Summary
holding that employees of sensitive federal agencies, including the Secret Service, have a privacy interest in keeping their names and duty-stations from being disclosed under Exemption 6
Summary of this case from Horvath v. U.S. Secret Serv.Opinion
Docket Nos. 10–1600 (Lead), 10–1618(XAP).
2012-09-5
Susan B. LONG, David Burnham, Plaintiffs–Appellants–Cross–Appellees, v. OFFICE OF PERSONNEL MANAGEMENT, Defendant–Appellee–Cross–Appellant.
Adina H. Rosenbaum, Public Citizen Litigation Group, Washington, D.C. (Scott L. Nelson, on brief), for Appellants–Cross–Appellees. Steve Frank, United States Department of Justice, Washington, D.C. (Leonard Schaitman, on brief), for Tony West, Assistant Attorney General, for Appellee–Cross–Appellant.
Adina H. Rosenbaum, Public Citizen Litigation Group, Washington, D.C. (Scott L. Nelson, on brief), for Appellants–Cross–Appellees. Steve Frank, United States Department of Justice, Washington, D.C. (Leonard Schaitman, on brief), for Tony West, Assistant Attorney General, for Appellee–Cross–Appellant.
Before: JACOBS, Chief Judge, CHIN and DRONEY, Circuit Judges.
DENNIS JACOBS, Chief Judge:
In response to plaintiffs' Freedom of Information Act (“FOIA”) request for all records in the central database of defendant Office of Personnel Management (“OPM”), OPM withheld from disclosure the names and duty-station information of over 800,000 federal employees. In a pair of orders, the United States District Court for the Northern District of New York (Norman A. Mordue, J.) granted in part and denied in part each side's motion for summary judgment resolving the applicability of FOIA's personal privacy exemption: Exemption 6, 5 U.S.C. § 552(b)(6). The district court ruled that OPM could withhold all employee names, but that only some of the duty-station information could be withheld. We agree that the names could be withheld, but conclude that OPM was entitled to withhold all of the duty-station information.
BACKGROUND
Plaintiffs Susan Long and David Burnham are professors at Syracuse University and co-directors of the Transactional Records Access Clearinghouse (“TRAC”), a data-gathering, research, and distribution organization affiliated with the university. TRAC's stated purpose is to provide the public and oversight institutions with “comprehensive information about federal staffing, spending, and the enforcement activities of the federal government.” J.A. 188.
Among other data-collection techniques, plaintiffs use FOIA to get records and data from OPM's Central Personnel Data File (“CPDF”), a database of approximately 100 data elements, or fields, concerning the federal civilian workforce. OPM's static files have information about federal employees at a particular moment in time; its dynamic files record personnel actions over intervals. Covered agencies submit quarterly data to OPM, which stores it in the CPDF. In addition to each employee's name, the CPDF's other fields include salary history, duty station, occupation, work schedule, and veteran status.
The CPDF includes records for almost every employee of the executive branch, except those that work in a few security agencies, the White House, the Office of the Vice President, and the Tennessee Valley Authority.
For a time, OPM provided plaintiffs with all the data fields contained in the CPDF, including those associated with the civilian workforce of the Department of Defense (“DoD”). Near year-end 2004, plaintiffs requested CPDF records for that year. In February 2005, OPM told plaintiffs it would be applying a newly-implemented data–release policy to their request. The upshot of this new policy is that OPM redacted the names and duty-station information for over 800,000 federal employees, the majority of whom were civilian DoD employees. The duty-station information withheld includes six data elements (organizational component code, duty post, bargaining unit, core-based statistical area, combined statistical area, and locality pay), which together disclose only the city and county where the employee works, but not the street address. For some employees whose duty-station information was redacted, OPM nevertheless indicated whether they worked within the Washington, D.C. metropolitan area.
There are some exceptions to this policy. For example, beginning with its response to plaintiffs' request for the 1996 CPDF file, OPM withheld name and duty-station information for all employees in the Bureau of Alcohol, Tobacco, and Firearms.
Plaintiffs' requests and OPM's disclosures took place in several iterations over several years, but these complexities are irrelevant to the legal issues before us.
