Case3:14-cv-03120 Document1 Filed07/10/14 Page1 of 133

1 BINGHAM MCCUTCHEN LLP Jonathan Loeb (#162758) jonathan.loeb@bingham.com

2

Jeffrey Rosenfeld (#221625) jeffreyrosenfeld@bingham.com Edward Andrews (#268479) edward.andrews@bingham.com

3

The Water Garden, Suite 2050 North 1601 Cloverfield Boulevard

4

Santa Monica, CA 90404-4082 Telephone: 310-907-1000

Facsimile: 310-907-2000 5

AMERICAN CIVIL LIBERTIES UNION FOUNDATION

6 OF NORTHERN CALIFORNIA

Linda Lye (#215584) llye@aclunc.org

7 Julia Harumi Mass (#189649) jmass@aclunc.org 39 Drumm Street

8

San Francisco, CA 94111 Telephone: 415-621-2493

9 Facsimile: 415-255-8437

10

ASIAN AMERICANS ADVANCING JUSTICE - ASIAN LAW CAUCUS

Nasrina Bargzie (#238917) nasrinab@advancingjustice-alc.org

11 Yaman Salahi (#288752) yamans@advancingjustice-alc.org

55 Columbus Avenue

12 San Francisco, CA 94111

Telephone: 415-848-7711

13 Facsimile: 415-896-1702

14

Attorneys for PlaintiffsWiley Gill, James Prigoff, Tariq Razak, Khaled Ibrahim, and Aaron Conklin

15 Additional counsel listed on signature page

16

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

17

SAN FRANCISCO-OAKLAND DIVISION

18

WILEY GILL; JAMES PRIGOFF; TARIQ

19

RAZAK; KHALED IBRAHIM; and AARON CONKLIN,

20 Plaintiffs,

21 v.

22 DEPARTMENT OF JUSTICE; ERIC H. HOLDER, Jr., in his official capacity as the
23 Attorney General of the United States; PROGRAM MANAGER - INFORMATION
24 SHARING ENVIRONMENT; KSHEMENDRA PAUL, in his official capacity as the Program
25 Manager of the Information Sharing Environment,

26 Defend

ants.

27

No. __________________ COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF
Administrative Procedure Act Case

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

Case3:14-cv-03120 Document1 Filed07/10/14 Page2 of 133

1

INTRODUCTION

2

1. This complaint challenges a widespread domestic surveillance program that

3 targets constitutionally protected conduct and encourages racial and religious profiling.

4 Plaintiffs are five United States citizens – two photographers, one white man who is a devout

5 Muslim, and two men of Middle Eastern and South Asian descent. They engaged in innocuous,

6 lawful, and in some cases First Amendment protected activity. Two were photographing sites of

7 aesthetic interest, one was likely viewing a website about video games inside his home, one was

8 buying computers at Best Buy, and another was standing outside a restroom at a train station

9 while waiting for his mother. Due to the standards issued by Defendants that govern the

10 reporting of information about people supposedly involved in terrorism, Plaintiffs were reported

11 as having engaged in “suspicious activities,” reports about them were entered into

12 counterterrorism databases, and they were subjected to unwelcome and unwarranted law

13 enforcement scrutiny and interrogation. Defendants’ unlawful standards for maintaining a

14 federal law enforcement database regarding such supposedly “suspicious” activities have not

15 yielded any demonstrable benefit in the fight against terrorism, but they have swept up innocent

16 Americans in violation of federal law.

17

2. Through the National Suspicious Activity Reporting Initiative (“NSI”), the federal

18 government encourages state and local law enforcement agencies as well as private actors to

19 collect and report information that has a potential nexus to terrorism in the form of so-called

20 Suspicious Activity Reports (“SARs”). SARs are collected and maintained in various

21 counterterrorism databases and disseminated to law enforcement agencies across the country.

22 An individual who is reported in a SAR is flagged as a person with a potential nexus to terrorism

23 and automatically falls under law enforcement scrutiny, which may include intrusive questioning

24 by local or federal law enforcement agents. Even when the Federal Bureau of Investigation

25 concludes that the person did not have any nexus to terrorism, a SAR can haunt that individual

26 for decades, as SARs remain in federal databases for up to 30 years.

27

3. Defendants Department of Justice (“DOJ”) and Program Manager of the

28 Information Sharing Environment (“PM-ISE”) have issued standards governing the types of

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

2

Case3:14-cv-03120 Document1 Filed07/10/14 Page3 of 133

1 information that should be reported in a SAR. Both standards authorize the collection,

2 maintenance, and dissemination of information, in the absence of any reasonable suspicion of

3 criminal activity. Defendants have also identified specific categories of behavior that they claim

4 satisfy each agency’s standard and should be reported as suspicious. These behavioral categories

5 range from the constitutionally protected (photographing infrastructure) to the absurd (“acting

6 suspiciously”).

7

4. Defendants’ standards conflict with a duly promulgated regulation of Defendant

8 DOJ that prohibits the collection, maintenance, and dissemination of criminal intelligence

9 information, unless there is reasonable suspicion of criminal activity. See 28 C.F.R. § 23 (1993).

10 The regulation’s reasonable suspicion requirement reflects the constitutional principle that law

11 enforcement should not take action against someone, unless there is good reason to believe

12 criminal activity is afoot. Neither of Defendants’ standards for reporting suspicious activity was

13 promulgated in accordance with the notice and comment requirements of the Administrative

14 Procedure Act (“APA”), 5 U.S.C. § 551 et seq. (2012). As a result, Defendants’ issuance and

15 implementation of standards for suspicious activity reporting violate federal statutory

16 requirements that agencies not act in an arbitrary and capricious manner and observe the

17 procedures required by law. Through this action for declaratory and injunctive relief, Plaintiffs

18 seek to set aside as unlawful Defendants’ standards for suspicious activity reporting.

19

PARTIES

20

5. Plaintiff Wiley Gill is a United States citizen and a custodian at California State

21 University, Chico (“Chico State”). Mr. Gill converted to Islam while he was a student at Chico

22 State. He resides in Chico, California. He is the subject of a SAR, attached as Appendix A to

23 this Complaint. The SAR was uploaded to eGuardian, a law enforcement database maintained

24 by the FBI. The SAR identifies Mr. Gill as a “Suspicious Male Subject in Possession of Flight

25 Simulator Game.” Mr. Gill was likely viewing a website about video games on his computer at

26 home, when two officers of the Chico Police Department entered and searched his home without

27 voluntary consent or a warrant based on probable cause.

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

3

Case3:14-cv-03120 Document1 Filed07/10/14 Page4 of 133

1

6. Plaintiff James Prigoff is a United States citizen and an internationally renowned

2 photographer of public art. Mr. Prigoff resides in Sacramento, California. Private security

3 guards warned Mr. Prigoff not to photograph a piece of public art called the “Rainbow Swash” in

4 Boston, Massachusetts. As a result of that encounter, an agent of the Federal Bureau of

5 Investigation (“FBI”) went to Mr. Prigoff’s home in Sacramento several months later and

6 questioned at least one neighbor about him. Upon information and belief, Mr. Prigoff is the

7 subject of a SAR or SAR precursor report.

8

7. Plaintiff Khaled Ibrahim is a United States citizen of Egyptian descent who works

9 as an accountant for Nordix Computer Corporation, a computer network consulting and service

10 company. He formerly worked as a purchasing agent for Nordix. Mr. Ibrahim resides in San

11 Jose, California. Mr. Ibrahim is the subject of a SAR, attached as Appendix B to the Complaint.

12 The SAR describes a “[s]uspicious attempt to purchase large number of computers.” Mr.

13 Ibrahim attempted to make a bulk purchase of computers from a Best Buy retail store in Dublin,

14 California, in his capacity as a purchasing agent for Nordix. The SAR was uploaded to

15 eGuardian, a law enforcement database maintained by the FBI. Dublin is located in Alameda

16 County, California.

17

8. Plaintiff Tariq Razak is a United States citizen of Pakistani descent. A graduate

18 of the University of California at Irvine, he works in the bio-tech industry. Mr. Razak resides in

19 Placentia, California. Mr. Razak is the subject of a SAR, attached as Appendix C to this

20 Complaint. The SAR identifies Mr. Razak as a “Male of Middle Eastern decent [sic] observed

21 surveying entry/exit points” at the Santa Ana Train Depot and describes him as exiting the

22 facility with “a female wearing a white burka head dress.” Mr. Razak had never been to the

23 Depot before and was finding his way to the county employment resource center, which is

24 located inside the Depot and where he had an appointment. The woman accompanying him was

25 his mother.

26

9. Plaintiff Aaron Conklin is a graphic design student and amateur photographer.

27 He resides in Vallejo, California. Private security guards have twice prevented Mr. Conklin

28 from taking photographs of industrial architecture from public locations. One such incident

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

4

Case3:14-cv-03120 Document1 Filed07/10/14 Page5 of 133

1 occurred outside the Shell refinery in Martinez, California, and resulted in Mr. Conklin being

2 detained and having his camera and car searched by Contra Costa County Sheriff’s Deputies,

3 who told Mr. Conklin that he would be placed on an “NSA watchlist.” Upon information and

4 belief, Mr. Conklin is the subject of a SAR. Martinez is located in Contra Costa County,

5 California.

6

10. Defendant DOJ is a federal agency within the meaning of the APA, 5 U.S.C. §

7 551(1). DOJ, through its components, has issued a standard governing SAR reporting, conducts

8 trainings on that standard, and plays a major role in implementing the NSI.

9

11. The FBI is a component of DOJ with both intelligence and law enforcement

10 responsibilities. The FBI has issued a standard governing the reporting of SARs, and trains law

11 enforcement and private sector personnel on its SAR reporting standard. The FBI oversees and

12 maintains the eGuardian system, which serves as a repository for SARs and allows thousands of

13 law enforcement personnel and analysts across the country to access SARs in the eGuardian

14 system. The FBI is one of the primary entities responsible for the NSI.

15

12. The Office of Justice Programs (“OJP”) was created pursuant to 42 U.S.C. § 3711

16 (2012) and is a component of Defendant DOJ. OJP administers grants to state and local law

17 enforcement entities. Upon information and belief, OJP funding supports, among other things,

18 entities that engage in the collection, maintenance, and dissemination of SARs, and systems that

19 collect, maintain, and disseminate SARs.

20

13. The Bureau of Justice Assistance (“BJA”), within OJP, provides assistance to

21 local criminal justice programs through policy, programming, and planning. BJA served as the

22 executive agent of the NSI until October 2013. BJA has issued a standard governing the

23 reporting of SARs, and conducts trainings on its SAR reporting standard.

24

14. The Program Management Office (“PMO”), also a component of DOJ, has played

25 a key role in implementing the NSI. On December 17, 2009, DOJ was named the executive

26 agent to establish and operate the PMO for the NSI. In March 2010, DOJ established the NSI

27 PMO within BJA to support nationwide implementation of the SAR process.

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

5

Case3:14-cv-03120 Document1 Filed07/10/14 Page6 of 133

1

15. Defendant Eric Holder is the Attorney General of the United States and as the

2 head of DOJ is responsible for the regulations, guidelines, and standards adopted by DOJ. He is

3 sued in his official capacity.

4

16. Defendant PM-ISE is a federal agency within the meaning of the APA, 5 U.S.C. §

5 551(1) (2012). Pursuant to the Intelligence Reform and Terrorism Prevention Act of 2004

6 (“IRTPA”), PM-ISE is charged with issuing uniform standards for sharing terrorism and

7 homeland security information across federal, state, and local governments. 6 U.S.C. § 485

8 (2012). PM-ISE has issued a standard governing SAR reporting and conducts trainings on that

9 standard. PM-ISE’s standard for SAR reporting is set forth in “Information Sharing

10 Environment (ISE) - Functional Standard (FS) - Suspicious Activity Reporting (SAR) Version

11 1.5” (“Functional Standard 1.5”), which the agency issued in May 2009. Functional Standard

12 1.5 is attached as Appendix D to this Complaint.

13

17. Defendant Kshemendra Paul occupies the office of the PM-ISE, is the head of

14 PM-ISE, and is responsible for the regulations, guidelines, and standards adopted by PM-ISE.

15 He is sued in his official capacity.

16

JURISDICTION AND VENUE

17

18. This is an action under the APA, to set aside agency actions because they are

18 arbitrary and capricious, an abuse of discretion, and not in accordance with law, and because

19 they are without observance of procedure required by law. See 5 U.S.C. § 706 (2)(A), (D)

20 (2012). This Court has subject matter jurisdiction pursuant to 28 U.S.C. § 1331 and § 1349

21 (2012).

22

19. The Court has authority to grant declaratory relief pursuant to the Declaratory

23 Judgment Act, 28 U.S.C. § 2201 and § 2202 (2012).

24

20. Venue is proper in this district pursuant to 28 U.S.C. § 1391(e) (2012) because

25 Defendants are agencies of the United States and officers of the United States sued in their

26 official capacities, a substantial part of the events or omissions giving rise to this action occurred

27 in this district, including Alameda and Contra Costa Counties, and one or more plaintiffs reside

28 in this district.

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

6

Case3:14-cv-03120 Document1 Filed07/10/14 Page7 of 133

1

INTRADISTRICT ASSIGNMENT

2

21. Pursuant to Local Rule 3-2(c) and (d), assignment to the San Francisco-Oakland

3 Division is proper because a substantial part of the events giving rise to this action occurred in

4 Alameda and Contra Costa Counties.

5

FACTUAL ALLEGATIONS

6 A. The Nationwide Suspicious Activity Reporting Initiative

7

22. The federal government created the NSI to facilitate the sharing of information

8 potentially related to terrorism across federal, state, local, and tribal law enforcement agencies.

9 In particular, the NSI creates the capability to share reports of information with a potential nexus

10 to terrorism, which have been dubbed Suspicious Activity Reports.

11

23. Fusion centers are focal points of the system for sharing SARs. There are

12 currently 78 fusion centers nationwide. They are generally, though not always, owned and

13 operated by state or local government entities. Fusion centers receive federal financial support,

14 including from OJP.

15

24. Defendants PM-ISE and DOJ train state, local, and tribal law enforcement

16 agencies as well as private entities to collect information about activities with a potential nexus

17 to terrorism based on the standard each agency has adopted, and to submit the information in the

18 form of a SAR, either to a fusion center or the FBI.

19

25. Fusion centers gather, receive, store, analyze, and share terrorism and other

20 threat-related information, including SARs. On information and belief, fusion centers collect,

21 maintain, and disseminate SARs through databases that receive financial support from OJP.

22

26. Defendants train fusion center analysts in their respective standards for SAR

23 reporting. Fusion center analysts review submitted SARs. If a SAR meets Defendants’

24 standards, it is uploaded to one or more national databases, such as the FBI’s eGuardian system,

25 where it can be accessed by the FBI and law enforcement agencies across the country. The

26 federal government maintains SARs sent to the FBI’s eGuardian system for 30 years. This is

27 done even when the FBI determines that the SAR has no nexus to terrorism. See Functional

28 Standard 1.5 at 34, 53; United States Government Accountability Office, “Information Sharing:

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

7

Case3:14-cv-03120 Document1 Filed07/10/14 Page8 of 133

1 Additional Actions Could Help Ensure That Efforts to Share Terrorism-Related Suspicious

2 Activity Reports Are Effective” at 7 (March 2013) (“GAO SAR Report”).

3

27. Pursuant to the process created by Defendants PM-ISE and DOJ for suspicious

4 activity reporting, individuals who are the subject of a SAR are automatically subjected to law

5 enforcement scrutiny at multiple levels of government. That scrutiny may include, but is not

6 limited to, follow-up interviews and other forms of investigation by law enforcement. For

7 example:

8

(a) At the initial response and investigation stage, and even before a SAR is

9

submitted to a fusion center or the FBI, Defendant PM-ISE instructs the federal,

10

state, local, or tribal law enforcement agency with jurisdiction to respond to the

11

reported observation by “gather[ing] additional facts through personal

12

observations, interviews, and other investigative activities. This may, at the

13

discretion of the [responding] official, require further observation or engaging the

14

suspect in conversation.” Functional Standard 1.5 at 32.

15

(b) Fusion center personnel “tak[e] steps to investigate SARs – such as

16

interviewing the individual engaged in suspicious activity or who witnessed

17

suspicious activity – before providing the SARs to the FBI.” GAO SAR Report at

18

16. Officials from fusion centers do investigative work as part of their vetting

19

process. Id. at 17.

20

(c) The FBI reviews all SARs that it receives from fusion centers for follow-up.

21

That follow-up can take the form of an interview with the subject of the SAR, and

22

includes, but is not limited to, engaging in a threat assessment of or opening an

23

investigation into the subject.

24

(d) FBI agents have admitted that they are required to follow-up on SARs, even

25

when they know the individual does not pose a threat. For example, a

26

professional freelance photographer in Los Angeles, California who specializes in

27

industrial photography, has twice been interviewed by the FBI after

28

photographing industrial sites. After security guards instructed him not to

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

8

Case3:14-cv-03120 Document1 Filed07/10/14 Page9 of 133

1

photograph certain industrial sites in the area of the Port of Long Beach in April

2

2008, FBI agents visited him at his home to question him about the incident. The

3

FBI contacted him again, after Los Angeles Sheriff’s Department personnel

4

interfered with his efforts to photograph another industrial site in approximately

5

December 2009. The FBI agent told the photographer that he knew the

6

photographer did not pose a threat but that because a report had been opened, he

7

was required to follow-up on it.

8

(e) As explained above, SARs that have been uploaded to a national database can

9

be accessed by law enforcement agencies nationwide. Once uploaded to a

10

national database, the subject of a SAR faces scrutiny and potential investigation

11

by one or more of the law enforcement agencies across the country that has access

12

to the database. That scrutiny is only increasing, as queries of national SAR

13

databases have dramatically jumped in recent years. The number of queries of

14

national SAR databases such as eGuardian has risen from about 2,800 queries as

15

of July 2010 to more than 71,000 queries as of February 2013. See GAO SAR

16

Report at 36.

17

28. This surveillance program has not proven effective in the fight against terrorism.

18 The United States Government Accountability Office (“GAO”) has faulted the program for

19 failing to demonstrate any results-oriented outcomes, such as arrests, convictions, or thwarted

20 threats, even though tens of thousands of SARs had been deemed sufficiently significant to be

21 uploaded to national SAR databases as of October 2012. See GAO SAR Report at 33, 36-38. In

22 2012, a Senate Subcommittee reviewed a year of similar intelligence reporting from state and

23 local authorities, and identified “dozens of problematic or useless” reports “potentially violating

24 civil liberties protections.” United States Senate, Permanent Subcommittee on Investigations,

25 Committee on Homeland Security and Governmental Affairs, “Federal Support for and

26 Involvement in State and Local Fusion Centers,” October 3, 2012 at 27. Another report, co-

27 authored by Los Angeles Police Department Deputy Chief Michael Downing, found that SARs

28 have “flooded fusion centers, law enforcement, and other security entities with white noise.”

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

9

Case3:14-cv-03120 Document1 Filed07/10/14 Page10 of 133

1 The George Washington University Homeland Security Policy Institute, “Counterterrorism

2 Intelligence: Fusion Center Perspectives,” June 26, 2012 at 31.

3

29. While the SARs process has not proven effective in combating terrorism, it has

4 been extremely effective in sweeping up innocent Americans and recording their lawful activity

5 in federal counterterrorism databases. Over 1,800 SARs from fusion centers in California show

6 that the program targets First Amendment protected activity such as photography and encourages

7 racial and religious profiling. Examples of SARs that met Defendants’ standards for SAR

8 reporting and have been uploaded to the FBI’s eGuardian database include:

9

x “Suspicious ME [Middle Eastern] Males Buy Several Large Pallets of Water”

10

x A sergeant from the Elk Grove Police Department reported “on a suspicious

11

individual in his neighborhood”; the sergeant had “long been concerned about a

12

residence in his neighborhood occupied by a Middle Eastern male adult physician

13

who is very unfriendly”

14

x “Female Subject taking photos of Folsom Post Office”

15

x “an identified subject was reported to be taking photographs of a bridge crossing

16

the American River Bike trail”

17

x “I was called out to the above address regarding a male who was taking

18

photographs of the [name of facility blacked out] [in Commerce, California]. The

19

male stated, he is an artist and enjoys photographing building[s] in industrial

20

areas … [and] stated he is a professor at San Diego State private college, and

21

takes the photos for his art class.”

22

x “I observed a male nonchalantly taking numerous pictures inside a purple line

23

train [in Los Angeles County] … The male said he was taking pictures because

24

they were going to film the television show ‘24’ on the train next week.”

25

x “two middle eastern looking males taking photographs of Folsom Dam. One of

26

the ME males appeared to be in his 50’s”

27

x “Suspicious photography of the Federal Courthouse in Sacramento”: an “AUSA

28

[Assistant United States Attorney] reported to the Court Security Officer (CSO) a

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

10

Case3:14-cv-03120 Document1 Filed07/10/14 Page11 of 133

1

suspicious vehicle occupied by what [name blacked out] described as two Middle

2

Eastern males, the passenger being between 40-50 years of age.”

3

x “Suspicious photography of Folsom Dam by Chinese Nationals”: “a Sac County

4

Sheriff's Deputy contacted 3 adult Asian males who were taking photos of

5

Folsom Dam. They were evasive when the deputy asked them for identification

6

and said their passports were in their vehicle.”

7 B. Conflicting Federal Rules for Collection of Intelligence Information

8

30. Defendants have issued three separate rules governing the collection of

9 intelligence information, in particular, suspicious activity reports. Only one of these rules,

10 however, requires reasonable suspicion of criminal activity for the information to be collected,

11 maintained, and disseminated, and only that rule was duly promulgated under the APA.

12

1. 28 C.F.R. Part 23

13

31. On June 19, 1968, President Lyndon B. Johnson signed into law the Omnibus

14 Crime Control and Safe Streets Act of 1968 (“Omnibus Act”). The Act created the Law

15 Enforcement Administration Agency (“LEAA”), a forerunner to OJP and a component of DOJ,

16 and authorized it to oversee the distribution of federal grants to state and local law enforcement

17 programs.

18

32. In 1978, after observing the notice and comment process set forth in the APA,

19 Defendant DOJ, through its component the LEAA, published a final rule establishing operating

20 principles for “Criminal Intelligence Systems.” See 28 C.F.R. § 23 (1993). The regulation was

21 promulgated pursuant to the LEAA’s statutory mandate to ensure that criminal intelligence is not

22 collected, maintained, or disseminated “in violation of the privacy and constitutional rights of

23 individuals.” 42 U.S.C. § 3789g(c) (2012).

24

33. Several commenters on the then-proposed regulation “were concerned that the

25 collection and maintenance of intelligence information should only be triggered by a reasonable

26 suspicion that an individual is involved in criminal activity.” See 43 Fed. Reg. 28,572 (June 30,

27 1978). The agency concurred, and the proposed operating principles were “revised to require

28 this criteria as a basis for collection and maintenance of intelligence information.” Id.

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

11

Case3:14-cv-03120 Document1 Filed07/10/14 Page12 of 133

1

34. Among other requirements, the final rule provides that a “project shall collect and

2 maintain criminal intelligence information concerning an individual only if there is reasonable

3 suspicion that the individual is involved in criminal conduct or activity and the information is

4 relevant to that criminal conduct or activity.” 28 CFR § 23.20(a).

5

35. In addition, the regulation states that while “pooling of information about” various

6 kinds of criminal activities such as drug trafficking, smuggling, and public corruption can be

7 helpful in “expos[ing] … ongoing networks of criminal activity,” “the collection and exchange

8 of intelligence data necessary to support control of serious criminal activity may represent

9 potential threats to the privacy of individuals to whom such data relates,” and the privacy

10 guidelines set forth in 28 CFR Part 23 are therefore necessary. 28 CFR § 23.2.

11

36. In 1980, DOJ amended the rule, following the public notice and comment process

12 set forth in the APA, to extend the reach of 28 C.F.R. Part 23 to criminal intelligence systems

13 funded by both discretionary and formula grants. 45 Fed. Reg. 61,612 (Sep. 17, 1980).

14

37. DOJ amended the rule again in 1993 to include a definition of “reasonable

15 suspicion”:

16

Reasonable Suspicion . . . is established when information exists which establishes

sufficient facts to give a trained law enforcement or criminal investigative agency officer,

17

investigator, or employee a basis to believe that there is a reasonable possibility that an

individual or organization is involved in a definable criminal activity or enterprise. 18

See 28 C.F.R. § 23.20.

19

38. “Reasonable suspicion” is the time-tested, constitutional standard that limits law

20

enforcement from taking action against someone, unless there is good reason to believe criminal

21

activity is afoot.

22

39. One commenter argued that “reasonable suspicion . . . is not necessary to the

23

protection of individual privacy and Constitutional rights, [and suggested] instead that

24

information in a funded intelligence system need only be ‘necessary and relevant to an agency’s

25

lawful purposes.’” 58 Fed. Reg. 178, 48451 (Sept. 16, 1993). The agency disagreed, replying:

26

the potential for national dissemination of information in intelligence information

27

systems, coupled with the lack of access by subjects to challenge the information,

justifies the reasonable suspicion standard as well as other operating principle restrictions

28

set forth in this regulation. Also, the quality and utility of ‘hits’ in an information system

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

12

Case3:14-cv-03120 Document1 Filed07/10/14 Page13 of 133

1

is enhanced by the reasonable suspicion requirement. Scarce resources are not wasted by agencies in coordinating information on subjects for whom information is vague,

incomplete and conjectural. 2

Id.

3

40. DOJ made an attempt in 2008 to amend the regulation to weaken its privacy

4

protections. In particular, the proposed rule would have (1) permitted information to be stored

5

regarding organizations as well as individuals; (2) allowed information to be stored based on

6

reasonable suspicion related to “domestic and international terrorism, including material support

7

thereof,” and (3) eliminated the requirement that law enforcement agencies receiving information

8

from a Criminal Intelligence System agree to comply with 28 C.F.R. Part 23, so that recipients

9

would merely need to have procedures “consistent with” Section 23. See 73 Fed. Reg. 44,674

10

(July 31, 2008). This attempted rulemaking, however, met with criticism and DOJ withdrew its

11

proposed rule. The regulation has remained unchanged since its last amendment in 1993.

12

41. In short, in initially adopting the regulation, DOJ emphasized the importance of

13

the reasonable suspicion requirement and since then has expanded the scope of the regulation,

14

reiterated the importance of the reasonable suspicion requirement, and withdrawn efforts to

15

weaken the regulation’s privacy protections.

16

2. PM-ISE Standard for Suspicious Activity Reporting

17

42. Defendant PM-ISE subsequently issued a standard for SAR reporting that –

18

unlike 28 CFR Part 23 – does not require reasonable suspicion of criminal activity before a

19

suspicious activity report is collected, maintained, or disseminated and was not issued through

20

the notice and comment procedure required by the APA, thus dodging public review.

21

43. Pursuant to the exercise of its statutory authority to “exercise governmentwide

22

authority over the sharing of [terrorism and homeland security] information,” 6 U.S.C. §

23

485(f)(1) (2012), PM-ISE has issued “Functional Standards” governing suspicious activity

24

reporting.

25

44. In or about May 2009, PM-ISE released Information Sharing Environment (ISE) -

26

Functional Standard (FS) - Suspicious Activity Reporting (SAR) Version 1.5 (“Functional

27

Standard 1.5”), which remains currently in effect. It sets forth the following standard for

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

13

Case3:14-cv-03120 Document1 Filed07/10/14 Page14 of 133

1 suspicious activity reporting: “[o]bserved behavior reasonably indicative of pre-operational

2 planning related to terrorism or other criminal activity.” Functional Standard 1.5 at 2 (emphasis

3 added).

4

45. The agency has expressly acknowledged that Functional Standard 1.5 requires

5 “less than the ‘reasonable suspicion’ standard.” PM-ISE, Privacy, Civil Rights, and Civil

6 Liberties Analysis and Recommendations–Nationwide Suspicious Activity Reporting Initiative

7 at 12 (draft May 2010).

8

46. The document also identifies sixteen categories of activity that fall under the

9 standard and provide a guide to law enforcement in determining what amounts to a suspicious

10 activity. These categories include photography, observation/surveillance, and acquisition of

11 materials or expertise. Functional Standard 1.5 at 29-30.

12

47. Functional Standard 1.5 applies to, inter alia, “all departments or agencies that

13 possess or use terrorism or homeland security information.” Functional Standard 1.5 at 1.

14 Functional Standard 1.5 applies to state, local, and tribal law enforcement agencies and fusion

15 centers that participate in the NSI. Agencies participating in the NSI follow Functional Standard

16 1.5 in reporting suspicious activity.

17

48. Functional Standard 1.5 purports to define the scope of suspicious activity that

18 should be reported for agencies participating in the NSI. The purpose of Functional Standard 1.5

19 is to standardize SAR reporting at the federal, state, and local levels.

20

49. PM-ISE trains participants in the NSI about, among other things, how to follow

21 Functional Standard 1.5.

22

50. In promulgating Functional Standard 1.5, PM-ISE expressly cited its legislative

23 authority under, inter alia, the IRTPA over governmentwide standards for information sharing.

24 Functional Standard 1.5 at 1.

25

51. Functional Standard 1.5 constitutes final agency action and a legislative rule

26 within the meaning of the APA.

27

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

14

Case3:14-cv-03120 Document1 Filed07/10/14 Page15 of 133

1

52. PM-ISE issued Functional Standard 1.5 without observing the process set forth in

2 the APA for public notice and comment. Functional Standard 1.5 went into immediate effect

3 upon its publication on May 1, 2009 and remains currently in effect.

4

3. DOJ Standard for Suspicious Activity Reporting

5

53. Defendant DOJ, through its components, has issued a standard for SAR reporting

6 (“DOJ’s SAR Standard”) that – unlike 28 CFR § 23 – does not require reasonable suspicion of

7 criminal activity before a suspicious activity report is collected, maintained, or disseminated and

8 was not issued through the notice and comment procedure required by the APA, thus dodging

9 public review.

10

54. DOJ, through its component the FBI, has set forth the following standard for

11 suspicious activity reporting: “observed behavior that may be indicative of intelligence gathering

12 or pre-operational planning related to terrorism, criminal or other illicit intention.” FBI, Privacy

13 Impact Assessment for the eGuardian Threat Tracking System at § 1.1 (emphasis added). This

14 standard is set forth in the FBI’s 2008 eGuardian Privacy Impact Assessment (“2008 eGuardian

15 PIA”), which is attached as Appendix E to this Complaint. “[T]he FBI uses the criteria in the

16 eGuardian Privacy Impact Assessment (dated November 25, 2008) … to determine if SARs have

17 a potential nexus to terrorism.” GAO SAR Report at 6 n.10.

18

55. DOJ’s “may be indicative” SAR Standard is even broader than PM-ISE’s

19 “reasonably indicative” Functional Standard 1.5. See GAO SAR Report at 15-16. But like

20 Functional Standard 1.5, DOJ’s SAR Standard encourages reporting even in the absence of

21 reasonable suspicion of criminal activity.

22

56. Just as Defendant PM-ISE has enumerated categories of behavior that fall under

23 its “reasonably indicative” reporting standard, DOJ through its components has also enumerated

24 categories of behavior that fall under its “may be indicative” reporting standard. These

25 categories of behavior are broader than the categories set forth in Functional Standard 1.5 and

26 include but are not limited to:

27

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

15

Case3:14-cv-03120 Document1 Filed07/10/14 Page16 of 133

1

(a) “Possible indicators of terrorist behaviors at hotels:…” FBI and United States

2

Department of Homeland Security, “Roll Call Release,” July 26, 2010, attached as

3

Appendix F to this Complaint.

4

(1) “Using payphones for outgoing calls or making front desk requests in

5

person to avoid using the room telephone.” Id.

6

(2) “Interest in using Internet cafes, despite hotel Internet availability….”

7

Id.

8

(3) “Requests for specific rooms, floors, or other locations in the

9

hotel….” Id.

10

(4) “Multiple visitors or deliveries to one individual or room.” Id.

11

(b) “No obvious signs of employment.” FBI, “Quick Reference Terrorism Card,”

12

attached as Appendix G to this Complaint.

13

(c) “Possess student visa but not English Proficient.” Id.

14

(d) “Persons not fitting into the surrounding environment, such as wearing

15

improper attire for the location.” Id.

16

(e) “Persons exhibiting unusual behavior such as staring or quickly looking away

17

from individuals or vehicles as they enter or leave designated facilities or

18

parking areas.” Id.

19

(f) “A blank facial expression in an individual may be indicative of someone

20

concentrating on something not related to what they appear to be doing.” Id.

21

(g) “[P]eople in places where they do not belong.” Bureau of Justice Assistance,

22

“Communities Against Terrorism: Potential Indicators of Terrorist Activities

23

Related to the General Public,” attached as Appendix H to this Complaint.

24

57. One category of behavior identified by DOJ as “suspicious” activity that should

25 be reported is a “catch-all”:

26

(a) “[P]eople acting suspiciously.” Id.

27

58. DOJ through its components has also issued “Potential Indicators of Terrorist

28 Activities Related to Electronic Stores” (attached as Appendix I to this Complaint) and

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

16

Case3:14-cv-03120 Document1 Filed07/10/14 Page17 of 133

1 “Potential Indicators of Terrorist Activities Related to Mass Transportation” (attached as

2 Appendix J to this Complaint). Activities identified as suspicious in connection with mass

3 transportation include “[a]cting nervous or suspicious,” and “[u]nusual or prolonged interest in

4 … entry points and access controls.”

5

59. DOJ through its components trains participants in the NSI about DOJ’s SAR

6 Standard. For example, as of 2013, the PMO had provided training for 290,000 line officers (law

7 enforcement officers whose routine duties put them in a position to observe “suspicious”

8 activity), 2,000 analytical personnel, and executives from 77 fusion centers. See GAO SAR

9 Report at 29. DOJ components teach participants in the NSI, including frontline officers and

10 fusion center analysts to submit to the FBI “all potentially terrorism-related information and not

11 just ISE-SARs that met the [PM-ISE’s] Functional Standard [1.5].” GAO SAR Report at 16.

12

60. DOJ’s SAR Standard applies to state, local, and tribal law enforcement agencies

13 and fusion centers that participate in the NSI. Agencies participating in the NSI follow DOJ’s

14 SAR Standard in reporting suspicious activity.

15

61. DOJ’s SAR Standard purports to define the scope of suspicious activity that

16 should be reported for agencies participating in the NSI. The purpose of DOJ’s SAR Standard is

17 to standardize SAR reporting at the federal, state, and local levels.

18

62. Because DOJ’s SAR Standard is broader than PM-ISE’s Functional Standard 1.5

19 and DOJ’s behavioral categories include the catch-all “people acting suspiciously,” any activity

20 that falls under PM-ISE’s Functional Standard also falls under DOJ’s SAR Standard.

21

63. Fusion centers that follow DOJ’s SAR Standard instead of PM-ISE’s Functional

22 Standard 1.5 send many SARs to the FBI for review. For example, of the SARs uploaded by one

23 state’s fusion center to a national SAR database from June 2011 to October 2012, only 10% met

24 PM-ISE’s Functional Standard 1.5. See GAO SAR Report at 16.

25

64. DOJ establishes an even broader standard than the already overbroad Functional

26 Standard 1.5, and the DOJ reinforces its broader standard through the trainings it provides to NSI

27 participants and through other mechanisms. For example, when fusion center personnel are

28 uncertain whether to share a SAR, DOJ encourages them to err on the side of overreporting. See

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

17

Case3:14-cv-03120 Document1 Filed07/10/14 Page18 of 133

1 GAO SAR Report at 16. In addition, the only feedback mechanism participants in the NSI

2 currently receive on whether they are reporting SARs appropriately is provided by the FBI

3 through its eGuardian system. See GAO SAR Report at 13-14. The feedback the FBI provides

4 reinforces the DOJ SAR Standard to NSI participants.

5

65. DOJ’s 2008 eGuardian PIA, which sets forth the agency’s standard for reporting

6 suspicious activity, was signed by four “Responsible Officials,” two “Reviewing Officials,” and

7 one “Approving Official.” It reflects the consummation of the agency’s decision making

8 process.

9

66. DOJ’s 2008 eGuardian PIA contains a set of mandatory, non-discretionary rules

10 and obligations. It lays out clear instructions for the use of the eGuardian system to collect and

11 share SARs and the standard for defining “suspicious activity.” For example, the 2008

12 eGuardian PIA states that the eGuardian system will “ensure consistency of process and of

13 handling protocols” and mandates that all users “will be required to complete robust system

14 training that will incorporate eGuardian policies and procedures.” 2008 eGuardian PIA at 4. In

15 addition, the eGuardian User Agreement, attached to the 2008 eGuardian PIA, states that

16 “[i]ncidents not meeting the criteria of suspicious activity or with a potential nexus to terrorism

17 and that, further, do not comply with the above-stated rules, will be immediately deleted from

18 eGuardian.” 2008 eGuardian PIA at 25.

19

67. DOJ has consistently reinforced its standard for SAR reporting, set forth in the

20 2008 eGuardian PIA, through training materials and other publications that identify categories of

21 behavior that the agency contends are suspicious and should be reported.

22

68. In promulgating DOJ’s SAR Standard, DOJ expressly invoked its statutory

23 “mandate” under IRTPA and “other statutes … to share terrorism information with other federal,

24 and state, local and tribal (SLT) law enforcement partners.” 2008 eGuardian PIA at 2.

25

69. DOJ’s SAR Standard constitutes final agency action and a legislative rule within

26 the meaning of the APA.

27

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

18

Case3:14-cv-03120 Document1 Filed07/10/14 Page19 of 133

1

70. Defendant DOJ issued the DOJ SAR Standard without observing the process set

2 forth in the APA for public notice and comment. It is the DOJ Standard for SAR reporting

3 currently in effect.

4

4. PM-ISE’s Functional Standard 1.5 and DOJ’s SAR Standard Conflict with

5

28 CFR Part 23

6

71. As a report of “[o]bserved behavior reasonably indicative of pre-operational

7 planning related to terrorism or other criminal activity” (Functional Standard 1.5) or a report of

8 “observed behavior that may be indicative of intelligence gathering or pre-operational planning

9 related to terrorism, criminal or other illicit intention” (DOJ’s SAR Standard), a SAR contains

10 data relevant to the identification of an individual who is suspected in some fashion of being

11 involved in criminal, in particular, terrorist activity.

12

72. A SAR constitutes “criminal intelligence” within the meaning of 28 CFR Part 23.

13

73. State, local, and tribal law enforcement agencies and fusion centers that

14 participate in the NSI and observe PM-ISE’s Functional Standard 1.5 and/or DOJ’s SAR

15 Standard collect, review, analyze, and disseminate SARs. These entities operate arrangements,

16 equipment, facilities, and procedures, used for the receipt, storage, interagency exchange or

17 dissemination, and analysis of SARs. Upon information and belief, these entities and the

18 systems they operate for receiving, storing, exchanging, disseminating, and analyzing SARs

19 operate through support from Defendant DOJ’s component OJP.

20

74. State, local, and tribal law enforcement agencies and fusion centers that

21 participate in the NSI and observe PM-ISE’s Functional Standard 1.5 and/or DOJ’s SAR

22 Standard are “projects” within the meaning of 28 CFR Part 23. The systems or databases on

23 which SARs are maintained and through which they are collected and disseminated are “criminal

24 intelligence systems” within the meaning of 28 CFR Part 23.

25

75. PM-ISE’s Functional Standard 1.5 and DOJ’s SAR Standard set forth operating

26 principles for the collection, maintenance, and dissemination of data relevant to the identification

27 of an individual who is suspected in some fashion of being involved in criminal, in particular,

28 terrorist activity. Both standards, however, encourage or purport to authorize collection,

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

19

Case3:14-cv-03120 Document1 Filed07/10/14 Page20 of 133

1 maintenance, and dissemination of such data even in the absence of reasonable suspicion of

2 criminal activity. Both standards encourage or purport to authorize collection, maintenance, and

3 dissemination of much more data than that permitted under 28 CFR Part 23. Both standards

4 therefore conflict with 28 CFR Part 23.

5

76. Through PM-ISE’s promulgation of Functional Standard 1.5 and DOJ’s

6 promulgation of its SAR Standard, and through each agency’s training of entities participating in

7 the NSI in their respective standards for reporting suspicious activity, Defendants PM-ISE, Paul,

8 DOJ, and Holder have undermined and thereby violated 28 CFR Part 23.

9

77. Neither DOJ nor PM-ISE has offered any reasoned basis for departing from the

10 reasonable suspicion standard set forth in 28 CFR Part 23 for the collection, maintenance, and

11 dissemination of SARs.

12

78. DOJ could rescind its SAR reporting standard. If DOJ rescinded its SAR

13 reporting standard, participants in the NSI would cease collecting, maintaining, reviewing,

14 analyzing and disseminating SARs based on DOJ’s SAR Standard, and it would be clear that the

15 governing standard for suspicious activity reporting is 28 CFR Part 23. As a result, individuals

16 who are currently the subject of SARs but whose conduct did not give rise to a reasonable

17 suspicion of criminal activity would no longer have their information collected, maintained, and

18 disseminated in SAR databases. DOJ could cease collecting, maintaining, reviewing, analyzing,

19 and disseminating SARs about individuals whose conduct did not give rise to a reasonable

20 suspicion of criminal activity.

21

79. PM-ISE could rescind Functional Standard 1.5. If PM-ISE rescinded Functional

22 Standard 1.5, participants in the NSI would cease collecting, maintaining, reviewing, analyzing

23 and disseminating SARs based on Functional Standard 1.5, and it would be clear that the

24 governing standard for suspicious activity reporting is 28 CFR Part 23. As a result, individuals

25 who are currently the subject of SARs but whose conduct did not give rise to a reasonable

26 suspicion of criminal activity would no longer have their information collected, maintained, and

27 disseminated in SAR databases.

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

20

Case3:14-cv-03120 Document1 Filed07/10/14 Page21 of 133

1 C. P laintiff’s Allegations

2

1. Wiley Gill

3

80. Wiley Gill is a United States citizen living in Chico, California. He works as a

4 custodian at Chico State, which he attended as an undergraduate. Mr. Gill converted to Islam in

5 2009, after learning about the religion in a course he took while a student at Chico State.

6

81. Mr. Gill is the subject of a SAR that identifies him as a “Suspicious Male Subject

7 in Possession of Flight Simulator Game.” This SAR falls into one or more of the behavioral

8 categories identified in Functional Standard 1.5, in particular, “[a]cquisition of [e]xpertise” and

9 potentially “[a]viation [a]ctivity.” Functional Standard 1.5 at 29-30. It also falls under one or

10 more behavioral categories identified by Defendant DOJ, such as the catch-all behavioral

11 category of “acting suspiciously.”

12

82. Mr. Gill’s SAR was collected, maintained, and disseminated through a fusion

13 center SAR database, and uploaded to eGuardian and/or another national SAR database. As a

14 result, the FBI has scrutinized Mr. Gill, conducted extensive background checks on him, and

15 created a file about him.

16

83. The SAR was created on or about May 23, 2012, and purports to document an

17 encounter between Mr. Gill and the Chico Police Department (“CPD”) on or about May 20,

18 2012. The SAR states that a CPD officer was investigating a domestic violence incident and

19 believed the suspect may have fled into Mr. Gill’s residence. The SAR states that this was later

20 discovered to be unfounded. It acknowledges that the CPD officer searched Mr. Gill’s home.

21 The SAR asserts that Mr. Gill’s computer displayed a screen titled something to the effect of

22 “Games that fly under the radar,” which appeared to be a “flight simulator type of game.” The

23 SAR concludes by describing Mr. Gill’s “full conversion to Islam as a young WMA [white, male

24 adult],” “pious demeanor,” and “potential access to flight simulators via the internet” as “worthy

25 of note.”

26

84. CPD’s search of Mr. Gill’s residence on or about May 20, 2012 did in fact occur.

27 But the SAR contains numerous misstatements and omits several crucial facts, including that two

28 CPD officers banged on Mr. Gill’s door and after when he went to open it, they came around the

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

21

Case3:14-cv-03120 Document1 Filed07/10/14 Page22 of 133

1 corner of the house with their guns drawn and pointed at Mr. Gill. Mr. Gill was thrown off

2 guard. The officers eventually lowered their guns, and then asked to search Mr. Gill’s home,

3 based on the alleged domestic violence incident involving two individuals that they claimed to

4 have received. Mr. Gill informed the officers that he was home alone. Despite that, the officers

5 continued to ask to search his home. Mr. Gill was reluctant to grant permission, but felt that he

6 had no choice under the circumstances. One officer remained with Mr. Gill outside, while the

7 other searched his home. Mr. Gill did not feel free to leave. Mr. Gill cooperated with the

8 officers’ request for identification. Mr. Gill believes that he was likely viewing a website about

9 video games at the time of the May 20, 2012, incident.

10

85. On information and belief, the officers’ contention that they were investigating a

11 domestic violence call was a pretext for searching Mr. Gill’s home because CPD had already

12 decided to investigate Mr. Gill because of his religion.

13

86. The SAR also describes two earlier encounters between CPD and Mr. Gill, one at

14 the Mosque that Mr. Gill attends and another while Mr. Gill was walking through downtown

15 Chico “with elders.” The SAR describes Mr. Gill in these instances as “avoid[ing] eye contact”

16 and “hesitant to answer questions.”

17

87. Mr. Gill recalls CPD officers visiting the Mosque he attends, paying what they

18 described as a courtesy visit in an attempt to build good relations with the Muslim community.

19 Mr. Gill listened to the presentation. When it was over, CPD officers asked Mr. Gill his name,

20 whether he went to school, and if he was employed. Mr. Gill answered all of their questions.

21 His understanding is that the officers did not question anyone else in this manner.

22

88. Mr. Gill also recalls encountering CPD officers while he was walking through

23 downtown Chico with two older Muslim men who are friends from the Mosque. A CPD officer

24 called out Mr. Gill’s name and asked Mr. Gill if he had found a job yet. Mr. Gill answered the

25 question, but was caught off guard by the encounter because he did not recognize the officer and

26 was surprised that the officer knew his name and employment status.

27

89. At no point during any of the encounters with CPD recounted in the SAR did Mr.

28 Gill engage in conduct that gave rise to a reasonable suspicion of criminal activity.

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

22

Case3:14-cv-03120 Document1 Filed07/10/14 Page23 of 133

1

90. The CPD also targeted Mr. Gill in two other encounters that are not described in

2 the SAR, and that do not involve any conduct by Mr. Gill that gave rise to a reasonable suspicion

3 of criminal activity, but instead reflect CPD’s suspicion of Mr. Gill because of his religion. One

4 of the incidents occurred before CPD filed the SAR about Mr. Gill on or about May 23, 2012;

5 the other occurred after. This religious harassment is attributable to the training of local law

6 enforcement on the SARs standards and process.

7

91. In approximately September 2010, after Mr. Gill had converted to Islam, two

8 CPD officers visited him at his apartment and requested to speak to him about supposedly “anti-

9 American statements” that he had made. One of the officers referred to having a file on Mr. Gill,

10 refused to explain what “anti-American statements” Mr. Gill had purportedly made or the source

11 of the information, and stated that he wished to ensure Mr. Gill would not turn into another

12 Mohammed Atta, one of the individuals identified as a September 11 hijacker. Mr. Gill still does

13 not know how he came to the attention of the CPD.

14

92. Around or after July 2012, Mr. Gill also received a telephone call from a CPD

15 officer. Over the phone, the CPD officer said Mr. Gill should shut down his Facebook page

16 because of the video games Mr. Gill played. At the time, Mr. Gill had a picture of the Shahada,

17 the Muslim statement of faith, on his Facebook page. Mr. Gill told the CPD officer he would not

18 take down his Facebook page and Mr. Gill also told the CPD officer that he believed the CPD

19 wanted Mr. Gill to take down his Facebook page because of its references to Islam. The CPD

20 officer refused to comment on Mr. Gill’s observation, but stated that he had a report on Mr. Gill

21 and indicated that Mr. Gill was on some kind of watch list.

22

93. By describing Mr. Gill’s conversion to Islam and “pious demeanor” in the SAR as

23 “worthy of note,” CPD implicitly acknowledges that it found him “suspicious” because he is a

24 devout Muslim.

25

94. Defendants’ issuance of overly broad definitions of “suspicious activity” and the

26 categories of behavior they have identified as “suspicious” include, among other things,

27 “[a]cquisition of expertise” (PM-ISE) and “[n]o obvious signs of employment” (DOJ). On

28 information and belief, CPD officers are trained in Defendants’ standards for SAR reporting.

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

23

Case3:14-cv-03120 Document1 Filed07/10/14 Page24 of 133

1

95. Defendants’ overly broad standards for reporting suspicious activity opens the

2 door to and encourages religious profiling. These standards opened the door to and encouraged

3 the religious profiling of Mr. Gill by CPD, CPD’s repeated questioning and ongoing scrutiny of

4 Mr. Gill, and CPD’s identification of Mr. Gill in a SAR as someone engaged in activity with a

5 potential nexus to terrorism.

6

96. In addition, Functional Standard 1.5 instructs law enforcement agencies at the

7 “[i]nitial [r]esponse and [i]nvestigation stage” to respond to the observation reported in a SAR,

8 and “gather[] additional facts,” by, inter alia, “engaging the suspect in conversation” and “other

9 investigative activities.” Functional Standard 1.5 at 32. The CPD was implementing the

10 protocols set forth in Functional Standard 1.5 when it harassed Mr. Gill on or about May 2012,

11 before, and after.

12

97. Because Mr. Gill is the subject of a SAR that falls under Defendants’ standards

13 for suspicious activity reporting, Mr. Gill has been automatically subjected to law enforcement

14 scrutiny. That scrutiny has included, among other things, CPD’s telephone call to him around or

15 after July 2012 and the FBI’s creation of a file about and investigation of Mr. Gill.

16

98. Given the repeated harassment Mr. Gill has already suffered by CPD, he fears

17 further action may be taken against him by CPD and other investigative agencies as the result of

18 this SAR. He also fears further investigative harassment at the hands of the CPD and other

19 agencies caused by the existence of the SAR.

20

99. Mr. Gill also has experienced frustration and stress resulting from the creation of

21 the SAR based on innocent conduct. He is also deeply troubled by what may result from the

22 collection, maintenance, and dissemination in a national database of a report describing him as

23 engaging in suspicious activity with a potential nexus to terrorism.

24

100. The SAR about Mr. Gill is maintained and will continue to be maintained in one

25 or more national SAR databases, where it can be accessed by law enforcement agencies across

26 the country.

27 //

28 //

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

24

Case3:14-cv-03120 Document1 Filed07/10/14 Page25 of 133

1

2. James Prigoff

2

101. James Prigoff is a United States citizen who resides in Sacramento, California.

3 He is an internationally renowned photographer. The focus of his work is public art, such as

4 murals and graffiti art. He has amassed over 80,000 photographic slides and published several

5 books containing his photography. Mr. Prigoff is also a former business executive, having

6 served as a Senior Vice President of the Sara Lee Corporation and a President of a division of

7 Levi Strauss.

8

102. In or around the spring of 2004, Mr. Prigoff was in Boston, Massachusetts. While

9 there, he sought to photograph a famous piece of public art known as the “Rainbow Swash,”

10 located in the Dorchester neighborhood of Boston. The artwork is painted on a natural gas

11 storage tank, which is surrounded by a chain link fence. It is highly visible to commuters from

12 the local expressway.

13

103. Mr. Prigoff drove a rental car to a public area outside the fence surrounding the

14 Rainbow Swash, and set up to take photographs. He chose the location in part because of

15 favorable lighting conditions. From this location, the sun was behind him and casting its light on

16 the Rainbow Swash. Before Mr. Prigoff could take any photographs, two private security guards

17 came out from inside the fenced area and told him that he was not allowed to photograph,

18 claiming the area was private property. Mr. Prigoff pointed out to the security guards that he

19 was not, in fact, on private property. The guards still insisted that Mr. Prigoff could not

20 photograph.

21

104. To avoid a confrontation with the guards, Mr. Prigoff departed. He left without

22 giving the security guards any identifying information.

23

105. He drove further down the road to another public location outside the fenced

24 perimeter and attempted to take photographs from this second location. But the guards began to

25 follow him.

