UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

CAUSE OF ACTION INSTITUTE,

Plaintiff, v. Civil Action No. 19-1915 (JEB)

EXPORT-IMPORT BANK OF THE UNITED STATES,

Defendant.

MEMORANDUM OPINION

In round two of this Freedom of Information Act bout, the parties return to the Court to

dispute the updated document redactions and withholding rationales put forth by Defendant

Export-Import Bank of the United States in response to two FOIA requests by Plaintiff Cause of

Action Institute. Last spring, this Court delivered a mixed bag of results on cross-motions for

summary judgment. Complete resolution was not to be had, as the Court determined that EXIM

had not provided sufficient justification for several of its withholdings and thus gave the Bank

another shot.

On this second go-round, the Court is able to resolve all of COA’s challenges to 41

documents that EXIM has continued to withhold after reprocessing its original production in

light of the Court’s prior Opinion. The Court once again delivers a split verdict: it will affirm the

Bank’s withholding of some records and order the release of others.

1 I. Background

Having previously summarized the relatively straightforward background of this case in

its prior Opinion, see Cause of Action v. Export-Import Bank of the United States,

(D.D.C. 2021), the Court recounts it only briefly here.

COA, a non-partisan government-oversight organization, filed two FOIA requests

seeking records from EXIM Bank, an independent agency that finances exports of various goods

and services. The first, filed on September 20, 2018, sought “records reflecting communications

involving four senior EXIM officials regarding a series of individuals and business entities.”

(citing ECF No. 1-1 (FOIA Request # 201800076F)). COA filed a second request on May 24,

2019, seeking “additional records from agency officials pursuant to a handful of new search

terms.”

at 74 (citing ECF No. 1-3 (FOIA Request # 201900047F)). This request generally

sought “communications among EXIM employees during congressional hearings for Kimberly

Reed’s nomination to be the Bank’s President, as well as information relating to certain

Government Accountability Office oversight activities.”

(citing ECF No. 1 (Complaint)).

After EXIM did not immediately respond to the requests, Plaintiff filed suit on June 26,

2019.

The Bank eventually produced “783 responsive records totaling 7,633 pages between

August 2019 and February 2020.”

(citing ECF No. 27-3 (Declaration of Lennell Jackson),

¶ 47; ECF No. 22 (3/3/20 Joint Status Rep.) at 1–2). Many of these records were fully or

partially redacted, and Plaintiff indicated its intent to challenge certain of those withholdings.

(citing ECF No. 28-4 (Declaration of Ryan P. Mulvey), ¶ 6;

at ECF pp. 30–474 (disputed

redacted records)). Both parties then moved for summary judgment, and, after reviewing the

documents in camera, this Court issued an Opinion granting in part and denying in part those

motions.

at 75–76, 96–97. The details of that 42-page Opinion need not be belabored here;

2 suffice it to say that this Court required EXIM to “go back and further show its work” if it

wished to maintain some of its redactions.

.

EXIM did just that. The Bank proceeded to reprocess the withheld records and disclose

some of the previously redacted documents in part or in full. See ECF No. 40-2 (2d Declaration

of Lennell Jackson), ¶ 8. It produced these documents on April 6 and 7, 2021, maintaining

redactions primarily under FOIA Exemptions 4 and 5. Id., ¶¶ 8, 12. Plaintiff informed the Bank

of its intent to challenge 41 of these withheld records on April 23, 2021. Id., ¶ 10. The parties

agreed to consolidate the challenged documents in one production and prepared an updated

Vaughn Index reflecting that. Id., ¶ 11; see also ECF No. 40-5 (Updated Vaughn Index); ECF

No. 41-6 (2d Declaration of Ryan Mulvey, Exh. B – Redacted Records, Vol. 1); No. 41-7 (2d

Declaration of Ryan Mulvey, Exh. B – Redacted Records, Vol. 2). The Court refers to that

production and the updated Vaughn Index throughout this Opinion.

EXIM once again moved for summary judgment on June 25, 2021. See ECF No. 40

(Def. MSJ). In response to Plaintiff’s Opposition and Cross-Motion for Summary Judgment, see

ECF No. 41-1 (Pl. Opp./Cross-MSJ), this Court ordered EXIM to submit unredacted copies of

the challenged documents for in camera review, which the Bank did on December 14. See

Minute Order of December 10, 2021; ECF No. 47 (Note of Delivery). Having now reviewed

those documents and the parties’ briefing, the Court is prepared to rule.

II. Legal Standard

Summary judgment must be granted if “the movant shows that there is no genuine

dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed.

R. Civ. P. 56(a); see also Anderson v. Liberty Lobby,

, 247–48 (1986); Holcomb v.

Powell,

(D.C. Cir. 2006). A fact is “material” if it is capable of affecting the

3 substantive outcome of the litigation. See Liberty Lobby,

; Holcomb,

. A dispute is “genuine” if the “evidence is such that a reasonable jury could return a verdict

for the nonmoving party.” Liberty Lobby,

; see also Scott v. Harris,

(2007); Holcomb,

. “A party asserting that a fact cannot be or is

genuinely disputed must support the assertion” by “citing to particular parts of materials in the

record” or “showing that the materials cited do not establish the absence or presence of a genuine

dispute, or that an adverse party cannot produce admissible evidence to support the fact.” Fed.

R. Civ. P. 56(c)(1).

FOIA cases typically and appropriately are decided on motions for summary judgment.

See Brayton v. Office of the U.S. Trade Representative,

(D.C. Cir. 2011). In a

FOIA case, a court may grant summary judgment based solely on information provided in an

agency’s affidavits or declarations when they “describe the justifications for nondisclosure with

reasonably specific detail, demonstrate that the information withheld logically falls within the

claimed exemption, and are not controverted by either contrary evidence in the record nor by

evidence of agency bad faith.” Larson v. Department of State,

(D.C. Cir.

2009) (citation omitted). Such affidavits or declarations “are accorded a presumption of good

faith.” SafeCard Services, Inc. v. SEC,

(D.C. Cir. 1991). “Unlike the

review of other agency action that must be upheld if supported by substantial evidence and not

arbitrary or capricious,” FOIA “expressly places the burden ‘on the agency to sustain its action’

and directs the district courts to ‘determine the matter de novo.’” U.S. Department of Justice v.

Reporters Committee for Freedom of Press,

(1989) (quoting

(a)(4)(B)).

4 III. Analysis

Congress enacted FOIA “to pierce the veil of administrative secrecy and to open agency

action to the light of public scrutiny.” Department of Air Force v. Rose,

(1976) (citation omitted). “The basic purpose of FOIA is to ensure an informed citizenry, vital to

the functioning of a democratic society, needed to check against corruption and to hold the

governors accountable to the governed.” John Doe Agency v. John Doe Corp.,

(1989) (citation omitted).

To further that purpose, the statute provides that “each agency, upon any request for

records which (i) reasonably describes such records and (ii) is made in accordance with

published rules[,] . . . shall make the records promptly available to any person.”

(a)(3)(A). The Government need not, however, turn over requested information that falls

into one of nine statutorily created exemptions from FOIA’s broad directive. See

§ 552(b)(1)–(9). “Those exemptions,” the Supreme Court has explained, “are as much a part of

FOIA’s purposes and policies as the statute’s disclosure requirement.” Food Marketing Institute

v. Argus Leader Media,

(2019) (quoting Encino Motorcars, LLC v.

Navarro,

(2018)) (cleaned up). Where an agency withholds records, it

bears the burden of showing that at least one of the exemptions applies. See Vaughn v. Rosen,

(D.C. Cir. 1975). In order to carry that burden, the Government must

provide a “relatively detailed justification” for its withholding, “specifically identifying the

reasons why a particular exemption is relevant.” Morley v. CIA,

(D.C. Cir.

2007) (quoting King v. U.S. Department of Justice,

(D.C. Cir. 1987)). Courts

can compel the release of any records that do not satisfy the requirements of at least one

exemption. See Reporters Committee,

.

5 Here, EXIM seeks to maintain redactions of 41 separate documents, most of which it

justifies with citations to FOIA Exemptions 4 and 5. See Vaughn Index. Before delving into

those exemptions, the Court considers three records that the Bank asserts fall outside of FOIA’s

scope entirely. It then moves on to Exemption 5, which is cited — sometimes alongside

Exemption 4 — to withhold the greatest number of records. The Court next takes up the

Exemption 4 withholdings, examining only redactions for which either Exemption 4 was the sole

exemption cited or that the Court determines are not supported by Exemption 5. See Center for

National Security Studies v. U.S. Department of Justice,

(D.C. Cir. 2003)

(explaining that court “need not address [any] other exemptions invoked” for particular

withholding justified by a single exemption). Finally, the Court briefly addresses Plaintiff’s

general challenge to Defendant’s decisions about segregability of withheld information.

A. Records Outside of FOIA’s Scope

FOIA empowers federal courts “to order the production of any agency records

improperly withheld from the complainant.”

