Summary:  This post discusses a recent decision holding that agency official’s web browsing histories, generated automatically by a web browser, are not “agency records” under FOIA.

“You are what you read. The information that you input into your mind informs your thinking patterns, and it influences . . . the decisions you make, the work you produce, and the interactions you have.”

—Zat Rena, Tell Me What You Read, And I’ll Tell You Who You Are (Oct. 3, 2017). 

Presumably, federal employees, like the rest of us, use the Internet for official business (and occasionally for personal matters) throughout their workday.  Are browsing histories created as a result “agency documents” subject to disclosure under FOIA?  A D.C. District Court Judge grappled with the issue in Cause of Action v. White House Office of Management and Budget, — F. Supp. 2d —, 2019 WL 6052369 (Nov. 15, 2019).

Factual Background and Decision

The controversy began with Cause of Action’s FOIA requests to the Office of Management and Budget (“OMB”) and the U.S. Department of Agriculture (“USDA”), for the browsing histories of four senior officials:  OMB Director Mulvaney, OMB’s Associate Director of Strategic Communications, Secretary of Agriculture Purdue, and USDA’s Director of Communications.  USDA asserted in response that the requested materials were not “agency records”; OMB did not respond at all.  Plaintiff sued to obtain the records.  Both agencies argued that the browsing histories were personal records, rather than agency records, and thus beyond FOIA’s reach.  Slip op. at 2, 8.

FOIA requires agencies to provide “agency records” in response to requesters, but does not define the term.  The Supreme Court has opined that “agency records” encompass records created or obtained by the agency[1] and sufficiently under its control at the time the FOIA request.  U.S. Department of Justice v. Tax Analysts, 492 U.S. 136, 144–45 (1989).  In determining the sufficiency of the agency’s control, the D.C. Circuit has established a four-factor test applicable in many circumstances.  Burka v. United States Department of Health and Human Services, 87 F.3d 508, 515 (D.C. Cir. 1996); Tax Analyst v. DOJ, 845 F.2d 1060, 1069 (D.C. Cir. 1988), aff’d on other grounds, 492 U.S. 136 (1989).  In particular, a court must consider: “(1) the intent of the document’s creator to retain or relinquish control over the records; (2) the ability of the agency to use and dispose of the record as it sees fit; (3) the extent to which agency personnel have read or relied upon the document; and (4) the degree to which the document was integrated into the agency’s record system or files.”[2]  The test has been described variously as the Burka test and the Tax Analyst test.

Initially, the D.C. Circuit required that all four elements favor a finding of lack of agency control, Tax Analyst v. DOJ, 845 F.2d at 1069; but for the most part later cases apply the factors in a more holistic fashion. See, e.g., Consumer Federation v. Department of Agriculture, 455 F.3d 283, 287 (D.C. Cir. 2006).  Moreover, given that the Government bears the burden of proving that requested materials are not agency records, Tax Analysts, 492 U.S. at 142 n. 3,[3] the D.C. Circuit has suggested that when the four-factor analysis yield no clear answer, such uncertainty favors the FOIA requester, Judicial Watch, Inc. v. U.S. Secret Service, 726 F.3d at 220.

The Court has distinguished government officials’ personal records from agency records.  Kissinger v. Reporters Committee for Freedom of the Press, 445 U.S. 136, 157 (1980);[4] see, Competitive Enterprise Institute v. Office of Science and Technology Privacy, 827 F.3d 145 (D.C. Cir. 2016); Media Research Center v. U.S. Department of Justice, 818 F. Supp. 2d 131, 140 (2011).  Only records an official holds as his or her personal records under a claim of right are considered outside of agency control.  See, Completive Enterprise Institute, 827 F.3d at 148 (Sentelle, J.); id. at 150–53 (Srinivasan, J., concurring).[5]

In Cause of Action, defendants conceded that they had created or obtained the browsing histories, leaving the sufficiency of their control over the records the only remaining question.  The District Court used the Burka test, in a holistic fashion, to make that determination.  Cause of Action v. OMB, 2019 WL 6052369, *8-*11.

