Long v. Immigration and Customs Enforcement

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

_________________________________________
)
SUSAN B. LONG, et al., )
)
Plaintiffs, )
)
v. ) Case No. 14-cv-00109 (APM)
)
IMMIGRATION AND CUSTOMS )
ENFORCEMENT, et al., )
)
Defendants. )
_________________________________________ )

MEMORANDUM OPINION AND ORDER

I. INTRODUCTION

Plaintiffs Susan B. Long and David Burnham brought this action against Defendants

Immigration and Customs Enforcement (“ICE”) and Customs and Border Protection (“CBP”)

pursuant to the Freedom of Information Act (“FOIA”) to challenge the agencies’ responses to

seven FOIA requests that Plaintiffs submitted between October 13, 2010, and February 26, 2013.

In these requests, Plaintiffs sought a “complete set of documentation” on two databases used by

both agencies as well as “snapshots” of data contained within one of the databases. Plaintiffs

submitted the requests on behalf of the Transactional Records Access Clearinghouse at Syracuse

University, which collects, organizes, and distributes data concerning federal government

enforcement activities. In response to Plaintiffs’ requests, Defendants produced some responsive

documents but withheld or redacted many others, prompting this lawsuit.

After two rounds of summary judgment briefing, the court concluded that an evidentiary

hearing was necessary to resolve two lingering issues related to ICE’s invocation of Exemption

7(E) to withhold certain material responsive to Plaintiffs’ first three FOIA requests—all of which
were directed only to Defendant ICE (“Defendant” or “ICE”). 1 Those issues are as follows:

(1) whether ICE properly withheld metadata and database schemas in response to Plaintiffs’ first

two FOIA requests because disclosure could reasonably be expected to risk circumvention of the

law; and (2) whether the materials or documents used to produce a summary document ICE

prepared in response to Plaintiffs’ third FOIA request were compiled for law enforcement

purposes, and whether the release of the summary document in full could reasonably be expected

to risk circumvention of the law.

Considering the evidence presented at the evidentiary hearing, as well as the arguments

presented in the parties’ briefs, supplemental memoranda, and at oral argument, the court

concludes that, as to Plaintiffs’ first and second FOIA requests, ICE reasonably concluded that

comprehensive disclosure of all requested information could risk circumvention of the law.

However, it appears that ICE may have withheld codes, code translations, field names, and table

names that can reasonably be segregated from otherwise properly exempt materials. Therefore,

the court orders ICE to conduct a segregability analysis as to these records. As to Plaintiffs’ third

FOIA request, ICE still has not provided any information indicating whether the underlying

materials used to produce the summary document were compiled for law enforcement purposes.

Accordingly, the court orders disclosure of that document in full, subject to the Exemption 6

withholdings the court previously approved.

II. BACKGROUND

The court has described the factual background and procedural history of this case at great

length in previous memorandum opinions, see Long v. ICE (Long I), 149 F. Supp. 3d 39, 43–47

(D.D.C. 2015); Long v. ICE (Long II), 279 F. Supp. 3d 226, 230 (D.D.C. 2017), and need not

1
The court previously granted summary judgment in favor of Defendant CBP on all issues pertaining to the requests
directed to that agency. Thus, the court refers to ICE as the sole “Defendant” throughout this opinion.

2
repeat those details here. The court thus recites only what is necessary to resolve the remaining

issues concerning Plaintiffs’ first three FOIA requests, which survived summary judgment and

formed the subject of the evidentiary hearing held on May 8 and 9, 2018. 2

A. FOIA Requests I and II

In their first two FOIA requests, Plaintiffs sought “a complete set of documentation” on

two databases owned and operated by ICE, which both ICE and CBP use to manage cases

pertaining to the detention of undocumented immigrants: the Enforcement Integrated Database

(“EID”) and the Integrated Decision Support Database (“IIDS”). Long I, 149 F. Supp. 3d at 44–

45; see also Defs.’ Mot. for Summ. J., ECF No. 17 [hereinafter Defs.’ Mot.], Ex. 1, ECF No. 17-

3 [hereinafter FOIA Request I]; Defs.’ Mot., Ex. 8, ECF No. 17-3 [hereinafter FOIA Request II].

1. FOIA Request I

Plaintiffs’ first request, dated October 13, 2010, sought records related to the EID. See

FOIA Request I. “The EID is the main repository of data for the enforcement of immigration law

[by] ICE and CBP.” 5/8/2018 Hr’g Tr., ECF No. 62 [hereinafter Day 1 Tr.], at 16:1-2. It “captures

and maintains information related to the investigation, arrest, booking, detention, and removal of

persons encountered during immigration and criminal law enforcement investigations and

operations conducted by” ICE and CBP. Long I, 149 F. Supp. 3d at 44 (quoting Defs.’ Mot., Decl.

of Karolyn Miller, ECF No. 17-1 [hereinafter Miller Decl.], ¶ 12); accord Day 1 Tr. at 16:5-13.

The EID contains, among other things, “an array of personally identifiable information about

persons detained for violating the Immigration and Nationality Act, including names, aliases, dates

of birth, telephone numbers, addresses, Alien Registration Numbers, Social Security Numbers,

passport numbers, and employment, educational, immigration, and criminal histories.” Long I,

2
For the sake of brevity, the court cites to its previous memorandum opinions as authority for stated facts that are
either undisputed or immaterial for purposes of resolving the narrow issues that remain in the litigation.

3
149 F. Supp. 3d at 44 (citing Miller Decl. ¶ 12); see Day 1 Tr. at 16:5-11. It also contains

information about arresting officers, the facility of detention for each immigrant taken into ICE’s

custody, and other investigative and sensitive law-enforcement information. See Day 1 Tr. at

16:11-13, 19:3-8; see also Sealed 5/8/2018 Hr’g Tr., ECF No. 58 [hereinafter Sealed Day 1 Tr.],

at 119:1–120:9.

ICE uses the EID “to manage cases from the time of an undocumented immigrant’s

detention through the person’s final case disposition.” Long I, 149 F. Supp. 3d at 44 (citing Defs.’

Mot., Decl. of Fernando Pineiro, ECF No. 17-2 [hereinafter Pineiro Decl.], ¶ 47). The EID is also

used by other components within the Department of Homeland Security, such as the CBP and U.S.

Citizenship and Immigration Services, as well as other federal agencies, such as the Department

of State, the Federal Bureau of Investigation, and the Social Security Administration. See Day 1

Tr. at 16:14–18:6.

