     10-1600 (L)
     Long v. Office of Personnel Mgmt.
 1
 2                       UNITED STATES COURT OF APPEALS
 3
 4                           FOR THE SECOND CIRCUIT
 5
 6                              August Term, 2011
 7
 8
 9     (Argued: May 18, 2012             Decided: September 5, 2012)
10
11                Docket Nos. 10-1600 (Lead) 10-1618 (XAP)
12
13   - - - - - - - - - - - - - - - - - - - -x
14
15   SUSAN B. LONG, DAVID BURNHAM,
16
17                     Plaintiffs-Appellants-Cross-Appellees,
18
19               - v.-
20
21   OFFICE OF PERSONNEL MANAGEMENT,
22
23                     Defendant-Appellee-Cross-Appellant.
24
25   - - - - - - - - - - - - - - - - - - - -x
26

27         Before:           JACOBS, Chief Judge, CHIN and DRONEY,
28                           Circuit Judges.
29
30         Appeal from two orders of the United States District

31   Court for the Northern District of New York (Norman A.

32   Mordue, J.) granting in part and denying in part each side’s

33   motion for summary judgment resolving the applicability of

34   Exemption 6 of the Freedom of Information Act, 5 U.S.C. §

35   552(b)(6), to a federal agency’s decision to withhold names

36   and duty-station information from personnel records for over

37   800,000 federal civilian employees.       We hold that the
1    district court correctly found that the names could be

2    withheld, but erred insofar as it found that the agency must

3    disclose all of the duty-station information.

4        AFFIRMED IN PART, REVERSED IN PART.

 5                                 ADINA H. ROSENBAUM, Public Citizen
 6                                 Litigation Group, Washington,
 7                                 D.C. (Scott L. Nelson, on
 8                                 brief), for Appellants-Cross-
 9                                 Appellees.
10
11                                 STEVE FRANK, United States
12                                 Department of Justice,
13                                 Washington, D.C. (Leonard
14                                 Schaitman, on brief), for Tony
15                                 West, Assistant Attorney
16                                 General, for Appellee-Cross-
17                                 Appellant.
18
19   DENNIS JACOBS, Chief Judge:
20
21       In response to plaintiffs’ Freedom of Information Act

22   (“FOIA”) request for all records in the central database of

23   defendant Office of Personnel Management (“OPM”), OPM

24   withheld from disclosure the names and duty-station

25   information of over 800,000 federal employees.      In a pair of

26   orders, the United States District Court for the Northern

27   District of New York (Norman A. Mordue, J.) granted in part

28   and denied in part each side’s motion for summary judgment

29   resolving the applicability of FOIA’s personal privacy

30   exemption: Exemption 6, 5 U.S.C. § 552(b)(6).      The district



                                     2
1    court ruled that OPM could withhold all employee names, but

2    that only some of the duty-station information could be

3    withheld.     We agree that the names could be withheld, but

4    conclude that OPM was entitled to withhold all of the duty-

5    station information.

6

7                                BACKGROUND

8        Plaintiffs Susan Long and David Burnham are professors

9    at Syracuse University and co-directors of the Transactional

10   Records Access Clearinghouse (“TRAC”), a data-gathering,

11   research, and distribution organization affiliated with the

12   university.    TRAC’s stated purpose is to provide the public

13   and oversight institutions with “comprehensive information

14   about federal staffing, spending, and the enforcement

15   activities of the federal government.”    J.A. 188.

16       Among other data-collection techniques, plaintiffs use

17   FOIA to get records and data from OPM’s Central Personnel

18   Data File (“CPDF”), a database of approximately 100 data

19   elements, or fields, concerning the federal civilian

20   workforce.1    OPM’s static files have information about


          1
            The CPDF includes records for almost every employee
     of the executive branch, except those that work in a few
     security agencies, the White House, the Office of the Vice
     President, and the Tennessee Valley Authority.
                                     3
1    federal employees at a particular moment in time; its

2    dynamic files record personnel actions over intervals.

3    Covered agencies submit quarterly data to OPM, which stores

4    it in the CPDF.   In addition to each employee’s name, the

5    CPDF’s other fields include salary history, duty station,

6    occupation, work schedule, and veteran status.

7        For a time, OPM provided plaintiffs with all the data

8    fields contained in the CPDF, including those associated

9    with the civilian workforce of the Department of Defense

10   (“DoD”).2   Near year-end 2004, plaintiffs requested CPDF

11   records for that year.   In February 2005, OPM told

12   plaintiffs it would be applying a newly-implemented data-

13   release policy to their request.   The upshot of this new

14   policy is that OPM redacted the names and duty-station

15   information for over 800,000 federal employees, the majority

16   of whom were civilian DoD employees.3   The duty-station

17   information withheld includes six data elements


          2
            There are some exceptions to this policy. For
     example, beginning with its response to plaintiffs’ request
     for the 1996 CPDF file, OPM withheld name and duty-station
     information for all employees in the Bureau of Alcohol,
     Tobacco, and Firearms.
          3
            Plaintiffs’ requests and OPM’s disclosures took place
     in several iterations over several years, but these
     complexities are irrelevant to the legal issues before us.
                                   4
1    (organizational component code, duty post, bargaining unit,

2    core-based statistical area, combined statistical area, and

3    locality pay), which together disclose only the city and

4    county where the employee works, but not the street address.

