Greenpeace, Inc. v. Department of Homeland Security
GREENPEACE, INC., Plaintiff,
DEPARTMENT OF HOMELAND SECURITY et al, Defendants.
TIMOTHY J. KELLY, United States District Judge
The Department of Homeland Security ("DHS") runs a government program known as Chemical Facility Anti-Terrorism Standards ("CFATS"). The purpose of CFATS is to identify chemical facilities that might be targeted by terrorists, and to promulgate and enforce standards for reducing the risks arising from potential terrorist attacks on those facilities. DHS requires facilities to submit information about certain chemicals they possess and, based on those submissions and other information (including information received from the broader intelligence community), determines which facilities pose a "high risk" of significant terrorism-related harm. Those high-risk facilities are required to implement various security measures. Alternatively, facilities may reduce their chemical holdings to levels that do not qualify them as high risk.
Plaintiff Greenpeace, Inc. ("Greenpeace") made a request pursuant to the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552, that DHS provide information regarding previously high-risk facilities that have reduced their chemical holdings. After a lengthy administrative process, DHS produced two heavily-redacted lists of facility names, withholding those names that might serve to identify a particular facility. DHS argues that the redacted information falls under FOIA's law-enforcement exemption, because releasing it would threaten public safety by increasing the risks to human life and health from terrorist attacks. Greenpeace disagrees, claiming that FOIA and DHS's own procedures require DHS to produce the records without redactions. Greenpeace has therefore brought suit against DHS and one of its components, the National Protection and Programs Directorate ("NPPD, " and together with DHS, "Defendants"). Greenpeace asserts claims under FOIA and the Administrative Procedure Act ("APA"), 5 U.S.C. § 551 et seq., and petitions the Court for a writ of mandamus.
Defendants have filed a motion to dismiss or, in the alternative, for summary judgment. ECF No. 11. Greenpeace has cross-moved for summary judgment. ECFNo. 14.[1] For the reasons explained below, Defendants' motion will be granted and Greenpeace's will be denied. Greenpeace's claims under the APA and for a writ of mandamus will be dismissed. In addition, the Court will enter summary judgment for Defendants on Greenpeace's FOIA claim.
I. Factual and Procedural Background
A. The CFATS Program
Congress initially created the CFATS program in 2006. Falcon Reply Decl. ¶ 4; see Nat'l Propane Gas Ass'n v. DHS, 534 F.Supp.2d 16, 18 (D.D.C. 2008) (describing history of program). The relevant act instructed DHS to issue "regulations establishing risk-based performance standards for security of chemical facilities and requiring vulnerability assessments and the development and implementation of site security plans for chemical facilities." Nat'l Propane, 534 F.Supp.2d at 18 (quoting Department of Homeland Security Appropriations Act, 2007, § 550(a), Pub. L. No. 109-295, 120 Stat. 1355, 1388 (2006)). DHS did so. See 6 C.F.R. pt. 27. In 2014, Congress enacted a formal statutory framework for the CFATS program. See Protecting and Securing Chemical Facilities from Terrorist Attacks Act of 2014, 6 U.S.C. § 621 et seq. The Infrastructure Security Compliance Division ("ISCD"), a component of DHS located within NPPD, operates CFATS. Pl's Resp. SoMF ¶ 4.
Under CFATS, DHS determines whether chemical facilities present "a high level of security risk, " which means that there is "the potential that a terrorist attack involving the facility could result in significant adverse consequences for human life or health, national security or critical economic assets." 6 C.F.R. § 27.205(a). The first step in making this determination is to identify which chemical facilities possess a "screening threshold quantity, " or "STQ, " of one or more "chemicals of interest." See 6 C.F.R. §§ 27.105, 27.200(b)(2). The chemicals of interest and their respective STQs are listed in Appendix A to the CFATS regulations. See 6 C.F.R. pt. 27 app. A. DHS requires chemical facilities to submit "Top-Screens, " reports listing each chemical of interest that the facilities possess at or above the STQ for that chemical. See Pl's Resp. SoMF ¶ 3; 6 C.F.R. § 27.200(b)(2).
