Stephen AGUIAR, Appellant v. DRUG ENFORCEMENT ADMINISTRATION, Appellee, 865 F.3d 730

GARLAND, Chief Judge: After he was convicted of narcotics offenses, Stephen Aguiar filed several Freedom of Information Act requests for materials relating to his investigation by the Drug Enforcement Administration (DEA). The DEA denied two of the requests, saying that software Aguiar identified was not an agency record and that copies of administrative subpoenas he wanted could not be located. The district court granted the DEA’s motion for

summary judgment as to both requests. Because the government’s declarations were insufficient to support

summary judgment in its favor, we vacate the judgment and remand for further proceedings. I In 2009, the Drug Enforcement Administration joined a criminal investigation of a drug-trafficking ring involving Aguiar. During the investigation, the DEA installed a Global Positioning System (GPS) tracker on at least one of his cars. Agents used software to monitor the tracker and to visualize tracking data on satellite maps. Around the same time, agents issued administrative subpoenas seeking Aguiar’s telephone and financial records.

The investigation ultimately led to Aguiar’s conviction on drug-trafficking charges, which the Second Circuit affirmed in December 2013. See United States v. Aguiar, 737 F.3d 251, 265 (2d Cir. 2013). While his direct appeal in the Second Circuit was pending, Aguiar made Freedom of Information Act (FOIA) requests seeking materials from the investigation. Two requests are at issue here.

First, Aguiar requested “all tracking information collected via GPS devices attached to my vehicles,” along with “all ... proprietary software associated with that information.” Letter from Stephen Aguiar to DEA (Aug. 19, 2013) (J.A. 102). In response to that request, the DEA gave Aguiar a printed copy of spreadsheets listing latitude and longitude coordinates captured by the GPS tracker that was attached to his Subaru Impreza. Unsatisfied with these spreadsheets, which he found difficult to interpret, Aguiar renewed his request for a copy of the software the DEA used to visualize GPS coordinates on maps.

In case the DEA again refused to give him the software, Aguiar asked in the alternative for images of the coordinates plotted onto satellite maps. Letter from Stephen Aguiar to U.S. Dep’t of Justice (Apr. 1, 2014) (J.A. 139). The DEA did not provide either the software or the map images. Second, Aguiar requested four specific administrative subpoenas that the DEA issued during its investigation. The agency responded that it had already searched for them to no avail.

A few months before Aguiar’s request for the four subpoenas, Aguiar had made several broader FOIA requests, including one for “any administrative subpoena” issued from the DEA’s Burlington, Vermont office during the investigation. Letter from Stephen Aguiar to DEA (Aug. 1, 2013) (J.A. 101). In response to those earlier requests, the DEA conducted a search that it said would have located the four subpoenas that Aguiar later specified.

In particular, according to a declaration from the chief of the DEA’s FOIA unit, Katherine Myrick, Aguiar’s earlier requests “were construed as seeking,” among other records, “administrative subpoenas ... pertaining to [Aguiar].” Deck of Katherine L. Myrick at 16 (Apr. 7, 2015) (J.A. 165) (“First Myrick Declaration”). The declaration described how the agency searched one of its record systems to locate two relevant case files. Id. at 18-19 (J.A. 167-68).

In describing the search within those case files, however, all the declaration said was that the “Burlington Resident Office was tasked with conducting a search of the two (2) files for all records related to [Aguiar] to include all investigative reports [and] administrative subpoenas.” Id. at 19 (J.A. 168). The DEA did not find the four specific subpoenas Aguiar requested.

In 2014, Aguiar, acting pro se, filed a FOIA complaint in the United States District Court for the District of Columbia, challenging the DEA’s failure to release the GPS mapping software, map images of the GPS data, the four administrative subpoenas, and additional materials no longer at issue. The DEA filed a motion for

summary judgment, accompanied by Myrick’s declaration describing the agency’s search. After briefing from both sides, the district court ordered the DEA to file a supplemental declaration identifying the “software used by the DEA to create images from the GPS tracking data, the nature of the DEA’s license to use that software,” and any applicable FOIA exemption. Aguiar v. DEA, Civ.' No. 14-02401, slip op. at 2 (July 20, 2015). The court instructed that the supplemental declaration should also explain whether the DEA’s search encompassed the four specific subpoenas Aguiar requested. Id.

