those dates.
Second Hardy Decl. ¶¶ 4, 6, J.A. 492–93. But despite
contesting these cutoff dates in the district court, the Reporters
Committee failed in its opening brief here to challenge that
court’s rejection of its argument and so has forfeited the
opportunity to do so. See Russell v. Harman International
Industries, Inc., 773 F.3d 253, 255 n.1 (D.C. Cir. 2014)
(argument not raised in opening brief on appeal is forfeited).
And the OIG report contains no clear indication that
participating offices held responsive records prior to the cutoff
dates, more than a year and a half before the report was issued.
Finally, to the extent the Reporters Committee argues that
the OIG report calls the adequacy of the search into question
16
because it refers to a handful of Timberline-related documents
that the search apparently failed to turn up, “the adequacy of a
search is ‘determined not by the fruits of the search, but by the
appropriateness of [its] methods.’” Hodge v. FBI, 703 F.3d
575, 580 (D.C. Cir. 2013) (alteration in original) (quoting
Iturralde v. Comptroller of the Currency, 315 F.3d 311, 315
(D.C. Cir. 2003)). That a few responsive documents may have
slipped through the cracks does not, without more, call into
question the search’s overall adequacy. See Mobley v. CIA, 806
F.3d 568, 583 (D.C. Cir. 2015) (“[A] search, under FOIA, ‘is
not unreasonable simply because it fails to produce all relevant
material.’” (quoting Meeropol v. Meese, 790 F.2d 942, 952–53
(D.C. Cir. 1986))).
IV.
Finding that material factual questions remain as to the
adequacy of the FBI’s search, we reverse and remand to the
district court for further proceedings consistent with this
opinion.
So ordered.