from Not finished yet department
In March, we noted that Wikimedia was suing the NSA for its mass surveillance program under Section 702 of the FISA Amendment Act. This is the part of the law that the NSA uses to justify its “upstream” collection – which allows the NSA to partner with backbone providers like AT&T and operate their fiber lines at entry points. /leaving the country and sniffing all the traffic. The problem with many lawsuits involving NSA surveillance is that it has been difficult for the plaintiff to meet the requirements necessary to obtain “quality”. In other words, can the plaintiff prove that he had rights violated by the program. Many previous attempts have failed, because they only presented stories of “well, the NSA collects everything, so…” and the courts said that was not enough, since it had to be shown that the Complainant, in particular, was a target.
Wikimedia (and the ACLU, which is helping with the case), thought they had compelling evidence that might give them standing. The following slide, revealed by Ed Snowden:
See that Wikipedia logo? The Wikimedia Foundation and the ACLU argued that this proved that the NSA was targeting Wikipedia users and that the Wikimedia Foundation therefore had standing.
Unfortunately, so far it doesn’t work. Earlier in the day, the court dismissed the lawsuit, saying Wikimedia had failed to present enough evidence to prove it had standing. The court, unsurprisingly, relied heavily on the Supreme Court’s decision in Clapper v. Amnesty International, in which SCOTUS rejected Amnesty’s similar claim saying the organization had failed to prove that it had standing because she could not prove that her team was caught in the net. Of course, in coming to this decision, the US government outright lied to the Supreme Court (which it has since admitted), claiming (incorrectly) that if information collected through such surveillance were used in criminal cases, the defendants would have talked about it.
But regardless, the court is saying that under the Clapper decision, Wikimedia has no standing, and is essentially arguing that this case is really no different than that. He dismisses the idea that, thanks to Snowden, we now know much more about the NSA’s surveillance program, essentially saying it’s still too speculative.
Plaintiffs cannot provide a sufficient factual basis for their claims because the scope and scale of upstream surveillance remains classified, leaving plaintiffs to base their claim of actual harm on guesswork and speculation about how the surveillance upstream must work in order to achieve the “stated objectives” of the government. “Indeed, the plaintiffs cite the government’s “stated objectives” in almost every facet of their argument…. There is, of course, a “possibility” that the NSA is conducting upstream surveillance in the manner alleged by the plaintiffs, but this “simple assertion” is not accompanied by a “factual element” that elevates it “to above a speculative level”, and therefore does not establish standing.
The court notes that the “speculative chain” may be “shorter” than in Clapper, but “it is nonetheless a speculative chain”.
The court also rejects the claim that since it was revealed that the NSA conducts “about” searches in addition to “to” and “from” searches, this reveals much broader searches. If you don’t remember, one of the revelations is that the NSA can run queries on not only something like “emails to or from Osama bin Laden”, but also ” emails on Osama bin Laden,” which would obviously include a much larger set of content to browse. The court doesn’t think it matters much:
…the plaintiff’s assertion that “about surveillance” is as if the hypothetical government agent reading every mail misses the mark. Unlike the hypothetical government agent reading every word of every communication and retaining the information, “about surveillance” is targeted in that it only uses communications that contain information matching the loaded selector.
In short…it’s okay for the NSA to dig through everything to find all the emails about Osama bin Laden, because they don’t use the data of everyone they reject. Furthermore, according to the court, the argument is still highly speculative.
