Buzzfeed Inc. v. U.S. Department of Homeland Security

• Court: District Court, District of Columbia
• Decided: August 10, 2023
• Docket: Civil Action No. 2019-3062
• Status: Published

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

BUZZFEED, INC.,

Plaintiff,

v. No. 19-cv-03062 (DLF) DEPARTMENT OF HOMELAND SECURITY et al.,

Defendants.

MEMORANDUM OPINION

In this action, Buzzfeed challenges the U.S. Customs and Border Protection’s (CBP)

withholding of documents under the Freedom of Information Act (FOIA), 5 U.S.C. § 552. Before

the Court is the defendants’ Renewed Motion for Summary Judgment, Dkt. 57, and the plaintiff’s

Cross-Motion for Summary Judgment, Dkt. 58. For the reasons that follow, the Court will grant

the defendants’ motion in part and deny it in part, and the Court will deny the plaintiff’s motion in

full.

I. BACKGROUND

On July 2, 2019, the Inspector General of the Department of Homeland Security (DHS)

issued an alert on overcrowding and prolonged detention of adults and children in the Rio Grande

Valley (RGV Alert). Defs.’ Stmt. of Material Facts ¶ 1, Dkt. 37-1; Howard Decl. ¶ 13, Dkt. 37-3.

The next day, Buzzfeed requested “any and all databases containing records on which the

calculation in” the RGV Alert “are based” including “a full and up-to-date copy of the database(s)

referenced in the above custody database.” Howard Decl. ¶¶ 5, 15. Buzzfeed’s request “also

demanded all records from 2010 through the date of the search documenting the structure and use of databases relied upon, to specifically include user manuals, schemas, layout, relationships, and

definitions of variables.” Id. ¶ 17.

Buzzfeed filed the instant case on October 14, 2019. See generally Compl., Dkt. 1. CBP

answered on December 29, 2019. See generally Answer, Dkt. 11. The agency determined that

Border Patrol was the division most likely to have responsive information, and it was likely to be

stored “within the Enforcement Integrated Database (EID).” Howard Decl. ¶¶ 19, 21. The EID is

a shared DHS database “owned and operated by U.S. Immigration and Customs Enforcement

(ICE).” Id. ¶ 21. The database “captures and maintains information related to the investigation,

arrest, booking, detention, and removal of persons encountered during immigration and criminal

law enforcement investigations and operations conducted by DHS components.” Id.

Over the following months, CBP worked with Buzzfeed to “narrow and clarify the scope

of” the request. Id. ¶ 24. In November 2020, this resulted in “a spreadsheet file for each fiscal

year from FY2010 to FY2020” with “over 4,423,000 unredacted rows of responsive data.” Id.

¶ 25. Each row contained the following data fields: Border Patrol sector, Date and Time of

Apprehension, Citizenship, Gender, Age, Demographic, Time in the U.S., Date and Time of Initial

Booking, Date and Time of Final Booking, Time in Custody. Id. ¶¶ 24–25. Buzzfeed sought

additional data for each individual that CBP withheld: facility name, alien registration number (A-

number) or “some other ‘unique identifier’ that would permit [p]laintiff to track individuals and

aggregate their records across multiple data sets,” id. ¶ 26, and “a decade’s worth of records

documenting the structure and use of EID, including manuals, schemas, layout relationships, and

definitions of variables, i.e. the keys and blueprints to the Department’s enforcement data

infrastructure,” id. ¶ 38.

2 CBP justified its withholdings under three FOIA exemptions: Exemptions 6, 7(C), and

7(E). Id. ¶¶ 27–29. Under Exemption 7(E), CBP withheld both the specific “Border Patrol station

or operational site” for each CBP encounter and documentation of the EID’s structure and use. Id.

¶¶ 30, 38. Under Exemptions 6 and 7(C), CBP withheld the A-number associated with each entry

and any other “similar unique identifier[] that would enable tracking and aggregation of data about

individuals across multiple data sets.” Id. ¶ 34.

The Court granted CBP’s Motion for Summary Judgment as to the EID’s schemas,

manuals, and relationships and denied it, without prejudice, as the other withholdings. Dkt. 50.

