Opinion
No. 23-1620
07-02-2024
T. Keith FOGG, Plaintiff - Appellant v. INTERNAL REVENUE SERVICE, Defendant - Appellee
Counsel who presented argument on behalf of the appellant and appeared on the appellant's brief, was Shawn M. Rodgers, of Skippack, PA. Counsel who presented argument on behalf of the appellee and appeared on the appellee's brief, was Janet A. Bradley, USDOJ, Tax Division, of Washington, DC. The following attorney(s) also appeared on the appellee's brief; Bruce R. Ellisen, USDOJ, Tax Division, of Washington, DC.
Appeal from United States District Court for the District of Minnesota Counsel who presented argument on behalf of the appellant and appeared on the appellant's brief, was Shawn M. Rodgers, of Skippack, PA. Counsel who presented argument on behalf of the appellee and appeared on the appellee's brief, was Janet A. Bradley, USDOJ, Tax Division, of Washington, DC. The following attorney(s) also appeared on the appellee's brief; Bruce R. Ellisen, USDOJ, Tax Division, of Washington, DC. Before BENTON, GRASZ, and STRAS, Circuit Judges. GRASZ, Circuit Judge.
T. Keith Fogg sought disclosure of certain redacted contents of the Internal Revenue Manual under the Freedom of Information Act (FOIA). See 5 U.S.C. § 552. The district court conducted an in camera inspection of the unredacted manual per this court's mandate. See Xanthopoulos v. I.R.S., 35 F.4th 1135, 1139 (8th Cir. 2022). The district court then granted summary judgment to the Internal Revenue Service (IRS), concluding the redacted contents were exempt from disclosure under the FOIA because they are techniques and procedures for law enforcement investigations and their disclosure could reasonably be expected to risk circumvention of the law. After conducting our own in camera inspection of the redacted contents, we affirm.
The Honorable Susan Richard Nelson, United States District Judge for the District of Minnesota.
I. Background
Internal Revenue Manual (IRM) § 21.1.3.3 deals with third-party authentication. See Xanthopoulos, 35 F.4th at 1137. Its purpose is to "confirm the identification of the person calling prior to releasing sensitive information" to "enhance protections for tax professionals and their clients." IRM § 21.1.3.3(3). Much of § 21.1.3.3 is available to the public, but the IRS redacted some portions of the IRM "relating to 'specialty situations' in which the IRS uses 'unique' authentication procedures to combat unauthorized disclosure of sensitive taxpayer information, identity theft, and criminal fraud." Xanthopoulos, 35 F.4th at 1137.
Available at https://perma.cc/BDH9-ZD73 (April 16, 2024).
In June 2019, Fogg and former co-plaintiff Nicholas Xanthopoulos submitted a FOIA request for the redacted contents of IRM § 21.1.3.3 so they could "understand how the IRS used or retained tax professionals' data collected under the new procedures." Id. The IRS claimed the redacted contents are exempt from FOIA disclosure under the FOIA's Exemption 7(E) because the redacted contents are "records or information compiled for law enforcement purposes" and "techniques and procedures for law enforcement investigations." See 5 U.S.C. § 552(b)(7)(E). Fogg and Xanthopoulos then sued the IRS in federal court, seeking court-ordered disclosure. See id. § 552(a)(4)(B). The district court originally denied their request to review the redacted contents in camera. On the parties' cross-motions for summary judgment, the district court granted summary judgment to the IRS, holding Exemption 7(E) applied to the redacted contents. See Xanthopoulos, 35 F.4th at 1137-38. After Fogg appealed to this court, we reversed both the grant of summary judgment to the IRS and the denial of Fogg's request for in camera inspection, remanding to the district court to conduct the in camera inspection. Id. at 1139.
Xanthopolous elected not to pursue an appeal following the district court's first grant of summary judgment, and he is no longer a party in this case.
