UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

ELECTRONIC PRIVACY INFORMATION CENTER , Plaintiff,

v. UNITED STATES DRUG ENFORCEMENT ADMINISTRATION , Defendant. Case No. 15-cv-00667 (CRC)

MEMORANDUM OPINION Before developing or procuring new information technology that involves the collection of identifiable personal infor mation, federal agencies must ass ess how that technology will affect citizens’ civil liberties and pr ivacy. Plaintiff Electronic Pr ivacy Information Center (“EPIC”) submitted a two-part Freedom of Information Act request to the Drug Enforcement Administration to obtain all suc h privacy assessments prepared by the agency. After considerable back-and-forth on s earch parameters and results, E PIC eventually received ten pages of responsive records fr om the DEA and 13 pages of record s from the Department of Justice’s Office of Privacy and C ivil Liberties (“OPCL”), which coordinates privacy assessments for all DOJ components includi ng the DEA. Believing that it ha s fulfilled its FOIA obligations, the DEA has moved for summary j udgment. EPIC has challenged th e adequacy of the DEA’s searches in its own cross-mo tion for summary judgment. Because the DEA’s declarations establish the reasonableness of its initial searches but not it s supplemental search for four specific programs, the Court wi ll grant in part and deny in par t the DEA’s motion, deny in part and reserve judgment in part on EPIC’s cross-motion, and direct the DEA to conduct a limited additional search.2 I. Background EPIC is a public-inter est research organization based in Washin gton, D.C. Pl.’s Compl. (“Compl.”) ¶ 4. Through its prin t and online publications, EPI C distributes reports “analyz[ing] the impact of government programs on civil liberties and privac y interests.” Id. In February 2015, EPIC submitted a FOIA request to the DEA seeking the foll owing records: Part 1 : All Privacy Impact Assessments ( “PIAs”) the DEA has conducted that are not publicly available at http://www .dea.gov/FOIA/PIA.shtml; and Part 2 : All Privacy Threshold Analysi s (“PTA”) documents and Initial Privacy Assessments (“IPAs”) the DEA has conducted since 2007 to presen t. Def.’s Statement of Material F acts (“DSOF”) ¶ 1. Agencies must generate a Privacy Impact Assessment (“PIA”) when “initia ting a new collection of informa tion” or “developing or procuring information technology t hat collects, maintains, or d isseminates information that is an identifiable form.” E-Government Act of 2002, Pub. L. 107-347, § 208, 116 Stat. 2899, 2921 (2002). The OPCL assists DOJ components, like the DEA, “by ass essing the need to conduct a PIA through the Initial Privac y Assessment (“IPA”) process.” Pl .’s Opp’n & Cross-Mot. Summ J. (“Pl.’s Opp’n”), Ex. 2 at 4. Thi s initial assessment, previ ously known as the Privacy Threshold Analysis (“PTA”), ide ntifies privacy concerns surroun ding the technology and informs the decision of whether additional privacy assessments, like a final PIA, will be necessary before the agency can i mplement a data collection pro gram or IT system. Compl. ¶ 11. If the OPCL determines a PIA is needed, the agency must submit the assessment for final OPCL approval and, if practicable , publicly post it before the system is operational. Id. ¶¶ 13, 15. The PIA remains online as l ong as the program is in use. Decl. Katherine L. Myrick Supp. Def.’s Mot. Summ. J (“First Myrick Decl.”) ¶ 16.3 The Chief Information Officer S upport Unit (“CIOSU”)—housed in the DEA’s Office of Information Systems—manages the “day-to-day implementation of a nd compliance” with the agency’s privacy assessment requirements. Decl. Katherine