Implementing FOIA's Statutory Exclusion Provisions

Background

Over twenty-five years ago, in 1986, Congress amended the Freedom of Information Act (FOIA) to provide special protection for three categories of particularly sensitive law enforcement records. For these three specifically defined categories of records, Congress provided that federal law enforcement agencies "may treat the records as not subject to the requirements of [the FOIA]." 5 U.S.C. § 552(c). These provisions, which are referred to as "exclusions" provide protection in three limited sets of circumstances where publicly acknowledging even the existence of the records could cause harm to law enforcement or national security interests.

The Three Exclusions

The first exclusion protects against disclosure of a pending criminal law enforcement investigation where there is reason to believe that the target is unaware of the investigation and disclosure of its existence could reasonably be expected to interfere with enforcement proceedings. The second exclusion, which applies only to records maintained by criminal law enforcement agencies, protects against disclosure of unacknowledged, confidential informants. The third exclusion, which applies only to the FBI, protects against disclosure of foreign intelligence or counterintelligence, or international terrorism records, when the existence of those records is classified.

The exclusions address three especially sensitive situations arising in the criminal law enforcement or national security context where invoking an exemption will not afford adequate protection because the very act of citing the exemption confirms the existence of the protected records. At the same time, using a "Glomar" response, i.e., a response where the agency neither confirms nor denies the existence of the records, is not viable or practicable because it would need to be applied to a broad range of requests in order to be effective, which would greatly limit the FOIA's access provisions. Indeed, when Congress amended the FOIA to include exclusions, the "neither confirm nor deny" response was already in existence and used by agencies for certain categories of requests. As is explained in the guidance issued by former Attorney General Meese addressing the 1986 amendments to the FOIA, it was because the Glomar response "inadequately protects against the particular harms in question that the more delicate exclusion mechanism, which affords a higher level of protection, sometimes must be employed." The exclusions themselves describe the three narrow categories of records where a "neither confirm nor deny" response would not be adequate.

For example, when a criminal law enforcement investigation is ongoing, and the target is unaware that it is pending, but suspects that he is under investigation, he might make a FOIA request for records on himself to see if he could find out whether he was being investigated. If the agency were to respond by advising the requester that it did, in fact, have records responsive to his request, but they were being withheld under Exemption 7(A), which protects records when disclosure could reasonably be expected to interfere with enforcement proceedings, the assertion of the exemption by the agency would reveal to the requester the very thing the agency needed to protect, i.e., the existence of the ongoing investigation.

If the agency were to respond by saying it could neither confirm nor deny the existence of records, i.e., provide a Glomar response, it would have to answer that way for all requests where someone asked for records on themselves, because a Glomar response is not effective unless it is used for all similar requests. That, in turn, would mean that the vast majority of requesters seeking records on themselves would receive Glomar responses, even though the chance that any particular requester was the target of an investigation covered by an exclusion would be extremely low.

To avoid both of these scenarios, exclusions authorize the agency to "treat the records as not subject to the requirements of the [FOIA]." This permits an agency to respond to a request seeking excluded records without revealing their existence, while also allowing the agency to respond to the vast majority of requests in the traditional manner, i.e., by advising the requester whether records exist, and if they do, by releasing any information that is not exempt and asserting exemptions for any material properly protected from disclosure.

In another example, if a criminal enterprise suspected it was infiltrated by an informant, it could try to uncover the suspected informant by using the FOIA. The enterprise could require the suspected informant to provide a privacy waiver and then could make a FOIA request to a law enforcement agency such as the FBI seeking any records on that individual. The submission of the privacy waiver would preclude the criminal law enforcement agency from using a privacy-based Glomar response. Without the exclusion, the law enforcement agency which was working with that informant in the criminal enterprise would be in an untenable position. Invoking Exemption 7(D), which protects confidential informants, would tip off the criminal enterprise that indeed it had been infiltrated. To address just such a scenario, the second exclusion removes criminal law enforcement informant records from the requirements of the FOIA, when they are requested by a third party, thereby providing protection for the confidential informant.

