The Fourth Circuit Remands Wikimedia’s Suit Against the NSA Back to District Court – Lawfare (blog)
In March of 2015, the Wikimedia foundation joined together with eight other non-profits in a challenge to NSAs mass surveillance program. This week, the U.S. Court of Appeals for the Fourth Circuit permitted the suit to move forward, but in the process, peeled off all plaintiffs other than Wikimedia itself.
The case comes to the Fourth Circuit as an appeal from the the U.S. District Court of Maryland. In October 2015, the District Court dismissed the case for lack of standing, basing its decision on Supreme Courts 2013 ruling in Clapper v. Amnesty International USA. In Clapper, the Court upheld the dismissal of a similar challenge from human rights groups because their complaint was speculative, alleging only a reasonable likelihood that their communications would be intercepted, not actual or imminent injury. Lacking concrete information about government programs, the Clapper plaintiffs failed to properly plead an injury in fact, and so lacked Article III standing. The same logic, held Judge Ellis of the Maryland District Court, should apply to Wikimedias challenge. This week, however, the Fourth Circuit rejected this comparison. Unlike Clapper, the court explained, the injuries alleged by the plaintiffs in this case are not speculative, but current, actual, and based on particularized allegations.
But the Fourth Circuit didnt stop there and just vacate the entirety of Judge Ellis judgement. Instead, it distinguished between Wikimedias claim of injury and those of the other plaintiffs: Because Wikimedias claim of injury by NSAs Upstream collection is based on particularized facts and sound inferences--construed in the light most favorable to Wikimedia for the purpose of the motion--it survives a motion to dismiss. By contrast, because the other plaintiffs allegation of injury (based on the allegation that NSA is intercepting, copying, and reviewing substantially all textbased communications entering and leaving the United States, including their own) is unsupported by enough well-pleaded facts, the District Courts dismissal was proper.
Below, we first summarize the Fourth Circuits reasoning with respect to Wikimedia, and then turn to its analysis of the other eight plaintiffs claim of injury.
The Wikimedia Allegation: Not Speculative,and Well-pleaded
The factual assertions in the Wikimedia Allegation are based on a combination of public information about the operation of Section 702, PCLOB reports about what NSA is doing, as well as technical analysis how NSA must be accomplishing what PCLOB reports.
Under Section 702 of the Foreign Intelligence Surveillance Act, the government is permitted to target for surveillance non-US persons reasonably believe to be outside the United States. The procedures for making such determinations are reviewed and approved by the FISC. According to the plaintiffs, NSA conducts this surveillance by installing surveillance devices on at least some of the 49 international submarine cables that carry communication in and out of the United States which comprise the internet backbone. NSA, the plaintiffs suggest, lacks the technical capability to sift the communication prior to collection. It therefore must collect and copy substantially all international text-based communicationsand many domestic ones as they flow across this backbone in the United States. Only after this initial collection, can NSA attempt[] to filter out and discard some wholly domestic communications, and then review and retain only those copied communications for that contain targeted selectors (such as specific IP or email addresses).
The essence of the Wikimedia allegation is that because of the technical realities of this Upstream collection, and because of the sheer volume of Wikimedias communications, the NSA has almost certainly collected at least some of the organizations communications. Wikimedia reasons that because Upstream surveillance requires the NSA to copy even wholly domestic communications before filtering them out and discarding them, and because Wikimedia engages in more than one trillion international communications each year, with individuals who are located in virtually every country on earth, the NSA must necessarily be intercepting, copying, and reviewing some of Wikimedias communications.
Declassified documents show that a single service provider facilitates upstream surveillance at seven major international chokepoints in the United States. But given the quantity of its communication, even if the NSA is only collecting communication from a single Internet backbone link, Wikimedia asserts its communications must have been intercepted. Thus, Wikimedias acute privacy interest in its communications, are implicated by NSA programs.
