Katsas, Circuit Judge.
Jamal Khashoggi, a prominent Saudi journalist, was murdered in a Saudi consulate in 2018, apparently on orders of the Saudi Crown Prince. Under the Freedom of Information Act, the plaintiffs here sought records about whether four United States intelligence agencies knew, before the murder, of an impending threat to Khashoggi. The agencies refused to confirm or deny whether they have any responsive records, on the ground that the existence or nonexistence of such records is classified information. We consider whether FOIA permitted this response.
FOIA generally requires federal agencies to disclose their records upon request, 5 U.S.C. § 552(a)(3)(A), subject to nine exemptions. Exemption 1 covers matters that are "specifically authorized under criteria established by an Executive order to be kept secret in the interest of national defense or foreign policy" and are "properly classified pursuant to such Executive order." Id. § 552(b)(1). The relevant executive order permits classification of information that "could reasonably be expected to cause identifiable or describable damage to the national security" if disclosed, and that "pertains to" either "intelligence activities" or "intelligence sources or methods." Exec. Order No. 13,526 § 1.4(c), 75 Fed. Reg. 707, 709 (Dec. 29, 2009).
To claim a FOIA exemption, an agency ordinarily must "acknowledge the existence of information responsive to a FOIA request and provide specific, nonconclusory justifications for withholding that information." Roth v. DOJ, 642 F.3d 1161, 1178 (D.C. Cir. 2011). But if "the fact of the existence or nonexistence of agency records" itself falls within a FOIA exemption, the agency may "refuse to confirm or deny the existence" of the requested records. Wolf v. CIA, 473 F.3d 370, 374 (D.C. Cir. 2007) (cleaned up). This is now known as a Glomar response, after the Central Intelligence Agency successfully refused to confirm or deny whether it had records about a ship called the Glomar Explorer. See Phillippi v. CIA, 546 F.2d 1009 (D.C. Cir. 1976). In considering a Glomar response, courts apply the "general exemption review standards established in non-Glomar cases." Wolf, 473 F.3d at 374. An agency thus bears the burden to sustain a Glomar response. 5 U.S.C. § 552(a)(4)(B).
If an agency has "officially acknowledged otherwise exempt information through prior disclosure," it has "waived its right to claim an exemption with respect to that information." ACLU v. CIA, 710 F.3d 422, 426 (D.C. Cir. 2013). A plaintiff urging official acknowledgment must point to "specific information in the public domain that appears to duplicate that being withheld." Id. at 427 (quoting Wolf, 473 F.3d at 378). The prior disclosure must match the information requested, must be as specific, and must have been "made public through an official and documented disclosure." Fitzgibbon v. CIA, 911 F.2d 755, 765 (D.C. Cir. 1990). To constitute official acknowledgment in the Glomar context, the prior disclosure must confirm the existence or nonexistence of records responsive to the FOIA request. ACLU, 710 F.3d at 427.
Jamal Khashoggi, a Saudi national and United States resident, frequently and
Soon after the murder, a State Department spokesman fielded questions at a press conference. A reporter asked whether "the U.S. had intelligence, overheard or intercepted communications, suggesting that there was a threat to Mr. Khashoggi." The spokesman responded: "[A]lthough I cannot comment on intelligence matters, I can say definitively the United States had no advanced knowledge of Jamal Khashoggi's disappearance." Press Briefing, Dep't of State (Oct. 10, 2018), 2017-2021.state.gov/briefings/department-press-briefing-october-10-2018. Asked a second time whether "you" had prior knowledge of a threat, the spokesman answered that "we" had no such knowledge. Id. Asked a third time whether "the administration" had prior knowledge, the spokesman answered: "[A]lthough I can't go into intelligence matters, I can definitively say that we had no knowledge in advance of Mr. Khashoggi's disappearance." Id.