By the time the district court conducted its in camera inspection, the IRS had revised the IRM and voluntarily released some of its previously redacted portions. Thus, the district court reviewed the five remaining redactions in IRM § 21.1.3.3: first, "a 'note' under § 21.1.3.3(3)"; second, "an 'exception' under § 21.1.3.3(3)"; third, "all of § 21.1.3.3(4)"; fourth, "all of § 21.1.3.3(5)"; and fifth, "approximately two lines of text under § 21.1.3.3(8)." The district court also allowed the IRS to publicly file a declaration from King Donaghy, a Supervisory Tax Analyst for the IRS's Customer Account Services. Donaghy's declaration explained that the five redactions "set forth the techniques and procedures IRS employees are to follow to authenticate the identity of the purported [third-party tax preparers] in various non-standard situations."
Based on its in camera inspection and Donaghy's declaration, the district court concluded Exemption 7(E) applied to the redacted contents of IRM § 21.1.3.3. The district court determined the redactions serve a law enforcement purpose because they "specifically address exceptions to the[ ] standard procedures" and involve "exceptional situations [of] a heightened risk of fraud or identity theft." It next concluded the redactions were "techniques and procedures for law enforcement investigations," whose disclosure "could reasonably be expected to risk circumvention of the law." See 5 U.S.C. § 552(b)(7)(E). Because it determined Exemption 7(E) applied to the redactions, the district court again granted summary judgment to the IRS. Fogg appeals once more, arguing Exemption 7(E) does not apply to the redacted contents.
II. Analysis
We review de novo the district court's grant of summary judgment. Xanthopoulos, 35 F.4th at 1138. "In the FOIA context, summary judgment is available to the agency where it 'proves that it has fully discharged its obligations under FOIA, after the underlying facts and inferences to be drawn from them are construed in the light most favorable to the FOIA requester.' " Id. (quoting Mo. Coal. for Env't Found. v. U.S. Army Corps of Eng'rs, 542 F.3d 1204, 1209 (8th Cir. 2008)). "[D]isclosure, not secrecy, is the dominant objective of the [FOIA]." Dep't of Air Force v. Rose, 425 U.S. 352, 361, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976). The FOIA is intended to give the public access to government documents unless an enumerated exemption to disclosure applies. See Mo. Coal., 542 F.3d at 1208. There are nine limited exemptions to disclosure—which we narrowly construe—and the government bears the burden of showing an exemption applies. Xanthopoulos, 35 F.4th at 1138.
In this case, the IRS claims the redacted contents of IRM § 21.1.3.3 are exempted from disclosure under Exemption 7(E). Under that exemption, the IRS may withhold from disclosing:
(7) records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information . . . (E) would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law . . . .5 U.S.C. § 552(b)(7)(E) (emphasis added). The district court determined—and neither party contests—that the redacted contents are compiled for "law enforcement purposes"; they protect taxpayer information from fraudulent attempts to access it. Thus, the IRS satisfied Exemption 7(E)'s threshold requirement that the redacted contents be for "law enforcement purposes."
The IRS only asserts the IRM's redacted contents are "techniques and procedures" for law enforcement investigations; it does not contend the redacted contents are "guidelines." Thus, we first need to determine whether the redacted contents are "techniques and procedures for law enforcement investigations" under Exemption 7(E)'s plain language. If they are, we then must determine whether disclosure is nevertheless compelled by some other FOIA provision.
A. Techniques and Procedures for Law Enforcement Investigations
Whether the redacted contents qualify as "techniques and procedures for law enforcement investigations" depends on the " 'ordinary, contemporary, common meaning' of those terms when FOIA was enacted," Xanthopoulos, 35 F.4th at 1138 (quoting Food Mktg. Institute v. Argus Leader Media, 588 U.S. 427, 433-34, 139 S.Ct. 2356, 204 L.Ed.2d 742 (2019)). "A court cannot expand or constrict the exemption beyond what its terms permit." Id. Because Congress enacted the current iteration of Exemption 7(E) in a 1986 amendment to the FOIA, see Freedom of Information Reform Act of 1986, H.R. 5484, 99th Cong. § 1802 (1986), we look to the meaning of exempting "techniques and procedures for law enforcement investigations or prosecutions" as it would have meant in 1986.
