American Civil Liberties Union v. Clapper

ROBERT D. SACK, Circuit Judge, concurs in the opinion of the Court and files a separate concurring opinion.

This appeal concerns the legality of the bulk telephone metadata collection program (the “telephone metadata program”), under which the National Security Agency (“NSA”) collects in bulk “on an ongoing daily basis” the metadata associated with telephone calls made by and to Americans, and aggregates those metadata into a repository or data bank that can later be queried. Appellants challenge the program on statutory and constitutional grounds. Because we find that the program exceeds the scope of what Congress has authorized, we vacate the decision below dismissing the complaint without reaching appellants’ constitutional arguments. We affirm the district court’s denial of appellants’ request for a preliminary injunction.

BACKGROUND

In the early 1970s, in a climate not altogether unlike today’s, the intelligence-gathering and surveillance activities of the NSA, the FBI, and the CIA came under public scrutiny. The Supreme Court struck down certain warrantless surveillance procedures that the government had argued were lawful as an exercise of the President’s power to protect national secu*793rity, remarking on “the inherent vagueness of the domestic security concept [and] the necessarily broad and continuing nature of intelligence gathering.” United States v. U.S. Dist. Court for the E. Dist. of Mich. (Keith), 407 U.S. 297, 320, 92 S.Ct. 2125, 32 L.Ed.2d 752 (1972). In response to that decision and to allegations that those agencies were abusing their power in order to’ spy on Americans, the Senate established the Select Committee' to Study Governmental Operations with Respect to Intelligence Activities (the “Church Committee”) to investigate whether the intelligence agencies had engaged in unlawful behavior and whether legislation was necessary to govern their activities. The Church Committee expressed concerns that the privacy rights of U.S. citizens had been violated by activities that had been conducted under the rubric of foreign intelligence collection.

The findings of the Church Committee, along with the Supreme Court’s decision in Keith and the allegations of abuse by the intelligence agencies, prompted Congress in 1978 to enact comprehensive legislation aimed at curtailing abuses and delineating the procedures to be employed in conducting surveillance in foreign intelligence investigations. That legislation, the Foreign Intelligence Surveillance Act of 1978 (“FISA”), Pub.L. No. 95-511, 92 Stat. 1783 (1978) (codified as amended at 50 U.S.C. ,§§ 1801 et seq.), established a special court, the Foreign Intelligence Surveillance Court (“FISC”), to review the government’s applications for orders permitting electronic surveillance. See 50 U.S.C. § 1803. Unlike ordinary Article III courts, the FISC conducts its usually ex parte proceedings in secret; its decisions are not, in the ordinary course, disseminated publicly. Id. § 1803(c).

We are faced today with a controversy similar to that which led to the Keith decision and the enactment of FISA. We must confront the question whether a surveillance program that the government has put in place to protect national security is lawful. That program involves the bulk collection by the government of telephone metadata created by telephone companies in the normal course of their business but now explicitly required by the government to be turned over in bulk on an ongoing basis. As in the 1970s, the revelation of this program has generated considerable public attention and concern about the intrusion of government into private matters. As in that era, as well, the nation faces serious threats to national security, including the threat of foreign-generated acts of terrorism against the United States. Now, as then, Congress is tasked in the first instance with achieving the right balance between these often-competing concerns. To do so, Congress has amended FISA, most significantly, after the terrorist attacks of September 11, 2001, in the PATRIOT Act. See USA PATRIOT ACT of 2001, Pub.L. No. 107-56, 115 Stat. 272 (2001). The government argues that § 215 of that Act authorizes the telephone metadata program. See id. § 215, 115 Stat. at 287 (codified as amended at 50 U.S.C. § 1861).

