A massive surveillance program by the National Security Agency to monitor Americans’ international internet traffic is the target of a years-long legal challenge brought on behalf of the Wikimedia Foundation by the Knight Institute and the ACLU. That lawsuit, Wikimedia Foundation v. NSA, questions the lawfulness of the NSA’s “Upstream” surveillance, in which the U.S. intelligence agency intercepts American’s private emails, internet messages, and web communications with people overseas, scans them for thousands of keywords associated with foreign surveillance targets, then copies and combs through vast amounts of the traffic. The Knight Institute’s lead on the case is Litigation Director Alex Abdo; we spoke recently about the First and Fourth Amendment issues behind the challenge, and the status of the lawsuit. An edited transcript of that conversation follows.
* * *
When did you first learn about the NSA program? And how did the Wikimedia lawsuit initially come about?
We learned about Upstream surveillance in 2013. It was one of the first programs that reporters working with documents provided by Edward Snowden revealed publicly. And we learned that it involved a far broader form of surveillance than we understood that the NSA was entitled to conduct on U.S. soil. It essentially involved the mass scanning of internet traffic going into and out of the country for communications that might be of interest to the NSA, including between U.S. persons and individuals outside the country. And it involved that collection without any warrant and not based on any level of suspicion.
 |
A lot of people and organizations were very concerned about it. Among them was the Wikimedia Foundation. It had a very particular reason to be concerned, which is that one of the documents released by the reporters working with the Snowden trove had a slide explaining why the NSA was interested in monitoring internet traffic, and on that slide was a picture of Wikipedia’s logo—Wikipedia is one of the Wiki sites that Wikimedia runs—making pretty clear that the NSA was interested in collecting the Wikipedia reading habits of its targets. So we ended up agreeing to file a lawsuit on Wikimedia’s behalf, challenging Upstream surveillance in an effort to protect their users from the NSA’s mass internet surveillance program.
Why was this surveillance such a problem for Wikipedia?
Wikipedia is the internet’s encyclopedia. It’s where millions of people around the globe go to learn about any number of topics. It’s our library online, and it’s been successful in part because it has allowed people to access all of this incredible information without having to ask for permission, without having to worry about being monitored by a repressive regime or its overzealous officers. Wikipedia takes the security and confidentiality of the services it provides very seriously, in the same way that the libraries of old took very seriously the list of people who checked out books, and why historically our country has been so concerned about the government acquiring information about our reading habits without a good reason. Their concern with Upstream surveillance in particular is that the NSA was short-circuiting the traditional legal requirements that protect our reading habits from government surveillance. That’s why they were concerned about it, and that’s why they decided to file a legal challenge.
But shouldn’t the government be able to target, to some degree at least, foreign agents, terrorists, criminals, whether through the internet or otherwise? Aren’t there minimization procedures that act as checks on these kinds of tools?
The government should be able to target foreign agents and terrorists and criminals, but Upstream surveillance and surveillance conducted under this legal authority more broadly, which is known as Section 702 of the Foreign Intelligence Surveillance Act, is not limited to targeting foreign agents, terrorists, or criminals. Under this program the NSA is allowed to target just about any foreigner abroad, even when those individuals are communicating with people in the U.S., and it can collect those communications without getting a warrant. And the result is that U.S. persons’ communications are swept into NSA databases without any prior judicial review and not based on any suspicion of wrongdoing.
The main requirement that the NSA has to show (not to a court, but just internally) before it can target an individual for surveillance under Upstream or Section 702 more broadly, is that the would-be target is a foreign person abroad and that they might be communicating what the NSA calls “foreign intelligence information,” which is a very broadly defined concept. It basically includes anything that might relate to the foreign affairs of the United States. And because those requirements are so lax, the result is that the NSA under these programs can target essentially any foreigner abroad. That means that U.S. persons’ communications with any foreigner abroad—essentially all of our international communications— are susceptible to being captured by the NSA without a warrant and without any showing of wrongdoing.
You would think that a program that involves such wide-scale collection at the outset would include robust protections for communications of U.S. persons that are inevitably picked up (and we know they’re inevitably picked up and in huge quantities). But there aren’t.