The individual terms comprising Exemption 7(E) are broad. A "technique" is "a technical method of accomplishing a desired aim," while a "procedure" is "a particular way of doing or going about the accomplishment of something." Allard K. Lowenstein Int'l Hum. Rts. Project v. Dep't of Homeland Sec., 626 F.3d 678, 682 (2d Cir. 2010) (hereinafter, Lowenstein Project) (quoting Technique, Webster's Third New Int'l Dictionary 2348 (1986), and Procedure, Webster's Third New Int'l Dictionary 1807 (1986)). Under those terms' plain meaning, practically any way of doing something is a "technique" or a "procedure." But Exemption 7(E) narrows the terms' otherwise broad meanings by cabining the exemption to only those "techniques" and "procedures" that are used in "law enforcement investigations." "Law enforcement" refers to "the act of enforcing the law, both civil and criminal," Pub. Emps. for Env't Resp. v. U.S. Section, Int'l Boundary & Water Comm'n, U.S.-Mex., 740 F.3d 195, 203 (D.C. Cir. 2014) (hereinafter, PEER) (citing Law enforcement, Black's Law Dictionary 964 (9th ed. 2009)), while an "investigation" is a "detailed examination" or a "searching inquiry," Investigation, Webster's Third New Int'l Dictionary 1189 (1986).
The IRS does not contend the redacted contents of IRM § 21.1.3.3 pertain to law enforcement "prosecutions" or have any prosecutorial component.
Even though "law enforcement investigations" may cover a wide swath of activities, the whole of Exemption 7(E)'s plain language imparts some limits. After all, a technique or procedure that serves a law enforcement purpose may not be a technique or procedure that serves a law enforcement investigation, as " 'law enforcement purposes' involve more than just investigation and prosecution." Milner v. Dep't of Navy, 562 U.S. 562, 583, 131 S.Ct. 1259, 179 L.Ed.2d 268 (2011) (Alito, J., concurring) (emphasis added). "Congress' decision to use different language to trigger Exemption 7 confirms that the concept of 'law enforcement purposes' sweeps in activities beyond investigation and prosecution." Id. at 584, 131 S.Ct. 1259.
It is especially important to scrutinize an agency's assertion of Exemption 7(E) when that agency is not solely a law enforcement agency, but instead serves "mixed law enforcement and administrative functions," as the IRS does. Xanthopoulos, 35 F.4th at 1139 (emphasis added). Those parts of the IRM relating solely to "administrative matters" fall outside Exemption 7(E)'s scope, such as the parts dealing with organizational hierarchy and internal human resources. See id. Accordingly, Fogg argues the redacted contents of IRM § 21.1.3.3 pertain to the IRS's routine, administrative functions and are not employed in "law enforcement investigations." The IRS asserts the redacted contents are used for special, non-routine scenarios "and are preventative in nature, and therefore are part of the IRS's law enforcement investigation efforts," likening the redacted contents to techniques and procedures for conducting background checks.