This case concerns a FOIA request for records bearing on whether the intelligence community had prior knowledge of the threat. The intelligence community includes eighteen executive agencies that "conduct intelligence activities necessary for the conduct of foreign relations and the protection of the national security of the United States." Exec. Order No. 12,333 § 1.4, 46 Fed. Reg. 59,941, 59,943 (Dec. 4, 1981); see also 50 U.S.C. § 3003(4) (listing intelligence-community agencies). The Director of National Intelligence is the head of the intelligence community, id. § 3023(b)(1), and so may direct how the community "carries out its mission," DiBacco v. U.S. Army, 795 F.3d 178, 198 (D.C. Cir. 2015). Exercising that authority, the Director promulgated Intelligence Community Directive 191. Under that Directive, any intelligence-community agency that "acquires credible and specific information indicating an impending threat of intentional killing, serious bodily injury, or kidnapping ... shall have a duty to warn the intended victim." Intelligence Community Directive 191, § E.1 (July 21, 2015). Each intelligence agency must "document and maintain records" regarding "duty to warn actions" such as the "method, means, and substance of any warning given." Id. § F.13.
The Knight First Amendment Institute at Columbia University and the Committee to Protect Journalists (CPJ) submitted FOIA requests for records relating to Khashoggi. On October 19, 2018, Knight sent requests to the Department of State and four intelligence-community agencies —the CIA, the Office of the Director of National Intelligence, the National Security Agency, and the Federal Bureau of Investigation. From each of the five agencies, Knight requested "[a]ll records concerning
The intelligence agencies issued Glomar responses. They asserted that the existence or nonexistence of responsive records is classified information protected by Exemption 1.
Knight voluntarily dismissed its claims, and CPJ dismissed its claims against the State Department. The remaining parties —CPJ and the four intelligence agencies —cross-moved for summary judgment. The district court upheld the agencies' Glomar responses and granted them summary judgment. Knight First Amend. Inst. at Colum. Univ. v. CIA, 424 F.Supp.3d 36, 42-46 (D.D.C. 2020).
CPJ raises two arguments on appeal. First, it contends that the State Department officially acknowledged that no responsive records exist, thus precluding the intelligence agencies from making a Glomar response. Second, on the merits, it argues that Exemption 1 does not cover the existence or nonexistence of responsive records. Our standard of review is de novo. Wolf, 473 F.3d at 374.
We begin with the question of official acknowledgement. An agency waives any right to make a Glomar response by disclosing whether responsive records exist. ACLU, 710 F.3d at 426. Once an agency makes such an acknowledgment, "there is no value in a Glomar response. The secret is out." Leopold v. CIA, 987 F.3d 163, 167 n.5 (D.C. Cir. 2021).
To establish official acknowledgment, a plaintiff must identify information in the public domain that (1) matches the information requested, (2) is as specific, and (3) has "been made public through an official and documented disclosure." Fitzgibbon, 911 F.2d at 765. CPJ invokes the State Department's assertion that "the United States" had no advance knowledge of Khashoggi's "disappearance" or of a threat to his life. Without prior knowledge of an impending threat to Khashoggi, CPJ reasons, the intelligence agencies could have had neither a duty to warn Khashoggi under Directive 191 nor any records related to the duty. For the sake of argument, we will assume that the State Department's assertion that the United States had no prior knowledge of the attack matched an assertion that the intelligence agencies have no responsive records, and that it did so with the requisite degree of specificity. We will further assume that statements made in a press conference are sufficiently formal and considered to constitute "official" acknowledgment by the agency making the statements. Nonetheless, we agree with the intelligence agencies
We do not "deem `official' a disclosure made by someone other than the agency from which the information is being sought." Frugone v. CIA, 169 F.3d 772, 774 (D.C. Cir. 1999). This is because, particularly "in the arena of intelligence and foreign relations," a statement made by "one in a position to know" is given unique meaning and weight. Fitzgibbon, 911 F.2d at 765 (cleaned up). While information from outside an agency may be viewed as "possibly erroneous," confirmation by the agency itself "would remove any lingering doubts." Frugone, 169 F.3d at 774-75 (cleaned up); see also Ameziane v. Obama, 699 F.3d 488, 492 (D.C. Cir. 2012) (absent confirmation, foreign adversaries "would be left guessing"). Confirmation from within an intelligence agency also could have "an adverse effect on our relations with other countries," who "might perceive themselves to be harmed by disclosure of their cooperation" with United States intelligence. Afshar v. Dep't of State, 702 F.2d 1125, 1131 (D.C. Cir. 1983) (cleaned up).