5    For some employees whose duty-station information was

6    redacted, OPM nevertheless indicated whether they worked

7    within the Washington, D.C. metropolitan area.

8        OPM withheld names and at least some duty-station

9    information for [I] all employees in what it deemed to be

10   five “sensitive” federal agencies: Bureau of Alcohol,

11   Tobacco, and Firearms (“ATF”), Drug Enforcement Agency

12   (“DEA”), DoD, Secret Service, and United States Mint; and

13   [ii] for those employees across all federal agencies who are

14   in twenty-four “sensitive” occupation categories: e.g.,

15   police, criminal investigating, nuclear engineering, game

16   law enforcement.4


          4
            The twenty-four occupations are ATF inspection,
     border patrol agent, compliance inspection & support,
     correctional officer, criminal investigating, custom patrol
     officer, customs & border protection, customs & border
     protection interdiction, customs inspection, game law
     enforcement, general inspection, general investigating,
     general national resources & biological science, immigration
     inspection, intelligence, intelligence clerk/aide, internal
     revenue officer, IRS agent, nuclear engineering, nuclear
     materials courier, plant protection & quarantine, police,
     U.S. marshal, and hearings & appeals.
                                  5
1        The policy change was security-related.    According to

2    the affidavit of OPM’s FOIA officer, Gary Lukowski, the

3    events of September 11, 2001--particularly the attack on the

4    Pentagon--and a subsequent anthrax attack caused OPM to

5    review the vulnerability of the federal workforce to

6    harassment and attack.   OPM’s new policy was in part

7    motivated by a similar change in policy undertaken by the

8    DoD in the immediate aftermath of September 11th.5   OPM also

9    attributes its change in policy to an outcry by a number of

10   individuals and federal agencies in response to a 2004

11   Washington Post feature that provided online access to the

12   CPDF, which allowed anyone to search for federal employees

13   by name, federal agency, or locality.

14       To justify withholding the names and duty-station

15   information, OPM invoked Exemption 6 of FOIA, which protects

16   from disclosure “personnel and medical files and similar

17   files the disclosure of which would constitute a clearly

18   unwarranted invasion of personal privacy.”    5 U.S.C. §

          5
            The DoD directed OPM not to release any personnel
     files of DoD employees in response to requests under FOIA,
     but instead to refer requesting parties to the DoD directly.
     Accordingly, in its initial responses to plaintiffs, OPM
     withheld all data on DoD employees and directed plaintiffs
     to seek it directly from the DoD. Eventually, OPM, with
     DoD’s consent, released the DoD data without names or duty
     stations.
                                   6
1    552(b)(6).   Plaintiffs unsuccessfully grieved some of the

2    decisions through OPM.

3        This suit seeks disclosure of the information withheld.

4    On cross-motions for summary judgment, the district court

5    ruled that OPM properly redacted the names and duty stations

6    for federal employees in the five sensitive agencies and

7    four of the sensitive occupations: general national

8    resources and biological science; plant protection and

9    quarantine; hearings and appeals; and border patrol.   See

10   Long v. Office of Pers. Mgmt. (Long I), No. 05 Civ. 1522

11   (NAM/DEP), 2007 WL 2903924, at *22 (N.D.N.Y. Sept. 30,

12   2007).   After further briefing, the court ruled that OPM

13   also properly withheld the names of federal employees in the

14   remaining occupations, see Long v. Office of Personnel

15   Mgmt. (Long II), No. 05 Civ. 1522 (NAM/DEP), 2010 WL 681321,

16   at *15 (N.D.N.Y. Feb. 23, 2010), but that Exemption 6 did

17   not allow withholding of duty-station information for the

18   remaining sensitive occupations, id. at *17.   The parties

19   cross-appealed.

20

21

22


                                   7
1                                DISCUSSION

2                                    I

3        “FOIA was enacted to promote honest and open

4    government,” Grand Cent. P’ship, Inc. v. Cuomo, 166 F.3d

5    473, 478 (2d Cir. 1999), and “to ensure public access to

6    information created by the government in order to hold the

7    governors accountable to the governed,” Tigue v. U.S. Dep’t

8    of Justice, 312 F.3d 70, 76 (2d Cir. 2002) (internal

9    quotation marks omitted).    It “strongly favors a policy of

10   disclosure and requires the government to disclose its

11   records unless its documents fall within one of the

12   specific, enumerated exemptions set forth in the Act.”

