EPIC requests the unclassified 2022 report, including any appendices or other attachments, by independent experts that the Cybersecurity and Infrastructure Security Agency (CISA) commissioned on the threat posed by surveillance technology exploitatio

In determining whether the disclosure will contribute to the public understanding, DHS considers: (i) whether the subject concerns identifiable operations or activities of the federal government; (ii) whether disclosure of the records is meaningfully informative in order to be “likely to contribute” to an increased public understanding of those operations or activities; (iii) whether the disclosur. [...] Disclosure of this report will provide the public with a better and more comprehensive understanding of the nature of SS7 and other communications network vulnerabilities as well as how to mitigate them. [...] § 5.11(k)(2)(iii), “it shall be presumed that a representative of the news media will satisfy this consideration.”35 As mentioned above, EPIC is a “representative of the news media.”36 EPIC routinely publishes records from its FOIA requests on its website, epic.org, and EPIC’s FOIA work is frequently covered by news outlets.37 Fourth, the disclosure will significantly enhance the public’s understa. [...] The expert report from 2022 has not yet been publicly released by CISA.38 Release of this report will publicize previously inaccessible information about the cybersecurity of our communications network from the agency tasked with leading the national effort to understand and reduce risk to our cyber infrastructure.39 2. [...] Disclosure of the requested information is “not primarily in the commercial interest” of EPIC.40 DHS considers two factors to determine whether this is met: (i) whether there is “any commercial interest of the requester.