26

106. To avoid further harassment by the guards, he drove to a third location on the

27 other side of the Rainbow Swash. The guards did not follow him to this third location, and he

28 was finally able to take photographs of the Rainbow Swash unmolested. But the lighting

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

25

Case3:14-cv-03120 Document1 Filed07/10/14 Page26 of 133

1 conditions were significantly inferior to those at the first two locations; from this third location,

2 he had to photograph into the sunlight.

3

107. At no point while he was attempting to photograph the Rainbow Swash did Mr.

4 Prigoff engage in conduct that gave rise to a reasonable suspicion of criminal activity.

5

108. Mr. Prigoff subsequently discovered photographs online, including on the

6 Rainbow Swash’s Wikipedia webpage. These widely available photographs were taken from

7 vantage points closer than the three locations from which Mr. Prigoff attempted to and actually

8 took photographs.

9

109. Mr. Prigoff returned to his home in Sacramento, California after his trip to

10 Boston. A few months later, on or about August 19, 2004, he came home one day to find a

11 business card affixed to his door from Agent A. Ayaz of the Joint Terrorism Task Force, which,

12 as noted above, is a partnership between the FBI and other law enforcement agencies. On the

13 back was a handwritten note stating, “Mr. Prigoff, please call me. Thanks.” Mr. Prigoff later

14 learned from a neighbor across the street that two agents had knocked on her door and asked for

15 information about Mr. Prigoff.

16

110. Mr. Prigoff called Mr. Ayaz, who asked if Mr. Prigoff had been to Boston.

17 Realizing that Mr. Ayaz was referring to his efforts to photograph a piece of public art, Mr.

18 Prigoff explained what had occurred. On information and belief, security guards at the site of the

19 Rainbow Swash had submitted a SAR or SAR precursor report regarding Mr. Prigoff that

20 included his rental car information, after which authorities traced him from Boston,

21 Massachusetts, to his home in Sacramento, California.

22

111. Mr. Prigoff is very upset that he was tracked cross-country from Boston to

23 Sacramento, and contacted by law enforcement agents at his home over his effort to engage in

24 photography from a public location. Mr. Prigoff is also very upset that law enforcement agents

25 questioned at least one of his neighbors about him, as such questioning casts the negative and

26 strong implication that Mr. Prigoff had somehow engaged in misconduct.

27

112. Taking photographs of infrastructure falls under one or more of the behavioral

28 categories identified by Defendant PM-ISE under Functional Standard 1.5 as “suspicious,” and

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

26

Case3:14-cv-03120 Document1 Filed07/10/14 Page27 of 133

1 also falls under one or more behavioral categories identified by Defendant DOJ, such as the

2 catch-all behavioral category of “acting suspiciously.” After attempting to photograph a piece of

3 public art painted on a natural gas storage tank in Boston, Mr. Prigoff was tracked to his home in

4 Sacramento and questioned about his trip to Boston, even though he never provided the security

5 guards with identifying information. On information and belief, Mr. Prigoff is the subject of a

6 SAR or SAR precursor report, which was filed by security guards at the Rainbow Swash. On

7 information and belief, the report about him was collected, maintained, and disseminated through

8 a fusion center database, and uploaded to eGuardian and/or another national SAR or similar

9 counterrorism database. On information and belief, the report about him was collected,

10 maintained, and disseminated under standards that authorized collection, maintenance and

11 dissemination of information even in the absence of reasonable suspicion of criminal activity;

12 Defendants’ standards for SAR reporting ratify that conduct.

13

113. On information and belief, security guards at the Rainbow Swash were trained in

14 standards that encourage reporting of activity deemed connected to terrorism, even in the

15 absence of reasonable suspicion of criminal activity; Defendants’ standards for SAR reporting

16 ratify that conduct. Because of that training, they interfered with Mr. Prigoff’s lawful efforts to

17 take photographs of the Rainbow Swash.

18

114. Because Mr. Prigoff is the subject of a report that falls under Defendants’

19 standards for suspicious activity reporting, Mr. Prigoff has been automatically subjected to law

20 enforcement scrutiny. That scrutiny has included but may not be limited to a follow-up visit by

21 an agent of the Joint Terrorism Task Force to his home, a telephone call with that agent, and

22 inquiries by that agent of at least one of his neighbors about him.

23

115. Upon information and belief, the report about Mr. Prigoff is maintained and will

24 continue to be maintained in one or more national SAR or similar counterterrorism databases,

25 where it can be accessed by law enforcement agencies across the country.

26

116. Mr. Prigoff continues to be an active photographer and often takes pictures of

27 architectural structures and post offices, among other sites that could be described as

28 “infrastructure.” Because taking photographs of infrastructure falls under one or more of the

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

27

Case3:14-cv-03120 Document1 Filed07/10/14 Page28 of 133

1 behavioral categories identified by Defendant PM-ISE under Functional Standard 1.5 as

2 “suspicious,” and also falls under one or more behavioral categories identified by Defendant

3 DOJ, such as the catch-all behavioral category of “acting suspiciously,” he is likely to be the

4 subject of another SAR in the future. He fears that his efforts to take photographs of such areas

5 will be hindered again in the future.

6

117. Mr. Prigoff is also deeply troubled by what may result from the collection,

7 maintenance, and dissemination in a national database of a report describing him as engaging in

8 suspicious activity with a potential nexus to terrorism.

9

3. Khaled Ibrahim

10

118. Khaled Ibrahim is a United States citizen of Egyptian descent living in San Jose,

11 California. He works in accounting for Nordix Computer Corporation, a computer network

12 consulting and service company. He formerly worked as a purchasing agent for Nordix. As part

13 of his job as purchasing agent, Mr. Ibrahim bought computers in bulk from retail stores, where

14 the stores allowed such transactions.

15

119. On several occasions in 2011, Mr. Ibrahim went to the Best Buy in Dublin,

16 California in order to attempt to purchase computers in bulk for Nordix. On one such occasion,

17 he was told that management did not allow such bulk purchases and, with that, Mr. Ibrahim left.

18

120. At no point while he was attempting to purchase computers from Best Buy did

19 Mr. Ibrahim engage in conduct that gave rise to a reasonable suspicion of criminal activity.

20

121. Mr. Ibrahim is the subject of a SAR, created on November 14, 2011, regarding

21 Mr. Ibrahim’s attempts to purchase “a large amount of computers.” The SAR about him was

22 collected, maintained, and disseminated through a fusion center SAR database, and uploaded to

23 the FBI’s eGuardian database. Upon information and belief, the personnel at the fusion center

24 who uploaded Mr. Ibrahim’s SAR to eGuardian were trained in Defendants’ standards for SAR

25 reporting.

26

122. The SAR pertaining to Mr. Ibrahim falls into one or more of the behavioral

27 categories identified in Functional Standard 1.5, in particular, “[a]cquisition … of unusual

28 quantities of materials.” Functional Standard 1.5 at 30. It also falls under one or more

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

28

Case3:14-cv-03120 Document1 Filed07/10/14 Page29 of 133

1 behavioral categories identified by Defendant DOJ, such as the catch-all behavioral category of

2 “acting suspiciously” and DOJ’s “Potential Indicators of Terrorist Activities Related to

3 Electronic Stores.”

4

123. Because Mr. Ibrahim is the subject of a SAR that falls under Defendants’

5 standards for suspicious activity reporting, Mr. Ibrahim has been automatically subjected to law

6 enforcement scrutiny. That scrutiny may include but is not limited to scrutiny or interviews by

7 any of the law enforcement agencies across the country that have access to the FBI’s eGuardian

8 system, to which his SAR was uploaded.

9

124. Mr. Ibrahim is particularly disturbed that trained law enforcement personnel at a

10 fusion center uploaded the SAR about him to eGuardian, thereby flagging him as an individual

11 with a potential nexus to terrorism. He is also troubled by what may result from the collection,

12 maintenance, and dissemination in a national database of a report describing him as engaging in

13 suspicious activity with a potential nexus to terrorism. Mr. Ibrahim is upset that a SAR was

14 entered about him potentially because of his Middle Eastern descent, and believes that this

15 system of racial profiling diminishes the rights of Middle Eastern communities.

16

125. The SAR about Mr. Ibrahim is maintained and will continue to be maintained in

17 one or more national SAR databases, where it can be accessed by law enforcement agencies

18 across the country.

19

4. Tariq Razak

20

126. Tariq Razak is a United States citizen of Pakistani descent. He resides in

21 Placentia, California. A graduate of the University of California at Irvine, he works in the bio-

22 tech industry.

23

127. Mr. Razak is the subject of a SAR pertaining to a “Male of Middle Eastern decent

24 [sic] observed surveying entry/exit points” at the Santa Ana Train Depot.

25

128. On May 16, 2011, Santa Ana Police Officer J. Gallardo filed a SAR regarding Mr.

26 Razak. According to the SAR, Officer Gallardo responded to a call at the Santa Ana Train

27 Depot from Security Officer Karina De La Rosa. Ms. De La Rosa explained that her “suspicion

28 became aroused because the male appeared to be observant of his surroundings and was

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

29

Case3:14-cv-03120 Document1 Filed07/10/14 Page30 of 133

1 constantly surveying all areas of the facility. The male’s appearance was neat and clean with a

2 closely cropped beard, short hair wearing blue jeans and a blue plaid shirt.” The SAR goes on to

3 describe how Mr. Razak, after studying entry/exit points moved to a part of the train station

4 where the restrooms are located and eventually departed the train station with “a female wearing

5 a white burka head dress” who had emerged from the restrooms. Office Gallardo concludes the

6 SAR by requesting that it be forwarded to the fusion center in Orange County “for review and

7 possible follow-up.”

8

129. According to the SAR, Security Officer De La Rosa stated that “she received

9 ‘suspicious activity as related to terrorism training’” and that “the behavior depicted by the male

10 was similar to examples shown in her training raising her suspicion and making the decision to

11 notify the police.” Mr. Razak is the subject of the SAR because of Defendants’ trainings on their

12 SAR reporting standards to state and local law enforcement and the private sector.

13

130. Mr. Razak was, indeed, at the Santa Ana Train Depot on May 16, 2011. The

14 woman he was with was his mother. He had an appointment at the county employment resource

15 center, which is located in the station building. He had not been to the station before and spent

16 some time locating the office before meeting up with his mother by the restrooms and leaving.

17 His mother was wearing a hijab (head scarf), and not a burka.

18

131. Mr. Razak did not talk to any security officers at the Santa Ana Train Depot that

19 day. The SAR notes the make and model of Mr. Razak’s vehicle, and his license plate number.

20 On information and belief, Security Officer De La Rosa followed Mr. Razak to his vehicle and

21 wrote down his license plate number to identify him.

22

132. At no point while he was waiting in the Train Depot did Mr. Razak engage in

23 conduct that gave rise to a reasonable suspicion of criminal activity.

24

133. This SAR falls into one or more of the behavioral categories identified in

25 Functional Standard 1.5, in particular, “Observation/Surveillance.” Functional Standard 1.5 at

26 30. It also falls under DOJ’s “Potential Indicators of Terrorist Activities Related to Mass

27 Transportation,” which includes, among other things, “[u]nusual or prolonged interest in …

28 [e]ntry points and access controls.” It also falls under one or more behavioral categories

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

30

Case3:14-cv-03120 Document1 Filed07/10/14 Page31 of 133

1 identified by Defendant DOJ, such as the catch-all behavioral category of “acting suspiciously.”

2 The SAR about Mr. Razak was collected, maintained, and disseminated through a fusion center

3 SAR database, and on information and belief has been uploaded to eGuardian and/or another

4 national SAR database.

5

134. Because Mr. Razak is the subject of a SAR that falls under Defendants’ standards

6 for suspicious activity reporting, Mr. Razak has been automatically subjected to law enforcement

7 scrutiny. That scrutiny may include but is not limited to scrutiny or interviews by any of the law

8 enforcement agencies across the country that have access to the SAR about him.

9

135. Mr. Razak is deeply troubled by what may result from the collection,

10 maintenance, and dissemination in a national database of a report describing him as engaging in

11 suspicious activity with a potential nexus to terrorism.

12

136. Upon information and belief, the SAR about Mr. Razak is maintained and will

13 continue to be maintained in one or more national SAR databases, where it can be accessed by

14 law enforcement agencies across the country.

15

5. Aaron Conklin

16

137. Aaron Conklin resides in Vallejo, California. Mr. Conklin is a student at Diablo

17 Valley College, studying graphic design. He is also an amateur photographer who posts his

18 work online. Mr. Conklin has a strong aesthetic interest in photographing industrial architecture,

19 including refineries.

20

138. In either 2011 or 2012, Mr. Conklin was photographing the Valero Refinery

21 located in Benicia, California at around 10:00 p.m. He chose to photograph at night for aesthetic

22 reasons, to capture the refinery illuminated against the dark night sky. Mr. Conklin set up in an

23 empty lot where a food truck parks during the day, near a publicly accessible sidewalk and a bus

24 stop. Mr. Conklin was positioned outside the refinery’s fenced perimeter.

25

139. Despite Mr. Conklin’s location outside the refinery’s perimeter in a publicly

26 accessible location, a private security guard from the refinery came out to tell Mr. Conklin that

27 he could not photograph the refinery and issued stern warnings. Mr. Conklin felt threatened and

28 feared that the situation would escalate if he remained, so he left. Because he fears further

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

31

Case3:14-cv-03120 Document1 Filed07/10/14 Page32 of 133

1 harassment, he has not returned to photograph the refinery, despite his desire to develop his

2 portfolio with photographs of industrial sites.

3

140. Mr. Conklin later discovered that images of the refinery, taken from a similar

4 location, were viewable on the internet through Google Maps, using the site’s “street view”

5 feature.

6

141. In or about November 2013, Mr. Conklin was attempting to photograph the Shell

7 Refinery located in Martinez, California at approximately 9:30 or 10:00 pm. He wished to

8 photograph the refinery at night for artistic reasons.

9

142. Mr. Conklin set up in the parking lot of a strip mall containing a smog testing

10 center and a dance studio, across the street from the Shell Refinery’s fenced perimeter.

11

143. As Mr. Conklin was preparing to photograph, a private security guard came out

12 from the refinery and stopped him. At least one other guard from the refinery soon joined the

13 first security guard. The security guards told Mr. Conklin that he was prohibited from

14 photographing the refinery and that photographing the refinery was illegal and somehow

15 connected to terrorism.

16

144. Despite Mr. Conklin’s complete cooperation with the security guards, they called

17 the Contra Costa County Sheriff’s department, and at least two deputies arrived on the scene.

18 The deputies searched through the pictures on Mr. Conklin’s camera and searched his car. They

19 also took pictures of Mr. Conklin, his camera equipment, and his vehicle. Mr. Conklin was

20 afraid and felt as though he did not have the option to object to the searches without making

21 matters worse for himself.

22

145. The deputies concluded by telling Mr. Conklin that he would have to be placed on

23 an “NSA watch list.” Only then was Mr. Conklin allowed to leave. The entire encounter lasted

24 between forty-five minutes and an hour.

25

146. At no point while he was attempting to photograph the Valero or Shell refineries

26 did Mr. Conklin engage in conduct that gave rise to a reasonable suspicion of criminal activity.

27

147. Taking photographs of infrastructure falls under one or more of the behavioral

28 categories identified by Defendant PM-ISE as “suspicious,” and also falls under one or more

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

32

Case3:14-cv-03120 Document1 Filed07/10/14 Page33 of 133

1 behavioral categories identified by Defendant DOJ, such as the catch-all behavioral category of

2 “acting suspiciously.” A Contra Costa deputy sheriff expressly told Mr. Conklin that he had to

3 be put on an “NSA watchlist.” On information and belief, Mr. Conklin is the subject of a SAR,

4 which was collected, maintained, and disseminated through a fusion center SAR database, and

5 uploaded to eGuardian and/or another national SAR database.

6

148. On information and belief, security guards at oil refineries are trained in

7 Defendants’ standards for SAR reporting. As a result, security guards at the Valero and Shell oil

8 refineries prevented Mr. Conklin from taking photographs of sites of aesthetic interest to him.

9 On information and belief, the Contra Costa deputy sheriffs are trained in Defendants’ standards

10 for SAR reporting. As a result, they detained and searched Mr. Conklin for doing nothing more

11 than attempting to photograph a site of aesthetic interest from a public location, told Mr. Conklin

12 that he had to be placed on a watchlist, and reported Mr. Conklin in a SAR.

13

149. Because Mr. Conklin is the subject of a SAR that falls under Defendants’

14 standards for suspicious activity reporting, Mr. Conklin has been automatically subjected to law

15 enforcement scrutiny. That scrutiny may include but is not limited to scrutiny or interviews by

16 any of the law enforcement agencies across the country that have access to the SAR about him.

17

150. Mr. Conklin was very upset by the encounter with private security and Contra

18 Costa deputy sheriffs at the Shell refinery. He wants to continue taking photographs of

19 industrial architecture in the future. But because of this event and the earlier incident at the

20 Valero refinery, he is afraid to continue photographing industrial sites for fear of being stopped

21 and questioned or, worse, arrested. Mr. Conklin has been chilled and has refrained from

22 engaging in certain forms of photography, despite his desire to develop his photography

23 portfolio. His inability to develop his photography portfolio limits his ability to apply

24 successfully for jobs in his chosen field.

25

151. Mr. Conklin is also deeply troubled by what may result from the collection,

26 maintenance, and dissemination in a national database of a report describing him as engaging in

27 suspicious activity with a potential nexus to terrorism.

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

33

Case3:14-cv-03120 Document1 Filed07/10/14 Page34 of 133

1

152. Mr. Conklin currently worries about being on a watchlist because he fears it will

2 adversely impact him in the future. For example, he is concerned about his employment

3 prospects if employers conduct background checks and he is flagged as someone with a potential

4 connection to terrorism. Mr. Conklin also currently worries about being on a watchlist because

5 he fears it will adversely impact his family. His father has worked and is seeking employment in

6 the aviation industry and as a result must undergo rigorous background checks; Mr. Conklin is

7 afraid about jeopardizing his father’s career based on his own innocent efforts to take

8 photographs of aesthetically interesting sites.

FIRST CLAIM FOR RELIEF 9

Violation of APA by Defendants DOJ and Eric Holder for

10

Agency Action that is Arbitrary and Capricious and Not in Accordance with Law

5 U.S.C. §§ 702, 706(2)(A) 11

153. Plaintiffs incorporate by reference all preceding paragraphs as if fully set forth

12

herein.

13

154. DOJ’s promulgation of DOJ’s SAR Standard constitutes final agency action.

14

155. DOJ and Eric Holder have issued a SAR Standard that sets forth operating

15

principles for the collection, maintenance, and dissemination of “criminal intelligence

16

information” within the meaning of 28 CFR Part 23. It applies to entities that operate

17

arrangements, equipment, facilities, and procedures used for the receipt, storage, interagency

18

exchange or dissemination and analysis of criminal intelligence information. These entities and

19

the systems they operate receive support from OJP and constitute “projects” and “criminal

20

intelligence systems” within the meaning of 28 CFR Part 23.

21

156. Because DOJ’s SAR standard is broader than 28 CFR Part 23 and authorizes the

22

collection, maintenance, and dissemination of information even in the absence of reasonable

23

suspicion of criminal activity, it conflicts with 28 CFR Part 23. DOJ has also undermined 28

24

CFR Part 23 by training participants in the NSI on DOJ’s SAR Standard.

25

157. Defendants DOJ and Eric Holder have not provided a reasoned basis for adopting

26

a conflicting standard.

27

158. Defendants’ actions described herein were and are arbitrary, capricious, an

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

34

Case3:14-cv-03120 Document1 Filed07/10/14 Page35 of 133

1 abuse of discretion, and otherwise not in accordance with law, and should be set aside as

2 unlawful pursuant to 5 U.S.C. § 706 (2012).

3

SECOND CLAIM FOR RELIEF

4

Violation of APA by Defendants PM-ISE and Kshemendra Paul for

Agency Action that is Arbitrary and Capricious and Not in Accordance with Law

5

5 U.S.C. §§ 702, 706(2)(A)

6

159. Plaintiffs incorporate by reference all preceding paragraphs as if fully set forth

7 herein.

8

160. PM-ISE’s promulgation of Functional Standard 1.5 constitutes final agency

9 action.

10

161. PM-ISE and Kshemendra Paul have issued a SAR Standard that sets forth

11 operating principles for the collection, maintenance, and dissemination of “criminal intelligence

12 information” within the meaning of 28 CFR Part 23. It applies to entities that operate

13 arrangements, equipment, facilities, and procedures used for the receipt, storage, interagency

14 exchange or dissemination and analysis of criminal intelligence information. These entities and

15 the systems they operate receive support from OJP and constitute “projects” and “criminal

16 intelligence systems” within the meaning of 28 CFR Part 23.

17

162. Because Functional Standard 1.5 is broader than 28 CFR Part 23 and authorizes

18 the collection, maintenance, and dissemination of information even in the absence of reasonable

19 suspicion of criminal activity, it conflicts with 28 CFR Part 23. PM-ISE has also undermined 28

20 CFR Part 23 by training participants in the NSI on Functional Standard 1.5.

21

163. Defendants PM-ISE and Kshemendra Paul have not provided a reasoned basis for

22 adopting a conflicting standard.

23

164. Defendants’ actions described herein were and are arbitrary, capricious, an

24 abuse of discretion, otherwise not in accordance with law and should be set aside as unlawful

25 pursuant to 5 U.S.C. § 706 (2012).

26 //

27 //

28 //

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

35

Case3:14-cv-03120 Document1 Filed07/10/14 Page36 of 133

1

THIRD CLAIM FOR RELIEF

2

Violation of APA by Defendants DOJ and Eric Holder

for Issuance of a Legislative Rule Without Notice and Comment

3

5 U.S.C. §§ 553, 706(2)(A), (D)

4

165. Plaintiffs incorporate by reference all preceding paragraphs as if fully set forth

5 herein.

6

166. DOJ’s SAR’s Standard is a legislative rule but was adopted without observing the

7 notice and comment procedure required under 5 U.S.C. § 553 (2012). Because DOJ’s SAR

8 Standard was adopted without observing the required notice and comment procedure,

9 Defendants’ actions described herein were and are also arbitrary, capricious, an abuse of

10 discretion, otherwise not in accordance with law, and without observance of procedure required

11 by law. Defendants’ actions should be set aside as unlawful pursuant to 5 U.S.C. § 706 (2012).

12

FOURTH CLAIM FOR RELIEF

13

Violation of APA by Defendants PM-ISE and Kshemendra Paul

for Issuance of a Legislative Rule Without Notice and Comment

14

5 U.S.C. §§ 553, 706(2)(A), (D)

15

167. Plaintiffs incorporate by reference all preceding paragraphs as if fully set forth

16 herein.

17

168. PM-ISE’s Functional Standard 1.5 is a legislative rule but was adopted without

18 observing the notice and comment procedure required under 5 U.S.C. § 553 (2012). Because

19 PM-ISE’s Functional Standard 1.5 was adopted without observing the required notice and

20 comment procedure, Defendants’ actions described herein were and are also arbitrary,

21 capricious, an abuse of discretion, otherwise not in accordance with law, and without observance

22 of procedure required by law. Defendants’ actions should be set aside as unlawful pursuant to 5

23 U.S.C. § 706 (2012).

24

PRAYER FOR RELIEF

25

WHEREFORE, Plaintiffs pray that the Court:

26

1. Enter a declaratory judgment that DOJ’s standard for SAR reporting is invalid and

27 issue a permanent injunction requiring Defendants DOJ and Eric Holder to rescind DOJ’s SAR

28 Standard and cease and desist from training participants in the NSI in DOJ’s SAR Standard.

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

36

Case3:14-cv-03120 Document1 Filed07/10/14 Page37 of 133

1

2. Enter a declaratory judgment that Functional Standard 1.5 is invalid and issue a

2 permanent injunction requiring Defendants PM-ISE and KSHEMENDRA PAUL to rescind

3 Functional Standard 1.5 and cease and desist from training participants in the NSI in Functional

4 Standard 1.5.

5

3. Enter a declaratory judgment that 28 CFR Part 23 sets forth the standard for SAR

6 reporting.

7

4. Enter a permanent injunction requiring Defendants to use 28 CFR Part 23 as the

8 standard for SAR reporting.

9

5. Award Plaintiffs their costs and expenses, including reasonable attorneys’ fees

10 and expert witness fees; and

11

6. Award such further and additional relief as is just and proper.

12

Respectfully submitted,

13 DATED: July 10, 2014 14 15 16 17 18 19 20 21 22 23 24 25

BINGHAM MCCUTCHEN LLP Jonathan Loeb (SBN 162758) jon.loeb@bingham.com Jeffrey Rosenfeld (SBN 221625) jeffrey.rosenfeld@bingham.com Edward Andrews (SBN 268479) edward.andrews@bingham.com The Water Garden Suite 2050 North 1601 Cloverfield Boulevard Santa Monica, CA 90404-4082 Telephone: 310-907-1000 Facsimile: 310-907-2000
BINGHAM MCCUTCHEN LLP Stephen Scotch-Marmo (pro hac vice pending) stephen.scotch-marmo@bingham.com Michael James Ableson (pro hac vice pending) michael.ableson@bingham.com 399 Park Avenue New York, NY 10022-4689 Telephone: 212-705-7000 Facsimile: 212-752-5378

26

27

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

37

Case3:14-cv-03120 Document1 Filed07/10/14 Page38 of 133

1

AMERICAN CIVIL LIBERTIES UNION FOUNDATION OF NORTHERN CALIFORNIA

Linda Lye (SBN 215584)

2

llye@aclunc.org

Julia Harumi Mass (SBN 189649)

3

jmass@aclunc.org

39 Drumm Street

4

San Francisco, CA 94111

Telephone: 415-621-2493

5

Facsimile: 415-255-8437

6

ASIAN AMERICANS ADVANCING

JUSTICE - ASIAN LAW CAUCUS

7

Nasrina Bargzie (SBN 238917)

nasrinab@advancingjustice-alc.org

8

Yaman Salahi (SBN 288752)

yamans@advancingjustice-alc.org

9

55 Columbus Avenue

San Francisco, CA 94111

10

Telephone: 415-848-7711

Facsimile: 415-896-1702 11

AMERICAN CIVIL LIBERTIES UNION

12

FOUNDATION

Hina Shamsi (pro hac vice pending)

13

hshamsi@aclu.org

Hugh Handeyside (pro hac vice pending)

14

hhandeyside@aclu.org

125 Broad Street

15

New York, NY 10004

Telephone: 212-549-2500

16

Facsimile: 212-549-2654

17

AMERICAN CIVIL LIBERTIES UNION

FOUNDATION OF SAN DIEGO AND IMPERIAL

18

COUNTIES

Mitra Ebadolahi (SBN 275157)

19

mebadolahi@aclusandiego.org

P.O. Box 87131

20

San Diego, CA 92138

Telephone: (619) 232-2121

21

Facsimile: (619) 232-0036

22

AMERICAN CIVIL LIBERTIES UNION

FOUNDATION OF SOUTHERN CALIFORNIA

23

Peter Bibring (SBN 223981)

pbibring@aclusocal.org

24

1313 West 8th Street

Los Angeles, CA 90017

25

Telephone: (213) 977-9500

Facsimile: (213) 977-5299 26

27

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

38

Case3:14-cv-03120 Document1 Filed07/10/14 Page39 of 133

1

By:___________/s/ Jonathan Loeb__________

Jonathan Loeb 2

BINGHAM MCCUTCHEN LLP 3

4

By:___________/s/ Linda Lye______________

5

Linda Lye

6

AMERICAN CIVIL LIBERTIES UNION

FOUNDATION OF NORTHERN CALIFORNIA 7

8

By:___________/s/ Nasrina Bargzie__________

9

Nasrina Bargzie

10

ASIAN AMERICANS ADVANCING JUSTICE –

ASIAN LAW CAUCUS 11

12

Attorneys for Plaintiffs Wiley Gill, James Prigoff,

Tariq Razak, Khaled Ibrahim, and Aaron Conklin 13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

39

Case3:14-cv-03120 Document1 Filed07/10/14 Page40 of 133

1

DECLARATION PURSUANT TO LOCAL RULE 5-1(i)(3)

2

Pursuant to Local Rule 5-1(i)(3), the undersigned filer declares that concurrence in the

3 filing of this document has been obtained from the other signatories to this document.

4

I declare under penalty of perjury under the laws of the United States that the foregoing is

5 true and correct. Executed this 10th day of July 2013.

6

7

_________

8

9

/s/ Jonathan Loeb______ Jonathan Loeb

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF

40

Case3:14-cv-03120 Document1 Filed07/10/14 Page41 of 133
Exhibit A
Exhibit A - Page 41

Case3:14-cv-03120 Document1 Filed07/10/14 Page42 of 133 Exhibit A - Page 42

Case3:14-cv-03120 Document1 Filed07/10/14 Page43 of 133 Exhibit A - Page 43

Case3:14-cv-03120 Document1 Filed07/10/14 Page44 of 133
Exhibit B
Exhibit B - Page 44

Case3:14-cv-03120 Document1 Filed07/10/14 Page45 of 133 Exhibit B - Page 45

Case3:14-cv-03120 Document1 Filed07/10/14 Page46 of 133 Exhibit B - Page 46

Case3:14-cv-03120 Document1 Filed07/10/14 Page47 of 133 Exhibit B - Page 47

Case3:14-cv-03120 Document1 Filed07/10/14 Page48 of 133
Exhibit C
Exhibit C - Page 48

Case3:14-cv-03120 Document1 Filed07/10/14 Page49 of 133
Exhibit C - Page 49

Case3:14-cv-03120 Document1 Filed07/10/14 Page50 of 133
Exhibit C - Page 50

Case3:14-cv-03120 Document1 Filed07/10/14 Page51 of 133
Exhibit C - Page 51

Case3:14-cv-03120 Document1 Filed07/10/14 Page52 of 133
Exhibit D
Exhibit D - Page 52

Case3:14-cv-03120 Document1 Filed07/10/14 Page53 of 133
UNCLASSIFIED ISE-FS-200
INFORMATION SHARING ENVIRONMENT (ISE)
FUNCTIONAL STANDARD (FS)
SUSPICIOUS ACTIVITY REPORTING (SAR)
VERSION 1.5
1. Authority. Homeland Security Act of 2002, as amended; The Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA), as amended; Presidential Memorandum dated April 10, 2007 (Assignment of Functions Relating to the Information Sharing Environment); Presidential Memorandum dated December 16, 2005 (Guidelines and Requirements in Support of the Information Sharing Environment); DNI memorandum dated May 2, 2007 (Program Manager’s Responsibilities); Executive Order 13388; and other applicable provisions of law, regulation, or policy.
2. Purpose. This issuance serves as the updated Functional Standard for ISE-SARs, and one of a series of Common Terrorism Information Sharing Standards (CTISS) issued by the PM-ISE. While limited to describing the ISE-SAR process and associated information exchanges, information from this process may support other ISE processes to include alerts, warnings, and notifications, situational awareness reporting, and terrorist watchlisting.
3. Applicability. This ISE-FS applies to all departments or agencies that possess or use terrorism or homeland security information, operate systems that support or interface with the ISE, or otherwise participate (or expect to participate) in the ISE, as specified in Section 1016(i) of the IRTPA.
4. References. ISE Implementation Plan, November 2006; ISE Enterprise Architecture Framework (EAF), Version 2.0, September 2008; Initial Privacy and Civil Liberties Analysis for the Information Sharing Environment, Version 1.0, September 2008; ISE-AM-300: Common Terrorism Information Standards Program, October 31, 2007; Common Terrorism Information Sharing Standards Program Manual, Version 1.0, October 2007; National Information Exchange Model, Concept of Operations, Version 0.5, January 9, 2007; 28 Code of Federal Regulations (CFR) Part 23; Executive Order 13292 (Further Amendment to Executive Order 12958, as Amended, Classified National Security Information); Nationwide Suspicious Activity Reporting Concept of Operations, December 2008; ISE Suspicious Activity Reporting Evaluation Environment (EE) Segment Architecture, December 2008.
5. Definitions.
a. Artifact: Detailed mission product documentation addressing information exchanges and data elements for ISE-SAR (data models, schemas, structures, etc.).
Exhibit D1- Page 53

Case3:14-cv-03120 Document1 Filed07/10/14 Page54 of 133

UNCLASSIFIED

ISE-FS-200

b. CTISS: Business process-driven, performance-based “common standards” for preparing terrorism information for maximum distribution and access, to enable the acquisition, access, retention, production, use, management, and sharing of terrorism information within the ISE. CTISS, such as this ISE-SAR Functional Standard, are implemented in ISE participant infrastructures that include ISE Shared Spaces as described in the ISE EAF. Two categories of common standards are formally identified under CTISS:
(1) Functional Standards – set forth rules, conditions, guidelines, and characteristics of data and mission products supporting ISE business process areas.
(2) Technical Standards – document specific technical methodologies and practices to design and implement information sharing capability into ISE systems.
c. Information Exchange: The transfer of information from one organization to another organization, in accordance with CTISS defined processes.
d. ISE-Suspicious Activity Report (ISE-SAR): An ISE-SAR is a SAR (as defined below in 5i) that has been determined, pursuant to a two-part process, to have a potential terrorism nexus (i.e., to be reasonably indicative of criminal activity associated with terrorism). ISE-SAR business, privacy, and civil liberties rules will serve as a unified process to support the reporting, tracking, processing, storage, and retrieval of terrorism-related suspicious activity reports across the ISE.
e. National Information Exchange Model (NIEM): A joint technical and functional standards program initiated by the Department of Homeland Security (DHS) and the Department of Justice (DOJ) that supports national-level interoperable information sharing.
f. Personal Information: Information that may be used to identify an individual (i.e., data elements in the identified “privacy fields” of this ISE-SAR Functional Standard).
g. Privacy Field: A data element that may be used to identify an individual and, therefore, may be subject to privacy protection.
h. Suspicious Activity: Observed behavior reasonably indicative of pre-operational planning related to terrorism or other criminal activity.
i. Suspicious Activity Report (SAR): Official documentation of observed behavior reasonably indicative of pre-operational planning related to terrorism or other criminal activity.
j. Universal Core (UCore): An interagency information exchange specification and implementation profile. It provides a framework for sharing the most commonly used data concepts of “who, what when, and where”. UCore serves as a starting point for data level integration and permits the development of richer domain specific exchanges. UCore was developed in concert with NIEM program office, and is a collaborative effort between Department of Defense (DOD), DOJ, DHS and the Intelligence Community.

2
Exhibit D - Page 54

Case3:14-cv-03120 Document1 Filed07/10/14 Page55 of 133

UNCLASSIFIED

ISE-FS-200

6. Guidance. This Functional Standard is hereby established as the nationwide ISE Functional Standard for ISE-SARs. It is based on documented information exchanges and business requirements, and describes the structure, content, and products associated with processing, integrating, and retrieving ISE-SARs by ISE participants.
7. Responsibilities.
a. The PM-ISE, in consultation with the Information Sharing Council (ISC), will:
(1) Maintain and administer this ISE-SAR Functional Standard, to include:
(a) Updating the business process and information flows for ISE-SAR.
(b) Updating data elements and product definitions for ISE-SAR.
(2) Publish and maintain configuration management of this ISE-SAR Functional Standard.
(3) Assist with the development of ISE-SAR implementation guidance and governance structure, as appropriate, to address privacy, civil rights, and civil liberties, policy, architecture, and legal issues.
(4) Work with ISE participants, through the CTISS Committee, to develop a new or modified ISE-SAR Functional Standard, as needed.
(5) Coordinate, publish, and monitor implementation and use of this ISE-SAR Functional Standard, and coordinate with the White House Office of Science and Technology Policy and with the National Institute of Standards and Technology (in the Department of Commerce) for broader publication, as appropriate.
b. Each ISC member and other affected organizations shall:
(1) Propose modifications to the PM-ISE for this Functional Standard, as appropriate.
(2) As appropriate, incorporate this ISE-SAR Functional Standard, and any subsequent implementation guidance, into budget activities associated with relevant current (operational) mission specific programs, systems, or initiatives (e.g. operations and maintenance {O&M} or enhancements).
(3) As appropriate, incorporate this ISE-SAR Functional Standard, and any subsequent implementation guidance, into budget activities associated with future or new development efforts for relevant mission specific programs, systems, or initiatives (e.g. development, modernization, or enhancement {DME}).
(4) Ensure incorporation of this ISE-SAR Functional Standard, as set forth in 7.b (2) or 7.b (3) above, is done in compliance with ISE Privacy Guidelines and any additional guidance provided by the ISE Privacy Guidelines Committee.

3
Exhibit D - Page 55

Case3:14-cv-03120 Document1 Filed07/10/14 Page56 of 133

UNCLASSIFIED

ISE-FS-200

8. Effective Date and Expiration. This ISE-FS is effective immediately and will remain in effect as the updated ISE-SAR Functional Standard until further updated, superseded, or cancelled.

__________________________________
Program Manager for the Information Sharing Environment
Date: May 21, 2009

4
Exhibit D - Page 56

Case3:14-cv-03120 Document1 Filed07/10/14 Page57 of 133

UNCLASSIFIED

ISE-FS-200

PART A – ISE-SAR FUNCTIONAL STANDARD ELEMENTS

SECTION I – DOCUMENT OVERVIEW

A. List of ISE-SAR Functional Standard Technical Artifacts

The full ISE-SAR information exchange contains five types of supporting technical artifacts. This documentation provides details of implementation processes and other relevant reference materials. A synopsis of the ISE-SAR Functional Standard technical artifacts is contained in Table 1 below.

Table 1 – Functional Standard Technical Artifacts1

Artifact Type
Development and Implementation Tools

Artifact
1. Component Mapping Template (CMT) (SAR-to-NIEM/UCore)

2. NIEM Wantlist

3. XML Schemas 4. XML Sample Instance 5. Codified Data Field Values

Artifact Description
This spreadsheet captures the ISE-SAR information exchange class and data element (source) definitions and relates each data element to corresponding National Information Exchange Model (NIEM) Extensible Mark-Up Language (XML) elements and UCore elements, as appropriate.
The Wantlist is an XML file that lists the elements selected from the NIEM data model for inclusion in the Schema Subset. The Schema Subset is a compliant version to both programs that has been reduced to only those elements actually used in the ISE-SAR document schema.
The XML Schema provides a technical representation of the business data requirements. They are a machine readable definition of the structure of an ISE-SARbased XML Message.
The XML Sample Instance is a sample document that has been formatted to comply with the structures defined in the XML Schema. It provides the developer with an example of how the ISE-SAR schema is intended to be used.
Listings, descriptions, and sources as prescribed by data fields in the ISE-SAR Functional Standard.

1 Development and implementation tools may be accessible through www.ise.gov. Additionally, updated versions of this Functional Standard will incorporate the CTISS Universal Core which harmonizes the NIEM Universal Core with the DoD/IC UCore.
5
Exhibit D - Page 57

Case3:14-cv-03120 Document1 Filed07/10/14 Page58 of 133

UNCLASSIFIED

ISE-FS-200

SECTION II – SUSPICIOUS ACTIVITY REPORTING EXCHANGES
A. ISE-SAR Purpose
This ISE-SAR Functional Standard is designed to support the sharing, throughout the Information Sharing Environment (ISE), of information about suspicious activity, incidents, or behavior (hereafter collectively referred to as suspicious activity or activities) that have a potential terrorism nexus. The ISE includes State and major urban area fusion centers and their law enforcement,2 homeland security,3 or other information sharing partners at the Federal, State, local, and tribal levels to the full extent permitted by law. In addition to providing specific indications about possible terrorism-related crimes, ISE-SARs can be used to look for patterns and trends by analyzing information at a broader level than would typically be recognized within a single jurisdiction, State, or territory. Standardized and consistent sharing of suspicious activity information regarding criminal activity among State and major urban area fusion centers and Federal agencies is vital to assessing, deterring, preventing, or prosecuting those involved in criminal activities associated with terrorism. This ISE-SAR Functional Standard has been designed to incorporate key elements that describe potential criminal activity associated with terrorism and may be used by other communities to address other types of criminal activities where appropriate.
B. ISE-SAR Scope
Suspicious activity is defined as observed behavior reasonably indicative of pre-operational planning related to terrorism or other criminal activity. A determination that such suspicious activity constitutes an ISE-SAR is made as part of a two-part process by trained analysts using explicit criteria. Some examples of the criteria for identifying those SARs, with defined relationships to criminal activity that also have a potential terrorism nexus, are listed below. Part B (ISE-SAR Criteria Guidance) provides a more thorough explanation of ISE-SAR criteria, highlighting the importance of context in interpreting such behaviors;
• Expressed or implied threat
• Theft/loss/diversion
• Site breach or physical intrusion
• Cyber attacks
• Probing of security response

2 All references to Federal, State, local and tribal law enforcement are intended to encompass civilian law enforcement, military police, and other security professionals.
3 All references to homeland security are intended to encompass public safety, emergency management, and other officials who routinely participate in the State or major urban area’s homeland security preparedness activities.
6
Exhibit D - Page 58

Case3:14-cv-03120 Document1 Filed07/10/14 Page59 of 133

UNCLASSIFIED

ISE-FS-200

It is important to stress that this behavior-focused approach to identifying suspicious activity requires that factors such as race, ethnicity, national origin, or religious affiliation should not be considered as factors that create suspicion (except if used as part of a specific suspect description). It is also important to recognize that many terrorism activities are now being funded via local or regional criminal organizations whose direct association with terrorism may be tenuous. This places law enforcement and homeland security professionals in the unique, yet demanding, position of identifying suspicious activities or materials as a byproduct or secondary element in a criminal enforcement or investigation activity. This means that, while some ISESARs may document activities or incidents to which local agencies have already responded, there is value in sharing them more broadly to facilitate aggregate trending or analysis.
Suspicious Activity Reports are not intended to be used to track or record ongoing enforcement, intelligence, or investigatory operations although they can provide information to these activities. The ISE-SAR effort offers a standardized means for sharing information regarding behavior potentially related to terrorism-related criminal activity and applying data analysis tools to the information. Any patterns identified during ISE-SAR data analysis may be investigated in cooperation with the reporting agency, Joint Terrorism Task Force (JTTF), or the State or major urban area fusion center in accordance with departmental policies and procedures. Moreover, the same constitutional standards that apply when conducting ordinary criminal investigations also apply to local law enforcement and homeland security officers conducting SAR inquiries. This means, for example, that constitutional protections and agency policies and procedures that apply to a law enforcement officer’s authority to stop, stop and frisk (“Terry Stop”)4, request identification, or detain and question an individual would apply in the same measure whether or not the observed behavior related to terrorism or any other criminal activity.
C. Overview of Nationwide SAR Cycle
As defined in the Nationwide Suspicious Activity Reporting Initiative (NSI) Concept of Operations (CONOPS5) and shown in Figure 1, the nationwide SAR process involves a total of 12 discrete steps that are grouped under five standardized business process activities – Planning, Gathering and Processing, Analysis and Production, Dissemination, and Reevaluation. The toplevel ISE-SAR business process described in this section has been revised to be consistent with the description in the NSI CONOPS. Consequently, the numbered steps in Figure 1 are the only ones that map directly to the nine-steps of the detailed information flow for nationwide SAR information sharing documented in Part C of this version of the ISE-SAR Functional Standard. For further detail on the 12 NSI steps, please refer to the NSI CONOPS.

4 “Terry Stop” refers to law enforcement circumstances related to Supreme Court of the United States ruling on “Terry v. Ohio (No. 67)” argued on December 12, 1967 and decided on June 10, 1968. This case allows a law enforcement officer to articulate reasonable suspicion as a result of a totality of circumstances (to include training and experience) and take action to frisk an individual for weapons that may endanger the officer. The Opinion of the Supreme Court regarding this case may be found at Internet site http://www.law.cornell.edu/supct/html/historics/USSC_CR_0392_0001_ZO.html.
5 PM-ISE, Nationwide SAR Initiative Concept of Operations (Washington: PM-ISE, 2008), available from www.ise.gov.
7
Exhibit D - Page 59

Case3:14-cv-03120 Document1 Filed07/10/14 Page60 of 133

UNCLASSIFIED

ISE-FS-200

Federal agencies

produce and make

available information

products to support

the development of

geographic risk

assessments by state

and major urban area

fusion centers National

coordinated information needs on

89 7
6

annual and ad hoc basis

Authorized ISE participants

access and

retrieve ISE-SAR

Front line LE

State and major urban area fusion centers, in coordination with local-Feds, develop risk assessments

State and major urban area fusion centers, in coordination with local-Feds, develop information needs based on risk assessment

personnel (FSLT) trained to recognize behavior and incidents indicative of criminal activity associated with terrorism; Community outreach plan implemented

Observation and reporting of behaviors and incidents by trained LE personnel during their routine activity

Supervisory review of the report in accordance with

Nationwide SAR Cycle

1

departmental policy
2

3

In major cities,

5
ISE-SAR posted in an ISE Shared Space

4
Determination and documentation of an ISE-SAR

At fusion center or JTTF, a trained analyst or LE officer determines, based on information available,

SAR made available to fusion center and/or JTTF

SAR reviewed by trained CT expert

knowledge, experience, and

personal judgment, whether

the information meeting the

ISE-SAR criteria may have a

terrorism nexus

Suspicious Activity Processing Steps

Planning

Gathering and Processing

Analysis and Production

Dissemination

Reevaluation

Figure 1. Overview of Nationwide SAR Process

D. ISE-SAR Top-Level Business Process

1. Planning

The activities in the planning phase of the NSI cycle, while integral to the overall NSI, are not discussed further in this Functional Standard. See the NSI CONOPS for more details.6

2. Gathering and Processing

Local law enforcement agencies or field elements of Federal agencies gather and document suspicious activity information in support of their responsibilities to investigate potential criminal activity, protect citizens, apprehend and prosecute criminals, and prevent crime. Information acquisition begins with an observation or report of unusual or suspicious behavior that may be indicative of criminal activity associated with terrorism. Such activities include, but are not limited to, theft, loss, or diversion, site breach or physical intrusion, cyber attacks, possible testing of physical response, or other unusual behavior or sector specific incidents. It is important to emphasize that context is an essential element of interpreting the relevance of such behaviors to criminal activity associated with terrorism. (See Part B for more details.)

6 Ibid., 17-18.

8
Exhibit D - Page 60

Case3:14-cv-03120 Document1 Filed07/10/14 Page61 of 133

UNCLASSIFIED

ISE-FS-200

Regardless of whether the initial observer is a private citizen, a representative of a private sector partner, a government official, or a law enforcement officer, suspicious activity is eventually reported to either a local law enforcement agency or a local, regional, or national office of a Federal agency. When the initial investigation or fact gathering is completed, the investigating official documents the event in accordance with agency policy, local ordinances, and State and Federal laws and regulations.
The information is reviewed within a local or Federal agency by appropriately designated officials for linkages to other suspicious or criminal activity in accordance with departmental policy and procedures.7 Although there is always some level of local review, the degree varies from agency to agency. Smaller agencies may forward most SARs directly to the State or major urban area fusion center or JTTF with minimal local processing. Major cities, on the other hand, may have trained counterterrorism experts on staff that apply a more rigorous analytic review of the initial reports and filter out those that can be determined not to have a potential terrorism nexus.
After appropriate local processing, agencies make SARs available to the relevant State or major urban area fusion center. Field components of Federal agencies forward their reports to the appropriate regional, district, or headquarters office employing processes that vary from agency to agency. Depending on the nature of the activity, the information could cross the threshold of “suspicious” and move immediately into law enforcement operations channels for follow-on action against the identified terrorist activity. In those cases where the local agency can determine that an activity has a direct connection to criminal activity associated with terrorism, it will provide the information directly to the responsible JTTF for use as the basis for an assessment or investigation of a terrorism-related crime as appropriate.
3. Analysis and Production
The fusion center or Federal agency enters the SAR into its local information system and then performs an additional analytic review to establish or discount a potential terrorism nexus. First, an analyst or law enforcement officer reviews the newly reported information against ISE-SAR criteria outlined in Part B of this ISE-SAR Functional Standard. Second, the Terrorist Screening Center (TSC) should be contacted to determine if there is valuable information in the Terrorist Screening Database. Third, he or she will review the input against all available knowledge and information for linkages to other suspicious or criminal activity.
Based on this review, the officer or analyst will apply his or her professional judgment to determine whether the information has a potential nexus to terrorism. If the officer or analyst cannot make this explicit determination, the report will not be accessible by the ISE, although

7 If appropriate, the agency may consult with a Joint Terrorism Task Force, Field Intelligence Group, or fusion center.
9
Exhibit D - Page 61

Case3:14-cv-03120 Document1 Filed07/10/14 Page62 of 133

UNCLASSIFIED

ISE-FS-200

it may be retained in local fusion center or Federal agency files in accordance with established retention policies and business rules.8
4. Dissemination
Once the determination of a potential terrorism nexus is made, the information becomes an ISE-SAR and is formatted in accordance with the ISE-SAR Information Exchange Package Document (IEPD) format described in Sections III and IV. This ISE-SAR is then stored in the fusion center, JTTF, or other Federal agency’s ISE Shared Space9 where it can be accessed by authorized law enforcement and homeland security personnel in the State or major urban area fusion center’s area of responsibility as well as other ISE participants, including JTTFs. This allows the fusion center to be cognizant of all terrorist-related suspicious activity in its area of responsibility, consistent with the information flow description in Part C. Although the information in ISE Shared Spaces is accessible by other ISE participants, it remains under the control of the submitting organization, i.e., the fusion center or Federal agency that made the initial determination that the activity constituted an ISE-SAR.
By this stage of the process, all initially reported SARs have been through multiple levels of review by trained personnel and, to the maximum extent possible, those reports without a potential terrorism nexus have been filtered out. Those reports posted in ISE Shared Spaces, therefore, can be presumed by Federal, State, and local analytic personnel to be terrorismrelated and information derived from them can be used along with other sources to support counterterrorism operations or develop counterterrorism analytic products. As in any analytic process, however, all information is subject to further review and validation, and analysts must coordinate with the submitting organization to ensure that the information is still valid and obtain any available relevant supplementary material before incorporating it into an analytic product.
Once ISE-SARs are accessible, they can be used to support a range of counterterrorism analytic and operational activities. This step involves the actions necessary to integrate ISESAR information into existing counterterrorism analytic and operational processes, including efforts to “connect the dots,” identify information gaps, and develop formal analytic products. Depending on privacy policy and procedures established for the NSI as a whole or by agencies responsible for individual ISE Shared Spaces, requestors may only be able to view reports in the Summary ISE-SAR Information format, i.e., without privacy fields. In these cases, requestors should contact the submitting organization directly to discuss the particular report more fully and obtain access, where appropriate, to the information in the privacy fields.

8 As was already noted in the discussion of processing by local agencies, where the fusion center or Federal agency can determine that an activity has a direct connection to a possible terrorism-related crime, it will provide the information directly to the responsible JTTF for use as the basis for an assessment or investigation.
9 PM-ISE, ISE Enterprise Architecture Framework, Version 2.0, (Washington: PM-ISE, 2008), 61-63
10
Exhibit D - Page 62

Case3:14-cv-03120 Document1 Filed07/10/14 Page63 of 133

UNCLASSIFIED

ISE-FS-200

5. Reevaluation10
Operational feedback on the status of ISE-SARs is an essential element of an effective NSI process with important implications for privacy and civil liberties. First of all, it is important to notify source organizations when information they provide is designated as an ISE-SAR by a submitting organization and made available for sharing—a form of positive feedback that lets organizations know that their initial suspicions have some validity. Moreover, the process must support notification of all ISE participants when further evidence determines that an ISE-SAR was designated incorrectly so that the original information does not continue to be used as the basis for analysis or action. This type of feedback can support organizational redress processes and procedures where appropriate.
E. Broader ISE-SAR Applicability
Consistent with the ISE Privacy Guidelines and Presidential Guideline 2, and to the full extent permitted by law, this ISE-SAR Functional Standard is designed to support the sharing of unclassified information or sensitive but unclassified (SBU)/controlled unclassified information (CUI) within the ISE. There is also a provision for using a data element indicator for designating classified national security information as part of the ISE-SAR record, as necessary. This condition could be required under special circumstances for protecting the context of the event, or specifics or organizational associations of affected locations. The State or major urban area fusion center shall act as the key conduit between the State, local, and tribal (SLT) agencies and other ISE participants. It is also important to note that the ISE Shared Spaces implementation concept is focused exclusively on terrorism-related information. However many SAR originators and consumers have responsibilities beyond terrorist activities. Of special note, there is no intention to modify or otherwise affect, through this ISE-SAR Functional Standard, the currently supported or mandated direct interactions between State, local, and tribal law enforcement and investigatory personnel and the Joint Terrorism Task Forces (JTTFs) or Field Intelligence Groups (FIGs).
This ISE-SAR Functional Standard will be used as the ISE-SAR information exchange standard for all ISE participants. Although the extensibility of this ISE-SAR Functional Standard does support customization for unique communities, jurisdictions planning to modify this ISE-SAR Functional Standard must carefully consider the consequences of customization. The PM-ISE requests that modification follow a formal change request process through the ISE-SAR Steering Committee and CTISS Committee under the Information Sharing Council, for both community coordination and consideration. Furthermore, messages that do not conform to this Functional Standard may not be consumable by the receiving organization and may require modifications by the nonconforming organizations.