Based on the Top-Screens and other information, including information received from the broader intelligence community about the threat of attack, DHS makes a preliminary determination of which facilities are high risk and places those high-risk facilities into one of four tiers. See Pl's Resp. SoMF ¶ 3; 6 C.F.R. § 27.220. DHS makes a final "tiering" decision for each facility after a "security vulnerability assessment." 6 C.F.R. §§ 27.215, 27.220(b). High-risk facilities must then implement security measures intended to reduce the risks associated with terrorist attacks. Pl's Resp. SoMF ¶ 3.
Facilities designated as high risk can also request a redetermination of their status if they alter their operations-for example, by reducing their holdings of chemicals of interest. See 6 C.F.R. § 27.205(b). Such facilities are informally referred to as "de-tiered, " because they are no longer considered high risk and thus are not placed in one of the four tiers. See Falcon Reply Decl. ¶ 11. In testimony before Congress in February 2012, an NPPD official explained that, since CFATS' inception, "more than 1, 600 facilities [had] completely removed their chemicals of interest, and more than 700 other facilities [had] reduced their holdings of chemicals of interest to levels resulting in the facilities no longer being considered high-risk." Defs.' Resp. SoMF ¶ 1. In February 2014, another NPPD official testified before Congress that "more than 3, 000 facilities [had] eliminated, reduced or modified their holdings of chemicals of interest." Id ¶ 3.
B. Greenpeace's FOIA Request and DHS's Response
On May 18, 2012, Greenpeace sent a letter to NPPD's FOIA office requesting "copies of all releasable documents and records that contain the most complete listing of chemical facilities that have reduced their holdings of threshold quantities of 'chemicals of interest' (COI) rendering them no longer 'high risk' facilities under [CFATS]." Fuentes Decl. Ex. B, at 1; Hind Decl. Ex. C, at l.[2] Almost ten months later, on March 13, 2013, NPPD issued an "interim response" stating that it had conducted a search and found 123 pages of responsive records, which would be withheld in full. Fuentes Decl. Ex. C, at 1; Hind Decl. Ex. D, at 1. The asserted grounds for withholding the documents were FOIA Exemption 5, and specifically, the deliberative process privilege; Exemption 7(E), an exemption for law-enforcement techniques, procedures and guidelines; and Exemption 7(F), an exemption for law-enforcement information whose release might endanger the safety of any individual. Fuentes Decl. Ex. C, at 1-2; Hind Decl. Ex. D, at 1-2.
On May 12, 2013, Greenpeace appealed the interim response to DHS's Associate General Counsel. Fuentes Decl. Ex. E; Hind Decl. Ex. E. Greenpeace argued that the claimed exemptions did not apply. Fuentes Decl. Ex. E; Hind Decl. Ex. E. In particular, citing Second Circuit case law, Greenpeace argued that Exemption 7(F) did not apply because DHS had not identified any particular individual who would be harmed by release of the information. Fuentes Decl. Ex. E, at 3 (citing ACLU v. Dep't of Def, 543 F.3d 59, 71 (2d Cir. 2008), vacated on other grounds, 130 S.Ct. 777 (2009)); Hind Decl. Ex. E, at 3. On September 27, 2013, while Greenpeace awaited a decision on its administrative appeal, NPPD finalized its earlier, "interim" response, standing by its decision to withhold the records but relying only on FOIA Exemptions 5 and 7(F), not 7(E). Fuentes Decl. Ex. D.
On June 27, 2014, Greenpeace received a response on its appeal from an attorney advisor at the U.S. Coast Guard Office of the Chief Administrative Law Judge. Fuentes Decl. Ex. H; Hind Decl. Ex. G. The attorney advisor explained that DHS's General Counsel had assigned FOIA appeals arising within DHS to that office. Fuentes Decl. Ex. H; Hind Decl. Ex. G; see also Hind Decl. Ex. F (2011 DHS memorandum assigning authority to Coast Guard). The attorney advisor ruled as follows: "NPPD's decision to withhold the records in their entirety pursuant [sic] is being reversed. The Agency has not provided adequate explanation as to why the requested records should be withheld pursuant to FOIA Exemptions (b)(5), (b)(7)(E), or (b)(7)(F)." Fuentes Decl. Ex. H, at 2; Hind Decl. Ex. G, at 2. The attorney advisor further explained that his decision was DHS's "final action, " and that Greenpeace could seek review in federal district court. Fuentes Decl. Ex. H, at 2; Hind Decl. Ex. G, at 2.
