UNITED STATES DISTRICT COURT 

FOR THE DISTRICT OF COLUMBIA

BUZZFEED, INC.,

Plaintiff,

v.

DEPARTMENT OF HOMELAND

SECURITY et al.,

Defendants.

No. 19-cv-03062 (DLF)

MEMORANDUM OPINION

In this action, Buzzfeed challenges the U.S. Customs and Border Protection’s (CBP)

withholding of documents under the Freedom of Information Act (FOIA), 5 U.S.C. § 552. Before 

the Court is the defendants’ Renewed Motion for Summary Judgment, Dkt. 57, and the plaintiff’s

Cross-Motion for Summary Judgment, Dkt. 58. For the reasons that follow, the Court will grant

the defendants’ motion in part and deny it in part, and the Court will deny the plaintiff’s motion in 

full. 

I. BACKGROUND

On July 2, 2019, the Inspector General of the Department of Homeland Security (DHS)

issued an alert on overcrowding and prolonged detention of adults and children in the Rio Grande 

Valley (RGV Alert). Defs.’ Stmt. of Material Facts ¶ 1, Dkt. 37-1; Howard Decl. ¶ 13, Dkt. 37-3. 

The next day, Buzzfeed requested “any and all databases containing records on which the 

calculation in” the RGV Alert “are based” including “a full and up-to-date copy of the database(s) 

referenced in the above custody database.” Howard Decl. ¶¶ 5, 15. Buzzfeed’s request “also

demanded all records from 2010 through the date of the search documenting the structure and use 
2

of databases relied upon, to specifically include user manuals, schemas, layout, relationships, and 

definitions of variables.” Id. ¶ 17. 

Buzzfeed filed the instant case on October 14, 2019. See generally Compl., Dkt. 1. CBP

answered on December 29, 2019. See generally Answer, Dkt. 11. The agency determined that

Border Patrol was the division most likely to have responsive information, and it was likely to be

stored “within the Enforcement Integrated Database (EID).” Howard Decl. ¶¶ 19, 21. The EID is 

a shared DHS database “owned and operated by U.S. Immigration and Customs Enforcement

(ICE).” Id. ¶ 21. The database “captures and maintains information related to the investigation,

arrest, booking, detention, and removal of persons encountered during immigration and criminal

law enforcement investigations and operations conducted by DHS components.” Id.

Over the following months, CBP worked with Buzzfeed to “narrow and clarify the scope

of” the request. Id. ¶ 24. In November 2020, this resulted in “a spreadsheet file for each fiscal

year from FY2010 to FY2020” with “over 4,423,000 unredacted rows of responsive data.” Id.

¶ 25. Each row contained the following data fields: Border Patrol sector, Date and Time of

Apprehension, Citizenship, Gender, Age, Demographic, Time in the U.S., Date and Time of Initial 

Booking, Date and Time of Final Booking, Time in Custody. Id. ¶¶ 24–25. Buzzfeed sought 

additional data for each individual that CBP withheld: facility name, alien registration number (Anumber) or “some other ‘unique identifier’ that would permit [p]laintiff to track individuals and 

aggregate their records across multiple data sets,” id. ¶ 26, and “a decade’s worth of records 

documenting the structure and use of EID, including manuals, schemas, layout relationships, and 

definitions of variables, i.e. the keys and blueprints to the Department’s enforcement data 

infrastructure,” id. ¶ 38. 
3

CBP justified its withholdings under three FOIA exemptions: Exemptions 6, 7(C), and

7(E). Id. ¶¶ 27–29. Under Exemption 7(E), CBP withheld both the specific “Border Patrol station 

or operational site” for each CBP encounter and documentation of the EID’s structure and use. Id.

¶¶ 30, 38. Under Exemptions 6 and 7(C), CBP withheld the A-number associated with each entry 

and any other “similar unique identifier[] that would enable tracking and aggregation of data about 

individuals across multiple data sets.” Id. ¶ 34.

The Court granted CBP’s Motion for Summary Judgment as to the EID’s schemas, 

manuals, and relationships and denied it, without prejudice, as the other withholdings. Dkt. 50. 

