[SCHEDULED FOR ORAL ARGUMENT ON SEPTEMBER 14, 2004] NOS. 03-5262, 04-5084 IN THE UNITED STATES COURT OF APPEALS FOR THE DISTRICT OF COLUMBIA CIRCUIT ELOUISE PEPION COBELL, et al., Plaintiffs-Appellees, Defendants-Appellants. v. GALE A. NORTON, SECRETARY OF THE INTERIOR, et al., ON APPEAL FROM THE UNITED STATES DISTRICT COURT PETER D. KEISLER stant w n e v General, GREGORY G. KATSAS Pf-UtY Ass istant Attorney Gener al. ROBERT E. KOPP LEWIS S. YELIN TARA L. GROVE: (292) 514-5089 Attornevs. AmellaL&Staf f P P .[ "- c ............... - - - - - . - . . _. . - . _ 2. The District Court Would, In Any Event, Lack Jurisdiction To Oversee IT I. THE INJUNCTIONS ARE WITHOUT LEGAL BASIS . . . . . . . . . . . . 5 A. The IT Security Injunctions Are 1. The Injunctions Must Be Vacated Because The Record Makes Clear That Interior Has Aggressively n Security ................................. 6 B. Pub. L. No. 108-108 Removes Any Possible Legal Basis For the Court's Injunctions . . . . . . 13 11. THE INJUNCTIONS ARE WITHOUT FACTUAL PREDICATE . . . . . 18 Thn nnlv R o l avant Uar-t -I74 ndi nua P T P P ~ ride L U securicy N c n i e v e m e n c s ........................ C. The 2001 TRO And Consent Order Provide No Support For The Present Injunctions . . . . . . . . . . 22 r. h 3 a, j., r* . ' * f . r 1 Injunctions By Making Factual Assertions Without Record Citations ..................... T T T THE RATANCE OF HARMS AND THE PUBLIC INTEREST CERTIFICATE OF COMPLIANCE CERTIFICATE OF SERVICE 29 ;I.- ;&:' ;* P ! -4% (D.D.C. 1999) ............................................ 15 Cobell v. Babbitt, 91 F.Supp. 2d 1 \u.u.c. LUW3) ............................... 3 , 19, .LY, L3 Cobell v. Norton, 334 F.3d 1128 ( D . C . Cir. 2003) ........... 5 ~ ~ _ _ _ _ _ _ 497 U.S. 871 (1990) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-9 Lvon v. Aqusta SPA, 252 F . 3 d 1078 (9th Cir. 2001) . . . . . . . . . . 18 4Y6 U . S . 414 ( I Y Y U ) ...................................... Y Robertson v. Seattle Audubon Soc'v, :17, 18 503 U.S. 429 (1992) ................................ United States v. White Mountain Apache Tribe, 10 5 3 7 U . S . 4 6 5 (2003) .................................... * Authorities c h i e f l y relied upon are marked with an asteriek. a <+A 3 , *Pub. L. NO. 108-108 ................................. 2, 13-18 I IN THE UNITED STATES COURT OF APPEALS FOR THE DISTHICT OF COLUMBIA CIRCUIT NOS. 03-5262, 04-5084 ELOUISE PEPION COBELL, et al., Plaintiffs-Appellees, v. GALE A. NORTON, SECRETARY OF THE INTERIOR, et al., Defendants-Appellants. FOR THE DISTRICT OF COLUMBIA ON APPEAL FROM THE UNITED STATES DISTRICT COURT REPLY BRIEF FOR THE APPELLANTS 3 INTRODUCTION AND SUMMARY In this action to compel performance of the accounting required by the 1994 Act, the district court has asserted control over Interior's computer systems and has severed its electronic links to the public! government contractors, state governments and other federal agencies. Plaintiffs supply neither a legal foundation nor a factual predicate for these orders. I. I n 2001, this Court concluded that the gavernment had unreasonably delayed in the performance of the accounting required by the 1994 Act and affirmed the district court's continuing jurisdiction for a five-year period, That jurisdiction, as t h i s Court made clear, was limited to -I s ". ucLc:L A*&-->-: tttl1llily whether the government was engaging in further unreasonable delay. Thus, IT security questions could fall xithin the district court:s jurisdiction, if ac aii, oniy to the extent they bear upon unreasonable delay in the performance of LL - - L - L _ _ L ---.- LIE a ~ a ~ u ~ u r y accounting. Plaintiffs are at pains to disclaim any connection between Ll- ~ I l t : present injunctions and the performance of an accounting, and they are surely correct: the district court had no authority to extend its jurisdiction to encompass IT security. Even more clearly, the court cannot assert authority over issues of iT security when the basis for its limited continuing jurisdiction has ceased to exist. As we show in our briefs in the structural injunction appeal, No. 03-5314, since Secretary Norton assumed office in 2001, Interior has committed itself to meeting this Court's mandate. There can be no question of unreasonable delay in the period since this Court's initial decision, and the justification for the court's original retention of jurisdiction has disappeared. Contrary to the implicit premise of plaintiffs' argument', the district court has no independent jurisdiction to address all matters related to trust management. Plaintiffs' insistence that the injunctions at issue bear no relation to the statutory accounting is, at least in part, a response to Pub. L. 108-108, which removes any legal basis for 2 .s, $& S b 1 I&. + : i?. i” * i r - # 3”. -T fj 6% -’\ if; ‘46% __ *: I . 