The Court denied Buzzfeed’s Cross-Motion for Summary Judgment with prejudice as to EID’s

schemas, manuals, and relationships and without prejudice as to the other issues. Id. After CBP

filed supplemental declarations, Dkt. 52, pursuant to the Court’s Order, Dkt. 49, the parties filed

renewed cross-motions for summary judgment, Dkts. 57, 58. The remaining issues are whether

CBP is permitted to withhold (1) A-numbers and alternative unique identifiers under Exemptions

6 and 7(C); (2) Border Patrol station locations under Exemption 7(E); and (3) variable definitions

in the EID under Exemption 7(E).

II. LEGAL STANDARDS

Rule 56 of the Federal Rules of Civil Procedure states that “[t]he court shall grant summary

judgment if the movant shows that there is no genuine dispute as to any material fact and the

movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). When a federal agency

moves for summary judgment in a FOIA case, the court views all facts and inferences in the light

most favorable to the requester, and the agency bears the burden of showing that it complied with

FOIA. Chambers v. U.S. Dep’t of Interior, 568 F.3d 998, 1003 (D.C. Cir. 2009).

3 To prevail under Rule 56, a federal agency “must prove that each document that falls within

the class requested either has been produced, is unidentifiable, or is wholly exempt from the

(FOIA’s) inspection requirements.” Perry v. Block, 684 F.2d 121, 126 (D.C. Cir. 1982) (per

curiam) (citation omitted). The agency “must show beyond material doubt . . . that it has conducted

a search reasonably calculated to uncover all relevant documents,” Weisberg v. DOJ, 705 F.2d

1344, 1351 (D.C. Cir. 1983), and must also explain why any enumerated exemptions listed in 5

U.S.C. § 552(b) apply to withheld information, see Judicial Watch, Inc. v. FDA, 449 F.3d 141, 147

(D.C. Cir. 2006).

“The peculiarities inherent in FOIA litigation, with the responding agencies often in sole

possession of requested records and with information searches conducted only by agency

personnel, have led federal courts to rely on government affidavits to determine whether the

statutory obligations of the FOIA have been met.” Perry, 684 F.2d at 126. Agency affidavits are

entitled to a presumption of good faith, see SafeCard Servs. v. SEC, 926 F.2d 1197, 1200 (D.C.

Cir. 1991), and a court may grant summary judgment based on an affidavit if it contains reasonably

specific detail and if neither contradictory record evidence nor evidence of bad faith calls it into

question, see Judicial Watch, Inc. v. U.S. Secret Serv., 726 F.3d 208, 215 (D.C. Cir. 2013). The

“vast majority of FOIA cases can be resolved on summary judgment.” Brayton v. Off. of the U.S.

Trade Representative, 641 F.3d 521, 527 (D.C. Cir. 2011).

III. ANALYSIS

A. Exemption 6 and 7(C)

CBP withheld A-numbers and any other similar unique database identifiers under

Exemptions 6 and 7(C). Howard Decl. ¶¶ 34–37. “FOIA Exemptions 6 and 7(C) seek to protect

the privacy of individuals identified in certain agency records.” ACLU v. DOJ, 655 F.3d 1, 6 (D.C.

Cir. 2011). Exemption 6 protects “personnel and medical files and similar files the disclosure of

4 which would constitute a clearly unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6),

and Exemption 7(C) protects “records or information compiled for law enforcement purposes” that

“could reasonably be expected to constitute an unwarranted invasion of personal privacy,” id.

§ 552(b)(7)(C). When an agency invokes both exemptions, courts “focus” on Exemption 7(C)

because it “establishes a lower bar for withholding material.” CREW. v. DOJ, 746 F.3d 1082,

1091 n.2 (D.C. Cir. 2014) (citation omitted).

1. A-Numbers

First, disclosing A-numbers could reasonably be expected to invade a substantial privacy

interest. In an Exemption 7(C) analysis, the first step is to identify the privacy interests implicated

by the release of records. ACLU, 655 F.3d at 6. To that end, the Court directed CBP to address

how the release of A-numbers could invade affected individuals’ privacy absent disclosure of their

names, addresses, dates of birth, or other direct identifying information. Order at 2. Among the

interests protected, Exemption 7(C) protects the privacy of individuals against the reputational

harm that may result from disclosure of law enforcement records. See CREW. v. DOJ, 658 F.

