ACLU Immigrants' Rts. Project v. ICE

58 F.4th 643

• Court: Court of Appeals for the Second Circuit
• Decided: January 26, 2023
• Docket: 21-1233
• Status: Published

Opinion

21-1233 ACLU Immigrants’ Rts. Project v. ICE

In the United States Court of Appeals for the Second Circuit

AUGUST TERM 2021 No. 21-1233 AMERICAN CIVIL LIBERTIES UNION IMMIGRANTS’ RIGHTS PROJECT, Plaintiff-Appellant, v. UNITED STATES IMMIGRATION AND CUSTOMS ENFORCEMENT, Defendant-Appellee. __________

ARGUED: MAY 18, 2022 DECIDED: JANUARY 26, 2023 __________ Before: RAGGI, WESLEY, and CARNEY, Circuit Judges. ________________ In this action under the Freedom of Information Act (“FOIA”), plaintiff appeals an award of summary judgment in the United States District Court for the Southern District of New York (George B. Daniels, Judge) in favor of defendant, arguing that the district court erred in concluding that requiring defendant to substitute Unique Identifying Numbers (“Unique IDs”) for FOIA-exempt agency Alien Identification Numbers (“A-Numbers”) in order to afford plaintiff access to non-exempt agency records in a person-centric manner constituted the impermissible creation of new records. In the 1 21-1233 ACLU Immigrants’ Rts. Project v. ICE

particular circumstances of this case, we reject the district court’s conclusion. A government agency cannot make an exempt record (here, A-Numbers), the sole “key” or “code” necessary to access non- exempt records in a particular manner; itself use the exempt record to obtain non-exempt records in that manner; and then invoke the record’s exempt status to deny the public similar access to the non- exempt records. Where an agency chooses to assign exempt records such a code function within its computer system, FOIA’s broad disclosure policy obligates the agency to substitute a different code in order to afford the public non-exempt records in the same manner as they are available to the agency. That conclusion particularly obtains here, where the substitute code can be neutral Unique IDs consisting of any combinations of numbers, letters, or symbols that are meaningless in themselves and that function only to afford access to the non-exempt records in the requested manner.

REVERSED AND REMANDED.

_________________

NOOR ZAFAR, American Civil Liberties Union Immigrants’ Rights Project, New York, NY (Michael Tan; Cody Wofsy, American Civil Liberties Union Immigrants’ Rights Project, San Francisco, CA; Carmen G. Iguina Gonzalez, American Civil Liberties Union Immigrants’ Rights Project, Washington, DC, on the brief), for Plaintiff- Appellant.

ZACHARY BANNON, Assistant United States Attorney (Benjamin H. Torrance, Assistant 2 21-1233 ACLU Immigrants’ Rts. Project v. ICE

United States Attorney, on the brief), for Damian Williams, United States Attorney for the Southern District of New York, New York, NY, for Defendant-Appellee.

EMILY J. CREIGHTON, American Immigration Council, Washington, DC, for Amici Curiae The American Immigration Council, Citizens for Responsibility and Ethics in Washington, Emily Ryo, Ingrid Eagly, Tom Wong, American Oversight, Open the Government, National Immigrant Justice Center, National Immigration Project of the National Lawyers Guild, and Refugee and Immigrant Center for Education and Legal Services, in support of Plaintiff-Appellant.

DAVID GREENE, Electronic Frontier Foundation, San Francisco, CA, for Amicus Curiae Electronic Frontier Foundation, in support of Plaintiff-Appellant.

MASON A. KORTZ, Harvard Law School, Cambridge, MA, for Amici Curiae The Center for Investigative Reporting, The Media Law Resource Center, Inc., and The MuckRock Foundation, in support of Plaintiff-Appellant. _________________

REENA RAGGI, Circuit Judge:

Plaintiff American Civil Liberties Union Immigrants’ Rights Project (“ACLU”) brought this Freedom of Information Act (“FOIA”) suit in the United States District Court for the Southern District of 3 21-1233 ACLU Immigrants’ Rts. Project v. ICE

New York (George B. Daniels, Judge) to compel defendant, United States Immigration and Customs Enforcement (“ICE”), to produce agency records in the form of electronic spreadsheet data pertaining to five stages of the immigration enforcement and deportation process. While ICE produced 21 spreadsheets of responsive data, the agency did not comply with ACLU’s request to replace exempt Alien Identification Numbers (“A-Numbers”) 1 on such spreadsheets with anonymized unique identifiers (“Unique IDs”). ACLU submits that such Unique IDs could be any combinations of numbers, letters, or symbols that, while meaningless in themselves, would allow ACLU to track datapoints pertaining to individual (but unidentified) aliens across ICE databases. On March 10, 2021, the district court granted ICE’s motion for summary judgment, ruling that ACLU’s requested substitution effectively required ICE to create new records, something the court was powerless to order under FOIA. See ACLU Immigrants’ Rts. Project v. ICE, No. 19-CV-7058, 2021 WL 918235 (S.D.N.Y. Mar. 10, 2021).

For the reasons stated herein, we conclude that ICE was not entitled to summary judgment in the particular circumstances of this case. In reaching that conclusion, we are mindful that ICE has chosen to organize its electronic databases by immigration events (e.g., arrests, detentions, deportations, etc.), rather than by individual

1 “An A-Number is a unique number assigned to any alien immigrating to the United States by the Department of Homeland Security,” of which ICE is a part. Vassilio-Diaz Decl. ¶ 20. 4 21-1233 ACLU Immigrants’ Rts. Project v. ICE

aliens. 2 We are further mindful that ICE has chosen—although it was not required—to have FOIA-exempt A-Numbers function as the sole “key” or “code” affording access to electronic data pertaining to individual aliens from its event-centric databases, and that ICE itself uses A-Numbers for that purpose. Thus, by here redacting A- Numbers from the spreadsheets it produced conveying datapoints by event rather than by person, ICE not only shielded the FOIA-exempt personal identifying information (“PII”) documented by the A- Numbers, but also effectively deprived the public of access to non- exempt records in the same person-centric manner available to the agency. In these circumstances, we approve the substitution of neutral Unique IDs for exempt A-Numbers. Such substitution does not alter the content of any record, but only preserves the computer

2 On the record before us, it is not clear why ICE maintains only event- centric electronic records. ICE has long maintained person-centric paper records, generally referred to as Alien Files, or “A-Files.” See U.S. DEP’T OF HOMELAND SEC., DHS/USCIS/PIA-009(a), PRIVACY IMPACT ASSESSMENT FOR THE CENTRAL INDEX SYSTEM (CIS) 2 (2017), https://www.dhs.gov/sites/default/files/publications/privacy-pia-uscis-09- a-cis-april-2017.pdf (defining Alien File as “series of records . . . which documents the history of [a particular alien’s] interaction with DHS as required by law”); Vassilio-Diaz Decl. ¶ 12 (acknowledging that ICE officers can view individual’s immigration history “by consulting his or her paper ‘Alien File’”); United States v. Noria, 945 F.3d 847, 850 n.5 (5th Cir. 2019) (“The Government creates an A-file, short for Alien File, for every non-citizen who comes into contact with a U.S. immigration agency. A-files contain documents relating to any and all interactions which the non- citizen has had with immigration agencies.” (internal quotation marks omitted)); see also United States v. Sokolov, 814 F.2d 864, 874-75 (2d Cir. 1987) (ordering production of A-file in case challenging denaturalization). 5 21-1233 ACLU Immigrants’ Rts. Project v. ICE

function necessary to afford the public access to non-exempt electronic records in the same manner that they are available to the agency.

Accordingly, we reverse the award of summary judgment to ICE, and we remand the case for further proceedings consistent with this opinion.

