Summary
rejecting the argument that unique identifiers are exempt under Exemption 7(E) because the agency did “not come forward with information to show that the mere possession of unique identifying information would facilitate one's ability to hack into CBP's system or that it would make a hacking more likely”
Summary of this case from Buzzfeed Inc. v. Dep't of Homeland Sec.Opinion
Civil Action No. 18-1614 (ABJ)
05-27-2020
AMERICAN IMMIGRATION COUNCIL, Plaintiff, v. U.S. IMMIGRATION AND CUSTOM ENFORCEMENT, et al., Defendants.
Creighton R. Magid, Dorsey & Whitney LLP, Emily Creighton, Legal Department, Washington, DC, Michelle S. Grant, Pro Hac Vice, Dorsey & Whitney LLP, Minneapolis, MN, Trina Ann Realmuto, Pro Hac Vice, American Immigration Council, Brookline, MA, for Plaintiff. Paul Cirino, U.S. Attorney's Office for the District of Columbia, Washington, DC, for Defendants.
Creighton R. Magid, Dorsey & Whitney LLP, Emily Creighton, Legal Department, Washington, DC, Michelle S. Grant, Pro Hac Vice, Dorsey & Whitney LLP, Minneapolis, MN, Trina Ann Realmuto, Pro Hac Vice, American Immigration Council, Brookline, MA, for Plaintiff.
Paul Cirino, U.S. Attorney's Office for the District of Columbia, Washington, DC, for Defendants.
MEMORANDUM OPINION
AMY BERMAN JACKSON, United States District Judge
Plaintiff American Immigration Council (the "Council") has brought this action against the United States Customs and Border Protection ("CBP") and the United States Immigration and Customs Enforcement ("ICE") under the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552 et seq. , seeking records on immigration enforcement activities. See Am. Compl. [Dkt. # 4] ¶¶ 1-2. The amended complaint contains three allegations against ICE and CBP: 1) failure to conduct adequate searches for responsive records; 2) failure to disclose responsive records; and 3) failure to grant plaintiff's public interest waiver request. Am. Compl. ¶¶ 28–40.
Pending before the Court is defendants’ motion for summary judgment, Defs.’ Mot. for Summ. J. [Dkt. # 27] ("Defs.’ Mot."); Defs.’ Mem. of Law in Supp. of Defs.’ Mot. [Dkt. # 27-1] ("Defs.’ Mem."). Plaintiff opposed and cross-moved for summary judgment. Pl.’s Cross-Mot. for Summ. J. [Dkt. # 28] ("Pl.’s Cross-Mot."), Pl.’s Opp. to Defs.’ Mot. and Mem. in Supp. of Pl.’s Cross-Mot. [Dkt. # 28-1] ("Pl.’s Cross-Mem."). Since the complaint was filed, defendants have turned over many records, and so the remaining issues to be decided relate to defendants’ withholding of certain categories of data. See generally Pl.’s Cross-Mem.; Defs.’ Mem. For the following reasons both parties’ motions are granted in part and denied in part.
BACKGROUND
The Council is a "tax-exempt, not-for-profit educational and charitable organization" located in Washington, D.C. Am. Compl. ¶ 7. It works to "increase public understanding of immigration law and policy, advocate for the fair and just administration of our immigration laws, protect the legal rights of noncitizens, and educate the public about the enduring contributions of America's immigrants." Am. Compl. ¶ 7. It also "seeks ... to hold the government accountable for unlawful conduct and restrictive interpretations of the law," in order to ensure that actions taken pursuant to immigration laws are "executed in a manner that comports with due process." Am. Compl. ¶ 7.
On October 13, 2017, the Council submitted a FOIA request to CBP and ICE, seeking "a complete dataset containing detailed information about all individuals who were apprehended by U.S. Customs and Border Protection; encountered by U.S. Immigration and Customs Enforcement; or removed from the United States between January 1, 2016 and October 10, 2017." Ex. A to Am. Compl., Oct. 13, 2017 FOIA Request [Dkt. # 4-1] ("Request 1") at 1. The Council sought information on: "(a) each individual who was apprehended by CBP, (b) each individual who was encountered by ICE, (c) each individual who was arrested by ICE, (d) each individual who was arrested by CBP, and (e) each individual who was removed or returned from the United States." Am. Compl. ¶¶ 11.
The Council's "apprehensions and encounters" requests, listed above as (a) and (b), asked for twenty-four data points, including the individuals’: citizen countries, birth dates, ages at apprehension or encounter, and gender, as well as the landmark (location where the encounter / apprehension took place); event time, type, and date; and last location where the individual was detained. See Request 1 at 1–3. The "arrested by ICE or CBP request," listed above as (c) and (d), asked for twenty-seven data points, including some that overlapped with the apprehension/encounter request, as well as: arrest sites, the time an individual was illegally in the United States, arrest method, "departed date," and more. See id. at 3–4. Finally, in relation to category (e) above, the Council sought fifty-three data points for each individual who was removed or returned from the United States by the two agencies, including information on the most serious criminal charges and convictions of each individual, and the removal program used by the agencies, among other information. See id. at 4–6. Along with these data points, the Council requested that defendants supply a "codebook with definitions of each variable included in the spreadsheet/s," id. at 6, as well as a waiver of processing fees. Id. at 7.
On February 14, 2018, after plaintiff had not received any "substantive response to its Request from either agency," Am. Compl. ¶ 19, it submitted a supplemental letter requesting the same data but for a time period up to and including the date of each agency's final response to the request. Ex. B to Declaration of Patrick Howard, Feb. 14, 2018 Suppl. Letter [Dkt. # 27-4] at 1. As of July 16, 2018, the date plaintiff filed the amended complaint, defendant had yet to produce any records. Am. Compl. ¶ 20.