1 . connection between tne inlunctions ana an accounting, congress presumably was aware when it enacted the legislation that the - - _ . - . - . . I - . - - the performance of an accounting. That some of the relief absence of any connection between the injunction and the accounting, the district court has itself taken a contrary injunction that requires an executive agency to sever its - . Court had made clear that the only aCtlOnable duty at issue was communications links. Under no circumstances could the court underlie the injunctions, reversal would be required because they factual showing, much less the showing of are unsupported by executive department. d . I . a* I 2' ,.a')* The district court conducted no meaningful evidentiary hearing on the issue of IT security. No evidence exists that any plaintiff has experienced harm as a result of alleged defects, and the only person known to have hacked into Interior's systems is the court's own Special Master. In issuing its July 2003 injunction, the court specifically found that plaintiffs had demonstrated a security threat from unauthorized internet access. Cobell, v. Norton, 274 F. Supp. 2d ! 111, 132 (D.D.C. 2003). That finding alone should have been dispositive of plaintiffs' claims. The court at no point considered the current state of IT security. Indeed, it dismissed the voluminous evidence submitted by Interior at the court's request on the ground that the agency's declarations were procedurally invalid. Plaintiffs offer no substantial defense of the court's ruling that Interior's declarations were improper, and they cite no evidence of present defects in IT security. Instead, they rely on outdated or inapposite reports, coupled with generalized and wholly unsupported allegations. And, plaintiffs completely ignore the enormous harm that the injunctions would inflict on Interior's operations and the public. For these reasons, the court's orders must be vacated and its oversight of IT security terminated. 4 ,? F@ ? \%Hj 1. 1% f. t ' dr-* 1y -- , --."b.: Judicial Review And This Court's 2001 Decision. 1. The Iniunctione Must Be Vacated ~ U A U ~ A - L - ~ U U uLaLuLury nccounung. The district court's 1999 declaratory judgment provided for r . r - . 2 ---- 2 - 3 2 -I ' - - - 2 - - L U L L A ~ L uc=r;+sIun 11rnlr;ea m e aistrict court's jurisdiction to detecting clear evidence of further unreasonable delay in the - ---,= -. - - r . . securicy issues could be relevant, if at all, only to the extent they provided clear evidence of continued unreasonable delay in the performance of the accounting. As discussed in our briefs in the structural injunction appeal, No. 03-5314, the record since this Court's initial decision and Secretary Norton's assumption of office in January 2001 makes clear that there has been no such unreasonable delay. As this Court held, it was evident even at the time of the contempt trial that Interior had made significant strides in completing an accounting. Cobell v. Norton, 334 F.3d 1128, 11148 5 e P L li r- 3 . f I* d la. ..k. $ ' !w b " 1 - t : n* h, ~ UIIU wur-Lcu I-' LIV. p L u u u L L A v i 1 WL a piail LUL U J - J J A L - ~ , ucLauac LIICLC: IS IIU eviaence LO . 1 f --A -- L - - J - I - ~ ~ ~ U c p C L ~ u e ~ l L ~ u ~ ~ s u ~ c c ~ o n LO airecr; a range of trust uurvurrb~, IT Security. --=...---- completing land-based accounts that would accomplish the ..- ..- Y b I V w support a finding of unreasonable delay with respect to the ~ ~ ~ f f i r m a m ~ ~ .-.F 3n -.m--.....t:-- matters, including I T security, t h a t operates without respect to Plaintiffs seek to sustain the injunctions on the theory in doing so, i t could declare and enforce trust obligations without regard to the provisions of any statute or the that it reflects. A court cannot properly arrogate to itself the power to oversee programmatic change and the day-to-day operations of executive agencies. These agencies are responsible, under the President's direction, for implementation of the laws, and are accountable to Congress for the expenditure of appropriated funds . The iimitatlons on judicial review established by the APA . .W' ensure that judicial and executive branch functions are not I biurred. In appropriate circumstances, a court may compel an agency to take action that, once taken, would be final agency action. It cannot, however, control the processes by which the agency meets its obligation to complete that action. Further review must await final agency action. See 5 U.S.C. 704. Thus, as this Court explained in 2001, whereas an agency's llsingle step or measure is reviewable, an on-going program or policy is not, in itself, a 'final agency action' under the RPA." 240 F.3d at 1095. That is why, as this Court declared, a plaintiff cannot "'seek wholesale improvement of [a] program by court decree, rather than in the offices of the Department [olf the Interior] or the halls of Congress, where programmatic improvements are normally made.'" Ibid. (quoting Luian v. National Wildlife Fed'rl, 497 U.S. 871, 891 (1990)). Plaintiffs appear to recognize that these precepts would generally preclude the judicial role assumed in this case. They 7 assert, however, that these "run-of-the-mill principles of administrative law" are not applicable because "[tlhis is a trust case, not a routine administrative law case," P1.Br. 29, and that Luian is P1.Br. 30. They can do so only by ignoring this Court's explicit pronouncement to the contrary. Plaintiffs' argument reflects their inability to distinguish between the nature of the suit considered by this Court in 2001 and the very different action that it has now become. This Court , was vigilant to examine the limits of its jurisdiction, but concluded that a suit to compel a particular agency action could proceed without enmeshing a court in a project of wholesale reform. The Court's rejection of the position now espoused by w+ a. -t_ ,.. - * plaintiffs was unambiguous. Indeed, the "wholesale reform" repudiated in Luian is directly analogous to plaintiffs' present effort. In Luian, Interior had implemented statutory directives pertaining to the withdrawal of federal lands from private use (such as mining). 497 U.S. at 875-79. Plaintiff purported to challenge the entirety of the "land withdrawal review program," that is, ('the continuing (and thus constantly changing) operations of the [Bureau of Land Management] in reviewing withdrawal revocation applications and the classification of public lands and developing land use plans as required by [statute]." - Id. at 890. The Court declared it "impossible" to bring such a challenge 8 L that "violation of the law1' was "rampant within this prograim. It plaintiff] must direct its attack against sorhe particular 'agency action' that causes it harm.;; ibid. The attempt to exercise control over all aspects of the Indian trusts represents a particuiariy striking departure from settled law insofar as the court purported to identify and enforce obligations without connection to any statute. Apart from claims arising directly under the Constitution, it is for ' c If.'* i a. Congress to determine what actions may be brought against the federal government that will require payment from the fisc. Office of Personnel Mqmt. v. Richmond, 496 U.S. 414, 424 (1990) ("no money can be paid out of the Treasury unless it has been 9 b; .. rr Y appropriated by an act of Congress") (quotation marks and citation omitted). "The command of the [Appropriations] Clause is not limited to the relief available in a judicial proceeding seeking payment of public funds." a. at 425. Consistent with that bedrock principle, the Supreme Court has made clear that actions seeking enforcement of Indian trust obligations cannot be premised solely on the basis of a trust relationship. Congress acts against a background of trust principles which may inform the interpretation of a statute, But an actionable breach must be premised on a provision of substantive law. That is the teaching of United States v. Mitchelh, 445 U.S. 535 (1980) (Mitchell I), and its progeny., The Court has stressed that to state a claim for breach of an Indian trust, a beneficiary must "identify a substantive source of law that establishes specific fiduciary o r other duties[.]" United States v. Navajo Nation, 537 U.S. 488, 506 (2003). The General Allotment Act of 1887, the Court made clear, created no such enforceable trust management obligations. See id. at 503-04 (describing the holding of Mitchell I); see also United States v. White Mountain ADache Tribe, 537 U.S. 465, 473 (2003) (same). Plaintiffs vigorously disclaim any connection between the injunctions they seek to defend and the 1994 Act, but cite no other statute as an alternative source of the duty at issue. 10 I . 1 4 _-. r" n Even if the Supreme Court had not foreclosed plaintifffs' argument, t h e i r attempt to create enforceable trust obligat.ions trusts and the IIM trusts, and, in particular, the fact that the expenditures they seek to compel come entirely from appropriated how common law principles could require a trustee t o spend millions of dollars of its own money to improve its security result of the asserted deficiencies. Plaintiffs' attempted reliance on this Court's initial litigation. Moreover, t h e Court confirmed that, under the APA, a plaintiff seeking to compel agency action unreasonably delayed observed, when the agency is under such an unequivocal statutory duty, 1lfaj.lure 50 to act constitutes, iil effect, an affirmatiTwre act that triggers 'final agency action' review." Ibid. plaintiffs nevertneiess urge t h a t observations in the