OPM withheld names and at least some duty-station information for [i] all employees in what it deemed to be five “sensitive” federal agencies: Bureau of Alcohol, Tobacco, and Firearms (“ATF”), Drug Enforcement Agency (“DEA”), DoD, Secret Service, and United States Mint; and [ii] for those employees across all federal agencies who are in twenty-four “sensitive” occupation categories: e.g., police, criminal investigating, nuclear engineering, game law enforcement.
The twenty-four occupations are ATF inspection, border patrol agent, compliance inspection & support, correctional officer, criminal investigating, custom patrol officer, customs & border protection, customs & border protection interdiction, customs inspection, game law enforcement, general inspection, general investigating, general national resources & biological science, immigration inspection, intelligence, intelligence clerk/aide, internal revenue officer, IRS agent, nuclear engineering, nuclear materials courier, plant protection & quarantine, police, U.S. marshal, and hearings & appeals.
The policy change was security-related. According to the affidavit of OPM's FOIA officer, Gary Lukowski, the events of September 11, 2001—particularly the attack on the Pentagon—and a subsequent anthrax attack caused OPM to review the vulnerability of the federal workforce to harassment and attack. OPM's new policy was in part motivated by a similar change in policy undertaken by the DoD in the immediate aftermath of September 11th. OPM also attributes its change in policy to an outcry by a number of individuals and federal agencies in response to a 2004 Washington Post feature that provided online access to the CPDF, which allowed anyone to search for federal employees by name, federal agency, or locality.
The DoD directed OPM not to release any personnel files of DoD employees in response to requests under FOIA, but instead to refer requesting parties to the DoD directly. Accordingly, in its initial responses to plaintiffs, OPM withheld all data on DoD employees and directed plaintiffs to seek it directly from the DoD. Eventually, OPM, with Do D's consent, released the DoD data without names or duty stations.
To justify withholding the names and duty-station information, OPM invoked Exemption 6 of FOIA, which protects from disclosure “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6). Plaintiffs unsuccessfully grieved some of the decisions through OPM.
This suit seeks disclosure of the information withheld. On cross-motions for summary judgment, the district court ruled that OPM properly redacted the names and duty stations for federal employees in the five sensitive agencies and four of the sensitive occupations: general national resources and biological science; plant protection and quarantine; hearings and appeals; and border patrol. See Long v. Office of Pers. Mgmt. (Long I), No. 05 Civ. 1522 (NAM/DEP), 2007 WL 2903924, at *22 (N.D.N.Y. Sept. 30, 2007). After further briefing, the court ruled that OPM also properly withheld the names of federal employees in the remaining occupations, see Long v. Office of Personnel Mgmt. (Long II), No. 05 Civ. 1522 (NAM/DEP), 2010 WL 681321, at *15 (N.D.N.Y. Feb. 23, 2010), but that Exemption 6 did not allow withholding of duty-station information for the remaining sensitive occupations, id. at *17. The parties cross-appealed.
DISCUSSION
I
“FOIA was enacted to promote honest and open government,” Grand Cent. P'ship, Inc. v. Cuomo, 166 F.3d 473, 478 (2d Cir.1999), and “to ensure public access to information created by the government in order to hold the governors accountable to the governed,” Tigue v. U.S. Dep't of Justice, 312 F.3d 70, 76 (2d Cir.2002) (internal quotation marks omitted). It “strongly favors a policy of disclosure and requires the government to disclose its records unless its documents fall within one of the specific, enumerated exemptions set forth in the Act.” Nat'l Council of La Raza v. U.S. Dep't of Justice, 411 F.3d 350, 355 (2d Cir.2005) (internal citation omitted). FOIA exemptions are construed narrowly, and a court is to resolve all doubts in favor of disclosure. See Grand Cent. P'ship, 166 F.3d at 478. The government bears the burden of establishing that any claimed exemption applies. Nat'l Council of La Raza, 411 F.3d at 356.
