Case 1:03-cv-01793-RBW Document 229-2 Filed 04/11/2008 Page 1 of 40 IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA _____________ Steven J. HATFILL, M.D., ) ) Plaintiff, ) ) v. ) Civil No. 1:03-CV-01793 (RBW) ) Attorney General Michael MUKASEY, ) et al., ) ) Defendants. ) ___________________________________ ) PLAINTIFF’S MEMORANDUM OF POINTS AND AUTHORITIES IN SUPPORT OF MOTION FOR PARTIAL SUMMARY JUDGMENT April 11, 2007 HARRIS, WILTSHIRE & GRANNIS, LLP Thomas G. Connolly, D.C. Bar # 420416 Mark A. Grannis, D.C. Bar # 429268 Patrick O’Donnell, D.C. Bar # 459360 1200 Eighteenth Street, N.W. Washington, D.C. 20036 Telephone: (202) 730-1300 Facsimile: (202) 730-1301 Case 1:03-cv-01793-RBW Document 229-2 Filed 04/11/2008 Page 2 of 40 TABLE OF CONTENTS INTRODUCTION......................................................................................................................... 1 SUMMARY JUDGMENT STANDARD .................................................................................... 6 ARGUMENT................................................................................................................................. 6 I. THE AGENCY DEFENDANTS VIOLATED THE SAFEGUARDING, INSTRUCTION, AND ACCOUNTING PROVISIONS OF THE PRIVACY ACT....................................................................... 6 A. The Investigative Disclosures in this Case Reflect "Records" Contained Within a "System of Records" ......................... 8 B. The Agency Defendants Failed to Safeguard Investigative Records About Dr. Hatfill or Instruct Their Officials on Their Privacy Act Obligations...... 10 1. Near-Total Ignorance of the Privacy Act................................................ 10 2. Near-Total Absence of Administrative Safeguards on Oral Briefings.................................................................. 14 3. Near-Total Absence of Administrative Safeguards on Media Interviews. ............................................................ 15 4. Failure to Heed Early Warning Signs .................................................... 16 5. Use of a Computerized Investigative Records System Known to be Insecure, With No Additional Safeguards. ....................... 18 6. Failure to Detect and Discipline Leakers................................................ 20 7. Silence of Senior Agency Officials.......................................................... 21 8. The “Person of Interest” Disclosures ..................................................... 22 9. Official Use of Anonymity Agreements With the Media ........................ 24 10. Conclusion: Abject Failure to Safeguard and Instruct......................... 27 C. The Agency Defendants Acted Intentionally in Failing to Safeguard............ 28 D. The Agency Defendants Intentionally Violated the Privacy Act’s Accounting Provision.................................................................. 32 II. THE PRIVACY ACT VIOLATIONS ADVERSELY AFFECTED DR. HATFILL .......................................................................................... 33 CONCLUSION ........................................................................................................................... 36 Case 1:03-cv-01793-RBW Document 229-2 Filed 04/11/2008 Page 3 of 40 INTRODUCTION The factual backdrop for this case need hardly be described in any detail, even six years later, because we all remember it well. The anthrax attacks of 2001 are etched into our memories not just because they were unprecedented—the first acts of bioterrorism on U.S. soil— but also, paradoxically, because they came right on the heels of the September 11, 2001 attacks and seemed to be related in some way. Pl.’s Statement of Undisputed Facts (“SOF”) ¶¶ 6-7. If one is inclined to consider the attacks as crime rather than warfare, then we deal here with the most notorious crime of a generation. It is an unsolved crime, but many people think they know who did it. They think they know that Steven Hatfill did it. And they think this because, for months stretching into years, that is what various DOJ and FBI officials led them to believe. SOF ¶ 87. Sometimes the officials did this in the open, at press conferences even, but more frequently they cloaked themselves in anonymity while leaking information about the anthrax investigation and Dr. Hatfill’s role in it. SOF ¶¶ 21-48, 62-86, 96-118. In doing so, they violated the Privacy Act. Their unlawful actions have left Dr. Hatfill a ruined man—ruined for the rest of his life as far as his career in biodefense is concerned, and ruined for the ages as far as his reputation is concerned. SOF ¶ 87, 175. It has never been possible to chase down each illegal leak, nor even each publication that contained illegal leaks—the Agency Defendants’ remarkable