I. Telephone Metadata

Before proceeding to explore the details of § 215 of the PATRIOT Act, we pause to define “telephone metadata,” in order to clarify the type of information that the government argues § 215 authorizes it to collect in bulk. Unlike what is gleaned from the more traditional investigative practice of wiretapping, telephone metadata do not include the voice content of telephone conversations. Rather, they include details about telephone calls, including, for example, the length of a call, the phone number from which the call was made, and the phone number called. Metadata can *794also reveal the user or device making or receiving a call through unique “identity numbers” associated with the equipment (although the government maintains that the information collected doés not include information about the identities or names of individuals), and provide information about the routing of a call through the telephone network, which can sometimes (although not always) convey information about a caller’s general location. According to the government, the metadata it collects do not include cell site locational information, which provides a more precise indication of a caller’s location than call-routing information does.

That telephone metadata do not directly reveal the content of telephone calls, however, does not vitiate the privacy concerns arising out of the government’s bulk collection of such data. Appellants and amici take pains to emphasize the startling amount of detailed information metadata can reveal — “information that could traditionally only be obtained by examining the contents of communications” and that is therefore “often a proxy for content.” Joint App’x 50 (Declaration of Professor Edward W. Felten). For example, a call to a single-purpose telephone number such as a “hotline” might reveal that an individual is: a victim of domestic violence or rape; a veteran; suffering from an addiction of one type or another; contemplating suicide; or reporting a crime. Metadata can reveal civil, political, or religious affiliations; they can also reveal an individual’s social status, or whether and when he or she is involved in intimate relationships.1

We recognize that metadata exist in more traditional formats, too, and that law enforcement and others have always been able to utilize metadata for investigative purposes. For example, just as telephone metadata may reveal the charitable organizations that an individual supports, observation of the outside of an envelope sent at the end of the year through the United States Postal Service to such an organization might well permit similar inferences, without requiring an examination of the envelope’s contents. But the structured format of telephone and other technology-related metadata, and the vast new technological capacity for large-scale and automated review and analysis, distinguish the type of metadata at issue here from more traditional forms. The more metadata the government collects and analyzes, furthermore, the greater the capacity for such metadata to reveal ever more private and previously unascertainable information about individuals. Finally, as appellants and amici point out, in today’s technologically based world, it is virtually impossible for an ordinary citizen to avoid creating metadata about himself on a regular basis simply by conducting his ordinary affairs.

*795II. Section 215

The original version of § 215, which predated the PATRIOT Act, allowed the Director of the FBI or his designee to obtain orders from the FISC authorizing common carriers, among others, to provide to the government certain business records for the purpose of foreign intelligence and international terrorism investigations where there existed “specific and articulable facts giving reason to believe that the person to whom the records pertain [wa]s a foreign power or an agent of a foreign power.” That provision was enacted in 1998 as an amendment to FISA. See Intelligence Authorization Act for Fiscal Year 1999, Pub.L. No. 105272, § 602, 112 Stat. 2396, 2410-11 (1998). The PATRIOT Act substantially revised § 215 to provide for the production not only of “business records” but also of “any tangible things,” and to eliminate the restrictions on the types of businesses such orders can reach. See USA PATRIOT ACT of 2001, Pub.L. No. 107-56, § 215. As subsequently amended by successor bills to the PATRIOT Act, the current version of § 215 allows the Director of the FBI or his designee to

make an application for an order requiring the production of any tangible things (including books, records, papers, documents, and other items) for an investigation to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism or clandestine intelligence activities.

50 U.S.C. § 1861(a)(1). In its current form, the provision requires such an application to include

a statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation (other than a threat assessment) conducted in accordance with subsection (a)(2) of this section to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism or clandestine intelligence activities.