13   Nat’l Council of La Raza v. U.S. Dep’t of Justice, 411 F.3d

14   350, 355 (2d Cir. 2005) (internal citation omitted).      FOIA

15   exemptions are construed narrowly, and a court is to resolve

16   all doubts in favor of disclosure.       See Grand Cent. P’ship,

17   166 F.3d at 478.   The government bears the burden of

18   establishing that any claimed exemption applies.      Nat’l

19   Council of La Raza, 411 F.3d at 356.

20       FOIA’s Exemption 6 permits federal agencies to withhold

21   from disclosure “personnel and medical files and similar

22   files the disclosure of which would constitute a clearly


                                     8
1    unwarranted invasion of personal privacy.”   5 U.S.C. §

2    552(b)(6).    To determine whether a federal agency may

3    withhold information pursuant to Exemption 6, we first

4    determine whether the information is kept in “personnel [or]

5    medical files [or] similar files.”    Id.; see U.S. Dep’t of

6    State v. Wash. Post Co., 456 U.S. 595, 598-601 (1982).      If

7    so, we “balance the public’s need for the information

8    against the individual’s privacy interest to determine

9    whether the disclosure of the names would constitute a

10   ‘clearly unwarranted invasion of personal privacy.’”      Wood

11   v. FBI, 432 F.3d 78, 86 (2d Cir. 2005) (quoting 5 U.S.C. §

12   552(b)(6)); accord U.S. Dep’t of State v. Ray, 502 U.S. 164,

13   175 (1991).

14       In resolving summary judgment motions in a FOIA case, a

15   district court proceeds primarily by affidavits in lieu of

16   other documentary or testimonial evidence, as we have

17   explained:

18                  In order to prevail on a motion for summary
19                  judgment in a FOIA case, the defending agency
20                  has the burden of showing that its search was
21                  adequate and that any withheld documents fall
22                  within an exemption to the FOIA. Affidavits
23                  or declarations supplying facts indicating
24                  that the agency has conducted a thorough
25                  search and giving reasonably detailed
26                  explanations why any withheld documents fall
27                  within an exemption are sufficient to sustain

                                    9
 1                 the agency’s burden. Affidavits submitted by
 2                 an agency are accorded a presumption of good
 3                 faith; accordingly, discovery relating to the
 4                 agency’s search and the exemptions it claims
 5                 for withholding records generally is
 6                 unnecessary if the agency’s submissions are
 7                 adequate on their face. When this is the case,
 8                 the district court may forgo discovery and
 9                 award summary judgment on the basis of
10                 affidavits.
11
12   Carney v. U.S. Dep’t of Justice, 19 F.3d 807, 812 (2d Cir.

13   1994) (internal quotation marks, footnote, and citations

14   omitted).   Neither party contends that the record in the

15   district court was deficient.        Accordingly, we now undertake

16   the same analysis for each category of withheld information,

17   reviewing the district court’s judgment de novo, see Nat’l

18   Council of La Raza, 411 F.3d at 355.6

19

20                                   II
21
22       The district court ruled that the names of the federal

23   employees in the five sensitive agencies and twenty-four


          6
            In a similar case, the withholding of names and
     duty-station information by OPM was ruled justified by the
     United States District Court for the District of Columbia.
     See Ctr. for Pub. Integrity v. U.S. Office of Pers. Mgmt.,
     No. 04-1274(GK), 2006 WL 3498089, at *6 (D.D.C. Dec. 4,
     2006). That court considered only whether Exemption 6
     justified OPM’s withholding of names together with
     duty-station information; it did not consider whether
     withholding duty-station information decoupled from employee
     names was justified by Exemption 6. Id.
                                     10
1    sensitive occupations were properly withheld because OPM had

2    demonstrated that disclosure of employee names could subject

3    them to harassment or attack.        Long I, 2007 WL 2903924, at

4    *15-19; Long II, 2010 WL 681321, at *16-17.       We conclude

5    that the public interests weighing in favor of disclosure

6    are few and weak, and are clearly outweighed by the

7    employees’ privacy interests.

8

9                                    A

10       Plaintiffs contend that federal employees’ interest in

11   their names is “[m]inimal or [n]on-[e]xistent,” and cannot

12   outweigh the public interest in disclosure.7       (Appellants’

13   Br. 21.)   “The balancing analysis for FOIA Exemption 6

14   requires that we first determine whether disclosure of the

15   files would compromise a substantial, as opposed to de

16   minimis, privacy interest, because if no significant privacy

17   interest is implicated FOIA demands disclosure.”       Multi Ag

18   Media LLC v. Dep’t of Agric., 515 F.3d 1224, 1229 (D.C. Cir.

19   2008) (internal quotation marks and alterations omitted));


          7
            There is no real dispute that the CPDF data (with
     names included) meets the statutory category of “personnel
     and medical files and similar files,” 5 U.S.C. § 552(b)(6),
     because the CPDF contains quintessential personnel
     information. Plaintiffs do not argue otherwise.
                                     11
1    accord Fed. Labor Relations Auth. v. U.S. Dep’t of Veterans

2    Affairs, 958 F.2d 503, 509 (2d Cir. 1992).     But the bar is

3    low: “FOIA requires only a measurable interest in privacy to

4    trigger the application of the disclosure balancing tests.”