For these reasons, we have framed a general rule that "[d]isclosure by one federal agency does not waive another agency's right to assert a FOIA exemption." Mobley v. CIA, 806 F.3d 568, 583 (D.C. Cir. 2015). Frugone is our leading case on this point. There, the Office of Personnel Management had officially acknowledged that the plaintiff formerly worked as a covert CIA employee, yet we upheld the CIA's Glomar response to a FOIA request for his personnel records. 169 F.3d at 774-75. We stressed the "untoward consequences that could ensue" if the CIA were "required either to confirm or to deny statements made by another agency." Id. at 775. For example, a CIA admission that it had employed the plaintiff, a Chilean resident, "could cause greater diplomatic tension between Chile and the United States than do the informal, and possibly erroneous, statements already made by the OPM." Id. Alternatively, a CIA denial that it had employed the plaintiff "would lessen the burden facing a foreign intelligence agency attempting to track the CIA's covert activities abroad." Id. Either way, the CIA's own authoritative statement would cause greater diplomatic or security perils than statements by another agency on the same matter. We thus held that "only the CIA can waive its right to assert an exemption to the FOIA." Id.
We have applied this rule in various cases and contexts. In Moore v. CIA, 666 F.3d 1330 (D.C. Cir. 2011), we agreed with the district court that "the FBI lacked the authority to make an official acknowledgment on behalf of the CIA." Id. at 1332. Likewise, in Military Audit Project v. Casey, 656 F.2d 724 (D.C. Cir. 1981), we held that disclosures by the National Science Foundation about the Glomar Explorer did not bar the CIA from invoking Exemption 1 to withhold documents about the vessel. Id. at 742-45. We have also rejected attempts to establish an agency's official acknowledgement based on disclosures by Congress, see Fitzgibbon, 911 F.2d at 766; Salisbury v. United States, 690 F.2d 966, 971 (D.C. Cir. 1982), the media, EPIC v. NSA, 678 F.3d 926, 933 n.5 (D.C. Cir. 2012), the agency's former employees, Afshar, 702 F.2d at 1133; Phillippi v. CIA, 655 F.2d 1325, 1330-31 (D.C. Cir. 1981), and foreign governments, Mobley, 806 F.3d at 583.
We have recognized one limited exception to the general rule: if a public disclosure is "made by an authorized representative of the agency's parent," it is "official" as to the subordinate agency. ACLU, 710 F.3d at 429 n.7. We have applied this exception in two situations. First,
This exception does not apply here. For one thing, the State Department is not a parent to any of the defendant intelligence agencies: the FBI is a component of the Department of Justice, see 28 U.S.C. § 531; the NSA is a component of the Department of Defense, see Memorandum from Harry S. Truman to the Secretary of State and the Secretary of Defense (Oct. 24, 1952); and neither the ODNI nor the CIA has a parent agency. Nor can the State Department be considered an "authorized representative" of the President for purposes of this exception. Though the State Department is authorized to act for the President in the sense that it "wield[s] executive power on his behalf," Seila Law LLC v. CFPB, ___ U.S. ___, 140 S.Ct. 2183, 2191, 207 L.Ed.2d 494 (2020), the same can be said of all executive agencies. If that were enough to allow one agency to make official acknowledgments binding on another, then the exception would entirely swallow up the rule.