In response, Myriek filed a supplemental declaration that did not address the software at all, although the accompanying Notice of Compliance explained that counsel for the DEA believed the software was licensed only for official purposes. See Supp. Deck of Katherine L. Myriek (Sept. 8, 2015) (J.A. 199) (“Second Myriek Declaration”); Notice of Compliance at 4 n.5 (Sept. 9, 2015).

The declaration did say, however, that Agu-iar’s request for the four subpoenas “was duplicative of his earlier requests,” and that the “previous searches would have uncovered all subpoena related information.” See Second Myriek Declaration at 4 (J.A. 202). The district court then granted

summary judgment to the DEA on all issues except Aguiar’s request for the software. As to Aguiar’s alternative request for map images, the district court held that producing those images would require creating a new record, which FOIA does not compel. As to the subpoenas, the court held that the DEA had discharged its FOIA obligations by performing an adequate search. Regarding the software, however, the court found that the record was still insufficient.

Invited to supplement the record again, the agency submitted another declaration, this time stating that it had searched two DEA offices but concluded that it “was not in possession or control of any system or software that was responsive to [Aguiar’s] request.” Supp. Decl. of Katherine L. Myriek at 8 (Nov. 10, 2015) (J.A. 223) (“Third Myriek Declaration”). The district court accepted this declaration as proving that the software “is not an •agency record,” and granted

summary judgment to the DEA on the software issue. Aguiar v. DEA, Civ. No. 14-0240, slip op. at 2, 2015 WL 7566661 (Nov. 24, 2015). Still acting pro se, Aguiar appealed the grant of

summary judgment. We appointed an amicus curiae to present arguments in support of Aguiar’s position. For purposes of this opinion, we will attribute to Aguiar the arguments made by the amicus because Aguiar filed a statement expressly joining in those arguments. II We review the district court’s grant of

summary judgment de novo. See Judicial Watch, Inc. v. U.S. Secret Serv., 726 F.3d 208, 215 (D.C. Cir. 2013). A court may grant

summary judgment only if there is “no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” FED. R. CIV. P. 56(a). “In FOIA cases, ‘summary judgment may be granted on the basis of agency affidavits if they contain reasonable specificity of detail rather than merely conclusory statements, and if they are not called into question by contradictory evidence in the record or by evidence of agency bad faith.’” Judicial Watch, 726 F.3d at 215 (quoting Consumer Fed’n of Am. v. Dep’t of Agric., 455 F.3d 283, 287 (D.C. Cir. 2006)).

We must draw “all justifiable inferences” in favor of the non-mov-ant, Aguiar. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 255, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). A We begin with Aguiar’s request for a copy of the GPS mapping software that was used to track his movements and about which a DEA agent testified at Agu-iar’s trial.

The DEA contends that the software is not subject to disclosure under FOIA, which empowers district courts to order the production of any “agency records improperly withheld.” 5 U.S.C. § 552(a)(4)(B). “The burden is on the agency to demonstrate, not the requester to disprove, that the materials sought are not ‘agency records’ or have not been ‘improperly’ “withheld.’ ” U.S. Dep’t of Justice v. Tax Analysts, 492 U.S. 136, 142 n.3, 109 S.Ct. 2841, 106 L.Ed.2d 112 (1989). Although FOIA does not define “agency records,” the Supreme Court and this court have identified limits on what documents come within the term.