5    Fed. Labor Relations Auth. v. U.S. Dep’t of Veterans

6    Affairs, 958 F.2d at 510.

7        The analysis is context specific.    “Names and other

8    identifying information do not always present a significant

9    threat to an individual’s privacy interest.”    Wood, 432 F.3d

10   at 88 (emphasis added); accord Ray, 502 U.S. at 176 n.12

11   (“We emphasize, however, that we are not implying that

12   disclosure of a list of names and other identifying

13   information is inherently and always a significant threat to

14   the privacy of the individuals on the list.”). “[W]hether

15   disclosure of a list of names is a significant or a de

16   minimis threat depends upon the characteristic(s) revealed

17   by virtue of being on the particular list, and the

18   consequences likely to ensue.”    Ray, 502 U.S. at 176 n.12

19   (internal quotation marks and alterations omitted).

20       It is not uncommon for courts to recognize a privacy

21   interest in a federal employee’s work status (as opposed to

22   some more intimate detail) if the occupation alone could


                                  12
1    subject the employee to harassment or attack.   Courts have

2    recognized, for example, a privacy interest in the names of

3    employees who worked on the regulatory approval of a

4    controversial drug, see Judicial Watch, Inc. v. FDA, 449

5    F.3d 141, 152-53 (D.C. Cir. 2006), and of law enforcement

6    agents who participated in an investigation, see Wood, 432

7    F.3d at 86-89; Nix v. United States, 572 F.2d 998, 1006 (4th

8    Cir. 1978).

9        The record on appeal persuades us that the federal

10   employees in both the sensitive agencies and the sensitive

11   occupations have a cognizable privacy interest in keeping

12   their names from being disclosed wholesale.    Michael Donley,

13   the Director of Administration and Management at DoD attests

14   that withholding of employee names is one of many security

15   measures instituted after the attack on the Pentagon on

16   September 11th to make it “as difficult as possible for

17   adversaries to collect valuable information that will enable

18   them to carry out attacks on DoD personnel.”    J.A. 328.

19   Moreover, disclosure of names could permit the targeting of

20   individual federal employees and their families outside the

21   workplace.    Lukowski, OPM’s FOIA officer, explains: many of

22   the agencies deal with national security, homeland security,



                                    13
1    or law enforcement, and “the mission and nature of the work

2    performed by those agencies rendered not only individuals in

3    specific occupations within the agencies, but any employee

4    in the agency, vulnerable to harassment or attack.”    J.A.

5    72.   OPM’s submissions sufficiently demonstrate that, by and

6    large, federal employees in the sensitive agencies and

7    occupations face an increased risk of harassment or attack.

8          Plaintiffs interpose two further objections.   First,

9    they point out that, under law developed in another circuit,

10   Exemption 6 is not a “blanket exemption,” Baez v. U.S. Dep’t

11   of Justice, 647 F.2d 1328, 1339 (D.C. Cir. 1980), or a

12   “categorical rule,” Armstrong v. Exec. Office of the

13   President, 97 F.3d 575, 582 (D.C. Cir. 1996), protecting the

14   names of mine-run federal law enforcement officers.    Neither

15   case implies that employees have no privacy interest in

16   their names.   Baez held that names could be withheld because

17   the public had no interest in obtaining the names at issue,

18   and implied that employees enjoy at least a minimal privacy

19   interest in their names.   See Baez, 647 F.2d at 1339.    The

20   ruling in Armstrong is that the Exemption 6 inquiry does not

21   end whenever a privacy interest has been identified, but

22   that the privacy interest must be weighed against the

23   public’s interest in disclosure.   Armstrong, 97 F.3d at 581-

24   82.

                                   14
1        Second, plaintiffs challenge the withholding of

2    information by category of employee, rather than record-by-

3    record.   This argument is not serious.    Plaintiffs seek

4    millions upon millions of data elements.     FOIA does not

5    require an agency to mobilize its full resources for

6    compliance with FOIA requests.      In cases in which

7    considerably smaller amounts of records have been sought,

8    withholding based upon general characteristics of classes of

9    people or employees has been found compliant.     See, e.g.,

10   U.S. Dep’t of Def. v. Fed. Labor Relations Auth., 510 U.S.

11   487, 501 (1994) (sustaining withholding of names and contact

12   information for entire class of employees without individual

13   inquiry); Nat’l Ass’n of Retired Fed. Emps. v. Horner, 879

14   F.2d 873, 879 (D.C. Cir. 1989) (recognizing privacy interest

15   in list of names of retired and disabled federal employees

16   without individual inquiry).

