ROGERS, Circuit Judge:
Pursuant to the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552, the Electronic Privacy Information Center ("EPIC") requested release by the Department of Homeland Security of Standard Operating Procedure 303 ("SOP 303"), which the Department describes as a protocol for shutting down wireless networks during critical emergencies. When the Department released only a heavily redacted version, EPIC successfully sued to compel disclosure. See Elec. Privacy Info. Ctr. v. Dep't of Homeland Sec., 999 F.Supp.2d 24 (D.D.C.2013) ("EPIC"). The Department appeals, invoking FOIA Exemption 7(F) on the ground that production of SOP 303 could reasonably be expected to endanger many individuals' lives or physical safety. Upon de novo review, we hold that the plain text of Exemption 7(F) protects law enforcement records the disclosure of which "could reasonably be expected to endanger the life or physical safety of any individual," 5 U.S.C. § 552(b)(7)(F), during a critical emergency, without requiring the withholding agency to specifically identify the individuals who would be endangered, and that much if not all of SOP 303 is exempt from disclosure. Accordingly, we reverse the grant of summary judgment to EPIC, and we remand the case for the district court to determine whether any reasonably segregable portions of SOP 303 can be disclosed.
SOP 303 is an "Emergency Wireless Protocol" that codifies a "unified voluntary process for the orderly shut-down and restoration of wireless services during critical emergencies such as the threat of radio-activated improvised explosive devices." Decl. James Holzer, I, Senior Dir. FOIA Opns., Privacy Off., Dep't Homeland Sec., ¶ 20, June 28, 2013; see Nat'l Sec. Telecomm. Advisory Comm., Termination of Cellular Networks During Emergency Situations, NSTAC Issue Review 2006-07, at 139 (2007) ("NSTAC Issue Review").
On July 10, 2012, EPIC submitted a FOIA request to the Department seeking the full text of SOP 303, the series of questions used to determine whether a shutdown is necessary, and any related protocols or guidelines. The Department initially responded that it had conducted a comprehensive search, but was unable to locate or identify any responsive records. Following an administrative appeal, however, the Department conducted another search and located one responsive record: SOP 303. See Nat'l Coordinating Ctr. for Telecomm. Standard Operating Procedure 303 (Sept. 25, 2009) ("SOP 303"). The SOP included the full text of the pre-determined series of questions that determines if a shutdown is necessary, and the executing protocols related to the implementation of SOP 303. Holzer Decl. ¶ 21.
Pursuant to FOIA Exemptions 6 and 7(C), which protect certain personal information, see 5 U.S.C. §§ 552(b)(6), (b)(7)(C), the Department withheld from EPIC the names, telephone numbers, and email addresses for state homeland security officials contained in SOP 303. Aside from a sentence explaining that SOP 303 "provides detailed procedures for the [NCC] to coordinate requests for the disruption of cellular service," certain subsection headings, and the title of Appendix E ("External Agency Cellular Service Disruption Implementation Instructions"), essentially all of SOP 303 was withheld pursuant to FOIA Exemptions 7(F) and 7(E), which permit non-disclosure of certain law-enforcement information that, respectively, "could reasonably be expected to endanger the life or physical safety of any individual," 5 U.S.C. § 552(b)(7)(F), or "would disclose techniques and procedures for law enforcement investigations or prosecutions," id. § 552(b)(7)(E).
On February 27, 2013, EPIC filed suit seeking the release of SOP 303 in its entirety. See 5 U.S.C. § 552(a)(4)(B). The parties filed cross motions for summary judgment. In support of summary judgment, the Department submitted the Holzer declaration asserting that SOP 303 was exempt from disclosure under FOIA Exemption 7(F) because "[m]aking SOP 303 public would, e.g., enable bad actors to insert themselves into the process of shutting down or reactivating wireless networks by appropriating verification methods and then impersonating officials designated for involvement in the verification process." Holzer Decl. ¶ 26. Such bad actors would, Holzer stated, then "be [able] to disable the protocol [and] freely use wireless networks to activate ... improvised explosive devices," so "there is a reasonable expectation that disclosure could reasonably endanger individuals' lives or physical safety." Id. Exemption 7(E) also applied because, according to Holzer, SOP 303 "contains a homeland security procedure primarily intended to efficiently and effectively deter the triggering of radio-activated improvised explosive devices," and during such critical emergencies "orderly deactivation of wireless networks may be the best option for preventing and/or mitigating explosions that would endanger life and property." Id. ¶ 25. Holzer repeated the "bad actor" explanation for non-disclosure, adding that SOP 303's production could "circumvent or interfere with a law enforcement strategy designed to prevent activation of improvised explosive devices by providing information about when shutdown procedures are used and how a shutdown is executed." Id.