(a)(4)(B) (emphasis added). While

the statute is clear that this power extends only to the release of “agency records,” it never

defines that term. Forsham v. Harris,

(1980). Courts have established,

nonetheless, that “agency” does not include “the President, his ‘immediate personal staff, or units

in the Executive Office whose sole function is to advise and assist the President.’” Judicial

Watch, Inc. v. U.S. Secret Service,

(D.C. Cir. 2013) (quoting Kissinger v.

Reporters Committee for Freedom of the Press,

(1980)) (cleaned up). In

addition, not all records in the possession of an agency subject to FOIA are “agency records” for

purposes of the Act; for instance, some may still qualify as executive records. Judicial Watch,

.

6 The parties here clash over whether EXIM has properly withheld portions of a two-page

email chain. See Def. MSJ at 7–8; Pl. Opp./Cross-MSJ at 4–14; ECF No. 44 (Def. Repl./Opp.)

at 1–4. The chain consists of several brief messages between an EXIM employee and Mark

Calabria, then “chief economist for Vice President Pence,” setting up a phone call. See Vaughn

Index, line 15; 2d Jackson Decl., ¶ 33. EXIM produced the messages from its employee, but it

redacted the messages from Calabria as “EOP [Executive Office of the President] not subject to

FOIA.” See Redacted Records, Vol. 1 at 000067–000068. These withholdings are warranted,

says Defendant, because FOIA does not apply to units in the EOP whose sole function is to

advise the President, as Calabria’s is. See Def. MSJ at 7–8. EXIM made no other arguments to

justify these withholdings. Plaintiff counters that the redaction of these portions of the email

chain constitutes improper “segmentation” of a record — that is, splicing one record into several

smaller records to avoid producing some — and that, in any event, these portions fall within

FOIA’s scope. See Pl. Opp./Cross-MSJ at 4–14.

Given Plaintiff’s focus on Defendant’s supposed segmentation, the Court finds it helpful

to begin by defining the record at issue. Although COA suggests that Defendant has improperly

broken this email chain into separate emails, defining each as an individual record in order to

withhold the emails from Calabria, that misrepresents EXIM’s position.

at 5–8. The Bank

has not argued that the email chain should be understood as a series of separate records; rather, it

contends that it has redacted portions of a single record — the email chain — claiming that they

fall outside of FOIA’s scope. See Def. MSJ at 7–8; Def. Repl./Opp. at 4–10. Although the

Court finds it difficult to comprehend why the Bank insists on withholding the redacted portions

of this entirely innocuous email chain, it nonetheless endeavors to assess whether FOIA entitles

Plaintiff to the production of this record in full.

7 Whether the withheld emails fall outside FOIA’s scope turns on whether or not they are

“agency records.” That term “extends only to those documents that an agency both (1) ‘create[s]

or obtain[s],’ and (2) ‘control[s] . . . at the time the FOIA request [was] made.’” Judicial Watch,

(quoting U.S. Department of Justice v. Tax Analysts,

, 144–45

(1989)). There is no dispute that the first prong is satisfied, as EXIM has at least obtained the

emails, but the parties spar over the control prong.

Typically, courts in this Circuit look to four factors to determine “whether an agency has

sufficient ‘control’ over a document to make it an ‘agency record.’” Judicial Watch,

(quoting Tax Analysts v. U.S. Department of Justice,

(D.C. Cir. 1988)).

Those are:

(1) the intent of the document’s creator to retain or relinquish control over the records; (2) the ability of the agency to use and dispose of the record as it sees fit; (3) the extent to which agency personnel have read or relied upon the document; and (4) the degree to which the document was integrated into the agency's record system or files.

Burka v. U.S. Department of Health and Human Services,

(D.C. Cir. 1996).

When the control question involves records obtained from or prepared in response to requests

from an agency not covered by FOIA, however, the D.C. Circuit has held that a modified version

of this test applies. Judicial Watch,

. This “modified control test” “renders the

first two factors of the standard test effectively dispositive” and essentially asks in this case

whether the EOP has expressed its intent to retain control over the records.

at 221–24, 231.

Defendant argues, however, that this test has no application here, since Calabria’s status

as a member of a “unit of the Executive Office whose sole function is to advise and assist the

President” renders his communications exempt from FOIA under decisions of the Supreme Court

8 and the D.C. Circuit. See Def. MSJ at 7–8 (citing Kissinger,

, and Judicial

Watch,

); Def. Repl./Opp. at 1–4. That position, however, overstates the

holdings of those cases. In Kissinger, the Supreme Court established that FOIA does not extend

to “the President’s immediate personal staff or units in the Executive Office whose sole function

is to advise and assist the President,” 445 U.S. at 156, and the D.C. Circuit later clarified that that

group includes members of the Vice President’s office. Wilson v. Libby,

(D.C. Cir. 2008). Documents created by individuals in those offices are thus “not ‘agency

records’ when they [are] made,” and so it is “undisputed that a requester could not use FOIA to

compel the President or his advisors to disclose their own [documents].” Judicial Watch,

(quoting Kissinger,

). That holding does not mean, however, that all

documents generated by members of the EOP can never be subject to FOIA; indeed, in Judicial

Watch, one of the two cases on which Defendant relies for this proposition, the D.C. Circuit did

not apply such a bright-line rule.

at 218–24. Instead, that court applied the modified-control

test to determine whether records created by the EOP but now in the possession of a FOIA-

covered agency were “agency records.”

The Court believes that the same approach is

appropriate here because, although the emails were created by EOP, they are now in the

possession of the Bank, which is a FOIA-covered agency.

The core inquiry under the modified-control test is whether the FOIA-exempt entity

“manifested a clear intent to control the document” at issue. Judicial Watch,

(internal quotation marks and citation omitted). Defendant, presumably because it does not

believe this inquiry relevant, has proffered nothing this time to demonstrate this intent. By

reference to a footnote in its Reply from the first round of summary-judgment briefing, the Bank

briefly argues that the Presidential Records Act establishes the requisite evidence of control. See

9 Def. Repl./Opp. at 3 (citing ECF No. 31 at 8 n.2). That argument holds no water, for the

manifestation of intent to control the document must not be “too general”; rather, it requires a

“specific showing of [EOP] intent to control documents sought by FOIA requesters.” United We

Stand America, Inc. v. IRS,

(D.C. Cir. 2004); see also Judicial Watch,

(“Congress did not intend the PRA to diminish the scope of FOIA.”).

In Judicial Watch, for example, a memorandum of understanding existed that led the

court to conclude that the FOIA-exempt agency had “manifested a clear intent to control the

document[s].”

. That memorandum explicitly directed that any information

provided to the FOIA-covered agency “is provided under an express reservation of White House

control” and required the agency to “regularly transfer all [White House] Records in its

possession to the White House.”

(internal quotation marks and citations omitted).

Defendant has offered nothing comparable to that explicit declaration of continued control here.

The Court, therefore, cannot conclude that the first two factors of the Burka test — which assess

the “intent of the document’s creator to retain or relinquish control over the records” and “the

ability of the agency to use and dispose of the record as it sees fit,” Judicial Watch,

(citations omitted) — weigh in favor of continued control by the EOP. Nor would it

conclude, if consideration of the third and fourth factors were appropriate, that they weigh in the

EOP’s favor, as EXIM personnel have certainly “read or relied upon the” emails, and the emails

appear to have been fully “integrated into the agency’s record system or files.”

Indeed, the

normal course of email exchanges would lead one to believe that emails they receive from

another entity do not remain in that entity’s control.

Since the Court determines that these records fall within FOIA’s scope and must be

disclosed, it need not address Plaintiff’s alternative argument that the Bank cannot withhold

10 portions of a responsive record as “part-agency records.” Cf. United We Stand, 359 F.3d at 603–

04. The Bank must therefore produce the portions of this email chain that are redacted as “EOP

not subject to FOIA.” It may, however, continue to redact Calabria’s email address under

Exemption 6, as the Court held in its previous Opinion. Cause of Action, 521 F. Supp. 3d at 92–

95.

B. Exemption 5

Moving to the specific exemptions, the Court starts with Exemption 5, which applies to

“inter-agency or intra-agency memorandums or letters that would not be available by law to a

party other than an agency in litigation with the agency.”

(b)(5). Withholdings

are restricted to “those documents, and only those documents, normally privileged in the civil

discovery context.” NLRB v. Sears, Roebuck & Co.,

(1975); see also United

States v. Weber Aircraft Corp.,

, 798–99 (1984). The exemption encompasses three

distinct components — namely, the deliberative-process privilege (sometimes referred to as

“executive privilege”), the attorney-client privilege, and the attorney-work-product privilege.

See American Immigration Council v. U.S. Department of Homeland Security,

(D.D.C. 2012). Here, the Court need only concern itself with the first.

The deliberative-process privilege shields internal agency “advisory opinions,

recommendations and deliberations” in order to “protect[] the decision making processes of

government agencies.” Sears,

(citations and internal quotation marks omitted).

