Cause of Action Institute v. Export-Import Bank of the United States

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

CAUSE OF ACTION INSTITUTE,

Plaintiff, v. Civil Action No. 19-1915 (JEB)

EXPORT-IMPORT BANK OF THE UNITED STATES,

Defendant.

MEMORANDUM OPINION

In round two of this Freedom of Information Act bout, the parties return to the Court to dispute the updated document redactions and withholding rationales put forth by Defendant Export-Import Bank of the United States in response to two FOIA requests by Plaintiff Cause of Action Institute. Last spring, this Court delivered a mixed bag of results on cross-motions for summary judgment. Complete resolution was not to be had, as the Court determined that EXIM had not provided sufficient justification for several of its withholdings and thus gave the Bank another shot.

On this second go-round, the Court is able to resolve all of COA’s challenges to 41 documents that EXIM has continued to withhold after reprocessing its original production in light of the Court’s prior Opinion. The Court once again delivers a split verdict: it will affirm the Bank’s withholding of some records and order the release of others.

2

I. Background Having previously summarized the relatively straightforward background of this case in its prior Opinion, see Cause of Action v. Export-Import Bank of the United States, 521 F. Supp. 3d 64 (D.D.C. 2021), the Court recounts it only briefly here.

COA, a non-partisan government-oversight organization, filed two FOIA requests seeking records from EXIM Bank, an independent agency that finances exports of various goods and services. The first, filed on September 20, 2018, sought “records reflecting communications involving four senior EXIM officials regarding a series of individuals and business entities.” Id. (citing ECF No. 1-1 (FOIA Request # 201800076F)). COA filed a second request on May 24, 2019, seeking “additional records from agency officials pursuant to a handful of new search terms.” Id. at 74 (citing ECF No. 1-3 (FOIA Request # 201900047F)). This request generally sought “communications among EXIM employees during congressional hearings for Kimberly Reed’s nomination to be the Bank’s President, as well as information relating to certain Government Accountability Office oversight activities.” Id. (citing ECF No. 1 (Complaint)).

After EXIM did not immediately respond to the requests, Plaintiff filed suit on June 26, 2019. Id. The Bank eventually produced “783 responsive records totaling 7,633 pages between August 2019 and February 2020.” Id. (citing ECF No. 27-3 (Declaration of Lennell Jackson), ¶ 47; ECF No. 22 (3/3/20 Joint Status Rep.) at 1–2). Many of these records were fully or partially redacted, and Plaintiff indicated its intent to challenge certain of those withholdings. Id. (citing ECF No. 28-4 (Declaration of Ryan P. Mulvey), ¶ 6; id. at ECF pp. 30–474 (disputed redacted records)). Both parties then moved for summary judgment, and, after reviewing the documents in camera, this Court issued an Opinion granting in part and denying in part those motions. Id. at 75–76, 96–97. The details of that 42-page Opinion need not be belabored here;

3

suffice it to say that this Court required EXIM to “go back and further show its work” if it wished to maintain some of its redactions. Id. at 74.

EXIM did just that. The Bank proceeded to reprocess the withheld records and disclose some of the previously redacted documents in part or in full. See ECF No. 40-2 (2d Declaration of Lennell Jackson), ¶ 8. It produced these documents on April 6 and 7, 2021, maintaining redactions primarily under FOIA Exemptions 4 and 5. Id., ¶¶ 8, 12. Plaintiff informed the Bank of its intent to challenge 41 of these withheld records on April 23, 2021. Id., ¶ 10. The parties agreed to consolidate the challenged documents in one production and prepared an updated Vaughn Index reflecting that. Id., ¶ 11; see also ECF No. 40-5 (Updated Vaughn Index); ECF No. 41-6 (2d Declaration of Ryan Mulvey, Exh. B – Redacted Records, Vol. 1); No. 41-7 (2d Declaration of Ryan Mulvey, Exh. B – Redacted Records, Vol. 2). The Court refers to that production and the updated Vaughn Index throughout this Opinion.

EXIM once again moved for summary judgment on June 25, 2021. See ECF No. 40 (Def. MSJ). In response to Plaintiff’s Opposition and Cross-Motion for Summary Judgment, see ECF No. 41-1 (Pl. Opp./Cross-MSJ), this Court ordered EXIM to submit unredacted copies of the challenged documents for in camera review, which the Bank did on December 14. See Minute Order of December 10, 2021; ECF No. 47 (Note of Delivery). Having now reviewed those documents and the parties’ briefing, the Court is prepared to rule. II. Legal Standard Summary judgment must be granted if “the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a); see also Anderson v. Liberty Lobby, 477 U.S. 242, 247–48 (1986); Holcomb v. Powell, 433 F.3d 889, 895 (D.C. Cir. 2006). A fact is “material” if it is capable of affecting the

4

substantive outcome of the litigation. See Liberty Lobby, 477 U.S. at 248; Holcomb, 433 F.3d at 895. A dispute is “genuine” if the “evidence is such that a reasonable jury could return a verdict for the nonmoving party.” Liberty Lobby, 477 U.S. at 248; see also Scott v. Harris, 550 U.S. 372, 380 (2007); Holcomb, 433 F.3d at 895. “A party asserting that a fact cannot be or is genuinely disputed must support the assertion” by “citing to particular parts of materials in the record” or “showing that the materials cited do not establish the absence or presence of a genuine dispute, or that an adverse party cannot produce admissible evidence to support the fact.” Fed. R. Civ. P. 56(c)(1).

FOIA cases typically and appropriately are decided on motions for summary judgment.

See Brayton v. Office of the U.S. Trade Representative, 641 F.3d 521, 527 (D.C. Cir. 2011). In a FOIA case, a court may grant summary judgment based solely on information provided in an agency’s affidavits or declarations when they “describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the information withheld logically falls within the claimed exemption, and are not controverted by either contrary evidence in the record nor by evidence of agency bad faith.” Larson v. Department of State, 565 F.3d 857, 862 (D.C. Cir. 2009) (citation omitted). Such affidavits or declarations “are accorded a presumption of good faith.” SafeCard Services, Inc. v. SEC, 926 F.2d 1197, 1200 (D.C. Cir. 1991). “Unlike the review of other agency action that must be upheld if supported by substantial evidence and not arbitrary or capricious,” FOIA “expressly places the burden ‘on the agency to sustain its action’ and directs the district courts to ‘determine the matter de novo.’” U.S. Department of Justice v. Reporters Committee for Freedom of Press, 489 U.S. 749, 755 (1989) (quoting 5 U.S.C. § 552(a)(4)(B)).

5

III. Analysis Congress enacted FOIA “to pierce the veil of administrative secrecy and to open agency action to the light of public scrutiny.” Department of Air Force v. Rose, 425 U.S. 352, 361 (1976) (citation omitted). “The basic purpose of FOIA is to ensure an informed citizenry, vital to the functioning of a democratic society, needed to check against corruption and to hold the governors accountable to the governed.” John Doe Agency v. John Doe Corp., 493 U.S. 146, 152 (1989) (citation omitted).

To further that purpose, the statute provides that “each agency, upon any request for records which (i) reasonably describes such records and (ii) is made in accordance with published rules[,] . . . shall make the records promptly available to any person.” 5 U.S.C. § 552(a)(3)(A). The Government need not, however, turn over requested information that falls into one of nine statutorily created exemptions from FOIA’s broad directive. See id. § 552(b)(1)–(9). “Those exemptions,” the Supreme Court has explained, “are as much a part of FOIA’s purposes and policies as the statute’s disclosure requirement.” Food Marketing Institute v. Argus Leader Media, 139 S. Ct. 2356, 2366 (2019) (quoting Encino Motorcars, LLC v. Navarro, 138 S. Ct. 1134, 1142 (2018)) (cleaned up). Where an agency withholds records, it bears the burden of showing that at least one of the exemptions applies. See Vaughn v. Rosen, 523 F.2d 1136, 1144 (D.C. Cir. 1975). In order to carry that burden, the Government must provide a “relatively detailed justification” for its withholding, “specifically identifying the reasons why a particular exemption is relevant.” Morley v. CIA, 508 F.3d 1108, 1122 (D.C. Cir. 2007) (quoting King v. U.S. Department of Justice, 830 F.2d 210, 219 (D.C. Cir. 1987)). Courts can compel the release of any records that do not satisfy the requirements of at least one exemption. See Reporters Committee, 489 U.S. at 755.

6

Here, EXIM seeks to maintain redactions of 41 separate documents, most of which it justifies with citations to FOIA Exemptions 4 and 5. See Vaughn Index. Before delving into those exemptions, the Court considers three records that the Bank asserts fall outside of FOIA’s scope entirely. It then moves on to Exemption 5, which is cited — sometimes alongside Exemption 4 — to withhold the greatest number of records. The Court next takes up the Exemption 4 withholdings, examining only redactions for which either Exemption 4 was the sole exemption cited or that the Court determines are not supported by Exemption 5. See Center for National Security Studies v. U.S. Department of Justice, 331 F.3d 918, 925 (D.C. Cir. 2003) (explaining that court “need not address [any] other exemptions invoked” for particular withholding justified by a single exemption). Finally, the Court briefly addresses Plaintiff’s general challenge to Defendant’s decisions about segregability of withheld information.

