Opinion
CIVIL NO. 16-00008 JMS/KSC
08-30-2016
CIVIL BEAT LAW CENTER FOR THE PUBLIC INTEREST, INC., Plaintiff, v. CENTERS FOR DISEASE CONTROL AND PREVENTION, Defendant.
Robert B. Black, Civil Beat Law Center for the Public Interest, Honolulu, HI, for Plaintiff. Rachel S. Moriyama, Office of the United States Attorney, Honolulu, HI, for Defendant.
Robert B. Black, Civil Beat Law Center for the Public Interest, Honolulu, HI, for Plaintiff.
Rachel S. Moriyama, Office of the United States Attorney, Honolulu, HI, for Defendant.
ORDER: (1) GRANTING IN PART AND DENYING IN PART DEFENDANT'S MOTION FOR SUMMARY JUDGMENT; AND (2) GRANTING IN PART AND DENYING IN PART PLAINTIFF'S COUNTER-MOTION FOR SUMMARY JUDGMENT
J. Michael Seabright, Chief United States District Judge
I. INTRODUCTION
Plaintiff Civil Beat Law Center for the Public Interest, Inc. ("Plaintiff") brings this action against Defendant Centers for Disease Control and Prevention ("Defendant" or "CDC") pursuant to the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552, claiming that the CDC wrongly denied its FOIA request for two documents.
Currently before the court is Defendant's Motion for Summary Judgment (the "CDC's Motion"), Doc. No. 15, and Plaintiff's Counter-Motion for Summary Judgment ("Plaintiff's Motion"), Doc. No. 21. For the reasons that follow, the court GRANTS in part and DENIES in part both Defendant's Motion and Plaintiff's Motion.
II. BACKGROUND
A. Plaintiff's FOIA Request
"According to media reports, in May 2014, the CDC found " ‘widespread regulatory noncompliance’ " upon inspecting University of Hawaii ("UH") laboratories using biological select agents and toxins ("BSAT"). Doc. No. 1, Compl. ¶ 2.
On April 24, 2015, Plaintiff submitted a FOIA request to the CDC seeking release of the records relating to the CDC's inspection of the UH laboratories. Doc. No. 15-3, Def.'s Ex. A. Specifically, Plaintiff requested two documents: (1) a "May 12, 2014 ‘show cause’ letter from Robbin Weyant, Director, Division of Select Agents & Toxins, to John Galland, University of Hawaii" (the "Letter"); and (2) a "May 12, 2014 inspection report with attachment(s) for University of Hawaii from Robbin Weyant, Director, Division of Select Agents & Toxins, to John Galland, University of Hawaii" (the "Report") (collectively, the "Documents"). Doc. No. 15-3, Def.'s Ex. A.
On April 30, 2015, the CDC FOIA Office acknowledged receipt of Plaintiff's FOIA request by letter. Doc. No. 15-4, Def.'s Ex. B.
On May 5, 2015, the CDC notified Plaintiff it was "withholding all records (18 pages) in full under the authority of 5 U.S.C. § [552](b)(3) and the Department's implementing regulations at 45 CFR § 5.64 because the [Documents] are specifically exempted from disclosure by 42 U.S.C. § 262a(h)(1)(C) and (E)." Doc. No. 15-6, Def.'s Ex. D.
Plaintiff timely administratively appealed the CDC's decision on May 11, 2015. Doc. No. 15-7, Def.'s Ex. E. On November 24, 2015, the Department of Health and Human Services (the "DHHS")—which contains various federal governmental agencies, including the CDC—denied Plaintiff's administrative appeal. Doc. No. 15-8. The parties agree that Plaintiff properly exhausted its administrative remedies. Doc. No. 25, Def.'s Response to Pl.'s Concise Statement of Facts ¶ 2.
B. Plaintiff's Lawsuit
On January 7, 2016, Plaintiff filed the present lawsuit challenging the CDC's decision to withhold the Documents in full. Doc. No. 1. 1. The CDC's Motion
The CDC's Motion, filed on May 11, 2016, contains two declarations in support of the CDC's decision to withhold the documents. Doc. No. 15. First, Bruno Viana, the acting FOIA Officer for the CDC "explain[ed] the procedures that were followed in responding to Plaintiff's FOIA request and the statutory justifications for withholding ... the identified, responsive records." Doc. No. 15-2, Bruno Viana Decl. ("Viana Decl.") ¶ 5. According to Viana:
On April 30, 2015, the CDC FOIA [O]ffice sent a memorandum to the Office of Public Health and Preparedness Response ("OPHR"), Division of Select Agents and Toxins ("DSAT"), instructing OPHPR/DSAT to review the FOIA request and search for the responsive documents .... OPHPR/DSAT was the CDC area chosen for the search because it was the area within the CDC most likely to collect and/or maintain records that related to the subject matter. OPHPR/DSAT regulates the possession, use, and transfer of select agents and toxins and the importation of infectious biological agents, hosts, and vectors of human disease to protect the public health in the United States.
The [OPHPR/] DSAT search revealed a total of eighteen (18) pages of responsive documents, including the May 12, 2014 "show cause" letter comprised of four (4) pages and the May 12, 2014 inspection report comprised of fourteen (14) pages.
Specific categories of select agent records and information are protected under 5 U.S.C. § 552(b)(3) and the Public Health Security and Bioterrorism Preparedness and Response Act of 2002, 42 U.S.C. § 262a(h).
5 U.S.C. § 552(b)(3) provides that the FOIA does not apply to matters that are specifically exempted from disclosure by a statute other than 5 U.S.C. § 552(b), if that statute "(A)(i) requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue; or (ii) establishes particular criteria for withholding or refers to particular types of matters to be withheld." See 5 U.S.C. § 552(b)(3)(A)(i) and (ii).
The Public Health Security and Bioterrorism Preparedness and Response Act of 2002, 42 U.S.C. § 262a, specifically prohibits DHHS/CDC from disclosing under FOIA certain information set out in Section 262a(h)(1), including:
(C) Any portion of a record that discloses the site-specific or transfer-specific safeguard and security measures used by a registered person to prevent unauthorized access to listed agents and toxins.
