On May 23, 2017, the Fourth Circuit Court of Appeals issued its opinion on Wikimedia foundation v. NSA/CSS. The Court vacated and remanded the NSA’s previously successful motion to dismiss Wikimedia’s Fourth and First Amendment claims against the NSA’s Upstream surveillance program, while a 2-1 majority upheld the dismissal of the eight other organizations joined as co-plaintiffs. The Court held that Wikimedia’s complaint contained sufficient factual allegations to determine Article III standing and that the District Court misapplied Clapper v. Amnesty International USA’s analysis of speculative injury.
The Court followed the Third Circuit’s approach in Schuchdart v. President of the United States, bifurcating its analysis to separately address the injury-in-fact requirement and whether the pleaded facts are sufficiently plausible to survive a facial challenge. The Plaintiffs in Wikimedia argued that, in practice, the Upstream program copies “substantially all international text-based communications—and many domestic ones” from key chokepoints along the Internet backbone. Wikimedia at 11. After collection, the NSA “attempts to filter out and discard some wholly domestic communications” but that effort “is incomplete.” Id. Collected communications are reviewed in full for approved targeted selectors, and then retains and analyzes all communications that contain those selectors as well as any that happen to be bundled with those communications in transit. Id.
Based on those assumptions of how the Upstream program operates, Wikimedia argued that the sheer volume and breadth of its yearly electronic communications, combined with the relatively small number of international backbone chokepoints, made it inevitable that the Upstream program had collected at least some of Wikimedia’s communications. Wikimedia described three categories of its communications that are implicated under Upstream: (1) communications with Wikimedia community members; (2) internal log communications, including IP addresses and URLs sought by users; and (3) communications between Wikimedia staff and person around the world. Id. at 12. Wikimedia also reasoned that since the NSA cannot know ahead of time which communications contained approved tasked selectors, Upstream “must copy and review all international text-based communications transiting [a] circuit in order to identify those of interest.” Id. Therefore, according to Wikimedia, if the NSA is monitoring even one of those backbone chokepoints, then it is intercepting, copying, and reviewing at least some portion of Wikimedia’s communications.
The Court found Wikimedia’s argument persuasive in establishing that Wikimedia had suffered an injury-in-fact, as the alleged collection has already occurred and “is not too speculative for Article III purposes. Id. at 24-25. The other two elements of standing were met as the Upstream surveillance was the direct cause of Wikimedia’s alleged Fourth and First Amendment harms, and that the requested injunctive and declaratory relief would redress those harms. Id. at 25. The Court then concluded that accepting the technical rules of the Internet as true, and given Wikimedia using those rules to explain the technical means for Upstream’s function, Wikimedia’s allegations are reasonable and entitled to the presumption of truth. Id. The Court further clarified that the District Court erred in describing Wikimedia’s allegations as “speculative,” and blurred the lines between the appropriate analysis for a motion for summary judgment and for a motion to dismiss. Id. at 28. The Court wrote that the District Court relied too heavily on Clapper, and that the District Court should not have used its own observations regarding the number of chokepoints the NSA uses in the Upstream program in analyzing a motion to dismiss.
While the Court unanimously agreed that the other plaintiffs likewise satisfied the same Article III elements as Wikimedia, it split on whether those other plaintiffs’ allegations were sufficiently plausible to survive the motion to dismiss. The majority held that those plaintiffs’ allegations that “the NSA is intercepting ‘substantially all’ text-based communications entering and leaving the United States” is too expansive to be plausible. Id. at 32. The Court found that these allegations allege what the Upstream program’s operational scope must be, did not rise to the level of those in Schuchardt, where plausibility was established through description of technical means and detailed exhibits. Id. at 34. These allegations, in contrast, lack the level of detail of those in Schuchardt, and thus are not plausible as alleged.
This decision is important both for the ongoing evolution of standing doctrine post-Clapper and for its implications for data transfers between the U.S. and EU. A primary concern from European regulators has been that U.S. law does not offer effective remedies of complaints against unlawful surveillance under the Upstream and PRISM programs. Critics have cited standing doctrine in particular as a significant hurdle to redress in the surveillance context. The Fourth Circuit’s agreement with the Third Circuit’s reasoning in Schuchardt, however, demonstrates that these claims can at the least survive a motion to dismiss, enabling the parties to engage in further discovery and potentially receive injunctive and declaratory relief. As such, this opinion may be a significant factor to both the upcoming EU-U.S. Privacy Shield review and ongoing cases examining the adequacy of U.S. surveillance safeguards for data transfers generally.