Buzzfeed, Inc. v. DHS, No. 19-03062, 2023 WL 5133158 (D.D.C. Aug. 10, 2023) (Friedrich, J.)

Buzzfeed, Inc. v. DHS, No. 19-03062, 2023 WL 5133158 (D.D.C. Aug. 10, 2023) (Friedrich, J.)

Re:  Request for records concerning alert on overcrowding and prolonged detention of adults and children in Rio Grande Valley

Disposition:  Granting in part and denying in part defendants’ renewed motion for summary judgment; denying plaintiff’s cross-motion for summary judgment

• Exemption 6 & Exemption 7(C):  The court relates that “[U.S. Customs and Border Protection (“CBP”)] withheld A-numbers and any other similar unique database identifiers under Exemptions 6 and 7(C).”  First, “the Court concludes that the A-numbers themselves are exempt from disclosure.”  The court finds that “disclosing A-numbers could reasonably be expected to invade a substantial privacy interest.”  “Here, CBP has established a substantial privacy interest in the release of A-numbers because they can be used to identify an individual who is mentioned in law enforcement files.”  Then, “the Court concludes that any public interest implicated by the disclosure does not outweigh individuals’ privacy interest.”  “[Plaintiff] argues that the [Rio Grande Valley] report would lead a reasonable person to believe that CBP might have engaged in misconduct.”  “But even assuming that [plaintiff] is correct, disclosure of A-numbers is not necessary to confirm or refute evidence of alleged misconduct.”  “A-numbers alone do not identify any wrongdoing.”  “Instead, by linking all datapoints pertaining to an individual alien, their function might be to allow for ‘track[ing] the movements of children held in detention and help determine how long individual children were held even if they were transferred among facilities.’”  “Alternatives to A-numbers, functioning the same way but with far fewer privacy concerns, surely exist.”  “For example, CBP could generate anonymous unique individual identifiers or organize the data in a person-centric manner.”
  
  “The Court concludes, in contrast, that the defendants have failed to provide sufficient information to assess the privacy interest implicated by potential alternative unique identifiers.”  “The defendants admit that they can anonymize A-numbers but argue that exemption 7(C) applies because a third party could reverse engineer A-numbers by decrypting the anonymous unique identifiers.”  “However, merely raising the possibility of decryption, without explaining how decryption is possible and its likelihood, is too ‘vague’ and ‘speculative.’”  “With regards to fingerprint identification numbers, the defendants’ supplemental declarations are also deficient.”  “The defendants acknowledged fingerprint identification numbers as the only person-centric identifier that appears in the underlying dataset, other than A-numbers.”  “But while CBP provided an example of how the release of A-numbers could compromise an individual’s privacy (by giving access to immigration files), it did not do so for fingerprint identification numbers.”  “Accordingly, the Court will order CBP to file a supplemental declaration stating the privacy concern with generating alternative unique identifiers or using fingerprint identification numbers.”
   
• Exemption 7(E):  The court holds that “CBP has justified the withholding of two types of information under Exemption 7(E).”  “First, it withheld the specific Border Patrol station or operational site (but not the sector) where each encounter took place.”  “Second, as relevant here after the Court’s first memorandum opinion, CBP withheld ‘records documenting . . . definitions of variables.’”  First, “[i]n its earlier memorandum opinion, the Court concluded that the issue that ‘remain[ed] unclear’ in the Exemption 7(E) analysis as to location information was whether release of redacted CBP locations, as compared to the apprehension location . . . would similarly ‘lead to circumvention of the immigration laws.’”  “The Court now agrees with the defendants that the locations of Border Patrol stations could reasonably be expected to risk circumvention of the law as required by Exemption 7(E).”  “CBP has already provided sector-level location information.”  “CBP has sufficiently explained that attaching the specific Border Patrol station to each row of data would ‘risk[ ] revealing if and when coverage areas between Border Patrol stations overlap or have gaps’ and ‘which Station’s Agents may face the heaviest workload at any given time.’”  “CBP’s supplemental declarations demonstrate logically how the release of the location of Border Patrol stations, and thus knowledge of which Border Patrol stations are relatively overwhelmed, might create a risk of circumvention of the law.”
  
  Second, the court relates that “[it] previously held that CBP properly withheld schemas, manuals, and relationships under Exemption 7(E) and granted the defendants’ motion for summary judgment on that issue.”  “However, the Court questioned whether CBP properly withheld ‘[g]lossaries and data dictionaries (i.e., records defining the meaning of tables, columns, variables, and other aspects of the database).’”  The court finds that “[t]he parties’ briefing does not make sufficiently clear the scope of the remaining dispute.”  “Thus, the Court will order a joint status report directing the parties to confer and state their positions on what additional records, if any, are sought in the search and are disputed.”