UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

BUZZFEED, INC.,

Plaintiff ,

v. DEPARTMENT OF HOMELAND SECURITY et al. ,

Defendants. No. 19

- cv - 03062 (DLF)

MEMORANDUM OPINION In this action, Buzzfeed challenges the U.S. Customs and Border Protection’s (CBP) withholding of documents under the Freedom of Information Act (FOIA), 5 U.S.C. § 552. Before the Court is the defendants ’ Renewed Motion for Summary Judgment, Dkt. 57 , and the plaintiff’s
Cross

- Motion for Summary Judgment, Dkt. 58

. For the reasons that follow, the Court will grant the defendants ’ m otion in part and deny it in part, and the Court will deny the plaintiff’s m otion in full

. I. BACKGROUND On July 2, 2019, the Inspector General of the Department of Ho meland Security (DHS) issued an alert on overcrowding and prolonged detention of adults and children in the Rio Grande Valley (RGV Alert). Def s .’ Stmt. of Material Facts ¶ 1, Dkt. 37

- 1; Howard Decl. ¶ 13, Dkt. 37

- 3. The next day, Buzzfeed requested “any and all databases containing records on which the calculation in” the RGV Alert “are based” including “a full and up

- to

- date copy of the database(s) referenced in the above custody database.” Howard Decl. ¶¶ 5, 15. Buzzfeed’s request “also demanded all records from 2010 through the date of the search documenting the structure and use2

of databases relied upon, to specifically include user manuals, schemas, layout, r elationships, and definitions of variables.” Id. ¶ 17

. Buzzfeed filed the instant case on October 14, 2019. See generally Compl., Dkt. 1. CBP answered on December 29, 2019. See generally Answer, Dkt. 11. The agency determined that Border Patrol was the division most likely to have responsive information, and it was likely to be stored “within the Enforcement Integrated Database (EID).” Howard Decl. ¶¶ 19, 21. The EID is a shared DHS database “owned and operated by U.S. Immigration and Customs Enforcement (ICE).” Id. ¶ 21. The database “captures and maintains info rmation related to the investigation, arrest, booking, detention, and removal of persons encountered during immigration and criminal law enforcement investigations and operations conducted by DHS components.” Id. Over the following months, CBP worked wit h Buzzfeed to “narrow and clarify the scope of” the request. Id. ¶ 24. In November 2020, this resulted in “a spreadsheet file for each fiscal year from FY2010 to FY2020” with “over 4,423,000 unredacted rows of responsive data.” Id. ¶ 25. Each row contained the following data fields: Border Patrol sector, Date and Time of Apprehension, Citizenship, Gender, Age, Demographic, Time in the U.S., Da t e and Time of Initial Booking, Date and Time of Final Booking, Time in Custody. Id. ¶¶ 24

– 25. Buzzfeed sought additional data for each individual that CBP withheld: facility name, alien registration number (A

number) or “some other ‘unique identifier’ t hat would permit [p]laintiff to track individuals and aggregate their records across multiple data sets,” id. ¶ 26 , and “ a decade’s worth of records documenting the structure and use of EID, including manuals, schemas, layout relationships, and definitions of variables, i.e. the keys and blueprints to the Department’s enforcement data infrastructure, ” i d. ¶ 38

.3

CBP justified its withholdings under three FOIA exemptions: Exemptions 6, 7(C), and 7(E). Id. ¶¶ 27

– 29. Under Exemption 7(E) , CBP withheld both the specific “Border Patrol station
or opera tional site” for each CBP encounter and documentation of the EID’s structure and use. Id. ¶¶ 30, 38. Under Exemptions 6 and 7(C) , CBP withheld the A

- number associated with each entry and any other “similar unique identifier[] that would enable tracking and aggregation of data about individuals across multiple data sets.” Id. ¶ 34. The Court granted CBP’ s Motion for S ummary Judgment as to the EID’s schemas, manuals, and relationships and denied it , without prejudice , as t he other withholdings

. Dkt. 50. The Court denied Buzzfeed’s Cross

- Motion for Summary Judgment with prejudice as to EID’s schemas, manuals, and relationships and without prejudice as to the other issues. Id. After CBP filed supplemental declaration s , Dkt. 52 , pursuant to the Court’s Order, Dkt. 49, the parties filed renewed cross - motions for summary judgment , Dkts. 57 , 5 8

. The remaining issues are whether CBP is permitted to withhold (1) A

- numbers and alternative un ique identifi ers under Exemption s 6 and 7( C) ; (2) Border Patrol s tation locations under Exemption 7(E); and (3) variable definitions in the EID under Exemption 7(E).

