UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
BUZZFEED, INC., Plaintiff,
v.
No. 19-cv-03062 (DLF)
U.S. DEPARTMENT OF HOMELAND SECURITY et al.,
Defendants.
MEMORANDUM OPINION
In this action, Buzzfeed challenges the U.S. Customs and Border Protection’s (CBP)
withholding of documents under the Freedom of Information Act (FOIA), 5 U.S.C. § 552. Before the Court is the Department’s Motion for Summary Judgment, Dkt. 37, and the plaintiff’s Cross-Motion for Summary Judgment, Dkt. 39. For the reasons that follow, the Court will grant the Department’s motion in part and deny it in part, deny the plaintiff’s motion, and direct the Department to file a supplemental declaration addressing the issues highlighted in this opinion. I. BACKGROUND On July 2, 2019, the Inspector General of the Department of Homeland Security (DHS)
issued an alert on overcrowding and prolonged detention of adults and children in the Rio Grande Valley (RGV Alert). Def.’s Stmt. of Material Facts ¶ 1, Dkt. 37-1; Howard Decl. ¶ 13, Dkt. 37-3. The next day, Buzzfeed requested “any and all databases containing records on which the calculation in” the RGV Alert “are based” including “a full and up-to-date copy of the database(s) referenced in the above custody database.” Howard Decl. ¶¶ 5, 15. Buzzfeed’s request “also demanded all records from 2010 through the date of the search documenting the
2
structure and use of databases relied upon, to specifically include user manuals, schemas, layout, relationships, and definitions of variables.” Id. ¶ 17.
Buzzfeed filed the instant case on October 14, 2019. See generally Compl., Dkt. 1. CBP answered on December 29, 2019. See generally Answer, Dkt. 11. The agency determined that Border Patrol was the division most likely to have responsive information, and it was likely to be stored “within the Enforcement Integrated Database (EID).” Howard Decl. ¶¶ 19, 21. The EID is a shared DHS database “owned and operated by U.S. Immigration and Customs Enforcement (ICE).” Id. ¶ 21. The database “captures and maintains information related to the investigation, arrest, booking, detention, and removal of persons encountered during immigration and criminal law enforcement investigations and operations conducted by DHS components.” Id.
Over the following months, CBP worked with Buzzfeed to “narrow and clarify the scope of” the request. Id. ¶ 24. In November 2020, this resulted in “a spreadsheet file for each fiscal year from FY2010 to FY2020” with “over 4,423,000 unredacted rows of responsive data.” Id. ¶ 25. Each row contained the following data fields: Border Patrol sector, Date and Time of Apprehension, Citizenship, Gender, Age, Demographic, Time in the U.S., Data and Time of Initial Booking, Date and Time of Final Booking, Time in Custody. Id. ¶¶ 24–25. Buzzfeed sought additional data for each individual that CBP withheld: facility name, alien registration number (A-number) or “some other ‘unique identifier’ that would permit [p]laintiff to track individuals and aggregate their records across multiple data sets,” justification for missing data, and “technical documentation revealing the underlying structure, code, and maintenance of the Department of Homeland Security’s Enforcement Integrated Database.” Id. ¶ 26.
CBP justified its withholdings under three FOIA exemptions: Exemptions 6, 7(C), and 7(E). Id. ¶¶ 27–29. Exemption 7(E) allows the withholding of law enforcement records or
3
information that would disclose techniques or procedures of investigations or prosecutions. Id. ¶ 29. Under this exemption, CBP withheld both the specific “Border Patrol station or operational site” for each CBP encounter and documentation of the EID’s structure and use. Id. ¶¶ 30, 38. Exemption 6 allows the withholding of personnel, medical, and similar personally identifying private information. Id. ¶ 27. Exemption 7(C) allows the same as to “law enforcement records or information that could reasonably be expected to constitute an unwarranted invasion of personal privacy.” Id. ¶ 28. Under these exemptions, CBP withheld the A-number associated with each entry and any other “similar unique identifier[] that would enable tracking and aggregation of data about individuals across multiple data sets.” Id. ¶ 34.
