Kinnucan v. National Security Agency

Opinion

FOR PUBLICATION

UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT No. 24-7642

MICHELLE J. KINNUCAN, D.C. No.

Plaintiff - Appellant, 2:20-cv-01309-

MJP

v.

OPINION

NATIONAL SECURITY AGENCY; CENTRAL INTELLIGENCE AGENCY; DEFENSE INTELLIGENCE AGENCY; UNITED STATES DEPARTMENT OF DEFENSE,

Defendants - Appellees.

Appeal from the United States District Court for the Western District of Washington Marsha J. Pechman, District Judge, Presiding

Argued and Submitted March 2, 2026 Seattle, Washington

Filed August 24, 2026

Before: Richard A. Paez, Carlos T. Bea, and Daniel A.

Bress, Circuit Judges.

Opinion by Judge Bress

2 KINNUCAN V. NATIONAL SECURITY AGENCY

SUMMARY *

Freedom of Information Act

Affirming the district court’s grant of summary judgment to the National Security Agency (NSA), the panel held that a document prepared by Congress and later transmitted to the NSA was not an agency record subject to disclosure under the Freedom of Information Act (FOIA), 5 U.S.C. § 552(a)(4)(B), because Congress manifested a clear intent to control the document.

Plaintiff Michelle Kinnucan submitted FOIA requests to the NSA seeking two volumes of a House Appropriations Committee (HAC) Report referenced in a report authored by the NSA. The NSA denied the FOIA request because the requested documents were not agency records subject to FOIA as they were both created by and controlled by the U.S. House of Representatives.

The panel adopted the D.C. Circuit’s test for when congressional documents transferred to agencies become agency records under FOIA. That is, a document prepared by Congress and provided to an agency is not subject to FOIA when, based on the facts and circumstances, Congress manifests a clear intent to control the document.

Applying that test to Kinnucan’s FOIA request, the panel held that, under the facts and circumstances of this case, the NSA demonstrated that Congress manifested a clear intent to control the HAC Report, such that it must still be regarded

*

This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.

KINNUCAN V. NATIONAL SECURITY AGENCY 3

as a congressional record outside of FOIA’s reach. Most prominently, the HAC Report is stamped with a banner, written in all capital letters, stating “NOT FOR RELEASE UNLESS AND UNTIL AUTHORIZED BY COMMITTEE.” Congress, which is not subject to FOIA, has to date not released that document publicly.

Accordingly, the panel affirmed the district court’s grant of summary judgment to the NSA.

COUNSEL

Caesar D. Kalinowski IV (argued), Davis Wright Tremaine LLP, Seattle, Washington; Thomas R. Burke, Davis Wright Tremaine LLP, San Francisco, California; Marietta Catsambas, Davis Wright Tremaine LLP, Washington, D.C.; for Plaintiff-Appellant. Michael Shih (argued) and Thomas Pulham, Attorneys, Appellate Staff, Civil Division; Brett A. Shumate, Assistant Attorney General; United States Department of Justice, Washington, D.C.; Katie D. Fairchild and Kristin B. Johnson, Assistant United States Attorneys; Teal L. Miller, Acting United States Attorney; Office of the United States Attorney, United States Department of Justice, Seattle, Washington; for Defendants-Appellees. Kyle Berti and Catherine C. Clark, Law Office of Catherine C. Clark PLLC, Seattle, Washington, for Amicus Curiae USS Liberty Veterans Association.

4 KINNUCAN V. NATIONAL SECURITY AGENCY

OPINION

BRESS, Circuit Judge:

Agency records are subject to disclosure under the Freedom of Information Act (FOIA). 5 U.S.C. § 552(a)(4)(B). Congressional records are not. Id. § 551(1)(A). This case requires us to decide when a document that is prepared by Congress and later transmitted to an agency becomes an “agency record” potentially accessible under FOIA. Consistent with the D.C. and Second Circuits, we hold that a document prepared by Congress and provided to an agency is not subject to FOIA when Congress manifests a clear intent to control the document. Applying that test, we conclude, based on the facts and circumstances, that when Congress provided the National Security Agency (NSA) with the House Appropriations Committee Report sought in this case, Congress manifested a clear intent to control the document. The document therefore did not become an “agency record,” so it falls outside of FOIA’s scope. We affirm the district court’s grant of summary judgment to the NSA.

I

On June 8, 1967, during the Six-Day War, Israeli forces attacked the U.S.S. Liberty, a naval intelligence ship, in international waters. Thirty-four American troops were killed and many more were injured. It appears the United States determined the strike was a tragic case of mistaken identity. Nevertheless, the event has remained the subject of public interest.

In August 1967, Congress held an oversight hearing to study the communications failures that led to the Liberty

KINNUCAN V. NATIONAL SECURITY AGENCY 5

incident. After the hearing, the House Appropriations Committee directed its staff to further examine the effectiveness of Department of Defense (DOD) communications systems. The result of this effort was a two-volume Committee report, referred to in this litigation as the “HAC Report,” which was prepared for the Chairman of the Committee. Volume I of the HAC Report surveyed the communications problems precipitating the Liberty incident, and Volume II assessed the DOD’s communications networks. There is no indication in the record that the HAC Report has ever been made public.