It “extends only to those documents that an agency both (1) ‘create[s] or obtain[s],’ and (2) ‘controls] ... at the time the FOIA request [was] made.’ ” Judicial Watch, 726 F.3d at 216 (alterations and emphasis in original) (quoting Tax Analysts, 492 U.S. at 144-45, 109 S.Ct. 2841). To determine whether a document satisfies those requirements, “we must ‘focus[ ] on a variety of factors surrounding the creation, possession, control, and use of the document.’ ” Id. at 217 (quoting Consumer Fed’n, 455 F.3d at 287).

In particular, to determine “whether an agency has sufficient ‘control’ over a document to make it an ‘agency record,’ ” this court usually examines four factors: the intent of the document’s creator to retain or relinquish control over the records; [2] the ability of the agency to use and dispose of the record as it sees fit; [3] the extent to which agency personnel have read or relied upon the document; and [4] the degree to which the document was integrated into the agency’s record system or files. Id. at 217 (quoting Tax Analysts v. U.S. Dep’t of Justice, 845 F.2d 1060, 1069 (D.C.

Cir. 1988), aff'd on other grounds, 492 U.S. 136, 109 S.Ct. 2841, 106 L.Ed.2d 112 (1989)). Courts have also elaborated on the term “withheld,” explaining that an agency can “withhold” a record only if it has “possession or control” of it. Kissinger v. Reporters Comm. for Freedom of the Press, 445 U.S. 136, 151, 100 S.Ct. 960, 63 L.Ed.2d 267 (1980); see DiBacco v. U.S. Army, 795 F.3d 178, 192 (D.C. Cir. 2015). The DEA’s principal argument on appeal is that it simply “does not have the requested software.” DEA Br. 12.

To establish that proposition, the DEA relies solely on the third declaration Katherine Myrick filed in the district court. That declaration states that the agency interpreted Aguiar’s request “as seeking software in the possession and control of DEA that would allow the inputting [of] longitude and latitude and display the information on a map.” Third Myrick Declaration 2 (J.A. 222). The agency searched two DEA offices, the declaration says, and concluded that it “was not in possession or control of any system or software that was responsive to [Aguiar’s] request.” Id. at 3 (J.A. 223).

The DEA asks us to read that statement to mean that the DEA searched for the software and—as a matter of fact—found nothing. But that is not what it says. It says only that the DEA “was not in possession or control” of any responsive software—which is a.legal assertion, and a conclusory one at that. By using that legal language, the declaration appears to conclude as a matter of law that the software is not in the agency’s “possession or control,” rather than to explain as a matter of fact that the software was not found. Even if that is not the only reasonable

interpretation of the declaration, we must view it in that light—the one most favorable to Aguiar, the non-moving party—on

summary judgment. See Anderson, 477 U.S. at 255, 106 S.Ct. 2505. Moreover, the DEA’s factual assertion on appeal—[1] that it “does not have the requested software”—conflicts with multiple statements the agency made in the district court that suggested familiarity with the software and its location. In those statements, the DEA told the court that: [2] the software is “licensed proprietary software-,” Mem. in Supp. of Def.’s Mot. for Summ. J. at 28 n.8; [3] the software is “generic or prefabricated right out of the box and available to others in the open marketplace,” Reply to Pl.’s Opp. to Def.’s Mot. for Summ.

J. at 10; [4] the DEA “is unsure whether the software is licensed, purchased, or used through another methodology,” but “upon information and belief the [DEA] believes the software is licensed to the DEA only for official government purposes,” Notice of Compliance at 4 n.5; and [5] “the DEA has identified many end users of GPS tracking software,” id. at 6.

Moreover, although Myrick’s third declaration concludes that the “DEA was not in possession or control of any system or software that was responsive to [Aguiar’s] request,” it acknowledges that [6] the “DEA does contract for a service that allows for viewing the location of a GPS tracking device[ ] on a geodetic map computer image.” Third Myrick Declaration 3 (J.A. 223).

Asked at oral argument to reconcile these six divergent descriptions, DEA counsel instead tacked on a seventh: There is a third party vendor that supplies a ... complex system, seemingly involving multiple different types and installations of software ... which has the capability of receiving data from GPS devices .... An agent at the DEA can then access those third-party servers, which likely have some kind of software on them to control and organize this data, in order to track those GPS devices in real time. Oral Arg. Recording 30:28—31:05.