Courts have concluded "law enforcement investigations" may include agency background checks into individuals seeking to obtain some government benefit. For example, the Second Circuit held the questions that U.S. Customs and Immigration Services "instructs its employees to ask visa applicants to detect ties to terrorism" are techniques and procedures for law enforcement investigations because they "identify potential terrorists and keep them from entering the United States . . . ." Knight First Amend. Inst. at Columbia Univ. v. U.S. Citizenship & Immigr. Servs., 30 F.4th 318, 331-32 (2d Cir. 2022). Likewise, the D.C. Circuit noted the C.I.A.'s "security clearance procedures" can be procedures for law enforcement investigations because they "uncover[ ] background information on potential [C.I.A. officer] candidates." Morley v. C.I.A., 508 F.3d 1108, 1129 (D.C. Cir. 2007). See also 100Reporters v. U.S. Dep't of State, 602 F. Supp. 3d 41, 80-81 (D.D.C. 2022) (holding Exemption 7(E) applied to State Department's vetting techniques and procedures for preventing the furnishing of assistance to foreign security forces believed to have committed human rights violations). These cases reveal that Exemption 7(E)'s definition of "law enforcement investigations" includes background checks. Thus, Exemption 7(E) applies to background check techniques and procedures "even when the [redacted] materials have not been compiled in the course of a specific investigation" or ongoing criminal investigation. See Tax Analysts v. I.R.S., 294 F.3d 71, 79 (D.C. Cir. 2002). Our task is to determine whether the redacted contents are techniques and procedures to help the IRS conduct background checks—a type of law enforcement investigation—into third-party callers, or if the redacted contents merely pertain to administrative authentication, as Fogg claims they do.
Based on our review of Donaghy's declaration and the redacted contents of IRM § 21.1.3.3, we conclude Exemption 7(E) applies; the redacted contents all involve techniques and procedures the IRS uses for law enforcement investigations. They are akin to background checks because they help the IRS to authenticate a caller's identity in special scenarios in which the caller raises a suspicion of fraud. These techniques and procedures are not "routine" and "already well known to the public," such that any public domain exception should apply. See Cox v. U.S. Dep't of Just., 576 F.2d 1302, 1310 (8th Cir. 1978); Knight, 30 F.4th at 332. Even if the concept of authenticating a caller's identity is publicly known, Exemption 7(E) still "protects information that would reveal facts about such techniques or their usefulness that are not generally known to the public, as well as other information when disclosure could reduce the effectiveness of such techniques." See Broward Bulldog, Inc. v. U.S. Dep't of Just., 939 F.3d 1164, 1191 (11th Cir. 2019). As evidenced by our in camera inspection and Donaghy's declaration, the IRM's redacted contents apply in non-standard scenarios, not involving every third-party caller. The techniques and procedures help the IRS conduct its law enforcement investigation into callers' identities, thus preventing tax fraud.
This is not a case where the agency's techniques and procedures only have a vague or tenuous connection to "law enforcement investigations." In PEER, the D.C. Circuit determined a dam-managing agency could withhold "emergency action plans" taken by emergency personnel in case of a dam failure because those plans constituted "guidelines for law enforcement investigations." See PEER, 740 F.3d at 204-05. "Those guidelines describe[d] the surveillance and detection of the cause of an emergency dam failure as well as the process for evaluating the dam failure when the emergency subsides." Id. at 205. The agency argued, and the court agreed, Exemption 7(E) applied to the emergency plans because they could constitute guidelines pertaining to "law enforcement investigations"—rather than constituting emergency-management plans—if a subsequent investigation into the dam failure eventually revealed "a suspicion of criminal sabotage or terrorism." Id. If PEER toed the line on what should qualify as a "law enforcement investigation," the IRS demonstrates IRM § 21.1.3.3 stands at least a few steps on the safe side of it.
For whatever reason an agency invokes Exemption 7(E), whether it seeks to withhold "techniques and procedures" or "guidelines," the agency must show the redactions are for "law enforcement investigations or prosecutions." The IRS has carried its burden here. After all, the IRS did not invent its duty to prevent unauthorized third-party access to tax-payer information. Rather, Congress mandated the IRS conduct such investigations into the identities of third parties who attempt to access taxpayer information. For example, 26 U.S.C. § 6103(a) forbids the IRS from disclosing tax return information to unauthorized third parties, while 26 U.S.C. § 7431 awards taxpayers damages if the IRS even negligently discloses their taxpayer information. See Snider v. United States, 468 F.3d 500, 512 (8th Cir. 2006) (affirming such an award). That Congress imposed these duties—and awards taxpayers when the IRS fails in its duties—reveals the techniques and procedures are for "law enforcement investigations."