In an internal letter to NPPD's FOIA office, the Coast Guard attorney advisor explained the basis for his decision. Palmer Reply Decl. Ex. CC. He explained that he had relied on cases, including Second Circuit precedent cited by Greenpeace, holding that Exemption 7(F) is unavailable unless the agency identifies a specific person who would be harmed by release of the information. See Id. NPPD disagreed with the attorney advisor's analysis of Exemption 7(F). See Palmer Reply Decl. ¶¶ 12, 17. DHS had continued to take the position in litigation that Exemption 7(F) does not require the agency to identify a specific individual who would be harmed. See Id. ¶¶ 12-14. The D.C. Circuit ultimately adopted that position in 2015. Id. ¶ 15 & n.3 (citing Elec. Privacy Info. Ctr. ("EPIC") v. DHS, 777 F.3d 518 (D.C. Cir. 2015)). Therefore, while NPPD determined to comply with the "letter" of the attorney advisor's decision by releasing a redacted version of the documents, it would not follow the attorney advisor's reasoning in making those redactions. See Id. ¶ 17.
Defendants' declarations further assert that DHS was not, in any event, bound by the Coast Guard attorney advisor's decision. They assert that, as a matter of agency procedure, DHS's Office of General Counsel reserves the right to review FOIA decisions made by Coast Guard attorney advisors. See Palmer Decl. ¶ 8; Palmer Reply Decl. ¶ 7 ■ In this case, Defendants assert, the Office of General Counsel did just that and determined that most of the material should be redacted pursuant to Exemption 7(F), contrary to the attorney advisor's reasoning in the internal letter. See Palmer Decl. ¶¶ 11-12; Palmer Reply Decl. ¶¶ 12-19.
On December 15, 2014, NPPD released the 123 pages of records to Greenpeace, but in heavily redacted form. Fuentes Decl. Ex. I; Hind Decl. Ex. H. The redacted records consisted of two documents. The first was a list of facility names (the "Unregulated Facilities List"). Hind Decl. Ex. H. Most of the names were redacted, and those remaining were nondescript: examples include "Tucson, AZ, " "College Street, " "Main, " and "Almond." Id. The Unregulated Facilities List concluded with approximately 20 blank pages followed by one final entry. See Id. The second document (the "Untiered Facilities List") was a spreadsheet with two columns. Fuentes Decl. Ex. J; Hind Decl. Ex. H, pt. II. Each entry in the first column consisted of a single number ranging from 0 to 19. See Hind Decl. Ex. H, pt. II. This field represented the number of chemicals of interest that each facility held at or above STQs. See Pl's Resp. SoMF ¶ 6. The second column contained the name of each facility, and as in the first document, most of the names were redacted. See Hind Decl. Ex. H, pt. II. NPPD asserted that Exemption 7(F) covered the redacted material, because it "constitutes information compiled for law enforcement purposes the disclosure of which could reasonably be expected to endanger the life or physical safety of any individual." Hind Decl. Ex. H, at 1.
On February 13, 2015, Greenpeace filed another appeal to DHS's Associate General Counsel. Hind Decl. Ex. I. The appeal argued that the documents NPPD had produced were "indecipherable" due to the redactions, which violated the earlier decision by the Coast Guard attorney advisor. See Id. at 1. On August 25, 2015, the same Coast Guard attorney advisor responded, explaining that NPPD was "obligated to comply" with his earlier decision but that his office had "no ability to force compliance." Hind Decl. Ex. J. He advised that Greenpeace had exhausted its administrative remedies and could bring suit in federal district court. See id.