It “rests on the obvious realization that officials will not communicate candidly among

themselves if each remark is a potential item of discovery and front page news.” Department of

Interior v. Klamath Water Users Protective Association,

, 8–9 (2001). In other words,

“if agencies were forced to ‘operate in a fishbowl,’” the “quality of administrative decision-

11 making would be seriously undermined . . . because the full and frank exchange of ideas on legal

or policy matters would be impossible.” Mead Data Center, Inc. v. U.S. Department of Air

Force,

(D.C. Cir. 1977).

To qualify under the privilege, a record must meet two requirements. First, it must be

predecisional — i.e., “generated before the adoption of an agency policy.” Judicial Watch, Inc.

v. U.S. Department of Defense,

(D.C. Cir. 2017) (citation omitted); see also

U.S. Fish and Wildlife Service v. Sierra Club, Inc.,

, 785–86 (2021). Second, a

record must be deliberative, meaning that it “reflect[s] the give-and-take of the consultative

process.” Judicial Watch,

(citation omitted). In this way, Exemption 5 focuses

on documents containing information that composes “part of a process by which governmental

decisions and policies are formulated.” Sears,

(citation omitted).

Additionally, in the context of Exemption 5, “an agency may withhold information —

even if it falls within the four corners of the exemption — ‘only if . . . the agency reasonably

foresees that disclosure would harm an interest protected by’ [that] exemption.” Rosenberg v.

U.S. Department of Defense,

, 256 (D.D.C. 2020) (quoting

(a)(8)(A)(i)(I)); see also S. Rep. No. 114-4 at 8 (2015). To satisfy this standard, an agency

must “identify specific harms to the relevant protected interests that it can reasonably foresee

would actually ensue from disclosure of the withheld materials,” and it must “connect [such]

harms in a meaningful way to the information withheld.” Center for Investigative Reporting v.

U.S. Customs & Border Protection,

, 106 (D.D.C. 2019) (cleaned up) (citation

omitted). While “boilerplate” articulations of harm are insufficient,

(citation omitted), the

government need not “identify harm likely to result from disclosure of each of its Exemption 5

withholdings.” Rosenberg v. U.S. Department of Defense,

(D.D.C.

12 2018). Rather, it “may take a categorical approach” and “group together like records,”

explaining “the foreseeable harm of disclosure for each category.”

.

The Bank asserts that this privilege protects the majority of disputed documents from

disclosure. Plaintiff disagrees. For the most part, the parties diverge on the elements mentioned

above — viz., whether the documents are predecisional and deliberative and whether disclosure

will result in foreseeable harm. For one set of records, however, Plaintiff also contests the

preliminary requirement that the records qualify as inter- or intra-agency materials. See Pl.

Opp./Cross-MSJ at 20–23; Def. Repl./Opp. at 10–15. The Court begins with this last set of

records before moving to assess — guided by the agency’s declarations, the Vaughn Index, and

in camera review — whether the other records at issue meet the predecisional, deliberative, and

foreseeable-harm requirements. In doing so, the Court adopts the document groupings presented

by the parties.

GAO Audit Responses and Document Productions

The parties first clash over the withholding of three records that the Bank sent to the

Government Accountability Office in connection with an audit it conducted of EXIM’s anti-

fraud controls. See ECF No. 40-3 (1st Declaration of Kenneth Tinsley), ¶ 10; Vaughn Index,

lines 45–47. Two of these documents “pre-exist[ed]” the GAO audit: the EXIM Risk Register,

which is “a register of the risks that EXIM determines to be its high-level risks, and an

assessment of both the inherent likelihood and impact . . . and the residual likelihood and impacts

of such risks,” and the Enterprise Risk Assessment, which “gives an overall assessment of

EXIM’s risk profile at the time.” 1st Tinsley Decl., ¶¶ 10, 10(a), (c). The third document, the

EXIM Responses to GAO Question No. 4 Re: Past Fraud Matters, “summarizes, for each of a

number of fraudulent transactions that occurred in the early 2000s, how the fraud was conducted,

13 how it was discovered and if there was anything particularly different or interesting regarding the

fraud in the matter.” Id., ¶ 10(b). Although that record contains “documents that were [] pre-

existing,” ECF No. 44-2 (2d Declaration of Kenneth Tinsley), ¶ 12, and content that “had been

previously put together by EXIM over a considerable period,” it was created and “contains

information that was formatted to respond to the GAO question.” Id.; see also 1st Tinsley Decl.,

¶ 10. One portion of this final document — an Office of the General Counsel memorandum

contained within the responses to GAO’s question — is not at issue now, as this Court has

already upheld its withholding. See Cause of Action, 521 F. Supp. 3d at 91–92; see also Pl.

Opp./Cross-MSJ at 20 n.13; Def. Repl./Opp. at 12 n.3.

a. Inter-agency or Intra-agency

The first matter of business is to decide if these three documents even qualify as inter- or

intra-agency records; if they do not, they must be released. As a unit of the Legislative Branch,

GAO is not a FOIA-covered “agency,” and so, at first glance, it would seem that documents

shared with GAO cannot qualify as “inter-agency” memoranda. The D.C. Circuit has held,

however, that agency documents shared with a governmental entity that does not itself qualify as

an “agency” for FOIA purposes may still be withheld under Exemption 5 in certain

circumstances. See, e.g., Rockwell International Corp. v. U.S. Department of Justice,

(D.C. Cir. 2001). Fortunately, the parties agree on the legal test that applies to

determine whether these documents may be withheld, which the Court lays out now.

In Dow Jones & Co., Inc. v. U.S. Department of Justice,

(D.C. Cir. 1990),

the D.C. Circuit considered whether a letter sent by a FOIA-covered Executive Branch agency to

Congress was properly withheld under Exemption 5.

. It held that it was not,

explaining that the statutory language of “inter-agency or intra-agency” records “will not stretch

14 to cover this situation, because Congress is simply not an agency.”

. But the court

acknowledged that such external communications from a FOIA-subject agency may qualify for

protection when they “are part and parcel of the agency’s deliberative process.”

.

Because the letter in question was drafted for the purpose of aiding the “deliberations of a non-

agency” — i.e., Congress — it could not qualify as either an intra- or inter-agency record.

.

The Circuit clarified the scope of this holding a decade later in Rockwell International,

when it considered an agency’s Exemption 5 withholding of several documents that the agency

had, once more, sent to Congress. See 235 F.3d at 603–04. This time, however, the court

reached the opposite outcome. Even though the files “were sent to assist” a congressional

subcommittee “in its deliberations,” they enjoyed protection under Exemption 5.

.

That was because the documents had been “created [earlier] as part of the [agency’s] deliberative

process,” thus making them “precisely the kind of inter- and intra-agency memoranda Exemption

5 protects.”

The agency did not “waive[] Exemption 5 protection” for documents that were

drafted to serve the agency’s decisionmaking process, as opposed to that of Congress, simply by

later sending them to the legislature.

at 603–04.

In sum, documents exchanged “between an agency and Congress . . . receive protection

as intra-agency memoranda if they were ‘part and parcel of the agency’s deliberative process,’”

but not if they were “created specifically to assist” or for the “sole purpose of assisting”

Congress “with its deliberations.”

at 604 (quoting Dow Jones,

); see also

Electronic Privacy Information Center v. Transportation Security Administration,

, 164–65 (D.D.C. 2013) (finding no Exemption 5 protection for document “prepared to

assist with Congressional deliberations rather than agency deliberations”).

15 Plaintiff argues that these documents were created for the sole purpose of assisting a

legislative agency; indeed, COA says, “[T]he sine qua non of the records — the very reason for

their existence — was GAO’s audit into Ex-Im’s ‘anti-fraud processes.’” Pl. Opp./Cross-MSJ at

22. The Bank counters that two of the three documents had been previously prepared for

EXIM’s own deliberative processes and should not lose their protection merely because they

were later turned over to GAO. See Def. Repl./Opp. at 11–12. As to the third document, the

Bank asserts that the information therein was “already ‘part and parcel of [EXIM’s] deliberative

process’” since the record contains only pre-existing documents or pre-existing information that

has been reformatted.

at 12–13 (quoting Rockwell International,

). Like the

two other documents, it should not lose its Exemption 5 protection when turned over to GAO.

EXIM further contends that, in any event, the GAO audit was “intended to assist EXIM in its

deliberative process of drafting internal fraud risk controls,” and so none of the documents

shared with GAO as part of this audit was created for the “sole purpose of assisting [the non-

FOIA agency] with its deliberations.”

at 14 (quoting Rockwell International,

).

The Court has little trouble finding that the EXIM Risk Register and the Enterprise Risk

Assessment meet the inter-agency requirement. Those documents, much like the files in

Rockwell International, were “created and used in on-going deliberations about various items”

“as part of [EXIM’s] discussions in a number of policy areas.” 2d Tinsley Decl., ¶ 10(a), (c).

