Buzzfeed Inc. v. U.S. Department of Homeland Security ( 2023 )

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
BUZZFEED, INC.,
Plaintiff,
v.
No. 19-cv-03062 (DLF)
DEPARTMENT OF HOMELAND
SECURITY et al.,
Defendants.
MEMORANDUM OPINION
In this action, Buzzfeed challenges the U.S. Customs and Border Protection’s (CBP)
withholding of documents under the Freedom of Information Act (FOIA), 5 U.S.C. § 552. Before
the Court is the defendants’ Renewed Motion for Summary Judgment, Dkt. 57, and the plaintiff’s
Cross-Motion for Summary Judgment, Dkt. 58. For the reasons that follow, the Court will grant
the defendants’ motion in part and deny it in part, and the Court will deny the plaintiff’s motion in
full.
I. BACKGROUND
On July 2, 2019, the Inspector General of the Department of Homeland Security (DHS)
issued an alert on overcrowding and prolonged detention of adults and children in the Rio Grande
Valley (RGV Alert). Defs.’ Stmt. of Material Facts ¶ 1, Dkt. 37-1; Howard Decl. ¶ 13, Dkt. 37-3.
The next day, Buzzfeed requested “any and all databases containing records on which the
calculation in” the RGV Alert “are based” including “a full and up-to-date copy of the database(s)
referenced in the above custody database.” Howard Decl. ¶¶ 5, 15. Buzzfeed’s request “also
demanded all records from 2010 through the date of the search documenting the structure and use
of databases relied upon, to specifically include user manuals, schemas, layout, relationships, and
definitions of variables.” Id. ¶ 17.
Buzzfeed filed the instant case on October 14, 2019. See generally Compl., Dkt. 1. CBP
answered on December 29, 2019. See generally Answer, Dkt. 11. The agency determined that
Border Patrol was the division most likely to have responsive information, and it was likely to be
stored “within the Enforcement Integrated Database (EID).” Howard Decl. ¶¶ 19, 21. The EID is
a shared DHS database “owned and operated by U.S. Immigration and Customs Enforcement
(ICE).” Id. ¶ 21. The database “captures and maintains information related to the investigation,
arrest, booking, detention, and removal of persons encountered during immigration and criminal
law enforcement investigations and operations conducted by DHS components.” Id.Over the following months, CBP worked with Buzzfeed to “narrow and clarify the scope
of” the request. Id. ¶ 24. In November 2020, this resulted in “a spreadsheet file for each fiscal
year from FY2010 to FY2020” with “over 4,423,000 unredacted rows of responsive data.” Id.
¶ 25. Each row contained the following data fields: Border Patrol sector, Date and Time of
Apprehension, Citizenship, Gender, Age, Demographic, Time in the U.S., Date and Time of Initial
Booking, Date and Time of Final Booking, Time in Custody. Id. ¶¶ 24–25. Buzzfeed sought
additional data for each individual that CBP withheld: facility name, alien registration number (A-
number) or “some other ‘unique identifier’ that would permit [p]laintiff to track individuals and
aggregate their records across multiple data sets,” id. ¶ 26, and “a decade’s worth of records
documenting the structure and use of EID, including manuals, schemas, layout relationships, and
definitions of variables, i.e. the keys and blueprints to the Department’s enforcement data
infrastructure,” id. ¶ 38.
2
CBP justified its withholdings under three FOIA exemptions: Exemptions 6, 7(C), and
7(E). Id. ¶¶ 27–29. Under Exemption 7(E), CBP withheld both the specific “Border Patrol station
or operational site” for each CBP encounter and documentation of the EID’s structure and use. Id.
¶¶ 30, 38. Under Exemptions 6 and 7(C), CBP withheld the A-number associated with each entry
and any other “similar unique identifier[] that would enable tracking and aggregation of data about
individuals across multiple data sets.” Id. ¶ 34.
The Court granted CBP’s Motion for Summary Judgment as to the EID’s schemas,
manuals, and relationships and denied it, without prejudice, as the other withholdings. Dkt. 50.
