Hillier v. Central Intelligence Agency ( 2018 )

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
WYNSHIP W. HILLIER,
Plaintiff,
v. Civil Action No. 16-cv-1836 (DLF)
CENTRAL INTELLIGENCE AGENCY, et al.,
Defendants.
MEMORANDUM OPINION
Pro se plaintiff Wynship Hillier invokes the Privacy Act of 1974, 5 U.S.C. § 552a, to
identify records about him at the Department of Homeland Security (DHS), United States
Department of State, and Central Intelligence Agency (CIA) (collectively the “defendants”).
Hillier claims these agencies have records confirming that he is “the target of a sophisticated
campaign” designed to render him an “involuntary psychiatric outpatient” and to convince him,
and others, that he suffers from “psychiatric disorders.” 2d Am. Compl. ¶ 4, Dkt. 33.
Dissatisfied by the agencies’ failure to produce any records, Hillier filed this lawsuit. Before the
Court are the defendants’ Motion for Summary Judgment, Dkt. 40, Hillier’s Motion for Partial
Summary Judgment Against Defendant United States Department of Homeland Security, Dkt.
41, and Hillier’s Cross-motion for Partial Summary Judgment Against the Central Intelligence
Agency and United States Department of State, Dkt. 48. For the reasons that follow, the Court
will grant in part and deny in part the defendant’s motion and deny Hillier’s motions.
I. BACKGROUND
For the past six years, Wynship Hillier has sought records that he believes DHS,
Department of State, and CIA possess. His quest began in early 2012 1 when he sent letters to
these agencies asking whether certain record systems contained records about him. See Defs.’
Statement of Facts ¶¶ 3, 6, 17, 29, Dkt. 40-1; Pl.’s Statement of Genuine Issues ¶¶ 3, 6, 17, 29,
Dkt. 45. 2 Each agency processed Hillier’s requests under both the Privacy Act, 5 U.S.C. § 552a,
and the Freedom of Information Act (FOIA), 5 U.S.C. §552. But none of the agencies provided
records to Hillier because (1) none were found, (2) the relevant record systems were statutorily
exempt from the Privacy Act and FOIA, or (3) the CIA could neither confirm nor deny the
existence of records that might reveal a classified relationship with the agency. Defs.’ Statement
of Facts ¶¶ 3, 6, 19, 29. Hillier exhausted his administrative remedies and commenced this
lawsuit on September 12, 2016. See 2d Am. Compl. Exs. 1–54; Defs.’ Statement of Facts
¶¶ 9, 31.
1
It appears that Hillier initially submitted a Privacy Act request to the CIA by a letter dated
February 4, 2009. 2d Am. Compl. Ex. 3. The CIA responded on March 13, 2009 by notifying
Hillier that it would not process his request until he provided certain identifying information
required by regulation. 2d Am. Compl. Ex. 4 (citing 32 C.F.R. § 1901.13). There is no evidence
that Hillier provided the required information, but he later submitted another Privacy Act request
via a letter dated January 6, 2011 (the record is clear that the letter should have been dated
January 6, 2012, not 2011). See Defs.’ Statement of Material Facts ¶ 29 n.1; Pl’s. Statement of
Genuine Issues ¶ 29.
Separately, the record also reflects that a January 19, 2012 letter the plaintiff addressed to the
Department of State was not received until much later when “a copy of the . . . letter was
attached to subsequent correspondence between Plaintiff and [the agency].” Defs.’ Statement of
Material Facts ¶ 17; Pl’s. Statement of Genuine Issues ¶ 17.
2
Hillier does not dispute the facts this opinion cites from the defendants’ statement of material
facts. Compare Pl.’s Statement of Genuine Issues, Dkt. 45, with Defs.’ Statement of Facts, Dkt.
40-1. Accordingly, for convenience, the Court omits parallel citations to Hillier’s statement of
genuine issues, Dkt. 45. To be clear, Hillier disputes other facts contained in the defendants’
statement of material facts that are not cited here.
2
Since then, Hillier has zealously prosecuted his lawsuit. In addition to securing leave to
amend his complaint three times, he submitted over 1,300 pages of argument and evidence. See
Dkts. 15–18, 20, 22, 26, 31, 33–35, 38, 39, 41–43, 45, 46, 48, 49, 52–56, 59, 61, 64. 65.
When the defendants moved for summary judgment on August 24, 2017, see Dkt. 40,
Hillier countered on September 7, 2017 with a motion for partial summary judgment against
DHS, see Dkt. 41. He also filed an opposition to the defendants’ motion for summary judgment,
a motion to compel discovery, a motion to participate in hearings by telephone or televideo, see
Dkts. 42, 43, 45, and, on October 17, 2017, he filed a cross-motion for partial summary judgment
against the CIA and Department of State, see Dkt. 48.
About a week after this case was reassigned to the undersigned judge on December 5,
2017, Hillier moved for leave to file a surreply to the defendants’ motion for summary judgment,
see Dkt. 52, which the Court granted. Several weeks later, Hillier filed a 454-page request
asking the Court to take judicial notice of facts that he argued were contained in Federal Register
notices and proposed rules, Executive Orders and memoranda, federal statistical reports
published on agency websites, a telephone directory posted on a government website, a page
from a government website, other court records, dictionaries, law review articles, workday
calculations, and legislative reports and documents. Pl’s. Req. for Judicial Notice at 1, 35, 54,
65, 85, 87, 90, 92, 95, 96, Dkt. 54.
On February 23, 2018, Hillier moved to amend his motion for partial summary judgment
against DHS, cross-motion for partial summary judgment against the CIA and Department of
State, motion to compel discovery, and opposition to the defendants’ motion for summary
judgment. Mot. to Amend at 1, Dkt. 55. In support, Hillier submitted 464 pages of exhibits. Id.
Exs. 71–166, Dkt. 55-1. He followed that with a March 19, 2018 motion seeking reconsideration
3
of the May 31, 2017 minute order issued by the judge who was previously assigned to this case.
Mot. for Recons. at 1, Dkt. 59. That minute order prohibited Hillier from further amending his
complaint “absent a showing of exceedingly good cause.” Minute Order of May 31, 2017.
The competing motions for summary judgment are addressed in this memorandum
opinion. Hillier’s other pending motions are addressed in the accompanying order.
II. LEGAL STANDARDS
Rule 56 of the Federal Rules of Civil Procedure mandates that “[t]he court shall grant
summary judgment if the movant shows that there is no genuine dispute as to any material fact”
and, viewing the evidence in the light most favorable to the nonmoving party, “the movant is
entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a); see also Paige v. Drug Enf’t
Admin., 665 F.3d 1355, 1358 (D.C. Cir. 2012). “A dispute is ‘genuine’ if the evidence is such
that a reasonable jury could return a verdict for the nonmoving party.” Paige, 665 F.3d at 1358.
A fact is material if it “might affect the outcome of the suit under the governing law.” Anderson
v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986).
Hillier invokes the Privacy Act to secure notice of records about him. The Privacy Act
mandates that “[e]ach agency that maintains a system of records shall . . . upon request by any
individual to gain access to his record or to any information pertaining to him which is contained
in the system, permit him . . . to review the record and have a copy made of all or any portion
thereof in a form comprehensible to him.” 5 U.S.C. § 552a(d)(1). The Privacy Act also allows
individuals to request notice that an agency’s system of records contains information about them.
See 5 U.S.C. §§ 552a(e)(4)(G), (f)(1).
The defendants treat Hillier’s requests as though he is also seeking records under FOIA.
Defs.’ Statement of Material Facts ¶¶ 3, 6, 19, 29. FOIA provides that “each agency, upon any
4
request for records which (i) reasonably describes such records and (ii) is made in accordance
with published rules stating the time, place, fees (if any), and procedures to be followed, shall
make the records promptly available to any person.” 5 U.S.C. § 552(a)(3)(A).
The Privacy Act and FOIA are structurally similar. Londrigan v. FBI, 670 F.2d 1164,
1169 (D.C. Cir. 1981). Both provide a requester with access to federal agency records about the
requester and create a private cause of action when an agency fails to comply with a valid
request. 3 See 5 U.S.C. §§ 552a(d)(1), (g)(1) (Privacy Act); 5 U.S.C. §§ 552(a)(3)(A), (a)(4)(B)
(FOIA).