On August 9, 2018, though, ICE produced three Excel spreadsheets, which it later amended on October 17, 2018. Attachment 3 to Defs.’ Mot., Declaration of Fernando Pineiro [Dkt. # 27-3] ("Pineiro Decl.") ¶¶ 9–10; Defs.’ SUMF ¶¶ 41–42. The responsive data was culled from ICE's Integrated Decision Support System database ("IIDS"), Pineiro Decl. ¶ 20, and the production contained:
(1) data on ICE apprehensions/encounters, which included 13 data points (that fulfilled 15 of the [p]laintiff's requested data points); (2) data on ICE arrests, which included 14 data points (that fulfilled 15 of the [p]laintiff's requested data points); and (3) data on ICE removals, which included 22 data points (that fulfilled 24 of the [p]laintiff's requested data points).
Defs.’ SUMF ¶ 42.
But ICE did not produce the birth dates of the individuals identified in the spreadsheets, "unique system identifier[s]," or "a codebook or other information regarding definitions of field variables." Pl.’s SUMF ¶¶ 12, 22, 37. It explains that the withheld data fell into three categories: (1) personal information that was withheld under FOIA Exemptions (b)(6) and (b)(7)(C); (2) data that does not exist in the IIDS database as requested and would require the creation of a new record, based on additional analysis and calculations, and (3) data that the agency does not possess at all. Defs.’ SUMF ¶¶ 44–54; Pl.’s SUMF ¶¶ 12.
CBP produced data sets on August 21, 2018, September 7, 2018, December 19, 2018, February 26, 2019, and March 5, 2019. Pl.’s SUMF ¶ 11; Defs.’ SUMF ¶¶ 88, 91, 104. The information came from three CBP offices: the United States Border Patrol ("USBP"), the Office of Field Operations ("OFO"), and the Air and Marine Operations ("AMO"). Declaration of Patrick Howard [Dkt. # 27-4] ("Howard Decl."). ¶ 16. The search conducted to produce the August 21, 2018 data set, which contained information from USBP and was supplemented on February 26, 2019 and March 5, 2019, located twenty-four data points of the thirty-two requested by plaintiff. Defs.’ SUMF ¶¶ 65, 68, 88. The agency produced spreadsheets containing seventeen of those, and it redacted seven columns: (1) one column with unique system identifiers, withheld pursuant to FOIA Exemption (7)(E); (2) one column identifying the name of the law enforcement operation; (3) four columns with data on the law enforcement incident location, withheld pursuant to Exemption (7)(E); and (3) one column with individuals’ birth dates, withheld pursuant to FOIA Exemption (6) and (7)(E). Howard Decl. ¶ 22; Defs.’ SUMF ¶¶ 69–70, 76, 83; Pl.’s SUMF ¶¶ 13, 22, 23.
The search conducted by CBP's Office of Field Operations to produce the data sets, delivered on September 7, 2018 and December 19, 2018, located thirteen of the twenty-seven data points requested by plaintiff. Defs.’ SUMF ¶¶ 90–91. That office withheld the same information that was withheld in the USBP data set. Defs.’ SUMF ¶ 92. Finally, the search conducted by the Air and Marine Operations located three responsive Excel spreadsheets, which were produced in full. Defs.’s SUMF ¶¶ 100–04.
Based on these productions, the scope of plaintiff's lawsuit narrowed. The issues to be resolved are: whether the defendants appropriately withheld date of birth information (ICE and CBP), unique identifiers (ICE and CBP), apprehension locations (CBP), and variable definitions (ICE), and whether blank cells in the spreadsheets (ICE and CBP) must be supplemented or explained. Pl.’s Cross-Mem. at 2.
STANDARD OF REVIEW
Summary judgment is appropriate "if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56(a). The party seeking summary judgment "bears the initial responsibility of informing the district court of the basis for its motion, and identifying those portions of the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, which it believes demonstrate the absence of a genuine issue of material fact." Celotex Corp. v. Catrett , 477 U.S. 317, 323, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986) (internal quotation marks omitted). To defeat summary judgment, the non-moving party must "designate specific facts showing that there is a genuine issue for trial." Id. at 324, 106 S.Ct. 2548 (internal quotation marks omitted). When the court is presented with cross-motions for summary judgment, it analyzes the underlying facts and inferences in each party's motion in the light most favorable to the non-moving party. See Anderson v. Liberty Lobby, Inc. , 477 U.S. 242, 247, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986).
The mere existence of a factual dispute is insufficient to preclude summary judgment. Id. , at 247–48, 106 S.Ct. 2505. A dispute is "genuine" only if a reasonable fact-finder could find for the non-moving party; a fact is "material" only if it is capable of affecting the outcome of the litigation. Id. at 248, 106 S.Ct. 2505 ; Laningham v. U.S. Navy , 813 F.2d 1236, 1241 (D.C. Cir. 1987).
When considering a motion for summary judgment under FOIA, the court must conduct a de novo review of the record. See 5 U.S.C. § 552(a)(4)(B). The court may grant summary judgment based on information provided in an agency's affidavits or declarations when they are "relatively detailed and non-conclusory," SafeCard Servs., Inc. v. SEC , 926 F.2d 1197, 1200 (D.C. Cir. 1991) (citation omitted), and "not controverted by either contrary evidence in the record nor by evidence of agency bad faith." Military Audit Project v. Casey , 656 F.2d 724, 738 (D.C. Cir. 1981). Such affidavits or declarations are "accorded a presumption of good faith, which cannot be rebutted by purely speculative claims about the existence and discoverability of other documents." SafeCard , 926 F.2d at 1200 (citation and internal quotation marks omitted).