L. M yrick Supp. Def.’s Reply Mot. Summ. J. (“Second Myrick Decl.”) ¶ 6. The CIOSU is the DEA’s p oint-of-contact for the OPCL and acts as a liaison between the O PCL and the DEA’s Senior Com ponent Official for Privacy (“SCOP”). The SCOP is responsible for approving PIAs before th e CIOSU submits them to the OPCL for final authorization. F irst Myrick Decl. ¶ 10. The CI OSU then “transmit[s], publish[es] online, and store[s] record copies of final DEA PIA s.” Second Myrick Decl. ¶ 6. DEA, accordingly, charged the C IOSU with leading the search for the requested records and providing responsive records to EPIC. Def.’s Mem. Supp. Mo t. Summ. J. 2. The CIOSU reached out to EPIC to clarif y if EPIC sought only final privac y assessments, or draft versions as well. First Myrick Decl. ¶ 11. EPI C responded that it was onl y interested in the final versions. Id. The CIOSU then crafted a sea rch tailored to EPIC’s request : For Part 1 of the request, the CIOSU searched its paper files; its SharePoint site—a network d rive shared by DEA components with IT responsibilities; relevant staff email; and its Share D rive—another network drive containing the CIOSU’s most comp rehensive collection of records and where privacy assessments are typically sto red. Id. ¶ 18. It used the searc h terms “Privacy Impact Assessment” and “PIA” for all of the electr onic databases; then, it winnowe d the results by adding the search term “final.” The Share Dri ve search—and no others—yielded res ponsive records. Id. ¶ 19. As an added precaution, the CIOSU ra n individual searches using te rms derived from the letter containing EPIC’s FOIA request. 1 Id. All but one of the PIAs uncovered were already public.

1 The additional search terms inc luded: Hemisphere, National Lic ense Plate Reader Initiative, LPR, DEA Internet C onnectivity Endeavor, DICE, Spec ial Operations Division, SOD,4 The remaining PIA, for a program called Avue Digital Services, was released to EPIC. Id. ¶¶ 20–22. The CIOSU followed the same me thodology for Part 2 of EPIC’s r equest, searching the same databases in a similar manner. It used search terms—“Priv acy Threshold Analysis,” “PTA,” “Initial Privacy Assessmen t,” “IPA,” and “privacy@usdoj. gov,” the OPCL’s email address—with “final” as a n additional filter. Id. ¶ 24. And, again, it ran independent searches using the program names listed a bove. No final PTAs or IPAs tu rned up. Id. The CIOSU did find, however, 13 OPCL determinat ion letters. Id. ¶ 25. The D EA told EPIC that IPAs and PTAs were essentially “working dr afts” and that the final produ cts from discussions with the OPCL were the determination letters themselves, which stated wh ether a final privacy assessment was needed before the system could be implemented. Id. EPIC chose to accept the OPCL determination letters in lieu of the PTAs and IPAs. Id. ¶ 26. Because the OPCL drafted these letters, the CIOSU sent th e letters to the OPCL to review and release. The OPCL released 13 minimally redacted determinatio n letters to EPIC in August 2 015. Id. ¶¶ 30–32; see also Pl.’s Opp’n, Ex. 3. EPIC does not challeng e these redactions. JointStatus Report 1, ECF No. 16. After reviewing the determinati on letters, EPIC challenged the sufficiency of the DEA’s initial search. The determinati on letters showed that the OPCL had requested four PIAs from DEA that were not available online and had not been uncovered b y the DEA’s initial search. EPIC asked the DEA to locate them. First Myrick Decl. ¶ 32. T he CIOSU re-ran its initial search, using the terms “PIA” a nd “final” to search its electro nic databases; no new PIAs were uncovered. Id. ¶ 33.