Presented with these seven inconsistent descriptions, we do not know how to square the heptagon. It may be that DEA is saying it does not possess the software in the physical sense. But that would not necessarily end the matter because a record can be under an agency’s control even if not physically held by the agency. In Burka v. U.S.

Department of Health & Human Services, for example, we held that, although the requested records were “neither created by agency employees, nor ... located on agency property,” the agency had a close enough relationship with the records to give the agency “constructive control” over them. 87 F.3d 508, 515 (D.C. Cir. 1996); see also Competitive Enter. Inst. v. Office of Sci. & Tech. Policy, 827 F.3d 145, 150 (D.C. Cir. 2016) (holding that emails, although stored on a private organization’s server, could nonetheless be “agency records” if the agency retained “possession and control”).

Or it may be that the DEA is saying the converse: that it does not legally control the records even though they are physically located on the agency’s premises. In Kissinger v. Reporters Committee for Freedom of the Press, for example, although notes Henry Kissinger made at the White House were stored in his office at the State Department, the Supreme Court held that they “were not in the control of the State Department at any time” and so were never State Department “agency records.” 445 U.S. at 157, 100 S.Ct. 960; cf. Goland v. CIA, 607 F.2d 339, 346-47 (D.C.

Cir. 1978) (holding that an “agency’s possession of a document, standing alone,” does not “dictate[] that it is an ‘agency record,’ ” and instead courts must evaluate “whether under all the facts of the case” it has come within the agency’s control). As an alternative to its contention on appeal that it does not have the requested software, the DEA argues that the record contains sufficient facts to establish, as a legal matter, that it did not “obtain[ ]” and does not “control[ ]” the software. Judicial Watch, 726 F.3d at 216.

The DEA bears the burden of proving either proposition, see Tax Analysts, 492 U.S. at 142 n.3, 109 S.Ct. 2841, and must do so beyond material factual dispute, see Fed. R. Civ. P. 56(a). The DEA cannot satisfy that burden for the same reason discussed above: these are fact-intensive inquiries, yet the record is at once devoid of actual evidence about the software and replete with inconsistent descriptions of it.

The DEA does not explain where the software is located, what arrangement it has with the software’s creator, how it uses the software, and why those circumstances amount to something short of obtaining and controlling the software. At best, the agency asks the court to speculate about “the likelihood that the software described by” a DEA agent at Aguiar’s trial “need not have been ‘obtained’ to be used by the DEA.” But it acknowledges that the record “does not speak directly to” the legal factors governing control. DEA Br. 17-18.

At bottom, we simply do not know enough about the software to credit either of the DEA’s arguments: that it does not have the software, or that it did not “obtain” and does not “control” the software in a way that satisfies the legal definition of an “agency record.” The district court repeatedly invited the DEA to shed light on these questions by supplementing the record. Because the agency declined those invitations, material questions of fact remain. As a consequence, the DEA is not entitled to

summary judgment on this issue. B Aguiar also contends that, if he is not entitled to a copy of the software, then he should at least receive the GPS tracking data visualized “as images plotted on a map.” Amicus Br. 19. The DEA, which has already given him that data as coordinates in a spreadsheet, protests that creating maps would constitute creating new agency records, which FOIA does not require. See Yeager v. DEA, 678 F.2d 315, 321 (D.C. Cir. 1982).