...
(E) Any portion of an evaluation or report of an inspection of a specific registered person conducted under subsection (f) that identifies the listed agent or toxin possessed by a specific registered person or that discloses the identity or location of a specific registered person if the agency determines that public disclosures of the information would endanger public health or safety.
The practical application of the FOIA exemptions related to select agent records requires knowledge and understanding of the applicable select agent regulations and the workings of the Federal Select Agent Program. With regard to FOIA requests for records relating to select agents, the CDC FOIA Office often seeks assistance and clarification from Federal Select Agent Program Officials to obtain background information relating to the regulations and the Federal Select Agent Program to ensure that the CDC FOIA Office has a sufficient knowledge base to apply the exemptions
properly. Redactions related to select agents are not discretionary.
The CDC FOIA Office, in consultation with [OPHPR/]DSAT and the CDC Branch of the DHHS Office of General Counsel, determined that the two records responsive to Plaintiff's FOIA Request constituted records that were exempt from disclosure under 5 U.S.C. § 552(b)(3) and 42 U.S.C. § 262a(h)(1)(C) and (E).
The CDC FOIA Office, in consultation with [OPHPR/]DSAT and the CDC Branch of the HHS Office of General Counsel, further determined that the responsive records were not reasonably segregable or amenable to partial redaction because the exempt information was so inextricably intertwined with the non-exempt information contained in the records. Moreover, because the requester (Plaintiff) already knew many specific details regarding the requested documents, including exempt information such as the specific site and identity of the registered person involved in the FOIA Request, the CDC FOIA Office concluded that the release of any further details contained in the responsive documents would hinder the prevention of unauthorized access to listed agents and toxins by exposing site specific or transfer specific safeguard and security measures used by the registered person. The CDC FOIA Office also determined that the release of any further details could identify the listed agents or toxins possessed by the specific registered person.
Id. ¶¶ 8-15.
Second, the CDC offered the Declaration of Dr. Daniel M. Sosin, the acting director for OPHPR/DSAT. Doc. No. 15-9, Declaration of Dr. Daniel M. Sosin ("Sosin Decl."). OPHPR/DSAT "administers the CDC's responsibilities in the Federal Select Agent Program ("FSAP")" for the CDC. Id. ¶¶ 3, 5. Dr. Sosin explained:
FSAP responsibilities include the inspection of entities registered with FSAP for the possession, use, and transfer of [biological select agents and toxins ("BSAT") ] to ensure that these entities are in compliance with the federal BSAT regulations. Regulated entities are provided with an inspection report that includes a list of departures from the BSAT regulations. When appropriate, a "show cause" letter is issued to an entity when an inspection of an entity identifies serious regulatory departures. The "show cause" letter lists specific applicable biosafety and security weaknesses; and gives the registered entity the opportunity to provide information as to why the entity's registration should not be suspended.
Id. ¶ 5. Put differently, the Report Plaintiff requested was an FSAP report detailing the University of Hawaii's "departures from the BSAT regulations" and the Letter was FSAP's "show cause" letter identifying "serious regulatory departures." Id. See also ¶¶ 6-9.
Dr. Sosin next discussed the implications of releasing the Documents to Plaintiff:
The possession, use, and transfer of BSAT is heavily regulated because they present a very real risk of being used as a bioweapon. I believe the potential for use of a listed BSAT as a bioweapon presents a serious danger to public health and safety. In order to obtain a listed BSAT for use as a bioweapon, a person (or persons) would be aided by the knowledge of the location of a listed BSAT, perhaps the names of individuals who have lawful access to a listed BSAT, and the site-specific safeguards and security measures used to prevent unauthorized access to listed BSAT in order to avoid or defeat those safeguards and security measures. The ... [D]ocuments requested by the Plaintiff identify listed BSAT registered for possession by the University of Hawaii and disclose the
location of those BSAT, and the site-specific safeguard and security measures used by the University of Hawaii to prevent unauthorized access to those BSAT. I believe the public release of this information has the potential to enable a person (or persons) with nefarious intent to locate and steal such listed BSAT and use them as a weapon of mass destruction that would endanger public health and safety.
Based upon the [OPHPR/]DSAT determination that one of the documents disclosed site-specific safeguard and security measures used by the University of Hawaii to prevent unauthorized access to [BSAT,] and the other document was an evaluation report of an inspection of the University of Hawaii conducted pursuant to 42 CFR part 73 that identified [BSAT] possessed by the University of Hawaii and that disclosed the identity and location of a specific registered person, [OPHPR/]DSAT recommended to the CDC FOIA Office that both responsive documents should be withheld under 5 U.S.C. § 552(b)(3) and 42 U.S.C. § 262a(h)(1)(C) and (E).
Id. ¶¶ 10-11.
Based on these declarations, the CDC argued it "properly determined that the responsive documents were not reasonably segregable and withheld them in their entirety pursuant to FOIA Exemption (b)(3) and 42 U.S.C. § 262a(h)(1)(C) and (E)." Doc. No. 15-1, CDC's Motion at 1-2.
2. Plaintiff's Motion
Plaintiff's Motion, filed on June 23, 2016, does not take issue with the CDC's characterization of 42 U.S.C. § 262a(h)(1)(C) and (E) as an applicable withholding statute. Doc. No. 21. Instead, Plaintiff's Motion argues that "the CDC adopted a blanket ‘standard practice’ of secrecy toward its inspection reports" in violation of FOIA. Id. at 18. Moreover, Plaintiff asserts:
The CDC must explain in as much detail as possible—without breaching the purpose of its claimed exemption—(1) the information in the requested inspection records, (2) why that information falls within the scope of the exemption, and (3) the basis for its determination that no information in the records is segregable. Instead, the CDC offers declarations from individuals who simply recount the CDC FOIA Office's and [OPHPR/]DSAT's procedures in responding to Plaintiff's request, without apparently reviewing the requested documents. The conclusory statements in those declarations fall woefully short of the CDC's burden.
