Buzzfeed Inc. v. U.S. Department of Homeland Security

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

BUZZFEED, INC.,

Plaintiff,

v. No. 19-cv-03062 (DLF) DEPARTMENT OF HOMELAND SECURITY et al.,

Defendants.

MEMORANDUM OPINION

In this action, Buzzfeed challenges the U.S. Customs and Border Protection’s (CBP) withholding of documents under the Freedom of Information Act (FOIA), 5 U.S.C. § 552. Before the Court is the defendants’ Renewed Motion for Summary Judgment, Dkt. 57, and the plaintiff’s Cross-Motion for Summary Judgment, Dkt. 58. For the reasons that follow, the Court will grant the defendants’ motion in part and deny it in part, and the Court will deny the plaintiff’s motion in full.

I. BACKGROUND

On July 2, 2019, the Inspector General of the Department of Homeland Security (DHS) issued an alert on overcrowding and prolonged detention of adults and children in the Rio Grande Valley (RGV Alert). Defs.’ Stmt. of Material Facts ¶ 1, Dkt. 37-1; Howard Decl. ¶ 13, Dkt. 37-3. The next day, Buzzfeed requested “any and all databases containing records on which the calculation in” the RGV Alert “are based” including “a full and up-to-date copy of the database(s) referenced in the above custody database.” Howard Decl. ¶¶ 5, 15. Buzzfeed’s request “also demanded all records from 2010 through the date of the search documenting the structure and use *2 of databases relied upon, to specifically include user manuals, schemas, layout, relationships, and definitions of variables.” Id. ¶ 17.

Buzzfeed filed the instant case on October 14, 2019. See generally Compl., Dkt. 1. CBP answered on December 29, 2019. See generally Answer, Dkt. 11. The agency determined that Border Patrol was the division most likely to have responsive information, and it was likely to be stored “within the Enforcement Integrated Database (EID).” Howard Decl. ¶¶ 19, 21. The EID is a shared DHS database “owned and operated by U.S. Immigration and Customs Enforcement (ICE).” Id. ¶ 21. The database “captures and maintains information related to the investigation, arrest, booking, detention, and removal of persons encountered during immigration and criminal law enforcement investigations and operations conducted by DHS components.” Id.

Over the following months, CBP worked with Buzzfeed to “narrow and clarify the scope of” the request. Id. ¶ 24. In November 2020, this resulted in “a spreadsheet file for each fiscal year from FY2010 to FY2020” with “over 4,423,000 unredacted rows of responsive data.” Id. ¶ 25. Each row contained the following data fields: Border Patrol sector, Date and Time of Apprehension, Citizenship, Gender, Age, Demographic, Time in the U.S., Date and Time of Initial Booking, Date and Time of Final Booking, Time in Custody. Id. ¶¶ 24–25. Buzzfeed sought additional data for each individual that CBP withheld: facility name, alien registration number (A-number) or “some other ‘unique identifier’ that would permit [p]laintiff to track individuals and aggregate their records across multiple data sets,” id. ¶ 26, and “a decade’s worth of records documenting the structure and use of EID, including manuals, schemas, layout relationships, and definitions of variables, i.e. the keys and blueprints to the Department’s enforcement data infrastructure,” id. ¶ 38.

CBP justified its withholdings under three FOIA exemptions: Exemptions 6, 7(C), and 7(E). Id. ¶¶ 27–29. Under Exemption 7(E), CBP withheld both the specific “Border Patrol station or operational site” for each CBP encounter and documentation of the EID’s structure and use. Id. ¶¶ 30, 38. Under Exemptions 6 and 7(C), CBP withheld the A-number associated with each entry and any other “similar unique identifier[] that would enable tracking and aggregation of data about individuals across multiple data sets.” Id. ¶ 34.