The Bank appears to have turned them over to GAO in their pre-existing form.

As in

Rockwell International, doing so did not constitute a waiver of Exemption 5 protection. See 235

F.3d 603–04; see also Murphy v. Department of the Army,

, 1158–59 (D.C. Cir.

16 1979) (no waiver of Exemption 5 privilege even when shared with Congress without assurance

of continued confidentiality).

The Reponses to GAO Question No. 4 Re: Past Fraud Matters poses a harder question.

Although that document contains information that was prepared for EXIM’s own purposes and

even includes some unaltered, pre-existing documents, it was compiled and formatted

specifically to respond to GAO’s inquiry. See 2d Tinsley Decl., ¶ 12(b); 2d Jackson Decl.,

¶ 29(a). The Bank thus created a new record in response to GAO’s audit, and it is that record —

not its constituent parts — that the Court must consider. The rationale that applies to justify the

withholdings in the EXIM Risk Register and the Enterprise Risk Assessment therefore does not

extend to this third record.

EXIM is not out of luck, however, as its responses to GAO might not have been created

for the “sole purpose of assisting [GAO] with its deliberations,” Rockwell International,

, if the Bank is correct that GAO’s audit ultimately served the purpose of informing

EXIM’s own deliberations about how to improve its anti-fraud controls. See Def. Repl./Opp. at

14. The Bank does not explain the impetus for the specific audit pursuant to which these records

were shared. Plaintiff, however, proffers two sample GAO audit reports as evidence of the

audits’ purpose, see Pl. Opp./Cross-MSJ at 23, and Defendant does not reject the analogy. See

ECF No. 46 (Pl. Repl.) at 14. Those reports reveal that GAO regularly conducts audits of

EXIM’s anti-fraud controls pursuant to statutory authority. See U.S. Gov’t Accountability

Office, Export-Import Bank: EXIM Should Explore Using Available Data to Identify

Applications with Delinquent Federal Debt, No. GAO-19-337 (May 2019), available at

https://bit.ly/3gkNf0U (May 2019 GAO Report); U.S. Gov’t Accountability Office, Export-

Import Bank: The Bank Needs to Continue to Improve Fraud Risk Management, No. GAO-18-

17 492 (July 2018), available at https://bit.ly/3D3aypV (July 2018 GAO Report). That alone is not

enough to defeat the Bank’s argument, but the language of the relevant statute is. See 12 U.S.C.

§ 635a-6(b).

Section 635a-6(b) provides in relevant part:

[T]he Comptroller General of the United States shall—(1) review the adequacy of the design and effectiveness of the controls used by the Export-Import Bank of the United States to prevent, detect, and investigate fraudulent applications for loans and guarantees and the compliance by the Bank with the controls . . . and (2) submit a written report regarding the findings of the review and providing such recommendations . . . to—(A) the Committee on Banking, Housing, and Urban Affairs and the Committee on Appropriations of the Senate; and (B) the Committee on Financial Services and the Committee on Appropriations of the House of Representatives.

That makes clear that GAO’s anti-fraud-procedures audits (though they may also aid EXIM’s

decisionmaking) are prepared for the benefit of congressional committees — a conclusion

bolstered by the fact that the sample GAO reports are both addressed to “Congressional

Committees.” May 2019 GAO Report at 1; July 2018 GAO Report at 1. The GAO responses,

accordingly, were “created specifically to assist” GAO and ultimately Congress, not as “part and

parcel of [EXIM’s] deliberative process.” Rockwell International,

(quoting Dow

Jones,

). That record thus fails Exemption 5’s threshold requirement that it be a

“inter-agency or intra-agency memorandum[]” and must be produced. See

(b)(5).

b. Predecisional, Deliberative, and Foreseeable Harm

Having cleared its first hurdle, the Bank must still establish that the two records

remaining — the Enterprise Risk Register and the Enterprise Risk Assessment — are

predecisional and deliberative and that release would cause foreseeable harm. Judicial Watch,

.

18 As to the first, EXIM explains that it was “created as a tool to help guide the process of

Enterprise Risk management at EXIM” and “is not a policy or procedure.” 2d Tinsley Decl.,

¶ 12a. The Register “represents a snapshot in time” and is intended “to be used as a ‘living

document’” that is “constantly assessed and changed.”

For each identified risk, the Register

includes “assessments of the nature of the risk, of the controls that are used to mitigate the risk,

and an assessment of the degree of the risk once those controls are applied.”

It is “used to

contribute to a wide array of intra-agency discussions pertaining to all the various risks listed.”

Based on this description, which appears to accurately reflect the content observed in the

Court’s in camera review, the Register is clearly “generated before the adoption of an agency

policy,” Judicial Watch,

, and contains “evaluations” or “analysis . . . prepared

for senior-level review and decisionmaking.” Machado Amadis v. U.S. Department of State,

, 370 (D.C. Cir. 2020).

For similar reasons, the Enterprise Risk Assessment is also predecisional and

deliberative. That document “was prepared by the accounting firm Ernst & Young, under a

contract with EXIM, and prepared in conjunction with discussions with several EXIM staff

members.” 2d Tinsley Decl., ¶ 12c. It “formed, and still forms, a step in EXIM’s overall

maturing of its Enterprise Risk Management,” but there “was and is no particular end-point

decision that arose or arises out of the Risk Assessment.” Id., ¶ 12(c)(i). As “a tool to be used as

one input into various policy discussions,” the Risk Assessment contains “the joint analysis of

various EXIM staff members and Ernst & Young regarding the state of EXIM risk management

at that time.” Id., ¶ 12c(i)–(ii). That description suffices to establish that this document, like the

Risk Register, is an input into EXIM’s decisionmaking processes and is predecisional and

deliberative.

19 EXIM asserts that disclosure of both documents will produce a similar harm — namely,

the release of information that bad actors could use to identify risk vulnerabilities at the Bank.

See Def. Resp./Opp. at 15–16; 2d Tinsley Decl., ¶ 12a, c(iii). “Informing outside parties how

EXIM assesses these risks allows malefactors to analyze weaknesses in EXIM’s assessments,

and then allows them to compile such information with other data it collects, and target

vulnerabilities in EXIM’s risk controls.” 2d Tinsley Decl., ¶ 12c(iii). EXIM staff who were

aware of the possibility that their risk identification and assessments might be revealed, “would

be ‘chilled’ or deterred from frankly assessing individual fraud matters, openly proposing plans

to address such fraud, or providing reports on past frauds to the GAO or other entities whose

function includes assisting EXIM in developing more secure measures to prevent future fraud.”

Def. Resp./Opp. at 15–16. “Such chilling of candid advice is exactly what the privilege seeks to

prevent.” Machado Amadis, 971 F.3d at 371. These records, therefore, were properly withheld.

Enterprise Risk Committee Meeting Minutes

EXIM redacted in part three documents containing minutes from meetings of the

Enterprise Risk Committee (ERC) in 2018. See Vaughn Index, lines 3–5. The redactions block

out “[i]nformation about specific parties and impaired transactions”; summaries of “information

presented to the ERC related to cybersecurity risk”; “the number of ‘top cross-cutting’ risks in

[EXIM’s] enterprise risk profiles”; “Country Cover” — i.e. “whether, and how, EXIM will

support transactions in certain countries” — and “a discussion of the EXIM risk related to human

capital.” 1st Tinsley Decl., ¶ 5a–e. Plaintiff, echoing the position that this Court set forth in its

last Opinion, asserts that the Bank has not provided sufficient explanation of why the redacted

material is predecisional and deliberative and risks causing foreseeable harm if disclosed. See

Pl. Opp./Cross-MSJ at 24–25.

20 To withhold documents under the deliberative-process privilege, the Bank must explain

“(1) what deliberative process is involved, (2) the role played by the documents in issue in the

course of that process, and (3) the nature of the decisionmaking authority vested in the office or

person issuing the disputed document[s], and the positions in the chain of command of the

parties to the documents.” Center for Biological Diversity v. EPA,

, 147

(D.D.C. 2017) (internal quotation marks and citations omitted). In its Vaughn Index, the Bank

explained that the redacted portions convey information about “specific parties and impaired

transactions . . . that form a part of the Enterprise Risk Committee’s (ERC) ongoing monitoring

and discussion regarding impaired credits,” and “discuss[] specific cybersecurity issues and risk

assessments which are part of continual and repeated process of cybersecurity risk management

and monitoring by the ERC.” Vaughn Index, line 3. The Vaughn Index further specifies that the

Country Cover redactions include analysis of “proposed steps regarding whether and how EXIM

will support transactions in Belarus,” and a human-capital risk analysis that was “presented to

ERC as part of a broader discussion within the agency regarding human capital and the risks

related to human capital concerns.”

lines 4–5.