C. DHS's Search Process
ISCD uses an electronic system called the Chemical Security Assessment Tool ("CSAT") to maintain records related to CFATS. Pl's Resp. SoMF ¶ 4. CSAT stores the information that chemical facilities submit to DHS pursuant to CFATS, including the information submitted in their Top-Screens. Id; Fuentes Decl. ¶ 16. DHS asserts that CSAT "is the only database within DHS that stores the information necessary to produce a complete and contemporaneous listing of chemical facilities that have reduced their holdings of threshold quantities of chemicals of interest, thereby rendering them no longer high risk facilities." Pl's Resp. SoMF ¶ 4. Among the information in CSAT is a name for each facility; these names are provided by the facilities themselves when they register in CSAT, and are not necessarily unique to each facility. Id. ¶ 8.
In June 2012, ISCD searched for records responsive to Greenpeace's requests by running two queries within CSAT. See Id. ¶ 5. The first query yielded a spreadsheet of 2, 733 facilities that DHS had previously determined to be high risk but that, as of the date of the search, were no longer considered high risk. Id. ¶ 6. This spreadsheet (the Untiered Facilities List that DHS ultimately produced with redactions) included both the name of each facility and the number of chemicals of interest at or above STQs. Id. Some of the facilities on this list "still hold a screening threshold quantity of one or more chemicals of interest" and thus continued to be regulated under CFATS, even though they were no longer considered high risk. Fuentes Decl. ¶17.
The second query yielded the Unregulated Facilities List that DHS also redacted and produced to Greenpeace. This list, a subset of the Untiered Facilities List, contained the names of 1, 687 facilities still in operation that had reported having no chemicals of interest at or above STQs. Pl's Resp. SoMF ¶ 7. Because these facilities have no chemical of interest at or above an STQ, they are not regulated under CFATS. Fuentes Decl. ¶ 18. DHS explains that, due to a technical error, about 20 blank pages were inserted into the list before the last entry, but that this error did not cause any information to be withheld. Id. ¶ 22.
DHS asserts that, by searching CSAT, it "conducted a search of all locations likely to contain responsive documents using methods reasonably expected to uncover all relevant documents." Id. ¶23.
D. DHS's Redactions
DHS heavily redacted both lists before producing them to Greenpeace. The redactions covered all "facility names that would allow an individual to identify the specific facility." Fuentes Decl. Ex. A (Vaughn index); Fuentes Decl. ¶ 26. DHS's declarants state that personnel in NPPD's FOIA office carefully reviewed each entry on the lists to redact only those entries that would allow a facility to be identified. See Fuentes Decl. ¶ 33. DHS invokes Exemption 7(F) to justify these redactions, abandoning the other exemptions it had asserted. It explains that ISCD is a "regulatory enforcement division" of DHS and that both lists are compiled from information obtained from regulated facilities, which face penalties if they fail to comply with CFATS regulations. Fuentes Decl. ¶ 25. Therefore, DHS asserts, they were "compiled for law enforcement purposes, " the threshold requirement under Exemption 7. 5 U.S.C. § 552(b)(7); see Fuentes Decl. ¶ 25.
DHS offers two reasons why releasing the redacted information "could reasonably be expected to endanger the life or physical safety of any individual, " as is required to satisfy Exemption 7(F). 5 U.S.C. § 552(b)(7). First, these facilities represent "soft" targets. Falcon Reply Decl. ¶ 5. Even facilities that are not determined to be "high risk" under CFATS still contain dangerous chemicals. Fuentes Decl. ¶ 30. Some facilities have chemicals of interest at or above STQs, but nonetheless are not considered high risk for a variety of reasons. Id; Falcon Reply Decl. ¶ 13. Moreover, even facilities that have no chemicals of interest at or above STQs might still possess chemicals of interest at lower levels. Fuentes Decl. ¶ 30. Even lower levels of those chemicals can "present a risk to the lives and physical safety of individuals, " particularly those that work at or live near the facilities. Id. ¶ 32. But because those facilities are not considered high risk, DHS does not require them to institute security measures, making them appealing targets for terrorists. Id. ¶¶ 28, 32.