The Court granted CBP’s Motion for Summary Judgment as to the EID’s schemas, manuals, and relationships and denied it, without prejudice, as the other withholdings. Dkt. 50. The Court denied Buzzfeed’s Cross-Motion for Summary Judgment with prejudice as to EID’s schemas, manuals, and relationships and without prejudice as to the other issues. Id. After CBP filed supplemental declarations, Dkt. 52, pursuant to the Court’s Order, Dkt. 49, the parties filed renewed cross-motions for summary judgment, Dkts. 57, 58. The remaining issues are whether CBP is permitted to withhold (1) A-numbers and alternative unique identifiers under Exemptions 6 and 7(C); (2) Border Patrol station locations under Exemption 7(E); and (3) variable definitions in the EID under Exemption 7(E).

II. LEGAL STANDARDS

Rule 56 of the Federal Rules of Civil Procedure states that “[t]he court shall grant summary judgment if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). When a federal agency moves for summary judgment in a FOIA case, the court views all facts and inferences in the light most favorable to the requester, and the agency bears the burden of showing that it complied with FOIA. Chambers v. U.S. Dep’t of Interior, 568 F.3d 998, 1003 (D.C. Cir. 2009).

To prevail under Rule 56, a federal agency “must prove that each document that falls within the class requested either has been produced, is unidentifiable, or is wholly exempt from the (FOIA’s) inspection requirements.” Perry v. Block, 684 F.2d 121, 126 (D.C. Cir. 1982) (per curiam) (citation omitted). The agency “must show beyond material doubt . . . that it has conducted a search reasonably calculated to uncover all relevant documents,” Weisberg v. DOJ, 705 F.2d 1344, 1351 (D.C. Cir. 1983), and must also explain why any enumerated exemptions listed in 5 U.S.C. § 552(b) apply to withheld information, see Judicial Watch, Inc. v. FDA, 449 F.3d 141, 147 (D.C. Cir. 2006).

“The peculiarities inherent in FOIA litigation, with the responding agencies often in sole possession of requested records and with information searches conducted only by agency personnel, have led federal courts to rely on government affidavits to determine whether the statutory obligations of the FOIA have been met.” Perry, 684 F.2d at 126. Agency affidavits are entitled to a presumption of good faith, see SafeCard Servs. v. SEC, 926 F.2d 1197, 1200 (D.C. Cir. 1991), and a court may grant summary judgment based on an affidavit if it contains reasonably specific detail and if neither contradictory record evidence nor evidence of bad faith calls it into question, see Judicial Watch, Inc. v. U.S. Secret Serv., 726 F.3d 208, 215 (D.C. Cir. 2013). The “vast majority of FOIA cases can be resolved on summary judgment.” Brayton v. Off. of the U.S. Trade Representative, 641 F.3d 521, 527 (D.C. Cir. 2011).

III. ANALYSIS

A. Exemption 6 and 7(C)

CBP withheld A-numbers and any other similar unique database identifiers under Exemptions 6 and 7(C). Howard Decl. ¶¶ 34–37. “FOIA Exemptions 6 and 7(C) seek to protect the privacy of individuals identified in certain agency records.” ACLU v. DOJ, 655 F.3d 1, 6 (D.C. Cir. 2011). Exemption 6 protects “personnel and medical files and similar files the disclosure of *5 which would constitute a clearly unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6), and Exemption 7(C) protects “records or information compiled for law enforcement purposes” that “could reasonably be expected to constitute an unwarranted invasion of personal privacy,” id. § 552(b)(7)(C). When an agency invokes both exemptions, courts “focus” on Exemption 7(C) because it “establishes a lower bar for withholding material.” CREW. v. DOJ, 746 F.3d 1082, 1091 n.2 (D.C. Cir. 2014) (citation omitted).

1. A-Numbers

First, disclosing A-numbers could reasonably be expected to invade a substantial privacy interest. In an Exemption 7(C) analysis, the first step is to identify the privacy interests implicated by the release of records. ACLU, 655 F.3d at 6. To that end, the Court directed CBP to address how the release of A-numbers could invade affected individuals’ privacy absent disclosure of their names, addresses, dates of birth, or other direct identifying information. Order at 2. Among the interests protected, Exemption 7(C) protects the privacy of individuals against the reputational harm that may result from disclosure of law enforcement records. See CREW. v. DOJ, 658 F. Supp. 2d 217, 239 (D.D.C. 2009) (noting that “protecting individuals against the stigma of being mentioned in the context of a law enforcement investigation is the precise purpose of Exemption 7(C)”).

