CoA Institute Files Second Lawsuit for Records Concerning EPA Employees’ Use of Encrypted Messaging App

Washington, D.C. – Cause of Action Institute (“CoA Institute”) today filed a second lawsuit in the U.S. District Court for the District of Columbia against the Environmental Protection Agency (“EPA”) for the failure to disclose records about an ongoing investigation into agency employees’ use of an encrypted messaging application, called “Signal.”  The records at issue—which were the subject of two Freedom of Information Act (“FOIA”) requests (here and here)—include a special report, requested by the EPA Office of Inspector General and generated by an agency contractor, which identifies the mobile applications running on most EPA-furnished devices, as well as documents concerning the agency’s continuing efforts to address allegations of wrongdoing, including the avoidance of federal records management laws.

CoA Institute Counsel Ryan Mulvey: “We now know that a small group of career EPA employees used Signal to avoid transparency.  These employees’ work-related communications—including their messages concerning any proposed efforts to thwart the new administration’s political appointees from carrying out the president’s policy agenda—should have been preserved for disclosure to the public.  Records released by the EPA, however, prove that this preservation never took place.  Now, the EPA has effectively refused to disclose any additional documents that could show how pervasive the use of Signal was and how seriously the agency has tried to rectify deficiencies in meeting its record preservation obligations.”

CoA Institute opened its investigation into the use of Signal at the beginning of the year, following media reports that suggested a select number of career officials were using the application to plan methods for obstructing the Trump administration’s incoming political leadership.  CoA Institute’s investigation was widely discussed in the press, along with Congress’s request for the EPA’s watchdog to independently investigate the matter.

Just hours after CoA Institute filed its first FOIA lawsuit, on March 23, 2017, the EPA’s Office of General Counsel acknowledged that there was, indeed, an “open law enforcement” investigation and, as a result, responsive records would have to be redacted.  The EPA ultimately reconsidered its position and, notwithstanding its active investigation, agreed to release relevant records.  Those records prompted the follow-up FOIA requests at issue in today’s lawsuit.

More information on CoA Institute’s investigation can be found here.

The full complaint can be found here.

For information regarding this press release, please contact Zachary Kurz, Director of Communications at CoA Institute:

Investigation Update: EPA Employees’ Use of an Encrypted Messaging App to Thwart Transparency and Fight the White House

Shortly after President Trump took office, Politico reported that a small group of career employees at the Environmental Protection Agency (“EPA”)—“numbering less than a dozen”—were using an encrypted messaging application, called “Signal,” to discuss ways in which to prevent incoming political appointees from implementing the Trump Administration’s policy agenda, which may violate the Federal Records Act.  These employees sought to form a sort of “opposition network” to combat any shift in the EPA’s mission and to preserve the “integrity” of “objfedective” scientific data collected for years by the agency.

The use of Signal at the EPA mirrored reports about the use of electronic messaging platforms at other agencies, including the State Department and the Department of Labor.  But the EPA seemed to present a particularly potent site for the fermentation of political opposition among the civil service bureaucracy.  As reported by Reuters, for example, “[o]ver 400 former EPA staff members” wrote an open letter to the U.S. Senate, asking that former Oklahoma Attorney General Scott Pruitt’s nomination as Administrator be rejected, and employees in the EPA’s Chicago regional office held a joint protest against Pruitt with the Sierra Club.  Such resistance, as our investigative findings suggested, has yet to dissipate.

* * *

Cause of Action Institute (“CoA Institute”) opened its investigation into the use of Signal following Politico’s report.  We were concerned that Signal might have been used to conceal internal agency communications from oversight and that the EPA had failed to meet its legal obligations under the Freedom of Information Act (“FOIA”) and the Federal Records Act to preserve records of official government business created or obtained on Signal.  The EPA’s less-than-sterling reputation for managing electronic records likely inspired the House of Representatives to seek similar clarification from the EPA Inspector General on the Signal scandal.

