Wikimedia Found. v. Nat'l Sec. Agency/Central Sec. Serv.

• Decision Date: 13 December 2019
• Docket Number: Case No. 1:15-cv-662
• Citation: 427 F.Supp.3d 582
• Parties: WIKIMEDIA FOUNDATION, Plaintiff, v. NATIONAL SECURITY AGENCY/CENTRAL SECURITY SERVICE, et al., Defendants.
• Court: U.S. District Court — District of Maryland

427 F.Supp.3d 582

WIKIMEDIA FOUNDATION, Plaintiff,

v.NATIONAL SECURITY AGENCY/CENTRAL SECURITY SERVICE, et al., Defendants.

Case No. 1:15-cv-662

United States District Court, D. Maryland.

Signed December 13, 2019

Filed December 16, 2019

Alex Abdo, Pro Hac Vice, Jameel Jaffer, Pro Hac Vice, Knight First Amendment Institute at Columbia University, Ashley Marie Gorski, Pro Hac Vice, Jonathan Hafetz, Pro Hac Vice, Patrick Toomey, Pro Hac Vice, American Civil Liberties Union Foundation, Charles Sims, Pro Hac Vice, David Alexander Munkittrick, Pro Hac Vice, John Browning, Pro Hac Vice, Proskauer Rose LLP, New York, NY, Benjamin Hansel Kleine, Pro Hac Vice, Devon Cook, Pro Hac Vice, Molly Smolen, Pro Hac Vice, Cooley LLP, San Francisco, CA, David Robert Rocah, Deborah A. Jeon, ACLU of Maryland, Baltimore, MD, for Plaintiff.

James Jordan Gilligan, Julia Alexandra Berman, Olivia R. Hussey Scott, Rodney Patton, Timothy A. Johnson, United States Department of Justice, Washington, DC, for Defendants.

National Security Agency/Central Security Service, pro se.

Michael S. Rogers, pro se.

Office of the Director of National Intelligence, pro se.

James R. Clapper, pro se.

Department of Justice, pro se.

Loretta E. Lynch, pro se.

MEMORANDUM OPINION

T.S. Ellis, III, United States District Judge

Plaintiff, Wikimedia Foundation ("Wikimedia"),¹ challenges the legality of the National Security Agency's ("NSA") Upstream surveillance data gathering efforts, one of a series of recent cases challenging the constitutionality of the NSA's surveillance programs.² According to the Director of National Intelligence ("DM"), Upstream surveillance is a surveillance program authorized pursuant to § 702 of the Foreign Intelligence Surveillance Act ("FISA") that involves the targeted collection of non-U.S. persons' international Internet communications by the NSA.³ Wikimedia alleges that the NSA has intercepted, copied, and collected Wikimedia's Internet communications pursuant to the Upstream surveillance program and that such interception, duplication, and collection exceeds the NSA's authority under FISA and violates Wikimedia's rights under the First and Fourth Amendments of the Constitution.

At issue in this matter is defendants' motion for summary judgment. Defendants argue that judgment must be entered in their favor because Wikimedia, the only remaining plaintiff, lacks Article III standing. Defendants also argue that even if a genuine dispute of material fact exists as to Wikimedia's standing, the state secrets doctrine precludes further litigation of Wikimedia's standing, and thus requires entry of judgment in defendants' favor.

Before analyzing the parties' arguments on the issue of Article III standing and the state secrets doctrine, however, it is important to address briefly three topics: (i) the definition of Upstream surveillance and the statutory authority for the NSA's Upstream surveillance program, (ii) the procedural history of this case, and (iii) the undisputed factual record developed by the parties. After addressing these three preliminary topics, which frame all of the analysis that follows, the pertinent summary judgment standard is set forth, and the parties' arguments are analyzed under that standard. For the reasons that follow, Wikimedia has failed to establish that it has Article III standing sufficient to survive summary judgment, and further litigation of this matter is precluded by the state secrets doctrine. Accordingly, this case must be dismissed, and judgment must be entered in favor of defendants.

I.

To begin with, it is necessary to define Upstream surveillance, the NSA program at issue in this litigation, and to clarify what is meant by the term Upstream surveillance as that term is used in this litigation. The NSA conducts Upstream surveillance pursuant to § 702 of FISA, 50 U.S.C. § 1881a. The government has acknowledged that it conducts § 702 surveillance through two programs, namely the Upstream and PRISM programs.⁴ In PRISM surveillance, the government acquires communications directly from a United States-based Internet Service Provider ("ISP"). See PCLOB 702 Report, at 33. In contrast, the acquisition of communications via Upstream surveillance does not occur "with the compelled assistance of the United States ISPs, but instead with the compelled assistance...of the providers that control the telecommunications backbone over which communications transit."⁵ Id. at 35. Thus, Upstream collection, unlike PRISM collection, "does not occur at the local telephone company or email provider with whom the targeted person interacts." Id. Instead, the collection of communications for Upstream surveillance "occurs ‘upstream’ in the flow of communications between communication service providers." Id. Only the Upstream surveillance program is at issue in this case.

