I have spent more than thirty years representing the people who get left holding the bill for someone else’s contaminated food. I have read more outbreak reports than I can count. And in all those years, I have learned to pay close attention not just to what a government agency tells the public, but to what it decides to hide.
So, when the FDA finally released its Executive Incident Summary on the ByHeart infant botulism outbreak, the first thing I looked for was the name of the company that supplied the powdered milk. It wasn’t there. In the single most important sentence of the document, the one tracing the contaminated ingredient back through the supply chain, the agency had blacked out two things: the name of the supplier and the place it operates. The sentence now reads that eight whole milk lot powders were traced to 33 fluid milk lots from a company FDA won’t name, located somewhere FDA won’t say.
Let me say plainly why that was the wrong call. And let me start with the part that should trouble any lawyer who has ever filed a public records request.
The wrong exemption for the wrong reason
When a federal agency withholds information, it has to cite a legal basis. FDA stamped these redactions with exemption (b)(5). That is the deliberative-process privilege. It exists to protect the give-and-take of internal agency decision-making, draft opinions, recommendations, the pre-decisional back-and-forth that helps officials reach a conclusion. It is not a tool for hiding facts.
The name of a milk supplier and the state it sits in are not anyone’s deliberations. They are findings. They are the factual result of a traceback investigation, the kind of bedrock fact a public health record exists to convey. Even the exemption that might at least be argued here, (b)(4), which covers confidential commercial information, would be a stretch given what’s already public. But (b)(5) isn’t even the right neighborhood. Using the deliberative-process privilege to black out a company’s name reads less like a careful legal judgment and more like reaching for whatever stamp was closest to hand. When the government has to misapply a privilege to keep a fact from the public, that is usually a sign the fact should have been public all along.
A redaction that protects no one
This outbreak sickened 48 infants across 17 states. Every single one of them was hospitalized. The youngest victims of any foodborne outbreak are the ones who can do nothing to protect themselves, and botulism in a baby is about as frightening a diagnosis as a parent can hear: a toxin that attacks the nervous system and causes paralysis, treatable only with a specialized antitoxin made from pooled human plasma.
These families did everything right. They bought a premium formula marketed as the next-best thing to breast milk. What they got was a product whose contamination, by FDA’s own case definition, reaches all the way back to March 23, 2022, the very day ByHeart began manufacturing. The agency drew the outbreak’s starting line at the company’s first day in business and then declined to name the supplier that fed into it.
Here is the part that should bother every one of us. The name isn’t actually a secret. Dairy Farmers of America has already confirmed, publicly and on the record, that its plant in Fallon, Nevada dried the milk, that Organic West was the source of the milk in the sample the FDA collected, and that Organic West sold the resulting powder to ByHeart. Trade publications have walked the entire chain in detail: roughly 55 organic farms shipping to Organic West, the milk dried into organic whole milk powder at the DFA facility, and that powder going into ByHeart’s formula before testing found botulinum toxin in sealed cans and in the ingredient itself.
So, the FDA redacted a name that the implicated processor has already volunteered to the world. That is not protecting an investigation. That is not guarding a trade secret. And here is the detail that turns an odd decision into an indefensible one: FDA named these very companies in its own public outbreak advisory. The agency’s February 26 advisory states in plain text that the milk powder isolates were collected at Dairy Farmers of America, the processor for ByHeart’s supplier, Organic West Milk. The agency put the names in one official document and then blacked them out of another, citing a privilege, while the underlying fact sat published on its own website. You cannot credibly claim a name must be withheld to protect anything when you have already printed it yourself.
It matters all the more because the abstract concedes the investigation came up empty on the central question. In FDA’s own words, the findings could not identify the source or root cause of the contamination. When an agency cannot tell the public why a product poisoned 48 babies, the least it owes them is a complete account of what it did learn, including where the ingredient came from. Redacting the one concrete link in the chain, after admitting you never found the cause, leaves the public with less than the facts already on the record.
Transparency is not a courtesy, It is the job.
People sometimes forget what these reports are for. An outbreak summary is not a press release for the companies involved. It is a public health document. Its purpose is to tell parents, pediatricians, regulators, and yes, other formula makers, what went wrong so that it does not happen again.
When you redact the supplier, you take that knowledge away from exactly the people who need it. Other manufacturers buying organic whole milk powder have a direct interest in knowing whose product was implicated and how. Public health officials in 17 states have an interest in a complete record. And the families whose babies spent weeks in hospital beds have a right to know the full path the contamination traveled to reach their kitchen counters. Withholding the name does not make anyone safer. It only makes accountability harder.
I have said for years that the FDA and the CDC too often decide that the public can handle less information than it can. We saw it with the romaine outbreaks. We are seeing it again here. The instinct toward secrecy is presented as caution. In practice it is the opposite of caution, because nothing invites a repeat outbreak faster than a record the next manufacturer cannot learn from.
Secrecy lets the finger-pointing win
There is a practical consequence to all this beyond principle. When the government keeps the supply chain in the dark, it hands the companies involved the power to write the story themselves.
That is already happening. The Dairy Farmers of America has put out a statement saying its powder met all required tests and reminding everyone that manufacturers of end-use consumer products have a responsibility to properly process ingredients to ensure product safety. Translation: not our problem, it was ByHeart’s job to control for this. ByHeart, for its part, declined to identify the source of the milk powder samples its own testing flagged. Each link in the chain is busy positioning blame at the next link, and the FDA’s redaction simply gives them more room to do it in the shadows.
Meanwhile we know what the FDA found inside ByHeart’s own operation. As far back as December 2023, the agency raised warnings, after inspectors documented a leaking roof, mold in a water tank, and 2,500 dead flies in a food production area at the company’s plant. Inspectors also found the facility violating its own rules for maintaining the temperatures needed to kill bacteria before packaging. That is the record. The public deserves to weigh it alongside a full and unredacted account of where the contaminated ingredient came from, not a version with the inconvenient names removed.
What the agency should do now
The fix is simple. Reissue the abstract without the redactions, or at minimum drop the (b)(5) stamp that never fit a factual finding to begin with. Name the supplier and its location the way the agency already named them in its own advisory. Stop treating a public health record as a document to be negotiated with the companies it describes.
I am not asking the FDA to assign legal blame. That is what courts are for, and the civil justice system will sort out responsibility among the farms, the processor, and the manufacturer with the benefit of full discovery. What I am asking is far more basic: that the agency charged with protecting our food supply tell us the truth, completely, when babies have been hospitalized in 17 states and the agency itself admits it never found the cause.
Forty-eight families learned the hard way that the system failed them. The least the FDA can do is give them, and the rest of us, an honest accounting. A black box where a name should be, propped up by a privilege that doesn’t fit, is not an honest accounting. It is the agency deciding, one more time, that we are better off not knowing.