Id. § 1861(b)(2)(A): Such an order “may only require the production of a tangible thing if such thing can be obtained with a subpoena duces tecum issued by a court of the United States in aid of a grand jury investigation or with any other order issued by a court of the United States directing the production of records or tangible things.” Id. § 1861(c)(2)(D). Finally, the statute requires the Attorney General to “adopt specific minimization procedures governing the retention and dissemination by the [FBI] of any tangible things, or information therein, received by the [FBI] in response to an order under this sub-chapter.” Id. § 1861(g)(1). Because § 215 contained a “sunset” provision from its'inception, originally terminating its authority on December 31, 2005, it has required subsequent renewal. USA PATRIOT Act of 2001, Pub.L. No. 107-56, § 224, 115 Stat. at 295. Congress has renewed § 215 seven times, most recently in 2011, at which time it was amended to expire on June 1, 2015. See PATRIOT Sunsets Extension Act of 2011, Pub.L. No. 112-14, 125 Stat. 216 (2011).

III. The Telephone Metadata Program

Americans first learned about the telephone metadata program that appellants now challenge on June 5, 2013, when the British newspaper The Guardian published a FISC order leaked by former government contractor Edward Snowden. The order directed Verizon Business Network Services, Inc. (“Verizon”), a telephone company, to produce to the NSA “on an ongoing daily basis ... all call detail records or ‘telephony metadata’ created by Verizon for communications (i) between the United States and abroad; or (ii) whol*796ly -within the United States, including local telephone calls.” In re Application of the FBI for an Order Requiring the Prod, of Tangible Things From Verizon Bus. Network Seros., Inc., ex rel. MCI Commc’n Seros., Inc., d/b/a Verizon Bus. Seros. (“Verizon Secondary Order”), No. BR 13-80, slip op. at 2 (F.I.S.C. Apr. 25, 2013). The order thus requires Verizon to produce call detail records, every day, on all telephone calls made through its systems or using its services where one or both ends of the call are located in the United States.

After the order was published, the government acknowledged that it was part of a broader program of bulk collection of telephone metadata from other telecommunications providers carried out pursuant to § 215. It is now undisputed that the government has been collecting telephone metadata information in bulk under § 215 since at least May 2006, when the FISC first authorized it to do so in a “Primary Order” describing the “tangible things” to be produced as “all call-detail records or ‘telephony metadata’ created by [redacted] ..., including] comprehensive communications routing information, including but hot limited to session identifying information (e.g., originating and terminating telephone number[s], communications device identifier[s], etc.), trunk identifier, and time and duration of call.” In re Application of the FBI for an Order Requiring the Prod, of Tangible Things From [Redacted] (“2006 Primary Order”), No. BR 06-05, slip op. at 2 (F.I.S.C. May 24, 2006), http:// www.dni.gov/files/documents/section/pub_ May% 2024% 202006% 20Order% 20from% 20FISC.pdf.

That order specified that the items were to be produced to the NSA; that there were “reasonable grounds to believe the tangible things sought [were] relevant to authorized investigations ... to protect against international terrorism”; and that the items sought “could be obtained with a subpoena duces tecum issued by a court of the United States in aid of a grand jury investigation or with any other order issued by a court of the United States directing the production of records or tangible things.” Id. at 3. The order required its recipient, upon receiving the “appropriate secondary order,”2 to “continue production on an ongoing daily basis ... for the duration of th[e] order” and contemplated creation of a “data archive” that would only be accessed “when NSA has identified a known telephone number for which ... there are facts giving rise to a reasonable, articulable suspicion that the telephone number is associated with [Redacted]” — presumably, with terrorist activity or a specific terrorist organization. Id. at 4-5. The order also states that the NSA “exclusively will operate” the network on which the metadata are stored and processed. Id. at 5.

The government has disclosed additional FISC orders reauthorizing the program. FISC orders must be renewed every 90 days, and the program has therefore been renewed 41 times since May 2006. Most recently, the program was reauthorized by the FISC on February 26, 2015; that authorization expires on June 1, 2015. See In re Application of the FBI for an Order Requiring the Prod, of Tangible Things From [Redacted], No. BR 15-24 (F.I.S.C. Feb. 26, 2015), http://www.dni.gov/files/ documents/0311/BR% 201524% 20Pri-mary% 20Order% 20-% 20Redacted.pdf.