The Court denied Buzzfeed’s Cross-Motion for Summary Judgment with prejudice as to EID’s 

schemas, manuals, and relationships and without prejudice as to the other issues. Id. After CBP 

filed supplemental declarations, Dkt. 52, pursuant to the Court’s Order, Dkt. 49, the parties filed 

renewed cross-motions for summary judgment, Dkts. 57, 58. The remaining issues are whether 

CBP is permitted to withhold (1) A-numbers and alternative unique identifiers under Exemptions 

6 and 7(C); (2) Border Patrol station locations under Exemption 7(E); and (3) variable definitions 

in the EID under Exemption 7(E).

II. LEGAL STANDARDS 

Rule 56 of the Federal Rules of Civil Procedure states that “[t]he court shall grant summary 

judgment if the movant shows that there is no genuine dispute as to any material fact and the 

movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). When a federal agency 

moves for summary judgment in a FOIA case, the court views all facts and inferences in the light 

most favorable to the requester, and the agency bears the burden of showing that it complied with 

FOIA. Chambers v. U.S. Dep’t of Interior, 568 F.3d 998, 1003 (D.C. Cir. 2009).
4

To prevail under Rule 56, a federal agency “must prove that each document that falls within 

the class requested either has been produced, is unidentifiable, or is wholly exempt from the 

(FOIA’s) inspection requirements.” Perry v. Block, 684 F.2d 121, 126 (D.C. Cir. 1982) (per 

curiam) (citation omitted). The agency “must show beyond material doubt . . . that it has conducted 

a search reasonably calculated to uncover all relevant documents,” Weisberg v. DOJ, 705 F.2d 

1344, 1351 (D.C. Cir. 1983), and must also explain why any enumerated exemptions listed in 5 

U.S.C. § 552(b) apply to withheld information, see Judicial Watch, Inc. v. FDA, 449 F.3d 141, 147 

(D.C. Cir. 2006).

“The peculiarities inherent in FOIA litigation, with the responding agencies often in sole 

possession of requested records and with information searches conducted only by agency 

personnel, have led federal courts to rely on government affidavits to determine whether the 

statutory obligations of the FOIA have been met.” Perry, 684 F.2d at 126. Agency affidavits are 

entitled to a presumption of good faith, see SafeCard Servs. v. SEC, 926 F.2d 1197, 1200 (D.C. 

Cir. 1991), and a court may grant summary judgment based on an affidavit if it contains reasonably 

specific detail and if neither contradictory record evidence nor evidence of bad faith calls it into 

question, see Judicial Watch, Inc. v. U.S. Secret Serv., 726 F.3d 208, 215 (D.C. Cir. 2013). The 

“vast majority of FOIA cases can be resolved on summary judgment.” Brayton v. Off. of the U.S. 

Trade Representative, 641 F.3d 521, 527 (D.C. Cir. 2011).

III. ANALYSIS 

A. Exemption 6 and 7(C) 

CBP withheld A-numbers and any other similar unique database identifiers under 

Exemptions 6 and 7(C). Howard Decl. ¶¶ 34–37. “FOIA Exemptions 6 and 7(C) seek to protect 

the privacy of individuals identified in certain agency records.” ACLU v. DOJ, 655 F.3d 1, 6 (D.C. 

Cir. 2011). Exemption 6 protects “personnel and medical files and similar files the disclosure of 
5

which would constitute a clearly unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6), 

and Exemption 7(C) protects “records or information compiled for law enforcement purposes” that 

“could reasonably be expected to constitute an unwarranted invasion of personal privacy,” id.

§ 552(b)(7)(C). When an agency invokes both exemptions, courts “focus” on Exemption 7(C) 

because it “establishes a lower bar for withholding material.” CREW. v. DOJ, 746 F.3d 1082, 

1091 n.2 (D.C. Cir. 2014) (citation omitted). 

1. A-Numbers

First, disclosing A-numbers could reasonably be expected to invade a substantial privacy 

interest. In an Exemption 7(C) analysis, the first step is to identify the privacy interests implicated 

by the release of records. ACLU, 655 F.3d at 6. To that end, the Court directed CBP to address 

how the release of A-numbers could invade affected individuals’ privacy absent disclosure of their 

names, addresses, dates of birth, or other direct identifying information. Order at 2. Among the 

interests protected, Exemption 7(C) protects the privacy of individuals against the reputational 

harm that may result from disclosure of law enforcement records. See CREW. v. DOJ, 658 F. 