10 The Reevaluation Phase also encompasses the establishment of an integrated counterterrorism information needs process, a process that does not relate directly to information exchanges through this standard. See page 23 of the NSI CONOPS for more details.
11
Exhibit D - Page 63

Case3:14-cv-03120 Document1 Filed07/10/14 Page64 of 133

UNCLASSIFIED

ISE-FS-200

F. Protecting Privacy
Laws that prohibit or otherwise limit the sharing of personal information vary considerably between the Federal, State, local, and tribal levels. The Privacy Act of 1974 (5 USC §552a) as amended, other statutes such as the E-Government Act, and many government-wide or departmental regulations establish a framework and criteria for protecting information privacy in the Federal Government. The ISE must facilitate the sharing of information in a lawful manner, which by its nature must recognize, in addition to Federal statutes and regulations, different State, local or tribal laws, regulations, or policies that affect privacy. One method for protecting privacy while enabling the broadest possible sharing is to anonymize ISE-SAR reports by excluding data elements that contain personal information. Accordingly, two different formats are available for ISE-SAR information. The Detailed ISE-SAR IEPD format includes personal information contained in the data fields set forth in Section IV of this ISE-SAR Functional Standard (“ISE-SAR Exchange Data Model”), including “privacy fields” denoted as containing personal information. If an ISE participant is not authorized to disseminate personal information from an ISE Shared Space (e.g., the requester site does not have a compliant privacy policy) or the SAR does not evidence the necessary nexus to terrorism-related crime (as required by this ISE-SAR Functional Standard), information from the privacy fields will not be loaded into the responsive document (search results) from the ISE Shared Space. This personal information will not be passed to the ISE participant. The Summary ISE-SAR Information format excludes privacy fields or data elements identified in Section IV of this ISE-SAR Functional Standard as containing personal information. Each ISE participant can exclude additional data elements from the Summary ISE-SAR Information format in accordance with its own legal and policy requirements. It is believed the data contained within a Summary ISE-SAR Information format will support sufficient trending and pattern recognition to trigger further analysis and/or investigation where additional information can be requested from the sending organization. Because of variances of data expected within ISE-SAR exchanges, only the minimum elements are considered mandatory. These are enumerated in the READ ME document in the technical artifacts folder that is part of this ISE-SAR Functional Standard.
Currently, the privacy fields identified in the ISE-SAR exchange data model (Section IV, below) are the minimum fields that should be removed from a Detailed ISE-SAR IEPD.
SECTION III – INFORMATION EXCHANGE DEVELOPMENT
This ISE-SAR Functional Standard is a collection of artifacts that support an implementer’s creation of ISE-SAR information exchanges, whether Detailed ISE-SAR IEPD or Summary ISE-SAR Information. The basic ISE-SAR information exchange is documented using five unique artifacts giving implementers tangible products that can be leveraged for local implementation. A domain model provides a graphical depiction of those data elements required for implementing an exchange and the cardinality between those data elements. Second, a Component Mapping Template is a spreadsheet that associates each required data element with its corresponding XML data element. Third, information exchanges include the schemas which consist of a document, extension, and constraint schema. Fourth, at least one sample XML Instance and associated style-sheet is included to help practitioners validate the model, mapping,

12
Exhibit D - Page 64

Case3:14-cv-03120 Document1 Filed07/10/14 Page65 of 133

UNCLASSIFIED

ISE-FS-200

and schemas in a more intuitive way. Fifth, a codified data field values listing provides listings, descriptions, and sources as prescribed by the data fields.

SECTION IV – ISE-SAR EXCHANGE DATA MODEL

A. Summary of Elements

This section contains a full inventory of all ISE-SAR information exchange data classes, elements, and definitions. Items and definitions contained in cells with a light purple background are data classes, while items and definition contained in cells with a white background are data elements. A wider representation of data class and element mappings to source (ISE-SAR information exchange) and target is contained in the Component Mapping Template located in the technical artifacts folder.

Cardinality between objects in the model is indicated on the line in the domain model (see Section 5A). Cardinality indicates how many times an entity can occur in the model. For example, Vehicle, Vessel, and Aircraft all have cardinality of 0..n. This means that they are optional, but may occur multiple times if multiple suspect vehicles are identified.

Clarification of Organizations used in the exchange:

• The Source Organization is the agency or entity that originates the SAR report (examples include a local police department, a private security firm handling security for a power plant, and a security force at a military installation). The Source Organization will not change throughout the life of the SAR.
• The Submitting Organization is the organization providing the ISE-SAR to the community through their ISE Shared Space. The Submitting Organization and the Source Organization may be the same.
• The Owning Organization is the organization that owns the target associated with the suspicious activity.

Table 2 – ISE-SAR Information Exchange Data Classes, Elements, and Definitions

Privacy Field
X

Source Class/Element

Source Definition

Aircraft Aircraft Engine Quantity Aircraft Fuselage Color Aircraft Wing Color
Aircraft ID
Aircraft Make Code Aircraft Model Code

The number of engines on an observed aircraft.
A code identifying a color of a fuselage of an aircraft.
A code identifying a color of a wing of an aircraft.
A unique identifier assigned to the aircraft by the observing organization—used for referencing. *If this identifier can be used to identify a specific aircraft, for instance, by using the aircraft tail number, then this element is a privacy field. [free text field]
A code identifying a manufacturer of an aircraft.
A code identifying a specific design or type of aircraft made by a manufacturer.

13
Exhibit D - Page 65

Case3:14-cv-03120 Document1 Filed07/10/14 Page66 of 133

UNCLASSIFIED

ISE-FS-200

Privacy Field X
X X

Source Class/Element

Source Definition

Aircraft Style Code
Aircraft Tail Number
Attachment Attachment Type Text Binary Image Capture Date Description Text Format Type Text
Attachment URI
Attachment Privacy Field Indicator Contact Information Person First Name Person Last Name E-Mail Address Full Telephone Number Driver License Expiration Date Expiration Year
Issuing Authority Text
Driver License Number
Follow-Up Action Activity Date Activity Time
Assigned By Text
Assigned To Text
Disposition Text Status Text Location

A code identifying a style of an aircraft. An aircraft identification number prominently displayed at various locations on an aircraft, such as on the tail and along the fuselage. [free text field]
Describes the type of attachment (e.g., surveillance video, mug shot, evidence). [free text field] Binary encoding of the attachment. The date that the attachment was created. Text description of the attachment. [free text field] Format of attachment (e.g., mpeg, jpg, avi). [free text field] Uniform Resource Identifier (URI) for the attachment. Used to match the attachment link to the attachment itself. Standard representation type that can be used for Uniform Resource Locators (URLs) and Uniform Resource Names (URNs). Identifies whether the binary attachment contains information that may be used to identify an individual.
Person to contact at the organization. Person to contact at the organization. An email address of a person or organization. [free text field] A full length telephone identifier representing the digits to be dialed to reach a specific telephone instrument. [free text field]
The month, date, and year that the document expires. The year the document expires. Code identifying the organization that issued the driver license assigned to the person. Examples include Department of Motor Vehicles, Department of Public Safety and Department of Highway Safety and Motor Vehicles. [free text field] A driver license identifier or driver license permit identifier of the observer or observed person of interest involved with the suspicious activity. [free text field]
Date that the follow-up activity started. Time that the follow up activity started. Organizational identifier that describes the organization performing a follow-up activity. This is designed to keep all parties interested in a particular ISE-SAR informed of concurrent investigations. [free text field] Text describing the person or sub-organization that will be performing the designated action. [free text field] Description of disposition of suspicious activity investigation. [free text field] Description of the state of follow-up activity. [free text field]

14
Exhibit D - Page 66

Case3:14-cv-03120 Document1 Filed07/10/14 Page67 of 133

UNCLASSIFIED

ISE-FS-200

Privacy Field X
X X

Source Class/Element

Source Definition

Location Description
Location Address Building Description County Name Country Name Cross Street Description Floor Identifier
ICAO Airfield Code for Departure
ICAO Airfield Code for Planned Destination
ICAO for Actual Destination
ICAO Airfield for Alternate
Mile Marker Text
Municipality Name Postal Code State Name Street Name Street Number Street Post Directional Street Pre Directional Street Type Unit ID Location Coordinates Altitude Coordinate Datum Latitude Degree
Latitude Minute
Latitude Second

A description of a location where the suspicious activity occurred. If the location is an address that is not broken into its component parts (e.g., 1234 Main Street), this field may be used to store the compound address. [free text field]
A complete reference that identifies a building. [free text field]
A name of a county, parish, or vicinage. [free text field]
A country name or other identifier. [free text field]
A description of an intersecting street. [free text field]
A reference that identifies an actual level within a building. [free text field]
An International Civil Aviation Organization (ICAO) airfield code for departure, indicates aircraft, crew, passengers, and cargo-on conveyance location information. [free text field]
An airfield code for planned destination, indicates aircraft, crew, passengers, and cargo on conveyance location information [free text field]
An airfield code for actual destination. Indicates aircraft, crew, passengers, and cargo on conveyance location information. [free text field]
An airfield code for Alternate. Indicates aircraft, crew, passengers, and cargo on conveyance location information. [free text field]
Identifies the sequentially numbered marker on a roadside that is closest to the intended location. Also known as milepost, or mile post. [free text field]
The name of the city or town. [free text field]
The zip code or postal code. [free text field]
Code identifying the state.
A name that identifies a particular street. [free text field]
A number that identifies a particular unit or location within a street. [free text field]
A direction that appears after a street name. [free text field]
A direction that appears before a street name. [free text field]
A type of street, e.g., Street, Boulevard, Avenue, Highway. [free text field]
A particular unit within the location. [free text field]
Height above or below sea-level of a location.
Coordinate system used for plotting location.
A value that specifies the degree of a latitude. The value comes from a restricted range between -90 (inclusive) and +90 (inclusive).
A value that specifies a minute of a degree. The value comes from a restricted range of 0 (inclusive) to 60 (exclusive).
A value that specifies a second of a minute. The value comes from a restricted range of 0 (inclusive) to 60 (exclusive).

15
Exhibit D - Page 67

Case3:14-cv-03120 Document1 Filed07/10/14 Page68 of 133

UNCLASSIFIED

ISE-FS-200

Privacy Field
X
X X X X
X X X

Source Class/Element

Source Definition

Longitude Degree
Longitude Minute
Longitude Second
Conveyance track/intent Observer
Observer Type Text
Person Employer ID Owning Organization Organization Item
Organization Description
Organization ID
Organization Local ID Other Identifier Person Identification Number (PID) PID Effective Date PID Effective Year PID Expiration Date PID Expiration Year PID Issuing Authority Text
PID Type Code Passport Passport ID Expiration Date Expiration Year Issuing Country Code Person AFIS FBI Number

A value that specifies the degree of a longitude. The value comes from a restricted range between -180 (inclusive) and +180 (exclusive). A value that specifies a minute of a degree. The value comes from a restricted range of 0 (inclusive) to 60 (exclusive). A value that specifies a second of a minute. The value comes from a restricted range of 0 (inclusive) to 60 (exclusive). A direction by heading and speed or enroute route and/or waypoint of conveyance [free text field]
Indicates the relative expertise of an observer to the suspicious activity (e.g., professional observer versus layman). Example: a security guard at a utility plant recording the activity, or a citizen driving by viewing suspicious activity. [free text field] Number assigned by an employer for a person such as badge number. [free text field]
A name of an organization that owns the target. [free text field] A text description of organization that owns the target. The description may indicate the type of organization such as State Bureau of Investigation, Highway Patrol, etc. [free text field] A federal tax identifier assigned to an organization. Sometimes referred to as a Federal Employer Identification Number (FEIN), or an Employer Identification Number (EIN). [free text field] An identifier assigned on a local level to an organization. [free text field]
An identifying number assigned to the person, e.g., military serial numbers. [free text field] The month, date, and year that the PID number became active or accurate. The year that the PID number became active or accurate. The month, date, and year that the PID number expires. The year that the PID number expires. The issuing authority of the identifier. This may be a State, military organization, etc. Code identifying the type of identifier assigned to the person. [free text field]
Document Unique Identifier. [free text field] The month, date, and year that the document expires. The year the document expires. Code identifying the issuing country. [free text field]
A number issued by the FBI’s Automated Fingerprint Identification System (AFIS) based on submitted fingerprints. [free text field]

16
Exhibit D - Page 68

Case3:14-cv-03120 Document1 Filed07/10/14 Page69 of 133

UNCLASSIFIED

ISE-FS-200

Privacy Field
X
X X
X X X X X

Source Class/Element

Source Definition

Age Age Unit Code Date of Birth Year of Birth Ethnicity Code Maximum Age Minimum Age State Identifier
Tax Identifier Number
Person Name First Name Last Name Middle Name
Full Name
Moniker
Name Suffix
Name Type Physical Descriptors Build Description Eye Color Code Eye Color Text Hair Color Code Hair Color Text Person Eyewear Text Person Facial Hair Text Person Height Person Height Unit Code
Person Maximum Height
Person Minimum Height
Person Maximum Weight

A precise measurement of the age of a person. Code that identifies the unit of measure of an age of a person (e.g., years, months). [free text field] The month, date, and year that a person was born. The year a person was born. Code that identifies the person’s cultural lineage. The maximum age measurement in an estimated range. The minimum age measurement in an estimated range. Number assigned by the State based on biometric identifiers or other matching algorithms. [free text field] A 9-digit numeric identifier assigned to a living person by the U.S. Social Security Administration. A social security number of the person. [free text field]
A first name or given name of the person. [free text field] A last name or family name of the person. [free text field] A middle name of a person. [free text field] Used to designate the compound name of a person that includes all name parts. This field should only be used when the name cannot be broken down into its component parts or if the information is not available in its component parts. [free text field] Alternative, or gang name for a person. [free text field] A component that is appended after the family name that distinguishes members of a family with the same given, middle, and last name, or otherwise qualifies the name. [free text field] Text identifying the type of name for the person. For example, maiden name, professional name, nick name.
Text describing the physique or shape of a person. [free text field] Code identifying the color of the person’s eyes. Text describing the color of a person’s eyes. [free text field] Code identifying the color of the person’s hair. Text describing the color of a person’s hair. [free text field] A description of glasses or other eyewear a person wears. [free text field] A kind of facial hair of a person. [free text field] A measurement of the height of a person. Code that identifies the unit of measure of a height of a person. [free text field] The maximum measure value on an estimated range of the height of the person. The minimum measure value on an estimated range of the height of the person. The maximum measure value on an estimated range of the weight of the person.

17
Exhibit D - Page 69

Case3:14-cv-03120 Document1 Filed07/10/14 Page70 of 133

UNCLASSIFIED

ISE-FS-200

Privacy Field
X

Source Class/Element

Source Definition

Person Minimum Weight

The minimum measure value on an estimated range of the weight of the person.

Person Sex Code

A code identifying the gender or sex of a person (e.g., Male or Female).

Person Weight

A measurement of the weight of a person.

Person Weight Unit Code

Code that identifies the unit of measure of a weight of a person. [free text field]

Race Code

Code that identifies the race of the person.

Skin Tone Code

Code identifying the color or tone of a person’s skin.

Clothing Description Text

A description of an article of clothing. [free text field]

Physical Feature

Feature Description

A text description of a physical feature of the person. [free text field]

Feature Type Code

A special kind of physical feature or any distinguishing feature. Examples include scars, marks, tattoos, or a missing ear. [free text field]

Location Description

A description of a location. If the location is an address that is not broken into its component parts (e.g., 1234 Main Street), this field may be used to store the compound address. [free text field]

Registration

Registration Authority Code

Text describing the organization or entity authorizing the issuance of a registration for the vehicle involved with the suspicious activity. [free text field]

Registration Number

The number on a metal plate fixed to/assigned to a vehicle. The purpose of the registration number is to uniquely identify each vehicle within a state. [free text field]

Registration Type

Code that identifies the type of registration plate or license plate of a vehicle. [free text field]

Registration Year

A 4-digit year as shown on the registration decal issued for the vehicle.

ISE-SAR Submission

Additional Details Indicator

Identifies whether more ISE-SAR details are available at the authoring/originating agency than what has been provided in the information exchange.

Data Entry Date

Date the data was entered into the reporting system (e.g., the Records Management System).

Dissemination Code

Generally established locally, this code describes the authorized recipients of the data. Examples include Law Enforcement Use, Do Not Disseminate, etc.

Fusion Center Contact First Identifies the first name of the person to contact at the fusion

Name

center. [free text field]

Fusion Center Contact Last Identifies the last name of the person to contact at the fusion

Name

center. [free text field]

Fusion Center Contact E-Mail Identifies the email address of the person to contact at the fusion

Address

center. [free text field]

Fusion Center Contact Telephone Number

The full phone number of the person at the fusion center that is familiar with the record (e.g., law enforcement officer).

18
Exhibit D - Page 70

Case3:14-cv-03120 Document1 Filed07/10/14 Page71 of 133

UNCLASSIFIED

ISE-FS-200

Privacy Field

Source Class/Element

Source Definition

Message Type Indicator Privacy Purge Date
Privacy Purge Review Date Submitting ISE-SAR Record ID ISE-SAR Submission Date ISE-SAR Title
ISE-SAR Version
Source Agency Case ID Source Agency Record Reference Name Source Agency Record Status Code
Privacy Information Exists Indicator
Sensitive Information Details Classification Label Classification Reason Text
Sensitivity Level
Tearlined Indicator Source Organization Organization Name Organization ORI
System ID
Fusion Center Submission Date Source Agency Contact First Name Source Agency Contact Last Name Source Agency Contact Email Address

e.g., Add, Update, Purge. The date by which the privacy information will be purged from the record system; general observation data is retained. Date of review to determine the disposition of the privacy fields in a Detailed ISE-SAR IEPD record. Identifies the Fusion Center ISE-SAR Record identifier for reports that are possibly related to the current report. [free text field] Date of submission for the ISE-SAR Record. Plain language title (e.g., Bomb threat at the “X” Hotel). [free text field] Indicates the specific version of the ISE-SAR that the XML Instance corresponds. [free text field] The case identifier for the agency that originated the SAR. Often, this will be a local law enforcement agency. [free text field] The case identifier that is commonly used by the source agency— may be the same as the System ID. [free text field]
The current status of the record within the source agency system.
Indicates whether privacy information is available from the source fusion center. This indicator may be used to guide people who only have access to the summary information exchange as to whether or not they can follow-up with the originating fusion center to obtain more information.
A classification of information. Includes Confidential, Secret, Top Secret, no markings. [free text field] A reason why the classification was made as such. [free text field] Local information security categorization level (Controlled Unclassified Information-CUI, including Sensitive But Unclassified or Law Enforcement Sensitive). [free text field] Identifies whether a report is free of classified information.
The name used to refer to the agency originating the SAR. [free text field] Originating Agency Identification (ORI) used to refer to the agency. The system that the case identifier (e.g., Records Management System, Computer Aided Dispatch) relates to within or the organization that originated the Suspicious Activity Report. [free text field]
Date of submission to the Fusion Center.
The first name of the person at the agency that is familiar with the record (e.g., law enforcement officer). [free text field] The last name of the person at the agency that is familiar with the record (e.g., law enforcement officer). [free text field] The email address of the person at the agency that is familiar with the record (e.g., law enforcement officer). [free text field]

19
Exhibit D - Page 71

Case3:14-cv-03120 Document1 Filed07/10/14 Page72 of 133

UNCLASSIFIED

ISE-FS-200

Privacy Field

Source Class/Element

Source Definition

Source Agency Contact Phone Number Suspicious Activity Report Community Description Community URI
LEXS Version
Message Date/Time Sequence Number Source Reliability Code
Content Validity Code
Nature of Source-Code
Nature of Source-Text Submitting Organization Organization Name Organization ID Organization ORI System ID Suspicious Activity Activity End Date Activity End Time Activity Start Date Activity Start Time Observation Description Text Observation End Date Observation End Time

The full phone number of the person at the agency that is familiar with the record (e.g., law enforcement officer).
Describes the intended audience of the document. [free text field]
The URL to resolve the ISE-SAR information exchange payload namespace.
Identifies the version of Department of Justice LEISP Exchange Specification (LEXS) used to publish this document. ISE-FS-200 has been built using LEXS version 3.1. The schema was developed by starting with the basic LEXS schema and extending that definition by adding those elements not included in LEXS. [free text field]
A timestamp identifying when this message was received.
A number that uniquely identifies this message.
Reliability of the source, in the assessment of the reporting organization: could be one of ‘reliable’, ‘unreliable’, or ‘unknown’
Validity of the content, in the assessment of the reporting organization: could be one of ‘confirmed’, ‘doubtful’, or ‘cannot be judged’
Nature of the source: Could be one of ‘anonymous tip’, ‘confidential source’, trained interviewer’, ‘written statement – victim, witness, other’, private sector’, or ‘other source’
Optional information of ‘other source’ is selected above. [free text field]
Common Name of the fusion center or ISE participant that submitted the ISE-SAR record to the ISE. [free text field]
Fusion center or ISE participant’s alpha-numeric identifier. [free text field]
ORI for the submitting fusion center or ISE participant. [free text field]
Identifies the system within the fusion center or ISE participant that is submitting the ISE-SAR. [free text field]
The end or completion date in Greenwich Mean Time (GMT) of an incident that occurs over a duration of time.
The end or completion time in GMT of day of an incident that occurs over a duration of time.
The date in GMT when the incident occurred or the start date if the incident occurs over a period of time.
The time of day in GMT that the incident occurred or started.
Description of the activity including rational for potential terrorism nexus. [free text field]
The end or completion date in GMT of the observation of an activity that occurs over a duration of time.
The end or completion time of day in GMT of the observation of an activity that occurred over a period of time.

20
Exhibit D - Page 72

Case3:14-cv-03120 Document1 Filed07/10/14 Page73 of 133

UNCLASSIFIED

ISE-FS-200

Privacy Field

Source Class/Element

Source Definition

Observation Start Date Observation Start Time Threat Type Code
Threat Type Detail Text
Suspicious Activity Code Weather Condition Details Target
Critical Infrastructure Indicator
Infrastructure Sector Code
Infrastructure Tier Text
Structure Type Code Target Type Text Structure Type Text Target Description Text Vehicle Color Code Description Make Name Model Name Style Code Vehicle Year

The date in GMT when the observation of an activity occurred or the start date if the observation of the activity occurred over a period of time.
The time of day in GMT that the observation of an activity occurred or started.
Broad category of threat to which the tip or lead pertains. Includes Financial Incident, Suspicious Activity, and Cyber Crime.
Breakdown of the Tip Type, it indicates the type of threat to which the tip or lead pertains. The subtype is often dependent on the Tip Type. For example, the subtypes for a nuclear/radiological tip class might be Nuclear Explosive or a Radiological Dispersal Device. [free text field]
Indicates the type of threat to which the tip or lead pertains. Examples include a biological or chemical threat.
The weather at the time of the suspicious activity. The weather may be described using codified lists or text.
Critical infrastructure, as defined by 42 USC Sec. 5195c, means systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.
The broad categorization of the infrastructure type. These include telecommunications, electrical power systems, gas and oil storage and transportation, banking and finance, transportation, water supply systems, emergency services (including medical, police, fire, and rescue), and continuity of government.
Provides additional detail that enhances the Target Sector Code. For example, if the target sector is Utilities, this field would indicate the type of utility that has been targeted such as power station or power transmission. [free text field]
National Data Exchange (N-DEx) Code that identifies the type of Structure that was involved in the incident.
Describes the target type if an appropriate sector code is not available. [free text field]
Text for use when the Structure Type Code does not afford necessary code. [free text field]
Text describing the target (e.g., Lincoln Bridge). [free text field]
Code that identifies the primary color of a vehicle involved in the suspicious activity.
Text description of the entity. [free text field]
Code that identifies the manufacturer of the vehicle.
Code that identifies the specific design or type of vehicle made by a manufacturer—sometimes referred to as the series model.
Code that identifies the style of a vehicle. [free text field]
A 4-digit year that is assigned to a vehicle by the manufacturer.

21
Exhibit D - Page 73

Case3:14-cv-03120 Document1 Filed07/10/14 Page74 of 133

UNCLASSIFIED

ISE-FS-200

Privacy Field X X
X X X
X

Source Class/Element

Source Definition

Vehicle Identification Number Used to uniquely identify motor vehicles. [free text field]

US DOT Number

An assigned number sequence required by Federal Motor Carrier Safety Administration (FMCSA) for all interstate carriers. The identification number (found on the power unit, and assigned by the U.S. Department of Transportation or by a State) is a key element in the FMCSA databases for both carrier safety and regulatory purposes. [free text field]

Vehicle Description

A text description of a vehicle. Can capture unique identifying information about a vehicle such as damage, custom paint, etc. [free text field]

Related ISE-SAR

Fusion Center ID

Identifies the fusion center that is the source of the ISE-SAR. [free text field]

Fusion Center ISE-SAR Record ID

Identifies the fusion center ISE-SAR record identifier for reports that are possibly related to the current report.

Relationship Description Text

Describes how this ISE-SAR is related to another ISE-SAR. [free text field]

Vessel

Vessel Official Coast Guard Number Identification

An identification for the Official (U.S. Coast Guard Number of a vessel). Number is encompassed within valid marine documents and permanently marked on the main beam of a documented vessel. [free text field]

Vessel ID

A unique identifier assigned to the boat record by the agency— used for referencing. [free text field]

Vessel ID Issuing Authority

Identifies the organization authorization over the issuance of a vessel identifier. Examples of this organization include the State Parks Department and the Fish and Wildlife department. [free text field]

Vessel IMO Number Identification

An identification for an International Maritime Organization Number (IMO number) of a vessel [free text field]

Vessel MMSI Identification

An identification for the Maritime Mobile Service Identity (MMSI) or a vessel [free text field]

Vessel Make

Code that identifies the manufacturer of the boat.

Vessel Model

Model name that identifies the specific design or type of boat made by a manufacturer—sometimes referred to as the series model.

Vessel Model Year

A 4-digit year that is assigned to a boat by the manufacturer.

Vessel Name

Complete boat name and any numerics. [free text field]

Vessel Hailing Port

The identifying attributes of the hailing port of a vessel [free text field]

Vessel National Flag

A data concept for a country under which a vessel sails. [free text field]

Vessel Overall Length

The length measurement of the boat, bow to stern.

Vessel Overall Length Measure

Code that identifies the measurement unit used to determine the boat length. [free text field]

Vessel Serial Number

The identification number of a boat involved in an incident. [free text field]

Vessel Type Code

Code that identifies the type of boat.

22
Exhibit D - Page 74

Case3:14-cv-03120 Document1 Filed07/10/14 Page75 of 133

UNCLASSIFIED

ISE-FS-200

Privacy Field

Source Class/Element

Source Definition

Vessel Propulsion Text

Text for use when the Boat Propulsion Code does not afford necessary code. [free text field]

B. Association Descriptions

This section defines specific data associations contained in the ISE-SAR data model structure. Reference Figure 2 (UML-based model) for the graphical depiction and detailed elements.

Table 3 – ISE-SAR Data Model Structure Associations

Link Between Associated Components

Target Element

Link From Suspicious Activity Report to Attachment

lexs:Digest/lexsdigest:Associations/lexsdigest:EntityAttachmentLinkAssociation

Link From Suspicious Activity Report to Sensitive Information Details

Hierarchical Association

Link From Suspicious Activity Report to ISE-SAR Submission

Hierarchical Association

Link From Suspicious Activity to Vehicle

lexs:Digest/lexsdigest:Associations/lexsdigest:IncidentInvolvedItemAssociation

Link From Vehicle to Registration

Hierarchical Association

Link From Suspicious Activity to Vessel

lexs:Digest/lexsdigest:Associations/lexsdigest:IncidentInvolvedItemAssociation

Link From Suspicious Activity to Aircraft

lexs:Digest/lexsdigest:Associations/lexsdigest:IncidentInvolvedItemAssociation

Link From Suspicious Activity to Location

lexs:Digest/lexsdigest:Associations/lexsdigest:ActivityLocationAssociation

Link From Suspicious Activity to Target

Hierarchical Association

Link From Location to Location Coordinates

Hierarchical Association

Link From Location to Location Address

Hierarchical Association

Link From Suspicious Activity Report to Related ISE-SAR

Hierarchical Association

Link From Person to Location lexs:Digest/lexsdigest:Associations/lexsdigest:PersonLocationAssociation

Link From Person to Contact lexs:Digest/lexsdigest:Associations/lexsdigest:EntityEmailAssociation or

Information

lexs:Digest/lexsdigest:Associations/lexsdigest:EntityTelephoneNumberAssociation

Link From Person to Driver License

Hierarchical Association

Link From Person to Passport Hierarchical Association

Link From Person to Other Identifier

Hierarchical Association

23
Exhibit D - Page 75

Case3:14-cv-03120 Document1 Filed07/10/14 Page76 of 133

UNCLASSIFIED

ISE-FS-200

Link Between Associated Components

Target Element

Link From Person to Physical Descriptors

Hierarchical Association

Link From Person to Physical Feature

Hierarchical Association

Link From Person to Person Name

Hierarchical Association

Link From Suspicious Activity Report to Follow-Up Action

Hierarchical Association

Link From Target to Location lexs:Digest/lexsdigest:Associations/lexsdigest:ItemLocationAssociation

Link From Suspicious Activity Report to Organization

Hierarchical Association

Link From Suspicious Activity to Person [Witness]

lexs:Digest/lexsdigest:Associations/lexsdigest:IncidentWitnessAssociation

Link From Suspicious Activity to Person [Person Of Interest]

lexs:Digest/lexsdigest:Associations/lexsdigest:PersonOfInterestAssociation

Link From Organization to Target

ext:SuspiciousActivityReport/nc:OrganizationItemAssociation

Link from ISE-SAR Submission to Submitting Organization

Hierarchical Association

Link From Submitting Organization to Contact Information

Hierarchical Association
(Note that the mapping indicates context and we are not reusing Contact Information components)

C. Extended XML Elements
Additional data elements are also identified as new elements outside of NIEM, Version 2.0. These elements are listed below:
AdditionalDetailsIndicator: Identifies whether more ISE-SAR details are available at the authoring/originating agency than what has been provided in the information exchange.
AssignedByText: Organizational identifier that describes the organization performing a follow-up activity. This is designed to keep all parties interested in a particular ISE-SAR informed of concurrent investigations.
AssignedToText: Text describing the person or sub-organization that will be performing the designated follow-up action.
ClassificationReasonText: A reason why the classification was made as such.
ContentValidityCode: Validity of the content, in the assessment of the reporting organization: could be one of ‘confirmed’, ‘doubtful’, or ‘cannot be judged’.

24
Exhibit D - Page 76

Case3:14-cv-03120 Document1 Filed07/10/14 Page77 of 133

UNCLASSIFIED

ISE-FS-200

Conveyancetrack/intent: A direction by heading and speed or enroute route and/or waypoint of conveyance.
CriticalInfrastructureIndicator: Critical infrastructure, as defined by 42 USC Sec. 5195c, means systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.
ICAOAirfieldCodeforDeparture: An International Civil Aviation Organization (ICAO) airfield code for departure, indicates aircraft, crew, passengers, and cargo-on conveyance location information.
ICAOAirfieldCodeforPlannedDestination: An airfield code for planned destination, indicates aircraft, crew, passengers, and cargo on conveyance location information.
ICAOforActualDestination: An airfield code for actual destination. Indicates aircraft, crew, passengers, and cargo on conveyance location information.
ICAOAirfieldforAlternate: An airfield code for Alternate. Indicates aircraft, crew, passengers, and cargo on conveyance location information.
NatureofSource-Code: Nature of the source: Could be one of ‘anonymous tip’, ‘confidential source’, trained interviewer’, ‘written statement – victim, witness, other’, private sector’, or ‘other source’.
PrivacyFieldIndicator: Data element that may be used to identify an individual and therefore is subject to protection from disclosure under applicable privacy rules. Removal of privacy fields from a detailed report will result in a summary report. This privacy field informs users of the summary information exchange that additional information may be available from the originator of the report.
ReportPurgeDate: The date by which the privacy fields will be purged from the record system; general observation data is retained. Purge policies vary from jurisdiction to jurisdiction and should be indicated as part of the guidelines.
ReportPurgeReviewDate: Date of review to determine the disposition of the privacy fields in a Detailed ISE-SAR IEPD record.
SourceReliabilityCode: Reliability of the source, in the assessment of the reporting organization: could be one of ‘reliable’, ‘unreliable’, or ‘unknown’.
VesselHailingPort: The identifying attributes of the hailing port of a vessel.
VesselNationalFlag: A data concept for a country under which a vessel sails.

25
Exhibit D - Page 77

Case3:14-cv-03120 Document1 Filed07/10/14 Page78 of 133

UNCLASSIFIED

ISE-FS-200

SECTION V – INFORMATION EXCHANGE IMPLEMENTATION ARTIFACTS
A. Domain Model
1. General Domain Model Overview
The domain model provides a visual representation of the business data requirements and relationships (Figure 2). This Unified Modeling Language (UML)-based Model represents the Exchange Model artifact required in the information exchange development methodology. The model is designed to demonstrate the organization of data elements and illustrate how these elements are grouped together into Classes. Furthermore, it describes relationships between these Classes. A key consideration in the development of a Domain Model is that it must be independent of the mechanism intended to implement the model. The domain model is actually a representation of how data is structured from a business context. As the technology changes and new Functional Standards emerge, developers can create new standards mapping documents and schema tied to a new standard without having to readdress business process requirements.

Figure 2 – UML-based Model
26
Exhibit D - Page 78

Case3:14-cv-03120 Document1 Filed07/10/14 Page79 of 133

UNCLASSIFIED

ISE-FS-200

B. General Mapping Overview

The detailed component mapping template provides a mechanism to cross-reference the business data requirements documented in the Domain Model to their corresponding XML Element in the XML Schema. It includes a number of items to help establish equivalency including the business definition and the corresponding XML Element Definition.

C. ISE-SAR Mapping Overview

The Mapping Spreadsheet contains seven unique items for each ISE-SAR data class and element. The Mapping Spreadsheet columns are described in this section.

Spreadsheet Name & Row Privacy Field Indicator Source Class/ Element
Source Definition
Target Element
Target Element Definition Target Element Base Mapping Comments

Table 4 – Mapping Spreadsheet Column Descriptions
Description
This field indicates that the information may be used to identify an individual.
Content in this column is either the data class (grouping of data elements) or the actual data elements. Classes are highlighted and denoted with cells that contain blue background while elements have a white background. The word “Source” is referring to the ISE-SAR information exchange. The content in this column is the class or element definition defined for this ISE-SAR information exchange. The word “Source” is referring to the ISE-SAR information exchange definition. The content in this column is the actual namespace path deemed equal to the related ISESAR information exchange element. The content in this column provides the definition of the target or NIEM element located at the aforementioned source path. “Target” is referring to the NIEM definition. Indicates the data type of the terminal element. Data types of niem-xsd:String or nc:TextType indicate free-form text fields. Provides technical implementation information for developers and implementers of the information exchange.

D. Schemas
The ISE-SAR Functional Standard contains the following compliant schemas;
• Subset Schema • Exchange Schema • Extension Schema • Wantlist

27
Exhibit D - Page 79

Case3:14-cv-03120 Document1 Filed07/10/14 Page80 of 133

UNCLASSIFIED

ISE-FS-200

E. Examples
The ISE-SAR Functional Standard contains two samples that illustrate exchange content as listed below.
1. XSL Style Sheet
This information exchange artifact provides an implementer and users with a communication tool which captures the look and feel of a familiar form, screen, or like peripheral medium for schema translation testing and user validation of business rules.
2. XML Instance
This information exchange artifact provides an actual payload of information with data content defined by the schema(s).

28
Exhibit D - Page 80

Case3:14-cv-03120 Document1 Filed07/10/14 Page81 of 133

UNCLASSIFIED

ISE-FS-200

PART B – ISE-SAR CRITERIA GUIDANCE

Category

Description

DEFINED CRIMINAL ACTIVITY AND POTENTIAL TERRORISM NEXUS ACTIVITY

Breach/Attempted Intrusion

Unauthorized personnel attempting to or actually entering a restricted area or protected site. Impersonation of authorized personnel (e.g. police/security, janitor).

Misrepresentation

Presenting false or misusing insignia, documents, and/or identification, to misrepresent one’s affiliation to cover possible illicit activity.

Theft/Loss/Diversion

Stealing or diverting something associated with a facility/infrastructure (e.g., badges, uniforms, identification, emergency vehicles, technology or documents {classified or unclassified}, which are proprietary to the facility).

Sabotage/Tampering/ Vandalism

Damaging, manipulating, or defacing part of a facility/infrastructure or protected site.

Cyber Attack

Compromising, or attempting to compromise or disrupt an organization’s information technology infrastructure.

Expressed or Implied Threat

Communicating a spoken or written threat to damage or compromise a facility/infrastructure.

Aviation Activity

Operation of an aircraft in a manner that reasonably may be interpreted as suspicious, or posing a threat to people or property. Such operation may or may not be a violation of Federal Aviation Regulations.

POTENTIAL CRIMINAL OR NON-CRIMINAL ACTIVITY REQUIRING ADDITIONAL FACT INFORMATION DURING INVESTIGATION11

Eliciting Information

Questioning individuals at a level beyond mere curiosity about particular facets of a facility’s or building’s purpose, operations, security procedures, etc., that would arouse suspicion in a reasonable person.

Testing or Probing of Security

Deliberate interactions with, or challenges to, installations, personnel, or systems that reveal physical, personnel or cyber security capabilities.

Recruiting

Building of operations teams and contacts, personnel data, banking data or travel data

Photography

Taking pictures or video of facilities, buildings, or infrastructure in a manner that would arouse suspicion in a reasonable person. Examples include taking pictures or video of infrequently used access points, personnel performing security functions (patrols, badge/vehicle checking), security-related equipment (perimeter fencing, security cameras), etc.

11 Note: These activities are generally First Amendment-protected activities and should not be reported in a SAR or ISE-SAR
absent articulable facts and circumstances that support the source agency’s suspicion that the behavior observed is not innocent, but rather reasonably indicative of criminal activity associated with terrorism, including evidence of pre-operational planning related to terrorism. Race, ethnicity, national origin, or religious affiliation should not be considered as factors that create suspicion (although these factors may used as specific suspect descriptions).

29
Exhibit D - Page 81

Case3:14-cv-03120 Document1 Filed07/10/14 Page82 of 133

UNCLASSIFIED

ISE-FS-200

Category Des Observation/Surveillance
Materials Acquisition/Storage
Acquisition of Expertise
Weapons Discovery Sector-Specific Incident

cription
Demonstrating unusual interest in facilities, buildings, or infrastructure beyond mere casual or professional (e.g. engineers) interest such that a reasonable person would consider the activity suspicious. Examples include observation through binoculars, taking notes, attempting to measure distances, etc.
Acquisition and/or storage of unusual quantities of materials such as cell phones, pagers, fuel, chemicals, toxic materials, and timers, such that a reasonable person would suspect possible criminal activity.
Attempts to obtain or conduct training in security concepts; military weapons or tactics; or other unusual capabilities that would arouse suspicion in a reasonable person.
Discovery of unusual amounts of weapons or explosives that would arouse suspicion in a reasonable person.
Actions associated with a characteristic of unique concern to specific sectors (such as the public health sector), with regard to their personnel, facilities, systems or functions.

30
Exhibit D - Page 82

Case3:14-cv-03120 Document1 Filed07/10/14 Page83 of 133

UNCLASSIFIED

ISE-FS-200

PART C – ISE-SAR INFORMATION FLOW DESCRIPTION

Step

Activity

1 Observation

Process
The information flow begins when a person observes behavior or activities that would appear suspicious to a reasonable person. Such activities could include, but are not limited to, expressed or implied threats, probing of security responses, site breach or physical intrusion, cyber attacks, indications of unusual public health sector activity, unauthorized attempts to obtain precursor chemical/agents or toxic materials, or other usual behavior or sector-specific incidents.12

Notes
The observer may be a private citizen, a government official, or a law enforcement officer.

12 Suspicious activity reporting (SAR) is official documentation of observed behavior that may be reasonably indicative of intelligence gathering and/or pre-operational planning related to terrorism or other criminal activity. ISE-SARs are a subset of all SARs that have been determined by an appropriate authority to have a potential nexus to terrorism nexus (i.e., to be reasonably indicative of criminal activity associated with terrorism).
31
Exhibit D - Page 83

Case3:14-cv-03120 Document1 Filed07/10/14 Page84 of 133

UNCLASSIFIED

ISE-FS-200

Step 2

Activity Process

Initial Response and Investigation

An official of a Federal, State, local, or tribal agency with jurisdiction responds to the reported observation.13 This official gathers additional facts through personal observations, interviews, and other investigative activities. This may, at the discretion of the official, require further observation or engaging the subject in conversation. Additional information acquired from such limited investigative activity could then be used to determine whether to dismiss the activity as innocent or escalate to the next step of the process. In the context of priority information requirements, as provided by State and major urban area fusion centers, the officer/agent may use a number of information systems to continue the investigation. These systems provide the officer/agent with a more complete picture of the activity being investigated. Some examples of such systems and the information they may provide include:
Department of Motor Vehicles provides drivers license and vehicle registration information;
National Crime Information Center provides wants and warrants information, criminal history information and access to the Terrorist Screening Center and the terrorist watch list, Violent Gang/Terrorism Organization File (VGTOF), and Regional Information Sharing System (RISS);
Other Federal, State, local, and tribal systems can provide criminal checks within the immediate and surrounding jurisdictions.
When the initial investigation is complete, the official documents the event. The report becomes the initial record for the law enforcement or Federal agency’s records management system (RMS).

Notes
The event may be documented using a variety of reporting mechanisms and processes, including but not limited to, reports of investigation, event histories, field interviews (FI), citations, incident reports, and arrest reports.
The record may be hard and/or soft copy and does not yet constitute an ISESAR.

13 If a suspicious activity has a direct connection to terrorist activity the flow moves along an operational path. Depending upon urgency, the information could move immediately into law enforcement operations and lead to action against the identified terrorist activity. In this case, the suspicious activity would travel from the initial law enforcement contact directly to the law enforcement agency with enforcement responsibility.
32
Exhibit D - Page 84

Case3:14-cv-03120 Document1 Filed07/10/14 Page85 of 133

UNCLASSIFIED

ISE-FS-200

Step

Activity Process

Notes

3 Local/Regional Processing

The agency processes and stores the information in the RMS following agency policies and procedures. The flow will vary depending on whether the reporting organization is a State or local agency or a field element of a Federal agency.
State, local, and tribal: Based on specific criteria or the nature of the activity observed, the State, local, and tribal law enforcement components forward the information to the State or major urban area fusion center for further analysis.
Federal: Federal field components collecting suspicious activity would forward their reports to the appropriate resident, district, or division office. This information would be reported to field intelligence groups or headquarters elements through processes that vary from agency to agency.
In addition to providing the information to its headquarters, the Federal field component would provide an information copy to the State or major urban area fusion center in its geographic region. This information contributes to the assessment of all suspicious activity in the State or major urban area fusion center’s area of responsibility.

The State or major urban area fusion center should have access to all suspicious activity reporting in its geographic region whether collected by State, local, or tribal entities, or Federal field components.

4 Creation of an ISESAR

The determination of an ISE-SAR is a two-part process. First, at the State or major urban area fusion center or Federal agency, an analyst or law enforcement officer reviews the newly reported information against ISE-SAR behavior criteria. Second, based on available knowledge and information, the analyst or law enforcement officer determines whether the information meeting the criteria has a potential nexus to terrorism.
Once this determination is made, the information becomes an “ISE-SAR” and is formatted in accordance with ISE-FS-200 (ISE-SAR Functional Standard). The ISE-SAR would then be shared with appropriate law enforcement and homeland security personnel in the State or major urban area fusion center’s area of responsibility.

Some of this information may be used to develop criminal intelligence information or intelligence products which identifies trends and other terrorism related information and is derived from Federal agencies such as NCTC, DHS, and the FBI.
For State, local, and tribal law enforcement, the ISESAR information may or may not meet the reasonable suspicion standard for criminal intelligence information. If it does, the information may also be submitted to a criminal intelligence information database and handled in accordance with 28 CFR Part 23.

33
Exhibit D - Page 85

Case3:14-cv-03120 Document1 Filed07/10/14 Page86 of 133

UNCLASSIFIED

ISE-FS-200

Step

Activity Process

5 ISE-SAR Sharing and In a State or major urban area fusion center, the

Dissemination

ISE-SAR is shared with the appropriate FBI field

components and the DHS representative and

placed in the State or major urban area fusion

center’s ISE Shared Space or otherwise made

available to members of the ISE.

The FBI field component enters the ISE-SAR

information into the FBI system and sends the

information to FBI Headquarters.

The DHS representative enters the ISE-SAR information into the DHS system and sends the information to DHS, Office of Intelligence Analysis.

6 Federal Headquarters At the Federal headquarters level, ISE-SAR

(HQ) Processing

information is combined with information from other

State or major urban area fusion centers and

Federal field components and incorporated into an

agency-specific national threat assessment that is

shared with ISE members.

The ISE-SAR information may be provided to

NCTC in the form of an agency-specific strategic

threat assessment (e.g., strategic intelligence

product).

7 NCTC Analysis

When product(s) containing the ISE-SAR information are made available to NCTC, they are processed, collated, and analyzed with terrorism information from across the five communities— intelligence, defense, law enforcement, homeland security, and foreign affairs—and open sources.
NCTC has the primary responsibility within the Federal government for analysis of terrorism information. NCTC produces federally coordinated analytic products that are shared through NCTC Online, the NCTC secure web site.
The Interagency Threat Assessment and Coordinating Group (ITACG), housed at NCTC, facilitates the production of coordinated terrorismrelated products that are focused on issues and needs of State, local, and tribal entities and when appropriate private sector entities. ITACG is the mechanism that facilitates the sharing of counterterrorism information with State, local, and tribal entities.

Notes

34
Exhibit D - Page 86

Case3:14-cv-03120 Document1 Filed07/10/14 Page87 of 133

UNCLASSIFIED

ISE-FS-200

Step 8

Activity Process

NCTC Alerts, Warnings, Notifications

NCTC products14, informed by the ITACG as appropriate, are shared with all appropriate Federal departments and agencies and with State, local,

and tribal entities through the State or major urban area fusion centers. The sharing with State, local,

and tribal entities and private sector occurs through the Federal departments or agencies that have been assigned the responsibility and have connectivity with the State or major urban area fusion centers. Some State or major urban area fusion centers, with secure connectivity and an NCTC Online account, can access NCTC products directly. State or major urban area fusion centers will use NCTC and ITACG informed products to help develop geographic-specific risk assessments (GSRA) to facilitate regional counterterrorism efforts. The GSRA are shared with State, local, and tribal entities and the private sector as appropriate. The recipient of the GSRA may use the GSRA to

develop information gathering priorities or requirements.

Notes
NCTC products form the foundation of informational needs and guide collection of additional information.
NCTC products should be responsive to informational needs of State, local, and tribal entities.

9 Focused Collection

The information has come full circle and the process begins again, informed by an NCTC or other Federal organization’s product and the identified information needs of State, local and tribal entities and Federal field components.

14 NCTC product include: Alerts, warnings, and notifications—identifying time sensitive or strategic threats; Situational awareness reports; and Strategic and foundational assessments of terrorist risks and threats to the United States and related intelligence information.
35
Exhibit D - Page 87

Case3:14-cv-03120 Document1 Filed07/10/14 Page88 of 133

UNCLASSIFIED

ISE-FS-200

Figure 3 – SAR Information Flow Diagram
36
Exhibit D - Page 88

Case3:14-cv-03120 Document1 Filed07/10/14 Page89 of 133
Exhibit E
Exhibit E - Page 89

Case3:14-cv-03120 Document1 Filed07/10/14 Page90 of 133 Exhibit E - Page 90

Case3:14-cv-03120 Document1 Filed07/10/14 Page91 of 133 Exhibit E - Page 91

Case3:14-cv-03120 Document1 Filed07/10/14 Page92 of 133 Exhibit E - Page 92

Case3:14-cv-03120 Document1 Filed07/10/14 Page93 of 133 Exhibit E - Page 93

Case3:14-cv-03120 Document1 Filed07/10/14 Page94 of 133 Exhibit E - Page 94

Case3:14-cv-03120 Document1 Filed07/10/14 Page95 of 133 Exhibit E - Page 95

Case3:14-cv-03120 Document1 Filed07/10/14 Page96 of 133 Exhibit E - Page 96

Case3:14-cv-03120 Document1 Filed07/10/14 Page97 of 133 Exhibit E - Page 97

Case3:14-cv-03120 Document1 Filed07/10/14 Page98 of 133 Exhibit E - Page 98

Case3:14-cv-03120 Document1 Filed07/10/14 Page99 of 133 Exhibit E - Page 99

Case3:14-cv-03120 Document1 Filed07/10/14 Page100 of 133 Exhibit E - Page 100

Case3:14-cv-03120 Document1 Filed07/10/14 Page101 of 133 Exhibit E - Page 101

Case3:14-cv-03120 Document1 Filed07/10/14 Page102 of 133 Exhibit E - Page 102

Case3:14-cv-03120 Document1 Filed07/10/14 Page103 of 133 Exhibit E - Page 103

Case3:14-cv-03120 Document1 Filed07/10/14 Page104 of 133 Exhibit E - Page 104

Case3:14-cv-03120 Document1 Filed07/10/14 Page105 of 133 Exhibit E - Page 105

Case3:14-cv-03120 Document1 Filed07/10/14 Page106 of 133 Exhibit E - Page 106

Case3:14-cv-03120 Document1 Filed07/10/14 Page107 of 133 Exhibit E - Page 107

Case3:14-cv-03120 Document1 Filed07/10/14 Page108 of 133 Exhibit E - Page 108

Case3:14-cv-03120 Document1 Filed07/10/14 Page109 of 133 Exhibit E - Page 109

Case3:14-cv-03120 Document1 Filed07/10/14 Page110 of 133 Exhibit E - Page 110

Case3:14-cv-03120 Document1 Filed07/10/14 Page111 of 133 Exhibit E - Page 111

Case3:14-cv-03120 Document1 Filed07/10/14 Page112 of 133 Exhibit E - Page 112

Case3:14-cv-03120 Document1 Filed07/10/14 Page113 of 133 Exhibit E - Page 113

Case3:14-cv-03120 Document1 Filed07/10/14 Page114 of 133 Exhibit E - Page 114

Case3:14-cv-03120 Document1 Filed07/10/14 Page115 of 133
Exhibit F
Exhibit F - Page 115

Case3:14-cv-03120 Document1 Filed07/10/14 Page116 of 133
UNCLASSIFIED//FOR OFFICIAL USE ONLY
ROLL CALL RELEASE In Collaboration with the ITACG
26 July 2010 
(U//FOUO) Indicators of Suspicious Behaviors at Hotels
(U//FOUO) Known or possible terrorists have displayed suspicious behaviors while staying at hotels overseas—including avoiding questions typically asked of hotel registrants; showing unusual interest in hotel security; attempting access to restricted areas; and evading hotel staff. These behaviors also could be observed in U.S. hotels, and security and law enforcement personnel should be aware of the potential indicators of terrorist activity.
(U//FOUO) Possible indicators of terrorist behaviors at hotels: The observation of multiple indicators may represent—based on the specific facts or circumstances—possible terrorist behaviors at hotels:
— (U//FOUO) Not providing professional or personal details on hotel registrations—such as place of employment, contact information, or place of residence.
— (U//FOUO) Using payphones for outgoing calls or making front desk requests in person to avoid using the room telephone.
— (U//FOUO) Interest in using Internet cafes, despite hotel Internet availability. — (U//FOUO) Non-VIPs who request that their presence at a hotel not be divulged. — (U//FOUO) Extending departure dates one day at a time for prolonged periods. — (U//FOUO) Refusal of housekeeping services for extended periods. — (U//FOUO) Extended stays with little baggage or unpacked luggage. — (U//FOUO) Access or attempted access to areas of the hotel normally restricted to staff. — (U//FOUO) Use of cash for large transactions or a credit card in someone else’s name. — (U//FOUO) Requests for specific rooms, floors, or other locations in the hotel. — (U//FOUO) Use of a third party to register. — (U//FOUO) Multiple visitors or deliveries to one individual or room. — (U//FOUO) Unusual interest in hotel access, including main and alternate entrances,
emergency exits, and surrounding routes. — (U//FOUO) Use of entrances and exits that avoid the lobby or other areas with cameras and
hotel personnel. — (U//FOUO) Attempting to access restricted parking areas with a vehicle or leaving unattended
vehicles near the hotel building. — (U//FOUO) Unusual interest in hotel staff operating procedures, shift changes,
closed-circuit TV systems, fire alarms, and security systems. — (U//FOUO) Leaving the property for several days and then returning. — (U//FOUO) Abandoning a room and leaving behind clothing, toiletries, or other items. — (U//FOUO) Noncompliance with other hotel policies.
,$
(U) Prepared by the DHS/I&A Homeland Counterterrorism Division, the DHS/I&A Cyber, Infrastructure, and Science Division, the FBI/Directorate of Intelligence, and the Interagency Threat Assessment and Coordination Group. This product is intended to assist federal, state, local, and private sector first responders so they may effectively deter, prevent, preempt, or respond to terrorist attacks against the United States. This product was coordinated with the DHS/Office of Infrastructure Protection. 
(U) Warning: This document is UNCLASSIFIED//FOR OFFICIAL USE ONLY (U//FOUO). It contains information that may be exempt from public release under the Freedom of Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, and disposed of in accordance with DHS policy relating to FOUO information and is not to be released to the public, the media, or other personnel who do not have a valid need to know without prior approval of an authorized DHS official. State and local homeland security officials may share this document with critical infrastructure and key resource personnel and private sector security officials without further approval from DHS.
(U) The FBI regional phone numbers can be found online at http://www.fbi.gov/contact/fo/fo.htm and the DHS National Operations Center (NOC) can be reached by telephone at (202) 282-9685 or by e-mail at NOC.Fusion@dhs.gov. For information affecting the private sector and critical infrastructure, contact the National Infrastructure Coordinating Center (NICC), a sub-element of the NOC. The NICC can be reached by telephone at (202) 282-9201 or by e-mail at NICC@dhs.gov.
UNCLASSIFIED//FOR OFFICIAL USE ONLY Exhibit F - Page 116

Case3:14-cv-03120 Document1 Filed07/10/14 Page117 of 133
Exhibit G
Exhibit G - Page 117

Case3:14-cv-03120 Document1 Filed07/10/14 Page118 of 133 Exhibit G - Page 118

Law Enforcement Sensitive

The FBI’s Terrorism Quick Reference Card

First responding officers should be aware of suspicious factors that may indicate a possible terrorist threat. These factors should be considered collectively in assessing a possible threat. This quick reference guide is intended to provide practical information for line officers but may not encompass every threat or circumstance. State and local law enforcement may contact their local FBI field office or resident agency for additional assistance.