telecommunications metadata, tel ecommunications, and metadata. First Myrick Decl. ¶ 19. None of these searches produ ced responsive records. Id.5 The DEA now moves for summar y judgment on the grounds that it c onducted a reasonable search and produced res ponsive records, thus fulfill ing its obligations under FOIA. EPIC’s cross-motion for summar y judgment raises three main obje ctions to the DEA’s search: 2 (1) The DEA’s search methodology was incomplete and not compreh ensive, (2) the agency improperly limited the scope of its search by using unsuitable search terms, and (3) it should have altered its search appro ach when EPIC provided it evidence of unaccounted-for PIAs. Pl.’s Opp’n 7–8. II. Standard of Review Organizations invoke FOIA “to pier ce the veil of administrative secrecy and to open agency action to the light of pub lic scrutiny.” Am. Civil Libe rties Union v. U.S. Dep’t of Justice, 655 F.3d 1, 5 (D.C. Cir. 2011). The statute imposes a general obligation on the government to provide records to the public. 5 U.S.C. § 552(a) . FOIA carves out explicit exceptions to this disclosure obligation, 5 U.S.C. § 552(b), bu t “[t]he basic purpose of FOIA is to ensure an informed citizenry, vital to the functioning of a dem ocratic society, needed to check against corruption and to hold the governors accountable to the governed,” NLRB v. Robbins Tire & Rubber Co., 437 U.S. 214, 24 2 (1978). Congress did not intend, however, “to reduce government agencies to full-time investigators on behalf of req uesters.” Judicial Watch v. Export-Import Bank, 108 F. Supp. 2d 19, 27 (D.D.C. 2000). FOIA cases are appropriately resolved at summary judgment. See Brayton v. Office of U.S. Trade Rep., 641 F.3d 521, 527 (D.C. Cir. 2011). In decidi ng a motion for summary

2 EPIC originally challenged the sufficiency of the DEA’s search es for responsive records to Part 1 and Part 2 of its FOIA request. It has since dropped its challeng e to the DEA’s search for responsive records to Part 2 of its request. Pl.’s Reply S upp. Cross-Mot. Summ. J. 2.6 judgment, the Court assumes the truth of the non-movant’s evide nce and draws all reasonable inferences in the non-movant’s favor. See Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 255 (1986). When an agency’s search is questioned, it must show “b eyond material doubt that its search was reasonably calculated to uncover all relevant docume nts.” Ancient Coin Collectors Guild v. U.S. Dep’t of State, 641 F.3d 504, 514 (D.C. Cir. 2011 ) (quoting Valencia-Lucena v. U.S. Coast Guard, 180 F.3d 321, 325 (D.C. Cir. 1999)) (internal quotation marks omitted). An agency’s search is judged by the i ndividual circumstances of ea ch case. See Truitt v. Dep’t of State, 897 F.2d 540, 542 (D.C. Cir . 1990). The central questio n is whether the search itself was reasonable, regardless of the r esults. See Cunningham v. U.S. Dep’t of Justice, 40 F. Supp. 3d 71, 83–84 (D.D.C. 2014). Agencies n eed not scour every databas e, but rather should conduct a “good faith, reasonable search of those systems of records like ly to possess requested records.” Id. (quoting SafeCard S ervs., Inc. v. SEC, 926 F.2d 1197, 1201 (D.C. Cir. 1991)). Agency declarations, especially from individuals coordinating the sear ch, are accorded “a presumption of good faith, which cannot be reb utted by purely sp eculative clai ms about the existence and discoverability of other documents.” SafeCard , 926 F.2d at 1200. Courts can decide—and award—sum mary judgment solely based on ag ency affidavits and declarations that are “rela tively detailed and non-concluso ry.” Id. Important details include what records were searched, who di d the search, and what search terms or processes were used. See Judicial Watch., Inc. v. Dep’t of the Navy, 971 F. Supp. 2d 1, 2 (D.D.C. 2013). A plaintiff can rebut an agency declarat ion by raising “substantial doubt[s ] as to the reasonableness of the search, especially in light of ‘well-defined requests and posit ive indications of overlooked materials.’” Cunningham, 40 F . Supp. 3d at 84 (quoting Foundin g Church of Scientology of Washington, D.C. v. NSA, 610 F .2d 824, 837 (D.C. Cir. 1979)).7 III. Analysis As