Appeals Court Revives Wikimedia's Lawsuit Against The NSA

from the doesn't-'collect-it-all'-mean-'collect-it-all?' dept

Back in 2015, Wikimedia's lawsuit against the NSA -- filed with several other plaintiffs and with the help of the ACLU -- was tossed out by the district court. Wikimedia argued it was illegally the subject of NSA upstream surveillance, thanks to the nature of this Section 702 collection. Wikimedia's reach is global, making it highly likely the NSA was gathering its content and communications while snagging data off internet backbones.

To further demonstrate the probability of this happening, Wikipedia submitted leaked Snowden documents, including an NSA presentation slide that contained Wikimedia's logo.

No dice. The district court said Wikimedia had no standing to pursue these claims, even with the unexpected buttress of leaked NSA documents. The court went even further, disabusing Wikipedia of its "99.9999999999% certainty" notion that the NSA had illegally harvested at least one of its trillions of internet transactions. In all, it was a very ugly day for Wikimedia and its lawsuit.

Fortunately, for Wikimedia, its lawsuit has been revived on appeal. The Fourth Circuit Appeals Court is far more amenable to Wikimedia's claims, finding them to be more credible than the lower court determined. From the opinion [PDF]:

[A]t least at this stage of the litigation, Wikimedia has standing to sue for a violation of the Fourth Amendment. And, because Wikimedia has self-censored its speech and sometimes forgone electronic communications in response to Upstream surveillance, it also has standing to sue for a violation of the First Amendment.

The court doesn't necessarily treat all of Wikimedia's allegations as true, but finds it has handed over enough background evidence to give it standing to pursue its First and Fourth Amendment claims.

But this revival is limited to Wikimedia and only some of its claims. The seven other plaintiffs aren't invited to the next district court round. A lack of produced evidence appears to have killed off the "dragnet" claims raised by the plaintiffs (which includes Wikimedia). The other defendants have a much smaller web footprint, making it less plausible their communications were subjected to upstream collection by the NSA. The only way those claims would be plausible is if the court found the "dragnet" assertions plausible… which it doesn't.

The Dragnet and Wikimedia Allegations share much in common. Because each alleges the same particularized and ongoing cognizable injuries, our analysis of the injury-in-fact, traceability, and redressability elements of Article III standing with respect to the Wikimedia Allegation also applies here. But there’s a key difference in the scope of the two allegations. In the Dragnet Allegation, Plaintiffs must plausibly establish that the NSA is intercepting “substantially all” text-based communications entering and leaving the United States, whereas it’s sufficient for purposes of the Wikimedia Allegation to show that the NSA is conducting Upstream surveillance on a single backbone link. Because Plaintiffs don’t assert enough facts about Upstream’s operational scope to plausibly allege a dragnet, they have no Article III standing.

The difference between the two claims is one of numbers. Wikimedia only had to show its traffic traveled across enough internet backbones to plausibly claim harvesting from any one of them would result in interception of its communications. The "dragnet" argument claims the NSA is harvesting almost everything that travels across multiple backbones. The majority finds this assertion unlikely. The dissent, however, says the same arguments Wikimedia put forth to demonstrate the probability of illegally-intercepted communications lend credence to the "dragnet" argument simply because that's how internet traffic works.

Plaintiffs have plausibly alleged that the NSA surveils most backbone links because — based on the technical rules governing internet communications — the agency cannot know which link the communications it targets will traverse when they enter or leave the United States. The path that packets take along the internet backbone is determined dynamically based on unpredictable conditions. Thus, a communication sent by a surveillance target can enter the United States through one backbone link, but an immediate response returned to the surveillance target can traverse a different backbone link. Similarly, communications sent by a surveillance target at different times or locations can traverse different backbone links. Given this technical limitation, the government’s disclosure that the NSA seeks to “comprehensively acquire communications that are sent to or from its targets,” J.A. 49, renders Plaintiffs’ allegation plausible. If the NSA cannot know which backbone link its targets’ internet communications will traverse, then the only way it can comprehensively acquire its targets’ communications is by surveilling virtually every backbone link.

It's a good point but it's not enough to save the rest of the plaintiffs, which include the National Association of Criminal Defense Lawyers, Human Rights Watch, and Amnesty International. Perhaps a further examination of Wikimedia's arguments by the lower court will aid these plaintiffs in their future legal endeavors.

Filed Under: 4th circuit, nsa, section 702, standing, surveillance, upstream collection
Companies: wikimedia

Court Tosses Company's Bid To Slap Down Olympics Social Media Restrictions Over Jurisdictional Issues

from the get-sued-first,-i-guess? dept

By now everyone should know that the IOC and USOC have completely perverted the concept of trademark law surrounding any mentioning of the Olympic Games. It's gotten so bad that the USOC has taken to threatening businesses that tweet out congratulatory messages to athletes, even when those businesses supported those athletes getting to the Olympics in the first place. The USOC seems to be under the impression that tweeting about the Olympics as a business is trademark infringement. It's not. It never was.

Yet those social media guidelines put forward by the USOC still exist and, coupled with the USOC's appetite for legal threats and lawsuits, that's typically enough to keep companies from challenging it on the matter. But one carpet cleaning business in Minnesota actually sued the USOC over the social media policy and its violation of that and other companies' free speech rights. Sadly that company, Zereorez, has had that suit tossed by the court on jurisdictional grounds, with the court essentially telling the company to come back after it's been sued by the USOC.

Zerorez, based in St. Louis Park, filed suit shortly before the Summer Olympics hoping to clarify whether the USOC could prohibit it from cheering for Minnesota athletes on social media. The company said it wanted to tweet “Congrats to the 11 Minnesotans competing in 10 different sports at the Rio 2016 Olympics!” but could not for fear of a lawsuit by the USOC.

U.S. District Judge Wilhelmina Wright in Minneapolis dismissed the case April 4, ruling that, because the USOC never sued or even threatened to sue Zerorez, the court lacked subject-matter jurisdiction.

Considering this suit was seeking a declaratory judgment that text Zerorez wanted to tweet out, but was afraid to because of the USOC guidelines, was ok, this can be viewed from the outside as a punt by the court. The judge's order goes to great lengths to outline what satisfies the jurisdictional requirements for a declaratory judgment. To anyone familiar with the USOC's antics, Zerorez's suit appears to satisfy them. Where the court disagrees is on the matter of whether or not an actual controversy exists in this case, with that controversy requiring that Zerorez first plan on engaging in what could be viewed as infringing behavior, which its tweet does in the context of the USOC's guidelines, and secondly that Zerorez has reason to expect to be sued by the USOC. Zerorez's filing pointed to other cases in intellectual property law in which declaratory judgment jurisdiction was accepted if the defendant had a prior history of filing or threatening to file infringement suits.

Here the court flatly declines to accept that standard, instead suggesting that Zerorez go ahead and get itself sued by the USOC if it wants to then protect its free speech rights.

If news reports of USOC's letters to other companies warning that only official sponsors of Team USA are permitted to use USOC's trademarks on their corporate social media channels create an actual controversy between USOC and Zerorez, a company with which USOC never communicated before this lawsuit, then any company that is not an official sponsor of Team USA could bring a declaratory-judgement action against USOC by asserting the same facts. Such a conclusion would eviscerate the actual-controversy requirement.

