A federal judge has dismissed the Wikimedia Foundation's challenge against the National Security Agency's Upstream surveillance program.

While the non-profit could show that its content was likely traveling through connection points monitored by the NSA, it could not prove the data was copied - because the tools to run Upstream are classified.

The right understanding of any matter and a misunderstanding of the same matter do not wholly exclude each other

The case was originally filed by the ACLU back in 2015 on behalf of nine educational, legal, human rights, and media organizations (including Wikimedia), but was dismissed later that year after the court concluded that the plaintiffs lacked “standing” to sue because they had not sufficiently alleged that their communications had been intercepted.

In 2017, after appeal, the decision was reversed - with Wikimedia allowed to continue as the size of its traffic needs (primarily due to Wikipedia) met the standing required to continue the case. Essentially, Wikimedia users download so much data, that it's statistically inevitable that the traffic would pass points monitored by NSA.

Wikimedia alleged that the NSA's Upstream surveillance program was illegally conducting bulk surveillance, and that this hindered the plaintiffs’ ability to ensure the basic confidentiality of their communications with contacts abroad.

While the PRISM surveillance program acquires communications directly from US Internet service providers - with the "compelled assistance" of those ISPs - Upstream focuses on data collection with the "compelled assistance" of providers that control the telecommunications backbone.

Judge T.S. Ellis III explained in his ruling: "Thus, Upstream collection, unlike PRISM collection, 'does not occur at the local telephone company or email provider with whom the targeted person interacts.' Instead, the collection of communications for Upstream surveillance 'occurs upstream in the flow of communications between communication service providers."

The government claims that Upstream follows Section 702 of the Foreign Intelligence Surveillance Act, which requires the surveillance to be targeted at non-US persons, and should not lead to the "intentional acquisition of wholly domestic surveillance."

Bulk collection is prohibited and, instead, the NSA must use 'selectors' - specific communication identifiers, such as email addresses or telephone numbers. Selectors cannot be as simple as key words, such as "bomb."

Once the NSA has targets in mind, the Attorney General and the DNI can jointly authorize surveillance for up to a year, if the Foreign Intelligence Surveillance Court (FISC) approves a written statement from the government demonstrating that the surveillance complies with the requirements. Should that happen, the government can then issue a 702 directive to US telecoms companies requiring them to assist in acquiring the communications involving the selectors.

The government describes Upstream as follows: "Certain Internet transactions transiting the Internet backbone network(s) of certain electronic communications provider(s) are filtered for the purpose of excluding wholly domestic communications[,] and are then scanned to identify for acquisition those transactions [that contain communications] to or from... persons targeting in accordance with the applicable NSA targeting procedures; only those transactions that pass through both the filtering and the scanning are ingested into Government databases."

With this in mind, Wikimedia challenged the legality of Upstream, claiming it violated 702, the First Amendment and the Fourth Amendment.

The case against the NSA

The organization's case relied on three assertions - one, that Wikimedia's communications were so vast that they almost certainly traverse every international backbone link. Two, that the NSA conducts Upstream surveillance on at least one of those points. And three, the NSA must be copying and reviewing all text-based communications going through that point.

The judge agreed with the first two points, while the third claim formed the crux of the deliberation process.

Wikimedia's chosen expert, Scott Bradner, said that the NSA "most likely" copies all communications traveling across one of its surveilled points, and then filters it. "Even if the NSA were monitoring only a single circuit under upstream collection, it would be copying and reviewing at least some of Wikimedia's communications."

This was challenged by the NSA's handpicked expert, Dr. Henning Schulzrinne. While Schulzrinne does not know how the Upstream program works, he provided details on how the NSA could hypothetically avoid collecting Wikimedia's communications. Using traffic mirroring, the NSA could conduct surveillance "without intercepting, copying, reviewing, or otherwise interacting with [the communications of Wikimedia."

He said that, among other things, the NSA could blacklist all of Wikimedia's static IP addresses and not collect any data from those addresses.

Bradner admitted this was possible, but countered that it was "simply implausible as a practical matter given everything we know about Upstream collection."

The judge, however, found that Schulzrinne's hypothetical "is consistent with [the] government's public disclosures about Upstream surveillance." More importantly, Schulzrinne proves that "it is not a technological necessity that the NSA must copy all of the text-based Internet communications traversing a circuit that the NSA monitors."

We don't know the truth of the matter, and we probably never will, as the actual details as to how Upstream operates are state secrets.

Judge Ellis said: "For Wikimedia to litigate the standing issue further, and for defendants to defend adequately in any further litigation, would require the disclosure of protected state secrets, namely details about the Upstream surveillance program's operations. For the reasons that follow, therefore, the standing issue cannot be tried, or otherwise further litigated, without risking or requiring harmful disclosures of privileged state secrets, an outcome prohibited under binding Supreme Court and Fourth Circuit precedent.

"Thus, the case must be dismissed, and judgment must be entered in favor of defendants."

The judge noted that Wikimedia's loss was "not through any fault of its own," but added: "It is appropriate, however, 'in limited circumstances like these, [that] the fundamental principle of access to court must bow to the fact that a nation without sound intelligence is a nation at risk."

Patrick Toomey, senior staff attorney with the ACLU's Speech, Privacy, and Technology Project, and one of Wikimedia's representatives on the case, told DCD: "The public record shows that Wikimedia, like millions of Americans, is swept up in the NSA’s mass Internet surveillance.

"It is disappointing that the court accepted the government's flawed secrecy claims to deny Wikimedia and its users the opportunity to defend their privacy rights. The decision places one of the government’s most intrusive and expansive surveillance programs beyond the reach of the Constitution, and we are exploring all options in response."

Chilling news

Wikimedia also contended that Upstream surveillance impaired its communications with community members, as shown by a drop in readership of certain Wikipedia pages.

It used data from a statistical analysis by Dr. Jonathon Penny, which concluded that it is "highly likely" that "public awareness of NSA surveillance programs, including Upstream surveillance... has had a large-scale chilling effect on Wikipedia users."

The judge, however, noted the data - covering a 32-month period - ended in August 2014, before the lawsuit was filed. This means that it does not show anything about ongoing harm.

He also said that the readership effects were from public awareness of media coverage of NSA surveillance generally, and not of Upstream surveillance specifically.

"Accordingly, Wikimedia cannot establish standing under this theory."