17

18                                  B

19       The privacy interest must be weighed against the public

20   interest that would be advanced by disclosure.     See Fed.

21   Labor Rel. Auth. v. U.S. Dep’t of Veterans Affairs, 958 F.2d

22   at 510 (“[O]nce a more than de minimis privacy interest is


                                    15
1    implicated the competing interests at stake must be balanced

2    in order to decide whether disclosure is permitted under

3    FOIA.”).   The only public interest cognizable under FOIA is

4    the public “understanding of the operations or activities of

5    the government.”   U.S. Dep’t of Justice v. Reporters Comm.

6    for Freedom of Press, 489 U.S. 749, 775 (1989); Bibles v.

7    Or. Natural Desert Ass’n, 519 U.S. 355, 355-56 (1997)

8    (identifying relevant public interest as “extent to which

9    disclosure of the information sought would shed light on an

10   agency’s performance of its statutory duties or otherwise

11   let citizens know what their government is up to” (internal

12   quotation marks and alterations omitted)).

13       In many contexts, federal courts have observed that

14   disclosure of individual employee names tells nothing about

15   “what the government is up to.”    See Fed. Labor Relations

16   Auth. v. U.S. Dep’t of Veterans Affairs, 958 F.2d at 512;

17   Schwarz v. U.S. Dep’t of Treasury, 131 F. Supp. 2d 142, 150

18   (D.D.C. 2000) (“Disclosure of [names of federal

19   employees] . . . would not contribute to the public

20   understanding of government functions.”); Voinche v. FBI,

21   940 F. Supp. 323, 330 (D.D.C. 1996) (“There is no reason to

22   believe that the public will obtain a better understanding



                                   16
1    of the workings of various agencies by learning the

2    identifies of [federal employees].”).   Other cases allow for

3    a possible public interest in identifying specific federal

4    employees; but that the interest is slight, and in each case

5    was substantially outweighed by the threat to the employee’s

6    personal privacy.   See Wood, 432 F.3d at 88-89 (authorizing,

7    under Exemption 6, redaction of the names of low-level FBI

8    employees who participated in investigation because public

9    interest was insufficiently furthered relative to the

10   potential for harassment); Judicial Watch, 449 F.3d at

11   152-54 (permitting FDA to withhold pursuant to Exemption 6

12   names of employees and outsiders who worked on regulatory

13   approval of “abortion pill”); Fed. Labor Relations Auth. v.

14   U.S. Dep’t of Commerce, 962 F.2d 1055, 1060 (D.C. Cir. 1992)

15   (permitting agency to keep private under Exemption 6 list of

16   employees who received positive commendation).

17       Plaintiffs posit a strong public interest in knowing

18   employee names because “Government work is done by people.”

19   But if that were weighed in the balance of the Exemption 6

20   inquiry, little would be left to FOIA’s protection for

21   personal privacy.   See Fed. Labor Relations Auth. v. U.S.

22   Dep’t of Veterans Affairs, 958 F.2d at 512 (“Compelling



                                   17
1    disclosure of personal information, that has no relationship

2    to an agency’s activities, on so attenuated a basis would

3    inevitably result in the disclosure of virtually all

4    personal information, thereby effectively eviscerating the

5    protections of privacy provided by Exemption 6.”).    Whether

6    the public has an interest in the identity of federal

7    workers, and to what extent, depends on circumstances,

8    including whether the information sought sheds light on

9    government activity.    See Wood, 432 F.3d at 88; Perlman v.

10   U.S. Dep’t of Justice, 312 F.3d 100, 107 (2d Cir. 2002),

11   vacated, 541 U.S. 970 (2004), reinstated after remand, 380

12   F.3d 110 (2d Cir. 2004).

13          Plaintiffs point to ways in which they (or the media)

14   have used the names of federal employees obtained from the

15   CPDF to inform themselves about what their “government is up

16   to.”    Specifically, they cite (1) disparities in the rates

17   at which individual immigration judges grant and deny asylum

18   requests; (2) high turnover rates at particular agencies;

19   (3) agency employees who wrongfully benefit from agency

20   programs; and (4) access to employees in order to “uncover

21   agency malfeasance.”    (Appellants’ Br. 34-37.)

22



                                    18
1        Such inquiries may be interesting, but they do not

2    illustrate how the disclosure of names serves the purposes

3    of FOIA.   First, the disposition data for individual

4    immigration judges are available even though the judges’

5    names are withheld, because OPM has now replaced employee

6    names with unique identifiers.8    Second, an employee’s name

7    may be useful for investigating the behavior of individual

8    employees; but courts have been skeptical of recognizing a

9    public interest in this “derivative” use of information,

10   which is indirect and speculative.    See Associated Press v.