Here you see the catch-22 that small businesses face in light of the chilling effects of the USOC's antics. The USOC gets to bully smaller entities less capable of defending themselves in court, but escapes the court when a company wants to get what is plainly free speech content declared legal and non-infringing. The choice left to companies via this ruling is: don't exercise your free speech rights, or go get sued first and then try to defend yourselves.

Which is beyond unfortunate and trends into being downright sad. If the USOC's guidelines bastardize trademark law, and they do, then that's the reason why so many companies would want to seek declaratory judgment that their free speech is kosher. The problem is the USOC, not the fact that Zerorez hasn't been sued yet.

Filed Under: declaratory judgment, free speech, olympics, social media, sponsorship, standing, trademark
Companies: usoc, zereorez

Ridiculously Stupid: 4 State Attorneys General File Totally Bogus Lawsuit Against Internet Transition

from the make-it-stop dept

Okay, this is really dumb. What is it about state attorneys general making totally bullshit claims? It seems to happen with fairly consistent frequency. The latest is that four state AGs (from Arizona, Texas, Oklahoma and Nevada) have filed a lawsuit to stop the IANA transition. If you don't recall, we've written about this a bunch. A bunch of people are up in arms over something they don't seem to understand. The IANA transition is a good thing. It's not the US government handing over the internet to Russia and China as you may have heard. It's the Commerce Department severing an almost entirely symbolic link between it and a very specific internet governance capability concerning top level domains. And it's important to complete the transition because other countries (including Russia and China) keep pointing to this symbolic link as a reason for why they should have more say in internet governance. Getting rid of the link keeps the internet functioning as it has for decades -- and takes away a weapon from Russia and China. More importantly, going back on the transition now actually gives even more ammo to Russia and China, allowing them to point to unilateral actions by the US gov't to block a process that everyone had agreed upon earlier.

Anyway, to the actual lawsuit. It's dumb. It's really dumb. If you live in Arizona, Texas, Oklahoma or Nevada, you should be embarrassed for your Attorneys General. Elect better ones next time, please. First of all, they have no standing whatsoever to file this lawsuit. The IANA/top level domain system is not those states' property. They have no claim here other than "HEY LOOK! POLITICAL FOOTBALL THAT WE CAN GRANDSTAND OVER!" That does not give them standing. The best they can come up with for claiming standing is... uh... "hey, we have some websites." No, really.

Plaintiffs operate multiple websites, including those that use the .gov and .com generic top level domains, to conduct their business and communicate with their citizens.

Yeah. That's not enough to get standing here, buckos. Also, in filing a lawsuit they don't allege any actual harms. That's kind of a big no no when filing a lawsuit. Instead, they sorta maybe kinda speculate that maybe possibly there could (sorta, maybe) be some (possible, maybe, not really) harm in the theoretical future. Maybe.

Second, the entire crux of the lawsuit is that the authoritative root zone file and the internet domain name system itself are somehow "property" of the federal government, and that this transition is, in effect, the giving away of government property without an act of Congress, violating the Property Clause of the Constitution. Except, as we just discussed recently, the Government Accountability Office studied this issue earlier this month and came to the conclusion that "nope, it's not property." In case you missed it then:

It is unlikely that either the authoritative root zone file—the public “address book” for the top level of the Internet domain name system—or the Internet domain name system as a whole, is U.S. Government property under Article IV. We did not identify any Government-held copyrights, patents, licenses, or other traditional intellectual property interests in either the root zone file or the domain name system. It also is doubtful that either would be considered property under common law principles, because no entity appears to have a right to their exclusive possession or use.

Others have walked through some of the other charges and find them all totally lacking. A judge is set to review this request for an injunction later today, and you never know how any individual judge might rule. So it's entirely possible that this will muck up the timing of the transition, but long term, this filing is not just a joke, but it's an embarrassment and a waste of taxpayer money in those four states.

Filed Under: arizona, congress, gao, iana, iana transition, internet governance, nevada, oklahoma, property, standing, texas
Companies: icann

ACLU Challenges Gag Orders Issued To Tech Companies By The DOJ

from the hey,-we-notified-SOMEBODY...-that-counts-for-something dept

The ACLU is hoping to intervene in Microsoft's legal battle against the government, challenging gag orders attached to warrants and subpoenas issued under the Electronic Communications Privacy Act (ECPA). Microsoft sued the DOJ back in April, arguing for the right to notify customers that their communications and data have been handed over to the government.

Microsoft didn't have a problem with the government's gag orders in every case. It's just that the demand for secrecy accompanied more than half of the ~300 orders per month Microsoft receives. And nearly 70% of those gag orders arrived with no fixed end date.

The ACLU petitioned the court to intervene in the case on its own behalf, citing its position as a Microsoft customer. The DOJ filed a motion to dismiss Microsoft's lawsuit, hoping the court will find Microsoft has no standing to challenge gag orders on its customers' behalf. The ACLU is trying to prevent this from happening until the DOJ addresses the issues raised by the ACLU's (attempted) intervention. In its opposition [PDF] to the DOJ's motion, the ACLU points out that the government's "no standing" argument pretty much nullifies any sort of due process for Microsoft customers (including the ACLU) who've been targeted by the DOJ's super-secret warrants, relegating them to a Kafka-esque legal purgatory.

The government attempts to insulate its refusal to provide notice from judicial review, arguing that neither Microsoft nor the ACLU has standing to raise these important constitutional questions. By the government’s logic, Microsoft does not ever have standing to defend its customers’ right to notice, and Microsoft’s customers, including the ACLU, may not defend their own right to notice until after they receive the primary relief they would seek—that is, notice. In the government’s view, the only plaintiffs who have standing to sue for notice are those who have already gotten it, and those deprived of notice forever have no ability to seek a remedy at all. That is not the law.

The hope here is to not only find the open-ended gag orders unconstitutional, but also the law granting this secrecy -- the ECPA -- unconstitutional as well. The shift from physical "papers" to digital files was addressed by legislators in the worst way possible. The ECPA did away with the notification requirement attached to searches of physical places. When a home or business is searched, the owner or resident is served with a warrant. For electronic communications, a third party is approached. Legislators apparently felt as long as someone was notified, that was good enough -- even if that someone isn't the target of the search warrant.

That's basically the government's argument: notice is served to the site of intrusion. If the affected parties don't actually reside there (but their "papers" do), too bad.

The government’s argument conflates a historical anachronism with a constitutional principle. The government is correct that officers traditionally provided Fourth Amendment notice at the physical site of the intrusion. But that is so because, for the first 175 years of the Fourth Amendment’s application, it was understood to cover primarily physical trespasses. See Katz, 389 U.S. at 353. As a result, notice provided at the site of the intrusion was notice to the individual whose Fourth Amendment rights were at stake. It is no surprise, therefore, that Federal Rule of Criminal Procedure 41 reflects that historical context. Under Rule 41(f), an officer executing a warrant must “give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken or leave a copy of the warrant and receipt at the place where the officer took the property.”

The ECPA is the DOJ's argument committed to paper. Notice only needs to be provided to the third party where communications and documents are held. To ensure the party whose documents/communications are being taken is kept out of the loop, the DOJ takes the wording of the law to heart and ignores the intent behind the Fourth Amendment protections granted to citizens.

