Buzzfeed Inc. v. U.S. Department of Homeland Security

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
BUZZFEED, INC.,
Plaintiff,
v.
No. 19-cv-03062 (DLF)
U.S. DEPARTMENT OF HOMELAND
SECURITY et al.,
Defendants.
MEMORANDUM OPINION
In this action, Buzzfeed challenges the U.S. Customs and Border Protection’s (CBP)
withholding of documents under the Freedom of Information Act (FOIA), 5 U.S.C. § 552.
Before the Court is the Department’s Motion for Summary Judgment, Dkt. 37, and the plaintiff’s
Cross-Motion for Summary Judgment, Dkt. 39. For the reasons that follow, the Court will grant
the Department’s motion in part and deny it in part, deny the plaintiff’s motion, and direct the
Department to file a supplemental declaration addressing the issues highlighted in this opinion.
I. BACKGROUND
On July 2, 2019, the Inspector General of the Department of Homeland Security (DHS)
issued an alert on overcrowding and prolonged detention of adults and children in the Rio
Grande Valley (RGV Alert). Def.’s Stmt. of Material Facts ¶ 1, Dkt. 37-1; Howard Decl. ¶ 13,
Dkt. 37-3. The next day, Buzzfeed requested “any and all databases containing records on which
the calculation in” the RGV Alert “are based” including “a full and up-to-date copy of the
database(s) referenced in the above custody database.” Howard Decl. ¶¶ 5, 15. Buzzfeed’s
request “also demanded all records from 2010 through the date of the search documenting the
structure and use of databases relied upon, to specifically include user manuals, schemas, layout,
relationships, and definitions of variables.” Id. ¶ 17.
Buzzfeed filed the instant case on October 14, 2019. See generally Compl., Dkt. 1. CBP
answered on December 29, 2019. See generally Answer, Dkt. 11. The agency determined that
Border Patrol was the division most likely to have responsive information, and it was likely to be
stored “within the Enforcement Integrated Database (EID).” Howard Decl. ¶¶ 19, 21. The EID
is a shared DHS database “owned and operated by U.S. Immigration and Customs Enforcement
(ICE).” Id. ¶ 21. The database “captures and maintains information related to the investigation,
arrest, booking, detention, and removal of persons encountered during immigration and criminal
law enforcement investigations and operations conducted by DHS components.” Id.Over the following months, CBP worked with Buzzfeed to “narrow and clarify the scope
of” the request. Id. ¶ 24. In November 2020, this resulted in “a spreadsheet file for each fiscal
year from FY2010 to FY2020” with “over 4,423,000 unredacted rows of responsive data.” Id.
¶ 25. Each row contained the following data fields: Border Patrol sector, Date and Time of
Apprehension, Citizenship, Gender, Age, Demographic, Time in the U.S., Data and Time of
Initial Booking, Date and Time of Final Booking, Time in Custody. Id. ¶¶ 24–25. Buzzfeed
sought additional data for each individual that CBP withheld: facility name, alien registration
number (A-number) or “some other ‘unique identifier’ that would permit [p]laintiff to track
individuals and aggregate their records across multiple data sets,” justification for missing data,
and “technical documentation revealing the underlying structure, code, and maintenance of the
Department of Homeland Security’s Enforcement Integrated Database.” Id. ¶ 26.
CBP justified its withholdings under three FOIA exemptions: Exemptions 6, 7(C), and
7(E). Id. ¶¶ 27–29. Exemption 7(E) allows the withholding of law enforcement records or
2
information that would disclose techniques or procedures of investigations or prosecutions. Id.
¶ 29. Under this exemption, CBP withheld both the specific “Border Patrol station or operational
site” for each CBP encounter and documentation of the EID’s structure and use. Id. ¶¶ 30, 38.
Exemption 6 allows the withholding of personnel, medical, and similar personally identifying
private information. Id. ¶ 27. Exemption 7(C) allows the same as to “law enforcement records
or information that could reasonably be expected to constitute an unwarranted invasion of
personal privacy.” Id. ¶ 28. Under these exemptions, CBP withheld the A-number associated
with each entry and any other “similar unique identifier[] that would enable tracking and
aggregation of data about individuals across multiple data sets.” Id. ¶ 34.
