Lamb v. Millennium Challenge Corp.

RANDOLPH D. MOSS, United States District Judge Jerry Goralski Lamb, proceeding pro se , brings this action under the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552, *209and the Privacy Act, 5 U.S.C. § 552a, seeking records relating to his background investigation and suitability determination to work as a contractor for the Millennium Challenge Corporation ("MCC"), a foreign assistance corporation established in the executive branch of the federal government. In a prior opinion, the Court dismissed a number of Lamb's claims and granted summary judgment, in part, in favor of the MCC. See Lamb v. Millennium Challenge Corp. , 228 F.Supp.3d 28, 36-38 (D.D.C. 2017) (" Lamb I "). In one respect, however, the Court concluded that the MCC had failed to carry its burden; although the MCC indicated that its search located five responsive records, including "the Report of Investigation," when it responded to Lamb's FOIA/Privacy Act request, the agency failed to make any mention of the Report of Investigation. Id. at 36. The Court also addressed Lamb's motion for leave to file a second amended complaint and granted that motion in part and denied it in part. Id. at 39-47. As to several proposed claims, the Court held that the amendment would be futile, but-among other claims-the Court permitted Lamb to add FOIA and Privacy Act claims against the Department of State, which assisted the MCC in conducting Lamb's background investigation. Id. at 42. The MCC and the State Department released additional records to Lamb, and both agencies now move for summary judgment. Dkt. 63. Lamb opposes that motion and cross-moves for summary judgment in his favor. Dkt. 65. For the reasons explained below, the Court will GRANT in part and DENY in part Defendants' motion for summary judgment and will DENY Lamb's cross-motion. I. BACKGROUND Because the relevant facts are set forth in detail in the Court's prior opinion, Lamb I , 228 F.Supp.3d at 33-35, the Court will only briefly summarize them here. On February 22, 2016, Lamb began work as a contractor for the MCC in a position that required a "favorable background check." Id. at 34. Although Lamb believed that he had been cleared for the job, about two weeks after starting work he was contacted by MCC "security" and was told that a State Department contractor needed to interview him as part of his background investigation. Id. Lamb's background investigation was then conducted in part by the MCC and in part by the State Department, which, at times, assists the MCC in completing background investigations. Id. On April 18, 2016, MCC officials confiscated Lamb's government identification, removed him from the premises, and terminated his employment. Id. Later, Lamb learned from his employer, which held the contract with the MCC, that he was terminated because his "security check came back unfavorable." Id. (citation omitted). Seeking to get to the bottom of the matter, Lamb submitted a FOIA/Privacy Act request for "copies of all information maintained about himself" to the MCC, and, when it failed timely to respond, he brought this suit. Id. Lamb amended his complaint as of right a month later, adding additional claims against the MCC as well as claims against the State Department contract-employee who had handled his background check. Id. The MCC subsequently released a number of records in response to Lamb's request, id. at 36, and moved for summary judgment, id. at 33. Lamb, in turn, cross-moved for summary judgment and moved for leave to file a second amended complaint. Id. And, finally, the State Department contract-employee moved to dismiss. Id. After considering the various motions, the Court issued an opinion dismissing the *210State Department contract-employee; granting the MCC's motion for summary judgment in part and denying it in part; and granting Lamb's motion for leave to amend in part and denying it in part. Id. at 47. As relevant to the pending motions, the Court denied the MCC's motion for summary judgment in part because the declaration submitted in support of the motion referred to a "Report of Investigation" ("ROI"), but its letter accompanying the release of records to Lamb made no mention of the ROI. Id. at 36-37. The Court also declined to grant Lamb leave to add a number of claims to his complaint on grounds of futility but did allow him to add a FOIA and Privacy Act claim against the State Department and to add a due process claim against the MCC. Id. at 39-47. Lamb promptly filed a second amended complaint, which, among other things, added FOIA/Privacy Act claims against the State Department and added three claims against James R. Blades, an MCC official. Dkt. 