Government Asks for Dismissal of PIA Claim in FirstNet Lawsuit
Thursday, January 25, 2018 | Comments

Attorneys for the U.S. government asked a Vermont district judge to dismiss the remaining claim in a lawsuit over the First Responder Network Authority (FirstNet), arguing that the two men who brought the suit do not have standing for such a claim.

Vermont residents Stephen Whitaker and David Gram sued the Department of Commerce (DOC), which houses FirstNet, last year over what they called unlawful denials of Freedom of Information Act (FOIA) requests and a failure by FirstNet to follow required privacy practices.

In December, Judge Geoffrey Crawford dismissed some of the FOIA claims and ruled in favor of the government on the rest of the FOIA claims. Because the case had been expedited on the basis of the FOIA claims, Crawford did not rule on the privacy issue, saying that the parties had not had adequate time to fully argue that particular issue.

Whitaker and Gram asked Crawford to allow an appeal to the U.S. Court of Appeals for the Second Circuit on the FOIA issues while the privacy portion of the case moves forward. Crawford has not yet ruled on that issue. The government voiced opposition to that request, arguing that the case did not meet the requirements for such a request and that granting the request would lead to an inefficient resolution of the case.

In their original complaint, Gram and Whitaker argued that FirstNet has not performed privacy impact assessments (PIAs), as required by the E-Government Act of 2002. Their complaint focused specifically on FirstNet’s state plan portal, which FirstNet and AT&T used to distribute plans to each state, but also included other FirstNet systems, such as the nationwide broadband network, which could distribute, collect or store personally identifiable information (PII).

Section 208 of the E-Government Act requires a federal agency to perform a PIA if that agency is “developing or procuring information technology that collects, maintains or disseminates information in an identifiable form” or that agency is “initiating a new collection of information that will be collected, maintained or disseminated using information technology” and that the collected information would allow an individual to be contacted in person or online.

One PIA related to FirstNet is available on the DOC website. That PIA covers FirstNet’s general services system (GSS), which provides “network services, e-mail services, file sharing, internet/intranet connectivity, client-server connectivity, web-enabled applications and office automation tools to all FirstNet users.”

In his order, Crawford ruled that because the nationwide broadband network is not yet in existence, it is not “ripe for judicial review” yet. However, Crawford ruled that the state plans portal is ripe for review now and asked the parties to submit briefs on that particular issue.

In its brief, the government argued that Whitaker and Gram do not have standing to bring a privacy claim because they are not individually impacted by the state plans portal.

The only personal information collected for the state plan portals was that of individuals who each state’s single point of contact (SPOC) for FirstNet identified as needing access to the state plan to assist the governor in making the state’s decision to opt in or out of FirstNet.

Because Whitaker’s and Gram’s personal information was not collected for the portal, they cannot be harmed by that collection of information and therefore do not have standing for a claim, the government argued.

Additionally, even if Whitaker and Gram had standing to bring a claim, the state plan portal does not require a PIA, the government said. The collected PII was not collected, stored or distributed over the state plan portal, and it was only collected to allow the necessary individuals access to the portal.

“FirstNet did not collect any information using the state plan portal,” the government’s brief said. “Rather, SPOCs provided user information via email, and FirstNet received this information over its email systems, which were subject of a PIA in accordance with section 208.”

A response brief from Whitaker and Gram is due Feb. 3.

Would you like to comment on this story? Find our comments system below.

Post a comment
Name: *
Email: *
Title: *
Comment: *


No Comments Submitted Yet

Be the first by using the form above to submit a comment!

Site Navigation