In our view, to the extent intra-agency Signal correspondence pertained to employees’ plans, in their official capacities, to fight the White House on policy issues, those records were governed by the FOIA and the Federal Records Act, even if created or received on private devices.  Applicable guidance from the National Archives and Records Administration (“NARA”) on electronic records states as much.  Although some have argued that Signal could have been used in the employees’ personal capacity or “off the record,” such claims rest on “murky legal ground.”  At least to the extent employees used Signal on EPA devices, there should have been some mechanism in place to preserve messages until agency authorities could determine whether federal records laws applied.  Such a mechanism was particularly important given the difficulty of recovering encrypted messages after deletion.

* * *

To date, CoA Institute’s investigation has unearthed previously undisclosed information about the Signal scandal and the EPA’s efforts to address allegations of legal wrongdoing.  In response to our first FOIA lawsuit, the EPA acknowledged that there was an “open law enforcement” investigation and, therefore, many of the records at issue would be withheld in full.  The EPA eventually changed its position on this matter and released a number of partially-redacted records.  Those records corroborate the alarming facts reported in the media and reveal much more.

For example, the EPA Office of Inspector General apparently opened its official investigation into the use of Signal only after reading the Washington Times report on CoA Institute’s FOIA efforts.  As Assistant Inspector General Patrick Sullivan noted:

Figure 1: February 3, 2017 E-mail from Patrick Sullivan to Arthur Elkins et al.

An unidentified special agent then explained how an official “hotline complaint” would be initiated, but only after consulting with IT staff.

Figure 2: February 3, 2017 E-mail from Unidentified Special Agent

The EPA’s administrative offices appear to have been alerted to the Signal scandal before the Inspector General, and only because of the efforts of President Trump’s political appointees.  David Schnare almost immediately highlighted the need for a high-level response.

Figure 3: February 2, 2017 E-mail from David Schnare

Mr. Schnare subsequently resigned from the EPA in March 2017, citing difficulties with “antagonistic” career staff opposed to President Trump’s policy agenda.

The next day, again in response to the Washington Times, another Trump-appointed advisor, former State Senator Donald Benton, described the media reports as “disturbing if true,” and wondered whether the EPA could detect whether Signal had been improperly downloaded on any devices. (Senator Benton also left the EPA following alleged clashes with Administrator Pruitt.)

Figure 4: February 3, 2017 E-mail from Donald Benton

Steven Fine, the EPA’s Acting Assistant Administrator of the Office of Environmental Information and Acting Chief Information Officer, assured Senator Benton that the agency could not detect “app downloads,” but could, in fact, scan devices for already-installed programs.

Figure 5: February 3, 2017 E-mail from Steven Fine

The EPA’s ability to “scan” for the installation of Signal was also revealed during summary judgment briefing against Judicial Watch in unrelated FOIA litigation.  A declarant for the EPA described a software tool known as “Mobile Device Management” or “MDM,” which can compile a master report that identifies the applications running on most EPA-furnished equipment.  Indeed, Mr. Fine likely wrote to Senator Benton with knowledge of the Inspector General’s pending request for “assistance in identifying whether certain mobile apps, including Signal, had been downloaded” to EPA devices.

Figure 6: February 3, 2017 E-mail from Patrick Sullivan

* * *

Figure 7: February 3, 2017 E-mail from Rena Key

Interestingly, an unidentified special agent in the Office of the Inspector General recognized the limitations in retrieving Signal messages, regardless of the agency’s ability to use MDM to identify the relevant devices on which the application was installed.

Figure 8: February 3, 2017 E-mail from Unidentified Special Agent

An EPA contractor eventually generated the requested report in the MDM devices and transmitted it to the Office of Environmental Information.  CoA Institute has a pending FOIA request for a copy of the MDM report.

Records released to CoA Institute also raise or confirm other concerning facts:

  • Based on a list of approved “Terms of Service” agreements, EPA employees never were, and still are not, authorized to download and use Signal. Although various social medial tools are approved for use, Signal is not one of them.
  • Internal agency guidance leaves individual employees with total discretion in determining whether text or instant messages need to be forwarded to an official e-mail address and agency recordkeeping system. Although the guidance highlights the differences between “substantive (or non-transitory)” records and those that need not be retained, there is no clear system of oversight to prevent the unauthorized deletion of electronic records.
  • On February 22, 2017, NARA wrote to the EPA to request an update on the records management issues involved in the Signal scandal. The EPA responded a month later, explaining that its investigation was still ongoing and a final report would be forthcoming.  The agency referred to its existing list of approved “Terms of Service” agreements, as well as its efforts to remind employees of their individual responsibility to preserve certain records.  No specific mention was made of the use of Signal.