The Department appeals, and our review of the grant of summary judgment is de novo, viewing the evidence in the light most favorable to the non-moving party. Pub. Emps. for Envtl. Responsibility v. U.S. Section, Int'l Boundary & Water Comm'n, U.S.-Mexico, 740 F.3d 195, 200 (D.C.Cir.2014) ("PEER").
The FOIA "mandates that an agency disclose records on request, unless they fall within one of nine exemptions." Milner v. Dep't of Navy, 562 U.S. 562, 131 S.Ct. 1259, 1262, 179 L.Ed.2d 268 (2011); see 5 U.S.C. §§ 552(a)(3)(A), (b)(1)-(9). The basic purpose of the FOIA reflects "a general philosophy of full agency disclosure." John Doe Agency v. John Doe Corp., 493 U.S. 146, 152, 110 S.Ct. 471, 107 L.Ed.2d 462 (1989) (quotation omitted); see also Nat'l Ass'n of Home Builders v. Norton, 309 F.3d 26, 32 (D.C.Cir.2002). The FOIA's exemptions "are explicitly made exclusive" and "must be narrowly construed." Milner, 131 S.Ct. at 1262 (internal quotation marks omitted). The burden is on the agency to justify withholding the requested documents, and the FOIA directs district courts to determine de novo whether non-disclosure was permissible. U.S. Dep't of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 755 & n. 6, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989) (citing 5 U.S.C. § 552(a)(4)(B)). This court's analysis of the scope of Exemption 7 in PEER, 740 F.3d at 202-06, is highly instructive, if not largely dispositive, here.
To fall within FOIA Exemption 7, "documents must first meet a threshold requirement: that the records were `compiled for law enforcement purposes.'" PEER, 740 F.3d at 202-03 (quoting 5 U.S.C. § 552(b)(7)). "[T]he term `compiled' in Exemption 7 requires that a document be created, gathered, or used by an agency for law enforcement purposes at some time before the agency invokes the exemption." Id. at 203 (citing John Doe Agency, 493 U.S. at 155, 110 S.Ct. 471). "Law enforcement entails more than just investigating and prosecuting individuals after a violation of the law," id. (emphasis in original), and "`includes ... proactive steps designed to prevent criminal activity and to maintain security.'" Id. (alteration
Applying these principles, the court held in PEER that emergency action plans and inundation maps created to prevent attacks on two dams on the U.S.-Mexico border and to maintain order and ensure dam security during emergencies satisfied Exemption 7's gateway requirement. Id. at 204. Here, too, the Department has shown that it compiled SOP 303 for law enforcement purposes. SOP 303 was developed after the 2005 bombings of London's transportation system to address deficiencies in the United States' ability to address and respond to such threats. The Holzer declaration explains that SOP 303 sets forth the steps taken to decide whether and when to disrupt wireless networks during critical emergencies to, for example, "efficiently and effectively deter the triggering of radio-activated improvised explosive devices." Holzer Decl. ¶ 25. As so described, SOP 303 was created to prevent crime and keep people safe, which qualify as law enforcement purposes. PEER, 740 F.3d at 202-04. SOP 303 meets Exemption 7's threshold test.
Even if a record satisfies Exemption 7's threshold test, an agency may only withhold the record pursuant to Exemption 7(F) if the record's release "could reasonably be expected to endanger the life or physical safety of any individual." 5 U.S.C. § 552(b)(7)(F); see PEER, 740 F.3d at 202. Our consideration of Exemption 7(F)'s scope begins and ends with its text. Milner, 131 S.Ct. at 1264, 1266-67.
Exemption 7(F) covers documents that "`could reasonably be expected to endanger the life or physical safety of any individual.'" PEER, 740 F.3d at 202 (quoting 5 U.S.C. § 552(b)(7)(F)). The scope of the exemption is broadly stated, see id. at 205, and consequently the government, once it has met Exemption 7's threshold test, "will ordinarily be able to satisfy Exemption 7(F) for documents relating to critical infrastructure, such as ... emergency plans." Id. at 206. Here, the Department maintains that disclosure of SOP 303, according to the Holzer declaration, "would enable bad actors to circumvent or interfere with a law enforcement strategy designed to prevent activation of improvised explosive devices" and "to insert themselves into the process of shutting down or reactivating wireless networks by appropriating verification methods and then impersonating officials designated for involvement in the verification process." Holzer Decl. ¶¶ 25-26. That explanation shows that SOP 303's production could reasonably be expected to place many individuals at risk and thus, the Department contends, SOP 303 falls within the scope of the plain text of Exemption 7(F).