The ECPA does not require the government to provide notice when it relies on a warrant, and so the government now routinely searches and seizes individuals’ electronic communications without providing any notice—delayed or otherwise—to those whose private information it has obtained. According to Microsoft’s Complaint, nearly half of the federal demands it has received under ECPA in the last eighteen months were accompanied by gag orders, the majority of which contained no time limit. Accordingly, a substantial portion of the individuals whose electronic communications the government demands from Microsoft receive no notice whatsoever, from either the government or Microsoft.

The law undercuts the Fourth Amendment by preventing those affected from challenging the lawfulness of the search or seeking redress through the judicial system for violations. Gag orders that run indefinitely allow the government to avoid being held accountable for any wrongdoing. In addition, the service of warrants to third parties is done without any meaningful oversight, putting the DOJ in the position of policing itself -- something it does with no particular enthusiasm or effectiveness.

Filed Under: doj, ecpa, gag order, standing, subpoena, surveillance, warrants
Companies: aclu, microsoft

PETA Has Lost Its Monkey's 'Next Friend' In Its Crazy Copyright Case

from the the-monkey's-uncle-is-missing dept

The ongoing saga that is the monkey selfie lawsuit has continued to move forward, with the lawyers for photographer David Slater filing their brief in response to PETA's. As you probably recall, PETA had teamed up with a primatologist named Antje Engelhardt claiming to be "next friends" for the Indonesian macaque monkey named Naruto, who is alleged to have taken the following selfie with David Slater's camera. Slater has claimed to hold the copyright on the photo for a long time, though he's wrong. But PETA is much more wrong in arguing that it can step in and claim both (a) that there is a copyright on the image and (b) that the monkey holds it. Slater is just wrong about the copyright existing.

Either way, the PETA case was easily tossed out of the district court based on the fact that monkeys can't get copyrights under US law (US laws don't apply to animals unless specifically stated -- this is why farms aren't legally considered murder camps, no matter what some vegetarians might say). And, of course, PETA appealed. And we expect it will go about as well as the district court case. But it may go even worse.

That's because in the reply, Slater's lawyer points out that not only can a monkey not hold a copyright, but also that PETA has even less standing than before, because the primatologist, Antje Engelhardt, has decided she's no longer a next friend of our buddy Naruto, the smiling monkey.

On appeal, the crazy got crazier. Dr. Engelhardt withdrew from the case. That leaves PETA, which does not allege any relationship with the monkey, as the monkey’s sole next friend.

[....]

Two putative next friends filed this action: PETA and Dr. Engelhardt, a primatologist who alleged that she has “known, monitored, and studied Naruto since his birth.” ER 23. It may well be that the relationship with Naruto Dr. Engelhardt alleged is “significant” under Coalition of Clergy v. Bush. However, Dr. Engelhardt moved to withdraw from the case, informing the Court that she “will not continue as a next friend to Appellant in this proceeding.” This Court granted Dr. Engelhardt’s motion, thus leaving PETA as Naruto’s lone putative next friend.

This is a fairly big problem for PETA and its big time (seriously) lawyers from the (previously respectable) law firm of Irell & Manella.

Unlike Dr. Engelhardt, PETA did not allege any relationship with Naruto, much less a significant one. That is a problem on appeal. PETA is now in a position very much like the ballot initiative defenders in Hollingsworth v. Perry, 133 S. Ct. 2652 (2013): a party necessary for standing at the district court is not participating in the appeal. “[S]tanding must be met by persons seeking appellate review, just as it must be met by persons appearing in courts of first instance.” Id. at 2661 (internal quotation marks and citation omitted).

All of the Naruto relationship allegations in the Complaint concern Dr. Engelhardt; none involve PETA.... PETA alleges no connection to Naruto, an Indonesian monkey who lives roughly 10,000 miles from PETA’s headquarters in Virginia.

In other words, even if Engelhardt had standing, PETA doesn't.

The filing also contains its fair share of monkey jokes, so we'll just end this post with a few of those:

Under controlling Ninth Circuit precedent, monkey see, monkey sue is not good law under any Act of Congress unless the legislative text plainly grants non-human animals standing to sue.

[....]

The only pertinent fact in this case is that Naruto is a monkey suing for copyright infringement.

Either way, one hopes that the court makes quick work of this case as well, but it is 9th Circuit, which perhaps deserves copyright on its... creative interpretations of copyright law at times. Hopefully this isn't one of those cases.

Filed Under: animals, antje engelhardt, copyright, david slater, monkey, monkey selfie, public domain, standing
Companies: irell & manella, peta

Court To Film Director: You Must First Create An Infringing Work Before We Can Discuss Whether Or Not It's Actually Infringing

from the take-this-loaded-gun,-press-it-to-your-temple-and-await-further-instructions dept

Is there anything more gloriously effed-up than IP law? I submit to you there is not. Here's the sub-headline for Eriq Gardner's Hollywood Reporter article, which deftly sums up the predicament facing a filmmaker looking to make a movie based on an old Buck Rogers novella.

Don Murphy can only clear rights if he potentially violates them first.

That's the ruling boiled down to a dozen words. The details, while enlightening, do nothing to change the underlying fact that Murphy may have to get sued for copyright infringement before he's allowed to prove he isn't infringing on anything.

That's not the only conundrum Murphy's facing. The other is this: no studio wants to touch the project until the rights have been sorted out. Murphy announced his plans to make a film based on "Armageddon 2419 A.D." at last year's Comic Con. The book was published in 1928. Murphy believes the copyright on the book and characters expired in 1956.

Quite obviously, the trust presiding over the original publisher's estate feels differently. The Dille Trust told Murphy the property must be licensed -- despite offering no proof that the copyright was still valid and despite one of the trust's beneficiaries (Robert Dille) being on board as a co-writer.

So, Murphy did what others have done: sued to have the work declared in the public domain. The problem is he hasn't infringed on the possibly uninfringeable work. The court, relying on a 2007 Supreme Court decision, basically tells Murphy he must start making this possibly-infringing work before it can start addressing his public domain claims.

Looking at the Buck Rogers case, Conti applies the Supreme Court's holding by questioning whether the dispute rises to an actual controversy from "immediacy" and "reality."

Regarding immediacy, Conti writes:

"In this case, the amended complaint does not contain specific, or even approximate, allegations about when plaintiff could begin film production, let alone release the allegedly infringing film, assuming a declaratory judgment is entered in plaintiff’s favor. A dispute 'lacks immediacy' where there are no allegations about 'when, if ever,' the product will be 'used in a manner that could potentially infringe' the intellectual property rights of another. Plaintiff’s nebulous allegations that 'development of the [film] is well underway' and that 'further production efforts could be undertaken in short order' are conclusory and insufficient to show the immediacy required by Article III."

Examining reality, Conti continues:

"At this early stage, the production and release of plaintiff’s film are 'contingent future event[s]' that may not occur 'as anticipated' or 'indeed may not occur at all.' As pleaded by plaintiff, the film project is still in an inchoate stage. Plaintiff does not allege it hired or entered into preliminary agreements with the parties 'integral to the commencement of production'—let alone the release—of a 'major motion picture.'... Plaintiff received 'preliminar[y,] . . . firm interest' in the project from Warner Brothers and Sony. Without allegations of actual commitment or intent to commit—through, for example, letters of intent—plaintiff’s vague, equivocal assertions fail to demonstrate the reality of this dispute. Plaintiff does not allege it entered into finalized, or even preliminary, financing, acquisition, licensing, or distribution agreements with these companies in connection with its potential film."