Under both the Privacy Act and FOIA, an agency must conduct an adequate and
reasonable search for relevant records. See Chambers v. U.S. Dep’t of Interior, 568 F.3d 998,
1003 (D.C. Cir. 2009) (stating that “the Privacy Act, like FOIA, requires” that a search “be
reasonably calculated to uncover all relevant documents” (internal quotation marks omitted)). In
this Circuit, courts apply the same standard under both statutes to determine the adequacy of a
search. 4 See id.; Hill v. U.S. Air Force, 795 F.2d 1067, 1069 (D.C. Cir. 1986) (per curiam)
(affirming search’s adequacy under Privacy Act for the same reasons the search was affirmed
under FOIA). Thus, “[i]n a suit seeking agency documents—whether under the Privacy Act or
the FOIA—at the summary judgment stage, where the agency has the burden to show that it
3
Unlike FOIA, however, the Privacy Act “does not have disclosure as its primary goal. Rather,
the main purpose of the Privacy Act’s disclosure requirement is to allow individuals on whom
information is being compiled and retrieved the opportunity to review the information and
request that the agency correct any inaccuracies.” Henke v. U.S. Dep’t of Commerce, 83 F.3d
1453, 1456–57 (D.C. Cir. 1996).
4
Hillier contends that FOIA is not relevant in this case. Pl.’s Opp’n Br. at 5–8, Dkt. 45. But
FOIA caselaw is relevant here because, as noted, the agencies treated his requests as seeking
records pursuant to the FOIA and the Privacy Act, and courts apply the same standards to
determine the adequacy of an agency’s search under both statutes. See, e.g., Chambers, 568 F.3d
at 1003; Ellis v. DOJ, 110 F. Supp. 3d 99, 107 (D.D.C. 2015).
5
acted in accordance with the statute, the court may rely on a reasonably detailed affidavit, setting
forth the search terms and the type of search performed, and averring that all files likely to
contain responsive materials (if such records exist) were searched.” Chambers, 568 F.3d at 1003
(internal alteration and quotation marks omitted). The agency’s affidavit is “accorded a
presumption of good faith, which cannot be rebutted by ‘purely speculative claims about the
existence and discoverability of other documents.’” SafeCard Servs., Inc. v. SEC, 926 F.2d
1197, 1200 (D.C. Cir. 1991) (quoting Ground Saucer Watch, Inc. v. CIA, 692 F.2d 770, 771
(D.C.Cir.1981)).
If agency searches reveal records responsive to a Privacy Act or FOIA request, an agency
may withhold access to the records if the statutes exempt them from disclosure. See 5 U.S.C.
§§ 552a(j)(2), (k)(2), 552(b). Although the Privacy Act and FOIA “substantially overlap,” the
statutes “are not completely coextensive; each provides or limits access to material not opened or
closed by the other.” Greentree, 674 F.2d at 78. The Privacy Act and FOIA “seek[] in different
ways to respond to the potential excesses of government,” and “[e]ach, therefore, has its own
functions and limitations.” Id. at 76. Accordingly, “[t]he two acts explicitly state that access to
records under each is available without regard to exemptions under the other.” Id. This means
that, when both statutes are at play, an agency seeking to withhold records must “demonstrate
that the documents fall within some exemption under each Act.” Martin v. Office of Special
Counsel, Merit Sys. Prot. Bd., 819 F.2d 1181, 1184 (D.C. Cir. 1987). “If a FOIA exemption
covers the documents, but a Privacy Act exemption does not, the documents must be released
under the Privacy Act; if a Privacy Act exemption but not a FOIA exemption applies, the
documents must be released under FOIA.” Id.
6
III. ANALYSIS
The defendants move for summary judgment under Rule 56 on the ground that their
searches were adequate but they found no nonexempt records to disclose to Hillier. Defs.’ Mot.
for Summ. J. at 1. Hillier opposes the defendants’ motion and champions his cross-motion for
summary judgment, which he contends must prevail because the agencies’ declarations
(1) contain statements contradicted by the record, (2) call into question the adequacy of the
searches, (3) pose evidentiary deficiencies, and (4) fail to address Hillier’s allegations of bad
faith. See Pl.’s Opp’n Br. at 1 (attached as Ex. 64 to Pl.’s Opp’n to Defs.’ Mot.), Dkt. 45. The
Court assesses the parties’ motions by considering each of Hillier’s Privacy Act requests and the
agencies’ corresponding searches and responses.
A. Hillier’s Privacy Act Request to the CIA
Hillier began his pursuit of federal agency records by sending a January 6, 2012 Privacy
Act request to the CIA. Shiner Decl. Ex. B at 1. Hillier’s request stated:
I believe that I may have been identified as a person of intelligence interest by your
agency, as I appear to be under surveillance, I appear to be the continual target of a
number of behaviors intended to provoke, threaten, intimidate, distress, and harass
me, and I continue to be a target for acts of battery.
Id. Hillier further stated that, “[d]ue to my education and subsequent work in operations
research, it is also possible that your agency has record[s] of me as a potential vendor or
consultant, and that fact has led to my identification as a person of intelligence interest to this or
another agency.” Id. Hiller requested notice of records about him in the following systems:
(1) CIA-22, Personnel Security Records; (2) CIA-24, Polygraph Records; (3) CIA-26, Office of
General Counsel Records; (4) CIA-32, Office of the Deputy Director of Central Intelligence for
Community Management Records; (5) CIA-33, National Intelligence Council Records; (6) CIA-
7
35, Directorate of Science & Technology Private Sector Contact Information; (7) CIA-37,
Directorate of Operation Records; (8) CIA-38, Academic and Business Contact Records;
(9) CIA-40, Research System Records; and (10) CIA-41, Intelligence Analysis Records. Hillier
identified himself by his full legal name, another name he used from 1990-91, his date and place
of birth, his social security number, his citizenship status, and his then-current and previous
residential addresses. Shiner Decl. Ex. B at 2.
1. The CIA’s Response
The CIA’s response to Hillier’s Privacy Act request is described in Antoinette B. Shiner’s
declaration. Shiner is a senior CIA official with Top Secret classification authority. Shiner Decl.
¶ 2, Dkt. 40-4. Shiner serves as the Information Review Officer for the CIA’s Litigation
Information Review Office. Id. ¶ 1. She is also a designated Records Validation Officer, which
means she is “authorized to testify or execute affidavits regarding CIA records and records
searches for litigation matters involving CIA information.” Id. ¶¶ 3, 5.
The CIA sent Hillier a March 5, 2012 letter stating that his request would be processed as
both a Privacy Act request and a FOIA request. 5 Id. ¶ 7. The CIA first focused on unclassified
records that “reveal an open or acknowledged relationship” between Hillier and the CIA. Id.
¶ 11. The CIA therefore confined its initial search to publicly released records about Hillier but
found none. Id. ¶ 12.
“[B]ased on this search, and analysis of the subject matter of the request,” the CIA
determined that the “Directorate of Support (DS) and the Director’s Area (DIR) were the
directorates most likely to maintain records responsive to the request because they were the most
5
The CIA also directed Hillier to contact the Office of the Director of National Intelligence
(ODNI) to request records from the CIA-33 system because the ODNI maintains that system. Id.
8
likely to maintain records that reflect an overt relationship between Mr. Hillier and the CIA.” Id.
According to Shiner, “[t]here were no additional locations that would reasonably likely . . .
maintain the records sought in this case.” Id. The CIA ultimately “identified the specific
databases that were reasonably likely to maintain responsive records,” id., and conducted
searches of all offices that manage the systems of records Hillier identified, id. ¶ 12 n.6. 6 The
CIA’s searches “us[ed] all variations of [Hillier’s] name and biographical identifiers that he
provided: ‘W Hillier,’ ‘Hillier (with DOB/SSN),’ ‘M Rainsong,’ and ‘Rainsong (with
DOB/SSN),’ ‘Wynship West Hillier,’ ‘Mabon Clearwater Rainsong,’ and ‘Hillier.’” Id. ¶ 13.
But the CIA again located no records about Hillier. Id. ¶ 13.
For classified records, the CIA provided a so-called “Glomar response” 7 that neither
confirmed nor denied the existence of records about Hillier pursuant to FOIA exemptions 1 and
3 and Privacy Act exemptions (j)(1) and (k)(1). FOIA exemption 1 protects from disclosure
“matters that are . . . specifically authorized under criteria established by an Executive order to
be kept secret in the interest of national defense or foreign policy and (B) are in fact properly
classified pursuant to such Executive order.” 5 U.S.C. § 552(b)(1). As Shiner explained,
Executive Order 13256 “is the operative executive order that governs classification,” Shiner
6
Shiner’s declaration states that the “Director’s Area” is a “cluster of offices under the Director
of the CIA, such as the Office of General Counsel, the Office of Public Affairs and the Office of
the Inspector General.” Shiner Decl. ¶ 12 n.5. The database searches at that directorate therefore
covered multiple offices.