BACKGROUND

The following facts derive largely from the sworn declaration of Donna Vassilio-Diaz, Unit Chief of the Statistical Tracking Unit within Enforcement and Removal Operations Law Enforcement and Systems Analysis at ICE, submitted in support of ICE’s motion for summary judgment, as well as from matters of which the court may take judicial notice. In FOIA cases, we accord such declarations “a presumption of good faith,” Carney v. DOJ, 19 F.3d 807, 812 (2d Cir. 1994) (internal quotation marks omitted), and can rely on them to support an award of summary judgment, at least to the extent “they are not called into question by contradictory evidence in the record or by evidence of agency bad faith,” Grand Cent. P’ship, Inc. v. Cuomo, 166 F.3d 473, 478 (2d Cir. 1999) (internal quotation marks omitted).

I. ICE Databases

Some understanding of certain ICE databases is useful to our discussion of the issues on appeal.

ICE’s Enforcement Integrated Database (“EID”) is the agency’s “common database repository for all records created, updated, and accessed by a number of software applications.“ Vassilio-Diaz Decl. ¶ 6. EID allows ICE officials, along with other law-enforcement components of the Department of Homeland Security, “to manage 6 21-1233 ACLU Immigrants’ Rts. Project v. ICE

cases from the time of an alien’s arrest, in-processing, or placement into removal proceedings, through the final case disposition.” Id. EID, however, does not store data on a person-centric basis; rather, it stores data in an event-centric manner. Thus, when a particular enforcement event occurs, ICE officers enter it into EID where it is stored with data recording similar events rather than with data pertaining to the same alien. Nevertheless, ICE software does permit the agency to retrieve EID data on a person-centric basis. Specifically, with an appropriate identifier—here the alien’s A-Number—ICE can search on an ad hoc basis for all events pertaining to that particular alien.

Another ICE database, the Integrated Decision Support System (“IIDS”), contains a subset of data from EID, maintained in “distinct data sets[,] which capture populations of aliens at various points in the removal lifecycle.” Id. ¶ 12. Thus, it too is event-centric, with data pertaining to categories of events, e.g., removals, detentions, administrative arrests, stored separately within IIDS. Updated regularly, IIDS functions as a “snapshot” of EID. Id. ¶¶ 9, 11. ICE queries IIDS to create reports for external stakeholders and to respond to requests for information, including FOIA requests.

Alien-risk-classification-assessment data and bond data are stored differently. The former are stored in the Risk Classification Assessment module of ICE’s Enforcement Case Tracking System,

7 21-1233 ACLU Immigrants’ Rts. Project v. ICE

which is stored in EID but not in IIDS. The latter are housed in a separate database called the Bond Management Information System. 3

II. ACLU’s FOIA Request

On October 3, 2018, ACLU submitted a FOIA request to ICE for “electronic spreadsheet data,” i.e., “data in a spreadsheet format” for five categories of information, each pertaining to a stage of the deportation process: (1) initial apprehensions, (2) risk classification assessments, (3) detentions, (4) removals, and (5) immigration bonds. FOIA Request from David Hausman, ACLU to ICE 1 (Oct. 3, 2018) (“ACLU FOIA Request”). ACLU’s request also denoted specific fields of data sought for each category—e.g., “Gender,” “Birth Date,” “Entry Date”—modeling its request in part on spreadsheet data that ICE had produced in response to prior FOIA requests. Id. at 2.

In its request, ACLU instructed ICE that there should be “a row in the spreadsheet for each individual or case.” Id. at 1. Further, and as relevant here, ACLU instructed ICE that, in deleting exempt A- Numbers from the spreadsheet, the agency should substitute anonymized Unique IDs for each unit of observation because such a substitution is necessary to allow ACLU to track individual (but unidentified) aliens across the five different categories of data. 4

3Notwithstanding these differences among ICE databases, we refer to them collectively throughout this opinion except where a particular database is relevant to the point being discussed.

4 Toward this end, ACLU requested that each data set contain a Unique ID field and that Unique IDs be consistent across the spreadsheets pertaining to each category of information. It appears that federal and state

8 21-1233 ACLU Immigrants’ Rts. Project v. ICE

III. District Court Proceedings

A. ACLU’s Complaint

On July 29, 2019, ACLU brought this court action charging ICE with failing timely to search its records and to produce responsive documents as required by FOIA. Reiterating its request for “five categories of ‘spreadsheet data’” and again specifying the particular data fields requested for each category, ACLU emphasized that it largely sought “records that [ICE] ha[d] previously disclosed under the FOIA.” Compl. ¶¶ 7-8. ACLU asserted that its FOIA request was critical to informing the public about the government’s then- operative immigration-enforcement policies and to understanding changes in those policies.

government agencies frequently use Unique IDs or other anonymized identifiers in producing records in other contexts. See, e.g., Raj Chetty et al., Race and Economic Opportunity in the United States: An Intergenerational Perspective, 135 Q.J. ECON. 711, 724-25 (2020) (describing researchers’ use of “unique person identifier . . . assigned by Census Bureau staff” to link Census data with data from federal income tax returns otherwise “stripped of personally identifiable information”); Judith Scott-Clayton & Basit Zafar, Financial Aid, Debt Management, and Socioeconomic Outcomes: Post-College Effects of Merit-Based Aid, 170 J. PUB. ECON. 68, 70 (2019) (describing how “random scrambled identifier” in state agency data permitted that data to be linked with data from private company and from Federal Reserve Bank of New York); Loryana L. Vie et al., The Person-Event Data Environment: Leveraging Big Data for Studies of Psychological Strengths in Soldiers, FRONTIERS PSYCH., Dec. 2013, at 2 (describing Defense Department’s Person-Event Data Environment, which replaces social security numbers with random strings of numbers, thereby “reduc[ing] the risk of an individual being identified” by researchers “while maintaining enough information for standard analysis”).

9 21-1233 ACLU Immigrants’ Rts. Project v. ICE

B. ICE’s Production

On September 30, 2019, ICE responded to ACLU’s FOIA request by producing 21 Microsoft Excel spreadsheets, containing 40 tabs of data. This equated to eight spreadsheet tabs of data for each of the five categories of information sought, containing between 2,000 and 1,000,000 rows of data per year. ACLU viewed this production as only partially responsive to its request because, although spreadsheets for four of the five categories of data included a column for “A-Numbers,” the A-Numbers themselves were redacted and replaced, not with the requested Unique IDs, but with repeated abbreviated citations to the two FOIA exemptions supporting redaction, specifically, 5 U.S.C. § 552(b)(6) and § 552(b)(7)(C), 5 a substitution that did not permit person-centric tracking.

On March 30, 2020, the district court so ordered the parties’ partial stipulation of settlement. Therein, ACLU waived any challenge to ICE’s invocation of the FOIA privacy exemptions to withhold A-Numbers from the produced spreadsheets. At the same time, however, the parties stipulated that on the open question of

5 These subsections exempt “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy,” 5 U.S.C. § 552(b)(6); and “records or information compiled for law enforcement purposes” that “could reasonably be expected to constitute an unwarranted invasion of personal privacy,” id. § 552(b)(7)(C). 10 21-1233 ACLU Immigrants’ Rts. Project v. ICE

whether ICE was required to substitute Unique IDs for the redacted A-Numbers, they would file cross-motions for summary judgment.6

C. Summary Judgment

In its motion for summary judgment, ICE conceded that an A- Number is “[t]he only piece of information stored in a row of IIDS data that connects an entry to an individual uniquely.” Vassilio-Diaz Decl. ¶ 20. Notwithstanding, ICE submitted that, because A- Numbers are exempt as PII, and because the substitution of such numbers with Unique IDs would require the creation of new records—an obligation not imposed by FOIA—ICE’s production to ACLU without Unique IDs had satisfied its FOIA obligations. Further, ICE professed not to have a computer program by which it could create person-centric reports of electronic data, “i.e., with each row corresponding to an individual and showing that individual’s removals, detentions, etc.” Id. ¶ 12. 7

In its cross-motion, ACLU submitted that its Unique ID request effectively sought only a means to track for itself individual aliens throughout the various events reflected in the produced spreadsheets. ACLU characterized the connections it sought to identify among such events as “Relational Information,” which it