Plaintiffs’ request for “a complete set of documentation on the [EID]” included:

(1) a copy of the records identifying each and every database table
in the EID and describing all fields of information that are stored in
each of these tables. . . .
(2) a copy of records defining each code used in recording data
contained [in] the EID. This is a request for the contents of specific
auxiliary tables—often referred to as code or lookup tables—within
the database itself where this information is stored. . . .
(3) a copy of the EID’s database schema[,] [i.e.,] a specific class of
records included in [the] database system that sets forth how the
database tables are interlinked[;] [and]
(4) records that identify the [Database Management System]
software (e.g., Oracle, DB2, Sybase, SQL Server, etc.) including
[the] Version No. used for the EID.

FOIA Request I at 1.

4
 2. FOIA Request II

Plaintiffs’ second request, dated October 18, 2010, sought the same information regarding

the IIDS that the first request sought regarding the EID. Long I, 149 F. Supp. 3d at 44–45; see

FOIA Request II. The IIDS is “a subset of the EID database repository . . . [that] provides a

continuously updated snapshot of selected EID data.” Long I, 149 F. Supp. 3d at 44 (alterations

in original) (quoting Miller Decl. ¶ 13); accord Day 1 Tr. at 18:16-18. Its intended purpose is “to

query EID data for operational or executive reporting purposes and is typically used to generate

management reports and statistics from EID data.” Long I, 149 F. Supp. 3d at 44–45 (quoting

Miller Decl. ¶ 13); see also Day 1 Tr. at 18:13-18 (describing the IIDS as ICE’s “reporting

system”); id. at 19:11-24 (noting that the IIDS is used to produce regular reports on all enforcement

actions as well as ad hoc reports for policymakers). Accordingly, the IIDS contains a subset of

information from the EID “that can be counted statistically,” Day 1 Tr. at 18:20-24, including

“biographic information, information about encounters between agents/officers and subjects, and

apprehension and detention information about all persons in EID,” Long I, 149 F. Supp. 3d at 45

(quoting Miller Decl. ¶ 13). The IIDS is also used by ICE to respond to FOIA requests for certain

data relating to its enforcement activities, including those submitted by the Transactional Records

Access Clearinghouse, or “TRAC,” on an ongoing basis. See Day 1 Tr. at 58:20-24; see also Long

v. Immigration & Customs Enf’t, No. 17-cv-01097 (APM), 2018 WL 4680278, at *2 n.4 (D.D.C.

Sept. 28, 2018). 3

In summary, Plaintiffs’ first two FOIA requests sought records that (1) identified the names

of EID and IIDS database tables and fields, (2) defined codes used to record data in those

3
Plaintiffs’ monthly requests for updated, anonymous, case-by-case information about persons removed as a result of
one of ICE’s immigration enforcement programs is the subject of another case currently pending before this court.
See Long v. Immigration & Customs Enf’t, No. 17-cv-1097 (D.D.C. filed June 8, 2017).

5
databases, (3) set forth the database schemas (that is, the way various database tables connect to

each other), and (4) disclosed the particular software and version number used for the databases.

3. ICE’s Response to FOIA Requests I and II and the Parties’ Motions for
Summary Judgment

In response to Plaintiffs’ requests, ICE released 97 pages, with redactions, and withheld

the remaining responsive information pursuant to FOIA Exemption 7(E), 4 which protects from

disclosure “records or information compiled for law enforcement purposes” if their disclosure

“would disclose techniques and procedures for law enforcement investigations or prosecutions, or

would disclose guidelines for law enforcement investigations or prosecutions if such disclosure

could reasonably be expected to risk circumvention of the law.” 5 U.S.C. § 552(b)(7)(E). In ruling

on the parties’ initial motions for summary judgment, the court held that the withheld material

responsive to Plaintiffs’ first two requests constituted records or information compiled for law

enforcement purposes that qualified at least as law enforcement guidelines, if not also law

enforcement methods and techniques. See Long I, 149 F. Supp. 3d at 48–50. The court also held

that the claimed risk associated with disclosure of the EID and IIDS metadata and database

schemas—the threat of a successful cyberattack on the databases—was “the kind of risk of

circumvention of the law that justifies withholding” under Exemption 7(E). Id. at 51.

Nevertheless, the court denied summary judgment, reasoning that it was unclear whether

disclosure of the metadata and database schemas could reasonably be expected to risk

circumvention of the law. Id. at 53–54. After giving ICE an opportunity to supplement the record

and allowing the parties to renew their motions for summary judgment, the court reached the same

4
The 97 redacted pages released by ICE were responsive only to Plaintiffs’ second FOIA request, which sought
records relating to the IIDS. See Pineiro Decl. ¶¶ 16–19. ICE did not produce any information in response to
Plaintiffs’ first FOIA request concerning the EID, on the grounds that “the release of any additional responsive
records . . . would expose ICE’s sensitive law enforcement data systems.” Id. ¶ 15.

6
conclusion once more, holding that genuine disputes of material fact remained as to the

reasonableness of ICE’s expectation of risk. See Long II, 279 F. Supp. 3d at 238–39. The court

concluded that an evidentiary hearing was required to resolve the parties’ dispute. Id. at 245.

B. FOIA Request III

Plaintiffs’ third FOIA request, dated September 21, 2012, sought information relating to

“snapshots” and extracts of the EID over a 12-month period. Long I, 149 F. Supp. 3d at 45; Long

II, 279 F. Supp. 3d at 230–31, 239. In particular, Plaintiffs requested records identifying

(1) “extracts and ‘snapshots’ prepared from the [EID] over the last 12 months,” along with records

relating to (2) “the frequency with which such extracts and snapshots have been prepared”;

(3) “who was responsible for preparing any snapshot or extract”; (4) “the recipient(s) of th[e]

extracts/snapshots”; and (5) “the EID system time required in their preparation during this period.”

Defs.’ Mot., Ex. 14, ECF No. 17-3 [hereinafter FOIA Request III]. In response to this request,

ICE created a nine-page document (“the Nine-Page Document”) summarizing the responsive

materials and released a redacted version of that document. Long II, 279 F. Supp. 3d at 231; see

also Pineiro Decl. ¶ 27. ICE did not, however, release the original responsive materials. Long II,

279 F. Supp. 3d at 231.

Of the five categories of materials sought in Plaintiffs’ third FOIA request, see id. at 239,

only the first, second, and fifth categories remain at issue, see id. at 241. 5 ICE withheld

information responsive to these three categories—specifically, “the timing and frequency of

snapshots, as well as the names of the law enforcement systems that interact with a particular EID

module”—pursuant to Exemption 7(E). See id. at 241; see also Defs.’ Suppl. Br. in Supp. of Defs.’

5
The court granted summary judgment in favor of ICE with respect to its withholding of the third and fourth categories
of information, i.e., the names, phone numbers, and email addresses of employees who manage the systems with
which the EID module interacts, pursuant to Exemption 6. See Long II, 279 F. Supp. 3d at 243–45.