The Tinsley Declarations also elaborate on the role that the information in each redaction

played in the process of monitoring and formulating responses to EXIM’s various risks. See 1st

Tinsley Decl., ¶ 5a–e; 2d Tinsley Decl., ¶ 7a–e. For example, as to the summary of impaired

transactions, Tinsley states that the “information precedes the final resolution of the impairment .

. . [and] is [presented] to allow for fulsome discussion about the various issues raised in these

matters.” 2d Tinsley Decl., ¶ 7a(ii). This “selection of the facts that staff deems most pertinent,

along with staff analysis and commentary regarding those facts . . . [is] one part of the flow of

information that then goes into discussions regarding the best approach to take in resolving each

21 matter.”

That assertion, and the several pages of description that accompany it, are sufficient

to establish that the meeting minutes were properly characterized as predecisional and

deliberative. See Judicial Watch, Inc. v. U.S. Department of Treasury,

, 28–

29 (D.D.C. 2011) (finding meeting minutes properly withheld under Exemption 5); see also

Leopold v. CIA,

(D.D.C. 2015) (factual matter may be withheld under

Exemption 5 where “the selection or organization of facts is part of an agency’s deliberative

process”) (citation omitted).

The Court finds that only one exception exists to the above conclusion. One line in the

cybersecurity portion of the minutes from August 22, 2018, is withheld pursuant to Exemptions 5

and 6. The Bank’s briefing and declarations offer no argument as to why this specific line meets

Exemption 5’s requirements, and the Court’s in camera review reveals that the line summarizes

a past personnel decision. See Vaughn Index, line 3; Redacted Records, Vol. 1 at 000002; see

also 2d Tinsley Decl., ¶ 7(b)(ii) (making argument that line is properly withheld under

Exemption 6 without Exemption 5 argument). EXIM has thus not met its burden to establish

that this line is properly withheld under Exemption 5. Nor is it properly withheld under

Exemption 6, since the Bank’s assertion that disclosing this line would “reveal specific

information about [the individual in question’s] life,” 2d Tinsley Decl., ¶ 7(b)(ii), is insufficient

to establish the applicability of Exemption 6, and the Court’s in camera review leads it to

conclude that the release of the redacted information would not “constitute a clearly unwarranted

invasion of personal privacy.”

(b)(6). This line, accordingly, must be produced.

As to the remainder of the records, the Bank has also carried its burden to establish that

disclosure would lead to reasonably foreseeable harm. As explained in its Vaughn Index,

“Exposing internal staff deliberations about these matters would stifle open discussion,

22 potentially undermine EXIM negotiating positions in some circumstances, potentially give

outside parties insight into EXIM risk vulnerabilities,” and even “harm[] relations with other

countries.” Vaughn Index, lines 3–4. That explanation is sufficient to satisfy the Bank’s

heightened burden. See Rosenberg, 442 F. Supp. 3d at 260–61 (finding agency adequately

established foreseeable harm where declarant stated disclosure would inhibit “frank discussions”

and impair efforts to furnish leadership with “the full and necessary understanding” required for

effective decisionmaking). The meeting minutes, therefore, were properly withheld.

Cyber Risk Acceptance Recommendations

Next up is a 14-page memorandum that “contains the CIO’s description of numerous

cybersecurity risks, an assessment of their potential impact on EXIM’s activities, and

recommendations for how the agency might mitigate those risks while concurrently accounting

for operational efficiency.” Spira Decl., ¶ 10; Vaughn Index, line 6. Plaintiff contends that, as

this Court found in its prior Opinion, EXIM has not provided a sufficient description of the role

of the memo in the Bank’s decisionmaking processes and has not addressed the potential for

adoption of the proposal contained therein. See Pl. Opp./Cross-MSJ at 26. As previously

directed by the Court, Defendant counters with several pages explaining the memorandum’s role

in the decisionmaking process surrounding cybersecurity risks, as well as the relationship

between the ERC and the Chief Information Officer. See Def. Repl./Opp. at 18–22; Cause of

Action, 521 F. Supp. 3d at 81.

The Bank explains, and the Court has confirmed through its own in camera review, that

the memorandum at issue presents to the ERC a series of the CIO’s assessments and

recommendations regarding various cybersecurity risks facing EXIM and, “[o]n the surface . . .

appears to be a document that seeks a final decision — i.e. the acceptance of the cybersecurity

23 risk assessments made by the CIO.” Spira Decl., ¶ 10. The ERC, however, “is not itself a

decision-making body”; rather, it “recommends plans, proposals etc. to the Chief Risk Officer,

for further discussion with the President of the agency, and the President’s staff in the ‘front

office.’” Id. The memorandum contains the results of the CIO’s information gathering, which

the “ERC then uses . . . to discuss the risks assessed, debate the possible course of action, and

provide input into the higher-level discussion with the Chief Risk Officer,” who, in turn,

deliberates with the President before a final decision is made. See Def. Repl./Opp. at 21–22;

Spira Decl., ¶ 10. The memorandum, accordingly, is “generated before the adoption of an

agency policy,” Judicial Watch,

, and is thus predecisional.

It is also deliberative, as it falls squarely within the category of documents this privilege

covers — “recommendations, draft documents, proposals, suggestions, and other subjective

documents which reflect the personal opinions of the writer rather than the policy of the agency.”

Coastal States Gas Corp. v. Department of Energy,

(D.C. Cir. 1980). Release

of this memorandum, furthermore, would undermine the purpose at the core of the deliberative-

process privilege: “assur[ing] that subordinates within an agency will feel free to provide the

decisionmaker with their uninhibited opinions and recommendations without fear of later being

subject to public ridicule or criticism.”

Finally, the Bank has easily met its burden to establish foreseeable harm here. This

memorandum is, as the Bank notes, “a gift to malefactors.” Def. Repl./Opp. at 22. The

document identifies EXIM’s cyber vulnerabilities, and release would allow “cyber-criminals [to]

use this information to identify and attack EXIM.”

Fear of that result “would have a direct

chilling effect on EXIM staff’s ability to freely and openly discuss such critical issues in

24 writing.”

The harm here is not only reasonably foreseeable, but manifestly evident. This

memorandum was properly withheld.

Presentation Slides

On to the next. EXIM has withheld portions of an internal slide presentation on the

“Intersection of EXIM Finance and National Defense Strategy.” Vaughn Index, line 7. Once

again, Plaintiff contends that the Bank has failed to provide sufficient detail on the role this

document plays in EXIM’s decisionmaking processes. See Pl. Resp./Cross-MSJ at 27.

The Bank’s Vaughn Index explains that the “[r]edacted portions of this document set

forth a framework for consideration on how to address certain aspects of national security

through EXIM.” Vaughn Index, line 7. Because “[t]hese national security concerns are

continual and prolonged, . . . there is no ‘final decision’ point with regard to the redacted

portions of the documents.”

As part of the ongoing evaluation of these concerns, “[t]his slide

presentation formed the basis of discussion with the Department of Defense.” Def. Repl./Opp. at

23; see also 2d Tinsley Decl., ¶ 9.

That description is sufficient for the Court to conclude that the Bank “here met its burden

of identifying the decisionmaking process to which [the slides] contributed” — the study of how

EXIM could respond to certain national-security concerns — even without identifying a specific

end decision. See Access Reports v. Department of Justice,

, 1196–97 (D.C. Cir.

1991) (rejecting need to pinpoint specific decision to which memorandum contributed). To the

extent some of the redacted information is factual, that, too, is properly considered deliberative,

since its exposure might “enable the public to probe [EXIM’s] deliberative processes,” and “the

selection or organization of facts is part of an agency’s deliberative process.” Leopold,

(citations omitted).

25 As with the last set of records, the harm here is self-evident. “[P]ublicizing these slides

would provide adversaries of the United States with insights into how EXIM and the United

States analyze international issues related to national security and what issues the United States

prioritizes.” 2d Tinsley Decl., ¶ 9b. That explanation satisfies the Bank’s obligation to “identify

specific harms to the relevant protected interests that it can reasonably foresee would actually

ensue from disclosure of the withheld materials and connect the harms in a meaningful way to

the information withheld.” Center for Investigative Reporting, 436 F. Supp. 3d at 106 (cleaned

up) (internal quotation marks and citations omitted). The redacted portions of the presentation

slides, too, were properly withheld.

Weekly Reports

The Court ends its Exemption 5 journey with EXIM’s largest category of withholdings.

The 25 records at issue here vary in their contents, but all are weekly reports compiling updates

from teams across the Bank and presented to internal, more senior decisionmakers. See Vaughn

Index, lines 9–11, 14, 17–19, 21–22, 24–26, 29–33, 35–43. In its last Opinion, the Court

determined that, while “select portions [of the withheld documents] contain internal staff

discussion that falls within the confines of the privilege,” the Bank had both over-redacted and

failed to sufficiently identify the decisionmaking processes to which the information contained in

the reports — much of which appeared to be factual — contributed. Cause of Action, 521 F.3d

at 82–84. Plaintiff contends that the same is true now, and that factual information that merely

provides ongoing updates to a decisionmaking group cannot be deliberative. See Pl. Opp./Cross-

MSJ at 28–29; Pl. Repl. at 19–20. EXIM responds with reprocessed records containing fewer

redactions and several pages of declarations explaining the content of each withholding. See 1st

Tinsley Decl., ¶ 8; 2d Tinsley Decl., ¶ 10.