*797The government disputes appellants’ characterization of the program as collecting “virtually all telephony metadata” associated with calls made or received in the United States, but declines to elaborate on the scope of the program or specify how the program falls short of that description. It is unclear, however, in what way appellants’ characterization of the program can be faulted. On its face, the Verizon order requires the production of “all call detail ■records or ‘telephony metadata’ ” relating to Verizon communications within the United States or between the United States and abroad. Verizon Secondary Order 2 (emphasis added). The Verizon order and the Primary Order described above reveal that the metadata collected include “comprehensive communications routing information, including but not limited to session identifying information (e.g., originating and terminating telephone number, International Mobile Subscriber Identity (IMSI) number, International Mobile station Equipment Identity (IMEI) number, etc.), trunk identifier,3 telephone calling card numbers, and time and duration of call.” Verizon Secondary Order 2; see also 2006 Primary Order 2. The government does not suggest that Verizon is the only telephone service provider subject to such an order; indeed, it does not seriously dispute appellants’ contention that all significant service providers in the United States are subject to similar orders.

The government explains that it uses the bulk metadata collected pursuant to these orders by making “queries” using metadata “identifiers” (also referred to as “selectors”), or particular phone numbers that it believes, based on “reasonable articulable suspicion,” to be associated with a foreign terrorist organization. Joint App’x 264 (Declaration of Teresa H. Shea). The identifier is used as a “seed” to search across the government’s database; the search results yield phone numbers, and the metadata associated with them, that have been in contact with the seed. Id. That step is referred to as the first “hop.” The NSA can then also search for the numbers, and associated metadata, that have been in contact with the numbers resulting from the first search — conducting a second “hop.” Id. at 265. Until recently, the program allowed for another iteration of the process, such that a third “hop” could be conducted, sweeping in results that include the metadata of, essentially, the contacts of contacts of contacts of the original “seed.” Id. The government asserts that it does not conduct any general “browsing” of the data. Id. at 263-65.

Section 215 requires that the Attorney General adopt “specific minimization procedures governing the retention and dissemination by the [government] of [information] received ... in response to an order under this subchapter.” 50 U.S.C. § 1861(g)(1). The procedures that have been adopted include the requirement that the NSA store the metadata within secure networks; that the metadata not be accessed for any purpose other than what is allowed under the FISC order; that the results of queries not be disseminated outside the NSA except in accordance with the minimization and dissemination requirements of NSA procedures; and that the relevant personnel receive comprehensive training on the minimization procedures and technical controls. Joint App’x 267-69. And as the government points out, the program is subject to oversight by the Department of Justice, the FISC, and Congress. Id. at 269. The minimization *798procedures require audits and reviews of the program by the NSA’s legal and oversight offices, the Office of the Inspector General, attorneys from the Department of Justice’s National Security Division, and the Office of the Director of National Intelligence. Id. The FISC orders that created the program require the NSA to provide periodic reports to the FISC. Id. at. 141. In the event of failures of compliance, reports must be made to the FISC, and, where those failures are significant, to the Intelligence and Judiciary Committees of both houses of Congress. Id. at 269. FISA itself also imposes a system of Congressional oversight, requiring periodic reports on the program from the Attorney General to the House and Senate Intelligence and Judiciary Committees. See 50 U.S.C. §§ 1862,1871.

