UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

_________________________________________ ) Susan B. Long, et al. , ) ) Plaintiffs, ) ) v. ) Civil No. 14-00109 (APM) ) Immigration and Customs Enforcement, et al. , ) ) Defendants. ) _________________________________________ )

MEMORANDUM OPINION AND ORDER
I. INTRODUCTION Plaintiffs Susan B. Long and Davi d Burnham bring this suit unde r the Freedom of Information Act (“FOIA”). Between October 13, 2010, and Februa ry 26, 2013, Plaintiffs submitted seven FOIA requests to two federal agencies, Defendan t Immigration and Customs Enforcement and Defendant Customs and Border Patrol. They soug ht metadata and database schema from databases used by both agencies, as well as “snapsh ots” of data contained within one of the databases. Defendants pr oduced some documents in respon se. But they withheld a host of others, relying on FOIA Exemptions 3 and 7 and claiming that pr oducing certain responsive materials would be overly burdensome. Plaintiffs brought this suit claiming that Defendants violated FOIA by failing to provide them with all materials res ponsive to their requests. Upon consideration of the parti es’ submissions and the record e vidence, the court grants in part and denies in par t the parties’ Cross- Motions for Summary Judgment.2 II. BACKGROUND Plaintiffs Susan B. Long and David Burnham are Co-Directors of the Transactional Records Access Clearinghouse (“TR AC”), “a research center estab lished by Syracuse University that gathers information about the functioning of federal law e nforcement and regulatory agencies, analyzes the data, and publishes reports.” See Pls.’ Mot. Summ. J., ECF N o. 18 [hereinafter Pls.’ Mot.], Decl. of Susan B. Long, ECF No. 18-2 [hereinafter Long D ecl.], ¶ 2. TRAC’s primary purpose is “to provide comprehensive information about the staf fing, spending, and enforcement activities of the federal government.” Id. Plaintiffs submitted seven FOIA requests either to Immigration and Customs Enforcement (“ICE”), Customs and Border Patrol (“CBP”), or both, which are described in f urther detail below.
A. Requests for EID and IIDS Metadata and Database Schema
1. FOIA Request I By letter dated October 13, 2010, Plaintiffs submitted a FOIA request to ICE for documentation related to the Enforcement Integrated Database (“ EID”). See Defs.’ Mot., Ex. 1, ECF No. 17-3 [hereinafter FOIA Request I]. The EID is a “share d common database repository for all records created, updated, and accessed by a number of [ Department of Homeland Security (“DHS”)] law enforcement and homeland security software applica tions.” Defs.’ Mot. for Summ. J., ECF No. 17 [hereinafter Defs.’ Mot.], Decl. of Karolyn Mill er, ECF No. 17-1 [hereinafter Miller Decl.], ¶ 12. EID “captures and maintains information related to the investigation, arrest, booking, detention, and removal of persons encountered during immigratio n and criminal law enforcement investigations and operations cond ucted by [ICE], [CBP], and U. S. Citizenship and Immigration Services.” Id. EID contains an array of personally identifiable information ab out persons detained for violating the Immigration a nd Nationality Act, including na mes, aliases, dates of birth,3 telephone numbers, addresses, Alie n Registration Numbers, Socia l Security Numbers, passport numbers, and employment, educational, immigration, and criminal histories. Id. ICE uses the EID database to manage cases from the time of an undocumented immig rant’s detention through the person’s final case disposition. Defs.’ Mot., Decl. of Fernand o Pineiro, ECF No. 17-2 [hereinafter Pineiro Decl.], ¶ 47. Plaintiffs’ first FOIA request sought: (1) a copy of the records identifying each and every database t able in the EID and describing all fields of information that are stored in each of these tables . . . (2) a copy of records defining each code used in recording data conta ined [in] the EID. This is a request for the contents of specific auxiliary tables —often referred to as code or lookup tables—within the d atabase itself where this inf ormation is stored . . . (3) a copy of the EID’s database schema . . . [and] (4) rec ords that identify the [Database Management Software (“DBMS”)] (e.g., Oracle, DB2, Syb ase, SQL Server, etc.) including [the] Version No. used for the EID. FOIA Request I at 1. In other words, Plaintiffs “sought a comp lete set of documentation on the [EID].” Pineiro Decl. ¶ 6 (in ternal quotation marks omitted).
2. FOIA Request II On October 18, 2010, Plaintiffs submitted a second FOIA request to ICE for “a complete set of documentation on the ‘IC E Integrated Decision Support . . . Database,’” known as “IIDS.” Defs.’ Mot., Ex. 8, ECF No. 17-3 [hereinafter FOIA Request II], at 1. IIDS is “a subset of the EID database repository . . . [that] provides a continuously update d snapshot of selected EID data.” Miller Decl. ¶ 13. IIDS’ “intended purpose . . . is . . . to q uery EID data for operational or executive reporting purposes and is typically used to generate management reports and statistics from EID data.” Id. “Specifically, IIDS contains b iographic information, informat ion about encounters between agents/officers and subjects, and apprehension and dete ntion information about all persons in EID.” Id. Plaintiffs’ second FOIA request sought the same information r egarding the IIDS database that the first request sought regarding the EID d atabase. See FOIA Request II at 1.4 In summary, FOIA Requests I and II sought documents that disclo se the fields, variables, codes, and structures of the EID and IIDS databases. It appear s that TRAC, as part of its goal to provide the public with information about law enforcement agenc ies, filed the requests in an attempt to learn what types of data ICE and CBP collect and rel y upon to perform their immigration enforcement duties. 3. Government Response to FOIA Requests I and II In response to FOIA Requests I and II, ICE conducted a search o f the System Lifecycle Management repository database (“SLM”), which is “the authoritative place for technical documents associated with EID and IIDS.” Defs.’ Mot., Decl. of Jeff Wilson, ECF No. 17-6 [hereinafter Wilson Decl.], at 5. SLM documents are divided in to sections and, after searching the EID and IIDS sections of the repository, IC E personnel reviewed responsive documents. Id. The agency then released 97 responsive pages, with redactions, and withheld the remaining responsive documents. Pineiro Decl. ¶ 19. CBP did not search its records in response to FOIA Requests I and II. See Pls.’ Mot. at 10; Defs.’ Opp’n to Pls.’ Mot. for Summ. J. & Re ply, ECF No. 25 [hereinafter Defs.’ Opp’n & Reply], at 18.