26 The Court considers the withheld records in groupings based on the author of the weekly

report, adopting the structure put forward by Defendant. See Def. Repl./Opp. at 25–27; 1st

Tinsley Decl., ¶ 8; 2d Tinsley Decl., ¶ 10. For each grouping, the Court focuses on a

representative document and then applies its conclusion to other records the Bank has stated (and

the Court has confirmed through in camera review) are substantially similar.

Before moving to the specifics of each group, the Court notes that all the reports share a

common feature that increases their likelihood of falling within Exemption 5: they are prepared

by lower-level employees for the benefit of upper-level decisionmakers. As the D.C. Circuit has

recognized, “[A] document from a subordinate to a superior official is more likely to be

predecisional, while a document moving in the opposite direction is more likely to contain

instructions to staff explaining the reasons for a decision already made.” Coastal States,

. “A recommendation to a supervisor on a matter pending before the supervisor,”

furthermore, “is a classic example of a deliberative document.” Abtew v. U.S. Department of

Homeland Security,

(D.C. Cir. 2015).

While things thus start off looking good for the Bank, its withholdings are complicated

by the fact that much of the redacted information appears to be factual rather than staff

evaluations or analysis. See 1st Tinsley Decl., ¶ 8 (“The reports are mostly informational and

provided to give the President and Senior Staff a snapshot of what is going on.”). “Purely factual

material usually cannot be withheld under Exemption 5, [but] it can be where it reflects an

exercise of discretion and judgment calls and where its exposure would enable the public to

probe an agency’s deliberative processes.” Leopold,

(citations and internal

quotation marks omitted). Whether this information is nonetheless protected for its role in a

deliberative process forms the focus of the Court’s analysis here.

27 a. Office of Board Authorized Finance reports

EXIM’s first set of withheld documents consists of weekly reports from the Office of

Board Authorized Finance (OBAF), which “handles the origination and monitoring of all

transactions large enough to require approval by the Board of Directors.” Vaughn Index, line 9.

“The redacted portions of [the representative] report cover proposed plans for handling

transactions generally, as well as specific and confidential applications, monitoring and

negotiating plans for specific impaired transactions[,] . . . and both aggregated and individual

information regarding pending transactions.”

EXIM represents that these reports “provide

the Senior Staff, and the President and her staff, with information . . . [that] can be incorporated

into any number of different decisions senior managers may have to make” about the handling of

the transactions referenced in the documents. See 2d Tinsley Decl., ¶ 10(b)(iv).

Although much of the information therein is best described as “factual,” it may be

properly withheld under deliberative process when “it reflects an exercise of discretion and

judgment calls and where its exposure would enable the public to probe an agency’s deliberative

processes.” Leopold,

(quoting Ancient Coin Collectors Guild v.

Department of State,

(D.C. Cir. 2011)) (internal quotation marks omitted).

Here, “the redacted information [wa]s chosen from an array of data to support the proposed

approach EXIM is taking in these matters,” 2d Tinsley Decl., ¶ 10(b)(iv), and “was not

assembled for an agency actor merely to pass along to outsiders, but rather for purely internal

deliberative purposes.” Electronic Privacy Information Center, 928 F. Supp. 2d at 167–68. That

supports the conclusion that it “must be protected in order to safeguard the agency’s deliberative

process.” Id. at 168. As this Court recognized in its prior Opinion, “[D]etails concerning the

Bank’s rolling efforts to monitor, manage, and conduct due diligence on certain of its existing,

28 pending, and prospective transactions and broader portfolio alike” are properly considered

predecisional and deliberative. Cause of Action, 521 F. Supp. 3d at 82; see also Center for

Public Integrity v. U.S. Department of Defense,

, 336–37, 346 (D.D.C. 2020)

(finding “weekly reports [giving] an overview of funding and related issues,” “contain[ing]

advice on actions that should be taken,” and providing subordinate’s “determination of which

issues are most relevant and important for the department” properly withheld under Exemption

5).

Disclosure of such information, moreover, would make it “very difficult” for EXIM to

“fulfill its mission” because fear of the release of this information, which “applicants customarily

keep . . . confidential,” would discourage applicants from participating in EXIM programs. See

2d Tinsley Decl., ¶ 10(b)(iv). The Bank has therefore discharged its obligation to establish the

foreseeable harm that would result from the release of this predecisional and deliberative

information, and the reports identified at lines 9, 17, 24, 30, and 37 were properly withheld. See

Vaughn Index, lines 17, 24, 30, and 37 (representing that “[t]he same type of information is

redacted” in these records as in record at line 9).

b. Office of the General Counsel reports

A similar rationale supports the withholding of EXIM’s second set of documents, which

comprises reports from the Office of the General Counsel and Corporate Secretary. See Vaughn

Index, lines 10, 18, 25, 32, 39. The redacted information in these reports “pertains to impaired

transactions” and “includes analytical information regarding EXIM’s approach to these matters.”

1st Tinsley Decl., ¶ 8(c). Much like the information in the first set of reports, this information,

though factual, is assembled for the benefit of senior decisionmakers, contributes to the

monitoring of EXIM transactions, and feeds into “intra-agency discussion” about how to handle

29 these transactions. See 2d Tinsley Decl., ¶ 10(c)(ii). “[P]ublic disclosure of this information

would publicize both EXIM’s specific and general approach to these matters[,] . . . significantly

undermin[ing] EXIM’s negotiating position . . . [and] pressur[ing] EXIM staff to curtail putting

such information in writing, thus making appropriate Senior Staff review more difficult.”

For much the same reasons given above, the Bank has justified withholding of these reports.

One further points bears mention. In the July 25, 2018, weekly report, there appears a

“Business Development Travel” section that is absent from the other reports in this group. That

section includes “both factual information obtained during the travel in question, as well as

analysis and synthesis of the information [] obtained.” Vaughn Index, line 18. This information

“is for the benefit of senior staff in discussions regarding EXIM’s competitiveness with foreign

export credit agencies,”

and its disclosure would “reveal[] to the foreign export credit

agencies the competitiveness issues that have drawn EXIM’s attention, and the steps EXIM is

considering to re-balance the competitiveness.” 2d Tinsley Decl., ¶ 10(c)(iii). The Court

concludes that this, too, qualifies as predecisional and deliberative, as its in camera review

confirms EXIM’s representation that this section includes analysis that may inform future

decisions.

c. Office of Risk Management reports

The third set of withheld documents contains weekly reports from the Office of Risk

Management. See Vaughn Index, lines 11, 19, 26, 33, 40. At the risk of repeating itself, the

Court again finds that these were properly withheld for much the same reasons as the previous

two sets. Redacted portions of these documents “address internal reorganizational steps being

discussed among senior managers relating to re-alignment of risk management within the

agency,” “analys[es] of economic conditions in [] countries for discussion relating to ‘country

30 cover,’ and internal emergency procedures related to continueing [sic] operations of government

in the event of a disaster (COOP).” Vaughn Index, line 11. These reports are predecisional and

deliberative because they feed into and discuss ongoing decisionmaking processes about the

“restructuring of risk management within EXIM,” “transaction due diligence” by EXIM loan

officers, and “steps being taken in connection with the Government[’]s ‘Continuity of Operations

Plan.’” 2d Tinsley Decl., ¶ 10(d)(ii)–(iv). Disclosure, furthermore, would “provide outside

parties with information they could use to undermine the effectiveness of risk management

within the agency” or “reveal the type of information that EXIM relies upon to make [its

transaction-due-diligence] analyses,” thereby “put[ting] at risk EXIM’s and the U.S.

Government’s ability to engage openly and honestly with some of these countries.”

These

records were properly withheld.

d. Office of the Chief Information Officer reports

Different records, same story. This time the records withheld are updates on EXIM’s

ongoing efforts to maintain and upgrade its cybersecurity defenses. Like the other records

discussed, these contain largely factual information that is used to inform the Bank’s monitoring

of and decisionmaking around cybersecurity initiatives. See 2d Tinsley Decl., ¶ 10(g). And like

those previously discussed, the documents at Vaughn Index lines 14, 22, 29, 36, and 43 were

properly withheld. See also supra, Sec. III.B.3 (concluding similar discussion of cybersecurity

issues properly withheld).

e. Miscellaneous documents

Finally, the terminus for Exemption 5. The last set of documents consists of three types

of records, two of which the Court concludes were properly withheld. The first — two weekly

reports from the Office of Policy and International Relations (OPAIR) — were properly withheld

31 for substantially the same reasons as the other weekly reports discussed. These records, at

Vaughn Index lines 21 and 35, provide “factual and analytical” information to inform

negotiations with the OECD and a specific country. See 2d Tinsley Decl., ¶ 10(f)(ii). The fact

that these negotiations have since terminated does not take these records outside of Exemption 5,

since “no specific decision was made with regard to the information” contained therein. See

Vaughn Index, line 21; see also Gold Anti-Trust Action Committee, Inc. v. Board of Governors

of the Federal Reserve System,

, 135–36 (D.D.C. 2011) (“[E]ven if an

internal discussion does not lead to the adoption of a specific government policy, its protection

under Exemption 5 is not foreclosed as long as the document was generated as part of a definable

decision-making process.”).