7
Mot. for Summ. J., ECF No. 35 [hereinafter Defs.’ Suppl. Summ. J. Br.], at 18–20, 25–26; Notice

of Suppl. Evidence, ECF No. 32, Suppl. Decl. of Jeff Wilson, ECF No. 32-2, ¶¶ 15–27, 44–49;

Notice of Filing Suppl. Vaughn Index, ECF No. 24, Vaughn Index, ECF No. 24-2, at 10 (No. 14).

The court denied summary judgment on this issue because ICE failed to present any

evidence indicating what materials or documents were relied upon to create the Nine-Page

Document and whether those materials or documents were “compiled for law enforcement

purposes,” 5 U.S.C. § 552(b)(7). See Long II, 279 F. Supp. 3d at 241–43. Absent such evidence,

the court explained, the court could not discern whether any portion of the Nine-Page Document

was eligible to be withheld pursuant to FOIA Exemption 7. Id. at 243. Moreover, the court

explained that even if it were to assume that the Nine-Page Document was created from materials

compiled for law enforcement purposes, the court still would be unable to determine whether ICE

properly invoked Exemption 7(E) to redact information relating to the timing and frequency of

snapshots, as ICE relied on the same rationale that it did to withhold materials responsive to

Plaintiffs’ first two FOIA Requests. Id. at 243 n.8. 6 Accordingly, the court held that an evidentiary

hearing was necessary to resolve this issue, as well. See id. at 245; see also 10/12/2017 Draft Hr’g

Tr. at 14–15.

C. Evidentiary Hearing

On May 8 and 9, 2018, the court held an evidentiary hearing to resolve the parties’ dispute

related to the propriety of ICE’s invocation of Exemption 7(E) to withhold EID and IIDS metadata

and database schemas as well as certain material responsive to Plaintiffs’ third FOIA request for

information concerning EID extracts and snapshots. During the hearing, the court heard

6
Because the court denied summary judgment as to the applicability of Exemption 7(E) to withhold the
abovementioned portions of the Nine-Page Document, the court saved for another day the question whether ICE
properly segregated any materials potentially exempt under Exemption 7(E) from non-exempt material. Id. at 244–
45.

8
testimony—both in open court and in a sealed, ex parte session—from government witness Tadgh

Smith, the Deputy Assistant Director for ICE’s Law Enforcement Systems and Analysis Division

(“LESA”) of Enforcement Removal Operations. See 5/8/2018 Minute Entry. The court also heard

testimony from two witnesses called by Plaintiffs: (1) Plaintiff Susan Long, who serves as a co-

director of TRAC and who submitted the underlying requests at issue in this case, and (2) Dr. Paul

Clark, who serves as the President and Chief Technology Officer of SecureMethods, Inc., and Paul

C. Clark, LLC, and who Plaintiffs offered as an expert in computer security and design. See id.;

5/9/2018 Minute Entry.

Following the evidentiary hearing, each party submitted a supplemental memorandum,

summarizing the evidence that supported their respective positions concerning the application of

Exemption 7(E). See generally Def.’s Post-Evidentiary H’rg Suppl. Mem., ECF No. 60

[hereinafter Def.’s Suppl. Mem.]; Pls.’ Post-Hr’g Suppl. Mem., ECF No. 61 [hereinafter Pls.’

Suppl. Mem.]. The court held oral argument on these submissions on July 27, 2018. 7/27/2018

Minute Entry. 7

III. LEGAL STANDARD

“The basic purpose of FOIA is to ensure an informed citizenry, vital to the functioning of

a democratic society, needed to check against corruption and to hold the governors accountable to

the governed.” NLRB v. Robbins Tire & Rubber Co., 437 U.S. 214, 242 (1978). Because of

FOIA’s critical role in promoting transparency and accountability, “[a]t all times courts must bear

in mind that FOIA mandates a ‘strong presumption in favor of disclosure.’” Nat’l Ass’n of Home

Builders v. Norton, 309 F.3d 26, 32 (D.C. Cir. 2002) (quoting U.S. Dep’t of State v. Ray, 502 U.S.

7
Some of the delay in resolving this matter is attributable to the parties’ eight-month-long efforts to settle this matter
and the related case, Long v. Immigration & Customs Enf’t, No. 17-cv-1097, which concluded in late July 2019.
See 17-cv-1097, Joint Status Report, ECF No. 30. Nevertheless, the court regrets the length of time it has taken to
issue this decision.

9
164, 173 (1991)). FOIA requires federal agencies to release all agency records responsive to a

request for production, see 5 U.S.C. § 552(a)(3)(A), unless the records fall within one of nine

narrowly construed exemptions, id. § 552(b); see Vaughn v. Rosen, 484 F.2d 820, 823 (D.C. Cir.

1973). “The agency bears the burden of establishing that a claimed exemption applies.” Citizens

for Responsibility & Ethics in Wash. v. U.S. Dep’t of Justice (“CREW”), 746 F.3d 1082, 1088

(D.C. Cir. 2014). Moreover, “even when an exemption applies, the agency is obligated to disclose

‘any reasonably segregable portion of a record’ after removing the exempt material and must note

the ‘amount of information deleted, and the exemption under which the deletion is made.’” Bartko

v. U.S. Dep’t of Justice, 898 F.3d 51, 62 (D.C. Cir. 2018) (cleaned up) (quoting 5 U.S.C. § 552(b)).

Although the vast majority of FOIA cases are appropriately resolved on motions for

summary judgment, the D.C. Circuit has observed that summary judgment is “not always” proper

in a FOIA case. Brayton v. Office of the U.S. Trade Representative, 641 F.3d 521, 527 (D.C. Cir.

2011). Summary judgment is inappropriate where “there is a conflict in the affidavits as to what

adverse consequences will flow from” disclosure of the materials withheld by the agency. Sears,

Roebuck & Co. v. Gen. Servs. Admin., 553 F.2d 1378, 1382 (D.C. Cir. 1977); see Gov’t

Accountability Project v. FDA, 206 F. Supp. 3d 420, 430 (D.D.C. 2016) (noting that while courts

“routinely resolve FOIA disputes in the summary judgment context,” summary judgment cannot

be granted “if dueling affidavits create a genuine dispute over issues of material fact”). “Resolving

issues of material fact in FOIA cases has, for example, required a bench trial to determine the

propriety of exempting certain documents from release under the FOIA, or

an evidentiary hearing.” Scudder v. CIA, 25 F. Supp. 3d 19, 29 (D.D.C. 2014) (internal citation

omitted).