A. Records Outside of FOIA’s Scope FOIA empowers federal courts “to order the production of any agency records improperly withheld from the complainant.” 5 U.S.C. § 552(a)(4)(B) (emphasis added). While the statute is clear that this power extends only to the release of “agency records,” it never defines that term. Forsham v. Harris, 445 U.S. 169, 178 (1980). Courts have established, nonetheless, that “agency” does not include “the President, his ‘immediate personal staff, or units in the Executive Office whose sole function is to advise and assist the President.’” Judicial Watch, Inc. v. U.S. Secret Service, 726 F.3d 208, 216 (D.C. Cir. 2013) (quoting Kissinger v. Reporters Committee for Freedom of the Press, 445 U.S. 136, 156 (1980)) (cleaned up). In addition, not all records in the possession of an agency subject to FOIA are “agency records” for purposes of the Act; for instance, some may still qualify as executive records. Judicial Watch, 726 F.3d at 216.

7

The parties here clash over whether EXIM has properly withheld portions of a two-page email chain. See Def. MSJ at 7–8; Pl. Opp./Cross-MSJ at 4–14; ECF No. 44 (Def. Repl./Opp.) at 1–4. The chain consists of several brief messages between an EXIM employee and Mark Calabria, then “chief economist for Vice President Pence,” setting up a phone call. See Vaughn Index, line 15; 2d Jackson Decl., ¶ 33. EXIM produced the messages from its employee, but it redacted the messages from Calabria as “EOP [Executive Office of the President] not subject to FOIA.” See Redacted Records, Vol. 1 at 000067–000068. These withholdings are warranted, says Defendant, because FOIA does not apply to units in the EOP whose sole function is to advise the President, as Calabria’s is. See Def. MSJ at 7–8. EXIM made no other arguments to justify these withholdings. Plaintiff counters that the redaction of these portions of the email chain constitutes improper “segmentation” of a record — that is, splicing one record into several smaller records to avoid producing some — and that, in any event, these portions fall within FOIA’s scope. See Pl. Opp./Cross-MSJ at 4–14.

Given Plaintiff’s focus on Defendant’s supposed segmentation, the Court finds it helpful to begin by defining the record at issue. Although COA suggests that Defendant has improperly broken this email chain into separate emails, defining each as an individual record in order to withhold the emails from Calabria, that misrepresents EXIM’s position. Id. at 5–8. The Bank has not argued that the email chain should be understood as a series of separate records; rather, it contends that it has redacted portions of a single record — the email chain — claiming that they fall outside of FOIA’s scope. See Def. MSJ at 7–8; Def. Repl./Opp. at 4–10. Although the Court finds it difficult to comprehend why the Bank insists on withholding the redacted portions of this entirely innocuous email chain, it nonetheless endeavors to assess whether FOIA entitles Plaintiff to the production of this record in full.

8

Whether the withheld emails fall outside FOIA’s scope turns on whether or not they are “agency records.” That term “extends only to those documents that an agency both (1) ‘create[s] or obtain[s],’ and (2) ‘control[s] . . . at the time the FOIA request [was] made.’” Judicial Watch, 726 F.3d at 216 (quoting U.S. Department of Justice v. Tax Analysts, 492 U.S. 136, 144–45 (1989)). There is no dispute that the first prong is satisfied, as EXIM has at least obtained the emails, but the parties spar over the control prong.

Typically, courts in this Circuit look to four factors to determine “whether an agency has sufficient ‘control’ over a document to make it an ‘agency record.’” Judicial Watch, 726 F.3d at 218 (quoting Tax Analysts v. U.S. Department of Justice, 845 F.2d 1060, 1069 (D.C. Cir. 1988)). Those are:

(1) the intent of the document’s creator to retain or relinquish control over the records;

(2) the ability of the agency to use and dispose of the record as it sees fit;

(3) the extent to which agency personnel have read or relied upon the document; and

(4) the degree to which the document was integrated into the agency's record system or files.

Burka v. U.S. Department of Health and Human Services, 87 F.3d 508, 515 (D.C. Cir. 1996). When the control question involves records obtained from or prepared in response to requests from an agency not covered by FOIA, however, the D.C. Circuit has held that a modified version of this test applies. Judicial Watch, 726 F.3d at 224. This “modified control test” “renders the first two factors of the standard test effectively dispositive” and essentially asks in this case whether the EOP has expressed its intent to retain control over the records. Id. at 221–24, 231.

Defendant argues, however, that this test has no application here, since Calabria’s status as a member of a “unit of the Executive Office whose sole function is to advise and assist the President” renders his communications exempt from FOIA under decisions of the Supreme Court

9

and the D.C. Circuit. See Def. MSJ at 7–8 (citing Kissinger, 445 U.S. at 156, and Judicial Watch, 726 F.3d at 226); Def. Repl./Opp. at 1–4. That position, however, overstates the holdings of those cases. In Kissinger, the Supreme Court established that FOIA does not extend to “the President’s immediate personal staff or units in the Executive Office whose sole function is to advise and assist the President,” 445 U.S. at 156, and the D.C. Circuit later clarified that that group includes members of the Vice President’s office. Wilson v. Libby, 535 F.3d 697, 708 (D.C. Cir. 2008). Documents created by individuals in those offices are thus “not ‘agency records’ when they [are] made,” and so it is “undisputed that a requester could not use FOIA to compel the President or his advisors to disclose their own [documents].” Judicial Watch, 726 F.3d at 216 (quoting Kissinger, 445 U.S. at 156). That holding does not mean, however, that all documents generated by members of the EOP can never be subject to FOIA; indeed, in Judicial Watch, one of the two cases on which Defendant relies for this proposition, the D.C. Circuit did not apply such a bright-line rule. Id. at 218–24. Instead, that court applied the modified-control test to determine whether records created by the EOP but now in the possession of a FOIA- covered agency were “agency records.” Id. The Court believes that the same approach is appropriate here because, although the emails were created by EOP, they are now in the possession of the Bank, which is a FOIA-covered agency.

The core inquiry under the modified-control test is whether the FOIA-exempt entity “manifested a clear intent to control the document” at issue. Judicial Watch, 726 F.3d at 221 (internal quotation marks and citation omitted). Defendant, presumably because it does not believe this inquiry relevant, has proffered nothing this time to demonstrate this intent. By reference to a footnote in its Reply from the first round of summary-judgment briefing, the Bank briefly argues that the Presidential Records Act establishes the requisite evidence of control. See

10

Def. Repl./Opp. at 3 (citing ECF No. 31 at 8 n.2). That argument holds no water, for the manifestation of intent to control the document must not be “too general”; rather, it requires a “specific showing of [EOP] intent to control documents sought by FOIA requesters.” United We Stand America, Inc. v. IRS, 359 F.3d 595, 602 (D.C. Cir. 2004); see also Judicial Watch, 726 F.3d at 228 (“Congress did not intend the PRA to diminish the scope of FOIA.”).

In Judicial Watch, for example, a memorandum of understanding existed that led the court to conclude that the FOIA-exempt agency had “manifested a clear intent to control the document[s].” 726 F.3d at 221, 223. That memorandum explicitly directed that any information provided to the FOIA-covered agency “is provided under an express reservation of White House control” and required the agency to “regularly transfer all [White House] Records in its possession to the White House.” Id. at 223 (internal quotation marks and citations omitted). Defendant has offered nothing comparable to that explicit declaration of continued control here. The Court, therefore, cannot conclude that the first two factors of the Burka test — which assess the “intent of the document’s creator to retain or relinquish control over the records” and “the ability of the agency to use and dispose of the record as it sees fit,” Judicial Watch, 726 F.3d at 218 (citations omitted) — weigh in favor of continued control by the EOP. Nor would it conclude, if consideration of the third and fourth factors were appropriate, that they weigh in the EOP’s favor, as EXIM personnel have certainly “read or relied upon the” emails, and the emails appear to have been fully “integrated into the agency’s record system or files.” Id. Indeed, the normal course of email exchanges would lead one to believe that emails they receive from another entity do not remain in that entity’s control.

Since the Court determines that these records fall within FOIA’s scope and must be disclosed, it need not address Plaintiff’s alternative argument that the Bank cannot withhold

11

portions of a responsive record as “part-agency records.” Cf. United We Stand, 359 F.3d at 603– 04. The Bank must therefore produce the portions of this email chain that are redacted as “EOP not subject to FOIA.” It may, however, continue to redact Calabria’s email address under Exemption 6, as the Court held in its previous Opinion. Cause of Action, 521 F. Supp. 3d at 92– 95.

B. Exemption 5 Moving to the specific exemptions, the Court starts with Exemption 5, which applies to “inter-agency or intra-agency memorandums or letters that would not be available by law to a party other than an agency in litigation with the agency.” 5 U.S.C. § 552(b)(5). Withholdings are restricted to “those documents, and only those documents, normally privileged in the civil discovery context.” NLRB v. Sears, Roebuck & Co., 421 U.S. 132, 149 (1975); see also United States v. Weber Aircraft Corp., 465 U.S. 792, 798–99 (1984). The exemption encompasses three distinct components — namely, the deliberative-process privilege (sometimes referred to as “executive privilege”), the attorney-client privilege, and the attorney-work-product privilege. See American Immigration Council v. U.S. Department of Homeland Security, 905 F. Supp. 2d 206, 216 (D.D.C. 2012). Here, the Court need only concern itself with the first.