The Court denied Buzzfeed’s Cross-Motion for Summary Judgment with prejudice as to EID’s
schemas, manuals, and relationships and without prejudice as to the other issues. Id. After CBP
filed supplemental declarations, Dkt. 52, pursuant to the Court’s Order, Dkt. 49, the parties filed
renewed cross-motions for summary judgment, Dkts. 57, 58. The remaining issues are whether
CBP is permitted to withhold (1) A-numbers and alternative unique identifiers under Exemptions
6 and 7(C); (2) Border Patrol station locations under Exemption 7(E); and (3) variable definitions
in the EID under Exemption 7(E).
II. LEGAL STANDARDS
Rule 56 of the Federal Rules of Civil Procedure states that “[t]he court shall grant summary
judgment if the movant shows that there is no genuine dispute as to any material fact and the
movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). When a federal agency
moves for summary judgment in a FOIA case, the court views all facts and inferences in the light
most favorable to the requester, and the agency bears the burden of showing that it complied with
FOIA. Chambers v. U.S. Dep’t of Interior, 568 F.3d 998, 1003 (D.C. Cir. 2009).
3
To prevail under Rule 56, a federal agency “must prove that each document that falls within
the class requested either has been produced, is unidentifiable, or is wholly exempt from the
(FOIA’s) inspection requirements.” Perry v. Block, 684 F.2d 121, 126 (D.C. Cir. 1982) (per
curiam) (citation omitted). The agency “must show beyond material doubt . . . that it has conducted
a search reasonably calculated to uncover all relevant documents,” Weisberg v. DOJ, 705 F.2d
1344, 1351 (D.C. Cir. 1983), and must also explain why any enumerated exemptions listed in 5
U.S.C. § 552(b) apply to withheld information, see Judicial Watch, Inc. v. FDA, 449 F.3d 141, 147
(D.C. Cir. 2006).
“The peculiarities inherent in FOIA litigation, with the responding agencies often in sole
possession of requested records and with information searches conducted only by agency
personnel, have led federal courts to rely on government affidavits to determine whether the
statutory obligations of the FOIA have been met.” Perry, 684 F.2d at 126. Agency affidavits are
entitled to a presumption of good faith, see SafeCard Servs. v. SEC, 926 F.2d 1197, 1200 (D.C.
Cir. 1991), and a court may grant summary judgment based on an affidavit if it contains reasonably
specific detail and if neither contradictory record evidence nor evidence of bad faith calls it into
question, see Judicial Watch, Inc. v. U.S. Secret Serv., 726 F.3d 208, 215 (D.C. Cir. 2013). The
“vast majority of FOIA cases can be resolved on summary judgment.” Brayton v. Off. of the U.S.
Trade Representative, 641 F.3d 521, 527 (D.C. Cir. 2011).
III. ANALYSIS
A. Exemption 6 and 7(C)
CBP withheld A-numbers and any other similar unique database identifiers under
Exemptions 6 and 7(C). Howard Decl. ¶¶ 34–37. “FOIA Exemptions 6 and 7(C) seek to protect
the privacy of individuals identified in certain agency records.” ACLU v. DOJ, 655 F.3d 1, 6 (D.C.
Cir. 2011). Exemption 6 protects “personnel and medical files and similar files the disclosure of
4
which would constitute a clearly unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6),
and Exemption 7(C) protects “records or information compiled for law enforcement purposes” that
“could reasonably be expected to constitute an unwarranted invasion of personal privacy,” id.§ 552(b)(7)(C). When an agency invokes both exemptions, courts “focus” on Exemption 7(C)
because it “establishes a lower bar for withholding material.” CREW. v. DOJ, 746 F.3d 1082,
1091 n.2 (D.C. Cir. 2014) (citation omitted).
1. A-Numbers
First, disclosing A-numbers could reasonably be expected to invade a substantial privacy
interest. In an Exemption 7(C) analysis, the first step is to identify the privacy interests implicated
by the release of records. ACLU, 655 F.3d at 6. To that end, the Court directed CBP to address
how the release of A-numbers could invade affected individuals’ privacy absent disclosure of their
names, addresses, dates of birth, or other direct identifying information. Order at 2. Among the
interests protected, Exemption 7(C) protects the privacy of individuals against the reputational
harm that may result from disclosure of law enforcement records. See CREW. v. DOJ, 658 F.