The parties have filed cross-motions for summary judgment. See generally Defs.’ Mot.
for Summ. J., Dkt. 37; Pl.’s Cross-Mot. for Summ. J., Dkt. 39. Buzzfeed does not challenge the adequacy of the government’s searches for responsive records, see Pl.’s Mem. in Supp. of Cross- Mot. for Summ. J. at 4 n.1, Dkt. 39-1, nor does it object to all of CBP’s withholdings, just those that reveal (1) unique identifying information about individuals, (2) detention locations, and (3) technical documentation about the EID, see id. at 1–2. II. LEGAL STANDARDS Rule 56 of the Federal Rules of Civil Procedure states that “[t]he court shall grant summary judgment if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). When a federal agency moves for summary judgment in a FOIA case, the court views all facts and inferences in the light most favorable to the requester, and the agency bears the burden of showing that it complied with FOIA. Chambers v. U.S. Dep’t of Interior, 568 F.3d 998, 1003 (D.C. Cir. 2009).
4
To prevail under Rule 56, a federal agency “must prove that each document that falls within the class requested either has been produced, is unidentifiable, or is wholly exempt from the (FOIA) inspection requirements.” Perry v. Block, 684 F.2d 121, 126 (D.C. Cir. 1982) (per curiam) (citation omitted). The agency “must show beyond material doubt . . . that it has conducted a search reasonably calculated to uncover all relevant documents,” Weisberg v. U.S. Dep’t of Justice, 705 F.2d 1344, 1351 (D.C. Cir. 1983), and must also explain why any of the nine enumerated exemptions listed in 5 U.S.C. § 552(b) apply to withheld information, see Judicial Watch, Inc. v. FDA, 449 F.3d 141, 147 (D.C. Cir. 2006); see also Mobley v. CIA, 806 F.3d 568, 580 (D.C. Cir. 2015) (agency bears burden of justifying application of exemptions, “which are exclusive and must be narrowly construed”).
“The peculiarities inherent in FOIA litigation, with the responding agencies often in sole possession of requested records and with information searches conducted only by agency personnel, have led federal courts to rely on government affidavits to determine whether the statutory obligations of the FOIA have been met.” Perry, 684 F.2d at 126. Agency affidavits are entitled to a presumption of good faith, see SafeCard Servs. v. SEC, 926 F.2d 1197, 1200 (D.C. Cir. 1991), and a court may grant summary judgment based on an affidavit if it contains reasonably specific detail and if neither contradictory record evidence nor evidence of bad faith calls it into question, see Judicial Watch, Inc. v. U.S. Secret Serv., 726 F.3d 208, 215 (D.C. Cir. 2013). The “vast majority of FOIA cases can be resolved on summary judgment.” Brayton v. Off. of the U.S. Trade Representative, 641 F.3d 521, 527 (D.C. Cir. 2011).
5
III. ANALYSIS A. Exemption 6 and 7(C)
“FOIA Exemptions 6 and 7(C) seek to protect the privacy of individuals identified in certain agency records.” ACLU v. DOJ, 655 F.3d 1, 6 (D.C. Cir. 2011). Exemption 6 protects “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6), and Exemption 7(C) protects “records or information compiled for law enforcement purposes” that “could reasonably be expected to constitute an unwarranted invasion of personal privacy,” id. § 552(b)(7)(C). When an agency invokes both exemptions, courts “focus” on Exemption 7(C) because it “establishes a lower bar for withholding material.” Citizens for Responsibility & Ethics in Wash. v. DOJ (CREW I), 746 F.3d 1082, 1091 n.2 (D.C. Cir. 2014) (internal quotation marks omitted). CBP withheld A-numbers and any other similar unique database identifiers under both exemptions. Howard Decl. ¶¶ 34–37.
Under Exemption 7(C), courts balance the privacy interests implicated by the records being sought against the public’s interest in their disclosure. Citizens for Responsibility & Ethics in Wash. v. DOJ (CREW II), 854 F.3d 675, 681 (D.C. Cir. 2017). The government “must account for the privacy interests at stake, recognizing that previous disclosures or admissions may have diminished those interests.” Id. at 683. But if the withheld information implicates a substantial privacy interest, the FOIA requester “bears the burden of showing (1) that ‘the public interest sought to be advanced is a significant one, an interest more specific than having the information for its own sake,’ and (2) that the information [it] seeks ‘is likely to advance that interest.’” Roth v. DOJ, 642 F.3d 1161, 1175 (D.C. Cir. 2011) (quoting Nat’l Archives & Records Admin. v. Favish, 541 U.S. 157, 172 (2004)). It is well established that “the only public
6
interest relevant for purposes of Exemption 7(C) is one that focuses on the citizens’ right to be informed about what their government is up to.” Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1115 (D.C. Cir. 2007) (internal quotation marks omitted).