Id. at 19 (internal citations omitted). Plaintiff also opined that, because many details about the University of Hawaii's BSAT research are publicly available, id. at 11-12, the Documents have "negligble security value." Id. at 3.
3. CDC's Reply
On July 5, 2016, the CDC replied to Plaintiff's Motion. Doc. No. 24 ("CDC's Reply"). The CDC reiterated its position that 42 U.S.C. § 262(a) (the "Act") qualifies as a withholding statute under FOIA Exemption 3. Id. at 1. In addition, the CDC asserted for the first time that it properly withheld the Documents under FOIA Exemption 6. a. Exemption 3
Under FOIA Exemption 6, federal agencies are exempt from disclosing "personnel and ... similar files" when the disclosure of such files "would constitute a clearly unwarranted invasion of personal privacy." 5 U.S.C. § 552(b)(6). The CDC's Reply explained it invoked Exemption 6 "to withhold discrete information relating to the names and telephone numbers of certain [OPHPR/]DSAT employees." Doc. No. 24, CDC's Reply at 13 n.8. The CDC further acknowledged that it "recognizes that it should have asserted this FOIA Exemption 6 in its initial moving papers and apologizes for its inadvertent oversight."Id. at 2 n.1.
In support of withholding the Documents pursuant to Exemption 3, the CDC offered a supplemental declaration from Mr. Viana, explaining that:
The CDC is mindful that the FOIA requires that an agency take reasonable steps to segregate and release nonexempt information ....
Contrary to Plaintiff's unsupported allegation, the CDC has not adopted a "blanket ‘standard practice’ of secrecy toward its inspection reports that ignores the plain language of the 2002 Act." The CDC conducts a case-by-case review of all FOIA requests received by the agency; FOIA requests involving information related to [BSAT] are treated no differently. The CDC, through [OPHPR/DSAT] and the CDC FOIA Office (and, as necessary, in consultation with the CDC Branch of the DHHS Office of the General Counsel), reviews all FOIA requests for information relating to [BSAT], including the documents responsive to such requests (such as the two responsive documents in this case), to determine what information is protected pursuant to FOIA Exemption 3 and 42 U.S.C. § 262a(h)(1). The CDC does not use a "blanket" policy for the application of FOIA Exemption 3, but it does apply FOIA Exemption 3 consistently to inspection reports and "show cause" letters concerning registered entities. The information in each document is then reviewed and assessed by the staff of [OPHPR/]DSAT and the CDC FOIA Office to determine what information, if any, falls outside of the scope of FOIA Exemption 3 and may be disclosed.
In the instant case, the CDC followed the above-described approach in processing Plaintiff's FOIA request and reviewing [the Documents.] In addition to the staff of the CDC FOIA Office, a representative of the OPHPR/[DSAT] and two attorneys from the CDC Branch of the DDHS Office of General Counsel ... reviewed the [Documents] and concurred with the CDC FOIA Office's determination that the [Documents], by their very nature and purpose, contained protected information exempted from disclosure under FOIA Exemption 3 and 42 U.S.C. § 262(a)(h)(1)(C) and/or (E), that was inextricably intertwined with non-exempt information such that reasonable segregation was not possible and would produce an essentially meaningless set of words and phrases which taken separately or together have minimal or no informational content. This is the basis upon which the CDC determined that the [Documents] were not reasonable segregable. In order to demonstrate this fact to the Court, redacted copies of the [Documents] are attached hereto as Exhibits 1 and 2[.]
Doc. No. 24-1, Supplemental Decl. of Bruno Viana ("Supp. Viana Decl.") ¶¶ 5-7 (internal citations omitted). That is, the CDC's Reply produced redacted versions of the Documents.
The Report is prefaced by a cover letter entitled "RE: Entity Inspection Report." Doc. No. 24-2, Ex. 1 at 1. The cover letter indicates that, pursuant to the Act, OPHPR/DSAT personnel inspected a facility containing BSAT "from March 03, 2014 to March 07, 2014" pursuant to the Act and, "[d]uring the inspection, departures from regulatory requirements ... were noted." Id. at 3. The cover letter warned that failure to produce a "detailed response" within 14 days "may result in the initiation of proceedings for the withdrawal of your facility registration to possess, use, or transfer" BSAT. Id. Pursuant to FOIA Exemptions 3 and 6, the CDC redacted the location of the facility, the names of the personnel inspecting the facility, and the names of the facility employees present during the inspection. See id. at 1-3.
The Report itself begins with the heading "Entity Departures" followed by 30 instances where a "Requirement" and an "Observation" are listed. Id. at 4-11. The substance of each "Requirement" and each "Observation" is fully redacted. Id.
The last three pages of the Report contain an attachment entitled "BSL-3/ABSL-3 Verification" (the "Attachment") See id. at 12-14. The Attachment describes airflow within the facility, "verification of HVAC design functionality under failure conditions," the requirement that "laboratory air does not exit the containment barrier of the facility," and outlines "minimum facility verification requirements." Id. at 12-13. The substance of the Attachment is not redacted. Id. at 12-14. However, the Attachment references the names and contact information of two CDC personnel and the CDC redacted the names of the CDC personnel as well as their contact information. Id. at 15.
The Letter produced in the CDC's Reply begins with "Subject: Opportunity to Show Cause why the Select Agent Registration of the [redacted] should not be suspended or revoked." Doc. No. 24-3, Def.'s Ex. 2. The Letter states that "[redacted] is being provided the opportunity to show why the registration of [redacted] to possess, use, and transfer [BSAT] should not be suspended or revoked." Id. at 1. The Letter explains that OPHPR/DSAT is taking action "based on the observations noted during the March 3-7, 2014 inspection" and that OPHPR/DSAT "has significant concerns regarding the administrative oversight of the [BSAT] possessed and used by [redacted] ...." Id. The Letter continues:
[Redacted] has failed to implement the amended regulatory requirements published in the Federal Register on October 5, 2012, by their effective dates of December 4, 2012 and April 3, 2013. Onsite evaluation of [redacted] [BSAT] program, conducted approximately 15 and 11 months after these effective dates, indicated a serious disregard for these regulatory requirements resulting in observed compliance departures in the security, biosafety, incident response, and training requirements of the [BSAT] regulations. Interviews conducted by the [OPHPR/]DSAT inspection team indicated that RO was aware of the new requirements, but took no action to ensure a compliant [BSAT] program. Specifically, onsite evaluation of [redacted] [BSAT] program indicated that at least one of the three [redacted] appointed AROs was fully aware of the regulatory requirements as specified in the notice of amended [BSAT] [redacted].
