Buzzfeed Inc. v. U.S. Department of Homeland Security

UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

BUZZFEED, INC.,

Plaintiff,

v.

No. 19-cv-03062 (DLF)

U.S. DEPARTMENT OF HOMELAND

SECURITY et al.,

Defendants.

MEMORANDUM OPINION

In this action, Buzzfeed challenges the U.S. Customs and Border Protection’s (CBP)

withholding of documents under the Freedom of Information Act (FOIA), 5 U.S.C. § 552.

Before the Court is the Department’s Motion for Summary Judgment, Dkt. 37, and the plaintiff’s

Cross-Motion for Summary Judgment, Dkt. 39. For the reasons that follow, the Court will grant

the Department’s motion in part and deny it in part, deny the plaintiff’s motion, and direct the

Department to file a supplemental declaration addressing the issues highlighted in this opinion.

I. BACKGROUND

On July 2, 2019, the Inspector General of the Department of Homeland Security (DHS)

issued an alert on overcrowding and prolonged detention of adults and children in the Rio

Grande Valley (RGV Alert). Def.’s Stmt. of Material Facts ¶ 1, Dkt. 37-1; Howard Decl. ¶ 13,

Dkt. 37-3. The next day, Buzzfeed requested “any and all databases containing records on which

the calculation in” the RGV Alert “are based” including “a full and up-to-date copy of the

database(s) referenced in the above custody database.” Howard Decl. ¶¶ 5, 15. Buzzfeed’s

request “also demanded all records from 2010 through the date of the search documenting the

structure and use of databases relied upon, to specifically include user manuals, schemas, layout,

relationships, and definitions of variables.” Id. ¶ 17.

Buzzfeed filed the instant case on October 14, 2019. See generally Compl., Dkt. 1. CBP

answered on December 29, 2019. See generally Answer, Dkt. 11. The agency determined that

Border Patrol was the division most likely to have responsive information, and it was likely to be

stored “within the Enforcement Integrated Database (EID).” Howard Decl. ¶¶ 19, 21. The EID

is a shared DHS database “owned and operated by U.S. Immigration and Customs Enforcement

(ICE).” Id. ¶ 21. The database “captures and maintains information related to the investigation,

arrest, booking, detention, and removal of persons encountered during immigration and criminal

law enforcement investigations and operations conducted by DHS components.” Id.

Over the following months, CBP worked with Buzzfeed to “narrow and clarify the scope

of” the request. Id. ¶ 24. In November 2020, this resulted in “a spreadsheet file for each fiscal

year from FY2010 to FY2020” with “over 4,423,000 unredacted rows of responsive data.” Id.

¶ 25. Each row contained the following data fields: Border Patrol sector, Date and Time of

Apprehension, Citizenship, Gender, Age, Demographic, Time in the U.S., Data and Time of

Initial Booking, Date and Time of Final Booking, Time in Custody. Id. ¶¶ 24–25. Buzzfeed

sought additional data for each individual that CBP withheld: facility name, alien registration

number (A-number) or “some other ‘unique identifier’ that would permit [p]laintiff to track

individuals and aggregate their records across multiple data sets,” justification for missing data,

and “technical documentation revealing the underlying structure, code, and maintenance of the

Department of Homeland Security’s Enforcement Integrated Database.” Id. ¶ 26.

CBP justified its withholdings under three FOIA exemptions: Exemptions 6, 7(C), and

7(E). Id. ¶¶ 27–29. Exemption 7(E) allows the withholding of law enforcement records or

2

information that would disclose techniques or procedures of investigations or prosecutions. Id.

¶ 29. Under this exemption, CBP withheld both the specific “Border Patrol station or operational

site” for each CBP encounter and documentation of the EID’s structure and use. Id. ¶¶ 30, 38.

Exemption 6 allows the withholding of personnel, medical, and similar personally identifying

private information. Id. ¶ 27. Exemption 7(C) allows the same as to “law enforcement records

or information that could reasonably be expected to constitute an unwarranted invasion of

personal privacy.” Id. ¶ 28. Under these exemptions, CBP withheld the A-number associated

with each entry and any other “similar unique identifier[] that would enable tracking and

aggregation of data about individuals across multiple data sets.” Id. ¶ 34.