CBP’s declaration discusses privacy concerns related to the release of A-numbers, but not to any other unique database identifiers. See Howard Decl. ¶¶ 34–37. The agency explains that A-numbers, unlike unique database identifiers, are used in contexts other than the EID, and so their release could reveal immigrants’ identities in a way that a database identifier would not. See Howard Decl. ¶¶ 34–37; Rojas-Vega v. U.S. Citizenship & Immig. Serv., No. 13-1540, 2014 WL 12614416, at *5 (D.D.C. Sep. 30, 2014) (explaining that all of an immigrant’s USCIS transactions are tracked by A-number). But because Buzzfeed is willing to accept unique database identifiers that would enable it to track individuals across multiple datasets and be less personally identifying than A-numbers, see Pl.’s Opp’n at 4, the Court declines at this time to decide whether CBP can withhold A-numbers under Exemption 7(C).
Instead, the Court will direct CBP to supplement its declaration to address whether there are any alternate unique database identifiers, and if there are, to identify the privacy interests associated with each. The Department’s briefing states that the existence of any unique database identifiers is “pure speculation,” Def.’s Reply at 5, but the Howard Declaration does not deny their existence, see Howard Decl. ¶¶ 34–37. Nor does it provide a Glomar response that neither confirmed nor denied the existence of any unique database identifiers. See People for the Ethical Treatment of Animals v. Nat’l Insts. of Health, Dep’t of Health & Human Servs., 745 F.3d 535, 540 (D.C. Cir. 2014) (explaining that an agency can refuse to acknowledge the existence of records in certain circumstances and providing the background of the Hughes Glomar Explorer). And there is reason to suspect that such identifiers exist. Indeed, in a separate case, another
7
agency acknowledged their existence. See Am. Immig. Council v. U.S. Immig. & Customs Enf’t, 464 F. Supp. 3d 228, 242 (D.D.C. 2020) (“ICE has produced data from EID in recent cases and its own declarant acknowledges that person-centric unique identifiers are reasonably likely to be found in EID[.]”). Because the current record does not contain sufficient detail about the privacy concerns associated with the release of alternate unique database identifiers (other than the A- number), the Court cannot weigh the privacy versus the public interests, as required under Exemption 7(C). See CEI Wash. Bureau, Inc. v. DOJ, 469 F.3d 126, 128–29 (D.C. Cir. 2006) (holding that summary judgment was inappropriate because of factual disputes relevant to the court’s balancing of individual privacy and public scrutiny under Exemption 7(C)).
Accordingly, the Court will not rule on Buzzfeed’s request for individual identifying information now but will instead deny CBP’s motion without prejudice and order it to file a supplemental declaration. This declaration shall state whether any unique identifiers (other than the A-number) exist in the EID and address the privacy interests with respect to any such identifiers. This new declaration shall also address how the release of A-numbers would invade the individuals’ privacy without knowledge of their names, addresses, dates of birth, or other identifying information. See, e.g., Heartland All. for Human Needs & Human Rights v. U.S. Immig. & Customs Enf’t, 406 F. Supp. 3d 90, 124 (D.D.C. 2019) (“order[ing] ICE to provide a supplemental declaration addressing the deficiencies identified” by the Court); see also Campbell v. U.S. Dep’t of Justice, 164 F.3d 20, 31 (D.C. Cir. 1998) (explaining that a new declaration “is favored where agency affidavits are facially inadequate” because “otherwise the district court is effectively left to speculate about” whether a document qualifies for withholding).