Finally, the court considers a few specific arguments as to why Wikimedia and some of the other plaintiffs have more direct evidence that sits differently. First of all, there is the lawyer Joshua Dratel, who is quite well known for having taken on fairly high-profile cases, such as the defense of Ross Ulbricht during the Silk Road arrest or the defense of the widow of the Boston Marathon bomber Tamarlane Tsarnaev. Two other clients were Agron Hasbajrami and Sabirhan Hasanoff – and in both cases the government admitted that these two were subject to Section 702 surveillance. From there, the ACLU argues that this means that the Dratel communications have almost certainly been scanned and examined by the NSA as well. However, the court does not buy it, saying that while it may be true that Dratel’s communications were probably scanned, there is still not enough evidence that they were scanned. by program 702 upstream that the lawsuit relates to:
The plaintiffs in this case … do not allege facts that plausibly establish that the information gathered from the two instances of Section 702 surveillance was the product of upstream surveillance. In none of the Dratel cases has the government indicated whether the information at issue came from PRISM or upstream monitoring, and no factual allegation in the CA plausibly establishes that upstream monitoring – rather than PRISM – was used to collect the information. Also, given what is known of the two surveillance programs, it seems much more likely that PRISM collection was used in these cases…
The court is probably here. There are two major surveillance programs under 702. The “Upstream” program which operates the backbone, then PRISM, in which a list of major internet companies agrees to hand over certain information in accordance with a FISA court decision rubber stamp telling them to hand over this information. And it is indeed likely that the part of the 702 that was used on Dratel customers was of the PRISM variety. But the “well, you were monitored under this other program using the same authority…” to dismiss this argument seems pretty weak. Because it always means monitoring dubious legality under the same judicial authority.
Then there’s the case of Wikimedia, which argues that given the government’s “stated goals” and the large amount of traffic to Wikipedia, it’s almost certain that Wikipedia has been swept into the Upstream collection. The court still does not buy it:
The plaintiffs’ argument is not persuasive because the statistical analysis on which the argument is based is incomplete and full of assumptions. On the one hand, the plaintiffs insist that Wikimedia’s more than one trillion annual Internet communications are significant in volume. But the plaintiffs provide no context to gauge the significance of that figure. A trillion is clearly a big number, but size is always relative. For example, a trillion dollars has enormous value, while a trillion grains of sand is just a small stretch of beach. Here, the relevant universe for comparison purposes is the total number of annual Internet communications, a figure which the Requesters do not provide – or even attempt to estimate – in the CA. Without defining the universe of the total number of Internet communications, it is impossible to determine whether Wikimedia’s alleged trillion annual Internet communications are significant or just a drop in the bucket annual Internet communications.Additionally, the plaintiffs conclude that there is a greater than 99.9999999999% chance that the NSA intercepted at least one of their more than a trillion communications based on an arbitrary assumption that it there is a 0.00000001% chance that the NSA will intercept a particular communication. Internet communications. Plaintiffs provide no basis for the 0.00000001% figure, nor explain why the figure is presented as a conservative assumption. Plaintiffs seem to assume that a series of zeros buys legitimacy. It’s not. Indeed, closer examination reveals that the number of zeros chosen by the applicants conveniently leads to the result desired by the applicant. If three more zeros are added to the complainants’ figure (0.00000000001%), the probability that at least one of Wikimedia’s trillion annual communications will be intercepted drops to about 10%. If four additional zeros are added (0.000000000001%), the probability that at least one of Wikimedia’s communications will be intercepted drops to 1%. In short, the plaintiffs’ hypothesis appears to be the product of reverse engineering; the plaintiffs first defined the conclusion they were looking for – virtual certainty – and then worked backwards to find a number that would lead to that conclusion. Mathematical gymnastics of this type does not constitute “sufficient factual material” to support a “plausible allegation”.
Ouch.
The court also rejects the idea that this type of decision means that the Upstream program can never be subject to judicial review, arguing that the fact that the FISA court has examined it (without any adversarial parties) is enough… and (again, incorrectly) that defendants sued with information collected under the program can challenge said collection. And, yes, it’s true that the DOJ has now said it will start briefing defendants, but it hasn’t done so in years.
The ACLU is, unsurprisingly upset by the decision, and I imagine it will soon be appealed.
Filed Under: fisa amendments act, joshua dratel, prism, section 702, standing, monitoring, upstream, wikipedia
Companies: aclu, wikimedia foundation