Before Smith, Higginson, and Willett, Circuit Judges. Don R. Willett, Circuit Judge: Adam Malik is an immigration attorney whose work often requires in-ternational travel. Upon his return from one such trip, the Department of Homeland Security (“DHS”) diverted him to secondary screening after his surname appeared in connection with an investigation involving an arms dealer. DHS seized Malik’s phone, decrypted it, screened the files for priv-ilege, searched the remaining files, and then returned the phone to Malik. While that was happening, Malik sued DHS for declaratory and injunctive relief. The district court dismissed most of Malik’s claims, reasoning that he lacks standing to seek declaratory relief related solely to past events. Next, while the court held that Malik does have standing to seek an injunction re-quiring DHS to delete the data that it had seized, the court also held that Malik’s constitutional theories have no merit. We agree, and we AFFIRM. I Adam Malik is an attorney who practices immigration law. He is also the managing member of a firm that bears his name (together, “Malik”).[1] He is a naturalized citizen, but his work requires frequent international travel, and his clients often litigate opposite DHS. Many of his 2,000+ clients have no criminal history, but others are facing or awaiting charges, or are negotiating plea bargains. Malik uses a passcode-protected smartphone to communicate with his clients via email, and to take notes, record conversations, access files, and otherwise manage his cases. Much of this data is privileged. The phone also contains some of Malik’s personal data, such as medical records and private communications. The phone’s software automatically downloads new emails and messages from remote servers. Malik and his brother boarded a flight from Costa Rica to the United States on January 3, 2021. While they were en route, a DHS officer flagged Malik in a passenger-screening system.[2] As a result, when Malik landed in Dallas, border officers directed him to a secondary screening area for questioning. As part of that questioning, the officers asked Malik to unlock his phone. Malik refused, citing the privileged data that the phone contained. The officers then seized the phone, and they informed Malik that they intended to search it. But because no one disabled the phone, it received some messages and data even after that seizure. The phone’s passcode feature prevented the border officers from accessing the phone, and thus from searching it, so they sent it to a forensics lab. The lab bypassed the phone’s security features, extracted the phone’s data, and returned the phone and the data to DHS. All of that took about three months. DHS then used a “filter team” to screen the extracted data for any privileged materials. That took about two more months. Once the filter team had finished, they provided the border officers in Dallas with “two thumb drives . . . consisting of the data that the filter team determined [the officers] were authorized to search.” DHS then conducted a border search of that data, and DHS returned the phone to Malik on May 21, 2021. Meanwhile, Malik had sued DHS. His complaint sought declaratory and injunctive relief related to the phone’s seizure. He asked the district court to declare that DHS’s seizure of the phone “violated” his constitutional rights (Counts 1–6) and “was done in violation of” an internal agency “[d]irective” addressing border searches (Count 7). He also asked the district court to declare that DHS’s “directive” itself “violates” the Administrative Procedure Act (Count 8). Finally, Malik asked for a permanent injunction that would prohibit DHS from searching the phone and would require DHS to inform him of any such search already completed and to “[s]ecurely destroy all copies of digital information that [DHS] obtained from the [phone]” (Count 12).[3] Discovery closed on February 11, 2022. Malik moved to reopen discovery a few weeks later, citing a public letter that United States Senator Ron Wyden sent to DHS’s Inspector General. Among other things, the letter alleges that DHS conducted “bulk surveillance of Americans’ financial records” by collecting troves of “transaction data” from Western Union. While the letter asks DHS to investigate these allegations, it does not address individual border searches, phone records, decryption, or DHS’s data-retention policies. The district court denied Malik’s motion. Malik asked the court to reconsider, but the court denied that request. Both parties moved for summary judgment. The district court granted DHS’s motion for summary judgment, and it denied Malik’s.[4] The court concluded that Malik “lacks standing to pursue declaratory relief” because his requests “relate[] only to past events.”[5] Among other things, the court reasoned that the record was “void of any . . . allegations or evidence” suggesting that Malik would again face a border search or seizure.[6] Next, however, the district court treated the injunctive relief as a request for “expungement,” that is, a remedy that would require DHS to delete all copies of the data that it extracted from Malik’s phone.[7] After concluding that Malik had standing to seek this remedy, the district court refused to grant relief, reasoning that “[b]ecause [DHS] did not violate Mr. Malik’s constitutional rights, his claim for expungement fails.”[8] Malik now appeals. He challenges the district court’s final summary judgment for DHS, as well as that court’s earlier decisions declining to reopen discovery. II The district court had federal-question jurisdiction under 28 U.S.C. § 1331, and we have appellate jurisdiction under 28 U.S.C. § 1291. We review summary judgment de novo, applying the same standard as the district court.[9] Summary judgment is appropriate when “there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.”