The parties have filed cross-motions for summary judgment. See generally Defs.’ Mot.

for Summ. J., Dkt. 37; Pl.’s Cross-Mot. for Summ. J., Dkt. 39. Buzzfeed does not challenge the

adequacy of the government’s searches for responsive records, see Pl.’s Mem. in Supp. of Cross-

Mot. for Summ. J. at 4 n.1, Dkt. 39-1, nor does it object to all of CBP’s withholdings, just those

that reveal (1) unique identifying information about individuals, (2) detention locations, and (3)

technical documentation about the EID, see id. at 1–2.

II. LEGAL STANDARDS

Rule 56 of the Federal Rules of Civil Procedure states that “[t]he court shall grant

summary judgment if the movant shows that there is no genuine dispute as to any material fact

and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). When a

federal agency moves for summary judgment in a FOIA case, the court views all facts and

inferences in the light most favorable to the requester, and the agency bears the burden of

showing that it complied with FOIA. Chambers v. U.S. Dep’t of Interior, 568 F.3d 998, 1003

(D.C. Cir. 2009).

3

To prevail under Rule 56, a federal agency “must prove that each document that falls

within the class requested either has been produced, is unidentifiable, or is wholly exempt from

the (FOIA) inspection requirements.” Perry v. Block, 684 F.2d 121, 126 (D.C. Cir. 1982) (per

curiam) (citation omitted). The agency “must show beyond material doubt . . . that it has

conducted a search reasonably calculated to uncover all relevant documents,” Weisberg v. U.S.

Dep’t of Justice, 705 F.2d 1344, 1351 (D.C. Cir. 1983), and must also explain why any of the

nine enumerated exemptions listed in 5 U.S.C. § 552(b) apply to withheld information, see

Judicial Watch, Inc. v. FDA, 449 F.3d 141, 147 (D.C. Cir. 2006); see also Mobley v. CIA,

806 F.3d 568, 580 (D.C. Cir. 2015) (agency bears burden of justifying application of exemptions,

“which are exclusive and must be narrowly construed”).

“The peculiarities inherent in FOIA litigation, with the responding agencies often in sole

possession of requested records and with information searches conducted only by agency

personnel, have led federal courts to rely on government affidavits to determine whether the

statutory obligations of the FOIA have been met.” Perry, 684 F.2d at 126. Agency affidavits are

entitled to a presumption of good faith, see SafeCard Servs. v. SEC, 926 F.2d 1197, 1200

(D.C. Cir. 1991), and a court may grant summary judgment based on an affidavit if it contains

reasonably specific detail and if neither contradictory record evidence nor evidence of bad faith

calls it into question, see Judicial Watch, Inc. v. U.S. Secret Serv., 726 F.3d 208, 215

(D.C. Cir. 2013). The “vast majority of FOIA cases can be resolved on summary judgment.”

Brayton v. Off. of the U.S. Trade Representative, 641 F.3d 521, 527 (D.C. Cir. 2011).

4

III. ANALYSIS

A. Exemption 6 and 7(C)

“FOIA Exemptions 6 and 7(C) seek to protect the privacy of individuals identified in

certain agency records.” ACLU v. DOJ, 655 F.3d 1, 6 (D.C. Cir. 2011). Exemption 6 protects

“personnel and medical files and similar files the disclosure of which would constitute a clearly

unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6), and Exemption 7(C) protects

“records or information compiled for law enforcement purposes” that “could reasonably be

expected to constitute an unwarranted invasion of personal privacy,” id. § 552(b)(7)(C). When

an agency invokes both exemptions, courts “focus” on Exemption 7(C) because it “establishes a

lower bar for withholding material.” Citizens for Responsibility & Ethics in Wash. v. DOJ

(CREW I), 746 F.3d 1082, 1091 n.2 (D.C. Cir. 2014) (internal quotation marks omitted). CBP

withheld A-numbers and any other similar unique database identifiers under both exemptions.

Howard Decl. ¶¶ 34–37.

Under Exemption 7(C), courts balance the privacy interests implicated by the records

being sought against the public’s interest in their disclosure. Citizens for Responsibility & Ethics

in Wash. v. DOJ (CREW II), 854 F.3d 675, 681 (D.C. Cir. 2017). The government “must

account for the privacy interests at stake, recognizing that previous disclosures or admissions

may have diminished those interests.” Id. at 683. But if the withheld information implicates a

substantial privacy interest, the FOIA requester “bears the burden of showing (1) that ‘the public

interest sought to be advanced is a significant one, an interest more specific than having the

information for its own sake,’ and (2) that the information [it] seeks ‘is likely to advance that

interest.’” Roth v. DOJ, 642 F.3d 1161, 1175 (D.C. Cir. 2011) (quoting Nat’l Archives &

Records Admin. v. Favish, 541 U.S. 157, 172 (2004)). It is well established that “the only public

5

interest relevant for purposes of Exemption 7(C) is one that focuses on the citizens’ right to be

informed about what their government is up to.” Sussman v. U.S. Marshals Serv., 494 F.3d

1106, 1115 (D.C. Cir. 2007) (internal quotation marks omitted).