EPIC maintains, however, that Exemption 7(F) requires the Department to identify with some specificity the individuals who would be endangered by SOP 303's disclosure. It relies on American Civil Liberties Union v. Department of Defense, 543 F.3d 59 (2d Cir.2008) ("ACLU"), vacated on other grounds, 558 U.S. 1042, 130 S.Ct. 777, 175 L.Ed.2d 508 (2009). In that case, the Defense Department had refused to release twenty-one photographs depicting abusive treatment of detainees by United States soldiers in at least seven different locations in Afghanistan and Iraq, invoking Exemption 7(F) on the ground that release of the photographs could reasonably be expected to endanger the life and physical safety of U.S. and Coalition troops, as well as civilians in Iraq and Afghanistan. ACLU, 543 F.3d at 64-65. The Second Circuit observed that "[t]he phrase `any individual' ... may be flexible, but is not vacuous," id. at 67, and concluded,
Our decision in PEER does not foreclose this interpretation of Exemption 7(F), for in PEER the court had no occasion to decide whether it agreed with it. The court stated that "even if we agreed with the Second Circuit's reading of Exemption 7(F), ... the [agency] would prevail even under the Second Circuit's approach." PEER, 740 F.3d at 206 (emphasis added). Unlike in PEER, however, here the Department does not point to a "particularized threat to a discrete population," id., but rather maintains its non-production falls within Exemption 7(F) because release of SOP 303 would endanger anyone in the United States who happens to be near an unexploded bomb or frequents high value targets. In the Department's view, it would be anomalous if it could withhold SOP 303 if disclosure poses a danger to a small group of specifically identifiable people but not where many or most people would be endangered by production. Furthermore, the Department contends that, even under the Second Circuit's interpretation, it has identified the individuals most likely to be at risk with the requisite degree of specificity because "there are identifiable groups who are more likely to be harmed" from SOP 303's disclosure, including "people near unexploded bombs, people who frequent high-value targets, and bomb squads and other first responders." Appellant's Br. 19. If viewed without regard to SOP 303's requirement that there be a critical emergency for a shutdown to take place, then the Department's interpretation may not accord with the Second Circuit's approach. See ACLU, 543 F.3d at 71. Significantly, however, the context addressed by the Second Circuit involved "vast" populations and the court disclaimed that it was confronting a case where there was a showing of a reasonable expectation of danger with respect to one or more individuals, see id., which we conclude there is here.
The court must both narrowly construe the FOIA's exemptions and apply the statute's plain text. See Milner, 131 S.Ct. at
EPIC maintains that Congress' choice to condition Exemption 7(F)'s availability on danger to an individual, rather than danger in general, indicates a requirement that the subject of the danger be identified with at least reasonable specificity. And according to EPIC, to reject its interpretation would read "individual" out of the statute, see ACLU, 543 F.3d at 70, thereby violating the anti-superfluity canon. See Milner, 131 S.Ct. at 1268; Qi-Zhuo v. Meissner, 70 F.3d 136, 139 (D.C.Cir.1995). But understood in context, the phrase "any individual" makes clear that Exemption 7(F) now shields the life or physical safety of any person, not only the law enforcement personnel protected under the pre-1986 version of the statute. The district court took note of the 1986 amendment but went beyond the exemption's plain text to impose a requirement divorced from the language Congress enacted. See EPIC, 999 F.Supp.2d at 32-34. Contrary to EPIC's suggestion that Congress could have made explicit that the government need not identify the individuals at risk with specificity, "the mere possibility of clearer phrasing cannot defeat the most natural reading of a statute." Caraco
EPIC implies that its interpretation of Exemption 7(F) is rooted in the exemption's command that disclosure "could reasonably be expected to endanger the life or physical safety of any individual." 5 U.S.C. § 552(b)(7)(F) (emphasis added). But EPIC does not explain why the release of records or information could reasonably be expected to endanger the life or physical safety of any individual only where the individual or individuals at risk can be identified specifically. Release of SOP 303, according to the Department, poses a concrete and non-speculative danger to numerous albeit unspecified individuals, see Holzer Decl. ¶¶ 25-26, and the Department thereby asserted a direct nexus between disclosure and a reasonable possibility of personal harm. See PEER, 740 F.3d at 206. The attacks in London that triggered the establishment of SOP 303 illustrate, as noted, that before-the-fact individual identification is unlikely to be practical. To the extent EPIC is suggesting that the Department has not satisfied Exemption 7(F)'s risk threshold, that suggestion is met by "[t]he confluence of Exemption 7(F)'s expansive text and [the court's] generally deferential posture when [it] must assess national security harms." Id. at 205 (citing Milner, 131 S.Ct. at 1272 (Alito, J., concurring)).