FOIA's Exemption 6 permits federal agencies to withhold from disclosure “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6). To determine whether a federal agency may withhold information pursuant to Exemption 6, we first determine whether the information is kept in “personnel [or] medical files [or] similar files.” Id.; see U.S. Dep't of State v. Wash. Post Co., 456 U.S. 595, 598–601, 102 S.Ct. 1957, 72 L.Ed.2d 358 (1982). If so, we “balance the public's need for the information against the individual's privacy interest to determine whether the disclosure of the names would constitute a ‘clearly unwarranted invasion of personal privacy.’ ” Wood v. FBI, 432 F.3d 78, 86 (2d Cir.2005) (quoting 5 U.S.C. § 552(b)(6)); accord U.S. Dep't of State v. Ray, 502 U.S. 164, 175, 112 S.Ct. 541, 116 L.Ed.2d 526 (1991).
In resolving summary judgment motions in a FOIA case, a district court proceeds primarily by affidavits in lieu of other documentary or testimonial evidence, as we have explained:
In order to prevail on a motion for summary judgment in a FOIA case, the defending agency has the burden of showing that its search was adequate and that any withheld documents fall within an exemption to the FOIA. Affidavits or declarations supplying facts indicating that the agency has conducted a thorough search and giving reasonably detailed explanations why any withheld documents fall within an exemption are sufficient to sustain the agency's burden. Affidavits submitted by an agency are accorded a presumption of good faith; accordingly, discovery relating to the agency's search and the exemptions it claims for withholding records generally is unnecessary if the agency's submissions are adequate on their face. When this is the case, the district court may forgo discovery and award summary judgment on the basis of affidavits.
Carney v. U.S. Dep't of Justice, 19 F.3d 807, 812 (2d Cir.1994) (internal quotation marks, footnote, and citations omitted). Neither party contends that the record in the district court was deficient. Accordingly, we now undertake the same analysis for each category of withheld information, reviewing the district court's judgment de novo, see Nat'l Council of La Raza, 411 F.3d at 355.
In a similar case, the withholding of names and duty-station information by OPM was ruled justified by the United States District Court for the District of Columbia. See Ctr. for Pub. Integrity v. U.S. Office of Pers. Mgmt., No. 04–1274(GK), 2006 WL 3498089, at *6 (D.D.C. Dec. 4, 2006). That court considered only whether Exemption 6 justified OPM's withholding of names together with duty-station information; it did not consider whether withholding duty-station information decoupled from employee names was justified by Exemption 6. Id.
II
The district court ruled that the names of the federal employees in the five sensitive agencies and twenty-four sensitive occupations were properly withheld because OPM had demonstrated that disclosure of employee names could subject them to harassment or attack. Long I, 2007 WL 2903924, at *15–19;Long II, 2010 WL 681321, at *16–17. We conclude that the public interests weighing in favor of disclosure are few and weak, and are clearly outweighed by the employees' privacy interests.
A
Plaintiffs contend that federal employees' interest in their names is “[m]inimal or [n]on-[e]xistent,” and cannot outweigh the public interest in disclosure. (Appellants' Br. 21.) “The balancing analysis for FOIA Exemption 6 requires that we first determine whether disclosure of the files would compromise a substantial, as opposed to de minimis, privacy interest, because if no significant privacy interest is implicated FOIA demands disclosure.” Multi Ag Media LLC v. Dep't of Agric., 515 F.3d 1224, 1229 (D.C.Cir.2008) (internal quotation marks and alterations omitted); accord Fed. Labor Relations Auth. v. U.S. Dep't of Veterans Affairs, 958 F.2d 503, 509 (2d Cir.1992). But the bar is low: “FOIA requires only a measurable interest in privacy to trigger the application of the disclosure balancing tests.” Fed. Labor Relations Auth. v. U.S. Dep't of Veterans Affairs, 958 F.2d at 510.
There is no real dispute that the CPDF data (with names included) meets the statutory category of “personnel and medical files and similar files,” 5 U.S.C. § 552(b)(6), because the CPDF contains quintessential personnel information. Plaintiffs do not argue otherwise.