6The stipulation acknowledged that ACLU reserved the right to argue for “alternative means for tracking persons within and across the categories of data.” Stipulation & Order ¶ 3, ACLU Immigrants’ Rts. Project v. ICE, 2021 WL 918235 (No. 19-CV-7058), ECF No. 29. 7At oral argument, ICE’s counsel suggested that the agency might be able to produce such person-centric reports, a point we discuss further infra at 38-39. 11 21-1233 ACLU Immigrants’ Rts. Project v. ICE

maintained was itself an agency “record” insofar as it conveyed “information on the relationships between [event] records, which discloses an individual’s interactions with ICE during the deportation process.” Mem. of Law in Supp. of Pl.’s Cross-Mot. for Summ. J. at 1, ACLU Immigrants’ Rts. Project v. ICE, 2021 WL 918235 (No. 19-CV- 7058), ECF No. 34; see also id. at 2 (arguing that “information conveyed by a record” is itself a “record” under FOIA). ACLU also maintained that insofar as A-Numbers convey Relational Information as well as exempt PII, the substitution of Unique IDs for A-Numbers was necessary here to allow the latter to be shielded without impermissibly hiding the former. Id. at 2-3, 20-22. 8

8Before the district court, ACLU also argued that substituting Unique IDs for A-Numbers finds support in FOIA’s requirement that agencies produce records in “any form or format requested . . . if the record is readily reproducible by the agency in that form or format.” Id. at 14 (emphasis omitted) (quoting 5 U.S.C. § 552(a)(3)(B)). Although ACLU does not specifically challenge the district court’s rejection of that argument, it does cite § 552(a)(3)(B) in discussing the statutory scheme as a whole. See Appellant Br. at 12-13. Moreover, one amicus argues that § 552(a)(3)(B) supports reversal. See Br. of Amicus Curiae Electronic Frontier Foundation at 24-26. Thus, we discuss § 552(a)(3)(B), infra at 25-30, consistent with our obligation to consider “the broader context of the statute as a whole” when interpreting FOIA. Seife v. FDA, 43 F.4th 231, 239 (2d Cir. 2022); see also Kamen v. Kemper Fin. Servs., Inc., 500 U.S. 90, 99 (1991) (instructing that “court is not limited to the particular legal theories advanced by the parties, but rather retains the independent power to identify and apply the proper construction of governing law”); Hankins v. Lyght, 441 F.3d 96, 104 (2d Cir. 2006) (applying Kamen to consider statutory language not relied on by party because “[w]e are required to interpret federal statutes as they are written”).

12 21-1233 ACLU Immigrants’ Rts. Project v. ICE

On March 10, 2021, the district court granted summary judgment in favor of ICE and denied summary judgment to ACLU. In explaining its ruling, the district court held that replacing A- Numbers with Unique IDs would have the agency create “new record[s],” which FOIA did not require. ACLU Immigrants’ Rts. Project v. ICE, 2021 WL 918235, at *5. The district court observed that Relational Information was not itself documented in any ICE databases or datapoints but, rather, was a “conceptual abstraction[]” not disclosable under FOIA. Id.; see also id. at *6 (stating that “agency is not obligated to produce information in the abstract” or to segregate and produce “meaning of every datapoint” (internal quotation marks omitted)).

ACLU timely appealed.

DISCUSSION

We review de novo a district court’s grant of summary judgment in a FOIA action, “including the threshold determination of whether the requested records are ‘agency records’ eligible for disclosure under the statute.” Behar v. DHS, 39 F.4th 81, 88 (2d Cir. 2022). A district court may award summary judgment on the basis of agency declarations if the declarations “describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the information withheld logically falls within the claimed exemption, and are not controverted by either contrary evidence in the record or by evidence of agency bad faith.” Knight First Amend. Inst. at Columbia Univ. v. USCIS, 30 F.4th 318, 327 (2d Cir. 2022) (internal quotation marks omitted). When an agency has satisfied its “burden of showing that its search was adequate and that any withheld [records] fall

13 21-1233 ACLU Immigrants’ Rts. Project v. ICE

within an exemption to the FOIA,” a plaintiff seeking to avoid an award of summary judgment to the government must show either bad faith sufficient to “impugn the agency’s affidavits” or “provide some tangible evidence that an exemption claimed by the agency should not apply or summary judgment is otherwise inappropriate.” Carney v. DOJ, 19 F.3d at 812. In this case, the parties do not dispute that A-Numbers are agency records, exempt from FOIA production insofar as they convey PII. See supra at 10. The only issue in dispute is whether ICE was required to substitute Unique IDs for deleted A- Numbers in producing the otherwise non-exempt records responsive to ACLU’s FOIA request.

I. The FOIA Mandate to Disclose Agency Records

A. The Original FOIA Mandate

First enacted in 1966, FOIA mandates that “each [federal] agency, upon any request for records which (i) reasonably describes such records and (ii) is made in accordance with published rules . . . , shall make the records promptly available to any person.” 5 U.S.C. § 552(a)(3)(A) (emphases added). As this court has long recognized, this is “a broadly conceived statute whose overriding aim is disclosure.” FLRA v. U.S. Dep’t of Veterans Affs., 958 F.2d 503, 505 (2d Cir. 1992); see N.Y. Times Co. v. DOJ, 939 F.3d 479, 488 (2d Cir. 2019) (“FOIA ‘adopts as its most basic premise a policy strongly favoring public disclosure of information in the possession of federal agencies.’” (quoting Halpern v. FBI, 181 F.3d 279, 286 (2d Cir. 1999))). Nevertheless, as the highlighted text makes plain, and as the Supreme Court has confirmed, the mandated disclosure pertains not to information generally but, rather, to agency “records” in particular. 14 21-1233 ACLU Immigrants’ Rts. Project v. ICE

Forsham v. Harris, 445 U.S. 169, 178 (1980) (stating that, although Congress, in enacting FOIA, “undoubtedly sought to expand public rights of access to Government information,” it “limited access to ‘agency records’” (quoting 5 U.S.C. § 552(a)(4)(B))); accord Goldgar v. Off. of Admin., Exec. Off. of the President, 26 F.3d 32, 34 (5th Cir. 1994) (“FOIA applies only to information in record form.”); see Yeager v. DEA, 678 F.2d 315, 321 (D.C. Cir. 1982) (“Agencies are not . . . required to commit to paper information that does not exist in some form as an agency ‘record.’”). 9

FOIA’s definitional section, 5 U.S.C. § 551, assigns no specialized statutory meaning to the word “record.” Thus, we construe the word according to its common meaning, which references information that is written, documented, or otherwise preserved in a tangible, perceivable, retrievable form. 10 Information

9 See also Ann H. Wion, Note, The Definition of “Agency Records” Under the Freedom of Information Act, 31 STAN. L. REV. 1093, 1095 (1979) (observing that “[r]equested material does not fall within the FOIA if it is not in the form of a ‘record’”); Stephen D. Hall, Comment, What Is a Record? Two Approaches to the Freedom of Information Act’s Threshold Requirement, 1978 BYU L. REV. 408, 415 (stating that courts treat “term ‘record’ [as] a threshold requirement” to FOIA production). One judge attributes the confusion that sometimes arises in distinguishing between “information” and “records” to “the fact that courts permit requesters to ask for general categories of information, but agencies must release records.” Cause of Action Inst. v. DOJ, 999 F.3d 696, 705 (D.C. Cir. 2021) (Rao, J., concurring) (emphases in original). 10See Record, BLACK’S LAW DICTIONARY (11th ed. 2019) (defining “record” as “[a] documentary account of past events, usu. designed to memorialize those events”; “information that is inscribed on a tangible medium or that, having been stored in an electronic or other medium, is retrievable in perceivable form”); XIII OXFORD ENGLISH DICTIONARY 360 (J.A. Simpson &

15 21-1233 ACLU Immigrants’ Rts. Project v. ICE

that is undocumented, conceptual, or abstract is not a “record” under FOIA. It is with this understanding of “record” that we consider FOIA’s requirement for “full agency disclosure unless information is exempted under clearly delineated statutory language.” Dep’t of Air Force v. Rose, 425 U.S. 352, 360-61 (1976) (quoting S. REP. NO. 89-813 at 3 (1965)).