With respect to the document creator’s intent to retain or relinquish control, defendants noted that “[n]one of the relevant employees did anything to save their histories from the automatic deletion process.”  Id. at *9.  But the Court concluded that when an official generates documents in the course of his or her employment, the intent of the agency, rather than that of the individual official, is critical.  Id.  Noting that “there is no suggestion that the [OMB or USDA] intended to relinquish control of the browsing histories,” id., the Court concluded that the first Burka factor favored plaintiffs.

Regarding the second factor, the agency’s ability to use and dispose of the records at issue, OMB and USDA claimed to pursue “a longstanding practice of following internet browsers’ automatic deletion setting,” which thus rendered the requested material beyond their control.  Id. at *10.  Defendant’s own declarations rebutted that assertion.  But the Court ascribed greater importance to two other facts.  First, whatever the browser’s automatic settings, the agencies’ could access and use its employees’ browsing histories.  Id.  Second, whether or not they exercised the power to modify the browser’s settings, the agencies possessed the capacity to modify the automatic deletion settings.  Id.

The most important Burka factor, the extent to which agency personnel have read or relied upon the document, favored the government.  The “use of the documents by employees other than the author” is critical.  Id. at *10 (quoting Bureau of Nat’l Affairs, Inc. v. U.S. Dep’t of Justice, 742 F.2d at 1493). [6]   More specifically, the Court must assess “the extent to which the creator of the document and other employees . . . relied upon the document to carry out the business of the agency.”  Id.  The defendants “represent[ed] that that they never accessed, distributed, or relied upon the browsing histories.”  Id.  Thus, the third Burka factor supported the defendants’ argument that the browsing histories were personal records.[7]

The fourth factor, integration of the requested documents into the agency’s records system, also favored the government.  OMB and USDA argued that the browsing histories were not integrated into their records systems. They “were stored on the local drive of the employee’s computer or mobile device.”The agencies’ information technology staff could access an employee’s browsing history only by physically sitting at the employee’s work station or virtually signing on to the workstation with the employee’s assistance.Id. at *11.  In response, plaintiff argued that “[t]he maintenance of Internet browsing history records on agency hardware, which is physically accessible by other agency officials or representatives” made the fourth Burka factor favor a finding of agency control.  Id.  Without much explanation, the Court asserted that the fourth factor weighed in favor of the browsing histories not qualifying as agency records.  Id.

The Court found the third factor, the extent to which agency personnel have read or relied upon the document, decisive.  Accordingly, the browsing histories were not agency records.  Id.

Observations

Something seems amiss.  Intuitively, browsing histories of employees using agency computers to conduct agency business would seem to be “agency records.”  No other governmental body, either a FOIA-exempt or even a FOIA-covered governmental entity, has any competing claim to the record.  Nor is the situation one in which the employee should be able to assert a claim of right to the record superior to the agency’s.  Nor can the proprietary owner of the web browser assert any exclusive right to the records.[8]

So where did the District Judge go wrong.  The Burka test obscures the intuitive answer in this setting.  The test’s strengths are its capability for broad application and its seemingly value-neutral character.  The test seems to resolve a range of issues reasonably well.  And the test does not call upon courts to decide whether as a matter of policy particular records should be subject to a FOIA request.  The test does not factor in any predicted consequences of making a category of documents subject to FOIA requests nor assessments of the importance of public access to the documents in terms of FOIA’s goals.  Granted such predictions and assessments may be quite difficult to make without seeing a variety of requests for such records.

In Cause of Action v. the National Archives and Records Administration, the Court noted that in the NARA context the Burka test’s focus is “‘divorced from FOIA’s key objective,” namely making accessible documents that “reveal[] to the public how federal agencies operate.’”  753 F.3d at 215.  Given NARA’s warehousing function, documents NARA archived revealed little about NARA’s own operations.  Id.  at 215-216.  With respect to browsing histories, agencies may largely consider themselves automatic repositories of employee browsing histories.  And unlike in almost all “agency records” cases, the browsing histories are not deliberately created by the agency — their production is merely a function of the web browser that the agency has failed to disable.[9]  Yet the browsing histories, particularly those of senior officials, can tell the public something about how the agency operates.