The analysis is context specific. “Names and other identifying information do not always present a significant threat to an individual's privacy interest.” Wood, 432 F.3d at 88 (emphasis added); accord Ray, 502 U.S. at 176 n. 12, 112 S.Ct. 541 (“We emphasize, however, that we are not implying that disclosure of a list of names and other identifying information is inherently and always a significant threat to the privacy of the individuals on the list.”). “[W]hether disclosure of a list of names is a significant or a de minimis threat depends upon the characteristic(s) revealed by virtue of being on the particular list, and the consequences likely to ensue.” Ray, 502 U.S. at 176 n. 12, 112 S.Ct. 541 (internal quotation marks and alterations omitted).
It is not uncommon for courts to recognize a privacy interest in a federal employee's work status (as opposed to some more intimate detail) if the occupation alone could subject the employee to harassment or attack. Courts have recognized, for example, a privacy interest in the names of employees who worked on the regulatory approval of a controversial drug, see Judicial Watch, Inc. v. FDA, 449 F.3d 141, 152–53 (D.C.Cir.2006), and of law enforcement agents who participated in an investigation, see Wood, 432 F.3d at 86–89;Nix v. United States, 572 F.2d 998, 1006 (4th Cir.1978).
The record on appeal persuades us that the federal employees in both the sensitive agencies and the sensitive occupations have a cognizable privacy interest in keeping their names from being disclosed wholesale. Michael Donley, the Director of Administration and Management at DoD attests that withholding of employee names is one of many security measures instituted after the attack on the Pentagon on September 11th to make it “as difficult as possible for adversaries to collect valuable information that will enable them to carry out attacks on DoD personnel.” J.A. 328. Moreover, disclosure of names could permit the targeting of individual federal employees and their families outside the workplace. Lukowski, OPM's FOIA officer, explains: many of the agencies deal with national security, homeland security, or law enforcement, and “the mission and nature of the work performed by those agencies rendered not only individuals in specific occupations within the agencies, but any employee in the agency, vulnerable to harassment or attack.” J.A. 72. OPM's submissions sufficiently demonstrate that, by and large, federal employees in the sensitive agencies and occupations face an increased risk of harassment or attack.
Plaintiffs interpose two further objections. First, they point out that, under law developed in another circuit, Exemption 6 is not a “blanket exemption,” Baez v. U.S. Dep't of Justice, 647 F.2d 1328, 1339 (D.C.Cir.1980), or a “categorical rule,” Armstrong v. Exec. Office of the President, 97 F.3d 575, 582 (D.C.Cir.1996), protecting the names of mine-run federal law enforcement officers. Neither case implies that employees have no privacy interest in their names. Baez held that names could be withheld because the public had no interest in obtaining the names at issue, and implied that employees enjoy at least a minimal privacy interest in their names. See Baez, 647 F.2d at 1339. The ruling in Armstrong is that the Exemption 6 inquiry does not end whenever a privacy interest has been identified, but that the privacy interest must be weighed against the public's interest in disclosure. Armstrong, 97 F.3d at 581–82.
Second, plaintiffs challenge the withholding of information by category of employee, rather than record-by-record. This argument is not serious. Plaintiffs seek millions upon millions of data elements. FOIA does not require an agency to mobilize its full resources for compliance with FOIA requests. In cases in which considerably smaller amounts of records have been sought, withholding based upon general characteristics of classes of people or employees has been found compliant. See, e.g., U.S. Dep't of Def. v. Fed. Labor Relations Auth., 510 U.S. 487, 501, 114 S.Ct. 1006, 127 L.Ed.2d 325 (1994)(sustaining withholding of names and contact information for entire class of employees without individual inquiry); Nat'l Ass'n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 879 (D.C.Cir.1989) (recognizing privacy interest in list of names of retired and disabled federal employees without individual inquiry).