CPJ urges a different approach. Although the State Department is outside the chain-of-command of the other four agencies, CPJ seeks to link all of them through the intelligence community. One State Department component—its Bureau of Intelligence and Research—is a member of the intelligence community. 50 U.S.C. § 3003(4)(I). In turn, the intelligence community is an "integrated" group of agencies, Exec. Order 13,470 § 1.7, 73 Fed. Reg. 45,325, 45,333 (July 30, 2008), that "relies heavily on collaboration" among its members, Mission, Intel.gov, www.intelligence.gov/mission. The FOIA request at issue concerns a duty to warn imposed on all intelligence-community agencies. Intelligence Community Directive 191, § B.1. And the State Department's public statement purported to speak on behalf of the entire United States. In these circumstances, CPJ urges us to attribute the statement to the entire intelligence community.
We decline to extend official acknowledgement so far. For one thing, CPJ's theory cannot be reconciled with our precedent. In Moore, we addressed a FOIA request to the FBI and CIA for records concerning a suspected member of the Icelandic Communist Party. 666 F.3d at 1331. The FBI had responded by releasing a report with "CIA-originated information" redacted, yet the CIA still issued a Glomar response. Id. at 1332. Both agencies were members of the intelligence community, the subject of the FOIA request was a matter of their shared responsibility, and the disclosure by one agency spoke to information presumably within the other's possession. Yet we agreed with the district court that "the FBI lacked the authority to make an official acknowledgment on behalf of the CIA," id., and we reiterated our holding in Frugone that "only the CIA can waive its right to assert an exemption to the FOIA," see id. at 1333 n.4. To be sure, the plaintiff in Moore did not present the exact theory pressed here by CPJ. But we did hold that one intelligence agency cannot officially acknowledge a matter for another, and "the same issue presented in a
In any event, we reject CPJ's argument to the extent it is not foreclosed by precedent. Even putting Moore aside, CPJ's theory would substantially expand official acknowledgment. As explained above, we have given effect to acknowledgments only within the same executive Department or by the President. But under CPJ's theory, any Department with a component agency in the intelligence community could bind all the intelligence agencies with generalized statements about what "the United States" knows or does not know. Departments with intelligence-community components include Defense, Energy, Homeland Security, Justice, Treasury, and State. See 50 U.S.C. § 3003(4). Intelligence-community agencies include the CIA, NSA, ODNI, Defense Intelligence Agency, National Geospatial-Intelligence Agency, and National Reconnaissance Office, among many others. See id. We see little basis for a rule permitting so many agencies to make official acknowledgments extending across large swaths of the entire Executive Branch.
Moreover, the rationale for not imputing statements by one agency to another applies with greater force, not lesser, in the intelligence context. Not surprisingly, many of our cases rejecting cross-agency acknowledgment—including Frugone, Moore, Fitzgibbon, Mobley, and Military Audit Project—have involved the CIA. This case illustrates why. An official statement about what "the United States" did not know, made by an agency outside the intelligence community and with an express disclaimer as to "intelligence matters," is one thing. An official statement about what the Central Intelligence Agency did or did not know, made by the CIA itself, would be quite another. Outside observers may ascribe more weight to an authoritative statement by the CIA itself, and its confirmation or denial may remove any lingering doubts and create further diplomatic problems. See, e.g., Afshar, 702 F.2d at 1130-31; Ameziane, 699 F.3d at 492.
For these reasons, we hold that the statements made by the State Department spokesman do not foreclose the intelligence agencies from asserting their Glomar responses.
The merits of the Glomar responses here turn on whether Exemption 1 covers the question whether the four intelligence agencies have documents responsive to CPJ's FOIA request. Exemption 1 permits agencies to withhold properly classified information, 5 U.S.C. § 552(b)(1), which includes information pertaining to intelligence activities, sources, or methods if disclosure "could reasonably be expected" to harm national security, Exec. Order No. 13,526 § 1.4, 75 Fed. Reg. at 709.