II. LEGAL STANDARDS Rule 56 of the Federal Rules of Civil Procedure states that “[t]he court shall grant summary judgment if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). When a federal agency moves for summary judgment in a FOIA case, the court views all facts and inferences in the light most favorable to the requester, and the agency bears the burden of showing that it complied with
FOIA. Chambers v. U.S. Dep’t o f Interior , 568 F.3d 998, 1003 (D.C. Cir. 2009).4

To prevail under Rule 56, a federal agency “must prove that each document that falls within the class requested either has been produced, is unidentifiable, or is wholly exempt from the (FOIA ’ s ) inspection req uirements.” Perry v. Block , 684 F.2d 121, 126 (D.C. Cir. 1982) (per curiam) (citation omitted). The agency “must show beyond material doubt . . . that it has conducted a search reasonably calculated to uncover all relevant documents,” Weisberg v. DOJ , 705 F.2d 1344, 1351 (D.C. Cir. 1983), and must also explain why any en umerated exemptions listed in 5 U.S.C. § 552(b) apply to withheld information, see Judicial Watch, Inc. v. FDA , 449 F.3d 141, 147 (D.C. Cir. 2006)

. “The peculiarities inherent in FOIA litigation, with the responding agencies often in sole possession of requested records and with information searches conducted only by agency personnel, have led federal courts to rely on government affidavits to determine whether the statutory obligations of the FOIA have been met.” Perry , 684 F.2d at 126. Agency affidavits are entitled to a presumption of good faith, see SafeCard Servs. v. SEC , 926 F. 2d 1197, 1200 (D.C. Cir. 1991), and a court may grant summary judgment based on an affidavit if it contains reasonably specific detail and if neither contradictory record evidence nor evidence of bad faith calls it into question, see Judicial Watch, Inc. v . U.S. Secret Serv. , 726 F.3d 208, 215 (D.C. Cir. 2013). The “vast majority of FOIA cases can be resolved on summary judgment.” Brayton v. Off. of the U.S. Trade Representative , 641 F.3d 521, 527 (D.C. Cir. 2011)

. III. ANALYSIS A. Exemption 6 and 7(C)
CBP withheld A

- numbers and any other similar unique database identifiers under Exemption s 6 an d 7(C). Howard Decl. ¶¶ 34

– 37. “ FOIA Exemptions 6 and 7(C) seek to protect the privacy of individuals identified in certain agency records.” ACLU v. DOJ , 655 F.3d 1, 6 (D.C. Cir. 2011). Exemption 6 protects “personnel and medical files and similar files the disclosure of5

which would co nstitute a clearly unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6), and Exemption 7(C) protects “records or information compiled for law enforcement purposes” that “could reasonably be expected to constitute an unwarranted invasion of perso nal privacy,” id. § 552(b)(7)(C). When an agency invokes both exemptions, courts “focus” on Exemption 7(C) because it “establishes a lower bar for withholding material.” CREW . v. DOJ , 746 F.3d 1082,
1091 n. 2 (D.C. Cir. 2014) ( c itation omitted).

1. A

- Numbers First, d isclosing A

- numbers could reasonably be expected to invade a substantial privacy
interest. In an Exemption 7(C) analysis, the first step is to identi fy the privacy interests implicated by the release of records. ACLU , 655 F.3d at 6

. To that end, the Court directed CBP to address
how the release of A

- numbers could invade affected individuals’ privacy absent disclosure of their

name s, addresses, dates of birth, or other direct identifying information. Order at 2. Among the interests protected, Exemption 7(C) protects the privacy of individuals against the reputational harm that may result from disclosure of law enforcement records. See CREW

. v. DOJ , 658 F. Supp. 2d 217 , 239 (D.D.C. 2009) ( noting that “ p rotecting individuals against the stigma of being mentioned in the context of a law enforcement investigation is the precise purpose of Exemption 7(C) ” ). Here, CBP has established a substantial privacy interest in the release of A

