A little more than a year after we filed suit on behalf of Edward Hasbrouck against the Customs and Border Protection (CBP) division of DHS to find out what records they are keeping about our international travels, and what they have done with those records, we had our first real day in court yesterday in front of Federal Judge Richard Seeborg in San Francisco.

Judge Seeborg was appointed as a judge of the U.S. District Court by President Obama, after a decade as a Federal magistrate and seven years before that as a Federal prosecutor. On first impression, he seems fair-minded and thoughtful, although — like most judges — inclined to give more “deference” than is warranted to even implausible claims by police and prosecutors, such as some of those made in the declarations submitted by the CBP in opposition to Mr. Hasbrouck’s complaint.

Mr. Hasbrouck was represented by David Greene of Holme Roberts & Owen (formerly executive director and staff counsel of the First Amendment Project), who conducted yesterday’s argument, along with FAP staff attorney Lowell Chow. Former FAP staff attorney Geoffrey King also worked on earlier stages of the case, as did several FAP law school student interns, who we were pleased were able to attend the argument. We are grateful to them all for their contributions.

CBP was represented by Assistant U.S. Attorney Neill Tseng, who conducted the argument, accompanied by an attorney from the CBP.

As we expected, and as is usual, no decision by the court was announced at yesterday’s hearing. In each of the other cases on Judge Seeborg’s motion calendar yesterday, he began by describing how he was “inclined” to rule on the matters before him. In our case, however, Judge Seeborg began — after some comments about how ill-suited the typical summary judgment motion practice is to FOIA or Privacy Act cases like this, where the issues only gradually become clear in the course of the briefing — by saying that after reading the lengthy pleadings he had only the most tentative “impression” as to how he might rule on any of the issues.

In other words, he still had an open mind, and oral argument might actually matter.

With that preface, Judge Seeborg invited Mr. Hasbrouck’s attorney, David Greene, to address whatever issues he thought were most important, and then gave AUSA Neill Tseng an opportunity to respond for the CBP.

If you’re just tuning in, the best places to start are the Identity Project FAQ (for the political issues and significance of the case) and our last reply brief before yesterday’s argument (for the legal issues).

Broadly speaking, the argument focused on what we would group into four main questions:

(1) Does the CBP (or any Federal agency) have the authority to issue _retroactive_ regulations exempting itself from complying with previously-made Privacy Act requests for access to records and for an accounting of disclosures of those records to other agencies or third parties?

We don’t think Congress should have given Federal agencies the authority to exempt themselves from the access and accounting requirements of the Privacy Act. But we’re not challenging that general authority in this case (although we or someone else could do so in a future case). The issue now before Judge Seeborg is that the first of Mr. Hasbrouck’s requests was made before the CBP had even announced that they were considering the possibility of such an exemption, and all of his requests were made months or years before the exemption rules were issued.

David Greene argued that Mr. Hasbrouck’s requests should have been processed, and information should have been disclosed to him, according to the rules in effect at the time the requests were made. Instead, the CBP has admitted that after identifying some of the records responsive to his requests, they sat on the records for 17 months until after they had finalized the regulations exempting themselves from having to release them to him.

AUSA Neill Tseng argued for the CBP that applying the exemption rules to requests that had been made months or years earlier has no “retroactive” effect, since (a) Mr. Hasbrouck hadn’t actually filed this lawsuit yet (only unanswered administrative requests and unanswered administrative appeals) when the exemption rules were promulgated, and (b) there are no negative consequences to not being able to know what’s in CBP files about yourself or with whom they have been shared. This ignores, of course, the fact that these records are being used by CBP and other foreign governments to make decisions with consequences such as whether or not to allow you to board airline flights, or how intrusively to search or interrogate you when you travel.

David Greene also pointed out that the precedents cited by CBP for retroactive application of rules related to rules contained in new laws enacted by Congress, not to new regulations issued by Federal agencies, and to amendments to FOIA rather than to the Privacy Act. In general, Federal agencies have no authority to issue retroactive regulations unless Congress has granted them express statutory authority to do so in a particular area, which they haven’t done with respect to the Privacy Act.

There are some parallels between the Freedom of Information Act (FOIA) and the Privacy Act, and most lawyers and Federal judges are (as Judge Seeborg volunteered) more familiar with FOIA litigation and case law. Nevertheless, these are different laws which protect different rights. Moreover, the consequences of withdrawing Privacy Act rights are very different from those of withdrawing FOIA rights.

FOIA exists to protect the public right of access to impersonal public records about the activities of government. The Privacy Act protects the individual right of access to personally identifiable, non-public government records about oneself. Retroactive denial of that private, personal right — on which Mr. Hasbrouck had relied, in the expectation of eventually being able to see what was in CBP’s records about himself, know to whom they had been disclosed, and have them expunged or corrected if they were irrelevant or inaccurate — is a very different sort of damage than keeping impersonal public records secret even if they have already been requested.

