Wikimedia Foundation v. NSA: Why we're here and where we're going

 
For the last two years, the Wikimedia Foundation has been fighting in the United States federal courts to protect the fundamental rights and freedoms of Wikimedia users from overly-broad government  surveillance. We challenged the U.S. National Security Agency’s (NSA) “Upstream” mass surveillance of the internet, which vacuums up international text-based online communications without individualized warrants or suspicion. Now, in the wake of an important court ruling in our favor, we take a closer look at Wikimedia Foundation v. NSA.
On May 23, 2017, the U.S. Fourth Circuit Court of Appeals ruled that the Wikimedia Foundation has adequately alleged standing to challenge the NSA’s Upstream surveillance of internet traffic and may proceed to the next stage of the case. Specifically, the court found that the Foundation has adequately alleged the suspicionless seizure and searching of its internet communications through Upstream surveillance.  The Fourth Circuit’s decision is an important, but still intermediate, victory for online privacy and free expression.  In this blog post, we’ll provide some background on the case and the practices it challenges, look at the most recent ruling, and discuss our next steps.
How we got here
In March 2015, we joined eight other co-plaintiffs (represented pro bono by the American Civil Liberties Union (ACLU)) to file a lawsuit challenging the NSA’s Upstream surveillance practices. However, the events that precipitated our case began much earlier.
In 1978, Congress passed the Foreign Intelligence Surveillance Act (FISA), which regulates the collection of communications that fall into the category of “foreign intelligence information” on U.S. soil. FISA required the government to show probable cause to a court that a particular surveillance target was a “foreign power” or an agent thereof.
However, in 2008, the Foreign Intelligence Surveillance Act Amendments Act (FAA) amended FISA to authorize the government to monitor communications of non-U.S. persons for “foreign intelligence information” without establishing probable cause or making any individualized showing to a court. And in 2013, public disclosures of NSA documents revealed the massive scope of the surveillance practices allegedly authorized by the FAA, including “Upstream” surveillance.
Upstream surveillance involves installing devices at major “chokepoints” along the internet backbone. The NSA then seizes international text-based communications passing through these chokepoints and combs through those communications for so-called “selectors” associated with tens of thousands of targets. Although the NSA claims that Section 702 of FISA authorizes Upstream surveillance, we believe that its scope exceeds what is actually allowed by the statute. This broad surveillance also infringes several provisions of the U.S. Constitution, including: the First Amendment, which protects freedom of speech and association; the Fourth Amendment, which protects against unreasonable searches and seizures; and Article III, which grants specific powers to the judicial branch of government.
At the District Court, the government asserted that the Wikimedia Foundation and our co-plaintiffs lacked standing. Standing is a legal concept that determines whether a party has alleged a specific injury and has a right to bring a claim in court. The government argued that we lacked standing because we had not plausibly alleged that the NSA actually intercepted and searched our communications. The District Court considered only the standing issue, agreed with the government, and granted its motion to dismiss. We then appealed to the Fourth Circuit, explaining how and why we have standing in this case.

Why we’re here

Privacy and free expression rights are fundamental to the Wikimedia Foundation’s vision of empowering everyone to share in the sum of all human knowledge.  Our mission depends on maintaining the privacy and confidentiality of user communications and activities, so as to encourage trust among community members and foster the creation and dissemination of free educational content.
In supporting Wikipedia and the other Wikimedia projects, we communicate with hundreds of millions of individuals who read or contribute to the repository of human knowledge. These communications often contain personally identifying, sensitive, or confidential information about users, our staff, and the Foundation. Suspicionless searches of these communications are like searching the patron records of the largest library in the world.
We strive to keep this information confidential, and always put user privacy first. The Wikimedia Foundation privacy policy limits what data we collect, how much we share, and how long we retain it. We never sell user information or share it with third parties for marketing purposes. In June 2015, we implemented HTTPS across the projects, which permit anonymous and pseudonymous participation as one of their key principles of operation.
We filed this lawsuit as another step in our efforts to stand up for Wikimedia users, and protect their ability to read and share knowledge freely and confidentially.

Where we’re going

The Fourth Circuit’s recent decision is a major step in the fight against mass surveillance. Notably, all three judges on the panel found that the Wikimedia Foundation had established standing, by alleging sufficient facts to defeat the government’s motion to dismiss. By a 2-1 vote, however, the panel upheld the lower court’s finding that our eight co-plaintiffs did not have standing. The third judge on the panel would have found that all nine plaintiffs had standing.
This important ruling is the most recent in a series of cases in which U.S. courts have permitted challenges to mass surveillance to go forward. This past October, the U.S. Third Circuit Court of Appeals held that an individual plaintiff had standing to challenge the NSA’s PRISM program, which collects internet communications directly from service providers. The Electronic Frontier Foundation (EFF)’s Jewel v. NSA case has also scored some legal victories, most recently when a District Court allowed EFF to conduct discovery from the government. Two other courts ruled against the U.S. government’s bulk collection of call records, which helped prompt the U.S. Congress to enact some positive reforms.
These cases partially reverse a previous trend in which courts were less skeptical of government snooping. In 2013, the Supreme Court ruled 5-4 that the plaintiffs in Clapper v. Amnesty International did not have standing to challenge mass surveillance on the ground that their claims were too speculative. However, the global surveillance disclosures following the Clapper decision have revealed a great deal about the true scope and scale of the U.S. government’s suspicionless surveillance practices. This information has prompted courts to conclude that Clapper doesn’t foreclose every challenge to government surveillance in the name of national security. Encouragingly, some plaintiffs—like the Foundation in this case—are increasingly afforded the opportunity to reach the merits of their claims, though many continue to face an uphill battle.  
These victories come as Section 702 of FISA is scheduled to sunset in December 2017. Section 702 sets out the process the U.S. government must follow for obtaining authorization to target non-U.S. persons reasonably believed to be abroad, including their communications with persons in the U.S. It also broadened the scope of surveillance beyond foreign powers and their agents to, for example, any information the government believes relates to the “foreign affairs” of the United States. No particularity or probable cause is necessary.
Regardless of the outcome in the courts, this year’s reauthorization debate represents an important opportunity for reform. Upstream’s many statutory and constitutional deficiencies must be fixed, and we welcome a public conversation about the importance of protecting internet users’ privacy and expressive freedoms.
Even though we have won this appeal, our fight against the NSA’s overbroad surveillance practices is far from over. We are closely reviewing the opinion with our counsel at the ACLU and our co-plaintiffs to determine the next steps, and we will continue to publish updates to keep Wikimedia users informed.

Want to learn even more about Wikimedia Foundation v. NSA?

An updated timeline, frequently asked questions, and more resources about this case can be found at our Wikimedia Foundation v. NSA resources page.  To view any of the legal documents or decisions in this case, check out the ACLU’s page.  Finally, if you want to add your voice to the cause, consider talking about your support on social media, or sharing the ACLU’s infographic about the case.
Jim Buatti, Legal Counsel
Aeryn Palmer, Legal Counsel
Thanks to Allison Davenport and Nick Gross for their assistance in preparing this blog post. Special thanks to all who have supported us in this litigation, including the ACLU’s Patrick Toomey and Ashley Gorski; the Knight Institute’s Jameel Jaffer and Alex Abdo; Aarti Reddy, Patrick Gunn, and Ben Kleine of our pro bono counsel Cooley, LLP; and the Wikimedia Foundation’s Zhou Zhou.