- numbers
because they can be used to identify an individual who is mentioned in law enforcement files

. The
agency explained that DHS categorizes A

- number s as standalone Sensitive P ersonal ly Identif iable Information ( S PII) , which means that an A

- number can “identify an individual without any other identifying information . . . .” Danisek Decl. ¶ 5, Dkt

. 52

- 1

. For example, an A

- number c an be
used to access personal and sensitive information through the Executive Office of Immigration6

Review’s Automated Case Information System

. Id. ¶ 6. In turn, this information can be used to identify the individual in the CBP database

. See i d. “[I]n evaluating the privacy impact of the release of information, the courts have taken into consideration potential derivative uses of that information.” ACLU , 655 F.3d at 7

. Thus , t hat “additional steps may be required to link these numbers to an individ ual’s identity , ” Danisek Decl. ¶ 6 , does not , by itself, eliminate the relevant privacy interest

. S ee also Nat’l Ass’n of Retired Fed. Emps. v. Horner , 879 F.2d 873 , 878 (D.C. Cir. 1989) (“ In virtually every case in which a privacy concern is implicated, someone must take steps after the initial disclosure in order to bring about the untoward effect.”). In sum, C BP ’s additional declaration sufficiently clarified how the release of A

- numbers would invade the
individual privacy interest protected by Exemption 7(C)

. 1 The analogy to social security numbers further highlights the privacy interest in A

number s
. CBP cites several cases highli ghting social security numbers ’ protect ion under
E xemption s 6 and 7(C). See, e.g. , Prison Legal News v. Lappin , 780 F. Supp. 2d 29 , 40 (D.D.C. 2011) ( “ [ A ] n individual’s social security number has a specific relationship to that individual . . .

. [ T ] he Court finds that the privacy interest in one’s social security number is self

- evident.”) ; see also Murder Accountability Project v. DOJ , No. 19

- cv - 2478, 2021 WL 2682539 , at *12 (D.D.C. June 30, 2021) ( noting that names, social security numbers, and alien registration numbers “are exactly the kind of personal identifying information that may be protected from disclo sure under Exemption 6 ”). L ike A

- numbers , social security numbers are unique to an individual and

1 F or the same reasons state d, h arm is also foreseeable f rom the release of A

- numbers

. See 5 U.S.C. § 552(a)(8)(A) ; see also Ecological Rights Found. v. EPA , 541 F. Supp. 3d 34, 65 (D.D.C. 2021) ( “ [W] hen invoking Exemption 7(C), an agency need not establish much more than the fact of disclosure to establish foreseeable harm ” because “disclosure of identifying information is a harm in and of itself.” ).7

categorized by DHS as standalone S PII

. 2 See Danisek Decl. ¶ 5. Thus, the Court will treat the privacy interest in A

- numbers similar ly to the privacy interest in social security numbers. Buzzfeed’s reli ance on Am erican Immigration Council v. ICE , 464 F. Supp. 3d 228 (D.D.C. 2020) is unpersuasive

. See Pl.’s First Mem

. at 6

– 7, Dkt. 39

- 1. There, the c ourt held that Exemption 7(C) did not allow ICE and CBP to withhold all information about the date of birth of apprehended individuals

. Am

. Im migr

. Council , 464 F. Supp. 3d at 239. T he c ourt al lowed
redact ion only of the specific date of birth , ordering disclosure of b irth year and month, and noted
that CBP had alr eady eac h ind ividual ’ s age. Id. at 239, 246. Unlike A

- numbers, however, mon th and year of birth are neither unique nor standalone S PII

. And in American Immig ration Council , because CBP had already disclosed age, minimal additional sensitive information was revealed by disclosing the month and year of birth

. Second, the C ourt concludes that any public interest implicated by the disclosure does not outweigh individuals ’ privacy interest

. See ACLU , 655 F.3d at 12. It is well established that “the only public interest relevant for purposes of Exemption 7(C) is one that focuses on the citizens ’ right to be informed about what their government is up to.” Sussman v. U.S. Marshals Serv. , 494 F.3d 1106, 1115 (D.C. Cir. 2007) ( citation omitted ). This public interest includes information that shows that the agency acted “negligently or otherwise improperly in the performance of [its] duties.” NARA v. Favish , 541 U.S. 157, 173 (2004). Generally, an agency can withhold information identifying private citizens mentioned in law enforcement records