The Fourth Circuit largely accepted Wikimedias arguments for the purpose of the motion. In order to establish Article III standing, a plaintiff must show an injury in fact. And in order to survive a motion to dismiss, a complaint must have sufficient factual matter in the complaint, such that the contents were accepted as true, it would state a claim of relief that is plausible on its face. Following the Third Circuits decision in Schuchardt v. President of the United States, the Fourth Circuit analyzed plaintiffs claims in two steps: first, it analyzed whether the allegations were sufficiently particularized to satisfy the injury-in-fact requirement and second, it analyzed whether the allegations contain sufficient detail to be credited as true for the purpose of resolving a facial challenge to a complaint. Wikimedias claims, ruled the Court, met both criteria.
The court lays out what it sees as three presumptively key facts from Wikimedias allegation:
Taken together, these three points indicate that Wikimedia has plausibly alleged that its communications travel all of the roads that a communication can take, and that the NSA seizes all the communications along at least one of those roads, and therefore may have violated Wikimedias Fourth Amendment rights. Its allegations are thus predicated on specific asserted facts and directly implicate the potential interests of Wikimedia in a concrete and particularized manner.
Unlike the speculation and guesswork of Clapper, Wikimedias combination of technical assertions and government documents amounted to a properly pleaded complaint. And unlike Clapper, the Wikimedia case concerns a motion to dismiss rather than a motion for summary judgment, dictating greater deference to complainant's account of facts.
While acknowledging that Wikimedias probability calculation (even if one assumes a 0.00000001% chance . . . of the NSA copying and reviewing any particular communication, the odds of the government copying and reviewing one of Wikimedias communication in a one year period would be greater than 99.999999999%), was incomplete and riddled with assumptions, the court concluded that it wasnt relevant for standing purposes. Importantly, given the motion to dismiss stage, the court also declined to consider the governments evidence (in the form of expert affidavits) disputing plaintiffs technical statements about NSA must operate. Without the opportunity to dispute the factual basis of the expert dispute, the government had little leg to stand on.
The Dragnet Allegation: Speculative, and Not Well-Pleaded
The other eight plaintiffs joined with Wikimedia in making the second allegation, which the court terms the Dragnet Allegation. The plaintiffs alleged that in the course of conducting Upstream surveillance the NSA is intercepting, copying, and reviewing substantially all text-based communications entering and leaving the United States, including their own. The core of the allegation is the assertion that due to the technical functionality of the internet, the NSA must be intercepting, copying, and reviewing information from most backbone chokepoints in order to engage effectively in Upstream collection. And if NSA is surveilling most backbone chokepoints, then it is likely that the plaintiffs communications have been examined. The plaintiffs allege that they have had to take burdensome and sometimes costly measures to protect themselves from this surveillance.
As with the Wikimedia Allegation, the district court dismissed the Dragnet Allegation under Clapper. The circuit court affirmed the dismissal, but on a different rationale, departing from the district courts reliance on Clapper for the reasons expressed above.
While the court writes that its analysis of standing for the Wikimedia Allegation applies also to the Dragnet Allegation as far as the presence of a particularized and cognizable ongoing injury, traceability, and redressability go (hence why Clapper is not controlling), it ultimately finds that the plaintiffs lack standing due to their failure to plausibly state a claim. The court considers the Wikimedia Allegation plausible, but the broader claims made in the Dragnet Allegation are harder for it to swallow:
In the Dragnet Allegation, Plaintiffs must plausibly establish that the NSA is intercepting substantially all text-based communications entering and leaving the United States, whereas its sufficient for purposes of the Wikimedia Allegation to show that the NSA is conducting Upstream surveillance on a single backbone link.