50. But, a month later, Lamb voluntarily dismissed his due process claims against Blades. Dkt. 53. Moreover, although Lamb did not dismiss his Privacy Act claim against Blades, the Court previously held that Blades is not subject to suit under the Privacy Act. Lamb I , 228 F.Supp.3d at 40. Accordingly, the only claims that remain are Lamb's FOIA and Privacy Act claims against the MCC and the State Department challenging the adequacy of the searches they conducted and their failure to release all responsive records.1 The MCC and State Department, having released additional records, now move for summary judgment, Dkt. 63, and Lamb cross-moves for summary judgment, Dkt. 65. II. ANALYSIS Unlike many FOIA/Privacy Act cases, the scope of Lamb's request is narrow-he seeks only the records "relied upon in" his background investigation, Dkt. 63 at 5 (Def.'s SUMF ¶ 9)-and the agencies have withheld very little. The MCC says that it has released in full all of the records that it has located, and the State Department released thirteen documents in full, released one with only one redaction (a third party's social security number), and referred one document to the Department of Defense. The Department of Defense, in turn, released that document, which is 121-pages long, with redactions (names, signatures, phone numbers and personally identifiable information of third parties and Department of Defense employees) on only two pages. But, notwithstanding the minimal nature of the withholdings, the Court concludes that it needs some additional information before it can reach a final decision in this case. A. Adequacy of Searches The adequacy of an agency's search for records "is analyzed under the same standard" for purposes of both FOIA and the Privacy Act. Thompson v. U.S. Dep't of Justice , 146 F.Supp.3d 72, 82 (D.D.C. 2015). To prevail on summary judgment, the agency must submit declarations that " 'denote which files were searched,' [and] by whom those files were searched, and [that] reflect a 'systematic approach to document location.' " Liberation Newspaper v. U.S. Dep't of State , 80 F.Supp.3d 137, 144 (D.D.C. 2015) (quoting Weisberg v. U.S. Dep't of Justice , 627 F.2d 365, 371 (D.C. Cir. 1980) ); see also Baker & Hostetler LLP v. U.S. Dep't of Commerce , 473 F.3d 312, 318 (D.C. Cir. 2006) ; *211Oglesby v. U.S. Dep't of the Army , 920 F.2d 57, 68 (D.C. Cir. 1990). Declarations "that include search methods, locations of specific files searched, descriptions of searches of all files likely to contain responsive documents, and names of agency personnel conducting the search are considered sufficient." Ferranti v. Bur. of Alcohol, Tobacco & Firearms , 177 F.Supp.2d 41, 47 (D.D.C. 2001) (citing Weisberg v. United States Dep't of Justice , 705 F.2d 1344, 1348 (D.C.Cir.1983) ). Those declarations, moreover, "are accorded a presumption of good faith, which cannot be rebutted by 'purely speculative claims about the existence and discoverability of other documents.' " SafeCard Servs., Inc. v. SEC , 926 F.2d 1197, 1200 (D.C. Cir. 1991) (quoting Ground Saucer Watch, Inc. v. CIA , 692 F.2d 770, 771 (D.C. Cir. 1981) ). But where "a review of the record raises substantial doubt, particularly in view of 'well defined requests and positive indications of overlooked materials,' summary judgment is inappropriate." Valencia-Lucena v. U.S. Coast Guard , 180 F.3d 321, 326 (D.C. Cir. 1999) (citation omitted). As explained below, there is ample evidence that the State Department and the MCC conducted adequate searches. 1. State Department The State Department's search for responsive records proceeded in several steps. First, the Information Programs and Services ("IPS") office-the State Department office charged with responding to FOIA and Privacy Act requests-screened Lamb's submission. Dkt. 63-3 at 2 (Stein Decl. ¶ 2). Based on that review, it "determined that the only [d]epartment component reasonably likely to contain responsive records was the Bureau of Diplomatic Security" ("DS"), id. at 4 (Stein Decl. ¶ 10), which, among other things, "conducts personnel security investigations," id. (Stein Decl. ¶ 11). The DS records system is "decentralized," and there is "no single database, application, or file structure that can be searched that would cover all records." Id. (Stein Decl. ¶ 12). Accordingly, the DS FOIA office screens incoming requests and "determines which DS components are reasonably likely to have responsive records." Id. at 5 (Stein Decl. ¶ 13). Here, after reviewing Lamb's request, a "Senior Reviewer" determined that the only component likely to have responsive records was the "Office of Personnel Security and Suitability" ("PSS")-the arm of DS that