In particular, the browsing histories of final decision-makers, often the agency head and deputies delegated decision-making authority, can reveal their unstated biases; the websites they visit can provide insight into their mindsets.  Web histories can reveal frequent access to Fox News, on one hand, or MSNBC, on the other, which surely provides possible insight into the official’s political leanings.  Or web histories can reveal frequent visits to white supremacist sites, again revealing a particular mindset.[10]  And indeed, browsing histories could tell the public whether and to what extent a decision-maker reviewed certain websites in reaching a conclusion on a particular issue.[11]  With respect to agency adjudicators in cases where the administrative record is the exclusive mode of decision, browsing histories could reveal whether the adjudicator conducted research outside of the record.[12]

The sorts of insights highlighted above seems less useful with respect to the browsing histories of employees who participate in the preliminary stages of the decision-making process, but are not the final decision-makers.  So in some ways Cause of Action’s requests for the browsing histories of the head of OMB and the Department of Agriculture provide one of the strongest cases for concluding that browsing histories can provide useful information that the public is entitled to know.

Consider also the potential uses of browsing histories for agency employees in the aggregate.  Such aggregate browsing history might reveal how much time government employees spend on personal pursuits during their duty hours or the extent to which employees visit sexually-explicit sites.[13]  However, FOIA requesters probably cannot compel agencies to provide such aggregate data, as such requests would require creation of new records that do not otherwise exist, see, NLRB v. Sears, Roebuck & Co., 421 U.S. 132, 161–62 (1975)( FOIA imposes no duty on the agency to create records); accord, Forsham v. Harris, 445 U.S. 169, 186 (1980).[14]

Assessing the potential consequences of classifying browsing histories as “agency records” would require consideration of several matters.  First, other than giving insight into the biases of decision-makers, such records will probably be of limited use in most cases.[15]  The no-doubt voluminous nature of the data may hide any nuggets that might provide insights regarding, for example, whether and how an agency official used particular websites in connection with a particular decision.  Second, much of individual employees’ browsing history records can or should be withheld in any event under FOIA’s exemptions or the policies underlying those exemptions, most notably exemptions 5 and 6.

Exemption 6 would certainly protect some elements of employee browsing histories.  Browsing histories certainly qualify as “personnel, medical, and similar records,” given the breadth of the courts’ reading of the phrase.  See, e.g., Cook v. National Archives & Records Administration, 758 F.3d 168, 174-75 (2d Cir. 2014).[16]  Exemption 6 would almost certainly justify redaction of sites visited solely for personal reasons.  Exemption 6 would also justify exclusion of sites visited for official reasons whenever the employee’s privacy interests exceeds the public interest in the information’s disclosure.  See, Prison Legal News v. Samuels, 787 F.3d 1142, 1147 (D.C. Cir. 2015).  Such Exemption 6 analyses could “separate the wheat from the chaff,” identifying and requiring disclosure of only the elements of employee browsing histories that provide true insights into the basis for an official’s decision or other relevant insights into the manner in which the agency operates.

But “is the game worth the candle”?  The time and expense of the necessary agency review of possibly voluminous browsing histories for such relevant elements seems excessive given the ambiguity and limited usefulness of the information likely to be revealed.[17]  Indeed, with respect to government officials below the level of final decision-makers, even insights into the general mindset of agency personnel seem of modest relevance.  And in addition, such information could be used by companies to direct unwanted solicitations to agency employees.  See, National Ass’n of Retired Employees v. Horner, 879 F.2d 873, 876, 878 (D.C. Cir. 1979).  Granted, web-based ads based on search histories and cookies are already made based on the sites employees visit.