As additional information becomes available, we will provide further analysis on the EPA’s investigation into the unauthorized use of Signal.

Selected records from CoA Institute’s FOIA production, excepts of which have been used above, can be accessed here.

Ryan P. Mulvey is Counsel at Cause of Action Institute.

Court Dismisses Hillary Clinton Email Recovery Case

Washington D.C. – A federal judge in the U.S. District Court for the District of Columbia today dismissed a case brought by Cause of Action Institute (“CoA Institute”) and Judicial Watch against the Secretary of State and the Archivist of the United States to compel them to fulfill their legal obligations to recover all of Hillary Clinton’s unlawfully removed email records during her tenure as Secretary of State.

In December 2016, the D.C. Circuit Court of Appeals ruled in favor of CoA Institute and Judicial Watch, overturning an earlier opinion by the same district court judge that had dismissed the case as “moot.” Despite the higher court’s rebuke, the Secretary of State and U.S. Archivist still refused to perform their statutory obligations under the Federal Records Act to recover Secretary Clinton’s email records by initiating action through the Attorney General.

CoA Institute President and CEO John J. Vecchione: “The fact that this case was dismissed does not absolve Secretary Clinton or show that all of her unlawfully removed email records have been recovered. In fact, the Court’s decision shows that Secretary Clinton violated the Federal Records Act and that a subset of her work-related emails remains missing. Unfortunately, the Court concluded that efforts by the FBI in its investigation of Secretary Clinton’s handling of classified material, which resulted in the recovery of numerous emails that Clinton had not previously turned over, left nothing further for the Attorney General to do.”

This case, for the first time, brought to light that the FBI’s investigation included the issuance of grand jury subpoenas. The Court stated that “referral to the Attorney General” is the typical remedy for unrecovered records, but found that unnecessary in this case because:

The Government has already deployed the law enforcement authority of the United States to recover Clinton’s emails, as the FBI has sought those records as part of its investigation into whether Clinton mismanaged classified information. The Court thus need not speculate about what the Attorney General might do.

Testimony submitted by FBI Assistant Director E.W. Priestap opined that the Bureau’s investigation was conclusive. However, the FBI’s investigation focused solely on “unauthorized transmission and storage of classified information” and was not a Federal Records Act record-recovery effort, which was the focus of this litigation. Regardless, the Court found Agent Priestap’s opinions “relevant and reliable,” stating:

Although the FBI and the Attorney General are not one and the same, Jeff Sessions would necessarily look to his investigative arm to recover Clinton’s emails. The FBI’s own assessment of its searches is therefore telling.

Read the full opinion here

Federal Records Law Must Keep Pace with Evolving Technology

Technology develops faster than law.  This maxim has implications across society, but one place it has particular purchase is in federal recordkeeping and the public’s right to access government information.  The two primary federal statutes that require government to preserve records and then allow the public to access those records are the Federal Records Act (“FRA”) and the Freedom of Information Act (“FOIA”).  Federal agencies, unfortunately, do not always live up to their obligations under these laws and government-oversight organizations turn to the courts to seek relief.  The public’s right to sue under the FOIA is well established.  However, courts rarely compel agencies to fulfil their FRA obligations.  My organization, Cause of Action Institute (“CoA Institute”), is currently involved in two important FRA lawsuits that may shape the future of agency obligations under the FRA for decades to come, as information technologies continue to change.

Both lawsuits arose from Secretaries of State failing to preserve their emails in compliance with the Federal Records Act.  Former Secretary Hillary Clinton’s email travails are well catalogued.  But former Secretary Colin Powell also used a non-governmental email account to conduct official government business.  The factual difference between these two cases is that while Secretary Clinton primarily used a personal email service with a server in her basement, Secretary Powell used an AOL account.  But Secretary Clinton also used a BlackBerry email account for the first two months of her tenure as Secretary of State.  So, from these two cases the same legal issue arises: what is an agency’s FRA obligation to recover unlawfully removed federal email records that are housed on commercial email servers?