[10] “A disputed fact is material if it might affect the outcome of the suit under the governing law.”[11] When reviewing summary judgment, we “construe[s] all facts and inferences in the light most favorable to the nonmoving party.”[12] Separately, “a district court has broad discretion in all discovery matters,” and “such discretion will not be disturbed ordinarily unless there are unusual circumstances showing a clear abuse.”[13] III Malik argues that he has standing to seek declaratory relief, that DHS violated the law by seizing his phone, that the district court abused its discretion by declining to reopen discovery, and that the district court’s decision is so unreasoned as to be unreviewable. We disagree at each turn. A Malik does not have standing to request a judgment declaring that the now-completed border search of his phone was unlawful when it occurred. Counts 1–6 of Malik’s complaint asked the district court to declare that DHS “violated” Malik’s constitutional rights by seizing and searching his phone. Count 7 asked the district court to declare that DHS acted “in violation of” of an internal agency directive. Count 8 asked the district court to “vacate” and “enjoin” that same directive, and to declare that the directive “violates the Administrative Procedure Act.” The district court dismissed each of these claims, holding instead that Malik lacked standing to pursue “declaratory relief related only to past events.”[14] We agree. “The Declaratory Judgment Act provides that, ‘[i]n a case of actual controversy within its jurisdiction . . . any court of the United States . . . may declare the rights and other legal relations of any interested party seeking such declaration.’”[15] But “past exposure to illegal conduct, by itself, does not evince a present case or controversy.”[16] Rather, “[f]or there to be a case or controversy under Article III, the plaintiff must have a ‘personal stake’ in the case—in other words, standing.”[17] To establish standing, “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief.”[18] The district court held that Malik “failed to allege an injury in fact,” and that he “failed to establish that his alleged injuries would likely . . . be redressed by a favorable decision.”[19] On appeal, Malik discusses only injury-in-fact. He does not address redressability. Thus, while Malik explains his purported injuries at some length, he never explains how a declaratory judgment would fix them. “A party forfeits an argument . . . by failing to adequately brief [it] on appeal.”[20] Malik has made no arguments about redressability. He has therefore forfeited any such arguments. As a result, he has all but conceded that he lacks standing to pursue declaratory relief. Nonetheless, even if Malik had presented arguments related to both injury and redressability, we would still conclude that he lacks standing to request the declaratory relief that he seeks. Malik begins by arguing that “[t]he government’s possession of the confidential information is [a] continuing harm to [him] and to his clients.” But Malik does not explain the nature of this harm, nor how a declaration could redress it. Instead, he cites Harbor Healthcare Systems, L.P. v. United States for the idea that “[a party] remains injured as long as the government retains [that party's] privileged documents.”[21] Even if the privileged documents that the phone contains belong to Malik rather than to his clients, the injury Malik identifies “can only be made whole by the government returning and destroying its copies of the privileged material.”[22] Declaratory relief would not require the government to destroy the data it seized. Instead, declaratory relief would help Malik and his clients only if the government later attempted to introduce the extracted data as evidence at a trial, and if the opposing party moved to suppress that evidence. Those are big “ifs.” Harbor Healthcare did not involve declaratory relief at all, but rather “a pre-indictment motion for return of property.”[23] So—even conceding for argument’s sake that DHS’s mere possession of the extracted data injures Malik—declaratory relief would not remedy that injury. That means that this purported injury is not redressable, and that Malik cannot rely on it to show standing (even if he had not forfeited this issue). Malik fares no better in his attempts to establish alternative injuries. For example, he says that the state bar might discipline him “because of the government’s search, examination, and retention of his files.” But a declaration would not undo the search, and it would not require DHS to surrender or delete the extracted data. Malik also speculates that he is “exposed” to tort claims that his clients may bring against him for “breach of fiduciary duty.” But he does not point to any pending or threatened claim, and he does not explain how the mere “exposure” is itself an injury (redressable or otherwise). Likewise, Malik never explains how DHS’s internal directive injures him, nor how an order vacating or enjoining that directive would redress any harm that he claims to face. The other injuries that he asserts are even more speculative and even less redressable. None of them comes close to establishing standing. [24] Finally, Malik argues that “[t]he public interest supports a finding of prudential standing here.” Whatever else it may be, prudential standing is no substitute for constitutional standing. Rather, “prudential standing” is a “misleading” term that is most often relevant when the question is “whether, using traditional principles of statutory interpretation, the party ‘has a cause of action under the statute.’”