Judge Seeborg gave absolutely no indication whatsoever of his thinking or likely ruling on this issue of retroactive application of Privacy Act exemption regulations. If he rules that the exemptions cannot be applied to Mr. Hasbrouck’s requests, there is likely to be both some further eventual disclosure of records, and further argument about the search for responsive records, which records should be released, and whether CBP has complied with its record-keeping obligations (particularly its obligation to maintain an “accounting of disclosures”).

It’s critical to realize, however, that this argument about retroactive application of the exemptions is relevant only to Mr. Hasbrouck’s requests (or to any other requests that were made before the exemption regulations were finalized).

Even if we are successful on this point and in the lawsuit as a whole, Mr. Hasbrouck (and perhaps a handful of others who made request before the new rules were issued) will be the only people who will ever be entitled to obtain any of their travel records from DHS under the Privacy Act, or to obtain any accounting of the other agencies, foreign governments, or private companies in the USA or abroad to which they have been disclosed.

Now that the exemption regulations are in effect, nobody — even a U.S. citizen — who makes a new request for their PNR data or other travel records from CBP or DHS has any right under the Privacy Act and the current regulations to receive any information at all from the government’s files about them.

Debate in the European Union in particular needs to be based on a clear understanding that when the U.S. says that foreign citizens will be “administratively” granted the same rights U.S. citizens have under the Privacy Act (except the right to sue to enforce those rights), that means that foreigners will, like U.S. citizens, have no Privacy Act rights at all to find out what records CBP and DHS keep about their travels, or how these travel records are used.

It important to recognize that the whole issue of Privacy Act exemptions, much less of their retroactive application, would never have arisen if CBP had done what is has claimed to have done, and provided everyone who requested it with a copy of CBP’s dossier about them.

Quite to the contrary, CBP admitted in court yesterday, and in its written briefs in this case, that it identified specific records about Mr. Hasbrouck that would be responsive to his Privacy Act requests, but withheld them as exempt from disclosure.

Any further claims to the EU by CBP, DHS, or other U.S. representatives that everyone who has requested their travel records has received them must be rejected as knowingly false, deliberately intended to mislead the EU and the European public about U.S. compliance with its (non-binding) “agreements” with the EU, and directly contradicted by the sworn statements made to the court in this case by CBP officials and attorneys.

(2) What personal identifiers are used to retrieve PNR data and other CBP travel records?

The Privacy Act of 1974 defines a “system of records” as “a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.”

The Privacy Act requires that each Federal government agency that maintains such a system of records shall, “publish in the Federal Register … a notice of the existence and character of the system of records, which notice shall include — … the policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records.”

There’s a good reason for this requirement. Without knowing which categories of data are used to retrieve records, it’s impossible to know which information about oneself to include in a request for records about oneself. Compliance with the requirement for public disclosure of retrieval practices, at least as to the personal identifiers used to retrieve records, is an essential prerequisite to the ability to exercise a meaningful personal right of access to those records.

Unfortunately, most of the CBP “System of Records Notices”, including those for the “Automated Targeting System” (ATS) and other systems of travel records, have said only that information is retrieved by “personal identifiers”, without specifying what those identifiers are.

So part of Mr. Hasbrouck’s FOIA request to CBP was for any records of what personal identifiers are used to retrieve PNR, ATS, and other travel records.

Since that information is specifically required by the Privacy Act to be published in the Federal Register, it shouldn’t be treated as exempt from disclosure if requested under FOIA.

At yesterday’s hearing, AUSA Tseng argued that — notwithstanding the requirement of the Privacy Act for publication of this information in the Federal Register, which he didn’t mention — this information should be exempt from disclosure even when specifically requested under FOIA.

“Whether we can retrieve records based on credit card number,” AUSA Tseng gave as an example, “is sensitive law enforcement information” exempt from disclosure under FOIA. Rather than arguing about the extent of what information about search and retrieval practices is required by the Privacy Act to be made public, CBP is now arguing that none of the specific identifiers need to be disclosed. “There are good reasons not to state every identifier by which records can be searched for or retrieved.”

It has been considered to be settled law that information specifically required to be disclosed pursuant to some other law (which would seem to include the Privacy Act) cannot be withheld from disclosure in response to a FOIA request, even if it might otherwise be exempt from FOIA. But to date, no court has yet addressed the question of what is required to be included in the Privacy Act notice of “the policies and practices of the agency regarding … retrievability … of the records.” So it’s hard to say how Judge Seeborg will rule on this point.