The NSA received the HAC Report in May 1968.

Although the NSA did not produce the HAC Report in this litigation, it did identify two documents that shed some light on the NSA’s acquisition of the Report.

First, the NSA produced a “Routing and Transmittal Slip” documenting a transfer of the HAC Report to the NSA’s Eugene Yeates, who served as Chief for the Office of Legislative Affairs during the relevant period. Although the transmittal slip is dated May 6th, the year of transmission is not contained on the document. The document states: “Gene, you asked to review the attached 2 volumes re: USS Liberty.” It is signed, but the name of the sender is illegible. It is contended that Yeates requested and received the HAC Report from Congress, which NSA does not dispute.

Second, a “Memorandum for the Director” produced by the NSA reflects an internal transfer of the HAC Report between NSA officials on May 13, 1968. It is alleged without contradiction that this memorandum was transmitted to NSA’s then-Director Marshall S. Carter. The memorandum is sent from Lieutenant Commander Edward Koczak, and states that it is attaching “a purloined copy of 6 KINNUCAN V. NATIONAL SECURITY AGENCY

the House Appropriations Committee report of the effectiveness of DoD communications triggered by the Liberty incident.” The memorandum goes on to describe how Volume I of the HAC Report “is of interest, albeit historical,” and that “Volume II is a treatise on DoD communications in general and contains a good summary.” Referring to Volume II, the memorandum “recommend[s] you read only this portion at your leisure.” Handwritten notes on the memorandum state “This is only copy,” and recommend providing the report to two other NSA officials. Considering the “Routing and Transmittal Slip” and “Memorandum for the Director,” the parties agree that the NSA obtained its copy of the HAC Report in May 1968.

The NSA provided sworn declarations attesting that the only version of the HAC Report in its files contains a prominent banner stating: “NOT FOR RELEASE UNLESS AND UNTIL AUTHORIZED BY COMMITTEE.” This banner appears on the cover page of each of the two volumes, and on two “memorandum pages” that follow the cover page of each volume. Those memorandum pages are titled “Memorandum for the Chairman” and are signed by the “Director” for the “Survey and Investigations House Appropriations Committee.” The memorandum pages in each volume are dated December 29, 1967, and February 15, 1968.

The NSA has not seen “any record indicating that NSA, or anyone else,” added the “NOT FOR RELEASE” banner “after NSA received the document in 1968.” An NSA representative further avers that “this banner is used by Congress to indicate its intent to retain control” of a document. Accordingly, NSA represents that the banner “would have been included by the staff of the Committee on

KINNUCAN V. NATIONAL SECURITY AGENCY 7

Appropriations of the U.S. House of Representatives as the preparer of the report.”

The NSA also represents in a sworn declaration that the HAC Report is marked “TOP SECRET” on every page. It is not clear who added that classification marking, but the memorandum pages in both volumes state that “This report is classified TOP SECRET because it contains information, so classified by the Department of Defense, relating to matters involving national security of the United States.” In addition, in handwritten print across the cover pages of both volumes of the HAC Report, there are notes reading: “Not releasable” and “Information appeared in the press on 8 July ’68.” The NSA believes the agency added these handwritten notes after the HAC Report was transmitted to the agency. According to the NSA, it has “consistently treated the HAC report as a Top Secret classified document, including [by] limiting its disclosure and employing other protections.”

In 1981, the NSA authored a different report titled “Attack on a Sigint Collector, the U.S.S. Liberty” (the Attack Report), which is a historical account of the 1967 Israeli attack (“Sigint” or “SIGINT” refers to “signals intelligence”). The two authors of the Attack Report were retired NSA researchers conducting work for the NSA. See William D. Gerhard & Henry W. Millington, Attack on a Sigint Collector, the U.S.S. Liberty, at vii, in 1 Special Series Crisis Collection (1981). The Attack Report cites the HAC Report and discusses it at a high level. Gerhard & Millington, supra, at 59–60. The Attack Report was originally published internally by NSA in 1981 and kept confidential, with “Top Secret” and “Confidential” designations appearing on the report’s pages. But in 2006, the Attack Report was declassified and released to the 8 KINNUCAN V. NATIONAL SECURITY AGENCY

public, and those markings were crossed out. However, the NSA has never publicly released the HAC Report.

In 2019, plaintiff Michelle Kinnucan, a researcher and armed forces veteran, submitted FOIA requests to the NSA seeking the two volumes of the HAC Report referenced in the Attack Report. In response to Kinnucan’s request, the NSA located one copy of the HAC Report in its files, with the “NOT FOR RELEASE” banner and the markings discussed above. The NSA denied Kinnucan’s FOIA request, explaining that the documents Kinnucan requested “are not agency records subject to the FOIA, as the records in question were both created by and are controlled by the U.S. House of Representatives.”

