Bassiouni, Mahmoud C v. CIABassiouni, Mahmoud C v. CIA
OPINION
Both the FOIA and the Privacy Act contain exceptions for classified information.
It is easy to appreciate the basis of this concern. A list of documents could show clusters of dates that reveal when the agency acquired the information. Knowing which documents entered the files, and when, could permit an astute inference how the information came to the CIA‘s attention—and, in the intelligence business, “how” often means “from whom.” A Vaughn index (named after Vaughn v. Rosen, 484 F.2d 820 (D.C. Cir. 1973)) thus could blow an agent‘s cover. Painstaking analysis of the patterns reflected in the agency‘s holdings might reveal that the person named in the request is himself a source of information. That would not be worrisome if people could request information only about themselves; Bassiouni knows whether he has ever been on the CIA‘s payroll (or has provided unpaid assistance). But any member of the public
Because lists of documents could assist foreign intelligence services—whose powers of inference and deduction rise with their own stock of information, which helps them to identify patterns that professors, newspaper reporters, and judges may miss—the CIA refuses to reveal its holdings. It does this even when disclosure could be innocuous. There are two risks in disclosing when the request is harmless (as Bassiouni‘s may well be) and keeping silent when the CIA sees a danger. The first risk is that whoever makes the decision on behalf of the CIA may miss some clue that foreign intelligence services would catch, and thus inadvertently reveal secrets. The second risk is that people would draw an inference from disparate treatment: if, for example, the CIA opens its files most of the time and asserts the state-secrets privilege only when the information concerns a subject under investigation or one of its agents, then the very fact of asserting the exemption reveals that the request has identified a classified subject or source. When a pattern of responses itself reveals classified information, the only way to keep secrets is to maintain silence uniformly. And this is what the CIA has done. Today the agency‘s silence is called a “Glomar response,” taking its name from the Hughes Glomar Explorer, a ship built (we now know) to recover a sunken Soviet submarine, but disguised as a private vessel for mining manganese nodules from the ocean floor. See Phillippi v. CIA, 546 F.2d 1009 (D.C. Cir. 1976). Every appellate court to address the issue has held that the FOIA permits the CIA to make a “Glomar response” when it fears that inferences from Vaughn indexes or selective disclosure could reveal classified sources or methods of obtaining foreign intelligence. See, e.g., Frugone v. CIA, 169 F.3d 772 (D.C. Cir. 1999); Minier v. CIA, 88 F.3d 796 (9th Cir. 1996).
Bassiouni does not take issue with these decisions. Instead he contends that the CIA waived its right to make a Glomar response when it revealed that its files contain at least one document bearing his name. Instead of responding to the 1999 request with stony silence, the CIA conceded again that it had some responsive documents and made what it calls a “no number, no list” response, which amounts to the same thing: the requester gets no details. How this can be a “waiver” we do not grasp. See Sims, 471 U.S. at 180; Stein v. Department of Justice, 662 F.2d 1245, 1259 (7th Cir. 1981). The risk to intelligence sources and methods comes from the details that would appear in a Vaughn index; it is these details—both the documents that appear in a list and the documents that the CIA might have gathered but did not—that permit crafty observers to infer what the CIA is investigating, what it has overlooked,
Perhaps it would be best to jettison the distinction between a “Glomar response” (refusing to acknowledge whether the CIA has even one responsive document) and a “no number, no list response” (acknowledging that the CIA has at least one responsive document but refusing to elaborate). Neither name has any magic; the statute and the executive order in combination, not the CIA‘s nomenclature, are dispositive. Because it is the details that could tip the agency‘s hand, they are what matter. From now on, a “Bassiouni response” could cover both situations, which are legally identical. Indeed, unless the CIA is willing to concede that its records system is like a roach motel—papers go in, but they don‘t come out—disclosure that the agency had some documents identifying a person in Year t does not imply that it still has them in Year t + n. The agency therefore could have made a flat Glomar response to Bassiouni‘s 1999 request. This shows that the Glomar response and the no number, no list response are functionally identical and implies that the verbal distinction should be eliminated, lest it confuse or mislead requesters and judges into thinking that something depends on the turn of phrase.
Bassiouni advances a distinct argument under subsection (e)(7) of the Privacy Act, which says that an agency must “maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity“.
Subsection (e)(7) says that the agency may not maintain records unless it meets certain conditions. It does not say that the agency must disclose records to the subject when that step would reveal classified intelligence sources and methods. See
AFFIRMED
Clerk of the United States Court of Appeals for the Seventh Circuit