The parties have filed cross-motions for summary judgment. See generally Defs.’ Mot.
for Summ. J., Dkt. 37; Pl.’s Cross-Mot. for Summ. J., Dkt. 39. Buzzfeed does not challenge the
adequacy of the government’s searches for responsive records, see Pl.’s Mem. in Supp. of Cross-
Mot. for Summ. J. at 4 n.1, Dkt. 39-1, nor does it object to all of CBP’s withholdings, just those
that reveal (1) unique identifying information about individuals, (2) detention locations, and (3)
technical documentation about the EID, see id. at 1–2.
II. LEGAL STANDARDS
Rule 56 of the Federal Rules of Civil Procedure states that “[t]he court shall grant
summary judgment if the movant shows that there is no genuine dispute as to any material fact
and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). When a
federal agency moves for summary judgment in a FOIA case, the court views all facts and
inferences in the light most favorable to the requester, and the agency bears the burden of
showing that it complied with FOIA. Chambers v. U.S. Dep’t of Interior, 568 F.3d 998, 1003
(D.C. Cir. 2009).
3
To prevail under Rule 56, a federal agency “must prove that each document that falls
within the class requested either has been produced, is unidentifiable, or is wholly exempt from
the (FOIA) inspection requirements.” Perry v. Block, 684 F.2d 121, 126 (D.C. Cir. 1982) (per
curiam) (citation omitted). The agency “must show beyond material doubt . . . that it has
conducted a search reasonably calculated to uncover all relevant documents,” Weisberg v. U.S.
Dep’t of Justice, 705 F.2d 1344, 1351 (D.C. Cir. 1983), and must also explain why any of the
nine enumerated exemptions listed in 5 U.S.C. § 552(b) apply to withheld information, see
Judicial Watch, Inc. v. FDA, 449 F.3d 141, 147 (D.C. Cir. 2006); see also Mobley v. CIA,
806 F.3d 568, 580 (D.C. Cir. 2015) (agency bears burden of justifying application of exemptions,
“which are exclusive and must be narrowly construed”).
“The peculiarities inherent in FOIA litigation, with the responding agencies often in sole
possession of requested records and with information searches conducted only by agency
personnel, have led federal courts to rely on government affidavits to determine whether the
statutory obligations of the FOIA have been met.” Perry, 684 F.2d at 126. Agency affidavits are
entitled to a presumption of good faith, see SafeCard Servs. v. SEC, 926 F.2d 1197, 1200
(D.C. Cir. 1991), and a court may grant summary judgment based on an affidavit if it contains
reasonably specific detail and if neither contradictory record evidence nor evidence of bad faith
calls it into question, see Judicial Watch, Inc. v. U.S. Secret Serv., 726 F.3d 208, 215
(D.C. Cir. 2013). The “vast majority of FOIA cases can be resolved on summary judgment.”
Brayton v. Off. of the U.S. Trade Representative, 641 F.3d 521, 527 (D.C. Cir. 2011).
4
III. ANALYSIS
A. Exemption 6 and 7(C)
“FOIA Exemptions 6 and 7(C) seek to protect the privacy of individuals identified in
certain agency records.” ACLU v. DOJ, 655 F.3d 1, 6 (D.C. Cir. 2011). Exemption 6 protects
“personnel and medical files and similar files the disclosure of which would constitute a clearly
unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6), and Exemption 7(C) protects
“records or information compiled for law enforcement purposes” that “could reasonably be
expected to constitute an unwarranted invasion of personal privacy,” id. § 552(b)(7)(C). When
an agency invokes both exemptions, courts “focus” on Exemption 7(C) because it “establishes a
lower bar for withholding material.” Citizens for Responsibility & Ethics in Wash. v. DOJ
(CREW I), 746 F.3d 1082, 1091 n.2 (D.C. Cir. 2014) (internal quotation marks omitted). CBP
withheld A-numbers and any other similar unique database identifiers under both exemptions.
Howard Decl. ¶¶ 34–37.
Under Exemption 7(C), courts balance the privacy interests implicated by the records
being sought against the public’s interest in their disclosure. Citizens for Responsibility & Ethics
in Wash. v. DOJ (CREW II), 854 F.3d 675, 681 (D.C. Cir. 2017). The government “must
account for the privacy interests at stake, recognizing that previous disclosures or admissions
may have diminished those interests.” Id. at 683. But if the withheld information implicates a
substantial privacy interest, the FOIA requester “bears the burden of showing (1) that ‘the public
interest sought to be advanced is a significant one, an interest more specific than having the
information for its own sake,’ and (2) that the information [it] seeks ‘is likely to advance that
interest.’” Roth v. DOJ, 642 F.3d 1161, 1175 (D.C. Cir. 2011) (quoting Nat’l Archives &
Records Admin. v. Favish, 541 U.S. 157, 172 (2004)). It is well established that “the only public
5
interest relevant for purposes of Exemption 7(C) is one that focuses on the citizens’ right to be
informed about what their government is up to.” Sussman v. U.S. Marshals Serv., 494 F.3d
1106, 1115 (D.C. Cir. 2007) (internal quotation marks omitted).