Kinnucan filed this lawsuit in September 2020, seeking (as relevant here) to compel the NSA to disclose the HAC Report. The district court granted the NSA’s motion for summary judgment. Recognizing that “neither the Supreme Court nor the Ninth Circuit has established a standard to address the constitutional considerations at play when an agency is in possession of a congressional record,” the district court applied a longstanding framework from the D.C. Circuit governing FOIA requests for records created by Congress and later transmitted to an agency. See, e.g., ACLU v. CIA, 823 F.3d 655, 662–63 (D.C. Cir. 2016). Under that test, whether an agency has sufficient control over a congressional document such that it becomes an “agency record” depends on “whether Congress manifested a clear intent to control the document.” Id. at 663 (quoting Jud. Watch, Inc. v. U.S. Secret Serv., 726 F.3d 208, 221 (D.C. Cir. 2013)). Applying that test to the facts and circumstances of the HAC Report’s creation and transmittal, the district court concluded that the HAC Report was not an

KINNUCAN V. NATIONAL SECURITY AGENCY 9

“agency record,” meaning it was not subject to disclosure under FOIA.

Kinnucan appealed, and this court granted the NSA’s motion for a voluntary remand to make further disclosures concerning Kinnucan’s FOIA request. With the benefit of the NSA’s additional disclosures (which included the “Routing and Transmittal Slip” and “Memorandum for the Director” discussed above), the district court again granted summary judgment to the NSA. In a thorough decision, the district court again concluded that the HAC Report is not an agency record under the D.C. Circuit test.

Kinnucan renews her appeal to this court.

II

We review the grant of summary judgment in FOIA cases de novo. Animal Legal Def. Fund v. FDA, 836 F.3d 987, 990 (9th Cir. 2016) (en banc) (per curiam). Consistent with FOIA’s “purpose” and “plain language,” there is a “strong presumption in favor of disclosure” under the Act. U.S. Dep’t of State v. Ray, 502 U.S. 164, 173 (1991). So when there is a dispute whether documents qualify as “agency records,” “[t]he burden is on the agency to demonstrate, not the requester to disprove, that the materials sought are not agency records.” U.S. DOJ v. Tax Analysts, 492 U.S. 136, 142 n.3 (1989) (quotations omitted).

A

To promote transparency, FOIA allows the public to gain access to governmental records. See, e.g., Hamdan v. U.S. DOJ, 797 F.3d 759, 769–70 (9th Cir. 2015); Mayo v. U.S. Gov’t Printing Off., 9 F.3d 1450, 1451 (9th Cir. 1993). Under FOIA, “each agency, upon any request for records . . . shall make the records promptly available to any person.” 5 10 KINNUCAN V. NATIONAL SECURITY AGENCY

U.S.C. § 552(a)(3)(A). If an agency fails to produce responsive documents, a district court may “enjoin the agency from withholding agency records and . . . order the production of any agency records improperly withheld from the complainant.” Id. § 552(a)(4)(B) (emphases added).

For government-held documents to be subject to disclosure under FOIA, they must first qualify as “agency records.” See Forsham v. Harris, 445 U.S. 169, 178 (1980) (“Congress undoubtedly sought to expand public rights of access to Government information when it enacted the Freedom of Information Act . . . [but] Congress limited access to ‘agency records.’” (quoting 5 U.S.C. § 552(a)(4)(B))). FOIA does not define the phrase “agency records.” See id. FOIA does define “agency” as “each authority of the Government of the United States.” 5 U.S.C. § 551(1). But critically, the statute expressly excludes from that definition certain enumerated entities, including “the Congress” and “the courts of the United States.” Id. § 551(1)(A), (B). Under FOIA, therefore, congressional records are not “agency records” when sought from Congress. See, e.g., United We Stand Am. v. IRS, 359 F.3d 595, 597 (D.C. Cir. 2004) (“Because Congress is not an agency, congressional documents are not subject to FOIA’s disclosure requirement.”).

Even when a document qualifies as an agency record, an agency may withhold it under FOIA’s exemptions to disclosure. See 5 U.S.C. § 552(b)(1)–(9). But the NSA argues, and the district court agreed, that the HAC Report did not qualify as an “agency record” in the first place. The sole question in this appeal is thus whether the HAC Report, a document originally generated by Congress but later transmitted to an agency, is an “agency record” subject to presumptive disclosure under FOIA.

KINNUCAN V. NATIONAL SECURITY AGENCY 11

In Tax Analysts, the Supreme Court set out a general standard for determining when a document transferred to an agency becomes an agency record for FOIA purposes. 492 U.S. at 144–46. That case did not involve congressional documents, but rather a FOIA request to the DOJ for publicly available district court tax decisions that the DOJ had in its possession. Id. at 140. At the time, obtaining copies of judicial decisions from individual courts was both difficult and costly. Id. The plaintiff, a periodical devoted to federal taxation issues, sought to reduce that expense by obtaining the court decisions from the DOJ, whose Tax Division received a copy of every ruling. Id. at 138–39. The DOJ denied the request on the ground that the district court decisions were not agency records under FOIA. Id. at 147.

