Paragraph 21 of a sworn declaration filed in Manhattan federal court last March ends with a few lines of code. An event on a page called main_menu, at a time written as a ten-digit number, of a type called entry. Then a field_change, an exit and a hyperlink. The Census Bureau official who signed the declaration labeled the sample plainly: it was offered "(with completely fake data)," to show the court what a web paradata file looks like without showing any of it.2 The real file records how households moved through an online survey: when each page opened, where people clicked, what they typed, when they went back and changed an answer.
Last Friday, September 25, Judge Lewis J. Liman of the Southern District of New York decided who may see that file and its neighbors.1 The records come from a 2024 field test of questions on sexual orientation and gender identity for the American Community Survey, the Bureau's large continuing household survey. On January 20, 2025, the President signed an executive order directing federal agencies to use the term sex rather than gender in their policies and documents. The contractor's report on the test, dated that month, was never finalized or released.1 A professor asked for the report, and then for two data files, under the Freedom of Information Act, and sued when the Bureau refused. The court gave three different answers. He cannot have what respondents said. He can have the field names and column headings of the file that holds it. And he can have the report, in the version the Bureau's disclosure board reviewed.1
That looks like a split decision, but it follows one line, and it is a line anyone who collects data should be able to draw. On one side are the answers: what people reported about themselves, which the Census Act seals so firmly that no one has to argue about harm. On the other side is the instrument: the questions, the field names, and the study of how the questions worked, all written by the agency or for it. My argument is that a statistical agency can seal every answer and still owe the public the shape of what it asked. This is not a claim that the answers should be released, that the test should resume, or that the Bureau acted in bad faith. The court upheld the withholding of every answer, and nothing here takes a side on the questions or on the order.
The answers belong to the people who gave them, and the law keeps them.
The questions belong to the agency that wrote them, and so does the account of how they worked.
Two files and a report
The survey part is ordinary. The Bureau tests new content for the ACS about every five years, and it usually works in two stages: cognitive interviews to settle the wording, then a field test to decide what to change.9 For this test it printed the proposed questions in the Federal Register in September 2023 and estimated that 271,680 of the 480,000 sampled addresses would respond.8 The notice named the design question it cared about most: how the questions perform when one person at an address answers for everyone who lives there, which is how the ACS usually works.8 RTI International ran about 250 cognitive interviews, and the field test began in the summer of 2024.1
The second request asked for two files, and the Bureau's own declarant described them. The self-response file can be pictured as a spreadsheet: one row for every person, one column for every question asked and answer given. The web paradata file is not a table at all. It is XML that needs a parser to read, and it logs each page a respondent opened, keystrokes and clicks, any error message shown, and any return to an earlier question. In the ACS each question gets its own web page, so the log traces a path through the questionnaire one question at a time.2
Why the answers stay sealed
The Census Act says no Commerce Department employee may use what people furnish for anything but the statistical purpose it was supplied for, publish anything that identifies them, or let anyone but sworn employees examine the individual reports.4 FOIA's third exemption honors statutes like that.5 And in 1982, in a case about the Bureau's master address lists, the Supreme Court held that "raw data reported by or on behalf of individuals" need not be disclosed, whether the request comes under FOIA or in discovery.7
The obvious next move is to strip the identifiers. Remove names, phone numbers and anything else that points to a person, and release the rest. The court explained why that fails, with an example worth remembering. Each column of a response file is still census data. The Bureau could black out everything except age, and releasing the ages would still violate the Act.1 The protection attaches to what people reported, not only to who they are.
Nor could the court order the Bureau to make the files safe by statistical means. Disclosure avoidance, as the Bureau's declarant on the subject, Michael Hawes, described it, means assessing the risk that someone could be singled out or something inferred about them, and then adding enough uncertainty to bring that risk down.3 There is, he wrote, "no magic one-size-fits-all formula," because the risk depends on everything else already published from the same data and on outside data an attacker could combine with it.3 For ACS products the Bureau's main technique is swapping. The method is itself kept confidential, and every published table and microdata file is built from the swapped files.9 Doing that to the requested files, the court said, would alter the substance of the records themselves. That is making a new record, and FOIA does not require an agency to create one.1
Why the headings are different
Then the court turned to the top row of the spreadsheet. The professor argued that the field names were devised by Census staff, and that a label an employee wrote is not data anyone reported.1 The government did not claim otherwise. It did not argue that the field names and column headings were protected by the Census Act, or that removing every response would be hard. It argued that producing only the headings would amount to a different request. The court disagreed: a request for a file, read liberally, covers the file's headings too. It ordered the self-response file's field names and column headings produced.1
Why would anyone want a row of headings with nothing under them? Because the header row is the one place where a file says what it is. The Federal Register printed the proposed wording in 2023, but a proposal is not the fielded instrument. A schema records which items were actually built, in which versions, with which follow-ups. I do not know what these particular headings show, and the opinion does not say. What matters is which side of the line they sit on. Nobody outside the Bureau reported them.