B. Requests for Snapshots
1. FOIA Requests for Snapshots and Information About Snapshots Plaintiffs also submitted FOIA requests to both ICE and CBP for “snapshots” of data from the EID database. As noted, the EID database includes “informa tion related to the investigation, arrest, booking, detention, and re moval of persons.” Miller De cl. ¶ 12. ICE and CBP maintain several other databases, much like the IIDS database, that cont ain “subsets of EID data” and “provide . . . continuously updated snapshot[s] of selected EID data.” Pls.’ Mot., Decl. of Jehan A. Patterson, ECF No. 18-1 [here inafter Patterson Decl.], Ex. A at 6. These snapshots allow CBP5 and ICE “to query EID data for operational or executive reporti ng purposes.” Id. Collectively, the snapshots allow ICE to search all of the information contai ned within the EID database at a particular point in time. Wilson Decl. at 4. As described bel ow, Plaintiffs’ additional FOIA requests sought copies of certain snapshots. On September 21, 2012, Plaintiffs submitted two FOIA requests t o ICE. One sought information about snapshots. It requested “records identifying any extracts and ‘snapshots’ prepared from the [EID] over the last 12 months, along with rec ords relating to the frequency with which such extracts and snapshots have been prepared, who was r esponsible for preparing any snapshot or extract, the recipient(s) of the extracts/snapshots , as well as the EID system time required in their preparation.” D efs.’ Mot., Ex. 16, ECF No. 1 7-3 [hereinafter FOIA Request III], at 1. The other request sought a copy of a snapshot itself, in particular, a “current ‘snapshot’ of ENFORCE prepared for [IIDS] system.” Defs.’ Mot., Ex. 19, ECF No. 17-3 [hereinafter FOIA Request IV], at 1. ENFORCE cons ists of several “applications” that allow “DHS personnel [to] create, modify, and access the data stored in the EID’s central data repository.” Patterson Decl.,
Ex. A at 2. On February 25, 2013, Plaintiffs submitted a fifth FOIA reques t, this time to CBP, which sought a “current ‘snapshot’ of [ the] EID database prepared for [the] CBP data warehouse.” Defs.’ Mot., Ex. 21, ECF No. 17-3 [hereinafter FOIA Request V], at 1. The next day, Plaintiffs submitted two final FOIA requests. The first was sent to ICE and sought “a current ‘snapshot’ of [the] EID database prepared for the EARM Data Mart.” Defs.’ Mot., Ex. 23 , ECF No. 17-3 [hereinafter FOIA Requests VI], at 1. The second, which was sent to both IC E and CBP, sought “the current ‘snapshot’ of [the] EID database prepared for EID Data Mart.” Defs.’ Mot., Ex. 23, ECF No. 17- 3 [hereinafter FOIA Requests VII] , at 1. The EARM Datamart and the EID Datamart, like the6 IIDS database, contain subsets of data from EID and are “typica lly used to generate management reports and statistics from EID data.” Patterson Decl., Ex. A at 6. Specifically, the EARM Datamart, which is used to tr ack cases of undocumented immigran ts who are in the removal process, Pineiro Decl. ¶ 47, contains a host of information abo ut immigration court proceedings and the detention statuses and locations of persons subject to such proceedings, Patterson Decl., Ex. A at 7. And the EID Datamart contains data on, among other things, arrests and removal processing, including personal info rmation about persons subjec t to those proceedings. Id. at 7.
2. Government Response to FOIA Requests III through VII In response to FOIA Request III , ICE disclosed nine pages of re cords that it asserted were responsive to the request, with r edactions pursuant to FOIA exe mptions 6, 7(C), and 7(E). Pineiro Decl. ¶ 27. Neither ICE nor CBP , however, produ ced copies of t he snapshots Plaint iffs requested in FOIA Requests IV through VII. 3. Summary of FOIA Requests In summary, TRAC submitted seven FOIA requests. Five were dire cted to ICE only, together requesting EID and IIDS metadata and database schema, as well as snapshots of data from the EID database and information about those snapshots. See FOIA Requests I, II, III, IV, and VI. One was directed to CBP only, requesting a snapshot of certain EID data. See FOIA Request V. And one was directed to both ICE and CBP, again seeking from ea ch agency a snapshot of certain EID data. See FOIA Request VII. C. Procedural History Plaintiffs filed this action on January 29, 2014, alleging tha t Defendants’ searches were inadequate and that Defendants improperly withheld responsive m aterials under FOIA. See generally Compl., ECF No. 1. On October 9, 2014, Defendants filed a Moti on for Summary7 Judgement. See generally Defs.’ Mot. In it, Defendants argued that their search was ade quate as they conducted searches in the SLM repository for documents res ponsive to Plaintiffs’ request for the EID and IIDS metadata and database schema, and that they pr operly withheld responsive documents pursuant to Exemptions 3, 7(A), and 7(E). Id. at 10-11, 15-26. With regard to the snapshots, Defendants asserted that they were unable to produce any responsive documents, because “the snapshots Plaintiffs requested were not retained f or the date ranges of the subject FOIA requests, . . . the requested information could not be pro duced with the technology currently in the Agency’s possession, and . . . even if the information c ould be produced, Defendants were not capable of redacting the information.” Id. at 11-12. On November 13, 2014, Plaintiffs filed a Cross-Motion for Summa ry Judgment. See generally Pls.’ Mot. In the Motion, Plaintiffs argued that Defendants’ c laimed FOIA exemptions are inapplicable. Id. at 14-26. They also disputed th e assertion that Defendants ar e unable to produce the requested snapshots. Id. at 27-30. Plaintiffs further argued that Defendants’ search was inadequate because Defendants: (1) did not sufficie ntly respond to FOIA Request III; (2) failed to search the EID and IIDS databases themselves for documents pertaining to the metadata and database schema of each system; and (3) failed to search CBP records. Id. at 31-32.
III. DISCUSSION
A. Standard of Review Under Federal Rule of Civil Procedure 56, a court must grant su mmary judgment “if the movant shows that there is no genuine dispute as to any materia l fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). When a court is applying this standard, “the evidence of the non-movant is to be believed, and all justifiab le inferences are to be drawn in his favor.” Anderson v. Liberty Lobby, Inc. , 477 U.S. 242, 255 (1986). A dispute is “genuine” only8 if a reasonable fact-finder coul d find for the nonmoving party, while a fact is “material” only if it is capable of affecting the outcome of litigation. Id. at 248-49. A non-material factual dispute is insufficient to prevent the c ourt from granting summary judgmen t. Id. at 249. FOIA cases often are appropriate ly decided on motions for summa ry judgment. See Defenders of Wildlife v. U.S. Border Patrol , 623 F. Supp. 2d 83, 87 (D.D.C. 2009). A court may award summary judgment in a FOIA case using solely the info rmation included in the agency’s affidavits or declarations if they are “relatively det ailed and non-conclusory,” SafeCard Servs., Inc. v. SEC , 926 F.2d 1197, 1200 (D.C. Cir. 1991) (citations and internal quotation marks omitted), and describe “the documents and the justifications fo r nondisclosure with reasonably specific detail, demonstrate that the information withheld logi cally falls within the claimed exemption, and are not controverted by either contrary evidence in the record nor by evidence of agency bad faith,” Military Audit Project v. Casey, 656 F.2d 724, 738 (D.C. Cir. 1981). “Unlike the review of other agency action that must be upheld if suppor ted by substantial evidence and not arbitrary or capricious, the FO IA expressly places the burden ‘ on the agency to sustain its action’ and directs the district courts to ‘determine the matter de novo .’” DOJ v. Reporters Comm. for Freedom of Press , 489 U.S. 749, 755 (1989) (quoting 5 U.S.C. § 552(a)(4)(B)).
B. EID and IIDS Metadata and Database Schema The court first considers Plaintiffs’ challenge to Defendants’ invocation of FOIA Exemptions 7(E), 7(A), and 3 to withhold and redact materials r esponsive to Plaintiffs’ requests for EID and IIDS metadata and database schema. “The basic purp ose of FOIA is to ensure an informed citizenry, vital to the functioning of a democratic so ciety, needed to check against corruption and to hold the governors accountable to the governe d.” NLRB v. Robbins Tire &
Rubber Co. , 437 U.S. 214, 242 (1978) (citation omitted). Because of FOIA ’s critical role in9 promoting transparency and accountability, “[a]t all times cour ts must bear in mind that FOIA mandates a ‘strong presumption in favor of disclosure.’” Nat’l Ass’n of Home Builders v. Norton , 309 F.3d 26, 32 (D.C. Cir. 2002) (quoting Dep’t of State v. Ray , 502 U.S. 164, 173 (1991)). But “an agency’s justification for invoking a FOIA exemption is suf ficient if it appears logical or plausible.” Larson v. Dep’t of State , 565 F.3d 857, 862 (D.C. Cir 2009 ) (citations and internal quotation marks omitted).