7
“The Glomar response takes its name from the CIA’s refusal to confirm or deny the existence
of records about the Hughes Glomar Explorer, a ship used in a classified CIA project to raise a
sunken Soviet submarine from the floor of the Pacific Ocean to recover the missiles, codes, and
communications equipment onboard for analysis by United States military and intelligence
experts.” People for the Ethical Treatment of Animals v. Nat’l Insts. of Health, Dep’t of Health
& Human Servs., 745 F.3d 535, 540 (D.C. Cir. 2014) (internal quotation and alteration marks
omitted).
9
Decl. ¶ 14, and it provides that, “in response to a request for information under the Freedom of
Information Act, the Presidential Records Act, the Privacy Act of 1974, or the mandatory review
provisions of this order: (a) An agency may refuse to confirm or deny the existence or
nonexistence of requested records whenever the fact of their existence or nonexistence is itself
classified under this order or its predecessors,” EO 13256 § 3.6(a). By a delegation of authority
under Executive Order 13256, Shiner is authorized to make classification decisions and
“determined that the fact of the existence vel non of the requested records is currently and
properly classified.” Shiner Decl. ¶ 15.
Because FOIA exemption 1 requires the CIA to describe the national security damage
that could result from revealing whether classified records exist about Hillier, id. ¶ 23, Shiner
explained that confirming the existence or nonexistence of records about Hillier could reveal
intelligence sources or methods and intelligence activities, including covert actions, as defined in
Executive Order 13256. See id. ¶¶ 17, 18, 19. Shiner stated that a response to Hillier’s Privacy
Act request could “jeopardize the clandestine nature of the Agency’s intelligence activities or
otherwise reveal previously undisclosed information about CIA sources, capabilities, authorities,
interests, relationships with domestic or foreign entities, strengths, weaknesses, and/or
resources.” Id. ¶ 18.
Shiner further stated that intelligence gathering is a primary function of the CIA that
depends on human sources and targets. Id. ¶ 19. According to Shiner, human sources will
furnish information only with confidence that the CIA will protect them from public disclosure.
Id. She emphasized that CIA confirmation of a human source may lead targets to retaliate
against the source or his family and friends. Id. Disclosure of human sources also “places in
jeopardy every individual with whom the individual has had contact.” Id. “Thus, the
10
indiscretion of one source in a chain of intelligence sources can damage an entire spectrum of
sources.” Id. For these reasons, Shiner concluded that confirming or denying the existence of
records about someone “reasonably could be expected to cause serious damage to U.S. national
security by indicating whether or not CIA maintained any human intelligence sources related to
an interest in the subject of the request.” Id. And she explained why consistent use of a Glomar
response is necessary even when the CIA has no records about a requester:
To be credible and effective, the CIA must use the Glomar response consistently in
all cases where the existence or nonexistence of records responsive to a FOIA
request is a classified fact, including instances in which the CIA does not possess
records responsive to a particular request. If the CIA were to invoke a Glomar
response only when it actually possessed responsive records, the Glomar response
would be interpreted as an admission that responsive records exist. This practice
would reveal the very information that the CIA must protect in the interest of
national security.
Id. ¶ 20.
Shiner asserted that a Glomar response was also proper under FOIA exemption 3, which
protects information exempted by statute when the statute (1) requires withholding the
information from the public in a manner that leaves no discretion on the issue or (2) establishes
particular criteria for withholding or refers to particular types of matters to be withheld. Id.
¶¶ 21, 23; see also 5 U.S.C. § 552(b)(3). The National Security Act of 1947, as amended,
mandates that the Director of National Intelligence protect intelligence sources and methods
from unauthorized disclosure and thereby requires the information to be withheld without
discretion. Shiner Decl. ¶ 22; see also 50 U.S.C. § 3024(i)(1). In accordance with that Act and
provisions of Executive Order 12333, and under the direction of the Director of National
Intelligence, “the CIA is authorized to protect CIA sources and methods from unauthorized
disclosure.” Shiner Decl. ¶ 22. As Shiner explained with respect to FOIA exemption 1, the
existence or nonexistence of records indicating a classified connection between Hillier and the
11
CIA could reveal information about intelligence sources and methods. Id. ¶ 18, 19. And the
National Security Act protects such information from unauthorized disclosure. Id. ¶ 22. Shiner
therefore stated that “the fact of the existence or nonexistence of records that would reflect a
classified connection to the CIA is exempt from disclosure under FOIA exemption [3] pursuant
to the National Security Act.” Id. ¶ 23.
Shiner also concluded that the existence or nonexistence of records about Hillier was
protected from disclosure by Privacy Act exemptions (j)(1) and (k)(1). Id. ¶¶ 24, 25, 26, 27.
Exemption (j)(1) authorizes the Director of the CIA to promulgate regulations that exempt
systems of records from the Privacy Act’s access and amendment provisions. 5 U.S.C.
§ 552a(d). Shiner Decl. ¶ 24; see also 5 U.S.C. § 552a(j)(1). The Director of the CIA did so in
32 C.F.R. § 1901.62(d)(1), which exempts from the Privacy Act’s access provisions parts of CIA
systems of records “that consist of, pertain to, or would otherwise reveal intelligence sources and
methods.” Shiner Decl. ¶ 24 (citing the regulation). As Shiner explained with respect to FOIA
exemptions 1 and 3, the existence or nonexistence of a classified connection between the CIA
and Hillier “implicates intelligence sources and methods.” Id. ¶ 24.
Privacy Act exemption (k)(1) authorizes the Director of the CIA to promulgate rules that
exempt agency systems of records from the access provision of the Privacy Act if the system is
subject to FOIA exemption 1. Id. ¶ 26 (citing 5 U.S.C. § 552a(k)(1)). As already discussed,
FOIA exemption 1 protects from disclosure information that is properly classified under an
executive order. 5 U.S.C. § 552(b)(1). Shiner asserted that the existence or nonexistence of a
classified connection between the CIA and Hillier “can reasonably be expected to cause serious
damage to U.S. national security” so it “is currently and properly classified under Executive
12
Order 13526 and is, therefore, exempt from disclosure under Privacy Act exemption (k)(1).”
Shiner Decl. ¶ 26.
Because the existence or nonexistence of classified responsive records about Hillier “is
itself a properly classified fact and . . . is intertwined with intelligence activities, sources, and
methods,” Shiner determined that “this fact is, and must remain, classified and protected by
statute.” Id. ¶ 28. Shiner therefore concluded that “the only appropriate response is for the CIA
to neither confirm nor deny the existence or nonexistence of the requested records under FOIA
exemptions [1 and 3] and Privacy Act exemptions (j)(1) and (k)(1).” Id.
2. Adequacy of the CIA’s Search and Propriety of Withholdings
To secure summary judgment under the Privacy Act and FOIA, the CIA “must show that
it made a good faith effort to conduct a search for the requested records, using methods which
can be reasonably expected to produce the information requested.” Reporters Comm. for
Freedom of Press v. FBI, 877 F.3d 399, 402 (D.C. Cir. 2017) (quoting Oglesby v. U.S. Dep’t of
Army, 920 F.2d 57, 68 (D.C. Cir. 1990)). “[T]he issue to be resolved is not whether there might
exist any other documents possibly responsive to the request, but rather whether the search for
those documents was adequate.” Weisberg v. DOJ, 745 F.2d 1476, 1485 (D.C. Cir. 1984). “The
adequacy of the search, in turn, is judged by a standard of reasonableness and depends, not
surprisingly, upon the facts of each case.” Id. The question is whether the CIA’s search was
“reasonably calculated to discover the requested documents, not whether it actually uncovered
every document extant.” SafeCard, 926 F.2d at 1201.
“A reasonably detailed affidavit, setting forth the search terms and the type of search
performed, and averring that all files likely to contain responsive materials (if such records exist)
were searched” is necessary for an agency to prevail on summary judgment. Oglesby, 920 F.2d
at 68. Agency declarations should also specify who performed the search, Steinberg v. DOJ, 23
13
F.3d 548, 552 (D.C. Cir. 1994), and “reflect [a] systematic approach to document location,”
Weisberg v. DOJ, 627 F.2d 365, 371 (D.C. Cir. 1980).