Here, CBP has established a substantial privacy interest in the release of A-numbers because they can be used to identify an individual who is mentioned in law enforcement files. The agency explained that DHS categorizes A-numbers as standalone Sensitive Personally Identifiable Information (SPII), which means that an A-number can “identify an individual without any other identifying information . . . .” Danisek Decl. ¶ 5, Dkt. 52-1. For example, an A-number can be used to access personal and sensitive information through the Executive Office of Immigration *6 Review’s Automated Case Information System. Id. ¶ 6. In turn, this information can be used to identify the individual in the CBP database. See id. “[I]n evaluating the privacy impact of the release of information, the courts have taken into consideration potential derivative uses of that information.” ACLU, 655 F.3d at 7. Thus, that “additional steps may be required to link these numbers to an individual’s identity,” Danisek Decl. ¶ 6, does not, by itself, eliminate the relevant privacy interest. See also Nat’l Ass’n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 878 (D.C. Cir. 1989) (“In virtually every case in which a privacy concern is implicated, someone must take steps after the initial disclosure in order to bring about the untoward effect.”). In sum, CBP’s additional declaration sufficiently clarified how the release of A-numbers would invade the individual privacy interest protected by Exemption 7(C).1

The analogy to social security numbers further highlights the privacy interest in A-numbers. CBP cites several cases highlighting social security numbers’ protection under Exemptions 6 and 7(C). See, e.g., Prison Legal News v. Lappin, 780 F. Supp. 2d 29, 40 (D.D.C. 2011) (“[A]n individual’s social security number has a specific relationship to that individual . . . . [T]he Court finds that the privacy interest in one’s social security number is self-evident.”); see also Murder Accountability Project v. DOJ, No. 19-cv-2478, 2021 WL 2682539, at *12 (D.D.C. June 30, 2021) (noting that names, social security numbers, and alien registration numbers “are exactly the kind of personal identifying information that may be protected from disclosure under Exemption 6”). Like A-numbers, social security numbers are unique to an individual and

1 For the same reasons stated, harm is also foreseeable from the release of A-numbers. See 5 U.S.C. § 552(a)(8)(A); see also Ecological Rights Found. v. EPA, 541 F. Supp. 3d 34, 65 (D.D.C. 2021) (“[W]hen invoking Exemption 7(C), an agency need not establish much more than the fact of disclosure to establish foreseeable harm” because “disclosure of identifying information is a harm in and of itself.”).

categorized by DHS as standalone SPII.2 See Danisek Decl. ¶ 5. Thus, the Court will treat the privacy interest in A-numbers similarly to the privacy interest in social security numbers.

Buzzfeed’s reliance on American Immigration Council v. ICE, 464 F. Supp. 3d 228 (D.D.C. 2020) is unpersuasive. See Pl.’s First Mem. at 6–7, Dkt. 39-1. There, the court held that Exemption 7(C) did not allow ICE and CBP to withhold all information about the date of birth of apprehended individuals. Am. Immigr. Council, 464 F. Supp. 3d at 239. The court allowed redaction only of the specific date of birth, ordering disclosure of birth year and month, and noted that CBP had already each individual’s age. Id. at 239, 246. Unlike A-numbers, however, month and year of birth are neither unique nor standalone SPII. And in American Immigration Council, because CBP had already disclosed age, minimal additional sensitive information was revealed by disclosing the month and year of birth.