1)

Possible Suicide Bomber Indicators

-A.L.E.R.T.

A.

Alone and nervous.

B.

Loose and/or bulky clothing (may

not fit weather conditions).

C.

Exposed wires (possibly through

sleeve).

D.

Rigid mid-section (explosive

device or may be carrying a rifle).

E.

Tightened hands (may hold

detonation device).

2) Passp ort History

A.

Recent travel overseas to

countries that sponsor terrorism.

B.

Multiple passports with different

countries/names (caution: suspect

may have dual citizenship).

C.

Altered passport numbers or

photo substitutions; pages have

been removed.

3) Other

Identification -Suspicious

Characteristics

A.

No current or fixed address;

fraudulent/altered: Social Security

cards, visas, licenses, etc.;

multiple ID's with names spelled

differently.

B. International

drivers ID:

1. There are no international or UN drivers' licenses -they are called permits.

2. Official international drivers' permits are valid for one year from entry into the U.S., they are paper-gray in color, not laminated, and are only valid for foreign nationals to operate in the U.S.

4) Employment/ School/Training

A.

No obvious signs of employment.

B.

Possess student visa but not

English proficient.

C.

An indication of military type

training in weapons or self-

defense.

5) Unus ual Items In Vehicles/Residences

A.

Training manuals; flight, scuba,

explosive, military, or extremist

literature.

B.

Blueprints (subject may have no

affiliation to architecture).

C.

Photographs/diagrams of specific

high profile targets or

infrastructures; to include

entrances/exits of buildings,

bridges, power/water plants,

routes, security cameras,

subway/sewer, and underground

systems.

D. Photos/ pictures of known

terrorists.

E.

Numerous prepaid calling cards

and/or cell phones.

F.

Global Positioning Satellite

(GPS) unit

G.

Multiple hotel receipts

H. Financial

records indicating

overseas wire transfers

I.

Rental vehicles (cash transactions

on receipts; living locally but

renting)

Law Enforcement Sensitive

Case3:14-cv-03120 Document1 Filed07/10/14 Page119 of 133 Exhibit G - Page 119

Law Enforcement Sensitive

The FBI’s Terrorism Quick Reference Card -- Continued

6) Pote ntial Props

A.

Baby stroller or shopping cart.

B.

Suspicious bag/backpack, golf

bag.

C.

Bulky vest or belt.

7) Hotel/Motel

Visits

A.

Unusual requests, such as:

1. Refusal of maid service.

2. Asking for a specific view

of bridges, airports,

military/government

installation (for

observational purposes).

3. Electronic surveillance

equipment in room

B.

Suspicious or unusual items left

behind.

C.

Use of lobby or other pay phone

instead of room phone.

8) Recruitme nt Techniques

CAUTION: The following factors, which may

constitute activity protected by the United

States Constitution, should only be considered

in the context of other suspicious activity and

not be the sole basis of law enforcement action.

A.

Public demonstrations and rallies.

B.

Information about new groups

forming.

C. Posters,

fliers, and underground

publications.

9)

Thefts, Purchases, Or Discovery Of:

A. Weapons/expl osive materials.

B. Cam era/surveillance equipment.

C.

Vehicles (to include rentals -

fraudulent name; or failure to

return vehicle).

D.

Radios: Short wave, two-way and

scanners.

E.

Identity documents (State IDs,

passports etc.)

F. Una uthorized uniforms

Law Enforcement Sensitive

Case3:14-cv-03120 Document1 Filed07/10/14 Page120 of 133 Exhibit G - Page 120

Law Enforcement Sensitive

II. Indicators and Detection

of Terrorist

Explosive/Weapons/CBN

Attack1

TP

PT

1. Possible Explosive Attack Indicators
x Theft of commercial-grade explosives, chemical substances, blasting caps.
x Large amounts of high-nitrate fertilizer sales to nonagricultural purchasers, or abnormally large amounts (compared with previous sales) to bona fide agricultural purchasers.
x Large theft or sales of chemicals which, when combined, create ingredients for explosives (fuel oil, nitrates).
x Theft or abnormal sales of containers (for example, propane bottles) or possible vehicles (trucks or cargo vans) in combination with other indicators.
x Reports of explosions where not authorized.

x Seizures of improvised explosive devices or materials.
2. Possible Weapons Attack Indicators
x Theft or unusual sales of large numbers of semi-automatic weapons, especially those which are known to be readily converted to fullyautomatic.
x Theft or unusual sales of militarygrade weapons ammunition.
x Reports of automatic weapons firing.
x Seizures of modified weapons or equipment used to modify weapons (especially silencers).
x Theft, sales, or seizure of night vision or thermal imaging equipment when combined with other indicators.
x Theft, loss, seizure, or recovery of
large amounts of cash by groups advocating violence against the government, military, or similar
targets.

3. Possible Chemical/Biological/Nuclear Indicators:
x Sales or theft of large quantities of baby formula, or an unexplained shortage in an area. (Baby formula is used to grow certain specific cultures.)
x Break-in or tampering with equipment at water treatment facilities or food processing facilities or warehouses.
x Theft or solicitation for sales of live agents, toxins, or diseases from medical supply companies or testing and experimentation facilities.
x Multiple cases of unexplained human or animal deaths.
x Sales to non-agricultural users or thefts of agricultural sprayers, or crop-dusting aircraft, foggers, river craft or other dispensing systems.
x Inappropriate inquiries regarding local chemical/biological/nuclear sales, storage, or transportation points and facilities.
x Inappropriate inquiries regarding heating and ventilation systems for buildings or facilities by persons not associated with service agencies.

Law Enforcement Sensitive

Case3:14-cv-03120 Document1 Filed07/10/14 Page121 of 133 Exhibit G - Page 121

III. Surveillance, Targeting, and Attack Indicators and Countermeasures

A. Surveillance2

TP

PT

According to the Department of Homeland Security, nearly every major terrorist attack has been preceded by a thorough surveillance of the targeted facility. Surveillance operations have certain characteristics that are particular to pre-operational activity. The degree of expertise used in the execution of the operation will increase or decrease the likelihood of detection. Some of these characteristics are:
x Suspicious persons or vehicles being observed in the same location on multiple occasions, including those posing as panhandlers, vendors, or others not previously seen in the area.

x Suspicious persons sitting in a parked car for an extended period of time for no apparent reason.

x Personnel observed near a potential target using or carrying video, still camera, or other observation equipment, especially when coupled with high magnification lenses.

Law Enforcement Sensitive
x Suspicious persons showing an interest in or photographing security systems and positions.
x Personnel observed with facility maps and/or photographs, or diagrams with specific buildings or facilities highlighted; or with notes regarding infrastructure, or listing of certain key personnel.
x Suspicious persons drawing pictures or taking notes in a non-tourist or other area not normally known to have such activity.
x Personnel possessing or observed using night vision or thermal devices near the potential target area
x Personnel observed parked near, standing near, or loitering near the same vicinity over several days, with no apparent reasonable explanation.
x A noted pattern or series of false alarms requiring law enforcement or emergency services response; individuals noticeably observing security procedures and responses or questioning security or facility personnel.
x Persons not fitting into the surrounding environment, such as wearing improper attire for the location.

x Theft of official identification (ID) cards (including family members, retirees), or government official license plates.
x Non-government persons in possession of government official ID cards.
x Recent damage to potential target perimeter security (breaches in the fenceline).
x Computer hackers attempting to access sites with personal information, maps, or other data useful to compiling a target information packet.
x Persons exhibiting unusual behavior such as staring or quickly looking away from individuals or vehicles as they enter or leave designated facilities or parking areas.
x A blank facial expression in an individual may be indicative of someone concentrating on something not related to what they appear to be doing.

Law Enforcement Sensitive

Case3:14-cv-03120 Document1 Filed07/10/14 Page122 of 133 Exhibit G - Page 122

Law Enforcement Sensitive

III. Surveillance, Targeting, and Attack Indicators and Countermeasures -Continued

B. Targeting3

TP

PT

If the intended target of an operation is an individual, the information collected on that person may include several of the following:

x The identity, age, residence, and social
status of the intended target. x A description of the vehicle that the
target drives. x The work environment of the intended
target, to include time of departure and return from work as well as the route taken to his/her place of employment. x The manner in which the target spends his/her free time and the places where he/she spends vacations and holidays. x The identity and address of the target’s friends. x The identity of the target’s spouse, where he/she works and whether the target visits him/her there. x The identity of the target’s children and whether the target visits at the school. x Whether the target has a significant other (boyfriend or girlfriend), that

person’s address, and when the target visits there. x The identity of the physician who treats the target. x The location of the stores where the target does his/her shopping. x The location of entrances and exits to the target’s residence, and the surrounding streets. x Means of surreptitiously entering the target’s residence. x Whether the target is armed; if protected by guards, the number of guards and their armament, if any.
If the intended target is a facility or important building, surveillance teams may attempt to obtain the following information pertaining to the exterior of the facility:
x The width of the streets and the direction in which they run leading to the facility.
x Available transportation to the facility. x The area, physical layout, and setting
of the facility. x Traffic signals and pedestrian areas
near the facility. x The location of security personnel
centers (police stations, etc.) and nearby government agencies. x The economic characteristics of the area where the place is located. x Traffic congestion times near the facility.

x Amount and location of lighting near the facility.
Surveillance teams may also attempt to obtain the following information pertaining to the interior of the facility:
x Number of people typically inside the facility.
x Number and location of guard posts within the facility.
x Number and names of the leaders within the facility.
x Number of floors and rooms within the facility.
x Telephone lines and the location of the switchboard.
x Times of entrance and exit of specific individuals.
x Inside parking available at the facility. x Location of electrical power switches.

Law Enforcement Sensitive

Case3:14-cv-03120 Document1 Filed07/10/14 Page123 of 133 Exhibit G - Page 123

III. Surveillance, Targeting, and Attack Indicators and Countermeasures -Continued
Training literature also identifies the use of photography and detailed drawings by those conducting surveillance operations. Photographs are taken to depict panoramic and overlapping views of potential target areas. Surveillance team members typically also draw a diagram of the target of the surveillance operation. The diagram is typically realistic so that someone who never saw the target could visualize it. In order for the diagram to accurately depict the target it should contain the following:

x Shapes and characteristics of buildings and surrounding features.
x Traffic directions and width of streets. x Location of traffic signals and
pedestrian areas. x Location of police stations, security
personnel centers and government agencies. x Location of public parks. x Amount and location of lighting.

C. Attack4

TP

PT

Pre-Attack Indicative Behaviors:

U

U

x Making threats directly to the target or indirectly to third parties.

Law Enforcement Sensitive
x “Leakage” by attacker (behavioral signs of intent to attack), including: - vague threats (to manage own emotions of anger, anxiety, or fear); - bragging to third parties of intent to attack; - exaggerated, larger-than-life articulated fantasies of success or outcome of bombing (e.g., number of victims, joining other martyrs that have preceded him); - evasive when questioned concerning past history and future plans, or such information is not realistic or verifiable.
x Casing of properties/buildings.
Pre-Attack Countermeasures:
U
x Proactively pursue through investigation and questioning any individual reported to be a threat to bomb or carry out a terrorist act and thereby arouse suspicions in others.
x Interview collaterals (family, friends, employers, neighbors and coreligionists) who observe changes in the individual’s behavior (withdrawal from previous social contacts; radicalization of beliefs; travel to countries know to be supportive of terrorist activities; associations with other suspected terrorists; new and unidentified sources of income; increase in religiousness).
x Gather intelligence in communities containing or supporting such activity.
Law Enforcement Sensitive

x Develop and acquire assets among trusted community resources (local media, religious leaders, community activists, and professionals).

Attack Preparation: Indicative Behaviors

U

U

x No direct threats to the target, but continues to communicate threat to trusted third parties.
x “Leakage” may continue to third parties, but may become more constricted on advice of higher-ups.
x “Boundary probing” with physical approaches to measure restrictions to access, if any (private security, physical boundaries, local law enforcement presence).
x Surveillance of target (victims and location); familiarization with area, decision making concerning dress and appearance, and select time and day to maximize casualties; countersurveillance of security personnel or barriers already in place.
x Acquisition of materials for the bomb, including the explosive proper, the detonation device, and the container. The latter may be selected on the basis of commonly seen packages or items in the target area (backpacks, grocery bags, retail bags) derived from surveillance.
x May prepare a suicide note or video for dissemination after the bombing.
x May give possessions away and get other worldly affairs in order.

Case3:14-cv-03120 Document1 Filed07/10/14 Page124 of 133 Exhibit G - Page 124

III. Surveillance, Targeting, and Attack Indicators and Countermeasures -Continued

x Emotions are likely to be more

volatile (quickly changing; may be

irritable, sad, easily upset).

x May indulge in “worldly sins” that

directly violate religious beliefs

(visiting bars, strip clubs, gambling) in

order to blend in with victims and

avoid apprehension.

x Will pay for items in cash.

x Daily behaviors become consistent

with no future (e.g., forgetting to take

U

U

change, purchasing one-way tickets).

x Handler’s involvement increases to

help suicide bomber stay focused and

manage anxiety; chief communication

will be through e-mail, cell phone, or

direct contact.

x May show arrogance and hatred

toward Americans through bragging,

expressed dislike of attitudes and

decisions of US government,

superiority of religious beliefs, and

difficulty tolerating proximity to those

hates (e.g., waiting in a grocery store

U

U

line becomes intolerable).

x Will engage in “private rituals” within

hours of the bombing that have

religious and symbolic meaning, such

as bathing, fasting, shaving of body

hair, perfuming, and increased

praying. These acts reinforce the

Law Enforcement Sensitive

meaning of his suicide bombing, steal him to the task, and keep him focused on the larger cause.

Attack Preparation Countermeasures

U

U

x Actively interview suspects and close

contacts reported to be engaging in

preparation to attack.

x Detain and/or arrest, if probable cause

to do so exists, to prevent further

preparation and attack.

x Conduct “warehouse surveys” of retail

outlets for bomb making materials to

identify the suspect’s acquisition

behavior and gather evidence (e.g.,

U

U

computer stores, Radio Shack or other

electronic instrument stores, and

chemical ingredient or fertilizer

outlets).

x Conduct counter-surveillance of the

identified target.

x Harden the identified target to reduce

or impede access by a suicide bomber

or other suicide terrorists.

x Monitor e-mail or cell phone usage of

the suspect bomber.

x Continue surveillance of the suspect’s

behavior.

Attack Initiation: Indicative Behaviors:
U

x Clothing is out of sync with the weather, suspect’s social position (he appears well-groomed but is wearing sloppy clothing), or location (wearing a coat inside a building).

Law Enforcement Sensitive

x Clothing is loose. x Suspect may be carrying heavy
luggage, bag, or wearing a backpack. x Suspect sometimes keeps his hands in
his pockets. x Suspect repeatedly pats his upper body
with his hands, as if double-checking whether he forgot something. x Pale face from recent shaving of beard. x No obvious emotion seen on the face. x Eyes appear to be focused and vigilant. Does not respond to authoritative voice commands or direct salutation from a distance. x May appear to be “in a trance.” x Suspect walks deliberately but is not running. x Just prior to detonation, suspect will hold his hands above his head and shout a phrase; or suspect will place his hands and head close to the bomb to obliterate post-mortem identification.

Case3:14-cv-03120 Document1 Filed07/10/14 Page125 of 133 Exhibit G - Page 125

III. Surveillance, Targeting, and Attack Indicators and Countermeasures -Continued
Attack Initiation Countermeasures:
x Call or shout a voice command from a distance to break the suspect’s concentration.
x Make physical contact with the suspect to distract his attention and physically impede his forward movement.
x Insure physical control before questioning, especially of hands and arms.
x Insure safety of civilian targets in immediate area.
Post Offense Behavior by Attacker’s Handlers or Associates: Indicative Behaviors:
x Synchronized serial attacks implemented in stages, in close physical or temporal proximity to increase casualties of first responders, including law enforcement and medical personnel.
x If there is a second attack, it is likely to occur within 20 minutes and be carried out along evacuation route of casualties or near first targeted area.

Law Enforcement Sensitive
x Surveillance of attack site to study first responders’ behavior and plan for future attacks.
Post Offense Countermeasures: x Make counter-surveillance team a part
of the first response. x Include bomb disposal experts in first
response to search for additional explosives.
Law Enforcement Sensitive

Case3:14-cv-03120 Document1 Filed07/10/14 Page126 of 133 Exhibit G - Page 126

Law Enforcement Sensitive
1 Source: Chief Warrant Officer 3 Del Stewart, U.S. Army Intelligence Center 2 Source: Chief Warrant Officer 3 Del Stewart, U.S. Army Intelligence Center; FBI Intelligence Bulletin 53, February 26, 2003, “Possible Indicators of al-Qaeda Surveillance.” 3 This section extracted from “Use of Surveillance by Terrorist Groups,” by the CONUS Analysis Section, Pol Mil/Force Protection Branch, Joint Forces Intelligence Command 4 This section extracted from “Suicide/Homicide Attacker Behaviors and Suggested Countermeasures,” by FBI Behavioral Analysis Program & Central Intelligence Agency analysts, and issued by the Interagency Intelligence Committee on Terrorism.
Law Enforcement Sensitive

Case3:14-cv-03120 Document1 Filed07/10/14 Page127 of 133
Exhibit H
Exhibit H - Page 127

Communities Against Terrorism

Potential Indicators of Terrorist Activities Related to the General Public

Case3:14-cv-03120 Document1 Filed07/10/14 Page128 of 133 Exhibit H - Page 128

What Should I Consider Suspicious?

What Should I Do?

3HRSOHLQYROYHGLQWHUURULVWDFWLYLW\ RIWHQH[KLELWLQGLFDWRUVWKDWLIREVHUYHG FRXOGLGHQWLI\DSRWHQWLDOLPSHQGLQJ FULPHRUWHUURULVWDWWDFN7KHIROORZLQJ LVDOLVWRIVRPHRIWKHFKDUDFWHULVWLFV RIVXFKSHUVRQVWKDW\RXVKRXOGEH DZDUHRI

x 8QXVXDOUHTXHVWVIRULQIRUPDWLRQ±
o TXHVWLRQVUHJDUGLQJVHQVLWLYH LQIRUPDWLRQVXFKDVVHFXULW\ SURFHGXUHVRUV\VWHPV
o TXHVWLRQVUHJDUGLQJIDFLOLW\ RSHUDWLRQV

x 8QXVXDOLQWHUHVWLQKLJKULVNRU V\PEROLFWDUJHWV
o VXUYHLOODQFH o QRWHWDNLQJ o GUDZLQJRIGLDJUDPV o DQQRWDWLQJPDSV o LQDSSURSULDWHSKRWRJUDSKVRU
YLGHRV

o SHRSOHRYHUGUHVVHGIRUWKH ZHDWKHU
x 8QXVXDODFWLYLW\± o SHRSOHDFWLQJVXVSLFLRXVO\ o SHRSOHGHSDUWLQJTXLFNO\ZKHQ VHHQRUDSSURDFKHG o SHRSOHLQSODFHVZKHUHWKH\GR QRWEHORQJ o YHKLFOHVWKDWDSSHDUWREH RYHUORDGHG
 


,WLVLPSRUWDQWWRJLYHDWKRURXJK UHSRUWZKHQQRWLI\LQJODZ HQIRUFHPHQW.HHSLQPLQGWKH UHVSRQGLQJRIILFHUPD\RQO\KDYHWKH LQIRUPDWLRQ\RXJDYHDWWKHWLPHRI \RXUFDOO3URYLGLQJDGHWDLOHG GHVFULSWLRQRISHUVRQVRUYHKLFOHVLV LPSHUDWLYHIRUDVXFFHVVIXOIROORZXS E\ODZHQIRUFHPHQWSHUVRQQHO

,IVRPHWKLQJVHHPVZURQJQRWLI\ ODZHQIRUFHPHQWDXWKRULWLHV
'WKRHQVDRIWHMWH\RRSIDRUGWKL]HHUV\RXUVDIHW\RU

&ROXPEXV2KLR'LYLVLRQRI3ROLFH +RPHODQG6HFXULW\6HFWLRQ
7HUURULVP(DUO\:DUQLQJ8QLW   

Help Protect Your Community

Be Part of the Solution

Case3:14-cv-03120 Document1 Filed07/10/14 Page129 of 133 Exhibit H - Page 129


7HUURULVPPD\EHQDWLRQDORU LQWHUQDWLRQDOLQVFRSHEXWWHUURULVW LQFLGHQWVRFFXUORFDOO\DQGDUH SUHFHGHGE\DQXPEHURISUHLQFLGHQW DFWLYLWLHV,QGLYLGXDOVLQWKH FRPPXQLW\DUHNH\WRLGHQWLI\LQJWKHVH SUHLQFLGHQWDFWLYLWLHV%\OHDUQLQJ ZKDWWRORRNIRU\RXFDQDLGODZ HQIRUFHPHQWRIILFLDOVLQSURWHFWLQJWKH KRPHODQG
%\EHLQJDZDUHRIZKDWWRORRNIRU DQGNQRZLQJKRZWRUHSRUWVXVSLFLRXV EHKDYLRU\RXFDQPDNHDSRVLWLYH FRQWULEXWLRQLQWKHILJKWDJDLQVW WHUURULVP7KHSDUWQHUVKLSEHWZHHQ WKHFRPPXQLW\DQGODZHQIRUFHPHQW LVHVVHQWLDOWRWKHVXFFHVVRI DQWLWHUURULVPHIIRUWV

,WLVLPSRUWDQWWRUHPHPEHUWKDWMXVW EHFDXVHVRPHRQH¶VVSHHFKDFWLRQV EHOLHIVDSSHDUDQFHRUZD\RIOLIHLV GLIIHUHQWLWGRHVQRWPHDQWKDWKHRU VKHLVVXVSLFLRXV,QVWHDGIRFXVRQ EHKDYLRUDQGDFWLYLWLHVWKDWDUHXQXVXDO RURXWRISODFHIRUWKHVLWXDWLRQDQGWKDW DSSHDUWREHVXVSLFLRXV
7KHDFWLYLWLHVRXWOLQHGRQWKLVKDQGRXW DUHE\QRPHDQVDOOLQFOXVLYHEXWKDYH EHHQFRPSLOHGIURPDUHYLHZRIWHUURULVW HYHQWVRYHUVHYHUDO\HDUV6RPHRIWKH DFWLYLWLHVWDNHQLQGLYLGXDOO\FRXOGEH LQQRFHQWDQGPXVWEHH[DPLQHGE\ODZ HQIRUFHPHQWSURIHVVLRQDOVLQDODUJHU FRQWH[WWRGHWHUPLQHZKHWKHUWKHUHLVD EDVLVWRLQYHVWLJDWH

7KLVSURMHFWZDVVXSSRUWHGE\*UDQW1XPEHU08%;. DZDUGHGE\WKH%XUHDXRI-XVWLFH$VVLVWDQFH2IILFHRI-XVWLFH3URJUDPV 86'HSDUWPHQWRI-XVWLFH7KHRSLQLRQVILQGLQJVDQGFRQFOXVLRQVRU UHFRPPHQGDWLRQVH[SUHVVHGLQWKLVGRFXPHQWDUHWKRVHRIWKHDXWKRUVDQG GRQRWQHFHVVDULO\UHSUHVHQWWKHRIILFLDOSRVLWLRQRUSROLFLHVRIWKH 86'HSDUWPHQWRI-XVWLFH

Potential Indicators of Terrorist Activities Related to the General
Public
  &ROXPEXV2KLR'LYLVLRQRI3ROLFH +RPHODQG6HFXULW\6HFWLRQ 7HUURULVP(DUO\:DUQLQJ8QLW   

Case3:14-cv-03120 Document1 Filed07/10/14 Page130 of 133
Exhibit I
Exhibit I - Page 130

Case3:14-cv-03120 Document1 Filed07/10/14 Page131 of 133

)%,)HGHUDO%XUHDXRI,QYHVWLJDWLRQ
Communities Against Terrorism
Potential Indicators of Terrorist Activities Related to Electronic Stores

What Should I Consider Suspicious?

3HRSOH:KR

x 6LJQLILFDQWO\DOWHUVDSSHDUDQFHIURPYLVLWWRYLVLWVKDYLQJEHDUGFKDQJLQJKDLU
FRORUVW\OHRIGUHVVHWF

x 0LVVLQJKDQGILQJHUVFKHPLFDOEXUQVVWUDQJHRGRUVRUEULJKWFRORUHGVWDLQVRQ
FORWKLQJ

x )LOOVD³VKRSSLQJOLVW´RIFRPSRQHQWVODFNLQJNQRZOHGJHDERXWVSHFLILFDWLRQV
DQGXVHV

x 3XUFKDVHVTXDQWLWLHVRISUHSDLGRUGLVSRVDEOHFHOOSKRQHV

x ,QVLVWVSUHSDLGSKRQHVQRWEHDFWLYDWHGRUSURJUDPPHGXSRQSXUFKDVH

x 3D\VFDVKIRUODUJHSXUFKDVHVXVHVFUHGLWFDUGVLQGLIIHUHQWQDPHVXVHV
VXVSLFLRXVLGHQWLILFDWLRQ

x 7UDYHOVLOORJLFDOGLVWDQFHWRSXUFKDVHLWHPVRUDVNVZKHUHVLPLODUVWRUHVDUH
ORFDWHG 
3XUFKDVHUVVKRZLQJXQXVXDOLQWHUHVWWKURXJKTXHVWLRQVUHODWHGWR

x 5DGLRIUHTXHQFLHVXVHGQRWXVHGE\ODZHQIRUFHPHQW

x 9RLFHRUGDWDHQFU\SWLRQ92,3VDWHOOLWHSKRQHVYRLFHSULYDF\

x 8VHRIDQRQ\PL]HUVSRUWDOVRURWKHUPHDQVWRVKLHOG,3DGGUHVV

x 6ZDSSLQJ6,0FDUGVLQFHOOSKRQHVRUKRZSKRQHORFDWLRQFDQEHWUDFNHG

x 5HZLULQJFHOOSKRQH¶VULQJHURUEDFNOLJKW



x 3URGXFWVFRPSRQHQWVUHODWHGWRPLOLWDU\VW\OHHTXLSPHQW

x 8QXVXDOFRPPHQWVUHJDUGLQJUDGLFDOWKHRORJ\YDJXHFU\SWLFZDUQLQJVRU

DQWL86VHQWLPHQWVWKDWDSSHDUWREHRXWRISODFHDQGSURYRFDWLYH



3XUFKDVHVLQFOXGLQJXQXVXDOFRPELQDWLRQVRI

- (OHFWURQLFWLPHURUWLPLQJGHYLFHV

ZD\UDGLRV





*36







3KRQHRU³EXJ´GHWHFWLRQGHYLFHV %DWWHULHV 6ZLWFKHV

'LJLWDO9RLFH&KDQJHUV 

:LUHDQGVROGHULQJWRROV

,QIUD5HG'HYLFHV 



1LJKW9LVLRQ

3ROLFHVFDQQHUV 



)ODVKOLJKW%XOEV



,WLVLPSRUWDQWWRUHPHPEHUWKDWMXVWEHFDXVHVRPHRQH¶VVSHHFK

DFWLRQVEHOLHIVDSSHDUDQFHRUZD\RIOLIHLVGLIIHUHQWLWGRHVQRW

PHDQWKDWKHRUVKHLVVXVSLFLRXV



What Should I Do?

%HSDUWRIWKHVROXWLRQ

9 5HTXLUHYDOLG,'IURPDOOQHZ

FXVWRPHUV

9 .HHSUHFRUGVRISXUFKDVHV

9 7DONWRFXVWRPHUVDVNTXHVWLRQV

DQGOLVWHQWRDQGREVHUYHWKHLU

UHVSRQVHV

9 :DWFKIRUSHRSOHDQGDFWLRQVWKDW

DUHRXWRISODFH

9

0DNHQRWHRIVXVSLFLRXVVWDWHPHQWV SHRSOHDQGRUYHKLFOHV



9 ,IVRPHWKLQJVHHPVZURQJQRWLI\

ODZHQIRUFHPHQWDXWKRULWLHV


'RQRWMHRSDUGL]H\RXUVDIHW\RUWKH

VDIHW\RIRWKHUV


3UHYHQWLQJWHUURULVPLVDFRPPXQLW\

HIIRUW%\OHDUQLQJZKDWWRORRNIRU\RX

FDQPDNHDSRVLWLYHFRQWULEXWLRQLQWKH

ILJKWDJDLQVWWHUURULVP7KHSDUWQHUVKLS

EHWZHHQWKHFRPPXQLW\DQGODZ

HQIRUFHPHQWLVHVVHQWLDOWRWKHVXFFHVV

RIDQWLWHUURULVPHIIRUWV


6RPHRIWKHDFWLYLWLHVWDNHQ

LQGLYLGXDOO\FRXOGEHLQQRFHQWDQGPXVW

EHH[DPLQHGE\ODZHQIRUFHPHQW

SURIHVVLRQDOVLQDODUJHUFRQWH[WWR

GHWHUPLQHZKHWKHUWKHUHLVDEDVLVWR

LQYHVWLJDWH7KHDFWLYLWLHVRXWOLQHGRQ

-RLQW5HJLRQDO,QWHOOLJHQFH &HQWHU-5,& ZZZMULFRUJ

-5,&PHQWLRQ ³7ULSZLUH´

7KLVSURMHFWZDVVXSSRUWHGE\*UDQW1XPEHU08%;.DZDUGHGE\WKH%XUHDXRI-XVWLFH$VVLVWDQFH2IILFHRI-XVWLFH3URJUDPV86'HSDUWPHQWRI-XVWLFH(DFKLQGLFWRUOLV WHGDERYHLVE\ LWVHOIODZIXOFRQGXFWRUEHKDYLRUDQGPD\DOVRFRQVWLWXWHWKHH[HUFLVHRIULJKWVJXDUDQWHHGE\WKH86&RQVWLWXWLRQ,QDGGLWLRQWKHUHPD\EHDZKROO\LQQRFHQWH[SODQDWLRQIRUFRQGXFWRUEHKDYLRUWKDW DSSHDUVVXVSLFLRXVLQQDWXUH)RUWKLVUHDVRQQRVLQJOHLQGLFDWRUVKRXOGEHWKHVROHEDVLVIRUODZHQIRUFHPHQWDFWLRQ7KHWRWDOLW\RIEHKDYLRUDOLQGLFDWRUVDQGRWKHUUHOHYDQWFLUFXPVWDQFHVVKRXOGEH
HYDOXDWHG ZKHQ FRQVLGHULQJ DQ\ ODZ HQIRUFHPHQW UHVSRQVH RU DFWLRQ
Exhibit I - Page 131

Case3:14-cv-03120 Document1 Filed07/10/14 Page132 of 133
Exhibit J
Exhibit J - Page 132

Case3:14-cv-03120 Document1 Filed07/10/14 Page133 of 133

)%,)HGHUDO%XUHDXRI,QYHVWLJDWLRQ
Communities Against Terrorism
Potential Indicators of Terrorist Activities
Related to Mass Transportation

What Should I Consider Suspicious?

What Should I Do?

5HODWHGWR,QGLYLGXDO$SSHDUDQFH*HQHUDO%HKDYLRUDQG&RPPXQLFDWLRQV
x 6LJQLILFDQWO\DOWHUVDSSHDUDQFHIURPYLVLWWRYLVLWVKDYLQJEHDUGFKDQJLQJKDLUFRORU VW\OHRIGUHVVHWF
x %XUQVRQERG\PLVVLQJILQJHUVRUKDQGEORRG\FORWKLQJEOHDFKHGERG\KDLURUEULJKW FRORUHGVWDLQVRQFORWKLQJVZLWFKRUZLUHVFRQFHDOHGLQKDQGFORWKLQJRUEDFNSDFN
x 3DVVLQJDQRQ\PRXVWKUHDWVWHOHSKRQHHPDLOWRIDFLOLWLHVLQFRQMXQFWLRQZLWKVXVSHFWHG VXUYHLOODQFHLQFLGHQWV
x $FWLQJQHUYRXVRUVXVSLFLRXVSRVVLEO\PXPEOLQJWRWKHPVHOYHVKHDY\VZHDWLQJ x 0RQLWRULQJSHUVRQQHORUYHKLFOHVHQWHULQJOHDYLQJIDFLOLWLHVRUSDUNLQJDUHDV x %HKDYLQJDVLIXVLQJDKLGGHQFDPHUDSDQQLQJDEULHIFDVHEDJRYHUDSDUWLFXODUDUHDRU
FRQVWDQWO\DGMXVWLQJDQJOHRUKHLJKWRIDQLWHP
x 'LVFUHHWO\XVLQJFDPHUDVYLGHRUHFRUGHUVELQRFXODUVRUQRWHWDNLQJDQGVNHWFKLQJ x 8QXVXDOFRPPHQWVPDGHUHJDUGLQJDQWL86UDGLFDOWKHRORJ\YDJXHRUFU\SWLF
ZDUQLQJV
x 4XHVWLRQLQJVHFXULW\IDFLOLW\SHUVRQQHOWKURXJKSHUVRQDOFRQWDFWWHOHSKRQHPDLORUH PDLO  5HODWHGWR3DVVHQJHU$FWLYLWLHVRU,QWHUHVWVLQ6HFXULW\
x 0XOWLSOHSHRSOHDUULYLQJWRJHWKHUVSOLWWLQJXSPD\FRQWLQXHWRFRPPXQLFDWHYLDFHOO SKRQH
x 8QXVXDORUSURORQJHGLQWHUHVWLQWKHIROORZLQJ - 6HFXULW\PHDVXUHVRUSHUVRQQHO - 6HFXULW\FDPHUDV - (QWU\SRLQWVDQGDFFHVVFRQWUROV - 3HULPHWHUEDUULHUVIHQFHVZDOOV - 8QDWWHQGHGWUDLQRUEXV
x 3DUNLQJYHKLFOHVLQUHVWULFWHG]RQHVRUSXUSRVHO\SODFLQJREMHFWVLQVHQVLWLYHRU YXOQHUDEOHDUHDVWRREVHUYHVHFXULW\UHVSRQVHV
x $WWHPSWLQJWRDFTXLUHRIILFLDOYHKLFOHVXQLIRUPVEDGJHVDFFHVVFDUGVRULGHQWLILFDWLRQ FUHGHQWLDOVIRUNH\IDFLOLWLHVUHSRUWVXFKORVVHVDQGGHDFWLYDWHDFFHVVFDUGVLPPHGLDWHO\
x 2EVHUYLQJVHFXULW\UHDFWLRQGULOOVRUSURFHGXUHVPD\OHDYHDQXQDWWHQGHGSDFNDJHWR SUREH  ,WLVLPSRUWDQWWRUHPHPEHUWKDWMXVWEHFDXVHVRPHRQH¶VVSHHFK DFWLRQVEHOLHIVDSSHDUDQFHRUZD\RIOLIHLVGLIIHUHQWLWGRHVQRW PHDQWKDWKHRUVKHLVVXVSLFLRXV -RLQW5HJLRQDO,QWHOOLJHQFH&HQWHU-5,& ZZZMULFRUJ -5,&PHQWLRQ³7ULSZLUH´ 

%HSDUWRIWKHVROXWLRQ
9 5HTXLUHYDOLG,'IURPDOOFXVWRPHUV 9 .HHSUHFRUGVRISXUFKDVHV 9 7DONWRFXVWRPHUVDVNTXHVWLRQVDQG
OLVWHQWRDQGREVHUYHWKHLUUHVSRQVHV
9 :DWFKIRUSHRSOHDQGDFWLRQVWKDWDUH
RXWRISODFH
9 0DNHQRWHRIVXVSLFLRXVVWDWHPHQWV
SHRSOHDQGRUYHKLFOHV
9 ,IVRPHWKLQJVHHPVZURQJQRWLI\ODZ
HQIRUFHPHQWDXWKRULWLHV

'RQRWMHRSDUGL]H\RXUVDIHW\RUWKH VDIHW\RIRWKHUV

3UHYHQWLQJWHUURULVPLVDFRPPXQLW\HIIRUW %\OHDUQLQJZKDWWRORRNIRU\RXFDQPDNH DSRVLWLYHFRQWULEXWLRQLQWKHILJKWDJDLQVW WHUURULVP7KHSDUWQHUVKLSEHWZHHQWKH FRPPXQLW\DQGODZHQIRUFHPHQWLV HVVHQWLDOWRWKHVXFFHVVRIDQWLWHUURULVP HIIRUWV

6RPHRIWKHDFWLYLWLHVWDNHQLQGLYLGXDOO\ FRXOGEHLQQRFHQWDQGPXVWEHH[DPLQHGE\ ODZHQIRUFHPHQWSURIHVVLRQDOVLQDODUJHU FRQWH[WWRGHWHUPLQHZKHWKHUWKHUHLVDEDVLV WRLQYHVWLJDWH7KHDFWLYLWLHVRXWOLQHGRQ WKLVKDQGRXWDUHE\QRPHDQV DOOLQFOXVLYHEXWKDYHEHHQFRPSLOHGIURPD UHYLHZRIWHUURULVWHYHQWVRYHUVHYHUDO\HDUV


7KLVSURMHFWZDVVXSSRUWHGE\*UDQW1XPEHU08%;.DZDUGHGE\WKH%XUHDXRI-XVWLFH$VVLVWDQFH2IILFHRI-XVWLFH3URJUDPV86'HSDUWPHQWRI-XVWLFH(DFKLQGLFWRUOLV WHGDERYHLVE\ LWVHOIODZIXOFRQGXFWRUEHKDYLRUDQGPD\DOVRFRQVWLWXWHWKHH[HUFLVHRIULJKWVJXDUDQWHHGE\WKH86&RQVWLWXWLRQ,QDGGLWLRQWKHUHPD\EHDZKROO\LQQRFHQWH[S ODQDWLRQIRUFRQGXFWRUEHKDYLRUWKDW DSSHDUVVXVSLFLRXVLQQDWXUH)RUWKLVUHDVRQQRVLQJOHLQGLFDWRUVKRXOGEHWKHVROHEDVLVIRUODZHQIRUFHPHQWDFWLRQ7KHWRWDOLW\RIEHKDYLRUDOLQGLFDWRUVDQGRWKHUUHOHYDQWFLUFXPVWDQFHVVKRXOGEH
HYDOXDWHG ZKHQ FRQVLGHULQJ DQ\ ODZ HQIRUFHPHQW UHVSRQVH RU DFWLRQ
Exhibit J - Page 133

 
 Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 1 of 39

1 MORGAN, LEWIS & BOCKIUS LLP

Stephen Sotch-Marmo (admitted pro hac vice)

2 stephen.scotch-marmo@morganlewis.com

Michael James Ableson (admitted pro hac vice)

3 michael.ableson@morganlewis.com

101 Park Avenue

4 New York, NY 10178

(212) 309.6000; Facsimile: (212) 309.6001

5 AMERICAN CIVIL LIBERTIES UNION FOUNDATION

6 OF NORTHERN CALIFORNIA Linda Lye (#215584) llye@aclunc.org

7

Julia Harumi Mass (#189649) jmass@aclunc.org 39 Drumm Street

8

San Francisco, CA 94111 Telephone: 415-621-2493

Facsimile: 415-255-8437 9

ASIAN AMERICANS ADVANCING

10 JUSTICE - ASIAN LAW CAUCUS

Nasrina Bargzie (#238917) nasrinab@advancingjustice-alc.org

11 Yaman Salahi (#288752) yamans@advancingjustice-alc.org 55 Columbus Avenue

12

San Francisco, CA 94111 Telephone: 415-848-7711

13 Facsimile: 415-896-1702

14

Attorneys for Plaintiffs Wiley Gill, James Prigoff, Tariq Razak, Khaled Ibrahim, and Aaron Conklin

15 Additional counsel listed on signature page

16

UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF CALIFORNIA

17

SAN FRANCISCO-OAKLAND DIVISION

18 WILEY GILL; JAMES PRIGOFF;TARIQ

19

RAZAK; KHALED IBRAHIM; and AARON CONKLIN,

20 Plaintiffs,

21 v.

22 DEPARTMENT OF JUSTICE; LORETTA E. LYNCH,1 in her official capacity as the Attorney
23 General of the United States; PROGRAM MANAGER - INFORMATION SHARING
24 ENVIRONMENT; KSHEMENDRA PAUL, in his official capacity as the Program Manager of
25 the Information Sharing Environment,

26

Defendants.

Case No. 3:14-cv-03120 (RS)
FIRST SUPPLEMENTAL COMPLAINT FOR DECLARATORY AND INJUNCTIVE RELIEF
Administrative Procedure Act Case

27
1 In light of Ms. Lynch’s swearing in as Attorney General on April 27, 2015, she is automatically substituted as a
28 Defendant in this action in place of Eric Holder. See Fed. R. Civ. P. 25(d).

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF 1 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 2 of 39

1

INTRODUCTION

2

1. This complaint challenges a widespread domestic surveillance program that

3 targets constitutionally protected conduct and encourages racial and religious profiling.

4 Plaintiffs are five United States citizens – two photographers, one white man who is a devout

5 Muslim, and two men of Middle Eastern and South Asian descent. They engaged in innocuous,

6 lawful, and in some cases First Amendment protected activity. Two were photographing sites of

7 aesthetic interest, one was likely viewing a website about video games inside his home, one was

8 buying computers at Best Buy, and another was standing outside a restroom at a train station

9 while waiting for his mother. Due to the standards issued by Defendants that govern the

10 reporting of information about people supposedly involved in terrorism, Plaintiffs were reported

11 as having engaged in “suspicious activities,” reports about them were entered into

12 counterterrorism databases, and they were subjected to unwelcome and unwarranted law

13 enforcement scrutiny and interrogation. Defendants’ unlawful standards for maintaining a

14 federal law enforcement database regarding such supposedly “suspicious” activities have not

15 yielded any demonstrable benefit in the fight against terrorism, but they have swept up innocent

16 Americans in violation of federal law.

17

2. Through the National Suspicious Activity Reporting Initiative (“NSI”), the federal

18 government encourages state and local law enforcement agencies as well as private actors to

19 collect and report information that has a potential nexus to terrorism in the form of so-called

20 Suspicious Activity Reports (“SARs”). SARs are collected and maintained in various

21 counterterrorism databases and disseminated to law enforcement agencies across the country.

22 An individual who is reported in a SAR is flagged as a person with a potential nexus to terrorism

23 and automatically falls under law enforcement scrutiny, which may include intrusive questioning

24 by local or federal law enforcement agents. Even when the Federal Bureau of Investigation

25 concludes that the person did not have any nexus to terrorism, a SAR can haunt that individual

26 for decades, as SARs remain in federal databases for up to 30 years.

27

3. Defendants Department of Justice (“DOJ”) and Program Manager of the

28 Information Sharing Environment (“PM-ISE”) have issued standards governing the types of

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF 2 Gill v. DOJ, CASE NO. 3:14-CV-03120 (RS)

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 3 of 39

1 information that should be reported in a SAR. Both standards authorize the collection,

2 maintenance, and dissemination of information, in the absence of any reasonable suspicion of

3 criminal activity. Defendants have also identified specific categories of behavior that they claim

4 satisfy each agency’s standard and should be reported as suspicious. These behavioral categories

5 range from the constitutionally protected (photographing infrastructure) to the absurd (“acting

6 suspiciously”).

7

4. Defendants’ standards conflict with a duly promulgated regulation of Defendant

8 DOJ that prohibits the collection, maintenance, and dissemination of criminal intelligence

9 information, unless there is reasonable suspicion of criminal activity. See 28 C.F.R. § 23 (1993).

10 The regulation’s reasonable suspicion requirement reflects the constitutional principle that law

11 enforcement should not take action against someone, unless there is good reason to believe

12 criminal activity is afoot. Neither of Defendants’ standards for reporting suspicious activity was

13 promulgated in accordance with the notice and comment requirements of the Administrative

14 Procedure Act (“APA”), 5 U.S.C. § 551 et seq. (2012). As a result, Defendants’ issuance and

15 implementation of standards for suspicious activity reporting violate federal statutory

16 requirements that agencies not act in an arbitrary and capricious manner and observe the

17 procedures required by law. Through this action for declaratory and injunctive relief, Plaintiffs

18 seek to set aside as unlawful Defendants’ standards for suspicious activity reporting.

19

PARTIES

20

5. Plaintiff Wiley Gill is a United States citizen and a custodian at California State

21 University, Chico (“Chico State”). Mr. Gill converted to Islam while he was a student at Chico

22 State. He resides in Chico, California. He is the subject of a SAR, attached as Appendix A to

23 this Complaint. The SAR was uploaded to eGuardian, a law enforcement database maintained

24 by the FBI. The SAR identifies Mr. Gill as a “Suspicious Male Subject in Possession of Flight

25 Simulator Game.” Mr. Gill was likely viewing a website about video games on his computer at

26 home, when two officers of the Chico Police Department entered and searched his home without

27 voluntary consent or a warrant based on probable cause.

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF 3 Gill v. DOJ, CASE NO. 3:14-CV-03120 (RS)

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 4 of 39

1

6. Plaintiff James Prigoff is a United States citizen and an internationally renowned

2 photographer of public art. Mr. Prigoff resides in Sacramento, California. Private security

3 guards warned Mr. Prigoff not to photograph a piece of public art called the “Rainbow Swash” in

4 Boston, Massachusetts. As a result of that encounter, an agent of the Federal Bureau of

5 Investigation (“FBI”) went to Mr. Prigoff’s home in Sacramento several months later and

6 questioned at least one neighbor about him. Upon information and belief, Mr. Prigoff is the

7 subject of a SAR or SAR precursor report.

8

7. Plaintiff Khaled Ibrahim is a United States citizen of Egyptian descent who works

9 as an accountant for Nordix Computer Corporation, a computer network consulting and service

10 company. He formerly worked as a purchasing agent for Nordix. Mr. Ibrahim resides in San

11 Jose, California. Mr. Ibrahim is the subject of a SAR, attached as Appendix B to the Complaint.

12 The SAR describes a “[s]uspicious attempt to purchase large number of computers.” Mr.

13 Ibrahim attempted to make a bulk purchase of computers from a Best Buy retail store in Dublin,

14 California, in his capacity as a purchasing agent for Nordix. The SAR was uploaded to

15 eGuardian, a law enforcement database maintained by the FBI. Dublin is located in Alameda

16 County, California.

17

8. Plaintiff Tariq Razak is a United States citizen of Pakistani descent. A graduate

18 of the University of California at Irvine, he works in the bio-tech industry. Mr. Razak resides in

19 Placentia, California. Mr. Razak is the subject of a SAR, attached as Appendix C to this

20 Complaint. The SAR identifies Mr. Razak as a “Male of Middle Eastern decent [sic] observed

21 surveying entry/exit points” at the Santa Ana Train Depot and describes him as exiting the

22 facility with “a female wearing a white burka head dress.” Mr. Razak had never been to the

23 Depot before and was finding his way to the county employment resource center, which is

24 located inside the Depot and where he had an appointment. The woman accompanying him was

25 his mother.

26

9. Plaintiff Aaron Conklin is a graphic design student and amateur photographer.

27 He resides in Vallejo, California. Private security guards have twice prevented Mr. Conklin

28 from taking photographs of industrial architecture from public locations. One such incident

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF 4 Gill v. DOJ, CASE NO. 3:14-CV-03120 (RS)

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 5 of 39

1 occurred outside the Shell refinery in Martinez, California, and resulted in Mr. Conklin being

2 detained and having his camera and car searched by Contra Costa County Sheriff’s Deputies,

3 who told Mr. Conklin that he would be placed on an “NSA watchlist.” Upon information and

4 belief, Mr. Conklin is the subject of a SAR. Martinez is located in Contra Costa County,

5 California.

6

10. Defendant DOJ is a federal agency within the meaning of the APA, 5 U.S.C. §

7 551(1). DOJ, through its components, has issued a standard governing SAR reporting, conducts

8 trainings on that standard, and plays a major role in implementing the NSI.

9

11. The FBI is a component of DOJ with both intelligence and law enforcement

10 responsibilities. The FBI has issued a standard governing the reporting of SARs, and trains law

11 enforcement and private sector personnel on its SAR reporting standard. The FBI oversees and

12 maintains the eGuardian system, which serves as a repository for SARs and allows thousands of

13 law enforcement personnel and analysts across the country to access SARs in the eGuardian

14 system. The FBI is one of the primary entities responsible for the NSI.

15

12. The Office of Justice Programs (“OJP”) was created pursuant to 42 U.S.C. § 3711

16 (2012) and is a component of Defendant DOJ. OJP administers grants to state and local law

17 enforcement entities. Upon information and belief, OJP funding supports, among other things,

18 entities that engage in the collection, maintenance, and dissemination of SARs, and systems that

19 collect, maintain, and disseminate SARs.