10
 Because evidentiary hearings are rare in the FOIA context, the case law outlining the

standards that govern those proceedings is unsurprisingly thin. Nevertheless, the court agrees with

Plaintiffs that “in those rare cases where, as here, facts bearing on exemption are genuinely

disputed, the agency’s burden requires it to prove by a preponderance of the evidence that the

factual dispute should be resolved in its favor.” Pls.’ Suppl. Mem. at 13–14; 8 cf. Nat’l Parks &

Conservation Ass’n v. Kleppe, 547 F.2d 673, 679–83 (D.C. Cir. 1976) (reviewing for clear error a

trial court’s findings—following a two-day evidentiary hearing—that certain factual predicates for

an agency’s withholding under Exemption 4 were supported by “[t]he preponderance of the

evidence”).

IV. DISCUSSION 9

A. FOIA Requests I–II: EID and IIDS Metadata and Database Schemas

The court begins by determining whether ICE properly withheld EID and IIDS metadata

and database schemas under Exemption 7(E) in response to Plaintiffs’ requests for complete

documentation of the EID and IIDS, respectively. Due to the technical nature of these requests,

the court starts with the basics, providing a brief summation of the specific types of records

requested by Plaintiffs before turning to ICE’s justification for withholding the metadata and

database schemas.

8
While ICE’s post-hearing supplemental memorandum does not outline a particular standard to be applied, see Def.’s
Suppl. Mem., the agency did not take issue with the standard proposed by Plaintiffs, or advocate any other standard
that should apply, at oral argument, see 7/27/2018 Draft Hr’g Tr.
9
The court treats the Discussion section as the required findings of fact and conclusions of law under Federal Rule of
Civil Procedure 52(a). Cf. Kleppe, 547 F.2d at 679 (reviewing a district court’s findings following a FOIA evidentiary
hearing under the standards set forth in Rule 52(a)). The court’s factual findings are not set forth in a separate section
in the opinion, as the parties’ remaining dispute by and large concerns the inferences of risk that can be drawn from
otherwise undisputed facts.

11
 1. Nature of the Information Requested

As discussed, Plaintiffs’ first two FOIA requests seek a complete set of documentation for

the EID and IIDS databases, including: (1) a copy of records identifying the database tables and

describing all fields of information stored within those tables; (2) a copy of records defining each

code used to record data in the database, including the contents of any “code or lookup tables” in

the databases; (3) a copy of the database schemas, i.e., the records in database systems that set

forth how tables are interlinked; and (4) records identifying the Database Management System

software and version number used for the databases. At this juncture, only the first three categories

of records remain in dispute. 10

a. Database tables and fields

Information within a database is organized into database “tables,” which contain data on a

particular subject. Day 1 Tr. at 136:12-21; accord Miller Decl. ¶¶ 7–8. The database tables can

be analogized to the Excel spreadsheets that ICE typically uses to produce information from the

databases. See Day 1 Tr. at 136:12-14; Miller Decl. ¶ 8; cf. Day 1 Tr. at 58:20–59:2, 71:7-16,

74:12-19. The tables typically comprise multiple “fields” of data, which correspond to columns

in a spreadsheet. See Day 1 Tr. at 53:19-22, 59:3-16, 63:1-6, 73:2-13, 74:15–75:9, 98:2-23,

136:22-25, 170:12-16; 5/9/2018 Hr’g Tr., ECF No. 57 [hereinafter Day 2 Tr.], at 53:5–17; see also

Miller Decl. ¶ 8. Rows within each table are the equivalent of a single record, which is a collection

of information about a specific person or event (depending on the topic around which the table is

organized). Miller Decl. ¶ 8; accord Day 1 Tr. at 136:16-25. “For example, in a table concerning

10
Plaintiffs no longer contest ICE’s response to their request for database management system software and version
numbers. See Day 1 Tr. at 135:18-20 (testimony of Plaintiff Susan Long, stating that Plaintiffs’ first two requests
“singled out four specific classes [of information], one of which [ICE] provided . . . the database system[s] being used
. . . they’ve provided that”); see also Pls.’ Suppl. Mem. at 10 n.1.

12
immigration detainers, each row might represent a different detainer, and one field—that is,

column—might record the date on which the detainer was lifted.” Pls.’ Suppl. Mem. at 3 (citing

Day 1 Tr. at 77 and Pls.’ Evidentiary Hr’g Ex. II, col. I).

Each table and field in the databases has a distinctive name. See, e.g., Pls.’ Evidentiary

Hr’g Ex. AA (listing table name, as well as field names within each table, for two other EID

modules); Pls.’ Evidentiary Hr’g Ex. DDD at 37–97 (graphical depiction of table names and field

names within IIDS); 11 see also Day 2 Tr. at 5:7–7:17. There are hundreds of database tables and

thousands of fields within those tables. Day 1 Tr. at 20:21–21:6. Because the IIDS is a subset of

the EID, the IIDS has its own set of table and field names, only some of which correspond with

the EID table and field names. See Day 2 Tr. at 5:15–7:5; see also Pls.’ Evidentiary Hr’g Ex. II.

b. Codes and code lookup tables

While some data entered into EID and IIDS fields take the form of intelligible English

words or phrases or numerical values, data are often recorded in the form of codes. See Day 1 Tr.

at 137:16-23; see also Miller Decl. ¶ 10 (explaining that codes are used to save space and reduce

the size of records in a database); cf. Day 1 Tr. at 21:7–22:9. Codes are strings of alphanumeric

characters that uniquely identify different pieces of information that may be recorded within a

given field. See Day 1 Tr. at 63:13-20, 137:16–138:2. For example, the database might assign a

unique numerical code for a particular county or detention facility, or a unique alphabetic code for

a particular state, rather than spelling out the name of the county, facility, or state. See id. at 138:4-

12. The databases also contain auxiliary tables, known as “code lookup tables,” which provide a

translation of the codes. See id. at 63:25–64:17, 66:21–67:7, 135:18–136:3, 138:3-25; see, e.g.,

Pls.’ Evidentiary Hr’g Exs. BB, DD.

11
Citations to Plaintiffs’ Exhibit DDD are to the page numbers of the PDF document.

13
 c. Database schemas

A database schema provides “the blueprint of [a] database[],” laying out “exactly where

everything is” in each database and “how it’s stored.” Day 1 Tr. at 23:5-22. It contains tables

often referred to as data “dictionaries”—database tables that set forth the names of tables and fields

within those databases. See id. at 23:2-12, 52:14–54:14; see, e.g., Pls.’ Evidentiary Hr’g Ex. AA

(sheet four); cf. Day 1 Tr. at 137:1-13, 144:16–147:19. It also includes graphical depictions of the

structure of the database, which includes not only the names of tables and fields therein, but also

the ways in which the tables are connected to one another. See Day 1 Tr. at 23:7-22, 57:8-24. In

the graphical depiction of the schema, each block represents a table, the items listed within each

block represent field names with a table, and arrows between the blocks represent “linkages”

between tables within the database. See Day 1 Tr. at 57:25–58:8, 157:6-9; see, e.g., Pls.’