The Shiner declaration satisfies the standards of both the Privacy Act and FOIA by
properly describing a systematic approach to the CIA’s search that first focused on publicly
released records and then turned to unclassified documents that the agency might possess. The
declaration explains that the CIA rationally determined that the Directorate of Support and the
Director’s Area were the only locations likely to have responsive records based on the results of
the search of publicly-released records and the substance of Hillier’s request. The declaration
states that the CIA identified specific databases that were reasonably likely to contain responsive
records and searched those databases using search terms consisting of the personal identifiers
Hillier presented in his Privacy Act request. The Court therefore finds that the CIA’s Shiner
declaration describes an adequate search conducted in good faith that was reasonably calculated
to discover Hillier’s requested documents. See Reporters Comm. for Freedom of Press, 877 F.3d
at 402; Oglesby, 920 F.2d at 68.
Hillier challenges the CIA’s search by first arguing that the Shiner declaration was not
based on personal knowledge. See Pl.’s Opp’n Br. at 25–26. But Shiner states in her declaration
that “I make the following statements based upon my personal knowledge and information made
available to me in my official capacity.” Shiner Decl. ¶ 6. In this Circuit, a declarant may
satisfy the personal knowledge requirement by “attest[ing] to his personal knowledge of the
procedures used in handling [a FOIA or Privacy Act] request and his familiarity with the
documents in question.” Barnard v. Dep’t of Homeland Sec., 598 F. Supp. 2d 1, 19 (D.D.C.
2009) (internal quotation marks omitted). Shiner’s declaration makes clear that she is familiar
with the procedures relating to the Privacy Act and FOIA requirements, as well as the records
14
Hillier requested. Shiner states that she: (1) worked in the review-and-release field for 18 years
in various official capacities that involved responsibility for classification and release
determinations, Shiner Decl. ¶ 2; (2) is a senior CIA official who holds original classification
authority to the Top Secret level, id. ¶ 3; (3) is responsible for litigation information and public
requests for information under the Privacy Act and FOIA, id. ¶ 4; (4) is a Records Validation
Officer authorized to testify about CIA records and searches, id. ¶ 5; and (5) “[t]hrough the
exercise of [her] official duties, [she] ha[s] become familiar with this civil action and the
underlying FOIA request,” id. ¶ 6. These statements suffice to satisfy the personal knowledge
requirement. See Barnard, 598 F. Supp. at 19.
Hillier also claims that Shiner’s declaration fails to identify who conducted and
supervised the searches or when the searches were performed. Pl.’s Opp’n Br. at 25–26. But
Shiner’s declaration, which must be accorded a presumption of good faith, see SafeCard Servs.,
Inc., 926 F.2d at 1200, identified who conducted the searches by stating that the CIA Information
and Privacy Coordinator received and processed Hillier’s request, Shiner Decl. ¶ 7, and the “CIA
employees who performed the necessary searches have access to pertinent records, are qualified
to search those records and regularly search those records in the course of their professional
duties,” id. ¶ 11. With respect to these employees’ names, “[t]he FOIA does not require the
disclosure of the names or information about agency staff involved in processing FOIA
requests.” Kidder v. FBI, 517 F. Supp. 2d 17, 24 (D.D.C. 2007). Indeed, this court previously
rejected as “frivolous” a requester’s contention that an agency should reveal the names of
employees who conducted searches. Harrison v. Fed. Bureau of Prisons, 611 F. Supp. 2d 54, 65
(D.D.C. 2009) (noting that personal identifying information about agency searchers would be
exempt from disclosure under FOIA exemption 6 if recorded).
15
Hillier cites no authority for the proposition that failing to identify the actual date on
which an agency conducts a search defeats the adequacy of the search or the presumption of
good faith attached to an agency declaration. See Pl.’s Opp’n Br. at 25–26. And Hillier’s claim
that Shiner did not supervise the searches is unavailing. Id. at 26. Shiner’s declaration states that
she is responsible for the classification review of CIA documents and information that are the
subject of court proceedings or Privacy Act and FOIA requests, and, as a Records Validation
Officer, she is authorized to testify or execute affidavits about CIA records searches. See Shiner
Decl. ¶¶ 4, 5. Shiner’s representations show that, through her authorities and position as a
Records Validation Officer for CIA records searches, id. ¶ 5, she had a managerial (and thus
supervisory) role with respect to the searches conducted here.
Hillier further argues that the CIA’s searches were incomplete because “entire systems of
records of which plaintiff requested search were apparently never touched.” Pl.’s Opp’n Br. at
29–30. But “there are some limits on what an agency must do to satisfy its FOIA obligations.”
Nation Magazine, Wash. Bureau v. U.S. Customs Serv., 71 F.3d 885, 891 (D.C. Cir. 1995).
“There is no requirement that an agency search every record system.” Oglesby, 920 F.2d at 68.
“Although an agency may not ignore a request to search specific record systems when a request
reaches the agency before it has completed its search, a search is generally adequate where the
agency has sufficiently explained its search process and why the specified record systems are not
reasonably likely to contain responsive records.” Mobley v. CIA, 806 F.3d 568, 582 (D.C. Cir.
2015). “Further, a request for an agency to search a particular record system—without more—
does not invariably constitute a ‘lead’ that an agency must pursue.” Id. “After all, a FOIA
requester’s detailed search instructions cannot dictate the reasonableness of the scope of an
agency’s FOIA search.” Nolen v. DOJ, 146 F. Supp. 3d 89, 98 (D.D.C. 2015).
16
Ultimately, the question is whether the agency’s search was reasonable based on the
facts, Mobley, 806 F.3d at 580, not “whether any further documents might conceivably exist,”
Truitt v. Dep’t of State, 897 F.2d 540, 542 (D.C. Cir. 1990). Here, the CIA determined that the
“Directorate of Support (DS) and the Director’s Area (DIR) were the directorates most likely to
maintain records responsive to the request because they were most likely to maintain records that
reflect an overt relationship between Mr. Hillier and the CIA.” Shiner Decl. ¶ 12. “[T]he
Agency identified the specific databases that were reasonably likely to maintain responsive
records,” and “[t]here were no additional locations that would [be] reasonably likely to maintain
the records sought in this case.” Id. All of the circumstances described in the Shiner declaration
demonstrate that the CIA made a good faith effort to conduct a search for Hillier’s requested
records, using methods that can reasonably be expected to produce the requested information.
See Oglesby, 920 F.2d at 68. The Court therefore holds that the CIA’s search was reasonable
and adequate. See Truitt, 897 F.2d at 542.
3. The CIA’s Glomar Response
Hillier contends that it was improper for the CIA to provide a Glomar response to his
request. Pl.’s Opp’n Br. at 25, 33–44. A “Glomar response . . . is proper if the fact of the
existence or nonexistence of agency records falls within a FOIA [or Privacy Act] exemption.”
Wolf v. CIA, 473 F.3d 370, 374 (D.C. Cir. 2007). “In determining whether the existence of
agency records vel non fits a FOIA exemption, courts apply the general exemption review
standards established in non-Glomar cases.” Id. If a Glomar response is justified, “the agency
need not conduct any search for responsive documents or perform any analysis to identify
segregable portions of such documents.” People for the Ethical Treatment of Animals, 745 F.3d
535 at 540. And “[c]ourts can grant summary judgment upholding a Glomar response based on
agency affidavits explaining the basis for the response.” Id. As described, the Shiner declaration
17
provides a detailed justification for the CIA’s Glomar response. Shiner explained the legal bases
for the response and how it complied with exemptions (j)(1) and (k)(1) of the Privacy Act and
exemptions 1 and 3 of FOIA. Shiner Decl. ¶¶ 13–27.
Hillier’s claim that the Glomar response was improper because the CIA misapplied its
regulations also is not persuasive. See Pl.’s Opp’n Br. at 18. Hillier’s argument appears to rest
on two premises: first, that he sought notice of records—not access to them; and second, that the
standard for invoking a Glomar response under the notice provisions of the applicable agency
regulations, see 32 C.F.R. § 1901.62(c), is higher than that for the access provision, see 32
C.F.R. § 1901.62(d)(1). Id. at 19–25. Even assuming that Hillier is right, Shiner’s declaration
demonstrates how confirming the existence of records about Hillier could jeopardize intelligence
sources and methods, see Shiner Decl. ¶¶ 18, 19, and would therefore satisfy any heightened
standard potentially applicable to a request for notice. The CIA’s Glomar response is amply
supported by Shiner’s declaration. See People for the Ethical Treatment of Animals, 745 F.3d at
540.