20

13. The Bureau of Justice Assistance (“BJA”), within OJP, provides assistance to

21 local criminal justice programs through policy, programming, and planning. BJA served as the

22 executive agent of the NSI until October 2013. BJA has issued a standard governing the

23 reporting of SARs, and conducts trainings on its SAR reporting standard.

24

14. The Program Management Office (“PMO”), also a component of DOJ, has played

25 a key role in implementing the NSI. On December 17, 2009, DOJ was named the executive

26 agent to establish and operate the PMO for the NSI. In March 2010, DOJ established the NSI

27 PMO within BJA to support nationwide implementation of the SAR process.

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF 5 Gill v. DOJ, CASE NO. 3:14-CV-03120 (RS)

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 6 of 39

1

15. Defendant Loretta Lynch is the Attorney General of the United States and as the

2 head of DOJ is responsible for the regulations, guidelines, and standards adopted by DOJ. She is

3 sued in her official capacity.

4

16. Defendant PM-ISE is a federal agency within the meaning of the APA, 5 U.S.C. §

5 551(1) (2012). Pursuant to the Intelligence Reform and Terrorism Prevention Act of 2004

6 (“IRTPA”), PM-ISE is charged with issuing uniform standards for sharing terrorism and

7 homeland security information across federal, state, and local governments. 6 U.S.C. § 485

8 (2012). PM-ISE has issued a standard governing SAR reporting and conducts trainings on that

9 standard. PM-ISE’s standard for SAR reporting is set forth its “Information Sharing

10 Environment (ISE) - Functional Standard (FS) - Suspicious Activity Reporting (SAR)”

11 (“Functional Standard”). PM-ISE issued Version 1.5 of the Functional Standard ” in May 2009.

12 Functional Standard 1.5 is attached as Appendix D to this Complaint. PM-ISE issued Version

13 1.5.5 of the Functional Standard in February 2015. Functional Standard 1.5.5 is attached as

14 Appendix K to this Complaint.

15

17. Defendant Kshemendra Paul occupies the office of the PM-ISE, is the head of

16 PM-ISE, and is responsible for the regulations, guidelines, and standards adopted by PM-ISE.

17 He is sued in his official capacity.

18

JURISDICTION AND VENUE

19

18. This is an action under the APA, to set aside agency actions because they are

20 arbitrary and capricious, an abuse of discretion, and not in accordance with law, and because

21 they are without observance of procedure required by law. See 5 U.S.C. § 706 (2)(A), (D)

22 (2012). This Court has subject matter jurisdiction pursuant to 28 U.S.C. § 1331 and § 1349

23 (2012).

24

19. The Court has authority to grant declaratory relief pursuant to the Declaratory

25 Judgment Act, 28 U.S.C. § 2201 and § 2202 (2012).

26

20. Venue is proper in this district pursuant to 28 U.S.C. § 1391(e) (2012) because

27 Defendants are agencies of the United States and officers of the United States sued in their

28 official capacities, a substantial part of the events or omissions giving rise to this action occurred

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF 6 Gill v. DOJ, CASE NO. 3:14-CV-03120 (RS)

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 7 of 39

1 in this district, including Alameda and Contra Costa Counties, and one or more plaintiffs reside

2 in this district.

3

INTRADISTRICT ASSIGNMENT

4

21. Pursuant to Local Rule 3-2(c) and (d), assignment to the San Francisco-Oakland

5 Division is proper because a substantial part of the events giving rise to this action occurred in

6 Alameda and Contra Costa Counties.

7

FACTUAL ALLEGATIONS

8 A. The Nationwide Suspicious Activity Reporting Initiative

9

22. The federal government created the NSI to facilitate the sharing of information

10 potentially related to terrorism across federal, state, local, and tribal law enforcement agencies.

11 In particular, the NSI creates the capability to share reports of information with a potential nexus

12 to terrorism, which have been dubbed Suspicious Activity Reports.

13

23. Fusion centers are focal points of the system for sharing SARs. There are

14 currently 78 fusion centers nationwide. They are generally, though not always, owned and

15 operated by state or local government entities. Fusion centers receive federal financial support,

16 including from OJP.

17

24. Defendants PM-ISE and DOJ train state, local, and tribal law enforcement

18 agencies as well as private entities to collect information about activities with a potential nexus

19 to terrorism based on the standard each agency has adopted, and to submit the information in the

20 form of a SAR, either to a fusion center or the FBI.

21

25. Fusion centers gather, receive, store, analyze, and share terrorism and other

22 threat-related information, including SARs. On information and belief, fusion centers collect,

23 maintain, and disseminate SARs through databases that receive financial support from OJP.

24

26. Defendants train fusion center analysts in their respective standards for SAR

25 reporting. Fusion center analysts review submitted SARs. If a SAR meets Defendants’

26 standards, it is uploaded to one or more national databases, such as the FBI’s eGuardian system,

27 where it can be accessed by the FBI and law enforcement agencies across the country. The

28 federal government maintains SARs sent to the FBI’s eGuardian system for 30 years. This is

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF 7 Gill v. DOJ, CASE NO. 3:14-CV-03120 (RS)

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 8 of 39

1 done even when the FBI determines that the SAR has no nexus to terrorism. See Functional

2 Standard 1.5 at 34, 53; United States Government Accountability Office, “Information Sharing:

3 Additional Actions Could Help Ensure That Efforts to Share Terrorism-Related Suspicious

4 Activity Reports Are Effective” at 7 (March 2013) (“GAO SAR Report”).

5

27. Pursuant to the process created by Defendants PM-ISE and DOJ for suspicious

6 activity reporting, individuals who are the subject of a SAR are automatically subjected to law

7 enforcement scrutiny at multiple levels of government. That scrutiny may include, but is not

8 limited to, follow-up interviews and other forms of investigation by law enforcement. For

9 example:

10

(a) At the initial response and investigation stage, and even before a SAR is

11

submitted to a fusion center or the FBI, Defendant PM-ISE instructs the federal,

12

state, local, or tribal law enforcement agency with jurisdiction to respond to the

13

reported observation by “gather[ing] additional facts through personal

14

observations, interviews, and other investigative activities. This may, at the

15

discretion of the [responding] official, require further observation or engaging the

16

suspect in conversation.” Functional Standard 1.5 at 32; accord Functional

17

Standard 1.5.5 at 53.

18

(b) Fusion center personnel “tak[e] steps to investigate SARs – such as

19

interviewing the individual engaged in suspicious activity or who witnessed

20

suspicious activity – before providing the SARs to the FBI.” GAO SAR Report at

21

16. Officials from fusion centers do investigative work as part of their vetting

22

process. Id. at 17.

23

(c) The FBI reviews all SARs that it receives from fusion centers for follow-up.

24

That follow-up can take the form of an interview with the subject of the SAR, and

25

includes, but is not limited to, engaging in a threat assessment of or opening an

26

investigation into the subject.

27

(d) FBI agents have admitted that they are required to follow-up on SARs, even

28

when they know the individual does not pose a threat. For example, a

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF 8 Gill v. DOJ, CASE NO. 3:14-CV-03120 (RS)

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 9 of 39

1

professional freelance photographer in Los Angeles, California who specializes in

2

industrial photography, has twice been interviewed by the FBI after

3

photographing industrial sites. After security guards instructed him not to

4

photograph certain industrial sites in the area of the Port of Long Beach in April

5

2008, FBI agents visited him at his home to question him about the incident. The

6

FBI contacted him again, after Los Angeles Sheriff’s Department personnel

7

interfered with his efforts to photograph another industrial site in approximately

8

December 2009. The FBI agent told the photographer that he knew the

9

photographer did not pose a threat but that because a report had been opened, he

10

was required to follow-up on it.

11

(e) As explained above, SARs that have been uploaded to a national database can

12

be accessed by law enforcement agencies nationwide. Once uploaded to a

13

national database, the subject of a SAR faces scrutiny and potential investigation

14

by one or more of the law enforcement agencies across the country that has access

15

to the database. That scrutiny is only increasing, as queries of national SAR

16

databases have dramatically jumped in recent years. The number of queries of

17

national SAR databases such as eGuardian has risen from about 2,800 queries as

18

of July 2010 to more than 71,000 queries as of February 2013. See GAO SAR

19

Report at 36.

20

28. This surveillance program has not proven effective in the fight against terrorism.

21 The United States Government Accountability Office (“GAO”) has faulted the program for

22 failing to demonstrate any results-oriented outcomes, such as arrests, convictions, or thwarted

23 threats, even though tens of thousands of SARs had been deemed sufficiently significant to be

24 uploaded to national SAR databases as of October 2012. See GAO SAR Report at 33, 36-38. In

25 2012, a Senate Subcommittee reviewed a year of similar intelligence reporting from state and

26 local authorities, and identified “dozens of problematic or useless” reports “potentially violating

27 civil liberties protections.” United States Senate, Permanent Subcommittee on Investigations,

28 Committee on Homeland Security and Governmental Affairs, “Federal Support for and

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF 9 Gill v. DOJ, CASE NO. 3:14-CV-03120 (RS)

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 10 of 39

1 Involvement in State and Local Fusion Centers,” October 3, 2012 at 27. Another report, co-

2 authored by Los Angeles Police Department Deputy Chief Michael Downing, found that SARs

3 have “flooded fusion centers, law enforcement, and other security entities with white noise.”

4 The George Washington University Homeland Security Policy Institute, “Counterterrorism

5 Intelligence: Fusion Center Perspectives,” June 26, 2012 at 31.

6

29. While the SARs process has not proven effective in combating terrorism, it has

7 been extremely effective in sweeping up innocent Americans and recording their lawful activity

8 in federal counterterrorism databases. Over 1,800 SARs from fusion centers in California show

9 that the program targets First Amendment protected activity such as photography and encourages

10 racial and religious profiling. Examples of SARs that met Defendants’ standards for SAR

11 reporting and have been uploaded to the FBI’s eGuardian database include:

12

 “Suspicious ME [Middle Eastern] Males Buy Several Large Pallets of Water”

13

 A sergeant from the Elk Grove Police Department reported “on a suspicious

14

individual in his neighborhood”; the sergeant had “long been concerned about a

15

residence in his neighborhood occupied by a Middle Eastern male adult physician

16

who is very unfriendly”

17

 “Female Subject taking photos of Folsom Post Office”

18

 “an identified subject was reported to be taking photographs of a bridge crossing

19

the American River Bike trail”

20

 “I was called out to the above address regarding a male who was taking

21

photographs of the [name of facility blacked out] [in Commerce, California]. The

22

male stated, he is an artist and enjoys photographing building[s] in industrial

23

areas … [and] stated he is a professor at San Diego State private college, and

24

takes the photos for his art class.”

25

 “I observed a male nonchalantly taking numerous pictures inside a purple line

26

train [in Los Angeles County] … The male said he was taking pictures because

27

they were going to film the television show ‘24’ on the train next week.”

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

10 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 11 of 39

1

 “two middle eastern looking males taking photographs of Folsom Dam. One of

2

the ME males appeared to be in his 50’s”

3

 “Suspicious photography of the Federal Courthouse in Sacramento”: an “AUSA

4

[Assistant United States Attorney] reported to the Court Security Officer (CSO) a

5

suspicious vehicle occupied by what [name blacked out] described as two Middle

6

Eastern males, the passenger being between 40-50 years of age.”

7

 “Suspicious photography of Folsom Dam by Chinese Nationals”: “a Sac County

8

Sheriff's Deputy contacted 3 adult Asian males who were taking photos of

9

Folsom Dam. They were evasive when the deputy asked them for identification

10

and said their passports were in their vehicle.”

11 B. Conflicting Federal Rules for Collection of Intelligence Information

12

30. Defendants have issued three separate rules governing the collection of

13 intelligence information, in particular, suspicious activity reports. Only one of these rules,

14 however, requires reasonable suspicion of criminal activity for the information to be collected,

15 maintained, and disseminated, and only that rule was duly promulgated under the APA.

16

1. 28 C.F.R. Part 23

17

31. On June 19, 1968, President Lyndon B. Johnson signed into law the Omnibus

18 Crime Control and Safe Streets Act of 1968 (“Omnibus Act”). The Act created the Law

19 Enforcement Administration Agency (“LEAA”), a forerunner to OJP and a component of DOJ,

20 and authorized it to oversee the distribution of federal grants to state and local law enforcement

21 programs.

22

32. In 1978, after observing the notice and comment process set forth in the APA,

23 Defendant DOJ, through its component the LEAA, published a final rule establishing operating

24 principles for “Criminal Intelligence Systems.” See 28 C.F.R. § 23 (1993). The regulation was

25 promulgated pursuant to the LEAA’s statutory mandate to ensure that criminal intelligence is not

26 collected, maintained, or disseminated “in violation of the privacy and constitutional rights of

27 individuals.” 42 U.S.C. § 3789g(c) (2012).

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

11 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 12 of 39

1

33. Several commenters on the then-proposed regulation “were concerned that the

2 collection and maintenance of intelligence information should only be triggered by a reasonable

3 suspicion that an individual is involved in criminal activity.” See 43 Fed. Reg. 28,572 (June 30,

4 1978). The agency concurred, and the proposed operating principles were “revised to require

5 this criteria as a basis for collection and maintenance of intelligence information.” Id.

6

34. Among other requirements, the final rule provides that a “project shall collect and

7 maintain criminal intelligence information concerning an individual only if there is reasonable

8 suspicion that the individual is involved in criminal conduct or activity and the information is

9 relevant to that criminal conduct or activity.” 28 CFR § 23.20(a).

10

35. In addition, the regulation states that while “pooling of information about” various

11 kinds of criminal activities such as drug trafficking, smuggling, and public corruption can be

12 helpful in “expos[ing] … ongoing networks of criminal activity,” “the collection and exchange

13 of intelligence data necessary to support control of serious criminal activity may represent

14 potential threats to the privacy of individuals to whom such data relates,” and the privacy

15 guidelines set forth in 28 CFR Part 23 are therefore necessary. 28 CFR § 23.2.

16

36. In 1980, DOJ amended the rule, following the public notice and comment process

17 set forth in the APA, to extend the reach of 28 C.F.R. Part 23 to criminal intelligence systems

18 funded by both discretionary and formula grants. 45 Fed. Reg. 61,612 (Sep. 17, 1980).

19

37. DOJ amended the rule again in 1993 to include a definition of “reasonable

20 suspicion”:

21

Reasonable Suspicion . . . is established when information exists which establishes

sufficient facts to give a trained law enforcement or criminal investigative agency officer,

22

investigator, or employee a basis to believe that there is a reasonable possibility that an

individual or organization is involved in a definable criminal activity or enterprise. 23

See 28 C.F.R. § 23.20.

24

38. “Reasonable suspicion” is the time-tested, constitutional standard that limits law

25

enforcement from taking action against someone, unless there is good reason to believe criminal

26

activity is afoot.

27

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

12 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 13 of 39

1

39. One commenter argued that “reasonable suspicion . . . is not necessary to the

2 protection of individual privacy and Constitutional rights, [and suggested] instead that

3 information in a funded intelligence system need only be ‘necessary and relevant to an agency’s

4 lawful purposes.’” 58 Fed. Reg. 178, 48451 (Sept. 16, 1993). The agency disagreed, replying:

5 6 7 8 9 Id.

the potential for national dissemination of information in intelligence information systems, coupled with the lack of access by subjects to challenge the information, justifies the reasonable suspicion standard as well as other operating principle restrictions set forth in this regulation. Also, the quality and utility of ‘hits’ in an information system is enhanced by the reasonable suspicion requirement. Scarce resources are not wasted by agencies in coordinating information on subjects for whom information is vague, incomplete and conjectural.

10

40. DOJ made an attempt in 2008 to amend the regulation to weaken its privacy

11 protections. In particular, the proposed rule would have (1) permitted information to be stored

12 regarding organizations as well as individuals; (2) allowed information to be stored based on

13 reasonable suspicion related to “domestic and international terrorism, including material support

14 thereof,” and (3) eliminated the requirement that law enforcement agencies receiving information

15 from a Criminal Intelligence System agree to comply with 28 C.F.R. Part 23, so that recipients

16 would merely need to have procedures “consistent with” Section 23. See 73 Fed. Reg. 44,674

17 (July 31, 2008). This attempted rulemaking, however, met with criticism and DOJ withdrew its

18 proposed rule. The regulation has remained unchanged since its last amendment in 1993.

19

41. In short, in initially adopting the regulation, DOJ emphasized the importance of

20 the reasonable suspicion requirement and since then has expanded the scope of the regulation,

21 reiterated the importance of the reasonable suspicion requirement, and withdrawn efforts to

22 weaken the regulation’s privacy protections.

23

2. PM-ISE Standard for Suspicious Activity Reporting

24

42. Defendant PM-ISE subsequently issued a standard for SAR reporting, known as

25 the “Functional Standard,” that – unlike 28 CFR Part 23 – does not require reasonable suspicion

26 of criminal activity before a suspicious activity report is collected, maintained, or disseminated

27 and was not issued through the notice and comment procedure required by the APA, thus

28 dodging public review.
FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

13 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 14 of 39

1

43. Pursuant to the exercise of its statutory authority to “exercise governmentwide

2 authority over the sharing of [terrorism and homeland security] information,” 6 U.S.C. §

3 485(f)(1) (2012), PM-ISE has issued “Functional Standards” governing suspicious activity

4 reporting.

5

44. In or about May 2009, PM-ISE released Information Sharing Environment (ISE) -

6 Functional Standard (FS) - Suspicious Activity Reporting (SAR) Version 1.5 (“Functional

7 Standard 1.5”). In or about February 2015, PM-ISE released Information Sharing Environment

8 (ISE) – Functional Standard (FS) – Suspicious Activity Reporting (SAR) Version 1.5.5

9 (“Functional Standard 1.5.5”). Both Functional Standard 1.5 and Functional Standard 1.5.5

10 adopt a “reasonably indicative” standard for suspicious activity reporting. See Functional

11 Standard 1.5 at 2 (defining suspicious activity as “[o]bserved behavior reasonably indicative of

12 pre-operational planning related to terrorism or other criminal activity”); Functional Standard

13 1.5.5 at 4 (defining suspicious activity as “[o]bserved behavior reasonably indicative of pre-

14 operational planning associated with terrorism or other criminal activity”). PM-ISE is

15 considering a further update to the Functional Standard (to be designated Version 2.0) that may

16 broaden the standard for suspicious activity reporting.

17

45. The agency has expressly acknowledged that the Functional Standard’s

18 “reasonably indicative” standard requires “less than the ‘reasonable suspicion’ standard.” PM-

19 ISE, Privacy, Civil Rights, and Civil Liberties Analysis and Recommendations–Nationwide

20 Suspicious Activity Reporting Initiative at 12 (draft May 2010).

21

46. The Functional Standard also identifies sixteen categories of activity that fall

22 under the standard and provide a guide to law enforcement in determining what amounts to a

23 suspicious activity. These categories include photography, observation/surveillance, and

24 acquisition of materials or expertise. Functional Standard 1.5 at 29-30; Functional Standard

25 1.5.5 at 42-51.

26

47. The Functional Standard applies to, inter alia, “all departments or agencies that

27 possess or use terrorism or homeland security information.” Functional Standard 1.5 at 1;

28 Functional Standard 1.5.5 at 1. The Functional Standard applies to state, local, and tribal law

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

14 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 15 of 39

1 enforcement agencies and fusion centers that participate in the NSI. Agencies participating in

2 the NSI follow the Functional Standard in reporting suspicious activity.

3

48. The Functional Standard purports to define the scope of suspicious activity that

4 should be reported for agencies participating in the NSI. The purpose of the Functional Standard

5 is to standardize SAR reporting at the federal, state, and local levels.

6

49. PM-ISE trains participants in the NSI about, among other things, how to follow

7 the Functional Standard .

8

50. In promulgating the Functional Standard, PM-ISE expressly cited its legislative

9 authority under, inter alia, the IRTPA over governmentwide standards for information sharing.

10 Functional Standard 1.5 at 1; Functional Standard 1.5.5 at 1.

11

51. The Functional Standard constitutes final agency action and a legislative rule

12 within the meaning of the APA.

13

52. PM-ISE issued the Functional Standard without observing the process set forth in

14 the APA for public notice and comment. Functional Standard 1.5.5 went into immediate effect

15 upon its publication on February 23, 2015 and remains currently in effect.

16

3. DOJ Standard for Suspicious Activity Reporting

17

53. Defendant DOJ, through its components, has issued a standard for SAR reporting

18 (“DOJ’s SAR Standard”) that – unlike 28 CFR § 23 – does not require reasonable suspicion of

19 criminal activity before a suspicious activity report is collected, maintained, or disseminated and

20 was not issued through the notice and comment procedure required by the APA, thus dodging

21 public review.

22

54. DOJ, through its component the FBI, has set forth the following standard for

23 suspicious activity reporting: “observed behavior that may be indicative of intelligence gathering

24 or pre-operational planning related to terrorism, criminal or other illicit intention.” FBI, Privacy

25 Impact Assessment for the eGuardian Threat Tracking System at § 1.1 (emphasis added). This

26 standard is set forth in the FBI’s 2008 eGuardian Privacy Impact Assessment (“2008 eGuardian

27 PIA”), which is attached as Appendix E to this Complaint. “[T]he FBI uses the criteria in the

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

15 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 16 of 39

1 eGuardian Privacy Impact Assessment (dated November 25, 2008) … to determine if SARs have

2 a potential nexus to terrorism.” GAO SAR Report at 6 n.10.

3

55. DOJ’s “may be indicative” SAR Standard is even broader than PM-ISE’s

4 “reasonably indicative” Functional Standard. See GAO SAR Report at 15-16. But like the

5 Functional Standard, DOJ’s SAR Standard encourages reporting even in the absence of

6 reasonable suspicion of criminal activity.

7

56. Just as Defendant PM-ISE has enumerated categories of behavior that fall under

8 its “reasonably indicative” reporting standard, DOJ through its components has also enumerated

9 categories of behavior that fall under its “may be indicative” reporting standard. These

10 categories of behavior are broader than the categories set forth in the Functional Standard and

11 include but are not limited to:

12

(a) “Possible indicators of terrorist behaviors at hotels:…” FBI and United States

13

Department of Homeland Security, “Roll Call Release,” July 26, 2010, attached as

14

Appendix F to this Complaint.

15

(1) “Using payphones for outgoing calls or making front desk requests in

16

person to avoid using the room telephone.” Id.

17

(2) “Interest in using Internet cafes, despite hotel Internet availability….”

18

Id.

19

(3) “Requests for specific rooms, floors, or other locations in the

20

hotel….” Id.

21

(4) “Multiple visitors or deliveries to one individual or room.” Id.

22

(b) “No obvious signs of employment.” FBI, “Quick Reference Terrorism Card,”

23

attached as Appendix G to this Complaint.

24

(c) “Possess student visa but not English Proficient.” Id.

25

(d) “Persons not fitting into the surrounding environment, such as wearing

26

improper attire for the location.” Id.

27

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

16 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 17 of 39

1

(e) “Persons exhibiting unusual behavior such as staring or quickly looking away

2

from individuals or vehicles as they enter or leave designated facilities or

3

parking areas.” Id.

4

(f) “A blank facial expression in an individual may be indicative of someone

5

concentrating on something not related to what they appear to be doing.” Id.

6

(g) “[P]eople in places where they do not belong.” Bureau of Justice Assistance,

7

“Communities Against Terrorism: Potential Indicators of Terrorist Activities

8

Related to the General Public,” attached as Appendix H to this Complaint.

9

57. One category of behavior identified by DOJ as “suspicious” activity that should

10 be reported is a “catch-all”:

11

(a) “[P]eople acting suspiciously.” Id.

12

58. DOJ through its components has also issued “Potential Indicators of Terrorist

13 Activities Related to Electronic Stores” (attached as Appendix I to this Complaint) and

14 “Potential Indicators of Terrorist Activities Related to Mass Transportation” (attached as

15 Appendix J to this Complaint). Activities identified as suspicious in connection with mass

16 transportation include “[a]cting nervous or suspicious,” and “[u]nusual or prolonged interest in

17 … entry points and access controls.”

18

59. DOJ through its components trains participants in the NSI about DOJ’s SAR

19 Standard. For example, as of 2013, the PMO had provided training for 290,000 line officers (law

20 enforcement officers whose routine duties put them in a position to observe “suspicious”

21 activity), 2,000 analytical personnel, and executives from 77 fusion centers. See GAO SAR

22 Report at 29. DOJ components teach participants in the NSI, including frontline officers and

23 fusion center analysts to submit to the FBI “all potentially terrorism-related information and not

24 just ISE-SARs that met the [PM-ISE’s] Functional Standard.” GAO SAR Report at 16.

25

60. DOJ’s SAR Standard applies to state, local, and tribal law enforcement agencies

26 and fusion centers that participate in the NSI. Agencies participating in the NSI follow DOJ’s

27 SAR Standard in reporting suspicious activity.

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

17 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 18 of 39

1

61. DOJ’s SAR Standard purports to define the scope of suspicious activity that

2 should be reported for agencies participating in the NSI. The purpose of DOJ’s SAR Standard is

3 to standardize SAR reporting at the federal, state, and local levels.

4

62. Because DOJ’s SAR Standard is broader than PM-ISE’s Functional Standard and

5 DOJ’s behavioral categories include the catch-all “people acting suspiciously,” any activity that

6 falls under PM-ISE’s Functional Standard also falls under DOJ’s SAR Standard.

7

63. Fusion centers that follow DOJ’s SAR Standard instead of PM-ISE’s Functional

8 Standard send many SARs to the FBI for review. For example, of the SARs uploaded by one

9 state’s fusion center to a national SAR database from June 2011 to October 2012, only 10% met

10 PM-ISE’s Functional Standard. See GAO SAR Report at 16.

11

64. DOJ establishes an even broader standard than the already overbroad Functional

12 Standard, and the DOJ reinforces its broader standard through the trainings it provides to NSI

13 participants and through other mechanisms. For example, when fusion center personnel are

14 uncertain whether to share a SAR, DOJ encourages them to err on the side of overreporting. See

15 GAO SAR Report at 16. In addition, the only feedback mechanism participants in the NSI

16 currently receive on whether they are reporting SARs appropriately is provided by the FBI

17 through its eGuardian system. See GAO SAR Report at 13-14. The feedback the FBI provides

18 reinforces the DOJ SAR Standard to NSI participants.

19

65. DOJ’s 2008 eGuardian PIA, which sets forth the agency’s standard for reporting

20 suspicious activity, was signed by four “Responsible Officials,” two “Reviewing Officials,” and

21 one “Approving Official.” It reflects the consummation of the agency’s decision making

22 process.

23

66. DOJ’s 2008 eGuardian PIA contains a set of mandatory, non-discretionary rules

24 and obligations. It lays out clear instructions for the use of the eGuardian system to collect and

25 share SARs and the standard for defining “suspicious activity.” For example, the 2008

26 eGuardian PIA states that the eGuardian system will “ensure consistency of process and of

27 handling protocols” and mandates that all users “will be required to complete robust system

28 training that will incorporate eGuardian policies and procedures.” 2008 eGuardian PIA at 4. In

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

18 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 19 of 39

1 addition, the eGuardian User Agreement, attached to the 2008 eGuardian PIA, states that

2 “[i]ncidents not meeting the criteria of suspicious activity or with a potential nexus to terrorism

3 and that, further, do not comply with the above-stated rules, will be immediately deleted from

4 eGuardian.” 2008 eGuardian PIA at 25.

5

67. DOJ has consistently reinforced its standard for SAR reporting, set forth in the

6 2008 eGuardian PIA, through training materials and other publications that identify categories of

7 behavior that the agency contends are suspicious and should be reported.

8

68. In promulgating DOJ’s SAR Standard, DOJ expressly invoked its statutory

9 “mandate” under IRTPA and “other statutes … to share terrorism information with other federal,

10 and state, local and tribal (SLT) law enforcement partners.” 2008 eGuardian PIA at 2.

11

69. DOJ’s SAR Standard constitutes final agency action and a legislative rule within

12 the meaning of the APA.

13

70. Defendant DOJ issued the DOJ SAR Standard without observing the process set

14 forth in the APA for public notice and comment. It is the DOJ Standard for SAR reporting

15 currently in effect.

16

4. PM-ISE’s Functional Standard and DOJ’s SAR Standard Conflict with 28

17

CFR Part 23

18

71. As a report of “[o]bserved behavior reasonably indicative of pre-operational

19 planning” related to or associated with “terrorism or other criminal activity” (Functional

20 Standard) or a report of “observed behavior that may be indicative of intelligence gathering or

21 pre-operational planning related to terrorism, criminal or other illicit intention” (DOJ’s SAR

22 Standard), a SAR contains data relevant to the identification of an individual who is suspected in

23 some fashion of being involved in criminal, in particular, terrorist activity.

24

72. A SAR constitutes “criminal intelligence” within the meaning of 28 CFR Part 23.

25

73. State, local, and tribal law enforcement agencies and fusion centers that

26 participate in the NSI and observe PM-ISE’s Functional Standard and/or DOJ’s SAR Standard

27 collect, review, analyze, and disseminate SARs. These entities operate arrangements,

28 equipment, facilities, and procedures, used for the receipt, storage, interagency exchange or

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

19 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 20 of 39

1 dissemination, and analysis of SARs. Upon information and belief, these entities and the

2 systems they operate for receiving, storing, exchanging, disseminating, and analyzing SARs

3 operate through support from Defendant DOJ’s component OJP.

4

74. State, local, and tribal law enforcement agencies and fusion centers that

5 participate in the NSI and observe PM-ISE’s Functional Standard and/or DOJ’s SAR Standard

6 are “projects” within the meaning of 28 CFR Part 23. The systems or databases on which SARs

7 are maintained and through which they are collected and disseminated are “criminal intelligence

8 systems” within the meaning of 28 CFR Part 23.

9

75. PM-ISE’s Functional Standard and DOJ’s SAR Standard set forth operating

10 principles for the collection, maintenance, and dissemination of data relevant to the identification

11 of an individual who is suspected in some fashion of being involved in criminal, in particular,

12 terrorist activity. Both standards, however, encourage or purport to authorize collection,

13 maintenance, and dissemination of such data even in the absence of reasonable suspicion of

14 criminal activity. Both standards encourage or purport to authorize collection, maintenance, and

15 dissemination of much more data than that permitted under 28 CFR Part 23. Both standards

16 therefore conflict with 28 CFR Part 23.

17

76. Through PM-ISE’s promulgation of its Functional Standard and DOJ’s

18 promulgation of its SAR Standard, and through each agency’s training of entities participating in

19 the NSI in their respective standards for reporting suspicious activity, Defendants PM-ISE, Paul,

20 DOJ, and Holder have undermined and thereby violated 28 CFR Part 23.

21

77. Neither DOJ nor PM-ISE has offered any reasoned basis for departing from the

22 reasonable suspicion standard set forth in 28 CFR Part 23 for the collection, maintenance, and

23 dissemination of SARs.

24

78. DOJ could rescind its SAR reporting standard. If DOJ rescinded its SAR

25 reporting standard, participants in the NSI would cease collecting, maintaining, reviewing,

26 analyzing and disseminating SARs based on DOJ’s SAR Standard, and it would be clear that the

27 governing standard for suspicious activity reporting is 28 CFR Part 23. As a result, individuals

28 who are currently the subject of SARs but whose conduct did not give rise to a reasonable

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

20 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 21 of 39

1 suspicion of criminal activity would no longer have their information collected, maintained, and

2 disseminated in SAR databases. DOJ could cease collecting, maintaining, reviewing, analyzing,

3 and disseminating SARs about individuals whose conduct did not give rise to a reasonable

4 suspicion of criminal activity.

5

79. PM-ISE could rescind the Functional Standard. If PM-ISE rescinded the

6 Functional Standard, participants in the NSI would cease collecting, maintaining, reviewing,

7 analyzing and disseminating SARs based on the Functional Standard, and it would be clear that

8 the governing standard for suspicious activity reporting is 28 CFR Part 23. As a result,

9 individuals who are currently the subject of SARs but whose conduct did not give rise to a

10 reasonable suspicion of criminal activity would no longer have their information collected,

11 maintained, and disseminated in SAR databases.

12 C. Plaintiff’s Allegations

13

1. Wiley Gill

14

80. Wiley Gill is a United States citizen living in Chico, California. He works as a

15 custodian at Chico State, which he attended as an undergraduate. Mr. Gill converted to Islam in

16 2009, after learning about the religion in a course he took while a student at Chico State.

17

81. Mr. Gill is the subject of a SAR that identifies him as a “Suspicious Male Subject

18 in Possession of Flight Simulator Game.” This SAR falls into one or more of the behavioral

19 categories identified in the Functional Standard, in particular, “[a]cquisition of [e]xpertise” and

20 potentially “[a]viation [a]ctivity.” Functional Standard 1.5 at 29-30; Functional Standard 1.5.5 at

21 45, 50. It also falls under one or more behavioral categories identified by Defendant DOJ, such

22 as the catch-all behavioral category of “acting suspiciously.”

23

82. Mr. Gill’s SAR was collected, maintained, and disseminated through a fusion

24 center SAR database, and uploaded to eGuardian and/or another national SAR database. As a

25 result, the FBI has scrutinized Mr. Gill, conducted extensive background checks on him, and

26 created a file about him.

27

83. The SAR was created on or about May 23, 2012, and purports to document an

28 encounter between Mr. Gill and the Chico Police Department (“CPD”) on or about May 20,

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

21 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 22 of 39

1 2012. The SAR states that a CPD officer was investigating a domestic violence incident and

2 believed the suspect may have fled into Mr. Gill’s residence. The SAR states that this was later

3 discovered to be unfounded. It acknowledges that the CPD officer searched Mr. Gill’s home.

4 The SAR asserts that Mr. Gill’s computer displayed a screen titled something to the effect of

5 “Games that fly under the radar,” which appeared to be a “flight simulator type of game.” The

6 SAR concludes by describing Mr. Gill’s “full conversion to Islam as a young WMA [white, male

7 adult],” “pious demeanor,” and “potential access to flight simulators via the internet” as “worthy

8 of note.”

9

84. CPD’s search of Mr. Gill’s residence on or about May 20, 2012 did in fact occur.

10 But the SAR contains numerous misstatements and omits several crucial facts, including that two

11 CPD officers banged on Mr. Gill’s door and after when he went to open it, they came around the

12 corner of the house with their guns drawn and pointed at Mr. Gill. Mr. Gill was thrown off

13 guard. The officers eventually lowered their guns, and then asked to search Mr. Gill’s home,

14 based on the alleged domestic violence incident involving two individuals that they claimed to

15 have received. Mr. Gill informed the officers that he was home alone. Despite that, the officers

16 continued to ask to search his home. Mr. Gill was reluctant to grant permission, but felt that he

17 had no choice under the circumstances. One officer remained with Mr. Gill outside, while the

18 other searched his home. Mr. Gill did not feel free to leave. Mr. Gill cooperated with the

19 officers’ request for identification. Mr. Gill believes that he was likely viewing a website about

20 video games at the time of the May 20, 2012, incident.

21

85. On information and belief, the officers’ contention that they were investigating a

22 domestic violence call was a pretext for searching Mr. Gill’s home because CPD had already

23 decided to investigate Mr. Gill because of his religion.

24

86. The SAR also describes two earlier encounters between CPD and Mr. Gill, one at

25 the Mosque that Mr. Gill attends and another while Mr. Gill was walking through downtown

26 Chico “with elders.” The SAR describes Mr. Gill in these instances as “avoid[ing] eye contact”

27 and “hesitant to answer questions.”

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

22 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 23 of 39

1

87. Mr. Gill recalls CPD officers visiting the Mosque he attends, paying what they

2 described as a courtesy visit in an attempt to build good relations with the Muslim community.

3 Mr. Gill listened to the presentation. When it was over, CPD officers asked Mr. Gill his name,

4 whether he went to school, and if he was employed. Mr. Gill answered all of their questions.

5 His understanding is that the officers did not question anyone else in this manner.

6

88. Mr. Gill also recalls encountering CPD officers while he was walking through

7 downtown Chico with two older Muslim men who are friends from the Mosque. A CPD officer

8 called out Mr. Gill’s name and asked Mr. Gill if he had found a job yet. Mr. Gill answered the

9 question, but was caught off guard by the encounter because he did not recognize the officer and

10 was surprised that the officer knew his name and employment status.

11

89. At no point during any of the encounters with CPD recounted in the SAR did Mr.

12 Gill engage in conduct that gave rise to a reasonable suspicion of criminal activity.

13

90. The CPD also targeted Mr. Gill in two other encounters that are not described in

14 the SAR, and that do not involve any conduct by Mr. Gill that gave rise to a reasonable suspicion

15 of criminal activity, but instead reflect CPD’s suspicion of Mr. Gill because of his religion. One

16 of the incidents occurred before CPD filed the SAR about Mr. Gill on or about May 23, 2012;

17 the other occurred after. This religious harassment is attributable to the training of local law

18 enforcement on the SARs standards and process.

19

91. In approximately September 2010, after Mr. Gill had converted to Islam, two

20 CPD officers visited him at his apartment and requested to speak to him about supposedly “anti-

21 American statements” that he had made. One of the officers referred to having a file on Mr. Gill,

22 refused to explain what “anti-American statements” Mr. Gill had purportedly made or the source

23 of the information, and stated that he wished to ensure Mr. Gill would not turn into another

24 Mohammed Atta, one of the individuals identified as a September 11 hijacker. Mr. Gill still does

25 not know how he came to the attention of the CPD.

26

92. Around or after July 2012, Mr. Gill also received a telephone call from a CPD

27 officer. Over the phone, the CPD officer said Mr. Gill should shut down his Facebook page

28 because of the video games Mr. Gill played. At the time, Mr. Gill had a picture of the Shahada,

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

23 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 24 of 39

1 the Muslim statement of faith, on his Facebook page. Mr. Gill told the CPD officer he would not

2 take down his Facebook page and Mr. Gill also told the CPD officer that he believed the CPD

3 wanted Mr. Gill to take down his Facebook page because of its references to Islam. The CPD

4 officer refused to comment on Mr. Gill’s observation, but stated that he had a report on Mr. Gill

5 and indicated that Mr. Gill was on some kind of watch list.

6

93. By describing Mr. Gill’s conversion to Islam and “pious demeanor” in the SAR as

7 “worthy of note,” CPD implicitly acknowledges that it found him “suspicious” because he is a

8 devout Muslim.

9

94. Defendants’ issuance of overly broad definitions of “suspicious activity” and the

10 categories of behavior they have identified as “suspicious” include, among other things,

11 “[a]cquisition of expertise” (PM-ISE) and “[n]o obvious signs of employment” (DOJ). On

12 information and belief, CPD officers are trained in Defendants’ standards for SAR reporting.

13

95. Defendants’ overly broad standards for reporting suspicious activity opens the

14 door to and encourages religious profiling. These standards opened the door to and encouraged

15 the religious profiling of Mr. Gill by CPD, CPD’s repeated questioning and ongoing scrutiny of

16 Mr. Gill, and CPD’s identification of Mr. Gill in a SAR as someone engaged in activity with a

17 potential nexus to terrorism.

18

96. In addition, the Functional Standard instructs law enforcement agencies at the

19 “[i]nitial [r]esponse and [i]nvestigation stage” to respond to the observation reported in a SAR,

20 and “gather[] additional facts,” by, inter alia, “engaging the suspect in conversation” and “other

21 investigative activities.” Functional Standard 1.5 at 32; Functional Standard 1.5.5 at 53. The

22 CPD was implementing the protocols set forth in the Functional Standard when it harassed Mr.

23 Gill on or about May 2012, before, and after.

24

97. Because Mr. Gill is the subject of a SAR that falls under Defendants’ standards

25 for suspicious activity reporting, Mr. Gill has been automatically subjected to law enforcement

26 scrutiny. That scrutiny has included, among other things, CPD’s telephone call to him around or

27 after July 2012 and the FBI’s creation of a file about and investigation of Mr. Gill.

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

24 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 25 of 39

1

98. Given the repeated harassment Mr. Gill has already suffered by CPD, he fears

2 further action may be taken against him by CPD and other investigative agencies as the result of

3 this SAR. He also fears further investigative harassment at the hands of the CPD and other

4 agencies caused by the existence of the SAR.

5

99. Mr. Gill also has experienced frustration and stress resulting from the creation of

6 the SAR based on innocent conduct. He is also deeply troubled by what may result from the

7 collection, maintenance, and dissemination in a national database of a report describing him as

8 engaging in suspicious activity with a potential nexus to terrorism.

9

100. The SAR about Mr. Gill is maintained and will continue to be maintained in one

10 or more national SAR databases, where it can be accessed by law enforcement agencies across

11 the country.

12

2. James Prigoff

13

101. James Prigoff is a United States citizen who resides in Sacramento, California.

14 He is an internationally renowned photographer. The focus of his work is public art, such as

15 murals and graffiti art. He has amassed over 80,000 photographic slides and published several

16 books containing his photography. Mr. Prigoff is also a former business executive, having

17 served as a Senior Vice President of the Sara Lee Corporation and a President of a division of

18 Levi Strauss.

19

102. In or around the spring of 2004, Mr. Prigoff was in Boston, Massachusetts. While

20 there, he sought to photograph a famous piece of public art known as the “Rainbow Swash,”

21 located in the Dorchester neighborhood of Boston. The artwork is painted on a natural gas

22 storage tank, which is surrounded by a chain link fence. It is highly visible to commuters from

23 the local expressway.

24

103. Mr. Prigoff drove a rental car to a public area outside the fence surrounding the

25 Rainbow Swash, and set up to take photographs. He chose the location in part because of

26 favorable lighting conditions. From this location, the sun was behind him and casting its light on

27 the Rainbow Swash. Before Mr. Prigoff could take any photographs, two private security guards

28 came out from inside the fenced area and told him that he was not allowed to photograph,

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

25 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 26 of 39

1 claiming the area was private property. Mr. Prigoff pointed out to the security guards that he

2 was not, in fact, on private property. The guards still insisted that Mr. Prigoff could not

3 photograph.

4

104. To avoid a confrontation with the guards, Mr. Prigoff departed. He left without

5 giving the security guards any identifying information.

6

105. He drove further down the road to another public location outside the fenced

7 perimeter and attempted to take photographs from this second location. But the guards began to

8 follow him.

9

106. To avoid further harassment by the guards, he drove to a third location on the

10 other side of the Rainbow Swash. The guards did not follow him to this third location, and he

11 was finally able to take photographs of the Rainbow Swash unmolested. But the lighting

12 conditions were significantly inferior to those at the first two locations; from this third location,

13 he had to photograph into the sunlight.

14

107. At no point while he was attempting to photograph the Rainbow Swash did Mr.

15 Prigoff engage in conduct that gave rise to a reasonable suspicion of criminal activity.

16

108. Mr. Prigoff subsequently discovered photographs online, including on the

17 Rainbow Swash’s Wikipedia webpage. These widely available photographs were taken from

18 vantage points closer than the three locations from which Mr. Prigoff attempted to and actually

19 took photographs.

20

109. Mr. Prigoff returned to his home in Sacramento, California after his trip to

21 Boston. A few months later, on or about August 19, 2004, he came home one day to find a

22 business card affixed to his door from Agent A. Ayaz of the Joint Terrorism Task Force, which,

23 as noted above, is a partnership between the FBI and other law enforcement agencies. On the

24 back was a handwritten note stating, “Mr. Prigoff, please call me. Thanks.” Mr. Prigoff later

25 learned from a neighbor across the street that two agents had knocked on her door and asked for

26 information about Mr. Prigoff.

27

110. Mr. Prigoff called Mr. Ayaz, who asked if Mr. Prigoff had been to Boston.

28 Realizing that Mr. Ayaz was referring to his efforts to photograph a piece of public art, Mr.

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

26 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 27 of 39

1 Prigoff explained what had occurred. On information and belief, security guards at the site of the

2 Rainbow Swash had submitted a SAR or SAR precursor report regarding Mr. Prigoff that

3 included his rental car information, after which authorities traced him from Boston,

4 Massachusetts, to his home in Sacramento, California.

5

111. Mr. Prigoff is very upset that he was tracked cross-country from Boston to

6 Sacramento, and contacted by law enforcement agents at his home over his effort to engage in

7 photography from a public location. Mr. Prigoff is also very upset that law enforcement agents

8 questioned at least one of his neighbors about him, as such questioning casts the negative and

9 strong implication that Mr. Prigoff had somehow engaged in misconduct.

10

112. Taking photographs of infrastructure falls under one or more of the behavioral

11 categories identified by Defendant PM-ISE under the Functional Standard as “suspicious,” and

12 also falls under one or more behavioral categories identified by Defendant DOJ, such as the

13 catch-all behavioral category of “acting suspiciously.” After attempting to photograph a piece of

14 public art painted on a natural gas storage tank in Boston, Mr. Prigoff was tracked to his home in

15 Sacramento and questioned about his trip to Boston, even though he never provided the security

16 guards with identifying information. On information and belief, Mr. Prigoff is the subject of a

17 SAR or SAR precursor report, which was filed by security guards at the Rainbow Swash. On

18 information and belief, the report about him was collected, maintained, and disseminated through

19 a fusion center database, and uploaded to eGuardian and/or another national SAR or similar

20 counterrorism database. On information and belief, the report about him was collected,

21 maintained, and disseminated under standards that authorized collection, maintenance and

22 dissemination of information even in the absence of reasonable suspicion of criminal activity;

23 Defendants’ standards for SAR reporting ratify that conduct.

24

113. On information and belief, security guards at the Rainbow Swash were trained in

25 standards that encourage reporting of activity deemed connected to terrorism, even in the

26 absence of reasonable suspicion of criminal activity; Defendants’ standards for SAR reporting

27 ratify that conduct. Because of that training, they interfered with Mr. Prigoff’s lawful efforts to

28 take photographs of the Rainbow Swash.
FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

27 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 28 of 39

1

114. Because Mr. Prigoff is the subject of a report that falls under Defendants’

2 standards for suspicious activity reporting, Mr. Prigoff has been automatically subjected to law

3 enforcement scrutiny. That scrutiny has included but may not be limited to a follow-up visit by

4 an agent of the Joint Terrorism Task Force to his home, a telephone call with that agent, and

5 inquiries by that agent of at least one of his neighbors about him.

6

115. Upon information and belief, the report about Mr. Prigoff is maintained and will

7 continue to be maintained in one or more national SAR or similar counterterrorism databases,

8 where it can be accessed by law enforcement agencies across the country.

9

116. Mr. Prigoff continues to be an active photographer and often takes pictures of

10 architectural structures and post offices, among other sites that could be described as

11 “infrastructure.” Because taking photographs of infrastructure falls under one or more of the

12 behavioral categories identified by Defendant PM-ISE under the Functional Standard as

13 “suspicious,” and also falls under one or more behavioral categories identified by Defendant

14 DOJ, such as the catch-all behavioral category of “acting suspiciously,” he is likely to be the

15 subject of another SAR in the future. He fears that his efforts to take photographs of such areas

16 will be hindered again in the future.

17

117. Mr. Prigoff is also deeply troubled by what may result from the collection,

18 maintenance, and dissemination in a national database of a report describing him as engaging in

19 suspicious activity with a potential nexus to terrorism.

20

3. Khaled Ibrahim

21

118. Khaled Ibrahim is a United States citizen of Egyptian descent living in San Jose,

22 California. He works in accounting for Nordix Computer Corporation, a computer network

23 consulting and service company. He formerly worked as a purchasing agent for Nordix. As part

24 of his job as purchasing agent, Mr. Ibrahim bought computers in bulk from retail stores, where

25 the stores allowed such transactions.

26

119. On several occasions in 2011, Mr. Ibrahim went to the Best Buy in Dublin,

27 California in order to attempt to purchase computers in bulk for Nordix. On one such occasion,

28 he was told that management did not allow such bulk purchases and, with that, Mr. Ibrahim left.

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

28 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 29 of 39

1

120. At no point while he was attempting to purchase computers from Best Buy did

2 Mr. Ibrahim engage in conduct that gave rise to a reasonable suspicion of criminal activity.

3

121. Mr. Ibrahim is the subject of a SAR, created on November 14, 2011, regarding

4 Mr. Ibrahim’s attempts to purchase “a large amount of computers.” The SAR about him was

5 collected, maintained, and disseminated through a fusion center SAR database, and uploaded to

6 the FBI’s eGuardian database. Upon information and belief, the personnel at the fusion center

7 who uploaded Mr. Ibrahim’s SAR to eGuardian were trained in Defendants’ standards for SAR

8 reporting.

9

122. The SAR pertaining to Mr. Ibrahim falls into one or more of the behavioral

10 categories identified in the Functional Standard, in particular, “[a]cquisition … of unusual

11 quantities of materials.” Functional Standard 1.5 at 30; Functional Standard 1.5.5 at 50. It also

12 falls under one or more behavioral categories identified by Defendant DOJ, such as the catch-all

13 behavioral category of “acting suspiciously” and DOJ’s “Potential Indicators of Terrorist

14 Activities Related to Electronic Stores.”

15

123. Because Mr. Ibrahim is the subject of a SAR that falls under Defendants’

16 standards for suspicious activity reporting, Mr. Ibrahim has been automatically subjected to law

17 enforcement scrutiny. That scrutiny may include but is not limited to scrutiny or interviews by

18 any of the law enforcement agencies across the country that have access to the FBI’s eGuardian

19 system, to which his SAR was uploaded.

20

124. Mr. Ibrahim is particularly disturbed that trained law enforcement personnel at a

21 fusion center uploaded the SAR about him to eGuardian, thereby flagging him as an individual

22 with a potential nexus to terrorism. He is also troubled by what may result from the collection,

23 maintenance, and dissemination in a national database of a report describing him as engaging in

24 suspicious activity with a potential nexus to terrorism. Mr. Ibrahim is upset that a SAR was

25 entered about him potentially because of his Middle Eastern descent, and believes that this

26 system of racial profiling diminishes the rights of Middle Eastern communities.

27

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

29 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 30 of 39

1

125. The SAR about Mr. Ibrahim is maintained and will continue to be maintained in

2 one or more national SAR databases, where it can be accessed by law enforcement agencies

3 across the country.

4

4. Tariq Razak

5

126. Tariq Razak is a United States citizen of Pakistani descent. He resides in

6 Placentia, California. A graduate of the University of California at Irvine, he works in the bio-

7 tech industry.

8

127. Mr. Razak is the subject of a SAR pertaining to a “Male of Middle Eastern decent

9 [sic] observed surveying entry/exit points” at the Santa Ana Train Depot.

10

128. On May 16, 2011, Santa Ana Police Officer J. Gallardo filed a SAR regarding Mr.

11 Razak. According to the SAR, Officer Gallardo responded to a call at the Santa Ana Train

12 Depot from Security Officer Karina De La Rosa. Ms. De La Rosa explained that her “suspicion

13 became aroused because the male appeared to be observant of his surroundings and was

14 constantly surveying all areas of the facility. The male’s appearance was neat and clean with a

15 closely cropped beard, short hair wearing blue jeans and a blue plaid shirt.” The SAR goes on to

16 describe how Mr. Razak, after studying entry/exit points moved to a part of the train station

17 where the restrooms are located and eventually departed the train station with “a female wearing

18 a white burka head dress” who had emerged from the restrooms. Office Gallardo concludes the

19 SAR by requesting that it be forwarded to the fusion center in Orange County “for review and

20 possible follow-up.”

21

129. According to the SAR, Security Officer De La Rosa stated that “she received

22 ‘suspicious activity as related to terrorism training’” and that “the behavior depicted by the male

23 was similar to examples shown in her training raising her suspicion and making the decision to

24 notify the police.” Mr. Razak is the subject of the SAR because of Defendants’ trainings on their

25 SAR reporting standards to state and local law enforcement and the private sector.

26

130. Mr. Razak was, indeed, at the Santa Ana Train Depot on May 16, 2011. The

27 woman he was with was his mother. He had an appointment at the county employment resource

28 center, which is located in the station building. He had not been to the station before and spent

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

30 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 31 of 39

1 some time locating the office before meeting up with his mother by the restrooms and leaving.

2 His mother was wearing a hijab (head scarf), and not a burka.

3

131. Mr. Razak did not talk to any security officers at the Santa Ana Train Depot that

4 day. The SAR notes the make and model of Mr. Razak’s vehicle, and his license plate number.