Aguiar responds that FOIA entitles him to the agency record in his preferred format, see 5 U.S.C. § 552(a)(3)(B), and that maps are merely another format of the GPS tracking data. Aguiar presents this argument as a “fallback position,” Amicus Br. 32, with respect to his request for a copy of the GPS mapping software. Because we vacate the district court’s grant of

summary judgment on that request and remand for further proceedings, it remains possible that Agu-iar will prevail in seeking the software. Accordingly, reaching Aguiar’s fallback request today would be premature. If the district court again enters judgment against Aguiar, he can bring another appeal. C The remaining FOIA request at issue is for four administrative subpoenas, which the DEA searched for but did not find. Contending that its search was adequate to discharge its FOIA obligations, the DEA sought and the district court granted

summary judgment. We vacate and remand for further proceedings on this issue as well. The agency is entitled to

summary judgment only if it “show[s] beyond material doubt that it has conducted a search reasonably calculated to uncover all relevant documents.” Motley v. CIA, 508 F.3d 1108, 1114 (D.C. Cir. 2007) (quoting Weisberg v. U.S. Dep’t of Justice, 705 F.2d 1344, 1351 (D.C. Cir. 1983)). To meet that burden, the agency may submit, and we may rely on, “reasonably detailed affidavit[s], setting forth the search terms and the type of search performed, and averring that all files likely to contain responsive materials (if such records exist) were searched.” DiBacco, 795 F.3d at 188 (quoting Valencia-Lucena v. U.S.

Coast Guard, 180 F.3d 321, 326 (D.C. Cir. 1999)). But “if a review of the record raises substantial doubt, particularly in view of well defined requests and positive indications of overlooked materials,” then we must deny

summary judgment. Id. (quoting Valencia-Lucena, 180 F.3d at 326). Here, the DEA’s declarations described its search in the following way. The DEA construed Aguiar’s request to include “all criminal investigative records, including administrative subpoenas, pertaining to or referencing [Aguiar] by name.” Second Myrick Declaration 2 (J.A. 200).

The agency believed that “[a]ny administrative subpoena maintained by DEA was reasonably likely to be found in an investigative ease file maintained in the DEA Investigative Reporting and Filing System (IRFS),” id., and that “no other record systems are reasonably likely to contain” the subpoenas, First Myrick Declaration 17 (J.A. 166). The agency identified two relevant investigative case files in IRFS, using Aguiar’s biographical details and an agency database. First Myrick Declaration 18 (J.A. 167).

Then, “[t]he Burlington Resident Office was tasked with conducting a search of [those] files for all records related to [Aguiar] to include all ... administrative subpoenas.” Id. at 19 (J.A. 168). This search turned up several subpoenas, but not the four Aguiar specifically requested. 1. The DEA’s declarations explain how it found the two case files, but not how it searched within those files. All they say is that one DEA office “was tasked with conducting a search” of the files for subpoenas. Id. That is little different than the affidavit we encountered in DeBrew v.

Atwood, which described only the agency employees to whom the search “was assigned,” “why they were chosen,” and what they found. 792 F.3d 118, 122 (D.C. Cir. 2015). That description, we held, was “not sufficiently detailed to support a

summary judgment because it does not disclose the search terms ... and the type of search performed.” Id.; see Weisberg v. U.S. Dep’t of Justice, 627 F.2d 365, 370 & n.49 (D.C.

Cir. 1980) (holding that an affidavit that “merely states the fact that [an employee] searched and expresses his conclusion that the files contain nothing [responsive]” “gives no detail as to the scope of the examination and thus is insufficient as a matter of law”); see also Motley, 508 F.3d at 1122 (holding that an affidavit that “merely identifies the [agency components] that were responsible for finding responsive documents without identifying the terms searched or explaining how the search was conducted in each component” could not justify

summary judgment (internal quotation marks and citation omitted)). On appeal, the DEA suggests that there was little more it could have said about the search of .the case files: “[Tjhere was no further ‘methodology’ to undertake other than to go through those files and see if any records therein were responsive.” DEA Br. 27. The implication of this statement is that the files consisted of physical documents, each of which the Burlington Resident Office examined manually to see if it was a subpoena.

The existing declarations do not describe the search in that way, but if that is so, it would of course resolve the matter, and the agency can say so in a new declaration filed with the district court. If the files were not susceptible to a manual search of every page, however, and particularly if they were electronic, then more will need to be said about the manner of the search. 2.