Evidentiary Hr’g Ex. DDD at 31–97.

2. ICE’s Justification for Withholding Responsive Material

With this context in mind, the court turns to ICE’s justification for withholding EID and

IIDS metadata and database schemas pursuant to Exemption 7(E). As discussed, the primary

question before the court is whether the disclosure of such material “could reasonably be expected

to risk circumvention of the law” under Exemption 7(E), 5 U.S.C. § 552(b)(7)(E) (emphasis

added). To satisfy this requirement, an agency need only “demonstrate logically how the release

of the requested information might create a risk of circumvention of the law.” Shapiro v. U.S.

Dep’t of Justice (Shapiro I), 893 F.3d 796, 800 (D.C. Cir. 2018) (cleaned up) (quoting Mayer

Brown LLP v. IRS, 562 F.3d 1190, 1194 (D.C. Cir. 2009)). “This is ‘a relatively low bar.’” Id.

(quoting Blackwell v. FBI, 646 F.3d 37, 42 (D.C. Cir. 2011)). Courts “generally have affirmed the

withholding of information related to databases—metadata, codes, and structures—under

14
Exemption 7(E) for risk of cyber-attack or data breach.” Shapiro v. Dep’t of Justice (Shapiro II),

393 F. Supp. 3d 111, 122 (D.D.C. 2019) (collecting cases); see also Levinthal v. Fed. Election

Comm’n, 219 F. Supp. 3d 1, 8 (D.D.C. 2016) (“[C]ourts in this District repeatedly have held that

information connected to law enforcement databases qualifies for exemption under 7(E).”).

Even when an exemption broadly applies, however, an agency nevertheless must “tailor”

its withholdings to only that which the exemption protects. Inst. for Justice v. IRS, 941 F.3d 567,

574 (D.C. Cir. 2019). Thus, the agency must “account for its obligation to disclose any reasonably

segregable portion of a record after removing the exempt material.” Id. (cleaned up).

a. Risk of Circumvention

The primary risk of circumvention of the law identified by ICE is the danger that a hacker

with access to the requested information will be able to carry out a more efficient and effective

cyberattack against the EID and IIDS databases. According to ICE, this risk flows from the

disclosure of EID and IIDS metadata and database schemas because hackers with advance

knowledge of such information would be able to “set up their own version of the database and

practice attacks in isolation, where they can’t be witnessed and [can] perfect their attack.” Defs.’

Suppl. Mem. at 4 (quoting Day 1 Tr. at 35:9-13). The agency’s witness, Tadgh Smith, testified

that “if you already know how [a database is] organized, you can make your attack very

targeted, . . . less likely to be noticed,” or even “cover up [your] tracks that [you] attacked [the

database] in the first place.” Day 1 Tr. at 45:9-13.

According to Smith, this advance knowledge would aid an attacker in executing a

Structured Query Language (“SQL”) 12 injection attack on the EID and IIDS databases, see Day 1

Tr. at 47:18-23.

12
SQL is a programming language that is used to access and manipulate records within a database. See Miller Decl.
¶ 16.

15
 The SQL injection attack . . . is a technique used by malicious
intruders or “hacktivists” to exploit web sites by changing the
intended effect of an SQL query by inserting new SQL keywords or
operators into the query. Basically, the attacker inserts or ‘injects’
SQL instructions in a web application Search field to cause the
program to malfunction.

Long I, 149 F. Supp. 3d at 50–51 (quoting Miller Decl. ¶ 16); accord Day 1 Tr. at 47:5-13 (Smith

Testimony); Day 2 Tr. at 90:3-19 (Clark testimony). Once a hacker gains a direct connection to

the database, he can issue “ad hoc commands” for the purpose of “corrupting the database in some

way,” Day 2 Tr. at 90:13-18, allowing him to “change” or “delete” data, or “merely read data [that

he is] not supposed to see,” Day 1 Tr. at 47:14-17; see also Day 2 Tr. at 90:19. Smith testified that

the information requested by Plaintiffs could be used in an SQL attack because a person who

knows the organization of a database will “know how to query that database” and, further, a person

who knows the table and field names in a database will be able to “target [their] attack.” Day 1

Tr. at 47:22–48:1. Smith suggested that these types of attacks may be executed not only by outside

bad actors, but also rogue insiders who would not otherwise have access to the databases. See id.

at 44:15–48:1.

At the evidentiary hearing, ICE—for the first time in four years of litigation—presented

testimony concerning remote access to the EID and IIDS, see id. at 26:11–29:2, a material fact that

has been a point of contention throughout this litigation, see Long II, 279 F. Supp. 3d at 236 (noting

that “it remains ambiguous to the court whether the [databases] can be externally or remotely

accessed,” and that this question is “material” because “Defendant’s argument centers on the fact

that a circumvention of law occurs only when a hacker accesses the database[s]”). In light of this

testimony, the court is satisfied that the databases are remotely, albeit not publicly, accessible via

a trusted internet connection, or “TIC,” and the parties do not seriously dispute this fact. See Def.’s

Suppl. Mem. at 3; cf. Pls.’ Suppl. Mem. at 10. This means that the execution of the aforementioned

16
attack is possible, provided that the attacker manages to gain access to the databases by subverting

the TIC, see Day 1 Tr. at 25:17–26:25, 32:5-9, and additional layers of security, see id. at 87:24–

88:11.

ICE asserts that advance knowledge of the metadata and database schemas would provide

the malicious intruder who manages to gain access to the databases (by circumventing the TIC and

other layers of protection) with the means to create greater mischief once inside. See Def.’s Suppl.

Mem. at 3–5. In other words, the asserted risk is tied to the additional damage a hacker might

cause once he gains unauthorized access to the EID and IIDS if he has advance knowledge of the

metadata and database schemas—not the prospect that he will gain such access in the first place

by successfully managing to subvert the TIC and traverse any security measures intended to protect

those databases. In this case, that additional harm might consist of viewing, modifying, or deleting

sensitive law enforcement information related to ICE’s enforcement duties, 13 and possibly even

erasing any evidence that the databases were attacked or otherwise compromised. See Day 1 Tr.

at 44:23–45:13; 47:2–48:1; see also Sealed Day 1 Tr. at 116:21–117:8.

Plaintiffs attack ICE’s risk assessment on two grounds. First, they maintain that,

notwithstanding ICE’s new evidence concerning access to the databases via the TIC, the security

measures employed by ICE to protect its databases are adequate to restrict unauthorized access,

and so any additional protections provided by the non-disclosure of the metadata and schemas

would be superfluous. See Pls.’ Suppl. Mem. at 10–11. Second, they contend that even if a would-

be attacker were to gain access to the databases, advance knowledge of the metadata and database

schemas would not materially aid the attacker in doing any damage. Id. at 1, 11–12.