Supp. 2d 217, 239 (D.D.C. 2009) (noting that “protecting individuals against the stigma of being
mentioned in the context of a law enforcement investigation is the precise purpose of Exemption
7(C)”).
Here, CBP has established a substantial privacy interest in the release of A-numbers
because they can be used to identify an individual who is mentioned in law enforcement files. The
agency explained that DHS categorizes A-numbers as standalone Sensitive Personally Identifiable
Information (SPII), which means that an A-number can “identify an individual without any other
identifying information . . . .” Danisek Decl. ¶ 5, Dkt. 52-1. For example, an A-number can be
used to access personal and sensitive information through the Executive Office of Immigration
5
Review’s Automated Case Information System. Id. ¶ 6. In turn, this information can be used to
identify the individual in the CBP database. See id. “[I]n evaluating the privacy impact of the
release of information, the courts have taken into consideration potential derivative uses of that
information.” ACLU, 655 F.3d at 7. Thus, that “additional steps may be required to link these
numbers to an individual’s identity,” Danisek Decl. ¶ 6, does not, by itself, eliminate the relevant
privacy interest. See also Nat’l Ass’n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 878 (D.C.
Cir. 1989) (“In virtually every case in which a privacy concern is implicated, someone must take
steps after the initial disclosure in order to bring about the untoward effect.”). In sum, CBP’s
additional declaration sufficiently clarified how the release of A-numbers would invade the
individual privacy interest protected by Exemption 7(C).1
The analogy to social security numbers further highlights the privacy interest in A-
numbers. CBP cites several cases highlighting social security numbers’ protection under
Exemptions 6 and 7(C). See, e.g., Prison Legal News v. Lappin, 780 F. Supp. 2d 29, 40 (D.D.C.
2011) (“[A]n individual’s social security number has a specific relationship to that individual . . . .
[T]he Court finds that the privacy interest in one’s social security number is self-evident.”); see
also Murder Accountability Project v. DOJ, No. 19-cv-2478, 2021 WL 2682539, at *12 (D.D.C.
June 30, 2021) (noting that names, social security numbers, and alien registration numbers “are
exactly the kind of personal identifying information that may be protected from disclosure under
Exemption 6”). Like A-numbers, social security numbers are unique to an individual and
1
For the same reasons stated, harm is also foreseeable from the release of A-numbers. See 5
U.S.C. § 552(a)(8)(A); see also Ecological Rights Found. v. EPA, 541 F. Supp. 3d 34, 65 (D.D.C.
2021) (“[W]hen invoking Exemption 7(C), an agency need not establish much more than the fact
of disclosure to establish foreseeable harm” because “disclosure of identifying information is a
harm in and of itself.”).
6
categorized by DHS as standalone SPII.2 See Danisek Decl. ¶ 5. Thus, the Court will treat the
privacy interest in A-numbers similarly to the privacy interest in social security numbers.
Buzzfeed’s reliance on American Immigration Council v. ICE, 464 F. Supp. 3d 228(D.D.C. 2020) is unpersuasive. See Pl.’s First Mem. at 6–7, Dkt. 39-1. There, the court held that
Exemption 7(C) did not allow ICE and CBP to withhold all information about the date of birth of
apprehended individuals. Am. Immigr. Council, 464 F. Supp. 3d at 239. The court allowed
redaction only of the specific date of birth, ordering disclosure of birth year and month, and noted
that CBP had already each individual’s age. Id. at 239, 246. Unlike A-numbers, however, month
and year of birth are neither unique nor standalone SPII. And in American Immigration Council,
because CBP had already disclosed age, minimal additional sensitive information was revealed by
disclosing the month and year of birth.
Second, the Court concludes that any public interest implicated by the disclosure does not
outweigh individuals’ privacy interest. See ACLU, 655 F.3d at 12. It is well established that “the
only public interest relevant for purposes of Exemption 7(C) is one that focuses on the citizens’
right to be informed about what their government is up to.” Sussman v. U.S. Marshals Serv., 494
F.3d 1106, 1115 (D.C. Cir. 2007) (citation omitted). This public interest includes information that
shows that the agency acted “negligently or otherwise improperly in the performance of [its]
duties.” NARA v. Favish, 541 U.S. 157, 173 (2004).