noted, EPIC contends the DEA’s search for final PIAs was unr easonable because it initially used an incomplete search methodology, unnecessarily limited the scope of the search, and did not modify its search once EPIC provided evidence of po tentially additional PIAs. A. Initial Search Methodology EPIC first maintains that perf orming a keyword search was unnec essary. In EPIC’s view, the DEA should have inst ead spoken with OPCL, CIOSU, and SCOP employees to determine the number and locati on of completed PIAs. The DEA—r ightly—responds that conducting a reasonable search do es not require involving exter nal agencies or departments. Def.’s Reply Supp. Mot. Summ. J. 3–4. Even though both are par ts of the Justice Department, the OPCL exists outside of the DEA. Thus, a search of the OPCL ’s records is best initiated by directing a FOIA request to the OPCL itself, which EPIC did not do. See Campbell v. U.S. Dep’t of Justice, 133 F. S upp. 3d 58, 65 (D.D.C. 2015) (holding that the DOJ’s Criminal Division was not required to searc h the DEA for responsive reco rds). More to the point, an agency’s se arch is reasonable if it is de signed and likely to produce responsive records. See id. at 64. The agency’s declarations show that the DEA’s initial search was just that. DEA chose the CI OSU to lead the search because of its familiarity and expertise with the agency’s compliance efforts and privacy documents. Fi rst Myrick Decl. ¶ 10. The CIOSU drafts, stores, and discu sses privacy assessments with th e OPCL. Second Myrick Decl. ¶ 6. Conversely, the SCOP only signs off on final PIAs before th ey are submitted to the OPCL. Id. Thus, the “CIOSU knows the locations where responsive [PIA s] are likely to be found.” First Myrick Decl. ¶ 10. The CIOS U searched its paper files, i ts Share Drive, its SharePoint site, and relevant staff electronic mail. And the search it designed was successful: It found PIAs, one8 of which was not already posted on line. Furthermore, the DEA e xplained why the CIOSU did not consult with the SCOP: “[T]here [was] no reasonable basis to believe that the SCOP would be able to identify the locati on of any additional final DEA PI As that CIOSU personnel did not locate through the searches they already conducted based on the ir knowledge of, and experience with, privacy documentation re quirements. . . .” Second Myrick Decl. ¶ 6. The DEA, not its FOIA requestors, is charged wit h determining the most effective way to search its records. EPIC has not provided any evidence unde rmining the DEA’s initial, go od-faith assessment of how and where to search for responsive records. B. Scope of Search EPIC next asserts that adding “fina l” as a search term resulted in underinclusive search results. EPIC’s main concern is that some requested records wo uld not have “final” in the body of the text or in the attache d message. It points to public PI As that do not include “final” in the name or content. Pl.’s Opp’n 9–10. B ut the DEA had clarified with EPIC that it wanted only the final PIAs. First Myrick Decl. ¶ 11. And the CIOSU’s initial set of search terms included the words “Privacy Impact Assessment” and “PIA,” which yielded too many results including all draft PIAs and any document that mentioned a PIA in passing. S econd Myrick Decl. ¶ 5. To find responsive records, the CIOSU added the term “final” becau se “[i]t is the customary practice of the CIOSU to use the word ‘final’ in the electronic file names of final, as opposed to draft, PIAs [in the Share Drive and SharePoint site].” Id. Th e CIOSU also typically uses “final” in “electronic mail message[s] transmitting a final PIA.” Id. Finally, the CIOSU conducted specific searches based on program names provided by EPIC witho ut adding “final” as a search term. These searches yielded no a dditional results. Id. This bolsters the DEA’s justification because searches without “final ” as a search term did not gener ate different results. EPIC does9 not respond to this argument a nd, in any event, has not raised substantial doubts about the scope of the DEA’s search. C. Supplemental Search for Missing PIAs The final issue before the Court is what obligations DEA was un der to continue searching once EPIC provided evidence of m issing PIAs. EPIC reviewed the 13 OPCL determination letters and found that the OPCL ha d required the DEA to perform a PIA for four technology systems. 