Supp. 2d 217, 239 (D.D.C. 2009) (noting that “protecting individuals against the stigma of being

mentioned in the context of a law enforcement investigation is the precise purpose of Exemption

7(C)”).

Here, CBP has established a substantial privacy interest in the release of A-numbers

because they can be used to identify an individual who is mentioned in law enforcement files. The

agency explained that DHS categorizes A-numbers as standalone Sensitive Personally Identifiable

Information (SPII), which means that an A-number can “identify an individual without any other

identifying information . . . .” Danisek Decl. ¶ 5, Dkt. 52-1. For example, an A-number can be

used to access personal and sensitive information through the Executive Office of Immigration

5 Review’s Automated Case Information System. Id. ¶ 6. In turn, this information can be used to

identify the individual in the CBP database. See id. “[I]n evaluating the privacy impact of the

release of information, the courts have taken into consideration potential derivative uses of that

information.” ACLU, 655 F.3d at 7. Thus, that “additional steps may be required to link these

numbers to an individual’s identity,” Danisek Decl. ¶ 6, does not, by itself, eliminate the relevant

privacy interest. See also Nat’l Ass’n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 878 (D.C.

Cir. 1989) (“In virtually every case in which a privacy concern is implicated, someone must take

steps after the initial disclosure in order to bring about the untoward effect.”). In sum, CBP’s

additional declaration sufficiently clarified how the release of A-numbers would invade the

individual privacy interest protected by Exemption 7(C).1

The analogy to social security numbers further highlights the privacy interest in A-

numbers. CBP cites several cases highlighting social security numbers’ protection under

Exemptions 6 and 7(C). See, e.g., Prison Legal News v. Lappin, 780 F. Supp. 2d 29, 40 (D.D.C.

2011) (“[A]n individual’s social security number has a specific relationship to that individual . . . .

[T]he Court finds that the privacy interest in one’s social security number is self-evident.”); see

also Murder Accountability Project v. DOJ, No. 19-cv-2478, 2021 WL 2682539, at *12 (D.D.C.

June 30, 2021) (noting that names, social security numbers, and alien registration numbers “are

exactly the kind of personal identifying information that may be protected from disclosure under

Exemption 6”). Like A-numbers, social security numbers are unique to an individual and

1 For the same reasons stated, harm is also foreseeable from the release of A-numbers. See 5 U.S.C. § 552(a)(8)(A); see also Ecological Rights Found. v. EPA, 541 F. Supp. 3d 34, 65 (D.D.C. 2021) (“[W]hen invoking Exemption 7(C), an agency need not establish much more than the fact of disclosure to establish foreseeable harm” because “disclosure of identifying information is a harm in and of itself.”).

6 categorized by DHS as standalone SPII.2 See Danisek Decl. ¶ 5. Thus, the Court will treat the

privacy interest in A-numbers similarly to the privacy interest in social security numbers.

Buzzfeed’s reliance on American Immigration Council v. ICE, 464 F. Supp. 3d 228

(D.D.C. 2020) is unpersuasive. See Pl.’s First Mem. at 6–7, Dkt. 39-1. There, the court held that

Exemption 7(C) did not allow ICE and CBP to withhold all information about the date of birth of

apprehended individuals. Am. Immigr. Council, 464 F. Supp. 3d at 239. The court allowed

redaction only of the specific date of birth, ordering disclosure of birth year and month, and noted

that CBP had already each individual’s age. Id. at 239, 246. Unlike A-numbers, however, month

and year of birth are neither unique nor standalone SPII. And in American Immigration Council,

because CBP had already disclosed age, minimal additional sensitive information was revealed by

disclosing the month and year of birth.