The plaintiffs pointed to the same evidence for the Dragnet Allegation as they do for the Wikimedia Allegation, with the addition of one New York Times article on Upstream surveillance: in other words, the mechanical details of how the internet functions and the NSAs stated goals of using Upstream collection to acquire information to, from, and about targets. But in the Wikimedia Allegation, the plaintiffs used that information to speculate about the way the NSA does what we know it to be doing (that is, engaging in Upstream collection). In contrast, in the Dragnet Allegation, the plaintiffs are using technical information and guesswork about NSAs incentives to speculate about the scope of NSA activities. Furthermore, the allegations fall short of the level of detail in Schuchardt, in which the Third Circuit found that the plaintiffs had demonstrated the sheer scale of the collection suggested a dragnet
This is a bridge too far for the court, which finds this claim implausible and therefore holds that the plaintiffs lack standing on Fourth Amendment grounds. Following this logic, the court also dismisses the plaintiffs First Amendment claims of chilled speech and their effort to establish standing on the grounds of their burdensome efforts to avoid surveillance, finding that in the absence of a plausible claim, these concerns constitute fears of hypothetical future harm such as are inadequate to provide standing under Clapper.
The plaintiffs creatively cite Fourth Circuit precedent in the form of a two-year-old antitrust case, SD3, LLC v. Black & Decker, as evidence that motive is an important factor in establishing standingpointing to NSAs alleged incentive to establish a dragnet. The court dismisses this assertion, saying that while it should come as not surprise that motive is an important factor in establishing an antitrust conspiracy, that the court had never intended to have the case stand for the broad proposition that motivation is always of special significance in plausibly pleading an injury. The court also distinguishes SD3 based on the level of detail provided by the plaintiffs on the existence of the boycott, which the court concludes were by and large absent, from the plaintiffs complaint here.
The court concludes by addressing Judge Andre Daviss dissent in part, specifically his assertion that the court need not have separately considered the non-Wikimedia plaintiffs standing. Given that the complaint rests upon the premise that the NSA is seizing each Plaintiffs unique communications, the questions of standing and relief for the Wikimedia and non-Wikimedia plaintiffs are also individualized and must be considered separately.
Judge Andre Daviss Dissent-in-Part
Judge Davis, while concurring with courts finding that Clapper is not controlling and that Wikimedia has standing, dissented on the grounds that the non-Wikimedia plaintiffs do as well.
Davis explains that while he agrees with the majoritys decision to accept as plausible Wikimedias factual allegation, he disagrees with the majoritys assertion that the other plaintiffs have not plausibly alleged in the Dragnet Allegation that the NSA is surveilling most backbone links. He gives greater credence to the plaintiffs citation of the New York Times report to bolster their allegation, which the majority dismissed as essentially a restatement of the original allegation. More importantly, he argues that because of the technical functionality of the internet to which the plaintiffs point, NSA cannot know which link the communications it targets will traverse when they enter or leave the United States, and therefore the only way it can comprehensively acquire its targets communications is by surveilling virtually every backbone link. In his view, this allegation is a logical extension of the Wikimedia Allegation, and is therefore plausible as well.
In a footnote, Davis also criticizes the majoritys decision to assess the standing of the non-Wikimedia plaintiffs separate from that of Wikimedia. Quoting the Supreme Courts decision in Horne v. Flores, he argues that in all standing inquiries, the critical question is whether at least one petitioner has alleged such a personal stake in the outcome of the controversy as to warrant his invocation of federal-court jurisdiction.