Court's 2001 opinion that the 1994 Act reflected preexisting trust duties (P1.Br. 31-323 implicitly permit p l i i i i i t i f f a to press claims without any statutory anchor. This Court explained that interpretation of statutory terms is informed by commofi lay t r i r s t I principles. See 240 F.3d 1099. Thus, the Court looked to such principles in construing the requirement, set out in the i994 Act, that the Secretary "account for" the balances in the IIM accounts. Likewise, the Court concluded t n a t the reasonableness of the government's response in implementing that accounting requirement should take into consideration the governmentis preexisting trust responsibilities and should not be measured solely on the basis of a foreshortened time frame commencing in 1994. But the Court did not suggest that general fiduciary ''p c c 4 responsibilities could be enforced in the absence of any connection to a specific statutory command. Indeed, the Court distinguished between an action to compel a statutory accounting arid attempts to assert control over subsidiary aspects of the agency's activity, noting that a "failure to implement a computer system" is not itself an actionable breach. Id. at 1105. 12 In the injunctions on review, the district court not only addressed matters outside the scope of its authority but compounded its intrusion into the affairs of a coordinate branch by ordering Interior to disconnect its communications links. plaintiffs offer no authority whatsoever for this unprecedented relief against an executive agency or, for that matter, against a private trustee. Under no circumstance could a court direct the agency to disable vital communications. B. Pub. L. No. 108-108 Removes Any Possible Legal Basis For the Court's Injunctions. As shown, the injunctions are without legal hasic: eve= apart from the enactment of Pub. L. 108-108, which provides that no provision of law "shall be construed or applied to r e q c i r e the Department of the Interior to commence or continue historical accounting activities with respect to the Individual ~ x d i a f i ~oi;ey Trust," absent new legislation or expiration of the statute on LUG December 31, 2004. 117 Stat. 1241, 12G3.1 r r h - ---- r r e w DLaLuLe - L - L - - L - Plaintiffs colorfully refer to this enactment as the IIM; Am; rrht D; Aa-ll L . , l u A A l y l l L A L A U c L ucLausc LA---.-- it was introduced by the Conference Committee. As noted in our brief in No. 03-5314, plaintiffs; neglect to mention that the House and Senate submitted their versions of the Interior appropriations bill before the court issued its Septeii-her 25, 2003 structural injunction. 13 L . ,- z 1. Pub, L , No- 108-108 Applies To The Injunctions. Plaintiffs urge that Pub. L. 108-108 is inapplicable to the IT security injunctions because the legislation was intended solely to remove the requirement to conduct "historical accounting activities," and t h u s does not affect "the portion of the case involving trust management and prospective institutional trust reform. ,P1 .Br. 3 3 - 3 4 . This characterization runs headlong into the district court's own view of the matter. In issuing the March 15, 2004 disconnection order, the court stated that "Interior's obligation to maintain and preserve individual trust data" - the sole basis for the court's oversight of IT security - is Ira corollary" to Interior's duties to provide an accounting under the 1994 Act. JA 4 7 8 . Although the court concluded that its injunction would in any event be an appropriate remedy for alleged breaches of "present trust obligations,1t JA 502 n.27, it did not abandon the view set out in the July 28, 2003 injunction that the alteration or destruction of trust data llwould necessarily further render any accounting of the individual Indian trust inaccurate and imprecise, and therefore inadequate." 274 F. Supp. 2d at 129- In any event, when Congress enacted Pub. L. 108-108, it was 3 3 . presumably aware that the district court, in issuing its 19913 declaratory judgment, had dismissed plaintiffs' common-law claims 1 4 ''with prejudice," Cobell v. Babbitt, 91 F. Supp. 2d 1: 58 (D.D.C. at 3 0 , 1999), and rejected plaintiffs' contention that they "may simply claim that they are the beneficiaries of a trust relationship with the United States and therefore invoke all of the rights that a common-law trust entails." Id. at 2 9 . The court observed that ~~[wlhatever the scope of the government's legal duties under the IIM trust, the source is statutory law.'' Congress was also presumably aware that this Court's 2001 opinion failure to provide an accounting, 240 F.3d at 1106, and that it distinction, ibid. The new legislation applies to a l l relief _ _ _ _ _ _ i s s i i e d in cnnnection with the claim f ~ r t h e acccunting, %hi& is the sole claim remaining in this suit, and does not cease to have the first place. review cannot plausibly be regarded as an aspect of the duty to perfcrm ari accounting, the goveriliiieiit is in f u i i agreement. Nevertheless, their attempt to remove this aspect of the case -G +-LA Frnm 4-La -"--a L A W I L L L A A G ULWYG UL '-LAC r L & L L . ' a L . ' ;mm,,t legislation is unavailing. The irony of plaintiffs' argument is evident. To avoid the " L -6 D..L T U U . U. T :08-:GEj, plaintiffs are obliged to disown any connection between the statutory accounting and IT security. In 15 P -: t B CX. '.I." h I , ,. a* .'