Id. at 1-2. Page 2 of the Letter is largely redacted. See id. at 2. It appears, however, that the "RO" failed to satisfy five regulatory requirements. See id. at 2 (stating that "[s]pecifically, the RO failed to:" followed by five bullet points and redacted text). The Letter concludes by stating that "CDC is willing to allow [redacted] to participate in a Performance Improvement Plan Program (PIPP)" and identifies various steps for "[redacted]" to take within 14 days if "[redacted] desires to participate in the PIPP." Id. at 4.
The term "RO" and "ARO" is not defined in the unredacted portions of the Letter.
Mr. Viana explains:
As reflected in Exhibits 1 and 2, the CDC redacted portions of the subject documents based primarily on FOIA Exemption 3 and 42 U.S.C. § 262a(h)(1)(C) and/or (E)....
The redactions based on FOIA Exemption 3 and 42 U.S.C. § 262a(h)(1)(C)
were made because those portions of the subject documents disclosed site-specific safeguards and/or security measures that were used by a specific registered entity to prevent unauthorized access to listed agents and toxins. As both of the [Documents] relate to a specific registered person and a specific location, the CDC determined that all of the information describing the nature and quality of the safety and security measures was site-specific and fell within the protections of Exemption 3 and Section 262a(h)(1)(C). The CDC determined that the public disclosure of the redacted information relating to site specific safeguard and security measures—including the identification of weaknesses and deficiencies of those site-specific safety and security measures that require correction by the registered entity—would endanger public health or safety ....
The redactions based on FOIA Exemption 3 and 42 U.S.C. § 262a(h)(1)(E) were made because those portions of the [Documents] constituted portions of an evaluation or report of an inspection of a specific registered person ... that identified the listed agent or toxin possessed by a specific registered person and/or disclosed the identity or location of a specific registered person or entity. The CDC determined that [the Documents] ... would endanger public health or safety because the documents, by their very nature and purpose, identify site-specific violations of regulatory requirements set out in 42 C.F.R. Part 73, including deficiencies relating to safety and security measures that must be corrected by the registered entity. The CDC determined that public disclosure of the redacted information contained in the requested documents would endanger public health or safety because it would inform individuals with nefarious intentions of site-specific weaknesses in the safeguards and/or security measures employed by the particular registered entity at a particular location....
The fact that Plaintiff may know the identity and/or location of the registered person does not render as non-exempt the redacted information protected by FOIA Exemption 3 and 42 U.S.C. § 262a(h)(1)(C) and/or (E) ; nor does it excuse the CDC from its duty not to disclose information protected by 42 U.S.C. § 262a(h)(1).
Doc. No. 24-1, Supp. Viana Decl. ¶¶ 8-11.
b. Exemption 6
In support of its newly-claimed Exemption 6, Mr. Viana explained:
The names and contact information of the [OPHPR/]DSAT staff members also were redacted in accordance with Exemption 6 because the disclosure of this private information will add nothing to the public's awareness of what its government is up to. Based on its determination that the privacy interests of the individual DSAT staff members identified in the [Documents] was not outweighed by the public's interest in the disclosure of their names and contact information, the CDC redacted that information pursuant to FOIA Exemption 6.
Id. ¶ 13 (citing Dep't of Justice v. Reporters Comm. for Freedom of Press , 489 U.S. 749, 756, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989) ).
4. Plaintiff's Reply
On July 11, 2016, Plaintiff filed its Reply ("Plaintiff's Reply"). Doc. No. 26. Plaintiff's Reply requests that the Court either (a) order the immediate disclosure of the Documents without redactions, or (b) conduct an "in camera review for the Court to identify the limited portions of the records that disclose site-specific measures used by UH to prevent unauthorized access to [BSAT]." Id. at 16.
Plaintiff's Reply articulates four primary concerns. First, "CDC redacted all references to UH" but "CDC introduced these documents here as relevant to a request specifically for UH inspection records, so the CDC obviously concedes that the redacted records concern UH. Redacting the specific references in the documents is baffling." Id. at 4. Second, Plaintiff takes issue with CDC's redaction of all specific regulatory deficiencies in the Documents. Id. at 8–12. Third, Plaintiff argues that the redacted Letter indicates that UH likely entered a PIPP it is therefore possible that the Documents "may no longer" be protected by FOIA Exemption 3 and 42 U.S.C. § 262a(h)(1)(C) and/or (E). Id. at 11–12. Finally, Plaintiff argues that "[t]he CDC has not put forward any valid legal or factual basis for withholding the names of the [OPHPR/]DSAT employees" pursuant to FOIA Exemption 6. Id. at 15.
5. Supplemental Briefing
After the July 18, 2016 hearing on Defendant's Motion and Plaintiff's Motion, Doc. No. 27, the court ordered the CDC to provide supplemental declarations addressing three deficiencies in the record and allowed Plaintiff the opportunity to respond. Doc. No. 30. Specifically, the court ordered the CDC to: (1) explain why it originally viewed the Documents as non-segregable but later produced redacted copies, id. at 2–3; (2) explain "how and why revealing regulatory deficiencies create a site-specific security issue in this context," id. at 4; and (3) "clearly state whether the CDC has ‘officially acknowledged’ the specifically redacted information in the context of the Documents." Id. at 6. In response, the CDC filed a supplemental brief containing four declarations on August 3, 2016. Doc. No. 31.