3 These (potential) PIAs wer e not online and ha d not previously been provided to EPIC. Pl.’s Opp’n 10–11. EPIC requested that the DEA perform a suppl emental search to uncover them. The CIOSU re-ran its initia l search with the same result s. EPIC rejects this latter search as unreasonable. A FOIA plaintiff can undermine the adequacy of an agency’s sear ch if it shows that the agency failed to follow a “clear and certain” lead. See Mobley v. C.I.A., 806 F.3d 568, 582 (D.C. Cir. 2015). “Such leads may indicate, for example, other offices that should have been searched, additional search terms that should have been used, o r records custodians who should have been consulted.” Coleman v. DEA, 134 F. Supp. 3d 294, 301 (D.D.C. 2015) (quoting Rollins v. U.S. Dep’t of State, 70 F. Supp. 3d 546, 550 (D.D.C. 2014)). An initially reasonable search can also become “‘untenab le’ once [the agency] discover[ s] information suggesting the existence of other responsive material.” Coleman, 134 F. Supp. 3d at 302 (quoting Campbell v. DOJ, 164 F.3d 20, 28 (D.C. Cir. 1998)). Here, the relevant OPC L determination letters— addressed to the DEA’s SCOP a nd Operational Support Division an d dated from 2010 to 2011— stated that “the DEA must comp lete a privacy impact assessment . . . for this system.” Pl.’s

3 The four unaccounted-for PIAs rela te to the LIMS, DrugSTAR, NV NS, and WebOCTS systems. See Pl.’s Opp’n, Ex. 3 at 3, 4, 12, 13.10 Opp’n 10. The E-Government Act mandates that PIAs be approved prior to a technology system being implemented. See Pub. L. 107-347, § 208, 116 Stat. 2899, 2921 (2002). Thus, if the DEA implemented or is operating any of these systems, a PIA should have existed for it. This is a “clear and certain” lead about f our specific PIAs. And while t he DEA is not required to account for specific records, it must “ reasonably attempt[] to locate t hem.” West v. Spellings, 539 F. Supp. 2d 55, 62 (D.D.C. 2008). Yet it does not appear that the DEA took reasonable steps to lo cate these four PIAs. First, it failed to justify why r e-running its original search would suddenly uncover new PIAs for programs that were years old. S econd, the CIOSU apparently did not run any independent searches using the program names as search terms—as it did with earlier search es. What is more, the OPCL letters were di rected to the SCOP, but no effort s were made to search the SCOP’s records. In the DEA’s own words, the SCOP “reviews, app roves, and signs final PIAs.” Second Myrick Decl. ¶ 6. If th e SCOP had reviewed and approved a final PIA without returning it to the CIOSU, a final versi on of the PIA might remain with t he SCOP. The CIOSU did not explain why searching the SCOP , once EPIC presented evidence of potential additive PIAs, was not likely to uncover responsive records. The OPCL letters pro vide a “lead” that the CIOSU failed to reasonably follow. Thus , the Court finds that EPIC h as raised a substantial doubt as to the sufficiency of the DEA’s suppl emental search for PIAs cover ing the four identified programs. It will therefore order the agency either to conduct a supplemental search consistent with this opinion or explain in a supplemental declaration why such a search would not be likely to uncover the remaining r ecords in question. Apart from the DEA’s failure t o run down the lead discussed abo ve, the Court finds that the DEA undertook a good-faith, initi al search that was reasona bly calculated to uncover11 responsive records. The affida vits offered by the DEA explain and justify where, why, and how the agency searched its files. N either FOIA nor this Court dem ands more of it. IV. Conclusion For the foregoing reasons, the Court will grant in part and den y in part Defendant’s Motion for Summary Judgment, and will deny in part and reserve judgment in part on Plaintiff’s Cross-Motion for Summary Judgment. An Order accompanies this M emorandum Opinion.

CHRISTOPHER R. COOPER United States District Judge Date: September 13, 2016