Generally, an agency can withhold information identifying private citizens mentioned in
law enforcement records. SafeCard Servs., 926 F.2d at 1206. If, however, disclosure is “necessary
2
At first, Buzzfeed seemed to acknowledge the sensitive nature of A-numbers. See Pl.’s Email at
1, Dkt. 57-3 (“In terms of data, it appears that we have not received two categories that would be
extremely helpful. The facility name, and a unique identifier like an A number. I believe we
discussed the possibility of providing some sort of placeholder identifier so as to avoid violating
individuals[’] privacy.”).
7
in order to confirm or refute compelling evidence that the agency is engaged in illegal activity[,]”
then disclosure may be warranted. Schrecker v. DOJ, 349 F.3d 657, 661 (D.C. Cir. 2003) (quoting
Safecard Servs., 926 F.2d at 1206). A FOIA requester “must produce evidence that would warrant
a belief by a reasonable person that the alleged Government impropriety might have occurred.”
NARA, 541 U.S. at 174.
Buzzfeed argues that the RGV report would lead a reasonable person to believe that CBP
might have engaged in misconduct. Pl.’s Reply at 7, Dkt. 48-1. But even assuming that Buzzfeed
is correct, disclosure of A-numbers is not necessary to confirm or refute evidence of alleged
misconduct. A-numbers alone do not identify any wrongdoing. Instead, by linking all datapoints
pertaining to an individual alien, their function might be to allow for “track[ing] the movements
of children held in detention and help determine how long individual children were held even if
they were transferred among facilities.” Pl.’s First Mem. at 2. Alternatives to A-numbers,
functioning the same way but with far fewer privacy concerns, surely exist. For example, CBP
could generate anonymous unique individual identifiers or organize the data in a person-centric
manner. Accordingly, the Court concludes that the A-numbers themselves are exempt from
disclosure.3
3
For the first time in this round of briefing, the defendants argue that A-numbers and A-number
alternatives are outside the scope of Buzzfeed’s FOIA request. See Defs.’ Mem. at 9–12; Pl.’s
Mem. at 2 n.2. Because the Court concludes that the A-numbers are exempt from disclosure, it
need not reach this issue as to the A-numbers. As to A-number alternatives, it appears to the Court
that any such argument was likely forfeited. In any event, the arguments made in the defendants’
brief, see Defs.’ Mem. at 9–12, do not clearly apply to A-number alternatives, which would not
necessarily themselves be personally identifying. If the defendants raise a scope argument in the
next round of briefing, the Court will consider that argument, and its potential forfeiture, at that
time.
8
2. Alternative Unique Identifiers
The Court concludes, in contrast, that the defendants have failed to provide sufficient
information to assess the privacy interest implicated by potential alternative unique identifiers.
The defendants admit that they can anonymize A-numbers but argue that exemption 7(C) applies
because a third party could reverse engineer A-numbers by decrypting the anonymous unique
identifiers. Visconti Decl. ¶ 9, Dkt. 52-2. However, merely raising the possibility of decryption,
without explaining how decryption is possible and its likelihood, is too “vague” and “speculative.”
Am. Immigr. Council, 464 F. Supp. 3d at 239. Furthermore, the defendants’ declarations do not
explain how this risk would follow from providing “auto-incremented integers or randomly
generated IDs” that are not generated using the A-numbers themselves. Flores Decl. ¶ 8, Dkt. 39-
2.
With regards to fingerprint identification numbers, the defendants’ supplemental
declarations are also deficient. The defendants acknowledged fingerprint identification numbers
as the only person-centric identifier that appears in the underlying dataset, other than A-numbers.