- P.' $ -y- ._ 1 - .* f, sx. a ,:? I! a- !",% 4- c %.. so doinq, thev only underscore the absence of any leqal basis for - inapplicable "because the IT injunctions do not require the expenditure of federal funds" to conduct an accountinq. P1.Br. the agency's communication links, and, indeed, Interior has spent -.+-a1 i m i n5v-r i r n 4 3 . m - t 4 -n enormous s u m s to do so. See. e m u . . J A 1811-12 ( N o r t o n D e c l . ) : LTA and continuing judicial monitoring of reconnected systems c o n t e m n l a t e r 3 i n the r n i i r t ' n nrrlers. ,TA 5119-17. w n i i l d iindniiht-dlv Plaintiffs also contend (P1.Br. 35) that Pub. L. 108-108 "plays no role in this appeal," because the July 2003 injunction was in effect at the time the statute was passed, and that - i n + i i n m t - i m n ~ . r = e m r \ t - a m t < - m a A h ~ r m-ma ;- t h e a t - t . . t e ~ ~ ~ t a v t _- & . w v b $ & w + & & v V a \F111CZ11 t U Y . Y . I V U - I V U W U L 3 C I A U L L C U J L A A C U L J L L l b L &&A court was considering Interior's security certifications, and the court's more recent, across-the-board disconnection order was not issued until March 15, 2004, when it entered the second ...: el, -- --: -- --e: -- L- cL- - - - L 1 -- t ** .-.. 'c* :- II 1 ..I& 11 .E. ? I *? , L.. r"' an unconstitutional lllegislative stay" and an impermissible taking of property without due process of law, Both arguments are meritless. In enacting Pub. L. 108-108, Congress amended the substantive law that provided the basis f o r this SlJlt. see; e.q., First Gibraltar Bank, FSB v. Morales, 42 F.3d 895, 900 (5th Cir. 1995) ("numerous statutory schemes use the language 'shall be construed' to describe the limitations and boundaries of a A V I I Y fin- m p - - l i - p LIILCIUULF- congressional delegation of authority" ) , Plaintiffs concede, as they must, that Congress can amend a m -pp&wy-'L sijbst-nti~~~e law prespecti~jely, eTVren in U I I =nnvnnvi A- =ti of limited duration and even when the law applies to a specific case. P I . & . 41. As they acknewleckje, the appropriations measure sustained in Robertson v. Seattle Audubon Soc'v, 503 U.S. ,l--A-L- ---A- ml-- 429 (19921, reflected both of these features. lllr 1vuLL11we:yL Timber Compromise a t issue in Robertson was an appropriations -^-I..-- i i i e a a u L e : t h a t expired by i t s terms at the end of the fiscal year, and that was enacted to resolve two pending lawsuits in which injunctions had already been entered. &g id. at 432-33. 'lne -. measure provided that Congress lldetermines and directs that" the actions already taken by the government constituted "adequate consideration for the purpose of meeting the statutory requirements that are t h e basis for t h e consolidated cases" cited in the legislation. Id. at 434-35. 17 +i& _.- ,*I % ' P :-* i ?a* ' ., The Supreme Court rejected the contention that the Northwest Plaintiffs alternatively suggest that Pub. L. No. 108-1.08 deprives them "of their vested property interests," thus which "may be altered according to subsequent changes in the law." Miller v. French, 530 U . S . 3 2 7 , 347 (2000). The be claimed here) does not vest until it has been reduced to an unreviewable final judgment. &e, e.s., Lvon v. Aqusta SPA, 252 ~ - removes any legal basis for the injunctions. 11. THE INJUNCTIONS ARE WITHOUT FACTUAL PREDICATE- on "findings of fact," P1.Br. 16, the district court conducted virtually no evidentiary proceedings on the issue of IT security. :&. :.a, -*.- .,Y 1' IP "% h I a .& . **.r L* p7 .ti ? -- u 1 7.q- .8u g ,ip* u a . & A ~ A . b b-LUYY L L L b L L Y J b L L L U U YULLGIGU L L L J U & y A.U L & ~ V C . L LVUIIU C I A U C T t n c r ~ r c l r f n 7 r n r ; l t h a t 2 crinrrln mlaaa-mnmknr hat4 aqiFGawclA 4n-iitw-cr UY a result of a security defect.3 Ix issuing its July 28, 2003 ixjunction, the cor;rt ixade ilo factual findings regarding alleged inadequacies in IT security. In a staternext igmrec! by plaintiffs, the cotlrt exprzasly recognized that "plaintiffs have not demonstrated to the --*-L--- 4-hn ...n--........--b-A 4-L-b --- --L LUG L~LUIALICLLGU -ULIULULCIUAL J~DL==IIIJ c u t : lly~ n G 4-kr. flh..*C V L LUG LUULL LILUL presently secure from unauthorized internet access.l1 274 F. a=t:aF?"t;n- El...