Since the existence of the telephone metadata program became public, a number of developments have altered the landscape, at least to some degree, within which we analyze the program. Among the most notable are modifications to the telephone metadata program announced by President Obama in January 2014. President Barack Obama, Remarks by the President on Review of Signals Intelligence (Jan. 17, 2014), http://www. whitehouse.gov/the-press-office/2014/01/17/ remarks-president-review-signalsintelligenee. The two immediate modifications that the President ordered, -which were subsequently incorporated in a FISC order sought by government motion, (1) limited the number of “hops” that can be searched to two, rather than three, and (2) required that a FISC judge find that the reasonable articulable suspicion standard has been satisfied before a seed can be queried, rather than (as had previously been the case) allowing designated NSA officials to determine for themselves whether such suspicion existed. Id. Both limitations were approved by the FISC in a February 5, 2014 FISC order. In re Application of the FBI for an Order Requiring the Prod, of Tangible Things, No. BR14-01 (F.I.S.C. Feb. 5, 2014), http:// www.uscourts.gov/uscourts/courts/fisc/br 14-01-order.pdf. These modifications were based in part on the recommendations of the Review Group on Intelligence and Communications Technologies established by the President. See President’s Review Grp. on Intelligence and Commc’ns Techs., Liberty and Security in a Changing World: Rep. and Recommendations of the President’s Review Grp. on Intelligence and Commc’ns Techs. (Dec. 12, 2013), https:// www.whitehouse.gov/sites/default/files/ docs/201312-12_rg_final_jreport.pdf. The Review Group also recommended that the system be modified such that a third party or the private carriers, rather than the government, collect and retain the bulk metadata. That recommendation, however, has so far not been adopted.

In addition to that group, the Privacy and Civil Liberties Oversight Board (“PCLOB”) published a detailed report on the program. The PCLOB is a bipartisan agency within the executive branch that was established in 2007, pursuant to a recommendation from the National Commission on Terrorist Attacks Upon the United States (the “9/11 Commission,” established after the September 11, 2001 terrorist attacks to prepare an account of 'the circumstances surrounding the attacks), in order to monitor the actions taken by the government to protect the nation from terrorism and to ensure that they are appropriately - balanced against the need to protect privacy and civil liberties. See Implementing Recommendations of the 9/11 Comm’n Act of 2007, Pub.L. No. 110-53, 121 Stat. 266 (2007). The PCLOB concluded that the program was inconsistent with § 215, violated the Electronic Communications Privacy Act, and *799implicated privacy and First Amendment concerns. See Privacy and Civil Liberties Oversight Board, Rep. on the Tel. Records Program Conducted Under Section 215 of the USA PATRIOT Act and on the Operations of the Foreign Intelligence Surveillance Court (Jan. 23, 2014) (“PCLOB Report”), https://www.pclob.gov/library/215 Report_on_the_Telephone_Records_ Program.pdf.

Legislation aimed at incorporating stronger protections of individual liberties into the telephone metadata program in a variety of ways (or eliminating it altogether) was introduced in both the House and the Senate during the 113th Congress. See USA FREEDOM Act, H.R. 3361, 113th Cong. (2014); USA FREEDOM Act, S. 2685, 113th Cong. (2014). A modified version of H.R. 3361, which lost the backing of some of the bill’s original supporters because it failed to end bulk collection, nevertheless passed the House in May 2014. USA FREEDOM Act, H.R. 3361, 113th Cong. (2014). In November 2014, however, a motion to invoke cloture on the Senate’s version of the bill — relatively more robust in terms of privacy protections — failed by a vote of 58^12, thereby preventing the bill from coming up for a vote in the Senate despite the desire of 58 senators to proceed to a vote on the measure. USA FREEDOM Act, S. 2685, 113th Cong. (2014). The current Congress is likewise considering bills aimed at modifying § 215; a bill that would place the bulk metadata collected into the hands of telecommunications providers, to be accessed by the government only with FISC authorization, has been introduced in both the House and the Senate in recent weeks. See USA FREEDOM Act of 2015, H.R. 2048/S. 1123, 114th Cong. (2015). On April 30, 2015, the bill passed the House Judiciary Committee. See USA FREEDOM Act of 2015, H.R. 2048, 114th Cong. (2015). A vote from the full House on the bill is expected later this month.

Finally, the program has come under scrutiny by Article III courts other than the FISC. In addition to this case, similar cases have been filed around the country challenging the government’s bulk collection of telephone metadata. See, e.g., Smith v. Obama, 24 F.Supp.3d 1005 (D.Idaho 2014), No. 14-35555 (9th Cir. argued Dec. 8, 2014); Klayman v. Obama, 957 F.Supp.2d 1 (D.D.C.2013), No. 14-5004 (D.C. Cir. argued Nov. 4, 2014).