The DEA’s declarations were also inadequate in another respect: while they explain how the agency found the two case files, they do not explain why the only reasonable place to look for the subpoenas was in case files maintained in the IRFS system. Although Myrick states that “no other record systems are reasonably likely to contain” the subpoenas, she does not say why. First Myrick Declaration 17 (J.A. 166).

Yet, an agency must not only “explain in its affidavit that no other record system was likely to produce responsive documents”; it must also “show, with reasonable detail,” that the agency’s approach “was reasonably calculated to uncover all relevant documents.” Oglesby v. U.S. Dep’t of the Army, 920 F.2d 57, 68 (D.C. Cir. 1990). To be sure, the degree of detail required depends on the case, and “the adequacy of a FOIA search is generally determined not by the fruits of the search, but by'the appropriateness of the methods used to carry out the search.” Iturralde v.

Comptroller of the Currency, 315 F.3d 311, 315 (D.C. Cir. 2003). Hence, “the failure of an agency to turn up one specific document in its search does not alone render a search inadequate.” Id. But in some cases, failure to find a record that once existed, coupled with a conclusory affidavit about the methodology of the search, can weaken the agency’s claim for

summary judgment. See Weisberg v. U.S. Dep’t of Justice, 627 F.2d 365, 370-71 (D.C. Cir. 1980). In this case, the search failed to turn up four subpoenas that Aguiar specifically requested. There is no dispute that they once existed: Aguiar’s declaration states that he saw copies of all four subpoenas in 2010, during discovery in his criminal trial, and that he also saw that they had been issued by a DEA agent. Declaration of Stephen Aguiar 1-2 (May 4, 2015) (J.A. 192-93). Not only must we accept that declaration as true in this

summary-judgment posture, but a DEA agent testified at Aguiar’s trial that the subpoenas had been issued. Trial Tr. 68 (Aug. 4, 2010) (J.A. 9). Moreover, there are grounds to believe that the DEA still had the subpoenas near the time Agu-iar made his FOIA request. At that time, Aguiar’s case was still ongoing: the Second Circuit did not resolve his direct appeal until December 2013, several months after the DEA conducted its search in August 2013. Under these circumstances, which include “well defined requests and positive indications of overlooked materials,” DiBacco, 795 F.3d at 188 (quoting Valencia-Lucena, 180 F.3d at 326), the DEA’s declarations are too sparse to assure the court on

summary judgment that the search was reasonable. On remand, the agency will need to file a new declaration explaining why the record system that it queried to produce the two files was the only one likely to contain the subpoenas.

And if the two were paper files, it will need to explain why it was unlikely that there were additional files, particularly electronic files, that could contain the subpoenas. ⅜⅜⅜ In sum, we conclude that the existing declarations were insufficient to explain: (1) why the search within the two case files that the IRFS record system identified was reasonably calculated to find the subpoenas, and (2) why the DEA thought it reasonably likely that the requested subpoenas would only be found in case files maintained in IRFS. For these reasons,

summary judgment for the agency on Aguiar’s request for the administrative subpoenas was unwarranted on the current record. HI Because the DEA has not met its

summary-judgment burden on either of the two FOIA requests that are before us on this appeal, we vacate the judgment and remand for further proceedings consistent with this opinion. So ordered. . Aguiar also suggests that the DEA’s search was insufficient because the agency failed to contact the agent who originally issued the subpoenas for further leads regarding their location. Had Aguiar made that suggestion to the agency or to the district court, our analysis might be different. But Aguiar never did so, either in his correspondence with the DEA or in his filings in the district court.

Under these circumstances, the agency "is not obliged to look beyond the four corners of the request for leads.” Kowalczyk v. Dep’t of Justice, 73 F.3d 386, 389 (D.C. Cir. 1996); cf. Valencia-Lucena v. U.S. Coast Guard, 180 F.3d 321, 325, 327-28 (D.C. Cir. 1999) (finding a search inadequate because the agency failed to contact an employee who was "a likely source for information about what happened to” a missing document and who was named in the FOIA request).