The Supreme Court in Tax Analysts framed a two-part inquiry to determine whether a document is an agency record. First, the agency must “create or obtain” the materials. Id. at 144 (quoting Forsham, 445 U.S. at 182). “Second, the agency must be in control of the requested materials at the time the FOIA request is made.” Id. at 145.

The Court concluded that the first requirement was met because the DOJ had obtained the documents from district courts. Id. at 146. The Court also held that the control requirement was met. Id. at 146–47. It clarified that “[b]y control we mean that the materials have come into the agency’s possession in the legitimate conduct of its official duties.” Id. at 145. Because the DOJ came to possess the district court decisions by the time of the FOIA requests, and those court decisions were “obviously not personal papers of agency employees,” the Court found the control requirement satisfied. Id. at 146–47. The Court rejected the argument that agency records encompass only records that were prepared “to be relied upon in agency decisionmaking.” Id.

12 KINNUCAN V. NATIONAL SECURITY AGENCY

at 147. That approach would “turn on the intent of the creator of a document relied upon by an agency,” when a “mens rea requirement is nowhere to be found in the Act.” Id.

We elaborated on the meaning of “agency records” in Rojas v. FAA, 941 F.3d 392 (9th Cir. 2019). In that case, the plaintiff made a FOIA request to the Federal Aviation Administration (FAA), seeking records related to the FAA’s hiring practices for air traffic controllers. Id. at 396. Relevant here, the plaintiff sought the disclosure of an FAA employee’s emails from his work email account. Id. at 400. The FAA denied the request as to some of the emails on the ground that they were personal communications and not agency records. Id. at 401.

Rojas rejected a “categorical rule” that documents are agency records whenever an agency employee creates them and they are found in agency files. Id. at 407. Instead, invoking Tax Analysts, Rojas observed that agency records are those that “have come into the agency’s possession in the legitimate conduct of its official duties” or “in connection with the transaction of public business.” Id. at 408–09 (quoting Tax Analysts, 492 U.S. at 145). We explained that courts could consider “a range of evidence” in making that determination. Id. at 409. But we refused to “fully embrace” the D.C. Circuit’s approach to non-congressional records, which turned partly on the intent of the author, because we viewed that approach as “in tension with” the Supreme Court’s determination in Tax Analysts “that ‘the intent of the creator of a document’ is not relevant to a determination of whether the document is an agency record.” Id. (quoting Tax Analysts, 492 U.S. at 147). We then remanded to the district court to apply the clarified standard to the emails at issue. Id.

KINNUCAN V. NATIONAL SECURITY AGENCY 13

Neither Tax Analysts nor Rojas addressed the question presented in this case—whether confidential records generated by Congress and then transmitted to an agency become agency records under FOIA. But the D.C. Circuit has addressed that scenario. Beginning in 1978, it has applied a special, modified standard to situations in which a plaintiff invokes FOIA to compel the disclosure of a congressional document held by an agency. See Jud. Watch, 726 F.3d at 221; Goland v. CIA, 607 F.2d 339, 346–47 (D.C. Cir. 1978). In this line of cases, the D.C. Circuit has placed significant weight on “special policy considerations” which “counsel in favor of according due deference to Congress’ affirmatively expressed intent to control its own documents.” Jud. Watch, 726 F.3d at 221 (quoting Paisley v. CIA, 712 F.2d 686, 693 n.30 (D.C. Cir. 1983), vacated in part on other grounds, 724 F.2d 201 (D.C. Cir. 1984)). Thus, in cases involving documents created by Congress, dispositive weight is placed on whether, based on the facts and circumstances, “Congress manifested a clear intent to control the document.” Id. (quoting United We Stand, 359 F.3d at 596). Where Congress has manifested a clear intent to retain control over a document, the document becomes an agency record under FOIA unless “the record reveals that Congress subsequently acted to vitiate the intent to maintain exclusive control.” ACLU, 823 F.3d at 664.

As noted above, the D.C. Circuit has also historically applied a separate standard for adjudicating when non- congressional records that make their way into an agency’s hands are agency records under FOIA. See id. at 662. In those circumstances, the D.C. Circuit considers four factors: (1) “the intent of the document’s creator to retain or relinquish control over the records;” (2) “the ability of the agency to use and dispose of the record as it sees fit;” (3) “the 14 KINNUCAN V. NATIONAL SECURITY AGENCY

extent to which agency personnel have read or relied upon the document;” and (4) “the degree to which the document was integrated into the agency’s record system or files.” Id. (quoting Jud. Watch, 726 F.3d at 218). But in the case of congressional records, and in considering whether “Congress manifested a clear intent to control the document,” the D.C. Circuit has characterized its Congressspecific approach as rendering “the first two factors of the standard test effectively dispositive.” Id. (quoting Jud. Watch, 726 F.3d at 221).