For all three exclusions, the records are removed from the requirements of the FOIA only during the time that the specific requirements of each exclusion are met. Thus, once the target of a criminal law enforcement investigation becomes aware of the existence of the ongoing investigation, the first exclusion would no longer apply. Similarly, once a confidential informant's status as an informant has been officially confirmed the second exclusion would no longer apply. Finally, when the existence of FBI foreign intelligence, counterintelligence, or international terrorism records is no longer classified, the third exclusion would not apply.

Handling of Excluded Records Under the Meese Guidelines

Since 1987, agencies have handled records excluded under these provisions according to the publicly available guidelines issued by Attorney General Meese. The Meese Guidance provided, among other things, that where the only records responsive to a request were excluded from FOIA by statute, "a requester can properly be advised in such a situation that 'there exist no records responsive to your FOIA request.'" The Meese Guidance also stated that it was "essential that all agencies that could potentially employ at least one of the three exclusions ensure that their FOIA communications are consistently phrased accordingly." Otherwise the protection afforded by the exclusion could be "undermined, even indirectly, by the form or substance of an agency's actions." These practices laid out in Attorney General Meese's Guidance have governed agency practice for more than twenty-five years.

Increased Transparency and Accountability Regarding Exclusions

The Department has examined those past practices governing use of exclusions to determine whether there are ways to bring greater accountability and transparency to the existence and use of exclusions in the FOIA without compromising the important national security and law enforcement interests that are at stake. As a result of that review, the Department has determined that there are a series of steps that agencies should take going forward that will achieve these goals.

1. Consultation with Office of Information Policy
   
   As a threshold matter, given the unusual nature of the exclusion provisions, the limited circumstances in which they apply, and the relative infrequency with which they are employed, any agency considering whether to invoke an exclusion should consult first with the Office of Information Policy. This will help ensure that all aspects of the request and possible excludable records are reviewed and analyzed before determining whether use of an exclusion is warranted.
    
2. Public Reporting on Exclusion Use
   
   In order to have a greater understanding of the government's use of exclusions, it is important for the public to know how often exclusions are invoked and by which agencies. To accomplish that, the Department has established a new reporting requirement that directs agencies to publicly report each year on the number of times, if any, that they invoked an exclusion. This reporting will be required yearly, as part of each agency's Chief FOIA Officer Report.
   
   This new reporting requirement began with the 2012 Chief FOIA Officer Reports and immediately revealed the limited number of times exclusions had been invoked. Only three agencies out of the ninety-nine subject to the FOIA in Fiscal Year 2011 reported having invoked an exclusion during the preceding fiscal year. Those agencies were the Department of Justice, the Department of Homeland Security, and EPA, which has some criminal law enforcement responsibilities.
   
   Specifically, the Department of Justice reported using exclusions in 147 requests out of the 63,992 requests that were processed in Fiscal Year 2011. The Department of Homeland Security reported using exclusions in less than twenty-eight requests out of the 145,631 requests processed in Fiscal Year 2011, and EPA reported using an exclusion three times out of the 10,435 requests it processed during that fiscal year. In total, out of 631,424 requests processed across the government in Fiscal Year 2011, exclusions were invoked in less than 178 cases, which is 0.03% of all processed requests. Because of this new public reporting requirement, interested members of the public can now readily see the extremely limited number of cases in which exclusions are invoked.
    
3. Description of Exclusions on Agency FOIA Websites
   
   In addition to public reporting, each agency can bring greater transparency to the topic of exclusions by ensuring that their FOIA website contains a brief description of the three statutory exclusions. In that way, when a member of the public is reviewing an agency's FOIA website in anticipation of making a FOIA request, he or she will be made aware of the fact that in addition to the nine exemptions to the FOIA there are also three narrow categories of records that can be excluded. An agency's FOIA Reference Guide is a logical place to include such a description.
    