Supp. 2d 217, 239 (D.D.C. 2009) (noting that “protecting individuals against the stigma of being 

mentioned in the context of a law enforcement investigation is the precise purpose of Exemption 

7(C)”). 

Here, CBP has established a substantial privacy interest in the release of A-numbers

because they can be used to identify an individual who is mentioned in law enforcement files. The 

agency explained that DHS categorizes A-numbers as standalone Sensitive Personally Identifiable

Information (SPII), which means that an A-number can “identify an individual without any other 

identifying information . . . .” Danisek Decl. ¶ 5, Dkt. 52-1. For example, an A-number can be

used to access personal and sensitive information through the Executive Office of Immigration 
6

Review’s Automated Case Information System. Id. ¶ 6. In turn, this information can be used to 

identify the individual in the CBP database. See id. “[I]n evaluating the privacy impact of the 

release of information, the courts have taken into consideration potential derivative uses of that 

information.” ACLU, 655 F.3d at 7. Thus, that “additional steps may be required to link these 

numbers to an individual’s identity,” Danisek Decl. ¶ 6, does not, by itself, eliminate the relevant 

privacy interest. See also Nat’l Ass’n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 878 (D.C. 

Cir. 1989) (“In virtually every case in which a privacy concern is implicated, someone must take 

steps after the initial disclosure in order to bring about the untoward effect.”). In sum, CBP’s

additional declaration sufficiently clarified how the release of A-numbers would invade the 

individual privacy interest protected by Exemption 7(C).

1

The analogy to social security numbers further highlights the privacy interest in Anumbers. CBP cites several cases highlighting social security numbers’ protection under 

Exemptions 6 and 7(C). See, e.g., Prison Legal News v. Lappin, 780 F. Supp. 2d 29, 40 (D.D.C. 

2011) (“[A]n individual’s social security number has a specific relationship to that individual . . . . 

[T]he Court finds that the privacy interest in one’s social security number is self-evident.”); see 

also Murder Accountability Project v. DOJ, No. 19-cv-2478, 2021 WL 2682539, at *12 (D.D.C. 

June 30, 2021) (noting that names, social security numbers, and alien registration numbers “are 

exactly the kind of personal identifying information that may be protected from disclosure under 

Exemption 6”). Like A-numbers, social security numbers are unique to an individual and 

1 For the same reasons stated, harm is also foreseeable from the release of A-numbers. See 5 

U.S.C. § 552(a)(8)(A); see also Ecological Rights Found. v. EPA, 541 F. Supp. 3d 34, 65 (D.D.C. 

2021) (“[W]hen invoking Exemption 7(C), an agency need not establish much more than the fact 

of disclosure to establish foreseeable harm” because “disclosure of identifying information is a 

harm in and of itself.”).
7

categorized by DHS as standalone SPII.

2

See Danisek Decl. ¶ 5. Thus, the Court will treat the 

privacy interest in A-numbers similarly to the privacy interest in social security numbers.

Buzzfeed’s reliance on American Immigration Council v. ICE, 464 F. Supp. 3d 228 

(D.D.C. 2020) is unpersuasive. See Pl.’s First Mem. at 6–7, Dkt. 39-1. There, the court held that 

Exemption 7(C) did not allow ICE and CBP to withhold all information about the date of birth of 

apprehended individuals. Am. Immigr. Council, 464 F. Supp. 3d at 239. The court allowed

redaction only of the specific date of birth, ordering disclosure of birth year and month, and noted 

that CBP had already each individual’s age. Id. at 239, 246. Unlike A-numbers, however, month 

and year of birth are neither unique nor standalone SPII. And in American Immigration Council, 

because CBP had already disclosed age, minimal additional sensitive information was revealed by 

disclosing the month and year of birth.

Second, the Court concludes that any public interest implicated by the disclosure does not 

outweigh individuals’ privacy interest. See ACLU, 655 F.3d at 12. It is well established that “the 

only public interest relevant for purposes of Exemption 7(C) is one that focuses on the citizens’

right to be informed about what their government is up to.” Sussman v. U.S. Marshals Serv., 494 

F.3d 1106, 1115 (D.C. Cir. 2007) (citation omitted). This public interest includes information that 

shows that the agency acted “negligently or otherwise improperly in the performance of [its] 

duties.” NARA v. Favish, 541 U.S. 157, 173 (2004). 