The Supreme Court decision being cited to put Murphy in the awkward position of having to roll the dice on copyright infringement has nothing to do with copyright. It's all about patents. And it's actually a good decision.

The latest ruling is in the MedImmune/Genentech case looking at whether or not licensing a patent means you can't challenge its validity. Genentech (and plenty of other patent holders) claimed that once you licensed a patent, you were basically saying that you agreed to its validity, and could no longer challenge it. The lower court agreed. This is problematic in a lot of ways, especially with the rise in patent extortion lawsuits, where it's often cheaper to just license the patent rather than fight it. MedImmune licensed the patent early on, rather than waste money fighting it, but challenged it later on when the patent in question became much more important (and the license much more expensive). With an 8 to 1 decision, the Supreme Court sided with MedImmune, saying that licensing a patent shouldn't preclude challenging that patent's validity. Another small step in the right direction.

And yet, here we are, looking at a director being asked to set himself for a lawsuit by the Dille Trust in order to prove he doesn't owe it anything. And in order to do that, he needs to convince a studio to walk across this IP minefield with him -- something no studio in its right mind would ever be willing to do.

The court has given him permission to file an amended complaint, but it's unclear what purpose that will serve under the Supreme Court's MedImmune decision. The only sensible response is to let the idea die. No studio will back a project based on a disputed property and no director is going to put the work in just to be hit with an injunction and statutory damages if the trust comes up with proof it still holds the copyright.

On the other hand, all the Dille Trust has to do is continue to insist it owns the property… even if it doesn't. That's it. Hail copyright.

Filed Under: buck rogers, copyright, don murphy, public domain, standing

Judge Again Says NSA Phone Records Program Is Unconstitutional; Orders NSA To Stop Collecting Phone Records Of Plaintiffs

from the here-we-go-again dept

Back in December of 2013, DC district court judge Richard Leon shocked many by declaring the NSA's bulk collection of phone records under Section 215 of the PATRIOT Act to be unconstitutional. Just a few months ago, the DC circuit appeals court overturned that ruling and sent it back to the lower court, saying that the plaintiff, Larry Klayman, failed to prove he had standing to bring the lawsuit -- mainly because Snowden only had revealed that the NSA was scooping up all Verizon Business Network phone records, and Klayman was a Verizon Wireless customer. That it had since been revealed that the NSA also got Verizon Wireless records was basically ignored.

As we noted in September, Judge Leon made it pretty clear that he still believed the program was unconstitutional, and pushed Klayman to get the process moving so he could rule. Klayman was able to bring new plaintiffs (J.J. Little and J.J. Little & Associates)) into the case who were Verizon Business Network Services subscribers to take that issue out of play. And now that's happened, and Leon has, once again declared the program unconstitutional and ordered an injunction to have it stopped.

With the Government's authority to operate the Bulk Telephony Metadata Program quickly coming to an end, this case is perhaps the last chapter in the Judiciary's evaluation of this particular Program's compatibility with the Constitution. It will not, however, be the last chapter in the ongoing struggle to balance privacy rights and national security interests under our Constitution in an age of evolving technological wizardry. Although this Court appreciates the zealousness with which the Government seeks to protect the citizens of our Nation, that same Government bears just as great a responsibility to protect the individual liberties of those very citizens.

Thus, for all the reasons stated herein, I will grant plaintiffs J.J. Little and J.J. Little & Associates' requests for an injunction and enter an order consistent with this Opinion that (1) bars the Government from collecting, as part of the NSA's Bulk Telephony Metadata Program, any telephone metadata associated with these plaintiffs' Verizon Business Network Services accounts and (2) requires the Government to segregate any such metadata in its possession that has already been collected.

He did not grant the same order for Klayman or other plaintiffs who were not customers of Verizon Business Services, in order to avoid the standing question. Perhaps more interesting is that, unlike last time, he did not give the government an immediate stay on this ruling, and you can tell he's a bit annoyed about what happened last time:

In my December 2013 Opinion, I stayed my order pending appeal in light of the national security interests at stake and the novelty of the constitutional issues raised. I did so with the optimistic hope that the appeals process would move expeditiously. However, because it has been almost two years since I first found that the NSA's Bulk Telephony Metadata Program likely violates the Constitution and because the loss of constitutional freedoms for even one day is a significant harm... I will not do so today.

Good for him.

As noted above, Judge Leon finds standing just for the two new plaintiffs, basically accepting the appeals court's ruling earlier that Klayman and other plaintiffs failed to "adequately" sustain their claims of harm. He rejects some silly defenses from the DOJ, including the claim that we no longer know if Verizon Business Network Services is a part of the program. As Leon says "it defies common sense for defendants to argue, as they apparently do that the Government has chosen to omit from this breathtakingly broad metadata collection Program a provider that the Government surveilled in the past and that, presumably, has the infrastructure to continue assisting in that surveillance. In fact it would make no sense whatsoever for the Government to use all available tools except VBNS call data to accomplish its putative goals."

Then onto the important stuff: the Fourth Amendment. Leon tackled much of that back in his 2013 opinion, but there's more here, noting that the problem is still in place, even after the USA Freedom Act passed:

In my December 2013 Opinion, I explained at length why both the indiscriminate bulk collection of telephony metadata and the analysis of that data each separately constitute a search within the meaning of the Fourth Amendment.... Neither the recent changes in the operation of the Program, nor the passage of the USA FREEDOM Act, has done anything to alter this analysis. The fact remains that the indiscriminate, daily bulk collection, long-term retention, and analysis of telephony metadata almost certainly violates a person's reasonable expectation of privacy.

Then there's the question of whether these collections count as "unreasonable searches" and Judge Leon finds that they do. In part, he tosses out the usual reliance on Smith v. Maryland by the government, which says that if you give data over to a third party, you no longer have any privacy rights over it (the so-called "third party doctrine"). The ruling compares it to the diminished privacy rights you have in going through airport security:

Notably, Americans know that airports are discrete areas in which certain rights otherwise enjoyed are forfeited.... It is their choice to enter that space and, in so doing, to check certain rights at the door. Not so with cellphones. As already described, cellphones have become a constant presence in people's lives. While plaintiffs' privacy interests in their aggregated metadata may be somewhat diminished by the fact that it is held by third-party service providers, this is a necessary reality if one is to use a cellphone at all, and it is, therefore, simply not analogous to the context of voluntarily entering an airport. In this case, plaintiffs have asserted that the searches were a substantial intrusion on their privacy, and I have no reason to doubt that, nor to find that their privacy expectations should have been diminished given the context. Rather, I conclude that plaintiffs' privacy interests are robust.

Judge Leon also notes that the public really had no idea this was happening, until recently:

Finally, far from Americans being put on notice of the Bulk Telephony Metadata Program such that they could choose to avoid it, the Program was, and continues to be, shrouded in secrecy. This may, of course, be practically necessary for the Program to be effective, but it nevertheless increases the level of the privacy intrusion.

Judge Leon then looks to see if, maybe, just maybe the government can justify this intrusion by showing that these searches were necessary to stop terrorist attacks, but again, finds no evidence to support that.