- uupp. L u ?;I a L -4- I J L . q 3 - l AS difi~iissed iii ~ i i r opening brief, that conclusion should have been dispositive of plaintiffs' claims. 522 G o v t . I3r. 3-7-38. The March 15, 2004 injunction generally required internet disconnection with respect to ail of interior's computer systems, whether or not a particular system housed or provided access to individual Indian trust data. ,JA 507-iZ. NO new evldence supported that action, and the court did not suggest that p - - l - L . E c p r . _ . - - - ~ . 7 only new evidence before it, the declarations provided by Interior. The court issued its injunction on the basis that the For the record, we note that plaintiffs represent that the class includes " a l l original allottees," P1.Br. i n.1, but the class that was certified (over the government's objection) was defined solely in terms of IIM account holders. D k t . 27, at 2-3. 19 I - i 4 "under penalty of Deriurv that the foreuoina is true and corrwt .- B. = * s . 1. The Record Aaq?ly Demonstrates Interior's IT Security Achievements. fact, secure." P1.Br. 16. It is unclear whether plaintiffs have reviewed our opening brief. See Govt. Br. 31-37. response to the courtis July 28, 2003 order. At the same time, however, they make no serious attempt to refute the showing in r a r ~ ~ ~IU LLQLLIVI~ u y auyyesc~ng tnat tne court also found the government's showing to be I1substantivelytt deficient. See P1.Br. 26. As plaintiffs effectively concede, the district court undertook no real substantive assessment of - ~ - - - z - - rrnn- I - n..-..-L - . . _ _ P1.Br. 2 6 - 2 8 . 4 - L U I I A b A L L ~ +ha rr,.Tr.awnma.-.~ y u w r A r LL)/UI.L..J c I II D - .. . . - -. railutu 1 1 1 I c l L t : L U U 3 . a J N 4t34, 4 Y 3 - 5 U U . However, as our opening brief demonstrated (at 41-43), and as detailed again below, the cited reports lend no support to the proposition that the integrity of IITD is at risk from --A - - - - , - - . . t L - . . . 4 : - L - - - - l c ". ..m .... P P 3 4% ~n any event; plaintiffs do not dispute that Interior submitted 900 pages - consisting of twelve declarations by agency officials and sigrned under penalty of perjury - detailing the substantial steps taken t o date with respect to computer security. See JA 924-1790 (8/11/03 Certifications). The filing demonstrated t h a t Interior has implemented, among other measure^.^ perimeter scanning regimens: multiple internal and external firewalls, router protections, advanced aDMZ1t technology, enhanced physical access controls, and stringent password protocols. See, e.s., JA 1486-1579 (MMS Certification). In cnnnectinn with these efforts, Interior explained that it has expended millions of dollars on security improvements, and that 4." t haa a*-" U I Y V a1 an cnntvantad " V I I I L U U I I U w i t h -"U-Jf-"-."'- maxiim.i~e .. ..I*. iniianendent experts tn results. See, e.s., JA 1536-37; see generally JA 924-1790 :mrr*n-remarrta ... ;tL .Pnarrar.t tn T T ( 8 /I 1 / o 3 Cert i ficatiGxs) . Nor do plaintiffs acknowledge, much less seek to refute, our n..,,,-t -r-4---:--1- -LA...:.-.- +-I.,& u u v ~ . L J L . ~ q - 3 0 . AS u u L A i i i e u A i l A i i L e l i u i .s DLxLeeiiLii Quarterly Report, Interior has now "installed additional systems, reconfigured systems, and intrusion updated security patches, scanned networks for vulnerabilities, updated password procedures and provided computer security training in an effort t o reduce further the potential risk to 21 P --- L P 2. e IITD associated with the potential threat, of unauthorized l ~ ~ ~ a g from the Internet." JA 622 (Sixteenth Quarterly Report at 5) ; see also JA 694-98 (Seventeenth Quarterly Report at 5-9). Significantly, the record shows that, against this backdrop, for our perimeter security at the Department overall." JA 841 !Tentimnrry of James A . Casor? at Phase 1.5 Triall.5 C. The 2001 TRO And Consent Order Provide No Support For The Present Injunctions. In the absence of record evidence, plaintiffs seek to justify the present injunctions by reference to the 2001 TRO and subsequent consent order. In particular, plaintiffs repeatedly quote the provision of the December 17, 2001 consent order stating that ttInterior Defendants recognize significant deficiencies in the security of information technology systems protecting individual Indian trust data. Correcting these deficiencies merits Interior Defendants' immediate attention.Il JA 412. &e, e.q., P1.Br. 1. Interior's 2001 declaration that it should devote immediate attention to improving security was not a statement that Plaintiffs' assertion that Interior's August 2003 showing was "unable to identify with any precision which systems or computers even housed or accessed the Trust Data," Pi.Br. 6, is difficult to comprehend. The declaration of Associate Deputy Secretary Cason and accompanying declarations of component officials expressly articulated which parts of the agency have IITD and which parts do noc. &e, e . s . , JA 931 (Cason Decl.). 