The deliberative-process privilege shields internal agency “advisory opinions, recommendations and deliberations” in order to “protect[] the decision making processes of government agencies.” Sears, 421 U.S. at 150 (citations and internal quotation marks omitted). It “rests on the obvious realization that officials will not communicate candidly among themselves if each remark is a potential item of discovery and front page news.” Department of Interior v. Klamath Water Users Protective Association, 532 U.S. 1, 8–9 (2001). In other words, “if agencies were forced to ‘operate in a fishbowl,’” the “quality of administrative decision-

12

making would be seriously undermined . . . because the full and frank exchange of ideas on legal or policy matters would be impossible.” Mead Data Center, Inc. v. U.S. Department of Air Force, 566 F.2d 242, 256 (D.C. Cir. 1977).

To qualify under the privilege, a record must meet two requirements. First, it must be predecisional — i.e., “generated before the adoption of an agency policy.” Judicial Watch, Inc. v. U.S. Department of Defense, 847 F.3d 735, 739 (D.C. Cir. 2017) (citation omitted); see also U.S. Fish and Wildlife Service v. Sierra Club, Inc., 141 S. Ct. 777, 785–86 (2021). Second, a record must be deliberative, meaning that it “reflect[s] the give-and-take of the consultative process.” Judicial Watch, 847 F.3d at 739 (citation omitted). In this way, Exemption 5 focuses on documents containing information that composes “part of a process by which governmental decisions and policies are formulated.” Sears, 421 U.S. at 150 (citation omitted).

Additionally, in the context of Exemption 5, “an agency may withhold information —

even if it falls within the four corners of the exemption — ‘only if . . . the agency reasonably foresees that disclosure would harm an interest protected by’ [that] exemption.” Rosenberg v. U.S. Department of Defense, 442 F. Supp. 3d 240, 256 (D.D.C. 2020) (quoting 5 U.S.C. § 552(a)(8)(A)(i)(I)); see also S. Rep. No. 114-4 at 8 (2015). To satisfy this standard, an agency must “identify specific harms to the relevant protected interests that it can reasonably foresee would actually ensue from disclosure of the withheld materials,” and it must “connect [such] harms in a meaningful way to the information withheld.” Center for Investigative Reporting v. U.S. Customs & Border Protection, 436 F. Supp. 3d 90, 106 (D.D.C. 2019) (cleaned up) (citation omitted). While “boilerplate” articulations of harm are insufficient, id. (citation omitted), the government need not “identify harm likely to result from disclosure of each of its Exemption 5 withholdings.” Rosenberg v. U.S. Department of Defense, 342 F. Supp. 3d 62, 79 (D.D.C.

13

2018). Rather, it “may take a categorical approach” and “group together like records,” explaining “the foreseeable harm of disclosure for each category.” Id. at 78.

The Bank asserts that this privilege protects the majority of disputed documents from disclosure. Plaintiff disagrees. For the most part, the parties diverge on the elements mentioned above — viz., whether the documents are predecisional and deliberative and whether disclosure will result in foreseeable harm. For one set of records, however, Plaintiff also contests the preliminary requirement that the records qualify as inter- or intra-agency materials. See Pl. Opp./Cross-MSJ at 20–23; Def. Repl./Opp. at 10–15. The Court begins with this last set of records before moving to assess — guided by the agency’s declarations, the Vaughn Index, and in camera review — whether the other records at issue meet the predecisional, deliberative, and foreseeable-harm requirements. In doing so, the Court adopts the document groupings presented by the parties.

GAO Audit Responses and Document Productions The parties first clash over the withholding of three records that the Bank sent to the Government Accountability Office in connection with an audit it conducted of EXIM’s anti- fraud controls. See ECF No. 40-3 (1st Declaration of Kenneth Tinsley), ¶ 10; Vaughn Index, lines 45–47. Two of these documents “pre-exist[ed]” the GAO audit: the EXIM Risk Register, which is “a register of the risks that EXIM determines to be its high-level risks, and an assessment of both the inherent likelihood and impact . . . and the residual likelihood and impacts of such risks,” and the Enterprise Risk Assessment, which “gives an overall assessment of EXIM’s risk profile at the time.” 1st Tinsley Decl., ¶¶ 10, 10(a), (c). The third document, the EXIM Responses to GAO Question No. 4 Re: Past Fraud Matters, “summarizes, for each of a number of fraudulent transactions that occurred in the early 2000s, how the fraud was conducted,

14

how it was discovered and if there was anything particularly different or interesting regarding the fraud in the matter.” Id., ¶ 10(b). Although that record contains “documents that were [] pre- existing,” ECF No. 44-2 (2d Declaration of Kenneth Tinsley), ¶ 12, and content that “had been previously put together by EXIM over a considerable period,” it was created and “contains information that was formatted to respond to the GAO question.” Id.; see also 1st Tinsley Decl., ¶ 10. One portion of this final document — an Office of the General Counsel memorandum contained within the responses to GAO’s question — is not at issue now, as this Court has already upheld its withholding. See Cause of Action, 521 F. Supp. 3d at 91–92; see also Pl. Opp./Cross-MSJ at 20 n.13; Def. Repl./Opp. at 12 n.3.

a. Inter-agency or Intra-agency The first matter of business is to decide if these three documents even qualify as inter- or intra-agency records; if they do not, they must be released. As a unit of the Legislative Branch, GAO is not a FOIA-covered “agency,” and so, at first glance, it would seem that documents shared with GAO cannot qualify as “inter-agency” memoranda. The D.C. Circuit has held, however, that agency documents shared with a governmental entity that does not itself qualify as an “agency” for FOIA purposes may still be withheld under Exemption 5 in certain circumstances. See, e.g., Rockwell International Corp. v. U.S. Department of Justice, 235 F.3d 598, 604 (D.C. Cir. 2001). Fortunately, the parties agree on the legal test that applies to determine whether these documents may be withheld, which the Court lays out now.

In Dow Jones & Co., Inc. v. U.S. Department of Justice, 917 F.2d 571 (D.C. Cir. 1990), the D.C. Circuit considered whether a letter sent by a FOIA-covered Executive Branch agency to Congress was properly withheld under Exemption 5. Id. at 572, 574. It held that it was not, explaining that the statutory language of “inter-agency or intra-agency” records “will not stretch

15

to cover this situation, because Congress is simply not an agency.” Id. at 574. But the court acknowledged that such external communications from a FOIA-subject agency may qualify for protection when they “are part and parcel of the agency’s deliberative process.” Id. at 575. Because the letter in question was drafted for the purpose of aiding the “deliberations of a non- agency” — i.e., Congress — it could not qualify as either an intra- or inter-agency record. Id. at 572, 575.

The Circuit clarified the scope of this holding a decade later in Rockwell International, when it considered an agency’s Exemption 5 withholding of several documents that the agency had, once more, sent to Congress. See 235 F.3d at 603–04. This time, however, the court reached the opposite outcome. Even though the files “were sent to assist” a congressional subcommittee “in its deliberations,” they enjoyed protection under Exemption 5. Id. at 604. That was because the documents had been “created [earlier] as part of the [agency’s] deliberative process,” thus making them “precisely the kind of inter- and intra-agency memoranda Exemption 5 protects.” Id. The agency did not “waive[] Exemption 5 protection” for documents that were drafted to serve the agency’s decisionmaking process, as opposed to that of Congress, simply by later sending them to the legislature. Id. at 603–04.

In sum, documents exchanged “between an agency and Congress . . . receive protection as intra-agency memoranda if they were ‘part and parcel of the agency’s deliberative process,’” but not if they were “created specifically to assist” or for the “sole purpose of assisting” Congress “with its deliberations.” Id. at 604 (quoting Dow Jones, 917 F.2d at 575); see also Electronic Privacy Information Center v. Transportation Security Administration, 928 F. Supp. 2d 156, 164–65 (D.D.C. 2013) (finding no Exemption 5 protection for document “prepared to assist with Congressional deliberations rather than agency deliberations”).

16

Plaintiff argues that these documents were created for the sole purpose of assisting a legislative agency; indeed, COA says, “[T]he sine qua non of the records — the very reason for their existence — was GAO’s audit into Ex-Im’s ‘anti-fraud processes.’” Pl. Opp./Cross-MSJ at 22. The Bank counters that two of the three documents had been previously prepared for EXIM’s own deliberative processes and should not lose their protection merely because they were later turned over to GAO. See Def. Repl./Opp. at 11–12. As to the third document, the Bank asserts that the information therein was “already ‘part and parcel of [EXIM’s] deliberative process’” since the record contains only pre-existing documents or pre-existing information that has been reformatted. Id. at 12–13 (quoting Rockwell International, 235 F.3d at 604). Like the two other documents, it should not lose its Exemption 5 protection when turned over to GAO. EXIM further contends that, in any event, the GAO audit was “intended to assist EXIM in its deliberative process of drafting internal fraud risk controls,” and so none of the documents shared with GAO as part of this audit was created for the “sole purpose of assisting [the non- FOIA agency] with its deliberations.” Id. at 14 (quoting Rockwell International, 235 F.3d at 604).