B. Circumvention of the Law
Even if the redacted contents are techniques and procedures for law enforcement investigations, Fogg argues the IRS should still disclose the redacted contents because their disclosure would not "reasonably be expected to risk circumvention of the law." See 5 U.S.C. § 552(b)(7)(E). He invokes Exemption 7(E)'s "circumvention clause," which appears immediately after the "guidelines" clause. The circumvention clause provides another way for a party to obtain otherwise exempted contents under the guidelines clause. Our court has yet to determine whether the circumvention clause also applies to the "techniques and procedures" clause. We can confidently say it does not. As the Second Circuit explained, "basic rules of grammar and punctuation dictate that the qualifying phrase modifies only the immediately antecedent 'guidelines' clause and not the more remote 'techniques and procedures' clause." Lowenstein Project, 626 F.3d at 681. Thus, under Exemption 7(E)'s plain language, Congress deemed that disclosure of "techniques or procedures for law enforcement investigations" presumptively risks circumvention of the law. Exemption 7(E), on its own, does not provide a party any other way of forcing an agency to disclose "techniques and procedures for law enforcement investigations."
Even though the circumvention clause does not apply to the techniques and procedures clause, the IRS must still satisfy the standard set by 5 U.S.C. § 552(a)(8)(A)(i), which Congress added to the FOIA in 2016 to curtail agency overuse of FOIA exemptions. See Leopold v. Dep't of Just., 94 F.4th 33, 37 (D.C. Cir. 2024). That subsection requires an agency to disclose redacted information—even if an exemption otherwise applies—unless "the agency reasonably foresees that disclosure would harm an interest protected by an exemption described in subsection (b)" or "disclosure is prohibited by law[.]" 5 U.S.C. § 552(a)(8)(A)(i)(I)-(II). This "foreseeable harm" requirement is an independent burden on the agency. See Reps. Comm. for Freedom of the Press v. F.B.I., 3 F.4th 350, 369 (D.C. Cir. 2021); Seife v. U.S. Food & Drug Admin., 43 F.4th 231, 235 (2d Cir. 2022). Under this amendment, "[a]pplicability of a FOIA exemption is still necessary—but no longer sufficient—for an agency to withhold the requested information." Seife, 43 F.4th at 235.
Neither the Supreme Court nor our sister circuits have addressed how the foreseeable harm requirement applies to Exemption 7(E), so we must begin by ascertaining what interests Congress intended Exemption 7(E) to protect before proceeding to examine whether disclosure would result in foreseeable harm to those interests. See id. at 239. One obvious interest is preventing "circumvention of the law."
At first blush, it could seem 5 U.S.C. § 552(a)(8)(A)(i) merely extends Exemption 7(E)'s circumvention clause to the techniques and procedures clause. But whereas Exemption 7(E)'s circumvention clause only requires the IRS to show how disclosing otherwise-exempted guidelines "could be reasonably expected to risk circumvention of the law," see 5 U.S.C. § 552(b)(7)(E) (emphasis added), the foreseeable harm requirement requires the IRS to show how disclosure would foreseeably harm the IRS's interest in preventing circumvention of the law, 5 U.S.C. § 552(a)(8)(A)(i).
There is a material difference between speaking of a foreseeable risk of harm on the one hand, and foreseeable harm on the other. As written, the circumvention clause allows an agency to withhold information if it can show a mere risk of harm, a minimal burden, requiring only the agency demonstrate "an expectation" of a risk. Mayer Brown LLP v. I.R.S., 562 F.3d 1190, 1193 (D.C. Cir. 2009). This is in contrast with § 552(a)(8)(A)(i), which demands the IRS show foreseeable harm stemming from disclosure. This showing requires more than just an expectation of a risk, but an actual expectation of harm. As the D.C. Circuit explained, "the foreseeability requirement means that agencies must concretely explain how disclosure 'would'—not 'could'—adversely impair [an exemption's protected interest]." See Reps. Comm., 3 F.4th at 369-70. Congress's addition of the foreseeable harm requirement may mean that Exemption 7(E)'s circumvention clause is left with little independent effect, even in guidelines cases. But such an interpretation is consistent with Congress's "concern" that the exemptions' built-in restrictions had proved insufficient to prevent "overus[e]." Leopold, 94 F.4th at 37.