11   U.S. Dep’t of Def., 554 F.3d 274, 292 (2d Cir. 2009) (“We

12   emphasize that the focus, in assessing a claim under

13   Exemption 6, must be solely upon what the requested

14   information reveals, not upon what it might lead to.”

15   (internal quotation marks omitted)); see also Ray, 502 U.S.

16   at 180 (Scalia, J., concurring) (“[I]t is unavoidable that

17   the focus, in assessing a claim under Exemption 6, must be

18   solely upon what the requested information reveals, not upon

19   what it might lead to.”).   But see Painting & Drywall Work

          8
            The same is true for plaintiffs’ assertion that
     access to employee names permitted TRAC to “trace[] a large
     drop in the enforcement of wildlife laws to the retirement
     of one employee.” (Appellants’ Br. 35.) The drop could
     just as easily be attributed to the single individual by way
     of the unique employee identifier.
                                   19
1    Pres. Fund, Inc. v. Dep’t of Hous. and Urban Dev., 936 F.2d

2    1300, 1303 (D.C. Cir. 1991) (indicating that derivative use

3    of information is cognizable under FOIA, but in that case

4    clearly outweighed by privacy interests).

5        Also discounted is the interest in identifying a

6    federal employee by name in order to make contact or conduct

7    interviews.   See Forest Serv. Emps. for Envtl. Ethics v.

8    U.S. Forest Serv., 524 F.3d 1021, 1028 (9th Cir. 2008)

9    (identity of forest service employees could be withheld

10   where primary purpose of identifying employees was to

11   contact employees directly to obtain information).   Such a

12   use is an example of the “derivative theory” of public

13   interest, and actually facilitates the invasion of the

14   employee’s personal privacy.   See Painting Indus. of Haw.

15   Mkt. Recovery Fund v. U.S. Dep’t of Air Force, 26 F.3d 1479,

16   1485 (9th Cir. 1994) (“Any additional public benefit the

17   requesters might realize through [contact with employees] is

18   inextricably intertwined with the invasions of privacy that

19   those contacts will work.”).   The use of personnel files to

20   contact government employees in the hopes of uncovering

21   malfeasance does not serve FOIA’s objectives.

22



                                    20
1                                   C

2          Where public interest favoring disclosure is no more

3    than minimal, a lesser privacy interest suffices to outweigh

4    it.   See U.S. Dep’t of Def. v. Fed. Labor Relations Auth.,

5    510 U.S. at 500.   This reciprocal principle is illustrated

6    by a pair of cases in which unions wanted employee contact

7    information in order to tell them about union activities.

8    While the privacy interest was small, no countervailing

9    public interest at all was cognizable under Exemption 6.

10   See id. at 502 (holding that employees’ home addresses need

11   not be disclosed to unions because such disclosure did not

12   further FOIA’s purpose of open government); Fed. Labor

13   Relations Auth. v. U.S. Dep’t of Veterans Affairs, 958 F.2d

14   at 513 (same).

15         Plaintiffs have identified no appreciable public

16   interest militating in favor of the wholesale disclosure of

17   names of employees in the sensitive agencies and sensitive

18   occupations.   OPM therefore need not identify any compelling

19   privacy interest in order to “clearly outweigh[]” the

20   nonexistent public interest.   See U.S. Dep’t of Def. v. Fed.

21   Labor Relations Auth., 510 U.S. at 500 (“Because a very

22   slight privacy interest would suffice to outweigh the


                                    21
1    relevant public interest, we need not be exact in our

2    quantification of the privacy interest.    It is enough for

3    present purposes to observe that the employees’ interest in

4    nondisclosure is not insubstantial.”).    Accordingly, we hold

5    that Exemption 6 permits OPM to withhold the names of

6    employees working in the sensitive agencies and sensitive

7    occupations.

8

9                                  III

10          The remaining issue is whether Exemption 6 permits OPM

11   to withhold duty-station information even after employee

12   names have been redacted.    The district court’s first

13   opinion considered the duty-station information together

14   with employee names, and found that both were properly

15   withheld for the sensitive agencies and the four sensitive

16   occupations that it considered.     Long I, 2007 WL 2903924, at

17   *19.    When the district court turned to the remaining twenty

18   sensitive occupations in Long II, it considered duty-station

19   information apart from names and found that “OPM has failed

20   to show more than a de minimis privacy interest in the . . .

21   geographic location of federal employees,” Long II, 2010 WL




                                    22
1    681321, at *17.9   Although the issue is close, we conclude

2    that OPM has demonstrated that employees possess a

3    cognizable privacy interest in their duty-station records

4    de-linked from their names, and that it clearly outweighs

5    any public interest that might be served by disclosure.

