Using FOIA to Access Intelligence Community Records
The Office of Government Information Services (OGIS) offers dispute resolution services to Freedom of Information Act (FOIA) requesters and agencies. This function allows OGIS to observe and examine the interactions between requesters and agencies across the federal government, and note common questions and issues that arise in the FOIA process. The FOIA Ombuds Observer addresses questions and issues frequently seen in our individual cases. Our goal is to increase efficiency and transparency in the FOIA process.
Using FOIA to Access Intelligence Community Records
December 9, 2024
No. 2025-02
Requesters regularly contact the Office of Government Information Services (OGIS) about their Freedom of Information Act (FOIA) requests for access to records held by the Intelligence Community (IC), a group of 18 federal government agencies that collect, analyze and deliver intelligence and counterintelligence to U.S. leaders. As with any FOIA request, requesters need to know which agency holds the records they seek and how to submit a request.
General questions and overview about Intelligence Community records and the FOIA and Mandatory Declassification Review (MDR) processes
What is the “Intelligence Community?”
Under provisions of the National Security Act of 1947, as amended[1], the term “Intelligence Community” includes the following federal agencies:
- The Office of the Director of National Intelligence (ODNI)
- The Central Intelligence Agency (CIA)
- The National Security Agency (NSA)
- The Defense Intelligence Agency (DIA)
- The National Geospatial-Intelligence Agency (NGA)
- The National Reconnaissance Office (NRO)
- The intelligence elements of the Army (USA), the Navy (USN), the Air Force (USAF), the Marine Corps (USMC), the Space Force (USSF), the Coast Guard (USCG), the Federal Bureau of Investigation (FBI), the Drug Enforcement Administration (DEA), and the Department of Energy (DOE)
- The Bureau of Intelligence and Research (INR) of the Department of State
- The Office of Intelligence and Analysis (OIA) at the Department of the Treasury
- The Office of Intelligence and Analysis (I&A) at the Department of Homeland Security (DHS)
Can anyone submit a FOIA or MDR request to federal agencies that are part of the Intelligence Community?
FOIA provides that any person has a right, enforceable in court, to obtain access to federal agency records except to the extent that any portions of such records are excluded from the FOIA through three exclusions or protected from public disclosure by one of nine exemptions, including national security.[2]
Please note: IC agencies are prohibited from disclosing records in response to FOIA requests made by any foreign government or international governmental organization, either directly or through a representative.[3] Section 3.5(h) of Executive Order 13526 states that only U.S. citizens or legal resident aliens may file Mandatory Declassification Review (MDR) requests to elements of the IC.
What is a Mandatory Declassification Review (MDR) request? Can anyone submit an MDR request?
When a requester wants access to a specific or narrow range of identifiable classified federal records, they can submit a Mandatory Declassification Review (MDR) request for the records instead of filing a FOIA request. Any classified record, regardless of its age or origin, can be the subject of an MDR request. (There are a few exceptions found in Executive Order 13526.)
Executive Order 13526 is the current legal authority for MDR requests and each agency administers MDR according to its own procedures. Requesters can ask for declassification either through an MDR or by filing a FOIA request. The regulation governing mandatory declassification review requires requesters to select one process or the other. If the requester fails to select one or the other, the request will be treated as a FOIA request unless the requested records are subject only to mandatory declassification review, 32 C.F.R. § 2001.33(f).
How do the FOIA and MDR processes differ?
Requesters seeking access to classified records may file a FOIA request or a Mandatory Declassification Review (MDR) request, not both. The differences are broadly outlined below.
|
|
|
| Authorization: 5 U.S.C. § 552; agency-specific FOIA regulations | Authorization: Executive Order (E.O.) 13526 and 32 C.F.R. § 2001; Interagency Security Classification Appeals Panel (ISCAP) regulation, 32 C.F.R. § 2003 |
| Records sought: specific records or records related to a general topic | Records sought: specific or narrow range of identifiable records that the agency can locate with a “reasonable amount of” effort. Records must be classified |
| Initial Request: Agencies have 20 working (business) days to respond + in cases of unusual circumstances, up to an additional 10 working days | Initial Request: Agencies have 1 year to respond |
| Appeal: To agency FOIA appellate authority within 90 calendar days of agency response. | Appeal: To agency within 60 calendar days of agency response or within 60 calendar days after 1 year as a constructive denial if agency has not acted on request. See 32 C.F.R. § 2003 for additional specific information |
| OGIS Assistance: request for OGIS dispute resolution assistance as a non-exclusive alternative to litigation | OGIS Assistance: Not available |
| Litigation: If still disagree or if not responded to within FOIA’s timeframe, requester may file a lawsuit in federal district court with possible appeals to the circuit court and U.S. Supreme Court. | Second-line appeal: ISCAP is the final appellate authority made up of senior officials from specific agencies, established by E.O. 13526. If the requester disagrees with ISCAP - no further recourse; if agency disagrees with ISCAP - it may appeal to the President within 60 calendar days. |
Under FOIA:
- An agency is required to conduct a reasonable search for "responsive” records—those records that meet the search criteria either specified by the requester or identified by the agency.
