A little over a year ago, in January 2025, I wrote in this space asking a simple question about the November 2024 E. coliO157:H7 romaine outbreak: why would the FDA not tell the public who grew, processed, and sold the lettuce that sickened 89 people across 15 states, hospitalized 36, gave 7 of them hemolytic uremic syndrome, and killed one? The agency had quietly announced the outbreak was over, called the vehicle a “common supplier” of romaine lettuce, and left it there. No grower. No processor. No names.
I said then that I would weigh in where the FDA would not. I have now spent the months since doing exactly that — staying on the agency until it unredacted the documents it should never have hidden in the first place. The documents are now in hand, and they tell the story the gray boxes were built to keep from you.
Here is the short version of how this played out.
When the FDA first released its traceback investigation summary for this outbreak (CARA #1280), nearly every name that mattered was blacked out under the (b)(4) exemption — the part of the Freedom of Information Act meant to shield genuine confidential commercial information and trade secrets. The processor was a gray box. The grower was a gray box. The ranch was a gray box. The distribution centers, the brokers, the lot codes — all gray boxes. What the public was left with was a document that confirmed romaine lettuce as the vehicle but told you absolutely nothing about whose romaine it was or where it came from.
So, I did what I always do. I stayed on them. And the FDA, in stages, unredacted the document.
The fully unredacted version now identifies, in plain text, what the (b)(4) boxes were hiding:
- Taylor Farms of California (Salinas, CA; FEI 3012342127) was the sole processor. The summary states that Taylor Farms “supplied all the romaine lettuce that would have been available at all points of sale during the timeframe of interest.”
- Anthony Costa & Sons LLC (Soledad, CA) was the single grower.
The records also fill in the other end of the chain, and that too was originally redacted. The unredacted summaries name Andre’s Banquets and Catering of St. Louis, Missouri (1 of the 15 states) as the caterer at the center of the largest cluster of illnesses — the events where many of these people actually ate the lettuce. The traceback ties Andre’s to three separate catered events with meal dates of November 6 through 8, 2024, including a marching band banquet and a Veteran’s Day luncheon at a St. Louis-area high school, with twenty-two cases linked to that point of service alone. The lettuce blend Andre’s served was supplied through its distributor and traced straight back up the chain to Taylor Farms and Anthony Costa & Sons. But the public had no way to know any of that while the caterer’s name, the school events, and the supplier above them all sat behind the same gray boxes — which meant the families who got sick at those events could not see, in the agency’s own records, how the lettuce on their plate connected to the field it came from.
None of that is a trade secret. The identity of the company that processed lettuce that killed someone is not confidential commercial information. The name of the farm that grew it is not a trade secret. A harvest date is not a proprietary formula. These are the basic facts of a public health disaster, and the only thing the redactions accomplished was to delay the moment when the public — and the families of the people who were hospitalized — could learn who was responsible.
I have been making this same point for years, and I will make it again here, because the FDA keeps forcing me to. Formulations, ingredients, and how products are made are trade secrets. Who supplied the tainted raw material, who made the tainted product, and where the tainted product was sold are not — especially during an outbreak. That line is not hard to draw. The agency simply refuses to draw it.
This matters for a reason that goes well beyond my own irritation. While those names sat behind gray boxes, the companies were free to take the position, in the investigation and elsewhere, that the evidence did not point to them. I have watched that move many times: a processor reviews its own internal traceability, announces it “determined there were no commonalities identified,” and lets the redactions do the rest of the work. But the FDA’s own records told a different story. The agency’s traceback identified a single processor and a single grower, found that the implicated product was available at every point of service, and tied it to specific lots. The unredacted document does not leave room for “it wasn’t us.” It was them. The records say so, by name.
That is exactly why over-redaction is not a harmless bureaucratic habit. When the FDA blacks out the name of the processor and the grower in a fatal outbreak, it is not protecting a trade secret — it is handing the responsible companies a period of deniability they did not earn, and the public did not consent to. The (b)(4) exemption was written to protect genuine competitive information, not to spare a lettuce processor the embarrassment of being named in connection with the produce it sold.
We do not have to guess whether transparency would cause the sky to fall, because we have already run the experiment. For most of the 2000s the USDA’s Food Safety and Inspection Service would name the manufacturer of E. coli-contaminated meat but refused to reveal where it was sold. I still remember people sickened in the 2002 ConAgra outbreak telling investigators they had heard about the recall but figured it did not apply to them because “we bought our meat at Safeway, not at ConAgra.” In 2008, after years of industry hand-wringing about distribution lists, FSIS finally concluded that naming retailers would not cause substantial competitive harm and began releasing the lists. Retailers of USDA-regulated products survived. Trade secrets did not collapse. Consumer confidence went up, not down. Chicken Little, the sky did not fall.
The FDA, which oversees roughly 80 percent of the food supply, could have learned that lesson from its sister agency two decades ago. Instead, it is still hiding behind “confidential commercial information,” and consumers are still left confused — not by too much information, but by too little. The most egregious example I know of remains the 2017 outbreak tied to I.M. Healthy soy nut butter — a great name for a product carrying a pathogen — which sickened dozens, some of them children, seriously. A recall was announced but no retailers were named, the company went bankrupt and had no interest in helping, and the product stayed on shelves and online for months after the recall. That is what secrecy buys you: contaminated product still within reach of the next family while the agency guards a “secret” that protects no one but the seller.
Years ago, a senior CDC official defended withholding company names by saying the practice protects not only public health but also “the bottom line of businesses that could be hurt by bad publicity.” I have a great deal of respect for the people in the diarrheal trenches, but that explanation has always had it exactly backwards. The government does not exist to protect a company’s bottom line from the consequences of selling food that hurts people. Protecting the public sometimes means the responsible company takes a reputational hit. That is not a bug in transparency. That is the point of it.
I would put the principle simply. When people are hospitalized and someone dies, the public’s interest in knowing who grew and processed the food is at its highest, and the commercial interest in staying anonymous is at its lowest. The FDA’s redaction practice in cases like this one inverts that balance. It treats the names of the firms as the secret most in need of protection, when the names are the single most important thing the public is entitled to know.
I am glad the FDA eventually unredacted this one. I should not have had to ask. The next family should not have to wait for a lawyer to pry the names loose months after the outbreak is over and the lettuce is long gone. If the agency genuinely wants to rebuild public trust in how it handles foodborne illness, it can start by drawing the (b)(4) line where the statute actually puts it — and by remembering that the public reporting on an outbreak is supposed to inform the public, not shield the companies.
The lettuce in this outbreak was grown by Anthony Costa & Sons and processed by Taylor Farms. The FDA’s own records say so. There was never a good reason for anyone to have to guess.