The D.C. Circuit has continued to apply its Congressspecific test since Tax Analysts, incorporating the “clear intent” standard into the “control” inquiry at the second step of the Tax Analysts test. See ACLU, 823 F.3d at 662–63. The D.C. Circuit has rejected the argument that Tax Analysts forecloses its approach, reasoning that cases involving Congress entail “considerations not at issue in Tax Analysts.” United We Stand Am., 359 F.3d at 599. The D.C. Circuit has also applied the “clear intent to control” test to presidential documents that are later transferred to an agency. See Jud. Watch, 726 F.3d at 223, 226. The Second Circuit has adopted the D.C. Circuit’s “clear intent to control” test. See Cox v. U.S. DOJ, 111 F.4th 198, 208 (2d Cir. 2024) (congressional records); Behar v. U.S. DHS, 39 F.4th 81, 88–90 (2d Cir. 2022) (presidential campaign records); Doyle v. U.S. DHS, 959 F.3d 72, 77–78 (2d Cir. 2020) (presidential records). As far as we are aware, no circuit has adopted a different standard for adjudicating whether records generated by Congress and transmitted to an agency are agency records under FOIA.

KINNUCAN V. NATIONAL SECURITY AGENCY 15

B

We adopt the D.C. Circuit’s test for when congressional documents transferred to agencies become agency records under FOIA. That is, a document prepared by Congress and provided to an agency is not subject to FOIA when, based on the facts and circumstances, Congress manifests a clear intent to control the document.

The D.C. Circuit’s test best respects Congress’s exclusion from FOIA, 5 U.S.C. § 551(1)(A), and most properly accounts for the concerns inherent in any FOIA request for congressional documents. As the D.C. Circuit explained in its foundational decision in this area, “Congress has undoubted authority to keep its records secret, authority rooted in the Constitution, longstanding practice, and current congressional rules.” Goland, 607 F.2d at 346 (citations omitted); cf. U.S. Const. art. I, § 5, cl. 3 (“Each House shall keep a Journal of its Proceedings, and from time to time publish the same, excepting such Parts as may in their Judgment require Secrecy.”). Yet at the same time, “Congress exercises oversight authority over the various federal agencies, and thus has an undoubted interest in exchanging documents with those agencies to facilitate their proper functioning in accordance with Congress’ originating intent.” Goland, 607 F.2d at 346.

To adopt the approach that Kinnucan urges, which asks only whether a congressional document was obtained by an agency as “part of its official duties or in connection with public business,” would require Congress to sacrifice one or the other of these two constitutional prerogatives. By Kinnucan’s lights, once Congress has transferred a document to an agency for its use in connection with official business, the document becomes subject to disclosure under 16 KINNUCAN V. NATIONAL SECURITY AGENCY

FOIA, even if Congress explicitly directs its confidentiality and continued control. That approach fails to respect the relevant interests at stake, for it would force Congress “either to surrender its constitutional prerogative of maintaining secrecy, or to suffer an impairment of its oversight role.” ACLU, 823 F.3d at 663 (quoting Goland, 607 F.2d at 346).

We do not suggest that these considerations would outweigh otherwise clear statutory text. Congress could, of course, subject its own records to disclosure under FOIA. But as it stands, FOIA expressly excludes Congress from its disclosure requirement. See 5 U.S.C. § 551(1)(A). And allowing plaintiffs to obtain confidential congressional records by submitting a FOIA request to “an entity that is covered under that statute,” based solely on the document’s location in agency files, would countenance “end runs” around FOIA’s explicit carveout for Congress, while frustrating Congress’s role as an oversight authority for the nation’s federal agencies. Jud. Watch, 726 F.3d at 225; see id. (“[W]here Congress has intentionally excluded a governmental entity from [FOIA], we have been unwilling to conclude that documents or information of that entity can be obtained indirectly, by filing a FOIA request with an entity that is covered under that statute.”); Goland, 607 F.2d at 346 (“It may be assumed that plaintiffs could not easily win release of the Hearing Transcript from the House of Representatives; we will not permit them to do indirectly what they cannot do directly because of the fortuity of the Transcript’s location.”); Doyle, 959 F.3d at 78 (refusing to interpret “agency records” to include White House visitor logs possessed by Secret Service because it was “hard for us to believe Congress intended that FOIA requesters be able to obtain from the gatekeepers of the White House what they are unable to obtain from its occupants” (quotations

KINNUCAN V. NATIONAL SECURITY AGENCY 17

omitted)). We “decline to confront Congress with this dilemma absent a more convincing showing of selfabnegating congressional intent.” Goland, 607 F.2d at 346.

The D.C. Circuit’s approach is not inconsistent with Tax Analysts. Tax Analysts had no occasion to consider how a document’s confidential nature or congressional origins could impact the FOIA analysis. See United We Stand, 359 F.3d at 599. Instead, the Court’s focus on whether “materials have come into the agency’s possession in the legitimate conduct of its official duties,” Tax Analysts, 492 U.S. at 145, arose in the context of documents that no one disputed were already generally available to the public—the decisions of federal courts, which today are easily accessible via a keystroke on Westlaw. See id. at 139–41. Because the Court was not confronting a request for confidential documents generated by Congress, Tax Analysts does not foreclose the D.C. Circuit’s approach.