As the court explained in its Order, "[w]hether the CDC's redactions are appropriate depends on whether the CDC has ‘officially acknowledged’ the specifically redacted information in the context of the Documents." Doc. No. 30 at 5. That is:
For information to qualify as ‘officially acknowledged,’ it must satisfy three criteria: (1) the information requested must be as specific as the information previously released; (2) the information requested must match the information previously disclosed; and (3) the information must already have been made public through an official and documented disclosure ... [P]rior disclosure of similar information does not suffice; instead, the specific information sought by the plaintiff must already be in the public domain by official disclosure. This insistence on exactitude recognizes the Government's vital interest in information relation to national security and foreign affairs.
Am. Civil Liberties Union v. Dep't of Defense, 628 F.3d 612, 620–21 (D.C. Cir. 2011) (internal citations and quotation marks omitted). See also Leopold v. Dep't of Justice, 130 F.Supp.3d 32, 47–48 (D.D.C. 2015) ("When information has been ‘officially acknowledged,’ its disclosure may be compelled even over an agency's otherwise valid exemption claim.") (citing Fitzgibbon v. CIA, 911 F.2d 755, 765 (D.C. Cir. 1990) (some internal marks omitted)).
In response to the court's first question, the CDC filed supplemental briefing on August 3, 2016 (the "CDC's Supplemental Brief"). Doc. No. 31. The CDC explained that this lawsuit:
presents the first time that the CDC's withholding of information under FOIA Exemption 3 and the [Act] ... has been challenged in litigation. Applying the nondisclosure provisions of the Act to particular select agent documents is not a simple process and requires a certain level of knowledge and understanding of the select agent regulations and the workings of ... [FSAP] in order to appropriate determine what information should be withheld and what information can be disclosed.
Doc. No. 31-1, Second Supp. Viana Decl. ¶ 5. Specifically, because "the disclosure of any information contained in the responsive documents would be associated with the registered identity identified by Plaintiff, the CDC FOIA Office took extreme precaution in reviewing the documents and applying the nondislosure provisions of the Act." Id. ¶ 6. Accordingly, the CDC initially took the position that the documents were protected in their entirety by the Act. Id. However, "[a]t the behest of legal counsel," the CDC "conducted a careful and thorough process of re-reviewing" the Documents and ultimately decided to produce them in redacted form. Id. ¶ 7.
In response to the court's second question, the CDC articulated fifteen concrete examples demonstrating how "revealing the regulatory deficiencies contained in a registered entity's FSAP inspection report could create site-specific security issues." Doc. No. 31-2, Supp. Sosin Decl. ¶ 19. See id. at ¶ 19 (a)–(o).
In response to the court's third question, the CDC stated it "has never ‘officially acknowledged’ or made any documented disclosure of the redacted information" in the Documents. Second Supp. Viana Decl. ¶ 11. Specifically, the CDC stated that it "has not publically identified whether the University of Hawaii is a registered entity" nor has it "made public any of the inspection results" contained in the Documents. Doc. No. 31-2, Supp. Sosin Decl. ¶¶ 10-11. Notwithstanding the foregoing, the CDC also declared that the Attachment "is available to the public on the Federal Select Agent Program website." Id. ¶ 12.
On August 10, 2016, Plaintiff responded to the CDC's Supplemental Brief ("Plaintiff's Response"). Doc. No. 32. Plaintiff first argued that the CDC has not justified its redactions of all references to the University of Hawaii. Id. at 1–3. Next, Plaintiff's Response contended that the CDC has not justified the redactions of CDC officials and their contact information in the Attachment. Id. at 13–16. Plaintiff's Response also maintained that the CDC failed to justify its redactions of site-specific regulatory deficiencies because the declarations in the CDC's Supplemental Brief only "offer[ ] generic descriptions of the ways that each regulation might be violated to argue that revealing anything about the deficiency might lead to a security breach." Id. at 16. Toward that end, Plaintiff's Response further argues that " ‘site-specific failures ' do not logically equate to ‘site-specific’ security measures." Id. at 23. Finally, Plaintiff's Response requests in camera review and asks that the court "order that—at a minimum—the CDC violated the FOIA by withholding the inspection records in their entirety," thereby forcing Plaintiff "to file suit and wait over a year to learn that the CDC's position regarding segregability was a patently meritless assessment." Id. at 28.
On August 15, 2016, the court issued a Minute Order indicating that it was inclined to agree with Plaintiff that the CDC conceded it improperly redacted the identity of personnel referenced in the Attachment and ordering the CDC to respond. Doc. No. 33. On August 17, 2016, the CDC affirmed that the information in the Attachment:
is publicly available on the Federal Select Agent Program website, including the redacted names and contact information of the ... [CDC personnel] who have been designated to answer questions about the HVAC policies. Accordingly, the CDC concedes that the specific redactions on PageID# 296 based on FOIA Exemption 6 (and noted in the Court's Minute Order) were made in error as the result of an inadvertent mistake.
Doc. No. 34 at 2. However, the CDC maintains "that all other redacted portions of the requested documents were properly withheld" pursuant to FOIA Exemptions 3 and 6. Id. at 2–3.
III. STANDARD OF REVIEW
Summary judgment is proper where there is no genuine issue of material fact and the moving party is entitled to judgment as a matter of law. See Fed. R. Civ. P. 56(c). Rule 56(c) mandates summary judgment "against a party who fails to make a showing sufficient to establish the existence of an element essential to the party's case, and on which that party will bear the burden of proof at trial." Celotex Corp. v. Catrett , 477 U.S. 317, 322, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986) ; see also Broussard v. Univ. of Cal. at Berkeley , 192 F.3d 1252, 1258 (9th Cir. 1999).
In the context of a FOIA lawsuit, summary judgment in favor of a federal agency is appropriate if the agency "demonstrate[s] that each document that falls within the class requested either has been produced, is unidentifiable, or is wholly exempt from the Act's inspection requirements." Ruotolo v. Dep't of Justice, Tax Div. , 53 F.3d 4, 9 (2d Cir. 1995). "When an agency chooses to invoke an exemption to shield information from disclosure, it bears the burden of proving the applicability of the exemption." Yonemoto v. Dep't of Veterans Affairs , 686 F.3d 681, 688 (9th Cir. 2011) (citation omitted). Toward that end, "[a]n agency may withhold only that information to which the exemption applies, and so must provide all ‘reasonably segregable’ portions of that record to the requester." Id. (citing 5 U.S.C. § 552(b) ). The court reviews de novo an agency's invocation of a FOIA exemption. 5 U.S.C. § 552(a)(4)(B).