8
B. Exemption 7(E)
Exemption 7(E) protects “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information . . . would disclose techniques and procedures for law enforcement investigations or prosecutions . . . if such disclosure could reasonably be expected to risk circumvention of the law.” 5 U.S.C. § 552(b)(7). The exemption does not ordinarily protect “routine techniques and procedures already well known to the public.” Founding Church of Scientology of Wash., D.C. v. NSA, 610 F.2d 824, 832 n.67 (D.C. Cir. 1979) (internal quotation marks omitted); see also Judicial Watch v. U.S. Dep’t of Commerce, 337 F. Supp. 2d 146, 181 (D.D.C. 2004) (citation omitted). It does, however, protect “confidential details of . . . program[s]” if only their “general contours [are] publicly known.” Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1112 (D.C. Cir. 2007) (citing Blanton v. DOJ, 64 Fed. App’x 787, 788–89 (D.C. Cir. 2003) (per curiam)); see also Shapiro v. DOJ, 893 F.3d 796, 801 (D.C. Cir. 2018) (permitting the government to withhold documents that would disclose the way in which the FBI uses a particular publicly known database). In this Circuit, Exemption 7(E) applies if the disclosure of information related to even “commonly known procedures” could “reduce or nullify their effectiveness.” Vazquez v. DOJ, 887 F. Supp. 2d 114, 116 (D.D.C. 2012) (internal quotation marks omitted), aff'd, No. 13-5197, 2013 WL 6818207 (D.C. Cir. Dec. 18, 2013) (per curiam).
CBP has justified the withholding of two types of information under Exemption 7(E).
First, CBP withheld the specific Border Patrol station or operational site (but not the sector) where each encounter took place. Howard Decl. ¶¶ 30–31. Second, CBP withheld “records documenting the structure and use of EID, including manuals, schemas, layout relationships, and definitions of variables.” Id. ¶ 38. The Court will address each in turn.
9
1. Specific location information CBP withheld under Exemption 7(E) information about specific “Border Patrol station[s]
or operational site[s]” because “[f]urther parsing of the location data, in a data production of this size, would disclose law enforcement sensitive techniques and procedures, and enable circumvention of law enforcement by yielding patterns and inferences about operational capacity, staffing, resource allocation, and transfer routes.” Id. ¶¶ 30–31. In particular, CBP predicts that “[d]isclosure of the requested information would inform would-be violators which sites are most vulnerable, and the circumstances under which Border Patrol is prompted to redistribute entrants or personnel between stations.” Id. ¶ 33. This would allow “third parties to circumvent the law by altering smuggling routes and patterns of conduct, adopting new methods of criminal operation, and effectuating other countermeasures to law enforcement operations, or planning disruptions of law enforcement operations in violation of criminal and immigration laws.” Id.
Another court in this district previously analyzed Border Patrol apprehension location data and found the withholding justified under Exemption 7(E). Am. Immig. Council, 464 F. Supp. 3d at 244–45. That court explained that the “over 1 million points of location data” would provide would-be criminals information that would allow them “to evade arrest or apprehension.” Id. at 245. This cleared Exemption 7(E)’s “relatively low bar . . . that release of documents might increase the risk that a law will be violated.” Id. at 244 (quoting Pub. Emps. for Env’t Responsibility v. U.S. Section, Int’l Boundary & Water Comm’n, 740 F.3d 195, 205 (D.C. Cir. 2014) (emphasis added)).
CBP insists that the same logic applies here. In particular, CBP contends that the release of detention center information would provide over 4 million points of location data that would
10
enable human traffickers and smugglers to evade the law. See Howard Decl. ¶ 25; Ctr. for Nat’l Sec. Studies v. DOJ, 331 F.3d 918, 928–29 (D.C. Cir. 2003) (recognizing in the national security context that, even when a single data point is innocuous, the government can justify withholding on the basis that disclosure of a vast array of innocuous points can jeopardize investigations); see also Reporters Comm. for Freedom of the Press v. FBI, 548 F. Supp. 3d 185, 203 (D.D.C. 2021) (concluding that revealing FBI unit location data “could reveal what kinds of crimes and geographic areas the agency prioritizes” and this information about resource allocation could “create a risk that wrongdoers will exploit the information to violate the law or escape the consequences of doing so”).1 The Court agrees that “[E]xemption [7(E)] is written in broad and general terms,” Mayer Brown LLP v. IRS, 562 F.3d 1190, 1193 (D.C. Cir. 2009), and covers “internal agency materials relating to guidelines, techniques, sources, and procedures for law enforcement investigations and prosecutions, even when the materials have not been compiled in the course of a specific investigation,” Tax Analysts v. IRS, 294 F.3d 71, 79 (D.C. Cir. 2002). Cf. Gilman v. DHS, 32 F. Supp. 3d 1, 19 (D.D.C. 2014) (recognizing that “assessment of border vulnerabilities is directly related to the potential violation of federal immigration laws and the CBP’s duty to deter illegal immigration and to apprehend illegal immigrants”). But what remains unclear is how the release of detention center information, as opposed to the apprehension location information, would enable traffickers and others to evade law enforcement. The Howard Declaration does not provide sufficient information for the Court to draw this conclusion. Thus,
1 Unlike in Exemption 5 cases, see, e.g., Reps. Comm. for Freedom of the Press v. FBI, 3 F.4th 350, 370 (D.C. Cir. 2021), no further foreseeable harm analysis is needed because “Exemption 7(E) by its own terms already requires that an agency show a risk of foreseeable harm,” Reps. Comm. of Freedom of the Press v. U.S. CBP, 567 F. Supp. 3d 97 (D.D.C. 2021) (citations omitted).