CBP’s declaration discusses privacy concerns related to the release of A-numbers, but not

to any other unique database identifiers. See Howard Decl. ¶¶ 34–37. The agency explains that

A-numbers, unlike unique database identifiers, are used in contexts other than the EID, and so

their release could reveal immigrants’ identities in a way that a database identifier would not.

See Howard Decl. ¶¶ 34–37; Rojas-Vega v. U.S. Citizenship & Immig. Serv., No. 13-1540, 2014

WL 12614416, at *5 (D.D.C. Sep. 30, 2014) (explaining that all of an immigrant’s USCIS

transactions are tracked by A-number). But because Buzzfeed is willing to accept unique

database identifiers that would enable it to track individuals across multiple datasets and be less

personally identifying than A-numbers, see Pl.’s Opp’n at 4, the Court declines at this time to

decide whether CBP can withhold A-numbers under Exemption 7(C).

Instead, the Court will direct CBP to supplement its declaration to address whether there

are any alternate unique database identifiers, and if there are, to identify the privacy interests

associated with each. The Department’s briefing states that the existence of any unique database

identifiers is “pure speculation,” Def.’s Reply at 5, but the Howard Declaration does not deny

their existence, see Howard Decl. ¶¶ 34–37. Nor does it provide a Glomar response that neither

confirmed nor denied the existence of any unique database identifiers. See People for the Ethical

Treatment of Animals v. Nat’l Insts. of Health, Dep’t of Health & Human Servs., 745 F.3d 535,

540 (D.C. Cir. 2014) (explaining that an agency can refuse to acknowledge the existence of

records in certain circumstances and providing the background of the Hughes Glomar Explorer).

And there is reason to suspect that such identifiers exist. Indeed, in a separate case, another

6

agency acknowledged their existence. See Am. Immig. Council v. U.S. Immig. & Customs Enf’t,

464 F. Supp. 3d 228, 242 (D.D.C. 2020) (“ICE has produced data from EID in recent cases and

its own declarant acknowledges that person-centric unique identifiers are reasonably likely to be

found in EID[.]”). Because the current record does not contain sufficient detail about the privacy

concerns associated with the release of alternate unique database identifiers (other than the A-

number), the Court cannot weigh the privacy versus the public interests, as required under

Exemption 7(C). See CEI Wash. Bureau, Inc. v. DOJ, 469 F.3d 126, 128–29 (D.C. Cir. 2006)

(holding that summary judgment was inappropriate because of factual disputes relevant to the

court’s balancing of individual privacy and public scrutiny under Exemption 7(C)).

Accordingly, the Court will not rule on Buzzfeed’s request for individual identifying

information now but will instead deny CBP’s motion without prejudice and order it to file a

supplemental declaration. This declaration shall state whether any unique identifiers (other than

the A-number) exist in the EID and address the privacy interests with respect to any such

identifiers. This new declaration shall also address how the release of A-numbers would invade

the individuals’ privacy without knowledge of their names, addresses, dates of birth, or other

identifying information. See, e.g., Heartland All. for Human Needs & Human Rights v. U.S.

Immig. & Customs Enf’t, 406 F. Supp. 3d 90, 124 (D.D.C. 2019) (“order[ing] ICE to provide a

supplemental declaration addressing the deficiencies identified” by the Court); see also

Campbell v. U.S. Dep’t of Justice, 164 F.3d 20, 31 (D.C. Cir. 1998) (explaining that a new

declaration “is favored where agency affidavits are facially inadequate” because “otherwise the

district court is effectively left to speculate about” whether a document qualifies for

withholding).

7

B. Exemption 7(E)

Exemption 7(E) protects “records or information compiled for law enforcement purposes,

but only to the extent that the production of such law enforcement records or information . . .

would disclose techniques and procedures for law enforcement investigations or prosecutions . . .

if such disclosure could reasonably be expected to risk circumvention of the law.” 5 U.S.C.