In addition, DHS claims, revealing this information could help terrorists identify facilities that are "high risk." DHS explains that facilities "regularly move between regulated and unregulated status, and tiered and untiered status, based on fluctuations in their chemical holdings and other facts that affect [DHS's] risk assessment of the facility (e.g., based on new threat information received from the intelligence community)." Id. ¶ 31. If DHS were required to release the unredacted lists periodically, then comparing the lists at different times would reveal the existence of some high-risk facilities: if a facility appeared on the list but later was removed, then it would be identifiable as "high risk." Id. DHS asserts that the risk of outing high-risk facilities is especially high given the age of the June 2012 lists at issue in this case: DHS is currently reanalyzing its risk determinations and expects that "approximately 5% of the previously untiered population of facilities will be determined to be high-risk and tiered." Falcon Deck ¶ 7.
DHS claims that these threats are not just hypothetical. One NPPD employee attests to "numerous reports from the intelligence community" discussing "the threat of terrorism involving chemicals and chemical facilities both in the United States and abroad." Falcon Reply Deck ¶ 6. There have also been actual chemical attacks overseas, including "attacks at two American-owned chemical facilities in France in 2015" and a thwarted terrorist plot in Australia. Id. ¶ 7.
Greenpeace responds by submitting a number of declarations (all from individuals who apparently have expertise in chemical safety) challenging DHS's claim that releasing the redacted information would pose a risk to life or physical safety. Greenpeace suggests that facilities that no longer have chemicals of interest at or above STQs are no more dangerous than "thousands of other facilities that are unregulated by CFATS" throughout the country. Orum Decl. ¶ 14. It provides examples such as underground storage tanks (which are regulated by the EPA and also listed on many state government websites) and facilities like dairy farms, which can be easily located online. Hind Decl. ¶ 17. Greenpeace further claims that not releasing the information would cause a safety risk: it would inhibit "developing and publicizing knowledge of successful practices at facilities" that have reduced their risk, and thereby "perpetuate unnecessary terrorist targets of opportunity." Orum Decl. ¶ 7; see Poje Decl. ¶¶ 11-12.
Greenpeace also asserts that much of the redacted information is already available to the public, such that there is no justification for withholding it. Many chemical facilities are "also regulated by other government agencies, " which have made available lists of those facilities and the chemicals they store. Orum Decl. ¶ 15. Greenpeace notes the EPA's Toxic Release Inventory ("TRI") program, which Congress created to "provide the public with information about releases of toxic chemicals in their community." Poje Decl. ¶ 10. Pursuant to the TRI program, facilities must make annual disclosures of certain chemicals they release or otherwise dispose of. Id. Greenpeace also points to the EPA's Risk Management Plan ("RMP"), which requires facilities to report holdings of certain substances over threshold amounts. Hind Decl. ¶ 18. The Houston Chronicle maintains a searchable online listing of RMP-regulated facilities. Id. The chemicals covered by the TRI and RMP programs overlap with the chemicals of interest regulated by CFATS, meaning many of the facilities regulated by CFATS (and the TRI- and RMP-reportable chemicals they store) are already publicly disclosed. Id. ¶¶ 18-21 & Ex. K; Poje Decl. ¶ 13. And Greenpeace asserts that information about these facilities can also be accessed through "a) web searches, phone books, tax records, or other public databases or records; b) direct observation; or c) engineering or other analysis of information sources that are lawfully disclosed or required to be disclosed." Orum Decl. ¶ 13.
         DHS's response is twofold. First, it points out that CFATS overlaps only incompletely with these other sources of public information, meaning that revealing the redacted names will provide terrorists with a new source of potential targets. See Falcon Reply Decl. ¶ 10. Next, and perhaps more importantly, DHS asserts that the availability of public information about chemical facilities makes the redacted information more dangerous, not less dangerous. A terrorist could cross-check the already-public lists against the lists of facilities that are not "high risk, " using the former ...