ANALYSIS
I. The Freedom of Information Act
FOIA requires government agencies to release records upon request in order to "ensure an informed citizenry, vital to the functioning of a democratic society, needed to check against corruption and to hold the governors accountable to the governed." NLRB v. Robbins Tire & Rubber Co. , 437 U.S. 214, 242, 98 S.Ct. 2311, 57 L.Ed.2d 159 (1978). The statute provides that: "each agency, upon any request for records which (i) reasonably describes such records and (ii) is made in accordance with published rules ... shall make the records promptly available to any person," 5 U.S.C. § 552(a)(3)(A), unless the records fall within one of nine narrowly construed exemptions. See § 552(b) ; FBI v. Abramson , 456 U.S. 615, 630–31, 102 S.Ct. 2054, 72 L.Ed.2d 376 (1982). This framework "represents a balance struck by Congress between the public's right to know and the government's legitimate interest in keeping certain information confidential." Ctr. for Nat'l Sec. Studies v. U.S. Dep't of Justice , 331 F.3d 918, 925 (D.C. Cir. 2003), citing John Doe Agency v. John Doe Corp. , 493 U.S. 146, 152, 110 S.Ct. 471, 107 L.Ed.2d 462 (1989). To prevail in a FOIA action, an agency must first demonstrate that it has made "a good faith effort to conduct a search for the requested records, using methods which can be reasonably expected to produce the information requested." Oglesby v. U.S. Dep't of Army , 920 F.2d 57, 68 (D.C. Cir. 1990). Second, the agency must show that "materials that are withheld ... fall within a FOIA statutory exemption." Leadership Conference on Civil Rights v. Gonzales , 404 F. Supp. 2d 246, 252 (D.D.C. 2005), citing Weisberg v. U.S. Dep't of Justice , 705 F.2d 1344, 1351 (D.C. Cir. 1983).
"[W]hen an agency seeks to withhold information, it must provide a relatively detailed justification" for the withholding, Morley v. CIA , 508 F.3d 1108, 1122 (D.C. Cir. 2007), quoting King v. U.S. Dep't of Justice , 830 F.2d 210, 219 (D.C. Cir. 1987) (internal quotation marks omitted), through a Vaughn index, an affidavit, or by other means. Gallant v. NLRB , 26 F.3d 168, 172–73 (D.C. Cir. 1994). The general rule in FOIA cases is that
[i]f an agency's affidavit describes the justifications for withholding the information with specific detail, demonstrates that the information withheld logically falls within the claimed exemption, and is not contradicted by contrary evidence in the record or by evidence of the agency's bad faith, then summary judgment is warranted on the basis of the affidavit alone.
ACLU v. U.S. Dep't of Def. , 628 F.3d 612, 619 (D.C. Cir. 2011).
After asserting and explaining the use of particular exemptions, an agency must release "[a]ny reasonably segregable portion of a record," 5 U.S.C. § 552(b), unless the non-exempt portions are "inextricably intertwined with exempt portions" of the record. Johnson v. Exec. Office for U.S. Attorneys , 310 F.3d 771, 776 (D.C. Cir. 2002), quoting Mead Data Cent., Inc. v. U.S. Dep't of Air Force , 566 F.2d 242, 260 (D.C. Cir. 1977). "In order to demonstrate that all reasonably segregable material has been released, the agency must provide a ‘detailed justification’ for its non-segregability," although "the agency is not required to provide so much detail that the exempt material would be effectively be disclosed." Id. , citing Mead Data Cent. , 566 F.2d at 261. Just as with the exemption analysis, "[a]gencies are entitled to a presumption that they complied with the obligation to disclose reasonably segregable material[,]" Sussman v. U.S. Marshals Serv. , 494 F.3d 1106, 1117 (D.C. Cir. 2007), citing Boyd v. Criminal Div. of U.S. Dep't of Justice , 475 F.3d 381, 391 (D.C. Cir. 2007), and "[a] court may rely on government affidavits that show with reasonable specificity why documents withheld pursuant to a valid exemption cannot be further segregated." Juarez v. U.S. Dep't of Justice , 518 F.3d 54, 61 (D.C. Cir. 2008), citing Armstrong v. Exec. Office of the President , 97 F.3d 575, 578 (D.C. Cir. 1996).
II. The record does not support defendants’ redaction of entire birth dates, and they will be required to produce birth month and year information.
A. Legal Standard
Exemption 6 allows agencies to withhold "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy[.]" 5 U.S.C. § 552(b)(6). The purpose of Exemption 6 is "to protect individuals from the injury and embarrassment that can result from the unnecessary disclosure of personal information." U.S. Dep't of State v. Wash. Post Co. , 456 U.S. 595, 599, 102 S.Ct. 1957, 72 L.Ed.2d 358 (1982). And "[t]he Supreme Court has made clear that Exemption 6 is designed to protect personal information in public records, even if it is not embarrassing or of an intimate nature[.]" Nat'l Ass'n of Retired Fed. Emps. v. Horner , 879 F.2d 873, 875 (D.C. Cir. 1989), citing Wash. Post , 456 U.S. at 600, 102 S.Ct. 1957. To determine whether Exemption 6 applies, a court must "weigh the ‘privacy interest in non-disclosure against the public interest in the release of the records.’ " Lepelletier v. FDIC , 164 F.3d 37, 46 (D.C. Cir. 1999), quoting Horner , 879 F.2d at 874.
To justify the withholding of individual birth dates, defendants also invoke Exemption 7(C), see Defs.’ Mem. at 8–11; Defs.’ Reply in Further Supp. of Defs.’ Mot. [Dkt. # 32] ("Defs.’ Mot.") at 2–6, which protects from disclosure "records or information compiled for law enforcement purposes ... [if] the production of such law enforcement records or information would ... constitute an unwarranted invasion of personal privacy." 5 U.S.C. § 522(b)(7)(C). Courts undertake a similar balancing test to analyze an agency's reliance on Exemption 7(C) as they do to examine an agency's use of Exemption 6. See ACLU v. U.S. Dep't of Justice , 655 F.3d 1, 6 (D.C. Cir. 2011). Here, it is undisputed that the records were compiled for law enforcement purposes, and because the Court finds that defendants improperly withheld all birth date data under Exemption 7(C), which establishes a lower bar for withholding materials than Exemption 6, see id. , the Court will discuss defendants’ withholding under that standard. See Dep't of Justice v. Reporters Comm. for Freedom of the Press , 489 U.S. 749, 756, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989) ("[T]he standard for evaluating a threatened invasion of privacy interests resulting from the disclosure of records complied for law enforcement purposes is somewhat broader than the standard applicable to personnel, medical, and similar files.").