§ 552(b)(7). The exemption does not ordinarily protect “routine techniques and procedures

already well known to the public.” Founding Church of Scientology of Wash., D.C. v. NSA, 610

F.2d 824, 832 n.67 (D.C. Cir. 1979) (internal quotation marks omitted); see also Judicial Watch

v. U.S. Dep’t of Commerce, 337 F. Supp. 2d 146, 181 (D.D.C. 2004) (citation omitted). It does,

however, protect “confidential details of . . . program[s]” if only their “general contours [are]

publicly known.” Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1112 (D.C. Cir. 2007)

(citing Blanton v. DOJ, 64 Fed. App’x 787, 788–89 (D.C. Cir. 2003) (per curiam)); see also

Shapiro v. DOJ, 893 F.3d 796, 801 (D.C. Cir. 2018) (permitting the government to withhold

documents that would disclose the way in which the FBI uses a particular publicly known

database). In this Circuit, Exemption 7(E) applies if the disclosure of information related to even

“commonly known procedures” could “reduce or nullify their effectiveness.” Vazquez v. DOJ,

887 F. Supp. 2d 114, 116 (D.D.C. 2012) (internal quotation marks omitted), aff'd, No. 13-5197,

2013 WL 6818207 (D.C. Cir. Dec. 18, 2013) (per curiam).

CBP has justified the withholding of two types of information under Exemption 7(E).

First, CBP withheld the specific Border Patrol station or operational site (but not the sector)

where each encounter took place. Howard Decl. ¶¶ 30–31. Second, CBP withheld “records

documenting the structure and use of EID, including manuals, schemas, layout relationships, and

definitions of variables.” Id. ¶ 38. The Court will address each in turn.

8

1. Specific location information

CBP withheld under Exemption 7(E) information about specific “Border Patrol station[s]

or operational site[s]” because “[f]urther parsing of the location data, in a data production of this

size, would disclose law enforcement sensitive techniques and procedures, and enable

circumvention of law enforcement by yielding patterns and inferences about operational

capacity, staffing, resource allocation, and transfer routes.” Id. ¶¶ 30–31. In particular, CBP

predicts that “[d]isclosure of the requested information would inform would-be violators which

sites are most vulnerable, and the circumstances under which Border Patrol is prompted to

redistribute entrants or personnel between stations.” Id. ¶ 33. This would allow “third parties to

circumvent the law by altering smuggling routes and patterns of conduct, adopting new methods

of criminal operation, and effectuating other countermeasures to law enforcement operations, or

planning disruptions of law enforcement operations in violation of criminal and immigration

laws.” Id.

Another court in this district previously analyzed Border Patrol apprehension location

data and found the withholding justified under Exemption 7(E). Am. Immig. Council, 464 F.

Supp. 3d at 244–45. That court explained that the “over 1 million points of location data” would

provide would-be criminals information that would allow them “to evade arrest or

apprehension.” Id. at 245. This cleared Exemption 7(E)’s “relatively low bar . . . that release of

documents might increase the risk that a law will be violated.” Id. at 244 (quoting Pub. Emps.

for Env’t Responsibility v. U.S. Section, Int’l Boundary & Water Comm’n, 740 F.3d 195, 205

(D.C. Cir. 2014) (emphasis added)).

CBP insists that the same logic applies here. In particular, CBP contends that the release

of detention center information would provide over 4 million points of location data that would

9

enable human traffickers and smugglers to evade the law. See Howard Decl. ¶ 25; Ctr. for Nat’l

Sec. Studies v. DOJ, 331 F.3d 918, 928–29 (D.C. Cir. 2003) (recognizing in the national security

context that, even when a single data point is innocuous, the government can justify withholding

on the basis that disclosure of a vast array of innocuous points can jeopardize investigations); see

also Reporters Comm. for Freedom of the Press v. FBI, 548 F. Supp. 3d 185, 203 (D.D.C. 2021)

(concluding that revealing FBI unit location data “could reveal what kinds of crimes and

geographic areas the agency prioritizes” and this information about resource allocation could

“create a risk that wrongdoers will exploit the information to violate the law or escape the

consequences of doing so”).1

The Court agrees that “[E]xemption [7(E)] is written in broad and general terms,” Mayer

Brown LLP v. IRS, 562 F.3d 1190, 1193 (D.C. Cir. 2009), and covers “internal agency materials

relating to guidelines, techniques, sources, and procedures for law enforcement investigations

and prosecutions, even when the materials have not been compiled in the course of a

specific investigation,” Tax Analysts v. IRS, 294 F.3d 71, 79 (D.C. Cir. 2002). Cf. Gilman v.