Generally, an agency can withhold information identifying private citizens mentioned in 

law enforcement records. SafeCard Servs., 926 F.2d at 1206. If, however, disclosure is “necessary

2 At first, Buzzfeed seemed to acknowledge the sensitive nature of A-numbers. See Pl.’s Email at 

1, Dkt. 57-3 (“In terms of data, it appears that we have not received two categories that would be 

extremely helpful. The facility name, and a unique identifier like an A number. I believe we 

discussed the possibility of providing some sort of placeholder identifier so as to avoid violating 

individuals[’] privacy.”). 
8

in order to confirm or refute compelling evidence that the agency is engaged in illegal activity[,]”

then disclosure may be warranted. Schrecker v. DOJ, 349 F.3d 657, 661 (D.C. Cir. 2003) (quoting 

Safecard Servs., 926 F.2d at 1206). A FOIA requester “must produce evidence that would warrant 

a belief by a reasonable person that the alleged Government impropriety might have occurred.” 

NARA, 541 U.S. at 174. 

Buzzfeed argues that the RGV report would lead a reasonable person to believe that CBP 

might have engaged in misconduct. Pl.’s Reply at 7, Dkt. 48-1. But even assuming that Buzzfeed 

is correct, disclosure of A-numbers is not necessary to confirm or refute evidence of alleged 

misconduct. A-numbers alone do not identify any wrongdoing. Instead, by linking all datapoints 

pertaining to an individual alien, their function might be to allow for “track[ing] the movements 

of children held in detention and help determine how long individual children were held even if 

they were transferred among facilities.” Pl.’s First Mem. at 2. Alternatives to A-numbers, 

functioning the same way but with far fewer privacy concerns, surely exist. For example, CBP 

could generate anonymous unique individual identifiers or organize the data in a person-centric 

manner. Accordingly, the Court concludes that the A-numbers themselves are exempt from 

disclosure.3 

3 For the first time in this round of briefing, the defendants argue that A-numbers and A-number 

alternatives are outside the scope of Buzzfeed’s FOIA request. See Defs.’ Mem. at 9–12; Pl.’s 

Mem. at 2 n.2. Because the Court concludes that the A-numbers are exempt from disclosure, it 

need not reach this issue as to the A-numbers. As to A-number alternatives, it appears to the Court 

that any such argument was likely forfeited. In any event, the arguments made in the defendants’ 

brief, see Defs.’ Mem. at 9–12, do not clearly apply to A-number alternatives, which would not 

necessarily themselves be personally identifying. If the defendants raise a scope argument in the 

next round of briefing, the Court will consider that argument, and its potential forfeiture, at that 

time.
9

2. Alternative Unique Identifiers

The Court concludes, in contrast, that the defendants have failed to provide sufficient 

information to assess the privacy interest implicated by potential alternative unique identifiers. 

The defendants admit that they can anonymize A-numbers but argue that exemption 7(C) applies 

because a third party could reverse engineer A-numbers by decrypting the anonymous unique 

identifiers. Visconti Decl. ¶ 9, Dkt. 52-2. However, merely raising the possibility of decryption, 

without explaining how decryption is possible and its likelihood, is too “vague” and “speculative.” 

Am. Immigr. Council, 464 F. Supp. 3d at 239. Furthermore, the defendants’ declarations do not 

explain how this risk would follow from providing “auto-incremented integers or randomly 

generated IDs” that are not generated using the A-numbers themselves. Flores Decl. ¶ 8, Dkt. 39-

2.

With regards to fingerprint identification numbers, the defendants’ supplemental 

declarations are also deficient. The defendants acknowledged fingerprint identification numbers 

as the only person-centric identifier that appears in the underlying dataset, other than A-numbers. 