It is true that Tax Analysts refused to limit the definition of “agency records” to “those documents prepared substantially to be relied upon in agency decisionmaking,” because such an interpretation presumed “a mens rea requirement [that] is nowhere to be found” in FOIA.” 492 U.S. at 147–48 (quotations omitted). Likewise, in Rojas, we declined to “fully embrace” the D.C. Circuit’s four-factor standard for non-congressional records because its first factor considered the intent of the author, which we regarded as “in tension” with Tax Analysts. Rojas, 941 F.3d at 408. But neither Tax Analysts nor Rojas considered the special considerations attendant to a request for documents prepared by Congress and transferred to an agency.

At issue under the D.C. Circuit’s approach to congressional records is not simply the “purpose for which”

18 KINNUCAN V. NATIONAL SECURITY AGENCY

Congress creates a record, Rojas, 941 F.3d at 408, or whether Congress created the document “primarily with an eye toward agency decisionmaking.” Tax Analysts, 492 U.S. at 147. Instead, the D.C. Circuit’s approach trains on whether, based on the facts and circumstances, Congress sought to maintain control over a document, accounting for Congress’s unique oversight authority. And under the second part of the Tax Analysts test, when “Congress has manifested its own intent to retain control” of documents it later circulates to an agency, “the agency—by definition— cannot lawfully control the documents.” United We Stand, 359 F.3d at 600 (internal quotation marks omitted) (quoting Paisley, 712 F.2d at 693).

Our adoption of the D.C. Circuit’s approach for congressional documents transmitted to agencies coheres with our basic analytical approach in Rojas, which rejected brightline distinctions in considering the “control” requirement. Rojas “reject[ed] a categorical rule” for determining if documents are agency records based solely on whether an agency employee created the documents and they were located in agency files. 941 F.3d at 407. Instead, we directed a “more complex analysis” that requires consideration of “a range of evidence.” Id. at 407, 409. The FOIA request in Rojas, which concerned the emails of an FAA employee, called for assessment of whether the emails were “in the agency’s possession in connection with agencyrelated business, or instead involve[d] personal matters.” Id. at 409. The circumstances of this case require us to answer whether the NSA has sufficient control and authority over the HAC Report to allow it unilaterally to release the report despite its congressional origins. When considering the “range of evidence” available to us for making that determination, id., we need not blind ourselves to Congress’s

KINNUCAN V. NATIONAL SECURITY AGENCY 19

express directions to maintain the confidentiality of its own documents.

Because we are satisfied that the D.C. Circuit’s approach to congressional records is both sound and faithful to controlling precedent, we adopt that approach for addressing FOIA requests to agencies for records originally created by Congress.

C

We now apply that approach to Kinnucan’s FOIA request.

The first question is, again, whether the NSA “create[d]

or obtain[ed]” the HAC Report. Tax Analysts, 492 U.S. at 144 (quoting Forsham, 445 U.S. at 182). There is no dispute that the NSA obtained the HAC Report in May 1968. The only disputed issue is the second part of the Tax Analysts test—whether the NSA is “in control of the requested materials.” Id. at 145. In the specific context of congressional records, and as discussed above, that means we must determine whether, based on the facts and circumstances, “Congress manifested a clear intent to control” the HAC Report. ACLU, 823 F.3d at 663 (quoting Jud. Watch, 726 F.3d at 221). We examine “[1] the intent of the document’s creator to retain or relinquish control over the records; [and] [2] the ability of the agency to use and dispose of the record as it sees fit.” ACLU, 823 F.3d at 662– 63 (citing Jud. Watch, 726 F.3d at 218, 221).

Under the facts and circumstances of this case, the NSA has demonstrated that Congress manifested a clear intent to control the HAC Report, such that it must still be regarded as a congressional record outside of FOIA’s reach. Most prominently, the HAC Report is stamped with a banner, 20 KINNUCAN V. NATIONAL SECURITY AGENCY

written in all capital letters, stating “NOT FOR RELEASE UNLESS AND UNTIL AUTHORIZED BY COMMITTEE.” That banner is affixed to the cover page of each of the two volumes of the HAC Report and on the memorandum pages that follow the cover pages.

The D.C. Circuit has consistently recognized similar markings as a highly relevant factor in determining whether Congress manifested a clear intent to assert continued control over a document, alongside other probative evidence. In Goland, for example, the D.C. Circuit found sufficient indicia of congressional control when a Congressional transcript was created in executive session, “bore the typewritten marking ‘Secret’ on its interior cover page,” which then “appear[ed] again on the first page of the text,” and the CIA submitted an affidavit stating that the document was used “for internal reference purposes only.” 607 F.2d at 347.

Later cases continued to emphasize the importance of such evidence. In United We Stand, the D.C. Circuit concluded that a congressional letter to the IRS stating that the document “is a Congressional record and is entrusted to the [IRS] for your use only,” and “may not be disclosed without the prior approval of the Joint Committee,” was not an agency record under FOIA. 359 F.3d at 601–02. In ACLU, the court held that the following letter to the CIA established that the subject documents were not agency records:

Any documents generated on the network drive referenced in paragraph 5, as well as any other notes, documents, draft and final recommendations, reports or other materials generated by Committee staff or

KINNUCAN V. NATIONAL SECURITY AGENCY 21

Members, are the property of the Committee and will be kept at the Reading Room solely for secure safekeeping and ease of reference. These documents remain congressional records in their entirety and disposition and control over these records, even after the completion of the Committee’s review, lies exclusively with the Committee. As such, these records are not CIA records under [FOIA] or any other law . . . If the CIA receives any request or demand for access to these records from outside the CIA under [FOIA] or any other authority, the CIA will immediately notify the Committee and will respond to the request or demand based upon the understanding that these are congressional, not CIA, records.