1. Exemption 7(E) Defendants rely primarily on Exem ption 7(E) to withhold records responsive to Plaintiffs’ request for metadata and database schema. Once again, the meta data and database schema sought in this case are the fields, variables, codes, and structures o f the EID and IIDS databases. Under Exemption 7(E), an agency may withhold information “compiled fo r law enforcement purposes” if, among other reasons, its rel ease “would disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines fo r law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law.” 5 U.S.C. § 552(b)(7)(E). Exemption 7(E) “sets a relatively low bar for the agency to justify withholding,” Blackwell v. FBI , 646 F.3d 37, 42 (D.C. Cir. 2011), and “where an agency ‘specializes in law enforcement, its decision to invoke [E]xemp tion 7 is entitled to deference,’”
Lardner v. DOJ , 638 F. Supp. 2d 14, 31 (D.D.C. 2009) (quoting Campbell v. DOJ , 164 F.3d 20, 32 (D.C. Cir. 1998). This does not excuse an agency, however, from the requirement of describing its “justifications for withholding the information with specif ic detail.” ACLU v. Dep’t of Defense , 628 F.3d 612, 619 (D.C. Cir. 2011)). Plaintiffs challenge Defendants’ invocation of Exemption 7(E) o n a host of grounds. Specifically, they argue that: (a) the records sought were notcompiled for law enforcement10 purposes; (b) the records do not disclose law enforcement techn iques, procedures, or guidelines; and (c) disclosure of the record s does not present a risk of ci rcumvention of the law. The court considers each of these arguments in turn. a. Compiled for law e nforcement purposes Defendants contend that they “engage in law enforcement activit y and the records responsive to the subject FOIA request were compiled for law en forcement purposes.” Defs.’ Mot. at 20. According to a declaration submitted by ICE’s Deputy FO IA Officer, Fernando Pineiro, the databases at issue—namely, EID and IIDS—contain “law enforcemen t sensitive information relating to investigations, enforcement operations, and checks of other law enforcement databases.” Defs.’ Mot. at 20 (quoting Pineiro Decl. ¶ 47). I CE uses IIDS, in particular, “to rapidly run reports and queries on data s tored in other ICE databases, particularly [EID].” Pineiro Decl. ¶ 47. Responding to Defendants’ c laim, Plaintiffs argue “[t]ha t [just because] the databases themselves may contain information compiled for law enforcement purposes does not, as the government assumes, mean that all information about the databases—especia lly information that, like the information requested here, serves data management and administrative purposes—was also compiled for law enforcement purposes.” Reply Mem. in Sup p. of Pls.’ Mot. for Summ. J., ECF No. 27 [hereinafter P ls.’ Reply], at 2. The court has little trouble rej ecting Plaintiffs’ argument. A record is deemed “compiled for a law enforcement purpose” so long as there is (1) a ration al “nexus” between the record and the agency’s law enforcement du ties and (2) a connection betwee n the subject of the record and a possible security risk or violation of federal law. See Campbell , 164 F.3d at 32; see also Pratt v.
Webster , 673 F.2d 408, 420 (D.C. Cir. 1982)

. The latter requirement must be satisfied “to establish that the agency acted within its principal function of law enfo rcement, rather than merely engaging11 in a general monitoring of i ndividuals’ ac tivities.” Pratt , 673 F.3d at 420. Plaintiffs concede that Defendants use the EID and IIDS databases for law enforcement p urposes—to assist ICE and CBP with deporting people who are unlaw fully in the United States, to arrest those who violate federal immigration laws, and to track investigations and court proceed ings of those apprehended.
See Pls.’ Mot. at 4. Thus, records concerning how these databases are constructed and how they operate—like the data itself—clearly have a rational “nexus” to Defendants’ law enforcement duties. The second prong of the “ law enforcement purpose” testis also satisfied because of the clear connection betwee n the records and possible security risk s or violations of law. These are not the kind of records compiled for generalized snooping of in dividuals’ lives, but were prepared to effectuate the agencies’ law enforcement responsibilities. The court thus concludes that the withheld records easily qualify as records or information “comp iled for law enforcement purposes.” b. Techniques, procedures, or guidelines Plaintiffs next argue that the withheld records concerning data base metadata and database schema would not, if released, disclose “techniques,” “procedur es,” or “guidelines” for law enforcement investigations or pro secutions, as those terms are used in Exemption 7(E). Plaintiffs contend that “the fact that data is used by law enforcement per sonnel in carrying out their duties does not mean that revealing information about a database discl oses the techniques and methods that law enforcers employ in using it.” Pls.’ Reply at 4. For their part, Defendants offer the following, from ICE’s Deputy FOIA Officer, Fernando Pineiro, in opposition to Plaintiffs’ position: ICE employed certain law enfor cement techniques and methods des igned to obtain information in furtherance of the nation’s immigration and cust oms laws, and ICE law enforcement officers use the database and systems that are the subjects of Plaintiffs’ FOIA request to mai ntain that information and carry out those duties.12 Pineiro Decl. ¶ 50; see also Defs.’ Mot. at 20-22. Although the court views the Pineiro Declaration as providing a rather thin explanation for why the metadata and database schema qualify as a law enforceme nt technique, procedure, or guideline, the court ultimately ag rees with Defendants based on the Court of Appeals’ decision in
Blackwell v. FBI , 646 F.3d 37 (D.C. Cir. 2011), as well as analogous district c ourt cases. In
Blackwell , the FBI sought to protect under Exemption 7(E) “methods of da ta collection, organization and presentation c ontained” in certain reports. Id. at 42 (internal quotation marks omitted). The FBI’s declarant explained that “the manner in wh ich the data is searched, organized and reported to the FBI is an internal technique, not known to the public,” and the “method was developed by [the vendor] to meetthe specific investigative ne eds of the FBI.” Id. (internal quotation marks omitted). Based on those averments (as well as an additional attestation concerning how disclosure could give rise to the potential risk of circumvention of the law), the Court of Appeals concluded tha t the FBI had pr operly invoked Ex emption 7(E). Id. Other cases from this Circuit are to similar effect. For insta nce, in Strunk v. DOJ , 905 F. Supp. 2d 142 (D.D.C. 2012), the court concluded that withhel d computer screen transaction codes, computer transaction codes, and computer function codes— similar to the codes at issue here—from a CBP database known as TECS, though not themselves l aw enforcement “techniques and procedures,” were protected “guidelines for law enforcement investigations and prosecutions” under Exemption 7(E). Id. at 148 (citation omitt ed). Similarly, in Skinner v. DOJ , 893 F. Supp. 2d 109 (D.D.C. 2012), the court agreed that computer access cod es associated with the TECS database were, at the least, law enforcement guidelines under E xemption 7(E), id. at 114. And other decisions have treated law enforcement database codes or fields in the same way. See Ortiz
v. DOJ , 67 F. Supp. 3d 109, 123 (D.D.C. 2014) (granting Exemption 7(E ) protection to “violator13 identifier codes”); Miller v. DOJ , 872 F. Supp. 2d 12, 29 (D.D.C. 2012) (permitting agency to withhold law enforcem ent numerical databas e codes used to ident ify information and individuals, as well as codes “relate[d] to procedures concerning the use of law enforcement resources and databases . . ., as well as case program and access codes”); McRae v. DOJ , 869 F. Supp. 2d 151, 169 (D.D.C. 2012) (holding that “codes, case numbers, and other computer information pertaining to the TECS, NCIC, and databases maintained by the North Caroli na authorities are techniques and procedures for law enforcement investigation”).