. SafeCard Servs. , 926 F.2d at 1206. If, however, disclosure is “ necessary

2 At first, Buzzfeed seemed to acknowledge the sensitive nature of A

- number s
. See Pl

. ’s Email at 1, Dkt. 57

- 3 (“ In terms of data, it appears that we have not received two categories that would be extremely helpful. The facility name, and a unique identifier like an A number. I believe we discussed the possibility of providing some sort of placeholder identifier so as to avoid violating individuals [ ’ ] privacy. ” ).8

in order to confirm or refute compelling evidence that the agency is engaged in illegal activity [ , ] ” then disclosu re may be warranted. Schrecker v. DOJ , 349 F.3d 657 , 661 (D.C. Cir. 2003) (quoting Safecard Servs. , 926 F.2d at 1206 ). A FOIA request e r “ must produce evidence that would warrant a belief by a reasonable person that the alleged Government impropriety might have occurred.”
N ARA , 541 U.S. at 174

. Buzzfeed argues that the RGV report would lead a reasonable person to believe that CBP might have engaged in misconduct. Pl.’s Reply at 7 , Dkt. 48

- 1

. But even assuming that Buzzfeed is correct, disclosure of A

- numbers is not necessary to confirm or refute evidence of alleged misconduct

. A

- numbe rs alone do not identify any wrongdoing. Instead, by linking all datapoints pertaining to an individual alien, their function might be to allow for “track [ing] the movements of children held in detention and help determine how long individual children were held even if they were transferred among facilities

. ” Pl.’s First Mem

. at 2

. A lternative s to A

- numbers, functioning the same way but with far fewer privacy concerns , surely exist. For example, CBP could generate anonymous unique individual identifiers or organize the data in a per son - centric

manner. Accordingly, the Cou rt concludes that the A

- numbers them selves are exempt from disclosure. 3

3 For the first time in this round of briefing, the defendants argue that A

- numbers and A

- number alternatives are outside the scope of Buzzfeed’s FOIA request. See Def s .’ Mem

. at 9

– 12; Pl.’s Mem

. at 2 n.2. Because the Court concludes that the A

- numbers are exempt from disclosure, it need not reach this issue as to the A

- numbers

. As to A

- number alternatives , i t appears to the Court that any such argument was likely forfeited. In any event, the arguments made i n the defendants ’ b rief, see Defs. ’ Mem . at 9

– 12, do not cl early apply to A

- number alternatives , which would not necessarily themselves be personally identif ying

. If the defend ants raise a scope argument in th e next round of briefing, the Cour t will consider that argument, and it s potential forfeiture, at that time.9 2. Alternative Unique Identifiers Th e Court c oncludes, in contrast , that the defendants have failed to provide sufficient information to assess the privacy interest implicated by potential alternative unique identifiers. The defendants admit that they can anonymize A

- numbers but argue that exemption 7(C) applies because a third party could reverse engineer A

- numbers by decrypting the anonymous unique identifiers

. Visconti Decl. ¶ 9, Dkt. 52

- 2

. However, merely raising the possibility of decryption, without explaining how decryption is possible and its likelihood, is too “vague” and “speculative

. ”
Am. Immigr. Council , 464 F. Supp. 3d at 239

. Furthermore , the defendants ’ declarations do not explain how this risk would follow from providing “ auto

- incremented integers or randomly generated IDs ” that are not generated using the A

- numbers themselves. Flores Decl. ¶ 8, Dkt. 39

- 2. With regards to fingerprint identification numbers, the defendants ’ supplemental declaration s are also deficient. The defend ants acknowledged fingerprint identification numbers as the only person

- centric identifier that appear s in the underlying dataset , other than A

- numbers

. Id. One declaration states that “ biometric identifiers ” are standalone S PII. Danisek Decl. ¶ 5. But

w hile CBP provided an example of how the release of A

- numbers could compromise an individual’s privacy (by giving access to immigration files), it did not do so for fingerprint
identification numbers. Agency declarations must “contain reasonable specificity of detail rather than merely conclus ory statements.” Jud. Watch , 726 F.3d at 215 (citation omitted) . Here, CBP failed to adequately explain how fingerprint identification numbers could compromise an individual’s privacy. 4