CBP’s declaration discusses privacy concerns related to the release of A-numbers, but not
to any other unique database identifiers. See Howard Decl. ¶¶ 34–37. The agency explains that
A-numbers, unlike unique database identifiers, are used in contexts other than the EID, and so
their release could reveal immigrants’ identities in a way that a database identifier would not.
See Howard Decl. ¶¶ 34–37; Rojas-Vega v. U.S. Citizenship & Immig. Serv., No. 13-1540, 2014
WL 12614416, at *5 (D.D.C. Sep. 30, 2014) (explaining that all of an immigrant’s USCIS
transactions are tracked by A-number). But because Buzzfeed is willing to accept unique
database identifiers that would enable it to track individuals across multiple datasets and be less
personally identifying than A-numbers, see Pl.’s Opp’n at 4, the Court declines at this time to
decide whether CBP can withhold A-numbers under Exemption 7(C).
Instead, the Court will direct CBP to supplement its declaration to address whether there
are any alternate unique database identifiers, and if there are, to identify the privacy interests
associated with each. The Department’s briefing states that the existence of any unique database
identifiers is “pure speculation,” Def.’s Reply at 5, but the Howard Declaration does not deny
their existence, see Howard Decl. ¶¶ 34–37. Nor does it provide a Glomar response that neither
confirmed nor denied the existence of any unique database identifiers. See People for the Ethical
Treatment of Animals v. Nat’l Insts. of Health, Dep’t of Health & Human Servs., 745 F.3d 535,
540 (D.C. Cir. 2014) (explaining that an agency can refuse to acknowledge the existence of
records in certain circumstances and providing the background of the Hughes Glomar Explorer).
And there is reason to suspect that such identifiers exist. Indeed, in a separate case, another
6
agency acknowledged their existence. See Am. Immig. Council v. U.S. Immig. & Customs Enf’t,
464 F. Supp. 3d 228, 242 (D.D.C. 2020) (“ICE has produced data from EID in recent cases and
its own declarant acknowledges that person-centric unique identifiers are reasonably likely to be
found in EID[.]”). Because the current record does not contain sufficient detail about the privacy
concerns associated with the release of alternate unique database identifiers (other than the A-
number), the Court cannot weigh the privacy versus the public interests, as required under
Exemption 7(C). See CEI Wash. Bureau, Inc. v. DOJ, 469 F.3d 126, 128–29 (D.C. Cir. 2006)
(holding that summary judgment was inappropriate because of factual disputes relevant to the
court’s balancing of individual privacy and public scrutiny under Exemption 7(C)).
Accordingly, the Court will not rule on Buzzfeed’s request for individual identifying
information now but will instead deny CBP’s motion without prejudice and order it to file a
supplemental declaration. This declaration shall state whether any unique identifiers (other than
the A-number) exist in the EID and address the privacy interests with respect to any such
identifiers. This new declaration shall also address how the release of A-numbers would invade
the individuals’ privacy without knowledge of their names, addresses, dates of birth, or other
identifying information. See, e.g., Heartland All. for Human Needs & Human Rights v. U.S.
Immig. & Customs Enf’t, 406 F. Supp. 3d 90, 124 (D.D.C. 2019) (“order[ing] ICE to provide a
supplemental declaration addressing the deficiencies identified” by the Court); see also
Campbell v. U.S. Dep’t of Justice, 164 F.3d 20, 31 (D.C. Cir. 1998) (explaining that a new
declaration “is favored where agency affidavits are facially inadequate” because “otherwise the
district court is effectively left to speculate about” whether a document qualifies for
withholding).
7
B. Exemption 7(E)
Exemption 7(E) protects “records or information compiled for law enforcement purposes,
but only to the extent that the production of such law enforcement records or information . . .
would disclose techniques and procedures for law enforcement investigations or prosecutions . . .
if such disclosure could reasonably be expected to risk circumvention of the law.” 5 U.S.C.