EPIC suggests that if there is a real danger from disclosure, then the Department should classify SOP 303, bringing it within FOIA Exemption 1, which protects materials that are classified pursuant to certain Executive orders. See 5 U.S.C. § 552(b)(1). The Second Circuit accepted a version of this argument in ACLU, explaining that
543 F.3d at 73. But the possibility of classification and the concomitant protection from disclosure provided by Exemption 1 do not render Exemption 7(F) superfluous. The Department has plausibly identified "practical barriers" to classifying SOP 303, including the fact that it "must be shared with federal law enforcement officials, [S]tate homeland security officials, and national cellular carriers." Reply Br. 6. Nor does adhering to the plain text of Exemption 7(F) eviscerate Exemption 1, which applies even to records not compiled for law enforcement purposes.
The NCC is presumed to be aware of the need to restore service promptly, particularly in an age in which wireless communication is a critical component of peoples' lives. See Riley v. California, ___ U.S. ___, 134 S.Ct. 2473, 2484, 2489, 189 L.Ed.2d 430 (2014); United States v. Jones, ___ U.S. ___, 132 S.Ct. 945, 957, 181 L.Ed.2d 911 (2012) (Sotomayor, J., concurring); id. at 963 (Alito, J., concurring in the judgment). It remains for EPIC and other litigants to seek additional judicial scrutiny by requesting findings on specific matters or in camera review. At some point, as our precedent indicates, the element of trust takes over where an agency has filed a sufficiently specific sworn declaration by a knowledgeable official. See Juarez v. U.S. Dep't of Justice, 518 F.3d 54, 60 (D.C.Cir.2008); King v. U.S. Dep't of Justice, 830 F.2d 210, 217 (D.C.Cir.1987). Even if SOP 303's shutdown protocol is a matter of significant
Finally, to the extent EPIC looks to Exemption 7(F)'s legislative history, the court's choice when "presented, on the one hand, with clear statutory language and, on the other, with dueling [congressional statements]," is foreordained. See Milner, 131 S.Ct. at 1267. Prior to the 1986 FOIA amendments, Exemption 7(F) protected records the release of which would "endanger the life or physical safety of law enforcement personnel." See Pub.L. No. 93-502, sec. 2(b), § 552(b)(7), 88 Stat. 1561, 1563-64 (1974). The exemption did not cover witnesses, interviewees, victims, informants, or families of law-enforcement personnel and thus, for example, undermined law enforcement officers' ability to enlist informants. 131 Cong. Rec. 253 (daily ed. Jan. 3, 1985) (statement of Hon. Carol E. Dinkins, Deputy U.S. Att'y Gen.). To remedy this omission, the Executive Branch asked that Exemption 7(F) be amended. Id. In response, Congress expanded Exemption 7(F) to protect law-enforcement documents if their release would endanger "any individual." 5 U.S.C. § 552(b)(7)(F); see Pub.L. No. 99-570, sec. 1802(a), § 552(b)(7), 100 Stat. 3207, 3255-56 (1986).
EPIC views Congress' amendment of Exemption 7(F) in 1986 to bring only witnesses, interviewees, victims, informants, and families of law-enforcement personnel within the exemption. There are statements of Members of Congress and the Executive Branch that reflect concern about those groups' prior omission. See 130 Cong. Rec. 3,502 (daily ed. Feb. 27, 1984) (statement of Sen. Hatch) ("The bill would ... extend [E]xemption 7(F) to include such persons as witnesses, potential witnesses, and family members whose personal safety is of central importance to the law enforcement process."); 130 Cong. Rec. 3,520 (daily ed. Feb. 27, 1984) (statement of Sen. Leahy) (describing certain changes to the FOIA as "narrowly aimed so that they will not interfere with the public's right to know where law enforcement is not seriously jeopardized"). Other Members' statements viewed the amendment to Exemption 7(F) as relatively broad. For instance, Senator Hatch, the principal sponsor of the amendment, remarked that the changes to Exemption 7 were "intended to ... ease considerably a Federal law enforcement agency's burden in invoking" it. 132 Cong. Rec. 31,424 (daily ed. Oct. 15, 1986). Although General Dinkins stated that the language of Exemption 7 would be "modified slightly — not revised wholesale," 131 Cong. Rec. 248, she also expressed concern that the prior version of the exemption did not protect "the life of any other person" besides law enforcement personnel. Id. at 253. And her explanation that the 1986 amendments expanded Exemption 7(F) "to include such persons as witnesses, potential witnesses, and family members," id. (emphasis added), is reasonably understood as illustrative not exclusive. In any event, what Congress enacted was broad language that was not limited to protection of law enforcement personnel and related persons. See PEER, 740 F.3d at 205. "We will not... allow ambiguous legislative history to muddy clear statutory language." Milner, 131 S.Ct. at 1266. "All we hold today is that Congress has not enacted the FOIA exemption [EPIC] desires. We leave to Congress, as is appropriate, the question whether it should do so." Id. at 1271.