13
ICE’s witness explained in further detail the sensitivity of the information contained within the EID and IIDS
databases in testimony during the sealed portion of the hearing. See Sealed Day 1 Tr. at 118:19–120:9.

17
 Plaintiffs’ first argument is easily dismissed. While the evidence adduced at the

evidentiary hearing demonstrates that there are security countermeasures in place to prevent a

hacker from gaining access to the system, see Day 1 Tr. at 29:3-5, 105:14-25, 107:19–109:2 (Smith

testimony); Day 2 Tr. at 77:8-13, 78:2–90:2, 93:25–97:12, 100:4-12 (Clark testimony), nowhere

was it credibly suggested that access is impossible. Indeed, based on the testimony presented

during the sealed, ex parte portion of the proceedings, the court finds that ICE’s systems are not

impervious to breach. See Sealed Day 1 Tr. at 115:6-14, 116:9-20.

Furthermore, the court finds that Dr. Clark’s opinion that an external breach of ICE’s

security measures is unlikely was heavily based on his erroneous assessment that the EID and IIDS

are not “particularly high-value assets” from an attacker’s perspective. See Day 2 Tr. at 94:11-12,

126:12-13. Dr. Clark, however, acknowledged that he was “not familiar with the data structures

in the database,” id. at 126:17-21, and he admitted that he was unaware that the databases include

highly sensitive categories of law enforcement information, see id. at 126:17–129:5—a fact which

was described to the court in detail during the sealed portion of the evidentiary hearing, see Sealed

Day 1 Tr. at 119:1–120:9 (Smith testimony). Dr. Clark’s risk assessment was therefore inevitably

deflated by that undervaluation. Additionally, notwithstanding Dr. Clark’s expertise in computer

network security and design, the court must afford some deference to Smith’s testimony in this

context, as his assessment of the risks of breach “reflects [his] access to more information than is

available to either” Plaintiffs, Dr. Clark, or this court. Sheridan v. U.S. Office of Pers. Mgmt., 278

F. Supp. 3d 11, 25 (D.D.C. 2017); see also Long I, 149 F. Supp. 3d at 53 (“Judges are not cyber

specialists, and it would be the height of judicial irresponsibility for a court to blithely disregard

such a claimed risk.”). The court therefore finds that there is a sufficient risk that an attacker could

18
gain access to ICE’s databases, such that any additional protections afforded by the non-disclosure

of the requested information would not be superfluous.

While Plaintiffs’ second argument is a closer call, the court finds that it is not unreasonable

for ICE to expect that greater harm might result from a cyberattack where the attacker has detailed

advance knowledge of the structure and organization of the databases. A hypothetical is instructive

here. Imagine a pair of art thieves who are planning to steal a valuable piece of artwork believed

to be located in a museum’s non-public storage vaults. The thieves have acquired a map of a

museum that provides no information about how to get inside, but identifies the location of the

museum’s motion sensors and the layout of the vaults. The map would, of course, offer the art-

loving larcenists no help in distracting the guards stationed outside or in picking the museum’s

locks. But, by memorizing its contents, the thieves might enjoy more success once inside,

potentially avoiding otherwise invisible motion sensors and moving more efficiently through the

non-public areas of the building. With the benefit of the map, the thieves might avoid detection

entirely, or at the very least, avoid apprehension by pulling off the heist more quickly.

Here, the database schemas and at least some of the other metadata that Plaintiffs seek are

like the thieves’ map. The database schemas in particular are “blueprint[s] of the databases” that

“lay[] out exactly where everything is and how it’s stored.” Day 1 Tr. at 23:20-22. Smith credibly

testified that advance knowledge of this information would assist a hacker in launching a more

targeted and effective attack that is less likely to be detected by the agency. See Day 1 Tr. at 35:5-

13, 45:5-11, 47:2–48:1. Plaintiffs’ own expert witness, Dr. Clark, acknowledged that advance

knowledge of the metadata and database schemas could make some difference in an attack by

enabling an attacker to recreate the database to practice his attack. Day 2 Tr. at 134:4-11. This

advance knowledge, Dr. Clark conceded, could reduce the number of queries necessary for a

19
hacker to accomplish his attack, thereby making the attack more efficient. See id. at 135:15-19

(acknowledging that a hacker’s advance “ability to list the contents of the database prior to [his

attack]” would lead to a “difference in time” required for the hack); id. at 136:14 (“There would

be a delta [in time] . . . .”).

Though Dr. Clark opined that this “delta” of time “would be small,” see, e.g., id. at 136:8-

14, and “it would be a matter of a couple queries,” id. at 135:18-19, the court finds the difference

in time to be sufficient to satisfy Exemption 7(E)’s low bar, particularly given the highly sensitive

nature of the law enforcement information contained in the databases. “[I]t is by now well

established that an agency that invokes Exemption 7(E) need not show that an identified risk will

actually increase substantially, or that the risks it relies upon will necessarily come to fruition.”

Sheridan, 278 F. Supp. 3d at 25. Instead, “exemption 7(E) only requires that the agency

demonstrate logically how the release of the requested information might create a risk of

circumvention of the law.” Id. (cleaned up) (quoting Mayer Brown LLP, 562 F.3d at 1194). True,

the disclosure of the metadata and database schemas in this case would not directly enable a cyber-

attack. See Long I, 149 F. Supp. 3d at 51 (noting the “the potential for a cyber-attack . . . is the

kind of risk of circumvention of the law that justifies withholding under Exemption 7”). But, by

enabling a hacker to move faster through the databases to view, modify, or delete data, disclosure

of the requested information could incentivize future attacks and make those attacks more harmful.

This increased risk of harm is well within the scope of FOIA’s Exemption 7(E). See Shapiro II,

393 F. Supp. 3d at 122 (upholding an agency’s withholding of a database name based on the

agency’s representation “that knowledge of the ‘database name[] makes the original source data

an attractive target for compromise’”); Strunk v. U.S. Dep’t of State, 905 F. Supp. 2d 142, 147

(D.D.C. 2012) (finding that an agency permissibly withheld sensitive database codes based in part

20
on the agency’s contention that “once an unauthorized user has gained access to the system,

knowledge of the withheld codes further facilitates the unauthorized user’s ability to navigate

through” the database and would “arm unauthorized users with the ability to corrupt the integrity

of the data contained therein”); cf. Mayer Brown, 562 F.3d at 1193 (holding that the IRS properly

withheld certain settlement guidelines pursuant to Exemption 7(E) on the ground that those

guidelines “could encourage decisions to violate the law or evade punishment,” even if they didn’t

“necessarily provide a blueprint for tax shelter schemes” (emphasis added)).