To date, the Government has still not cited a single instance in which telephone metadata analysis actually stopped an imminent attack, or otherwise aided the Government in achieving any time-sensitive objective. Although the Government is not required to adduce a specific threat in order to demonstrate that a "special need" exists, providing this Court with examples of the Program's success would certainly strengthen the Government's argument regarding the Program's efficacy. This is especially true given that the Program is not designed for detection and deterrence like most other programs upheld under the "special needs" doctrine. Indeed, most warrantless searches upheld under the "special needs" doctrine boast deterrence as a substantial Governmental interest.

He also rejects the idea that the USA Freedom Act shows that Congress is okay with the program and that proves that the NSA had the "special needs" necessary to keep the program running. And he clearly thinks this is a dumb argument, even saying a sarcastic "Please!" in his response:

....the Government makes the bootstrap argument that the enactment of the USA FREEDOM Act confirms the importance of this Program to meeting the Government's special needs, and suggests that this Court should defer to that judgment. Please! I recognize that my duty to evaluate the efficacy of this Program is "not meant to transfer from politically accountable officials to the courts the decision as to which among reasonable alternative law enforcement techniques should be employed to deal with a serious public danger."... Nonetheless, while "the choice among such reasonable alternatives remains with the governmental officials," I must still determine whether the Program is reasonably effective in accomplishing its goals, even if not optimally so.... This is a conclusion I simply cannot reach given the continuing lack of evidence that the Program has ever actually been successful as a means of conducting time-sensitive investigations in cases involving imminent threats of terrorism.

From there he goes on to detail why letting the program continue to spy on the plaintiffs would create significant harm and rejects the idea that the government can't respond quickly enough, noting that it's had 22 months since his original ruling to figure out how to handle this.

Of course, again, the ruling only applies to the bulk phone records of two plaintiffs -- and the entire program is set to end at the end of this month anyway, but it is still an important victory for the 4th Amendment and against NSA bulk surveillance.

Filed Under: 4th amendment, bulk records, doj, j.j. little, larry klayman, mass surveillance, metadata, nsa, richard leon, standing

Court Dismisses Wikimedia's Lawsuit Over NSA Surveillance

from the not-over-yet dept

Back in March, we noted that Wikimedia was suing the NSA over its mass surveillance program under Section 702 of the FISA Amendments Act. This is the part of the law that the NSA uses to justify its "upstream" collection -- which lets the NSA partner with backbone providers like AT&T and tap their fiber lines at entry/exit points from the country and sniff through all the traffic. The problem in many lawsuits concerning NSA surveillance is that it's been difficult for the plaintiff to satisfy the requirements necessary to get "standing." That is, can the plaintiff prove that he/she/it had rights violated by the program. Many earlier attempts failed, because they just presented stories of "well, the NSA is collecting everything, so..." and the courts have said that's not enough, since it needs to be shown that the plaintiff, in particular, was a target.

Wikimedia (and the ACLU, who is helping with the case), believed they had a smoking gun that could grant them standing. The following slide, which was revealed by Ed Snowden: See that Wikipedia logo? Wikimedia Foundation and the ACLU argued that this presented evidence that the NSA was targeting Wikipedia users, and thus the Wikimedia Foundation had standing.

Unfortunately, so far, it's not working. Earlier today, the court tossed out the lawsuit, saying that Wikimedia did not present enough evidence to prove it has standing. The court, not surprisingly, relies heavily on the Supreme Court's ruling in Clapper v. Amnesty International, in which SCOTUS rejected Amnesty's similar claim by saying the organization failed to prove it had standing, since it couldn't prove its team was caught up in dragnet surveillance. Of course, famously, to get to that ruling, the US government flat out lied to the Supreme Court (something it has since admitted), claiming (incorrectly) that if information collected via such surveillance was used in criminal cases, the defendants would be told about it.

But, no matter, the court says that under the Clapper ruling, Wikimedia does not have standing, and basically argues that this case really is no different than that one. It rejects the idea that, thanks to Snowden, we now know a lot more about the NSA's surveillance program, basically saying that it's still too speculative.

Plaintiffs cannot provide a sufficient factual basis for their allegations because the scope and scale of Upstream surveillance remain classified, leaving plaintiffs to prop their allegation of actual injury on suppositions and speculation about how Upstream surveillance must operate in order to achieve the government's "stated goals." Indeed, plaintiffs cite the government's "stated goals" in nearly every facet of their argument.... It is, of course, a "possibility" that the NSA conducts Upstream surveillance in the manner plaintiffs allege, but this "bare assertion" is unaccompanied by "factual matter" that raises it "above a speculative level," and hence does not establish standing.

The court notes that the "speculative chain" may be "shorter" than in the Clapper case, but "it is a chain of speculation nonetheless."

The court also rejects the claim that since it's been revealed that the NSA does "about" searches in addition to "to" and "from" searches, that reveals much more broad searches. If you don't recall, one of the revelations is the fact that the NSA can run queries not just on something like "emails to or from Osama bin Laden" but also "emails about Osama bin Laden" which obviously would include a much larger set of content to sniff through. The court doesn't think this matters very much:

... plaintiff's contention that "about surveillance" is like the hypothetical government agent reading every piece of mail misses the mark. Unlike the hypothetical government agent reading every word of every communication and retaining the information, "about surveillance" is targeted insofar as it makes use of only those communications that contain information matching the tasked selector.

In short... it's not a problem that the NSA sniffs through everything to find all the emails about Osama bin Laden, because it's not using the data in all the ones it rejects. Besides, the court argues, the argument is still highly speculative.

Finally, the court looks at a few specific arguments for why Wikimedia and some of the other plaintiffs have more direct evidence that situate themselves differently. First, there's lawyer Joshua Dratel, who is somewhat well known for taking some rather high profile cases, such as handling Ross Ulbricht's defense over the Silk Road arrest, or defending the widow of Boston Marathon bomber Tamarlane Tsarnaev. Two other clients were Agron Hasbajrami and Sabirhan Hasanoff -- and in both cases, the government has admitted those two were subject to Section 702 surveillance. From there, the ACLU argues this means that Dratel's communications were almost certainly swept up and looked at by the NSA as well. However, the court doesn't buy it, saying that while it may be true that Dratel's communications were likely swept up, there's still not enough evidence that it was swept up by the 702 upstream program that the lawsuit is about:

Plaintiffs in this case... do not allege facts that plausibly establish that the information gathered from the two instances of Section 702 surveillance was the product of Upstream surveillance. In neither of Dratel's cases did the government indicate whether the information at issue was derived from PRISM or Upstream surveillance, and no factual allegations in the AC plausibly establish that Upstream surveillance--rather than PRISM--was used to collect the information. Moreover, given what is known about the two surveillance programs, it appears substantially more likely that PRISM collection was used in these cases...

The court is probably right here. There are two major surveillance programs under 702. The "Upstream" program that taps the backbone and then PRISM, in which a list of big internet firms agree to hand over certain information pursuant to a FISA court ruling rubber stamp telling them to hand over that information. And it is actually likely that the part of 702 that was used on Dratel's clients was of the PRISM variety. But the "well, you were surveilled under this other program using the same authority..." reason to dump this argument seems pretty weak. Because it still means surveillance of dubious legality under the same legal authority.