B
The privacy interest must be weighed against the public interest that would be advanced by disclosure. See Fed. Labor Rel. Auth. v. U.S. Dep't of Veterans Affairs, 958 F.2d at 510 (“[O]nce a more than de minimis privacy interest is implicated the competing interests at stake must be balanced in order to decide whether disclosure is permitted under FOIA.”). The only public interest cognizable under FOIA is the public “understanding of the operations or activities of the government.” U.S. Dep't of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 775, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989); Bibles v. Or. Natural Desert Ass'n, 519 U.S. 355, 355–56, 117 S.Ct. 795, 136 L.Ed.2d 825 (1997) (identifying relevant public interest as “extent to which disclosure of the information sought would shed light on an agency's performance of its statutory duties or otherwise let citizens know what their government is up to” (internal quotation marks and alterations omitted)).
In many contexts, federal courts have observed that disclosure of individual employee names tells nothing about “what the government is up to.” See Fed. Labor Relations Auth. v. U.S. Dep't of Veterans Affairs, 958 F.2d at 512;Schwarz v. U.S. Dep't of Treasury, 131 F.Supp.2d 142, 150 (D.D.C.2000) ( “Disclosure of [names of federal employees] ... would not contribute to the public understanding of government functions.”); Voinche v. FBI, 940 F.Supp. 323, 330 (D.D.C.1996) (“There is no reason to believe that the public will obtain a better understanding of the workings of various agencies by learning the identifies of [federal employees].”). Other cases allow for a possible public interest in identifying specific federal employees; but that the interest is slight, and in each case was substantially outweighed by the threat to the employee's personal privacy. See Wood, 432 F.3d at 88–89 (authorizing, under Exemption 6, redaction of the names of low-level FBI employees who participated in investigation because public interest was insufficiently furthered relative to the potential for harassment); Judicial Watch, 449 F.3d at 152–54 (permitting FDA to withhold pursuant to Exemption 6 names of employees and outsiders who worked on regulatory approval of “abortion pill”); Fed. Labor Relations Auth. v. U.S. Dep't of Commerce, 962 F.2d 1055, 1060 (D.C.Cir.1992) (permitting agency to keep private under Exemption 6 list of employees who received positive commendation).
Plaintiffs posit a strong public interest in knowing employee names because “Government work is done by people.” But if that were weighed in the balance of the Exemption 6 inquiry, little would be left to FOIA's protection for personal privacy. See Fed. Labor Relations Auth. v. U.S. Dep't of Veterans Affairs, 958 F.2d at 512 (“Compelling disclosure of personal information, that has no relationship to an agency's activities, on so attenuated a basis would inevitably result in the disclosure of virtually all personal information, thereby effectively eviscerating the protections of privacy provided by Exemption 6.”). Whether the public has an interest in the identity of federal workers, and to what extent, depends on circumstances, including whether the information sought sheds light on government activity. See Wood, 432 F.3d at 88; Perlman v. U.S. Dep't of Justice, 312 F.3d 100, 107 (2d Cir.2002), vacated,541 U.S. 970, 124 S.Ct. 1874, 158 L.Ed.2d 464 (2004), reinstated after remand, 380 F.3d 110 (2d Cir.2004).
Plaintiffs point to ways in which they (or the media) have used the names of federal employees obtained from the CPDF to inform themselves about what their “government is up to.” Specifically, they cite (1) disparities in the rates at which individual immigration judges grant and deny asylum requests; (2) high turnover rates at particular agencies; (3) agency employees who wrongfully benefit from agency programs; and (4) access to employees in order to “uncover agency malfeasance.” (Appellants' Br. 34–37.)
Such inquiries may be interesting, but they do not illustrate how the disclosure of names serves the purposes of FOIA. First, the disposition data for individual immigration judges are available even though the judges' names are withheld, because OPM has now replaced employee names with unique identifiers. Second, an employee's name may be useful for investigating the behavior of individual employees; but courts have been skeptical of recognizing a public interest in this “derivative” use of information, which is indirect and speculative. See Associated Press v. U.S. Dep't of Def., 554 F.3d 274, 292 (2d Cir.2009) (“We emphasize that the focus, in assessing a claim under Exemption 6, must be solely upon what the requested information reveals, not upon what it might lead to.” (internal quotation marks omitted)); see also Ray, 502 U.S. at 180, 112 S.Ct. 541 (Scalia, J., concurring) (“[I]t is unavoidable that the focus, in assessing a claim under Exemption 6, must be solely upon what the requested information reveals, not upon what it might lead to.”). But see Painting & Drywall Work Pres. Fund, Inc. v. Dep't of Hous. and Urban Dev., 936 F.2d 1300, 1303 (D.C.Cir.1991) (indicating that derivative use of information is cognizable under FOIA, but in that case clearly outweighed by privacy interests).