The Court has little trouble finding that the EXIM Risk Register and the Enterprise Risk Assessment meet the inter-agency requirement. Those documents, much like the files in Rockwell International, were “created and used in on-going deliberations about various items” “as part of [EXIM’s] discussions in a number of policy areas.” 2d Tinsley Decl., ¶ 10(a), (c). The Bank appears to have turned them over to GAO in their pre-existing form. Id. As in Rockwell International, doing so did not constitute a waiver of Exemption 5 protection. See 235 F.3d 603–04; see also Murphy v. Department of the Army, 613 F.2d 1151, 1158–59 (D.C. Cir.

17

1979) (no waiver of Exemption 5 privilege even when shared with Congress without assurance of continued confidentiality).

The Reponses to GAO Question No. 4 Re: Past Fraud Matters poses a harder question.

Although that document contains information that was prepared for EXIM’s own purposes and even includes some unaltered, pre-existing documents, it was compiled and formatted specifically to respond to GAO’s inquiry. See 2d Tinsley Decl., ¶ 12(b); 2d Jackson Decl., ¶ 29(a). The Bank thus created a new record in response to GAO’s audit, and it is that record — not its constituent parts — that the Court must consider. The rationale that applies to justify the withholdings in the EXIM Risk Register and the Enterprise Risk Assessment therefore does not extend to this third record.

EXIM is not out of luck, however, as its responses to GAO might not have been created for the “sole purpose of assisting [GAO] with its deliberations,” Rockwell International, 235 F.3d at 604, if the Bank is correct that GAO’s audit ultimately served the purpose of informing EXIM’s own deliberations about how to improve its anti-fraud controls. See Def. Repl./Opp. at 14. The Bank does not explain the impetus for the specific audit pursuant to which these records were shared. Plaintiff, however, proffers two sample GAO audit reports as evidence of the audits’ purpose, see Pl. Opp./Cross-MSJ at 23, and Defendant does not reject the analogy. See ECF No. 46 (Pl. Repl.) at 14. Those reports reveal that GAO regularly conducts audits of EXIM’s anti-fraud controls pursuant to statutory authority. See U.S. Gov’t Accountability Office, Export-Import Bank: EXIM Should Explore Using Available Data to Identify Applications with Delinquent Federal Debt, No. GAO-19-337 (May 2019), available at https://bit.ly/3gkNf0U (May 2019 GAO Report); U.S. Gov’t Accountability Office, Export- Import Bank: The Bank Needs to Continue to Improve Fraud Risk Management, No. GAO-18-

18

492 (July 2018), available at https://bit.ly/3D3aypV (July 2018 GAO Report). That alone is not enough to defeat the Bank’s argument, but the language of the relevant statute is. See 12 U.S.C. § 635a-6(b).

Section 635a-6(b) provides in relevant part:

[T]he Comptroller General of the United States shall—(1) review the adequacy of the design and effectiveness of the controls used by the Export-Import Bank of the United States to prevent, detect, and investigate fraudulent applications for loans and guarantees and the compliance by the Bank with the controls . . . and (2) submit a written report regarding the findings of the review and providing such recommendations . . . to—(A) the Committee on Banking, Housing, and Urban Affairs and the Committee on Appropriations of the Senate; and (B) the Committee on Financial Services and the Committee on Appropriations of the House of Representatives.

That makes clear that GAO’s anti-fraud-procedures audits (though they may also aid EXIM’s decisionmaking) are prepared for the benefit of congressional committees — a conclusion bolstered by the fact that the sample GAO reports are both addressed to “Congressional Committees.” May 2019 GAO Report at 1; July 2018 GAO Report at 1. The GAO responses, accordingly, were “created specifically to assist” GAO and ultimately Congress, not as “part and parcel of [EXIM’s] deliberative process.” Rockwell International, 235 F.3d at 604 (quoting Dow Jones, 917 F.2d at 575). That record thus fails Exemption 5’s threshold requirement that it be a “inter-agency or intra-agency memorandum[]” and must be produced. See 5 U.S.C. § 552(b)(5).

b. Predecisional, Deliberative, and Foreseeable Harm Having cleared its first hurdle, the Bank must still establish that the two records remaining — the Enterprise Risk Register and the Enterprise Risk Assessment — are predecisional and deliberative and that release would cause foreseeable harm. Judicial Watch, 847 F.3d at 739.

19

As to the first, EXIM explains that it was “created as a tool to help guide the process of Enterprise Risk management at EXIM” and “is not a policy or procedure.” 2d Tinsley Decl., ¶ 12a. The Register “represents a snapshot in time” and is intended “to be used as a ‘living document’” that is “constantly assessed and changed.” Id. For each identified risk, the Register includes “assessments of the nature of the risk, of the controls that are used to mitigate the risk, and an assessment of the degree of the risk once those controls are applied.” Id. It is “used to contribute to a wide array of intra-agency discussions pertaining to all the various risks listed.” Id. Based on this description, which appears to accurately reflect the content observed in the Court’s in camera review, the Register is clearly “generated before the adoption of an agency policy,” Judicial Watch, 847 F.3d at 739, and contains “evaluations” or “analysis . . . prepared for senior-level review and decisionmaking.” Machado Amadis v. U.S. Department of State, 971 F.3d 364, 370 (D.C. Cir. 2020).

For similar reasons, the Enterprise Risk Assessment is also predecisional and deliberative. That document “was prepared by the accounting firm Ernst & Young, under a contract with EXIM, and prepared in conjunction with discussions with several EXIM staff members.” 2d Tinsley Decl., ¶ 12c. It “formed, and still forms, a step in EXIM’s overall maturing of its Enterprise Risk Management,” but there “was and is no particular end-point decision that arose or arises out of the Risk Assessment.” Id., ¶ 12(c)(i). As “a tool to be used as one input into various policy discussions,” the Risk Assessment contains “the joint analysis of various EXIM staff members and Ernst & Young regarding the state of EXIM risk management at that time.” Id., ¶ 12c(i)–(ii). That description suffices to establish that this document, like the Risk Register, is an input into EXIM’s decisionmaking processes and is predecisional and deliberative.

20

EXIM asserts that disclosure of both documents will produce a similar harm — namely, the release of information that bad actors could use to identify risk vulnerabilities at the Bank. See Def. Resp./Opp. at 15–16; 2d Tinsley Decl., ¶ 12a, c(iii). “Informing outside parties how EXIM assesses these risks allows malefactors to analyze weaknesses in EXIM’s assessments, and then allows them to compile such information with other data it collects, and target vulnerabilities in EXIM’s risk controls.” 2d Tinsley Decl., ¶ 12c(iii). EXIM staff who were aware of the possibility that their risk identification and assessments might be revealed, “would be ‘chilled’ or deterred from frankly assessing individual fraud matters, openly proposing plans to address such fraud, or providing reports on past frauds to the GAO or other entities whose function includes assisting EXIM in developing more secure measures to prevent future fraud.” Def. Resp./Opp. at 15–16. “Such chilling of candid advice is exactly what the privilege seeks to prevent.” Machado Amadis, 971 F.3d at 371. These records, therefore, were properly withheld.

Enterprise Risk Committee Meeting Minutes EXIM redacted in part three documents containing minutes from meetings of the Enterprise Risk Committee (ERC) in 2018. See Vaughn Index, lines 3–5. The redactions block out “[i]nformation about specific parties and impaired transactions”; summaries of “information presented to the ERC related to cybersecurity risk”; “the number of ‘top cross-cutting’ risks in [EXIM’s] enterprise risk profiles”; “Country Cover” — i.e. “whether, and how, EXIM will support transactions in certain countries” — and “a discussion of the EXIM risk related to human capital.” 1st Tinsley Decl., ¶ 5a–e. Plaintiff, echoing the position that this Court set forth in its last Opinion, asserts that the Bank has not provided sufficient explanation of why the redacted material is predecisional and deliberative and risks causing foreseeable harm if disclosed. See Pl. Opp./Cross-MSJ at 24–25.

21

To withhold documents under the deliberative-process privilege, the Bank must explain “(1) what deliberative process is involved, (2) the role played by the documents in issue in the course of that process, and (3) the nature of the decisionmaking authority vested in the office or person issuing the disputed document[s], and the positions in the chain of command of the parties to the documents.” Center for Biological Diversity v. EPA, 279 F. Supp. 3d 121, 147 (D.D.C. 2017) (internal quotation marks and citations omitted). In its Vaughn Index, the Bank explained that the redacted portions convey information about “specific parties and impaired transactions . . . that form a part of the Enterprise Risk Committee’s (ERC) ongoing monitoring and discussion regarding impaired credits,” and “discuss[] specific cybersecurity issues and risk assessments which are part of continual and repeated process of cybersecurity risk management and monitoring by the ERC.” Vaughn Index, line 3. The Vaughn Index further specifies that the Country Cover redactions include analysis of “proposed steps regarding whether and how EXIM will support transactions in Belarus,” and a human-capital risk analysis that was “presented to ERC as part of a broader discussion within the agency regarding human capital and the risks related to human capital concerns.” Id., lines 4–5.