2 2 ,*. . " Lr ! i *- I t d a i n t i f f s had s u f f e r e d or would s u f f e r imminent harm as a r e s u l t ~~ -. -~ - - -~~ ~ - ~ ~ - ~ -~ - - _ _ _ _ contrary, as Interior emphasized in opposing plaintiffs' nreliminarv iniiinrt-inn mntinn filed in necemher 2 n n i . ---- -.---_- - - - - - - - - , - - - - - - - - - - - , - - - - - - - r----- -- individual Indian trust data. The only evidence of actual intrusion and alteration of data is that performed by Predictive Systems under the direction of +ha Cnorial M a a t a r L A A ~ L ILIULAI A m c 2 v I u c l l b LLUIU L l l e LUULL J LCc;ULJIl1L1Ull 1 1 1 LUU3 L L l d L plaintiffs had not established an ongoing security threat. LKK p~esenc uijuncEions. bee, e.q., YL.B~. 4-5, 6. Apart: rrom the evidence of his unauthorized hacking, the report recounted ~ . I . - - 7 . - - - - - 9 issues aacing as rar D a m as the 1980's and 1990's. See, e - s . , P- ,*.t .. I rr r: P JA 1877-83 (SDecial Master Report at 17-18) (discussins 1989 and - - report are similarly flawed. _ _ -I P1.Br. 5, 16-17 n.37. Plaintiffs refer to Droblems resultina from the absence of an -l; - - -- - , - _ -------- - --- in the context of this litigation, as reflected in both the ,July 2003 and March 2004 iniunctions. See 274 F. Siinn. 2d at 135: ,TA court's IT takeover is misguided as well. The government agreed Plaintiffs inaccurately suggest that the Master "penetratedn Interior systems in a relevant way in February isnd March 2003. See P1.Br. 20; see also JA 481. In the spring of n r u t - . ,F 3nn1 tha M a a t n r l a n n n t r s m t n r w-n -his t r r ..ra--tv3t- @a- D l D- G-..- ' Plaintiffs also purport to take issue with Interior's assertion that only approximately 6,600 of its 110,000 computers ?c"17 - 3-1 hniiae nr n r n ~ r i A n =.mmnca tn T T T n u r a r r y c ~ . f i LwiiipuLcL J Y J L ~ I I I iiiay c;ULlBlYL UI One U ~ ~ A L O UAAU computer, or as many as several hundred or even thousands of computers. The 6,600 to 110,000 ratio noted in the declaration of Interior's Chief Information Officer presents no n--? \ .i,.mnnn * * "consenLea- to any of No Support For The Injunctions. Ultimately, plaintiffs seek to make their case by referring to reports discussing government computer security. 17-19. As our opening brief discussed (at 41-43), those reports do not supply the evidence that is wholly absent from the record. ---L--L T - L - - ~ - - ~ ~ ~ ~ = ~ L L c L 8 r A ~ l . . - e L - - -- c- the Special Master's hacking activities is now likewise moot. - See P1.Br. 9. Plaintiffs do not contend, however, that Interior was aware of the Master's alteration of data and creation of a fietitioiis accoiint when those activicies COOK piace in 2001. 25 personnel qualifications, and protections against data loss. Nothing in the scorecard addressed the particular question of the threat to the integrity of data posed by unauthorized internet access, much less whether any such threat might exist with respect to Individual Indian Trust Data. And, as our opening brief also explained (at 4 2 1 , the subcommittee also gave a generic aF1l grade to a number of other agencies, including the Departments of Justice, State, and Homeland Security. JA 2195. The other reports cited are equally inapt. Plaintiffs quote a September 2003 GAO report to the effect that Interior Itis carrying out few of the activities that support critical foundational processes," and that an internal Interior order Intended to strengthen the agency's ability to manage its IT' investments "has not been fully implemented. It P1 .Br. 18 (quoting These statements have no evident connection to a: GAO Report! computer security, nor do they touch upon issues regarding I.ITD .I.&* in y-.&"-- n = , ~ t i ~ 1 1 1 a t - ---- - Indeed. as our opening brief explained (at 431, the cited GAO report is not devoted to security questions, but to aildyeis ~f Interior's overall management of IT investments. Plaintiffs' citation to a September 2003 Interior financial -----c r a p u r ~ c- LU WA-IY 18 * similarly unavailhg. r e p u l c u l y alLu c : _- +ha nvamav=+ 4 r\n report noted that Interior Ifadministers several financial Pl=Br. 18. That: report concerned financial management, including financial L1ls yLbpULUCIV.. of finanrial statements. The 26 1. 3 I L II c 1 'C F.*' i ' 'ir L m *- I, rRa P 1 1 1 "P car 1 IF"! 