IV. Procedural History

On June 11, 2013, the American Civil Liberties Union and American Civil Liberties Union Foundation (collectively, “ACLU”) and the New York Civil Liberties Union and New York Civil Liberties Union Foundation (collectively, “NY-CLU”) — current and former- Verizon customers, respectively — sued the government officials responsible for administering the telephone metadata program, challenging the program on both statutory and constitutional grounds and seeking declaratory and injunctive relief. The complaint asks the court to declare that the telephone metadata program exceeds the authority granted by § 215, and also violates the First and Fourth Amendments to the U.S. Constitution. It asks the court to permanently enjoin defendants from continuing the program, and to order defendants to “purge from their possession all of the call records of [plaintiffs’ communications” collected in accordance with the program. Joint App’x 27.

On August 26, 2013, plaintiffs moved for a preliminary injunction barring defendants from collecting their call records under the program, requiring defendants to quarantine all of the call records they had already collected, and prohibiting de*800fendants from using their records to perform queries on any phone number or other identifier associated with plaintiffs. On the same date, the government moved to dismiss the complaint.

On December 27, 2013, the district court granted the government’s motion to dismiss and denied plaintiffs’ motion for a preliminary injunction. See ACLU v. Clapper, 959 F.Supp.2d 724 (S.D.N.Y. 2013). Plaintiffs now appeal that decision.

DISCUSSION

We review de novo a district court’s grant of a motion to dismiss under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). Klein & Co. Futures, Inc. v. Bd. of Trade of City of New York, 464 F.3d 255, 259 (2d Cir.2006); see also Lotes Co., Ltd. v. Hon Hai Precision Indus. Co., 753 F.3d 395, 403 (2d Cir.2014). We review a district court’s denial of a preliminary injunction for abuse of discretion, see Cent. Rabbinical Cong, of U.S. & Canada v. N.Y.C. Dep’t of Health & Mental Hygiene, 763 F.3d 183, 192 (2d Cir.2014), which occurs when the court’s decision either “rests on an error of law ... or a clearly erroneous factual finding, or ... its decision — though not necessarily the product of a legal error or a clearly erroneous factual finding — cannot be located within the range of permissible decisions,” Vincenty v. Bloomberg, 476 F.3d 74, 83 (2d Cir.2007).

I. Standing

The district court ruled that appellants had standing to bring this case. Clapper, 959 F.Supp.2d at 738. The government argues that the district court’s ruling was erroneous, contending that appellants lack standing because they have not demonstrated that any of the metadata associated with them have been or will be actually reviewed by the government, and have not otherwise identified an injury that is sufficiently concrete or imminent to confer standing. We recognize that “ ‘[n]o principle is more fundamental to the judiciary’s proper role in our system of government than the constitutional limitation of federal-court jurisdiction to actual cases or controversies.’ ” Clapper v. Amnesty Int’l USA,'— U.S.-, 133 S.Ct. 1138, 1146, 185 L.Ed.2d 264 (2013), quoting DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 341, 126 S.Ct. 1854,164 L.Ed.2d 589 (2006) (alteration in original). In order to meet that requirement, plaintiffs must, among other things, establish that they have standing to sue. Raines v. Byrd, 521 U.S. 811, 818, 117 S.Ct. 2312, 138 L.Ed.2d 849 (1997). “Standing under Article III of the Constitution requires that an injury be concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling.” Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139, 149, 130 S.Ct. 2743, 177 L.Ed.2d 461 (2010); see also Amnesty Int’l, 133 S.Ct. at 1147 (collecting cases). The Supreme Court has “repeatedly reiterated that ‘threatened injury must be certainly impending to constitute injury in fact,’ and that ‘[ajllegations of possible future injury5 are not sufficient.” Amnesty Int’l, 133 S.Ct. at 1147, quoting Whitmore v. Arkansas, 495 U.S. 149, 158, 110 S.Ct. 1717, 109 L.Ed.2d 135 (1990) (emphasis in original). We remain mindful that the “ ‘standing inquiry has been especially rigorous when reaching the merits of [a] dispute would force us to decide whether an action taken by one of the other two branches of the Federal Government was unconstitutional’ ” and “in cases in which the Judiciary has been requested to review actions of the political branches in the fields of intelligence gathering and foreign affairs.” Id., quoting Raines, 521 U.S. at 819-20, 117 S.Ct. 2312.