Id. One declaration states that “biometric identifiers” are standalone SPII. Danisek Decl. ¶ 5. But
while CBP provided an example of how the release of A-numbers could compromise an
individual’s privacy (by giving access to immigration files), it did not do so for fingerprint
identification numbers. Agency declarations must “contain reasonable specificity of detail rather
than merely conclusory statements.” Jud. Watch, 726 F.3d at 215 (citation omitted). Here, CBP
failed to adequately explain how fingerprint identification numbers could compromise an
individual’s privacy.4
4
The Court is skeptical, however, that the analysis for fingerprint identification numbers will
ultimately be substantially different from that for A-numbers.
9
CBP has not sufficiently explained the privacy interest implicated by alternative unique
identifiers.5 Accordingly, the Court will order CBP to file a supplemental declaration stating the
privacy concern with generating alternative unique identifiers or using fingerprint identification
numbers.
B. Exemption 7(E)
Exemption 7(E) protects “records or information compiled for law enforcement purposes,
but only to the extent that the production of such law enforcement records or information . . . would
disclose techniques and procedures for law enforcement investigations or prosecutions . . . if such
disclosure could reasonably be expected to risk circumvention of the law.” 5 U.S.C. § 552(b)(7).
The exemption does not ordinarily protect “routine techniques and procedures already well known
to the public.” Founding Church of Scientology of Wash., D.C. v. NSA, 610 F.2d 824, 832 n.67
(D.C. Cir. 1979) (citation omitted). It does, however, protect “confidential details of . . .
program[s]” if only their “general contours [are] publicly known.” Sussman, 494 F.3d at 1112;
see also Shapiro v. DOJ, 893 F.3d 796, 801 (D.C. Cir. 2018) (permitting the government to
withhold documents that would disclose the way in which the FBI uses a particular publicly known
database). In this Circuit, Exemption 7(E) applies if the disclosure of information related to even
5
The Visconti Declaration asserts that a hacker could use unique identifiers “to quickly access
identifying information about specific people and their private information in the CBP database.”
Visconti Decl. ¶ 8. That assertion is insufficiently justified, and the Court is skeptical. An
individual who hacks the CBP database would presumably gain access to existing unique
identifiers because they appear in the underlying dataset. And it is unclear that arbitrary unique
identifiers, associated with individuals solely for the purpose of redacting A-numbers in this
disclosure, would facilitate such easy access. The defendants, moreover, do not assert that the
disclosure of unique identifiers would make hacking the database more likely. Cf. Am. Immigr.
Council, 464 F. Supp. 3d at 243 (rejecting the argument that unique identifiers are exempt under
Exemption 7(E) because the agency did “not come forward with information to show that the mere
possession of unique identifying information would facilitate one’s ability to hack into CBP’s
system or that it would make a hacking more likely”).
10
“commonly known procedures” could “reduce or nullify their effectiveness.” Vazquez v. DOJ,
887 F. Supp. 2d 114, 116 (D.D.C. 2012) (citation omitted), aff’d, No. 13-5197, 2013 WL 6818207(D.C. Cir. Dec. 18, 2013) (per curiam).
CBP has justified the withholding of two types of information under Exemption 7(E). First,
it withheld the specific Border Patrol station or operational site (but not the sector) where each
encounter took place. Howard Decl. ¶¶ 30–31. Second, as relevant here after the Court’s first
memorandum opinion, CBP withheld “records documenting . . . definitions of variables.” Id. ¶ 38.
The Court will address each in turn.
1. Location Information
In its earlier memorandum opinion, the Court concluded that the issue that “remain[ed]
unclear” in the Exemption 7(E) analysis as to location information was whether release of redacted
CBP locations, as compared to the apprehension location, see Am. Immigr. Council, 464 F. Supp.
3d at 244–45, would similarly “lead to circumvention of the immigration laws.” First Mem. Op.
at 10–11.6 The Court now agrees with the defendants that the locations of Border Patrol stations
could reasonably be expected to risk circumvention of the law as required by Exemption 7(E).
“Exemption 7(E)’s requirement that disclosure risk circumvention of the law sets a
relatively low bar for the agency to justify withholding.” Pub. Emps. for Env’t Resp. v. U.S.