B. Hillier’s Privacy Act Requests to DHS
Hillier next sent a January 11, 2012 letter to the Disclosure Officer at the Office of
Intelligence and Analysis in DHS asking for notice of non-exempt records about him in a record
system he identified as “DHS/IA-001 (Office of Intelligence and Analysis Enterprise Records
System).” Sepeta Decl. Ex. A at 1, Dkt. 40-2. Hillier’s letter requested that the agency “please
search record categories A, B, C, D, E, F, G, H, and I, as listed on 73 FR 28132.” Id. Hillier
noted that records about him “may have been compiled at any time from 1983 to the present”
and he added that he worked for two defense department contractors in the mid-1980s. Id. He
also stated: “I may have been mistakenly identified as a terrorist, as people have suggested this
much to me, I appear to be under surveillance, I appear to be the continual target of a number of
18
behaviors intended to provoke, threaten, intimidate, distress, and harass me, and I continue to be
a target for continuing incidents of battery, and am currently disabled as the result of one such
incident.” Id. Hillier then identified himself by his full legal name, an alternate name he used
from 1990–91, his date and place of birth, his social security number, his citizenship status, and
both his then-current and a prior residential address. Id.
The next day, January 12, 2012, Hillier sent a similar letter to the Chief Privacy Officer
and Chief Freedom of Information Act Officer at DHS. Id. Ex. D at 1. In this second letter,
Hillier requested any non-exempt records about him located in the following two record systems:
• DHS/ALL-30 “Department of Homeland Security (DHS)/ALL-030 Use
of the Terrorist Screening Database (TSDB) System of Records”
(record categories: identifying information and other available
identifying particulars including audit records containing such,
references to and/or information from other government law
enforcement and intelligence databases or other relevant databases
containing such).
• DHS/ALL-031 “Information Sharing Environment (ISE) Suspicious
Activity Reporting (SAR) Initiative System of Records” (record
categories: attachments, contact information for submitters of ISE-
SARs, driver license, follow-up action, location, location address,
location coordinates, observer, owning organization, other identifier,
passport, person, person name, physical descriptors, physical feature,
ISE-SAR submission, sensitive information details, source
organization, suspicious activity report, submitting organization,
suspicious activity, target, vehicle, and related ISE-SAR).
Id. Hillier stated that “[DHS] may have a record about me because I may have been mistakenly
identified as a known or suspected terrorist.” Id. Hillier provided the same identifying
information that he submitted in his first letter to the agency, with the exception of his social
security number, which he omits. Id. at 2. He added a California driver’s license number and a
passport number. Id. He also indicated that records might be in the possession of the following
DHS components: Headquarters; Directorate for National Protection and Programs; Directorate
for Science and Technology; Office of Policy; Office of Health Affairs; Office of Intelligence
19
and Analysis; Office of Operations Coordination and Planning; Federal Law Enforcement
Training Center; Domestic Nuclear Detection Office; United States Coast Guard; Federal
Emergency Management Agency; and the United States Secret Service. Id.
1. DHS’s Response
Arthur R. Sepeta’s declaration describes DHS’s searches and response to Hillier’s
Privacy Act requests. As the Chief of the Privacy and Intelligence Oversight Branch at Office of
Intelligence and Analysis, Sepeta has “direct oversight” of the FOIA and Privacy Act policies,
procedures, and litigation involving Office of Intelligence and Analysis records. Sepeta Decl.
¶ 1. Sepeta states that DHS treated Hillier’s requests as requests under both the Privacy Act and
FOIA consistent with the agency’s policy and “to provide the greatest degree of access
authorized.” Id. ¶ 9. The defendants emphasize that, as a result, DHS “searched a broader
universe of records than those in the system of records that Plaintiff identified in his request.”
Defs.’ Reply at 5, Dkt. 47. As Sepeta explains, “[t]he Privacy Act’s right of access is limited to
records in a system of records, whereas FOIA searches encompass a much broader scope of
records.” Sepeta Decl. ¶ 9.
a. DHS’s Search of Record System DHS/IA-001
According to Sepeta, Hillier’s January 11, 2012 request seeking notice of records about
him in the DHS/IA-001 record system was referred to the Office of Intelligence and Analysis
and assigned the tracking number 12-OIA-0030. Id. ¶¶ 10, 21. DHS/IA-001 is an Enterprise
Records System that contains all records over which the Office of Intelligence and Analysis
exercises control. Id. ¶ 22. The Office of Intelligence and Analysis searched the DHS/IA-001
record system using Hillier’s name, the alternate name he identified, his date and place of birth,
both his present and prior residential addresses, and the last four digits of his social security
number. Id. ¶ 22. The search encompassed “the Production Management Branch, the State and
20
Local Program Office, Enterprise Mission Support Division, and the Analysis and Production
Office.” Id. ¶ 22.
On February 29, 2012, the Office of Intelligence and Analysis advised Hillier by letter
that no responsive records were found during the search of the DHS/IA-001 record system. Id.
¶ 11 & Ex. C at 1, Dkt. 40-2. The Office of Intelligence and Analysis also confirmed that no
records existed before January 24, 2003, the date DHS was created. Id. Ex. C at 1.
b. DHS’s Search of Record System DHS/ALL-30
DHS’s Privacy Office processed Hillier’s second request seeking notice of records about
him in the record system identified as DHS/ALL-30 (Use of the Terrorist Screening Database
Systems of Records). 8 Id. ¶ 13 & Ex. E at 1, Dkt. 40-2. In a March 19, 2012 letter, the Privacy
Office explained to Hillier that, even if records about him exist in the DHS/ALL-30 record
system, he had no right to access the records because they are exempt under both the Privacy Act
and FOIA. Id. Ex. E at 1–2.
Addressing the Privacy Act first, the Privacy Office stated that the records in DHS/ALL-
30 are exempt from the Act because the Terrorist Screening Database is part of a Federal Bureau
of Investigation (FBI) record system that the FBI has exempted from certain provisions of the
Act. Id. Ex. E at 1. According to the Privacy Office, the FBI exempted the Terrorist Screening
Database from 5 U.S.C. § 552a(d), which is the Privacy Act provision that provides access
rights. Id. Because DHS gets Terrorist Screening Database information from the FBI’s Terrorist
Screening Center, the FBI’s exemption “carries over when the TSDB information is transferred
to the Department.” Id.
8
The record does not reflect that DHS assigned a tracking number to this request. See Id. ¶¶ 12–
13; id. Ex. E.
21
The Privacy Office further explained that DHS’s record systems that receive the FBI’s
Terrorist Screening Database information through the Watch List Service are also exempt under
the Privacy Act, including the Privacy Act provision providing access to records. Id. (citing 5
U.S.C. §§ 552a(d), (j)(2), (k)(1), (k)(2), and 76 Fed. Reg. 81787). Information from the Terrorist
Screening Database “is categorized as Sensitive Security Information (‘SSI’) under 49 U.S.C.
§114(r), and the implementing regulation found at 49 CFR part 1520.” Id. Citing 49 C.F.R.
§§ 1520.9(a)(2) and 1520.15(a), the Privacy Office stated that “[r]ecords containing SSI are not
available for public inspection or copying, nor can they be released to anyone who does not have
an official need to know.” Id. The Privacy Office therefore concluded that Hillier “has no right
to access or amend the records contained in these systems” and denied his request under the
Privacy Act. Id.
The Privacy Office reached a similar result under FOIA, concluding that any records
responsive to Hillier’s request for records in DHS/ALL-30 are exempt from disclosure under
FOIA exemption 3 because they constitute Sensitive Security Information exempt by a statute,
49 U.S.C. § 114(r), Sepeta Decl. Ex. E at 2, which prohibits the disclosure of qualifying
information that is “obtained or developed in carrying out security under authority of the
Aviation and Transportation Security Act,” 49 U.S.C. § 114(r)(1). Thus, the Privacy Office
provided a Glomar response and neither confirmed nor denied the existence of records that might
reveal Hillier’s status in the Terrorist Screening Database. Sepeta Decl. Ex. E at 2.
The Privacy Office further concluded that any such records were also subject to FOIA
exemption 7(E), 5 U.S.C. § 552(b)(7)(E). Id. Exemption 7(E) protects law enforcement
information that “would disclose techniques and procedures for law enforcement investigations
22
or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions
if such disclosure could reasonably be expected to risk circumvention of the law.” 5 U.S.C.