profligacy with investigative information made that impossible. Literally thousands of mainstream news stories have now linked Dr. Hatfill’s name to anthrax forever; Lexis-Nexis alone shows over 2800 such articles and broadcasts. SOF ¶ 175. The sheer number of investigative leaks attributed to FBI or DOJ in these stories has always been extremely damning for the Agency Defendants, for surely no one Case 1:03-cv-01793-RBW Document 229-2 Filed 04/11/2008 Page 4 of 40 can believe that virtually every major news outlet in the nation was engaging in simultaneous wholesale fabrication. Even more damning, however, is the content of these stories, which was typically detailed enough to show both that the leaks came from the Agency Defendants and that no competent law enforcement official could possibly think they were appropriate. Leakers told the news media not just that they were focusing their investigation on Dr. Hatfill, but why they were focusing on Dr. Hatfill: his alleged motive, his alleged ability to commit the crimes, and even the nature of the evidence that was supposedly being gathered against him. SOF ¶¶ 96-117. In some cases, the leakers said directly what others clearly implied: that investigators thought Dr. Hatfill had committed the attacks. See, e.g., SOF ¶¶ 113, 116. Leakers revealed specific investigative techniques being used against Dr. Hatfill, see, e.g., SOF ¶¶ 22-23, 62, 68, 96, 116, sometimes going so far as to reveal the time and place of future searches that were expressly linked to Dr. Hatfill. See, e.g., SOF ¶¶ 41, 101(a). Leakers described for reporters exactly what was found in searches connected with Dr. Hatfill, from the contents of his dumpster to the contents of his hard drive to the contents of a pond where he supposedly disposed of evidence. See, e.g., SOF ¶¶ 96(b), 96(c), 101(c), 113(b). Leakers told the news media about spooky- sounding projects on which Dr. Hatfill had worked—projects he undertook for this nation’s defense against bioterror attacks—and these often appeared in the press after varying degrees of embellishment. See, e.g., 101(b), 117. Dr. Hatfill’s driving record, his supposedly unflattering personality traits, and even his personal medical information were leaked with reckless abandon. See, e.g., SOF ¶¶ 18, 68(i), 106(l), 106(m), 113(e). At any trial of this case, the evidence would show to the satisfaction of any reasonable person that these and many other disclosures were made by FBI and DOJ officials. In many 2 Case 1:03-cv-01793-RBW Document 229-2 Filed 04/11/2008 Page 5 of 40 cases, the evidence would be uncontroverted. There are, for example, over 140 instances supported by direct testimony or admissions in which FBI or DOJ officials—some whose names we know, and some whose names we do not know—disclosed investigative records about Dr. Hatfill that were protected from public disclosure under the Privacy Act, 5 U.S.C. § 552a. See SOF ¶¶ 21-48, 62-86, 96-118. Exs. 201 & 202 (detailing disclosures by identified and unidentified FBI and Justice Department officials).1 In other cases, the evidence overwhelmingly suggests unlawful disclosure by FBI or DOJ, but there is at least a wisp of a denial that prevents us from treating the attribution to FBI or DOJ as uncontroverted for purposes of summary judgment. And in yet more cases, the identity of the leaker will simply never be known for sure, even though the nature of the information leaked amply justifies an inference of FBI or DOJ origin. E.g., SOF ¶96. All of these leaks, however, have two things in common: They contain information the Agency Defendants had a duty to keep secret, and they show that the Agency Defendants failed in that duty. Overt, direct disclosure is only one of the ways a federal agency can violate the Privacy Act. That statute also imposes more comprehensive obligations on agencies so that leaks of private information can be prevented as a matter of policy, rather than simply punished after the fact. Three of these more comprehensive obligations are at issue in Count III of the First Amended Complaint and in this motion. First, the Privacy Act requires that each covered agency establish rules of conduct for employees who deal with information about private citizens, and train those employees about the need to avoid unauthorized disclosures. See 5 U.S.C. § 552a(e)(9). Second, the Privacy Act also imposes on each covered agency an affirmative obligation to safeguard its records. See 5 U.S.C. § 552a(e)(10). Third, the Privacy Act requires 1 All exhibits cited herein are attached to the Declaration of Steven Fredley filed concurrently herewith. 3 Case 1:03-cv-01793-RBW Document 229-2 Filed 04/11/2008 Page 6 of 40 each covered agency to maintain an accounting of each disclosure of protected