B. Defendants improperly withheld entire birth dates under Exemption 7(C).
Defendants submit that they withheld birth dates from their productions to protect the privacy of third-parties. See Defs.’ Mem. at 10, 16. They append two declarations to their motion, one by a representative from ICE and another by a representative of CBP. See Pineiro Decl.; Howard Decl. Defendants’ ICE declarant explains that ICE withheld the dates of birth of third-party individuals who are included in the disclosed data sets because "[s]uch information, if disclosed to the public or to a third-party requester without the permission of the individual, could expose the individual to identity theft and may reasonably lead to unwanted contact from persons that might seek to harm the individual." Pineiro Decl. ¶ 38. He adds that "third-party individuals have a recognized privacy interest in not being publicly associated with law enforcement investigations through the release of records complied for law enforcement purposes," and that for these reasons, ICE determined that birth dates, which are "personally identifying information" should be withheld as their disclosure "would not shed any further light as to the operations of ICE." Id. ¶¶ 39–41.
Similarly, the CBP declarant states that CBP withheld birth dates because their disclosure "would lead to an unwarranted invasion of privacy." Howard Decl. ¶¶ 22(c), 23(c), 25(c). But unlike ICE, CBP provided the ages of the individuals in 99.98% of the lines in the OFO spreadsheet, Supplemental Declaration of Patrick Howard [Dkt. # 32-2] ("Suppl. Howard Decl.") ¶ 17; and in 98.99% of the data produced in Sheet 1 of the USBP production and 100% in Sheet 2. See Declaration of Robert M. Lewandowski [Dkt. # 32-3] ("Lewandowski Decl.") ¶ 11. As for the third data set – provided by AMO – defendants submit that the "database is more limited than the databases available to either OFO or USBP," and it does not contain "age or citizenship" entries. Suppl. Howard Decl. ¶¶ 8, 11.
D.C. Circuit decisions "have consistently supported nondisclosure of names or other information identifying individuals appearing in law enforcement records...." Schrecker v. U.S. Dep't of Justice , 349 F.3d 657, 661 (D.C. Cir. 2003) (collecting cases). Indeed, in SafeCard Servs., Inc. v. SEC , 926 F.2d 1197 (D.C. Cir. 1991), the Circuit "adopted a categorial rule permitting an agency to withhold information identifying private citizens mentioned in law enforcement records, unless disclosure is ‘necessary in order to confirm or refute compelling evidence that the agency is engaged in illegal activity.’ " Schrecker , 349 F.3d at 661, quoting SafeCard , 926 F.2d at 1206. The Court recognized that "[t]here is little question that disclosing the identity of targets of law-enforcement investigations can subject those identified to embarrassment and potentially more serious reputational harm." SafeCard , 926 F.2d at 1205, quoting Senate of Puerto Rico v. U.S. Dep't of Justice , 823 F.2d 574, 588 (D.C. Cir. 1987).
The question here is whether the information being withheld in fact identifies private citizens and could cause them harm if released. While date of birth information typically falls into the category of information that may properly be withheld, see Horner , 879 F.2d at 875, the release of potentially identifying information has been deemed to be "only a de minimis invasion of privacy" when the names and full dates of birth of the individuals involved were otherwise unknown. U.S. Dep't of State v. Ray , 502 U.S. 164, 176, 112 S.Ct. 541, 116 L.Ed.2d 526 (1991).
In Ray , the Supreme Court held that the State Department had appropriately redacted names pursuant to Exemption 6 in notes of interviews with returned Haitian nationals who volunteered to be interviewed anonymously. 502 U.S. at 179, 112 S.Ct. 541. The Court emphasized that already-produced unredacted portions of the notes contained other personal information on interviewees’ families, employment statuses, and living conditions, and that if names were also released, it would constitute a significant invasion of privacy and could place the interviewees in danger for cooperating with the U.S. government. Id. at 175–77, 112 S.Ct. 541. The Court noted, however, that the personal information that had already been released constituted "only a de minimis invasion of privacy when the identities of the interviewees" remained unknown. Id. at 176, 112 S.Ct. 541.
Plaintiff submits that "[d]efendants provide so little information about the individuals in the spreadsheet, there is no meaningful risk that birthdate[s] could be combined with other data to ascertain identities." Pl.’s Cross-Mem. at 10. Therefore, plaintiff contends that defendants have not met their burden to establish that disclosing entire birthdates in an anonymous data set gives rise to a privacy interest at all. Id. So the first matter the Court must address is whether there is a dispute of fact raised by the factual assertions in the parties’ pleadings about the potential invasion of privacy caused by the release of birthdates that would preclude the Court from entering judgment for either party. See CEI Washington Bureau, Inc. v. U.S. Dep't of Justice , 469 F.3d 126, 127, 129 (D.C. Cir. 2006) (holding that the district court erred in entering judgment for the government when "each party questioned the factual accuracy of the other's claims" regarding the potential invasion of privacy caused by releasing individuals’ names, birth dates, FBI Numbers, and Alien Registration Numbers in produced data sets).
The defendants’ declarations raise concerns about exposure to identify theft, unwanted or harassing contacts, and the stigma of being mentioned in law enforcement files. See Pineiro Decl. ¶¶ 38–39. But these are very vague and speculative harms, and ICE does not explain how the birth dates, without more, would identify the individuals involved or give rise to any of those concerns given the lack of other data, in particular, the individuals’ names, on the same spreadsheets. In other words, the case is distinguishable from CEI Washington Bureau , in which the issue was the disclosure of names along with birthdates, and FBI and Alien Registration numbers. For that reason, the Court finds that there is a dispute of fact that precludes the entry of summary judgment in defendants’ favor as a matter of law on this issue. And even if defendants could satisfactorily establish the existence of a personal privacy interest in one's birthdate standing alone, there is a genuine dispute about whether that interest outweighs the public interest in the requested information – plaintiff's reporting about the age of individuals encountered by immigration officials. See Declaration of Guillermo Cantor [Dkt. # 28-3] ("Cantor Decl.") ¶ 12. But similarly, plaintiff has not carried its burden to establish the lack of any genuine question of fact with respect to the absence of an individual privacy interest in a complete birth date.