Larson v. Department of State , 565 F.3d 857, 862 (D.C. Cir. 2009), explains:
Summary judgment is warranted on the basis of agency affidavits when the affidavits describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the information withheld logically falls within the claimed exemption, and are not controverted by either contrary evidence in the record nor by evidence of agency bad faith .... an agency's justification for invoking a FOIA exemption is sufficient if it appears logical or plausible.
Id. (internal citation and quotation marks omitted). Additionally, an agency's affidavits are "accorded a presumption of good faith" that "cannot be rebutted by purely speculative claims." SafeCard Servs., Inc. v. SEC , 926 F.2d 1197, 1200 (D.C. Cir. 1991) (quotation marks and citation omitted).
Although "FOIA provides district courts the option to conduct in camera review, 5 U.S.C. § 552(a)(4)(B)," Larson , 565 F.3d at 869, "when the agency meets its burden by means of affidavits, in camera review is neither necessary nor appropriate." Id. at 870 (citation and quotation marks omitted). That is, so long as "the agency's affidavits provide specific information sufficient to place the documents within the exemption category, if this information is not contradicted in the record, and if there is no evidence in the record of agency bad faith, then summary judgment is appropriate without in camera review of the documents." Id. (citation and quotation marks omitted). See also Citizens Comm'n on Human Rights v. FDA , 45 F.3d 1325, 1329 (9th Cir. 1995) ("If the affidavits contain reasonably detailed descriptions of the documents and allege facts sufficient to establish an exemption, the district court need look no further."). See also Lion Raisins v. Dep't of Agric. , 354 F.3d 1072, 1079 (9th Cir. 2004) ("In camera inspection of documents is disfavored ... where the government sustains its burden of proof by way of its testimony or affidavits.") (citing Lewis v. IRS , 823 F.2d 375, 378 (9th Cir. 1987) ). Moreover, "[w]here the government invokes FOIA exemptions in cases involving national security issues," the court is "required to accord substantial weight to the agency's affidavits" because of its "limited institutional expertise on intelligence matters, as compared with the executive branch." Hamdan v. Dep't of Justice , 797 F.3d 759, 770 (9th Cir. 2015).
IV. DISCUSSION
A. Exemption 3
"A two-part inquiry determines whether Exemption 3 applies to a given case. First, a court must determine whether there is a statute within the scope of Exemption 3. Then, it must determine whether the requested information falls within the scope of the statute." Minier v. C.I.A. , 88 F.3d 796, 801 (9th Cir. 1996).
FOIA Exemption 3 allows an agency to withhold information "specifically exempted from disclosure by statute ..., if that statute (A)(i) requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue, or (ii) establishes particular criteria for withholding or refers to particular types of matters to be withheld." 5 U.S.C. § 552(b)(3)(A). Here, the CDC contends that the Public Health Security and Bioterrorism Preparedness and Response Act (the "Act") is a withholding statute pursuant to FOIA Exemption 3. The Act expressly provides that the DHHS is forbidden from disclosing the following information pursuant to a FOIA request:
(C) Any portion of a record that discloses the site-specific or transfer-specific safeguard and security measures used by a registered person to prevent unauthorized access to listed agents and toxins.
....
(E) Any portion of an evaluation or report of an inspection of a specific registered person conducted under subsection (f) of this section that identifies the listed agent or toxin possessed by a specific registered person or that discloses the identity or location of a specific registered person if the agency determines that public disclosure of the information would endanger public health or safety.
42 U.S.C. § 262a(h)(1). See also 42 U.S.C. § 262a(h)(2) (explaining that the DHHS is one of the covered federal agencies prohibited from providing the above-referenced information pursuant to FOIA). Based on the plain language of the Act, the court concludes that it falls within the scope of Exemption 3. Minier , 88 F.3d at 801.
The court finds that the CDC's justifications for invoking Exemption 3 are logical and plausible. Larson , 565 F.3d at 862. That is, the CDC's declarations adequately "describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the information held logically falls within the claimed exemption, and are not controverted by either contrary evidence in the record nor by evidence of agency's bad faith." Id.
Plaintiff's objections to the contrary are unpersuasive. With regard to Plaintiff's objection that CDC wrongly redacted any reference to the University of Hawaii, the Act makes clear that the CDC may not disclose:
Any portion of an evaluation or report of an inspection of a specific registered person ... that identifies the listed agent or toxin possessed by a specific registered person or that discloses the identity or location of a specific registered person if the agency determines that public disclosure of the information would endanger public health or safety.
42 U.S.C. § 262a(h)(1)(E). Thus, when the CDC produced the Documents it appropriately redacted references to the location of the specific registered person (i.e. , the location of the inspected facility) based on its articulated determination that public disclosure would endanger public health or safety. See, e.g. , Viana Decl. ¶ 15 (explaining that "the release of any further details contained in the responsive documents would hinder the prevention of unauthorized access to listed agents and toxins by exposing site specific or transfer specific safeguard and security measures used by the registered person"). See also Sosin Decl. ¶ 10 (stating that "the public release of this information has the potential to enable a person (or persons) with nefarious intent to locate and steal such listed BSAT and use them as a weapon of mass destruction that would endanger public health and safety").
And the CDC recognizes that Plaintiff already knows this information. See Viana Decl. ¶ 15 ("[T]he requester (Plantiff) already knew many specific details regarding the requested documents, including exempt information such as the specific site and identity of the registered person involved in the FOIA Request"). But the fact that Plaintiff knows this information "does not render as non-exempt the redacted information protected by FOIA Exemption 3 and 42 U.S.C. § 262a(h)(1)(C) and/or (E) ; nor does it excuse the CDC from its duty not to disclose information protected by 42 U.S.C. § 262a(h)(1)." Supp. Viana Decl. ¶ 11. See also Am. Civil Liberties Union , 628 F.3d at 620–21 ; Leopold , 130 F.Supp.3d at 47–48. That is, there is no exception in the Act allowing the CDC to produce exempt information that has already entered the public domain through other means.