4 The Court is skeptical , however, that the analysis for fingerprint identification numbers will ultimately be substantially d ifferent from that for A

- numbers.10

CBP has not suffici ently explained the privacy interest implicated by alternative unique identifiers

. 5 Accordingly, the Court will order CBP to file a supplemental declaration stating the privacy concern with generating alternative unique identifiers or using fingerprint identification numbers.
B. Exemption 7(E) Exemption 7(E) protects “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforceme nt records or information . . . would disclose techniques and procedures for law enforcement investigations or prosecutions . . . if such disclosure could reasonably be expected to risk circumvention of the law.” 5 U.S.C. § 552(b)(7). The exemption does not ordinarily protect “routine techniques and procedures already well known to the public.” Founding Church of Scientology of Wash., D.C. v. NSA , 610 F.2d 824, 832 n.67 (D.C. Cir. 1979) ( citation omitted)

. It does, however, protect “confidential details of . . . program[s]” if only their “general contours [are] publicly known

. ” Sussman , 494 F.3d at 1112 ; see also Shapiro v. DOJ , 893 F.3d 796, 801 (D.C. Cir. 2018) (permitting the government to withhold documents that would disclose the way in which the FBI use s a particular publicly known database). In this Circuit, Exemption 7(E) applies if the disclosure of information related to even

5 The Visconti Declaration asserts that a hacker could use unique identifiers “to quickly access identifying information about specific people and their private information in the CBP database .” Visconti Dec l. ¶ 8. That assertion is insufficiently justified, and the Court is ske ptical. A n individual who hacks the CBP database would presumably gain access to existing unique i dentifiers because they appear in the underlying dataset. And it is unclear that arbitrary unique identifiers, associated with individuals solely for the purpose of redacting A

- numbers in this discl osure, would facilitate such ea sy access. The defendants , moreover , do not assert that the disclosure of unique identifiers would make hacking the database more likely. Cf. Am

. Immigr

. Council , 464 F. Supp. 3d at 243 (rejecting the argument that unique identifiers are exempt under Exemption 7(E) because the agency did “ not come forward with information to show that the mere possession of unique identifying information would facilitate one ’ s ability to hack into CBP ’ s system or that it would make a hacking more likely ” ).11

“commonly known procedures” could “reduce or nullify their effectiveness.” Vazquez v. DOJ , 887 F. Supp. 2d 114, 116 (D.D.C. 2012) ( citation omitted), aff ’ d , No. 13

- 5197, 2013 WL 6818207 (D.C. Cir. Dec. 18, 2013) (per curiam). CBP has justified the withholding of two types of information under Exemption 7(E). First,
it withheld the specific Border Patrol statio n or operational site (but not the sector) where each encounter took place. Howard Decl. ¶¶ 30

– 31. Second, as re levant here afte r the Court ’ s first memorandum opinion, CB P withheld “records documenting

. . . definitions of variables.” Id. ¶ 38.
The Court will address each in turn

.

1. Location Information
In its earlier memorandum opinion, the Court co ncluded that the issue that “ remain[ed]
unclear ” in the Exemption 7(E) analysis as to location information was whether release of redacted
CBP location s , as compared to the apprehension location, see Am. Immigr. Council , 464 F. S u pp. 3d at 244

– 45 , would similarly “ lead to circum vention of the immigration laws. ” First Mem. Op.
at 10

– 11. 6 The Court now agrees with the d efendants that the locations of Border Patrol s tations could reasonably be expected to risk circum vention of the law as requ ired by Exemption 7 (E).

“ Exemption 7(E) ’ s requirement that disclosure risk circumvention of the law sets a relatively low bar for the agency to justify withholding

. ” Pub. Emps. for Env ’ t Resp. v. U.S. Section, Int ’ l Boundary & Water Comm ’ n, U.S.