Blackwell and these district court decisi ons teach that internal database codes, fields, and other types of identifiers used by law enforcement agencies to conduct, organize, and manage investigations and prosecutions q ualify, at least, as law enfor cement guidelines, if not also law enforcement methods and techniques. Thus, the court rejects Pl aintiffs’ argument that the EID and IIDS metadata and databas e schema do not qualify for withho lding under Exemption 7(E). c. Circumvention of the law The parties’ final area of disag reement about the application o f Exemption 7(E) is also their most significant. They dispute whether disclosure of the metad ata and database schema “could reasonably be expected to risk c ircumvention of the law.” 5 U. S.C. § 522(b)(7)(E). Defendants assert that disclosure of the EID and IIDS metadata and databas e schema would enable “individuals to access [ICE]’s law enforcement database, includ ing its investigative files, manipulate data within those databases, and launch a full scale cyber-attack against [ICE].” Defs.’ Mot. at 21. To establish the risk of such an attack, Defendant s offer the affidavit of Karolyn Miller, an Information Technology Specialis t in Information Security at ICE, who identifies a specific14 kind of risk—a Structured Query Language injection attack, or a “SQL injection attack,” on the EID and IIDS databases. Miller Decl. ¶ 16. As M iller explains : The SQL injection attack . . . is a technique used by malicious intruders or “hacktivists” to expl oit web sites by cha nging the intended eff ect of an SQL query by inserting new SQL keywords or operators into the query. Bas ically, the attacker inserts or “injects” SQL instruc tions in a web application Sear ch field to cause the program to malfunction. The program’s error allows the attacke r to then access otherwise restricted parts of the database to view or steal inf ormation . . . that will allow the attacker to not only access the full database, but . . . also potentially allow access to other parts of the IT system . . . by using the stole n credentials.
Id. She concludes that, “[s]hould ICE be required to provide . . . database schema, tables, codes, code values, and database version, ICE will have disclosed the exact information that an SQL [injection] attacker needs to penetrate the EID and IIDS databa ses and systems, and potentially the ICE network.” Id. ¶ 19.
i. Plaintiffs’ legal interpre tation of Exemption 7(E) Plaintiffs offer two rejoinders —one legal, the other factual—to Defendants’ ominous prediction of a potentially debilitating cyber-attack resulting from disclosure. Plaintiffs first argue that, “[a]lthough a cyber-attack would undoubtedly constitute a violation of law, such a violation does not constitute circumvention of a relevant law within the meaning of Exemption 7(E).” Pls.’ Mot. at 16. Instead, according to Plaintiffs, “the exemption a llows an agency to withhold techniques, procedures, and guidelines that it uses to enforce particular laws . . . if disclosure of those techniques, procedures, or guidelines would allow an indi vidual to circumvent those laws.”
Id. In other words, Plaintiffs contend that Exemption 7(E) applies only if the risk that there will be a violation of law relates to those laws that the subject la w enforcement agency is tasked with enforcing. Plaintiffs thus argue that an unlawful cyber-attack cannot serve as a basis for withholding EID and IIDS metadata and database schema because s uch information, if disclosed, does not risk circumvention of t he laws enforced by Defendants.15 The FOIA statute, however, cannot be read so narrowly. Exempti on 7(E) plainly states that withholding is permissible und er that provision if “disclo sure could reasonably be expected to risk circumvention of the law ”—“the law,” period. 5 U.S.C. § 552(b)(7)(E). Congress did no t qualify or modify “the law” in any way to circumscribe the type s of laws that might be violated in the event of disclosure for Exemption 7(E) to apply. Thus, a p lain reading of the statute does not support Plaintiffs’ interpretation. Nor have courts read the exempti on as Plaintiffs have proposed. Indeed, courts in this District have recognized the ris k of a cyber-attack or a breach of a law enforcement database as valid grounds for withholding under Exemption 7(E). In Skinner , the court upheld the agency’s decision to withhold data under Exemption 7(E) where the agency showed that release of the subject data would “(1) permit unauthorized users to avoid reco gnition, instant detection and apprehension, (2) give them near-unfettered access to one of th e nation’s most critical electronic law enforcement infrastructures, and (3) arm these intruders wi th the ability to irreparably corrupt the integrity of [the database] by altering or manipulating it. ” 893 F. Supp. 2d at 113 (internal quotation marks omitted). Likewise, in Strunk , the court recognized a ris k of circumvention where disclosure of data could “facilitate[ ] access to and navigatio n through [a law enforcement database] and reveal[ ] mechanisms for access to and navigation through [the database].” 905 F. Supp. 2d at 147. There, the ag encies asserted that “individuals who knew the meaning of the codes . . . would gain access to CBP law enforcement techniques and procedures that would permit them to . . . corrupt[ ] the integrity of ongoing investigation s.” Id. at 148. Skinner and Strunk make clear that the potential fo r a cyber-attack or data breach is the kind of risk of circumvention of the law that justifies withholding under Exemption 7.16 ii. Plaintiffs’ factual challenge to the asserted risk of a cyberattack This case, however, differs from Skinner and Strunk in one important respect: Plaintiffs here have aggressively challenged Defendants’ assertion that di sclosure of the metadata and database schema would expose the EID and IIDS databases to a SQ L injection attack. In support, Plaintiffs have offered the decl aration of an expert in data se curity, Dr. Paul Clark, President and Chief Technology Officer of SecureMethods, Inc., and Paul C. Cl ark, LLC, 1 who disputes the potential for a SQL a ttack. He explains: A SQL injection attack is a type of remote execution attack. I n other words, someone who is not physically on the premises where a computer system is located nonetheless can launch an attack by transmitting malicious inst ructions through a web interface that has a direct connection to a database that w ill accept and execute such instructions . . . . [R]emote execution is not a credible threat to the EID or IIDS systems . . . [because] there is no publicly accessible we b interface to the EID or IIDS, nor do agencies outside of [DHS] have access to the da tabase systems. Pls.’ Mot., Decl. of Paul C. Cla rk, ECF No. 18-3 [hereinafter C lark Decl.], ¶¶ 11-12 (emphasis added). Defendants offer a relatively limp response to Dr. Clark’s crit ique. They do not disagree that a hacker would require an external access point to execute a SQL injection attack; nor do they claim that the EID or IIDS databases are in fact accessible thr ough an external access point. Rather, through the affidavit of Jeff Wilson, Unit Chief of the Information Technology Management Unit within Enforcement and Removal Operations, Law Enforcement and Systems Analysis at ICE, Defendants state: “[T]here are still dangers associated with providing information and records associated with system development, data tables and fields, outage times, etc., whether or not the database has a ‘publ ically accessible web interface. ’” Defs.’ Opp’n & Reply, Suppl.

1 See Pls.’ Mot., Decl. of Paul C. Clark, ECF No. 18-3, at 11.17 Decl. of Jeff Wilson, ECF No. 25-1 [hereinafter Wilson Suppl. D ecl.], ¶ 9. Wilson cites as the sole example a 2014 cyber-attack against Home Depot, which was executed using malware inserted at point-of-sale machines in stores in the United Stat es and Canada. Id. Wilson Suppl. Decl. ¶ 9. Wilson adds: Intimate knowledge of tables, codes, and schemas can be used to create a more sophisticated attack that lasts days, weeks or even months. Ad ditional technical dangers include: cross site s cripting, session hijacking, SQL injection, race conditions, unformatted error messages, improper html rendering and submittals, among others.
Id. ¶ 10. But nowhere does he say that any of those “additional te chnical dangers” could be accomplished when a system, like the one at issue here, has no an external access point. Plaintiffs offer an obvious reto rt to Wilson’s statements. In a supplemental declaration, Dr. Clark states: “In the Home Depot example [Wilson] cites, a ccess was obtained not through a web interface, but through point -of-sale devices that connected to Home Depot’s system. ICE obviously does not use point-of-sa le devices that would provide an attacker with access to its systems, and Mr. Wilson does not s uggest that any comparable me ans of access to ICE’s systems exists.” Pls.’ Reply, Suppl. Decl. of Paul C. Clark., ECF 27-2 [hereinafter Clark Suppl. Decl.], ¶ 4. When pressed at oral argument, counsel for Defendants was unable to identify any SQL injection attacks that have occurred without a public access po int and asked to further brief the question whether a SQL injection attack could be achieved only via a public access point. Hr’g Tr. at 21:3-23:14, Oct. 28, 2015 (Draft). In evaluating whether Plaintiffs have carried their burden of s howing a risk of circumvention of the law, the court is fully cognizant of the l ow bar that the Court of Appeals has set for establishing such risk. See, e.g. , Pub. Employees for Envtl. Re sponsibility v. U.S. Section,18 Int’l Boundary & Water Comm’n , U.S.-Mexico , 740 F.3d 195, 204-05 (D.C. Cir. 2014); Blackwell
v. FBI , 646 F.3d at 42. Trial courts are to: [L]ook[ ] not just for circumven tion of the law, but for a risk of circumvention; not just for an actual or certain risk of cir cumvention, but for an expected risk; not just for an undeniably or universally expected risk, but for a reaso nably expected risk; and not just for certitude of a reasonably expected risk, but f or the chance of a reasonably expected risk. Mayer Brown LLP v. IRS , 562 F.3d 1190, 1193 (D.C. Cir. 2009). Courts must heed that low bar, especially in cases where an agency has warned that disclosure could lead to a c yber-attack on, or security breach of, an agency data system containing sensitive law enforcement and personal information. Judges are not cybe r specialists, and it would be the height of judicial irresponsibility for a court to blithely disregard such a claimed risk. But the standard of review of a claimed 7(E) exemption, while highly deferential, is not
“vacuous.” Campbell , 164 F.3d at 32 (quoting Pratt , 673 F.2d at 421). Courts have a responsibility to ensure that an agency is not simply manufactu ring an artificial risk and that the agency’s proffered risk assessment is rooted in facts. Based o n the present record, the court cannot find that Defendants have carried their burden of showing that disclosure of the IED and IIDS metadata and database schema increases the risk of a cyber-atta ck of the kind Defendants posit. The sole risk that Defendants claim might be heightened by the release of metadata and database schema is that of a SQL injection attack. On the present recor d, however, it is undisputed that a SQL injection attack requires an external point of entry, such as a website or point-of-sale machine, and that the IED and IIDS databas es are not so exposed. The co urt is thus left unconvinced, at this juncture, that the sole risk of circumvention of the law claime d by Defendants—a SQL injection attack—would be increased if the requested metadata and databas e schema were disclosed. The court, therefore, denies Defenda nts’ Motion for Summary Judgmen t as to its invocation of19 Exemption 7(E) to withhold information concerning IED and IIDS metadata and database schema. 2 The court, however, will not at this juncture order Defendants to disclose the withheld material. Rather, in the exercise of its discretion, the courtwill permit Defendants to supplement the record with additional affidavits or other evidence to esta blish that disclosure of the IED and IIDS metadata and database schema will increase the risk of a c yber-attack, data breach, or any other circumvention of the law. 3 See Wolf v. CIA , 569 F. Supp. 2d 1, 10 (D.D.C. 2008) (“Where an agency’s declarations are deficient, courts generally will r equest that an agency supplement its supporting declarations rather th an order discovery.” (citationand internal quotation marks omitted)); see also Hall v. CIA , 668 F. Supp. 2d 172, 188-93 (D.D.C. 2009) (granting in part a nd denying in part the agency’s and the plaintiff’s cross-motions for summary judgment, and permitting the agency to submit a “supplemental filing” in supp ort of its invocat ion of certain FOIA exemptions). 2. Exemption 3 Defendants alternatively argue t hat their withholding of metada ta and database schema is justified under FOIA Exemption 3. Generally speaking, that exe mption protects a record from disclosure if it has been “specifically exempted from disclosur e by statute.” 5 U.S.C. § 552(b)(3). Here, Defendants have argued that the withheld materials are ex empt from disclosure under the

2 Defendants also invoke Exemption 7(A) to justify withholding the metadata and database schema. However, Defendants’ invocation of Exemption 7(A) relies on arguments su bstantially identical to those presented in connection with their Exemption 7(E) claim. That is, disclosure of the re quested information would expose the databases to potential cyber-attacks. See Defs.’ Opp’n and Reply at 22-23; Hr’g Tr. 26:5-28:9. Thus, for the same reason that the court has denied summary judgment on Defendants’ invocation of Exemption 7(E), it does so as to Defendants’ invocation of Exemption 7(A). 3 Defendants’ briefing also suggests the possibility of an “insi de job” where someone within ICE or CBP, who otherwise does not have access to the requested information, co uld use it to gain unauthorized access to the databases. See Defs.’ Opp’n. and Reply at 10; see also Hr’g Tr. at 24:8-25:3. But Defendants have not presented any evidence of how the requested disclosures might increase the risk of suc h an attack. Defendants may wish to address this risk in its supplemental submission.20 Federal Information Security Management Act (“Management Act”), 44 U.S.C. §§ 3541-49. They are incorrect. Exemption 3 applies only if a st atute “requires that matters b e withheld from the public in such a manner as to leave no di scretion on the issue” or “estab lishes particular criteria for withholding or refers to particular types of matters to be with held.” 5 U.S.C. § 552(b)(3)(A). Exemption 3 further provides that, “if [the statute was] enacte d after the date of enactment of the OPEN FOIA Act of 2009,” Exemption 3 applies only if the statute “specifically cites to this paragraph.” Id. § 552(b)(3)(B). The statute upon which Defendants rely—the Management Act—was repealed in its entirety on December 18, 2014—after this case was filed—and rep laced by the Federal Information Security Modernization Act of 2014 (“Modernization Act”), 44 U.S.C. § 3551 et seq. (2014). As the Modernization Act is the law in effect at the t ime the court is rendering its decision, it is the controlling law in the present dispute. See Bradley v. School Bd. of City of Richmond , 416 U.S. 696, 711 (1974) (stating the “principle that a court is to apply the law in effect at the time it renders its decision, unless doing so would result in manifest injustice or there is statutory direction or legislative histor y to the contrary”). The Modernization Act does not ena ble Defendants to invoke Exem ption 3 here for two reasons. First, because the Mode rnization Act was enacted afte r the OPEN FOIA Act of 2009, for it to protect records from disclosure under Exemption 3 it must “specifically cite[ ] to [Exemption 3].” 5 U.S.C. § 552(b)(3)(B). It does not do so. Second, to the extent that the Modernization Act does cite to FOIA, it does not a lter agencies’ obligations unde r the FOIA statute. The Modernization Act expressly stat es that “[n]othing in this subc hapter . . . may be construed as affecting the authority of . . . the head of any agency, with r espect to the authorized use or21 disclosure of information, includ ing . . . the disclosure of in formation under section 552 of title 5.” 44 U.S.C. § 3558. Therefore, Defendants’ claim that the reques ted materials can be withheld pursuant to Exemption 3 fails.
C. Copies of Snapshots of Data from the EID Database The parties’ second major dispute concerns Defendants’ non-prod uction of copies of “snapshots” of data from the EID database. Again, “snapshots” are continuously updated extracts of portions of the EID database that enable Defendants to searc h and manipulate the EID data. Plaintiffs assert that Defendant s have not complied with FOIA b ecause they failed to disclose copies of the requested snapshots and did not perform an adequa te search for them. Defendants offer two reasons why they cannot comply with Plaintiffs’ reque sts for copies of snapshots. First, they argue that their “document system is not capable of produc ing the information for distribution to Plaintiffs.” Defs.’ Mot. a t 13. Second, they argue that ev en if they could produce the snapshots, “Defendants lack[ ] the technol ogy to redact the information.” Id. at 14. Under FOIA, “an agency shall provide the record in any form or format requested by the person if the record is readily reproducible by the agency in that form or format.” 5 U.S.C. § 552(a)(3)(B) (emphasis added). The key term, “readily reprod ucible,” “is not . . . synonymous with technical[ly] feasible.” Scudder v. CIA , 25 F. Supp. 3d 19, 38 (D.D.C. 2014). Rather, “[t]he Court may consider the burde n on the defendant agency in determ ining whether the documents at issue are ‘readily reproducible.’” Id . To justify withholding otherwise responsive materials, the “agency’s evidence of burden . . . must be not only compelling, but also demonstrate that compliance with a request would impose a significant burden or interference with the agency’s operation.” Public.Resource.Org v. IRS , 78 F. Supp. 3d 1262, 1266 (N.D. Cal. 2015) (citing TPS,
Inc. v. DOD , 330 F.3d 1191, 1195 (9th Cir. 2003)). Among the factors that a court may consider22 in assessing the claimed burden are the amount of time, expense , and personnel that would be required to complete document searches and production, as well as whether the agency has the existing technology or would have to purchase new technology to perform those tasks. See Wolf
v. CIA , 569 F. Supp. 2d at 9 (“Courts often look for a detailed expla nation by the agency regarding the time and expense of a proposed search in order to assess it s reasonableness.” (citation omitted)); Pinson v. DOJ , 80 F. Supp. 3d 211, 217 (D.D.C. 2015) (holding that DOJ did n ot carry its burden by merely asserting th at the search would require a “burdensome effort” without offering estimates of “the time required to conduct [the] reque sted search, the cost of such a search, or the number of files that woul d have to be manually searched” ). Consistent with these principles, courts have held that agencie s need not disclose records when conducting a search for requested materials would impose a n unreasonable burden. See, e.g. , Nation Magazine, Washington Bureau v. U.S. Customs Serv. , 71 F.3d 885, 891-92 (D.C. Cir. 1995) (determining that a request that required an agency to search through 23 years of unindexed files imposed an unreasonable burden); Am. Fed’n of Gov’t Employees, Local 2782 v. U.S. Dep’t of
Commerce , 907 F.2d 203, 208-09 (D.C. Cir. 1990) (holding that a requestthat required a search of “every chronological office f ile and correspondent file, int ernal and external, for every branch office [and] staff office” was overbroad); Nat’l Sec. Counselors v. CIA. , 960 F. Supp. 2d 101, 161- 62 (D.D.C. 2013) (concluding that a request that sought copies of all federal intelligence agency records pertaining to a supercom puter and required a search of all agency offices was so broad as to impose an unreasonable burden upon the agency). Courts also have held that agencies are excused from complying with FOIA requests where “review[ing], r edact[ing], and arrang[ing] for inspection [of] a vast quantity of material” presents an unreas onable burden. Am. Fed’n of Gov’t Employees , 907 F.2d at 209; see also Vietnam Veterans of Am. Conn. Greater Hartford Chapter23 120 v. DHS , 8 F. Supp. 3d 188, 203 (D. Conn. 2014) (FOIA request for whic h agency would need to locate, review, and make heavy redactions to 26,000 packets, each of which contained 50 pages, was unreasonably burdensome); Hainey v. Dep’t of Interior , 925 F. Supp. 2d 34, 45 (D.D.C. 2013) (holding that it would be unreas onably burdensome to require th e agency to search and review every email sent or received by 25 different employees througho ut a two-year time period). Particularly relevant here, one court has held that the process of making redactions to 20 million responsive records within a database was sufficiently burdensom e to justify the agency’s withholding of the entirety of the requested information. See Ayuda, Inc. v. FTC , 70 F. Supp. 3d 247, 276-77 (D.D.C. 2014) (“[B]ecause the agency aims to protec t the private information of citizens by withholding the data fields at issue, and because t he manual review needed for redacting such information is unreasonably burdensome, the Court conclude s that the FTC properly withheld the data fields.”). Consistent with the above cases, the court finds that Defendant s have demonstrated that producing and redacting the requested snapshots would be unduly burdensome. According to Defendants’ affiant Jeff Wilson, “[c]urrently, there is no spec ific product, report or snapshot generated during the Extract-Tr ansform-Load (ETL) process where information from the EID is transferred to IIDS and the datamarts . . . . [T]his process i s automatic and occurs through a link established between two databases with no tangible extract file s.” Wilson Suppl. Decl. ¶ 15; see also Wilson Decl. at 8 (“To produce an extract in a format that coul d be consumed by the external entity, a new record would need to be created. It would requir e the design, development, and implementation of a different pro cess for this new record that does not include law enforcement sensitive and/or personally iden tifiable information[.]”). In other words, according to Wilson, when EID data is collected, organized, and transferred to a fun ctional database like IIDS, no24 reproducible extract or copy of t he transferred data, or snapsh ot, is created to provide to a FOIA requester. Wilson adds: “ICE does not currently have the tech nology to [produce the requested snapshots]. It is difficult to assess what it would take to pr ovide a severable copy because the EID is comprised of so many data elements.” Wilson Decl. at 9. At a minimum, Wilson explains, duplication and production of snapshots would “require a new co ntract to facilitate the extract process and associated databases in the hundreds of thousands t o millions of dollars.” Id. The contract would have to provide for the hiring of additional inf ormation technology specialists, including experts in database design and maintenance, large dat a storage and transfer, networking, and programming, as well as the hiring of experts to remove or redact sensitive law enforcement data. Id. And, according to Wilson, even if Defendants could replicate t he snapshot for production, they would face tremendous challenges in redacting sensitive pe rsonal and law enforcement material, which even Plaintiffs concede are subject to valid FO IA exemptions. The tables available in the EID consist of more than 6. 7 billion rows of data, with the total amount of information contained within the EID exceeding five terabytes. Id. at 7. Wilson equated the volume of data to “1.8 million songs on an iPod” or an audiobook that “would take approximately 9.5 years to read.”
Id. Further employing the example of an iPod, Wilson stated that re dacting exempt information would be akin to “redacting ever y artist, album, and song name as well as significant portions of the song[s].” Id. at 8. According to Wilson, “[a]t this particular time, the IC E FOIA Office does not have the existing technology or expertise for processing th is data.” Wilson Suppl. Decl. ¶ 16. Although Wilson could have been more descriptive in explaining precisely what it would take to redact exempt information and why such process would be unduly burdensome, he does state the following: “The redaction proce ss for this request is expensiv e for a federal agency. It requires a25 modification to an existing cont ract, clearances, background sc reenings, training, and ramp up time.” Id. Plaintiffs dispute Defendants’ c ontention that producing and re dacting the requested snapshots would impose an undue burden on the agencies. Plaint iffs offer their own expert declaration from Michael Hasan, a software engineer employed by Plaintiffs’ research institute, TRAC. To rebut Defendants’ conte ntion that reproducing a snaps hot would impose an undue burden, Hasan states that “[e]xt raction is a built-in functiona lity of any commercial [DBMS] software that allows any database object or table to be queried and extracted into text or another electronic representation. . . . Thus, it should be an easy an d inexpensive process to extract data using such software.” Pls.’ Mot., Decl. of Michael Hasan, ECF No. 18-4 [hereinafter Hasan Decl.], ¶ 10. As to Defendants’ contentions concerning the burdensomen ess of redacting the snapshots, Hasan states, “[r]edaction is a nother built-in functionality th at is common across commercial DBMS packages. It is a trivial m atter to redact a column of in formation (for example, a column containing Social Security numbers of individuals apprehended b y defendants) by executing a simple . . . command that either deletes the data in the column or replaces the data with a special symbol to denote redaction.” Id. ¶ 13. Although Hasan’s Declaration raises some questions about whethe r the snapshots are indeed readily reproducible and redactable, the court ultimatel y finds those questions insufficient to create a genuine dispute of material fact that would preclud e a grant of summary judgment in Defendants’ favor. FOIA requires courts to “accord substantial weight to an affidavit of an agency concerning the agency’s determination as to technical feasibili ty . . . and reproducibility[.]”
See 5 U.S.C. § 552(a)(4)(B) (emphasis added); see also Scudder , 25 F. Supp. 3d at 39 (“[S]ubstantial deference is due an agency’s ‘reproducibility’ determination[.]”). Here,26 Defendants’ declarant, Jeff Wils on, has attested, based on his specific knowledge of and experience with the EID database and associated datamarts that replicating and redacting the snapshots would create an undue burden on the agencies. The co urt, as it must, accords that view substantial weight. Plaintiffs ’ declarant, though an expert in the field of database systems and management, has not offered any evidence that specifically rebu ts Wilson’s assertions about the agencies’ present tec hnological capabilities as to the EID database and associated datamarts or regarding the burden that reproduction and redaction of the sna pshots would impose on them. Instead, Hasan offers only observations about commercial databa ses in general—his declaration reveals no specific knowledge abo ut the EID database and its as sociated operations. Hasan, naturally, is limited by his lack of first-hand experience with the EID database and the datamarts at issue in this case. But once, as here, an agency has proffe red a declaration as to the technical feasibility and reproducibility of a records request—which, by statute, must be accorded substantial weight—a plaintiff mu st offer more than generalitie s about technical capabilities of generic systems to ove rcome or raise quest ions about that decla ration. Plaintiffs have failed to do so here. Plaintiffs make one additional argument in an effort to rebut D efendants’ contention that reproducing and redacting would impose an undue burden. Plaint iffs argue that Defendants must be able to produce and redact the snapshot because they have pr eviously provided Plaintiffs with redacted portions of snapshots in response to other FOIA reques ts. Long Decl. ¶¶ 16-20. Defendants do not deny the past productions but argue that Plai ntiffs’ present requests are meaningfully different in scope and scale. Whereas Plaintiffs’ previous, fulfilled requests sought specific information contained in the snapshots, the present re quests seek the snapshots in their entirety. Defs.’ Mot. at 14. For example, one previous reques t sought “anonymous case-by-case27 information on each removal and return for January 2014 .” Wilson Suppl. Decl. ¶ 12 (emphasis added). “The request specificall y asked for 54 data elements f or each individual removed/returned; the data elements include[d], inter alia, bio graphical information, criminal history, and immigration history for every individual removed/r eturned for a limited time period.”
Id. As to that request, ICE reviewed the relevant information and created new spreadsheets in order to provide it to Plaintiffs. See id. ICE also created codes that it used to alter exempt information contained in the requested data set so that such in formation was not released.
See Hr’g Tr. at 15:1-16; see also Wilson Suppl. Decl. ¶ 12. Defendants thus contend that these past productions serve as poor com parators for the present, far more expansive requests. The court agrees. The court again accords substantial weight t o the representations of Defendants’ affiant, Jeff Wilson. According to Wilson, a reque st for a snapshot of the entire database is “vastly different” fr om Plaintiffs’ previous reques ts and, as a consequence, the manner in which ICE responded to the prior requests is “wholly inadequ ate for responding to a request for all the data replicated at unspecified points in time into othe r datamarts.” Wilson Suppl. Decl. ¶ 13. Wilson adds that “the replication or copying of all datafrom EID data into the IIDS, and other datamarts[,] is not a pull of data,” which was sufficient to respond to past requests. Id. Plaintiffs have not offered any evidence specific to the databa ses at issue here that rebuts those contentions. The court therefo re concludes that FOIA does not require Defendants to produce redacted copies of the requested snapshots.
D. Request for Discovery In a related argument, Plaintiffs request that the court allow them to conduct discovery on the factual issues concerning De fendants’ capacity to produce and redact the extracts and snapshots from their databases. They argue that they “have introduced fac ts casting serious doubt on28 defendants’ assertions that they lack the technology to produce and redact data extract files and that they would have to spend ‘hundreds of thousands to million s of dollars,’ Wilson Decl. at 9, on a contract to create a new da tabase.” Pls.’ Mot. at 30. Courts have “broad discretion to manage the scope of discovery” in FOIA cases. SafeCard
Servs. , 926 F.2d at 1200. “Discovery in FOIA is rare and should be d enied where an agency’s declarations are reasonably detailed, submitted in good faith and the court is satisfied that no factual dispute remains.” Schrecker v. DOJ , 217 F. Supp. 2d 29, 35 (D.D.C. 2002); see also Baker & Hostetler LLP v. U.S. Dep’t of Commerce , 473 F.3d 312, 318 (D.C. Cir. 2006). Here, Defendants have set forth detai led affidavits explaining that t hey currently lack the technology to produce and redact copies of the requested snapshots and that a cquiring the necessary technology and marshalling the resources ne cessary to produce and redact c opies of the snapshots would be unduly burdensome. Although Plaintiffs have offered rebuttal d eclarations that raise some questions about Defendants’ assertions, for the reasons already discussed, Plaintiffs have not offered any evidence that is specific to the EID and other data bases at issue in this case, to create a factual dispute that might oth erwise justify allowing Plainti ffs to take discovery. Cf. Scudder , 25 F. Supp. 3d at 37 (finding that factual disputes existed whe re the plaintiff “provided reasonable evidence, based on his purported personal experience and observ ations, that the documents requested do exist in the format requested . . . even alert[ing] the defend ant’s FOIA staff as to where within the defendant’s com puter systems the electronicall y stored documents [we]re located”). Accordingly, Plainti ffs’ request for discovery is d enied.
E. Adequacy of the Search Plaintiffs argue that Defendants’ search was inadequate in thre e ways. First, Plaintiffs argue that Defendants failed to provide any information regardi ng their search for FOIA Request29 III—that is, “records identifying any extracts and ‘snapshots’ prepared from the [EID] over the last 12 months, along with records relating to the frequency wi th which such extracts and snapshots have been prepared, who was responsible for preparing any snaps hot or extract, the recipient(s) of the extracts/snapshots, as well as the EID system time required in their preparation.” FOIA Request III at 1; see also Pls.’ Mot. at 31. Second, they a rgue that Defendants’ search for the metadata and database schema was inadequate because Defendants did not search the EID and IIDS databases for responsive r ecords. Pls.’ Mot. at 31-32. F inally, Plaintiffs argue that Defendants’ search was inadequate because they failed to search any CBP records. Id. at 32. FOIA requires an agency to conduc t a search for responsive reco rds that is “reasonably calculated to discover the requested documents.” SafeCard Servs. , 926 F.2d at 1201. “In general, the adequacy of a search is ‘determined not by the fruits of th e search, but by the appropriateness of [its] methods.’” Hodge v. FBI , 703 F.3d 575, 579 (D.C. Cir. 2013) (quoting Iturralde v. Comptroller of the Currency , 315 F.3d 311, 315 (D.C. Cir. 2003)). In order to prevail on summary judgment, “the agency must show that it made a good faith effor t to conduct a search for the requested records, using methods which can be reasonably expect ed to produce the information requested.” Oglesby v. U.S. Dep’t of the Army , 920 F.2d 57, 68 (D.C. Cir. 1990) (citation omitted). To carry this burden, the agency may submit a “reasonably detai led affidavit, setting forth the search terms and the type of search performed, and averring tha t all files likely to contain responsive materials (if such records exist) were searched.” Id . “The adequacy of the search, in turn, is judged by a standard o f reasonableness and depends, no t surprisingly, upon the facts of each case.” Weisberg v. DOJ , 745 F.2d 1476, 1485 (D.C. Cir. 1984) (citation omitted). The court agrees with Plaintiffs ’ first contention that Defenda nts have not explained what search, if any, they undertook to locate extract identification and preparation records sought in30 FOIA Request III. Indeed, the government does not even respond to this argument. See Defs.’ Reply at 17-18. Because Defenda nts do not address what search, if any, they conducted, the court will deny summary judgement as to the adequacy of their search in response to FOIA Request III. See Oglesby , 920 F.2d at 68. Defendants sha ll submit an affidavit that se ts forth the search efforts undertaken in response to F OIA Request III. Plaintiffs next argue that the search Defendants conducted in r esponse to FOIA Requests I and II was inadequate. Plaintiffs ’ first two FOIA requests sou ght metadata and data schema from the EID and IIDS databases, inc luding “records identifying the database tables . . . records defining the codes . . . database schema, and records that identify the DBMS software.” FOIA Request I at 1; FOIA Request II at 1. According to declarant Jeff Wilson, I CE conducted the following search: On July 15, 2014, the ICE [Office of the Chief Information Offi cer (“OCIO”)] searched the [SLM] repositor y and located 2,793 documents. The SLM repository is the authoritative place for technical documents associated w ith the EID and IIDS. As a result, no other databases were required to be searched by OCIO. SLM documents are organized by secti ons so personnel located the “E ID” and “IIDS” sections throughout the repository and transferred applicable d ocuments for review. Wilson Decl. at 5. Plaintiffs contend that this search was ina dequate because Defendants did not search the EID and IIDS databases themselves for responsive doc uments. Pls.’ Mot. at 31-32. According to Plaintiffs, “[l]ocating and copying the responsive information from the [EID and IIDS] databases would require only the execution of simple comm ands, and would provide the most accurate and current records responsive to the requests fo r database schema and code tables.” Pls.’ Reply at 24 (citing Pls.’ Reply, Second Decl. of Michael Hasan, ECF No. 27-3 [hereinafter Sec. Hasan Decl.], ¶¶ 9-10). The court disagrees with Plaint iffs and finds that Defendants’ search of the SLM repository for the requested records was adequate. “There is no requireme nt that an agency search every record system.” Oglesby , 920 F.2d at 68 (citations omitted). The agency responded to the FOIA31 request by searching the “author itative” database where respons ive records were likely to be held. It identified the sections of that database where responsive do cuments were likely to be found and reviewed the responsive documents. Though Plaintiffs may be co rrect that “[t]he database schema and [metadata] are actually a built-in part of any modern datab ase,” Sec. Hasan Decl. ¶ 10, and therefore, are necessarily contai ned within the EID and IIDS da tabases, they have not offered any reason to believe that responsive records—other than the databa se schema and codes themselves, which Defendants are not require d to produce at this juncture—w ould be found within the databases. Absent such a showing, the court is satisfied that Defendants conducted a proper search for the EID and IIDS database schema and metadata. See Mobley v. CIA , Civ. No. 11-cv-02072, Civ. No. 11-cv-02073, 2015 WL 7423687, *8 (D.C. Cir. Nov. 13, 2 015) (“Agency affidavits—so long as they are ‘relatively detailed and non-conclusory’—are ‘ accorded a presumption of good faith, which cannot be rebutted by ‘purely speculative claims a bout the existence and discoverability of other documents.’” (citations omitted)). Plaintiffs last contend that the search was inadequate because Defendants failed to search CBP records for responsive documents. Of Plaintiffs’ seven FOI A requests at issue in this case, only FOIA Requests V and VII were directed to CBP. Both of tho se were requests for copies of the requested snapshots. Because the court already has conclud ed that Defendants need not produce copies of snapshots, the court does not reach the issue of the adequacy of Defendants’ search of CBP records.
IV. CONCLUSION AND ORDER For the reasons set forth above, Defendants’ Motion is granted in part and denied in part and Plaintiffs’ Cross-Motion is granted in part and denied in p art. Judgment is entered in favor of32 Defendants as to (1) the adequacy of the search for FOIA Reques ts I and II and (2) their withholding of copies of snapshot s in response to FOIA Requests IV through VII. As for the grounds on which the court has denied Defendants’ Mo tion, within 30 days of this date, Defendants shall be permitted to supplement their su mmary judgment briefing with additional evidence that supports their assertions that (1) dis closure of metadata and database schema “could reasonably be expe cted to risk circumvention of t he law” under Exemption 7(E) and (2) they have conducted an adequate search for records in r esponse to FOIA Request III. Thereafter, within seven days, Plaintiffs shall notify the cour t if they intend to challenge the newly submitted evidence, and if so, the parties shall propose a brie fing schedule.

Dated: December 14, 2015 Amit P. Mehta United States District Judge