See more here:
The Fourth Circuit Remands Wikimedia's Suit Against the NSA Back to District Court - Lawfare (blog)
- CISA, NSA, and Partners Issue Annual Report on Top Exploited Vulnerabilities - HSToday - December 5th, 2024 [December 5th, 2024]
- Where Will The Top Amateurs at NSA Yamaha Land After the Team Closes? - Vurbmoto - December 5th, 2024 [December 5th, 2024]
- CISA, NSA, FBI and International Partners Publish Guide for Protecting Communications Infrastructure - HSToday - December 5th, 2024 [December 5th, 2024]
- Main players backing Syrian government have been weakened by other conflicts, NSA Sullivan says - NBC News - December 5th, 2024 [December 5th, 2024]
- Trump's incoming NSA Mike Waltz wants US to dance cheek-to-check with India - The Times of India - November 14th, 2024 [November 14th, 2024]
- What Trump's NSA Nominee Said On India's Pivotal Role In The 21st Century - NDTV - November 14th, 2024 [November 14th, 2024]
- Exclusive: Nakasone on exploding pagers, life after the NSA and another possible government job - The Record from Recorded Future News - November 14th, 2024 [November 14th, 2024]
- FBI, CISA, and NSA reveal most exploited vulnerabilities of 2023 - BleepingComputer - November 14th, 2024 [November 14th, 2024]
- CISA, NSA, and Partners Issue Annual Report on Top Exploited Vulnerabilities - National Security Agency - November 14th, 2024 [November 14th, 2024]
- 6 Principles of Operational Technology Cybersecurity released by joint NSA initiative - Security Intelligence - November 14th, 2024 [November 14th, 2024]
- It's official FBI, CISA, and NSA reveal the most exploited vulnerabilities of 2023 - TechRadar - November 14th, 2024 [November 14th, 2024]
- Donald Trump picks Mike Waltz as US NSA: What it means for China and India - The Times of India - November 14th, 2024 [November 14th, 2024]
- Who is Mike Waltz, Donald Trump's new NSA pick? What are his ties to India Caucus? - Firstpost - November 14th, 2024 [November 14th, 2024]
- NSA should not oversee the management of national facilities RexDanquah - Citi Sports Online - November 14th, 2024 [November 14th, 2024]
- Trudeaus NSA admits to leaking secret intel alleging Indias interference to Washington Post - Firstpost - October 31st, 2024 [October 31st, 2024]
- White House dials NSA Ajit Doval: Here's what happened in the call - The Economic Times - October 31st, 2024 [October 31st, 2024]
- NSA Doval Stresses Need For Stable Indo-Pacific In Phone Call With US Counterpart Sullivan - News18 - October 31st, 2024 [October 31st, 2024]
- Director-General of NSA calls for continued support from government - GhanaWeb - October 21st, 2024 [October 21st, 2024]
- 5G Non Standalone Nsa Architecture Market to Reach USD 240.0 - openPR - October 21st, 2024 [October 21st, 2024]
- NSA meets with Minister Muir and DAERA to discuss industry concerns - Meat Management - October 21st, 2024 [October 21st, 2024]
- NSA cyber chief: Espionage is now Russias focus for cyberattacks on Ukraine - The Record from Recorded Future News - October 11th, 2024 [October 11th, 2024]
- NSA Investigating If Chinese Hackers Breached US Telecoms - Yahoo Finance - October 11th, 2024 [October 11th, 2024]
- NSA Issues Updated Guidance on Russian SVR Cyber Operations - National Security Agency - October 11th, 2024 [October 11th, 2024]
- News - Honoring the Stars and Stripes: NSA Philadelphia Hosts Dignified Flag Disposal Ceremony - DVIDS - October 11th, 2024 [October 11th, 2024]
- NSA's Program for Nursing Mothers in the Workplace Considered a Model for USG - National Security Agency - October 11th, 2024 [October 11th, 2024]
- NSA investigating hack of three major telecommunications companies - Baltimore Sun - October 11th, 2024 [October 11th, 2024]