6

7                                   A

8        Plaintiffs argue that federal employees have no privacy

9    interest in their duty-station information once their names

10   have been redacted.10   “[P]rivacy interests protected by the

11   exemptions to FOIA are broadly construed.”   Associated Press

12   v. U.S. Dep’t of Justice, 549 F.3d 62, 65 (2d Cir. 2008).

13   Exemption 6 extends to “personnel and medical files and

14   similar files the disclosure of which would constitute a

15   clearly unwarranted invasion of personal privacy.”   5 U.S.C.

          9
             This portion of the district court’s reasoning
     substantially undermines its earlier finding that OPM could
     redact duty-station information for the five sensitive
     agencies and four of the sensitive occupations. However, it
     did not expressly revisit its earlier order, and we will
     assume that it was left intact. In any event, our review is
     de novo. See Nat’l Council of La Raza, 411 F.3d at 355.
          10
            Plaintiffs also posit that employee duty-station
     information does not constitute “personnel and medical files
     and similar files” referenced in Exemption 6. 5 U.S.C. §
     552(b)(6). The redaction of names, however, does not change
     the nature of the files that plaintiffs seek--the CPDF is
     still a collection of personnel records.
                                   23
1    § 552(b)(6).   “[B]oth the common law and the literal

2    understandings of privacy encompass the individual’s control

3    of information concerning his or her person.”    Reporters

4    Comm., 489 U.S. at 763; Fed. Labor Relations Auth. v. U.S.

5    Dep’t of Veterans Affairs, 958 F.2d at 510 (“[T]he concept

6    of privacy is not an abstract concept, but rather a

7    valuable--and, in the present context, elastic--right whose

8    boundaries are delineated by the type of information sought

9    and by the persons requesting it.”).

10       The records sought by plaintiffs are “personal” in the

11   sense that they are specific to individuals.    Even if

12   employee names are replaced by anonymous identifiers, every

13   employee entry contains dozens of items of personal

14   information about the individual.   The current and career

15   information reveals job classification, pay, veteran status,

16   and work schedule.   This data is personal to the employee

17   because it is wholly “information concerning his or her

18   person.”   Reporters Comm., 489 U.S. at 763.    And it would be

19   child’s play for a determined researcher to deduce a name

20   from the descriptive data if the researcher is looking for

21   anyone specific.

22



                                   24
1        Some duty-station information redacted by OPM was at

2    one time freely available.   But it is now private

3    nevertheless in the sense that it is “intended for or

4    restricted to the use of a particular person or group or

5    class of persons: not freely available to the public.”     Id.,

6    489 U.S. at 763-64 (quoting Webster's Third New

7    International Dictionary 1804 (1976)).   OPM’s affidavits on

8    the subject, which we accord a presumption of good faith,

9    see Carney, 19 F.3d at 812, set forth in reasonable detail

10   that OPM (and DoD) now preserve the privacy of duty-station

11   information pursuant to comprehensive data security and

12   safety plans.

13       Plaintiffs contend that “because the withheld records

14   do not provide work addresses . . . the potential harasser

15   or attacker would not be able to locate the employee.”

16   (Appellants’ Br. 59-60.)    But knowledge that an employee

17   works for a particular agency or in a particular role, in a

18   particular locality, is often enough to pinpoint the street

19   address of the workplace.    Plaintiffs concede as much.   Id.

20   at 43.

21       Redaction of names goes a long way toward protecting

22   against surveillance and publicity those things that are



                                    25
1    generally treated as nobody else’s business.       See Grand

2    Cent. P’ship, 166 F.3d at 485-86.        But a primary reason for

3    the protection afforded by Exemption 6 is to protect

4    individuals’ physical safety.        See Judicial Watch, 449 F.3d

5    at 152-53.   That is the risk that the OPM attests will arise

6    from disclosure of the duty-station information.

7        OPM’s affidavits set forth how terrorists and others

8    could derive specific work addresses from the duty-station

9    information.   Plaintiffs contend that this risk of harm is

10   not personal because an individual cannot be identified from

11   disclosure of duty-station information, and therefore any

12   harm would be directed at the entire federal agency (or a

13   particular office location), not the individual employee.

14   Even if an individual cannot be identified from the duty-

15   station information, the risk of harm to that individual is

16   not abated by anonymity.   “If the disclosure assisted

17   wrongdoers in carrying out an attack, it would be Jane

18   Doe . . . , [a] real person[], who would be harmed.”

19   (Appellee’s Br. 80.)    Federal employees thus have a

20   cognizable personal privacy interest in safeguarding the

21   disclosure of their duty-station information when a risk of

22   such harm is present.