5 On information and belief, Security Officer De La Rosa followed Mr. Razak to his vehicle and

6 wrote down his license plate number to identify him.

7

132. At no point while he was waiting in the Train Depot did Mr. Razak engage in

8 conduct that gave rise to a reasonable suspicion of criminal activity.

9

133. This SAR falls into one or more of the behavioral categories identified in the

10 Functional Standard, in particular, “Observation/Surveillance.” Functional Standard 1.5 at 30;

11 Functional Standard 1.5.5 at 49. It also falls under DOJ’s “Potential Indicators of Terrorist

12 Activities Related to Mass Transportation,” which includes, among other things, “[u]nusual or

13 prolonged interest in … [e]ntry points and access controls.” It also falls under one or more

14 behavioral categories identified by Defendant DOJ, such as the catch-all behavioral category of

15 “acting suspiciously.” The SAR about Mr. Razak was collected, maintained, and disseminated

16 through a fusion center SAR database, and on information and belief has been uploaded to

17 eGuardian and/or another national SAR database.

18

134. Because Mr. Razak is the subject of a SAR that falls under Defendants’ standards

19 for suspicious activity reporting, Mr. Razak has been automatically subjected to law enforcement

20 scrutiny. That scrutiny may include but is not limited to scrutiny or interviews by any of the law

21 enforcement agencies across the country that have access to the SAR about him.

22

135. Mr. Razak is deeply troubled by what may result from the collection,

23 maintenance, and dissemination in a national database of a report describing him as engaging in

24 suspicious activity with a potential nexus to terrorism.

25

136. Upon information and belief, the SAR about Mr. Razak is maintained and will

26 continue to be maintained in one or more national SAR databases, where it can be accessed by

27 law enforcement agencies across the country.

28

5. Aaron Conklin

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

31 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 32 of 39

1

137. Aaron Conklin resides in Vallejo, California. Mr. Conklin is a student at Diablo

2 Valley College, studying graphic design. He is also an amateur photographer who posts his

3 work online. Mr. Conklin has a strong aesthetic interest in photographing industrial architecture,

4 including refineries.

5

138. In either 2011 or 2012, Mr. Conklin was photographing the Valero Refinery

6 located in Benicia, California at around 10:00 p.m. He chose to photograph at night for aesthetic

7 reasons, to capture the refinery illuminated against the dark night sky. Mr. Conklin set up in an

8 empty lot where a food truck parks during the day, near a publicly accessible sidewalk and a bus

9 stop. Mr. Conklin was positioned outside the refinery’s fenced perimeter.

10

139. Despite Mr. Conklin’s location outside the refinery’s perimeter in a publicly

11 accessible location, a private security guard from the refinery came out to tell Mr. Conklin that

12 he could not photograph the refinery and issued stern warnings. Mr. Conklin felt threatened and

13 feared that the situation would escalate if he remained, so he left. Because he fears further

14 harassment, he has not returned to photograph the refinery, despite his desire to develop his

15 portfolio with photographs of industrial sites.

16

140. Mr. Conklin later discovered that images of the refinery, taken from a similar

17 location, were viewable on the internet through Google Maps, using the site’s “street view”

18 feature.

19

141. In or about November 2013, Mr. Conklin was attempting to photograph the Shell

20 Refinery located in Martinez, California at approximately 9:30 or 10:00 pm. He wished to

21 photograph the refinery at night for artistic reasons.

22

142. Mr. Conklin set up in the parking lot of a strip mall containing a smog testing

23 center and a dance studio, across the street from the Shell Refinery’s fenced perimeter.

24

143. As Mr. Conklin was preparing to photograph, a private security guard came out

25 from the refinery and stopped him. At least one other guard from the refinery soon joined the

26 first security guard. The security guards told Mr. Conklin that he was prohibited from

27 photographing the refinery and that photographing the refinery was illegal and somehow

28 connected to terrorism.
FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

32 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 33 of 39

1

144. Despite Mr. Conklin’s complete cooperation with the security guards, they called

2 the Contra Costa County Sheriff’s department, and at least two deputies arrived on the scene.

3 The deputies searched through the pictures on Mr. Conklin’s camera and searched his car. They

4 also took pictures of Mr. Conklin, his camera equipment, and his vehicle. Mr. Conklin was

5 afraid and felt as though he did not have the option to object to the searches without making

6 matters worse for himself.

7

145. The deputies concluded by telling Mr. Conklin that he would have to be placed on

8 an “NSA watch list.” Only then was Mr. Conklin allowed to leave. The entire encounter lasted

9 between forty-five minutes and an hour.

10

146. At no point while he was attempting to photograph the Valero or Shell refineries

11 did Mr. Conklin engage in conduct that gave rise to a reasonable suspicion of criminal activity.

12

147. Taking photographs of infrastructure falls under one or more of the behavioral

13 categories identified by Defendant PM-ISE as “suspicious,” and also falls under one or more

14 behavioral categories identified by Defendant DOJ, such as the catch-all behavioral category of

15 “acting suspiciously.” A Contra Costa deputy sheriff expressly told Mr. Conklin that he had to

16 be put on an “NSA watchlist.” On information and belief, Mr. Conklin is the subject of a SAR,

17 which was collected, maintained, and disseminated through a fusion center SAR database, and

18 uploaded to eGuardian and/or another national SAR database.

19

148. On information and belief, security guards at oil refineries are trained in

20 Defendants’ standards for SAR reporting. As a result, security guards at the Valero and Shell oil

21 refineries prevented Mr. Conklin from taking photographs of sites of aesthetic interest to him.

22 On information and belief, the Contra Costa deputy sheriffs are trained in Defendants’ standards

23 for SAR reporting. As a result, they detained and searched Mr. Conklin for doing nothing more

24 than attempting to photograph a site of aesthetic interest from a public location, told Mr. Conklin

25 that he had to be placed on a watchlist, and reported Mr. Conklin in a SAR.

26

149. Because Mr. Conklin is the subject of a SAR that falls under Defendants’

27 standards for suspicious activity reporting, Mr. Conklin has been automatically subjected to law

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

33 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 34 of 39

1 enforcement scrutiny. That scrutiny may include but is not limited to scrutiny or interviews by

2 any of the law enforcement agencies across the country that have access to the SAR about him.

3

150. Mr. Conklin was very upset by the encounter with private security and Contra

4 Costa deputy sheriffs at the Shell refinery. He wants to continue taking photographs of

5 industrial architecture in the future. But because of this event and the earlier incident at the

6 Valero refinery, he is afraid to continue photographing industrial sites for fear of being stopped

7 and questioned or, worse, arrested. Mr. Conklin has been chilled and has refrained from

8 engaging in certain forms of photography, despite his desire to develop his photography

9 portfolio. His inability to develop his photography portfolio limits his ability to apply

10 successfully for jobs in his chosen field.

11

151. Mr. Conklin is also deeply troubled by what may result from the collection,

12 maintenance, and dissemination in a national database of a report describing him as engaging in

13 suspicious activity with a potential nexus to terrorism.

14

152. Mr. Conklin currently worries about being on a watchlist because he fears it will

15 adversely impact him in the future. For example, he is concerned about his employment

16 prospects if employers conduct background checks and he is flagged as someone with a potential

17 connection to terrorism. Mr. Conklin also currently worries about being on a watchlist because

18 he fears it will adversely impact his family. His father has worked and is seeking employment in

19 the aviation industry and as a result must undergo rigorous background checks; Mr. Conklin is

20 afraid about jeopardizing his father’s career based on his own innocent efforts to take

21 photographs of aesthetically interesting sites.

FIRST CLAIM FOR RELIEF 22

Violation of APA by Defendants DOJ and Loretta Lynch for

23

Agency Action that is Arbitrary and Capricious and Not in Accordance with Law

5 U.S.C. §§ 702, 706(2)(A) 24

153. Plaintiffs incorporate by reference all preceding paragraphs as if fully set forth

25

herein.

26

154. DOJ’s promulgation of DOJ’s SAR Standard constitutes final agency action.

27

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

34 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 35 of 39

1

155. DOJ and Loretta Lynch have issued a SAR Standard that sets forth operating

2 principles for the collection, maintenance, and dissemination of “criminal intelligence

3 information” within the meaning of 28 CFR Part 23. It applies to entities that operate

4 arrangements, equipment, facilities, and procedures used for the receipt, storage, interagency

5 exchange or dissemination and analysis of criminal intelligence information. These entities and

6 the systems they operate receive support from OJP and constitute “projects” and “criminal

7 intelligence systems” within the meaning of 28 CFR Part 23.

8

156. Because DOJ’s SAR standard is broader than 28 CFR Part 23 and authorizes the

9 collection, maintenance, and dissemination of information even in the absence of reasonable

10 suspicion of criminal activity, it conflicts with 28 CFR Part 23. DOJ has also undermined 28

11 CFR Part 23 by training participants in the NSI on DOJ’s SAR Standard.

12

157. Defendants DOJ and Loretta Lynch have not provided a reasoned basis for

13 adopting a conflicting standard.

14

158. Defendants’ actions described herein were and are arbitrary, capricious, an

15 abuse of discretion, and otherwise not in accordance with law, and should be set aside as

16 unlawful pursuant to 5 U.S.C. § 706 (2012).

17

SECOND CLAIM FOR RELIEF

18

Violation of APA by Defendants PM-ISE and Kshemendra Paul for

Agency Action that is Arbitrary and Capricious and Not in Accordance with Law

19

5 U.S.C. §§ 702, 706(2)(A)

20

159. Plaintiffs incorporate by reference all preceding paragraphs as if fully set forth

21 herein.

22

160. PM-ISE’s promulgation of the Functional Standard constitutes final agency

23 action.

24

161. PM-ISE and Kshemendra Paul have issued a SAR Standard that sets forth

25 operating principles for the collection, maintenance, and dissemination of “criminal intelligence

26 information” within the meaning of 28 CFR Part 23. It applies to entities that operate

27 arrangements, equipment, facilities, and procedures used for the receipt, storage, interagency

28 exchange or dissemination and analysis of criminal intelligence information. These entities and

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

35 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 36 of 39

1 the systems they operate receive support from OJP and constitute “projects” and “criminal

2 intelligence systems” within the meaning of 28 CFR Part 23.

3

162. Because the Functional Standard is broader than 28 CFR Part 23 and authorizes

4 the collection, maintenance, and dissemination of information even in the absence of reasonable

5 suspicion of criminal activity, it conflicts with 28 CFR Part 23. PM-ISE has also undermined 28

6 CFR Part 23 by training participants in the NSI on the Functional Standard.

7

163. Defendants PM-ISE and Kshemendra Paul have not provided a reasoned basis for

8 adopting a conflicting standard.

9

164. Defendants’ actions described herein were and are arbitrary, capricious, an

10 abuse of discretion, otherwise not in accordance with law and should be set aside as unlawful

11 pursuant to 5 U.S.C. § 706 (2012).

12

THIRD CLAIM FOR RELIEF

13

Violation of APA by Defendants DOJ and Loretta Lynch

for Issuance of a Legislative Rule Without Notice and Comment

14

5 U.S.C. §§ 553, 706(2)(A), (D)

15

165. Plaintiffs incorporate by reference all preceding paragraphs as if fully set forth

16 herein.

17

166. DOJ’s SAR’s Standard is a legislative rule but was adopted without observing the

18 notice and comment procedure required under 5 U.S.C. § 553 (2012). Because DOJ’s SAR

19 Standard was adopted without observing the required notice and comment procedure,

20 Defendants’ actions described herein were and are also arbitrary, capricious, an abuse of

21 discretion, otherwise not in accordance with law, and without observance of procedure required

22 by law. Defendants’ actions should be set aside as unlawful pursuant to 5 U.S.C. § 706 (2012).

23

FOURTH CLAIM FOR RELIEF

24

Violation of APA by Defendants PM-ISE and Kshemendra Paul

for Issuance of a Legislative Rule Without Notice and Comment

25

5 U.S.C. §§ 553, 706(2)(A), (D)

26

167. Plaintiffs incorporate by reference all preceding paragraphs as if fully set forth

27 herein.

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

36 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 37 of 39

1

168. PM-ISE’s Functional Standard is a legislative rule but was adopted without

2 observing the notice and comment procedure required under 5 U.S.C. § 553 (2012). Because

3 PM-ISE’s Functional Standard was adopted without observing the required notice and comment

4 procedure, Defendants’ actions described herein were and are also arbitrary, capricious, an abuse

5 of discretion, otherwise not in accordance with law, and without observance of procedure

6 required by law. Defendants’ actions should be set aside as unlawful pursuant to 5 U.S.C. § 706

7 (2012).

8

PRAYER FOR RELIEF

9

WHEREFORE, Plaintiffs pray that the Court:

10

1. Enter a declaratory judgment that DOJ’s standard for SAR reporting, and any

11 successor standard for SAR reporting that adopts a standard lower than “reasonable suspicion,”

12 is invalid and issue a permanent injunction requiring Defendants DOJ and LORETTA LYNCH

13 to rescind DOJ’s SAR Standard and cease and desist from training participants in the NSI in

14 DOJ’s SAR Standard.

15

2. Enter a declaratory judgment that PM-ISE’s Functional Standard, and any

16 successor standard for SAR reporting that adopts a standard lower than “reasonable suspicion,”

17 is invalid and issue a permanent injunction requiring Defendants PM-ISE and KSHEMENDRA

18 PAUL to rescind the Functional Standard and cease and desist from training participants in the

19 NSI in the Functional Standard.

20

3. Enter a declaratory judgment that 28 CFR Part 23 sets forth the standard for SAR

21 reporting.

22

4. Enter a permanent injunction requiring Defendants to use 28 CFR Part 23 as the

23 standard for SAR reporting.

24

5. Award Plaintiffs their costs and expenses, including reasonable attorneys’ fees

25 and expert witness fees; and

26

6. Award such further and additional relief as is just and proper.

27 DATED: August 25, 2015

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

37 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 38 of 39

1

2

Respectfully submitted,

3

By:___________/s/ Linda Lye______________

4

Linda Lye

5

AMERICAN CIVIL LIBERTIES UNION

FOUNDATION OF NORTHERN CALIFORNIA

6

Linda Lye (SBN 215584)

llye@aclunc.org

7

Julia Harumi Mass (SBN 189649)

jmass@aclunc.org

8

39 Drumm Street

San Francisco, CA 94111

9

Telephone: 415-621-2493

Facsimile: 415-255-8437 10

ASIAN AMERICANS ADVANCING

11

JUSTICE - ASIAN LAW CAUCUS

Nasrina Bargzie (SBN 238917)

12

nasrinab@advancingjustice-alc.org

Yaman Salahi (SBN 288752)

13

yamans@advancingjustice-alc.org

55 Columbus Avenue

14

San Francisco, CA 94111

Telephone: 415-848-7711

15

Facsimile: 415-896-1702

16

MORGAN, LEWIS & BROCKIUS LLP

Stephen Scotch-Marmo (admitted pro hac vice)

17

stephen.scotch-marmo@morganlewis.com

Michael Abelson (admitted pro hac vice)

18

michael.abelson@morganlewis.com

101 Park Avenue,

19

New York, NY 10178

Tel: 212.309.6000

20

Fax: 212.309.6001

399 Park Avenue

21

New York, NY 10022

22

MORGAN, LEWIS & BROCKIUS LLP

Jeffrey Raskin (#169096)

23

jraskin@morganlewis.com

Nicole R. Sadler (#275333)

24

nsadler@morganlewis.com

Phillip Wiese (#291842)

25

pwiese@morganlewis.com

One Market Street, Spear Street Tower

26

San Francisco, CA 94105

Tel: 415.442.1000

27

Fax: 415.442.1001

28

AMERICAN CIVIL LIBERTIES UNION

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

38 Gill v. DOJ, CASE NO. 3:14-CV-03120

Case 3:14-cv-03120-RS Document 70 Filed 09/03/15 Page 39 of 39

FOUNDATION

1

Hina Shamsi (admitted pro hac vice)

hshamsi@aclu.org

2

Hugh Handeyside (admitted pro hac vice)

hhandeyside@aclu.org

3

125 Broad Street

New York, NY 10004

4

Telephone: 212‐549‐2500

Facsimile: 212-549-2654 5

AMERICAN CIVIL LIBERTIES UNION

6

FOUNDATION OF SAN DIEGO AND IMPERIAL

COUNTIES

7

Mitra Ebadolahi (SBN 275157)

mebadolahi@aclusandiego.org

8

P.O. Box 87131

San Diego, CA 92138

9

Telephone: (619) 232-2121

Facsimile: (619) 232-0036 10

AMERICAN CIVIL LIBERTIES UNION

11

FOUNDATION OF SOUTHERN CALIFORNIA

Peter Bibring (SBN 223981)

12

pbibring@aclusocal.org

1313 West 8th Street

13

Los Angeles, CA 90017

Telephone: (213) 977-9500

14

Facsimile: (213) 977-5299

15

Attorneys for Plaintiffs Wiley Gill, James Prigoff,

16

Tariq Razak, Khaled Ibrahim, and Aaron Conklin

17

18

19

20

21

22

23

24

25

26

27

28

FIRST SUPP. COMPL. FOR DEC. AND INJ. RELIEF (RS)

39 Gill v. DOJ, CASE NO. 3:14-CV-03120

 
 1

2

3

4

5

6

7

8

UNITED STATES DISTRICT COURT

9

NORTHERN DISTRICT OF CALIFORNIA

United States District Court Northern District of California

10
WILEY GILL, et al., 11
Plaintiffs, 12
v. 13
DEPARTMENT OF JUSTICE, et al., 14
Defendants. 15

Case No. 14-cv-03120-RS
ORDER ON CROSS MOTIONS FOR SUMMARY JUDGMENT

16

17

I. INTRODUCTION

18

This is a challenge brought under the Administrative Procedures Act (“APA”), to certain

19 aspects of the National Suspicious Activity Reporting Initiative (“NSI”), a nationwide program

20 that collects, vets, and disseminates intelligence with a possible nexus to terrorism. Plaintiffs

21 contend defendant Program Manager-Information Sharing Environment (“PM-ISE”) has adopted a

22 so-called “Functional Standard” that utilizes overly broad criteria to define the types of activities

23 deemed as having a potential nexus to terrorism. As a result, plaintiffs allege, state and local law

24 enforcement authorities submit “Suspicious Activity Reports” (“SARs”) to the federal government

25 even if unsupported by reasonable suspicion of criminal activity, and innocent Americans are

26 “wrongly branded as potential terrorists.”

27

Plaintiffs contend the Functional Standard conflicts with a duly-promulgated DOJ

28 regulation, 28 C.F.R. Part 23 (hereafter “Part 23”), which they assert was adopted to protect

1 constitutional and privacy rights by prohibiting the collection of “criminal intelligence” unless

2 supported by “reasonable suspicion.” The Functional Standard, in contrast, calls for sharing of

3 SARs whenever they reflect “observed behavior” that is “reasonably indicative of pre-operational

4 planning associated with terrorism or other criminal activity.” The crux of the controversy,

5 therefore, lies in the distinction between the “reasonably indicative” standard, and the “reasonable

6 suspicion” standard. Both sides agree that “reasonably indicative” is a lesser standard which calls

7 for dissemination of SARs even in the absence of “reasonable suspicion.” The question is whether

8 defendants failed to comply with the APA in adopting the “reasonably indicative” standard.

9

Plaintiffs contend defendants violated the APA in two ways. First, plaintiffs insist the

10 Functional Standard was adopted without complying with the APA’s requirement that the public

11 be provided a notice and comment period prior to adoption of “legislative rules.” While

United States District Court Northern District of California

12 defendants acknowledge no such notice and comment procedure was utilized, they argue that the

13 Functional Standard is not a “legislative rule” subject to the requirement, or that even if it were,

14 the violation was harmless because the Functional Standard was adopted through a collaborative

15 process that included public input. Second, plaintiffs contend adoption of the Functional Standard

16 was “arbitrary and capricious” because of the alleged conflict with Part 23. Defendants argue

17 there is no conflict that renders adoption of the Functional Standard improper.

18

The parties have brought cross-motions for summary judgment. Because defendants have

19 shown that adoption of the Functional Standard did not violate the APA, their motion will be

20 granted and plaintiffs’ motion will be denied.

21

22

II. BACKGROUND

23

As plaintiffs describe it, the NSI was created to facilitate the nationwide sharing of

24 information potentially related to terrorism. It is premised on the notion that while state, local, and

25 tribal law enforcement agents – so called “front line” personnel – are well situated to gather that

26 type of information, their reports should be vetted under uniform standards. DOJ and PM-ISE

27 have issued protocols relating to SAR reporting designed to provide such standards for evaluating

28

ORDER ON CROSS-MOTIONS FOR SUMMARY JUDGMENT

CASE NO. 14-cv-03120-RS

2

1 information collected by front line personnel before it is disseminated nationally. At the time of a

2 prior motion to dismiss in this action, the parties were disputing whether DOJ’s protocols and the

3 PM-ISE protocols were separate or not. Now, the parties appear to be in agreement that only the

4 one “Functional Standard” is at issue—and that it was first adopted in 2009, and revised in 2015.

5

The SAR process proceeds in three stages: collection of information by front line

6 personnel, vetting by trained analysts at “fusion centers,” and dissemination to law enforcement

7 nationwide. Front line personnel are allegedly trained in the Functional Standard, collect

8 information about people engaged in activities that purportedly have a potential nexus to terrorism,

9 and submit such information in the form of SARs, either directly to the Federal Bureau of

10 Investigation or to a fusion center.

11

Fusion centers, which are federally funded, gather, receive, store, analyze, and share

United States District Court Northern District of California

12 intelligence, including SARs, related to terrorism and other threats. Although the local collecting

13 agencies perform some vetting, the primary responsibility for doing so rests with fusion centers,

14 whose staff are trained in the Functional Standard and review SARs for compliance with that

15 standard. SARs meeting the standard are then disseminated both regionally through the fusion 16 center’s database, and nationally through a data base known as “eGuardian.”1 The FBI oversees

17 eGuardian, which allows law enforcement personnel across the country to access SARs that have

18 been uploaded to it. Plaintiffs allege that the federal government maintains SARs sent to

19 eGuardian for 30 years, even when the FBI has determined that a particular SAR has no nexus to 20 terrorism.2

21

22

23

24 1 There is some indication certain other databases may have been used in the past.
25 2 From materials attached as exhibits to the complaint, however, it appears that where no nexus to 26 potential terrorism can be validated, the SAR will not be made accessible through the ISE. Also,
the protocols appear to include some measures to address removing unfounded information. See 27 Complaint Exh. D, pp. 61-63; Exh. E, p. 93.

28

ORDER ON CROSS-MOTIONS FOR SUMMARY JUDGMENT

CASE NO. 14-cv-03120-RS

3

1

III. LEGAL STANDARD

2

Although the parties characterize their briefing as constituting cross-motions for “summary

3 judgment,” they recognize this is not an inquiry under Rule 56 of the Federal Rules of Civil

4 Procedure as to whether there are disputed factual issues for trial. Rather, this is the review on the

5 merits under the APA of the validity of the adoption of the Functional Standard. See, Klamath

6 Siskiyou Wildlands Ctr., 962 F. Supp. 2d at 1233; see also Sierra Club v. Mainella, 459 F. Supp.

7 2d 76, 89 (D.D.C. 2006) (“[T]he standard set forth in Rule 56(c) does not apply [in an APA case]

8 because of the limited role of a court in reviewing the administrative record.”); McCrary v.

9 Gutierrez, 495 F. Supp. 2d 1038, 1041 (N.D. Cal. 2007) (judicial review of agency action under

10 the APA limited to the administrative record).

11

“Under the APA, it is the role of the agency to resolve factual issues to arrive at a decision

United States District Court Northern District of California

12 that is supported by the administrative record, whereas ‘the function of the district court is to

13 determine whether or not as a matter of law the evidence in the administrative record permitted the 14 agency to make the decision it did.’” Sierra Club, 459 F.Supp. 2d at 90 (quoting Occidental Eng’g

15 Co. v. INS, 753 F.2d 766, 769–70 (9th Cir. 1985)). In other words, “the district court acts like an 16 appellate court, and the ‘entire case’ is ‘a question of law.’” Nat’l Law Ctr. on Homelessness & 17 Poverty v. U.S. Dep’t of Veterans Affairs, 842 F. Supp. 2d 127, 130 (D.D.C. 2012) (quoting Amer.

18 Bioscience, Inc. v. Thompson, 269 F.3d 1077, 1083 (D.C. Cir. 2001)). “Summary judgment thus

19 serves as the mechanism for deciding, as a matter of law, whether the agency action is supported

20 by the administrative record and otherwise consistent with the APA standard of review.”

21 Stuttering Found. of Am. v. Springer, 498 F. Supp. 2d 203, 207 (D.D.C. 2007).

22

23

IV. DISCUSSION

24

A. Notice and Comment

25

An agency may lawfully issue a so-called “legislative rule” only by using the notice and

26 comment procedure described in the APA, unless it publishes a specific finding of good cause

27 documenting why such procedures “are impracticable, unnecessary, or contrary to the public

28

ORDER ON CROSS-MOTIONS FOR SUMMARY JUDGMENT

CASE NO. 14-cv-03120-RS

4

1 interest.” 5 U.S.C. § 553(b), (b)(B). In contrast, an agency need not follow the notice and 2 comment procedure to issue an “interpretive rule.” § 553(b)(A). See Hemp Indus. Ass’n v. Drug

3 Enforcement Admin., 333 F.3d 1082, 1087 (9th Cir. 2003). Here, there is no dispute that the

4 Functional Standard was adopted without notice and comment, or a specific finding of good cause

5 that none was appropriate.

6

Courts have struggled with identifying the difference between

7

legislative rules and interpretive rules. In general terms, interpretive

rules merely explain, but do not add to, the substantive law that

8

already exists in the form of a statute or legislative rule. Yesler

Terrace Community Council v. Cisneros, 37 F.3d 442, 449 (9th

9

Cir.1994). Legislative rules, on the other hand, create rights, impose

obligations, or effect a change in existing law pursuant to authority

10

delegated by Congress. Id.

11

United States District Court Northern District of California

12 Hemp Indus., 333 F.3d at 1087.

13

Plaintiffs argue the Functional Standard is “legislative” because, they contend, no statute

14 sets forth a self-executing substantive standard governing the type of information that can be

15 collected, maintained, or disseminated. Plaintiffs explain the statutes operate instead to delegate

16 the authority for the promulgation of such standards to defendants, and that they have done so in

17 the Functional Standard. Defendants, in turn, point to the voluntary nature of the system as a

18 whole to argue the standard is not legislative in nature.

19

The Functional Standard does not fit neatly into either side of the dichotomy described in

20 Hemp Industries, above. It is not inarguably merely an “explanation” of other substantive law that

21 already existed “in the form of a statute or legislative rule.” Nor, however, is it plainly a rule that

22 “create[s] rights, impose[s] obligations, or effect[s] a change in existing law pursuant to authority

23 delegated by Congress.”

24

Rather, as defendants argue, it primarily describes an operating procedure—a policy, a

25 plan, a strategy—allowing cooperation and communication among various governmental actors.

26 At the motion to dismiss stage, defendants argued this “guidance” aspect of the standard meant it

27 was not a “final agency action” subject to judicial review. See Bennett v. Spear, 520 U.S. 154

28

ORDER ON CROSS-MOTIONS FOR SUMMARY JUDGMENT

CASE NO. 14-cv-03120-RS

5

1 (1997) (“First, the action must mark the ‘consummation’ of the agency’s decisionmaking

2 process—it must not be of a merely tentative or interlocutory nature. And second, the action must

3 be one by which ‘rights or obligations have been determined,’ or from which ‘legal consequences

4 will flow.’”) While there was and is no dispute that the Functional Standard was neither tentative

5 nor interlocutory, it far less clearly constitutes a rule determining legal rights and obligations.

6 Even though the order on the motion to dismiss called that question in plaintiff’s favor at the

7 pleading stage, there is good reason to treat the Functional Standard as not constituting a final

8 agency action within the meaning of Bennet v. Spear.

9

Even assuming, however, there was “final agency action,” it was fundamentally a policy

10 guidance statement not subject to a notice-and-comment requirement.

11

United States District Court Northern District of California

12

When a federal agency issues a directive concerning the future

exercise of its discretionary power, for purposes of APA section

13

553, its directive will constitute either a substantive rule, for which

notice-and-comment procedures are required, or a general statement

14

of policy, for which they are not . . . .

15

To the extent that the directive merely provides guidance to agency

officials in exercising their discretionary powers while preserving

16

their flexibility and their opportunity to make “individualized

determination [s],” it constitutes a general statement of policy. . . . 17

18 Mada-Luna v. Fitzpatrick, 813 F.2d 1006, 1013–14 (9th Cir. 1987).

19

20

Accordingly, defendants are entitled to summary judgment that adoption of the Functional

21 Standard without a notice-and-comment period did not violate the APA.3

22

23

24
25 3 As noted above, defendants also argue any failure to follow the notice and comment procedures of the APA was harmless in light of how the Functional Standard was adopted. Defendants insist
26 it was a collaborative process that included public input. It is subject to question, however, whether an agency could avoid any statutory notice and comment process by undertaking a more
27 informal procedure.

28

ORDER ON CROSS-MOTIONS FOR SUMMARY JUDGMENT

CASE NO. 14-cv-03120-RS

6

1

2

B. Arbitrary and capricious

3

Plaintiffs also seek to set aside the Functional Standard as arbitrary, capricious, an abuse of

4 discretion, or otherwise not in accordance with law.

5

The scope of review under the “arbitrary and capricious” standard is

6

narrow and a court is not to substitute its judgment for that of the

agency. Nevertheless, the agency must examine the relevant data

7

and articulate a satisfactory explanation for its action including a

rational connection between the facts found and the choice made . .

8

. . . In reviewing that explanation, [the court] must consider whether

the decision was based on a consideration of the relevant factors and

9

whether there has been a clear error of judgment . . . .

10

11 Motor Vehicle Mfrs. Ass’n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983) (citations

United States District Court Northern District of California

12 omitted).

13

As the Motor Vehicles court further explained:

14 15 16 17 18 Id.

Normally, an agency rule would be arbitrary and capricious if the agency has relied on factors which Congress has not intended it to consider, entirely failed to consider an important aspect of the problem, offered an explanation for its decision that runs counter to the evidence before the agency, or is so implausible that it could not be ascribed to a difference in view or the product of agency expertise.

19

Here, plaintiffs’ theory is that because the Functional Standard does not require SARs to be

20 based on a “reasonable suspicion,” it conflicts with Part 23’s requirement that criminal intelligence

21 not be collected or maintained unless supported by “reasonable suspicion.” The rules in Section 23

22 proceed from an “[o]perating principle[]” that a “project shall collect and maintain criminal

23 intelligence information concerning an individual only if there is reasonable suspicion that the

24 individual is involved in criminal conduct or activity and the information is relevant to that

25 criminal conduct or activity.” 28 C.F.R. § 23.20(a). There is no dispute that the Functional

26 Standard allows for collection and dissemination of SARs not meeting that test.

27

Defendants insist there is no conflict between the Functional Standard and Part 23 because,

28

ORDER ON CROSS-MOTIONS FOR SUMMARY JUDGMENT

CASE NO. 14-cv-03120-RS

7

1 they contend, the NSI is not a system for collecting “criminal intelligence.” They argue that the

2 Functional Standard and 28 C.F.R. Part 23 were issued pursuant to distinct statutory authorities for

3 application to different information gathering programs. Compare 42 U.S.C. § 3789g(c)

4 (authorizing OJP to issue policy standards for criminal intelligence systems funded under the

5 Omnibus Crime Control and Safe Streets Act of 1968 Pub. L. 90-351, 82 Stat. 197, codified at 42

6 U.S.C. §3711 et seq. (“Omnibus Act”) with 6 U.S.C. § 485(f)(2)(A)(iii) (authorizing the Program

7 Manager to issue functional standards for the ISE). Defendants note that the operating principles

8 of Part 23 are expressly linked to federal funding of criminal intelligence systems under the

9 Omnibus Act. See 42 U.S.C. § 3789g(c); 28 C.F.R. § 23.1; 28 C.F.R. § 23.3; 28 C.F.R. § 23.30; 28

10 C.F.R. § 23.40.

11

Plaintiffs correctly observe that the arguments defendants now make about the claimed

United States District Court Northern District of California

12 lack of Omnibus Act funding were not the basis on which the agency decided to adopt the

13 “reasonably indicative” standard in lieu of a “reasonable suspicion” standard. Plaintiffs also

14 rightly note that, generally, “an agency’s action must be upheld, if at all, on the basis articulated

15 by the agency itself,” Motor Vehicle, 463 U.S. at 50.

16

Nevertheless, plaintiffs have not shown that it was arbitrary and capricious for the

17 Functional Standard to depart from the “reasonable suspicion” standard of Part 23. The

18 administrative record includes the following description of why the “reasonably indicative”

19 standard was adopted:

20

The use of the “reasonably indicative” determination process allows

supervisors at source agencies and trained analysts and investigators

21

at fusion centers and other agencies to have a uniform process that

will result in better quality SARs and the posting of more reliable

22

ISEǦSARs to the ISE Shared Spaces, while at the same time

enhancing privacy, civil rights, and civil liberties protections.

23

Furthermore, this revision improves mission effectiveness and

enables NSI participating agency personnel to identify and address,

24

in a more efficient manner, potential criminal and terrorism threats

by using more narrowly targeted language. Finally, better quality

25

SARS should result in a sufficiently high quality of information

enabling agencies and analysts to “connect the dots” while not

26

producing so much information as to overwhelm agency analytical

capacity. In addition, the “reasonably indicative” determination is an

27

essential privacy, civil rights, and civil liberties protection because it

28

ORDER ON CROSS-MOTIONS FOR SUMMARY JUDGMENT

CASE NO. 14-cv-03120-RS

8

emphasizes a behaviorǦfocused approach to identifying suspicious

1

activity and mitigates the risk of profiling based upon race,

ethnicity, national origin, or religious affiliation or activity. 2

3

Plaintiffs insist the record also shows defendants were “aware of the need” to address Part

4 23, because it was raised during discussion of the Functional Standard. Plaintiffs’ argument,

5 however, presupposes that SARs are “criminal intelligence” governed under Part 23. Defendants

6 have shown that to the contrary, the Functional Standard was developed to address data collection

7 and dissemination issues not already within the scope of Part 23. While they certainly could have

8 adopted the same standard, the record reveals no “clear error of judgment” or “failure to consider

9 an important aspect of the problem” or such a counter-factual or implausible explanation as to 10 permit the court to substitute its judgment of what a better rule might be.4 Accordingly,

11 defendants are entitled to summary judgment that adoption of the Functional Standard did not

United States District Court Northern District of California

12 violate the APA as arbitrary and capricious.

13

14

C. Motion to strike

15

In connection with their argument that Part 23 applies only to systems funded under the

16 Omnibus Act, defendants have offered a declaration of Marilynn B. Atsatt to show that the FBI

17 eGuardian and the “NSI SAR Data Repository” are not funded under the Omnibus Act.

18 Defendants also proffer a declaration from Basil N. Harris describing the adoption and amendment

19 of the Functional Standard, including the public input that allegedly was solicited and considered.

20

Defendants have consistently sought to enforce the principle that, with narrow exceptions,

21 APA actions are decided on the administrative record and nothing more. In extended proceedings

22 before the assigned magistrate judge, and in objections to her rulings, defendants resisted attempts

23 to expand that record. Defendants also successfully resisted plaintiffs’ requests to be allowed

24 discovery. In light of that discovery history, plaintiffs’ motion to strike these declarations is

25
26 4 Plaintiffs have offered policy arguments as to why, in their view, the “reasonably indicative” standard draws a poor balance between individual rights and public safety. In an action under the
27 APA, however, something more must be shown.

28

ORDER ON CROSS-MOTIONS FOR SUMMARY JUDGMENT

CASE NO. 14-cv-03120-RS

9

1 granted. 5

2

3

V. CONCLUSION

4

Defendants’ motion is granted, and plaintiffs’ motion is denied. A separate judgment will

5 issue.

6

7

8 IT IS SO ORDERED.

9

10 Dated: March 27, 2017

United States District Court Northern District of California

11

______________________________________

12

RICHARD SEEBORG United States District Judge

13

14

15

16

17

18

19

20

21

22

23

24

25
26 5 Plaintiffs’ motion to supplement the record under the exception for extra-record evidence related to standing is denied as moot. Defendants’ challenge to plaintiffs’ standing was rejected at
27 the motion to dismiss stage, and was not renewed on summary judgment.

28

ORDER ON CROSS-MOTIONS FOR SUMMARY JUDGMENT

CASE NO. 14-cv-03120-RS

10

 
 1

2

3

4

5

6

7

UNITED STATES DISTRICT COURT

8

NORTHERN DISTRICT OF CALIFORNIA

9
WILEY GILL, et al., 10
Plaintiffs, 11
v. 12
DEPARTMENT OF JUSTICE, et al., 13
Defendants. 14

Case No. 14-cv-03120-RS
ORDER DENYING MOTION TO DISMISS

United States District Court Northern District of California

15

16

I. INTRODUCTION

17

In this action brought under the Administrative Procedures Act (“APA”), plaintiffs

18 challenge certain aspects of the National Suspicious Activity Reporting Initiative (“NSI”), a

19 nationwide program that collects, vets, and disseminates intelligence with a possible nexus to

20 terrorism. Plaintiffs contend that defendants Department of Justice (“DOJ”) and the Program

21 Manager-Information Sharing Environment (“PM-ISE”) have issued protocols utilizing an overly

22 broad standard to define the types of activities that should be deemed as having a potential nexus

23 to terrorism. As a result, plaintiffs allege, state and local law enforcement authorities submit

24 “Suspicious Activity Reports” (“SARs”) to the federal government even if unsupported by

25 reasonable suspicion of criminal activity, and innocent Americans are “wrongly branded as

26 potential terrorists.”

27

Plaintiffs contend that the protocols they are challenging conflict with a duly

28 promulgated DOJ regulation, 28 C.F.R. Part 23, which they assert was adopted to protect

1 constitutional and privacy rights by prohibiting the collection of criminal intelligence unless

2 supported by reasonable suspicion. In their four-count complaint, plaintiffs assert that each of the

3 two challenged protocols, (1) violates the APA’s requirement that the public be provided a notice

4 and comment period prior to adoption of “legislative rules,” and/or, (2) is invalid as “arbitrary and

5 capricious,” in light of the alleged conflict with 28 C.F.R. Part 23.

6

Defendants move to dismiss, contending plaintiffs lack standing, and have not stated viable

7 APA claims in any event. Alternatively, defendants challenge venue. The motion will be denied,

8 for reasons explained below.

9

10

II. BACKGROUND

11

As plaintiffs describe it, the NSI was created to facilitate the nationwide sharing of

United States District Court Northern District of California

12 information potentially related to terrorism. It is premised on the notion that while state, local, and

13 tribal law enforcement agents – so called “front line” personnel – are well situated to gather that

14 type of information, their reports should be vetted under uniform standards. DOJ and PM-ISE

15 have each issued protocols relating to SAR reporting designed to provide such standards for

16 evaluating information collected by front line personnel before it is disseminated nationally.

17

DOJ’s protocols, which plaintiffs refer to as the “DOJ SAR Standard,” appear in several

18 documents, including one entitled “eGuardian 2008 Privacy Impact Assessment.” The

19 PM-ISE protocols appear in a document entitled “Information Sharing Environment (ISE) –

20 Functional Standard (FS) – Suspicious Activity Reporting (SAR) Version 1.5.”

21 (hereinafter “Functional Standard 1.5”). Defendants contend there is only one standard—

22 Functional Standard 1.5—and that the DOJ protocols conform thereto and do not represent a set of

23 rules that could be separately challenged. Plaintiffs object that defendants’ position contradicts

24 the allegations of the complaint and certain evidence. For purposes of the present motion,

25 however, neither party contends there is any significance to the dispute over whether there is one

26 set of protocols or two. For convenience, the challenged protocols will hereinafter be referred to

27 as “Defendants’ Standards” without any determination as to whether the so-called DOJ SAR

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

2

1 Standard is separate from Functional Standard 1.5 or not.

2

According to the allegations of the complaint, the SAR process proceeds in three stages:

3 collection by front line personnel, vetting by trained analysts at “fusion centers,” and

4 dissemination to law enforcement nationwide. Front line personnel are allegedly trained in

5 Defendants’ Standards, collect information about people engaged in activities that purportedly

6 have a potential nexus to terrorism, and submit the information in the form of SARs, either

7 directly to the Federal Bureau of Investigation or to a fusion center.

8

Fusion centers, which are federally funded, gather, receive, store, analyze, and share

9 intelligence, including SARs, related to terrorism and other threats. Although the local collecting

10 agencies perform some vetting, the primary responsibility for doing so rests with fusion centers,

11 whose staff are trained in Defendants’ Standards and review SARs for compliance with those

United States District Court Northern District of California

12 Standards.

13

SARs that meet Defendants’ Standards are then disseminated both regionally through the

14 fusion center’s database, and nationally through a data base known as “eGuardian” and/or another 15 national database.1 The FBI oversees eGuardian, which allows law enforcement personnel across

16 the country to access the SARs that have been uploaded to it. Plaintiffs expressly allege that the

17 federal government maintains SARs sent to eGuardian for 30 years, even when the FBI has 18 determined that a particular SAR has no nexus to terrorism.2

19

Each of the four plaintiffs knows or believes that he is the subject of an SAR, or in the case

20 of one plaintiff, a report similar to an SAR. Plaintiff Wiley Gill, a U.S. citizen and graduate of

21

22 1 Defendants contend that eGuardian is presently the only such database system in use, and 23 request judicial notice of materials found on certain government websites to establish that fact.
While judicial notice would not be an appropriate mechanism to resolve this factual issue at the 24 pleading stage or otherwise, the dispute is not material to the issues presented, as the result would
be the same regardless of the number of databases presently in use.
25 2 From materials attached as exhibits to the complaint, however, it appears that where no nexus to 26 potential terrorism can be validated, the SAR will not be made accessible through the ISE. Also,
the protocols appear to include some measures to address removing unfounded information. See 27 Complaint Exh. D, pp. 61. 63; Exh. E, p. 93.

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

3

1 California State University, Chico, converted to Islam after learning about the religion in a class.

2 In 2012, the Chico Police Department conducted a warrantless search of his home for reasons

3 allegedly later acknowledged to be unfounded. The police reported the encounter and two earlier

4 interactions with Gill in an SAR. The SAR notes that Gill “is unemployed” and states that he had

5 “potential access to flight simulators via the internet,” because his computer displayed a webpage

6 titled something “similar to ‘Games that fly under the radar.’” The complaint asserts that Gill, a

7 video game enthusiast, was likely viewing a website about video games. The SAR concludes by

8 describing as “worthy of note” Gill’s “full conversion to Islam as a young WMA [white, male

9 adult]” and his “pious demeanor.”

10

Plaintiff Khaled Ibrahim, a U.S. citizen of Egyptian descent who works in accounting, is

11 the subject of an SAR describing his attempt to purchase “a large amount of computers.” At the

United States District Court Northern District of California

12 time, Ibrahim, worked as a purchasing agent, and was seeking to make a bulk purchase of

13 computers for his employer.

14

Plaintiff Aaron Conklin, believes he is the subject of an SAR. Conklin is a graphic design

15 student and amateur photographer with an interest in industrial architecture. He has twice been

16 prevented from photographing oil refineries. In one incident at the Shell refinery in Martinez,

17 California, he was questioned by private security, and then detained and searched by Contra Costa

18 Sheriff’s deputies, who told him he had to be placed on an “NSA watch list.”

19

Finally, James Prigoff is a U.S. citizen and renowned photographer of public art, who

20 believes he is the subject of an “SAR or SAR-like report.” While attempting to photograph a

21 famous piece of public art on a natural gas storage tank near Boston, he allegedly was harassed by

22 private guards, who prevented him from photographing the tank from his preferred location.

23 Although he provided the guards no identifying information, the FBI purportedly then tracked him 24 cross-country, visited his home in Sacramento, and questioned a neighbor about him.3

25

26 3 Because the incident involving Prigoff predated adoption of Defendants’ Standards, they contend those standards cannot have caused his alleged injury, and, in a footnote, contend his claims are

27 time-barred in any event. Even assuming the timing issues could ultimately undermine Prigoff’s claims, defendants have not shown that his separate dismissal from the action is warranted at this

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

4

1

III. LEGAL STANDARD

2

A complaint must contain “a short and plain statement of the claim showing that the

3 pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2). While “detailed factual allegations are not

4 required,” a complaint must have sufficient factual allegations to “state a claim to relief that is

5 plausible on its face.” Ashcroft v. Iqbal, 566 U.S. 652, 678 (2009) (citing Bell Atlantic v. Twombly,

6 550 U.S. 544, 570 (2007)). A claim is facially plausible “when the pleaded factual content allows

7 the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”

8 Id. This standard asks for “more than a sheer possibility that a defendant acted unlawfully.” Id.

9 The determination is a context-specific task requiring the court “to draw in its judicial experience

10 and common sense.” Id. at 1950.

11

A motion to dismiss a complaint under Rule 12(b)(6) of the Federal Rules of Civil

United States District Court Northern District of California

12 Procedure tests the legal sufficiency of the claims alleged in the complaint. See Parks Sch. of

13 Bus., Inc. v. Symington, 51 F.3d 1480, 1484 (9th Cir. 1995). Dismissal under Rule 12(b)(6) may

14 be based on either the “lack of a cognizable legal theory” or on “the absence of sufficient facts

15 alleged under a cognizable legal theory.” Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699

16 (9th Cir. 1990).

17

Defendants also invoke Rule 12(b)(1), arguing that plaintiffs’ purported lack of standing

18 deprives the Court of subject matter jurisdiction. A motion to dismiss for lack of subject matter

19 jurisdiction may be made on the grounds that the lack of jurisdiction appears from the “face of the

20 complaint,” or may be based on extrinsic evidence apart from the pleadings. Warren v. Fox

21 Family Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003); McMorgan & Co. v. First Cal.

22 Mortgage Co., 916 F. Supp. 966, 973 (N.D. Cal. 1995). Where the jurisdictional issue is whether

23 the plaintiff has standing, dismissal is also appropriate under Rule 12(b)(6) absent sufficient

24 factual allegations in the complaint, which, if proven, would confer standing. Sacks v. Office of

25 Foreign Assets Control, 466 F.3d 764, 771 (9th Cir. 2006).

26 27 juncture.

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

5

1

Defendants’ venue challenge is brought under Rule 12(b)(3), which states that a party may

2 move to dismiss a case for “improper venue.” The question of whether venue is “wrong” or

3 “improper” is generally governed by 28 U.S.C. § 1391. That provision states that “[e]xcept as
4 otherwise provided by law . . . this section shall govern the venue of all civil actions brought in
5 district courts of the United States.” § 1391(a)(1). It further provides that “[a] civil action may be
6 brought in—(1) a judicial district in which any defendant resides, if all defendants are residents of
7 the State in which the district is located; (2) a judicial district in which a substantial part of the
8 events or omissions giving rise to the claim occurred, or a substantial part of property that is the subject of the action is situated; or (3) if there is no district in which an action may otherwise be
9 brought as provided in this section, any judicial district in which any defendant is subject to the
10 court’s personal jurisdiction with respect to such action.” § 1391(b). When venue is challenged,
11 the court must determine whether the case falls within one of the three categories set out in §
12 1391(b). If it does, venue is proper; if it does not, venue is improper, and the case must be
13 dismissed or transferred under § 1406(a).
14

United States District Court Northern District of California

15

16 III. DISCUSSION
17 A. Standing
18 “To satisfy Article III’s standing requirements, a plaintiff must show (1) she has suffered
19 an ‘injury in fact’ that is (a) concrete and particularized and (b) actual or imminent, not conjectural
20 or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3)
21 it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable
22 decision.” Bernhardt v. Cnty. of Los Angeles, 279 F.3d 862, 868–69 (9th Cir. 2002) (quoting
23 Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180–81 (2000)).
24 Defendants primarily frame their challenge to plaintiffs’ standing as a purported failure to
25 allege facts showing causation and redressability. Defendants’ argument characterizes plaintiffs’
26 supposed injuries as arising, if at all, primarily from the actions of the “front line” state and local
27

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

6

1 law enforcement authorities. Defendants contend plaintiffs have not alleged, and credibly cannot,

2 that the scrutiny they purportedly received from state and local police, or even from private

3 security personnel, was the result of the challenged protocols or other conduct of defendants.

4

The allegations of the complaint, however, show that the gravamen of the alleged injuries

5 lie not in actions of “front line” authorities standing alone, but in the fact that those authorities,

6 pursuant to the guidance and training provided by defendants, submit SAR reports under criteria

7 and circumstances that are allegedly inconsistent with legal principles and policies embodied in

8 other law. Plaintiffs’ cognizable challenge is not to the conduct of law enforcement or private

9 security officers during the alleged encounters per se, although there is at least some implication

10 that plaintiffs believe Defendants’ Standards lead front line personnel to overreach even at the

11 point of making initial observations. Plaintiffs are claiming injury from what occurs after the

United States District Court Northern District of California

12 encounters, pursuant to the Standards.

13

As such, defendants’ contentions as to causality and redressability both fail. The harms

14 plaintiffs seek to remedy arise directly from the existence of Defendants’ Standards. If plaintiffs

15 can show those standards violate the APA, they will be declared invalid.

16

While invoking causality and redressability as the main purported shortcomings of

17 plaintiffs’ standing, defendants also imply that merely being the subject of an SAR, in the national

18 database, should not be deemed a cognizable injury. In light of the privacy and reputational

19 interests involved, however, this argument is not tenable. See Meese v. Keene, 481 U.S. 465, 474-

20 75 (1987) (plaintiff had standing to challenge statute labeling films he exhibited as “political

21 propaganda” because of “risk of injury to his reputation”); Joint Anti-Fascist Refugee Comm. v.

22 McGrath, 341 U.S. 123, 131, 140-41 (1951) (organizations had “clear” standing to challenge 23 loyalty oath based on injury, inter alia, to “reputation”). 4 Accordingly, the motion to dismiss for

24 lack of standing must be denied.

25
26 4 Defendants suggest that because SARs are not disseminated to the general public, plaintiffs suffer no reputational injury. In light of the alleged wide distribution and availability of the
27 information, however, this argument is not persuasive.

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

7

1

2

B. Alternative remedies

3

Defendants further argue that Plaintiffs’ APA claims are barred because Plaintiffs have

4 adequate alternative remedies, in that they theoretically could sue the individual local agencies or

5 private guards that collected SARs about them. This argument similarly misconstrues the nature

6 of plaintiffs’ claims. The challenge is to the system itself, not to the acts of the “front line”

7 personnel. While plaintiffs may indeed believe that those officials and private actors overstepped

8 their bounds in at least some of the instances (e.g., Conklin contends the security guards had no

9 right to interfere with his taking photographs on public property), the primary issue is the

10 collection and dissemination of SARs through national databases under standards that plaintiffs

11 contend are not appropriate. A suit against local agencies or security guards cannot change

United States District Court Northern District of California

12 Defendants’ Standards. Indeed, local and private defendants likely would have a defense against

13 any claim that their preparation and transmission of SARs is wrongful, when undertaken pursuant

14 to those standards. Accordingly, the APA claims are not subject to dismissal on grounds that

15 plaintiffs have adequate remedies elsewhere.

16

17

C. Finality of agency action

18

Claims under the APA lie only against “final” agency actions. In Bennett v. Spear, 520

19 U.S. 154 (1997), the Supreme Court set out the legal standard for agency action to be considered

20 final: 21 22 23

First, the action must mark the “consummation” of the agency’s decisionmaking process—it must not be of a merely tentative or interlocutory nature. And second, the action must be one by which “rights or obligations have been determined,” or from which “legal consequences will flow.”

24 Id. at 177-78 (citations omitted). Defendants concede the first prong, but challenge the second,

25 asserting that Functional Standard 1.5 does not impose a “binding legal norm,” but merely

26 provides “functional guidance for the operation of the NSI” and that NSI participants are not

27 “require[d]” to follow this guidance.

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

8

1

It may be that Defendants’ Standards do not mandate any state or local law

2 enforcement agency participate in the NSI and share SARs meeting those standards. There is no

3 dispute, however, that if a state or local law enforcement agency does participate in the NSI and

4 submits SARs, it is to do so consistent with the Defendants’ Standards. As such, those standards

5 “alter the legal regime” and have “direct and appreciable legal consequences,” such that the

6 second prong of the finality requirement is satisfied. Bennett, 520 U.S. at 178.