1 management systems f o r i t s bureaus and external agency customers," and that inadequate controls could affect its "ability to prevent and detect unauthorized access and changes to its financial information." JA 2101. It was in that context t h s t the r e p r t stated, in the passage partially qlmted by plaintiffs, P1.Br. 18, that [iln some instances, the Department has not established access contrels that limit or detect inappropriate access to information technology systems and related resources, thereby increasing the r i s k ef unauthorized modification, loss, or disclosure of sensitive and confidential A L L = YUULGU AUAAYUUYL A A U U L A W L A L A L A Y LU UV W A L l l L L L G data.1' I b i A . "ha - v f i t ~ A l - a m m * * = ~ , e k5.a n n t h 4 - m tn A n . . v : t h t L n The same holds true with regard to the second passage t h a t plaintiffs recite, which plaintiffs also quote selectively and ---L---L - - - L I - - . . L wiuiuuL c w i i l ; e x L . See Pi.Br. i8; see also 14. a t 2 ni2. The sentence in question states in full: "The increasing growthl in electronic commerce and the growing vulnerabilities of information systems to unauthorized access have resulted in the need for a compre~ens~ve improvement to security." J-A 2i03 (Financial Management Report). This statement contains no Interior "admission," P1.k. 18, much less one that would shed any light on the particular issue of access to IITD by unauthorized persons via the internet. 27 c :" c y. cr r u c i L a A L UI UVI, ~ ~ i c ; ~ u u ~ r r y u u ~ s u u ~ c e u weD siT;es ( c l ~ L i i u ) ; anu ensuring that system security plans are of a sufficiently high - -..-, 2 L _ _ I T . _ - - _ . - - . .. * . . 1 -. - - \ security policies ana proceaures" and "mlly integrate corrective action plans," "DO1 should continue to report to the Congress the rlaintirrs quote this statement selectively and without: context. See P1.Br. 19. Contrary to plaintiffs' suggestion, L w Q *.* -*o b I *w . 1 -.< a m L , In June 2003, a centralized computer security handling capability was implemented within the Department. 2L.- T - - - . A - - L - -_- I---__ L-11 L - L L - I .--- 1 - - 3 " Plaintiffs place significant reliance on assertions devoid of citation of any kind. Plaintiffs' "Statement1' asserts, for plague Interior's systems and cause further. irreparable injury to the Plaintiffs-Beneficiaries,'' P1.Br. 1 (emphasis in original); Trust Data continues to be at imminent risk of further loss, destruction, or corruption,'' M. at 5 ; and that "the protection ; rx L L . A U . (;IL b These and other similar statements strewn throughout - - 1 - ; - & 2 Z z - . , r . L - - 2 - C - REQUIRE REVERSAL. a I! c .?* .. I c L _ . 111. THE MUJANCIS UF HARMS AND THE PUBLIC INTEREST As shown, reversal is required because t h e injunctions are ' k n . ..%+ w r?w procurement, financial management, and hiring and recruitment, 1 7 . 1 - 7 t --J - 2 - 7 ---I-- _ _ ---I- L - - - J airniiariy, Key services upon wnlcn millions of Citizens Uepena - including in particular the maintenance and provision of vital lnterior activities that would be disabled operate for the specific benefit of tribes and individual Indians, e.q., Indian were required to undergo a Department-wide disconnection of its computer systems. And, of course, a number of systems were 4.- m n'l L P Ysl ,L'" b W T i ' a Plaintiffs cannot avoid these and the other fundamental errors in CONCLUSION court's oversight of IT security should be terminated. PETER D. KEISLER Assistant Attorney General KENNETH L. WAINSTEIN Actins United States Attorney ROBERT E. KOPP MARK B. STERN THOMAS M. BONDY CHARLES W. SCARBOROUGH ALISA B. KLEIN LEWIS S. YELIN TARA L. GROVE (202) 514-5089 Attornevs, Appellate Staff Civil Division. Room 9108 Department of Justice 601 I) Street, N.W. Washinston, D. C. 20530 JUNE 2004 32 ZERTIFfZkTE OF CCUPLIAkK!E WIT= R';TIYE 32 (a) ( 7 ) ( 2 ) OF THE FEDERAL RULES OF APPELLATE PROCEDURE I hereby certify pursuant to Fed. R. App. P. 32(a) (7) (C) that the foregoing reply brief contains 6,884 words, according to the count of Core1 Wordperfect 9. # ! . -?n ,_ i k Q Charles W. Scarborough I c c (202) 785-4166 cERTIFI~TE OF SERVICE I hereby certify that on this 21st day of June, 2004, I to the following counsel by hand delivery: The Honorable Royce C. Lamberth United States District Court United States Courthouse Third and Constitution Ave., N.W. Washington, D.C. 20001 Keith M. Harper Native American Rights Fund 1712 N Street, N.W. Washington, D.C. 20036-2976 G. William Austin c . I I. %. '#a & c w Kilpatrick Stockton 607 14th Street, N.W., Suite 900 Washington, D.C. 20005 (202) 508-5800 and to the following by federal express, overnight mail: Elliott H. Levitas Law Office of Elliott H. Levitas 1100 Peachtree Street Suite 2800 Atlanta, GA 30309-4530 (404) 815-6450 and to the following by regular, first class mail: Dennis Marc Gingold Law Office Of Dennis i q a r c ~ l n g o i ~ 607 14th Street, N.W., Box 6 Washington, D.C. 20005 E a r l O l d Person ( p m s e ) Blackfeet Tribe P.O. Box 850 Browning, MT 59417 Charles W. Scarborough