- Honoring the Stars and Stripes: NSA Philadelphia Hosts Dignified Flag Disposal Ceremony [Image 8 of 8] - DVIDS - October 11th, 2024 [October 11th, 2024]
- NSA Hiring Over a Thousand in the Next Year - ClearanceJobs - October 4th, 2024 [October 4th, 2024]
- What Its Really Like to Work at NSA - National Security Agency - October 4th, 2024 [October 4th, 2024]
- US Elections: Former NSA John Bolton Claims Both Harris And Trump Do Not Qualify To Be President | NewsX Exclusive - NewsX - October 4th, 2024 [October 4th, 2024]
- Honoring the fallen: Bells toll for Americas heroes at NSA Mechanicsburg - American Military News - October 4th, 2024 [October 4th, 2024]
- How often should you turn off your phone? Heres what the NSA says - PCWorld - October 4th, 2024 [October 4th, 2024]
- NSA and Allies Issue Advisory about PRC-Linked Actors and Botnet Operations - HSToday - September 28th, 2024 [September 28th, 2024]
- NSA warns that Active Directory is an "exceptionally large and difficult to defend" attack surface - The Stack - September 28th, 2024 [September 28th, 2024]
- News - Honoring the Fallen: Bells Toll for Americas Heroes at NSA Mechanicsburg - DVIDS - September 28th, 2024 [September 28th, 2024]
- National Storage Affiliates Trust (NYSE:NSA) Given Average Recommendation of "Reduce" by Brokerages - MarketBeat - September 28th, 2024 [September 28th, 2024]
- Lack of Standard Stadiums: NSA boss sacked, facilities closed - What has been said and done so far - GhanaWeb - September 21st, 2024 [September 21st, 2024]
- NSA and Allies Issue Advisory about PRC-Linked Actors and Botnet Operations - National Security Agency - September 21st, 2024 [September 21st, 2024]
- UTEP Establishes Collaboration with DoD, NSA to Help Enhance U.S. Semiconductor Workforce - The University of Texas at El Paso - September 21st, 2024 [September 21st, 2024]
- The NSA advises you to turn off your phone once a week - here's why - ZDNet - September 21st, 2024 [September 21st, 2024]
- NSA Publishes Cyber Advisory on China-Linked Threat Actors - Executive Gov - September 21st, 2024 [September 21st, 2024]
- Former NSA Director Nakasone opens new institute at Vanderbilt to train right type of leader - Washington Times - September 21st, 2024 [September 21st, 2024]
- ACR lauds legislation that would fine insurers for delayed NSA payments - AuntMinnie - September 16th, 2024 [September 16th, 2024]
- NSA threatens lawsuit over election rigging allegation, demands apology - Pulse Nigeria - September 16th, 2024 [September 16th, 2024]
- NSA explains its work with private sector on election security and fighting foreign cyber threats - Washington Times - September 16th, 2024 [September 16th, 2024]
- NSA to debut podcast to boost public awareness of classified missions - Nextgov/FCW - August 31st, 2024 [August 31st, 2024]
- In Beijing, Bidens NSA Calls Out Chinas Destablising Actions, Openly Supports Philippines - Hindustan Times - August 31st, 2024 [August 31st, 2024]
- Why the NSA advises you to turn off your phone once a week - ZDNet - August 31st, 2024 [August 31st, 2024]
- Getting into rhythm: NSA places high expectations on themselves for 2024 - Suffolk News-Herald - August 31st, 2024 [August 31st, 2024]
- NSA readying podcast to share untold stories of codebreakers missions - Washington Times - August 31st, 2024 [August 31st, 2024]
- Trump govt stopped aid to Pakistan over ISI's 'undeniable complicity' with terrorists: Ex-US NSA - Hindustan Times - August 31st, 2024 [August 31st, 2024]
- Top NSA researcher tapped to lead Pentagons UAP investigation hub - DefenseScoop - August 27th, 2024 [August 27th, 2024]