823 F.3d at 665. See also Paisley, 712 F.2d at 694 (observing that a lack of “external indicia of control or confidentiality on the faces of the documents” cut against a conclusion of congressional control).

Most of these cases involved congressional records generated after the D.C. Circuit developed its standard for adjudicating FOIA requests to agencies for congressional documents. See Goland, 607 F.2d at 345–48. Still, the HAC Report banner is not as detailed or specific as the markings in United We Stand or ACLU. While that makes this a closer case, we conclude that the only reasonable inference is that the banner reflects Congress’s explicit intent to prevent release of the HAC Report absent Committee authorization, 22 KINNUCAN V. NATIONAL SECURITY AGENCY

meaning that Congress intended to retain control of the document for FOIA purposes.

Kinnucan responds that the exact circumstances of the banner’s inclusion on the HAC Report are not completely apparent from the record. For example, it is not clear whether the banner was appended to the HAC Report when the Committee initially generated the report or when it was later transmitted to the NSA in May 1968. But that distinction is immaterial, for in either event, the clear import of the banner is to restrict further dissemination absent explicit authorization from the Committee. See ACLU, 823 F.3d at 664 (“Congress may manifest an intent to retain control over documents either when the documents are created or when the documents are transmitted to an agency.” (emphases in original)). The important point is that Congress affixed the banner to the report, before it was transmitted to the agency in May 1968. That is the only credible inference from the record, given that the memorandum pages on which the banner appears are addressed to the “Chairman” from the “Director” of the “Survey and Investigations” staff; those pages are dated December 29, 1967 and February 15, 1968, before transmission to the agency; and the NSA has represented without contradiction its “understanding that the banner would have been included” by the staff of the HAC “as the preparer of the report.”

We do not read the banner, as Kinnucan would have it, to represent a limitation only on the Committee’s authority to disclose the HAC Report to other entities. The banner is not so narrowly drawn. Kinnucan also argues that the banner “does not evince an intent to never release the Report—just that copies could not be released to Congress, agencies, or others until initially authorized by the Committee itself,”

KINNUCAN V. NATIONAL SECURITY AGENCY 23

which occurred upon transmission to the NSA. But given that the banner was present on the HAC Report when it was transmitted to the NSA, we cannot reasonably infer that the banner no longer applied when the NSA obtained its copy. Further, while not dispositive of our inquiry, the official charged with overseeing the NSA’s FOIA office avers that “this banner is used by Congress to indicate its intent to retain control.” Even making all inferences in Kinnucan’s favor, the record indicates that Congress’s restriction on the HAC Report’s dissemination continued in force after the document was transferred to the NSA.

Other facts and circumstances surrounding the HAC Report support our understanding of the banner. The HAC Report is marked “TOP SECRET” on every page, “because it contains information, so classified by the Department of Defense, relating to matters involving national security of the United States.” The “TOP SECRET” markings, though not sufficient to satisfy the government’s burden alone, are also consistent with Congress’s clear intention to retain control of the HAC Report. Although a document’s classification status poses a distinct question from whether it qualifies as a congressional record under FOIA, these markings support our conclusion that Congress, through the banner, manifested an explicit intent to preclude unauthorized dissemination. See Goland, 607 F.2d at 347 (“[T]he facts that the Committee met in executive session and that the Transcript was denominated ‘Secret’ plainly evidence a Congressional intent to maintain Congressional control over the document’s confidentiality.”). 1

1 We do not rely on the statements allegedly made by congressional staffers to NSA officials in 2009 and 2024 regarding Congress’s supposed objections to releasing the HAC Report. These statements 24 KINNUCAN V. NATIONAL SECURITY AGENCY

The NSA has also met its burden to demonstrate that the agency is not free “to use and dispose of the” HAC Report “as it sees fit.” ACLU, 823 F.3d at 662 (quotations omitted); see Judicial Watch, 726 F.3d at 223 (observing that the White House’s “manifest[ation]” of “a clear intent to control the documents” meant that “the agency is not free to use and dispose of the documents as it sees fit” (quotations omitted)). Indeed, according to the NSA, its “treatment of the Congressional report has been consistent with the Agency’s understanding that the document at all times has been and continues to be controlled by the Committee on Appropriations of the U.S. House of Representatives.” The NSA further represents that it has limited the HAC Report’s disclosure and employed other protections based on the report’s status as a “Top Secret classified document.” Consistent with these limitations, the NSA represents that it has never released the HAC Report to the public. Nor is there any evidence that it has.