DHS, 32 F. Supp. 3d 1, 19 (D.D.C. 2014) (recognizing that “assessment of border vulnerabilities

is directly related to the potential violation of federal immigration laws and the CBP’s duty to

deter illegal immigration and to apprehend illegal immigrants”). But what remains unclear is

how the release of detention center information, as opposed to the apprehension location

information, would enable traffickers and others to evade law enforcement. The Howard

Declaration does not provide sufficient information for the Court to draw this conclusion. Thus,

1

Unlike in Exemption 5 cases, see, e.g., Reps. Comm. for Freedom of the Press v. FBI, 3 F.4th

350, 370 (D.C. Cir. 2021), no further foreseeable harm analysis is needed because “Exemption

7(E) by its own terms already requires that an agency show a risk of foreseeable harm,” Reps.

Comm. of Freedom of the Press v. U.S. CBP, 567 F. Supp. 3d 97 (D.D.C. 2021) (citations

omitted).

10

the Court will direct CBP to explain in its supplemental declaration how disclosure of this

information would reveal apprehension location, as well as staffing, resource allocation, and

transfer route information, see Howard Decl. ¶¶ 31–33, and thereby lead to the circumvention of

the immigration laws. See, e.g., Heartland All., 406 F. Supp. 3d at 124; see also Campbell, 164

F.3d at 31.

2. EID documentation

CBP also withheld “a decade’s worth of records documenting the structure and use of

EID, including manuals, schemas, layout relationships, and definitions of variables, i.e. the keys

and blueprints to the Department’s enforcement data infrastructure.” Howard Decl. ¶ 38. It

justified its withholding under Exemption 7(E) on the grounds that the release of “[s]uch

technical, law enforcement sensitive material . . . would facilitate breach, sabotage, alteration, or

manipulation of the Department’s law enforcement database.” Id. “Courts have repeatedly

recognized the risk of a cyber-attack as valid grounds for withholding under Exemption 7(E)”

and accordingly “have affirmed the withholding of information related to databases—metadata,

codes, and structures—under Exemption 7(E) for risk of cyber-attack or data breach.” Shapiro v.

DOJ, 393 F. Supp. 3d 111, 122 (D.D.C. 2019) (cleaned up).

Another court in this district has analyzed schema information relating to the EID. See

Long v. ICE, 464 F. Supp. 3d 409 (D.D.C. 2020). The Long Court concluded that disclosure of

EID schema would allow hackers to access the database more easily and more effectively, cause

more damage to the database, and escape detection more easily. See id. at 419–23. Hackers

would be able to do this, according to ICE’s witness, by setting up their own database to practice

attacks and perfect their methodology. See id. at 419. Manuals and layout relationships would

provide similarly useful material and “could reasonably be expected to risk circumvention of the

11

law.” 5 U.S.C. § 552(b)(7)(E). Although it is true, as the plaintiffs note, that the government has

not provided a “case-specific” explanation for the risk, Pl.’s Opp’n at 13, the risk does not differ

from that in Long because that case involved the same database at issue here. Therefore, the

Court concludes that CBP properly withheld schemas, manuals, and relationships under

Exemption 7(E).

It is less clear, however, whether CBP properly withheld other records under Exemption

7(E). In fact, the Long Court concluded that certain information that appears to have included

variable definitions from the EID “could be released without creating an unacceptable threat to

the security of the EID.” 464 F. Supp. 3d at 424; see id. at 423–25. ICE’s expert testified in

Long that the disclosure of certain codes, code translations, and field names would not create a

security risk to the EID or other databases. See id. at 424. The court then ordered ICE to release

some information from the EID after it conducted a segregability analysis. Id. at 425. Because

this Court cannot determine from the Howard Declaration and the parties’ briefing whether the

information that the CBP withheld here is different than the information that ICE produced in

Long, the Court will also direct the agency to address in its supplemental declaration the

distinctions, if any, between information requested here and that disclosed in Long. The agency

shall also address whether the testimony and record in that 2020 case remains applicable and

accurate. See, e.g., Heartland All., 406 F. Supp. 3d at 124; see also Campbell, 164 F.3d at 31.

12

CONCLUSION

For the foregoing reasons, the defendant’s Motion for Summary Judgment is granted in

part and denied without prejudice in part and the plaintiff’s Cross-Motion for Summary

Judgment is denied with prejudice in part and denied without prejudice in part. A separate order

consistent with this decision accompanies this memorandum opinion.

________________________

DABNEY L. FRIEDRICH

United States District Judge

June 27, 2022

13