- The agency is obligated to ensure that the records are properly classified.
- A requester may request assistance from the agency's FOIA Public Liaison (FPL) and/or OGIS at any point during the administrative process. If they disagree with the initial response, they can file an administrative appeal to the agency's FOIA appellate authority; if they are dissatisfied with the administrative result, they can file a lawsuit against the agency in federal district court.
Under MDR:
- The request goes to a specific point of contact named in the Federal Register; the agency has one year to respond.
- The agency is not required to conduct a search, so requesters need to be able to identify the specific record(s) they want reviewed under MDR in order to enable the agency to locate it with a reasonable amount of effort..
- The request is typically processed by the named point of contact which may be a FOIA office, a declassification office, or a separate MDR office.
- A requester who disagrees with the agency’s initial assessment can appeal to the agency within 60 working days. After the appeal, the requester can then appeal to the Interagency Security Classification Appeals Panel (ISCAP), which is the final appellate authority made up of senior officials from specified agencies.
- The requester may appeal directly to the ISCAP if the agency has issued no initial decision for an MDR within one year of filing or no final decision on an agency level appeal within 180 days of the filing of the appeal.
- If an agency disagrees with ISCAP’s decision, it has 60 days to appeal to the President or must release the records; if a requester disagrees with ISCAP, they have no further recourse—there is no litigation in the MDR context.
- Under MDR, agencies review records only to determine if classified information may be declassified. If the records contain sensitive information covered under one of nine exemptions to FOIA, (other than FOIA Exemption 1), requesters must file a FOIA request to obtain that information.
For more information on the MDR process, refer to the Information Security Oversight Office’s (ISOO’s) Mandatory Declassification Review, Frequently Asked Questions, webpages and Mandatory Declassification Review Training slides.
What are the advantages of filing a MDR request versus a FOIA request?
- Results from recent ISOO Annual Reports to the President show the extent of material examined under the MDR process. For example, the 2022 report stated that 206,866 pages of classified material were examined, with 88,165 pages (43%) declassified in full and 90,848 pages (44%) declassified in part. The 2023 report stated that 157,593 pages of classified material were examined, with 74,094 pages (47%) declassified in full and 66,911 pages (42%) declassified in part.
- MDR is the only way to request a review of classified presidential records located in a Presidential Library that predates the Presidential Records Act (i.e., before the Reagan administration).
- MDR offers an expedited appeals mechanism and an appeal alternative to litigation -- ISCAP. However, MDR requesters may not pursue federal court litigation if they are unhappy with the result.
What are the advantages to filing a FOIA request over a MDR request?
- FOIA requires agencies to conduct searches for responsive records, so FOIA requests do not require the same degree of specificity as MDRs.
- FOIA provides both administrative appeal rights and preserves the right to file federal court litigation.
- FPL and OGIS are both available to assist requesters.
Do IC agencies routinely review classified records for potential release?
Apart from MDRs, agencies regularly review their own records for declassification. Under E.O. 13526, all classified records that have been determined to have permanent historical value are subject to automatic declassification 25 years from the date of the document, unless they are reviewed and properly exempted under an ISCAP approved declassification guide. Information exempted at 25 years is subject to re-review at 50 years, and records exempted at 50 years are subject to re-review at 75 years. It is important to note that agencies do not have to review for declassification any records already reviewed within the past two years under FOIA, MDR, or the regular declassification review process.
What should I do before submitting a FOIA request?
It is important to understand the types of records each agency has. Prior to making a FOIA request, we encourage requesters to review the agency websites and FOIA Libraries as the information may already be available online or the publicly available information may help them in formulating more targeted FOIA requests. Requesters can also use the new search tool on FOIA.gov to aid in their search.
Most agency websites include blogs, and information about the resources and services the agency provides, and the agencies’ budgets, performance, and strategic plans.
What information should I include if I am requesting IC records about myself?
When a person submits a request for their own records, this is known as a “first-party request.” If you are requesting records about yourself, your request should include identity verification that follows the agency's procedure as stated on their website and in their regulations. Many agencies accept a signed statement, swearing under penalty of perjury, that you are the person you say you are and the records you request are about yourself. Depending on the agency, this statement may be instead of a notarized copy of government-issued identification, or it may be in addition to such documentation. Some agencies may use Verification of Identity Form, such as the Department of Justice.
If you are seeking information about yourself, you can help the agency conduct its search by including the following information in your request.
- Your full name (first, middle, and last name) as well as any prior names used;
- The specific circumstances in which you had contact(s) with the agency;
- The date(s) of such contact(s);
- The location(s) of such contact(s);
- An explanation of why you believe the agency maintains records on you;
- Proof of any “officially” acknowledged relationship or association between yourself and the agency (e.g., an official press release);
- Your unique personal identifiers (e.g., your Social Security Number, date of birth, place of birth, home address);
- A clear description of the records you seek;
- Any other information that will help the agency determine whether it has responsive records.