Plaintiff submits that defendants should be required to produce the month and year of the individuals’ birth at a minimum. Pl.’s Cross-Mem. at 11–13. The Court finds that there is no genuine dispute that the government can adequately protect whatever minimal privacy interests the detainees have in their birthdates by redacting the date but not the month and year, because the agency has not identified any harm that would flow from a more limited disclosure, and the statute requires that reasonably segregable portions of records should be provided. See Juarez v. U.S. Dep't of Justice , 518 F.3d 54, 61 (D.C. Cir. 2008). Indeed, CPB disclosed columns in its spreadsheets containing the age of the individuals, and that information is indistinguishable from their year of birth. Therefore, the Court finds that even if one assumes that the information is covered by Exemption 6 and 7(C), when one balances the public interest in the requested information against the minimal privacy interests that otherwise anonymous individuals would have in partial birth date information, judgment should be entered in plaintiff's favor in part, and the government will be ordered to supply that information at a minimum.
Defendants argue that redacting birth days would be too burdensome a task because the agencies lack proper software to redact data within cells. See Suppl. Decl. of Patricia J. de Castro [Dkt. # 32-1] ("Suppl. de Castro Decl.") ¶ 8; Suppl. Howard Decl. ¶ 19. Plaintiff has identified two methods that it says could accomplish intra-cell redactions in Excel. See Supplemental Declaration of Guillermo Cantor [Dkt. # 33-1] ("Suppl. Cantor Decl.") ¶¶ 5–20. The Court will leave the mechanics of compliance up to the parties; one option would be to negotiate an agreement to produce the spreadsheets in electronic Excel format to counsel for plaintiff without any redactions in the birthdate field, subject to a strict protective order that would require counsel to redact the precise date of birth, and prohibit counsel from disseminating the native data further.
III. The record does not support defendants’ withholding of unique identifiers.
In its FOIA requests, plaintiff sought what it refers to as "unique anonymized person-level identifiers," see Pl.’s Cross-Mem. at 13, "for each individual" who had been apprehended by CBP, encountered by ICE, arrested by either agency, or removed from the United States. See Request 1 at 1, 3–4; Ex. E to Am. Compl. [Dkt. # 4-5] ("2018 FOIA Request") at 2, 3, 5. The two agencies have not produced the requested identifiers for different reasons. ICE takes the position that it is not required to turn over unique identifiers because the agency does not possess the identifiers requested by plaintiff in its IIDS database, and it is not required to "make interpretations and assumptions" in order to build a new record to produce the requested information. Declaration of Patricia J. de Castro [Dkt. # 27-2] ("de Castro Decl.") ¶¶ 26, 29; see also Defs.’ Reply at 6–8. CBP maintains that it properly redacted unique identifiers from the data sets it produced pursuant to Exemption 7(E). Howard Decl. ¶ 23(a). The Court finds that while ICE was not required to produce records it did not possess, it has not shown that its search was adequate, because it is undisputed that it did not search other databases where the identifiers were reasonably likely to be found. In addition, the Court finds that the record does not support CBP's reliance on Exemption 7(E) to support its redaction of unique identifying information from its productions, and summary judgment will be granted for plaintiff with regard to the production of CBP's unique identifiers.
A. ICE properly withheld unique identifiers from its IIDS production because they do not exist, but a genuine dispute exists as to whether it was required to produce identifiers from additional databases.
ICE asserts that it withheld unique identifiers, because "the data requested does not exist in" IIDS, the only ICE database searched for responsive records. de Castro Decl. ¶ 26. The de Castro declaration explains that "IIDS is an event-centric and not person-centric" database; it "cannot distinguish by person and thus cannot be relied upon to report [unique identifiers] accurately." Id. ¶ 29. The declaration goes on to explain that an analyst would have to assign each alien a unique number and tie silos of data together "in a way that defies IIDS's setup, ... to produce a brand new data set/record." Id. The ICE declarant emphasizes that FOIA does not require agencies to produce data that does not exist or to generate new records, and so, in responding to FOIA requests, "[i]f the data points do not exist in IIDS as requested, or would require additional research, analysis, assumptions and/or calculations ... or require the creations of a new record, ICE no longer provides those data points as a matter of discretion." Id. ¶ 33.
Plaintiff points out that ICE has, in fact, produced unique identifiers in previous disclosures. It submits a declaration by Emily Ryo, a researcher and Professor of Law and Sociology at the University of Southern California who focuses on immigration and criminal justice, among other topics, see Declaration of Emily Ryo [Dkt. # 28-6] ("Ryo Decl.") ¶¶ 1–2, that states that ICE has included unique person-level identifiers in other FOIA productions that Ryo has examined, and the declaration includes a snapshot of a spreadsheet with a "Unique Subject ID" column. Id. ¶¶ 6–7.
The law is clear that the Freedom of Information Act does not require agencies to generate new records in response to FOIA requests. Forsham v. Harris , 445 U.S. 169, 186, 100 S.Ct. 977, 63 L.Ed.2d 293 (1980), citing N.L.R.B. v. Sears, Roebuck & Co. , 421 U.S. 132, 161–62, 95 S.Ct. 1504, 44 L.Ed.2d 29 (1975) ; Yeager v. DEA , 678 F.2d 315, 321 (D.C. Cir. 1982) ("It is well settled that an agency is not required by FOIA to create a document that does not exist in order to satisfy a request."). Defendants’ declarant, de Castro, explains that while plaintiffs have produced an image of a production from another case that appears to include unique system identifiers, the data might "have existed in relation to the requested data" in that case, but "in this case, records produced to the [p]laintiff in response to the FOIA request did not include those data points." Suppl. de Castro Decl. ¶ 11. She adds that at one point, ICE provided unique identifiers "as a[n] ... exercise of discretion," but because of its current workload, it "now merely limits returned data to what the FOIA requires." Id. ¶ 13.
The fact that person-centric unique identifiers do not exist in ICE's IIDS database is not disputed, and the legal principle that an agency is not required to create new records is well-settled. But that is not the question to be decided; the request for unique identifiers for certain categories of individuals was directed to the agency, and it was not limited to any particular database.