Technically, the government might well be unable to invoke Exemption 5 to limit disclosure of browsing histories.[18]  Web browser histories probably do not qualify as “memorand[a] or letters” nor comfortably fit within the “deliberative process privilege” analysis.[19]  Nevertheless, public disclosure of employee browsing histories would no doubt place a chill on agency employees of a type the deliberative process privilege is designed to forestall.[20]  In particular, disclosing such histories will convey the agency officials’ exploration of ideas as a part of participating in an agency decision-making process.  It may lead employees to avoid visiting certain websites or lead them to do so on personally-owned computers and devices.  Web searches would generally be pre-decisional and their disclosure would reveal something more than even internal agency deliberations, namely the deliberation of an individual in either attempting to provide advice to the decision-maker or making the decision himself or herself.[21]

Conclusion

Cause of Action v. OMB grapples with an interesting issue.  While the Court applied a Burka analysis to resolve the issue, one can question whether Burka provides an adequate framework to decide whether browsing histories are agency records.

---

[1] This requirement makes records created by government contractors but never transferred to the agency inaccessible by FOIA request.  See, Forsham v. Harris, 445 U.S. 169, 178 (1980).  For a discussion of the doctrine’s application to back up data for environmental impact statements, see Rocky Mountain Wild v. U.S. Forest Service: Applying Forsham v. Harris in the NEPA Context, 36 YALE J. ON REG.: NOTICE & COMMENT  (March 11, 2018).

[2] When an agency has either obtained records from or prepared documents for a FOIA-exempt governmental entity, such as Congress, only the first two factors are considered.  Judicial Watch, Inc. v. U.S. Secret Service, 726 F.3d 208, 221 (D.C. Cir. 2013)( White House visitor logs preserved by the Secret Service); United We Stand America, Inc. v. IRS, 359 F.3d 595 (D.C. Cir. 2004)( document generated in response to a congressional request); Goland v. CIA, 607 F.2d 339 (D.C. Cir. 1978)( transcript of a closed congressional hearing).  With respect to records held for posterity by the National Archives (“NARA”), the D.C. Circuit found the Burka test unhelpful.  Cause of Action v. National Archives and Records Administration, 753 F.3d 210, 215 (D.C. Cir. 2014).  A District Judge reached a similar conclusion with regard to transition team records maintained by the General Services Administration. Democracy Forward Found. v. U.S. General Services Admin., 393 F. Supp. 3d 45 (D.D.C. 2019); see, Bernard Bell, Presidential Transition Teams, GSA, and the FBI: The Three Shell Game, FOIA Style, 36 YALE J. ON REG.: NOTICE & COMMENT  (July 6, 2019).

[3] The Supreme Court cited the relevant congressional reports. S.Rep. No. 813, 89th Cong., 2nd Sess., 8 (1965); H.R.Rep. No. 1497, 89th Cong., 2d Sess., 9 (1966).

[4] In Kissinger, the Court said: “If mere physical location of papers and materials could confer status as an ‘agency record’ Kissinger’s personal books, speeches, and all other memorabilia stored in his office would have been agency records subject to disclosure under the FOIA.” 445 U.S. at 157.

[5] The clearest expression of the “claim of right” requirement came in Kissinger’s interpretation of the statutory term “withholding.”  445 U.S. at 154-55. But in Competitive Enterprise Institute, the judges in the majority as well as the concurring judge used the phrase to define “agency record.”

[6] The Court, citing Consumer Federation v. Department of Agriculture, 455 F.3d at 291-93, noted that an agency official’s appointments calendar that was neither distributed to nor relied upon by others is not an agency record, unlike appointments calendars distributed to top agency staff.

[7] The Court refused plaintiff’s motion to conduct discovery, which may have rebutted the agencies’ representations regarding access, distribution, and reliance upon browser histories.  The Court considered the plaintiff’s suggestion that the contested browsing histories were used by the defendants for purposes other than those described in defendants’ detailed declarations “purely speculative.”  Id. at *7.

[8] The intuitive answer is arguably even more compelling given the burden imposed on the government to prove that requested documents are not government records.

