Every white box on a FOIA release carries a code, and the codes are arguments, not facts. Here is the working translation — what each exemption lawfully covers, and the over-reach patterns appeals feast on.
| Code | Protects | Classic over-reach |
|---|---|---|
| (b)(5) | Deliberative process, attorney work product | Facts dressed as deliberation; final decisions treated as drafts — and the foreseeable-harm test now required, rarely shown |
| (b)(6) | Personal privacy in personnel-type files | Redacting the requester's own information back at them; officials' names doing official acts |
| (b)(7) | Law-enforcement records, subdivided (A) through (F) | 'Techniques' claims over routine, publicly known procedures; (7)(A) invoked for investigations long closed |
| (b)(3) | Material other statutes wall off — visa records under INA 222(f) prominently | Sweeping adjacent records behind the named statute's actual scope |
| (b)(1) | Properly classified national-security material | Rarer in benefits files than the redactions imply |
Segregability — exempt passages do not exempt pages; releasable portions must be carved out and produced. Foreseeable harm — since 2016, lawful-to-withhold is not enough; the agency must show release would actually harm the protected interest. Most boilerplate fails one or both, which is what the appeal is for.
Your own information generally can't hide behind privacy exemptions from you — a correct appeal ground and a common win.
A refusal to confirm records exist at all — reserved for cases where the fact of existence is itself protected, and over-used. It's challengeable like any withholding.
Post-2016, yes more than ever: deliberative claims without a foreseeable-harm showing are the softest target on the modern exemption board.