Further, the CDC expressly stated that it "has never ‘officially acknowledged’ or made any documented disclosure of the redacted information" in the Documents. Second Supp. Viana Decl. ¶ 11. The CDC further stated that it "has not publically identified whether the University of Hawaii is a registered entity" nor has it "made public any of the inspection results" contained in the Documents. Doc. No. 31-2, Supp. Sosin Decl. ¶¶ 10-11. These declarations—which are accorded a presumption of good faith and are not controverted by any contrary evidence in the record, Larson , 565 F.3d at 862 —effectively establish that the CDC has not "officially acknowledged" the Documents. See Am. Civil Liberties Union , 628 F.3d at 620–21 ; Leopold , 130 F.Supp.3d at 47–48. As such, the CDC has satisfied its burden for redacting any references to the University of Hawaii in the Documents. That is, it was appropriate for the CDC to redact any references to the University of Hawaii because, even if Plaintiff knows the precise location of the CDC inspection, the CDC is not required to produce the information in response to a FOIA request. Plaintiff next argues that the CDC "seeks a blanket rule that any information about regulatory deficiencies is exempt under the security exception" and that "[t]he supplemental declarations concede that the CDC's factual proffer has no connection to the specific records at issue." Doc. No. 32 at 17. The court disagrees. To begin, the CDC has never asked for a "blanket rule." To the contrary, the CDC has repeatedly emphasized that this case presents an "unusual set of facts." Doc. No. 31-1, Second Supp. Viana Decl. ¶ 6. And, while the CDC may not have initially undertaken a sufficiently detailed approach to the Documents, it subsequently "conducted a careful and thorough process of re-reviewing and redacting the documents." Id. ¶ 7. Indeed, the CDC has issued multiple sets of declarations in this case—first, in connection with the CDC's Motion, then in support of the CDC's Reply, and finally in the CDC's Supplemental Brief. While the court found that the declarations attached to the CDC's Motion and the CDC's Reply were not sufficiently detailed, the agency redoubled its efforts with its declarations in support of the CDC's Supplemental Brief. Ultimately, the court is persuaded that these declarations, in their totality, reflect a particularized approach to the Documents at issue in this case.
Pickard v. Department of Justice, 653 F.3d 782 (9th Cir. 2011), is not to the contrary. Pickard involved a federal inmate who sued the Department of Justice under FOIA in an effort to compel the Drug Enforcement Administration ("DEA") to produce records regarding a confidential informant. Id. at 784. In that case, the DEA "submitted a Glomar response refusing to confirm or deny the existence of any responsive records." Id. A Glomar response allows an agency to "refus[e] to confirm or deny the existence of records where to answer the FOIA inquiry would cause harm cognizable under a FOIA exception." Id. at 786. In Pickard, the Ninth Circuit held that a Glomar response was inappropriate because the government had called the confidential informant "as a witness in Pickard's criminal trial and elicit[ed] testimony ... that identifies [the individual] as a confidential informant." Id. But the CDC never issued a Glomar response to Plaintiff's FOIA request in this case. Indeed, the CDC confirmed the existence of the Documents during the administrative review of Plaintiff's FOIA Request. See Doc. No. 15-6. And, ultimately, the CDC also produced substantial portions of the Documents in unredacted form. As the CDC itself explained, it "determined that a ‘Glomar Response’ [is] not appropriate in this case" and the CDC therefore "acknowledge[d] its possession of two select agent documents that were responsive to Plaintiff's request." Doc. No. 31, Second Supp. Viana Decl. ¶ 6. As such, Pickard —which is specific to an agency's invocation of a Glomar response—is unhelpful to Plaintiff.
--------
The court is also persuaded that it was appropriate in this case for the CDC to offer abstract examples about what could happen if the CDC revealed the specific regulatory deficiencies in the Documents. As the CDC explained, regulatory deficiencies only arise in the context of "performance standards that each registered entity must satisfy based upon the nature of its select agent program and its particular facilities." Suppl. Sosin. Decl. ¶ 17. Accordingly, "by application, every regulatory deficiency listed in an inspection report or show cause letter would be a ‘site-specific’ failure to protect against theft, loss, or release." Id. In light of this fact, the CDC explained "[r]evealing the regulatory deficiencies contained in a registered entity's FSAP inspection report could create site-specific security issues." Id. ¶ 19. Moreover, the CDC has consistently explained:
because the requester (Plaintiff) already knew many specific details regarding the requested documents, including exempt information such as the specific site and identity of the registered person involved in the FOIA request, the CDC FOIA Office concluded that the release of any further details contained in the responsive documents would hinder the prevention of unauthorized access to listed agents and toxins by exposing site specific or transfer specific safeguard and security measures used by the registered person.
Doc. No. 15-2, Viana Decl. ¶ 15. That is, in this context, "the release of any further details could identify the listed agents or toxins possessed by the specific registered person." Id. As such, in lieu of providing specific details regarding the site-specific deficiencies in the Documents, the CDC offered fifteen examples of regulatory deficiencies. See Doc. No. 31-1, Second Supp. Sosin Decl. ¶¶ 19 (a)-(o).
In light of the foregoing, the court finds that the CDC demonstrated the applicability of Exemption 3 with regard to the site-specific deficiencies in the Documents in "reasonably specific detail." Larson , 565 F.3d at 862. The court is persuaded that, in this context, the CDC was as specific as it could be without revealing the very information that is subject to Exemption 3 and the Act. As such, the CDC has met its burden of invoking Exemption 3 to redact the site-specific regulatory deficiencies in the Documents.
The remainder of Plaintiff's objections to the CDC's redactions of the Documents pursuant to Exemption 3 and the Act are purely speculative, and therefore do nothing to controvert the CDC's good faith declarations. SafeCard Servs., Inc. , 926 F.2d at 1200.