The same is true for plaintiffs' assertion that access to employee names permitted TRAC to “trace[ ] a large drop in the enforcement of wildlife laws to the retirement of one employee.” (Appellants' Br. 35.) The drop could just as easily be attributed to the single individual by way of the unique employee identifier.
Also discounted is the interest in identifying a federal employee by name in order to make contact or conduct interviews. See Forest Serv. Emps. for Envtl. Ethics v. U.S. Forest Serv., 524 F.3d 1021, 1028 (9th Cir.2008) (identity of forest service employees could be withheld where primary purpose of identifying employees was to contact employees directly to obtain information). Such a use is an example of the “derivative theory” of public interest, and actually facilitates the invasion of the employee's personal privacy. See Painting Indus. of Haw. Mkt. Recovery Fund v. U.S. Dep't of Air Force, 26 F.3d 1479, 1485 (9th Cir.1994) (“Any additional public benefit the requesters might realize through [contact with employees] is inextricably intertwined with the invasions of privacy that those contacts will work.”). The use of personnel files to contact government employees in the hopes of uncovering malfeasance does not serve FOIA's objectives.
C
Where public interest favoring disclosure is no more than minimal, a lesser privacy interest suffices to outweigh it. See U.S. Dep't of Def. v. Fed. Labor Relations Auth., 510 U.S. at 500, 114 S.Ct. 1006. This reciprocal principle is illustrated by a pair of cases in which unions wanted employee contact information in order to tell them about union activities. While the privacy interest was small, no countervailing public interest at all was cognizable under Exemption 6. See id. at 502, 114 S.Ct. 1006 (holding that employees' home addresses need not be disclosed to unions because such disclosure did not further FOIA's purpose of open government); Fed. Labor Relations Auth. v. U.S. Dep't of Veterans Affairs, 958 F.2d at 513 (same).
Plaintiffs have identified no appreciable public interest militating in favor of the wholesale disclosure of names of employees in the sensitive agencies and sensitive occupations. OPM therefore need not identify any compelling privacy interest in order to “clearly outweigh[ ]” the nonexistent public interest. See U.S. Dep't of Def. v. Fed. Labor Relations Auth., 510 U.S. at 500, 114 S.Ct. 1006 (“Because a very slight privacy interest would suffice to outweigh the relevant public interest, we need not be exact in our quantification of the privacy interest. It is enough for present purposes to observe that the employees' interest in nondisclosure is not insubstantial.”). Accordingly, we hold that Exemption 6 permits OPM to withhold the names of employees working in the sensitive agencies and sensitive occupations.
III
The remaining issue is whether Exemption 6 permits OPM to withhold duty-station information even after employee names have been redacted. The district court's first opinion considered the duty-station information together with employee names, and found that both were properly withheld for the sensitive agencies and the four sensitive occupations that it considered. Long I, 2007 WL 2903924, at *19. When the district court turned to the remaining twenty sensitive occupations in Long II, it considered duty-station information apart from names and found that “OPM has failed to show more than a de minimis privacy interest in the ... geographic location of federal employees,” Long II, 2010 WL 681321, at *17. Although the issue is close, we conclude that OPM has demonstrated that employees possess a cognizable privacy interest in their duty-station records de-linked from their names, and that it clearly outweighs any public interest that might be served by disclosure.
This portion of the district court's reasoning substantially undermines its earlier finding that OPM could redact duty-station information for the five sensitive agencies and four of the sensitive occupations. However, it did not expressly revisit its earlier order, and we will assume that it was left intact. In any event, our review is de novo. See Nat'l Council of La Raza, 411 F.3d at 355.