Plaintiff points out that in other FOIA cases in this district and others, ICE has disclosed information from multiple databases along with information from IIDS. Pl.’s Cross-Mem. at 14-15. In particular, plaintiff points to instances in which ICE produced data from the Enforcement Integrated Database ("EID"). See e.g., Long v. ICE , 149 F. Supp. 3d 39, 55–57 (D.D.C. 2015) ; Long v. ICE , No. 5:17-cv-00506, 2018 WL 4642824, at *22 (N.D.N.Y. Sept. 27, 2018). Therefore, it submits that the agency's search for the requested records of identifiers was inadequate and that the decision in this case to produce data from IIDS alone, and not EIDS, was "erroneous," and a sign that the agency acted in bad faith. Pl.’s Reply in Supp. of Cross-Mot. for Summ. J. [Dkt. # 33] ("Pl.’s Reply") at 8–10.
An agency seeking judgment in its favor in a FOIA action must first demonstrate that it has made "a good faith effort to conduct a search for the requested records, using methods which can be reasonably expected to produce the information requested." Oglesby , 920 F.2d at 68. To fulfill the goals of the Act, courts require agencies "to follow through on obvious leads to discover requested documents." Valencia-Lucena v. U.S. Coast Guard , 180 F. 3d 321, 325 (D.C. Cir. 1999). An agency "fulfills its obligations under FOIA if it can demonstrate beyond material doubt that its search was ‘reasonably calculated to uncover all relevant documents.’ " Id. (emphasis added), quoting Truitt v. U.S. Dep't of State , 897 F.2d 540, 542 (D.C. Cir. 1990). Compliance with that standard is often established by the submission of a "reasonably detailed affidavit" describing the search. Oglesby , 920 F.2d at 68. But when "a review of the record raises substantial doubt" that certain materials were intentionally overlooked, Valencia-Lucena , 180 F.3d at 326, the presumption of good faith normally accorded to agency affidavits, SafeCard Servs. , 926 F.2d at 1200, may be overcome. Valencia-Lucena , 180 F.3d at 326.
de Castro states clearly that ICE only searched the IIDS database in its effort to locate records that were responsive to plaintiff's request. See de Castro Decl. ¶ 9 ("For the FOIA request that is the subject of this litigation, ICE conducted searches utilizing [IIDS]."). But in the same declaration, she describes another ICE database, EID, as "the common database repository for all records created, updated, and accessed by a number of software applications," which "captures and maintains information related to the investigation, arrest, booking, detention, and removal of persons encountered ... by ICE and CBP." Id. ¶¶ 6–7. Importantly, EID allows more than 55,000 users to "access a person-centric and/or event-centric view of the data." Id. ¶¶ 6–8 (emphasis added). By contrast, "IIDS contains information that is adapted for efficient report writing," including "a subset of case and enforcement-related information that is used to create reports for consumption." Id. ¶ 10. ICE chose to search IIDS instead of EID "to protect the integrity of the live data held in the EID ... and to avoid adversely affecting the performance of EID." Id. ¶ 11.
Here, ICE's acknowledgement that the unique identifiers likely appear in another database creates a genuine dispute about whether the search for responsive records was adequate, and plaintiff has directed the Court to other cases in which the record reflects that ICE was apparently able to search and produce data from EID. Because ICE has produced data from EID in recent cases and its own declarant acknowledges that person-centric unique identifiers are reasonably likely to be found in EID, a genuine dispute of fact exists about whether ICE made a "a good faith effort to conduct a search for the requested records, using methods which can be reasonably expected to produce the information requested." Oglesby , 920 F.2d at 68. For that reason, defendants’ motion for summary judgment is denied, and the issue is remanded to ICE for a further search in accordance with this opinion. Plaintiff's motion is denied as moot in light of the remand to ICE.
B. CBP improperly redacted unique identifiers under Exemption 7(E), and summary judgment will be granted for plaintiff on that issue.
Unlike ICE, CBP reported that its database search returned unique identifiers, but the agency redacted that information under FOIA Exemption 7(E).
Exemption 7(E) allows an agency to withhold:
records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records or information ... would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law.
5 U.S.C. § 552(b)(7)(E). "Under [D.C. Circuit] precedents, Exemption 7(E) sets a relatively low bar for the agency to justify withholding: ‘Rather than requiring a highly specific burden of showing how the law will be circumvented, [E]xemption 7(E) only requires that the [agency] demonstrate logically how the release of the requested information might create a risk of circumvention of the law,’ " Blackwell v. FBI , 646 F.3d 37, 42 (D.C. Cir. 2011), quoting Mayer Brown, LLP v. IRS , 562 F.3d 1190, 1194 (D.C. Cir. 2009). "[W]here an agency ‘specializes in law enforcement, its decision to invoke [E]xemption 7 is entitled to deference.’ " Lardner v. U.S. Dep't of Justice , 638 F. Supp. 2d 14, 31 (D.D.C. 2009), quoting Campbell v. U.S. Dep't of Justice , 164 F.3d 20, 32 (D.C. Cir. 1998).
Defendants submit that they withheld unique identifiers, which are "tied [to] each individual who was apprehended and the details of his or her apprehension" because "[i]f CBP systems were ever compromised, this identifier, if produced, could be used to identify specific people and their private information in the CBP database systems as well as sensitive law enforcement data...." Howard Decl. ¶¶ 22(a), 23(a), 25(a). The declaration clarifies that "[w]hile the system identifier is not direct person identification information, the identifier is unique to CBP database systems and can be used to navigate the system if parties outside of CBP were ever to acquire access to these sensitive law enforcement systems." Id.
Plaintiff does not contest that the records were compiled for law enforcement purposes. It complains first, though, that CBP's rationale is too speculative: "CBP does not argue that the unique identifiers are likely to lead to a security breach," so accepting its argument that "if there were a security breach, the hacker might find the unique identifiers useful ... would be a dramatic and potentially limitless expansion of Exemption 7(E)." Pl.’s Cross-Mem. at 16 (emphasis in original). The Court agrees.