Second, the Court concludes that any public interest implicated by the disclosure does not

outweigh individuals’ privacy interest. See ACLU, 655 F.3d at 12. It is well established that “the

only public interest relevant for purposes of Exemption 7(C) is one that focuses on the citizens’

right to be informed about what their government is up to.” Sussman v. U.S. Marshals Serv., 494

F.3d 1106, 1115 (D.C. Cir. 2007) (citation omitted). This public interest includes information that

shows that the agency acted “negligently or otherwise improperly in the performance of [its]

duties.” NARA v. Favish, 541 U.S. 157, 173 (2004).

Generally, an agency can withhold information identifying private citizens mentioned in

law enforcement records. SafeCard Servs., 926 F.2d at 1206. If, however, disclosure is “necessary

2 At first, Buzzfeed seemed to acknowledge the sensitive nature of A-numbers. See Pl.’s Email at 1, Dkt. 57-3 (“In terms of data, it appears that we have not received two categories that would be extremely helpful. The facility name, and a unique identifier like an A number. I believe we discussed the possibility of providing some sort of placeholder identifier so as to avoid violating individuals[’] privacy.”).

7 in order to confirm or refute compelling evidence that the agency is engaged in illegal activity[,]”

then disclosure may be warranted. Schrecker v. DOJ, 349 F.3d 657, 661 (D.C. Cir. 2003) (quoting

Safecard Servs., 926 F.2d at 1206). A FOIA requester “must produce evidence that would warrant

a belief by a reasonable person that the alleged Government impropriety might have occurred.”

NARA, 541 U.S. at 174.

Buzzfeed argues that the RGV report would lead a reasonable person to believe that CBP

might have engaged in misconduct. Pl.’s Reply at 7, Dkt. 48-1. But even assuming that Buzzfeed

is correct, disclosure of A-numbers is not necessary to confirm or refute evidence of alleged

misconduct. A-numbers alone do not identify any wrongdoing. Instead, by linking all datapoints

pertaining to an individual alien, their function might be to allow for “track[ing] the movements

of children held in detention and help determine how long individual children were held even if

they were transferred among facilities.” Pl.’s First Mem. at 2. Alternatives to A-numbers,

functioning the same way but with far fewer privacy concerns, surely exist. For example, CBP

could generate anonymous unique individual identifiers or organize the data in a person-centric

manner. Accordingly, the Court concludes that the A-numbers themselves are exempt from

disclosure.3

3 For the first time in this round of briefing, the defendants argue that A-numbers and A-number alternatives are outside the scope of Buzzfeed’s FOIA request. See Defs.’ Mem. at 9–12; Pl.’s Mem. at 2 n.2. Because the Court concludes that the A-numbers are exempt from disclosure, it need not reach this issue as to the A-numbers. As to A-number alternatives, it appears to the Court that any such argument was likely forfeited. In any event, the arguments made in the defendants’ brief, see Defs.’ Mem. at 9–12, do not clearly apply to A-number alternatives, which would not necessarily themselves be personally identifying. If the defendants raise a scope argument in the next round of briefing, the Court will consider that argument, and its potential forfeiture, at that time.

8 2. Alternative Unique Identifiers

The Court concludes, in contrast, that the defendants have failed to provide sufficient

information to assess the privacy interest implicated by potential alternative unique identifiers.

The defendants admit that they can anonymize A-numbers but argue that exemption 7(C) applies

because a third party could reverse engineer A-numbers by decrypting the anonymous unique

identifiers. Visconti Decl. ¶ 9, Dkt. 52-2. However, merely raising the possibility of decryption,

without explaining how decryption is possible and its likelihood, is too “vague” and “speculative.”

Am. Immigr. Council, 464 F. Supp. 3d at 239. Furthermore, the defendants’ declarations do not

explain how this risk would follow from providing “auto-incremented integers or randomly

generated IDs” that are not generated using the A-numbers themselves. Flores Decl. ¶ 8, Dkt. 39-

2.

With regards to fingerprint identification numbers, the defendants’ supplemental

declarations are also deficient. The defendants acknowledged fingerprint identification numbers

as the only person-centric identifier that appears in the underlying dataset, other than A-numbers.