Second, the Court concludes that any public interest implicated by the disclosure does not outweigh individuals’ privacy interest. See ACLU, 655 F.3d at 12. It is well established that “the only public interest relevant for purposes of Exemption 7(C) is one that focuses on the citizens’ right to be informed about what their government is up to.” Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1115 (D.C. Cir. 2007) (citation omitted). This public interest includes information that shows that the agency acted “negligently or otherwise improperly in the performance of [its] duties.” NARA v. Favish, 541 U.S. 157, 173 (2004).

Generally, an agency can withhold information identifying private citizens mentioned in law enforcement records. SafeCard Servs., 926 F.2d at 1206. If, however, disclosure is “necessary

2 At first, Buzzfeed seemed to acknowledge the sensitive nature of A-numbers. See Pl.’s Email at 1, Dkt. 57-3 (“In terms of data, it appears that we have not received two categories that would be extremely helpful. The facility name, and a unique identifier like an A number. I believe we discussed the possibility of providing some sort of placeholder identifier so as to avoid violating individuals[’] privacy.”).

in order to confirm or refute compelling evidence that the agency is engaged in illegal activity[,]” then disclosure may be warranted. Schrecker v. DOJ, 349 F.3d 657, 661 (D.C. Cir. 2003) (quoting Safecard Servs., 926 F.2d at 1206). A FOIA requester “must produce evidence that would warrant a belief by a reasonable person that the alleged Government impropriety might have occurred.” NARA, 541 U.S. at 174.

Buzzfeed argues that the RGV report would lead a reasonable person to believe that CBP might have engaged in misconduct. Pl.’s Reply at 7, Dkt. 48-1. But even assuming that Buzzfeed is correct, disclosure of A-numbers is not necessary to confirm or refute evidence of alleged misconduct. A-numbers alone do not identify any wrongdoing. Instead, by linking all datapoints pertaining to an individual alien, their function might be to allow for “track[ing] the movements of children held in detention and help determine how long individual children were held even if they were transferred among facilities.” Pl.’s First Mem. at 2. Alternatives to A-numbers, functioning the same way but with far fewer privacy concerns, surely exist. For example, CBP could generate anonymous unique individual identifiers or organize the data in a person-centric manner. Accordingly, the Court concludes that the A-numbers themselves are exempt from disclosure.3

3 For the first time in this round of briefing, the defendants argue that A-numbers and A-number alternatives are outside the scope of Buzzfeed’s FOIA request. See Defs.’ Mem. at 9–12; Pl.’s Mem. at 2 n.2. Because the Court concludes that the A-numbers are exempt from disclosure, it need not reach this issue as to the A-numbers. As to A-number alternatives, it appears to the Court that any such argument was likely forfeited. In any event, the arguments made in the defendants’ brief, see Defs.’ Mem. at 9–12, do not clearly apply to A-number alternatives, which would not necessarily themselves be personally identifying. If the defendants raise a scope argument in the next round of briefing, the Court will consider that argument, and its potential forfeiture, at that time.

2. Alternative Unique Identifiers

The Court concludes, in contrast, that the defendants have failed to provide sufficient information to assess the privacy interest implicated by potential alternative unique identifiers. The defendants admit that they can anonymize A-numbers but argue that exemption 7(C) applies because a third party could reverse engineer A-numbers by decrypting the anonymous unique identifiers. Visconti Decl. ¶ 9, Dkt. 52-2. However, merely raising the possibility of decryption, without explaining how decryption is possible and its likelihood, is too “vague” and “speculative.” Am. Immigr. Council, 464 F. Supp. 3d at 239. Furthermore, the defendants’ declarations do not explain how this risk would follow from providing “auto-incremented integers or randomly generated IDs” that are not generated using the A-numbers themselves. Flores Decl. ¶ 8, Dkt. 39-2.