Now, you would think that a program that involves such wide-scale collection at the outset would include robust protections for communications of U.S. persons that are inevitably picked up (and we know they’re inevitably picked up and in huge quantities). But there aren’t. The government is allowed to keep Americans’ communications for long periods of time. It’s allowed to keep them indefinitely if it can show that our communications also contain foreign intelligence information. It can search through them using the names and identifiers of U.S. persons, again all without a warrant.
That’s very troubling. That’s a model for a future in which our intelligence agencies have essentially Google-like access to our communications and use of the internet. And we don’t think that’s the model that the founders had in mind when they drafted the Fourth Amendment, which was meant to limit government intrusions into personal and private spaces and requires that they be tailored to the government’s justifications. And this is not a targeted program in any meaningful sense. It’s one that involves collection on a vast scale without warrants and without any showing of wrongdoing.
You’ve mentioned some of the Fourth Amendment concerns that the case raises. What about First Amendment concerns?
The two rights are very closely connected. Privacy is a precondition of free speech. It is hard to formulate dissenting thoughts, to assemble with like-minded people who may be dissidents or critics of government policy, unless you have some modicum of privacy, and private places to formulate unorthodox beliefs and thoughts. Our concern is not just that NSA surveillance overreaches into private places, but that it will inevitably suppress dissent, and inevitably have a conforming effect on public discourse and beliefs in the country. This concern is historically rooted. The Supreme Court has for a very long time recognized the connection between these two rights. And it has placed a heavier thumb on the scale of individual privacy when there’s a real risk of official surveillance making it harder for people to dissent from official policy. That’s why we think the case is more than just about privacy rights. It’s also about free speech rights.
When the U.S. Court of Appeals for the Fourth Circuit dismissed the case this fall, it raised the issue of “state secrets privilege,” which elevates claims of secrecy over the rights of internet users. Was the court wrong to raise this? And how, if at all, do the special procedures that Congress enacted in the related Foreign Intelligence Surveillance Act, or FISA, factor in?
We do think that the court’s application of the state secrets privilege was wrong. Let me provide a little bit of context. One of the extraordinary challenges to litigating over NSA surveillance is establishing what we call “standing.” Before you can sue over a government practice, you have to show that you were injured by it. And it’s very hard to sue over a secret surveillance program because almost by definition you don’t know whether you were injured by it, even if you have very good reason to suspect that you were swept up in the surveillance, that you were a target, or maybe one of your contacts was a target. And so the courts have let very few challenges to NSA surveillance over the last 20 years go forward, essentially only those where the government has effectively confirmed that someone was the target of surveillance.
It effectively insulates this kind of surveillance from judicial scrutiny, or at least from adversarial judicial scrutiny where you have parties on both sides represented in court. And it makes it more likely that abuses will go unnoticed.
That’s troubling for a variety of reasons. It effectively insulates this kind of surveillance from judicial scrutiny, or at least from adversarial judicial scrutiny where you have parties on both sides represented in court. And it makes it more likely that abuses will go unnoticed, and more unlikely that the program will be subjected to the kind of scrutiny you want it subjected to, where you have fierce advocates presenting the best arguments about the problems with the program to a court. We tried to get around that problem in this case by showing that Wikimedia’s communications with its users around the globe were so voluminous and so geographically distributed that it was essentially impossible to imagine an NSA surveillance program like Upstream not capturing at least some of their communications.
At the first stage of the case, the district court disagreed with us, but the Fourth Circuit reversed and said that our complaint adequately alleges that Wikimedia’s communications have been swept up in the course of Upstream surveillance, due in large part to how many millions of users Wikipedia has all around the globe, and also, due to what we publicly know about how Upstream surveillance operates, which involves scanning of internet communications as they pass through chokepoints on the internet backbone.
We went back to the trial court after the Fourth Circuit ruled in our favor, and this time the court required us to put forward evidence of our claims. We put forward our evidence, including a very lengthy and detailed declaration by an expert in internet networking and surveillance technology, making the same showing that we had prevailed on in the Fourth Circuit. And the district court, again, disagreed with us, and again dismissed the case.
We again appealed, and the Fourth Circuit again agreed with us on the question of standing. The court held that we had—this time with evidence and not just based on the allegations in our complaint—shown that Wikimedia’s communications were swept up in the course of Upstream surveillance. But it held that our challenge could not be litigated without the government’s inadvertent revelation of state secrets. And it said, as a result, the case cannot go forward, even though we believe that we can make our case entirely without reliance on any secret evidence from the government. We think that the public record is sufficient to demonstrate the surveillance of Wikimedia and to show why Upstream surveillance is unconstitutional. But the Fourth Circuit said the government wouldn’t be able to present any defense without revealing state secrets, and so it dismissed the case.