In Mayer Brown LLP the Court of Appeals stated: "Exemption 7(E) clearly protects information that would train potential violators to evade the law or instruct them how to break the law ... and [i]t exempts from disclosure information that could increase the risks that a law will be violated or that past violators will escape legal consequences." 562 F.3d at 1193 (omitted). In that case, the IRS clearly explained that the documents it withheld detailed the agency's settlement strategies and objectives, as well as acceptable settlement ranges for entities accused of certain tax evasion crimes. See id. at 1191–92. Based on that showing, the D.C. Circuit held that the IRS properly relied on the exemption because the data had the potential to inform the public about effective ways to evade tax laws. Id. at 1193.
By contrast, in Long v. ICE , 149 F. Supp. 3d 39 (D.D.C. 2015) (" Long I "), and a later opinion, Long v. ICE , 279 F. Supp. 3d 226 (D.D.C. 2017) (" Long II "), the court twice denied defendant ICE's motions for summary judgment on its use of Exemption 7(E) to withhold EID and IIDS metadata to keep hackers from "launch[ing] a full scale cyber-attack against [ICE]." Long I , 149 F. Supp. 3d at 50 (internal quotation omitted). In Long I , the court commented that it was "left unconvinced ... that the sole risk of circumvention of the law claimed by Defendants – a [cyber] attack – would be increased if the requested [data] were disclosed," and it gave defendant the opportunity to supplement the record with additional support for its argument. Id. at 53. Left unpersuaded by the supplemental declarations, the court ultimately determined that it could "not hold ... that Defendant's expectation of risk of circumvention of law ... [was] reasonable." Long II , 279 F. Supp. 3d at 238.
Here, the agency's showing falls short of the standard requiring a logical connection between the released information and a circumvention of the law. Howard warns that that if an individual who possessed the unique identifier information were to hack illegally into CBP's databases, then the unique identifier information could be utilized to obtain sensitive law enforcement data. But the agency has not come forward with information to show that the mere possession of unique identifying information would facilitate one's ability to hack into CBP's system or that it would make a hacking more likely. In other words, the harm the exemption is designed to avert – the circumvention of the law – would not be caused or advanced by the disclosure of the data in question, and it depends upon the hypothetical commission of a crime that is independent of the disclosure of the data the defendant seeks to withhold.
The cased cited by the defense are inapposite as they both involved information that would facilitate unauthorized access to agency databases. In Strunk v. U.S. Department of State , the Court held that CBP could withhold computer codes pursuant to Exemption 7(E), but it relied on declarations that explained that the withheld data would facilitate access to CBP's database and reveal the precise procedures for retrieving documents from it. 770 F. Supp. 2d 10, 17 (D.D.C. 2012). Similarly, in McRae v. U.S. Department of Justice , the court upheld the withholding of "mapping and routing codes" that showed how a database query was accomplished and how a user could retrieve the resulting data. 869 F. Supp. 2d 151, 168 (D.D.C. 2012).
--------
Because defendant CBP has failed to tie the potential circumvention of the law to CBP's release of unique identifiers, its motion for summary judgment on that point will be denied, and plaintiff's cross-motion is granted. This issue is remanded to CBP to produce the spreadsheets with unredacted unique identifiers by June 11, 2020.
IV. The record supports CBP's withholding of location information under Exemption 7(E) and summary judgment will be granted for defendants on that issue.
The third issue in dispute concerns CBP's decision to withhold specific location information – that is, data detailing where individuals were apprehended or encountered – from its OFO and USBP data sets. In its OFO data set, CBP produced "Field Office" information – showing which of nineteen OFO regions in the United States was involved in each event, see Howard Decl. ¶ 25(b), but it relied on Exemption 7(E) to redact apprehension sites and points of encounter ("POE") from the spreadsheets it produced. See CBP Vaughn Index [Dkt. # 27-6] ("CBP Index") at 1; Howard Decl. ¶ 25b; Suppl. Howard Decl. ¶ 20. Similarly, USBP provided data indicating the "sectors" in which apprehensions and/or arrests took place, but it withheld specific location data by redacting columns entitled: "Site," "Landmark Arrest[,]" "First Station Detained[,]" and "Last Station Detained" under Exemption 7(E). Lewandowski Decl. ¶¶ 14–19.
CPB asserts that disclosure of specific location data "may show law enforcement staffing and coverage information thereby identifying weaknesses in law enforcement operations, techniques and procedures," and it warns that disclosure of that information "would be debilitating and detrimental to both CBP and the law enforcement community, and it would enable individuals to alter their patterns of conduct, adopt new methods of operation, relocate, change associations, and effectuate other countermeasures, thereby corrupting the integrity of ongoing investigations." CBP Index at 2; see Lewandowski Decl. ¶¶ 15c–d.
Plaintiff maintains that defendants "have not demonstrated an actual risk, have not explained how data about past law enforcement operations creates future vulnerabilities, or why landmark, site, and station data is different from sector information...." Pl.’s Reply at 13. But the D.C. Circuit has emphasized that Exemption 7(E) is "a relatively low bar;" and to support withholding records on that basis, "an agency must demonstrate only that release of documents might increase the risk ‘that a law will be violated ....’ " Pub. Emps. for Envtl. Responsibility v. U.S. Section, Int'l Boundary and Water Comm'n , 740 F.3d 195, 205 (D.C. Cir. 2014) (emphasis added), quoting Mayer Brown , 562 F.3d at 1193.
Defendants have satisfied that requirement here. CPB's declarant explains that specific location data disclosed in a production of the size involved here "will provide the public with information on staffing strengths and weaknesses of individual ports of entry." Suppl. Howard Decl. ¶ 21. The Lewandowski declaration adds further clarification: "[p]laintiff's request is not for an individual apprehension or arrest. Plaintiff's request is for all apprehensions and arrests over a 34 month period across the United States. The substantive effect of over 1 million points of location data would be the disclosure of law enforcement techniques and procedures." Lewandowski Decl. ¶ 15b. Defendants contend that this volume of information will enable criminals to utilize a technique called "port shopping," through which they use "information [on] operations, arrests and apprehensions and staffing and specific ports of entry" to evade arrest or apprehension. Suppl. Howard Decl. ¶ 22. In addition, they submit that other redacted information, like point of entry data on arrests and apprehensions could reveal daily traveler volume, which could allow "terrorists or smugglers to plan entries at ports that would be busier, and perhaps, easier to slip through the crowd." Id. ¶ 23.