7

8

D. Arbitrary and Capricious

9

Plaintiffs’ first and second claims for relief seek to set aside the DOJ SAR Standard and

10 Functional Standard 1.5, respectively, as “arbitrary, capricious, an abuse of discretion, otherwise

11 not in accordance with law.” Plaintiffs’ theory is that because Defendants’ Standards do not

United States District Court Northern District of California

12 require SARs to be based on a “reasonable suspicion” standard, they conflict with 28 C.F.R. Part

13 23’s requirement that criminal intelligence not be collected or maintained unless supported by

14 “reasonable suspicion.”

15

The rules in that section proceed from an “[o]perating principle[]” that a “project shall

16 collect and maintain criminal intelligence information concerning an individual only if there is

17 reasonable suspicion that the individual is involved in criminal conduct or activity and the

18 information is relevant to that criminal conduct or activity.” 28 C.F.R. § 23.20(a). There is no

19 dispute that Defendants’ Standards allow for collection and dissemination of SARs not meeting

20 that test.

21

Defendants insist there is no conflict between the Standards and Part 23 because, they

22 contend, the NSI is not a system for collecting “criminal intelligence.” They argue that the

23 Functional Standard and 28 C.F.R. Part 23 were issued pursuant to distinct statutory authorities for

24 application to different information gathering programs. Compare 42 U.S.C. § 3789g(c)

25 (authorizing OJP to issue policy standards for criminal intelligence systems funded under the

26 Omnibus Act) with 6 U.S.C. § 485(f)(2)(A)(iii) (authorizing the Program Manager to issue

27 functional standards for the ISE). They note that the operating principles of 28 C.F.R. Part 23 are

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

9

1 expressly linked to federal funding of criminal intelligence systems under the Omnibus Act. See

2 42 U.S.C. § 3789g(c); 28 C.F.R. § 23.1; 28 C.F.R. § 23.3; 28 C.F.R. § 23.30; 28 C.F.R. § 23.40.

3

As plaintiffs point out, however, whether or not ISE is appropriately characterized as a

4 criminal intelligence system within the scope of Part 23 may depend on factual issues not

5 appropriately resolved at the motion to dismiss stage. It may be that the question of whether

6 Defendants’ Standards are subject to being set aside as “arbitrary, capricious, an abuse of

7 discretion, otherwise not in accordance with law” will ultimately turn primarily on legal issues.

8 The question is certainly the heart of this case. At this juncture, however, defendants have not

9 shown the declaratory relief claims should be dismissed, as opposed to adjudicated on the merits.

10

11

E. Notice and comment

United States District Court Northern District of California

12

Plaintiffs’ third and fourth claims for relief seek determinations that the DOJ SAR

13 Standard and Functional Standard 1.5, respectively, are invalid because they were adopted without

14 notice and comment. An agency can issue a legislative rule only by using the notice and comment

15 procedure described in the APA, unless it publishes a specific finding of good cause documenting

16 why such procedures “are impracticable, unnecessary, or contrary to the public interest.” 5 U.S.C.

17 § 553(b), (b)(B). In contrast, an agency need not follow the notice and comment procedure to

18 issue an interpretive rule. § 553(b)(A). See Hemp Indus. Ass’n v. Drug Enforcement Admin., 333

19 F.3d 1082, 1087 (9th Cir. 2003). There is no dispute that the Standards were adopted without

20 notice and comment, or a specific finding of good cause that none was appropriate.

21

Courts have struggled with identifying the difference between

22

legislative rules and interpretive rules. In general terms, interpretive

rules merely explain, but do not add to, the substantive law that

23

already exists in the form of a statute or legislative rule. Yesler

Terrace Community Council v. Cisneros, 37 F.3d 442, 449 (9th

24

Cir.1994). Legislative rules, on the other hand, create rights, impose

obligations, or effect a change in existing law pursuant to authority

25

delegated by Congress. Id.

26

27 Hemp Indus., 333 F.3d at 1087.

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

10

1

Plaintiffs contend Defendants’ Standards are “legislative” because no statute sets forth “a

2 self-executing substantive standard governing the type of information that can be collected,

3 maintained, or disseminated.” Plaintiffs contend the statutes instead delegate the authority to

4 promulgate such standards to defendants, and that they have done so in Functional Standard 1.5.

5 Defendants, in turn, point to the voluntary nature of the system as a whole to argue the standards

6 are not legislative in nature.

7

This issue also goes to the heart of plaintiffs’ case for declaratory relief. The proper

8 characterization of Defendants’ Standards as legislative or interpretative likely will involve few

9 disputed factual issues, and perhaps can be resolved on cross-motions for summary judgment. At

10 this juncture, however, plaintiffs have sufficiently identified potential grounds for treating the

11 standards as legislative to avoid dismissal. Whether those arguments will prevail on a more

United States District Court Northern District of California

12 fulsome record remains to be seen.

13

14

F. Venue

15

Finally, defendants contend that at a minimum, the claims of all plaintiffs other than

16 Ibrahim should be severed and dismissed because they arose outside this district.5 This argument

17 relies on the same mischaracterization of the claims discussed above. Plaintiffs are not

18 challenging the circumstances of their individual encounters with authorities per se, but the

19 underlying federal scheme.

20

Parties may be permissively joined where their claims arise “out of the same transaction,

21 occurrence, or series of transactions or occurrences,” and there is a common “question of law or

22 fact.” Fed. R. Civ. P. 20(a)(1). This rule “is to be construed liberally in order to promote trial

23 convenience and to expedite the final determination of disputes, thereby preventing multiple

24 lawsuits.” League to Save Lake Tahoe v. Tahoe Reg’l Planning Agency, 558 F.2d 914, 917 (9th

25
26 5 It is unclear why defendants believe Conklin’s claims arose outside this district given that in one of the alleged events underlying those claims he was photographing a refinery in Contra Costa
27 County.

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

11

1 Cir. 1977). Challenges to a governmental policy or system generally satisfy the same transaction

2 or occurrence requirement. See United States v. Mississippi, 380 U.S. 128, 142-43 (1965); see also

3 Turner v. LaFond, No. C 09–00683 MHP, 2009 WL 3400987, at *3 (N.D. Cal Oct. 20, 2009)

4 (“Typically this requirement will be met where plaintiffs collectively challenge a widely-held

5 practice or policy.”) Accordingly, the venue objection is not tenable.

6

7

V. CONCLUSION

8

9

The motion to dismiss is denied. The parties shall appear for a further case management

10 conference on March 12, 2015, with an updated joint case management conference statement to be 11 filed one week in advance.

United States District Court Northern District of California

12 13 IT IS SO ORDERED.

14 Dated: February 20, 2015
15
16
17

______________________________________
RICHARD SEEBORG United States District Judge

18

19

20

21

22

23

24

25

26

27

28

ORDER DENYING MOTION TO DISMISS

CASE NO. 14-cv-03120-RS

12

 
 CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege11ofo1f 919

FOR PUBLICATION
UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT

WILEY GILL; JAMES PRIGOFF; TARIQ RAZAK; KHALED IBRAHIM; AARON CONKLIN,
Plaintiffs-Appellants,
v.
UNITED STATES DEPARTMENT OF JUSTICE; MATTHEW WHITAKER, Acting Attorney General; PROGRAM MANAGER INFORMATION SHARING ENVIRONMENT; THE OFFICE OF THE PROGRAM MANAGER OF THE INFORMATION SHARING ENVIRONMENT,
Defendants-Appellees.

No. 17-16107 D.C. No.
3:14-cv-03120-RS
OPINION

Appeal from the United States District Court for the Northern District of California
Richard Seeborg, District Judge, Presiding
Argued and Submitted October 18, 2018 San Francisco, California
Filed January 29, 2019

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege22ofo1f 919

2

GILL V. USDOJ

Before: MILAN D. SMITH, JR. and ANDREW D. HURWITZ, Circuit Judges, and RICHARD K. EATON,*
Judge.

Opinion by Judge Milan D. Smith, Jr.

SUMMARY**

Administrative Procedure Act
The panel affirmed the district court’s summary judgment in favor of federal defendants in an action under the Administrative Procedure Act (“APA”) challenging the Functional Standard regarding the sharing of terrorismrelated information.
In the wake of 9/11, the federal government sought to standardize the sharing of terrorism-related information through the adoption of a Functional Standard. Plaintiffs are United States citizens who are the subjects of a Suspicious Activity Report (SAR) or Information Sharing Environment (ISE)-SAR, none of whom have been charged with a crime.
The panel held that the Functional Standard constituted final agency action because it had legal and practical effects.

* Richard K. Eaton, Judge of the United States Court of International Trade, sitting by designation.
** This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege33ofo1f 919

GILL V. USDOJ

3

The panel held that the Functional Standard was exempt from the APA’s notice and comment requirement because the significant discretion retained by agencies and their analysts in determining whether to disseminate information demonstrated that the Functional Standard was not a legislative rule. Legislative rules have the force of law, and are subject to notice and comment under the APA before becoming effective.

Plaintiffs argued that the Functional Standard was arbitrary and capricious under the APA because it was inconsistent with the “reasonable suspicion” standard for disseminating criminal intelligence information in 28 C.F.R. Part 23. The panel held that the Department of Justice’s decision to exclude SARs from Part 23 was not contrary to the record, and was consistent with the stated objectives of the Nationwide Suspicious Activity Reporting Initiative. The panel concluded that the Functional Standard was not arbitrary and capricious under the APA.

COUNSEL
Linda Lye (argued) and Julia Harumi, American Civil Liberties Union Foundation of Northern California Inc., San Francisco, California; Michael James Ableson and Stephen Scotch-Marmo, Morgan, Lewis & Bockius LLP, New York, New York; Christina Sinha, Asian Americans Advancing Justice—Asian Law Caucus, San Francisco, California; Hugh Handeyside, American Civil Liberties Union Foundation, New York, New York; Mitra Ebadolahi, American Civil Liberties Union Foundation of San Diego and Imperial Counties, San Diego, California; Jeffrey S. Raskin, Morgan Lewis & Bockius LLP, San Francisco, California; Peter Bibring, American Civil Liberties Union

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege44ofo1f 919

4

GILL V. USDOJ

Foundation of Southern California, Los Angeles, California; for Plaintiffs-Appellants.

Daniel Aguilar (argued) and H. Thomas Byron III, Appellate Staff; Alex G. Tse, Acting United States Attorney; Civil Division, United States Department of Justice, Washington, D.C.; for Defendants-Appellees.

OPINION
M. SMITH, Circuit Judge:
In the wake of 9/11, law enforcement agencies at the federal, state, and local levels found that they were unable to communicate effectively about potential threats to our national security. In response, the federal government sought to standardize the sharing of terrorism-related information through the adoption of a “Functional Standard.” Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, and Tariq Razak (collectively, Plaintiffs) challenged the Functional Standard under the Administrative Procedure Act (APA).1 The district court granted summary judgment in favor of the federal defendants.
We affirm. Although the Functional Standard constitutes final agency action, it was not required to undergo the APA notice and comment procedure, nor was it arbitrary and capricious.

1 Plaintiffs raised only an APA challenge and do not contend that the Functional Standard is unconstitutional or has been applied to them in an unconstitutional manner.

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege55ofo1f 919

GILL V. USDOJ

5

FACTUAL AND PROCEDURAL BACKGROUND
I. Factual Background
In October 2007, President George W. Bush issued a National Strategy for Information Sharing concerning terrorism-related information. The Strategy created fusion centers that would ensure Suspicious Activity Reports (SARs) were “disseminated to and evaluated by appropriate government authorities,” and identify requirements to support a “unified process for reporting, tracking, and accessing” SARs. The nationwide effort to standardize this information sharing was called the Nationwide Suspicious Activity Reporting Initiative (NSI).
To “govern[] how terrorism information is acquired, accessed, shared, and used,” the Program Manager for the Information Sharing Environment (ISE) has issued three Functional Standards since the inception of the NSI, each superseding the previous one: Functional Standard 1.0 (issued January 2008), Functional Standard 1.5 (issued May 2009), and Functional Standard 1.5.5 (issued February 2015).2 The current Functional Standard 1.5.5 focuses “exclusively on terrorism-related information.”

2 The Program Manager sought input from various civil liberties groups throughout the process of refining the Functional Standards. After promulgating Standard 1.0, the Program Manager hosted a conference with advocates from the American Civil Liberties Union (ACLU) and other privacy and civil liberties groups. The ACLU noted its concerns with the overbroad behavioral categories and the Standard’s definition of a suspicious activity, suggesting a “reasonably indicative” standard. The ACLU also recommended that certain information should not be reported absent reasonable suspicion of criminality.

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege66ofo1f 919

6

GILL V. USDOJ

The Functional Standard defines suspicious activity as “[o]bserved behavior reasonably indicative of preoperational planning associated with terrorism or other criminal activity.” After receiving a report of suspicious activity, an officer creates a SAR. The SAR then undergoes a two-part evaluation process. An analyst determines whether the SAR meets certain behavioral criteria and has a potential nexus to terrorism.3 If the analyst concludes that it does, the SAR becomes an ISE-SAR, and is uploaded to the eGuardian repository, where it is available to all NSI participants. The ISE-SAR is also input into the Federal Bureau of Investigation (FBI) classified system and sent to the Department of Homeland Security Office of Intelligence Analysis.
Plaintiffs are United States citizens who are the subjects of a SAR or ISE-SAR, none of whom has been charged with a crime. The ISE-SAR on Gill notes his potential access to a “flight simulator type of game,” his conversion to Islam, and his “pious demeanor.” The FBI visited Gill’s sister and questioned her about Gill’s religious beliefs. Another SAR describes Razak as a male of believed Middle Eastern descent who “meticulously stud[ied] the entry/exit points”

After the ISE issued Functional Standard 1.5, the Program Manager re-engaged with the ACLU to obtain their feedback on a draft privacy and civil liberties report. The ACLU again recommended that information meet the reasonably indicative standard before dissemination. In May 2013, the ISE held another conference with civil liberties groups, including the ACLU, to discuss Functional Standard 1.5.5.
3 The behavioral categories include both defined criminal activity, such as “Breach/Attempted Intrusion,” “Misrepresentation,” and “Cyberattack,” along with other activity, such as “Photography,” “Acquisition of Expertise,” and “Weapons Collection/Discovery.”

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege77ofo1f 919

GILL V. USDOJ

7

of a train station. After the SAR was uploaded to eGuardian, the FBI questioned Razak. The SAR concerning Ibrahim notes his attempt to purchase “a large amount of computers.” Two reports concerning Ibrahim were uploaded to eGuardian.
Private guards prevented Prigoff, a professional photographer, from taking photographs of a work of public art near Boston, an incident resulting in the creation of multiple SARs. The FBI then visited Prigoff’s home and questioned a neighbor about him. In northern California, private security stopped Conklin, an amateur photographer, from photographing oil refineries, and during the subsequent questioning, the sheriff’s deputies told him he would be placed on an “NSA watch list.”
II. Procedural Background
In 2014, Plaintiffs sued the Attorney General, the Department of Justice, and the ISE Program Manager (collectively, the Department). The complaint asserted two APA challenges to the Functional Standard, contending that: (1) the promulgation of the Functional Standard without notice and comment was unlawful; and (2) the Standard was arbitrary and capricious because it did not comply with the “reasonable suspicion” standard in 28 C.F.R. Part 23 for the dissemination of criminal intelligence information.4
The Department moved to dismiss, arguing that Plaintiffs lacked standing, and that the Functional Standard

4 At the onset of this lawsuit, only Functional Standard 1.5 was at issue. Version 1.5.5 was not promulgated until February 2015. At the summary judgment stage, Plaintiffs challenged both versions.

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege88ofo1f 919

8

GILL V. USDOJ

did not constitute final agency action pursuant to the APA. The district court denied the Department’s motion.
The parties later cross-moved for summary judgment. The district court granted summary judgment for the Department, finding that: (1) the Functional Standard is a policy guidance statement exempt from the notice and comment requirement; and (2) the Functional Standard is not arbitrary and capricious because it addresses data issues outside the scope of 28 C.F.R. Part 23. Plaintiffs timely appealed.

JURISDICTION AND STANDARD OF REVIEW
We have jurisdiction pursuant to 28 U.S.C. § 1291. We review de novo a district court’s grant of summary judgment, and we may affirm on any ground supported by the record. White v. City of Sparks, 500 F.3d 953, 955 (9th Cir. 2007).
ANALYSIS
I. Final Agency Action
The APA allows judicial review only of final agency actions. 5 U.S.C. § 704; see Ukiah Valley Med. Ctr. v. FTC, 911 F.2d 261, 266 (9th Cir. 1990). Although it denied the Department’s motion to dismiss for lack of finality, the district court observed in its summary judgment order that there was “good reason to treat the Functional Standard as not constituting a final agency action.” We review de novo whether agency action is final. Havasupai Tribe v. Provencio, 906 F.3d 1155, 1161–62 (9th Cir. 2018).
For agency action to be final, it must “mark the consummation of the agency’s decisionmaking process” and “must be one by which rights or obligations have been

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege99ofo1f 919

GILL V. USDOJ

9

determined, or from which legal consequences will flow.” Bennett v. Spear, 520 U.S. 154, 177–78 (1997) (internal quotation marks omitted). “We focus on the practical and legal effects of the agency action” and interpret finality in a “pragmatic and flexible manner.” Or. Nat. Desert Ass’n v. U.S. Forest Serv., 465 F.3d 977, 982 (9th Cir. 2006); see also Indus. Customers of Nw. Utils. v. Bonneville Power Admin., 408 F.3d 638, 646 (9th Cir. 2005) (considering any “direct and immediate effect on the day-to-day operations of the party seeking review,” and if “immediate compliance with the [action’s] terms is expected”). Regardless of an agency’s characterization, we consider the actual effects of the action to determine whether it is final. Columbia Riverkeeper v. U.S. Coast Guard, 761 F.3d 1084, 1094–95 (9th Cir. 2014).
The Department does not dispute that the first finality requirement—consummation of the decisionmaking process—is met. Instead, it concentrates on the second Bennett prong, contending the Functional Standard “merely provides procedural guidelines for [agencies’] voluntary participation” and does not impose binding obligations. Plaintiffs counter that the Functional Standard has legal force because the Department can revoke an agency’s eGuardian membership for violating the terms of the eGuardian User Agreement, which requires compliance with the Standard. Plaintiffs also assert that compliance with the Functional Standard is a practical requirement of the NSI, and that this “condition on participation” renders the Functional Standard final. We agree; the Functional Standard constitutes final agency action because it has legal and practical effects.
The Functional Standard imposes “direct and appreciable legal consequences.” Bennett, 520 U.S. at 178. In Oregon Natural Desert, we held the Forest Service’s

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege1010ofo1f 919

10

GILL V. USDOJ

issuance of annual operating instructions (AOIs) to permittees grazing livestock on national forest land constituted final agency action under the APA. 465 F.3d at 979. The AOIs outlined restrictions on the permit holder’s right to graze. Id. at 980, 986. If a permittee did not comply with the directives in the AOI, the Forest Service could issue a notice of non-compliance and impose administrative sanctions, such as suspension or cancellation of the permit, against the permit holder. Id. at 987–88. We held that the AOIs had legal consequences because the Forest Service could take enforcement actions against a non-complying permittee, imposing “substantial and intricate legal obligations.” Id. at 988, 990.
The Functional Standard is not materially distinguishable. To be sure, participation in the NSI remains within the agencies’ discretion. And, absent that participation, the Functional Standard does not obligate analysts or agencies to send SAR information or penalize them for sending non-compliant SARs. But, as the Department conceded below, once an agency decides to participate, the eGuardian User Agreement permits the Department to revoke agency membership for violating various policies, including the Functional Standard. Like the suspension of permits in Oregon Natural Desert, 465 F.3d at 988, eGuardian membership revocation is a legal consequence.
The Functional Standard is also final agency action because of its practical effects. In Havasupai, we held a Forest Service Mineral Report was a “practical requirement to the continued operation” of a mine—and therefore final agency action—because the parties “understood that mine operations would not resume until” the Mineral Report’s determination of valid existing rights “was completed.”

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege1111ofo1f 919

GILL V. USDOJ

11

906 F.3d at 1163. An agency action can be final even if its legal or practical effects are contingent on a future event. See Bennett, 520 U.S. at 170 (noting an agency could “technically” disregard the issued opinion, but to do so would subject it or its employees to “substantial civil and criminal penalties, including imprisonment”); City of Fremont v. F.E.R.C., 336 F.3d 910, 914 (9th Cir. 2003) (concluding agency orders that attach legal consequences to future proceedings satisfy the finality analysis).
Similarly, because the eGuardian User Agreement permits the Department to revoke participating agencies’ access for failure to comply with the Functional Standard, once an agency joined the NSI there was the immediate understanding that its analysts would conform to the Functional Standard when submitting SARs. Thus, we hold the Functional Standard constitutes final agency action.
II. Notice and Comment Procedure
The APA requires a notice and comment procedure for agency “rule making.”5 5 U.S.C. § 553. However, “interpretive rules, general statements of policy, or rules of agency organization, procedure, or practice” are exempt from the notice and comment requirement. 5 U.S.C. § 553(b)(3)(A). The district court found the Functional Standard was “fundamentally a policy guidance statement” and therefore not subject to the notice and comment requirement. We review de novo the district court’s determination of the scope of the APA’s notice and comment

5 The APA defines “rule making” as “agency process for formulating, amending, or repealing a rule.” 5 U.S.C. § 551(5).

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege1212ofo1f 919

12

GILL V. USDOJ

requirement. Mada-Luna v. Fitzpatrick, 813 F.2d 1006, 1011 (9th Cir. 1987).
Legislative rules have the “force of law,” and are subject to notice and comment under the APA before becoming effective Hemp Indus. Ass’n v. Drug Enf’t Admin., 333 F.3d 1082, 1087–88 (9th Cir. 2003). Policy guidance statements, on the other hand, “do not have the force and effect of law and are not accorded that weight in the adjudicatory process,” see Shalala v. Guernsey Mem’l Hosp., 514 U.S. 87, 99 (1995), and need not undergo notice and comment. “The critical factor to determine whether a directive announcing a new policy constitutes a legislative rule or a general statement of policy ‘is the extent to which the challenged [directive] leaves the agency, or its implementing official, free to exercise discretion to follow, or not to follow, the [announced] policy in an individual case.’” Colwell v. Dep’t of Health & Human Servs., 558 F.3d 1112, 1124 (9th Cir. 2009) (second and third alterations in original) (quoting Mada-Luna, 813 F.2d at 1013). That a policy “provid[es] direction—where once there was none”—does not automatically transform it into a legislative rule. Prof’ls & Patients for Customized Care v. Shalala, 56 F.3d 592, 600– 01 (5th Cir. 1995).
Plaintiffs contend the Functional Standard is a legislative rule because it creates a “binding norm” by establishing sixteen exclusive categories the agencies must use in defining suspicious activity. The Department responds that the Functional Standard is not a legislative rule because it provides only standardized guidance that does not have any legal effect. Although we “need not accept the agency characterization at face value,” Hemp Indus., 333 F.3d at 1087, we agree with the Department that the Functional

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege1313ofo1f 919

GILL V. USDOJ

13

Standard is not a legislative rule because it allows analysts to exercise discretion.
SARs undergo a two-part evaluation before being included in eGuardian. First, an FBI or fusion center analyst “reviews” the SAR information against the sixteen preoperational behaviors identified in the Functional Standard, “keeping in mind . . . the importance of context, facts, and circumstances.” If the SAR information reflects one or more of the pre-operational behaviors, then, based on the “context, facts, and circumstances,” the analyst uses “professional judgment” to determine whether the information has a potential nexus to terrorism. Only if—in the analyst’s judgment—a potential nexus to terrorism exists is the SAR disseminated as an ISE-SAR.
While the Functional Standard employs a combination of mandatory and discretionary language, it does not compel analysts or agencies to disseminate SAR information, nor does it require analysts to create an ISE-SAR when the information reflects a certain number of behavioral categories. Rather, if the SAR contains at least one of the categorized activities, the analyst must still ascertain whether it has a potential nexus to terrorism. No single category of behavior or aggregation of categories is determinative.
The Functional Standard is thus similar to the Food & Drug Administration’s policy guide at issue in Professionals and Patients for Customized Care. The FDA promulgated a policy utilizing nine factors to help the agency determine whether to initiate an enforcement action against a pharmacy engaged in drug manufacturing. 56 F.3d at 593. In holding that the policy did not constitute a legislative rule, the Fifth Circuit noted that although the nine factors “assist[ed] the FDA in identifying pharmacies engaged in the manufacture

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege1414ofo1f 919

14

GILL V. USDOJ

of drugs,” the “ultimate decision whether to bring an enforcement action” remained with the agency. Id. at 601. Likewise, the Functional Standard aids agencies in determining whether an individual is engaged in suspicious activity, but the final decision to disseminate an SAR rests in the analyst’s discretion.
This significant discretion retained by agencies and their analysts in determining whether to disseminate information compels our decision that the Functional Standard is not a legislative rule. Therefore, the Functional Standard was exempt from the notice and comment requirement.
III. Arbitrary and Capricious
Agency action violates the APA if it is arbitrary or capricious. 5 U.S.C. § 706(2)(A). Plaintiffs argue that the Functional Standard is arbitrary and capricious because it is inconsistent with the “reasonable suspicion” standard for disseminating criminal intelligence information in 28 C.F.R. Part 23 (Part 23). On summary judgment, the district court rejected that argument. We review the district court’s decision de novo. Nat’l Ass’n of Home Builders v. Norton, 340 F.3d 835, 840–41 (9th Cir. 2003).
Pursuant to Part 23, criminal intelligence systems can retain criminal intelligence information “only if there is reasonable suspicion that the individual is involved in criminal conduct or activity.” 28 C.F.R. § 23.20(a) (emphasis added). Part 23 defines criminal intelligence information, in pertinent part, as “data which has been evaluated to determine that it: (i) is relevant to the identification of and the criminal activity engaged in by an individual who or organization which is reasonably suspected of involvement in criminal activity.” Id. § 23.3(b)(3). The Functional Standard, in contrast, defines

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege1515ofo1f 919

GILL V. USDOJ

15

suspicious activity as “[o]bserved behavior reasonably indicative of pre-operational planning associated with terrorism or other criminal activity.” (emphasis added). Consequently, some SARs—including those related to Plaintiffs—do not reach the reasonable suspicion standard that Part 23 requires for criminal intelligence.
Plaintiffs’ arbitrary and capricious challenge is twofold. They contend that: (1) the Department initially failed to consider the applicability of Part 23; and (2) the rationale eventually offered for why Part 23 does not apply contradicts the record.
Several principles guide our analysis. An agency must “examine the relevant data and articulate a satisfactory explanation for its action including a ‘rational connection between the facts found and the choice made.’” Motor Vehicle Mfrs. Ass’n of U.S., Inc. v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983) (quoting Burlington Truck Lines, Inc. v. United States, 371 U.S. 156, 168 (1962)). A rule is arbitrary and capricious if the agency has “entirely failed to consider an important aspect of the problem, [or] offered an explanation for its decision that runs counter to the evidence before the agency.” Id. Our review of an agency decision “is based on the administrative record and the basis for the agency’s decision must come from the record.” Norton, 340 F.3d at 841. That review is “narrow;” we may not “substitute [our] judgment for that of the agency.” FCC v. Fox Television Stations, Inc., 556 U.S. 502, 513 (2009). And, we will “uphold a decision of less than ideal clarity if the agency’s path may reasonably be discerned.” Motor Vehicle, 463 U.S. at 43.
First, Plaintiffs challenge the ISE’s July 2010 explanation concerning Functional Standard 1.5’s use of the “reasonably indicative” standard as a post-hoc

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege1616ofo1f 919

16

GILL V. USDOJ

rationalization. But, Functional Standard 1.5.5, promulgated in February 2015, superseded version 1.5. The Executive Summary for version 1.5.5 provided a detailed explanation for why SAR information need not comply with Part 23 and the reasonable suspicion standard. Thus, Plaintiffs’ argument concerning the Department’s 2010 explanation for Functional Standard 1.5 is moot.
Second, Plaintiffs argue that the ISE’s 2015 explanation is inconsistent with Functional Standard 1.5.5. The 2015 explanation states that SAR information “represents information about suspicious behavior” and “has a potential criminal nexus.” In contrast, it asserts that criminal intelligence “focuses on the investigative stage once a tip or lead has been received and on identifying the specific criminal subject(s), the criminal activity in which they are engaged, and the evaluation of facts to determine that the reasonable suspicion standard has been met.” Succinctly, according to the 2015 explanation, criminal intelligence is “a product of investigation.”
The Department asserts that its interpretation of Part 23 is entitled to Auer deference, which requires an agency’s interpretation of its own ambiguous regulation to control unless “plainly erroneous or inconsistent with the regulation.” Turtle Island Restoration Network v. U.S. Dep’t of Commerce, 878 F.3d 725, 733 (9th Cir. 2017) (quoting Auer v. Robbins, 519 U.S. 452, 461 (1997)). “But Auer deference is warranted only when the language of the regulation is ambiguous.” Christensen v. Harris Cty., 529 U.S. 576, 588 (2000). If the language of a “regulation is unambiguous, we apply the terms as written.” Christopher v. SmithKline Beecham Corp., 635 F.3d 383, 392 (9th Cir. 2011). The Department identifies no ambiguity in Part 23, and we find none. Thus, we independently

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege1717ofo1f 919

GILL V. USDOJ

17

determine whether the ISE’s decision to exclude the Functional Standard from Part 23’s scope is consistent with the regulation.
Plaintiffs focus on the one sentence in the Department’s explanation of Functional Standard 1.5.5, which states that Part 23 “[c]riminal intelligence information is a product of investigation.” They argue that SARs are also criminal intelligence subject to the reasonable suspicion standard of Part 23 because an official conducts “initial investigation or fact gathering” before creating a SAR. That narrow focus distorts the ISE’s explanation.
As originally conceived in October 2007, SARs involved “tips and leads” information, that is, an “uncorroborated report or information that alleges or indicates some form of possible criminal activity.” Tips and leads required only “mere suspicion,” a lower standard than the reasonable suspicion required for criminal intelligence data. In response to concerns regarding Functional Standard 1.0, version 1.5 implemented a somewhat stricter standard— “reasonably indicative”—albeit one still less demanding than the reasonable suspicion standard. Given the lower reasonably indicative standard utilized by the Functional Standard, some SARs do not rise to the level of criminal intelligence. This lower threshold underscores the purpose of ISE-SARs disseminated in accordance with Functional Standard 1.5.5: to determine whether to engage in “followup information gathering” about potential terrorist activity, not necessarily to determine whether a crime has occurred.
The distinction between criminal intelligence and SAR information is admittedly not always precise. The ISE Program Manager early on recognized the potential for SARs to contain criminal intelligence subject to Part 23. Thus, the ISE’s Initial Privacy and Civil Liberties Analysis

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege1818ofo1f 919

18

GILL V. USDOJ

of September 2008 stated, “agencies should clearly articulate when 28 C.F.R. Part 23 should be applied . . . . ISE-SAR information . . . may be subject to the requirements of 28 C.F.R. Part 23.” Further, an investigating officer “gathers additional facts through personal observations, interviews, and other investigative activities before creating a SAR, suggesting that the “product of investigation” phrase is not dispositive of whether SAR information comes within the ambit of Part 23.
“We will . . . uphold a decision of less than ideal clarity if the agency’s path may reasonably be discerned.” Motor Vehicle, 463 U.S. at 43. From the outset, the ISE has consistently pronounced that an ISE-SAR need not meet the reasonable suspicion standard in order to expand the base of information gathered. The 2015 explanation, published with Functional Standard 1.5.5, also makes clear that the government intentionally seeks more than reports showing a reasonable suspicion that terrorism-related crimes have occurred. Considering the entirety of the 2015 rationale and the historical explanations before us, we find the Department’s decision to exclude SARs from Part 23 is not contrary to the record, and is consistent with the stated objectives of the NSI. Accordingly, we hold that the Functional Standard was not arbitrary and capricious.
CONCLUSION
The Functional Standard endeavors to standardize terrorism-related information sharing nationwide. Although the Functional Standard constituted final agency action, it was not a legislative rule because it requires significant analyst discretion. It therefore was exempt from the notice and comment requirement. And, the Standard was not arbitrary and capricious because the ISE’s 2015 explanation distinguishing Part 23 information and SARs is consistent

CCaassee:31:71-41-6c1v-0073,10210/2-R9S/201D9o,cIuDm: 1e1n1t 17309323F,ilDekdtE02n/t0ry7:/5109-1P, Pagaege1919ofo1f 919

GILL V. USDOJ

19

with the ISE’s objectives. We affirm the judgment of the district court.
AFFIRMED.

 
 Lawsuit Challenges Government’s ‘Suspicious Activity Report’ Program | American Civil Liberties Union

JOIN »

RENEW »


 SEARCH
Go

BECAUSE FREEDOM CAN'T PROTECT ITSELF
KEY ISSUES ACTION STORIES ABOUT US DONATE

HOME › NATIONAL SECURITY

Lawsuit Challenges Government’s ‘Suspicious Activity Report’ Program
Share
FBI Created Counterterrorism Files for Plaintiffs’ Innocuous Activities
July 10, 2014
FOR IMMEDIATE RELEASE 
CONTACT: media@aclu.org
SAN FRANCISCO – Civil rights groups filed a lawsuit today challenging the legality of the federal government’s controversial Suspicious Activity Reporting (SAR) program. The lawsuit, filed by the American Civil Liberties Union of California, the national ACLU, and Asian Americans Advancing Justice-Asian Law Caucus, was brought on behalf of five Americans who had their information entered into law enforcement databases for innocent things like taking pictures, buying computers, or standing in a train station, and were then subjected to investigation.
“This domestic surveillance program wrongly targets First Amendment-protected activities, encourages racial and religious profiling, and violates federal law,” said Linda Lye, staff attorney with the ACLU of Northern California. “The Justice Department’s own rules say that there should be reasonable suspicion before creating a record on someone, but the government’s instructions to local police are that they should write up SARs even if there’s no valid reason to suspect a person of doing anything wrong.”
A Justice Department regulation dating to 1978 prohibits the collection and dissemination of “criminal intelligence information” unless there is “reasonable suspicion” of criminal activity. However, the Justice Department’s standard for SARs doesn’t require reasonable suspicion of wrongdoing, only behavior that “may be indicative” of terrorism planning “or other illicit intention.”
The plaintiffs in the lawsuit have learned that such a low bar can cover virtually anything. James Prigoff is an 86-year-old renowned photographer of public art who has lectured at numerous universities and had his work exhibited at the Smithsonian and other museums around the world. In 2004, he was in Boston taking pictures of a famous piece of public art called the Rainbow Swash, which is painted on a natural gas storage tank. Private security guards told him to stop. Several months later, the FBI went to Prigoff’s home in Sacramento to question him about his activities in Boston and also contacted at least one neighbor about him – a clear indication that a report identifying him as a suspicious person with a potential connection to terrorism had been written and distributed nationwide.
“All I was doing was taking pictures in a public place, and now I’m apparently in a government terrorism database for decades,” said Prigoff. “This is supposed to be a free country, where the government isn’t supposed to be tracking you if you’re not doing anything wrong. I lived through the McCarthy era, and I know how false accusations, surveillance, and keeping files on innocent people can destroy careers and lives. I am deeply troubled that the SAR program may be recreating that same climate of false accusation and fear today.”

BLOG OF RIGHTS
RELATED POSTS
Suing to Defend Americans' Right to Take Pictures in Public
What’s the Government Doing Targeting Civil Rights Leaders?
Dear Privacy Board: It’s Us, the 95%
See All Posts
TRENDING TOPICS
NSA Government Surveillance Universal Human Rights FISA Amendments Act Supreme Court FISA Birth Control Coverage Birth Control Court Cases Domestic Drones Overincarceration
See All Topics
FEATURES
States Where They Think We’re Stupid: Abortion Access Under Attack in 2013
Time to Rein in the Surveillance State
Billions of Dollars Wasted on Racially Biased Arrests
See All »
TAKE
»
ACTION
President Obama:

SIGN UP
Get breaking news on issues you care about
E-MAIL ADDRESS
FOLLOW US
FACEBOOK
TWITTER
BLOG of RIGHTS
EMAIL
NEWSFEED
We Need to End Dragnet NSA Surveillance
TAKE ACTION

FIND YOUR
LOCAL ACLU AFFILIATE

SSeelelectct

Go

CAMPAIGNS
Defending Targets of Discrimination
Smart Justice, Fair Justice
Keep America Safe and Free
Protecting Civil Liberties In The Digital Age
Organization News and Highlights
Spy Files
Real ID

https://www.aclu.org/national-security/lawsuit-challenges-governments-suspicious-activity-report-program[7/10/2014 11:25:34 PM]

Lawsuit Challenges Government’s ‘Suspicious Activity Report’ Program | American Civil Liberties Union
Another plaintiff, Wiley Gill, was the subject of a 2012 SAR that was obtained by the ACLU of California through a Public Records Act request. He was identified as a “Suspicious Male Subject in Possession of Flight Simulator Game.” At the time, he was likely looking at websites on his computer about video games. The SAR identifies Gill as “worthy of note” because he converted to Islam and has a “pious demeanor.”
The SAR was submitted to one of the nation’s 78 “fusion centers,” which are operated by state and local government agencies and are meant to collect and analyze threat-related information. If an analyst believes that a report meets the SAR program’s standards, he or she uploads it to one or more national databases, where it can remain for up to 30 years. In the case of Gill, the SAR was forwarded to the FBI, which then opened a file on him.
“The only reason that someone deemed Mr. Gill ‘suspicious’ is because he is a devout Muslim, not because he has done anything wrong,” said Asian Americans Advancing Justice-Asian Law Caucus attorney Nasrina Bargzie. “With such a lax standard it’s not surprising that the result is religious profiling of this nature. Racial and religious profiling of Arab, Middle Eastern, Muslim and South Asian communities needs to stop.”
Last year, a U.S. Government Accountability Office investigation found that the SAR program had failed to demonstrate any arrests, convictions, or thwarted threats, even though tens of thousands of SARs have been uploaded to government databases. In 2012, a bipartisan Senate subcommittee report found that fusion centers have not identified a single terrorist threat, and that similar intelligence reporting “potentially endangered the civil liberties or legal privacy protections of the U.S. persons they mentioned.”
“The SAR program is an intrusion into the privacy of citizens and is unwarranted,” said Jonathan Loeb, co-lead counsel in the lawsuit and a partner at Bingham McCutchen. “Furthermore, the program was implemented without the appropriate notice and opportunity for the public to comment.”
No changes to the SAR program have been made since the GAO and Senate reports were issued, despite repeated calls from a coalition of civil rights and other organizations.
Today’s complaint is at: aclu.org/national-security/gill-v-doj-complaint
Detailed descriptions of the plaintiff’s experiences are at: aclu.org/files/assets/sar_complaint.pdf#page=21
Almost two thousand Suspicious Activity Reports obtained by the ACLU of California and released in 2013 are at: aclu.org/blog/national-security-technology-and-liberty/government-spying-youaclu-releases-new-evidence
Gill v. DOJ – Challenge to Government's Suspicious Activity Reporting Program

Grant Edward Snowden Immunity Now

LEGISLATIVE
SCORECARD
SUPREME COURT
LEARNMORE

RELATED LINKS
Cases Letters Reports ACLU Centers Press Releases Miscellaneous

OUR HISTORY

INFOGRAPHICS

VIDEO PHOTOS

ACLU History: Defending Liberty in Times of National Crisis
More History

Grounded: Life on the No Fly List
Launch More InfoGraphics

The NSA knew our secrets. One year later, we know theirs.
Watch Video More Videos

https://www.aclu.org/national-security/lawsuit-challenges-governments-suspicious-activity-report-program[7/10/2014 11:25:34 PM]

Lawsuit Challenges Government’s ‘Suspicious Activity Report’ Program | American Civil Liberties Union

NEVER MISS AN ACTION THAT'S IMPORTANT TO YOU.
Sign up for the ACLU Action newsletter.

HELP GUARANTEE FREEDOM FOR ALL.
Chip in to help protect all of our rights and liberties.

E-mail address

Sign Up >

CAPITAL PUNISHMENT Clemency Effective Counsel Execution Methods Innocence and the Death Penalty Junk Science and Capital Punishment Mental Illness and the Death Penalty Race and the Death Penalty
CRIMINAL LAW REFORM Drug Sentencing and Penalties Drug Testing Health-Based Solutions Marijuana Law Reform Police Practices Race and Criminal Justice Search and Seizure Juvenile Justice
DISABILITY RIGHTS Criminal Justice Education Integration and Autonomy
FREE SPEECH Campaign Finance Reform Censorship Flag Desecration Internet Censorship Right to Protest Student Speech

HIV / AIDS Criminal Justice and HIV HIV/AIDS Discrimination Prevention and Education Testing and Privacy
HUMAN RIGHTS Children's Rights Death Penalty Immigrants' Rights National Security Racial Justice Women's Rights
IMMIGRANTS' RIGHTS State Anti-Immigrant Laws Local Anti-Immigrant Laws Immigration Detention Immigration Enforcement

LGBT RIGHTS LGBT Basic Rights and Liberties LGBT Parenting LGBT Relationships LGBT Youth & Schools Discrimination Against Transgender People
NATIONAL SECURITY Detention Discrimination Dissent Ideological Exclusion Secrecy Spy Files Surveillance & Privacy Targeted Killings Torture
PRISONERS' RIGHTS Immigration Detention Medical Care in Prison Mental Health Care in Prison Prison Conditions Private Prisons Restriction of Prisoners' Rights Women in Prison Solitary Confinement

RACIAL JUSTICE Affirmative Action Criminal Justice Education Indigent Defense Juvenile Justice Racial Profiling
RELIGION & BELIEF Free Exercise of Religion Government-Funded Religion Religion and Schools The Public Square
REPRODUCTIVE FREEDOM Abortion Birth Control Pregnancy Religion and Reproductive Rights Sex Education

TECHNOLOGY AND LIBERTY Biological Technologies Consumer Privacy Internet Free Speech Internet Privacy Medical Privacy Students Workplace Privacy
VOTING RIGHTS Voter Suppression Promoting Access Voting Rights Act Redistricting
WOMEN'S RIGHTS Criminal Justice Education Employment Human Rights Violence Against Women

SITE MAP: 
Key Issues 
Features 
Action Center 
Blog 
Press Room 
Local Affiliate Finder 
About the ACLU 
Legislative 
In the Courts 
Our History 
 Video 
Podcasts 
Photos 
All Multimedia 
E-mail Sign-up 
Donate 


User Agreement 
Privacy Statement 
Contact Us 
Accessibility

© ACLU, 125 Broad Street, 18th Floor, New York NY 10004 
This is the website of the American Civil Liberties Union and the ACLU Foundation. Learn more about these two components of the ACLU.

The ACLU earns a 4-star rating from Charity Navigator and meets
the highest standards of the Better Business Bureau's Wise
Giving Alliance.

https://www.aclu.org/national-security/lawsuit-challenges-governments-suspicious-activity-report-program[7/10/2014 11:25:34 PM]

 
 Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 1 of 22
ADRMOP,CASREF,CLOSED,REFDIS
U.S. District Court California Northern District (San Francisco) CIVIL DOCKET FOR CASE #: 3:14−cv−03120−RS

Gill et al v. Department of Justice et al Assigned to: Hon. Richard Seeborg Referred to: Magistrate Judge Kandis A. Westmore Case in other court: 17−16107 Cause: 05:702 Administrative Procedure Act
Plaintiff

Date Filed: 07/10/2014 Date Terminated: 03/29/2017 Jury Demand: None Nature of Suit: 899 Other Statutes: Administrative Procedures Act/Review or Appeal of Agency Decision Jurisdiction: U.S. Government Defendant

Wiley Gill

represented by Jeffrey Scott Raskin Morgan Lewis and Bockius One Market, Spear Street Tower San Francisco, CA 94105 415−442−1000 Fax: 415−442−1001 Email: jraskin@morganlewis.com LEAD ATTORNEY ATTORNEY TO BE NOTICED

Jonathan Alan Loeb Blank Rome LLP 2029 Century Park East 6th Floor Santa Monica, CA 90067 424−239−3422 Fax: 424−239−3443 Email: jloeb@blankrome.com TERMINATED: 10/27/2015 LEAD ATTORNEY ATTORNEY TO BE NOTICED

Christina Sinha Asian Americans Advancing Justice − Asian Law Caucus 55 Columbus Avenue San Francisco, CA 94111 (415) 896−1701 Fax: (415) 896−1702 Email: christinas@advancingjustice−alc.org ATTORNEY TO BE NOTICED

Edward A Andrews Bingham McCutchen LLP The Water Garden, Suite 2050 North 1601 Cloverfield Boulevard 1620 26th St 4th Fl Santa Monica, CA 90404−4082 310−907−1000 Fax: (310) 907−2000 ATTORNEY TO BE NOTICED

Hina Shamsi American Civil Liberties Union Foundation 125 Broad Street, 18th Floor New York, NY 10004 212−549−2500 Fax: (212) 549−2654 Email: hshamsi@aclu.org

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 2 of 22
ATTORNEY TO BE NOTICED
Hugh Handeyside American Civil Liberties Union Foundation 125 Broad Street New York, NY 10004 212−549−2500 Fax: (212) 549−2654 Email: hhandeyside@aclu.org ATTORNEY TO BE NOTICED
Jeffrey Rosenfeld Blank Rome 2029 Century Park East 6th Floor Los Angeles, CA 90067 424−239−3417 Fax: 424−239−3807 Email: jrosenfeld@blankrome.com TERMINATED: 10/27/2015 ATTORNEY TO BE NOTICED
John David Loy ACLU of San Diego P.O. Box 87131 San Diego, CA 92138−7131 (619) 232−2121 x230 Email: davidloy@aclusandiego.org ATTORNEY TO BE NOTICED
Julia Harumi Mass American Civil Liberties Union of Northern California, Inc. 39 Drumm Street San Francisco, CA 94111 415−621−2493 Fax: 415−255−8437 Email: jmass@aclunc.org TERMINATED: 02/11/2019
Linda Lye ACLU Foundation of Northern California, Inc. 39 Drumm Street San Francisco, CA 94111 (415) 621−2493 Fax: (415) 255−8437 Email: lye.linda@gmail.com TERMINATED: 02/11/2019
Michael James Ableson Morgan, Lewis & Bockius LLP 101 Park Avenue New York, NY 10178 (212) 309−6113 Fax: (212) 309−6001 Email: michael.ableson@morganlewis.com ATTORNEY TO BE NOTICED
Mitra Ebadolahi ACLU Foundation of San Diego and Imperial Counties P.O. Box 87131 San Diego, CA 92138 619−232−2121

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 3 of 22
Fax: 619−232−0036 Email: mebadolahi@aclusandiego.org ATTORNEY TO BE NOTICED
Nasrina Bargzie Boies Schiller Flexner LLP 44 Montgomery Street 41st Floor San Francisco, CA 94104 4152936800 Email: nbargzie@bsfllp.com TERMINATED: 05/26/2016 ATTORNEY TO BE NOTICED
Nicole Robins Sadler Morgan Lewis Bockius LLP One Market Spear Street Tower San Francisco, CA 94105 415−442−1373 Fax: 415−442−1001 Email: nsadler@morganlewis.com TERMINATED: 04/27/2016
Peter Bibring ACLU Foundation of Southern California 1313 West 8th Street Los Angeles, CA 90017 213−977−9500 Fax: 213−977−5299 Email: pbibring@aclusocal.org ATTORNEY TO BE NOTICED
Phillip Jared Wiese Morgan, Lewis and Bockius LLP One Market, Spear Street Tower San Francisco, CA 94105 (415) 442−1483 Fax: (415) 442−1001 Email: pwiese@morganlewis.com ATTORNEY TO BE NOTICED
Shilpi Agarwal ACLU Foundation of Northern California 39 Drumm Street San Francisco, CA 94111 (415) 621−2493 Fax: (415) 255−1478 Email: sagarwal@aclunc.org ATTORNEY TO BE NOTICED
Stephen Scotch−Marmo Morgan, Lewis & Bockius LLP 101 Park Avenue New York, NY 10178 (212) 309−6167 Fax: (212) 309−6001 Email: stephen.scotch−marmo@morganlewis.com ATTORNEY TO BE NOTICED
Winifred Virginia Kao Asian Law Caucus 55 Columbus Avenue San Francisco, CA 94111 415−896−1701

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 4 of 22

Plaintiff James Prigoff

Fax: 415−896−1702 Email: winifredk@advancingjustice−alc.org ATTORNEY TO BE NOTICED
Yaman Salahi Asian American Advancing Justice−Asian Law Caucus 55 Columbus Avenue San Francisco, CA 94610 415−848−7711 Fax: (415) 896−1702 Email: yamans@advancingjustice−alc.org TERMINATED: 01/20/2016
represented by Jeffrey Scott Raskin (See above for address) LEAD ATTORNEY ATTORNEY TO BE NOTICED
Jonathan Alan Loeb (See above for address) TERMINATED: 10/27/2015 LEAD ATTORNEY ATTORNEY TO BE NOTICED
Edward A Andrews (See above for address) ATTORNEY TO BE NOTICED
Hina Shamsi (See above for address) ATTORNEY TO BE NOTICED
Hugh Handeyside (See above for address) ATTORNEY TO BE NOTICED
Jeffrey Rosenfeld (See above for address) TERMINATED: 10/27/2015 ATTORNEY TO BE NOTICED
John David Loy (See above for address) ATTORNEY TO BE NOTICED
Julia Harumi Mass (See above for address) TERMINATED: 02/11/2019
Linda Lye (See above for address) TERMINATED: 02/11/2019
Michael James Ableson (See above for address) ATTORNEY TO BE NOTICED
Mitra Ebadolahi (See above for address) ATTORNEY TO BE NOTICED
Nasrina Bargzie

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 5 of 22

Plaintiff Tariq Razak

(See above for address) TERMINATED: 05/26/2016 ATTORNEY TO BE NOTICED
Nicole Robins Sadler (See above for address) TERMINATED: 04/27/2016
Peter Bibring (See above for address) ATTORNEY TO BE NOTICED
Phillip Jared Wiese (See above for address) ATTORNEY TO BE NOTICED
Shilpi Agarwal (See above for address) ATTORNEY TO BE NOTICED
Stephen Scotch−Marmo (See above for address) ATTORNEY TO BE NOTICED
Winifred Virginia Kao (See above for address) ATTORNEY TO BE NOTICED
Yaman Salahi (See above for address) TERMINATED: 01/20/2016
represented by Jeffrey Scott Raskin (See above for address) LEAD ATTORNEY ATTORNEY TO BE NOTICED
Jonathan Alan Loeb (See above for address) TERMINATED: 10/27/2015 LEAD ATTORNEY ATTORNEY TO BE NOTICED
Edward A Andrews (See above for address) ATTORNEY TO BE NOTICED
Hina Shamsi (See above for address) ATTORNEY TO BE NOTICED
Hugh Handeyside (See above for address) ATTORNEY TO BE NOTICED
Jeffrey Rosenfeld (See above for address) TERMINATED: 10/27/2015 ATTORNEY TO BE NOTICED
John David Loy (See above for address) ATTORNEY TO BE NOTICED

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 6 of 22

Plaintiff Khaled Ibrahim

Julia Harumi Mass (See above for address) TERMINATED: 02/11/2019
Linda Lye (See above for address) TERMINATED: 02/11/2019
Michael James Ableson (See above for address) ATTORNEY TO BE NOTICED
Mitra Ebadolahi (See above for address) ATTORNEY TO BE NOTICED
Nasrina Bargzie (See above for address) TERMINATED: 05/26/2016 ATTORNEY TO BE NOTICED
Nicole Robins Sadler (See above for address) TERMINATED: 04/27/2016
Peter Bibring (See above for address) ATTORNEY TO BE NOTICED
Phillip Jared Wiese (See above for address) ATTORNEY TO BE NOTICED
Shilpi Agarwal (See above for address) ATTORNEY TO BE NOTICED
Stephen Scotch−Marmo (See above for address) ATTORNEY TO BE NOTICED
Winifred Virginia Kao (See above for address) ATTORNEY TO BE NOTICED
Yaman Salahi (See above for address) TERMINATED: 01/20/2016
represented by Jeffrey Scott Raskin (See above for address) LEAD ATTORNEY ATTORNEY TO BE NOTICED
Jonathan Alan Loeb (See above for address) TERMINATED: 10/27/2015 LEAD ATTORNEY ATTORNEY TO BE NOTICED
Edward A Andrews (See above for address)

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 7 of 22
ATTORNEY TO BE NOTICED
Hina Shamsi (See above for address) ATTORNEY TO BE NOTICED
Hugh Handeyside (See above for address) ATTORNEY TO BE NOTICED
Jeffrey Rosenfeld (See above for address) TERMINATED: 10/27/2015 ATTORNEY TO BE NOTICED
John David Loy (See above for address) ATTORNEY TO BE NOTICED
Julia Harumi Mass (See above for address) TERMINATED: 02/11/2019
Linda Lye (See above for address) TERMINATED: 02/11/2019
Michael James Ableson (See above for address) ATTORNEY TO BE NOTICED
Mitra Ebadolahi (See above for address) ATTORNEY TO BE NOTICED
Nasrina Bargzie (See above for address) TERMINATED: 05/26/2016 ATTORNEY TO BE NOTICED
Nicole Robins Sadler (See above for address) TERMINATED: 04/27/2016
Peter Bibring (See above for address) ATTORNEY TO BE NOTICED
Phillip Jared Wiese (See above for address) ATTORNEY TO BE NOTICED
Shilpi Agarwal (See above for address) ATTORNEY TO BE NOTICED
Stephen Scotch−Marmo (See above for address) ATTORNEY TO BE NOTICED
Winifred Virginia Kao (See above for address) ATTORNEY TO BE NOTICED
Yaman Salahi

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 8 of 22

Plaintiff Aaron Conklin

(See above for address) TERMINATED: 01/20/2016
represented by Jeffrey Scott Raskin (See above for address) LEAD ATTORNEY ATTORNEY TO BE NOTICED
Jonathan Alan Loeb (See above for address) TERMINATED: 10/27/2015 LEAD ATTORNEY ATTORNEY TO BE NOTICED
Edward A Andrews (See above for address) ATTORNEY TO BE NOTICED
Hina Shamsi (See above for address) ATTORNEY TO BE NOTICED
Hugh Handeyside (See above for address) ATTORNEY TO BE NOTICED
Jeffrey Rosenfeld (See above for address) TERMINATED: 10/27/2015 ATTORNEY TO BE NOTICED
John David Loy (See above for address) ATTORNEY TO BE NOTICED
Julia Harumi Mass (See above for address) TERMINATED: 02/11/2019
Linda Lye (See above for address) TERMINATED: 02/11/2019
Michael James Ableson (See above for address) ATTORNEY TO BE NOTICED
Mitra Ebadolahi (See above for address) ATTORNEY TO BE NOTICED
Nasrina Bargzie (See above for address) TERMINATED: 05/26/2016 ATTORNEY TO BE NOTICED
Nicole Robins Sadler (See above for address) TERMINATED: 04/27/2016
Peter Bibring (See above for address) ATTORNEY TO BE NOTICED

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 9 of 22

V. Defendant U.S. Department of Justice
Defendant Eric H. Holder, Jr. in his official capacity as Attorney General of the United States TERMINATED: 09/08/2015

Phillip Jared Wiese (See above for address) ATTORNEY TO BE NOTICED
Shilpi Agarwal (See above for address) ATTORNEY TO BE NOTICED
Stephen Scotch−Marmo (See above for address) ATTORNEY TO BE NOTICED
Winifred Virginia Kao (See above for address) ATTORNEY TO BE NOTICED
Yaman Salahi (See above for address) TERMINATED: 01/20/2016
represented by Paul Gerald Freeborne U.S. Department of Justice Civil Division 20 Massachusetts Avenue N.W., Room 6108 Washington, DC 20001 (202) 353−0543 Fax: (202) 616−8460 Email: paul.freeborne@usdoj.gov TERMINATED: 03/07/2016 LEAD ATTORNEY
Steven Andrew Myers United States Department of Justice Civil Division, Federal Programs Branch 1100 L St. NW Washington, DC 20005 (202) 305−8648 Fax: (202) 616−8470 Email: steven.a.myers@usdoj.gov LEAD ATTORNEY ATTORNEY TO BE NOTICED
Kieran Gavin Gostin Wilkinson Walsh LLP 2001 M St NW 10th Floor Washington, DC 20036 202−847−4031 Fax: 202−847−4005 Email: kgostin@wilkinsonwalsh.com TERMINATED: 08/25/2016 ATTORNEY TO BE NOTICED
represented by Paul Gerald Freeborne (See above for address) TERMINATED: 03/07/2016 LEAD ATTORNEY

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 10 of 22

Defendant Program Manager − Information Sharing Environment
Defendant Kshemendra Paul in his official capacity as Program Manager of the Information Sharing Environment
Defendant Attorney General Loretta Lynch
Date Filed # Docket Text

Steven Andrew Myers (See above for address) LEAD ATTORNEY ATTORNEY TO BE NOTICED
Kieran Gavin Gostin (See above for address) TERMINATED: 08/25/2016 ATTORNEY TO BE NOTICED
represented by Paul Gerald Freeborne (See above for address) TERMINATED: 03/07/2016 LEAD ATTORNEY
Steven Andrew Myers (See above for address) LEAD ATTORNEY ATTORNEY TO BE NOTICED
Kieran Gavin Gostin (See above for address) TERMINATED: 08/25/2016 ATTORNEY TO BE NOTICED
represented by Paul Gerald Freeborne (See above for address) TERMINATED: 03/07/2016 LEAD ATTORNEY
Steven Andrew Myers (See above for address) LEAD ATTORNEY ATTORNEY TO BE NOTICED
Kieran Gavin Gostin (See above for address) TERMINATED: 08/25/2016 ATTORNEY TO BE NOTICED
represented by Paul Gerald Freeborne (See above for address) TERMINATED: 03/07/2016 LEAD ATTORNEY
Steven Andrew Myers (See above for address) LEAD ATTORNEY ATTORNEY TO BE NOTICED
Kieran Gavin Gostin (See above for address) TERMINATED: 08/25/2016 ATTORNEY TO BE NOTICED

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 11 of 22

07/10/2014
07/10/2014 07/10/2014 07/10/2014

1 COMPLAINT for Declaratory and Injunctive Relief against Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment (Filing fee $ 400.00, receipt number 0971−8757477.). Filed by James Prigoff, Wiley Gill, Khaled Ibrahim, Aaron Conklin. (Attachments: # 1 Civil Cover Sheet)(Loeb, Jonathan) (Filed on 7/10/2014) Modified on 7/10/2014 (gbaS, COURT STAFF). (Entered: 07/10/2014)
2 Proposed Summons. (Loeb, Jonathan) (Filed on 7/10/2014) (Entered: 07/10/2014)
3 CONSENT/DECLINATION to Proceed Before a US Magistrate Judge by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak.. (Loeb, Jonathan) (Filed on 7/10/2014) (Entered: 07/10/2014)
4 Case assigned to Hon. Richard Seeborg.