This question is important to the future of federal recordkeeping law and public access to information because we are already seeing an explosion of non-email methods of electronic communication.  Some of these methods of communication store information locally, such as on a phone or computer, and some store them on commercial servers.  For example, FOIA requesters have been battling for access to text messages for years, agency employees use various forms of instant messaging while at work, and we’ve now seen the rise of the surreptitious use of phone applications such as Signal and Confide that do not always preserve the communications.

In Armstrong v. Bush, the D.C. Circuit recognized two cognizable private rights of action under the Federal Records Act.  First, a plaintiff may bring a case against an agency if that agency does not have the requisite recordkeeping policies in place or if the policies are insufficiently clear so that an employee does not know what type of records he is required to save.  Second, a plaintiff may bring a case to compel the head of an agency or the Archivist of the United States to recover records that have been unlawfully removed from the agency.  If the agency head or Archivist is either unable or unwilling to perform that duty, then the FRA requires them to “initiate action through the Attorney General for the recovery” of those records.  To our knowledge, no such referral to the Attorney General has ever occurred.

At stake in CoA Institute’s Clinton and Powell cases is whether a plaintiff can force the agency head and Archivist to refer the matter to the Attorney General when, through their own actions, they have failed to recover all the missing records.  In both cases the State Department asked representatives of Secretaries Clinton and Powell to recover the unlawfully removed records and return them to the agency for historical preservation and for response to FOIA requests.  In both cases those representatives responded that they were unable to obtain copies of the records that were housed on BlackBerry and AOL servers, respectively.  The State Department and Archivist have responded in the ongoing suits that those efforts are sufficient and that they are not required to use legal process or refer the matter to the Attorney General for more forceful efforts at record recovery.

CoA Institute’s case related to Secretary Clinton has already been to the D.C. Circuit once and the appellate court held that the agency is only absolved of its Federal Records Act obligations if it can establish the “fatal loss” of the records in question.  The State Department and Archivist have not made a sufficient affirmative showing that BlackBerry, and AOL in the case of Secretary Powell, do not have, and cannot recover, these email records.  They have offered no statements from either company or detailed efforts by those companies to recover and return the federal records.

Whether the district court compels the current Secretary of State and Archivist to make such an affirmative showing or requires them to refer the matter to the Attorney General for him to attempt record recovery could set an important precedent.  This decision will shape the future of agency responsibilities under the Federal Records Act and the public’s ability to have access to its government’s information as communications technology continues to change.

James Valvo is counsel and senior policy advisor at Cause of Action Institute.  He is counsel in both cases discussed in this article.  You can follow him on Twitter @JamesValvo.

CoA Institute Moves to Strike FBI Official’s Opinions from Clinton Email Case

Washington D.C. – Cause of Action Institute (“CoA Institute”) today filed a motion to strike from the record improper opinion testimony submitted by FBI Assistant Director E.W. Priestap. The declaration was filed in support of the government’s defense in a pending case against the State Department and National Archives and Records Administration regarding former Secretary of State Hillary Clinton’s unlawful removal of emails.  The suit seeks to refer the matter to the Attorney General, which is what the law requires.

A federal judge in August ordered the government to publicly release the unredacted declaration that it had previously filed so that only the judge was able to review it. The FBI’s declaration includes several opinions that the government relies on to support its case. For example, Mr. Priestap states that “[i]t is my opinion that there are no further investigative actions that can be undertaken by the FBI to recover additional Clinton work-related e-mails which would be meaningful to the investigation, as described above.”

However, the investigation Mr. Priestap is referencing is “the potential unauthorized transmission and storage of classified information on the personal e-mail server of former Secretary Clinton.”  He is not referencing a record-recovery effort pursuant to the Federal Records Act (“FRA”), which is the subject of this litigation.

Cause of Action Institute President and CEO John J. Vecchione: “The FBI’s declaration revealed grand jury subpoenas where there was probable cause to believe classified information may have been involved. This litigation is not merely about classified information, but about the government doing everything in its power to recover Secretary Clinton’s records, in accordance with the law. The opinions offered by Mr. Priestap are unfounded under the applicable standard of law and ignore that this suit seeks more than classified material, which was the FBI’s interest.”