oversees the "personnel security program, including background investigations of applicants who have applied for security clearances or positions of public trust" and, crucially, "conducts background investigations on behalf of ... the Millennium Challenge Corporation." Id. (Stein Decl. ¶ 13). PSS then conducted a search of its case management system using the names "Lamb" and "Jerry G. Lamb," verified any results using Lamb's birthdate, and, using the results, identified and retrieved Lamb's paper Security Background File. Id. at 5-6 (Stein Decl. ¶ 14). The file contained fifteen responsive records, thirteen of which the State Department released in full, one of which it released with a small redaction, and one of which it forwarded to the Department of Defense for processing. Id. at 3 (Stein Decl. ¶ 7). Given the nature of the records at issue, which one would not expect to find scattered throughout the Department, this search was adequate. An "agency fulfills its obligations under FOIA" and the Privacy Act "if it can demonstrate beyond material doubt" that its search was sufficient. Valencia-Lucena , 180 F.3d at 325. When narrowing a search to particular components or files, "an agency must not only 'explain in its [declaration] that no *212other record system was likely to produce responsive documents'; it must also 'show, with reasonable detail,' that the agency's approach 'was reasonably calculated to uncover all relevant documents.' " Aguiar v. Drug Enf't Admin. , 865 F.3d 730, 739 (D.C. Cir. 2017) (quoting Oglesby , 920 F.2d at 68 ). The Department did so here. As explained in the Stein declaration, the Department evaluated Lamb's request based on "the description of the records requested," IPS's "familiarity with the holdings of the Department's records systems," and the "substantive and functional mandates of numerous Department offices and Foreign Service posts and missions." Id. at 3 (Stein Decl. ¶ 8). Given Lamb's own characterization of the Department's connection to his records-that is, it assisted in conducting a background check on behalf of another agency, Dkt. 50 at 3 (Am. Compl. ¶ 10)- the Department has provided the type of "necessary details ... about the scope or methods of the searches conducted," Defs. of Wildlife v. U.S. Border Patrol , 623 F.Supp.2d 83, 91-92 (D.D.C. 2009), to support a motion for summary judgment. Lamb's sole argument to the contrary posits that, because the records the Department ultimately released did not include his "finger prints and/or finger print results," the search must have been incomplete. Dkt. 65 at 9. Under both FOIA and the Privacy Act, however, the adequacy of a search is typically measured by "the appropriateness of the methods used to carry [it] out," and not simply by "the fruits of the search." Iturralde v. Comptroller of Currency , 315 F.3d 311, 315 (D.C. Cir. 2003). Although an agency's failure to locate a document that the evidence shows likely resided in the agency's files at the time of the search can raise questions about the adequacy of the search, a plaintiff's mere assertion that he believed that the agency would find the missing record, even if based on common sense, is not alone sufficient to "demonstrate the inadequacy of a search." Boyd v. Criminal Div. of U.S. Dep't of Justice , 475 F.3d 381, 391 (D.C. Cir. 2007). That is particularly so when the agency has offered detailed evidence that it searched for the relevant records in all of the locations where they were likely to be found. The Court, accordingly, concludes that the State Department's search was adequate. 2. MCC The history of the MCC's search is slightly more complicated. The Court denied the MCC's prior motion for summary judgment based on a "potential inconsistency" in the MCC's evidence, which "at a minimum, warrant[ed] clarification." Lamb I , 228 F.Supp.3d at 36. As the Court explained, the MCC previously attested that it located "five ... documents that were responsive to plaintiff's request, including the Report of Investigation. " Id. (quoting Dkt. 17-1 at 2 (Walker-Watkins Decl. ¶ 5) ). In its response to Lamb's request, moreover, the agency did, indeed, release five documents. The ROI, however, was not one of them. Given this inconsistency, the Court concluded that the "proper recourse" was to require a "more exhaustive account" of the MCC's search and "in particular, to require that it provide a further declaration explaining whether the 'Report of Investigation' was produced and, if not, why not." Lamb I , 228 F.Supp.3d at 37 (internal quotations omitted). The MCC has now done so. Tamiko N. Walker-Watkins, the Assistant General Counsel and the Chief FOIA Officer at the MCC, has filed a supplemental