There are “nine, exclusive” FOIA exemptions. American Oversight v. DOJ, 45 F.4th 579, 587 (2d Cir. 2022); see 5 U.S.C. § 552(b)(1)-(9). Courts construe these exemptions narrowly, see FBI v. Abramson, 456 U.S. 615, 630 (1982); Long v. Off. of Pers. Mgmt., 692 F.3d 185, 190 (2d Cir. 2012), and place the burden on the invoking agency to demonstrate applicability, see Carney v. DOJ, 19 F.3d at 812.

In sum, as originally enacted, FOIA requires “virtually every document,” i.e., record, “generated by an agency [to be made] available to the public in one form or another,” unless an agency clearly demonstrates that it “falls within one of the Act’s nine exemptions.” NLRB v. Sears, Roebuck & Co., 421 U.S. 132, 136 (1975).

B. E-FOIA’s Extension of the Mandate to Electronic Records

By the end of the Twentieth Century, Congress recognized that “agency records” were no longer all documented on “pieces of

E.S.C. Weiner eds., 2d ed. 1989) (defining “record” as “[a]n account of some fact or event preserved in writing or other permanent form”); WEBSTER’S THIRD NEW INTERNATIONAL DICTIONARY 1897 (Philip Babcock Gove ed. 2002) (defining “record” as “evidence, knowledge or information remaining in permanent form (as a relic, inscription, document)”). 16 21-1233 ACLU Immigrants’ Rts. Project v. ICE

paper . . . placed in filing cabinets.” H.R. REP. NO. 104-795, at 11 (1996). A growing “volume of Federal agency records” was being “created and retained in electronic formats.” Id. Accordingly, in 1996, Congress enacted the Electronic Freedom of Information Act Amendments (“E-FOIA”), Pub. L. No. 104-231, 110 Stat. 3048 (1996), which “codified a principle already established” by federal courts, i.e., that “‘the full disclosure policies of the FOIA’” pertain as much to records created or stored electronically as to those documented on paper. Ctr. for Investigative Reporting v. DOJ, 14 F.4th 916, 938 (9th Cir. 2021) (quoting Institute for Just. v. IRS, 941 F.3d 567, 571 (9th Cir. 2019)); see S. REP. NO. 104-272, at 29 (1996) (stating that “[a]s a general rule, information maintained in electronic form should be no less subject to the FOIA than information maintained in conventional paper record form”). Toward this end, E-FOIA describes a disclosable agency “record” as “any information that would be an agency record subject to the requirements of [5 U.S.C. § 552] when maintained by an agency in any format, including an electronic format.” 5 U.S.C. § 552(f)(2)(A). 11 Thus, E-FOIA makes plain that the threshold “record” requirement for FOIA, as well as that Act’s full-disclosure,

11As the D.C. Circuit has observed, this language does “not broaden the concept of an agency record”; it merely clarifies that, under FOIA, a “record” includes documented information in all formats. Aguiar v. DEA, 992 F.3d 1108, 1111 (D.C. Cir. 2021) (quoting H.R. REP. NO. 104-795, at 19- 20). That observation finds support in the legislative history. See, e.g., H.R. REP. NO. 104-795, at 19 (stating that “matter not previously subject to FOIA when maintained in a non-electronic format is not made subject to FOIA by this bill”). 17 21-1233 ACLU Immigrants’ Rts. Project v. ICE

narrow-exemption philosophy, applies equally in the electronic and in the physical contexts. 12

As relevant here, E-FOIA further updates FOIA by adding provisions requiring federal agencies (1) to provide a responsive “record in any form or format requested by the person if the record is readily reproducible by the agency in that form or format,” id. § 552(a)(3)(B); and (2) to make “reasonable efforts to search for the records in electronic form or format”—defining “search” as “to review, manually or by automated means, agency records for the purpose of locating those records which are responsive to a request,” id. § 552(a)(3)(C)-(D). In imposing this search requirement, Congress specifically recognized that “[c]omputer records found in a database rather than in a file cabinet may require the application of codes or some form of programming to retrieve the information.” H.R. REP. NO. 104-795, at 22. The need to employ such codes or programming would “not amount to the creation of records.” Id.; see Ctr. for Investigative Reporting v. DOJ, 14 F.4th at 938 (holding that “using a query to search for and extract a particular arrangement or subset of data already maintained in an agency’s database does not amount to the creation of a new record”). At the same time, however, E-FOIA, like FOIA, requires agencies to disclose only existing records, “not [to] create documents that do not exist.” H.R. REP. NO. 104-795, at 22. Thus, agencies and courts are left to the not-always-easy task of identifying “when the manipulation of data points in an electronic

12See generally H.R. REP. NO. 104-795, at 20 (stating that, after E-FOIA, as before, it is “information that passes the threshold test of being an agency record” that is subject to disclosure “[n]o matter how it is preserved” (emphasis added)). 18 21-1233 ACLU Immigrants’ Rts. Project v. ICE

database . . . crosses the all-important line between searching a database, on the one hand, and either creating a record or conducting research in a database on the other.” National Sec. Couns. v. CIA, 898 F. Supp. 2d 233, 270-71 (D.D.C. 2012).

C. FOIA’s Segregability Requirement

FOIA’s segregability requirement can sometimes inform that inquiry. It instructs that “[a]ny reasonably segregable portion of a record shall be provided to any person requesting such record after deletion of the portions which are exempt.” 5 U.S.C. § 552(b). Thus, agencies responding to FOIA requests must “differentiate among the contents of a document rather than . . . treat it as an indivisible ‘record,’” FBI v. Abramson, 456 U.S. at 626, disclosing “non-exempt portions . . . unless they are inextricably intertwined with exempt portions,” Mead Data Cent., Inc. v. U.S. Dep’t of Air Force, 566 F.2d 242, 260 (D.C. Cir. 1977); see U.S. Dep’t of State v. Ray, 502 U.S. 164, 173 (1991) (observing that agency has burden of demonstrating inability to segregate).

Congress reinforced the segregability obligation in 2016 when, “concern[ed] that ‘some agencies [were] overusing FOIA exemptions,’” Seife v. FDA, 43 F.4th 231, 235 (2d Cir. 2022) (second alteration in original) (quoting S. REP. NO. 114-4, at 2 (2015)), it enacted the FOIA Improvement Act of 2016, Pub. L. No. 114-185, 130 Stat. 538, one provision of which specifically requires agencies to “consider whether partial disclosure of information is possible whenever the agency determines that a full disclosure of a requested record is not possible” and to “take reasonable steps necessary to segregate and release nonexempt information,” 5 U.S.C. § 552(a)(8)(A)(ii). 19 21-1233 ACLU Immigrants’ Rts. Project v. ICE

With these principles in mind, we consider the challenged award of summary judgment to ICE.

II. “Relational Information”

We begin by briefly addressing ACLU’s primary argument for urging error in the district court’s finding that the substitution of Unique IDs for A-Numbers requires the creation of new records. ACLU submits that the substitution reveals “Relational Information”—i.e., “information on the relationships between records, which disclose an individual’s interactions with ICE during the deportation process”—which is not a new record but, rather, a non-exempt record already existing in ICE databases. Mem. of Law in Supp. of Pl.’s Cross-Mot. for Summ. J. at 1. Alternatively, ACLU maintains that Relational Information is a segregable, non-exempt component of A-Numbers, which ICE does not dispute are pre- existing records. These arguments present certain challenges, 13 which we need not resolve conclusively because, in the end, we conclude that ICE was not entitled to summary judgment.

