ELECTRONIC PRIVACY INFORMATION CENTER v. NATIONAL SECURITY AGENCY

Filing 1

COMPLAINT against NATIONAL SECURITY AGENCY ( Filing fee $ 350, receipt number 4616032727) filed by ELECTRONIC PRIVACY INFORMATION CENTER. (Attachments: # 1 Civil Cover Sheet)(tr)

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
_________________________________________________
)
ELECTRONIC PRIVACY INFORMATION CENTER )
1718 Connecticut Ave., N.W.
)
Suite 200
)
Washington, DC 20009
)
)
Plaintiff,
)
)
v.
) Civil Action No.__________
)
NATIONAL SECURITY AGENCY
)
9800 Savage Road,
)
Suite 6248
)
Washington, D.C. 20530
)
)
Defendant.
)
_________________________________________________ )

COMPLAINT FOR INJUNCTIVE RELIEF
1.

This is an action under the Freedom of Information Act (“FOIA”),

5 U.S.C. § 552 (2010), for injunctive and other appropriate relief, seeking the release of agency
records sought by the Electronic Privacy Information Center from the National Security Agency.
Jurisdiction and Venue
2.

This Court has subject matter jurisdiction over this action and personal jurisdiction

over the parties pursuant to 5 U.S.C. § 552(a)(4)(B) (2010) and 5 U.S.C. § 552(a)(6)(C)(i) (2010).
This Court also has jurisdiction over this action pursuant to 28 U.S.C. § 1331 (2010). Venue is
proper in this district under 5 U.S.C. § 552(a)(4)(B) (2010).
Parties
3.

Plaintiff Electronic Privacy Information Center (“EPIC”) is a public interest research

1

organization incorporated as a not-for-profit corporation in Washington, D.C. EPIC’s activities
include the review of federal policies and practices that impact the civil liberties and privacy
interests of Internet users. EPIC routinely testifies before the United States Congress regarding
emerging privacy and civil liberties issues. EPIC also publishes books, reports, a bi-weekly
electronic newsletter, and maintains two of the most popular Internet sites on privacy – EPIC.ORG
and PRIVACY.ORG.
4.

Defendant the National Security Agency (“NSA”) is an agency established in the

Executive Branch of the United States Government. The NSA is an agency within the meaning of
5 U.S.C. § 552(f)(1) (2010).
Facts
Defendant NSA and Google Entered Into a “Cooperative Research and Development
Agreement” Following a Cyber Attack in January 2010
5.

On January 12, 2010, Google reported a major cyber attack from “highly

sophisticated” hackers in China.
6.

On February 4, 2010, the Washington Post and the Wall Street Journal reported

that Google contacted the NSA regarding the firm’s security practices, immediately following
the attack.
7.

The Wall Street Journal reported that the NSA’s general counsel drafted a

“cooperative research and development agreement” within twenty-four hours of Google’s January
12, 2010 announcement, authorizing the agency to "examine some of the data related to the
intrusion into Google's systems."
8.

On January 13, 2010, Google changed a key setting, encrypting by default all

subsequent traffic to and from its electronic mail servers.
9.

Previous to January 13, 2010, Google chose not encrypt Gmail, the firm's
2

electronic mail service, by default despite two compelling warnings about the risk in 2009.
10.

On March 17, 2009, prior to the cyber attack in January 2010, Petitioner EPIC

filed a Complaint before the Federal Trade Commission, urging the Commission to investigate
Google’s reluctance to encrypt cloud-based user data by default.
11.

Following the EPIC complaint to the Federal Trade Commission, 37 experts in

privacy and security wrote Google to highlight the “very real risk of data theft and snooping”
posed by non-encryption.
EPIC Submitted a FOIA Request to the NSA Regarding Its Collaboration With Google
12.

On February 4, 2010, EPIC transmitted, via certified mail, a written FOIA request

(“EPIC's NSA-Google FOIA Request”) to the NSA for agency records. EPIC requested the
following agency records:
a. All records concerning an agreement or similar basis for collaboration, final or
draft, between the NSA and Google regarding cyber security;
b. All records of communication between NSA and Google concerning Gmail,
including but not limited to Google’s decision to fail to routinely encrypt
Gmail messages prior to January 13, 2010; and
c. All records of communications regarding NSA’s role in Google’s decision
regarding the failure to routinely deploy encryption for cloud-based
computing service, such as Google Docs.
13.