declaration explaining that the agency "discovered the inadvertent omission of the ROI from the packet" that was initially delivered to *213Lamb, and that it subsequently "attached the ROI to the responsive records and mailed the complete packet to Mr. Lamb." Dkt. 63-1 at 4-5 (Walker-Watkins Supp. Decl. ¶ 14). To be sure, the Walker-Watkins supplemental declaration injects some additional confusion into the case. The declaration describes, for example, five responsive records, including the ROI, without attempting to reconcile this assertion with the MCC's initial release letter to Lamb, which identified five responsive records, not including the ROI. Compare Dkt. 63-1 at 3 (Walker-Watkins Supp. Decl. ¶ 10) with Dkt. 17-6 at 1. Ultimately, however, in yet another declaration, the MCC has now clarified that it released the five documents identified in the initial release letter and, subsequently, the ROI-for a total of six documents. Dkt. 67-1 at 1-2 (McCarthy Decl. ¶¶ 4, 6). That same declaration also clarifies, moreover, that the "Finger Print Results" listed in the initial release letter is the same document as the "OPM SAC case closing transmittal form," identified in the supplemental Walker-Watkins declaration. Id. at 2 (McCarthy Decl. ¶ 5). Given this history, it is not surprising that Lamb questions the adequacy of the MCC's search for records. The Court is convinced, however, that the MCC has now clarified the confusion. And, with that confusion behind it, the agency's description of its search-including its choice to search the Office of Domestic and International Security, which is the office "responsible for processing and adjudicating suitability determinations and security clearances for the MCC employees," Dkt. 63-1 at 2 (Walker-Watkins Supp. Decl. ¶ 7)-demonstrates that the search it conducted was "was reasonably calculated to uncover all relevant documents." Oglesby , 920 F.2d at 68. For the same reason he disputes the adequacy of the State Department's search, Lamb also argues that the MCC's search was inadequate. He once again questions why the MCC search did not yield "records pertaining to his ... fingerprinting," and he adds a similar argument with respect to "his MCC badging." Dkt. 72 at 4-5. The answer, however, remains the same. A FOIA/Privacy Act requester's expectation that an adequate search would find a particular record, which was not located, is generally not enough to defeat an agency's motion for summary judgment, at least absent evidence that the record was likely located in the agency's files at the time of the search or other reason to question the adequacy of the search. See Boyd , 475 F.3d at 390-91. Moreover, as discussed, the MCC attests that it did, in fact, locate and release his "[f]inger [p]rint [r]esults." See Dkt. 67-1 at 2 (McCarthy Decl. ¶ 5). Lamb also argues that the MCC's release of only a single page of his determination letter "suggests ... that only Plaintiff's personnel file was searched as opposed to an electronic search of what is apparently an electronically generated document." Dkt. 72 at 8. The supplemental Walter-Watkins declaration, however, says otherwise. Walter-Watkins avers, under the penalty of perjury, that the MCC's Department of International Security "conducted an electronic ... search" for responsive records using Lamb's name and social security number, Dkt. 63-1 at 2 (Walker-Watkins Supp. Decl. ¶ 7), in addition to a "manual search" of his personnel security file, id. at 3 (Walker-Watkins Supp. Decl. ¶ 10). Agency declarations, like this one, submitted in support of the adequacy of a search, must be "accorded a presumption of good faith, which cannot be rebutted by 'purely speculative claims about the existence and discoverability of *214other documents.' " SafeCard Servs. , 926 F.2d at 1200 (citation omitted). The Court, accordingly, concludes that the MCC's search for responsive records was sufficient. B. Withholdings Lamb also argues that the State Department, the MCC, and the Department of Defense have unlawfully withheld responsive records in whole or in part. With the exception of minor redactions made to a document releases by the Department of Defense, the Court disagrees. But as to those redactions, the Court concludes that it needs additional information to reach a decision. 