What should I include with my request if I am requesting IC records about another person, group, or organization?
When a person submits a request for records about another individual or group, this is known as a “third-party request.” To protect the personal privacy interests of third parties, laws such as the Privacy Act of 1974 may prohibit the federal government from disclosing a third party’s information to you. You may be able to obtain greater access to the records you seek by including the following information with your request:
- the request subject’s written consent for the agency to disclose their records to you (e.g., you could have the subject complete and sign a verification of identity form authorizing the agency to the release the records to you); or
- proof of the request subject’s death (obituary or death certificate); or
- a clear demonstration that public interest in disclosure of the records outweighs the request subject’s personal privacy interest.
Please know that these third-party protections also apply if someone requests records from the government pertaining to you.
What can I expect after I submit a FOIA request to an IC agency?
Typically, after an agency receives your FOIA request, the agency will send you a letter acknowledging its receipt of your request and tracking number for your request. If necessary, the agency may contact you to request additional information to process your request.
Most federal agencies use multi-track systems that place incoming FOIA requests into two (or more) processing tracks, sometimes called “queues,” based on their complexity. Often the two tracks are called "simple" and "complex."
When determining whether a particular request belongs in a simple or complex queue, an agency may consider factors including whether a request requires lengthy review due to the high volume and/or complexity of the records; whether the records contain classified, sensitive, or technical information that requires coordinated review by agency subject matter experts; and/or whether the request will require the agency to coordinate the review of the responsive records with a subject matter expert and/or another government agency or agencies.
Each agency has a FOIA Public Liaison (FPL) available to help requesters narrow the scope of the request in case it can be processed more quickly. After you receive the acknowledgement letter, FOIA gives you the right to request an estimated date of completion from the agency. It is important to note that this date is an estimate to give context to requesters; it is not a deadline for agency action.
What information does the Intelligence Community deny?
IC agencies withhold classified information under FOIA Exemption 1, 5 U.S.C. § 552 (b)(1), which shields national security information. Other exemptions routinely used by IC agencies include Exemption 3, 5 U.S.C. § 552 (b)(3), which shields information under non-FOIA statutes such as the National Security Act of 1947 and the Central Intelligence Act of 1949. Like all agencies across the government, IC agencies often rely on FOIA Exemptions 6 and 7(C), 5 U.S.C. §§ 552(b)(6) and (b)(7)(C), to protect personal privacy, the latter specifically in law enforcement records. Although agencies are required to explain any exemptions asserted, certain agencies offer more detailed explanations about the information they deny. Those are included below in the discussion for the relevant agency.
In response to my FOIA or MDR request, an IC agency sent me a letter stating that the agency located records which originated with another government agency and that it is referring the records to the other agency for review and a direct response? What is a “referral” and what does this letter mean?
Under FOIA, Executive Order 13526, and 32 C.F.R. § 2001.33(a), when an agency receives a request for records in its custody that contain classified and/or sensitive information that originated with another agency and/or are of interest to another agency, the agency in receipt of the FOIA request will refer the documents to the other agency for review - either as a consultation or as a direct response to the requester. In those instances in which the agency contacts another agency to determine whether to release information in full or in part and it consults with the other agency, the agency that received the FOIA request will respond to the requester. In other instances, the agency that received the FOIA request may refer documents directly to another agency for that agency’s review and release of any non-exempt information directly to the requester (direct response).
The Department of Justice guidance on Referrals, Consultations, and Coordination: Procedures for Processing Records When Another Agency or Entity Has an Interest in Them generally instructs agencies to inform requesters of the names of the agencies to which it directs referrals and/or consultations unless doing so would reveal a sensitive, FOIA-exempt fact. In those cases, the agency making the referral may not disclose the identity of the other agency to the requester and should continue to assist the requester in determining the status of the request.
Agency-Specific Information
[1] See 50 U.S.C. § 3003.
[2] See Dept. of Justice Guide to the Freedom of Information Act, Introduction at 1, citing 5 U.S.C. §§ 552(a)(3), (a)(4)(B), (b) and (c).
[3] See 5 U.S.C. § 552(a)(3)(E) (“[a]n agency, or part of an agency, that is an element of the intelligence community … shall not make any record available … to—(i) any government entity, other than a State, territory, commonwealth, or district of the United States, or any subdivision thereof; or (ii) a representative of a government entity ….”). See also The Intelligence Authorization Act of Fiscal Year 2003, Pub. L. No. 107-306, 116 Stat. 2383 (2002). In accordance with OIP DOJ guidance, if a member of the Intelligence Community receives a FOIA request that appears to have been made by or on behalf of a non-U.S. government entity, the agency may inquire into the requester’s circumstances to determine how to respond to the request. See Dept. of Justice Guide to the Freedom of Information Act page 43, citing FOIA Post 2002: FOIA Amended by Intelligence Authorization Act.
[4] https://www.cia.gov/about/
[5] https://www.cia.gov/about/
[6] https://www.cia.gov/library/readingroom/foia-helpful-hints