[25] That question is not at issue. Malik also nests mootness and ripeness within his “prudential standing” argument, but those doctrines cannot create a redressable injury even if they do sometimes show that injury is absent. Malik has forfeited any argument that his purported injuries are redressable, and even if he had presented such an argument, it would fail. Therefore, he cannot establish standing to seek declarations related to whether DHS unlawfully seized his phone, and the district court thus correctly dismissed Malik’s Counts 1–8. B The district court also correctly concluded that DHS “did not violate . . . Malik’s constitutional rights when it searched” his phone.[26] 1 Count 12 of Malik’s complaint asks for an injunction requiring DHS to “[s]ecurely destroy all copies of digital information that [DHS] obtained from the [phone]” and to “ inform [Malik] of the manner of the destruction.” DHS argues that Malik lacks standing to request such an injunction. But the district court disagreed, and so do we.[27] “[P]laintiffs seeking injunctive . . . relief can satisfy the redressability requirement only by demonstrating a continuing injury or threatened future injury.”[28] DHS’s ongoing possession of Malik’s data plausibly constitutes an ongoing injury. At minimum, he has plausibly alleged that the phone contains work-product privileged materials. We have previously recognized the “privacy harm arising from the seizure and retention of specific attorney– client privileged documents.”[29] “In contrast to the attorney-client privilege, the work product privilege belongs to both the client and the attorney, either one of whom may assert it.”[30] Accordingly, we now recognize that an ongoing injury-in-fact exists so long as the government continues to retain an attorney’s specifically identified work-product privileged materials. In keeping with that injury, the district court treated Malik’s Count 12 as a request for “expungement.”[31] “[C]ourts have used expungement as a remedy for other constitutional or statutorily-created rights that have been violated by a state or other governmental agency.”[32] An order of expungement would redress the injury that Malik has identified. In the district court, DHS argued that “the information is being retained only because Malik requested a litigation hold,” and that Malik cannot not rely on this self-inflicted injury to show standing. And, on appeal, DHS has represented that it will “destroy the remaining data in its possession and will be happy to provide an appropriate certification to Malik that all data in the government’s possession has been destroyed and that no data was transferred to any other governmental or nongovernmental entity or person” as soon as these “proceedings” conclude. DHS made similar representations to the district court. In other words, DHS argues that this lawsuit is the only obstacle separating Malik from the expungement that he seeks. We do not agree that Malik’s injury is self-inflicted. The injury is that DHS still possesses privileged information that it unlawfully seized from his phone. Malik did not volunteer that data to DHS, and he has no control over how DHS handles it. That is why Malik came to court. DHS argues that it will delete the data if Malik non-suits this case. But while the possibility of an alternate form of relief confirms that Malik has suffered an injury, it does not mean that he caused the injury. That is especially true here, where Malik lacks any power to redress his injury. Instead, the most he can do is non-suit this case and trust DHS to delete the data. Where redress cannot be self-actuated, we are hesitant to conclude that an injury is self-inflicted. We also do not agree that DHS can moot Malik’s suit merely by promising to delete the data once the suit is over. By its very nature, a promise of some future action cannot redress Malik’s injury now. DHS’s promise, then, supports no more than a prediction that this case could be moot in the future. But it is not presently moot. Rather, DHS still has Malik’s data. Just as we will not rely on “conjectural or hypothetical” facts to find that standing is present, so too we will not rely on predictions and what-ifs to find that standing is absent.[33] We hold that Malik has standing to seek expungement. 2 Turning to the merits, we do not agree that Malik is entitled to expungement. The Fourth Amendment protects each individual’s “right . . . to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.”[34] “Although the Fourth Amendment applies at the border, its protections are severely diminished.”[35] That is because “an individual’s privacy expectations are lessened by the tradition of inspection procedures at the border.”[36] Those “inspection[s]” fall into two categories: routine and nonroutine.[37] Routine searches do not require “individualized suspicion or probable cause.”[38] On the other hand, “‘nonroutine’ searches need only reasonable suspicion, not the higher threshold of probable cause.”[39] DHS “flagged” Malik because his surname appeared in connection with an investigation involving an international arms dealer. That apparent connection gave DHS reasonable suspicion for the search, even if hindsight suggests that any actual connection was illusory. On appeal, Malik argues that DHS’s search and seizure of his phone was unlawful in three ways. We disagree on each front. First, Malik argues that DHS lacked statutory authority to search his phone. He argues that the search was unlawful because “Congress authorizes border searches only in accordance with federal regulations” and “[n]o statute or regulation addresses forensic examinations of electronic devices.” We disagree. Congress has authorized the Secretary of the Treasury to “prescribe regulations for the search of persons and baggage and . . . to employ . . . inspectors for the examination and search of persons.”[40] Congress has also determined that “all persons coming into the United States from foreign countries shall be liable to detention and search . . . under such regulations.”