- Mexico , 740 F.3d 195 , 204

– 05 (D.C. Cir. 2014) ( citation omitted)

. Law enforcement agencies receive “a measure of deference” in their decision to invoke Exemption 7(E)

. Am. Immigr. Council v. DHS , 950 F. Supp. 2d 221 , 245 (D.D.C. 2013)

. The agency only has the burden to “ demonstrate logically how the release of the requested

6 In its br iefs, the plaintiff agrees that “the Court identified the salient issues in its order and no further argument from either si de is warranted. ” Pl. ’s Mem

. a t 2.12

information might create a risk of circumvention of the law.” Mayer Brown LLP v. IRS , 562 F.3d
1190 , 1194 (D.C. Cir. 2009) (cleaned up)

. Here, the disclosure of the Border Patrol s tations asso ciated with apprehension s could reasonably be expected to risk circumvention of the immigration law s
. CBP has already provided

s ector

- level location information

. Howard Decl. ¶ 31. CBP has sufficiently explain ed that attaching the specific Border Patrol s tation to each row of data wo uld “risk[] revealing if and when coverage areas between Border Patrol s tations overlap or have gaps ” and “ which Station’s Agents may face the heaviest workload at any given time. ” Visconti Decl. ¶ 10

. CBP’s supplemental
declaration s demonstrate logically how the release of the location of Border Patrol stations , and
thus knowledge of which Border Patrol s tations are re latively overwhelmed, might create a risk of
circumvention of the law. Ac cordingly, the Court will grant summary judgement in favor of the
defendant s on whether the specific Border Patrol s tation locations were properly withheld under Exemption 7(E). 7

2. EID Variable Definitions
Th e Court previously held that CBP properly withheld schemas, manuals, and relationships under Exemption 7(E) and granted the defendants ’ motion for summary judgment on that issue. However, the Court questioned whether CBP properly withheld “ [ g ] lossaries and data dictionarie s (i.e., records defining the meaning of tables, columns, variables, and other aspects of the database)

. ” Compl. Ex. A at 2, Dkt. 1

- 1 ; see First Mem. Op

. In Long v. ICE , 464 F. Supp. 3d 409 (D.D.C. 2020) , another court in this District ordered ICE to conduct a segregability analy sis as to “ field and table names, codes, code translations, and

7 As previously explained, no further foreseeable harm an alysis is needed under Exemption 7(E). See First Mem. Op. at 10 n.1

.13

code lookup table s .” Id. at 426

– 27

. In light of Long , th is Court direct ed CBP to address in supplemental declaration s the distinctions , if any, between information requested by Buzzfeed and
that disclosed in Long

. Order at 2. The agency was also directed to address whether the testimony
and record in that 2020 case remain applicable and accurate

. Id. After the Court’s Ord er, CBP
released “ 73 pages of abbreviations, glossary of terms, processing disposition codes, charging and entry status codes .” Def s .’ Mem

. at 20

. Buzzfeed confirms that CBP has “made a supplemental production in response to the Court’s order .” Pl.’s Mem

. at 6. But it contends that “[CBP] ha[s] not provided a declaration supporting the claims made in [ its ] brief

. . . and the Court should expressly order [CBP] to produce to [Buzzfeed] the information produced in Long to the extent it
was not alr eady produced .” Id.
The parties’ briefing does not make sufficiently clear the scope of t he remaining dispute

. Thus, the Court will order a joint status report directing the parties to confer and state their positions on what additional records, if any, are sought in the s earch and are disputed.

CONCLUSION For the foregoing reasons : 1) The defendants ’ Motion for S ummary J udgment is granted, and the p laintiff’s C ross M otion for S ummary J udgment is denied with prejudice , with respect to the withholding of A

- numbers. The d efendant s ’ m otion and the p laintiff’s c ross - motion are both denied without prejudice with respect to alternative unique identifiers

. 2) The d efendant s ’ M otion for S ummary J udgment is granted, and the p laintiff’s C ross M otion for S ummary J udgment is denied with prejudice , with respect to the withholding of Border Patrol s tation locations. 3) The defendants ’ Motion for Summary Judgment and the p laintiff’s C ross - M otion for S ummary J udgment are both denied without prejudice with respect to the information on variable definitions.14

A separate order consistent with this decision accompanies this memorandum opinion.

________________________ DABNEY L. FRIEDRICH United States District Judge August 10 , 2023