1. State Department Summary judgment "is warranted when the agency's affidavits 'describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the information withheld logically falls within the claimed exemption, and are not controverted by either contrary evidence in the record nor by evidence of agency bad faith.' " Elec. Frontier Found. v. U.S. Dep't of Justice , 739 F.3d 1, 7 (D.C. Cir. 2014) (quoting Miller v. Casey , 730 F.2d 773, 776 (D.C. Cir. 1984) ); see also Senate of the Commonwealth of P.R. v. U.S. Dep't of Justice , 823 F.2d 574, 585 (D.C. Cir. 1987). Applying that standard, the State Department's single withholding is easily resolved. In the fourteen records the Department released, it withheld only a single piece of information: "the Social Security number of a third party" contained on a one-page form entitled "Authorization to Conduct Criminal History Inquiry for Spouse or Cohabitant." Dkt. 63-3 at 10 (Stein Decl. ¶ 25). To justify its withholding, the Department invoked FOIA Exemptions 6 and 7(C). Because the Court concludes that the redaction was proper under Exemption 6, it need not consider the Department's alternative basis for withholding the social security number. Exemption 6 permits an agency to withhold "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." 5 U.S.C. § 552(b)(6). The Supreme Court has construed the phrase "and similar files" broadly to reach "information which applies to a particular individual" and that is contained in government files. Dep't of State v. Washington Post Co. , 456 U.S. 595, 602, 102 S.Ct. 1957, 72 L.Ed.2d 358 (1982). "The mere fact that an agency file or record contains personal, identifying information, however, is not enough to invoke Exemption 6; in addition, the information must be 'of such a nature that its disclosure would constitute a clearly unwarranted privacy invasion.' " Edelman v. SEC , 239 F. Supp. 3d 45, 55 (D.D.C. 2017) (quoting Nat'l Ass'n of Home Builders v. Norton , 309 F.3d 26, 32 (D.C. Cir. 2002) ). "To determine whether release of a file would result in a clearly unwarranted invasion of personal privacy," the Court "must balance the private interest involved (namely, 'the individual's right of privacy') against the public interest (namely, 'the basic purpose of the Freedom of Information Act,' which is 'to open agency action to the light of public scrutiny')." Horowitz v. Peace Corps , 428 F.3d 271, 278 (D.C. Cir. 2005) (citation omitted). Applying this test, the Department acted well within its authority in redacting a third party's social security number from the form at issue. "Generally, personal identifying information such as a person's... social security number may be protected under Exemption 6." Smith v. Dep't of Labor , 798 F.Supp.2d 274, 284 (D.D.C. 2011) (citing Wash. Post Co. , 456 U.S. at 600, 102 S.Ct. 1957 ). Indeed, as the *215Department notes, social security numbers raise particular concerns-the risk of identity theft-and are unlikely to "shed ... light on the operations ... of the U.S. Government." Dkt. 63-3 at 10 (Stein Decl. ¶ 25). When there is no public interest in disclosure, a court "need not linger over the balance; something, even a modest privacy interest, outweighs nothing every time." Nat'l Ass'n of Retired Fed. Emps. v. Horner , 879 F.2d 873, 879 (D.C. Cir. 1989). And here, the privacy interest at stake is far from "modest." As a result, notwithstanding "the presumption in favor of disclosure," Nat'l Ass'n of Home Builders , 309 F.3d at 32, the required balance tips overwhelmingly in favor of nondisclosure. The Court, accordingly, concludes that the State Department appropriately invoked Exemption 6 to protect the third party's social security number from disclosure. 2. Department of Defense The State Department forwarded a 121-page "document to the Department of Defense for review and direct response to [Lamb]." Dkt. 63-3 at 3 (Stein Decl. ¶ 7). After reviewing that document, the Department of Defense determined that material contained on two pages-pages 114 and 115-required redaction under FOIA Exemptions 6, 7(C), and 7(D). Dkt. 63-4 at 2 (Jensen Decl. ¶ 6-7). The Department also declined to release these materials pursuant to the Privacy Act, concluding that they were compiled "solely for the purpose of determining suitability, eligibility, or qualifications for Federal civil employment ... [or] Federal contracts," and are thus exempt from disclosure under 5 U.S.C. § 552a(k)(5) ("Privacy Act Exemption (k)(5)"). Id. at 6 (Jensen Decl. ¶ 19-20). A copy of the document, containing these redactions, was then provided to Lamb. Id. at 2 (Jensen Decl. ¶ 7). Although the Court concludes that the Department of Defense properly invoked Exemptions 6 and 7(C), further explanation is necessary before the Court can reach any conclusions regarding the Department's reliance on FOIA Exemption 7(D) and Privacy Act Exemption (k)(5). The Department of Defense invoked Exemptions 6 and 7(C) to protect the identity of law enforcement officers, other government employees, and a confidential source. In support of those withholdings, it