Wikimedia Foundation v. National Security Agency/FAQ

On March 10, 2015, the Wikimedia Foundation, the non-profit organization that supports Wikipedia and its sister projects, filed suit against the United States National Security Agency (NSA) and the Department of Justice (DOJ), among others. The Foundation and its eight co-plaintiffs are represented by the American Civil Liberties Union (ACLU). The lawsuit is a challenge to dragnet surveillance by the NSA, specifically the large-scale seizing and search of internet communications frequently referred to as “upstream” surveillance.

Privacy is one of our core values. We work hard to protect the information that users share and generate when they visit the Wikimedia projects. Last year, we implemented HTTPS to encrypt traffic to and from the Wikimedia projects to make this data and communications with users more secure. The Wikimedia Foundation’s aim in filing this suit is similar: to protect the rights of the Foundation and Wikimedia users around the world by ending upstream mass surveillance. Wikipedia is one of the world’s largest collaborative free knowledge resources and receives hundreds of millions of unique visitors per month. Mass surveillance undermines privacy and free expression rights on the Internet and creates a chilling effect that threatens the future growth and well-being of the Wikimedia projects.

What does this lawsuit challenge?

Our lawsuit challenges the NSA’s unfounded, large-scale search and seizure of international internet communications, frequently referred to as "upstream" surveillance. Using upstream surveillance, the NSA seizes and searches virtually all text-based internet communications flowing into and out of the United States. It does so by tapping directly into the internet's "backbone"—the network of high-capacity cables, switches, and routers that carry domestic and international internet communications. This backbone connects the Wikimedia global community of readers and contributors to Wikipedia and the other Wikimedia projects, such as Wikimedia Commons and Wikidata.

What is the U.S. government’s legal justification for this program?

The U.S. government has used the Foreign Intelligence Surveillance Act (FISA) Amendments Act of 2008 (FAA) (see 50 U.S.C. § 1881a) to justify broad, “upstream” mass surveillance inside of the United States. Under the FAA, “the Attorney General and the Director of National Intelligence may authorize jointly, for a period of up to one year from the effective date of the authorization, the targeting of [non-US] persons reasonably believed to be located outside the United States to acquire "foreign intelligence information.” Yet upstream surveillance is not limited to communications involving the government’s targets. Instead, the government is copying and searching substantially all text-based Internet communications into and out of the United States, in order to locate communications to and from its targets. Moreover, the targeting standard is very low: the statute only requires “reasonable belief” that a target is a non-US person located outside the United States, likely to communicate "foreign intelligence information"—an expansive and elastic category. The government need not establish that its targets are foreign agents, much less terrorists. We believe the broad interpretation of this statute that allows for upstream surveillance is unconstitutional.

How does surveillance or the fear of surveillance affect readers and editors of Wikipedia and its sister projects?

Mass surveillance is a threat to intellectual freedom and a spirit of inquiry, two of the driving forces behind Wikimedia. Wikipedia is written by people from around the world who often tackle difficult subjects. Very frequently they choose to remain anonymous, or pseudonymous. This allows them to freely create, contribute, and discover, without fear of reprisal. Surveillance might be used to reveal sensitive information, create a chilling effect to deter participation, or in extreme instances, identify individual users. Pervasive surveillance undermines the freedoms upon which Wikipedia and its communities are founded.

How does surveillance affect Wikipedia as a knowledge resource?

Wikipedia is a living resource for knowledge. It is written by volunteers around the globe, in hundreds of languages. It reflects the world around us and changes to embody current events, notable individuals, evolving theories, emerging art, and more. Wikipedia relies on the contributions of editors and the support of readers to evolve and grow. If readers and editors are deterred from participating in Wikipedia because of concerns about surveillance, the health of Wikipedia as a resource to the world is jeopardized.

Who is paying for this lawsuit? Will it be expensive for Wikimedia?

We are very fortunate to have pro bono representation from world-class attorneys at the ACLU. We are also supported by the top-notch attorneys at Cooley, LLP, who are now representing us pro bono as well. Because legal representation is often the most expensive aspect of civil litigation, we expect the cost to the Foundation to be relatively very small. However, we do foresee the use of limited, preallocated staff and budget resources to ensure that we put forth the best case possible.

Why is it important that the Wikimedia Foundation ensures privacy and anonymity for its users?

Privacy is a core value of the Wikimedia movement. From its beginning, Wikipedia has allowed users to keep their identities private through the use of anonymous or pseudonymous editing. This has been reinforced by the Wikimedia Foundation’s firm commitment to protecting the privacy and data of its users through legal and technical means. Privacy makes freedom of expression possible, sustains freedom of inquiry, and allows for freedom of information and association. Knowledge flourishes where privacy is protected.

Why did Wikimedia join this lawsuit against the NSA?

Our role at the Wikimedia Foundation is to protect Wikipedia, its sister projects, and the Wikimedia community of users. This means providing our users with the right conditions to facilitate their work, and protecting them when necessary. Defending the privacy of our editors, readers, and community is paramount to us. We believe privacy is essential to facilitating and advancing free knowledge.

How do you know Wikimedia has been singled out for surveillance by the NSA?

One of the NSA documents revealed by whistle-blower Edward Snowden specifically identifies Wikipedia's HTTP traffic as a target for surveillance alongside several other major websites like CNN.com, Gmail, and Facebook. The previously secret slide declares that monitoring these sites can allow NSA analysts to learn “nearly everything a typical user does on the Internet.” In addition, a second NSA slide, published in July 2015, instructs analysts on how to use search strings containing the words “wikipedia” and “wikimedia” on HTTP traffic. In June 2015, the Wikimedia Foundation implemented HTTPS to encrypt traffic to and from the Wikimedia projects to make data and communications with users more secure.

Has the Wikimedia Foundation taken any measures to protect its users’ privacy?

The Wikimedia Foundation takes privacy very seriously, which is why we find the NSA’s upstream mass surveillance so troubling. In June, 2015 we implemented the HTTPS protocol by default to protect user privacy by encrypting traffic on Wikimedia sites. You do not need to create an account or login to read or edit Wikipedia or the other Wikimedia sites. If you do decide to create an account, you can choose any username you like -- we don’t require real names, email addresses, or any other personally identifying information, and we never sell your data. When law enforcement agencies or governments request data about our users, we push back, and ensure that they have followed the law and our stringent rules regarding such requests.

Why did the district court dismiss the case?

In October 2015, a federal district court in Maryland dismissed the case on standing grounds. The court found that our complaint did not plausibly allege that the NSA was specifically monitoring Wikimedia communications or the communications of our eight co-plaintiffs. In so doing, the court referenced a previous decision, Clapper v. Amnesty International, in which the Supreme Court of the United States found that a different set of plaintiffs lacked standing to challenge a different surveillance program. We respectfully disagreed with the court’s decision, with regard to both the similarity of this case to Clapper and the wealth of evidence about government surveillance provided in our complaint. We appealed the district court's decision to the U.S. Fourth Circuit Court of Appeals.

What happened on appeal?

In May 2017, the Fourth Circuit ruled unanimously that our challenge to upstream surveillance could go forward. The court rejected the district court’s analysis, concluding that it was “plausible” that our communications are subject to upstream surveillance, based in part on the sheer number of our communications with users around the world, and the way in which this type of surveillance operates. Two of the three judges on the panel dismissed the eight other plaintiffs’ allegations as implausible.

Where is the case now?

The lawsuit is back before the federal district court in Maryland. Even though we plausibly alleged that our communications are subject to upstream surveillance, the government has brought a further challenge to our standing arguments, and we must present evidence to support them.