The Tinsley Declarations also elaborate on the role that the information in each redaction played in the process of monitoring and formulating responses to EXIM’s various risks. See 1st Tinsley Decl., ¶ 5a–e; 2d Tinsley Decl., ¶ 7a–e. For example, as to the summary of impaired transactions, Tinsley states that the “information precedes the final resolution of the impairment . . . [and] is [presented] to allow for fulsome discussion about the various issues raised in these matters.” 2d Tinsley Decl., ¶ 7a(ii). This “selection of the facts that staff deems most pertinent, along with staff analysis and commentary regarding those facts . . . [is] one part of the flow of information that then goes into discussions regarding the best approach to take in resolving each

22

matter.” Id. That assertion, and the several pages of description that accompany it, are sufficient to establish that the meeting minutes were properly characterized as predecisional and deliberative. See Judicial Watch, Inc. v. U.S. Department of Treasury, 796 F. Supp. 2d 13, 28– 29 (D.D.C. 2011) (finding meeting minutes properly withheld under Exemption 5); see also Leopold v. CIA, 89 F. Supp. 3d 12, 21 (D.D.C. 2015) (factual matter may be withheld under Exemption 5 where “the selection or organization of facts is part of an agency’s deliberative process”) (citation omitted).

The Court finds that only one exception exists to the above conclusion. One line in the cybersecurity portion of the minutes from August 22, 2018, is withheld pursuant to Exemptions 5 and 6. The Bank’s briefing and declarations offer no argument as to why this specific line meets Exemption 5’s requirements, and the Court’s in camera review reveals that the line summarizes a past personnel decision. See Vaughn Index, line 3; Redacted Records, Vol. 1 at 000002; see also 2d Tinsley Decl., ¶ 7(b)(ii) (making argument that line is properly withheld under Exemption 6 without Exemption 5 argument). EXIM has thus not met its burden to establish that this line is properly withheld under Exemption 5. Nor is it properly withheld under Exemption 6, since the Bank’s assertion that disclosing this line would “reveal specific information about [the individual in question’s] life,” 2d Tinsley Decl., ¶ 7(b)(ii), is insufficient to establish the applicability of Exemption 6, and the Court’s in camera review leads it to conclude that the release of the redacted information would not “constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6). This line, accordingly, must be produced.

As to the remainder of the records, the Bank has also carried its burden to establish that disclosure would lead to reasonably foreseeable harm. As explained in its Vaughn Index, “Exposing internal staff deliberations about these matters would stifle open discussion,

23

potentially undermine EXIM negotiating positions in some circumstances, potentially give outside parties insight into EXIM risk vulnerabilities,” and even “harm[] relations with other countries.” Vaughn Index, lines 3–4. That explanation is sufficient to satisfy the Bank’s heightened burden. See Rosenberg, 442 F. Supp. 3d at 260–61 (finding agency adequately established foreseeable harm where declarant stated disclosure would inhibit “frank discussions” and impair efforts to furnish leadership with “the full and necessary understanding” required for effective decisionmaking). The meeting minutes, therefore, were properly withheld.

Cyber Risk Acceptance Recommendations Next up is a 14-page memorandum that “contains the CIO’s description of numerous cybersecurity risks, an assessment of their potential impact on EXIM’s activities, and recommendations for how the agency might mitigate those risks while concurrently accounting for operational efficiency.” Spira Decl., ¶ 10; Vaughn Index, line 6. Plaintiff contends that, as this Court found in its prior Opinion, EXIM has not provided a sufficient description of the role of the memo in the Bank’s decisionmaking processes and has not addressed the potential for adoption of the proposal contained therein. See Pl. Opp./Cross-MSJ at 26. As previously directed by the Court, Defendant counters with several pages explaining the memorandum’s role in the decisionmaking process surrounding cybersecurity risks, as well as the relationship between the ERC and the Chief Information Officer. See Def. Repl./Opp. at 18–22; Cause of Action, 521 F. Supp. 3d at 81.

The Bank explains, and the Court has confirmed through its own in camera review, that the memorandum at issue presents to the ERC a series of the CIO’s assessments and recommendations regarding various cybersecurity risks facing EXIM and, “[o]n the surface . . . appears to be a document that seeks a final decision — i.e. the acceptance of the cybersecurity

24

risk assessments made by the CIO.” Spira Decl., ¶ 10. The ERC, however, “is not itself a decision-making body”; rather, it “recommends plans, proposals etc. to the Chief Risk Officer, for further discussion with the President of the agency, and the President’s staff in the ‘front office.’” Id. The memorandum contains the results of the CIO’s information gathering, which the “ERC then uses . . . to discuss the risks assessed, debate the possible course of action, and provide input into the higher-level discussion with the Chief Risk Officer,” who, in turn, deliberates with the President before a final decision is made. See Def. Repl./Opp. at 21–22; Spira Decl., ¶ 10. The memorandum, accordingly, is “generated before the adoption of an agency policy,” Judicial Watch, 847 F.3d at 739, and is thus predecisional.

It is also deliberative, as it falls squarely within the category of documents this privilege covers — “recommendations, draft documents, proposals, suggestions, and other subjective documents which reflect the personal opinions of the writer rather than the policy of the agency.” Coastal States Gas Corp. v. Department of Energy, 617 F.2d 854, 866 (D.C. Cir. 1980). Release of this memorandum, furthermore, would undermine the purpose at the core of the deliberative- process privilege: “assur[ing] that subordinates within an agency will feel free to provide the decisionmaker with their uninhibited opinions and recommendations without fear of later being subject to public ridicule or criticism.” Id.

Finally, the Bank has easily met its burden to establish foreseeable harm here. This memorandum is, as the Bank notes, “a gift to malefactors.” Def. Repl./Opp. at 22. The document identifies EXIM’s cyber vulnerabilities, and release would allow “cyber-criminals [to] use this information to identify and attack EXIM.” Id. Fear of that result “would have a direct chilling effect on EXIM staff’s ability to freely and openly discuss such critical issues in

25

writing.” Id. The harm here is not only reasonably foreseeable, but manifestly evident. This memorandum was properly withheld.

Presentation Slides

On to the next. EXIM has withheld portions of an internal slide presentation on the “Intersection of EXIM Finance and National Defense Strategy.” Vaughn Index, line 7. Once again, Plaintiff contends that the Bank has failed to provide sufficient detail on the role this document plays in EXIM’s decisionmaking processes. See Pl. Resp./Cross-MSJ at 27.

The Bank’s Vaughn Index explains that the “[r]edacted portions of this document set forth a framework for consideration on how to address certain aspects of national security through EXIM.” Vaughn Index, line 7. Because “[t]hese national security concerns are continual and prolonged, . . . there is no ‘final decision’ point with regard to the redacted portions of the documents.” Id. As part of the ongoing evaluation of these concerns, “[t]his slide presentation formed the basis of discussion with the Department of Defense.” Def. Repl./Opp. at 23; see also 2d Tinsley Decl., ¶ 9.

That description is sufficient for the Court to conclude that the Bank “here met its burden of identifying the decisionmaking process to which [the slides] contributed” — the study of how EXIM could respond to certain national-security concerns — even without identifying a specific end decision. See Access Reports v. Department of Justice, 926 F.2d 1192, 1196–97 (D.C. Cir. 1991) (rejecting need to pinpoint specific decision to which memorandum contributed). To the extent some of the redacted information is factual, that, too, is properly considered deliberative, since its exposure might “enable the public to probe [EXIM’s] deliberative processes,” and “the selection or organization of facts is part of an agency’s deliberative process.” Leopold, 89 F. Supp. 3d at 21 (citations omitted).

26

As with the last set of records, the harm here is self-evident. “[P]ublicizing these slides would provide adversaries of the United States with insights into how EXIM and the United States analyze international issues related to national security and what issues the United States prioritizes.” 2d Tinsley Decl., ¶ 9b. That explanation satisfies the Bank’s obligation to “identify specific harms to the relevant protected interests that it can reasonably foresee would actually ensue from disclosure of the withheld materials and connect the harms in a meaningful way to the information withheld.” Center for Investigative Reporting, 436 F. Supp. 3d at 106 (cleaned up) (internal quotation marks and citations omitted). The redacted portions of the presentation slides, too, were properly withheld.

Weekly Reports

The Court ends its Exemption 5 journey with EXIM’s largest category of withholdings.

The 25 records at issue here vary in their contents, but all are weekly reports compiling updates from teams across the Bank and presented to internal, more senior decisionmakers. See Vaughn Index, lines 9–11, 14, 17–19, 21–22, 24–26, 29–33, 35–43. In its last Opinion, the Court determined that, while “select portions [of the withheld documents] contain internal staff discussion that falls within the confines of the privilege,” the Bank had both over-redacted and failed to sufficiently identify the decisionmaking processes to which the information contained in the reports — much of which appeared to be factual — contributed. Cause of Action, 521 F.3d at 82–84. Plaintiff contends that the same is true now, and that factual information that merely provides ongoing updates to a decisionmaking group cannot be deliberative. See Pl. Opp./Cross- MSJ at 28–29; Pl. Repl. at 19–20. EXIM responds with reprocessed records containing fewer redactions and several pages of declarations explaining the content of each withholding. See 1st Tinsley Decl., ¶ 8; 2d Tinsley Decl., ¶ 10.