The second type of withheld document is another weekly report from OPAIR. See

Vaughn Index, line 42. The redacted portions “pertain to two unrelated conceptual proposals

made by outside parties that will need to be explored and discussed.” 2d Tinsley Decl.,

¶ 10(f)(iii). A “combination of selected factual information and analysis,” the redacted

information constitutes “staff’s internal analysis[, which] is not necessarily the final EXIM

analysis.”

Such “advisory opinions, recommendations, and deliberations,” especially when

provided by staff to senior decisionmakers, are precisely what the deliberative-process privilege

is intended to shield. Sears,

; see also Coastal States,

.

The final two records are weekly reports from the Office of Congressional and

Intergovernmental Affairs. See Vaughn Index, lines 31, 38. Only one line is redacted from these

reports, and the Bank contends that the redaction is justified because “it summarizes the gist of

an internal discussion regarding a potential reorganization within the agency, and whether that

reorganization required a report to Congress.” 2d Tinsley Decl., ¶ 10(h). That this material is

32 predecisional is evident: it is “presented to the Senior Staff expressly as an ‘action item.’”

The Court is not convinced, however, that the Bank has established that it is deliberative.

Although EXIM argues that the redacted information summarizes ongoing discussions and “is a

part of the broader discussion regarding the issue,”

it is not clear to the Court what a reader

of this line could glean about EXIM’s decisionmaking processes from its content. At most, one

might be able to identify the decision the Bank’s leaders must make, but identifying the decision

does not risk exposing anything about the process itself; indeed, it is something agencies seeking

to assert Exemption 5 are required to do. See Center for Biological Diversity, 279 F. Supp. 3d at

147 (requiring agency to identify “deliberative process . . . involved). These last reports,

consequently, must be produced in full.

C. Exemption 4

At last departing the shores of Exemption 5, the Court now travels to the land of

Exemption 4, which the Bank cites to justify the withholding of 24 records. The Court need only

consider seven of those records here, however, because it has already determined that EXIM

properly withheld the redacted information in the others pursuant to Exemption 5. See Center

for National Security Studies,

. The only Vaughn Index lines at issue are thus

12–13, 20, 27–28, 34, and 41.

Those records may be sorted into two categories. The first contains weekly reports from

the Office of Small Business (OSB), which “covers those transactions and programs not

requiring Board of Directors approval.” Vaughn Index, line 12; see also

lines 20, 27, 34, 41.

Each update is produced largely unredacted, with redactions “pertain[ing] to specific confidential

information regarding identified exporters[, s]pecifically . . . the business concentration, or

planned concentration, in specific countries.” 1st Tinsley Decl., ¶ 8(e). The second set is in fact

33 one document produced twice, which is a weekly update from OPAIR. See Vaughn Index, lines

13, 28. The lone redaction in that report “refer[s] to specific terms of a guarantee issued by

EXIM to the Private Export Finance Corporation (PEFCO).” 1st Tinsley Decl., ¶ 8(f)(i).

Exemption 4, which EXIM contends justifies these redactions, shields from disclosure

“commercial or financial information obtained from a person and privileged or confidential.”

(b)(4). To demonstrate that this exemption shelters the information withheld, the

Bank must show that it is “(1) commercial or financial, (2) obtained from a person, and (3)

privileged or confidential.” Public Citizen Health Research Group. v. FDA,

(D.C. Cir. 1983). There is no dispute about the first prong, so the Court focuses its discussion on

the second and third elements.

Obtained From a Person

“Information is considered ‘obtained from a person’ if the information originated from an

individual, corporation, or other entity, and so long as the information did not originate within

the federal government.” Electronic Privacy Information Center v. U.S. Department of

Homeland Security,

(D.D.C. 2015) (citing Board of Trade of City of

Chicago v. Commodity Futures Trading Commission,

(D.C. Cir. 1980)). The

D.C. Circuit has held, however, that information originating within the Government may still be

considered “obtained from a person” when it summarizes information supplied by an external

party or is a portion of a document “from which information supplied by [the third party] could

be extrapolated.” Gulf Western Industries, Inc. v. United States,

, 529–30 (D.C.

Cir. 1979). Agency-generated records that constitute agency analysis of third-party information

(as opposed to mere summary), on the other hand, are not “obtained from a person.”

Philadelphia Newspapers, Inc. v. Department of Health and Human Services,

,

34 66–67 (D.D.C. 1999). “[T]he key distinction — which will obviously be blurry in many

instances — is between information that is either repeated verbatim or slightly modified by the

agency, and information that is substantially reformulated by the agency, such that it is no longer

a ‘person’s’ information but the agency’s information.” Southern Alliance for Clean Energy v.

U.S. Department of Energy,

(D.D.C. 2012).

COA maintains that the records withheld under Exemption 4 fall into the latter category,

or, at least, that EXIM has not provided sufficient information to establish that the redacted

information came from outside the agency. See Pl. Opp. and Cross-MSJ at 17–18. The Bank

rejoins that its Vaughn Index and declarations demonstrate that this information was collected

from applicants and customers of the Bank, and the unveiling of any ensuing analysis would

allow the extrapolation of the underlying data. See Def. Repl./Opp. at 5–7.

As to the OSB reports, the Court concludes fairly easily that EXIM has established that

most of the redacted information came from customers of the Bank. Although the Bank does not

specify the method by which it acquired each piece of information — which “may come from

documents that EXIM has received, or it may be oral information EXIM collects by phone or in

meetings,” 2d Jackson Decl., ¶ 22 — it represents that the information was provided by the

customers or partners being discussed in the report and is presented with “very selective edits.”

Vaughn Index, line 12. The Court’s in camera review confirms that this is the case. Indeed, the

redacted information does not appear to include EXIM analysis or manipulation, but rather is a

recitation of customers’ plans or statistics about their businesses. That is information “obtained

from a person.”

(b)(4); see Southern Alliance for Clean Energy,

(information recited or minimally modified may be “obtained from a person”); Electronic

35 Privacy Information Center,

(information from a corporation is “obtained

from a person”).

Only one set of redactions in this group does not fall clearly into this category. Those are

the redactions under the “New Issuing Bank Credit Limit (IBCL)” heading in the record at

Vaughn Index, line 20. See Redacted Records, Vol. 1 at 000084. The redacted information

appears to be the amount of an EXIM-approved credit limit, the recipient of that credit limit, and

the cotton exporter that will be supported by the IBCL. EXIM offers no explanation specific to

this record (arguing instead that it simply follows the determination of the record at Vaughn

Index, line 12), and it is not clear to the Court why this information would have been obtained

from an outside party, rather than from inside the Bank. See Vaughn Index, line 20; 1st Tinsley

Decl., ¶ 8(e); 2d Tinsley Decl., ¶ 10(e). The Court, accordingly, concludes that EXIM has not

met its burden to establish that this information is “obtained from a person,” and the information

must be disclosed.

This trend continues with the OPAIR weekly report. EXIM explains that the redacted

portion of this report refers to the terms of a guarantee made to PEFCO. See Vaughn Index, line

13; 1st Tinsley Decl., ¶ 8(f); 2d Tinsley Decl., ¶ 10(f)(i). But EXIM also states that the redacted

terms were “issued by EXIM to [PEFCO],” 2d Tinsley Decl., ¶ 10(f)(i), which would seem to

eliminate the possibility that this information came from PEFCO to EXIM. Indeed, this

establishes that the redacted information moved in the opposite direction. EXIM rejoins that

“terms or conditions . . . are arrived at by agreement,” and “the term or condition would not exist

but for . . . PEFCO’s agreement so in that sense the terms and conditions came from PEFCO.”

That argument is unavailing. See Southern Alliance for Clean Energy,

(citing In Defense of Animals v. National Institutes of Health,

, 102–03

36 (D.D.C. 2008)) (“[T]he mere fact that information was the product of negotiations between a

‘person’ and the agency does not make that information ‘obtained from a person’ under

Exemption 4.”). A more natural reading of EXIM’s description, supported by the Court’s in

camera review of the redacted information, leads to the conclusion that this information was not

obtained from a person, as Exemption 4 requires. The records at Vaughn Index lines 13 and 28

shall be disclosed.