[41] Those regulations, in turn, provide that “[a]ll persons, baggage, and merchandise arriving in the Customs territory of the United States from places outside thereof are liable to inspection and search.”[42] “Congress, since the beginning of our Government, has granted the Executive plenary authority to conduct routine searches and seizures at the border, without probable cause or a warrant, in order to regulate the collection of duties and to prevent the introduction of contraband into this country.”[43] DHS found the cell phone on Malik’s “person” because it was part of the “baggage” that he was carrying with him into the United States. The search easily falls within the “plenary authority” that Congress has granted to the Executive branch.[44] Malik’s statutory argument therefore fails. Second, Malik argues that DHS lacked “reasonable suspicion” for the search. DHS responds that the search was “routine” or “basic” such that reasonable suspicion was not required. We recently held that “no reasonable suspicion is necessary to conduct [a] routine manual cell phone search at the border.”[45] Here, however, we need not decide whether the search was routine versus non-routine. That is because reasonable suspicion was present. Reasonable suspicion requires only a “minimal level of objective justification that consists of more than inchoate or unparticularized suspicion or hunch.”[46] DHS met that “low threshold” here.[47] As the district court held, the apparent connection between Malik and “an international arms dealer with known ties to the Dallas area” was plenty to create reasonable suspicion—even if Malik is correct that the connection appears dubious in hindsight.[48] We thus reject Malik’s second argument. Third, Malik argues that we should extend Riley v. California to border searches.[49] Yet, for “[routine] cell phone searches at the border, our sister circuits have uniformly held that Riley does not require either a warrant or reasonable suspicion.”[50] We have held the same.[51] Even for non-routine searches, our sister circuit “have differed only as to whether reasonable suspicion is required.”[52] We are not aware of any circuit court that has extended Riley‘s warrant requirement to the border. “Ordinarily, we would expect a party encouraging us to adopt a new constitutional [theory] to convincingly distinguish adverse authorities” and “to discuss the contours of the doctrine [he] wishes us to adopt.[53] Malik has not done any of that. He has not even attempted to argue that the search was anything other than routine. He also has not discussed or analyzed Riley at any length, nor has he addressed the fact that “[e]very circuit that has faced this question has agreed that Riley does not mandate a warrant requirement for border searches of electronic devices, whether basic or advanced.”[54] Instead, Malik has asked us to “intervene” and hold “that a judicial warrant is required at this time for the search of an attorney’s confidential client files and communications at the border.” Malik’s request for our “intervention” is itself a tacit concession that our precedent does not currently require a warrant for cell-phone searches at the border. We express no view on how the border-search exception may develop or be clarified in future cases, but we do expressly decline to address it further here.[55] C The district court did not abuse its discretion by refusing to reopen discovery to allow Malik to question DHS about the allegations that appear in the Wyden letter. That is because Malik never identifies how the letter relates to this case. The letter does not address searches, seizure, extraction, or retention of records from phones, nor even border searches of individuals. Instead, it alleges that DHS conducted “bulk surveillance of Americans’ financial records,” in large part by collecting swaths of “transaction data” from Western Union. None of that relates to the issues in this case—whether standing or the merits. Malik’s exhibits on appeal include a second letter from Senator Wyden. The senator issued that letter about a month after Malik filed his notice of appeal in this case. As relevant here, the second letter alleges that DHS searches phones at the border thousands of times per year, and that this data “is saved and searchable for 15 years by thousands of [DHS] employees, with minimal protections against abuse.” Citing the second letter, Malik argues that “this matter should be remanded to the District Court . . . for further discovery.” The proper procedure for addressing such “newly discovered evidence” would be for Malik to “file[] a Rule 60(b)(2) motion to set aside the judgment in the district court” and to “seek[] an indicative ruling pursuant to Rule 62.1.”[56] Malik has not taken that step. Even if he had, we do not see how the second letter adds anything to the arguments that Malik has already presented. The district court did not abuse its discretion by declining to reopen discovery. D Finally, we do not agree with Malik that the district court’s opinion is so unreasoned as to be unreviewable. He argues that the district court “failed to explain what reasonable suspicion standard it applied.” But the district court said that the standard was a “low threshold,” and that DHS satisfied the standard when it identified a potential link between Malik and an “international arms dealer.”[57] Malik also says that the district court “failed to address the two-hours of confidential information automatically download to the [phone] after its seizure and warrantless examination,” and that the filter team was “biased.” But the district court held that Malik did not have standing to pursue these claims. Malik’s arguments on this theme have no merit. IV The district court’s judgment is AFFIRMED.
