Election agency’s IT security report exempt from FOIA, judge says

December 5, 2016

Polling equipment is set and ready at a local polling station in a Milwaukee County Parks building the day before election day in MilwaukeeThe Federal Election Commission has defeated a lawsuit filed by a reporter and investigative journalism organization the Center for Public Integrity seeking disclosure of a study assessing vulnerabilities in the agency’s IT systems.

Investigative reporter Dave Levinthal and CPI could not show that the commission violated the Freedom of Information Act by withholding the study, U.S. District Judge Amit P. Mehta of the District of Columbia said.

While the commission released more than 1,450 pages of nonexempt records and portions of records mentioning the study, the reporter and the Pulitzer Prize-winning news organization argued the agency also needed to disclose the final report.

Judge Mehta rejected their argument, agreeing with the commission that the report fell under two FOIA exemptions as both deliberative material and a law enforcement record.

He granted the commission’s summary judgment motion and denied the summary judgment motion filed by Levinthal and CPI.

According to the opinion, the lawsuit concerned a report that outside contractor SD Solutions LLC prepared for the commission in fiscal year 2014 and other related documents.

With the report, the commission sought to determine whether to implement information security guidelines the U.S. Department of Commerce’s National Institute of Standards and Technology published in February 2014, Judge Mehta said.

To prepare the report, SD Solutions assessed the commission’s physical and virtual IT assets, according to the opinion.

In the final report, it described the commission’s sensitive IT systems as well as current and potential vulnerabilities, the opinion said.

The report also recommended measures the commission could take to protect against unlawful or unauthorized access, according to the opinion.

The commission refers to the final SD Solutions report and related documents as the NIST study, the opinion said.

The NIST study includes an overview memorandum from the commission’s chief information office that summarizes the final report and the practicalities of implementing the guidelines. The overview also lists required personnel and financial resources, the opinion said.

The second part of the NIST study is SD Solutions’ final report, the judge said.

In July 2015 Levinthal and CPI requested the NIST study and any commission emails, memoranda or other related documents that mention or refer to the report, the opinion said.

They said this information would benefit the public understanding of the commission’s capabilities during a high-profile election, according to the opinion.

The commission denied the request for the NIST study, but released nonexempt relevant documents, the judge said.

Levinthal and CPI filed an administrative appeal, which was denied, the opinion said.

They then filed a complaint in the District Court on Oct. 5, 2015, challenging the withholding of SD Solutions’ final report.

The commission responded saying the report qualified as deliberative material and a law enforcement record, two FOIA exemptions.

Both sides filed summary judgment motions, but Judge Mehta ruled in favor of the commission.

Levinthal and CPI claimed the report was not related to law enforcement purposes because it was not connected to a particular investigation, but the judge disagreed, saying that argument misconstrued the law.

The report evaluated and suggested recommendations to address vulnerabilities in the commission’s IT system, “a critical law enforcement tool,” the judge said.

The commission’s chief information office also declared that releasing the study could threaten the technology systems, allow hackers to bypass current security mechanisms and otherwise prevent the agency from fulfilling its legal obligations, the judge said.

The judge also rejected the argument that the commission did not sufficiently explain why it withheld information under the deliberative material exemption that could have been segregated from the nonexempt material.

Based on the evidence, the commission’s chief information office did a line-by-line analysis to see if any information could be disclosed, the judge said.

Levinthal et al. v. Federal Election Commission, No. 15-cv-1624, 2016 WL 6902111 (D.D.C. Nov. 23, 2016).