If you have a restricted timeframe & the information that the US government would be interested in knowing details about an event that happened in that timeframe, then that might well be enough information to identify the company involved, or at least reduce the list of candidates to a very short one indeed.

The OP probably has a contractual duty to protect their client's identity & therefore can't take the risk that revealing more details would result in their client being identified.