Then there's the case of Wikimedia, who argues that given the government's "stated goals," and the vast amount of traffic going to Wikipedia, it's all but certain that Wikipedia has been swept up in the Upstream collection. The court still isn't buying it:

Plaintiffs' argument is unpersuasive, as the statistical analysis on which the argument rests is incomplete and riddled with assumptions. For one thing, plaintiffs insist that Wikimedia's over one trillion annual Internet communications is significant in volume. But plaintiffs provide no context for assessing the significance of this figure. One trillion is plainly a large number, but size is always relative. For example, one trillion dollars are of enormous value, whereas one trillion grains of sand are but a small patch of beach. Here, the relevant universe for comparison purposes is the total number of annual Internet communications, a figure plaintiffs do not provide--nor even attempt to estimate--in the AC. Without defining the universe of the total number of Internet communications, it is impossible to determine whether Wikimedia's alleged one trillion annual Internet communications is significant or just a drop in the bucket of all annual Internet communications.

Moreover, plaintiffs conclude that there is a greater than 99.9999999999% chance that the NSA has intercepted at least one of their over one-trillion communications on the bases of an arbitrary assumption, namely that there is a 0.00000001% chance the NSA will intercept any particular Internet communication. Plaintiffs provide no basis for the 0.00000001% figure, nor do they explain why the figure is presented as a conservative assumption. Plaintiffs seem to presume a string of zeroes buys legitimacy. It does not. Indeed, a closer look reveals that the number of zeros chosen by plaintiffs leads conveniently to plaintiff's desired result. If three more zeros are added to plaintiffs' figure (0.00000000001%), the odds that at least one of Wikimedia's one trillion annual communications is intercepted drops to approximately 10%. If four more zeros are added (0.000000000001%), the odds that at least one of Wikimedia's communications is intercepted drops to 1%. In short, plaintiffs' assumption appears to be the product of reverse engineer; plaintiffs first defined the conclusion they sought--virtual certainty--and then worked backwards to find a figure that would lead to that conclusion. Mathematical gymnastics of this sort do not constitute "sufficient factual matter" to support a "plausible allegation."

Ouch.

The court also rejects the idea that this kind of ruling means that the Upstream program can never face judicial review, pretending that the fact that the FISA court reviewed it (without any adversarial party) is enough... and (again, incorrectly) that criminal defendants prosecuted with information collected under the program can challenge said collection. And, yes, it's true that the DOJ has now said that it will start informing defendants, but it didn't for years.

The ACLU is, not surprisingly upset by the ruling, and I imagine it will be appealed soon.

Filed Under: fisa amendments act, joshua dratel, prism, section 702, standing, surveillance, upstream, wikipedia
Companies: aclu, wikimedia foundation

Appeals Court Strikes Down Ruling Finding NSA Phone Records Collection Unconstitutional

from the well-that's-too-bad dept

Back in December of 2013, judge Richard Leon of the DC district court, ruled that the NSA's bulk metadata collection under Section 215 of the PATRIOT Act was unconstitutional and issued an injunction against it (though, recognizing the inevitable appeal, Judge Leon stayed the injunction). This was in the case brought by Larry Klayman and FreedomWorks.

Leon's ruling was detailed and thorough... but the DC circuit appeals court has overturned it and sent it back to the lower court, focusing mainly on the "standing" question that has been raised in basically every case against NSA surveillance. In short, the government says "if you can't prove that we spied on you directly, then you can't sue us over our spying on everyone generally." That seems sketchy for all sorts of reasons, and Judge Leon, in his original ruling pointed out how ridiculous it was, mocking the government's reliance on the Supreme Court ruling in "Clapper" (a case against James Clapper) where the Supreme Court basically agreed that you needed more evidence to show you had standing. Of course, that ruling only happened after the US Solicitor General lied to the Supreme Court about how defendants arrested using such data would be told how it was collected. Besides, here, Judge Leon noted, there was plenty of evidence that everyone's information was being collected.

Straining mightily to find a reason that plaintiffs nonetheless lack standing to challenge the metadata collection, the Government argues that Judge Vinson's order names only Verizon Business Network Services ("VBNS") as the recipient of the order, whereas plaintiffs claim to be Verizon Wireless subscribers. The Government obviously wants me to infer that the NSA may not have collected records from Verizon Wireless (or perhaps any other non-VBNS entity, such as AT&T and Sprint). Curiously, the Government makes this argument at the same time it is describing in its pleadings a bulk metadata collection program that can function only because it "creates an historical repository that permits retrospective analysis of terrorist-related communications across multiple telecommunications networks, and that can be immediately accessed as new terrorist-associated telephone identifiers come to light."

[....] Put simply, the Government wants it both ways. Virtually all of the Government's briefs and arguments to this Court explain how the Government has acted in good faith to create a comprehensive metadata database that serves as a potentially valuable tool in combating terrorism--in which case the NSA must have collected metadata from Verizon Wireless, the single largest wireless carrier in the United States, as well as AT&T and Sprint, the second and third-largest carriers.... Yet in one footnote, the Government asks me to find that plaintiffs lack standing based on the theoretical possibility that the NSA has collected a universe of metadata so incomplete that the program could not possibly serve its putative function. Candor of this type defies common sense and does not inspire confidence!

But, the appeals court just doesn't buy it. From the opinion by Judge Janice Brown:

The record, as it stands in the very early stages of this litigation, leaves some doubt about whether plaintiffs’ own metadata was ever collected. Plaintiffs’ central allegation is that defendants “violated the Fourth Amendment to the U.S. Constitution when they unreasonably searched and seized and continue to search Plaintiffs’ phone records . . . without reasonable suspicion or probable cause.” ... Plaintiffs have supported this claim with specific facts, notably: (1) The NSA operates a bulk telephony-metadata collection program; and (2) on April 25, 2013, the FISC issued an order requiring Verizon Business Network Services to produce its subscribers’ call detail records to the NSA on a daily basis from April 25, 2013 to July 19, 2013. However, plaintiffs are Verizon Wireless subscribers and not Verizon Business Network Services subscribers. Thus, the facts marshaled by plaintiffs do not fully establish that their own metadata was ever collected.

Judge Brown admits that Judge Leon explains why the government's own statements make it clear that its metadata collection goes beyond just Verizon Business Network Services, but doesn't think it's enough evidence. She also highlights how there is at least some more substantial evidence than in the Clapper/Amnesty International case that the Supreme Court ruled on, but still doesn't find it enough:

However, the burden on plaintiffs seeking a preliminary injunction is high. Plaintiffs must establish a “substantial likelihood of success on the merits.” ... Although one could reasonably infer from the evidence presented the government collected plaintiffs’ own metadata, one could also conclude the opposite. Having barely fulfilled the requirements for standing at this threshold stage, Plaintiffs fall short of meeting the higher burden of proof required for a preliminary injunction.

Instead, Judge Brown says that the lower court could try to determine if it's appropriate for Klayman/Freedomworks to be allowed to conduct discovery with the government to obtain more evidence that his phone record info was collected -- while admitting that's unlikely because "secret program" and all that.

On remand it is for the district court to determine whether limited discovery to explore jurisdictional facts is appropriate.... Of course, I recognize that, in order for additional discovery to be meaningful, one of the obstacles plaintiffs must surmount is the government’s unwillingness to make public a secret program.... It is entirely possible that, even if plaintiffs are granted discovery, the government may refuse to provide information (if any exists) that would further plaintiffs’ case. Plaintiffs’ claims may well founder in that event. But such is the nature of the government’s privileged control over certain classes of information. Plaintiffs must realize that secrecy is yet another form of regulation, prescribing not “what the citizen may do” but instead “what the citizen may know.”... Regulations of this sort may frustrate the inquisitive citizen but that does not make them illegal or illegitimate. Excessive secrecy limits needed criticism and debate. Effective secrecy ensures the perpetuation of our institutions. In any event, our opinions do not comment on the propriety of whatever privileges the government may have occasion to assert.