11
the Court will direct CBP to explain in its supplemental declaration how disclosure of this information would reveal apprehension location, as well as staffing, resource allocation, and transfer route information, see Howard Decl. ¶¶ 31–33, and thereby lead to the circumvention of the immigration laws. See, e.g., Heartland All., 406 F. Supp. 3d at 124; see also Campbell, 164 F.3d at 31.
2. EID documentation CBP also withheld “a decade’s worth of records documenting the structure and use of EID, including manuals, schemas, layout relationships, and definitions of variables, i.e. the keys and blueprints to the Department’s enforcement data infrastructure.” Howard Decl. ¶ 38. It justified its withholding under Exemption 7(E) on the grounds that the release of “[s]uch technical, law enforcement sensitive material . . . would facilitate breach, sabotage, alteration, or manipulation of the Department’s law enforcement database.” Id. “Courts have repeatedly recognized the risk of a cyber-attack as valid grounds for withholding under Exemption 7(E)” and accordingly “have affirmed the withholding of information related to databases—metadata, codes, and structures—under Exemption 7(E) for risk of cyber-attack or data breach.” Shapiro v. DOJ, 393 F. Supp. 3d 111, 122 (D.D.C. 2019) (cleaned up).
Another court in this district has analyzed schema information relating to the EID. See Long v. ICE, 464 F. Supp. 3d 409 (D.D.C. 2020). The Long Court concluded that disclosure of EID schema would allow hackers to access the database more easily and more effectively, cause more damage to the database, and escape detection more easily. See id. at 419–23. Hackers would be able to do this, according to ICE’s witness, by setting up their own database to practice attacks and perfect their methodology. See id. at 419. Manuals and layout relationships would provide similarly useful material and “could reasonably be expected to risk circumvention of the
12
law.” 5 U.S.C. § 552(b)(7)(E). Although it is true, as the plaintiffs note, that the government has not provided a “case-specific” explanation for the risk, Pl.’s Opp’n at 13, the risk does not differ from that in Long because that case involved the same database at issue here. Therefore, the Court concludes that CBP properly withheld schemas, manuals, and relationships under Exemption 7(E).
It is less clear, however, whether CBP properly withheld other records under Exemption 7(E). In fact, the Long Court concluded that certain information that appears to have included variable definitions from the EID “could be released without creating an unacceptable threat to the security of the EID.” 464 F. Supp. 3d at 424; see id. at 423–25. ICE’s expert testified in Long that the disclosure of certain codes, code translations, and field names would not create a security risk to the EID or other databases. See id. at 424. The court then ordered ICE to release some information from the EID after it conducted a segregability analysis. Id. at 425. Because this Court cannot determine from the Howard Declaration and the parties’ briefing whether the information that the CBP withheld here is different than the information that ICE produced in Long, the Court will also direct the agency to address in its supplemental declaration the distinctions, if any, between information requested here and that disclosed in Long. The agency shall also address whether the testimony and record in that 2020 case remains applicable and accurate. See, e.g., Heartland All., 406 F. Supp. 3d at 124; see also Campbell, 164 F.3d at 31.
13
CONCLUSION
For the foregoing reasons, the defendant’s Motion for Summary Judgment is granted in part and denied without prejudice in part and the plaintiff’s Cross-Motion for Summary Judgment is denied with prejudice in part and denied without prejudice in part. A separate order consistent with this decision accompanies this memorandum opinion.
________________________
DABNEY L. FRIEDRICH
United States District Judge June 27, 2022