27

The Court considers the withheld records in groupings based on the author of the weekly report, adopting the structure put forward by Defendant. See Def. Repl./Opp. at 25–27; 1st Tinsley Decl., ¶ 8; 2d Tinsley Decl., ¶ 10. For each grouping, the Court focuses on a representative document and then applies its conclusion to other records the Bank has stated (and the Court has confirmed through in camera review) are substantially similar.

Before moving to the specifics of each group, the Court notes that all the reports share a common feature that increases their likelihood of falling within Exemption 5: they are prepared by lower-level employees for the benefit of upper-level decisionmakers. As the D.C. Circuit has recognized, “[A] document from a subordinate to a superior official is more likely to be predecisional, while a document moving in the opposite direction is more likely to contain instructions to staff explaining the reasons for a decision already made.” Coastal States, 617 F.2d at 868. “A recommendation to a supervisor on a matter pending before the supervisor,” furthermore, “is a classic example of a deliberative document.” Abtew v. U.S. Department of Homeland Security, 808 F.3d 895, 899 (D.C. Cir. 2015).

While things thus start off looking good for the Bank, its withholdings are complicated by the fact that much of the redacted information appears to be factual rather than staff evaluations or analysis. See 1st Tinsley Decl., ¶ 8 (“The reports are mostly informational and provided to give the President and Senior Staff a snapshot of what is going on.”). “Purely factual material usually cannot be withheld under Exemption 5, [but] it can be where it reflects an exercise of discretion and judgment calls and where its exposure would enable the public to probe an agency’s deliberative processes.” Leopold, 89 F. Supp. 3d at 21 (citations and internal quotation marks omitted). Whether this information is nonetheless protected for its role in a deliberative process forms the focus of the Court’s analysis here.

28

a. Office of Board Authorized Finance reports EXIM’s first set of withheld documents consists of weekly reports from the Office of Board Authorized Finance (OBAF), which “handles the origination and monitoring of all transactions large enough to require approval by the Board of Directors.” Vaughn Index, line 9. “The redacted portions of [the representative] report cover proposed plans for handling transactions generally, as well as specific and confidential applications, monitoring and negotiating plans for specific impaired transactions[,] . . . and both aggregated and individual information regarding pending transactions.” Id. EXIM represents that these reports “provide the Senior Staff, and the President and her staff, with information . . . [that] can be incorporated into any number of different decisions senior managers may have to make” about the handling of the transactions referenced in the documents. See 2d Tinsley Decl., ¶ 10(b)(iv).

Although much of the information therein is best described as “factual,” it may be properly withheld under deliberative process when “it reflects an exercise of discretion and judgment calls and where its exposure would enable the public to probe an agency’s deliberative processes.” Leopold, 89 F. Supp. 3d at 21 (quoting Ancient Coin Collectors Guild v. Department of State, 641 F.3d 504, 513 (D.C. Cir. 2011)) (internal quotation marks omitted). Here, “the redacted information [wa]s chosen from an array of data to support the proposed approach EXIM is taking in these matters,” 2d Tinsley Decl., ¶ 10(b)(iv), and “was not assembled for an agency actor merely to pass along to outsiders, but rather for purely internal deliberative purposes.” Electronic Privacy Information Center, 928 F. Supp. 2d at 167–68. That supports the conclusion that it “must be protected in order to safeguard the agency’s deliberative process.” Id. at 168. As this Court recognized in its prior Opinion, “[D]etails concerning the Bank’s rolling efforts to monitor, manage, and conduct due diligence on certain of its existing,

29

pending, and prospective transactions and broader portfolio alike” are properly considered predecisional and deliberative. Cause of Action, 521 F. Supp. 3d at 82; see also Center for Public Integrity v. U.S. Department of Defense, 486 F. Supp. 3d 317, 336–37, 346 (D.D.C. 2020) (finding “weekly reports [giving] an overview of funding and related issues,” “contain[ing] advice on actions that should be taken,” and providing subordinate’s “determination of which issues are most relevant and important for the department” properly withheld under Exemption 5).

Disclosure of such information, moreover, would make it “very difficult” for EXIM to “fulfill its mission” because fear of the release of this information, which “applicants customarily keep . . . confidential,” would discourage applicants from participating in EXIM programs. See 2d Tinsley Decl., ¶ 10(b)(iv). The Bank has therefore discharged its obligation to establish the foreseeable harm that would result from the release of this predecisional and deliberative information, and the reports identified at lines 9, 17, 24, 30, and 37 were properly withheld. See Vaughn Index, lines 17, 24, 30, and 37 (representing that “[t]he same type of information is redacted” in these records as in record at line 9).

b. Office of the General Counsel reports A similar rationale supports the withholding of EXIM’s second set of documents, which comprises reports from the Office of the General Counsel and Corporate Secretary. See Vaughn Index, lines 10, 18, 25, 32, 39. The redacted information in these reports “pertains to impaired transactions” and “includes analytical information regarding EXIM’s approach to these matters.” 1st Tinsley Decl., ¶ 8(c). Much like the information in the first set of reports, this information, though factual, is assembled for the benefit of senior decisionmakers, contributes to the monitoring of EXIM transactions, and feeds into “intra-agency discussion” about how to handle

30

these transactions. See 2d Tinsley Decl., ¶ 10(c)(ii). “[P]ublic disclosure of this information would publicize both EXIM’s specific and general approach to these matters[,] . . . significantly undermin[ing] EXIM’s negotiating position . . . [and] pressur[ing] EXIM staff to curtail putting such information in writing, thus making appropriate Senior Staff review more difficult.” Id. For much the same reasons given above, the Bank has justified withholding of these reports.

One further points bears mention. In the July 25, 2018, weekly report, there appears a “Business Development Travel” section that is absent from the other reports in this group. That section includes “both factual information obtained during the travel in question, as well as analysis and synthesis of the information [] obtained.” Vaughn Index, line 18. This information “is for the benefit of senior staff in discussions regarding EXIM’s competitiveness with foreign export credit agencies,” id., and its disclosure would “reveal[] to the foreign export credit agencies the competitiveness issues that have drawn EXIM’s attention, and the steps EXIM is considering to re-balance the competitiveness.” 2d Tinsley Decl., ¶ 10(c)(iii). The Court concludes that this, too, qualifies as predecisional and deliberative, as its in camera review confirms EXIM’s representation that this section includes analysis that may inform future decisions.

c. Office of Risk Management reports The third set of withheld documents contains weekly reports from the Office of Risk Management. See Vaughn Index, lines 11, 19, 26, 33, 40. At the risk of repeating itself, the Court again finds that these were properly withheld for much the same reasons as the previous two sets. Redacted portions of these documents “address internal reorganizational steps being discussed among senior managers relating to re-alignment of risk management within the agency,” “analys[es] of economic conditions in [] countries for discussion relating to ‘country

31

cover,’ and internal emergency procedures related to continueing [sic] operations of government in the event of a disaster (COOP).” Vaughn Index, line 11. These reports are predecisional and deliberative because they feed into and discuss ongoing decisionmaking processes about the “restructuring of risk management within EXIM,” “transaction due diligence” by EXIM loan officers, and “steps being taken in connection with the Government[’]s ‘Continuity of Operations Plan.’” 2d Tinsley Decl., ¶ 10(d)(ii)–(iv). Disclosure, furthermore, would “provide outside parties with information they could use to undermine the effectiveness of risk management within the agency” or “reveal the type of information that EXIM relies upon to make [its transaction-due-diligence] analyses,” thereby “put[ting] at risk EXIM’s and the U.S. Government’s ability to engage openly and honestly with some of these countries.” Id. These records were properly withheld.

d. Office of the Chief Information Officer reports Different records, same story. This time the records withheld are updates on EXIM’s ongoing efforts to maintain and upgrade its cybersecurity defenses. Like the other records discussed, these contain largely factual information that is used to inform the Bank’s monitoring of and decisionmaking around cybersecurity initiatives. See 2d Tinsley Decl., ¶ 10(g). And like those previously discussed, the documents at Vaughn Index lines 14, 22, 29, 36, and 43 were properly withheld. See also supra, Sec. III.B.3 (concluding similar discussion of cybersecurity issues properly withheld).

e. Miscellaneous documents Finally, the terminus for Exemption 5. The last set of documents consists of three types of records, two of which the Court concludes were properly withheld. The first — two weekly reports from the Office of Policy and International Relations (OPAIR) — were properly withheld

32

for substantially the same reasons as the other weekly reports discussed. These records, at Vaughn Index lines 21 and 35, provide “factual and analytical” information to inform negotiations with the OECD and a specific country. See 2d Tinsley Decl., ¶ 10(f)(ii). The fact that these negotiations have since terminated does not take these records outside of Exemption 5, since “no specific decision was made with regard to the information” contained therein. See Vaughn Index, line 21; see also Gold Anti-Trust Action Committee, Inc. v. Board of Governors of the Federal Reserve System, 762 F. Supp. 2d 123, 135–36 (D.D.C. 2011) (“[E]ven if an internal discussion does not lead to the adoption of a specific government policy, its protection under Exemption 5 is not foreclosed as long as the document was generated as part of a definable decision-making process.”).