*801Appellants in this case have, despite those substantial hurdles, established standing to sue, as the district court correctly held. Appellants here need not speculate that the government has'collected, or may in the future collect, their call records. To the contrary, the government’s own orders demonstrate that appellants’ call records are indeed among those collected as part of the telephone metadata program. Nor has the government disputed that claim. It argues instead that any alleged injuries here depend on the government’s reviewing the information collected, and that appellants have not shown anything more than a “speculative prospect that their telephone numbers would ever be used as a seléctor to query, or be included in the results of queries of, the telephony metadata.” Appellees’ Br. 22.

But the government’s argument misapprehends what is required to establish standing in a case such as this one. Appellants challenge the telephone meta-data program as a whole, alleging injury from the very collection of their telephone metadata. And, as the district court observed, it is not disputed that the government collected telephone metadata associated with the appellants’ telephone calls. The Fourth Amendment protects against unreasonable searches and seizures. Appellants contend that the collection of their metadata exceeds the scope of what is authorized by § 215 and constitutes a Fourth Amendment search. We think such collection is more appropriately challenged, at least from a standing perspective, as a seizure rather than as a search. Whether or not such claims prevail on the merits, appellants surely have standing to allege injury from the collection, and maintenance in a government database, of records relating to them. “[A] violation of the [Fourth] Amendment is fully accomplished at the time of an unreasonable governmental intrusion.” United States v. Verdugo-Urquidez, 494 U.S. 259, 264, 110 S.Ct. 1056,108 L.Ed.2d 222 (1990) (internal quotation marks omitted). If the telephone metadata program is unlawful, appellants have suffered a concrete and particularized injury fairly traceable to the challenged program and redressable by a favorable ruling.

Amnesty International does not hold otherwise. There, the Supreme Court, reversing our decision, held that respondents had not established standing because they could not show that the government was surveilling them, or that such surveillance was “certainly impending.” 131 S.Ct. at 1148-1150. Instead, the Supreme Court stated that respondents’ standing arguments were based on a “speculative chain of possibilities” that required that: respondents’ foreign contacts be targeted for surveillance; the surveillance be conducted pursuant to the statute challenged, rather than under some other authority; the FISC approve the surveillance; the government actually intercept the communications of the foreign contacts; and among those intercepted communications be those involving respondents. Id. Because respondents’ injury relied on that chain of events actually transpiring, the Court held that the alleged injury was not “fairly traceable” to the statute being challenged. Id. at 1150. As to costs incurred by respondents to avoid surveillance, the Court characterized those costs as “a product of their fear of surveillance” insufficient to confer standing. Id. at 1152.

Here, appellants’ alleged injury requires no speculation whatsoever as to how events will unfold under § 215 — appellants’ records (among those of numerous others) have been targeted for seizure by the government; the government has used the challenged statute to effect that seizure; the orders have been approved *802by the FISC; and the records have been collected. Amnesty International’s “speculative chain of possibilities” is, in this context, a reality. That case in no way suggested that such data would need to be reviewed or analyzed in order for respondents to suffer injury.