In light of the foregoing, the court finds that the CDC properly redacted the Documents pursuant to Exemption 3 and the Act. Because the CDC's declarations adequately satisfy its burden, the court declines to conduct an in camera inspection of the Documents. See Lion Raisins , 354 F.3d at 1079 ("In camera inspection of documents is disfavored, however, where the government sustains its burden of proof by way of its testimony or affidavits.").
B. Exemption 6
Plaintiff argues that the CDC's invocation of Exemption 6 "seeks to create from whole cloth an exemption for the identity of any [OPHPR/]DSAT employee." Doc. No. 26, Pl.'s Reply at 13.
"Exemption 6 allows an agency to withhold ‘personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.’ " Prudential Locations LLC v. Dep't of Hous. and Urban Dev. , 739 F.3d 424, 429 (9th Cir. 2013) (quoting 5 U.S.C. § 552(b)(6) ). The court "ask[s] two questions in deciding whether an agency has properly withheld records or information under Exemption 6." Id. First, the court asks "whether the document qualifies under the heading of ‘personnel and medical files and similar files.’ " Id. (quoting § 552(b)(6) ). Second, the court considers "whether the production of the document, or information contained therein, ‘would constitute a clearly unwarranted invasion of personal privacy.’ " Id. (quoting § 552(b)(6) ).
"Congress, in enacting Exemption 6, intended to strike a proper balance between the protection of the individual's right of privacy and the preservation of the public's right to Government information by excluding those kinds of files the disclosure of which might harm the individual." Dep't of Air Force v. Rose , 425 U.S. 352, 383, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976) (citation and quotation marks omitted). In evaluating the applicability of Exemption 6, the court must "weigh, realistically, the grave consequences implicit in release of this particular information, in any form, against the relatively inconsequential claim of ‘need’ for the material alleged in the complaint." Id. (citation and quotation marks omitted).
Here, CDC invoked Exemption 6 to redact names and contact information of the OPHPR/DSAT personnel identified within the Documents. In this context, the Documents are similar to personnel files in the sense that they contain the names and contact information of OPHPR/DSAT personnel in the context of a specific investigation conducted at a specific time and location with regard to highly-sensitive BSAT data. See Doc. Nos. 24–2 and 24–3. CDC properly invoked Exemption 6 because releasing this information is, at a minimum, "a clearly unwarranted invasion of personal privacy." § 552(b)(6).
Put simply, this information could realistically endanger the named OPHPR/DSAT personnel as well as the greater public health. Rose , 425 U.S. at 383, 96 S.Ct. 1592. As the CDC explained, "DSAT staff members have knowledge of, and process highly sensitive, national security records and data on a daily basis." Supp. Viana Decl. ¶ 12. Releasing the names and contact information of the specific OPHPR/DSAT personnel associated with the Documents could empower an individual with "nefarious intent" to target the OPHPR/DSAT personnel in the Documents, thereby posing a security risk. See Sosin Decl. ¶¶ 10-11.
Additionally, there is no apparent cognizable "need" for this information to be released. Rose , 425 U.S. at 383, 96 S.Ct. 1592. There is nothing in the record that indicates the information redacted pursuant to Exemption 6 would "shed light on the agency's performance of its duties." Murphy v. I.R.S. , 79 F.Supp.2d 1180, 1184 (D. Haw. 1999) (citing Reporters Comm. for Freedom of Press , 489 U.S. at 762, 109 S.Ct. 1468 ). See also Supp. Viana Decl. ¶ 13 (explaining that "the disclosure of this private information will add nothing to the public's awareness of what its government is up to"). To the contrary—as Plaintiff's briefing demonstrates—Plaintiff is perfectly capable of evaluating the CDC's performance of its duties without the names and contact information of OPHPR/DSAT personnel associated with the Documents.
Moreover, the court observes that this particularized information the CDC redacted pursuant to Exemption 6 is distinguishable from the generic website directories referenced in Plaintiff's Reply. See Doc. No. 26-1, Plaintiff's Reply at 14 (referring to Plaintiff's exhibits of various website directories containing data such as the names and contact information of government employees). Although the names and contact information of OPHPR/DSAT may be available on the Internet, any such information is posted without detailed context that makes clear the specifics of their job duties. By contrast, forcing the CDC to disclose the names and contact information of OPHPR/DSAT in the Documents would reveal much more specific and personal information such as where they conduct their investigations, when they conduct them, and what kind of sensitive BSAT-related information they know. As such, the Documents provide substantially more context than a generic website directory, and the CDC properly invoked Exemption 6 in response to Plaintiff's request. Rose , 425 U.S. at 383, 96 S.Ct. 1592.
Notwithstanding the foregoing, the CDC has conceded that "the specific redactions on PageID# 296 based on FOIA Exemption 6 (and noted in the Court's Minute Order) were made in error as the result of an inadvertent mistake." Doc. No. 34 at 2. Accordingly, the CDC is ordered to produce to Plaintiff that page without the inappropriate redactions no later than September 12, 2016.
C. Plaintiff's Requests
Plaintiff's Response "respectfully requests that the Court enter an order (1) declaring that the CDC violated the FOIA by withholding all records as not reasonably segregable; and (2) requiring the CDC to disclose all non-exempt information" in the Documents. Doc. No. 32 at 29-30.
The CDC's approach to this case could certainly have been more focused: the CDC belatedly claimed Exemption 6 and the CDC also overzealously redacted PageID# 296. Additionally, the court agrees that the CDC should promptly produce a properly-redacted version of PageID# 296. But lack of focus is not, in and of itself, a FOIA violation. See Yonemoto , 686 F.3d at 689 (explaining that "the production of all nonexempt material, however belatedly, moots FOIA claims") (internal quotation marks omitted).
V. CONCLUSION
Based on the above, the court GRANTS in part and DENIES in part both the CDC's Motion and Plaintiff's Motion. The CDC is ordered to produce to Plaintiff a properly redacted version of Page ID# 296 by September 12, 2016. The Clerk of Court is ordered to close this case.
IT IS SO ORDERED.