Got that? Excessive government secrecy sucks, but, hey, what can you do?

In a separate ruling, Judge Stephen Williams also says there's no standing, giving even more deference to the Supreme Court's ruling in the Clapper/Amnesty International case. While at least Judge Brown was willing to distinguish the two, Judge Williams sees no such distinction:

Here, the plaintiffs’ case for standing is similar to that rejected in Clapper. They offer nothing parallel to the Clapper plaintiffs’ evidence that the government had previously targeted them or someone they were communicating with (No. 3 above). And their assertion that NSA’s collection must be comprehensive in order for the program to be most effective is no stronger than the Clapper plaintiffs’ assertions regarding the government’s motive and capacity to target their communications

In fact, Judge Williams takes the odd position of adding in possible reasons why the NSA might not be collecting everyone's metadata to show why such an inference is unfounded:

The strength of plaintiffs’ inference from the government’s interest in having an effective program rests on an assumption that the NSA prioritizes effectiveness over all other values. In fact, there are various competing interests that may constrain the government’s pursuit of effective surveillance. Plaintiffs’ inference fails to account for the possibility that legal constraints, technical challenges, budget limitations, or other interests prevented NSA from collecting metadata from Verizon Wireless. Many government programs (even ones associated with national defense) seem to be calibrated or constrained by collateral concerns not directly related to the program’s stated objectives, such as funding deficiencies, bureaucratic inertia, poor leadership, and diversion to non-defense interests of resources nominally dedicated to defense. It is possible that such factors have operated to hamper the breadth of the NSA’s collection.

Basically, we can't assume that Verizon Wireless metadata was collected because, you know, maybe it wasn't. Maybe "bureaucratic inertia" meant the NSA really didn't care about Verizon Wireless. Who can really say?

The only "dissent" on the three judge panel comes from Judge David Sentelle, who says he basically agrees with absolutely everything Judge Williams says except for the idea that the case should be remanded to the district court for further discovery, saying the entire case should be dismissed outright.

Plaintiffs have not demonstrated that they suffer injury from the government’s collection of records. They have certainly not shown an “injury in fact” that is “actual or imminent, not conjectural or hypothetical.” ... I agree with the conclusion of my colleagues that plaintiffs have not shown themselves entitled to the preliminary injunction granted by the district court. However, we should not make that our judicial pronouncement, since we do not have jurisdiction to make any determination in the cause. I therefore would vacate the preliminary injunction as having been granted without jurisdiction by the district court, and I would remand the case, not for further proceedings, but for dismissal.

[....]

Without standing there is no jurisdiction. Without jurisdiction we cannot act.... Therefore, I agree with my colleagues that the issuance of the preliminary injunction was an ultra vires act by the district court and must be vacated. However, I believe we can do no more. I would remand the case for dismissal, not further proceedings.

So... that's not great. However, it also creates a pretty clear circuit split between the DC Circuit and the 2nd Circuit, which you may recall ruled that the ACLU and others had standing in a similar lawsuit. Given this clear circuit split, perhaps the Supreme Court can actually be persuaded to take up the case and fix the mistake it made in the Clapper case a couple years ago...

Filed Under: doj, larry klayman, mass surveillance, metadata, nsa, phone records, section 215, standing, surveillance

Huge Win: Appeals Court Says NSA's Bulk Phone Records Collection Not Actually Authorized By PATRIOT Act

from the huge-win dept

Whoa. In a huge ruling, the Second Circuit appeals court has ruled that the NSA's bulk phone records collection is not authorized by the PATRIOT Act. In other words, for all the debate about the renewal of Section 215 this month, which the government insists enables such bulk collection, this appeals court says "nope." The ruling is important on a number of different points, even though it doesn't touch on the constitutionality of the program. It does make some other key points though. The biggest, as Rep. Jim Sensenbrenner (author of the PATRIOT Act) has said all along is that, contrary to the US government's claims, Section 215 does not authorize the bulk collection of any data.

We hold that the text of § 215 cannot bear the weight the government asks us to assign to it, and that it does not authorize the telephone metadata program. We do so comfortably in the full understanding that if Congress chooses to authorize such a far‐reaching and unprecedented program, it has every opportunity to do so, and to do so unambiguously. Until such time as it does so, however, we decline to deviate from widely accepted interpretations of well‐established legal standards.

The actual ruling is overturning a district court ruling that had previously tossed out a challenge to the Constitutionality of the bulk metadata program by the ACLU. This ruling reinstates that case and sends it back to the lower court. As part of that, the court doesn't yet rule on the constitutionality of the overall program, but rather just notes that from the plain reading of Section 215, it does not mean that it authorized the government to collect such a massive trove of phone records.

The other key point in the ruling is on the question of "standing." The DOJ regularly claims that people cannot challenge these programs unless they have specific evidence that they were spied on under the program. Plenty of cases have been thrown out after plaintiffs couldn't prove that the government had directly applied the program to their information, and thus the courts said they lacked standing. In this case, at least, the district court had found that the ACLU had standing, and the appeals court reconfirms that. But here's the key point: the court notes that merely the collection of the data is enough to show standing. This is in contrast to the DOJ's attempt to claim that the collection doesn't matter -- it's only if the government then looks at the data. The court disagrees, reminding the DOJ that the Fourth Amendment applies to not just "searches" but also "seizures," and the data collection is a seizure:

Appellants in this case have, despite those substantial hurdles, established standing to sue, as the district court correctly held. Appellants here need not speculate that the government has collected, or may in the future collect, their call records. To the contrary, the government’s own orders demonstrate that appellants’ call records are indeed among those collected as part of the telephone metadata program. Nor has the government disputed that claim. It argues instead that any alleged injuries here depend on the government’s reviewing the information collected, and that appellants have not shown anything more than a “speculative prospect that their telephone numbers would ever be used as a selector to query, or be included in the results of queries of, the telephony metadata.”

But the government’s argument misapprehends what is required to establish standing in a case such as this one. Appellants challenge the telephone metadata program as a whole, alleging injury from the very collection of their telephone metadata. And, as the district court observed, it is not disputed that the government collected telephone metadata associated with the appellants’ telephone calls. The Fourth Amendment protects against unreasonable searches and seizures. Appellants contend that the collection of their metadata exceeds the scope of what is authorized by § 215 and constitutes a Fourth Amendment search. We think such collection is more appropriately challenged, at least from a standing perspective, as a seizure rather than as a search. Whether or not such claims prevail on the merits, appellants surely have standing to allege injury from the collection, and maintenance in a government database, of records relating to them. “[A] violation of the [Fourth] Amendment is fully accomplished at the time of an unreasonable governmental intrusion.” United States v. Verdugo‐Urquidez, 494 U.S. 259, 264 (1990) (internal quotation marks omitted). If the telephone metadata program is unlawful, appellants have suffered a concrete and particularized injury fairly traceable to the challenged program and redressable by a favorable ruling.

That's a very important finding and one that I imagine will also be quite useful in challenging other aspects of NSA surveillance.