offers the declaration of Roxanne Jensen, the Acting Branch Chief of the Information Release Branch of the Air Force Office of Special Investigations ("AFOSI"). Dkt. 63-4 at 1 (Jensen Decl. ¶ 1). According to Jensen, her office applied Exemptions 6 and 7(C) "to protect from disclosure the names, signatures, phone numbers of ... AFOSI law enforcement officers and other ... AFOSI government employees" and to protect the "personally identifiable information of third parties." Id. at 3 (Jensen Decl. ¶ 12). As she further explains, the Department of Defense was concerned that disclosure of identifying information about Air Force law enforcement personnel and other employees would raise the prospect of "harassment" and could interfere "in the performance of their duties by persons who are currently of interest to law enforcement or [who] oppose the ... AFOSI mission." Id. at 4 (Jensen Decl. ¶ 13). Disclosure of the identities of law enforcement personnel, in particular, would pose a risk of "harassment and annoyance" in the conduct of their official responsibilities and "in their private lives," and could make them "target[s] by" those "who may" hold a "[ ]grudge." Id. (Jensen Decl. ¶ 14). Similarly, according to Jensen, disclosure of the names and other personally identifiable information regarding the third parties "could expose [them] to identity theft and may reasonably lead to unwanted contact from persons that might *216seek to harm them." Id. at 4-5 (Jensen Decl. ¶ 15). In addition, those individuals have an "interest in not being associated with law enforcement investigations," given "the stigmatizing connotation carried by the mere mention of individuals in law enforcement files." Id. at 5 (Jensen Decl. ¶ 16). The government once again relies on both Exemption 6 and Exemption 7(C)-but, this time, the Court concludes that Exemption 7(C) provides ample support for withholding the information at issue, and thus does not reach Exemption 6. Exemptions 6 and 7(C) differ in significant respects. Thus, while Exemption 6 is available only if the disclosure "would constitute a clearly unwarranted invasion of personal privacy," 5 U.S.C. § 552(b)(6) (emphasis added), "[t]he adverb 'clearly' ... is not used in Exemption 7(C)," Nat'l Archives & Records Admin. v. Favish , 541 U.S. 157, 165, 124 S.Ct. 1570, 158 L.Ed.2d 319 (2004). Similarly, while "Exemption 6 refers to disclosures that 'would constitute' an invasion of privacy, Exemption 7(C) encompasses any disclosure that 'could reasonably be expected to constitute' such an invasion." Dep't of Justice v. Reporters Comm. for Freedom of the Press , 489 U.S. 749, 756, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989) (emphasis added). In one respect, however, Exemption 7(C) sweeps less broadly than Exemption 6: it applies only to records "compiled for law enforcement purposes." 5 U.S.C. § 552(b)(7)(C). That requirement, however, is met here because "[t]he principal purpose of a background investigation is to ensure that a prospective employee [or contractor] has not broken the law or engaged in other conduct making her ineligible for the position" and " 'to determine whether there are any law enforcement or security issues in [her] past that could affect [her] ability ... to carry out' the position." Mittleman v. Office of Pers. Mgmt. , 76 F.3d 1240, 1243 (D.C. Cir. 1996) (per curiam) (alteration in original) (citation omitted). As the D.C. Circuit has opined, "[e]nforcement of the law fairly includes not merely the detection and punishment of violations of law but their prevention." Id. (citation and internal quotation marks omitted). As a result, a file "compiled" for purposes of conducting a background check clears the "compiled-for-law-enforcement-purposes" requirement of Exemption 7, regardless of whether the information at issue reveals a violation of the law. Id. Although Exemption 7(C) typically requires that the court balance the privacy interest at stake against the public interest in disclosure, see Reporters Comm. for Freedom of the Press , 489 U.S. at 763, 109 S.Ct. 1468, the D.C. Circuit has "adopted a categorical rule permitting an agency to withhold information identifying private citizens mentioned in law enforcement records, unless disclosure is 'necessary in order to confirm or refute compelling evidence that the agency is engaged in illegal activity.' " Schrecker v. U.S. Dep't of Justice , 349 F.3d 657, 661 (D.C. Cir. 2003) (quoting SafeCard Services, Inc. , 926 F.2d at 1206 ). Because Lamb has not offered any-let alone "compelling"-evidence of illegal activity, that categorical rule applies to the name and identifying information of the third party. The AFOSI employees, in