I'm sure this works for other institutions also, not just MIT. Maybe the evidence they have for the request requires disclosing data that violates FERPA, which they obviously aren't allowed to do.