Counsel for plaintiff or the removing party is responsible for serving the Complaint or Notice of Removal, Summons and the assigned judge's standing orders and all other new case documents upon the opposing parties. For information, visit E−Filing A New Civil Case at http://cand.uscourts.gov/ecf/caseopening.

07/10/2014
07/10/2014 07/11/2014 07/11/2014 07/11/2014 07/11/2014 07/14/2014 07/14/2014 07/16/2014

Standing orders can be downloaded from the court's web page at www.cand.uscourts.gov/judges. Upon receipt, the summons will be issued and returned electronically. Counsel is required to send chambers a copy of the initiating documents pursuant to L.R. 5−1(e)(7). A scheduling order will be sent by Notice of Electronic Filing (NEF) within two business days. (svS, COURT STAFF) (Filed on 7/10/2014) (Entered: 07/10/2014)
5 Initial Case Management Scheduling Order with ADR Deadlines: Case Management Statement due by 10/2/2014. Case Management Conference set for 10/9/2014 10:00 AM in Courtroom 3, 17th Floor, San Francisco. (Attachments: # 1 Standing Order) (gbaS, COURT STAFF) (Filed on 7/10/2014) (Entered: 07/10/2014)
6 Summons Issued as to Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. (gbaS, COURT STAFF) (Filed on 7/10/2014) (Entered: 07/10/2014)
7 MOTION for leave to appear in Pro Hac Vice Hugh Handeyside ( Filing fee $ 305, receipt number 0971−8760932.) filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Attachments: # 1 Certificate of Good Standing)(Lye, Linda) (Filed on 7/11/2014) (Entered: 07/11/2014)
8 MOTION for leave to appear in Pro Hac Vice Hina Shamsi ( Filing fee $ 305, receipt number 0971−8761004.) filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Attachments: # 1 Certificate of Good Standing)(Lye, Linda) (Filed on 7/11/2014) (Entered: 07/11/2014)
9 ORDER GRANTING APPLICATION FOR ADMISSION OF ATTORNEY HUGH HANDEYSIDE PRO HAC VICE. by Judge Richard Seeborg (cl, COURT STAFF) (Filed on 7/11/2014) (Entered: 07/11/2014)
10 ORDER GRANTING APPLICATION FOR ADMISSION OF ATTORNEY HINA SHAMSI PRO HAC VICE. by Judge Richard Seeborg (cl, COURT STAFF) (Filed on 7/11/2014) (Entered: 07/11/2014)
11 MOTION for leave to appear in Pro Hac Vice by Stephen Scotch−Marmo ( Filing fee $ 305, receipt number 0971−8764691.) filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Scotch−Marmo, Stephen) (Filed on 7/14/2014) (Entered: 07/14/2014)
12 ORDER GRANTING APPLICATION FOR ADMISSION OF ATTORNEY STEPHEN SCOTCH−MARMO PRO HAC VICE. by Judge Richard Seeborg (cl, COURT STAFF) (Filed on 7/14/2014) (Entered: 07/14/2014)
13 MOTION for leave to appear in Pro Hac Vice of Attorney Michael Ableson ( Filing fee $ 305, receipt number 25GMJS9U.) Filing fee previously paid on 07/16/2014 filed by Wiley Gill. (Ableson, Michael) (Filed on 7/16/2014) (Entered: 07/16/2014)

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 12 of 22

07/16/2014 07/22/2014 08/06/2014 08/21/2014 08/28/2014
10/14/2014 10/16/2014 10/16/2014
10/24/2014 11/06/2014 11/06/2014
11/13/2014 11/14/2014 11/20/2014 12/08/2014 12/11/2014

14 ORDER GRANTING APPLICATION FOR ADMISSION OF ATTORNEY MICHAEL ABLESON PRO HAC VICE. by Judge Richard Seeborg (cl, COURT STAFF) (Filed on 7/16/2014) (Entered: 07/16/2014)
15 NOTICE of Appearance by Paul Gerald Freeborne on Behalf of the Federal Defendants (Freeborne, Paul) (Filed on 7/22/2014) (Entered: 07/22/2014)
16 NOTICE of Appearance by Kieran Gavin Gostin (Gostin, Kieran) (Filed on 8/6/2014) (Entered: 08/06/2014)
17 STIPULATION WITH PROPOSED ORDER filed by Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Proposed Order)(Gostin, Kieran) (Filed on 8/21/2014) (Entered: 08/21/2014)
18 CLERK'S NOTICE CONTINUING CASE MANAGEMENT CONFERENCE. Case Management Statement due by 1/2/2015. Case Management Conference previously set for 10/9/14 has been CONTINUED TO 1/8/2015 10:00 AM in Courtroom 3, 17th Floor, San Francisco. This is a text only entry. There is no document associated with this notice. (cl, COURT STAFF) (Filed on 8/28/2014) (Entered: 08/28/2014)
19 MOTION for Leave to File Excess Pages filed by Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Proposed Order)(Gostin, Kieran) (Filed on 10/14/2014) (Entered: 10/14/2014)
20 ORDER by Judge Richard Seeborg granting 19 Motion for Leave to File Excess Pages. (cl, COURT STAFF) (Filed on 10/16/2014) (Entered: 10/16/2014)
21 MOTION to Dismiss filed by Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. Motion Hearing set for 1/8/2014 01:30 PM in Courtroom 3, 17th Floor, San Francisco before Hon. Richard Seeborg. Responses due by 11/20/2014. Replies due by 12/11/2014. (Attachments: # 1 Proposed Order)(Gostin, Kieran) (Filed on 10/16/2014) (Entered: 10/16/2014)
22 NOTICE of Appearance by John David Loy (Loy, John) (Filed on 10/24/2014) (Entered: 10/24/2014)
Reset Hearing re 21 MOTION to Dismiss Motion Hearing set for 1/8/2015 01:30 PM in Courtroom 3, 17th Floor, San Francisco before Hon. Richard Seeborg. (cl, COURT STAFF) (Filed on 11/6/2014) (Entered: 11/06/2014)
23 CLERK'S NOTICE RESETTING THE TIME ON CASE MANAGEMENT CONFERENCE. Case Management Conference RESET TO 01:30 PM on January 8, 2015 in Courtroom 3, 17th Floor, San Francisco. This is a text only entry. There is no document associated with this notice. (cl, COURT STAFF) (Filed on 11/6/2014) (Entered: 11/06/2014)
24 STIPULATION WITH PROPOSED ORDER re page limits filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 11/13/2014) (Entered: 11/13/2014)
25 STIPULATION AND ORDER REGARDING PAGE LIMITS. Signed by Judge Richard Seeborg on 11/14/14. (cl, COURT STAFF) (Filed on 11/14/2014) (Entered: 11/14/2014)
26 RESPONSE (re 21 MOTION to Dismiss ) filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 11/20/2014) (Entered: 11/20/2014)
27 SUMMONS Returned Executed by Tariq Razak, James Prigoff, Wiley Gill, Khaled Ibrahim, Aaron Conklin. All Defendants. (Lye, Linda) (Filed on 12/8/2014) (Entered: 12/08/2014)
28 REPLY (re 21 MOTION to Dismiss ) filed byDepartment of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. (Gostin, Kieran) (Filed on 12/11/2014) (Entered: 12/11/2014)

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 13 of 22

12/18/2014 12/18/2014 12/18/2014 12/18/2014 12/22/2014 12/22/2014
12/31/2014 12/31/2014 01/06/2015 01/08/2015
02/20/2015 02/26/2015 03/05/2015 03/12/2015
03/20/2015 04/01/2015
04/01/2015 04/03/2015

29 ADR Certification (ADR L.R. 3−5 b) of discussion of ADR options Filed by Defendants (Freeborne, Paul) (Filed on 12/18/2014) (Entered: 12/18/2014)
30 Certificate of Interested Entities by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak (Lye, Linda) (Filed on 12/18/2014) (Entered: 12/18/2014)
31 ADR Certification (ADR L.R. 3−5 b) of discussion of ADR options by Plaintiffs (Lye, Linda) (Filed on 12/18/2014) (Entered: 12/18/2014)
32 NOTICE of need for ADR Phone Conference (ADR L.R. 3−5 d) (Lye, Linda) (Filed on 12/18/2014) (Entered: 12/18/2014)
33 NOTICE of Change In Counsel by Michael James Ableson and Stephen Scotch−Marmo (Ableson, Michael) (Filed on 12/22/2014) (Entered: 12/22/2014)
34 ADR Clerk's Notice Setting ADR Phone Conference on January 6, 2015 at 2:30 PM Pacific time. Please note that you must be logged into an ECF account of counsel of record in order to view this document. (cmf, COURT STAFF) (Filed on 12/22/2014) (Entered: 12/22/2014)
35 NOTICE of Appearance by Jeffrey Scott Raskin Notice of Appearance of Jeffrey S. Raskin and Nicole R. Sadler (Raskin, Jeffrey) (Filed on 12/31/2014) (Entered: 12/31/2014)
36 CASE MANAGEMENT STATEMENT (JOINT) filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 12/31/2014) (Entered: 12/31/2014)
ADR Remark: ADR Phone Conference held 1/6/2015 with Daniel Bowling, ADR Program Staff Attorney. (cmf, COURT STAFF) (Filed on 1/6/2015) (Entered: 01/06/2015)
37 Minute Entry for proceedings held before Hon. Richard Seeborg: Further Case Management Conference held on 1/8/2015. Motion Hearing held on 1/8/2015 re 21 MOTION to Dismiss Court Reporter Name: James Pence. (cl, COURT STAFF) (Date Filed: 1/8/2015) (Entered: 01/08/2015)
38 ORDER by Judge Richard Seeborg denying 21 Motion to Dismiss. (cl, COURT STAFF) (Filed on 2/20/2015) (Entered: 02/20/2015)
39 STIPULATION filed by Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. (Gostin, Kieran) (Filed on 2/26/2015) (Entered: 02/26/2015)
40 CASE MANAGEMENT STATEMENT (JOINT) filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Scotch−Marmo, Stephen) (Filed on 3/5/2015) (Entered: 03/05/2015)
41 Minute Entry for proceedings held before Hon. Richard Seeborg: Further Case Management Conference held on 3/12/2015. Further Case Management Conference set for 7/9/2015 10:00 AM in Courtroom 3, 17th Floor, San Francisco.Court Reporter: Not Reported. (cl, COURT STAFF) (Date Filed: 3/12/2015) (Entered: 03/12/2015)
42 STIPULATION To Extend Time For Defendants to Answer Plaintiffs' Complaint filed by Department of Justice, Eric H. Holder, Jr, Program Manager − Information Sharing Environment. (Freeborne, Paul) (Filed on 3/20/2015) (Entered: 03/20/2015)
43 Consent Administrative Motion to File Under Seal Defendants' Answer filed by Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Declaration, # 2 Proposed Order)(Freeborne, Paul) (Filed on 4/1/2015) (Entered: 04/01/2015)
44 ORDER by Judge Richard Seeborg granting 43 Administrative Motion to File Under Seal. (cl, COURT STAFF) (Filed on 4/1/2015) (Entered: 04/01/2015)
45 DOCUMENT E−FILED UNDER SEAL re 44 Order on Administrative Motion to File Under Seal Defendants' Answer to Complaint by Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. (Freeborne, Paul) (Filed on 4/3/2015) (Entered: 04/03/2015)

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 14 of 22

04/24/2015 05/05/2015 06/04/2015 06/04/2015 06/04/2015 06/04/2015
06/16/2015 06/17/2015
06/30/2015 06/30/2015

46 STIPULATION re: Filing of Unredacted Answer filed by Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Answer)(Gostin, Kieran) (Filed on 4/24/2015) (Entered: 04/24/2015)
47 NOTICE of Change of Address by Nicole Robins Sadler (Sadler, Nicole) (Filed on 5/5/2015) (Entered: 05/05/2015)
48 STIPULATION WITH PROPOSED ORDER Setting Hearing Date and Briefing Schedule for Plaintiffs Special Motion to Establish Right to Discovery on the Department of Justices Standard for Suspicious Activity Reporting and Submission of Administrative Record Regarding Functional Standard filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Sadler, Nicole) (Filed on 6/4/2015) (Entered: 06/04/2015)
49 ORDER by Judge Richard Seeborg granting [#48] Stipulation Setting Hearing Date and Briefing Schedule for Plaintiffs Special Motion to Establish Right to Discovery on the Department of Justices Standard for Suspicious Activity Reporting and Submission of Administrative Record Regarding Functional Standard. (cl, COURT STAFF) (Filed on 6/4/2015) (Entered: 06/04/2015)
50 MOTION for Discovery Notice of Motion and Memorandum of Law In Support of Plaintiffs Special Motion to Establish Right to Discovery on the Department of Justices Standard for Suspicious Activity Reporting filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. Motion Hearing set for 8/20/2015 01:30 PM in Courtroom 3, 17th Floor, San Francisco before Hon. Richard Seeborg. Responses due by 7/10/2015. Replies due by 7/30/2015. (Attachments: # 1 Proposed Order)(Sadler, Nicole) (Filed on 6/4/2015) (Entered: 06/04/2015)
51 Declaration of Hugh Handeyside in Support of 50 MOTION for Discovery Notice of Motion and Memorandum of Law In Support of Plaintiffs Special Motion to Establish Right to Discovery on the Department of Justices Standard for Suspicious Activity Reporting filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Attachments: # 1 Exhibit A, # 2 Exhibit B, # 3 Exhibit C, # 4 Exhibit D, # 5 Exhibit E, # 6 Exhibit F, # 7 Exhibit G, # 8 Exhibit H, # 9 Exhibit I, # 10 Exhibit J, # 11 Exhibit K, # 12 Exhibit L, # 13 Exhibit M, # 14 Exhibit N, # 15 Exhibit O, # 16 Exhibit P, # 17 Exhibit Q)(Related document(s) 50 ) (Sadler, Nicole) (Filed on 6/4/2015) (Entered: 06/04/2015)
52 NOTICE by Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment re 49 Order on Stipulation, 41 Case Management Conference − Further,, Set Hearings, of Filing of Administrative Record (Attachments: # 1 Certification of Administrative Record, # 2 Exhibit A − Index of Administrative Record)(Freeborne, Paul) (Filed on 6/16/2015) (Entered: 06/16/2015)
53 ADMINISTRATIVE RECORD by Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. Amendment to 52 Notice (Other), Supplement to Notice of Filing of Administrative Record−Administrative Record. (Attachments: # 1 Supplement AR−Part 2, # 2 Supplement AR−Part 3, # 3 Supplement AR−Part 4, # 4 Supplement AR−Part 5, # 5 Supplement AR−Part 6, # 6 Supplement AR−Part 7, # 7 Supplement AR−Part 8, # 8 Supplement AR−Part 9, # 9 Supplement AR−Part 10, # 10 Supplement AR−Part 11, # 11 Supplement AR−Part 12, # 12 Supplement AR−Part 13, # 13 Supplement AR−Part 14, # 14 Supplement AR−Part 15, # 15 Supplement AR−Part 16, # 16 Supplement AR−Part 17, # 17 Supplement AR−Part 18)(Freeborne, Paul) (Filed on 6/17/2015) Modified on 6/17/2015 (gbaS, COURT STAFF). (Entered: 06/17/2015)
54 STIPULATION WITH PROPOSED ORDER re 41 Case Management Conference − Further,, Set Hearings, filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 6/30/2015) (Entered: 06/30/2015)
55 CLERK'S NOTICE The Case Management Conference previously set for 7/9/2015 is continued to 8/20/2015 at 1:30 PM in Courtroom 3, 17th Floor, San Francisco. This is a text only entry. There is no document associated with this notice.(rslc2, COURT STAFF) (Filed on 6/30/2015) (Entered: 06/30/2015)

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 15 of 22

07/10/2015
07/29/2015 07/30/2015
08/12/2015 08/14/2015 08/17/2015 08/21/2015 08/25/2015
08/26/2015
08/26/2015
08/28/2015 09/01/2015 09/01/2015

56 RESPONSE (re 50 MOTION for Discovery Notice of Motion and Memorandum of Law In Support of Plaintiffs Special Motion to Establish Right to Discovery on the Department of Justices Standard for Suspicious Activity Reporting ) filed byDepartment of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. (Gostin, Kieran) (Filed on 7/10/2015) (Entered: 07/10/2015)
57 NOTICE of Appearance by Nicole Robins Sadler (Sadler, Nicole) (Filed on 7/29/2015) (Entered: 07/29/2015)
58 REPLY (re 50 MOTION for Discovery Notice of Motion and Memorandum of Law In Support of Plaintiffs Special Motion to Establish Right to Discovery on the Department of Justices Standard for Suspicious Activity Reporting ) Reply in Support of Plaintiffs Special Motion to Establish Right to Discovery on the Department of Justices Standard for Suspicious Activity Reporting filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Sadler, Nicole) (Filed on 7/30/2015) (Entered: 07/30/2015)
59 JOINT CASE MANAGEMENT STATEMENT & Proposed Order filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Sadler, Nicole) (Filed on 8/12/2015) (Entered: 08/12/2015)
60 ORDER by Judge Richard Seeborg denying 50 Motion for Discovery. (cl, COURT STAFF) (Filed on 8/14/2015) (Entered: 08/14/2015)
Reset Hearing: Further Case Management Conference previously set for 8/20/2015 Continued to 8/27/2015 at 10:00 AM in Courtroom 3, 17th Floor, San Francisco. (cl, COURT STAFF) (Filed on 8/17/2015) (Entered: 08/17/2015)
61 JOINT CASE MANAGEMENT STATEMENT Supplemental Joint Case Management Statement filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 8/21/2015) (Entered: 08/21/2015)
62 ORDER CONTINUING CASE MANAGEMENT CONFERENCE AND DIRECTING SUPPLEMENTAL FILING. Further Case Management Conference previously set for 8/27/2015 Continued to 9/3/2015 at 10:00 AM in Courtroom 3, 17th Floor, San Francisco. Signed by Judge Richard Seeborg on 8/25/15. (cl, COURT STAFF) (Filed on 8/25/2015) (Entered: 08/25/2015)
63 STIPULATION WITH PROPOSED ORDER re 62 Order,, Set Hearings, Regarding Continuation of Initial Case Management Conference filed by Department of Justice, Eric H. Holder, Jr, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Proposed Order)(Freeborne, Paul) (Filed on 8/26/2015) (Entered: 08/26/2015)
64 STIPULATION AND ORDER RE 63 CONTINUING FURTHER CASE MANAGEMENT CONFERENCE. Further Case Management Conference previously set for 9/3/2015 Continued to 9/10/2015 at 10:00 AM in Courtroom 3, 17th Floor, San Francisco. Signed by Judge Richard Seeborg on 8/26/15. (cl, COURT STAFF) (Filed on 8/26/2015) (Entered: 08/26/2015)
65 Statement re Notice re Pltfs' Mot for Leave to File Suppl Complaint by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 8/28/2015) (Entered: 08/28/2015)
66 MOTION for Leave to File Notice of Motion and Motion for Leave to File Supplemental Complaint; and Memorandum of Points and Authorities in Support filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 9/1/2015) (Entered: 09/01/2015)
67 Declaration of Linda Lye in Support of 66 MOTION for Leave to File Notice of Motion and Motion for Leave to File Supplemental Complaint; and Memorandum of Points and Authorities in Support filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Attachments: # 1 Exhibit Exhibit 1, # 2 Exhibit Exhibit 2 Pages 1 to 16, # 3 Exhibit Exhibit 2 Pages 17 to 33, # 4 Exhibit Exhhibit 2 Pages 34 to 50, # 5 Exhibit Exhibit 2 Pages 51 to 58, # 6 Exhibit Exhibit 2 Pages 59 to 65, # 7 Exhibit Exhibit 2 Pages 66 to 131, # 8 Exhibit Exhibit 2 Pages 132 to 194)(Related document(s) 66 ) (Lye, Linda) (Filed on 9/1/2015) (Entered: 09/01/2015)

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 16 of 22

09/01/2015 09/02/2015 09/03/2015
09/04/2015 09/08/2015 09/08/2015 10/01/2015 10/01/2015 10/01/2015
10/01/2015 10/08/2015 10/09/2015

68 Proposed Order re 66 MOTION for Leave to File Notice of Motion and Motion for Leave to File Supplemental Complaint; and Memorandum of Points and Authorities in Support, 67 Declaration in Support,, [Proposed] Order Granting Plaintiffs' Motion for Leave to File Supplemental Complaint by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 9/1/2015) (Entered: 09/01/2015)
69 ORDER by Judge Richard Seeborg granting 66 Motion for Leave to File. (cl, COURT STAFF) (Filed on 9/2/2015) (Entered: 09/02/2015)
70 FIRST AMENDED COMPLAINT for Declaratory and Injunctive Relief against All Defendants. Filed by Tariq Razak, James Prigoff, Wiley Gill, Khaled Ibrahim, Aaron Conklin. (Attachments: # 1 Exhibit A, # 2 Exhibit B, # 3 Exhibit C, # 4 Exhibit D Part 1a, # 5 Exhibit D Part 1b, # 6 Exhibit D Part 2, # 7 Exhibit E, # 8 Exhibit F, # 9 Exhibit G, # 10 Exhibit H, # 11 Exhibit I, # 12 Exhibit J, # 13 Exhibit K)(Lye, Linda) (Filed on 9/3/2015) Modified on 9/4/2015 (gbaS, COURT STAFF). (Entered: 09/03/2015)
71 JOINT CASE MANAGEMENT STATEMENT Further Supplemental Joint Case Management Statement filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 9/4/2015) (Entered: 09/04/2015)
72 ORDER REFERRING ISSUES TO MAGISTRATE JUDGE AND CONTINUING FURTHER CASE MANAGEMENT CONFERENCE. Order Referring Case to Magistrate Judge. Further Case Management Conference set for 11/19/2015 at 10:00 AM in Courtroom 3, 17th Floor, San Francisco. Signed by Judge Richard Seeborg on 9/8/15. (cl, COURT STAFF) (Filed on 9/8/2015) (Entered: 09/08/2015)
CASE REFERRED to Magistrate Judge Kandis A. Westmore for Discovery (ahm, COURT STAFF) (Filed on 9/8/2015) (Entered: 09/08/2015)
73 MOTION Complete the Administrative Record Plaintiffs Notice of Motion and Motion to Complete the Administrative Record; Memorandum of Points and Authorities in Support Thereof filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. Motion Hearing set for 11/5/2015 11:00 AM before Magistrate Judge Kandis A. Westmore. Responses due by 10/15/2015. Replies due by 10/22/2015. (Sadler, Nicole) (Filed on 10/1/2015) (Entered: 10/01/2015)
74 Statement re 73 MOTION Complete the Administrative Record Plaintiffs Notice of Motion and Motion to Complete the Administrative Record; Memorandum of Points and Authorities in Support Thereof Plaintiffs Statement re: Filing of Noticed Motion to Complete the Administrative Record by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Sadler, Nicole) (Filed on 10/1/2015) (Entered: 10/01/2015)
75 Declaration of Linda Lye in Support of 73 MOTION Complete the Administrative Record Plaintiffs Notice of Motion and Motion to Complete the Administrative Record; Memorandum of Points and Authorities in Support Thereof filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Attachments: # 1 Exhibit 1, # 2 Exhibit 2, # 3 Exhibit 3, # 4 Exhibit 4, # 5 Exhibit 5, # 6 Exhibit 6, # 7 Exhibit 7, # 8 Exhibit 8, # 9 Exhibit 9)(Related document(s) 73 ) (Sadler, Nicole) (Filed on 10/1/2015) (Entered: 10/01/2015)
76 Proposed Order re 73 MOTION Complete the Administrative Record Plaintiffs Notice of Motion and Motion to Complete the Administrative Record; Memorandum of Points and Authorities in Support Thereof [Proposed] Order Granting Plaintiffs Motion to Complete the Administrative Record by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Sadler, Nicole) (Filed on 10/1/2015) (Entered: 10/01/2015)
77 STIPULATION WITH PROPOSED ORDER filed by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Proposed Order)(Gostin, Kieran) (Filed on 10/8/2015) (Entered: 10/08/2015)
78 ORDER GRANTING 77 STIPULATION WITH PROPOSED ORDER (AS MODIFIED BY THE COURT); CONTINUING HEARING ON 73 MOTION TO COMPLETE THE ADMINISTRATIVE RECORD TO DECEMBER 3, 2015 AT

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 17 of 22

10/22/2015 10/27/2015 10/28/2015 11/05/2015 11/09/2015 11/09/2015 12/02/2015
12/02/2015 12/03/2015
12/18/2015 12/22/2015

11:00 AM. Signed by Judge Kandis A. Westmore on 10/09/2015. (kawlc2S, COURT STAFF) (Filed on 10/9/2015) (Entered: 10/09/2015)
79 RESPONSE (re 73 MOTION Complete the Administrative Record Plaintiffs Notice of Motion and Motion to Complete the Administrative Record; Memorandum of Points and Authorities in Support Thereof ) filed byDepartment of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Exhibit 1, # 2 Exhibit 2)(Gostin, Kieran) (Filed on 10/22/2015) (Entered: 10/22/2015)
80 NOTICE by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak of Withdrawal of Counsel (Attachments: # 1 Proposed Order)(Scotch−Marmo, Stephen) (Filed on 10/27/2015) (Entered: 10/27/2015)
81 ORDER withdrawing counsel. Signed by Judge Richard Seeborg on 10/28/15. (cl, COURT STAFF) (Filed on 10/28/2015) (Entered: 10/28/2015)
82 REPLY (re 73 MOTION Complete the Administrative Record Plaintiffs Notice of Motion and Motion to Complete the Administrative Record; Memorandum of Points and Authorities in Support Thereof ) filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff. (Sadler, Nicole) (Filed on 11/5/2015) (Entered: 11/05/2015)
83 STIPULATION WITH PROPOSED ORDER re 72 Order,, Order Referring Case to Magistrate Judge,, Set Hearings, Regarding Continuation of November 19, 2015 Case Management Conference filed by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Proposed Order)(Freeborne, Paul) (Filed on 11/9/2015) (Entered: 11/09/2015)
84 CLERK'S NOTICE CONTINUING FURTHER CASE MANAGEMENT CONFERNCE. Case Management Statement due by 1/21/2016. Further Case Management Conference previously set for 11/19/2015 Continued to 1/28/2016 at 10:00 AM in Courtroom 3, 17th Floor, San Francisco. (This is a text−only entry generated by the court. There is no document associated with this entry.) (cl, COURT STAFF) (Filed on 11/9/2015) (Entered: 11/09/2015)
85 CLERK'S NOTICE Continuing Motion Hearing as to 73 MOTION Complete the Administrative Record Plaintiffs Notice of Motion and Motion to Complete the Administrative Record; Memorandum of Points and Authorities in Support Thereof. Motion Hearing continued to 12/17/2015 11:00 AM before Magistrate Judge Kandis A. Westmore. (This is a text−only entry generated by the court. There is no document associated with this entry.)(kawlc1, COURT STAFF) (Filed on 12/2/2015) (Entered: 12/02/2015)
86 CLERK'S NOTICE Advancing Motion Hearing on 73 MOTION Complete the Administrative Record to Thursday, 12/3/2015 11:00 AM in Courtroom 2, 4th Floor, Oakland before Magistrate Judge Kandis A. Westmore. (This is a text−only entry generated by the court. There is no document associated with this entry.) (kawlc1, COURT STAFF) (Filed on 12/2/2015) (Entered: 12/02/2015)
87 Minute Entry for proceedings held before Magistrate Judge Kandis A. Westmore: Arguments heard, matter submitted. Court to issue order.Motion Hearing held on 12/3/2015. re 73 MOTION Complete the Administrative Record Plaintiffs Notice of Motion and Motion to Complete the Administrative Record; Memorandum of Points and Authorities in Support Thereof filed by James Prigoff, Aaron Conklin, Khaled Ibrahim, Wiley Gill, Tariq Razak Court Reporter Name Diane Skillman. (sisS, COURT STAFF) (Date Filed: 12/3/2015) (Entered: 12/03/2015)
88 Order by Magistrate Judge Kandis A. Westmore granting in part and denying in part 73 motion to complete administrative record.(kawlc2S, COURT STAFF) (Filed on 12/18/2015) (Entered: 12/18/2015)
89 STIPULATION WITH PROPOSED ORDER filed by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Proposed Order)(Gostin, Kieran) (Filed on 12/22/2015) (Entered: 12/22/2015)

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 18 of 22

12/22/2015 01/11/2016 01/13/2016 01/13/2016 01/15/2016
01/15/2016 01/20/2016 01/20/2016 01/21/2016
01/29/2016
01/29/2016 02/11/2016 02/12/2016

90 STIPULATION AND ORDER REGARDING EXTENSION TO SEEK RELIEF FROM MAGISTRATE JUDGE'S NONDISPOSITIVE ORDER. Signed by Judge Richard Seeborg on 12/22/15. (cl, COURT STAFF) (Filed on 12/22/2015) (Entered: 12/22/2015)
91 NOTICE of Substitution of Counsel by Winifred Virginia Kao (Kao, Winifred) (Filed on 1/11/2016) (Entered: 01/11/2016)
92 First MOTION for Leave to File Excess Pages Unopposed Administrative Motion to Exceed Page Limits For Motion Filed Under L.R. 72−2 filed by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Affidavit, # 2 Proposed Order)(Freeborne, Paul) (Filed on 1/13/2016) (Entered: 01/13/2016)
93 ORDER by Judge Richard Seeborg granting 92 Motion for Leave to File Excess Pages. (cl, COURT STAFF) (Filed on 1/13/2016) (Entered: 01/13/2016)
94 MOTION Relief from Nondispositive Pretrial Order of Magistrate Judge re 88 Order on Motion for Miscellaneous Relief Pursuant to L.R. 72−2 filed by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. Responses due by 1/29/2016. Replies due by 2/5/2016. (Attachments: # 1 Proposed Order)(Freeborne, Paul) (Filed on 1/15/2016) (Entered: 01/15/2016)
95 ORDER SETTING BRIEFING SCHEDULE. Signed by Judge Richard Seeborg on 1/15/16. (cl, COURT STAFF) (Filed on 1/15/2016) (Entered: 01/15/2016)
96 STIPULATION WITH PROPOSED ORDER Regarding Continuation of January 28, 2016 Case Management Conference filed by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Proposed Order)(Freeborne, Paul) (Filed on 1/20/2016) (Entered: 01/20/2016)
97 TRANSCRIPT ORDER by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak for Court Reporter Diane Skillman. (Lye, Linda) (Filed on 1/20/2016) (Entered: 01/20/2016)
98 CLERK'S NOTICE CONTINUING FURTHER CASE MANAGEMENT CONFERENCE. Case Management Statement due by 2/11/2016. Further Case Management Conference previously set for 1/28/2016 Continued to 2/18/2016 at 10:00 AM in Courtroom 3, 17th Floor, San Francisco. (This is a text−only entry generated by the court. There is no document associated with this entry.) (cl, COURT STAFF) (Filed on 1/21/2016) (Entered: 01/21/2016)
99 Transcript of Proceedings held on December 3, 2015, before Judge Kandis A. Westmore. Court Reporter Diane E. Skillman, telephone number 510−451−2930, Diane_Skillman@cand.uscourts.gov. Per General Order No. 59 and Judicial Conference policy, this transcript may be viewed only at the Clerk's Office public terminal or may be purchased through the Court Reporter until the deadline for the Release of Transcript Restriction. After that date it may be obtained through PACER. Any Notice of Intent to Request Redaction, if required, is due no later than 5 business days from date of this filing. (Re 97 Transcript Order ) Release of Transcript Restriction set for 4/28/2016. (Related documents(s) 97 ) (Skillman, Diane) (Filed on 1/29/2016) (Entered: 01/29/2016)
100 RESPONSE (re 94 MOTION Relief from Nondispositive Pretrial Order of Magistrate Judge re 88 Order on Motion for Miscellaneous Relief Pursuant to L.R. 72−2 ) Plaintiffs Response to Defendants Motion for Relief from Non−Dispositive Pretrial Order of Magistrate Judge filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Sadler, Nicole) (Filed on 1/29/2016) (Entered: 01/29/2016)
101 CASE MANAGEMENT STATEMENT (Joint) filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 2/11/2016) (Entered: 02/11/2016)
102 ORDER RE DEFENDANTS' MOTION FOR RELIEF FROM NON−DISPOSITIVE PRETRIAL ORDER OF MAGISTRATE JUDGE. Further Case Management Conference set for 8/4/2016 at 10:00 AM in Courtroom 3, 17th

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 19 of 22

03/04/2016 04/08/2016 04/08/2016 04/15/2016 05/10/2016
05/25/2016 06/10/2016 06/21/2016 07/22/2016 07/25/2016 08/18/2016
08/22/2016 09/22/2016
09/22/2016

Floor, San Francisco.Signed by Judge Richard Seeborg on 2/16/16. (cl, COURT STAFF) (Filed on 2/12/2016) (Entered: 02/12/2016)
103 NOTICE by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment Notice of Withdrawal of Counsel (Freeborne, Paul) (Filed on 3/4/2016) (Entered: 03/04/2016)
104 STIPULATION WITH PROPOSED ORDER filed by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. (Attachments: # 1 Proposed Order)(Gostin, Kieran) (Filed on 4/8/2016) (Entered: 04/08/2016)
105 ORDER by Judge Richard Seeborg granting 104 Stipulation regarding extension of deadline to comply with Magistrate Judge's Order.(cl, COURT STAFF) (Filed on 4/8/2016) (Entered: 04/08/2016)
106 NOTICE by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak Notice of Withdrawal of Nicole R. Sadler as Counsel for Plaintiffs (Wiese, Phillip) (Filed on 4/15/2016) (Entered: 04/15/2016)
107 NOTICE by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment of Filing of Supplemental Administrative Record (Attachments: # 1 Certification, # 2 Supplemental Administrative Record − Part 1, # 3 Supplemental Administrative Record − Part 2)(Gostin, Kieran) (Filed on 5/10/2016) (Entered: 05/10/2016)
108 NOTICE of Substitution of Counsel by Christina Sinha (Sinha, Christina) (Filed on 5/25/2016) (Entered: 05/25/2016)
109 NOTICE of Appearance by Phillip Jared Wiese (Wiese, Phillip) (Filed on 6/10/2016) (Entered: 06/10/2016)
110 JOINT CASE MANAGEMENT STATEMENT filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 6/21/2016) (Entered: 06/21/2016)
111 CLERK'S NOTICE The Case Management Conference previously set for August 4, 2016, is continued to January 26, 2017, at 10:00 AM in Courtroom 3, 17th Floor, San Francisco. This is a text only entry. There is no document associated with this notice. (rslc2S, COURT STAFF) (Filed on 7/22/2016) (Entered: 07/22/2016)
112 CASE MANAGEMENT SCHEDULING ORDER: Motion Hearing for cross MSJ set for 12/8/2016 01:30 PM in Courtroom 3, 17th Floor, San Francisco before Hon. Richard Seeborg. Signed by Judge Richard Seeborg on 7/25/16. (bpf, COURT STAFF) (Filed on 7/25/2016) (Entered: 07/25/2016)
113 MOTION for Summary Judgment and Memorandum in Support filed by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. Motion Hearing set for 12/8/2016 01:30 PM in Courtroom 3, 17th Floor, San Francisco before Hon. Richard Seeborg. Responses due by 9/22/2016. Replies due by 10/20/2016. (Attachments: # 1 Exhibit A, # 2 Exhibit B)(Gostin, Kieran) (Filed on 8/18/2016) (Entered: 08/18/2016)
114 NOTICE of Substitution of Counsel by Steven Andrew Myers (Myers, Steven) (Filed on 8/22/2016) (Entered: 08/22/2016)
115 RESPONSE (re 113 MOTION for Summary Judgment and Memorandum in Support ) Plaintiffs' Opposition to Defendants' Motion for Summary Judgment and Cross−Motion for Summary Judgment; Memorandum of Points and Authorities in Support filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Wiese, Phillip) (Filed on 9/22/2016) (Entered: 09/22/2016)
116 Declaration of Linda Lye in Support of 115 Opposition/Response to Motion, Motion for Summary Judgment and Cross−Motion for Summary Judgment filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Related document(s) 115 ) (Wiese, Phillip) (Filed on 9/22/2016) (Entered: 09/22/2016)

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 20 of 22

09/22/2016 09/22/2016 09/22/2016 09/22/2016 09/22/2016
09/29/2016
09/30/2016 10/20/2016 11/01/2016 11/03/2016 11/03/2016

117 Declaration of James Prigoff in Support of 115 Opposition/Response to Motion, Motion for Summary Judgment and Plaintiffs' Opposition to Defendants' Motion for Summary Judgment filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Related document(s) 115 ) (Wiese, Phillip) (Filed on 9/22/2016) (Entered: 09/22/2016)
118 Declaration of Tariq Razak in Support of 115 Opposition/Response to Motion, Motion for Summary Judgment filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Related document(s) 115 ) (Wiese, Phillip) (Filed on 9/22/2016) (Entered: 09/22/2016)
119 Declaration of Khaled Ibrahim in Support of 115 Opposition/Response to Motion, Motion for Summary Judgment filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Related document(s) 115 ) (Wiese, Phillip) (Filed on 9/22/2016) (Entered: 09/22/2016)
120 Declaration of Aaron Conklin in Support of 115 Opposition/Response to Motion, Motion for Summary Judgment and Plaintiffs' Opposition to Defendants' Motion for Summary Judgment filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Related document(s) 115 ) (Wiese, Phillip) (Filed on 9/22/2016) (Entered: 09/22/2016)
121 First MOTION to Strike 113 MOTION for Summary Judgment and Memorandum in Support Plaintiffs Motion to Strike Defendants Declarations and to Supplement the Record with Plaintiffs Declarations; Memorandum of Points and Authorities in Support filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. Motion Hearing set for 12/8/2016 01:30 PM in Courtroom 3, 17th Floor, San Francisco before Hon. Richard Seeborg. Responses due by 10/20/2016. Replies due by 11/17/2016. (Attachments: # 1 Proposed Order [Proposed] Order Denying Defendants' Motion for Summary Judgment, Granting Plaintiffs' Motions to Strike and Supplement, and Granting Plaintiffs' Motion for Summary Judgment)(Wiese, Phillip) (Filed on 9/22/2016) (Entered: 09/22/2016)
122 STIPULATION WITH PROPOSED ORDER re 121 First MOTION to Strike 113 MOTION for Summary Judgment and Memorandum in Support Plaintiffs Motion to Strike Defendants Declarations and to Supplement the Record with Plaintiffs Declarations; Memorandum of Points and Authorities in Su filed by Department of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. (Myers, Steven) (Filed on 9/29/2016) (Entered: 09/29/2016)
123 STIPULATION AND ORDER RE 122 SETTING BRIEFING SCHEDULE ON PLAINTIFFS' MOTION TO STRIKE DEFENDANTS' DECLARATIONS AND TO SUPPLEMENT THE RECORD WITH PLAINTIFFS' DECLARATIONS. Signed by Judge Richard Seeborg on 9/30/16. (cl, COURT STAFF) (Filed on 9/30/2016) (Entered: 09/30/2016)
124 REPLY (re 113 MOTION for Summary Judgment and Memorandum in Support ) ; Opposition to Plaintiffs' Motion for Summary Judgment 115 ; and Opposition to Plaintiffs' Motion to Strike Defendants' Declarations and Supplement the Record with Plaintiffs' Declarations 121 filed byDepartment of Justice, Eric H. Holder, Jr, Loretta Lynch, Kshemendra Paul, Program Manager − Information Sharing Environment. (Myers, Steven) (Filed on 10/20/2016) (Entered: 10/20/2016)
125 ADMINISTRATIVE MOTION File Declaration Unopposed Administrative Motion to File Declaration in Support of Summary Judgment filed by Wiley Gill. Responses due by 11/7/2016. (Attachments: # 1 Declaration Declaration of Linda Lye in Support of Unopposed Administrative Motion to File Declaration in Support of Summary Judgment, # 2 Proposed Order [Proposed] Order)(Lye, Linda) (Filed on 11/1/2016) (Entered: 11/01/2016)
126 ORDER by Judge Richard Seeborg granting 125 Administrative Motion. (cl, COURT STAFF) (Filed on 11/3/2016) (Entered: 11/03/2016)
127 Declaration of Wiley Gill in Support of 115 Opposition/Response to Motion, Motion for Summary Judgment filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Related document(s) 115 ) (Wiese, Phillip) (Filed on 11/3/2016) (Entered: 11/03/2016)

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 21 of 22

11/17/2016 12/08/2016

128 REPLY (re 113 MOTION for Summary Judgment and Memorandum in Support ) Plaintiffs Reply in Support of Motion for Summary Judgment and Motion to Strike And Supplement filed byAaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Wiese, Phillip) (Filed on 11/17/2016) (Entered: 11/17/2016)
129 Minute Entry for proceedings held before Hon. Richard Seeborg: Motion Hearing held on 12/8/2016. Matters taken under submission. Court to issue an order re 121 First MOTION to Strike 113 MOTION for Summary Judgment Total Time in Court 30 minutes. Court Reporter: Pam Batalo.

Plaintiff Attorney: Lynda Lye, Julia Harumi Mass, Christina Sinha, Ellie Chapman, Phillip Wiese. Defendant Attorney: Steven Meyers.

01/18/2017 01/18/2017
03/13/2017 03/14/2017
03/27/2017 03/29/2017 05/28/2017
05/30/2017 06/08/2017 02/07/2019 02/07/2019 03/26/2019

This is a text only Minute Entry (cl, COURT STAFF) (Date Filed: 12/8/2016) (Entered: 12/08/2016)
130 JOINT CASE MANAGEMENT STATEMENT Further Joint Case Management Statement and [Proposed] Order filed by Wiley Gill. (Lye, Linda) (Filed on 1/18/2017) (Entered: 01/18/2017)
131 CLERK'S NOTICE CONTINUING CASE MANAGEMENT CONFERENCE. Case Management Statement due by 3/16/2017. Initial Case Management Conference previously set for 1/26/2017 Continued to 3/23/2017 at 10:00 AM in Courtroom 3, 17th Floor, San Francisco. (cl, COURT STAFF) (Filed on 1/18/2017) (Entered: 01/18/2017)
132 JOINT CASE MANAGEMENT STATEMENT Further Joint Case Management Statement and [Proposed] Order filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. (Lye, Linda) (Filed on 3/13/2017) (Entered: 03/13/2017)
133 CLERK'S NOTICE RESCHEDULING FURTHER CASE MANAGEMENT CONFERENCE. Case Management Statement due by 4/20/2017. Further Case Management Conference previously set for 3/23/2017 Continued to 4/27/2017 at 10:00 AM in Courtroom 3, 17th Floor, San Francisco. (This is a text−only entry generated by the court. There is no document associated with this entry.) (cl, COURT STAFF) (Filed on 3/14/2017) (Entered: 03/14/2017)
134 ORDER ON CROSS MOTIONS FOR SUMMARY JUDGMENT. Signed by Judge Richard Seeborg on 3/27/17. (cl, COURT STAFF) (Filed on 3/27/2017) (Entered: 03/27/2017)
135 JUDGMENT. Signed by Judge Richard Seeborg on 3/29/17. (cl, COURT STAFF) (Filed on 3/29/2017) (Entered: 03/29/2017)
136 NOTICE OF APPEAL to the 9th Circuit Court of Appeals filed by Aaron Conklin, Wiley Gill, Khaled Ibrahim, James Prigoff, Tariq Razak. Appeal of Order, Terminate Motions 134 , Judgment, Terminated Case 135 (Appeal fee FEE NOT PAID.) ***17−16107*** (Lye, Linda) (Filed on 5/28/2017) Modified on 6/8/2017 (gbaS, COURT STAFF). (Entered: 05/28/2017)
137 USCA Appeal Fees received $ 505.00 receipt number 0971−11430023 re 136 Notice of Appeal, filed by James Prigoff, Aaron Conklin, Khaled Ibrahim, Wiley Gill, Tariq Razak. (gbaS, COURT STAFF) (Filed on 5/30/2017) (Entered: 06/07/2017)
138 USCA Case Number 17−16107 for 136 Notice of Appeal, filed by James Prigoff, Aaron Conklin, Khaled Ibrahim, Wiley Gill, Tariq Razak. (gbaS, COURT STAFF) (Filed on 6/8/2017) (Entered: 06/08/2017)
139 OPINION of USCA as to 136 Notice of Appeal, filed by James Prigoff, Aaron Conklin, Khaled Ibrahim, Wiley Gill, Tariq Razak. (gbaS, COURT STAFF) (Filed on 2/7/2019) (Entered: 02/07/2019)
140 NOTICE of Substitution of Counsel by Shilpi Agarwal (Agarwal, Shilpi) (Filed on 2/7/2019) (Entered: 02/07/2019)
141 MANDATE of USCA as to 136 Notice of Appeal, filed by James Prigoff, Aaron Conklin, Khaled Ibrahim, Wiley Gill, Tariq Razak. (gbaS, COURT STAFF) (Filed on

Case: 3:14-cv-3120 As of: 06/10/2020 09:52 AM PDT 22 of 22 3/26/2019) (Entered: 03/26/2019)