Id. One declaration states that “biometric identifiers” are standalone SPII. Danisek Decl. ¶ 5. But 

while CBP provided an example of how the release of A-numbers could compromise an 

individual’s privacy (by giving access to immigration files), it did not do so for fingerprint 

identification numbers. Agency declarations must “contain reasonable specificity of detail rather 

than merely conclusory statements.” Jud. Watch, 726 F.3d at 215 (citation omitted). Here, CBP 

failed to adequately explain how fingerprint identification numbers could compromise an 

individual’s privacy.4 

4 The Court is skeptical, however, that the analysis for fingerprint identification numbers will 

ultimately be substantially different from that for A-numbers.
10

CBP has not sufficiently explained the privacy interest implicated by alternative unique 

identifiers.

5

 Accordingly, the Court will order CBP to file a supplemental declaration stating the 

privacy concern with generating alternative unique identifiers or using fingerprint identification 

numbers. 

B. Exemption 7(E)

Exemption 7(E) protects “records or information compiled for law enforcement purposes, 

but only to the extent that the production of such law enforcement records or information . . . would 

disclose techniques and procedures for law enforcement investigations or prosecutions . . . if such 

disclosure could reasonably be expected to risk circumvention of the law.” 5 U.S.C. § 552(b)(7). 

The exemption does not ordinarily protect “routine techniques and procedures already well known 

to the public.” Founding Church of Scientology of Wash., D.C. v. NSA, 610 F.2d 824, 832 n.67 

(D.C. Cir. 1979) (citation omitted). It does, however, protect “confidential details of . . . 

program[s]” if only their “general contours [are] publicly known.” Sussman, 494 F.3d at 1112; 

see also Shapiro v. DOJ, 893 F.3d 796, 801 (D.C. Cir. 2018) (permitting the government to 

withhold documents that would disclose the way in which the FBI uses a particular publicly known 

database). In this Circuit, Exemption 7(E) applies if the disclosure of information related to even 

5 The Visconti Declaration asserts that a hacker could use unique identifiers “to quickly access 

identifying information about specific people and their private information in the CBP database.” 

Visconti Decl. ¶ 8. That assertion is insufficiently justified, and the Court is skeptical. An 

individual who hacks the CBP database would presumably gain access to existing unique 

identifiers because they appear in the underlying dataset. And it is unclear that arbitrary unique 

identifiers, associated with individuals solely for the purpose of redacting A-numbers in this 

disclosure, would facilitate such easy access. The defendants, moreover, do not assert that the 

disclosure of unique identifiers would make hacking the database more likely. Cf. Am. Immigr.

Council, 464 F. Supp. 3d at 243 (rejecting the argument that unique identifiers are exempt under 

Exemption 7(E) because the agency did “not come forward with information to show that the mere 

possession of unique identifying information would facilitate one’s ability to hack into CBP’s 

system or that it would make a hacking more likely”).
11

“commonly known procedures” could “reduce or nullify their effectiveness.” Vazquez v. DOJ, 

887 F. Supp. 2d 114, 116 (D.D.C. 2012) (citation omitted), aff’d, No. 13-5197, 2013 WL 6818207 

(D.C. Cir. Dec. 18, 2013) (per curiam). 

CBP has justified the withholding of two types of information under Exemption 7(E). First, 

it withheld the specific Border Patrol station or operational site (but not the sector) where each 

encounter took place. Howard Decl. ¶¶ 30–31. Second, as relevant here after the Court’s first 

memorandum opinion, CBP withheld “records documenting . . . definitions of variables.” Id. ¶ 38. 

The Court will address each in turn.

1. Location Information

In its earlier memorandum opinion, the Court concluded that the issue that “remain[ed] 

unclear” in the Exemption 7(E) analysis as to location information was whether release of redacted

CBP locations, as compared to the apprehension location, see Am. Immigr. Council, 464 F. Supp.

3d at 244–45, would similarly “lead to circumvention of the immigration laws.” First Mem. Op. 

at 10–11.6 The Court now agrees with the defendants that the locations of Border Patrol stations 

could reasonably be expected to risk circumvention of the law as required by Exemption 7(E).

“Exemption 7(E)’s requirement that disclosure risk circumvention of the law sets a 

relatively low bar for the agency to justify withholding.” Pub. Emps. for Env’t Resp. v. U.S. 

Section, Int’l Boundary & Water Comm’n, U.S.-Mexico, 740 F.3d 195, 204–05 (D.C. Cir. 2014)

(citation omitted). Law enforcement agencies receive “a measure of deference” in their decision 

to invoke Exemption 7(E). Am. Immigr. Council v. DHS, 950 F. Supp. 2d 221, 245 (D.D.C. 2013). 

The agency only has the burden to “demonstrate logically how the release of the requested

6

In its briefs, the plaintiff agrees that “the Court identified the salient issues in its order and no 

further argument from either side is warranted.” Pl.’s Mem. at 2.
12

information might create a risk of circumvention of the law.” Mayer Brown LLP v. IRS, 562 F.3d 

1190, 1194 (D.C. Cir. 2009) (cleaned up).

Here, the disclosure of the Border Patrol stations associated with apprehensions could 

reasonably be expected to risk circumvention of the immigration laws. CBP has already provided 

sector-level location information. Howard Decl. ¶ 31. CBP has sufficiently explained that 

attaching the specific Border Patrol station to each row of data would “risk[] revealing if and when 

coverage areas between Border Patrol stations overlap or have gaps” and “which Station’s Agents 

may face the heaviest workload at any given time.” Visconti Decl. ¶ 10. CBP’s supplemental 

declarations demonstrate logically how the release of the location of Border Patrol stations, and 

thus knowledge of which Border Patrol stations are relatively overwhelmed, might create a risk of 

circumvention of the law. Accordingly, the Court will grant summary judgement in favor of the 

defendants on whether the specific Border Patrol station locations were properly withheld under 

Exemption 7(E).7

2. EID Variable Definitions

The Court previously held that CBP properly withheld schemas, manuals, and relationships 

under Exemption 7(E) and granted the defendants’ motion for summary judgment on that issue. 

However, the Court questioned whether CBP properly withheld “[g]lossaries and data dictionaries 

(i.e., records defining the meaning of tables, columns, variables, and other aspects of the 

database).” Compl. Ex. A at 2, Dkt. 1-1; see First Mem. Op. 

In Long v. ICE, 464 F. Supp. 3d 409 (D.D.C. 2020), another court in this District ordered 

ICE to conduct a segregability analysis as to “field and table names, codes, code translations, and 

7 As previously explained, no further foreseeable harm analysis is needed under Exemption 7(E). 

See First Mem. Op. at 10 n.1.
13

code lookup tables.” Id. at 426–27. In light of Long, this Court directed CBP to address in 

supplemental declarations the distinctions, if any, between information requested by Buzzfeed and 

that disclosed in Long. Order at 2. The agency was also directed to address whether the testimony 

and record in that 2020 case remain applicable and accurate. Id. After the Court’s Order, CBP 

released “73 pages of abbreviations, glossary of terms, processing disposition codes, charging and 

entry status codes.” Defs.’ Mem. at 20. Buzzfeed confirms that CBP has “made a supplemental 

production in response to the Court’s order.” Pl.’s Mem. at 6. But it contends that “[CBP] ha[s] 

not provided a declaration supporting the claims made in [its] brief . . . and the Court should 

expressly order [CBP] to produce to [Buzzfeed] the information produced in Long to the extent it 

was not already produced.” Id.

The parties’ briefing does not make sufficiently clear the scope of the remaining dispute. 

Thus, the Court will order a joint status report directing the parties to confer and state their 

positions on what additional records, if any, are sought in the search and are disputed. 

CONCLUSION

For the foregoing reasons:

1) The defendants’ Motion for Summary Judgment is granted, and the plaintiff’s CrossMotion for Summary Judgment is denied with prejudice, with respect to the withholding

of A-numbers. The defendants’ motion and the plaintiff’s cross-motion are both denied 

without prejudice with respect to alternative unique identifiers. 

2) The defendants’ Motion for Summary Judgment is granted, and the plaintiff’s CrossMotion for Summary Judgment is denied with prejudice, with respect to the withholding 

of Border Patrol station locations. 

3) The defendants’ Motion for Summary Judgment and the plaintiff’s Cross-Motion for 

Summary Judgment are both denied without prejudice with respect to the information on

variable definitions.
14

A separate order consistent with this decision accompanies this memorandum opinion.

________________________

DABNEY L. FRIEDRICH

United States District Judge

August 10, 2023