With regards to fingerprint identification numbers, the defendants’ supplemental declarations are also deficient. The defendants acknowledged fingerprint identification numbers as the only person-centric identifier that appears in the underlying dataset, other than A-numbers. Id. One declaration states that “biometric identifiers” are standalone SPII. Danisek Decl. ¶ 5. But while CBP provided an example of how the release of A-numbers could compromise an individual’s privacy (by giving access to immigration files), it did not do so for fingerprint identification numbers. Agency declarations must “contain reasonable specificity of detail rather than merely conclusory statements.” Jud. Watch, 726 F.3d at 215 (citation omitted). Here, CBP failed to adequately explain how fingerprint identification numbers could compromise an individual’s privacy.4

4 The Court is skeptical, however, that the analysis for fingerprint identification numbers will ultimately be substantially different from that for A-numbers.

CBP has not sufficiently explained the privacy interest implicated by alternative unique identifiers.5 Accordingly, the Court will order CBP to file a supplemental declaration stating the privacy concern with generating alternative unique identifiers or using fingerprint identification numbers.

B. Exemption 7(E)

Exemption 7(E) protects “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information . . . would disclose techniques and procedures for law enforcement investigations or prosecutions . . . if such disclosure could reasonably be expected to risk circumvention of the law.” 5 U.S.C. § 552(b)(7). The exemption does not ordinarily protect “routine techniques and procedures already well known to the public.” Founding Church of Scientology of Wash., D.C. v. NSA, 610 F.2d 824, 832 n.67 (D.C. Cir. 1979) (citation omitted). It does, however, protect “confidential details of . . . program[s]” if only their “general contours [are] publicly known.” Sussman, 494 F.3d at 1112; see also Shapiro v. DOJ, 893 F.3d 796, 801 (D.C. Cir. 2018) (permitting the government to withhold documents that would disclose the way in which the FBI uses a particular publicly known database). In this Circuit, Exemption 7(E) applies if the disclosure of information related to even

5 The Visconti Declaration asserts that a hacker could use unique identifiers “to quickly access identifying information about specific people and their private information in the CBP database.” Visconti Decl. ¶ 8. That assertion is insufficiently justified, and the Court is skeptical. An individual who hacks the CBP database would presumably gain access to existing unique identifiers because they appear in the underlying dataset. And it is unclear that arbitrary unique identifiers, associated with individuals solely for the purpose of redacting A-numbers in this disclosure, would facilitate such easy access. The defendants, moreover, do not assert that the disclosure of unique identifiers would make hacking the database more likely. Cf. Am. Immigr. Council, 464 F. Supp. 3d at 243 (rejecting the argument that unique identifiers are exempt under Exemption 7(E) because the agency did “not come forward with information to show that the mere possession of unique identifying information would facilitate one’s ability to hack into CBP’s system or that it would make a hacking more likely”).

“commonly known procedures” could “reduce or nullify their effectiveness.” Vazquez v. DOJ, 887 F. Supp. 2d 114, 116 (D.D.C. 2012) (citation omitted), aff’d, No. 13-5197, 2013 WL 6818207 (D.C. Cir. Dec. 18, 2013) (per curiam).

CBP has justified the withholding of two types of information under Exemption 7(E). First, it withheld the specific Border Patrol station or operational site (but not the sector) where each encounter took place. Howard Decl. ¶¶ 30–31. Second, as relevant here after the Court’s first memorandum opinion, CBP withheld “records documenting . . . definitions of variables.” Id. ¶ 38. The Court will address each in turn.

1. Location Information

In its earlier memorandum opinion, the Court concluded that the issue that “remain[ed] unclear” in the Exemption 7(E) analysis as to location information was whether release of redacted CBP locations, as compared to the apprehension location, see Am. Immigr. Council, 464 F. Supp. 3d at 244–45, would similarly “lead to circumvention of the immigration laws.” First Mem. Op. at 10–11.6 The Court now agrees with the defendants that the locations of Border Patrol stations could reasonably be expected to risk circumvention of the law as required by Exemption 7(E).