These declarations are accorded a presumption of regularity, see Nat'l Archives & Records Admin. v. Favish , 541 U.S. 157, 174, 124 S.Ct. 1570, 158 L.Ed.2d 319 (2004), and they identify specific ways in which the requested information could be used to circumvent law enforcement efforts and might increase the risk that a law will be violated. Therefore, the Court will grant summary judgment in favor of the defendants on the issue of whether it was appropriate to withhold specific location data under Exemption 7(E) and deny plaintiff's motion on that issue.
V. A genuine dispute of fact exists as to whether ICE should have produced variable definitions to plaintiff.
The next issue concerns plaintiff's ability to decipher the information it received. CBP produced "ten pages and other information defining or describing key definitions, fields, and variables as requested by the Council," Pl.’s Cross-Mem. at 21, n.4, but ICE has not produced a codebook or glossary of the terms and acronyms contained in its spreadsheets. See de Castro Decl. ¶ 19. ICE maintains that no such document exists. Id.
As noted above, "FOIA imposes no duty on the agency to create records," id. , and this Circuit has instructed that "FOIA neither requires an agency to answer questions disguised as a FOIA request ... or to create documents or opinions in response to an individual's request for information." Hudgins v. IRS , 620 F. Supp. 19, 21 (D.D.C. 1985), aff'd , 808 F.2d 137 (D.C. Cir. 1987) (internal citations omitted). But updates to FOIA passed in 1996, known as the Electronic FOIA Amendments ("E-FOIA"), Pub. L. No. 104-231, 104th Cong., 110 Stat. 3048, expanded the definition of a record to include "any information that would be an agency record ... when maintained by an agency in any format , including an electronic format." E-FOIA, § 3, 110 Stat. at 3049. And courts in this district have since held that in light of the amendments, " ‘electronic database searches are not ... regarded as involving the creation of new records,’ " Nat'l Sec. Counselors v. CIA , 898 F. Supp. 2d 233, 270 (D.D.C. 2012), quoting People for the Am. Way Found. v. U.S. Dep't of Justice , 451 F. Supp. 2d 6, 14 (D.D.C. 2006), particularly where points of data requested already exist. See id. at 271 (differentiating between a FOIA request for "a listing or index" of a database's contents, which "would not necessarily have existed prior to a given FOIA request," and the contents or underlying data itself).
Plaintiff has not come forward with evidence that casts doubt on the declaration by de Castro that a glossary for the particular spreadsheets produced to the plaintiff does not exist. See Suppl. de Castro Decl. ¶ 17 ("The FOIA request made by Plaintiff required ICE STU to produce a unique set of Excel spreadsheets, not created in the usual course of business for agency use and therefore not accompanied by a glossary or list of definitions. Therefore, ICE does not have a preexisting agency record for definitions in this particular data set that can be produced as a record.").
But the issue does not rise or fall with the availability of a standalone codebook if the requested information can be located within the agency's electronic database. And here, as the ICE declarant further explains, that search has not been conducted. See Suppl. de Castro Decl. ¶ 18. ("ICE uses thousands of acronyms in the normal course of business, which are not collated in a searchable database, and would need to be given a narrowed list of terms for this request to be feasible.").
Therefore, defendants’ motion for summary judgment on this issue will be denied without prejudice and plaintiff's will be denied as moot; plaintiff is ordered to submit a narrowed list of the particular terms within the spreadsheets produced by ICE for which a definition is required by June 4, 2020, and ICE must conduct a search to determine whether it has definitions for those terms within its electronic databases. If the definitions are found in separate locations or records, it is not incumbent upon ICE to collate the information into a new, single record or glossary that answers plaintiff's questions, but the information it locates must be timely produced.
VI. Summary judgment will be granted for defendants on their production of blank spreadsheet cells.
Plaintiff initially challenged defendants’ production of spreadsheets that contained blank cells without providing "even the barest explanation for some missing data." Pl.’s Cross-Mem. at 23. In particular, plaintiff objected to defendants’ lack of explanation regarding whether the information did not exist or whether it was redacted. Id. In subsequently filed declarations, however, defendants explained that the blank cells in both CBP and ICE-produced spreadsheets were not redacted, but that the information for those cells does not exist. See Suppl. Howard Decl. ¶¶ 31–32; Lewandowski Decl. ¶¶ 22–23. Plaintiff does not raise the issue again in its reply. Because defendants have shown that the information does not exist, and FOIA does not require the creation of new responsive data, see Sears, Roebuck & Co. , 421 U.S. at 161–62, 95 S.Ct. 1504, summary judgment will be granted for defendants with regard to blank cells.
CONCLUSION
For the foregoing reasons:
1) plaintiff's motion for summary judgment is granted in part with regard to defendants’ redaction of complete birthdates, defendants’ motion on that issue is denied, and ICE is ordered to produce birthdate data with only the day of the month redacted;
2) defendants’ motion for summary judgment is denied with respect to ICE's failure to produce unique identifiers; the matter is remanded to ICE for a more complete search; and plaintiff's motion is denied as moot;
3) plaintiff's motion with regard to CBP's redaction of unique identifiers is granted; CBP is ordered to produce spreadsheets with that data
unredacted by June 11, 2020, and defendants’ motion is denied;
4) defendants’ motion is granted as to their withholding of certain location information, and plaintiff's motion is denied;
5) defendants’ motion with respect to ICE's failure to produce a codebook will be denied without prejudice, and plaintiff is required to submit to defendant a narrowed list of terms that require a definition by June 4, 2020; if ICE locates the requested definitions within its electronic databases, it must timely produce them to plaintiff;
6) defendants’ motion is granted as to their production of blank cells, and plaintiff's motion is denied as moot.
A separate order will issue.