Furthermore, a faster attack is not the only risk associated with the information Plaintiffs

seek. Smith also testified that advance knowledge of the databases’ organization could enable

attackers to “cover up their tracks,” making it “less likely” that the attack would “be noticed,

monitored or even discovered.” Day 1 Tr. at 45:10-12. Dr. Clark did not address this distinct

threat during his testimony. Plaintiffs also ignore this risk in their supplemental briefing,

contending only that advance knowledge of the databases’ organization and structure would not

provide an attacker a meaningful “head start.” See Pls.’ Suppl. Mem. at 11–12. Based on Smith’s

uncontroverted testimony, particularly that given during the sealed portion of the hearing, see

Sealed Day 1 Tr. at 116:15–117:18, the court finds that there is a material risk that comprehensive

knowledge of the organization of the databases could enable a bad actor to execute an attack

undetected. FOIA Exemption 7(E) does not countenance such risk. See Prechtel v. Fed.

Commc’ns Comm’n, 330 F. Supp. 3d 320, 335 (D.D.C. 2018) (holding that an agency appropriately

withheld electronic server logs whose release would give “future attackers a ‘roadmap’ to evade

the [agency’s] future defensive efforts”); Sheridan, 278 F. Supp. 3d at 25 (concluding that an

agency permissibly withheld source code that would “identify the ‘locked doors’ that have been

21
designed into [its] software (telling a malicious actor where and how to attempt to breach [the]

system)”).

In sum, while the risk of conferring any material advantage on future hackers by disclosing

the full suite of metadata and database schemas may not be imminent or severe, the court cannot

conclude that it is unreasonable to expect that such a risk might come to fruition in light of Smith’s

testimony. 14

b. ICE’s Segregability Analysis

That does not end the analysis, however. Even when a FOIA exemption applies, “[a]ny

reasonably segregable portion of a record shall be provided . . . after deletion of the portions which

are exempt.” 5 U.S.C. § 552(b). “Before approving the application of a FOIA exemption, the

district court must make specific findings of segregability regarding the documents to be

withheld.” Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1116 (D.C. Cir. 2007). Indeed, the

court must make such a finding “even if the requester did not raise the issue of segregability before

the court.” Id.

Several factors suggest that ICE may have withheld segregable, non-exempt materials.

Most importantly, Smith acknowledged at the evidentiary hearing that the disclosure of certain

information sought by Plaintiffs would not create any additional risk to the security of ICE’s

databases. For example, Smith testified that the codes and code translations within certain code

14
Smith also opined the disclosure of the database metadata and schema could present a risk of a “phishing” attack,
where a bad actor could use knowledge of the “setup of the system” to trick an ICE employee into clicking on a
malicious link or otherwise following an “instruction that will be beneficial to the attacker.” Day 1 Tr. 48:2-23; see
also Def.’s Suppl. Mem. at 5. The court does not address this threat because it appears that the risks associated with
a phishing attack versus an SQL attack are similar. To the extent the risks are not coextensive, however, the court
rejects Defendant’s argument that the danger of phishing provides an independent basis for its withholdings. The
“key” reason, according to ICE, that the withheld information presents a risk of a phishing attack is that it is not
“publicly available information.” 7/27/2018 Draft Hr’g Tr. at 9. But that argument is circular. The information is
not publicly available only if it is subject to one of FOIA’s nine exemptions. ICE has identified nothing unique about
the withheld information that would create more of a risk of phishing than any other otherwise non-publicly available
information that is subject to FOIA.

22
lookup tables could be released without creating an unacceptable threat to the security of the EID

and IIDS databases, see Day 1 Tr. at 66:24–67:10, and that any other metadata contained within

the tables that might pose a risk could be easily redacted, see id. at 70:9–71:6. Similarly, Smith

testified that not all field names pose the same risk, if released. While Smith explained that ICE

tries to replace actual field names with a plain-language description in its reporting and its

responses to FOIA requests, id. at 40:25–41:19, he acknowledged that the disclosure of actual field

names will not always create an independent threat to the security of the databases, see, e.g., id. at

41:20–42:5. Instead, Smith explained that the “sensitive” field names are those that could indicate,

“through coding best practice,” how the databases are connected to one another, allowing a hacker

to “reverse engineer” the database schema in order to rebuild the database. Id. at 42:6–43:25. As

with the other metadata contained within the code lookup tables, Smith testified that if ICE were

to produce to Plaintiffs an Excel spreadsheet that contained those field names that show linkages

between multiple database tables, the agency could redact those field names while still producing

others. See id. at 71:7-12.

While Smith later suggested that, under ICE’s “defense in depth” security protocol, 15

disclosing any of the information requested by Plaintiffs would create an unacceptable risk, id. at

112:23–113:1, the court cannot square this statement with Smith’s earlier testimony. Nor can the

court accept the agency’s invitation to rely on ICE’s policy of defense in depth as an independent

basis to withhold the information requested here. Doing so would afford blanket protection to

every detail about the agency’s databases, without further explanation or justification. See id. at

112:25–113:8 (opining that “there’s a threat at every layer with every detail that’s released”); see

also 7/27/2018 Draft Hr’g Tr. at 15 (stating that “Mr. Smith explained during his testimony . . .

15
Defense in depth is a cybersecurity protocol in which multiple, iterative layers of countermeasures are used to secure
a network system. See Day 1 Tr. at 29:6–30:13; Day 2 Tr. at 91:7-12.

23
that really any little piece of information that is out there could lead to potential harm”). The court

need not decide whether “defense in depth” is an outdated approach to cybersecurity, as Plaintiffs’

expert suggests, see Day 2 Tr. at 91:7–92:7, 97:13–98:24; even if it remains an accepted security

practice, its mandate of virtually limitless non-disclosure is incompatible with FOIA.

In addition, ICE recently publicly disclosed some of the metadata at issue in this case,

suggesting that it has withheld segregable, non-exempt information and undermining its contention

that “defense in depth” requires non-disclosure of any and all database details. While the court is

satisfied that ICE’s disclosures of the EID and IIDS database schema and metadata in 2010 and

2011 were inadvertent, 16 ICE’s contemporaneous disclosures of subsets of these data lack such an

explanation. For instance, Dr. Long testified, and ICE did not dispute that, in the two weeks prior

to the evidentiary hearing, ICE produced to TRAC field names, codes, code translations, and code

lookup tables from portions of the EID and IIDS databases. See Day 1 Tr. at 179:3-11; id. at

143:2–144:14. In addition, in November 2017, in response to a lawsuit filed by Plaintiffs against

ICE in the Southern District of New York, ICE filed a declaration that provided “data points”

(including field names) that “exist[] within IIDS” and identified several dozen such fields by their

actual EID names. See Decl. of Marla Jones, ECF No. 15-1, at 7–10 Long v. ICE, 5:17-cv-00506-

BKS-TWD (S.D.N.Y Nov. 8, 2017); see also Pls.’ Suppl. Mem. at 6–7. ICE simultaneously filed

two spreadsheets of responsive information, which apparently included code translations and IIDS

field names with the underbars replaced by spaces. See Pls.’ Suppl. Mem. at 7; see also Pls.