contrast, "may not have as great a claim to privacy as that afforded to ordinary private citizens." Lesar v. U.S. Dep't of Justice , 636 F.2d 472, 487 (D.C. Cir. 1980). But their privacy interests, nonetheless, outweigh the public interest in disclosure of their names, signatures, and phone numbers. On one side of the balance, government investigators and employees "have a legitimate interest in preserving the secrecy of matters that conceivably *217could subject them to annoyance or harassment in either their official or private lives." Id. ; see also Smith , 798 F.Supp.2d at 284. And, on the other side of the balance, Lamb has failed to identify any public interest in disclosure, and the Court is unaware of any way in which the redacted, personal information would further the statutory purpose of elucidating the workings of the government. See Beck v. U.S. Dep't of Justice , 997 F.2d 1489, 1493 (D.C. Cir. 1993) ; see also Elec. Privacy Info. Ctr. v. Dep't of Homeland Sec. , 384 F.Supp.2d 100, 117 (D.D.C. 2005) ("[T]he public interest in learning the names of these lower-echelon employees is small."). The Court, accordingly, holds that the redactions of the names and other identifying personal information was lawful. The Department, however, also invokes FOIA Exemption 7(D) and Privacy Act Exemption (k)(5), and, as to these exemptions, the Court requires further information to assess the parties' contentions. Because FOIA and the Privacy Act "explicitly state that access to records under each is available without regard to exemptions under the other," Martin v. Office of Special Counsel , 819 F.2d 1181, 1184 (D.C. Cir. 1987), the Court will first address the Department's FOIA defense and will then turn to the Privacy Act. To invoke FOIA Exemption 7(D), an agency must show (1) that the records at issue were compiled for law enforcement purposes and (2) that their disclosure "could reasonably be expected to disclose the identity of a confidential source ... [or] information furnished by a confidential source." 5 U.S.C. § 552(b)(7)(D). Because Exemption 7(D) applies not only to the identity of the informant, but also to the "information furnished," it sweeps more broadly than Exemption 7(C). As the D.C. Circuit explained in Campbell v. U.S. Department of Justice , 164 F.3d 20 (D.C. Cir. 1998), Exemption 7(D) applies only when 'the particular source spoke with an understanding that the communication would remain confidential.' " Id. at 34 (quoting Dep't of Justice v. Landano , 508 U.S. 165, 172, 113 S.Ct. 2014, 124 L.Ed.2d 84 (1993) ). Such an understanding may arise based on "either an express or implied assurance of confidentiality," id. , but, either way, the agency bears the burden of demonstrating by probative evidence that such an assurance was made. Although context matters, a declaration that "simply asserts that [the] source[ ] received express assurances of confidentiality without providing any basis for the declarant's knowledge of this alleged fact," for example, might not suffice. Campbell , 164 F.3d at 34-35. Here, Jensen merely asserts that "[t]he source provided the information" at issue "with the understanding that ... AFOSI would keep the information confidential and [would] not disclose [it] (except for law enforcement purposes)." Dkt. 63-4 at 6-7 (Jensen Decl. ¶ 20). She does not indicate whether that assertion is made based on personal knowledge, whether the assurance at issue was express or implied, or what, if any, evidence supports her conclusion. See Campbell , 164 F.3d at 34 (requiring probative evidence of express assurance, such as notation on face of withheld document, personal knowledge of declarant, statement from the source, "or contemporaneous documents discussing practices or policies for dealing with the source or similarly situated sources"). The Court is, of course, "sensitive to the [agency's] need to protect confidential informants." Spataro v. Dep't of Justice , 279 F.Supp.3d 191, 205 (D.D.C. 2017). But, under controlling law, more detail is required to invoke Exemption 7(D). See *218Citizens for Responsibility & Ethics in Wash. v. U.S. Dep't of Justice , 746 F.3d 1082, 1101 (D.C. Cir. 2014) ("boilerplate" assertion "will not do"). Although the Court cannot conclude, based on the current record, the Department of Defense properly invoked Exemption 7(D), it also cannot conclude that the Exemption is inapplicable. Rather, the Court simply needs more information to make a determination. As a result, the Court will deny both Defendants' and Lamb's motions for summary judgment on this issue, but it will do so without prejudice to any party. Finally, the Court concludes that it also needs additional information