Furthermore, the court notes that even beyond the "seizure" aspect, the government is clearly doing "searches" as well:

The government admits that, when it queries its database, its computers search all of the material stored in the database in order to identify records that match the search term. In doing so, it necessarily searches appellants’ records electronically, even if such a search does not return appellants’ records for close review by a human agent. There is no question that an equivalent manual review of the records, in search of connections to a suspect person or telephone, would confer standing even on the government’s analysis. That the search is conducted by a machine might lessen the intrusion, but does not deprive appellants of standing to object to the collection and review of their data.

The DOJ tried to rely on the big ruling against Amnesty International at the Supreme Court a couple of years ago, noting that that was dismissed because the record collection there was speculative. Yet, in this case, that's not true:

Here, appellants’ alleged injury requires no speculation whatsoever as to how events will unfold under § 215 – appellants’ records (among those of numerous others) have been targeted for seizure by the government; the government has used the challenged statute to effect that seizure; the orders have been approved by the FISC; and the records have been collected. Amnesty International’s “speculative chain of possibilities” is, in this context, a reality.

The court also finds that there's standing on First Amendment grounds, thanks to the chilling effects of surveillance:

Appellants likewise have standing to assert a First Amendment violation. Appellants contend that their First Amendment associational rights are being violated, both directly and through a “chilling effect” on clients and donors. The Supreme Court has long recognized that an organization can assert associational privacy rights on behalf of its members, stating that “[i]t is hardly a novel perception that compelled disclosure of affiliation with groups engaged in advocacy may constitute . . . a restraint on freedom of association.”

There's a lot more in the ruling as well, including a clear rejection of the idea that the program and the orders of the FISA court to collect this data are somehow "not reviewable" by the judicial system. The DOJ says that because the court orders are secret, that means there can't be judicial review. The 2nd Circuit's response is basically, "you're really undermining your own case here":

Upon closer analysis, however, that argument fails. The government has pointed to no affirmative evidence, whether “clear and convincing” or “fairly discernible,” that suggests that Congress intended to preclude judicial review. Indeed, the government’s argument from secrecy suggests that Congress did not contemplate a situation in which targets of § 215 orders would become aware of those orders on anything resembling the scale that they now have. That revelation, of course, came to pass only because of an unprecedented leak of classified information. That Congress may not have anticipated that individuals like appellants, whose communications were targeted by § 215 orders, would become aware of the orders, and thus be in a position to seek judicial review, is not evidence that Congress affirmatively decided to revoke the right to judicial review otherwise provided by the APA in the event the orders were publicly revealed.

And then there's this lovely line:

In short, the government relies on bits and shards of inapplicable statutes, inconclusive legislative history, and inferences from silence...

Hey, DOJ/NSA: this court isn't buying what you're selling.

Next up, the DOJ trots out a standard talking point, about how collecting all this info is just like a grand jury subpoena. Once again, the court points out that's ridiculous, focusing on the fact that Section 215 requires the information to be "relevant." We've discussed in the past how the NSA has reinterpreted relevance to mean "might be useful at some point in the future." And the court explicitly rejects that:

The records demanded are all‐encompassing; the government does not even suggest that all of the records sought, or even necessarily any of them, are relevant to any specific defined inquiry. Rather, the parties ask the Court to decide whether § 215 authorizes the “creation of a historical repository of information that bulk aggregation of the metadata allows,”.... because bulk collection to create such a repository is “necessary to the application of certain analytic techniques,” ... That is not the language in which grand jury subpoenas are traditionally discussed.

Thus, the government takes the position that the metadata collected – a vast amount of which does not contain directly “relevant” information, as the government concedes – are nevertheless “relevant” because they may allow the NSA, at some unknown time in the future, utilizing its ability to sift through the trove of irrelevant data it has collected up to that point, to identify information that is relevant. We agree with appellants that such an expansive concept of “relevance” is unprecedented and unwarranted.

And further on that point:

The government has not attempted to identify to what particular “authorized investigation” the bulk metadata of virtually all Americans’ phone calls are relevant.... Put another way, the government effectively argues that there is only one enormous “anti‐terrorism” investigation, and that any records that might ever be of use in developing any aspect of that investigation are relevant to the overall counterterrorism effort.

And, as the court notes, that doesn't just redefine "relevant" -- it reads it right out of the law:

The government’s approach essentially reads the “authorized investigation” language out of the statute. Indeed, the government’s information‐gathering under the telephone metadata program is inconsistent with the very concept of an “investigation.” To “investigate” something, according to the Oxford English Dictionary, is “[t]o search or inquire into; to examine (a matter) systematically or in detail; to make an inquiry or examination into.” 8 Oxford English Dictionary 47 (2d ed. 2001). Section 215’s language thus contemplates the specificity of a particular investigation – not the general counterterrorism intelligence efforts of the United States government. But the records in question here are not sought, at least in the first instance, because the government plans to examine them in connection with a “systematic examination” of anything at all; the records are simply stored and kept in reserve until such time as some particular investigation, in the sense in which that word is traditionally used in connection with legislative, administrative, or criminal inquiries, is undertaken. Only at that point are any of the stored records examined. The records sought are not even asserted to be relevant to any ongoing “systematic examination” of any particular suspect, incident, or group; they are relevant, in the government’s view, because there might at some future point be a need or desire to search them in connection with a hypothetical future inquiry.

The court regularly cites the PCLOB report that found the Section 215 program unconstitutional, and seems to have clearly understood the deeper issues with this program. While it falls short of ordering the program to stop (noting that the program is set to end at the end of this month anyway), this ruling is pretty suggestive of how the court might eventually rule on the program's constitutionality if it returns.

Oh, and how can we leave out this tidbit on "secret law":

Congress cannot reasonably be said to have ratified a program of which many members of Congress – and all members of the public – were not aware.

And it totally rejects the usual NSA defenders' stance that it wasn't secret because members of Congress could have found out about the program if they took significant steps. Not enough, the court says:

In 2010, the Senate and House Intelligence Committees requested that the Executive Branch provide all members of Congress access to information about the program before the reauthorization vote. In response, the Executive Branch provided the Intelligence Committee chairs with a classified paper on the program, which was then made available to members of Congress. That availability, however, was limited in a number of ways. First, the briefing papers could only be viewed in secure locations, for a limited time period and under a number of restrictions.... The government does not dispute appellants’ assertion that members of Congress could not bring staff with them when they went to read the briefing papers, nor discuss the program with their staff. And, of course, no public debate on the program took place. In 2011, briefing papers were also provided to the Intelligence Committees, but only the Senate Committee shared the papers with other members of that body who were not committee members. The House Intelligence Committee did not share the papers at all with non‐members, leaving the non‐committee Representatives in the dark as to the program.

We had highlighted Rep. Mike Rogers (then head of the House Intelligence Committee) for failing to make the documents available, and it's nice to see the court pick up on that.

While this doesn't go all the way to ending the program, this is a huge ruling from an important appeals court. This issue will still have to play out for years in other courts and eventually the Supreme Court, but today's ruling by this court is a huge victory for the 4th Amendment, even if the court didn't go all the way there in its analysis.

Filed Under: 1st amendment, 2nd circuit, 4th amendment, bulk collection, congress, doj, house intelligence committee, mass surveillance, nsa, patriot act, section 215, standing
Companies: aclu