The full Motion to Strike is available here.
CoA Institute also filed its reply brief available here.

For information regarding this press release, please contact Zachary Kurz, Director of Communications at CoA Institute:

CoA Institute Forces FBI to Reveal New Details of Clinton Email Investigation

Washington D.C. – The FBI has revealed previously undisclosed details outlining the scope of its investigation into Hillary Clinton’s email practices as Secretary of State. The disclosure, made Wednesday evening, was a result of Cause of Action Institute (“CoA Institute”) convincing the court to release the secret declaration. In August, U.S. District Court Judge James Boasberg ruled in favor of CoA Institute ordering the government to produce the full declaration that had been filed ex parte and in camera, meaning only the judge had been able to review it.

The declaration reveals the FBI issued several grand jury subpoenas to allies of Mrs. Clinton in instances where there was probable cause to believe those individuals may have received classified information. These subpoenas were issued in addition to subpoenas to her email service providers. The FBI claims it recovered thousands of emails that had previously not been returned to the State Department.

Cause of Action Institute President and CEO John J. Vecchione: “Americans are finally getting important information about the FBI’s efforts to recover the government emails possessed by Hillary Clinton. It’s amazing that this information was only revealed by this suit and not by Congress, the mainstream press, or the administration.”

The full FBI declaration is available here.

For information regarding this press release, please contact Zachary Kurz, director of communications:

Judge Orders Government to Reveal Evidence in FBI Clinton Email Investigation

Washington D.C. – The Honorable James Boasberg, a federal judge for the U.S. District Court for the District of Columbia, today ordered the government to produce an unredacted declaration filed in secret early this summer containing new, undisclosed details about the scope of the FBI’s investigation into Hillary Clinton’s email practices as Secretary of State.

The government had previously disclosed the evidence to the court ex parte and in camera, meaning only the judge was able to review it, but characterized the declaration as including, “additional details about the grand jury process . . . as well as about other sealed proceedings” and was submitted to provide “further details of the subpoenas to establish to the Court’s satisfaction the thoroughness of the inquiries made in this regard.”

Cause of Action Institute filed a motion in June to produce the declaration and the judge today granted that request.

Cause of Action Institute President and CEO John J. Vecchione: “I applaud the court’s opinion. The government attempted to end a case with evidence no one could review. This order makes public details submitted by the government about the FBI’s efforts to recover then-Secretary Clinton’s unlawfully removed emails. Americans deserve to know the full scope of that investigation, and we, as Plaintiffs, should have an opportunity to contest the relevance of the government’s facts.”

In his order, Judge Boasberg writes:

“The 2016 presidential election may have come and gone, but Plaintiffs Judicial Watch and Cause of Action Institute’s quest for Hillary Clinton’s emails lives on. As most readers will remember, Clinton used private email accounts during her tenure as Secretary of State, embroiling the government in myriad Freedom of Information Act suits. In this case, however, Plaintiffs have taken a different tack, alleging a violation of the Federal Records Act. That is, they claim Defendants State Department and the National Archives and Records Administration failed to maintain records of Clinton’s emails and must now seek the Department of Justice’s Case assistance in their recovery. Most broadly characterized, Plaintiffs’ suit pertains to tens of thousands of communications. At this stage, however, the parties have largely zeroed in on a sliver of that trove — to wit, emails sent by Clinton on two Blackberry accounts during her first weeks in office.

“The present controversy is narrower still. To establish its good-faith recovery efforts, the Government has submitted a declaration describing grand-jury subpoenas issued to Clinton’s service providers. The catch? It offers the full version for in camera and ex parte review only. Plaintiffs have responded with a Motion to Produce, arguing that to the extent this Court might rely on the declaration, they must have unfiltered access. After reviewing the document in camera, the Court concludes that it largely rehashes information already made public, thus obviating any need for secrecy. The Court will therefore grant Plaintiffs’ Motion in large part and, subject to a very limited exception, order that Defendants resubmit an unredacted version of the declaration.”

Judge Boasberg’s full order is available here.
The Plaintiffs’ motion to produce the declaration is available here.

For information regarding this press release, please contact Zachary Kurz, Director of Communications: