FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

THERESA CAMERANESI; JUDITH No. 14-16432

LITEKY,

Plaintiffs-Appellees, D.C. No. 4:12-cv-00595-PJH v.

UNITED STATES DEPARTMENT OF ORDER AND

DEFENSE; U.S. ARMY TRAINING OPINION

AND DOCTRINE COMMAND,

Defendants-Appellants.

Appeal from the United States District Court for the Northern District of California Phyllis J. Hamilton, Chief Judge, Presiding

Argued and Submitted May 13, 2016 San Francisco, California

Filed May 8, 2017

Before: Andrew J. Kleinfeld, Sandra S. Ikuta, and Paul J. Watford, Circuit Judges.

Order; Opinion by Judge Ikuta; Dissent by Judge Watford 2 CAMERANESI V. U.S. DEP’T OF DEFENSE

SUMMARY*

Freedom of Information Act

The panel withdrew the opinion and dissent filed on September 30, 2016; filed a superseding opinion and dissent; and reversed the district court’s summary judgment in favor of plaintiffs, who brought an action under the Freedom of Information Act (“FOIA”) against the United States Department of Defense seeking the names of foreign students and instructors at the Western Hemisphere Institute for Security Cooperation.

The panel held that disclosure of the names of the foreign students and instructors would constitute a clearly unwarranted invasion of personal privacy, and was exempt from disclosure under Exemption 6 of FOIA, which provides that FOIA “does not apply to . . . personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6).

Applying the two-step test to determine whether disclosing the names would constitute an unwarranted invasion of personal privacy under Exemption 6, the panel first concluded that the affidavits and other evidence submitted by the Department of Defense was sufficient to carry the Department’s burden to establish that the disclosure of the requested information gave rise to a nontrivial risk of harassment and mistreatment. Second, the panel balanced the

* This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.

CAMERANESI V. U.S. DEP’T OF DEFENSE 3

privacy interests against the public interests, and concluded that the small incremental value stemming from disclosure of the identities did not outweigh the serious risks that would result from disclosure.

Dissenting, Judge Watford would affirm the district court’s summary judgment, because in his view the Department of Defense did not carry its burden of demonstrating that the students’ and instructors’ interests outweighed the strong public interest in disclosure of their names.

COUNSEL

Steve Frank (argued) and Leonard Schaitman, Appellate Staff; Melinda Haag, United States Attorney; Civil Division, United States Department of Justice, Washington, D.C.; for Defendants-Appellants.

Duffy Carolan (argued), Jassy Vick Carolan LLP, San Francisco, California; Kent Spriggs, Spriggs Law Firm, Tallahassee, Florida; for Plaintiffs-Appellees.

Bruce D. Brown, Katie Townsend, Adam A. Marshall, and D. Victoria Baranetsky, Washington, D.C., as and for Amicus Curiae The Reporters Committee for Freedom of the Press. 4 CAMERANESI V. U.S. DEP’T OF DEFENSE

ORDER

The opinion and dissent filed on September 30, 2016, and appearing at 839 F.3d 751, are withdrawn. The superseding opinion and dissent will be filed concurrently with this order.

Appellees’ petition for rehearing en banc, filed November 14, 2016, is DENIED. Judge Ikuta voted to deny the petition for rehearing en banc and Judge Kleinfeld so recommended. Judge Watford voted to grant the petition for rehearing en banc. The petition for rehearing en banc was circulated to the judges of the court, and no judge requested a vote for en banc consideration. No further petitions for rehearing or rehearing en banc will be entertained.

OPINION

IKUTA, Circuit Judge:

This case requires us to determine whether the names of foreign students and instructors at the Western Hemisphere Institute for Security Cooperation (WHINSEC) are exempt from disclosure under Exemption 6 of the Freedom of Information Act (FOIA). 5 U.S.C. § 552(b)(6). Because we conclude that the disclosure of these names “would constitute a clearly unwarranted invasion of personal privacy,” id., we reverse the district court’s grant of summary judgment to the plaintiffs.

CAMERANESI V. U.S. DEP’T OF DEFENSE 5

I

We begin with the factual background regarding the development of WHINSEC, the Department of Defense’s adjustments to its disclosure policy in light of the terrorist attacks of 2001, and the plaintiffs’ lawsuit.

A

The United States Army School of the Americas (SOA) opened in 1946 “for the purpose of providing military education and training to military personnel of Central and South American countries and Caribbean countries.” 10 U.S.C. § 4415(b) (1987). In 1989, during the Salvadoran Civil War, Salvadoran soldiers gunned down six Jesuit priests as well as their housekeeper and her 16-year-old daughter. It was later reported that 19 of the 26 soldiers implicated in these deaths had attended SOA. These murders sparked protests against SOA and prompted the formation of School of the Americas Watch (SOAW), a human rights and advocacy group dedicated to monitoring SOA graduates and lobbying for closure of the school.1

As part of these monitoring efforts, SOAW submitted a FOIA request to the Department of Defense (DOD) seeking the names of all former and current SOA students and instructors. The DOD granted the request in 1994, and

1 The dissent provides a much lengthier and more detailed discussion of SOA’s history, relying primarily on newspaper articles and other extra- record material. Dissent at 38–40. While this further illuminates the reasons for Congress’s decision to address these issues through legislative enactments, the dissent’s historical research is otherwise not relevant to the legal question before us: whether the public’s interest in disclosure outweighs the privacy interest of WHINSEC students and instructors. 6 CAMERANESI V. U.S. DEP’T OF DEFENSE

disclosed the names of all SOA students and instructors dating back to the school’s formation in 1946. SOAW used the names to create a database containing the names, countries, and courses taken or taught by each attendee.

In 1997, Congress sought to improve the human rights record of SOA by adopting the Leahy Amendments to the Foreign Operations Appropriations Act. See Foreign Operations, Export Financing, and Related Programs Appropriation Act, 1998, Pub. L. No. 105-118, § 570, 111 Stat. 2386, 2429 (1997).2 The Leahy Amendments precluded the DOD from providing congressionally appropriated funds

2 Specifically, the Leahy Amendments stated:

None of the funds made available by this Act may be provided to any unit of the security forces of a foreign country if the Secretary of State has credible evidence that such unit has committed gross violations of human rights, unless the Secretary determines and reports to the Committees on Appropriations that the government of such country is taking effective measures to bring the responsible members of the security forces unit to justice: Provided, That nothing in this section shall be construed to withhold funds made available by this Act from any unit of the security forces of a foreign country not credibly alleged to be involved in gross violations of human rights: Provided further, That in the event that funds are withheld from any unit pursuant to this section, the Secretary of State shall promptly inform the foreign government of the basis for such action and shall, to the maximum extent practicable, assist the foreign government in taking effective measures to bring the responsible members of the security forces to justice.

§ 570, 111 Stat. at 2429.

CAMERANESI V. U.S. DEP’T OF DEFENSE 7

to any unit of a foreign country’s security forces if there was credible evidence that the unit “has committed gross violations of human rights,” unless the Secretary of State reported to Congress that the foreign government was “taking effective measures to bring the responsible members of the security forces unit to justice.” Id.

Congress reenacted the Leahy Amendments in subsequent appropriations bills3 until 2008, when the amendments were codified as part of the DOD appropriations rules, 10 U.S.C. § 2249e, and the Foreign Assistance Act, 22 U.S.C. § 2151 et seq. The provisions pertaining to the DOD, 10 U.S.C. § 2249e, state that no funds “made available to the Department of Defense . . . may be used for any training, equipment, or other assistance for a unit of a foreign security force if the Secretary of Defense has credible information that the unit has committed a gross violation of human rights.” Id. § 2249e(a)(1). The law further requires the Secretary of Defense to consult with the Secretary of State to “ensure that prior to a decision to provide any training, equipment, or other assistance to a unit of a foreign security force full consideration is given to any credible information available to the Department of State relating to human rights violations by such unit.” Id. § 2249e(a)(2). The statute does not require

3 See Appropriations 2000 — Department of Defense, Pub. L. 106-79, § 8098, 113 Stat. 1212, 1259 (1999); Foreign Operations, Export Financing, and Related Programs Appropriations Act, 2002, Pub. L. No. 107-115, § 556, 115 Stat. 2118, 2160 (2002); Department of Defense Appropriations Act, 2004, Pub. L. 108-87, § 8077, 117 Stat. 1054, 1090 (2003); Department of Defense, Emergency Supplemental Appropriations to Address Hurricanes in the Gulf of Mexico, and Pandemic Influenza Act, 2006, Pub. L. 109-148, § 8069, 119 Stat. 2680, 2714 (2005); Department of Defense Appropriations, Pub. L. No. 110-116, § 8062, 121 Stat. 1295, 1328 (2007). 8 CAMERANESI V. U.S. DEP’T OF DEFENSE

the DOD to continue to monitor the performance of such units or the careers of individual members of those units after they leave WHINSEC. The provisions pertaining to the Secretary of State impose a similar ban on providing assistance to a unit believed to have committed human rights violations. 22 U.S.C. § 2378d.4 As later amended in 2011, the statute also directs the Secretary of State to “establish, and periodically update, procedures to . . . ensure that when an individual is designated to receive United States training, equipment, or other types of assistance the individual’s unit is vetted as well as the individual.” Id. § 2378d(d)(5).5 If the Secretary determines that a particular unit is ineligible for assistance, the Secretary is required to “make publicly available, to the maximum extent practicable, the identity of those units for which no assistance shall be furnished.” Id. § 2378d(d)(7). As with the statute regulating the DOD, there is no requirement for the Secretary of State to continue monitoring students for human rights abuses after they graduate from WHINSEC. In short, the statutes require the Secretary of State to take the lead in vetting foreign units receiving United States assistance, and the Secretary of

4 22 U.S.C. § 2378d(a) states: “No assistance shall be furnished under this chapter or the Arms Export Control Act to any unit of the security forces of a foreign country if the Secretary of State has credible information that such unit has committed a gross violation of human rights.” 5 The requirement that the Secretary of State “establish, and periodically update, procedures to . . . ensure that . . . the individual’s unit is vetted as well as the individual” was added to the statute on December 23, 2011, see Consolidated Appropriations Act, 2012, Pub. L. 112-74, § 2378d, 125 Stat. 786, 1216 (2011), after the March 1, 2011 FOIA request in this case. The parties do not argue that this affects our analysis of the plaintiffs’ FOIA request for information about individual students and instructors at WHINSEC, and therefore we do not address this issue.

CAMERANESI V. U.S. DEP’T OF DEFENSE 9

Defense to consider information from the State Department before providing training or assistance to foreign military units, but not to continue such vetting after the assistance has concluded.

B

In conjunction with implementing these laws, Congress replaced SOA with a new training facility called the Western Hemisphere Institute for Security Cooperation (WHINSEC). See Floyd D. Spence National Defense Authorization Act for Fiscal Year 2001, Pub. L. No. 106-398, § 911, 114 Stat. 1654A-226 (2000) (codified at 10 U.S.C. § 2166). WHINSEC, which opened its doors on January 17, 2001, provides “professional education and training to eligible personnel of nations of the Western Hemisphere.” 10 U.S.C. § 2166(b). Section 2166 states that one of the purposes of WHINSEC is “promoting . . . respect for human rights.” Id. To accomplish this goal, Congress required that the WHINSEC curriculum “include mandatory instruction for each student, for at least 8 hours, on human rights, the rule of law, due process, civilian control of the military, and the role of the military in a democratic society.” Id. § 2166(d)(1).

To ensure that WHINSEC complies with its statutory obligations, Congress established an independent WHINSEC Board of Visitors charged with “inquir[ing] into the curriculum, instruction, physical equipment, fiscal affairs, and academic methods of [WHINSEC].” Id. § 2166(e)(4)(A). Under this statute, the Board of Visitors must hold an annual public meeting and “submit to the Secretary of Defense a written report of its activities and of its views and recommendations pertaining to the Institute.” Id. §§ 2166(e)(3), (5). Pursuant to these obligations, the Board 10 CAMERANESI V. U.S. DEP’T OF DEFENSE

of Visitors maintains an updated database containing details on its annual meetings from 2002 to the present.6 The minutes reflect that the Board closely oversaw the development of WHINSEC’s human rights curriculum, see Board of Visitors WHINSEC, Minutes of Annual Meeting (Jun. 3–4, 2002),7 and ultimately concluded that WHINSEC “is a success story, in terms of its diligent pursuit of its mission of teaching professional military values, including human rights and democracy,” Board of Visitors WHINSEC, Minutes of Annual Meeting (Dec. 1–2, 2004).8 In executing its ongoing duty to monitor WHINSEC’s fulfillment of its human rights mission,9 the Board has formed a curriculum subcommittee which has “observed classes, reviewed selected lesson plans and reference material, and visited training facilities,” as well as interviewed students and faculty. Memorandum from Matthew D. Anderson & Robert C. Morlino, WHINSEC BoV, on Curriculum Review of WHINSEC (July 13, 2007) (Annex 3 in Sec’y of Def., Annual Report to Cong. on the Activities of the Western Hemisphere Institute for Security Cooperation 19 (2007)). In

6 The minutes for each Board of Visitors meeting may be found online under the link for the relevant year. See Committee History 2002–2015, Board of Visitors WHINSEC, online at . 7 Online at . 8 Online at . 9 See, e.g., Board of Visitors WHINSEC, Annual Organizational Meeting 2015 (Nov. 21, 2014), online at .

CAMERANESI V. U.S. DEP’T OF DEFENSE 11

2007, the Board’s curriculum subcommittee concluded that WHINSEC had made “enormous strides in inserting human rights and democracy education into the curriculum, and is reported to have exceeded minimum required hours of instruction.” Memorandum from the Curriculum Review Sub-Committee, WHINSEC BoV, on Review of WHINSEC Curriculum (May 30, 2007) (Annex 3 in Sec’y of Def., Annual Report to Cong. on the Activities of the Western Hemisphere Institute for Security Cooperation 25 (2007)).10 Based on this report, the Board of Visitors concluded that WHINSEC “was meeting and in some cases exceeding its congressional mandate in the area of promoting human rights and democratic values.” Memorandum from Matthew D. Anderson & Robert C. Morlino, WHINSEC BoV, on Curriculum Review of WHINSEC (July 13, 2007) (Annex 3 in Sec’y of Def., Annual Report to Cong. on the Activities of the Western Hemisphere Institute for Security Cooperation 19 (2007)).

While the State Department, rather than WHINSEC, is responsible for vetting the individuals designated to attend the school, the Board has reviewed the vetting process in response to public comments. Letter from Ambassador Jose S. Sorzano, Immediate Past Board Chairman, WHINSEC

10 According to the Annual Report to Congress, WHINSEC’s human rights curriculum “consisted of nine integrated parts: Democracy and Human Rights Class, Democracy and Human Rights Week, the Intermediate Level Education (ILE) Electives, Human Rights Instructor Course, Engagement Skills Training Facility, Human Rights Subject Matter Expert Exchanges, Human Rights NGO Roundtables, and the Field Studies Program.” Sec’y of Def., Annual Report to Cong. on the Activities of the Western Hemisphere Institute for Security Cooperation 3 (2007). The report included a detailed description of this curriculum. Id. at 4–6. 12 CAMERANESI V. U.S. DEP’T OF DEFENSE

BoV & Bishop Robert C. Morlino, Board Chairman, WHINSEC BoV, to School of Americas Watch 1–2 (Feb. 15, 2007) (Annex F in Sec’y of Def., Annual Report to Cong. on the Activities of the Western Hemisphere Institute for Security Cooperation (2006)). On one occasion, in response to charges by SOAW that “several alleged human rights violators had participated in WHINSEC programs,” the Board requested an investigation into the vetting process and reported that “effort and care” went into making the vetting process “rigorous, labor intensive, layered, and multi- agency.” Id. at 1–2.11 As part of its oversight effort, despite having neither funds nor legal authority “to follow the subsequent military careers of former [WHINSEC] students on an organized basis,” the Board of Visitors nevertheless employed analysts to conduct external evaluations, used a survey tool developed by the United States Southern Command, and made efforts through contacts in foreign countries to obtain ongoing information regarding former WHINSEC students. Board of Visitors WHINSEC, Minutes of Annual Meeting 4 (Dec. 1–2, 2004).

Each report by the Board of Visitors is ultimately sent to the Secretary of Defense, who is then required to submit a detailed annual report to Congress. 10 U.S.C. § 2166(i). In its 2007 report, the Secretary noted that the “WHINSEC Democracy and Human Rights Program is a very successful and innovative program” that “is woven into every aspect of the curriculum.” Sec’y of Def., Annual Report to Cong. on the Activities of the Western Hemisphere Institute for Security Cooperation 3 (2007). With respect to the student

11 The Board also noted that according to the State Department, there was “no evidence to verify the very serious charges” that were made against these individuals. Id.

CAMERANESI V. U.S. DEP’T OF DEFENSE 13

selection process, the Secretary stated that after the participating foreign countries nominate individuals to attend WHINSEC, the American Embassy in each country conducts a background check, which is “followed up by thorough vetting at the Department of State, in accordance with the Leahy Amendment.” Id. at 7. The nominees “are scrutinized for records of human rights abuses, corruption, or criminal activities that would render them ineligible or inappropriate for U.S. training programs.” Id.

C

The terrorist attacks of September 11, 2001, which occurred just nine months after WHINSEC began operations, heightened the DOD’s concerns regarding protecting its personnel. On November 9, 2001, the DOD issued a memorandum instructing all DOD components to “ordinarily withhold lists of names and other personally identifying information of personnel . . . in response to requests under the FOIA.” The memorandum also reemphasized the DOD’s longstanding policy of refusing to disclose identifying information of American service members. 5 U.S.C. § 552(b)(3). In 2006, the DOD promulgated regulations to formalize this policy, mandating that “Army components shall ordinarily withhold lists of names (including active duty military, civilian employees, contractors, members of the National Guard and Reserves, and military dependents) and other personally identifying information” in response to FOIA requests. 32 C.F.R. § 518.13(f)(2).

The DOD’s November 9, 2001 memorandum regarding American military personnel did not immediately impact WHINSEC’s privacy policies. The DOD continued disclosing the names of WHINSEC students and instructors 14 CAMERANESI V. U.S. DEP’T OF DEFENSE

through 2004, and SOAW incorporated each new set of names into its database. SOAW’s database included some 60,000 names, which it used to identify individuals who have allegedly engaged in human rights abuses.

In 2005, however, the Army’s General Counsel determined that international personnel should be accorded the same right to privacy as U.S. personnel. Following this decision, the DOD ceased its annual public disclosure of WHINSEC students and instructors and began to redact the names of WHINSEC students from all publicly released documents. The DOD continued to comply with the Leahy Amendment requirements to disclose the names of WHINSEC students and instructors to Congress in a classified format. In 2010, Congress amended the National Defense Authorization Act to require the Secretary of Defense to “release to the public, upon request . . . the entire name . . . [of] each student and instructor at the Western Hemisphere Institute for Security Cooperation,” but the statute allowed the Secretary to “waive the [disclosure] requirement . . . if the Secretary determines it to be in the national interest.” National Defense Authorization Act for Fiscal Year 2010, Pub. L. No. 111-84, § 1083, 123 Stat. 2190, 2482 (2009). The Secretary exercised his authority to waive disclosure in both 2009 and 2010. This disclosure requirement was not included in subsequent appropriations bills.12

12 See National Defense Authorization Act for Fiscal Year 2012, Pub. L. 112-81, 125 Stat. 1298 (2011); National Defense Authorization Act for Fiscal Year 2013, Pub. L. 112-239, 126 Stat. 1632 (2013); National Defense Authorization Act for Fiscal Year 2014, Pub. L. 113-66, 127 Stat. 672 (2013); Carl Levin and Howard P. “Buck” McKeon National Defense Authorization Act for Fiscal Year 2015, Pub. L. 113-291, 128 Stat. 3292 (2014).

CAMERANESI V. U.S. DEP’T OF DEFENSE 15

In March 2010, the House of Representatives Committee on Armed Services convened a hearing to receive testimony from U.S. Air Force General Douglas Fraser, Commander of the United States Southern Command, and U.S. Air Force General Victor Renuart, Jr., Commander of the North American Aerospace Defense Command. See Hearing on National Defense Authorization Act for Fiscal Year 2011 and Oversight of Previously Authorized Programs Before the H. Comm. on Armed Services, 111th Cong. 1 (2010). Among other issues, the generals addressed questions regarding a proposed amendment to the appropriations act that would authorize publication of personal information of WHINSEC students. General Fraser spoke against public disclosure of the names of WHINSEC students and urged Congress to respect the “rights and desires of the nations who provide [WHINSEC students]” by protecting their privacy. Id. at 16. He further stated that disclosure would threaten the privacy of the United States citizen instructors and staff. Id. General Renuart agreed with General Fraser regarding “the importance of maintaining the security of the individuals attending [WHINSEC], as well as the faculty.” Id. In explaining the risks of disclosure, General Renuart described an event that, while not involving a WHINSEC attendee, was “an example of what can happen when information is in fact released.” Id. The event involved the Mexican navy’s successful raid on Arturo Beltran Leyva, the alleged leader of a Mexican drug cartel. One of the naval officers involved in the raid was killed, and his name was subsequently released to the public. As a result, his mother, wife and children were killed. According to General Renuart, the DOD could not “afford to have the information that is held in WHINSEC released because it will have that kind of effect potentially for the individuals who are extremely valuable to us.” Id. at 19. Accordingly, General Renuart advised the representatives that 16 CAMERANESI V. U.S. DEP’T OF DEFENSE

“we need to be very careful about the release of that information, and we would oppose that.” Id. Congress ultimately decided not to include the disclosure requirement in the appropriations act.

D

On March 1, 2011, two members of SOAW, Theresa Cameranesi and Judith Liteky, sent a FOIA request to the DOD (specifically, the U.S. Army Training and Doctrine Command) for “the names, ranks, branches, countries of origin, lists of courses taken or taught, and/or dates and years of attendance of students, instructors, and guest instructors at [WHINSEC]” in fiscal years 2005 to 2010. A few weeks later, the plaintiffs amended their FOIA request to request information on the units of WHINSEC students and instructors. The DOD partially denied the request on April 5, 2011. It disclosed some responsive records but withheld the names or units of WHINSEC attendees under FOIA Exemption 6. See 5 U.S.C. § 552(b)(6). The plaintiffs filed an administrative appeal, which the DOD denied on June 8, 2011.

Following the denial of their administrative appeal, the plaintiffs filed suit in district court, claiming that DOD violated FOIA by failing to disclose the requested records. The parties filed cross-motions for summary judgment. In its motion, the DOD argued that it was entitled to withhold the identifying information regarding students and instructors under Exemption 6 to FOIA, 5 U.S.C. § 552(b)(6), and submitted two affidavits from Lee A. Rials, the Public Affairs Specialist for WHINSEC, in support. Rials’s affidavits stated that “[t]here are a number of risks associated with releasing the names of WHINSEC students, instructors, and guest

CAMERANESI V. U.S. DEP’T OF DEFENSE 17

instructors,” because these students “are directly involved in conflicts with criminal gangs, drug cartels, and other violent individuals.” Rials then stated that assessments prepared by the Defense Intelligence Agency (which had not been approved for public release) “indicate that the public disclosure of WHINSEC’s records may increase the threat to Latin American students from: (1) the intelligence and security apparatuses of countries hostile to U.S. interests and to U.S. partner nations in the Western Hemisphere; (2) terrorist organizations operating in the Western Hemisphere; and (3) drug trafficking organizations operating in the Western Hemisphere.” As an example, Rials stated that in some countries “security personnel and their families have been attacked after being identified in the media,” and referenced the 2010 testimony of General Renuart before the House Armed Services Committee. Finally, Rials stated that foreign nations participating in the WHINSEC program opposed “public disclosure of personally identifying information of students and instructors” and that such disclosure “may have adverse effects on future participation in training programs at WHINSEC.”

The district court granted summary judgment in favor of the plaintiffs. It held that DOD had not established that WHINSEC students and instructors had “a substantial privacy interest in their names” because they had not been promised confidentiality and their names had been routinely provided to the public before 2004.13 The DOD timely appealed.

13 The district court separately addressed the plaintiffs’ request for WHINSEC unit information in an order issued July 29, 2013. This issue is not before us. 18 CAMERANESI V. U.S. DEP’T OF DEFENSE

II

In the past, we employed a standard unique to FOIA cases for reviewing a district court’s summary judgment. See Yonemoto v. Dep’t of Veterans Affairs, 686 F.3d 681, 688 (9th Cir. 2011) (holding that in reviewing a grant of summary judgment in a FOIA case, we first review de novo whether there is an adequate factual basis to support the district court’s decision, and if there is, we then review the district court’s conclusions of fact for clear error). We have now overruled this FOIA-specific summary judgment standard, and instead apply our usual summary judgment standard. See Animal Legal Def. Fund v. U.S. Food & Drug Admin., No. 13-17131, 2016 WL 4578362, at *2 (9th Cir. Sept. 2, 2016) (en banc). Accordingly, we now review the district court’s grant or denial of motions for summary judgment de novo. Id. “[W]e view the evidence in the light most favorable to the nonmoving party, determine whether there are any genuine issues of material fact, and decide whether the district court correctly applied the relevant substantive law.” Id. at *1. “If there are genuine issues of material fact in a FOIA case, the district court should proceed to a bench trial or adversary hearing.” Id. at *2. In this case, the facts are undisputed and the decision turns on the legal issue whether disclosure of the names of foreign students and instructors at WHINSEC “would constitute a clearly unwarranted invasion of personal privacy” for purposes of Exemption 6. 5 U.S.C. § 552(b)(6). We have jurisdiction to review the district court’s grant of summary judgment under 28 U.S.C. § 1291.

III

FOIA requires federal agencies to disclose records that are requested by a member of the public. 5 U.S.C. § 552.

CAMERANESI V. U.S. DEP’T OF DEFENSE 19

The statute provides that “each agency, upon any request for records which (i) reasonably describes such records and (ii) is made in accordance with published rules . . . and procedures to be followed, shall make the records promptly available to any person.” Id. § 552(a)(3)(A).14 FOIA’s disclosure obligations extend to all agency records except the nine categories of records listed in § 552(b) as exempt from disclosure. “[A]s a general rule, when documents are within FOIA’s disclosure provisions, citizens should not be required to explain why they seek the information” because information about government functions “belongs to citizens to do with as they choose.” Nat’l Archives & Records Admin. v. Favish, 541 U.S. 157, 172 (2004). But when disclosure affects the types of information protected by the exemptions, “the usual rule that the citizen need not offer a reason for requesting the information must be inapplicable.” Id.

At issue here is Exemption 6, which provides that FOIA “does not apply to . . . personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6). In order to withhold information from disclosure under Exemption 6, the agency must specifically invoke the exemption and must carry the burden of proving that disclosure would constitute a clearly unwarranted invasion of personal privacy. See Yonemoto, 686 F.3d at 693.

When evaluating an agency’s invocation of an exemption to FOIA, we “balance the public interest in disclosure against

14 FOIA defines “agency” as “each authority of the Government of the United States, whether or not it is within or subject to review by another agency.” 5 U.S.C. § 551(1). There is no dispute that the DOD is an agency subject to FOIA. 20 CAMERANESI V. U.S. DEP’T OF DEFENSE

the interest Congress intended the [e]xemption to protect.” Dep’t of Def. v. Fed. Labor Relations Auth., 510 U.S. 487, 495 (1994). Our cases establish a two-step test for balancing individual privacy rights against the public’s right of access. First, we evaluate the personal privacy interest at stake to ensure “that disclosure implicates a personal privacy interest that is nontrivial or . . . more than [] de minimis.” Yonemoto, 686 F.3d at 693 (internal citation and quotation marks omitted). Second, if the agency succeeds in showing that the privacy interest at stake is nontrivial, the requester “must show that the public interest sought to be advanced is a significant one and that the information [sought] is likely to advance that interest.” Lane v. Dep’t of Interior, 523 F.3d 1128, 1137 (9th Cir. 2008) (alteration in original) (quoting Favish, 541 U.S. at 172) (internal quotation marks omitted); see also Yonemoto, 686 F.3d at 694. “Otherwise, the invasion of privacy is unwarranted.” Favish, 541 U.S. at 172.

A

We begin with an evaluation of the privacy interests at stake, which must be “some nontrivial privacy interest in nondisclosure.” Fed. Labor Relations Auth., 510 U.S. at 501 (emphasis omitted). A showing that the interest is more than de minimis will suffice. See Lahr v. Nat’l Transp. Safety Bd., 569 F.3d 964, 977 (9th Cir. 2009). “The personal privacy contemplated by Exemption 6, as well as its law-enforcement counterpart, Exemption 7(C), . . . is not some limited or cramped notion of that idea.” Yonemoto, 686 F.3d at 693 (internal citation and quotation marks omitted).15 Rather, a

15 Exemption 7(C) allows withholding “records or information compiled for law enforcement purposes, but only to the extent that the production of such law enforcement records . . . could reasonably be

CAMERANESI V. U.S. DEP’T OF DEFENSE 21

disclosure implicates personal privacy if it affects either “the individual’s control of information concerning his or her person,” Dep’t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989), or constitutes a “public intrusion[] long deemed impermissible under the common law and in our cultural traditions,” Favish, 541 U.S. at 167.16

Disclosures that would subject individuals to possible embarrassment, harassment, or the risk of mistreatment constitute nontrivial intrusions into privacy under Exemption 6. See Dep’t of State v. Ray, 502 U.S. 164, 176–77 (1991); see also Forest Serv. Emps. for Envtl. Ethics v. U.S. Forest Serv., 524 F.3d 1021, 1025–28 (9th Cir. 2008); Painting Indus. of Haw. Mkt. Recovery Fund v. U.S. Dep’t of Air Force, 26 F.3d 1479, 1483 (9th Cir. 1994). In Ray, for instance, immigration attorneys made a FOIA request for the disclosure of unredacted versions of interviews that the State Department had conducted with Haitians who “attempted to emigrate illegally to the United States and were involuntarily returned to Haiti.” 502 U.S. at 166. The State Department had provided copies of the interviews, but had redacted “the names and other identifying information” of the interview

expected to constitute an unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(7)(C). As we explained in Yonemoto, because both Exemption 7(C) and Exemption 6 “require balancing the public interest with personal privacy, cases interpreting the interest in personal privacy with regard to one of the two exemptions are useful in the context of the other.” 686 F.3d at 693 n.7 (internal quotation marks omitted). “If a nontrivial privacy interest is at stake, however, Exemption 7(C) requires a somewhat higher showing of public interest to overcome it than does Exemption 6.” Id. 16 Although both Reporters Committee and Favish concern Exemption 7(C), we have previously relied on them to define what makes a privacy interest “nontrivial.” See Yonemoto, 686 F.3d at 693. 22 CAMERANESI V. U.S. DEP’T OF DEFENSE

subjects. Id. at 169. The Court rejected the plaintiffs’ argument that “any invasion of privacy from the mere act of disclosure of names and addresses would be de minimis and little more than speculation.” Id. at 170 (internal quotation marks omitted). Rather, the Court relied on the State Department’s explanation that “disclosure of the interviewees’ identities could subject them or their families to embarrassment in their social and community relationships,” and noted that “the State Department considered the danger of mistreatment sufficiently real to necessitate” a program to monitor treatment of returnees. Id. at 176 (internal quotation marks omitted). The Court acknowledged that “[h]ow significant the danger of mistreatment may now be is, of course, impossible to measure,” but nevertheless held that “the privacy interest in protecting these individuals from any retaliatory action that might result from a renewed interest in their aborted attempts to emigrate must be given great weight.” Id. at 176–77. Although the Court was “not implying that disclosure of a list of names and other identifying information is inherently and always a significant threat to the privacy of the individuals on the list,” it concluded that in this case, “disclosure of the interviewees’ names would be a significant invasion of their privacy because it would subject them to possible embarrassment and retaliatory action.” Id. at 176 n.12.

We have similarly held that the potential for harassment from third parties gives rise to a cognizable privacy interest. In Forest Service Employees, we considered a public interest group’s FOIA request for the names of 23 firefighters who had participated in fighting a wildfire in which two firefighters died. 524 F.3d at 1023. We concluded that the employees had nontrivial privacy interests in the disclosure of their names because Exemption 6 protected against the

CAMERANESI V. U.S. DEP’T OF DEFENSE 23

“potential for harassment” that “would be presented by the media, curious neighbors, and the [public interest group] itself,” which might try to make unwanted contacts with the employees. Id. at 1026. In so holding, we explained that “[t]he avoidance of harassment is a cognizable privacy interest under Exemption 6,” even when the harassment at issue is merely “unwanted commercial solicitations.” Id. (citing Painting Indus., 26 F.3d at 1483); see also Prudential Locations LLC v. U.S. Dep’t of Housing and Urban Dev., 739 F.3d 424, 432 (9th Cir. 2013). Similarly, Lahr noted that “protection from . . . unwanted contact [by third parties] facilitated by disclosure of a connection to government operations and investigations is a cognizable privacy interest” under Exemption 6. 569 F.3d at 976.

An agency may carry its burden of establishing a nontrivial privacy interest by showing that the requested disclosure has “[t]he potential” to result in the sorts of harassment described in our cases. Lahr, 569 F.3d at 976. Although “a threat to privacy [that] is conceivable on some generalized conjectural level is not sufficient to justify evoking Exemption 6,” Yonemoto, 686 F.3d at 694, “the invasion of a personal privacy interest may be ‘clearly unwarranted’ even when the invasion of privacy is far from a certainty,” Prudential Locations, 739 F.3d at 432. The Supreme Court has relied on an agency’s reasonable assessment that disclosure “would subject [the affected individuals] to possible embarrassment and retaliatory action,” Ray, 502 U.S. at 176 n.12 (emphases added), and we have regularly done the same, see Prudential Locations, 739 F.3d at 432 (disclosure “would likely” result in an invasion of privacy); Forest Serv. Emps., 524 F.3d at 1026 (disclosure “may” result in an invasion of privacy). 24 CAMERANESI V. U.S. DEP’T OF DEFENSE

B

If the agency succeeds in showing a nontrivial privacy interest at step one, we then proceed to step two. At this step, we balance the individual’s right of privacy against the public interest in disclosure. Yonemoto, 686 F.3d at 694.

We consider two factors in evaluating the public interest in disclosure. First, “we examine whether ‘the public interest sought to be advanced is a significant one’—one ‘more specific than having the information for its own sake.’” Id. (quoting Favish, 541 U.S. at 172). Second, we examine “whether the requested information ‘is likely to advance that interest.’” Id. (quoting Favish, 541 U.S. at 172); see also Lane, 523 F.3d at 1137.

In considering whether the public interest is significant, “the only relevant public interest in the FOIA balancing analysis is the extent to which disclosure of the information sought would she[d] light on an agency’s performance of its statutory duties or otherwise let citizens know what their government is up to.” Yonemoto, 686 F.3d at 694 (quoting Bibles v. Or. Nat. Desert Ass’n, 519 U.S. 355, 355–56 (1997) (per curiam)). The requested information must “contribut[e] significantly to public understanding of the operations or activities of the government.’” Forest Serv. Emps., 524 F.3d at 1025 (alteration in original) (quoting Fed Labor Relations Auth. 510 U.S. at 495). “In other words, information about private citizens that is accumulated in various governmental files but that reveals little or nothing about an agency’s own conduct is not the type of information to which FOIA permits access.” Id. (internal quotation marks omitted). We do not give weight to the FOIA requester’s personal interest in obtaining information “[b]ecause Congress clearly intended

CAMERANESI V. U.S. DEP’T OF DEFENSE 25

the FOIA to give any member of the public as much right to disclosure as one with a special interest.” Fed. Labor Relations Auth., 510 U.S. at 496 (internal quotation marks omitted).

In examining whether the requested information is likely to advance a significant public interest, we consider whether it will “appreciably further the public’s right to monitor the agency’s action,” Forest Serv. Emps., 524 F.3d at 1027 (internal quotation marks omitted). If the information sought does not “add significantly to the already available information concerning the manner in which [the agency] has performed its statutory duties,” we give the public interest less weight. Prudential Locations, 739 F.3d at 433; see also Ray, 502 U.S. at 178 (holding that the public interest did not outweigh a nontrivial privacy interest where obtaining the names and personal information of the returnees “would not shed any additional light on the Government’s conduct of its obligation”). Thus when a FOIA requester sought the identities of Forest Service employees in order to “conduct its own investigation” of a fatal fire incident that had already been investigated by the government, the “marginal additional usefulness of such information” was not “sufficient to overcome the privacy interests at stake.” Forest Serv. Emps., 524 F.3d at 1027 (internal quotation marks omitted).

When a FOIA requester alleges a public interest in showing “that responsible officials acted negligently or otherwise improperly in the performance of their duties,” Favish, 541 U.S. at 174, we are guided by the Supreme Court’s decisions in Ray and Favish. In Ray, the FOIA requesters argued that disclosure of the identities of the Haitian returnees was necessary for “ascertaining the veracity of the interview reports.” 502 U.S. at 179. The Court 26 CAMERANESI V. U.S. DEP’T OF DEFENSE

rejected this argument, holding that “[w]e generally accord Government records and official conduct a presumption of legitimacy,” and that requesters had presented no evidence to overcome this presumption. Id. Ray expressly reserved the question of “[w]hat sort of evidence of official misconduct might be sufficient to identify a genuine public interest in disclosure.” Id. The Court subsequently answered this question in Favish, holding that where “the public interest being asserted is to show that responsible officials acted negligently or otherwise improperly in the performance of their duties,” then “the requester must establish more than a bare suspicion” in order to overcome the presumption of legitimacy accorded to official conduct. 541 U.S. at 174. Rather, “the requester must produce evidence that would warrant a belief by a reasonable person that the alleged Government impropriety might have occurred.” Id.17

Courts have applied Favish when a FOIA requester alleges that a governmental investigation is not believable or that the government has otherwise acted negligently or improperly in carrying out its statutory duties.18 For instance, in Forest Service Employees, the requester alleged that the public interest in obtaining the identities of Forest Service employees included an interest in “determin[ing] whether the Forest Service accurately recounted the [fatal fire] incident”

17 If the FOIA requester does not allege any government impropriety, the Favish reasonable belief standard may be inapplicable. See Citizens for Responsibility & Ethics in Wash. v. U.S. Dep’t of Justice, 746 F.3d 1082, 1094–95 (D.C. Cir. 2014). 18 The dissent therefore errs in suggesting that Favish’s holding is limited to cases where the FOIA requester seeks “materials related to the alleged mishandling of an investigation into one isolated incident.” Dissent at 44.

CAMERANESI V. U.S. DEP’T OF DEFENSE 27

in its investigative report, and “to reconcile inconsistencies.” Forest Serv. Emps, 524 F.3d at 1027 (internal quotation marks omitted). We gave this interest little weight because “[w]e generally accord government records a ‘presumption of legitimacy,’” id. at 1028 (quoting Favish, 541 U.S. at 174), and there was not enough evidence in the record that “direct contact with the employees would produce any information that has not already been revealed to the public,” id. (citing Ray, 502 U.S. at 178–79). In Associated Press v. U.S. Department of Defense, a FOIA requester argued that it needed the identities of the detainees discussed in a DOD report investigating allegations of detainee abuse at Guantanamo Bay Naval Base in order to determine whether the DOD “responded differently to allegations of abuse depending on the nationalities or religions of the abused detainees.” 554 F.3d 274, 289 (2d Cir. 2009). The Second Circuit held that this argument was “squarely foreclosed by Favish,” because “there is no evidence of government impropriety.” Id. In Union Leader Corp. v. U.S. Department of Homeland Security, a FOIA requester sought the identities of aliens who had been arrested by the government in 2011. 749 F.3d 45, 48 (1st Cir. 2014). The First Circuit held there was a public interest in the aliens’ identities because of evidence that the aliens had previously committed crimes or been ordered removed, but nevertheless had remained in the United States for years before their 2011 arrests. Id. at 56. Such evidence was “at least enough to warrant a reasonable belief ‘that the alleged Government impropriety might have occurred.’” Id. (quoting Favish, 541 U.S. at 174) (emphasis omitted). 28 CAMERANESI V. U.S. DEP’T OF DEFENSE

IV

We now apply this two-step test to determine whether disclosing the names of foreign WHINSEC students and instructors “would constitute a clearly unwarranted invasion of personal privacy” for purposes of Exemption 6. 5 U.S.C. § 552(b)(6).

A

We first consider whether disclosure of the names and units of foreign WHINSEC students and instructors implicates a nontrivial privacy interest. See Yonemoto, 686 F.3d at 693. We give little weight to the district court’s ruling that DOD failed to establish that WHINSEC students and instructors had “a substantial privacy interest in their names and military units” because the district court applied the wrong legal standard; it should have considered whether nontrivial privacy interests, rather than substantial privacy interests, were at stake.

Here, the evidence submitted by the DOD demonstrated that disclosure of the identities of foreign WHINSEC students and instructors would give rise to possible harassment, stigma, or violence as a result of their association with the United States—exactly the sorts of risks that courts have recognized as nontrivial in previous cases. See Ray, 502 U.S. at 176–77 & n.12; Lahr, 569 F.3d at 975–76; Forest Serv. Emps., 524 F.3d at 1025–28; Painting Indus., 26 F.3d at 1483. The DOD submitted sufficient evidence to substantiate this nontrivial risk, see Lewis v. IRS, 823 F.2d 375, 378 (9th Cir. 1987), including Rials’s affidavits and the testimony of two United States generals.

CAMERANESI V. U.S. DEP’T OF DEFENSE 29

The plaintiffs argue that the evidence of risks faced by the WHINSEC students and instructors should be disregarded as overly speculative. We disagree. We have never held that an agency must document that harassment or mistreatment have happened in the past or will certainly happen in the future; rather, the agency must merely establish that disclosure would result in a “potential for harassment.” Forest Serv. Emps., 524 F.3d at 1026. Here, the government’s affidavits set forth its conclusion that foreign military and law enforcement personnel who are publicly associated with the United States would be subject to possible mistreatment or attack. See Ray, 502 U.S. at 176 n.12. The same concerns rationally underlay the DOD’s decision to protect the identity of U.S. law enforcement and military personnel from FOIA requests. See 32 C.F.R. § 518.13(f)(2); see also id. § 286.12(f)(2) (providing that DOD will not disclose the “names and duty addresses” of United States “military and civilian personnel who are assigned to units that are sensitive, routinely deployable, or stationed in foreign territories” because such disclosure “can constitute a clearly unwarranted invasion of personal privacy”). Given its affidavits and other evidence in the record, the government carried its burden of showing that foreign law enforcement and military personnel would face similar risks if their identities were revealed, and therefore established that WHINSEC students and instructors have a nontrivial privacy interest. See Prudential Locations, 739 F.3d at 432; Lahr, 569 F.3d at 977; Forest Serv. Emps., 524 F.3d at 1026.

The district court also erred in holding that the WHINSEC students and instructors lacked a nontrivial privacy interest because the DOD had not promised confidentiality. As a legal matter, “an assurance of confidentiality from the government” is not a necessary 30 CAMERANESI V. U.S. DEP’T OF DEFENSE

condition “for the existence of a cognizable personal privacy interest under Exemption 6.” Prudential Locations, 739 F.3d at 431–32. Moreover, the court’s conclusion that WHINSEC students and instructors do not have a reasonable expectation of privacy is not supported by the record. The DOD has not disclosed the names of WHINSEC students since 2004 and likewise redacts the names of WHINSEC students from public documents. Any disclosures are now made only with the consent of the students or the sending nation. A majority of foreign countries that send students to WHINSEC rely on the DOD’s current disclosure practices and oppose public disclosure of the identities of their students and instructors. Further, the DOD exercised its discretion to ensure that no disclosures would be made in response to Congress’s requirement that the DOD disclose the names of WHINSEC students in 2009 and 2010, and Congress chose not to reenact this requirement. Under these circumstances, students and instructors at WHINSEC could reasonably conclude that their identities would not be disclosed without their permission.

Accordingly, we conclude that the affidavits and other evidence submitted by the DOD are sufficient to carry the DOD’s burden to establish that disclosure of the requested information gives rise to a nontrivial risk of harassment and mistreatment.

B

At step two, we balance the privacy interests identified at the first step against the public interest favoring disclosure. In order to conduct this balancing, we begin by identifying the public interest at issue, focusing on the “only relevant public interest under Exemption 6,” which is “the extent to which the information sought would she[d] light on an

CAMERANESI V. U.S. DEP’T OF DEFENSE 31

agency’s performance of its statutory duties or otherwise let citizens know what their government is up to.” Forest Serv. Emps., 524 F.3d at 1027 (internal quotation marks omitted).

Plaintiffs first argue that obtaining the identities of the WHINSEC students and instructors would shed light on the DOD’s performance of two statutory duties. As previously noted, the DOD is required to deny assistance, including WHINSEC training, to any “unit of a foreign security force if the Secretary of Defense has credible information that the unit has committed a gross violation of human rights.” 10 U.S.C. § 2249e(a). The DOD must also “ensure that when an individual is designated to receive United States training, equipment, or other types of assistance [including WHINSEC training] the individual’s unit is vetted as well as the individual.” 22 U.S.C. § 2378d(d)(5). But this second statutory obligation is imposed only on the Secretary of State, who was not the recipient of the plaintiffs’ FOIA request, and Congress assigned the DOD only the correlative obligation to consult with the State Department regarding information on units that have committed human rights violations. 10 U.S.C. § 2249e(a). Nevertheless, we will assume for the sake of argument that DOD’s obligation to consult with the State Department is analogous to the State Department’s obligation to screen potential students at WHINSEC, and that both obligations are meant to ensure that members of a foreign security unit that has engaged in human rights abuses (and by extension, individuals who have themselves engaged in human rights violations) are not allowed to participate in WHINSEC training.

According to plaintiffs, obtaining the identities of the WHINSEC students and instructors would allow them to disclose deficiencies in the vetting process required by these 32 CAMERANESI V. U.S. DEP’T OF DEFENSE

statutes. But disclosure of these identities would not “contribut[e] significantly to public understanding of the operations or activities of the government,” Forest Serv. Emps., 524 F.3d at 1024–25 (quoting Fed. Labor Relations Auth., 510 U.S. at 495), because the government already has an investigative process in place to review the vetting process, and information regarding the effectiveness of the Department of State’s procedures for vetting prospective trainees is available to the public through the Board of Visitors’s public reports. See 10 U.S.C. § 2166(e)(5). Given this ongoing review of DOD compliance, the disclosure of the names of all students and instructors at WHINSEC would not have significant “marginal additional usefulness,” Forest Serv. Emps., 524 F.3d at 1027–28, or “add significantly to the already available information concerning the manner in which [the agency] has performed its statutory duties,” Prudential Locations, 739 F.3d at 433.

Plaintiffs separately contend that the government has improperly performed its vetting duties, and submit an affidavit identifying two instances where the Secretary of State mistakenly allowed individuals who had allegedly participated in human rights abuses to attend the school.19 Although we agree there is a public interest in identifying government impropriety in performing its statutory duties, allegations of two errors among the thousands of students that trained at WHINSEC from 2001 through 2004 does not

19 One individual allegedly commanded a unit that beat and shot 16 members of an indigenous organization in 1983 and then was allowed to attend WHINSEC in 2003. A second individual was allegedly responsible for the kidnapping and torture of a human rights organizer in 1997 and then attended WHINSEC in 2002. SOAW also points to three students who attended WHINSEC while under official investigation for corruption, which is not alleged to be a human rights abuse.

CAMERANESI V. U.S. DEP’T OF DEFENSE 33

amount to a “meaningful evidentiary showing” that would lead to “a belief by a reasonable person that the alleged Government impropriety might have occurred.” Favish, 541 U.S. at 174–75; see also Union Leader Corp., 749 F.3d at 56; Associated Press, 554 F.3d at 285.

Second, plaintiffs contend that they can use the names of WHINSEC students to track their conduct after they have received their training. According to plaintiffs, this will further the public interest in understanding the agency’s performance of its statutory duties and in letting the public know what their government is up to because if WHINSEC attendees violate human rights once they return to their service in foreign governments, it shows that WHINSEC human rights training is not effective. We disagree that the requested information will “appreciably further the citizens’ right to be informed about what their government is up to.” Fed. Labor Relations Auth., 510 U.S. at 497 (internal quotation marks omitted). The government has monitored WHINSEC’s compliance with its statutory obligation to provide its students mandatory instruction on human rights, 10 U.S.C. § 2166(d)(1), and the publicly available reports from the Board of Visitors and Secretary of Defense make clear that WHINSEC is exceeding congressional requirements in this area. The Board of Visitors regularly monitors, reports on, and makes recommendations for improvements to WHINSEC’s curriculum. Id. § 2166(e)(4)(A); see also Memorandum from Matthew D. Anderson & Robert C. Morlino, WHINSEC BoV, on Curriculum Review of WHINSEC (July 13, 2007) (Annex 3 in Sec’y of Def., Annual Report to Cong. on the Activities of the Western Hemisphere Institute for Security Cooperation 19 (2007)). 34 CAMERANESI V. U.S. DEP’T OF DEFENSE

Moreover, the relationship between WHINSEC’s obligation to provide human rights training to WHINSEC students and the subsequent conduct of foreign law enforcement or military personnel, perhaps years after their training at WHINSEC, is tenuous at best. Even if individual attendees are later alleged to engage in human rights abuses, such subsequent incidents are unlikely to shed light on what the government is currently up to at WHINSEC. Given the Board of Visitors’s responsibility for monitoring and reporting on WHINSEC’s curriculum, the disclosure of the names of all foreign students and instructors at WHINSEC would not “add significantly to the already available information concerning the manner in which [the agency] has performed its statutory duties,” Prudential Locations, 739 F.3d at 433, or “appreciably further the public’s right to monitor the agency’s action,” Forest Serv. Emps., 524 F.3d at 1027. The Supreme Court has ruled that the purposes of FOIA are not fostered by disclosure of information about private individuals that “reveals little or nothing about an agency’s own conduct.” Reporters Comm. for Freedom of Press, 489 U.S. at 773.

Having defined the public interest at stake, we now weigh it against the privacy interest of the WHINSEC students and instructors. The DOD has presented evidence that disclosing the names of WHINSEC students and instructors would put them at risk of harassment, retaliation, or even death. Where serious privacy interests are present on one side of the balance, the public’s marginal interests will not be enough to require disclosure. Forest Serv. Emps., 524 F.3d at 1027. Because any incremental value stemming from the disclosure of the identities of WHINSEC students and instructors is small, the public interest in this case does not outweigh the serious risks that would result from disclosure. We therefore

CAMERANESI V. U.S. DEP’T OF DEFENSE 35

conclude that disclosure would give rise to a “clearly unwarranted” invasion of privacy and that the information requested by plaintiffs is exempt from disclosure under Exemption 6 of FOIA.

The dissent disagrees with our application of the FOIA balancing test because it is not persuaded by the government’s reasons for instituting a new policy to withhold the names of students and instructors in 2005. The dissent argues that because the DOD disclosed the names of SOA and WHINSEC students and instructors until 2004, it must “provide a satisfactory explanation” for its change in policy in order to invoke Exemption 6. Dissent at 47.

The dissent’s analysis is wrong for several reasons. Most important, FOIA does not impose a duty on the government to provide a satisfactory explanation of a change in its policy; rather, it merely requires us to decide on the record before us whether disclosure of the requested information would give rise to a “clearly unwarranted” invasion of privacy. 5 U.S.C. § 552(b)(6). Here, the record demonstrates that disclosure would do so. Applying simple common sense, there is no question that there are many groups in foreign countries that would seek to harm those who are publicly associated with the United States military. Even the dissent concedes that these risks are real. Dissent at 37, 47. These risks outweigh the public interest in disclosure here and are therefore sufficient to justify withholding under Exemption 6.

But even if we were to evaluate the government’s explanation of its policy decision, we disagree with the dissent’s view that the government did “not provide a satisfactory explanation.” Dissent at 47. The government explained that the DOD circulated an internal memorandum 36 CAMERANESI V. U.S. DEP’T OF DEFENSE

changing its policies regarding disclosure of the names of defense personnel two months after the terrorist attacks of September 11, 2001, and realized that international personnel should be accorded the same protection some years later. In our view, a government bureaucracy’s failure to demonstrate speed and efficiency in applying a policy issued in one context to a related but different context does not raise the inference that the government is hiding the true reasons for that policy. Indeed, it took the DOD five years to formalize its policy regarding American military personnel after it circulated its informal memo. See 32 C.F.R. § 518.13(f)(2); see also The Freedom of Information Act Program, 71 Fed. Reg. 9222, 9232 (Feb. 22, 2006).20

20 The dissent also speculates that the threats facing WHINSEC students and instructors were “undoubtedly” present during the decade from 1994 to 2004, and so infers that it would be unreasonable for the government to change its nondisclosure policy starting in 2005. Dissent at 47–48. There is no support in the record for this speculation, and it is equally likely that escalating violence influenced the government’s decision to change its nondisclosure policy in 2005. See, e.g., Mary Jordan & Kevin Sullivan, Border Police Chief Only Latest Casualty in Mexico Drug War, Wash. Post, June 16, 2005 (reporting on Mexico’s “worst barrage of drug-related violence in years” and noting that an “increasing number” of victims of drug violence are “public servants” who “stood up to organized crime”); Ginger Thompson & James C. McKinley, Jr., Mexico’s Drug Cartels Wage Fierce Battle for Their Turf, N.Y. Times, Jan. 14. 2005 (noting that while in “the last four years” Mexico had made advances in its fight against drug cartels, a new wave of drug related killings showed that cartel leaders had begun to regroup, and noting that at least 34 people, including three federal agents and two journalists, had been assassinated in the last six months of 2004).

CAMERANESI V. U.S. DEP’T OF DEFENSE 37

Because disclosing the names of WHINSEC students and instructors would give rise to a “clearly unwarranted” invasion of privacy, those names are therefore exempt from disclosure under Exemption 6 of FOIA.

REVERSED.

WATFORD, Circuit Judge, dissenting:

The Department of Defense has shown that the Western Hemisphere Institute for Security Cooperation’s foreign students and instructors have a non-trivial privacy interest in keeping their identities secret. Disclosing their names to the public would reveal their affiliation with the Institute, which might expose them to the risk of harassment or violence when they return to their home countries. But the question remains under Exemption 6 of the Freedom of Information Act (FOIA) whether that invasion of privacy would be “clearly unwarranted.” 5 U.S.C. § 552(b)(6). To answer that question, we must balance the privacy interests at stake against the public interest in disclosure protected by FOIA—namely, “the citizens’ right to be informed about ‘what their government is up to,’” which encompasses “[o]fficial information that sheds light on an agency’s performance of its statutory duties.” Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749, 773 (1989). In my view, on the thin evidentiary record presented here, the Department of Defense did not carry its burden of demonstrating that the students’ and instructors’ privacy interests outweigh the strong public interest in disclosure of their names. 38 CAMERANESI V. U.S. DEP’T OF DEFENSE

I

Let’s start with the public interest in disclosure, which requires a little bit of background. The Institute is operated by the Army at Fort Benning, Georgia. It was established in 2001, but it is actually a continuation of the School of the Americas (SOA), which opened its doors under a different name in 1946 and moved to Fort Benning in the 1980s. SOA became the subject of considerable controversy after the 1989 massacre of six Jesuit priests in El Salvador during that country’s civil war. It turned out that 19 of the soldiers involved in the massacre had received training at SOA.

That incident was not an anomaly. After the Army began releasing the names of former SOA students and instructors in 1994 as a result of FOIA requests, human rights activists linked the school’s attendees to a host of notorious crimes. A few examples: SOA graduates were implicated in additional atrocities committed during the civil war in El Salvador, including the assassination of Archbishop Oscar Romero, the execution of four American churchwomen, and the massacre of hundreds of civilians in the village of El Mozote. A Guatemalan colonel who attended SOA was accused of murdering, six months after graduating, an American innkeeper in Guatemala in 1990. Six Peruvian SOA graduates were connected to the killings of nine students and a professor in Peru in 1992. In addition, SOA counted among its alumni Salvadoran death-squad leader Roberto D’Aubuisson; Bolivian strongman Hugo Banzer Suarez; Panamanian dictator and convicted drug-trafficker Manuel Noriega; Argentine dictators and “dirty war” culprits Roberto Viola and Leopoldo Galtieri; and Ecuador’s Guillermo Rodriguez and Peru’s Juan Velasco Alvarado, both of whom toppled democratically elected governments. See H.R. 732,

CAMERANESI V. U.S. DEP’T OF DEFENSE 39

106th Cong. (1999); Richard F. Grimmett & Mark P. Sullivan, Congressional Research Service, U.S. Army School of the Americas: Background and Congressional Concerns 3–4 (2001); Eric Schmitt, School for Assassins, or Aid to Latin Democracy?, N.Y. Times, Apr. 3, 1995, at A8.

The Army cautioned, rightly, that these incidents were not representative of the vast majority of SOA attendees, although it did not disclaim them entirely. A spokesman for the school responded to the criticism in 1995 by observing that “[o]ut of 59,000 students who have graduated from a variety of programs, less than 300 have been cited for human rights violations like torture and murder, and less than 50 have been convicted of anything.” Schmitt, School for Assassins, at A8. However, the controversy escalated in 1996 when the Pentagon released excerpts of training manuals previously used at SOA that provided instruction on torturing and executing insurgents. See Dana Priest, U.S. Instructed Latins on Executions, Torture, Wash. Post, Sept. 21, 1996, at

A1.

In 1997, Congress began imposing legislative restrictions on the school’s operations. It enacted what became known as the Leahy Amendment, which barred the military from assisting any foreign security unit credibly believed to have committed human rights abuses unless that unit’s government had taken steps to bring the responsible parties to justice. See Foreign Operations, Export Financing, and Related Programs Appropriations Act for Fiscal Year 1998, Pub. L. No. 105- 118, § 570, 111 Stat. 2386, 2429 (1997). Congress also barred funding for SOA unless the Secretary of Defense certified that the training provided at the school was consistent with that provided to U.S. personnel at other military institutions, “particularly with respect to the 40 CAMERANESI V. U.S. DEP’T OF DEFENSE

observance of human rights.” Id. at 2401. The intended effect of these provisions was to preclude Latin American military and law-enforcement personnel from attending SOA if their units had engaged in past human rights abuses, and to ensure that the school’s attendees were not trained in ways that might contribute to human rights abuses after they returned to their home countries. The Leahy Amendment and the certification requirement did not quiet the outcry over SOA. In 1999, the House of Representatives passed an amendment by a vote of 230–197 that would have closed SOA altogether. See 145 Cong. Rec. 18716–26, 18737 (1999).

In response to this congressional action, the Army pledged curricular changes and increased civilian participation at the school, and these proposed changes succeeded in staving off the school’s closure. In 2000, rather than close SOA, Congress decided to impose reform measures. Congress required the school to include instruction for all students on respect for human rights and principles of democratic governance, and mandated oversight of the school by a Board of Visitors composed primarily of civilians and civilian-designees. See National Defense Authorization Act for Fiscal Year 2001, Pub. L. No. 106-398, § 911, 114 Stat. 1654, 1654A-226–28 (2000) (codified at 10 U.S.C. § 2166). To avoid association with SOA’s controversial past, it was thought best to rename the school going forward. Beginning in early 2001, the school began operating under its new name: the Western Hemisphere Institute for Security Cooperation.

That background is relevant to understanding the strength of the public interest in disclosure involved here. Disclosing the names of the Institute’s foreign students and instructors is necessary to allow citizens to remain informed about “what

CAMERANESI V. U.S. DEP’T OF DEFENSE 41

their government is up to.” For example, without the names, the public has no way of determining whether the issues that led to the school’s near closure have been adequately addressed. Is the Army in fact barring attendance of foreign military and law-enforcement personnel who belong to units with records of human rights abuses? Or are such individuals continuing to receive training at the Institute at taxpayer expense? Have the new curricular requirements been effective in instilling the importance of respect for human rights and democratic values? Or are students trained at the Institute continuing to commit human rights abuses upon returning to their home countries? These are not idle questions given the school’s checkered history. Because the Institute remained in operation only after Congress mandated reforms designed to fix the problems that formerly plagued the school, the public has a strong ongoing interest in assessing whether those measures are working.

Beyond advancing this more general interest, disclosing the names of the Institute’s foreign students and instructors would also shed light on how well the Departments of Defense and State are performing their statutory duties. See Reporters Committee, 489 U.S. at 773. Under the current version of the Leahy Amendment, the government may not train, equip, or otherwise assist any “unit” of a foreign security force if the unit has committed “a gross violation of human rights.” 10 U.S.C. § 2249e(a)(1); 22 U.S.C. § 2378d(a). This restriction imposes specific duties upon the Departments of Defense and State. The Defense Department is expressly barred from spending funds on the proscribed foreign assistance, and prior to aiding a foreign security unit, the Secretary of Defense must consult with the Secretary of State regarding “any credible information available to the Department of State relating to human rights violations by 42 CAMERANESI V. U.S. DEP’T OF DEFENSE

such unit.” 10 U.S.C. § 2249e(a). In turn, the Secretary of State must “ensure that when an individual is designated to receive United States training, equipment, or other types of assistance the individual’s unit is vetted as well as the individual.” 22 U.S.C. § 2378d(d)(5). Disclosure of the names of the Institute’s foreign students would allow the public to assess the State Department’s performance of its vetting functions, as well as the Defense Department’s performance of its duty to consult with the State Department and to refrain from training any units with suspect human rights records.

II

The strength of the public interest in disclosure is what distinguishes this case from the cases on which the Department of Defense relies to justify its invocation of Exemption 6. In those cases, the courts struck the balance in favor of protecting privacy interests because the public interest in disclosure was either non-existent or exceptionally weak.

In the first set of cases, there was simply no cognizable public interest in disclosure at all. See Bibles v. Oregon Natural Desert Association, 519 U.S. 355, 355–56 (1997) (per curiam); Department of Defense v. FLRA, 510 U.S. 487, 497–98 (1994); Reporters Committee, 489 U.S. at 774–75. The requested information revealed “little or nothing” about the relevant government agencies or their activities, and therefore could not “appreciably further the citizens’ right to be informed about what their government is up to.” FLRA, 510 U.S. at 497 (internal quotation marks omitted). For the reasons just explained, the same cannot be said about the information requested by the plaintiffs in this case.

CAMERANESI V. U.S. DEP’T OF DEFENSE 43

In the second set of cases, the courts held that although a cognizable public interest in disclosure existed, it was adequately served by the wealth of information the government had already made publicly available. See Department of State v. Ray, 502 U.S. 164, 178 (1991); Prudential Locations LLC v. HUD, 739 F.3d 424, 433 (9th Cir. 2013) (per curiam); Forest Service Employees for Environmental Ethics v. U.S. Forest Service, 524 F.3d 1021, 1028 (9th Cir. 2008). In those cases, obtaining the additional information sought by the requesters (the names of particular individuals) would not have shed any light on the operations or activities of the government. Here, by contrast, without obtaining the foreign students’ and instructors’ names, the public cannot exercise its right to remain informed about the Army’s operation of the Institute or assess how well the Departments of State and Defense are performing their statutory duties.

The majority asserts that annual reports produced by the Institute’s Board of Visitors, as well as those issued by the Department of Defense itself, are adequate for these purposes, see Maj. op. at 32, 33, 34, but in truth the reports are utterly useless in this regard. They merely provide general conclusions about the Army’s operation of the Institute and the government’s vetting of its attendees, not the underlying information necessary to determine whether those conclusions are correct.1 Without knowing the actual names of those allowed to attend the Institute, the public has no way of independently verifying whether students are properly vetted before enrolling at the Institute, or whether after graduating they engage in human rights abuses in their home

1 The Board of Visitors’ reports are available at https://database.faca.gov/committee/histories.aspx?cid=1860&fy=2002. 44 CAMERANESI V. U.S. DEP’T OF DEFENSE

countries. As the majority would have it, the public must simply take the government’s word for it that the reform measures mandated by Congress have been effective. This fox-guarding-the-henhouse notion is, of course, completely antithetical to FOIA’s core purpose.

Finally, in the last set of cases, the requesters alleged that, in the course of investigating an isolated incident, the government had either engaged in a cover-up or conducted an insufficiently thorough investigation. See National Archives and Records Administration v. Favish, 541 U.S. 157, 160–61 (2004) (requester alleged that Vince Foster’s death was not actually a suicide); Lahr v. National Transportation Safety Board, 569 F.3d 964, 969 (9th Cir. 2009) (requester alleged that TWA Flight 800 did not crash; it was shot down by the military); Lane v. Department of the Interior, 523 F.3d 1128, 1131–33 (9th Cir. 2008) (requester alleged that her former supervisor had in fact threatened a fellow employee with a gun, contrary to the conclusion reached by investigators). In that narrow context, when the asserted public interest rests on showing that “the investigative agency or other responsible officials acted negligently or otherwise improperly in the performance of their duties,” the requester must produce at least some evidence of government impropriety to substantiate the public interest claim. Favish, 541 U.S. at 173–74.

The majority’s reliance on this last set of cases is misplaced for two reasons. First, the standard established in those cases does not apply here. The plaintiffs are not seeking materials related to the alleged mishandling of an investigation into one isolated incident, the only context in which the Supreme Court and our court have applied the Favish standard. Rather, they are seeking information

CAMERANESI V. U.S. DEP’T OF DEFENSE 45

relevant to assessing government activities of a programmatic nature, a context in which the Supreme Court has held that a strong public interest in disclosure exists without any showing of government impropriety. See Department of the Air Force v. Rose, 425 U.S. 352, 368 (1976). But even under the majority’s reading of Favish, the standard established in that case does not apply here because the plaintiffs are not merely seeking information about whether an agency “acted negligently or improperly in carrying out its statutory duties.” Maj. op. at 26. They are also seeking information necessary to determine whether students who attend the Institute commit human rights abuses or other misconduct after returning to their home countries. As the majority itself acknowledges, that interest is in no way tied to the interest in monitoring whether the Departments of Defense and State are properly carrying out their statutory duties. Maj. op. at 34.

Second, even if the plaintiffs were required under Favish to make a threshold evidentiary showing, they have done so. The plaintiffs would merely need to establish “more than a bare suspicion” of impropriety—in other words, “evidence that would warrant a belief by a reasonable person that the alleged Government impropriety might have occurred.” Favish, 541 U.S. at 174. The plaintiffs have easily satisfied that standard by pointing to the troubled history of SOA, which led Congress to acknowledge a need for new vetting and oversight procedures. The majority simply ignores the relevance of this pre-2001 history. Yet it is precisely because of the problems that plagued the Institute’s predecessor that the public has such a strong interest in determining whether or not the reforms implemented to correct those problems have been effective. 46 CAMERANESI V. U.S. DEP’T OF DEFENSE

III

What I have shown thus far, I hope, is that the public interest in disclosure is much stronger than the majority is willing to allow. But what about the privacy interests at stake? Are they strong enough to outweigh the public interest in disclosure? That depends on how grave we believe the risk of harm to the foreign students and instructors might be if their names are disclosed. Ordinarily, I would be inclined to give considerable deference to the judgment of military officials about the gravity of the risks posed by disclosure of potentially sensitive information. The reason I think we should be more skeptical here is that the military itself determined for a decade, from 1994 to 2004, that the risks of disclosure were not sufficiently compelling to justify withholding the names under Exemption 6. During this period, the Army disclosed not only the names of all foreign students and instructors who attended the Institute each year, but also the names of all foreign students and instructors who had attended the Institute and its predecessor dating back to 1946—some 60,000 names in all.

It would be one thing if the Department of Defense had informed us that its risk assessment changed in 2005 because a foreign student or instructor had been targeted for harassment or violence due to his affiliation with the Institute. That would make it easy to understand the Department’s about-face. But here, the Defense Department pointed to no such event, and indeed, so far as the record discloses, none of the 60,000 individuals whose names have been publicly released has ever been the target of harassment or violence based on their having attended the Institute or its predecessor.

CAMERANESI V. U.S. DEP’T OF DEFENSE 47

The Department of Defense is certainly correct in arguing that it is not required to show some past incident of harm in order to invoke Exemption 6 as a basis for non-disclosure. But in light of the history involved here, I think we are entitled to demand from the Department some explanation for why it is now saying that the risks of disclosure are too great when apparently it did not believe that to be true before. Otherwise, we are simply rubber-stamping the government’s decision.

The declarations submitted by the Department of Defense do not provide a satisfactory explanation (or frankly any explanation at all). The Department provided just two short declarations from a public affairs staffer at the Institute named Lee Rials. Attached to one of his declarations is a transcript of testimony given by two generals at a 2010 congressional hearing devoted to other subjects during which the generals answered a single question about the Institute. (This is the congressional testimony to which the majority refers. See Maj. op. at 15–16.) The Rials declarations assert, based on “Defense Intelligence Agency assessments” which the government chose not to submit, that disclosure of the foreign students’ and instructors’ names would increase the risk of retaliation from three sources: (1) “the intelligence and security apparatuses of countries hostile to U.S. interests”; (2) “terrorist organizations operating in the Western Hemisphere”; and (3) “drug trafficking organizations operating in the Western Hemisphere.” But the risks of retaliation from these sources were undoubtedly present during the 1994–2004 time period as well. They did not just pop up beginning in 2005. Rials’ declarations offer no explanation for why the military has determined that those risks had increased sufficiently by 2005 to warrant striking a 48 CAMERANESI V. U.S. DEP’T OF DEFENSE

different balance between privacy interests and the public interest in disclosure.2

At oral argument, the government’s lawyer asserted that the terrorist attacks of September 11, 2001, caused the Department of Defense to reassess its prior policy of disclosing the names. The main problem with that explanation: It appears nowhere in the declarations the government submitted. Neither the Rials declarations nor the testimony from the two generals mentions the September 11 attacks. The government did submit a copy of a November 2001 Defense Department memo that announced, in light of the recent attacks, a new policy with respect to “DoD personnel” of withholding “lists of names and other personally identifying information.” However, Rials did not cite this memo in explaining the Department of Defense’s 2005 decision to stop disclosing the names of the Institute’s foreign students and instructors, and the government failed to offer any other declaration—let alone one from a military officer—explaining the memo’s role in the 2005 decision- making process.

The link between the November 2001 memo regarding “DoD personnel” and the Army’s 2005 decision to stop

2 The majority’s only response to this point is to speculate that “it is equally likely that escalating violence influenced the government’s decision to change its nondisclosure policy in 2005.” Maj. op. at 36 n.20. The problem with this response is just that—it is predicated entirely on speculation. The majority cannot identify any evidence in the record of escalating violence that would justify the Defense Department’s withholding decision in 2005 because the Department submitted no such evidence. And because the government bears the burden of establishing a basis for withholding under Exemption 6, that dearth of evidence is fatal to its claim. See Ray, 502 U.S. at 173.

CAMERANESI V. U.S. DEP’T OF DEFENSE 49

disclosing the names of foreign military personnel attending the Institute is not so obvious that we can assume a connection without any supporting evidence. For one thing, it is not by any means clear that the memo was intended to apply to foreign students and instructors at a U.S. military training school; the memo’s focus appears to be on protecting the identities of U.S. military personnel, who would be obvious targets for attack in the wake of September 11. Had the memo also been intended to cover foreign students and instructors at the Institute, it is inconceivable that the Army would have continued to disclose their names in response to FOIA requests for more than three years after the memo’s issuance, which is what happened here. For another thing, the November 2001 memo relied on an Exemption 6 balancing analysis (under which privacy interests were deemed to prevail), but that analysis is quite different for the two groups of personnel. The public interest in knowing which foreign students our government chooses to train militarily and what comes of that training is much stronger than any public interest that might exist in the disclosure of the identities of U.S. military personnel.

* * *

Under FOIA, Congress has established a “strong presumption in favor of disclosure,” and it has placed “the burden on the agency to justify the withholding of any requested documents.” Ray, 502 U.S. at 173. Had the government provided a sturdier evidentiary foundation for its decision to withhold the requested information, I would have readily agreed with my colleagues’ resolution of this appeal. On this record, though, I think we are compelled to reject the government’s invocation of Exemption 6. I would therefore affirm the district court’s decision.