§ 552(b)(7). The exemption does not ordinarily protect “routine techniques and procedures
already well known to the public.” Founding Church of Scientology of Wash., D.C. v. NSA, 610
F.2d 824, 832 n.67 (D.C. Cir. 1979) (internal quotation marks omitted); see also Judicial Watch
v. U.S. Dep’t of Commerce, 337 F. Supp. 2d 146, 181 (D.D.C. 2004) (citation omitted). It does,
however, protect “confidential details of . . . program[s]” if only their “general contours [are]
publicly known.” Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1112 (D.C. Cir. 2007)
(citing Blanton v. DOJ, 64 Fed. App’x 787, 788–89 (D.C. Cir. 2003) (per curiam)); see also
Shapiro v. DOJ, 893 F.3d 796, 801 (D.C. Cir. 2018) (permitting the government to withhold
documents that would disclose the way in which the FBI uses a particular publicly known
database). In this Circuit, Exemption 7(E) applies if the disclosure of information related to even
“commonly known procedures” could “reduce or nullify their effectiveness.” Vazquez v. DOJ,
887 F. Supp. 2d 114, 116 (D.D.C. 2012) (internal quotation marks omitted), aff'd, No. 13-5197,
2013 WL 6818207 (D.C. Cir. Dec. 18, 2013) (per curiam).
CBP has justified the withholding of two types of information under Exemption 7(E).
First, CBP withheld the specific Border Patrol station or operational site (but not the sector)
where each encounter took place. Howard Decl. ¶¶ 30–31. Second, CBP withheld “records
documenting the structure and use of EID, including manuals, schemas, layout relationships, and
definitions of variables.” Id. ¶ 38. The Court will address each in turn.
8
1. Specific location information
CBP withheld under Exemption 7(E) information about specific “Border Patrol station[s]
or operational site[s]” because “[f]urther parsing of the location data, in a data production of this
size, would disclose law enforcement sensitive techniques and procedures, and enable
circumvention of law enforcement by yielding patterns and inferences about operational
capacity, staffing, resource allocation, and transfer routes.” Id. ¶¶ 30–31. In particular, CBP
predicts that “[d]isclosure of the requested information would inform would-be violators which
sites are most vulnerable, and the circumstances under which Border Patrol is prompted to
redistribute entrants or personnel between stations.” Id. ¶ 33. This would allow “third parties to
circumvent the law by altering smuggling routes and patterns of conduct, adopting new methods
of criminal operation, and effectuating other countermeasures to law enforcement operations, or
planning disruptions of law enforcement operations in violation of criminal and immigration
laws.” Id.Another court in this district previously analyzed Border Patrol apprehension location
data and found the withholding justified under Exemption 7(E). Am. Immig. Council, 464 F.
Supp. 3d at 244–45. That court explained that the “over 1 million points of location data” would
provide would-be criminals information that would allow them “to evade arrest or
apprehension.” Id. at 245. This cleared Exemption 7(E)’s “relatively low bar . . . that release of
documents might increase the risk that a law will be violated.” Id. at 244 (quoting Pub. Emps.
for Env’t Responsibility v. U.S. Section, Int’l Boundary & Water Comm’n, 740 F.3d 195, 205
(D.C. Cir. 2014) (emphasis added)).
CBP insists that the same logic applies here. In particular, CBP contends that the release
of detention center information would provide over 4 million points of location data that would
9
enable human traffickers and smugglers to evade the law. See Howard Decl. ¶ 25; Ctr. for Nat’l
Sec. Studies v. DOJ, 331 F.3d 918, 928–29 (D.C. Cir. 2003) (recognizing in the national security
context that, even when a single data point is innocuous, the government can justify withholding
on the basis that disclosure of a vast array of innocuous points can jeopardize investigations); see
also Reporters Comm. for Freedom of the Press v. FBI, 548 F. Supp. 3d 185, 203 (D.D.C. 2021)
(concluding that revealing FBI unit location data “could reveal what kinds of crimes and
geographic areas the agency prioritizes” and this information about resource allocation could
“create a risk that wrongdoers will exploit the information to violate the law or escape the
consequences of doing so”).1
The Court agrees that “[E]xemption [7(E)] is written in broad and general terms,” Mayer
Brown LLP v. IRS, 562 F.3d 1190, 1193 (D.C. Cir. 2009), and covers “internal agency materials
relating to guidelines, techniques, sources, and procedures for law enforcement investigations
and prosecutions, even when the materials have not been compiled in the course of a
specific investigation,” Tax Analysts v. IRS, 294 F.3d 71, 79 (D.C. Cir. 2002). Cf. Gilman v.