As noted, the government contends that its Upstream surveillance program is conducted pursuant to FISA § 702. Specifically, § 702 permits the Attorney General and the DNI to authorize jointly, for up to one year, foreign-intelligence surveillance targeted at non-U.S. persons located abroad,⁶ if the Foreign Intelligence Surveillance Court ("FISC")⁷ approves the government's written certification demonstrating that the intended surveillance complies with statutory requirements.⁸ To approve such a certification, the FISC must determine that the government's targeting procedures are reasonably designed:

(i) to ensure that acquisition "is limited to targeting persons reasonably believed to be located outside the United States," 50 U.S.C. § 1881a(j)(2)(B)(i) ;

(ii) to prevent the intentional acquisition of wholly domestic communications, id. § 1881a(j)(2)(B)(ii) ;

(iii) to "minimize the acquisition and retention, and prohibit the dissemination, of nonpublicly available information concerning unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign-intelligence information," id. § 1801(h)(1); seeid. § 1881a(j)(2)(C) ; and

(iv) to ensure that the procedures "are consistent with ... the [F]ourth [A]mendment," id. § 1881a(j)(3)(A).⁹

In effect, FISC approval of government surveillance pursuant to § 702 means that the FISC has found that the surveillance comports with the statutory requirements and the Constitution.

The recent release of public reports and declassification of some FISC opinions have revealed additional details regarding the collection of communications pursuant to § 702. After the FISC approves a § 702 certification, the NSA designates "targets," which are non-U.S. persons located outside the United States who are reasonably believed to possess or receive, or are likely to communicate, foreign-intelligence information designated in the certification.¹⁰ The NSA then attempts to identify "selectors," namely the specific means by which the targets communicate, such as email addresses or telephone numbers.¹¹ Importantly, selectors cannot be key words (e.g. , "bomb") or targets' names (e.g. , "Bin Laden"); rather, selectors must be specific communication identifiers.¹² The government then may issue a § 702 directive to a U.S. telecommunications service provider requiring it to assist the government in acquiring communications involving those selectors.¹³

As for the actual collection of communications containing these targeted selectors, the government has described the Upstream surveillance collection process as follows:

[C]ertain Internet transactions transiting the Internet backbone network(s) of certain electronic communication service provider(s) are filtered for the purpose of excluding wholly domestic communications[,] and are then scanned to identify for acquisition those transactions [that contain communications] to or from ... persons targeted in accordance with the applicable NSA targeting procedures; only those transactions that pass through both the filtering and the scanning are ingested into Government databases.

Defs.' Br. 4 (quoting Pub. Decl. of Daniel R. Coats, Director of National Intelligence, ¶ 15, ECF No. 138-2).¹⁴ Thus, the Upstream surveillance collection process involves three steps—(1) filtering, (2) scanning, and (3) ingesting. As this description shows, although the government has disclosed some information about Upstream surveillance in declassified documents and unclassified reports, most technical details of the Upstream surveillance process remain classified. Wikimedia Found. v. Nat'l Sec. Agency , 857 F.3d 193, 202 (4th Cir. 2017) (citing Jewel v. Nat'l Sec. Agency , 810 F.3d 622, 627 (9th Cir. 2015) ).

II.

With this statutory framework and definition of Upstream surveillance in mind, it is appropriate to turn to the procedural history of this case. On June 22, 2015, Wikimedia, along with eight other organizations,¹⁵ filed the Amended Complaint in this suit, challenging the legality of the NSA's Upstream surveillance program. The Amended Complaint alleges that Upstream surveillance (i) exceeds the scope of the government's authority under § 702, (ii) violates Article III, (iii) violates the First Amendment, and (iv) violates the Fourth Amendment and requests (i) a declaration that Upstream surveillance violates the Constitution and § 702 and (ii) an order permanently enjoining the NSA from conducting Upstream surveillance. On August 6, 2015, defendants moved to dismiss the Amended Complaint, arguing that plaintiffs lacked Article III standing. On October 23, 2015, defendants' motion was granted on the ground that plaintiffs' allegations were too speculative to establish Article III standing. Wikimedia Found. v. Nat'l Sec. Agency, 143 F. Supp. 3d 344, 356 (D. Md. 2015), aff'd in part, vacated in part, and remanded by , 857 F.3d 193 (4th Cir. 2017).

Thereafter, plaintiffs appealed, and the Fourth Circuit affirmed in part, vacated in part, and remanded the case for further consideration. Wikimedia Found., 857 F.3d at 200. Specifically, the Fourth Circuit vacated the finding that...