In reaching that conclusion, we note that ACLU did not identify “Relational Information” as the records being sought in either its FOIA request to ICE or in its initial filings with the district court. Rather, ACLU identified the requested records as “electronic spreadsheet data,” i.e., datapoints existing within ICE’s databases

13For example, a particular database query can identify, and in that same sense link, responsive existing datapoints. That may demonstrate a relationship among these datapoints. But is that relationship documented in the database separate and apart from the responsive datapoints? The question admits no easy answer. 20 21-1233 ACLU Immigrants’ Rts. Project v. ICE

produced in a spreadsheet format. See ACLU FOIA Request, at 1. 14 The identification of existing datapoints as records disclosable under FOIA finds support in caselaw and is not here disputed by ICE. See, e.g., Institute for Just. v. IRS, 941 F.3d at 570 (“In the context of a request for a database, FOIA requires agencies to disclose all [existing] non- exempt data points.” (internal quotation marks omitted)).

Focusing on these existing datapoints, we conclude that, in the circumstances of this case, A-Numbers are simply a tool—a sort of key or code—chosen by ICE to access its event-centric databases in such a way as to obtain existing datapoints. To the extent A-Numbers are themselves FOIA-exempt records, ACLU argues for their replacement by Unique IDs—numbers meaningless in themselves but able to perform the same access function as A-Numbers—a process that would neither document any new information nor create any new records in ICE databases. That argument persuades without regard to whether the relationship among such datapoints is a “record” under FOIA for reasons we now explain.

III. ICE Must Produce the Responsive Datapoints in a Person- Centric Arrangement or Provide ACLU with a Means to Do So Itself

14Even though ACLU instructed ICE to substitute Unique IDs for exempt A-Numbers in the requested spreadsheets, it appears to have recognized that it was the datapoints reported in the spreadsheets, not the links that could be identified by means of the Unique IDs, that were the disclosable FOIA records. See, e.g., Hausman Decl. ¶¶ 3, 6-7, 13 (identifying sought “records” as datapoints drawn from ICE databases, and explaining that Unique IDs were sought to “link the[se] records”). 21 21-1233 ACLU Immigrants’ Rts. Project v. ICE

From the outset, ACLU has made clear that what it seeks are requested fields of data in a spreadsheet format that allows it to track datapoints pertaining to individual, unidentified aliens. ICE acknowledges that it can, and on an ad hoc basis does, itself retrieve datapoints pertaining to individual aliens from across its event- centric databases using A-Numbers. Thus, the question we consider is whether under FOIA, ICE’s acknowledged ability to access immigration records in a person-centric manner—in other words, its own ability to track a single individual across the various stages of immigration proceedings—requires ICE to afford the public (here, ACLU) similar access to the data.

In urging a negative answer, ICE relies essentially on (1) the exempt status of A-Numbers; and (2) FOIA’s requirement that agencies produce existing records, not that they create new ones. We consider these arguments mindful that FOIA’s exemptions must be construed narrowly, see FBI v. Abramson, 456 U.S. at 630, and that even when exemptions shield records, agencies must take “reasonable steps” to ensure the release of all non-exempt information in any readily reproducible requested form or format, 5 U.S.C. § 552(a)(3)(B), (a)(8)(A)(ii). When we do that in the particular circumstances here, text, context, and history lead us to reject ICE’s arguments.

A. Construing Exemptions Narrowly

Applying these principles here, we note ICE’s acknowledgment that, at present, exempt A-Numbers are the only datapoints within its databases “that connect[] an entry uniquely to an individual.” Appellee Br. at 6. Thus, ICE concedes that “[w]ithout . . . A-numbers, the ACLU cannot use ICE’s data to track

22 21-1233 ACLU Immigrants’ Rts. Project v. ICE

individuals between the separate IIDS datasets.” Mem. of Law in Supp. of Def.’s Mot. for Summ. J. at 13, ACLU Immigrants’ Rts. Project v. ICE, 2021 WL 918235 (No. 19-CV-7058), ECF No. 31. 15 We are further mindful, however, that A-Numbers are not essential to perform this function; other numbers, letters, symbols, or combinations thereof could be substituted to the same effect. In these circumstances—i.e., where ICE has chosen to make exempt A- Numbers the essential code for gaining person-centric access to datapoints in its event-centric databases, and where ICE itself uses that key or code to gain such access—we conclude that ICE may not rely on A-Numbers’ exemption from FOIA disclosure to deny the public equal access to non-exempt records. Rather, ICE must find an alternative means to provide ACLU with responsive person-centric access to non-exempt records.

Indeed, to hold otherwise could have the perverse effect of encouraging agencies to make exempt records the singular means for gaining access to non-exempt records responsive to a particular query

15 It is not clear from the record whether (1) ICE can use A-Numbers to search for data across all its databases or only in IIDS or in EID, see Oral Arg. at 33:57-34:30, 35:08-35:20; and (2) such a search is sufficient, in any event, to respond to ACLU’s FOIA request. To the extent relevant, these matters can be pursued further on remand. Nevertheless, we make two observations. First, as the D.C. Circuit has stated, while “[t]here is no [FOIA] requirement that an agency search every record system . . . [,] the agency cannot limit its search to only one record system if there are others that are likely to turn up the information requested.” Oglesby v. U.S. Dep’t of Army, 920 F.2d 57, 68 (D.C. Cir. 1990). Second, FOIA itself does not require an agency to search for responsive records “when such efforts would significantly interfere with the operation of the agency’s automated information system.” 5 U.S.C. § 552(a)(3)(C). 23 21-1233 ACLU Immigrants’ Rts. Project v. ICE

and, thereby, effectively to conceal those records from the public, at least in the way responsive to the query. 16 Such an outcome is contrary to the “clear legislative intent” underlying FOIA: “to assure public access to all governmental records whose disclosure would not significantly harm specific governmental interests.” Dep’t of Air Force v. Rose, 425 U.S. at 365 (internal quotation marks omitted).

Here, ACLU’s proposed substitution of Unique IDs for A- Numbers is a reasonable step for affording the public the same person-centric access to non-exempt records that is available to ICE. In reaching that conclusion, we act in furtherance of our obligation “narrowly” to construe FOIA’s exemptions. FBI v. Abramson, 456 U.S. at 630. In doing so here, we distinguish between the content of an electronic record and the function it may have been assigned within a computer system. The relevant FOIA exemptions, 5 U.S.C. § 552(b)(6)-(7), protect against “unwarranted invasion[s] of personal privacy.” These exemptions support ICE withholding A-Numbers from the public because their content is effectively all PII. But the same conclusion does not obtain with respect to the function that ICE has assigned A-Numbers within its electronic databases, which is to afford person-centric access to non-exempt records across ICE’s event-centric databases. As already noted, it was not necessary for ICE to use an exempt record to perform this function. Any combinations of numbers, letters, or symbols would do.

Moreover, precisely because Unique IDs can be meaningless in themselves, they do not alter the content of any exempt record. Nor

16 We do not suggest that such is ICE’s intent here. 24 21-1233 ACLU Immigrants’ Rts. Project v. ICE

do they document any new information, or otherwise create any new records. Rather, Unique IDs serve only to substitute for deleted exempt A-Numbers in order to preserve a function necessary to afford the public the same person-centric access to non-exempt records that ICE already has. In these circumstances, the substitution of Unique IDs for A-Numbers is a reasonable step in shielding the exempt PII content of A-Numbers, while preserving the access function formerly performed by those exempt records.

A physical analogy may be useful. If an agency were to maintain non-exempt, person-centric records in a vault, the lock of which could be opened only with a combination of exempt numbers, the agency could not decline to produce documents from the vault by invoking the exemption afforded to the lock combination. Rather, FOIA would oblige the agency to open the vault itself and produce the responsive records. Or, the agency would have to change the combination to non-exempt numbers and thereby afford public access. So here, ICE must itself use A-Numbers to produce a spreadsheet of person-centric data for ACLU, see infra at 38-39, or, as ACLU here requests, ICE must change the “lock” combination numbers so that ACLU can itself access records in a person-centric manner.