DHS, 32 F. Supp. 3d 1, 19 (D.D.C. 2014) (recognizing that “assessment of border vulnerabilities
is directly related to the potential violation of federal immigration laws and the CBP’s duty to
deter illegal immigration and to apprehend illegal immigrants”). But what remains unclear is
how the release of detention center information, as opposed to the apprehension location
information, would enable traffickers and others to evade law enforcement. The Howard
Declaration does not provide sufficient information for the Court to draw this conclusion. Thus,
1
Unlike in Exemption 5 cases, see, e.g., Reps. Comm. for Freedom of the Press v. FBI, 3 F.4th
350, 370 (D.C. Cir. 2021), no further foreseeable harm analysis is needed because “Exemption
7(E) by its own terms already requires that an agency show a risk of foreseeable harm,” Reps.
Comm. of Freedom of the Press v. U.S. CBP, 567 F. Supp. 3d 97 (D.D.C. 2021) (citations
omitted).
10
the Court will direct CBP to explain in its supplemental declaration how disclosure of this
information would reveal apprehension location, as well as staffing, resource allocation, and
transfer route information, see Howard Decl. ¶¶ 31–33, and thereby lead to the circumvention of
the immigration laws. See, e.g., Heartland All., 406 F. Supp. 3d at 124; see also Campbell, 164
F.3d at 31.
2. EID documentation
CBP also withheld “a decade’s worth of records documenting the structure and use of
EID, including manuals, schemas, layout relationships, and definitions of variables, i.e. the keys
and blueprints to the Department’s enforcement data infrastructure.” Howard Decl. ¶ 38. It
justified its withholding under Exemption 7(E) on the grounds that the release of “[s]uch
technical, law enforcement sensitive material . . . would facilitate breach, sabotage, alteration, or
manipulation of the Department’s law enforcement database.” Id. “Courts have repeatedly
recognized the risk of a cyber-attack as valid grounds for withholding under Exemption 7(E)”
and accordingly “have affirmed the withholding of information related to databases—metadata,
codes, and structures—under Exemption 7(E) for risk of cyber-attack or data breach.” Shapiro v.
DOJ, 393 F. Supp. 3d 111, 122 (D.D.C. 2019) (cleaned up).
Another court in this district has analyzed schema information relating to the EID. See
Long v. ICE, 464 F. Supp. 3d 409 (D.D.C. 2020). The Long Court concluded that disclosure of
EID schema would allow hackers to access the database more easily and more effectively, cause
more damage to the database, and escape detection more easily. See id. at 419–23. Hackers
would be able to do this, according to ICE’s witness, by setting up their own database to practice
attacks and perfect their methodology. See id. at 419. Manuals and layout relationships would
provide similarly useful material and “could reasonably be expected to risk circumvention of the
11
law.” 5 U.S.C. § 552(b)(7)(E). Although it is true, as the plaintiffs note, that the government has
not provided a “case-specific” explanation for the risk, Pl.’s Opp’n at 13, the risk does not differ
from that in Long because that case involved the same database at issue here. Therefore, the
Court concludes that CBP properly withheld schemas, manuals, and relationships under
Exemption 7(E).
It is less clear, however, whether CBP properly withheld other records under Exemption
7(E). In fact, the Long Court concluded that certain information that appears to have included
variable definitions from the EID “could be released without creating an unacceptable threat to
the security of the EID.” 464 F. Supp. 3d at 424; see id. at 423–25. ICE’s expert testified in
Long that the disclosure of certain codes, code translations, and field names would not create a
security risk to the EID or other databases. See id. at 424. The court then ordered ICE to release
some information from the EID after it conducted a segregability analysis. Id. at 425. Because
this Court cannot determine from the Howard Declaration and the parties’ briefing whether the
information that the CBP withheld here is different than the information that ICE produced in
Long, the Court will also direct the agency to address in its supplemental declaration the
distinctions, if any, between information requested here and that disclosed in Long. The agency
shall also address whether the testimony and record in that 2020 case remains applicable and
accurate. See, e.g., Heartland All., 406 F. Supp. 3d at 124; see also Campbell, 164 F.3d at 31.
12
CONCLUSION
For the foregoing reasons, the defendant’s Motion for Summary Judgment is granted in
part and denied without prejudice in part and the plaintiff’s Cross-Motion for Summary
Judgment is denied with prejudice in part and denied without prejudice in part. A separate order
consistent with this decision accompanies this memorandum opinion.
________________________
DABNEY L. FRIEDRICH
United States District Judge
June 27, 2022
13