A
Plaintiffs argue that federal employees have no privacy interest in their duty-station information once their names have been redacted. “[P]rivacy interests protected by the exemptions to FOIA are broadly construed.” Associated Press v. U.S. Dep't of Justice, 549 F.3d 62, 65 (2d Cir.2008). Exemption 6 extends to “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6). “[B]oth the common law and the literal understandings of privacy encompass the individual's control of information concerning his or her person.” Reporters Comm., 489 U.S. at 763, 109 S.Ct. 1468; Fed. Labor Relations Auth. v. U.S. Dep't of Veterans Affairs, 958 F.2d at 510 (“[T]he concept of privacy is not an abstract concept, but rather a valuable—and, in the present context, elastic—right whose boundaries are delineated by the type of information sought and by the persons requesting it.”).
Plaintiffs also posit that employee duty-station information does not constitute “personnel and medical files and similar files” referenced in Exemption 6. 5 U.S.C. § 552(b)(6). The redaction of names, however, does not change the nature of the files that plaintiffs seek—the CPDF is still a collection of personnel records.
The records sought by plaintiffs are “personal” in the sense that they are specific to individuals. Even if employee names are replaced by anonymous identifiers, every employee entry contains dozens of items of personal information about the individual. The current and career information reveals job classification, pay, veteran status, and work schedule. This data is personal to the employee because it is wholly “information concerning his or her person.” Reporters Comm., 489 U.S. at 763, 109 S.Ct. 1468. And it would be child's play for a determined researcher to deduce a name from the descriptive data if the researcher is looking for anyone specific.
Some duty-station information redacted by OPM was at one time freely available. But it is now private nevertheless in the sense that it is “intended for or restricted to the use of a particular person or group or class of persons: not freely available to the public.” Id., 489 U.S. at 763–64, 109 S.Ct. 1468 (quoting Webster's Third New International Dictionary 1804 (1976)). OPM's affidavits on the subject, which we accord a presumption of good faith, see Carney, 19 F.3d at 812, set forth in reasonable detail that OPM (and DoD) now preserve the privacy of duty-station information pursuant to comprehensive data security and safety plans.
Plaintiffs contend that “because the withheld records do not provide work addresses ... the potential harasser or attacker would not be able to locate the employee.” (Appellants' Br. 59–60.) But knowledge that an employee works for a particular agency or in a particular role, in a particular locality, is often enough to pinpoint the street address of the workplace. Plaintiffs concede as much. Id. at 43.
Redaction of names goes a long way toward protecting against surveillance and publicity those things that are generally treated as nobody else's business. See Grand Cent. P'ship, 166 F.3d at 485–86. But a primary reason for the protection afforded by Exemption 6 is to protect individuals' physical safety. See Judicial Watch, 449 F.3d at 152–53. That is the risk that the OPM attests will arise from disclosure of the duty-station information.
OPM's affidavits set forth how terrorists and others could derive specific work addresses from the duty-station information. Plaintiffs contend that this risk of harm is not personal because an individual cannot be identified from disclosure of duty-station information, and therefore any harm would be directed at the entire federal agency (or a particular office location), not the individual employee. Even if an individual cannot be identified from the duty-station information, the risk of harm to that individual is not abated by anonymity. “If the disclosure assisted wrongdoers in carrying out an attack, it would be Jane Doe ..., [a] real person[ ], who would be harmed.” (Appellee's Br. 80.) Federal employees thus have a cognizable personal privacy interest in safeguarding the disclosure of their duty-station information when a risk of such harm is present.
Plaintiffs also label the risk of harm as speculative, but the record satisfies us that the risk is no more attenuated or contingent than risks of harassment or attack that have been recognized in FOIA cases dealing with federal law enforcement officers. See, e.g., Wood, 432 F.3d at 88; Halpern v. FBI, 181 F.3d 279, 297 (2d Cir.1999).