The second type of withheld document is another weekly report from OPAIR. See Vaughn Index, line 42. The redacted portions “pertain to two unrelated conceptual proposals made by outside parties that will need to be explored and discussed.” 2d Tinsley Decl., ¶ 10(f)(iii). A “combination of selected factual information and analysis,” the redacted information constitutes “staff’s internal analysis[, which] is not necessarily the final EXIM analysis.” Id. Such “advisory opinions, recommendations, and deliberations,” especially when provided by staff to senior decisionmakers, are precisely what the deliberative-process privilege is intended to shield. Sears, 421 U.S. at 150; see also Coastal States, 617 F.2d at 868.

The final two records are weekly reports from the Office of Congressional and Intergovernmental Affairs. See Vaughn Index, lines 31, 38. Only one line is redacted from these reports, and the Bank contends that the redaction is justified because “it summarizes the gist of an internal discussion regarding a potential reorganization within the agency, and whether that reorganization required a report to Congress.” 2d Tinsley Decl., ¶ 10(h). That this material is

33

predecisional is evident: it is “presented to the Senior Staff expressly as an ‘action item.’” Id. The Court is not convinced, however, that the Bank has established that it is deliberative. Although EXIM argues that the redacted information summarizes ongoing discussions and “is a part of the broader discussion regarding the issue,” id., it is not clear to the Court what a reader of this line could glean about EXIM’s decisionmaking processes from its content. At most, one might be able to identify the decision the Bank’s leaders must make, but identifying the decision does not risk exposing anything about the process itself; indeed, it is something agencies seeking to assert Exemption 5 are required to do. See Center for Biological Diversity, 279 F. Supp. 3d at 147 (requiring agency to identify “deliberative process . . . involved). These last reports, consequently, must be produced in full.

C. Exemption 4 At last departing the shores of Exemption 5, the Court now travels to the land of Exemption 4, which the Bank cites to justify the withholding of 24 records. The Court need only consider seven of those records here, however, because it has already determined that EXIM properly withheld the redacted information in the others pursuant to Exemption 5. See Center for National Security Studies, 331 F.3d at 925. The only Vaughn Index lines at issue are thus 12–13, 20, 27–28, 34, and 41.

Those records may be sorted into two categories. The first contains weekly reports from the Office of Small Business (OSB), which “covers those transactions and programs not requiring Board of Directors approval.” Vaughn Index, line 12; see also id., lines 20, 27, 34, 41. Each update is produced largely unredacted, with redactions “pertain[ing] to specific confidential information regarding identified exporters[, s]pecifically . . . the business concentration, or planned concentration, in specific countries.” 1st Tinsley Decl., ¶ 8(e). The second set is in fact

34

one document produced twice, which is a weekly update from OPAIR. See Vaughn Index, lines 13, 28. The lone redaction in that report “refer[s] to specific terms of a guarantee issued by EXIM to the Private Export Finance Corporation (PEFCO).” 1st Tinsley Decl., ¶ 8(f)(i).

Exemption 4, which EXIM contends justifies these redactions, shields from disclosure “commercial or financial information obtained from a person and privileged or confidential.” 5 U.S.C. § 552(b)(4). To demonstrate that this exemption shelters the information withheld, the Bank must show that it is “(1) commercial or financial, (2) obtained from a person, and (3) privileged or confidential.” Public Citizen Health Research Group. v. FDA, 704 F.2d 1280, 1290 (D.C. Cir. 1983). There is no dispute about the first prong, so the Court focuses its discussion on the second and third elements.

Obtained From a Person

“Information is considered ‘obtained from a person’ if the information originated from an individual, corporation, or other entity, and so long as the information did not originate within the federal government.” Electronic Privacy Information Center v. U.S. Department of Homeland Security, 117 F. Supp. 3d 46, 63 (D.D.C. 2015) (citing Board of Trade of City of Chicago v. Commodity Futures Trading Commission, 627 F.2d 392, 404 (D.C. Cir. 1980)). The D.C. Circuit has held, however, that information originating within the Government may still be considered “obtained from a person” when it summarizes information supplied by an external party or is a portion of a document “from which information supplied by [the third party] could be extrapolated.” Gulf Western Industries, Inc. v. United States, 615 F.2d 527, 529–30 (D.C. Cir. 1979). Agency-generated records that constitute agency analysis of third-party information (as opposed to mere summary), on the other hand, are not “obtained from a person.” Philadelphia Newspapers, Inc. v. Department of Health and Human Services, 69 F. Supp. 2d 63,

35

66–67 (D.D.C. 1999). “[T]he key distinction — which will obviously be blurry in many instances — is between information that is either repeated verbatim or slightly modified by the agency, and information that is substantially reformulated by the agency, such that it is no longer a ‘person’s’ information but the agency’s information.” Southern Alliance for Clean Energy v. U.S. Department of Energy, 853 F. Supp. 2d 60, 68 (D.D.C. 2012).

COA maintains that the records withheld under Exemption 4 fall into the latter category, or, at least, that EXIM has not provided sufficient information to establish that the redacted information came from outside the agency. See Pl. Opp. and Cross-MSJ at 17–18. The Bank rejoins that its Vaughn Index and declarations demonstrate that this information was collected from applicants and customers of the Bank, and the unveiling of any ensuing analysis would allow the extrapolation of the underlying data. See Def. Repl./Opp. at 5–7.

As to the OSB reports, the Court concludes fairly easily that EXIM has established that most of the redacted information came from customers of the Bank. Although the Bank does not specify the method by which it acquired each piece of information — which “may come from documents that EXIM has received, or it may be oral information EXIM collects by phone or in meetings,” 2d Jackson Decl., ¶ 22 — it represents that the information was provided by the customers or partners being discussed in the report and is presented with “very selective edits.” Vaughn Index, line 12. The Court’s in camera review confirms that this is the case. Indeed, the redacted information does not appear to include EXIM analysis or manipulation, but rather is a recitation of customers’ plans or statistics about their businesses. That is information “obtained from a person.” 5 U.S.C. §552(b)(4); see Southern Alliance for Clean Energy, 853 F. Supp. 2d at 68 (information recited or minimally modified may be “obtained from a person”); Electronic

36

Privacy Information Center, 117 F. Supp. 3d at 63 (information from a corporation is “obtained from a person”).

Only one set of redactions in this group does not fall clearly into this category. Those are the redactions under the “New Issuing Bank Credit Limit (IBCL)” heading in the record at Vaughn Index, line 20. See Redacted Records, Vol. 1 at 000084. The redacted information appears to be the amount of an EXIM-approved credit limit, the recipient of that credit limit, and the cotton exporter that will be supported by the IBCL. EXIM offers no explanation specific to this record (arguing instead that it simply follows the determination of the record at Vaughn Index, line 12), and it is not clear to the Court why this information would have been obtained from an outside party, rather than from inside the Bank. See Vaughn Index, line 20; 1st Tinsley Decl., ¶ 8(e); 2d Tinsley Decl., ¶ 10(e). The Court, accordingly, concludes that EXIM has not met its burden to establish that this information is “obtained from a person,” and the information must be disclosed.

This trend continues with the OPAIR weekly report. EXIM explains that the redacted portion of this report refers to the terms of a guarantee made to PEFCO. See Vaughn Index, line 13; 1st Tinsley Decl., ¶ 8(f); 2d Tinsley Decl., ¶ 10(f)(i). But EXIM also states that the redacted terms were “issued by EXIM to [PEFCO],” 2d Tinsley Decl., ¶ 10(f)(i), which would seem to eliminate the possibility that this information came from PEFCO to EXIM. Indeed, this establishes that the redacted information moved in the opposite direction. EXIM rejoins that “terms or conditions . . . are arrived at by agreement,” and “the term or condition would not exist but for . . . PEFCO’s agreement so in that sense the terms and conditions came from PEFCO.” Id. That argument is unavailing. See Southern Alliance for Clean Energy, 853 F. Supp. 2d at 68 (citing In Defense of Animals v. National Institutes of Health, 543 F. Supp. 2d 83, 102–03

37

(D.D.C. 2008)) (“[T]he mere fact that information was the product of negotiations between a ‘person’ and the agency does not make that information ‘obtained from a person’ under Exemption 4.”). A more natural reading of EXIM’s description, supported by the Court’s in camera review of the redacted information, leads to the conclusion that this information was not obtained from a person, as Exemption 4 requires. The records at Vaughn Index lines 13 and 28 shall be disclosed.

