After reporting on the struggles of the US’s $44 million vaccine management system, we requested documents related to the CDC’s no-bid contracts for the underlying software, awarded to consulting giant Deloitte. The records we got back had significant redactions—including the company’s costs, the identities of those who worked on the project, and even Deloitte’s explanation for why it was qualified to do the job.

The CDC paid Deloitte to build a system that would help doctors manage vaccine inventory and report shots, let eligible people schedule appointments, and send out second-shot reminders and proofs of vaccination.

Months after the contracted deadline, Deloitte delivered a customized version of a preexisting Salesforce product called Vaccine Cloud. It was so difficult to use that only a handful of states signed up, as we reported in January. 

But the documents released under the Freedom of Information Act deliberately blocked certain pieces of information from the public record, including what prior experience Deloitte had with building similar tools and how charges like travel expenses and labor were justified or broken down. They also redacted the names of everyone involved—even the communications person assigned to the project, who would likely be responsible for speaking to the media.

As part of our reporting, we requested several Deloitte contracts unrelated to the vaccine system from the US Food and Drug Administration. That agency also redacted similar information.

“It's basically a rubber stamp“

All the redactions cite a rule in the Freedom of Information Act commonly referred to as Exemption 4, which allows companies to hide “commercial information” such as trade secrets from the public. 

The contractor, rather than the government, decides what is considered sensitive information. When a government agency receives a request for records, it sends that request to the contractors, who mark what they want to keep secret. 

Companies have essentially free rein to call contract details “confidential business information,” thanks to a 2019 decision by the Supreme Court. Before that, companies had to explain why releasing the information would cause “substantial harm” to their business. 

“Now all the agency has to do is get an affidavit from someone at the company that says, ‘We treat this as confidential business information.’ Period. Full stop,” says Victoria Baranetsky, the general counsel at the Center for Investigative Reporting. “It’s basically a rubber stamp.”