Risk of physical attack distinguishes this case from cases in which the redaction of names has been found sufficient to secure other privacy interests. See Ray, 502 U.S. at 175–176, 112 S.Ct. 541 (once names were redacted from interviews with Haitians attempting to enter United States, they had only a de minimis privacy interest in those records); ACLU v. Department of Defense, 543 F.3d 59, 85–86 (2d Cir.2008), vacated on other grounds,––– U.S. ––––, 130 S.Ct. 777, 175 L.Ed.2d 508 (2009) (detainees whose abuse was depicted in photographs had no more than de minimis privacy interest because all identifying information had been redacted).
Here, as discussed above, redaction of employee names does not allay the threat of harassment or attack of federal employees. We therefore hold that federal employees have a more than de minimis privacy interest in safeguarding the disclosure of their duty-station information when a risk of such harm is present.
The parties disagree about whether the duty-station information should be treated as a whole, or as separate data fields in the CPDF: organizational component, post of duty, bargaining unit, core-based statistical area, combined statistical area, and locality pay area. Organizational component codes are 18–digit codes, a portion of which indicates the employees' place within the hierarchy of the agency, and a portion of which might indicate where the employee is geographically located. Plaintiffs contend that organizational components are different because they primarily tell where an employee fits within an organization's overall structure, and only sometimes contain geographic information as well. However, OPM has sufficiently shown that, because organizational codes are unique to each agency and frequently changing, there is no feasible way for it to segregate those that contain geographic information from those that do not, or to redact the portion of the code that contains the geographic information.
B
It remains to weigh the employees' privacy interests against the public's interest in the duty-station information. The chief public interest identified by plaintiffs is an interest in seeing where the federal government deploys its personnel. Although this information might shed some dim, diffused light on “what the Government is up to,” Reporters Comm., 489 U.S. at 780, 109 S.Ct. 1468 (internal quotation marks omitted), the number of federal employees here and there is a rough data point that imparts virtually nothing about the function of the federal government.
OPM has identified other sources from which plaintiffs could obtain much of the information they seek. That further reduces the public interest, such as it is. See U.S. Dep't of Def. Dep't of Military Affairs v. Fed. Labor Relations Auth., 964 F.2d 26, 29–30 (D.C.Cir.1992) (recognizing that “alternative sources of information available that could serve the public interest in disclosure” diminish public interest value of disclosure). For example, plaintiffs present a hypothetical comparison of staffing levels in the Federal Emergency Management Agency before and after Hurricane Katrina; but OPM points out that multiple, comprehensive reports exist on the subject.
OPM cites two reports, one prepared by The White House, and one prepared by FEMA itself. See The Federal Response to Hurricane Katrina: Lessons Learned (2006), available at http:// georgewbush whitehouse. archives. gov/ reports/ katrina- lessons- learned; A Performance Review of FEMA's Disaster Management Activities in Response to Hurricane Katrina, OIG–06–32 (2006), available at http:// www. dhs. gov/ xoig/ assets/ mgmtrpts/ OIG_ 06– 32_ Mar 06. pdf.
Finally, the duty-station information is on a comprehensive computerized database that is vulnerable to analysis and manipulation by persons seeking to identify targets for violence, or to increase casualties. Heightened vigilance is appropriate in cases involving computerized databases. See Reporters Comm., 489 U.S. at 766–67, 109 S.Ct. 1468 (citing the Privacy Act of 1974 for the proposition that “Congress' basic policy concern regarding the implications of computerized data banks for personal privacy is certainly relevant”).
The threat cited by OPM is not specific as to location or individual. But plaintiffs seek records of millions of employees who work in dozens of agencies and hundreds of occupations. It is not feasible to gauge the threat to each individual employee, office, or facility included in the CPDF. Since the defendant agency has already demonstrated that employees will be put at risk by disclosure, this uncertainty has weight in the balance struck by Exemption 6.
Accordingly, we hold that OPM has demonstrated that employee privacy concern about the release of their duty-station information clearly outweighs the public interests identified by plaintiffs.
CONCLUSION
For the foregoing reasons, we AFFIRM the judgment of the district court insofar as it ruled that FOIA Exemption 6 permitted OPM to withhold all of the names at issue and some of the duty-station information, but REVERSE insofar as it ruled that duty-station information for twenty sensitive occupations must be disclosed.