The Bureau already treats headings this way when it publishes on purpose. Its public-use microdata come with a data dictionary that names every variable and its codes: AGEP is age, from 0 for under one year up to a top code of 99; SEX is coded 1 for male and 2 for female.11 The questionnaires themselves, back to 1996, sit on a public forms page.910 In those planned products the names are public from the start, and only the values beneath them go through disclosure review. The test file was never prepared for release, so its values stay sealed. Its labels need no preparation.
The paradata file is harder, and the court did not pretend otherwise. An XML log has no single header row. Its structure lives in element and attribute names, the event, page, time and type of the declaration's fake sample. Whether something like field names can be produced from it the court left to the parties to discuss, with a return to court if they cannot agree.1 That question is open. It is the honest edge of this argument.
Two kinds of no
The report shows the case's second mechanism. In 2016 Congress amended FOIA to add a harm test: an agency may withhold information only if it "reasonably foresees that disclosure would harm" an interest an exemption protects, or if the law forbids disclosure.56 The same paragraph says it requires nothing to be disclosed that falls under the third exemption.5 So there are two kinds of no. A statutory no, like the Census Act's, arrives with Congress's judgment already made; the agency does not have to show harm. A discretionary no, like the privilege for internal deliberation, the agency has to earn, record by record.
Once the Bureau's Disclosure Review Board had reviewed the report, the Bureau stopped relying on the Census Act to withhold it, which left only the deliberative process privilege.1 The court agreed that the recommendations were deliberative, the kind of material the privilege covers. But the Bureau's account of harm was general. The court's verdict on it fits in a sentence: "The same assertions could be made in every case."1 The record cut the other way too. The Bureau's own comments on the draft went to typos, grammar and clarity. The contractor had expected the report to be published, and the Bureau had told the Office of Management and Budget it would release at least one report on the aggregate results. Deliberation cannot be chilled, the court reasoned, if those deliberating never expected privacy.1
That asymmetry is what the case turns on. For the answers, Congress has already run the harm test, and the result is always no. For everything the agency wrote, the agency has to run the test itself and show its work, and a promise to publish makes the work harder to show.
The layer in between
Paradata sits awkwardly between the two. The instrument generates it, but it records what people did. Mick Couper's 1998 paper on survey quality in computer-assisted collection, usually cited as the start of paradata research, described keystroke files as automatic byproducts of the software, and listed web measures such as where respondents abandon a survey, when they back up to change an answer, and the time spent on each screen. He drew two lessons: if we collect such data we should use it, and we owe care to the people who provide it, "whether they do so knowingly or not."12 The ACS now uses paradata in routine operations, to help decide when to stop pursuing a household in the field.9 The court treated the raw paradata like the answers, as data from respondents, which fits Couper's warning. A click is reported as surely as an answer, even when no one meant to report it.1
Last week's dispatch here, The dots are a survey, not a plan, argued that a survey should be read with a survey's questions: who answered, and what they were asked. This case is the same idea from the collector's side. What people answered is theirs. What they were asked is the agency's, and it is part of the record. An earlier essay, A schema change is a change of promise, was about altering a schema that others depend on; this one is only about who may see it.
Objections, considered
Headings can leak. A field name can carry more than a label: a derived flag, a version code, a marker for a skip path. Value labels in a codebook can reveal answer categories, and the Bureau keeps even its swapping method secret.9 All true. But the government did not argue that these headings were protected, and the court ordered headings, not values. The fair lesson is that a schema needs its own disclosure review, the way a small cell in a table does. It is not a reason to treat every schema as secret by default.
The questions were already public, so headings add nothing. The proposed wording was printed in 2023.8 But a proposal is not the file that was fielded, and the professor asked for a record of what the Bureau actually built. I would keep this modest. No one outside the Bureau yet knows what these headings show, and they may show little that is new.
Releasing drafts chills candor, and one opinion is thin ground. Agencies need room to test ideas and be wrong. The court accepted that; it found the recommendations deliberative. The Bureau lost on proof, not on principle: its own edits were clerical, and the contractor expected publication. This is one district court on one record. It sets out what a showing of harm must look like, not a rule that drafts are public, and nothing here is legal advice.
An agency can promise to keep every answer secret and still have to show the world what it asked.
Before you seal the next file
- Sort each collection into layers. Know which parts the law seals, which you withhold by choice, and which are already public.
- Keep the instrument as its own record. The wording, the order and every version you fielded, preserved apart from the responses.
- Be able to hand over a header row and a codebook without touching a single response.
- Check whether your field names leak, the way you would check a small cell.
- For anything withheld by choice, state the harm as "would," not "could," for this record, not every record.
- Put paradata in the inventory, under the same rules as the answers.
Back to the lines in paragraph 21. Every value in them is fake, and in the real file every value would be sealed: the times, the pages each person opened, whatever they typed. Those are gold. The words that hold the values, event, page, time and type, are blue; the Bureau wrote them. Whether anyone may see those words for the real log is still being worked out. Last Friday settled the simpler case first: the answers stay with the people who gave them, and the questions belong to the record.