Confidential

Even after establishing that the OSB reports are “obtained from a person,” EXIM may

withhold them under Exemption 4 only if it also demonstrates that they are “privileged or

confidential.” Public Citizen Health Research Group,

. Only the “confidential”

nature of the records is at issue here. To satisfy this requirement, the Bank must show that the

withheld commercial or financial information is “both customarily and actually treated as private

by its owner.” WP Company LLC v. U.S. Small Business Administration,

, 12

(D.D.C. 2020) (quoting Food Marketing,

). In other words, the information

must be “customarily kept private, or at least closely held, by the person imparting it.” Food

Marketing,

. The critical question is “how the particular party customarily

treats the information, not how the industry as a whole treats the information.” Center for Auto

Safety v. National Highway Traffic Safety Administration,

(D.C. Cir. 2001)

(citing Critical Mass Energy Project v. Nuclear Regulatory Commission,

,

878–80 (D.C. Cir. 1992)).

An agency seeking to establish customary treatment may “proceed solely on its sworn

affidavits.” Judicial Watch, Inc. v. U.S. Department of Commerce,

(D.D.C. 2004). Those affidavits must be “made on personal knowledge,” Animal Legal

37 Defense Fund, Inc. v. Department of the Air Force,

(D.D.C. 1999)

(quoting Fed. R. Civ. P. 56(e)), which can be demonstrated in a variety of ways. An agency may

“relay[] that the submitters themselves told the agency that the information is confidential, . . .

indicat[e] that the agency reached an ‘understanding’ with the submitters ‘that the information

w[ould] be held in confidence by the U.S. and not publicly divulged,’ . . . point[] to confidential

markings on the documents themselves or to the existence of a non-disclosure agreement, or . . .

provid[e] descriptions of the documents that demonstrate their confidential nature.” Center for

Investigative Reporting, 436 F. Supp. 3d at 110–11 (quoting Judicial Watch,

). Excluded from the list of acceptable methods are “[c]onclusory statements by an agency

official about what the agency official may believe about how a submitter customarily treats the

information at issue.” Id. at 111.

“Complicating matters,” the Supreme Court in 2019 suggested that “the plain meaning of

the word ‘confidential’” might require the government to establish an “additional necessary

condition” before invoking Exemption 4 — namely, that “the party receiving the information . . .

‘provide[d] some assurance that it [would] remain secret.’” Renewable Fuels Association v.

U.S. EPA,

, 10 (D.D.C. 2021) (quoting Food Marketing.,

).

The Court, however, did not resolve whether this second condition is mandatory, see Food

Marketing,

, and this Court has since explained that binding Circuit precedent

compels an answer in the negative. See Renewable Fuels Association, 519 F. Supp. 3d at 12

(“The current law of the D.C. Circuit . . . is that information is confidential under Exemption 4

‘if it is of a kind that would customarily not be released to the public by the person [or entity]

from whom it was obtained.’”) (alteration in original) (quoting Critical Mass,

).

This Court, accordingly, declines to “read the word ‘confidential’ to impose a blanket

38 requirement that the government provide an assurance of privacy in every case in which it asserts

Exemption 4.”

It acknowledges, however, that an assurance of confidentiality may be

relevant to determining whether information is “confidential.” See Shapiro v. Department of

Justice, No. 12-313,

, at *25 (July 2, 2020).

EXIM contends in its declarations and Vaughn Index that the redacted information is not,

“in EXIM’s experience[,] . . . generally shared publicly.” Vaughn Index, line 12. COA rejoins

that the Bank has put forth nothing more than “conclusory” claims about the customary treatment

of this information. See Pl. Opp./Cross-MSJ at 16–17. In response, the Bank’s declarant stated

that the redacted information “is not customarily publicized by exporters as it reveals

competitively valuable information,” and he notes that EXIM did not redact information where it

established that an exporter had diverted from its customary practice. See 1st Tinsley Decl.,

¶ 8(e). He declared, furthermore, that the information is “precisely the kind of information that

U.S. exporters supported by EXIM have identified over the years as sensitive and that such

companies do not customarily divulge publicly.” 2d Tinsley Decl., ¶ 10(e)(i). That knowledge

is based on Tinsley’s “40-plus years at EXIM” and his “many direct conversations or

communications with EXIM customers regarding their confidentiality expectations.” Id.,

¶ 6(a)(iii). It is also drawn from the Bank’s “long experience with U.S. exporters,” from which it

has made “determinations regarding the customary habits of those exporters based on

generalizations gleaned over thousands of communications covering decades.” Id., ¶ 8(e)(i).

Although EXIM would ideally have solicited input from the specific exporters discussed in these

reports, the Court finds that it may rely here on its “decades of accumulated experience and

interaction with participants on the question of confidentiality” to conclude that “this type of

39 information is customarily kept confidential by the parties that submit it to EXIM.” Id.,

¶ 6(a)(viii); see Center for Investigative Reporting, 436 F. Supp. 3d at 110–11.

The Bank has declared, furthermore, that it “assures transaction applicants, exporters and

other transaction participants that it will protect the information they provide to EXIM from

disclosure to the maximum extent permitted.” 2d Jackson Decl., ¶ 17; see also ECF No. 40-6

(Exhibit B, Copy of Memorandum re: Treatment of Confidential Materials). To the extent that

evidence of assurance of confidentiality is necessary, EXIM has satisfied that requirement. At

the very least, this evidence of assurance supports the conclusion that the redacted information is

“confidential.” Shapiro,

, at *25.

Foreseeable Harm

An agency may withhold information under Exemption 4 — even if it falls within the

scope of the exemption — “only if . . . the agency reasonably foresees that disclosure would

harm an interest protected by [that] exemption.”

(a)(8)(A)(i)(I); see also

Reporters Committee for Freedom of Press v. FBI,

, 369–70 (D.C. Cir. 2021). To

satisfy this standard, an agency must “identify specific harms to the relevant protected interests

that it can reasonably foresee would actually ensue from disclosure of the withheld materials,”

and it must “connect [such] harms in a meaningful way to the information withheld.” Center for

Investigative Reporting, 436 F. Supp. 3d at 106 (cleaned up) (citation omitted).

Plaintiff points out that Defendant mounts no foreseeable-harm arguments specific to

Exemption 4 in its briefing. See Pl. Opp./Cross-MSJ at 36–37; Pl. Repl. at 20–21. Defendant,

however, has put forth bases for the harm of disclosing each document in its Vaughn Index and

its declarations. See Def. Repl./Opp. at 27–28 (noting as much). EXIM contends that disclosure

of the information in OSB reports would harm the submitting customers by essentially “telling

40 all of their competitors that [the country in which they have concentrated their sales] is where the

business is.” 2d Tinsley Decl., ¶ 10(e)(i). Publication of information participants expect the

Bank to keep confidential, moreover, would “severely hamper[]” EXIM’s ability to perform its

function; “[i]f EXIM transaction parties were to lose faith in EXIM’s ability to keep

[confidential] information private,” the Bank would lose access to information it “relies upon to

complete its underwriting of transactions, to monitor transactions as they proceed, and to settle,

or work-out transactions that run into difficulties.” 2d Jackson Decl., ¶ 19. That suffices to

“directly articulate[] [a] link between the specified harm and the specific information contained

in the material withheld.” WP Company LLC v. U.S. Small Business Administration, No. 20-

1240,

, at *4 (D.D.C. Dec. 13, 2021) (quoting Reporters Committee,

) (finding similar harms sufficient to satisfy foreseeable-harm requirement).

The OSB weekly reports, identified at Vaughn Index lines 12, 20, 27, 34, and 41, were

thus properly withheld under Exemption 4.

D. Segregability

Plaintiff’s last challenge is a general critique of Defendant’s failure “to show that it

released all reasonably segregable portions of the records at issue.” Pl. Opp./Cross-MSJ at 37–

38. While COA is of course correct that EXIM bears the burden of releasing “[a]ny reasonably

segregable portion of a record” and must “take reasonable steps necessary to segregate and

release nonexempt information,” the Court is satisfied that Defendant has discharged that

obligation here, despite its misgivings last go-round. See

(a)(8)(A)(ii)(II); 552(b);

Cause of Action, 521 F.3d at 96. Unlike last time, the Bank has redacted almost no records in

full, and the Court’s in camera review did not reveal any instances of apparent over-redaction.

EXIM has instead redacted specific portions of the records at issue and has explained to the

41 Court’s satisfaction the rationale for its withholdings. See Hodge v. FBI,

(D.C. Cir. 2013) (finding segregation obligation met where court found redactions consistent

with application of claimed exemptions).

* * *

For those still keeping score, the final results are now in, and EXIM must release the

documents at the following lines of the Vaughn Index: 3 (in part), 13, 15 (in part), 20 (in part),

28, 31, 38, and 46 (in part). The others are properly withheld.

IV. Conclusion

For the foregoing reasons, the Court will grant in part and deny in part the Motions for

Summary Judgment. A separate Order so stating will issue this day.

/s/ James E. Boasberg JAMES E. BOASBERG United States District Judge Date: January 27, 2022

42