Agencies may carry their burden of proof through declarations explaining why a FOIA exemption applies. See Oglesby v. U.S. Dep't of Army, 79 F.3d 1172, 1178 (D.C. Cir. 1996). Summary judgment is warranted if the declarations justify the nondisclosure "with reasonably specific detail" and are "not controverted by either contrary evidence in the record nor by evidence of agency bad faith." Miller v. Casey, 730 F.2d 773, 776 (D.C. Cir. 1984) (cleaned up). Moreover, in the national-security context, "courts must accord substantial weight to an agency's affidavit concerning the details of the classified status of the disputed record." Wolf, 473 F.3d at 374 (cleaned up); see Ctr. for Nat'l Sec. Studies v. DOJ, 331 F.3d 918, 927 (D.C. Cir. 2003) (CNSS) ("the judiciary
Here, the intelligence agencies have logically and plausibly explained why the existence or nonexistence of responsive records is classified information. The four declarations express the same concerns. The existence of responsive records would show that the United States had an intelligence interest in, and the ability to gather information about, a particular person (Khashoggi) at a particular time (shortly before his murder), which could tend to reveal against whom and how surveillance might have been conducted. ODNI Decl. at 9-10 (J.A. 69-70); NSA Decl. at 9 (J.A. 92); CIA Decl. at 18-19 (J.A. 124-25); FBI Decl. at 9-10 (J.A. 158-59). For example, "if a particular individual who is the target of IC surveillance mentioned Mr. Khashoggi and very specific information about him (e.g. an intent to harm Mr. Khashoggi) when that individual was using a particular method of communication, that individual would learn that they were being surveilled during a specific period of time and what method the IC was using to surveil them." ONDI Decl. at 10 (J.A. 70). On the other hand, the non-existence of responsive records would show a "blind spot" in United States intelligence, CIA Decl. at 19 (J.A. 125)—i.e., "a lack or dearth of underlying intelligence information" reflecting "gaps in IC capabilities, the success of evasive tactics taken by adversaries, and/or IC intelligence collection priorities," NSA Decl. at 9 (J.A. 92). Either response "would be of great interest to adversaries," who "continually gather details regarding the [IC's] specific intelligence capabilities, authorities, and interests" and "attempt to use this information to their advantage." CIA Decl. at 19 (J.A. 125). For these reasons, revealing whether responsive documents exist would "reasonably be expected to result in at least serious damage to national security." ODNI Decl. at 9 (J.A. 69).
CPJ disputes the "logical or plausible" standard. It cites cases stating that a Glomar response is appropriate only where confirming or denying the existence of responsive records "would"—not could—"itself cause harm cognizable under an FOIA exception," ACLU, 710 F.3d at 426 (cleaned up), as well as one out-of-circuit case stating that Glomar responses require "a particularly persuasive affidavit," Florez v. CIA, 829 F.3d 178, 182 (2d Cir. 2016) (cleaned up). CPJ argues the intelligence agencies therefore must show that confirming the existence or nonexistence of responsive records "would necessarily harm national security in every reasonably plausible circumstance." Reply Br. at 21.
CPJ's legal analysis is flawed in several respects. To begin, it reads too much into our passing use of "would." None of the cited cases mentions or turns on the difference between "would" and "could." But those same cases do make clear that, in the Glomar context, "courts apply the general exemption review standards established in non-Glomar cases." ACLU, 710 F.3d at 426 (quoting Wolf, 473 F.3d at 374). In non-Glomar cases, the applicability of Exemption 1 turns on whether disclosure of the record at issue "could reasonably be expected" to harm national security. Exec. Order No. 13,526 § 1.4, 75 Fed. Reg. at 709 (emphasis added). Moreover, in the national-security context, our precedents assess only whether the government's