Id. One declaration states that “biometric identifiers” are standalone SPII. Danisek Decl. ¶ 5. But

while CBP provided an example of how the release of A-numbers could compromise an

individual’s privacy (by giving access to immigration files), it did not do so for fingerprint

identification numbers. Agency declarations must “contain reasonable specificity of detail rather

than merely conclusory statements.” Jud. Watch, 726 F.3d at 215 (citation omitted). Here, CBP

failed to adequately explain how fingerprint identification numbers could compromise an

individual’s privacy.4

4 The Court is skeptical, however, that the analysis for fingerprint identification numbers will ultimately be substantially different from that for A-numbers.

9 CBP has not sufficiently explained the privacy interest implicated by alternative unique

identifiers.5 Accordingly, the Court will order CBP to file a supplemental declaration stating the

privacy concern with generating alternative unique identifiers or using fingerprint identification

numbers.

B. Exemption 7(E)

Exemption 7(E) protects “records or information compiled for law enforcement purposes,

but only to the extent that the production of such law enforcement records or information . . . would

disclose techniques and procedures for law enforcement investigations or prosecutions . . . if such

disclosure could reasonably be expected to risk circumvention of the law.” 5 U.S.C. § 552(b)(7).

The exemption does not ordinarily protect “routine techniques and procedures already well known

to the public.” Founding Church of Scientology of Wash., D.C. v. NSA, 610 F.2d 824, 832 n.67

(D.C. Cir. 1979) (citation omitted). It does, however, protect “confidential details of . . .

program[s]” if only their “general contours [are] publicly known.” Sussman, 494 F.3d at 1112;

see also Shapiro v. DOJ, 893 F.3d 796, 801 (D.C. Cir. 2018) (permitting the government to

withhold documents that would disclose the way in which the FBI uses a particular publicly known

database). In this Circuit, Exemption 7(E) applies if the disclosure of information related to even

5 The Visconti Declaration asserts that a hacker could use unique identifiers “to quickly access identifying information about specific people and their private information in the CBP database.” Visconti Decl. ¶ 8. That assertion is insufficiently justified, and the Court is skeptical. An individual who hacks the CBP database would presumably gain access to existing unique identifiers because they appear in the underlying dataset. And it is unclear that arbitrary unique identifiers, associated with individuals solely for the purpose of redacting A-numbers in this disclosure, would facilitate such easy access. The defendants, moreover, do not assert that the disclosure of unique identifiers would make hacking the database more likely. Cf. Am. Immigr. Council, 464 F. Supp. 3d at 243 (rejecting the argument that unique identifiers are exempt under Exemption 7(E) because the agency did “not come forward with information to show that the mere possession of unique identifying information would facilitate one’s ability to hack into CBP’s system or that it would make a hacking more likely”).

10 “commonly known procedures” could “reduce or nullify their effectiveness.” Vazquez v. DOJ,

887 F. Supp. 2d 114, 116 (D.D.C. 2012) (citation omitted), aff’d, No. 13-5197, 2013 WL 6818207

(D.C. Cir. Dec. 18, 2013) (per curiam).

CBP has justified the withholding of two types of information under Exemption 7(E). First,

it withheld the specific Border Patrol station or operational site (but not the sector) where each

encounter took place. Howard Decl. ¶¶ 30–31. Second, as relevant here after the Court’s first

memorandum opinion, CBP withheld “records documenting . . . definitions of variables.” Id. ¶ 38.

The Court will address each in turn.

1. Location Information

In its earlier memorandum opinion, the Court concluded that the issue that “remain[ed]

unclear” in the Exemption 7(E) analysis as to location information was whether release of redacted

CBP locations, as compared to the apprehension location, see Am. Immigr. Council, 464 F. Supp.

3d at 244–45, would similarly “lead to circumvention of the immigration laws.” First Mem. Op.

at 10–11.6 The Court now agrees with the defendants that the locations of Border Patrol stations

could reasonably be expected to risk circumvention of the law as required by Exemption 7(E).

“Exemption 7(E)’s requirement that disclosure risk circumvention of the law sets a

relatively low bar for the agency to justify withholding.” Pub. Emps. for Env’t Resp. v. U.S.