4. Individual Notification in Response Letters
   
   Because exclusions are limited to criminal law enforcement records or to certain national security records of the FBI, most agencies will never have occasion to invoke an exclusion. That fact is evident from the public reporting that the Department of Justice now requires and which showed that in Fiscal Year 2011 only three agencies used an exclusion.
   
   While their use is quite limited, the Department is hereby changing its previous guidance concerning how law enforcement components where excluded records might exist should word their responses to FOIA requests. Going forward, when a component that maintains criminal law enforcement records responds to a request, it should notify the requester that the FOIA excludes certain records from the requirements of the FOIA and that the agency’s response addresses only those records that are subject to the FOIA. To ensure that these notifications do not themselves reveal the existence of excluded records in a particular case, those components of agencies that maintain criminal law enforcement records and might possibly use an exclusion should include the notification in response to all their requests.
   
   For example, the FBI and Federal Bureau of Prisons within the Department of Justice, as well as U.S. Customs and Border Protection and Immigration and Customs Enforcement within the Department of Homeland Security (DHS), which are all agency components that maintain criminal law enforcement records, should include the notification in all their response letters. Beyond DHS and the Department of Justice, there are other agencies with components that maintain criminal law enforcement records, such as EPA's Office of Enforcement and Compliance Assurance, or any agency's Office of Inspector General. These agency components should likewise be including a notification about exclusions in response to all their requests.
   
   Including such a notification represents a fresh approach to the handling of exclusions. This approach both informs requesters of the existence of the statutory exclusions in general, but does not acknowledge the existence of any excluded records in response to any specific request. This new approach will thus preserve the important law enforcement and national security interests that formed the basis for Congress’ inclusion of exclusions in the FOIA over twenty-five years ago, while at the same time be in keeping with Attorney General Holder’s commitment to open government.

4(a). Content of New Language Addressing Exclusions for Response Letters

Because exclusions are limited to criminal law enforcement records or certain national security-related records maintained by the FBI, the FBI and all agency components that maintain criminal law enforcement records should include the following language in response to all their requests:

“For your information, Congress excluded three discrete categories of law enforcement and national security records from the requirements of the FOIA. See 5 U.S.C. 552(c). This response is limited to those records that are subject to the requirements of the FOIA. This is a standard notification that is given to all our requesters and should not be taken as an indication that excluded records do, or do not, exist.”

This language should be a standard notification that is included in the FOIA responses of the FBI and other agency components that maintain criminal law enforcement records.

4(b). Impact of Notification

Significantly, in the limited circumstances where an exclusion is actually invoked, this new notification requirement will ensure that the agency is providing to the requester in its response letter three important facts. The letter with the notification will:

• advise the requester of the existence of the three statutory exclusions,
• inform the requester that excluded records are not subject to the requirements of the FOIA, and
• put the requester on notice that any excluded records are not part of the response being provided by the agency.

With the excluded records addressed by virtue of this notification, the criminal law enforcement component can then respond to the remainder of the request in the usual way, advising the requester of the handling of any records that exist that are subject to the FOIA. This new, more transparent approach will provide requesters with a clear explanation of the agency’s actions and the reasoning behind the handling of requests.

Conclusion

This guidance is intended to provide greater transparency and accountability to a distinct aspect of the FOIA, which while used in a very limited number of cases, is expressly part of the FOIA statute and is necessary to protect vital law enforcement and national security interests. Using this multi-layered approach to implementing the FOIA's statutory exclusion provisions will ensure that the public is better informed about the existence of records that are "excluded" or outside the requirements of the FOIA.

The new reporting requirement contained in Chief FOIA Officer Reports will allow the public to readily see the extent to which exclusions are employed each year and by which agencies. The description of exclusions on agency websites will further increase public understanding of this distinct part of the law. Lastly, this new approach ensures that requesters to law enforcement components where excluded records might exist are advised that there are records outside the requirements of the FOIA and that such records are not part of the agency's response. At the same time, because the notification will be included in any response made by a criminal law enforcement component, its inclusion will not reveal in any specific case whether excluded records were located or not. In its totality this new approach will ensure greater transparency and accountability in the handling of statutory exclusions.