The NSA’s use of the HAC Report to some limited extent by internally sharing the document among NSA officials does not alter our conclusion. Kinnucan points out that the transmission slip and the Memorandum for the Director show that the HAC Report was circulated internally to the NSA’s Director and a handful of other officials. The Attack Report also states that the HAC Report was among the sources stored in the “Crisis Collection” of the “NSA History Collection,” where Kinnucan suggests NSA employees could have accessed it. See Gerhard & Millington, supra, at 60.

were made as a result of FOIA requests and thus are “post-hoc objection[s]” that cannot “manifest the clear assertion of congressional control” that is required. ACLU, 823 F.3d at 664 (quotations omitted).

KINNUCAN V. NATIONAL SECURITY AGENCY 25

But even when construing the record most favorably to Kinnucan on these points, the NSA’s internal use of the HAC Report remains consistent with the banner, which precluded the NSA from releasing the document outside of the agency. The D.C. Circuit has elsewhere concluded, and we agree, that a congressional record with explicit limits on dissemination does not become an agency record under FOIA merely because an agency uses the document on an internal and confidential basis, consistent with the scope of Congress’s claim to continued control.

In ACLU, the D.C. Circuit considered a FOIA request for a report generated by the Senate Select Committee on Intelligence (SSCI) that reviewed the CIA’s post-9/11 detention practices. 823 F.3d at 658. To create that report, SSCI sent a letter to the CIA in 2009 arranging the terms of congressional review of confidential CIA materials, with the letter asserting congressional control and ownership over any resulting work product. Id. at 659–60. The result of the congressional inquiry was a “6,000-plus page investigative report” and a “500-plus page Executive Summary.” Id. at 658. Congress eventually released the Executive Summary to the public, but the full report was kept confidential. Id. SSCI did, however, send the full report to the President and specified individuals at the CIA, Department of Defense, Department of Justice, and Department of State. Id. at 660. That transmittal included a letter to the President from Committee Chair Senator Feinstein, which indicated that:

[T]he full report should be made available within the CIA and other components of the Executive Branch for use as broadly as appropriate to help make sure that this experience is never repeated. To help 26 KINNUCAN V. NATIONAL SECURITY AGENCY

achieve that result, I hope you will encourage use of the full report in the future development of CIA training programs, as well as future guidelines and procedures for all Executive Branch employees, as you see fit.

Id.

Based on the letter’s recommendation that the full report be used “broadly” by the Executive Branch, the plaintiffs in ACLU argued that Congress had relinquished its claim to continued control over the full report. Id. at 667. The D.C. Circuit disagreed, explaining that while the Feinstein letter “undoubtedly gives the Executive Branch some discretion to use the Full Report for internal purposes,” it “does not override the Senate Committee’s clear intent to maintain control of the Full Report expressed in the [earlier] letter.” Id. We likewise conclude that, even making all reasonable inferences in Kinnucan’s favor, the NSA’s limited circulation of the HAC Report to its own officials is consistent with Congress’s assertion of control over the HAC Report, as indicated by the banner. 2 These points also answer the argument that the Attack Report renders the HAC Report an agency record under FOIA. The NSA’s preparation of the Attack Report did not convert the HAC Report into an agency record because, as discussed above, the agency’s internal use of the document remained consistent with the banner’s limitation on

2 The internal NSA “Memorandum for the Director” describes the HAC Report as “purloined.” The meaning of this statement is unclear. Regardless, whatever it could refer to, it does not override or undermine the clear import of the banner.

KINNUCAN V. NATIONAL SECURITY AGENCY 27

dissemination outside of the agency. And the Attack Report’s eventual declassification in 2006 did not have that effect either, because the HAC Report is a distinct record that has remained confidential. In the same way that the public dissemination of the Executive Summary of the report in ACLU did not render the full report an agency record, see 823 F.3d at 666, the declassification and publication of the Attack Report does not make the HAC Report disclosable under FOIA. See also Cox, 111 F.4th at 212 (“The fact that the Committee decided to declassify certain portions of the report for publication but not others demonstrates that it still maintained control over the report.”).

In sum, the district court correctly determined that Congress manifested a clear intent to control the HAC Report. In particular, the banner placed on the report shows Congress’s intent to preclude disclosure of the report outside of the agency. Nothing that the NSA has done with the HAC Report since its 1968 transmission shows an “ability . . . to use and dispose of the record as it sees fit.” ACLU, 823 F.3d at 662 (quoting Judicial Watch, 726 F.3d at 218). And nothing in the record demonstrates that Congress subsequently vitiated its intent to control the document, either through action by Congress itself or through probative circumstantial evidence.

At bottom, Kinnucan seeks from the NSA an oversight document commissioned by Congress. The banner on the document, affixed by Congress, expressly sought to maintain its ability to control the document’s release. Congress, which is not subject to FOIA, has to date not released that document publicly. While we appreciate that there may be public interest in the HAC Report, it is not subject to disclosure under FOIA. The proper recourse for 28 KINNUCAN V. NATIONAL SECURITY AGENCY

obtaining this document is to petition the document’s author—Congress.

AFFIRMED.