§ 552(b)(7)(E). Accordingly, the Privacy Office denied Hillier’s request for notice of records
relating to him based on FOIA exemptions 3 and 7(E). Sepeta Decl. Ex. E at 2.
c. DHS’s Search of Record System DHS/ALL-031
Hillier’s third request asking for notice of records about him located in the DHS/ALL-
031 system was referred to the Office of Intelligence and Analysis where it was assigned
tracking number 12-OIA-0040. Sepeta Decl. ¶ 13. The Sepeta declaration and exhibits indicate
that the records in DHS/ALL-031 are a subset of the records contained in DHS/IA-001, which,
as noted, is a comprehensive record system that contains all records over which the Office of
Intelligence and Analysis exercises control. Id. ¶¶ 14, 22 & Ex. F at 1 (stating that DHS/IA-001
“includes . . . ISE . . . and Suspicious Activity Reporting (SAR)”). As a result, the Office of
Intelligence and Analysis’s search of DHS/IA-001 using Hillier’s full name, alternative name,
birth date, birth place, and current and prior residential addresses also covered records in
DHS/ALL-031. Id. ¶ 21.
Sepeta’s declaration states that the Office of Intelligence and Analysis’s April 4, 2012
letter to Hillier served as its final response to Hillier’s request about DHS/ALL-031. Id. ¶ 14.
The April 4, 2012 letter, however, refers to DHS/ALL-030 rather than to DHS/ALL-031, which
appears to be a typographical error. 9 Id. Ex. F at 1, Dkt. 40-2. Perhaps this is why, after Hillier
9
The confusion about whether DHS/ALL-031 was adequately searched can be attributed to this
apparent typographical error in the Privacy Office’s April 4, 2012 letter to Hillier. See Sepeta
Decl. Ex. F at 1. DHS/ALL-031 is consistently characterized in Sepeta’s declaration and
exhibits, as well as in Hillier’s January 12, 2012 Privacy Act request, as an “Information Sharing
Environment and Suspicious Activity Reporting System.” Id. ¶¶ 12, 22, Ex. D at 1, Ex. E at 2,
Ex. H at 1; see also id Ex. E at 2 (“As it relates to your access for records in the DHS/All-031,
Information Sharing Environment (ISE) Suspicious Activity Reporting (SAR) Initiative System
of Records . . . . I am referring your request to the FOIA Officer for OI&A . . . .”). Although the
23
pursued an administrative appeal on April 20, 2012, id. ¶ 15, the United States Coast Guard
Office of the Chief Administrative Law Judge 10 remanded the matter back to the Office of
Intelligence and Analysis on February 12, 2013, stating that “the record does not reflect whether
the proper database was searched or otherwise accounted for in the Final Response,” id. Ex. G at
2, Dkt. 40-2.
The Sepeta declaration reveals that on May 8, 2012—after Hillier filed his administrative
appeal on April 20, 2012 but before it was remanded on February 12, 2013—the Office of
Intelligence and Analysis conducted a search of computers and share drives belonging to
personnel within the Production Management Branch of the Office of Intelligence and
Analysis. 11 Id. ¶ 23. The Office of Intelligence and Analysis conducted the search using the
personal identifiers Hillier provided in his January 12, 2012 letter. Id. The Office of Intelligence
and Analysis limited the search to the Production and Management Branch of the Office of
Privacy Office’s April 4, 2012, letter refers to DHS/ALL-030 rather than to DHS/ALL-031, it
characterizes the system as the “Information Sharing Environment and Suspicious Activity
Reporting system,” id. Ex. F at 1, thereby indicating that it is intended to be DHS/ALL-031. In
contrast, the DHS/ALL-030 system is consistently characterized as “Use of the Terrorist
Screening Database System of Records.” Id. ¶ 12, Ex. D at 1, Ex. E at 1. Moreover, Hillier’s
request for records in the DHS/ALL-031 record system is the only request that was referred to
the Office of Intelligence and Analysis on March 19, 2012. Thus, the record indicates that the
reference to DHS/ALL-030 in the April 4, 2012 letter to Hillier is a typographical error, although
DHS has never said so.
10
By contract, the United States Coast Guard Office of the Chief Administrative Law Judge
reviews FOIA appeals for the DHS General Counsel. See id. Ex. G at 2.
11
Although the Sepeta declaration never expressly states whether that search involved the
DHS/ALL-031 record system, the declaration cites the tracking number that applied to the
DHS/ALL-031 record system. Sepeta Decl. ¶ 16. Moreover, on remand, the Office of
Intelligence and Analysis reported on November 26, 2013 that it “searched all component level
SAR [Suspicious Activity Reporting] files, and other source material without result.” Id. ¶ 18,
Ex. H at 2, Dkt. 40-2. As noted, this search must have involved the DHS/ALL-031 record
system given that system’s characterization in the Privacy Office’s March 19, 2012 letter as a
“suspicious activity reporting” system. Id. Ex. E at 1.
24
Intelligence and Analysis because that branch was responsible for keeping finished intelligence
products and the search would have identified responsive documents created between the time of
the first and second searches. Id. Because the Office of Intelligence and Analysis discovered no
responsive records during the second search, “there was no need to further expand the search to
other offices.” Id. DHS denied Hillier’s administrative appeal on July 9, 2015. Id. ¶ 19.
2. Adequacy of DHS’s Searches
Hillier does not challenge DHS’s searches of DHS/IA-001 or DHS/ALL-030. But he
does contest DHS’s search of DHS/ALL-031 because it was limited to the Office of Intelligence
and Analysis—only one of DHS’s twelve components. See Pl.’s Br. In Support of Mot. for
Partial Summ. J. at 10, Dkt. 41; Pl.’s Opp’n Br. at 9. 12
Although an agency is not required to search every record system, Oglesby, 920 F.2d at
68, it cannot ignore requests to search specific systems that are received before it completes its
searches, Mobley, 806 F.3d at 582. If an agency elects not to search specific systems that a
requester has identified, controlling precedent makes clear that the agency must “sufficiently
explain[] . . . why the specified record systems are not reasonably likely to contain responsive
records.” Mobley, 806 F.3d at 582. The Sepeta declaration lacks sufficient detail to meet this
standard. As a result, the Court is unable to conclude whether DHS’s search was adequate.
Hillier’s Privacy Act request to DHS seeking notice of records in DHS/ALL-031
identified the following 12 components where Hillier believed records could be found:
Headquarters; Directorate for National Protection and Programs; Directorate for Science and
Technology; Office of Policy; Office of Health Affairs; Office of Intelligence and Analysis;
12
Because the arguments raised in Hillier’s other motions are similar to those raised in his
opposition to the defendants’ motion for summary judgment, from this point forward the Court
cites to his opposition to the defendants’ motion for summary judgment.
25
Office of Operations Coordination and Planning; Federal Law Enforcement Training Center;
Domestic Nuclear Detection Office; United States Coast Guard; Federal Emergency
Management Agency; and the United States Secret Service. Sepeta Decl. Ex. D at 2. The Sepeta
declaration states that the Office of Intelligence and Analysis searched for records “over which
[it] maintained control,” id. ¶ 23, but never mentions whether the other 11 components might
have responsive records or their records are under the Office of Intelligence and Analysis’s
“control.” If DHS determined that the Office of Intelligence and Analysis was the only DHS
component that had a record system reasonably likely to contain responsive records, the Sepeta
declaration should say so. See Mobley, 806 F.3d at 582.
It is also unclear whether the Office of Intelligence and Analysis’s search of the
DHS/ALL-031 system was limited to only its own suspicious activity reports or whether it
included the suspicious activity reports of other DHS components. The Sepeta declaration’s
exhibits indicate that the Office of Intelligence and Analysis’s search might not have been so
limited. As the Office of Intelligence and Analysis FOIA Officer explained in a November 26,
2013 letter responding to the remand of Hillier’s administrative appeal:
[S]everal operational components within DHS regularly observe or otherwise
encounter suspicious activities while executing their authorized missions and
performing operational duties. Components document those observations or
encounters in SARs. DHS I&A is one of the DHS components that routinely
collects and formats information into SARs. These documents are stored locally,
which means that all contributors, including DHS components, exercise control
over their own reports and they are not available in the absence of a specific query.
And because each contributor maintains control over its own information, when a
record from a contributor is located, the contributor has sole authority to determine
whether it can be released outside NSI participants.
As a contributor to this system of records, DHS I&A has authority over only its
own SARs. Nevertheless, DHS I&A searched all component level SAR files, and
other source material without result. To the extent that Mr. Hillier wants a search
of SARs contributed by other NSI participants, he must make separate requests.