Evidentiary Hr. Exs. YY, ZZ; Day 2 Tr. at 14:19–16:23.

16
Smith testified that these disclosures were mistaken, that the agency has since taken steps to update its FOIA protocol
and mitigate the security threat caused by the releases, and that the databases themselves have been substantially
updated since the releases. See Day 1 Tr. at 36:14–40:4; see also id. at 159:1-6 (Long testimony, acknowledging that
the 2010 and 2011 releases “would not necessarily at all reflect all of the fields that might [currently] be in the
database”). Given these developments, the court finds that these particular disclosures do not have any bearing on the
reasonableness of ICE’s withholdings under Exemption 7(E) or the adequacy of the agency’s segregability analysis.

24
 Given Smith’s admissions and ICE’s contemporaneous disclosures of codes, code

translations, and field names (both actual names and thinly disguised substitutes), the court cannot

conclude that ICE has released all reasonably segregable material. As best the court can discern,

only metadata that “describes the organization of [ICE’s] data and the structure of [its] databases,”

presents any risk, see Day 1 Tr. 62:21-22, and it appears that only such metadata that cannot be

readily intuited from other contexts presents a material risk, see id. at 41:20–42:5 (Smith opining

that there would be no danger in releasing the field name “AD” (a code for Address) “because it’s

pretty easy to figure out that the content of that field is something we would release and that an

abbreviation could be extrapolated out to that language”). The court is satisfied that the database

schemas (which, by definition, describe the structure of ICE’s databases) present such a material

risk. But the other categories of information requested by Plaintiffs—field and table names, codes,

code translations, and code lookup tables—do not appear to uniformly pose such a risk. 17

Therefore, the court upholds ICE’s withholdings as to the database schemas and directs

ICE to conduct a segregability analysis as to the additional requested metadata.

B. FOIA Request III: Records Concerning EID Extracts and Snapshots

Next, the court turns to ICE’s withholding of certain information relating to EID extracts

and snapshots in response to Plaintiffs’ third FOIA request. Recall that the court previously denied

summary judgment on this issue because ICE had failed to present any evidence indicating what

materials or documents were relied upon to create the Nine-Page Document and whether those

materials or documents were compiled for law enforcement purposes. See Long II, 279 F. Supp.

3d at 241–43. “In the absence of any” such evidence, the court explained, it could not “discern if

17
It is possible that the segregation of a dataset this large would not be “reasonabl[e],” see 5 U.S.C. § 552(b), or that
the disclosure of all non-structural metadata would nevertheless reveal too much about the databases’ structure. ICE
has not made any such representation, however.

25
any portion of the Nine–Page Document is eligible to be withheld pursuant to FOIA Exemption

7.” Id. at 243. 18

The court has reminded ICE of the need for this information multiple times. At the

evidentiary hearing, for instance, the court instructed ICE that it had not “heard anything about”

the Nine-Page Document “in terms of the source material for this information and whether it would

qualify as law-enforcement material,” Day 1 Tr. at 126:17-19, and that “in order to even meet the

threshold for 7(E), there needs to be some evidence that the underlying material upon which this

document was drawn itself is . . . compiled for law-enforcement purposes,” id. at 127:6-10; see

also 10/12/2017 Draft Hr’g Tr. at 6, 14–15 (discussing the need for additional information on this

issue). ICE responded that it intended to provide this information “by way of a supplemental

affidavit.” Day 1 Tr. at 129:10-12.

At the oral argument held following the evidentiary hearing, the court reiterated that it had

not received any evidence regarding whether the information underlying the Nine-Page Document

had been compiled for law enforcement purposes, and ICE again indicated that its “intention [was]

to submit a declaration concerning the nine page document.” 7/27/2018 Draft Hr’g Tr. at 21–23.

The court stressed that “there have been a number of mile posts in this case where evidence could

have been and should have been submitted,” and that it was not the court’s intention to leave the

record open “beyond the opportunity that was given at the end of the hearing to receive additional

evidence” on the sources of the Nine-Page Document. Id. at 41.

ICE never submitted the promised declaration, and the court continues to be unable to

“discern what materials contributed to the Nine–Page Document and, correlatively, whether those

materials were compiled for law enforcement purposes.” Long II, 279 F. Supp. 3d at 242.

18
The court held, however, that Defendants properly withheld under Exemption 6 the names and contact information
of the federal employees identified in the Nine-Page Document. Id. at 244.

26
Consequently, it remains unclear whether “any portion of the Nine-Page Document is eligible to

be withheld pursuant to FOIA Exemption 7.” Id. at 243. 19 The agency now has had multiple bites

at the apple, and still has not met its “burden of establishing that a claimed exemption applies.”

CREW, 746 F.3d at 1088. Accordingly, the court orders disclosure of the Nine-Page Document in

full, excepting the information it properly withheld pursuant to FOIA Exemption 6. See Long II,

279 F. Supp. 3d at 243–44.

V. CONCLUSION AND ORDER

For the reasons set forth above, the court orders the following:

1. As to Plaintiffs’ first and second FOIA requests, ICE permissibly concluded that

comprehensive release of this information is reasonably expected to risk circumvention

of the law. As to the requested field and table names, codes, code translations, and

code lookup tables, however, ICE must conduct a segregability analysis consistent with

this opinion. In particular, ICE should evaluate whether the requested metadata that

does not link to other portions of the databases or otherwise reveal the databases’

structure can be released, and whether linkage fields and other sensitive data can be

redacted. ICE need not conduct an additional segregability analysis as to the database

schemas, however.

2. As to Plaintiffs’ third FOIA request, ICE must disclose the Nine-Page Document in

full, subject to the Exemption 6 redactions that the court has previously upheld.

19
Because ICE has not met its burden as to this threshold question, the court does not reach the separate question of
“whether there is a reasonable risk of circumvention of law from the disclosure” of the withheld portions of the Nine-
Page Document. See Long II, 279 F. Supp. 3d at 243 n.8.

27
 3. ICE shall submit its supplemental segregability analysis no later than July 2, 2020. The

parties shall also file a Joint Status Report on the same day, regarding ICE’s disclosure

of the Nine-Page Document and any other outstanding issues in this litigation.

Dated: June 2, 2020 Amit P. Mehta
United States District Judge

28