EPIC's NSA-Google FOIA Request followed immediately after news reports that

appeared in the Wall Street Journal and Washington Post concerning a cyber attack on computer
servers maintained by Google that contain the personal information of users of Google services.
14.

EPIC urged the NSA to expedite processing for EPIC’s NSA-Google FOIA Request

on the bases that it pertains to a matter about which there is an urgency to inform the public relating
to an actual or alleged federal government activity and that it was made by a person primarily
engaged in disseminating information. 5 U.S.C. § 552(a)(6)(E) (2010). Petitioner cited the
3

widespread press reports of the arrangements as well as the privacy interests of hundreds of millions
of Internet users who would be affected by the decisions.
15.

EPIC also requested “News Media” fee status under the Freedom of Information

Act, based on its status as a “representative of the news media” and previous determinations by
other federal agencies.
The NSA Failed to Provide Records Responsive to EPIC’s FOIA Request
16.

The NSA mailed a response to EPIC dated March 10, 2010 and postmarked March

15, 2010 (“The NSA's Letter”).
17.

The NSA's Letter acknowledged the NSA’s receipt of EPIC’s NSA-Google FOIA

Request, and acknowledged EPIC’s News Media status.
18.

The NSA's Letter cited FOIA exemption b(3) and Section 6 of the National Security

Agency Act, neither confirming nor denying its relationship with Google.
19.

The NSA's Letter contained no records responsive to EPIC's NSA-Google FOIA

Request.
20.

The NSA's Letter failed to respond to the request for expedited processing in EPIC's

NSA-Google FOIA Request.
EPIC Filed an Administrative Appeal with the NSA
21.

On May 7, 2010, more than twenty working days after the NSA received EPIC’s

NSA-Google FOIA Request, EPIC transmitted a written administrative appeal to the NSA (“EPIC’s
Administrative Appeal”).
22.

EPIC’s Administrative Appeal appealed the NSA’s failure to disclose records

responsive to EPIC’s FOIA Request. The agency failed to present factual evidence that the
requested documents fall within Section 6. Furthermore, simple redactions can sufficiently conceal

4

any protected information that does appear on original copies of the requested documents.
The NSA Failed to Respond to EPIC’s Administrative Appeal
23.

Through the date of this pleading, which is filed more than twenty working days

after the NSA received EPIC’s Administrative Appeal, the NSA has not responded to EPIC’s
Administrative Appeal.
24.

Through the date of this pleading, the NSA has failed to produce any documents in

response to EPIC’s FOIA Request.
Count I
Violation of the FOIA: Failure to Comply With Statutory Deadlines
25.

Paragraphs 1-25 above are hereby incorporated by reference as if set forth fully

26.

The NSA’s response to EPIC’s FOIA Request violated the statutory deadlines

herein.

imposed by the FOIA, including the deadlines set forth in 5 U.S.C. § 552(a)(6)(A) (2010).
27.

EPIC has exhausted the applicable administrative remedies with respect to EPIC’s

FOIA Request.
28.

The NSA has wrongly withheld responsive agency records from EPIC.

29.

EPIC is entitled to injunctive relief compelling the release and disclosure of the

requested agency records.
Requested Relief
WHEREFORE, plaintiff prays that this Court:
A.

order defendant to conduct an adequate search for agency records responsive to EPIC’s
NSA-Google FOIA Request within five working days of the date of the Court’s Order in
this matter, with such searching including but not limited to all records concerning an
agreement or similar basis for collaboration between the NSA and Google regarding
5

cyber security;
B.

order defendant to produce all responsive agency records within ten business days of the
Court’s Order in this matter;

C.

award plaintiff its costs and reasonable attorneys’ fees incurred in this action pursuant to
5 U.S.C. § 552(a)(4)(E) (2010); and

D.

grant such other relief as the Court may deem just and proper.

6

Respectfully submitted,
By:

________________________________
Marc Rotenberg, Esquire (DC Bar # 422825)
John Verdi, Esquire (DC Bar # 495764)
Ginger McCall, Esquire (Penn. Bar*#307260)
Conor Kennedy, Esquire**
ELECTRONIC PRIVACY INFORMATION
CENTER
1718 Connecticut Avenue, N.W.
Suite 200
Washington, D.C. 20009
[phone] (telephone)
[phone] (facsimile)

Dated:

*

D.C. bar admission pending.
N.Y. bar admission pending.

**

7