- NSA Releases Guide to Combat Living Off the Land Attacks - Infosecurity Magazine - August 27th, 2024 [August 27th, 2024]
- With a little help from the National Archives, NSA finally releases Grace Hopper lecture. Watch it here. - MuckRock - August 27th, 2024 [August 27th, 2024]
- Trump administration NSA H.R. McMaster says there was "inconsistency" in foreign policy - CBS News - August 25th, 2024 [August 25th, 2024]
- 'Putin exploited Trump's ego and insecurities': Former NSA in new book - The Times of India - August 25th, 2024 [August 25th, 2024]
- NSA calls for urgent Government action on illegal sheep imports - Meat Management - August 14th, 2024 [August 14th, 2024]
- Sheikh Hasina Resignation LIVE Updates: Ex Bangladesh PM Sheikh Hasina Meets NSA Ajit Doval At Hindon Airbase - NDTV - August 5th, 2024 [August 5th, 2024]
- NSA Claims It Cant Watch an Important Tape It Recorded in the 1980s - Gizmodo - July 17th, 2024 [July 17th, 2024]
- Letter to NSA Sullivan Requesting Assessment of Information Russia Has Shared with the PRC on U.S. Weapons Capabilities in Ukraine - Select Committee... - July 17th, 2024 [July 17th, 2024]
- The NSA Is Defeated By A 1950s Tape Recorder. Can You Help Them? - Hackaday - July 17th, 2024 [July 17th, 2024]
- Letter to NSA on Microsoft's Billion Dollar Partnership with UAE Firm G42 - Select Committee on the CCP | - July 17th, 2024 [July 17th, 2024]
- NSA Fast Pitch World Series kicks off with Skills Competition & Heavy Hitters Camp, featuring College World Series Champions from the University... - July 17th, 2024 [July 17th, 2024]
- NSA contractor bilked government for hundreds of hours she never worked - Washington Times - July 6th, 2024 [July 6th, 2024]
- Signals intelligence has become a cyber-activity - The Economist - July 6th, 2024 [July 6th, 2024]
- OpenAI adds former NSA chief to its board - CNBC - June 15th, 2024 [June 15th, 2024]
- Former head of NSA joins OpenAI board - The Verge - June 15th, 2024 [June 15th, 2024]
- Former NSA Head Joins OpenAI Board and Safety Committee - RetailWire - June 15th, 2024 [June 15th, 2024]
- Former NSA head joins OpenAI board and safety committee - TechCrunch - June 15th, 2024 [June 15th, 2024]
- OpenAI Appoints Cybersecurity Expert And Retired US Army Genera With NSA Pedigree To Board, Enhancing AI ... - Benzinga - June 15th, 2024 [June 15th, 2024]
- Former NSA head Paul Nakasone to helm national security institute at Vanderbilt - The Record from Recorded Future News - May 15th, 2024 [May 15th, 2024]
- US is still chasing down pieces of Chinese hacking operation, NSA official says - The Record from Recorded Future News - March 18th, 2024 [March 18th, 2024]
- 6 CISO Takeaways from the NSA's Zero-Trust Guidance - Dark Reading - March 18th, 2024 [March 18th, 2024]
- St. John's M.S. in Cyber and Information Security Earns Key NSA Validation - St John's University News - March 18th, 2024 [March 18th, 2024]
- Senate votes to confirm Lt. Gen. Timothy Haugh to lead CYBERCOM and NSA/CSS - United States Cyber Command - December 23rd, 2023 [December 23rd, 2023]
- NSA Highlights AI, Partnerships in 2023 Cyber Review - MeriTalk - December 23rd, 2023 [December 23rd, 2023]
- NSA Publishes 2023 Cybersecurity Year in Review - National Security Agency - December 23rd, 2023 [December 23rd, 2023]
- Senate votes to confirm Lt. Gen. Timothy Haugh to lead CYBERCOM and NSA/CSS - National Security Agency - December 23rd, 2023 [December 23rd, 2023]
- NSA Reiterates Achievements in AI & Defense Against Russia, China in 2023 Cybersecurity Review - Executive Gov - December 23rd, 2023 [December 23rd, 2023]
- NSA appoints new Cyber Command head | SC Media - SC Media - December 23rd, 2023 [December 23rd, 2023]