26
Sepeta Decl. Ex. H at 2, Dkt. 47-1 (emphasis added) (quotation marks omitted). This letter
suggests that the Office of Intelligence and Analysis conducted a search of all DHS (i.e.,
component level) suspicious activity reports, not just the Office of Intelligence and Analysis’s
reports. 13 Neither the Sepeta declaration nor the defendants’ legal briefs make this argument,
however, so the Court is left to believe this might not be the case.
This lack of clarity is compounded by the fact that, as already discussed, the Office of
Intelligence and Analysis’s April 4, 2012 letter to Hillier that purports to be DHS’s final
response to Hillier’s request about DHS/ALL-031 makes reference to DHS/ALL-030 rather than
to DHS/ALL-031. The Court presumes that this is an error but it would be helpful if the Sepeta
declaration said so one way or the other.
Because the Sepeta declaration fails to state whether DHS determined that the Office of
Intelligence and Analysis was the only component with a record system that was reasonably
likely to contain records responsive to Hillier’s request, the declaration lacks sufficient detail for
the Court to determine whether DHS’s search was adequate. The Court will therefore deny
without prejudice the defendants’ motion for summary judgment with respect to the search
conducted by DHS.
Hillier’s other challenges to the search of DHS/ALL-031 are not compelling. Hillier
questions whether the DHS/ALL-031 record system was properly characterized as “under the
13
Additionally, it appears that Hillier was required to submit separate Privacy Act requests to
search suspicious activity reports contributed by other participants in the Nationwide Suspicious
Activity Reporting Initiative. See Sepeta Decl. Ex. H at 2 (stating “[t]o the extent that Mr.
Hillier wants a search of SARs contributed by other NSI participants, he must make separate
requests”). The record does not reflect that he ever did that, although it is unclear whether that is
required for the 11 components Hillier identified or only applies to other agencies that participate
in the Nationwide Suspicious Activity Reporting Initiative.
27
purview” of the Office of Intelligence and Analysis as the Privacy Office stated in the March 19,
2012 letter to Hillier. Pl.’s Opp’n Br. at 9. Wrapped into this argument is Hillier’s dispute about
Sepeta’s citation of 6 C.F.R. § 5.4 as the basis for referring his DHS/ALL-031 request to the
Office of Intelligence and Analysis. Id. That regulation states that “the component that first
receives a request for a record and maintains that record is the component responsible for
responding to the request” unless the request was misdirected to that component or a component
determines the records originated at another component or the information was provided by
another component or is of substantial interest to another component. 6 C.F.R. §§ 5.4(a), (c), (d).
These points culminate with Hillier alleging that the FOIA Program Specialist who signed the
March 19, 2012 letter to Hillier was “lying” about the agency’s rationale for referring Hillier’s
DHS/ALL-031 request to the Office of Intelligence and Analysis. Pl.’s Opp’n Br. at 13–14.
It was reasonable for the Privacy Office’s FOIA Program Specialist to determine that
DHS/ALL-031 “falls under the purview of the DHS Office of Intelligence and Analysis,” Sepeta
Decl. Ex. E at 2, given that the DHS/ALL-031 system is a subset of DHS/IA-001, a
comprehensive record system over which the Office of Intelligence and Analysis has control, see
id. ¶ 22. Furthermore, 6 C.F.R. § 5.4(a) makes clear that a component that first receives a
request for records is responsible for responding to the request if it “maintains that record.”
There is no evidence that DHS’s Privacy Office “maintains” records in DHS/ALL-031, in which
case it was appropriate for that component to forward the request to a component that did
maintain such records. Notably too, 6 C.F.R. § 5.4 provides that if a component determines that
it maintains responsive records that contain information of substantial interest to another
component, then “[t]he component may refer the responsibility for responding to the request or
portion of the request to the component . . . best able to determine whether to disclose the
28
relevant records.” 6 C.F.R. § 5.4(d)(3). The regulation goes on to state that “[o]rdinarily, the
component . . . that created or initially acquired the record will be presumed to be best able to
make the disclosure determination.” Id. Hillier offered the Court no reason to think that DHS’s
Privacy Office erred by referring his request to search DHS/ALL-031 to the Office of
Intelligence and Analysis given that there is no evidence that the Privacy Office maintains any
records in that system.
C. Hillier’s Department of State Privacy Act Request
Hillier’s final attempt to identify records about him was initiated by a January 19, 2012
Privacy Act request sent to the Department of State Director of Foreign Affairs Document and
Reference Center. 2d Am. Compl. Ex. 34 at 1; Stein Decl. ¶ 4, Dkt. 40-3. In that letter, Hillier
asks the Department of State to check whether it possesses any non-exempt records about Hillier
in the STATE-06 “Coordinator for the Combatting of Terrorism Records” (all record categories)
record system. 2d Am. Compl. Ex. 34 at 1; Stein Decl. ¶ 4, Dkt. 40-3. Hillier states that he
“believes that the Department of State may have records about [him] because [he] [was] an
American Citizen involved in terrorist incidents.” 2d Am. Compl. Ex. 34 at 1. Hillier supplies
the Department of State with his full legal name, another name he used in the past, his date and
place of birth, his social security number, and his then-current mailing address. Id. at 2. 14
14
It appears from the record that Hillier’s January 19, 2012 letter to the Department of State was
returned to him, Stein Decl. ¶ 4, but at some point Hillier began corresponding with the
Department of State’s Office of Information Programs and Services. The Office of Information
Programs and Services later received Hillier’s request for STATE-06 records as an attachment to
subsequent correspondence with him. Id.
29
1. The Department of State’s Response
The Department of State submits Eric F. Stein’s declaration describing the agency’s
response to Hillier’s Privacy Act request. Stein is the Department of State’s Director of the
Office of Information Programs and Services and the official responsible for responding to
records requests under the Privacy Act and FOIA. Stein Decl. ¶ 1, Dkt. 40-3. According to
Stein, the Department of State processes Privacy Act requests under both the Privacy Act and
FOIA. Id. ¶ 6.
Stein states that he reviewed Hillier’s Privacy Act request and determined that the Bureau
of Counterterrorism and Countering Violent Extremism was the Department of State component
likely to have responsive documents “because [Hillier’s] request specifically referred to STATE-
06, and [the Bureau of Counterterrorism and Countering Violent Extremism] is the Department
component that would maintain any records described in STATE-06, ‘Coordinator for the
Combatting of Terrorism Records.’” Id. ¶ 9. Stein also determined that the Department of
State’s Retired Record Inventory Management System, “a searchable database that automates the
processing of records retired to the Records Service Center” was reasonably likely to have
responsive records. Id. Stein “concluded that no other offices or records systems were
reasonably likely to maintain documents responsive to [Hillier’s] request related to STATE-06.”
Id.
According to Stein, the Bureau of Counterterrorism and Countering Violent Extremism
Director of the Office of Regional Affairs determined that the only bureau components
reasonably likely to have responsive records were the Office of South and Central Asia and the
Near East, and the Office of Africa, Europe, the Americas, and Asia. Id. ¶ 11. Stein explains
that these two offices “work on counterterrorism policy in individual countries, and all [bureau]
30
records that reference an American involved with terrorist activities would pass through these
offices.” Id. In addition, “[a]ny American who had joined a terrorist organization or been
kidnapped by terrorists would also have had the attention of the office leadership in these two
offices.” Id.
Three officials knowledgeable about Hillier’s Privacy Act request and the record systems
in these two offices searched both the unclassified and classified electronic files for records
relating to Hillier. Id. ¶ 12. The official who was a Program Analyst for the Office of Africa,
Europe, the Americas, and Asia “searched the unclassified and classified shared drives (a
collection of folders stored on a local network) used by both [the Office of South and Central
Asia and the Near East and the Office of Africa, Europe, the Americas, and Asia] to maintain
their electronic records, including archived emails stored in .pst files, using the following names
and other identifying information provided by Plaintiff: ‘Wynship Hillier,’ ‘Wynship West
Hillier,’ ‘Mabon Rainsong,’ ‘Mabon Clearwater Rainsong,’ and Mr. Hillier’s Social Security
number.” Id. In addition, the Deputy Office Director of the Office of South and Central Asia
and the Near East and the Office Director for the Office of Africa, Europe, the Americas, and
Asia “searched their unclassified and classified email records and individual drives using the
search terms: ‘Wynship Hillier,’ ‘Wynship West Hillier,’ ‘Mabon Rainsong,’ ‘Mabon Clearwater
Rainsong,’ and Mr. Hillier’s Social Security number.” Id. Stein states that “[n]o date
restrictions were applied to these searches,” id., and no responsive records were found, id. ¶ 13.