CPJ further contends that, if the intelligence agencies confirmed the existence of responsive records, foreign adversaries would have no way of knowing exactly what the records are or how they were acquired, and thus no reliable way to make conclusions about sources and methods. We are unpersuaded. For one thing, as the declarations lay out, the mere fact that an intelligence agency was monitoring threats to specific individuals by specific governments at specific times would be useful information for foreign adversaries, even if the information revealed nothing further about specific sources and methods. Moreover, connections to specific intelligence agencies would themselves be revealing. For example, the NSA's mission is to collect signals intelligence, NSA Decl. at 3 (J.A. 86); if it had responsive documents, that would tend to reveal something about the collection of signals intelligence, despite CPJ's speculation that agency files might consist of nothing more than anonymous tips or press accounts. In some cases, confirmation might also tend to reveal even more about sources and methods —if, for example, Khashoggi's attackers had used very specific channels of communication to carry out their plot. See ODNI Decl. at 10 (J.A. 70). And even if targets could not deduce with certainty that they had been surveilled, a mere suspicion could induce them to take countermeasures. See FBI Decl. at 9 (J.A. 158) (to be effective, intelligence activities, methods, and sources must remain "unknown and unsuspected" (emphasis added)). Furthermore, even if confirming the existence of responsive records might not always be harmful in cases like this one, CPJ does not dispute that confirming the nonexistence of responsive records would be harmful. Yet the agencies cannot pick and choose: if they confirm the existence of responsive records in cases where they exist, and issue Glomar responses in similar cases where no responsive records exist, the Glomar response would effectively signal confirmation that no responsive records exist—and thus lose its value as this became apparent over time. See ODNI Decl. at 10 (J.A. 70); NSA Decl. at 10-11 (J.A. 93-94). For all these reasons, we see nothing illogical or implausible in the concerns raised by the intelligence agencies.
The agencies' concerns here also track ones that we credited in Wolf. There, the CIA issued a Glomar response to a FOIA request for all records related to a deceased Colombian politician. See 473 F.3d at 372. We credited concerns that "confirming or denying an Agency interest in a foreign national reasonably could damage sources and methods by revealing CIA priorities, thereby providing foreign intelligence sources with a starting point for applying countermeasures against the CIA and thus wasting Agency resources." Id. at 377. And we did so without considering hypothetical scenarios like, for example, the possibility that the existence of responsive records might reflect nothing more than an anonymous tip or a press clipping.
CPJ argues that the declarations here were not specific enough to support the Glomar responses. We disagree. In the national-security context, agency declarations need only "explain the justifications for nondisclosure with reasonably specific detail," Freedom Watch, Inc. v. NSA, 783 F.3d 1340, 1344-45 (D.C. Cir. 2015) (cleaned up), which means enough detail to permit "meaningful" judicial review, Campbell v. DOJ, 164 F.3d 20, 30 (D.C. Cir. 1998). As our discussion
CPJ further argues that the intelligence agencies have taken inconsistent positions in different cases. It notes that, in another case, the CIA and ODNI acknowledged that they could not make a Glomar response to a FOIA request for records relating to Khashoggi's death. Open Soc'y Just. Initiative v. CIA, 505 F.Supp.3d 234, 241 (S.D.N.Y. 2020). But the request in Open Society included records about the acknowledged, after-the-fact investigation into Khashoggi's death conducted by the CIA. The request was thus far different from one seeking the existence of duty-to-warn documents that would indicate either prior knowledge of the threat to Khashoggi or the absence of such knowledge. As CPJ itself acknowledges, such prior knowledge "would only come via intelligence sources." Reply Br. at 9. And unlike the later investigation and congressional briefing, no intelligence agency has confirmed or denied any prior knowledge.
Finally, CPJ contends that the State Department's press statement that "the United States" had no prior knowledge of Khashoggi's "disappearance" undercuts the agencies' Glomar response even if it does not constitute an official acknowledgment. But the agencies maintained their prediction of future harm even after taking that press statement into account. ODNI Decl. at 11 (J.A. 71); NSA Decl. at 11 (J.A. 94); CIA Decl. at 20-21 (J.A. 126-27); FBI Decl. at 10 (J.A. 159). This position was hardly illogical or implausible. For as explained above, a press statement from an agency outside the intelligence community, which expressly declined to "comment on intelligence matters," is far different from confirmation (or denial) that a specific intelligence agency had (or did not have) credible and specific information of an impending threat to Khashoggi.
The district court correctly concluded that the intelligence agencies' Glomar responses were valid under Exemption 1.