We think that’s wrong for a variety of reasons, but one of the most important is that Congress in the Foreign Intelligence Surveillance Act, which is the statute the government relies on to conduct Upstream surveillance, included a very important provision that allows courts reviewing challenges to FISA surveillance to look at classified evidence behind closed doors, without revealing it to the public. Our argument was that this provision represented Congress’s balancing of the right of people to challenge NSA surveillance and the government’s obligation to keep classified information secret. And we said that the court should rely on that procedure to review any classified evidence behind closed doors without revealing it to the public, while still ruling on our constitutional challenge to Upstream surveillance.
The court disagreed with us. It said that that procedure was available essentially only to people who the government explicitly told had been subject to NSA surveillance. But we think the court was wrong there too. This provision makes sense only if you think of it as an independent check on NSA surveillance that can be invoked by people who have that evidence that they were monitored by the NSA, even if the government doesn’t want to confirm that fact. But the court disagreed and we’re now considering next steps.
What are the next steps following this dismissal? And also isn’t there a related state secrets case now before the Supreme Court that might have some bearing on this suit?
There is. There’s a case called Fazaga before the Supreme Court. One of the main issues in that case is related to the issue in the Wikimedia case, which is whether this procedure in FISA for the review of classified evidence behind closed doors supersedes or preempts the state secrets privilege, whether it essentially represents Congress’s determination that secrets in FISA challenges should be dealt with in a particular way, rather than having cases dismissed in their entirety. And we think the answer to that is yes. But that’s a question that the Supreme Court will consider in Fazaga. And if it rules in what we think of as the right way in that case, then presumably our challenge in Wikimedia’s case will then be allowed to go forward. So that’s what we’re hoping for.
It is extremely difficult right now, and the recent ruling makes it even harder, to file a legal challenge against NSA surveillance, even when ... there are reasons to be very concerned about the constitutionality of these programs.
I think one of the most important things about the Wikimedia case is what it says about the ability of our courts to publicly consider the constitutionality of NSA surveillance. It is extremely difficult right now, and the recent ruling makes it even harder, to file a legal challenge against NSA surveillance, even when—based on the plain language of the authorities that the NSA has been given—there are reasons to be very concerned about the constitutionality of these programs. It’s so difficult because the courts have erected procedural barriers to suits going forward.
For years, the problem was you couldn’t show that you were monitored so you couldn’t demonstrate legal standing. One of the very first surveillance cases that I was involved in with my colleague Jameel Jaffer was Clapper v. Amnesty International, which involved a challenge to NSA surveillance. We represented people whose communications we thought were very likely to be swept up in NSA surveillance, including, for example, the then-head lawyer for the lead defendant in the military commissions trial in Guantánamo, the individual accused of masterminding 9/11.
We argued that if anybody is going to be swept up in these broad surveillance programs, it is people like these, so you should allow us to challenge the constitutionality of these programs. The Supreme Court said no in a 5-4 decision. It held that we had not sufficiently demonstrated that these people were actually surveilled. Now fast track nearly 10 years, and we have been able to make that showing. The Fourth Circuit now has twice ruled that we have made the showing required to allow us to challenge a program of NSA surveillance. But now another procedural barrier has been erected, the state secrets privilege.
The result of all of this is that NSA surveillance will likely only ever be subject to real adversarial testing in U.S. courts if and when the government decides it wants to allow those challenges to go forward. I think that's a terrible state of affairs.
Now, the government would of course say there is a court that weighs in on the constitutionality of NSA surveillance, and it’s the Foreign Intelligence Surveillance Court. And the FISC, as it’s called, does have a role in overseeing this kind of surveillance. But its role is limited, and it is involved at a stage where the issues are extraordinarily abstract. The FISC is asked once a year to approve the broad procedures for Section 702 surveillance. It is not asked to review the targeting decisions made by the government, and it is not permitted to consider constitutional challenges raised by those who might be implicated by the surveillance. That’s just not a substitute for the kind of adversarial testing that our court system relies on to get the answers right.
A. Adam Glenn was a writer/editor at the Knight First Amendment Institute.