Stein further explains that “[a]ll files are maintained electronically, so a search of these record
systems would have located any responsive records.” Id. ¶ 12.
Addressing the Retired Records Inventory Management System, Stein describes the
system as a “searchable database that automates the processing of records retired to the Records
31
Service Center and tracks the status of all boxes received” at the center. Id. ¶ 14. Stein states
that both the full text and the metadata of records in the “retired file manifests” are searchable.
Id. He explains that “retired file manifests serve as an index of the contents of retired paper files
and are used to direct a researcher to particular file folders or documents in retired file boxes.”
Id. Stein notes, however, that “[o]n occasion, manifests do not contain sufficient detail to
indicate the exact contents maintained under a given subject, so once a potentially responsive
box is located, the entire contents of the box must be searched manually.” Id.
According to Stein, an Office of Information Programs and Services Information
Specialist who was knowledgeable about FOIA and the Retired Records Inventory Management
System searched the system using the terms “counterterrorism” or “CT.” Id. ¶ 15. The search
covered the time period from January 1, 2007 through the date of the search. Id. The 2007 date
was derived from Hillier’s statement that he was involved in terrorist incidents since 2007. Id.
The Office of Information Programs and Services “determined that these search terms would
locate any records during the time frame that were covered by STATE-06.” Id. Stein states that
the search located “[n]o retired file manifests for CT for the relevant time period.” Id. The
Information Specialist also searched all the system records using the terms “Hillier,” “Wynship,”
or “Rainsong,” but “[n]o relevant retired file manifests indicating the existence of records
regarding [Hillier] were located.” Id.
By letter dated January 13, 2017, the Office of Information Programs and Services
advised Hillier that professional employees in the Department of State’s Bureau of
Counterterrorism and Countering Violent Extremism who are familiar with the content and
organization of the agency’s non-exempt records conducted a thorough search of records in
STATE-06 and found no records about him. Id. Ex. 1.
32
2. Adequacy of the Department of State’s Searches
Stein’s declaration explains the scope of the Department of State’s search, which was
defined by Hillier’s request for records about him in the STATE-06 system. Stein identifies the
methodology deployed to identify the record systems reasonably likely to have responsive
records and the timeframe that was applied. The declaration also identifies who performed the
searches, the search terms that were used, and the type of searches that were performed. See
Steinberg, 23 F.3d at 552.
Hillier raises a series of objections to the Stein declaration, Pl.’s Opp’n Br. at 3–5, 16–18,
none of which the Court finds convincing. First, Hillier contends that the declaration is deficient
because it does not state that it was based on personal knowledge. But Hillier is mistaken. The
first paragraph of the declaration states “I make the following statements based upon my
personal knowledge, including information furnished to me in the course of my official duties.”
Stein Decl. ¶ 1. Stein also states that he is “familiar with the efforts of Department personnel to
process the Privacy Act request” and “in charge of coordinating the agency’s search efforts with
respect to [Hillier’s] request.” Id. Stein’s declaration therefore demonstrates his personal
knowledge of the procedures used in handling requests and his familiarity with the documents in
question. See Barnard, 598 F. Supp. 2d at 19.
Second, Hillier claims that the Stein declaration is deficient because the Director of the
Office of Regional Affairs relied on hearsay to determine that only the Office of South and
Central Asia and the Near East and the Office of Africa, Europe, the Americas and Asia were
reasonably likely to maintain responsive records. But “courts in this jurisdiction have long held
that [agency] declarants may rely on ‘information they have obtained in the course of their
official duties.’” Canning v. U.S. Dep’t of State, 134 F. Supp. 3d 490, 510 (D.D.C. 2015)
(quoting Barnard, 598 F. Supp. 2d at 19); Cucci v. DEA, 871 F. Supp. 508, 513 (D.D.C. 1994);
33
Inst. for Policy Studies v. CIA, 885 F. Supp. 2d 120, 133 (D.D.C. 2012)). Thus, “declarations
that contain hearsay in recounting searches for documents are generally acceptable.” Gov’t
Accountability Project v. DOJ, 852 F. Supp. 2d 14, 23 (D.D.C. 2012) (internal quotation and
alteration marks omitted).
Third, Hillier claims that the Stein declaration does not adequately explain why the
Office of South and Central Asia and the Near East and the Office of Africa, Europe, the
Americas and Asia were the only components that were likely to have responsive records. The
Court disagrees. Stein explained that the Office of Information Programs and Services
determined that CT was the component that maintains records in STATE-06, the system Hillier
requested be searched. Stein Decl. ¶¶ 4, 9. The Director of Regional Affairs in CT further
determined that the Office of South and Central Asia and the Near East and the Office of Africa,
Europe, the Americas and Asia were the “only CT components reasonably likely to maintain
responsive records” because “all CT records that reference an American involved with terrorist
activities would pass through these offices.” Id. ¶ 11. As noted, Hillier identified himself as
someone believed to be involved in terrorist incidents. 2d Am. Compl. Ex. 34 at 1. Thus, it was
reasonable for the agency to conduct searches in systems used by the components through which
all records referencing Americans involved with terrorism would pass.
Fourth, Hillier argues that Stein’s declaration is defective because paragraph 10 of the
declaration states that CT maintains records about American citizens involved in terrorist
incidents overseas or who have been captured by a terrorist organization. According to Hillier,
that statement is inconsistent with a Department of State publication that indicates that the
system of records includes American citizens involved in terrorist incidents “vel non.” Pl.’s
Opp’n Br. at 17. Hillier also claims that Stein’s statement that all STATE-06 records are
34
electronic, Stein Decl. ¶ 12, conflicts with a more than 40-year-old (1977) Department of State
System of Records Notice (SORN) that states “Storage: Hard copy,” see Pl.’s Opp’n Br. at 17
(quoting 42 Fed. Reg. 49702). Neither of these alleged inconsistencies, however, create a
genuine issue of material fact because they are irrelevant to the question of whether the
Department of State conducted a search reasonably calculated to uncover Hillier’s requested
records. See Anderson, 477 U.S. at 248 (“Only disputes over facts that might affect the outcome
of the suit under the governing law will properly preclude the entry of summary judgment.
Factual disputes that are irrelevant or unnecessary will not be counted.”).
Finally, Hillier argues that the Department of State acted in bad faith by delaying its
responses to his requests. It is well established, however, that “delays in responding to a FOIA
request are rarely, if ever, grounds for discrediting later affidavits by the agency.” Iturralde v.
Comptroller of Currency, 315 F.3d 311, 315 (D.C. Cir. 2003). 15 The delays alleged here do not
undermine the Stein declaration. Because the declaration is sufficiently detailed to conclude that
the Department of State made a good faith effort to search for the records Hillier requests using
methods that can reasonably be expected to produce the information requested, the Court finds
that the agency’s searches were adequate. See Oglesby, 920 F.2d at 68.
CONCLUSION
For the foregoing reasons, defendants’ Motion for Summary Judgment, Dkt. 40, will be
granted in part with respect to the CIA and Department of State and denied in part without
prejudice with respect to DHS. Hillier’s Motion for Partial Summary Judgment Against
15
Hillier originally made allegations of bad faith against the CIA, see Pl.’s Opp’n Br. at 45–46,
but appears to have abandoned those allegations, see Pl.’s Am. Opp’n Br. at 45-46 (attached as
Ex. 85 to Pl.’s Mot. to Amend, Dkt. 55). Regardless, the Court would reject any such challenge
for the reasons stated here.
35
Defendant United States Department of Homeland Security, Dkt. 41, will be denied without
prejudice because, without more detail about whether DHS determined that the Office of
Intelligence and Analysis was the only component with a record system that was reasonably
likely to contain responsive records, the Court is unable to conclude one way or the other
whether the search was reasonable, in which case neither party can prevail at this juncture. The
Court will deny Hillier’s Cross-Motion for Partial Summary Judgment Against the Central
Intelligence Agency and United States Department of State, Dkt. 48, because the Court holds
that the searches conducted by those agencies were reasonable and the CIA’s Glomar response
was compliant with both the Privacy Act and FOIA. Hillier ably raised numerous arguments
throughout the litigation of his Privacy Act requests and his remaining motions are addressed in
the accompanying order.
_________________________
DABNEY L. FRIEDRICH
United States District Judge
September 12, 2018
36