(3) Are there any access logs or other records of the searches for, and/or retrieval of, CBP travel records?

As was noted in our reply brief, CBP and DHS have claimed repeatedly — including in their Privacy Impact Assessments and in reports to and “agreements” with the European Union — that all access to PNR and ATS data is logged for audit purposes.

If they exist, those logs should include records of the searches CBP carried out to identify and retrieve records about Mr. Hasbrouck, in response to his Privacy Act and FOIA requests, as were described in declarations submitted by CBP staff in opposition to our lawsuit.

So Mr. Hasbrouck reasonably expected that, when he requested all records created in the course of processing his initial request, the response would include these search and access logs.

CBP admits that they didn’t even search for these logs. During yesterday’s hearing, AUSA Tseng said that, “I’m not even sure that ‘logs’ is the correct term for these records”, despite the repeated descriptions of them as “logs” in previous official DHS statements.

Apparently referring to a description provided by CBP (but not in their briefs), Tseng said that these “audit” records include each query that is made to the databases, the employee ID of the person making the query, and the date and time of the query.

But Tseng claimed that these audit records can only be searched by employee ID, date, and/or time, and not by anything that identifies the person about whom records were searched for or retrieved.

So it would be impossible, Tseng claimed, to find out from these logs who had searched for or retrieved which records about Mr. Hasbrouck, when, or using what query.

That seems unlikely, since it would render the “logs” useless for the purpose for which they are supposedly intended: Auditing whether personal information has been improperly viewed, used, or disclosed.

If an auditor wants to know, for example, whether any system user has improperly retrieved records about President Obama (as was done with his passport records), they wouldn’t start with the name or ID of the person who had improperly looked at the President’s file, or the date and time when they had done so. None of that would yet be known. They would start, obviously, by looking for all audit records for queries that including the search string “Obama”, or some other unique identifier(s) of the President.

Perhaps realizing that his claims about the logs appeared dubious, Tseng said that CBP would be able, if Judge Seeborg so desires, to provide additional declarations clarifying the functions and capabilities of the audit log system. We hope that Judge Seeborg will take him up on that offer.

In the meantime, anyone reading or hearing CBP and DHS claims about the auditing of access to these records should be aware of CBP’s claims in this case about how limited the logs are. In particular, CBP specifically claimed yesterday that it is impossible to generate from these “logs” any list of who searched for or retrieved records about a particular person, when, or using what queries. If what CBP says is true, they don’t know, and have no way to find out, who has looked at Mr. Hasbrouck’s (or anyone else’s) file. Any of tens of thousands of DHS employees with access to the system could have looked up their dossier about you, and there’s no way for CBP auditors or for you to find out if that has happened.

(4) Did CBP conduct an adequate search for its records responsive to Mr. Hasbrouck’s requests?

The adequacy of an agency’s search for records responsive to a Privacy Act of FOIA request is a judgment call that depends largely on the judge’s degree of trust in the agency’s competence and good faith. In general, Judge Seeborg’s “impression” seemed to be that in most respects he was willing to accept what CBP claimed to have done as being “adequate”, despite the long list in our reply brief and my supporting declaration of specific records that we have reason to believe exists, or that CBP has said exist, but that CBP didn’t even look for in response to Mr. Hasbrouck’s requests.

It’s not clear, with respect to some of these items, whether CBP didn’t look for them because they thought they didn’t or might not exist or because it would be too hard to find them if they did exist, looked for them in some unspecified or ineffective way but didn’t find them, did find them or knew they existed but thought they weren’t “responsive” to the requests, or knew they existed and were responsive but didn’t produce them because they thought they were exempt.

There was some argument about why we believe some of this information exists, whether it would be responsive to our requests, and whether and how it would be reasonable to search for it.

On many of these points we fear that Judge Seeborg may be inclined to defer to CBP’s judgment. The only category of these records that seemed to concern him were those that CBP essentially admits they know exist, such as specific e-mail messages within CBP about my request that were mentioned in CBP declarations but not listed on their “Vaughn index” of responsive records that they have withheld.

AUSA Tseng repeated the claim in one of the CBP declarations that CBP believed that this e-mail either wasn’t responsive or was exempt. “But in that case, aren’t you required to list it” on the Vaughn index and state the basis for your claim that it’s exempt?, Judge Seeborg asked.

Tseng was quick to offer to file a supplemental Vaughn index listing at least some of these items, and we expect that Judge Seeborg will order CBP to do so.

Unless Judge Seeborg rules against us on all of these issues, and grants CBP’s motions for summary judgment against Mr. Hasbrouck in their entirety, his initial ruling won’t be the end of the case.

Stay tuned.