Section, Int’l Boundary & Water Comm’n, U.S.-Mexico, 740 F.3d 195, 204–05 (D.C. Cir. 2014)

(citation omitted). Law enforcement agencies receive “a measure of deference” in their decision

to invoke Exemption 7(E). Am. Immigr. Council v. DHS, 950 F. Supp. 2d 221, 245 (D.D.C. 2013).

The agency only has the burden to “demonstrate logically how the release of the requested

6 In its briefs, the plaintiff agrees that “the Court identified the salient issues in its order and no further argument from either side is warranted.” Pl.’s Mem. at 2.

11 information might create a risk of circumvention of the law.” Mayer Brown LLP v. IRS, 562 F.3d

1190, 1194 (D.C. Cir. 2009) (cleaned up).

Here, the disclosure of the Border Patrol stations associated with apprehensions could

reasonably be expected to risk circumvention of the immigration laws. CBP has already provided

sector-level location information. Howard Decl. ¶ 31. CBP has sufficiently explained that

attaching the specific Border Patrol station to each row of data would “risk[] revealing if and when

coverage areas between Border Patrol stations overlap or have gaps” and “which Station’s Agents

may face the heaviest workload at any given time.” Visconti Decl. ¶ 10. CBP’s supplemental

declarations demonstrate logically how the release of the location of Border Patrol stations, and

thus knowledge of which Border Patrol stations are relatively overwhelmed, might create a risk of

circumvention of the law. Accordingly, the Court will grant summary judgement in favor of the

defendants on whether the specific Border Patrol station locations were properly withheld under

Exemption 7(E).7

2. EID Variable Definitions

The Court previously held that CBP properly withheld schemas, manuals, and relationships

under Exemption 7(E) and granted the defendants’ motion for summary judgment on that issue.

However, the Court questioned whether CBP properly withheld “[g]lossaries and data dictionaries

(i.e., records defining the meaning of tables, columns, variables, and other aspects of the

database).” Compl. Ex. A at 2, Dkt. 1-1; see First Mem. Op.

In Long v. ICE, 464 F. Supp. 3d 409 (D.D.C. 2020), another court in this District ordered

ICE to conduct a segregability analysis as to “field and table names, codes, code translations, and

7 As previously explained, no further foreseeable harm analysis is needed under Exemption 7(E). See First Mem. Op. at 10 n.1.

12 code lookup tables.” Id. at 426–27. In light of Long, this Court directed CBP to address in

supplemental declarations the distinctions, if any, between information requested by Buzzfeed and

that disclosed in Long. Order at 2. The agency was also directed to address whether the testimony

and record in that 2020 case remain applicable and accurate. Id. After the Court’s Order, CBP

released “73 pages of abbreviations, glossary of terms, processing disposition codes, charging and

entry status codes.” Defs.’ Mem. at 20. Buzzfeed confirms that CBP has “made a supplemental

production in response to the Court’s order.” Pl.’s Mem. at 6. But it contends that “[CBP] ha[s]

not provided a declaration supporting the claims made in [its] brief . . . and the Court should

expressly order [CBP] to produce to [Buzzfeed] the information produced in Long to the extent it

was not already produced.” Id.

The parties’ briefing does not make sufficiently clear the scope of the remaining dispute.

Thus, the Court will order a joint status report directing the parties to confer and state their

positions on what additional records, if any, are sought in the search and are disputed.

CONCLUSION

For the foregoing reasons:

1) The defendants’ Motion for Summary Judgment is granted, and the plaintiff’s Cross- Motion for Summary Judgment is denied with prejudice, with respect to the withholding of A-numbers. The defendants’ motion and the plaintiff’s cross-motion are both denied without prejudice with respect to alternative unique identifiers.

2) The defendants’ Motion for Summary Judgment is granted, and the plaintiff’s Cross- Motion for Summary Judgment is denied with prejudice, with respect to the withholding of Border Patrol station locations.

3) The defendants’ Motion for Summary Judgment and the plaintiff’s Cross-Motion for Summary Judgment are both denied without prejudice with respect to the information on variable definitions.

13 A separate order consistent with this decision accompanies this memorandum opinion.

________________________ DABNEY L. FRIEDRICH United States District Judge August 10, 2023