Confidential

Even after establishing that the OSB reports are “obtained from a person,” EXIM may withhold them under Exemption 4 only if it also demonstrates that they are “privileged or confidential.” Public Citizen Health Research Group, 704 F.2d at 1290. Only the “confidential” nature of the records is at issue here. To satisfy this requirement, the Bank must show that the withheld commercial or financial information is “both customarily and actually treated as private by its owner.” WP Company LLC v. U.S. Small Business Administration, 502 F. Supp. 3d 1, 12 (D.D.C. 2020) (quoting Food Marketing, 139 S. Ct. at 2366). In other words, the information must be “customarily kept private, or at least closely held, by the person imparting it.” Food Marketing, 139 S. Ct. at 2363. The critical question is “how the particular party customarily treats the information, not how the industry as a whole treats the information.” Center for Auto Safety v. National Highway Traffic Safety Administration, 244 F.3d 144, 148 (D.C. Cir. 2001) (citing Critical Mass Energy Project v. Nuclear Regulatory Commission, 975 F.2d 871, 872, 878–80 (D.C. Cir. 1992)).

An agency seeking to establish customary treatment may “proceed solely on its sworn affidavits.” Judicial Watch, Inc. v. U.S. Department of Commerce, 337 F. Supp. 2d 146, 171 (D.D.C. 2004). Those affidavits must be “made on personal knowledge,” Animal Legal

38

Defense Fund, Inc. v. Department of the Air Force, 44 F. Supp. 2d 295, 303 (D.D.C. 1999) (quoting Fed. R. Civ. P. 56(e)), which can be demonstrated in a variety of ways. An agency may “relay[] that the submitters themselves told the agency that the information is confidential, . . . indicat[e] that the agency reached an ‘understanding’ with the submitters ‘that the information w[ould] be held in confidence by the U.S. and not publicly divulged,’ . . . point[] to confidential markings on the documents themselves or to the existence of a non-disclosure agreement, or . . . provid[e] descriptions of the documents that demonstrate their confidential nature.” Center for Investigative Reporting, 436 F. Supp. 3d at 110–11 (quoting Judicial Watch, 337 F. Supp. 2d at 171). Excluded from the list of acceptable methods are “[c]onclusory statements by an agency official about what the agency official may believe about how a submitter customarily treats the information at issue.” Id. at 111.

“Complicating matters,” the Supreme Court in 2019 suggested that “the plain meaning of the word ‘confidential’” might require the government to establish an “additional necessary condition” before invoking Exemption 4 — namely, that “the party receiving the information . . . ‘provide[d] some assurance that it [would] remain secret.’” Renewable Fuels Association v. U.S. EPA, 519 F. Supp. 3d 1, 10 (D.D.C. 2021) (quoting Food Marketing., 139 S. Ct. at 2363). The Court, however, did not resolve whether this second condition is mandatory, see Food Marketing, 139 S. Ct. at 2363, and this Court has since explained that binding Circuit precedent compels an answer in the negative. See Renewable Fuels Association, 519 F. Supp. 3d at 12 (“The current law of the D.C. Circuit . . . is that information is confidential under Exemption 4 ‘if it is of a kind that would customarily not be released to the public by the person [or entity] from whom it was obtained.’”) (alteration in original) (quoting Critical Mass, 975 F.2d at 879). This Court, accordingly, declines to “read the word ‘confidential’ to impose a blanket

39

requirement that the government provide an assurance of privacy in every case in which it asserts Exemption 4.” Id. It acknowledges, however, that an assurance of confidentiality may be relevant to determining whether information is “confidential.” See Shapiro v. Department of Justice, No. 12-313, 2020 WL 3615511, at *25 (July 2, 2020).

EXIM contends in its declarations and Vaughn Index that the redacted information is not, “in EXIM’s experience[,] . . . generally shared publicly.” Vaughn Index, line 12. COA rejoins that the Bank has put forth nothing more than “conclusory” claims about the customary treatment of this information. See Pl. Opp./Cross-MSJ at 16–17. In response, the Bank’s declarant stated that the redacted information “is not customarily publicized by exporters as it reveals competitively valuable information,” and he notes that EXIM did not redact information where it established that an exporter had diverted from its customary practice. See 1st Tinsley Decl., ¶ 8(e). He declared, furthermore, that the information is “precisely the kind of information that U.S. exporters supported by EXIM have identified over the years as sensitive and that such companies do not customarily divulge publicly.” 2d Tinsley Decl., ¶ 10(e)(i). That knowledge is based on Tinsley’s “40-plus years at EXIM” and his “many direct conversations or communications with EXIM customers regarding their confidentiality expectations.” Id., ¶ 6(a)(iii). It is also drawn from the Bank’s “long experience with U.S. exporters,” from which it has made “determinations regarding the customary habits of those exporters based on generalizations gleaned over thousands of communications covering decades.” Id., ¶ 8(e)(i). Although EXIM would ideally have solicited input from the specific exporters discussed in these reports, the Court finds that it may rely here on its “decades of accumulated experience and interaction with participants on the question of confidentiality” to conclude that “this type of

40

information is customarily kept confidential by the parties that submit it to EXIM.” Id., ¶ 6(a)(viii); see Center for Investigative Reporting, 436 F. Supp. 3d at 110–11.

The Bank has declared, furthermore, that it “assures transaction applicants, exporters and other transaction participants that it will protect the information they provide to EXIM from disclosure to the maximum extent permitted.” 2d Jackson Decl., ¶ 17; see also ECF No. 40-6 (Exhibit B, Copy of Memorandum re: Treatment of Confidential Materials). To the extent that evidence of assurance of confidentiality is necessary, EXIM has satisfied that requirement. At the very least, this evidence of assurance supports the conclusion that the redacted information is “confidential.” Shapiro, 2020 WL 3615511, at *25.

Foreseeable Harm

An agency may withhold information under Exemption 4 — even if it falls within the scope of the exemption — “only if . . . the agency reasonably foresees that disclosure would harm an interest protected by [that] exemption.” 5 U.S.C. § 552(a)(8)(A)(i)(I); see also Reporters Committee for Freedom of Press v. FBI, 3 F.4th 350, 369–70 (D.C. Cir. 2021). To satisfy this standard, an agency must “identify specific harms to the relevant protected interests that it can reasonably foresee would actually ensue from disclosure of the withheld materials,” and it must “connect [such] harms in a meaningful way to the information withheld.” Center for Investigative Reporting, 436 F. Supp. 3d at 106 (cleaned up) (citation omitted).

Plaintiff points out that Defendant mounts no foreseeable-harm arguments specific to Exemption 4 in its briefing. See Pl. Opp./Cross-MSJ at 36–37; Pl. Repl. at 20–21. Defendant, however, has put forth bases for the harm of disclosing each document in its Vaughn Index and its declarations. See Def. Repl./Opp. at 27–28 (noting as much). EXIM contends that disclosure of the information in OSB reports would harm the submitting customers by essentially “telling

41

all of their competitors that [the country in which they have concentrated their sales] is where the business is.” 2d Tinsley Decl., ¶ 10(e)(i). Publication of information participants expect the Bank to keep confidential, moreover, would “severely hamper[]” EXIM’s ability to perform its function; “[i]f EXIM transaction parties were to lose faith in EXIM’s ability to keep [confidential] information private,” the Bank would lose access to information it “relies upon to complete its underwriting of transactions, to monitor transactions as they proceed, and to settle, or work-out transactions that run into difficulties.” 2d Jackson Decl., ¶ 19. That suffices to “directly articulate[] [a] link between the specified harm and the specific information contained in the material withheld.” WP Company LLC v. U.S. Small Business Administration, No. 20- 1240, 2021 WL 5881972, at *4 (D.D.C. Dec. 13, 2021) (quoting Reporters Committee, 3 F.4th at 371) (finding similar harms sufficient to satisfy foreseeable-harm requirement).

The OSB weekly reports, identified at Vaughn Index lines 12, 20, 27, 34, and 41, were thus properly withheld under Exemption 4.

D. Segregability Plaintiff’s last challenge is a general critique of Defendant’s failure “to show that it released all reasonably segregable portions of the records at issue.” Pl. Opp./Cross-MSJ at 37– 38. While COA is of course correct that EXIM bears the burden of releasing “[a]ny reasonably segregable portion of a record” and must “take reasonable steps necessary to segregate and release nonexempt information,” the Court is satisfied that Defendant has discharged that obligation here, despite its misgivings last go-round. See 5 U.S.C. § 552(a)(8)(A)(ii)(II); 552(b); Cause of Action, 521 F.3d at 96. Unlike last time, the Bank has redacted almost no records in full, and the Court’s in camera review did not reveal any instances of apparent over-redaction. EXIM has instead redacted specific portions of the records at issue and has explained to the

42

Court’s satisfaction the rationale for its withholdings. See Hodge v. FBI, 703 F.3d 575, 582 (D.C. Cir. 2013) (finding segregation obligation met where court found redactions consistent with application of claimed exemptions).

* * *

For those still keeping score, the final results are now in, and EXIM must release the documents at the following lines of the Vaughn Index: 3 (in part), 13, 15 (in part), 20 (in part), 28, 31, 38, and 46 (in part). The others are properly withheld. IV. Conclusion For the foregoing reasons, the Court will grant in part and deny in part the Motions for Summary Judgment. A separate Order so stating will issue this day.

/s/ James E. Boasberg

JAMES E. BOASBERG

United States District Judge Date: January 27, 2022