                                     26
1        Plaintiffs also label the risk of harm as speculative,

2    but the record satisfies us that the risk is no more

3    attenuated or contingent than risks of harassment or attack

4    that have been recognized in FOIA cases dealing with federal

5    law enforcement officers.   See, e.g., Wood, 432 F.3d at 88;

6    Halpern v. FBI, 181 F.3d 279, 297 (2d Cir. 1999).

7        Risk of physical attack distinguishes this case from

8    cases in which the redaction of names has been found

9    sufficient to secure other privacy interests.   See Ray, 502

10   U.S. at 175-176 (once names were redacted from interviews

11   with Haitians attempting to enter United States, they had

12   only a de minimis privacy interest in those records); ACLU,

13   543 F.3d 59, 85-86 (2d Cir. 2008), vacated on other grounds,

14   130 S. Ct. 777 (2009) (detainees whose abuse was depicted in

15   photographs had no more than de minimis privacy interest

16   because all identifying information had been redacted).

17       Here, as discussed above, redaction of employee names

18   does not allay the threat of harassment or attack of federal

19   employees.   We therefore hold that federal employees have a

20   more than de minimis privacy interest in safeguarding the

21   disclosure of their duty-station information when a risk of




                                   27
1    such harm is present.11

2

3                                  B

4        It remains to weigh the employees’ privacy interests

5    against the public’s interest in the duty-station

6    information.   The chief public interest identified by

7    plaintiffs is an interest in seeing where the federal

8    government deploys its personnel.   Although this information

9    might shed some dim, diffused light on “what the Government

10   is up to,” Reporters Comm., 489 U.S. at 780 (internal

11   quotation marks omitted), the number of federal employees

12   here and there is a rough data point that imparts virtually

13   nothing about the function of the federal government.


          11
            The parties disagree about whether the duty-station
     information should be treated as a whole, or as separate
     data fields in the CPDF: organizational component, post of
     duty, bargaining unit, core-based statistical area, combined
     statistical area, and locality pay area. Organizational
     component codes are 18-digit codes, a portion of which
     indicates the employees’ place within the hierarchy of the
     agency, and a portion of which might indicate where the
     employee is geographically located. Plaintiffs contend that
     organizational components are different because they
     primarily tell where an employee fits within an
     organization’s overall structure, and only sometimes contain
     geographic information as well. However, OPM has
     sufficiently shown that, because organizational codes are
     unique to each agency and frequently changing, there is no
     feasible way for it to segregate those that contain
     geographic information from those that do not, or to redact
     the portion of the code that contains the geographic
     information.
                                   28
1        OPM has identified other sources from which plaintiffs

2    could obtain much of the information they seek.    That

3    further reduces the public interest, such as it is.    See

4    U.S. Dep’t of Def. Dep’t of Military Affairs v. Fed. Labor

5    Relations Auth., 964 F.2d 26, 29-30 (D.C. Cir. 1992)

6    (recognizing that “alternative sources of information

7    available that could serve the public interest in

8    disclosure” diminish public interest value of disclosure).

9    For example, plaintiffs present a hypothetical comparison of

10   staffing levels in the Federal Emergency Management Agency

11   before and after Hurricane Katrina; but OPM points out that

12   multiple, comprehensive reports exist on the subject.12

13       Finally, the duty-station information is on a

14   comprehensive computerized database that is vulnerable to

15   analysis and manipulation by persons seeking to identify

16   targets for violence, or to increase casualties.    Heightened

17   vigilance is appropriate in cases involving computerized

18   databases.   See Reporters Comm., 489 U.S. at 766-67 (citing


          12
            OPM cites two reports, one prepared by The White
     House, and one prepared by FEMA itself. See The Federal
     Response to Hurricane Katrina: Lessons Learned (2006),
     available at http://georgewbush-
     whitehouse.archives.gov/reports/katrina-lessons-learned; A
     Performance Review of FEMA’s Disaster Management Activities
     in Response to Hurricane Katrina, OIG-06-32 (2006),
     available at
     http://www.dhs.gov/xoig/assets/mgmtrpts/OIG_06-32_Mar06.pdf.
                                   29
1    the Privacy Act of 1974 for the proposition that “Congress’

2    basic policy concern regarding the implications of

3    computerized data banks for personal privacy is certainly

4    relevant”).

5        The threat cited by OPM is not specific as to location

6    or individual.   But plaintiffs seek records of millions of

7    employees who work in dozens of agencies and hundreds of

8    occupations.   It is not feasible to gauge the threat to each

9    individual employee, office, or facility included in the

10   CPDF.   Since the defendant agency has already demonstrated

11   that employees will be put at risk by disclosure, this

12   uncertainty has weight in the balance struck by Exemption 6.

13       Accordingly, we hold that OPM has demonstrated that

14   employee privacy concern about the release of their duty-

15   station information clearly outweighs the public interests

16   identified by plaintiffs.

17

18                               CONCLUSION

19       For the foregoing reasons, we AFFIRM the judgment of

20   the district court insofar as it ruled that FOIA Exemption 6

21   permitted OPM to withhold all of the names at issue and some

22   of the duty-station information, but REVERSE insofar as it

23   ruled that duty-station information for twenty sensitive

24   occupations must be disclosed.

                                     30