to determine whether the Department of Defense-or the State Department-properly invoked Privacy Act Exemption (k)(5). That provision allows "[t]he head of any agency" to "promulgate rules ... to exempt any system of records" if that "system of records" consists of "investigatory material compiled solely for the purpose of determining suitability, eligibility, or qualifications for Federal civilian employment, ... Federal contracts, or access to classified information, but only to the extent that the disclosure of such material would reveal the identity of a source who furnished information to the Government under an express promise that the identity of the source would be held in confidence ...." 5 U.S.C § 552a(k)(5).2 Pursuant to this authority, the Department of the Air Force has issued a rule exempting a number of specific systems of records. See Privacy Act Program; Implementation; Final Rule, 69 Fed. Reg. 954, 961, 968-71 (Jan. 7, 2004) (codified at 32 C.F.R. Pt. 806b, App. D ). Two omissions, however, prevent the Court from deciding whether Privacy Act Exemption (k)(5), and the implementing regulation, apply here. First, the Jensen declaration does not indicate whether the understanding of confidentiality at issue arose by virtue of an "express promise," as required by the exemption, or by implication. Second, the declaration does not identify the system of records at issue, and thus the Court cannot determine whether that system of records is subject to the implementing regulation. Accordingly, the Court once again concludes that it lacks sufficient information to determine whether-or not-the cited exemption is available and, thus, once again, must deny both Defendants' and Lamb's motions for summary judgment without prejudice with respect to this issue. 3. MCC That leaves Lamb's claims against the MCC's "withholdings." Lamb argues that, despite the MCC's representations to the contrary, he "has not received [the] Finger Print results," the MCC's "letter stating the reason for an unfavorable treatment," or "the OPM SAC case closing transmittal form, adjudication grid, adjudication worksheet, [and] all records that supported the adjudication grid and ROI." Dkt. 65 at 18. In response, the MCC's declarant, Walker-Watkins, attests that the agency "attached the ROI to the responsive records and mailed the complete packet to Mr. Lamb via United States Postal Service (USPS) priority mail" and that it "received confirmation from the USPS that the packet was received by Mr. Lamb on March 15, 2017." *219Dkt. 63-1 at 4-5 (Walker-Watkins Supp. Decl. ¶ 14) (emphasis added). She attaches to her declaration, moreover, a Postal Service receipt, which-although undated-appears to bear Lamb's signature. Dkt. 63-2 at 8 (Walker-Watkins Supp. Decl. Ex. F). The dispute here is not about whether the MCC has lawfully "withheld" responsive records-at least as that term is commonly used. Rather, the question is simply whether the records were actually delivered to Lamb. See Crooker v. U.S. State Dep't , 628 F.2d 9, 10 (D.C. Cir. 1980) (per curiam) ("Once the records are produced the substance of the controversy disappears and becomes moot since the disclosure which the suit seeks has already been made."). This issue, however, is easily resolved. Although the evidence supports the MCC's contention that it delivered the records, as required, out of an abundance of caution and to promote judicial economy, the Court will simply direct that the MCC mail Lamb another copy of the responsive records, including the ROI. CONCLUSION For the reasons explained above, Defendants' motion for summary judgment, Dkt. 63, is GRANTED in part and DENIED in part, without prejudice, and Plaintiff's cross-motion for summary judgment, Dkt. 65, is DENIED without prejudice. The parties shall meet and confer regarding a schedule for renewed motions limited to the two open issues discussed above and shall file a joint status report on or before October 12, 2018, proposing a schedule for renewed motions on those-and only those-two issues. Footnotes [1] To the extent Lamb intends to sue Blades in his official capacity as an MCC official, see Dkt. 72 at 5, that claim-at best-duplicates the claims against the MCC addressed below. [2] The relevant provision of the Privacy Act also provides that material may be exempt from disclosure if it was furnished under "an implied promise" of confidentiality, but only if the individual "furnished information ... prior to the effective date of" the statute. 5 U.S.C § 552a(k)(5)(2). Because the effective date of this provision was December 31, 1974, see Pub. L. No. 93-579, 88 Stat. 1896 (1974), the Court assumes that this provision is inapplicable here.