Section, Int’l Boundary & Water Comm’n, U.S.-Mexico, 740 F.3d 195, 204–05 (D.C. Cir. 2014)
(citation omitted). Law enforcement agencies receive “a measure of deference” in their decision
to invoke Exemption 7(E). Am. Immigr. Council v. DHS, 950 F. Supp. 2d 221, 245 (D.D.C. 2013).
The agency only has the burden to “demonstrate logically how the release of the requested
6
In its briefs, the plaintiff agrees that “the Court identified the salient issues in its order and no
further argument from either side is warranted.” Pl.’s Mem. at 2.
11
information might create a risk of circumvention of the law.” Mayer Brown LLP v. IRS, 562 F.3d
1190, 1194 (D.C. Cir. 2009) (cleaned up).
Here, the disclosure of the Border Patrol stations associated with apprehensions could
reasonably be expected to risk circumvention of the immigration laws. CBP has already provided
sector-level location information. Howard Decl. ¶ 31. CBP has sufficiently explained that
attaching the specific Border Patrol station to each row of data would “risk[] revealing if and when
coverage areas between Border Patrol stations overlap or have gaps” and “which Station’s Agents
may face the heaviest workload at any given time.” Visconti Decl. ¶ 10. CBP’s supplemental
declarations demonstrate logically how the release of the location of Border Patrol stations, and
thus knowledge of which Border Patrol stations are relatively overwhelmed, might create a risk of
circumvention of the law. Accordingly, the Court will grant summary judgement in favor of the
defendants on whether the specific Border Patrol station locations were properly withheld under
Exemption 7(E).7
2. EID Variable Definitions
The Court previously held that CBP properly withheld schemas, manuals, and relationships
under Exemption 7(E) and granted the defendants’ motion for summary judgment on that issue.
However, the Court questioned whether CBP properly withheld “[g]lossaries and data dictionaries
(i.e., records defining the meaning of tables, columns, variables, and other aspects of the
database).” Compl. Ex. A at 2, Dkt. 1-1; see First Mem. Op.
In Long v. ICE, 464 F. Supp. 3d 409 (D.D.C. 2020), another court in this District ordered
ICE to conduct a segregability analysis as to “field and table names, codes, code translations, and
7
As previously explained, no further foreseeable harm analysis is needed under Exemption 7(E).
See First Mem. Op. at 10 n.1.
12
code lookup tables.” Id. at 426–27. In light of Long, this Court directed CBP to address in
supplemental declarations the distinctions, if any, between information requested by Buzzfeed and
that disclosed in Long. Order at 2. The agency was also directed to address whether the testimony
and record in that 2020 case remain applicable and accurate. Id. After the Court’s Order, CBP
released “73 pages of abbreviations, glossary of terms, processing disposition codes, charging and
entry status codes.” Defs.’ Mem. at 20. Buzzfeed confirms that CBP has “made a supplemental
production in response to the Court’s order.” Pl.’s Mem. at 6. But it contends that “[CBP] ha[s]
not provided a declaration supporting the claims made in [its] brief . . . and the Court should
expressly order [CBP] to produce to [Buzzfeed] the information produced in Long to the extent it
was not already produced.” Id.The parties’ briefing does not make sufficiently clear the scope of the remaining dispute.
Thus, the Court will order a joint status report directing the parties to confer and state their
positions on what additional records, if any, are sought in the search and are disputed.
CONCLUSION
For the foregoing reasons:
1) The defendants’ Motion for Summary Judgment is granted, and the plaintiff’s Cross-
Motion for Summary Judgment is denied with prejudice, with respect to the withholding
of A-numbers. The defendants’ motion and the plaintiff’s cross-motion are both denied
without prejudice with respect to alternative unique identifiers.
2) The defendants’ Motion for Summary Judgment is granted, and the plaintiff’s Cross-
Motion for Summary Judgment is denied with prejudice, with respect to the withholding
of Border Patrol station locations.
3) The defendants’ Motion for Summary Judgment and the plaintiff’s Cross-Motion for
Summary Judgment are both denied without prejudice with respect to the information on
variable definitions.
13
A separate order consistent with this decision accompanies this memorandum opinion.
________________________
DABNEY L. FRIEDRICH
United States District Judge
August 10, 2023
14