B. E-FOIA’s “Form or Format” Requirement

This conclusion not only comports with the strict application of FOIA exemptions, but also finds some support in the statutory provision requiring agencies to provide their non-exempt records to the public in “any form or format . . . readily reproducible.” 5 U.S.C. § 552(a)(3)(B). Here, we conclude that ICE’s substitution of Unique

25 21-1233 ACLU Immigrants’ Rts. Project v. ICE

IDs for A-Numbers would effectively allow it to provide non-exempt records in the requested person-centric form or format. In concluding otherwise, the district court relied on Sai v. TSA, 466 F. Supp. 3d 35 (D.D.C. 2020), which narrowly construed “form” as used in 5 U.S.C. § 552(a)(3)(B) to refer only to “the media—e.g., paper or thumb drive” in which a record might be produced, and “format” to refer only “to the electronic ‘structure for the processing, storage, or display’ of data . . . —e.g., PDF or JPEG.” Id. at 47-48 (quoting Format, CONCISE OXFORD ENGLISH DICTIONARY (Oxford University Press, 12th ed. 2011)); accord ACLU Immigrants’ Rts. Project v. ICE, 2021 WL 918235, at *6.

Such a construction does not comport with our own understanding of the ordinary meaning of “form” and “format.” Dictionary definitions of these words indicate that records might be supplied in whatever “pattern or schema,” WEBSTER’S THIRD NEW INTERNATIONAL DICTIONARY, supra note 10, at 892 (defining “form”); “general plan of physical organization or arrangement,” id. at 893 (defining “format”); or “style or manner of arrangement or presentation,” VI OXFORD ENGLISH DICTIONARY, supra note 10, at 85 (defining “format”), requested. 17

17We are unpersuaded by Sai v. TSA’s reliance on a computer-centric definition of “format” to limit that word to file type, as it is uncontested that the word “format” as used in § 552(a)(3)(B) applies to a paper record too. Insofar as Sai v. TSA—not the dictionary it cites—interprets “structure for the processing, storage, or display” to mean file type, that interpretation is not obvious, particularly in light of other definitions in the computer context that define format more expansively to reference the way data is “arranged.” See VI OXFORD ENGLISH DICTIONARY, supra note 10, at 85

26 21-1233 ACLU Immigrants’ Rts. Project v. ICE

Context also cautions against a narrow construction of “format.” In another § 552 E-FOIA provision, Congress states that the law’s disclosure obligation reaches “any information that would be an agency record . . . in any format, including an electronic format.” Id. § 552(f)(2)(A) (emphasis added). Sai v. TSA does not dispute that this reference to an “electronic format” is not singular. See 466 F. Supp. 3d at 45; United States v. Edwards, 834 F.3d 180, 193 (2d Cir. 2016) (stating that use of indefinite article “implies the possibility of a larger number than one”). More to the point, the statutory use of the word “any” has long signaled “Congress’s intent to sweep broadly to reach all varieties of the item referenced.” Cohen v. JP Morgan Chase & Co., 498 F.3d 111, 117 (2d Cir. 2007) (emphasis added); see Republic of Iraq v. Beaty, 556 U.S. 848, 856 (2009) (“[T]he word ‘any’ . . . has an expansive meaning, giving us no warrant to limit the class of [things referenced].” (some internal quotation marks and citation omitted)).

Additionally, although E-FOIA’s legislative history sometimes references different media when discussing “form,” see, e.g., H.R. REP. NO. 104-795, at 20 (stating that “information should be made available in another electronic form, e.g., CD-ROM or disc”), it elsewhere emphasizes that the purpose of the “form or format” provision is to “provide public access to information in more meaningful formats” so that information can be more “useable,” Federal Information Policy

(defining “format” in the context of “Computers,” as “[a] particular arrangement of data or characters in a record, instruction, word, etc., in a form that can be processed or stored by a computer”); Format, AMERICAN HERITAGE DICTIONARY, https://www.ahdictionary.com/word/search. html?q=format (last viewed Dec. 7, 2022) (defining “format” in the context of “Computers” as “[t]he arrangement of data for storage or display”). 27 21-1233 ACLU Immigrants’ Rts. Project v. ICE

Oversight: Hearing Before the Subcomm. on Gov’t Mgmt., Info. & Tech. of the H. Comm. on Gov’t Reform & Oversight, 104th Cong. 12 (1996) (statement of Sen. Patrick Leahy 18). This suggests a certain flexibility in the format requirement. Still elsewhere, and as pertinent here, the history instructs that “agencies should search for and retrieve data in the same manner used in the ordinary course of agency business with their existing retrieval-programming capability,” and should even “comply with . . . requests” to “have data retrieved according to specifications other than those ordinarily used.” S. REP. NO. 104-272, at 28.

We do not here attempt to delineate the outer boundaries of FOIA’s “form or format” requirement, although we note that the statute itself conditions production on the records being “readily reproducible” by the agency in the requested form or format. 5 U.S.C. § 552(a)(3)(B). We conclude only that text, context, and history support a more liberal construction of the provision than the district court here recognized.

Like the D.C. Circuit, however, we are mindful that identifying readily reproducible forms or formats presents particular challenges in the electronic context given constantly “evolving practices of data storage and use.” Aguiar v. DEA, 992 F.3d 1108, 1112 (D.C. Cir. 2021). For this reason, in Aguiar itself, the court left open the question

18Senator Leahy was E-FOIA’s leading sponsor. See S.1090 - Electronic Freedom of Information Improvement Act of 1996, CONGRESS.GOV, https://www.congress.gov/bill/104th-congress/senate-bill/1090 (last viewed Dec. 7, 2022).

28 21-1233 ACLU Immigrants’ Rts. Project v. ICE

“whether and under what circumstances a duty of production would arise under FOIA when an agency technically stores information in one way, such as numerically as GPS coordinates, but typically accesses that information in another way, such as graphically as maps.” Id. We cannot avoid that question here because although ICE stores immigration data by event, it can, and on an ad hoc basis does, access that information in a person-centric manner in the regular course of agency business. 19

E-FOIA’s legislative history suggests that Congress anticipated that agencies might store electronic records in ways different from how the public might request them. In such circumstances Congress, nevertheless, expected agencies to take reasonable steps to effect retrieval in the requested form or format, even if that required some conversion of data. Senator Patrick Leahy made this point when he stated:

If an agency maintains an electronic information system in such a way that objectively understandable access to any nonexempt information in it is dependent upon a computer program or software that is unavailable to the public, then the agency must upon request, . . . take all

19Aguiar v. DEA is distinguishable from this case because (1) ICE itself uses the A-Numbers to serve the function of accessing records in a person- centric manner, and (2) the Unique IDs do not document any new information. In Aguiar, not only did the agency not itself view data in the particular graphical arrangement plaintiff requested, it also did not possess the software required to access the data in the form requested. See 992 F.3d at 1113. Moreover, supplying the requested graphical arrangement would have required “editorial judgment” on the agency’s part, id., a requirement absent here given the meaninglessness of Unique IDs, see infra at 35 & n.21. 29 21-1233 ACLU Immigrants’ Rts. Project v. ICE

reasonable steps to convert the data in order to afford FOIA access to it in a requested electronic form.

S. REP. NO. 104-272, at 32. Here, person-centric access to non-exempt records in ICE databases is “dependent upon” A-Numbers, records that because of their PII content are “unavailable to the public.” One way of “convert[ing]” exempt A-Numbers to afford the public the same person-centric access to non-exempt records as is available to ICE could be to produce all responsive datapoints from its event- centric databases but to substitute Unique IDs for exempt A- Numbers, as ACLU requests. This would allow ACLU to arrange the non-exempt records for itself in a person-centric manner or “format.”

In approving this course, we are mindful that Congress foresaw the need for an agency to apply “codes or some form of programming” to retrieve records in a requested electronic format, and expressly stated that the use of such codes or programming would “not amount to the creation of records.” H.R. REP. NO. 104- 795, at 22. That conclusion applies as much to substituted access code numbers—here, Unique IDs in place of exempt A-Numbers—as it does to the application of new computer coding or programming to retrieve responsive records. Though the tools are different, each functions to retrieve non-exempt records in their existing state but organized in a particular format. Thus, in the urged substitution, ICE would query databases for datapoints by reference to meaningless Unique IDs rather than exempt A-Numbers. Like the D.C. Circuit, we are satisfied that “using a query to search for and extract a particular arrangement or subset of data already maintained in an agency’s database does not amount to the creation of a new record.” Ctr. for Investigative Reporting v. DOJ, 14 F.4th at 938. 30 21-1233 ACLU Immigrants’ Rts. Project v. ICE

C. FOIA’s Segregation and Redaction Principles

The approved substitution also finds support in principles applicable to FOIA’s segregation and redaction provisions, which expect an agency to produce the segregable, non-exempt information in a record after “deleti[ng]” exempt information. 5 U.S.C. § 552(b). In the physical context, deletion is frequently accomplished by cutting or blacking out exempt text from paper records. But such techniques do not always transfer to more complex electronic formats. Thus, some courts have approved the use of unique identifiers or other anonymization techniques to segregate exempt from non-exempt information within an electronic record. 20 We need not here decide

20See, e.g., Evans v. BOP, 951 F.3d 578, 587 (D.C. Cir. 2020) (remanding for consideration, inter alia, of whether faces in prison video could be blurred or replaced in such a way as to allow parties to see when relevant actions were taken by persons in guard uniforms versus persons in prison garb); Hawkinson v. ICE, 554 F. Supp. 3d 253, 275 (D. Mass. 2021) (stating that substitution of “unique identifier” was “arguably . . . a method of redaction” that may be required in some circumstances); Mattachine Soc’y of Wash., D.C. v. DOJ, 267 F. Supp. 3d 218, 228 (D.D.C. 2017) (holding that substitution of alphanumeric markers for names throughout documents “protect[ed] . . . privacy interests” while “allowing the public to better study the effects” of particular executive order); City of Chicago v. ATF, No. 00-CV- 3417, 2001 WL 34088619, at *4-5 (N.D. Ill. Mar. 8, 2001) (stating that “unique identifier code would serve to separate the sensitive information” identifying persons and gun serial numbers from relevant “information regarding trafficking patterns”), rev’d on other grounds, 423 F.3d 777 (7th Cir. 2005); ACLU of S. Cal. v. Super. Ct., 400 P.3d 432, 440-41 (Cal. 2017) (remanding for trial court to consider under California FOIA feasibility of different methods for anonymizing data, including “substitution” of “unique (fictional) number[s]” for exempt datapoints); Bowie v. Evanston Cmty. Consol. Sch. Dist. No. 65, 538 N.E.2d 557, 560-61 (Ill. 1989) (holding, under Illinois FOIA, that to protect privacy while disclosing requested

31 21-1233 ACLU Immigrants’ Rts. Project v. ICE

that such substitution should be approved in all circumstances. We conclude only that Unique IDs are apt here where they do not substitute for any content in an exempt document. Indeed, in responding to ACLU’s FOIA request, ICE can withhold exempt A- Numbers in their entirety. The substitution of Unique IDs for redacted A-Numbers here serves only to maintain a function within ICE databases without which the public cannot access non-exempt records in the same manner as the agency does.

This does not run afoul of the D.C. Circuit’s reasoning in Yeager v. DEA, relied on by ICE. There, the court declined to order DEA to alter the content of an agency record “in such a way that [the record] no longer falls within a specific [FOIA] exemption.” 678 F.2d at 322. The court reasoned that, in enacting FOIA, Congress did not intend “any manipulation or restructuring of the substantive content of a record when it commanded agencies to ‘delete’ exempt information.” Id. at 323 (emphasis added). Rather, it was the “deletion of (exempt) information” from an agency record that would “provide full protection for the purposes to be served by the exemption.” Id. (internal quotation marks omitted).

records, defendant was required to “produce a masked and scrambled record,” which did “not lead to the creation of a ‘new’ record”); Kryston v. Bd. of Educ., 77 A.D.2d 896, 897, 430 N.Y.S.2d 688, 690 (2d Dep’t 1980) (holding, under New York FOIA, that “rearranging or ‘scrambling’” records does not constitute record creation and would simultaneously protect privacy, provide requested records, and impose no onerous burden on agency). But see, e.g., Institute for Just. v. IRS, 547 F. Supp. 3d 1, 8 n.3 (D.D.C. 2021) (stating that, on remand, agency is not required to create “anonymous identifiers” for the officers or agents listed in records because FOIA does not obligate creation of records). 32 21-1233 ACLU Immigrants’ Rts. Project v. ICE

We note that Yeager predates E-FOIA, and thus its pronouncements were made without the benefit of Congress’s views on the particular efforts that agencies might reasonably be expected to take in retrieving requested electronic records. See supra at 16-19 (quoting H.R. REP. NO. 104-795, at 22; S. REP. NO. 104-272, at 31). In any event, this case is distinguishable from Yeager. There, the proposed replacement of the specific place and date of certain events with general references to geographic region and span of years would undoubtedly have altered the “substantive content” of the produced record. Yeager v. DEA, 678 F.2d at 319 n.9, 323. By contrast, the substitution of Unique IDs here would make no changes to the substantive content of exempt A-Numbers. Nor would it permit A- Numbers to be produced in some altered state. Rather, Unique IDs would replace A-Numbers in their entirety for the sole purpose of preserving the access function A-Numbers perform within ICE’s computer system.

The particular Unique IDs substituted for this purpose would be no more relevant to the performance of that function than the particular A-Numbers had been. All that matters is that there be some number, letter, or symbol that can be tracked across ICE databases to retrieve existing, non-exempt datapoint records pertaining to individual aliens. Absent preservation of this function, the exemption afforded A-Numbers effectively becomes a lock that, in violation of FOIA, denies the public access to non-exempt records in the same manner that the records are available to the agency.

We have already discussed those parts of E-FOIA’s legislative history indicating that Congress did not view an agency’s use or

33 21-1233 ACLU Immigrants’ Rts. Project v. ICE

creation of new codes or queries to access electronic records responsive to a FOIA request as the creation of a new record. See supra at 29-30. In urging otherwise, ICE cites this court’s decision in ACLU v. DOJ, 681 F.3d 61 (2d Cir. 2012). In that case, we ruled that a district court had exceeded its authority under FOIA by proposing a disclosure “compromise,” whereby classified information in responsive records would be replaced by “a purportedly neutral phrase composed by the court.” Id. at 71. We stated that a court cannot order “an agency to produce anything other than responsive, non-exempt records,” and that requiring an agency to “alter[] or modif[y]” existing records “would effectively be ‘creating’ documents—something FOIA does not obligate agencies to do.” Id. ICE submits that this reasoning tracks that of other courts of appeals and warrants affirming the award of summary judgment in its favor. See Flightsafety Servs. Corp. v. DOL, 326 F.3d 607, 613 (5th Cir. 2003) (holding that requiring agency to “insert new information in place of the redacted information requires the creation of new agency records, a task that the FOIA does not require the government to perform”); Students Against Genocide v. Dep’t of State, 257 F.3d 828, 837 (D.C. Cir. 2001) (rejecting request that agency “produce new photographs at different resolution” to mask confidential information, stating that “although agencies are required to provide ‘any reasonably segregable,’ non-exempt portion of an existing record, 5 U.S.C. § 552(b), they are not required to create new documents”). We disagree.

Neither ACLU v. DOJ nor any of the other cases cited by ICE are akin to this one. In ACLU v. DOJ, the proposed substitution not only would have altered the “substantive content” of the exempt 34 21-1233 ACLU Immigrants’ Rts. Project v. ICE

record—a concern highlighted in Yeager v. DEA, 678 F.3d at 323, discussed supra at 32-33—but also would have required the exercise of judgment and analysis in effecting the proposed substitution. By contrast, the substitution here would have no effect on the substantive content of A-Numbers. See supra at 24-25. Substitution would simply preserve the function that such numbers performed in identifying responsive, non-exempt records within ICE databases. Further, we understand that the substitution of meaningless Unique IDs could be effected by an automated replacement program without any agency (or court) analysis, research, or judgment. 21 As for what programming steps an agency must take to identify and retrieve non- exempt records, ACLU v. DOJ had no occasion to consider that question, much less to consider it in circumstances where, as here, the agency made its ability to identify and retrieve responsive non- exempt records dependent on an exempt record. In sum, because the circumstances and issues for decision in this case differ significantly

21In ACLU v. DOJ, we expressed particular concern that it was the district court, rather than the agency, exercising judgment about redactions and substitutions for classified material. See 681 F.3d at 71-72. In Everytown for Gun Safety Support Fund v. ATF, 403 F. Supp. 3d 343 (S.D.N.Y. 2019), rev’d and remanded on other grounds, 984 F.3d 30 (2d Cir. 2020), the district court suggested that where generating responsive information requires even the agency “to engage in additional research or conduct additional analyses above and beyond the contents of its database,” there was the possibility of new record creation, id. at 359. We need not here decide whether to adopt this Everytown test. It suffices to note that the proposed substitution in this case raises none of the Everytown concerns.

35 21-1233 ACLU Immigrants’ Rts. Project v. ICE

from those in ACLU v. DOJ, we do not think that the holding in that case precludes the proposed substitution here.

D. The Burden of Substitution

Finally, we consider whether the substitution of Unique IDs for A-Numbers is a reasonable or unduly burdensome means for producing the requested non-exempt records. See generally 5 U.S.C. § 552(a)(8)(A)(ii)(II) (referencing segregation). As noted supra at 18, FOIA expressly requires an agency to make “reasonable efforts to search for . . . records in electronic form or format.” Id. § 552(a)(3)(C). And Congress, in imposing this search requirement, recognized that “[c]omputer records found in a database rather than in a file cabinet may require the application of codes or some form of programming” for their retrieval. H.R. REP. NO. 104-795, at 22.

Nevertheless, the “time and resources” that an agency must commit to retrieve electronic records may be pertinent to identifying the efforts that can reasonably be expected to retrieve responsive agency records. Cook v. Nat’l Archives & Recs. Admin., 758 F.3d 168, 178 (2d Cir. 2014) (internal quotation marks omitted). The “value” of what can be retrieved can also inform the inquiry. Mays v. DEA, 234 F.3d 1324, 1327 (D.C. Cir. 2000) (explaining “excision of exempt information” not required where it “would impose significant costs on the agency and produce an edited document with little informational value” (internal quotation marks omitted)).

Focusing first on value, ICE itself acknowledges that, without exempt A-Numbers, it is impossible to access any non-exempt records in the same person-centric manner that ICE can. Thus, to the extent

36 21-1233 ACLU Immigrants’ Rts. Project v. ICE

the proposed substitution is necessary to afford such comparable access, it yields high informational value.

As for the burden imposed, the few courts to have considered the question have concluded that it is not unduly burdensome to require agencies already possessing computer capabilities to acquire software or to craft new computer queries to be able to retrieve responsive electronic records from their databases. See Stahl v. DOJ, No. 19-CV-4142, 2021 WL 1163154, at *7 (E.D.N.Y. Mar. 26, 2021) (observing that if agency could avoid production of responsive video recording by arguing that it would need to acquire video-editing software, “no video would ever be disclosed”); City of Chicago v. ATF, 2001 WL 34088619, at * 5 (deeming few hours required to write computer program to retrieve encrypted data to be “minuscule” burden); see also S. REP. NO. 104-272, at 28 (“When requesters seek to have data retrieved according to specifications other than those ordinarily used by agencies for data retrieval from the database system involved, agencies should comply with such requests where they can reasonably and efficiently do so.”). We assume that this conclusion may vary depending on circumstances.

We need not pursue the matter further here, however, because ICE has conceded that “the burden” involved in substituting Unique IDs for A-Numbers “would not meet the threshold applied to the burden for segregability.” Appellee Br. at 13 n.2. 22 Insofar as any

22 While ICE here spoke of “segregability,” we think it used the term, even if not aptly, to reference the substitution being sought here by ACLU. See App’x 129 (stating before district court that ICE was not arguing that burden of substituting Unique IDs for A-Numbers would exceed

37 21-1233 ACLU Immigrants’ Rts. Project v. ICE

questions may remain as to ICE’s technical capability to substitute Unique IDs for A-Numbers consistently across all five databases, we leave those to be addressed by the district court on remand consistent with this opinion and after any further inquiry into the nature of ICE databases that may be warranted.

E. The “Big Spreadsheet” Alternative

One final observation. Although the issue on summary judgment (and, thus, on appeal) was limited to whether FOIA requires ICE to substitute Unique IDs for A-Numbers, lingering in the record is the unanswered question of whether ICE might also satisfactorily respond to ACLU’s FOIA request by producing a “Big Spreadsheet,” each line of which contains all datapoints retrieved from across ICE databases pertaining to a single (unidentified) alien. 23 At oral argument before this court, ICE suggested that the Big Spreadsheet option was an alternative means to provide ACLU with a person-centric view of the responsive records without entailing record creation. See Oral Arg. at 22:07-22:38. Meanwhile, both in its brief to this court and at oral argument, ACLU not only stated that ICE could avoid the substitution of Unique IDs for A-Numbers by

“reasonability standards . . . provided for segregation or the readily reproducible standard that is required under the form or format requirement” (emphasis added)). As noted supra note 4, the substitution of Unique IDs in such circumstances is no novel practice; federal agencies appear frequently to employ it in affording public access to their records. 23 Each line in the spreadsheet would essentially mirror the data ICE retrieves when it uses A-Numbers to conduct a person-centric search of its databases, but with the A-Numbers deleted. 38 21-1233 ACLU Immigrants’ Rts. Project v. ICE

producing a “Big Spreadsheet,” but also indicated that such production “would [be] a sufficient response to the ACLU’s request.” Appellant Br. at 7 & n.4; Oral Arg. at 41:45-42:45. We do not ourselves reach any conclusions regarding a “Big Spreadsheet” response to ACLU’s FOIA request. 24 We state only that nothing in this opinion should be understood to foreclose further consideration of this alternative on remand. 25

CONCLUSION

To summarize, in the particular circumstances of this case where,

(1) ICE has chosen to make exempt records, i.e., A-Numbers, the sole key or code for accessing non-exempt records pertaining to individual aliens; (2) ICE can, and does, itself use exempt A-Numbers for this purpose; (3) the agency’s assignment of that access function to an exempt record effectively denies public access to non-

24While we note that some district courts have held that requiring ICE to produce a person-centric report akin to the “Big Spreadsheet” proposed here would itself entail record creation, see Long v. ICE, No. 17-CV-506, 2022 WL 705493, at *4-6 (N.D.N.Y. Mar. 9, 2022); Long v. ICE, No. 17-CV-1097, 2021 WL 3931879, at *4-5 (D.D.C. Sept. 2, 2021), we express no view on the merits of these rulings. 25 ACLU states that it requested the substitution of Unique IDs as a comparatively less burdensome means of disclosure than producing a Big Spreadsheet. ICE, which can be expected to have a better understanding of its own computer systems, can state its position on this point in the district court as circumstances warrant. 39 21-1233 ACLU Immigrants’ Rts. Project v. ICE

exempt records in the same form and format available to the agency; (4) the content of the exempt record is irrelevant to its assigned function; any combinations of numbers, letters, or symbols—meaningless in themselves—could perform the function; and (5) such a substitution would not alter the substantive content of exempt A-Numbers but would only preserve an access function across ICE’s event-centric databases,

we conclude that the substitution of Unique IDs for A-Numbers does not create any new agency records and is a reasonable step to shield the exempt content of A-Numbers while preserving the function necessary to afford public access to non-exempt records in the same person-centric form or format available to the agency.

Accordingly, we REVERSE the award of summary judgment to ICE, and we REMAND the case to the district court for further proceedings consistent with this opinion.