Even though the district court did not analyze the redacted contents under the heightened foreseeable harm requirement—only analyzing whether the IRS cleared the "low bar" of Exemption 7(E)'s circumvention clause—the record still supports the IRS's withholding under the heightened standard. First, Donaghy's declaration specifically references the IRS's determination that lax authentication procedures allowed wrongdoers to access taxpayer information in the past. The IRS adopted the redacted techniques and procedures of IRM § 21.1.3.3 to improve its third-party authentication procedures and prevent ongoing circumvention of the law. Thus, the IRS can reasonably foresee harm stemming from disclosing the redacted contents because the harm preceded the adoption of the techniques and procedures. Indeed, the IRS adopted those techniques and procedures in response to ongoing unauthorized third-party access to taxpayer information.
That is not to say a withholding agency satisfies its burden under the foreseeable harm requirement simply by showing it adopted techniques or procedures in response to past harm. Mere demonstration of past harm is no guarantee that disclosing the adopted techniques or procedures inevitably leads to that harm repeating. The agency must still justify its withholding by explaining how disclosure of the withheld techniques or procedures leads to foreseeable harm.
Second, Donaghy explains, to the greatest extent possible, how disclosure of the redacted contents leads to circumvention of the law. See Cox, 576 F.2d at 1311 (A withholding agency "must articulate its reasoning with specificity, to the degree that it can do so without revealing . . . the content of the material in question."). As to Redaction 1, Donaghy states this redacted material "explains the identity authentication elements required of a third-party purportedly holding the taxpayer's [power of attorney] or [tax information authorization] as modified for certain non-standard circumstances." She explains that disclosing these techniques would inform wrongdoers "of the modified authentication elements that satisfy the IRS's investigation or the non-standard circumstances for which they are modified," which would enable those wrongdoers to circumvent those procedures, and thus circumvent the law.
As to the other four redactions, Donaghy likewise describes the techniques and procedures to the greatest extent she can without revealing the content of the redacted material. Redaction 2 "describes alternative identity authentication procedures for a particular group of purported [power of attorney] and/or [tax information authorization] holders"; Redactions 3 and 4 "describe[ ] certain procedures IRS employees are instructed to follow with respect to callers who present another specific non-standard circumstance"; and Redaction 5 "describes alternative identity authentication procedures for certain purported [power of attorney] and/or [tax information authorization] holders under certain other non-standard circumstances." She also explains that disclosing these procedures could reduce their "effectiveness in accurately identifying callers and distinguishing those with taxpayer-authorized access from those attempting to obtain return information fraudulently or without a taxpayer's authorization."
Granted, Donaghy references how disclosure would lead to a foreseeable "risk" of circumvention of the law, invoking the language of Exemption 7(E)'s circumvention clause. But even though she does not specifically invoke the foreseeable harm requirement, her affidavit and accompanying materials nevertheless establish that disclosure would lead to foreseeable harm. This is not the case when an agency attempts to withhold information based only on overly broad generalizations. See Reps. Comm., 3 F.4th at 370 (holding the agency's "assertion of harm in [two] umbrella paragraphs" of its declaration did not address foreseeable harm when those paragraphs were "scanty," "wholly generalized and conclusory," and "just mouthing the generic rationale for the [exemption] itself"). Even though Fogg accuses Donaghy's declaration of containing some conclusory language as to why the IRS expects greater circumvention of the law, the declaration also contains enough redaction-by-redaction specifics to meet the heightened burden for withholding.
III. Conclusion
We affirm the district court.