[9] The District Judge quoted the plaintiff’s description of browsing histories’ generation:

“The use of an Internet browser to visit a website entails the automatic creation and collection of numerous pieces of information known collectively as a ‘session history entry.’ Such information may include details about the user, his or her individual device and wider network (e.g., Internet protocol address), and a minimum, the location or [Uniform Resource Locator (‘URL’) ] that has been visited. By navigating between webpages, a browser user adds or modifies entries to his or her session history, which is then maintained on and accessible through the native structure of the browser itself. [ ] The information is typically viewed through the ‘History’ function of the browser.” Compl. ¶¶ 11–12.

Cause of Action v. OMB at *2, n.2.

[10] Tom McKay, Stephen Miller Linked to White Supremacist Sites, Pushed Racist Talking Points in Leaked Emails, GIZMODO (posted 11/12/19 11:55PM).

[11] The Administrative Conference of the United States (“ACUS”) has recently given attention to administrative adjudicators’ use of the Internet in connection with their decision-making.  Jeremy S. Graboyes, Independent Research By Agency Adjudicators In The Internet Age, October 31, 2019.

[12] Id.

[13] The Commonwealth of Virginia prohibited its employees from “utilize[ing] agency-owned or agency-leased computer equipment to access, download, print or store any information infrastructure files or services having sexually explicit content.” Va. Code Ann. § 2.2-2827(B) (previously Va. Code Ann. § 2.1-805;) See generally, Urofsky v. Gilmore, 216 F.3d 401 (4th Cir. 2000) (en banc), cert. denied, 531 U.S. 1070 (2001).

[14] For application of this principle in the context of digital records, see Long v. CIA, 2019 WL 4277362 *4 (D.D.C. Sept. 10, 2019), and Nat’l Sec. Counselors v. CIA, 898 F. Supp. 2d 233, 270 (D.D.C. 2012).

[15] Even with regard to top agency official’s biases, browsing history may be ambiguous.  Agency officials may visit sites whose philosophy they reject in order to ascertain the perspective of either those with whom they disagree or potential opponents.

[16]President Bush’s and Vice President Cheney’s requests for their own presidential records held by NARA qualified as “personnel and medical files and similar files” within the meaning of Exemption 6, because they contained personally identifiable information.  In particular, they revealed the archived materials the President and Vice President sought as well as their general research interests.  Cook, 758 F.3d at 175-76.

[17] Congress reached such a judgment with regard to certain CIA files.  Central Intelligence Agency Information Act, Pub. L. 98–477, 98 Stat. 2209 (Oct. 15, 1984)(codified at 50 U.S.C. § 3141). After over a decade of experience with FOIA’s application to the CIA, Congress concluded that CIA resources were diverted to time-consuming searches and line by line security review of operational files that were “almost invariably” unreleasable. H.R. Rep. 98-726. Part 1, 98^th Cong. 2d Sess. 4–5 (May 1, 1984); S. Rep. 98-305, 98th Cong., 1st Sess. 10–11 (Nov. 9, 1983).

[18] Exemption 5 allows the government to withhold “inter-agency or intra-agency memorandums or letters that would not be available by law to a party other than an agency in litigation with the agency.”  5 U.S.C. §552(b)(5).

[19] Granted, for litigators or other lawyers in engaged in research in anticipation of litigation, browsing histories of websites or legal research databased would presumably be protected by the work product privilege.

[20] Cook v. National Archives & Records Administration, 758 F.3d at 176 (preserving the confidentiality of research requests [is] critical to ensuring that research and intellectual inquiry not be chilled).

[21] Agencies probably cannot invoke Exemption 2 to withhold employees’ browsing history.  That exemption allows agencies to withhold records “related solely to the internal personnel rules and practices of an agency.”  5 U.S.C. §552(b)(2).  In Milner v. Department of the Navy, 562 U.S. 562 (2011), the Supreme Court stated that the exemption protects only those rules and practices that “concern the conditions of employment in federal agencies—such matters as hiring and firing, work rules and discipline, compensation and benefits.” Id. at 570.   Individual employee’s browsing histories do not comfortably fit within that definition.