Long v. ICE, No. 14-00109, 2020 WL 2849904 (D.D.C. June 2, 2020) (Mehta, J.)

Long v. ICE, No. 14-00109, 2020 WL 2849904 (D.D.C. June 2, 2020) (Mehta, J.)

Re:  Requests for "'complete set of documentation'" on two databases used by both agencies as well as "'snapshots'" of data contained within one of the databases

Disposition:  Following evidentiary hearing, finding certain information withholdable under Exemption 7(E), finding defendants' segregability explanation as to that information lacking, and ordering disclosure in full of certain information

• Exemption 7(E):  The court holds that "while the risk of conferring any material advantage on future hackers by disclosing the full suite of metadata and database schemas may not be imminent or severe, the court cannot conclude that it is unreasonable to expect that such a risk might come to fruition in light of [defendant's] testimony."  "The court . . . finds that there is a sufficient risk that an attacker could gain access to ICE's databases, such that any additional protections afforded by the non-disclosure of the requested information would not be superfluous."  "[T]he court finds that it is not unreasonable for ICE to expect that greater harm might result from a cyberattack where the attacker has detailed advance knowledge of the structure and organization of the databases."  The court relates that "[defendant credibly testified that advance knowledge of ["the database schemas and at least some of the other metadata"] would assist a hacker in launching a more targeted and effective attack that is less likely to be detected by the agency."  While "the disclosure of the metadata and database schemas in this case would not directly enable a cyber-attack," "by enabling a hacker to move faster through the databases to view, modify, or delete data, disclosure of the requested information could incentivize future attacks and make those attacks more harmful."  "This increased risk of harm is well within the scope of FOIA's Exemption 7(E)."
   
• Litigation Considerations, "Reasonably Segregable" Requirements:  The court holds that "[s]everal factors suggest that ICE may have withheld segregable, non-exempt materials."  "Most importantly, [defendants] acknowledged at the evidentiary hearing that the disclosure of certain information sought by Plaintiffs would not create any additional risk to the security of ICE's databases."  "In addition, ICE recently publicly disclosed some of the metadata at issue in this case, suggesting that it has withheld segregable, non-exempt information and undermining its contention that 'defense in depth' requires non-disclosure of any and all database details."  "Given [defendants'] admissions and ICE's contemporaneous disclosures of codes, code translations, and field names (both actual names and thinly disguised substitutes), the court cannot conclude that ICE has released all reasonably segregable material."  "As best the court can discern, only metadata that 'describes the organization of [ICE's] data and the structure of [its] databases,' presents any risk . . . and it appears that only such metadata that cannot be readily intuited from other contexts presents a material risk."  "The court is satisfied that the database schemas (which, by definition, describe the structure of ICE's databases) present such a material risk."  "But the other categories of information requested by Plaintiffs – field and table names, codes, code translations, and code lookup tables – do not appear to uniformly pose such a risk."  "Therefore, the court upholds ICE's withholdings as to the database schemas and directs ICE to conduct a segregability analysis as to the additional requested metadata."
   
• Litigation Considerations:  Despite the court reminding defendant about certain information "multiple times," the court holds that "ICE never submitted the promised declaration, and the court continues to be unable to 'discern what materials contributed to [a] Nine–Page Document and, correlatively, whether those materials were compiled for law enforcement purposes.'"  "Consequently, it remains unclear whether 'any portion of the Nine-Page Document is eligible to be withheld pursuant to FOIA Exemption 7.'"  "The agency now has had multiple bites at the apple, and still has not met its 'burden of establishing that a claimed exemption applies.'"  "Accordingly, the court orders disclosure of the Nine-Page Document in full, excepting the information it properly withheld pursuant to FOIA Exemption 6."