The government also takes issue with the district court’s reliance on Amidax Trading Group v. S.W.LF.T. SCRL, 671 F.3d 140 (2d Cir.2011). In Amidax, we held that plaintiffs had not established standing to challenge the government’s acquisition of financial records from SWIFT, a messaging service that routes financial transactions, via administrative subpoenas issued by the Office of Foreign Asset Control. Id. at 148-49. Because there was insufficient support for the allegation that Amidax’s own records were among those handed over to the government, we held that Amidax had not alleged a plausible injury in fact. Id. That case, too, differs from the case at bar, where appellants have presented evidence that their data are being collected. To the extent Amidax speaks to the circumstances presented by this case, it supports, albeit in dictum, appellants’ position. We noted in Amidax that “[t]o establish an injury in fact — and thus, a personal stake in this litigation— [Amidax] need only establish that its information was obtained by the government.” Id. at 147 (second alteration in original). There, too, we viewed the collection of the data in question, if it had in fact occurred, as an injury sufficient to confer standing, without considering whether such data were likely to be reviewed.

Finally, the government admits that, when it queries its database, its computers search all of the material stored in the database in order to identify records that match the search term. In doing so, it necessarily searches appellants’ records electronically, even if such a search does not return appellants’ records for close review by a human agent. There is no question that an equivalent manual review of the records, in search of connections to a suspect person or telephone, would confer standing even on the .government’s analysis. That the search is conducted by a machine might lessen the intrusion, but does not deprive appellants of standing to object to the collection and review of their data.

Appellants likewise have standing to assert a First Amendment violation. Appellants contend that their First Amendment associational rights are being -violated, both directly and through a “chilling effect” on clients and donors. The Supreme Court has long recognized that an organization can assert associational privacy rights on behalf of its members, stating that “[i]t is hardly a novel perception that compelled disclosure of affiliation with groups engaged in advocacy may constitute ... a restraint on freedom of association.” NAACP v. Alabama, 357 U.S. 449, 462, 78 S.Ct. 1163, 2 L.Ed.2d 1488 (1958). In NAACP, furthermore, the Supreme Court held that the organization “argue[d] ... appropriately the rights of its members, and that its nexus with them [wa]s sufficient to permit that it act as their representative before this Court.” Id. at 458-59, 78 S.Ct. 1163. We have similarly stated that a union’s “standing to assert the First and Fourteenth Amendment rights of association and privacy of its individual members is beyond dispute.” Local 1814, Int’l Longshoremen’s Ass’n v. Waterfront Comm’n of N.Y. Harbor, 667 F.2d 267, 270 (2d Cir.1981). When the government collects appellants’ metadata, appellants’ members’ interests in keeping their associations and contacts private are implicated, and any potential “chilling effect” is created at that point. Appellants have therefore alleged a concrete, fairly traceable, and redressable injury sufficient *803to confer standing to assert their First Amendment claims as well.

II. Preclusion and the Administrative Procedure Act

The government next contends that appellants are impliedly precluded from bringing suit to challenge the telephone metadata program on statutory grounds. According to the government, the statutory scheme set out by § 215 limits judicial review of § 215 orders “to the FISC and its specialized mechanism for appellate review,” Appellees’ Br. 26, and provides for challenges to those orders only by recipients of § 215 orders (that is, the communications companies), rather than the targets of such orders, thereby impliedly precluding appellants here from bringing suit in federal court. The government also argues that 18 U.S.C. § 2712 impliedly precludes the relief appellants seek, either independently or in conjunction with the larger statutory framework established by the two provisions.

A. Section 215 and Implied Preclusion

The Administrative Procedure Act (“APA”) waives sovéreign immunity for suits against the United States for relief other than money damages. Under the APA, “[a] person suffering legal wrong because of agency action, or adversely affected or aggrieved by agency action within the meaning of a relevant statute, is entitled to judicial review thereof,” and can bring suit in an “action in a court of the United States seeking relief other than money damages.” 5 U.S.C. § 702. The APA thus establishes a broad right of judicial review of administrative action. The APA does not, however, apply where “statutes preclude judicial review.” Id. § 701.

In determining whether judi