Q. What is the best process for challenging a refusal by the CIA to confirm or deny the existence of records under Section 3.6(a) of Executive Order 13526?
A. The type of determination to which you are referring is known as a “Glomar response” or “Glomarization.” Although an agency can issue a Glomar response based on different FOIA exemptions, the relevant one in your case is Exemption One, 5 U.S.C. § 552(b)(1).
Exemption One permits an agency to withhold information “specifically authorized under criteria established by an Executive order to be kept secret in the interest of national defense or foreign policy.” Such information must not only qualify for classification but “in fact [be] properly classified.” Executive Order 13526 sets forth the current standards and procedures for national security classification. It identifies both the substantive categories of information that can be classified (e.g., military plans) and the procedural requirements that an agency must satisfy to effect classification.
Executive Order 13526 also provides non-disclosure protection for the fact of the existence of records. Under Section 3.6(a), “[a]n agency may refuse to confirm or deny the existence or nonexistence of requested records whenever the fact of their existence or nonexistence is itself classified under this order or its predecessors.” On a “mosaic” or “compilation” theory, this protection can even extend to sets of non-classified records that implicate national security concerns when considered in the aggregate.
FOIA requesters usually rely on two methods to overcome an Exemption One Glomar response. First, while in litigation, a requester can challenge the affidavit providing the basis for an agency’s refusal to confirm or deny the existence of records. An affidavit may lack specificity or vital details, or it may contradict other available evidence regarding the existence of the requested records. There could be an independent basis to prove bad faith on the part of the government in handling the FOIA request or records at issue. Challenging an agency affidavit is difficult. Courts tend to defer to agencies in the FOIA context, and deference to agency expertise in national security cases is even stronger.
A requester can also challenge a Glomar response based on “waiver”—that is, by proving that the fact of the existence of records is already in the public domain and, moreover, has been “officially acknowledged.” In the D.C. Circuit, "official acknowledgement" means that the requested records (or, in this case, the fact of those records' existence) are (1) as “specific” as those previously released, (2) “match” the information previously disclosed, and (3) were disclosed in an “official and documented” manner. To illustrate: in National Security Archive v. Central Intelligence Agency, a court accepted a waiver argument when a requester sought biographies on seven former Eastern European heads of state and the CIA had already officially acknowledged that it kept biographies on all “heads of state.” Widespread media coverage about the existence of records will be insufficient. Similarly, general comments from a public official—even in testimony before Congress—may not satisfy the standard.