“Exemption 7(E)’s requirement that disclosure risk circumvention of the law sets a relatively low bar for the agency to justify withholding.” Pub. Emps. for Env’t Resp. v. U.S. Section, Int’l Boundary & Water Comm’n, U.S.-Mexico, 740 F.3d 195, 204–05 (D.C. Cir. 2014) (citation omitted). Law enforcement agencies receive “a measure of deference” in their decision to invoke Exemption 7(E). Am. Immigr. Council v. DHS, 950 F. Supp. 2d 221, 245 (D.D.C. 2013). The agency only has the burden to “demonstrate logically how the release of the requested

6 In its briefs, the plaintiff agrees that “the Court identified the salient issues in its order and no further argument from either side is warranted.” Pl.’s Mem. at 2.

information might create a risk of circumvention of the law.” Mayer Brown LLP v. IRS, 562 F.3d 1190, 1194 (D.C. Cir. 2009) (cleaned up).

Here, the disclosure of the Border Patrol stations associated with apprehensions could reasonably be expected to risk circumvention of the immigration laws. CBP has already provided sector-level location information. Howard Decl. ¶ 31. CBP has sufficiently explained that attaching the specific Border Patrol station to each row of data would “risk[] revealing if and when coverage areas between Border Patrol stations overlap or have gaps” and “which Station’s Agents may face the heaviest workload at any given time.” Visconti Decl. ¶ 10. CBP’s supplemental declarations demonstrate logically how the release of the location of Border Patrol stations, and thus knowledge of which Border Patrol stations are relatively overwhelmed, might create a risk of circumvention of the law. Accordingly, the Court will grant summary judgement in favor of the defendants on whether the specific Border Patrol station locations were properly withheld under Exemption 7(E).7

2. EID Variable Definitions

The Court previously held that CBP properly withheld schemas, manuals, and relationships under Exemption 7(E) and granted the defendants’ motion for summary judgment on that issue. However, the Court questioned whether CBP properly withheld “[g]lossaries and data dictionaries (i.e., records defining the meaning of tables, columns, variables, and other aspects of the database).” Compl. Ex. A at 2, Dkt. 1-1; see First Mem. Op.

In Long v. ICE, 464 F. Supp. 3d 409 (D.D.C. 2020), another court in this District ordered ICE to conduct a segregability analysis as to “field and table names, codes, code translations, and

7 As previously explained, no further foreseeable harm analysis is needed under Exemption 7(E). See First Mem. Op. at 10 n.1.

code lookup tables.” Id. at 426–27. In light of Long, this Court directed CBP to address in supplemental declarations the distinctions, if any, between information requested by Buzzfeed and that disclosed in Long. Order at 2. The agency was also directed to address whether the testimony and record in that 2020 case remain applicable and accurate. Id. After the Court’s Order, CBP released “73 pages of abbreviations, glossary of terms, processing disposition codes, charging and entry status codes.” Defs.’ Mem. at 20. Buzzfeed confirms that CBP has “made a supplemental production in response to the Court’s order.” Pl.’s Mem. at 6. But it contends that “[CBP] ha[s] not provided a declaration supporting the claims made in [its] brief . . . and the Court should expressly order [CBP] to produce to [Buzzfeed] the information produced in Long to the extent it was not already produced.” Id.

The parties’ briefing does not make sufficiently clear the scope of the remaining dispute. Thus, the Court will order a joint status report directing the parties to confer and state their positions on what additional records, if any, are sought in the search and are disputed.

CONCLUSION

For the foregoing reasons:

1) The defendants’ Motion for Summary Judgment is granted, and the plaintiff’s Cross- Motion for Summary Judgment is denied with prejudice, with respect to the withholding of A-numbers. The defendants’ motion and the plaintiff’s cross-motion are both denied without prejudice with respect to alternative unique identifiers.

2) The defendants’ Motion for Summary Judgment is granted, and the plaintiff’s Cross- Motion for Summary Judgment is denied with prejudice, with respect to the withholding of Border Patrol station locations.

3) The defendants’ Motion for Summary Judgment and the plaintiff’s Cross-Motion for Summary Judgment are both denied without prejudice with respect to the information on variable definitions.

A separate order consistent with this decision accompanies this memorandum opinion.

________________________ DABNEY L. FRIEDRICH United States District Judge August 10, 2023